Merge mozilla-central into services
authorGregory Szorc <gps@mozilla.com>
Wed, 01 May 2013 23:32:18 -0700
changeset 130596 70e0955ccc87a145deb366eaade6c5f7d926da1f
parent 130595 3a7209e3c338c0f50fd919b80d70a9512b725ca4 (current diff)
parent 130593 7f72b029e78e88e5c6a7557626fadb604137b63c (diff)
child 130602 e474b6cfebce4bc92055737bc1331ad002d7d0c1
push id27443
push userryanvm@gmail.com
push dateThu, 02 May 2013 11:39:45 +0000
treeherdermozilla-inbound@ff9eed6225d7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone23.0a1
first release with
nightly linux32
70e0955ccc87 / 23.0a1 / 20130502030939 / files
nightly linux64
70e0955ccc87 / 23.0a1 / 20130502030939 / files
nightly mac
70e0955ccc87 / 23.0a1 / 20130502030939 / files
nightly win32
70e0955ccc87 / 23.0a1 / 20130502030939 / files
nightly win64
70e0955ccc87 / 23.0a1 / 20130502030939 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge mozilla-central into services
js/src/tests/js1_5/extensions/regress-336409-2.js
--- a/b2g/components/SignInToWebsite.jsm
+++ b/b2g/components/SignInToWebsite.jsm
@@ -131,17 +131,17 @@ function Pipe() {
 }
 
 Pipe.prototype = {
   init: function pipe_init() {
     Services.obs.addObserver(this, "identity-child-process-shutdown", false);
     Services.obs.addObserver(this, "identity-controller-unwatch", false);
   },
 
-  uninit: function pipe_init() {
+  uninit: function pipe_uninit() {
     Services.obs.removeObserver(this, "identity-child-process-shutdown");
     Services.obs.removeObserver(this, "identity-controller-unwatch");
   },
 
   observe: function Pipe_observe(aSubject, aTopic, aData) {
     let options = {};
     if (aSubject) {
       options = aSubject.wrappedJSObject;
--- a/b2g/components/test/unit/test_signintowebsite.js
+++ b/b2g/components/test/unit/test_signintowebsite.js
@@ -101,16 +101,17 @@ function test_watch() {
   do_test_pending();
 
   setup_test_identity("pie@food.gov", TEST_CERT, function() {
     let controller = SignInToWebsiteController;
 
     let mockedDoc = mockDoc({loggedInUser: null}, function(action, params) {
       do_check_eq(action, 'ready');
       controller.uninit();
+      MinimalIDService.RP.unwatch(mockedDoc.id);
       do_test_finished();
       run_next_test();
     });
 
     controller.init({pipe: mockReceivingPipe()});
     MinimalIDService.RP.watch(mockedDoc, {});
   });
 }
@@ -125,16 +126,17 @@ function test_request_login() {
       function(action, params) {
         do_check_eq(action, 'ready');
         do_check_eq(params, undefined);
       },
       function(action, params) {
         do_check_eq(action, 'login');
         do_check_eq(params, TEST_CERT);
         controller.uninit();
+        MinimalIDService.RP.unwatch(mockedDoc.id);
         do_test_finished();
         run_next_test();
       }
     ));
 
     controller.init({pipe: mockReceivingPipe()});
     MinimalIDService.RP.watch(mockedDoc, {});
     MinimalIDService.RP.request(mockedDoc.id, {});
@@ -151,16 +153,17 @@ function test_request_logout() {
       function(action, params) {
         do_check_eq(action, 'ready');
         do_check_eq(params, undefined);
       },
       function(action, params) {
         do_check_eq(action, 'logout');
         do_check_eq(params, undefined);
         controller.uninit();
+        MinimalIDService.RP.unwatch(mockedDoc.id);
         do_test_finished();
         run_next_test();
       }
     ));
 
     controller.init({pipe: mockReceivingPipe()});
     MinimalIDService.RP.watch(mockedDoc, {});
     MinimalIDService.RP.logout(mockedDoc.id, {});
@@ -181,28 +184,83 @@ function test_request_login_logout() {
       function(action, params) {
         do_check_eq(action, 'login');
         do_check_eq(params, TEST_CERT);
       },
       function(action, params) {
         do_check_eq(action, 'logout');
         do_check_eq(params, undefined);
         controller.uninit();
+        MinimalIDService.RP.unwatch(mockedDoc.id);
         do_test_finished();
         run_next_test();
       }
     ));
 
     controller.init({pipe: mockReceivingPipe()});
     MinimalIDService.RP.watch(mockedDoc, {});
     MinimalIDService.RP.request(mockedDoc.id, {});
     MinimalIDService.RP.logout(mockedDoc.id, {});
   });
 }
 
+function test_logout_everywhere() {
+  do_test_pending();
+  let logouts = 0;
+
+  setup_test_identity("fugu@food.gov", TEST_CERT, function() {
+    let controller = SignInToWebsiteController;
+
+    let mockedDoc1 = mockDoc({loggedInUser: null}, call_sequentially(
+      function(action, params) {
+        do_check_eq(action, 'ready');
+      },
+      function(action, params) {
+        do_check_eq(action, 'login');
+      },
+      function(action, params) {
+        // Result of logout from doc2.
+        // We don't know what order the logouts will occur in.
+        do_check_eq(action, 'logout');
+        if (++logouts === 2) {
+          do_test_finished();
+          run_next_test();
+        }
+      }
+    ));
+
+    let mockedDoc2 = mockDoc({loggedInUser: null}, call_sequentially(
+      function(action, params) {
+        do_check_eq(action, 'ready');
+      },
+      function(action, params) {
+        do_check_eq(action, 'login');
+      },
+      function(action, params) {
+        do_check_eq(action, 'logout');
+        if (++logouts === 2) {
+          do_test_finished();
+          run_next_test();
+        }
+      }
+    ));
+
+    controller.init({pipe: mockReceivingPipe()});
+    MinimalIDService.RP.watch(mockedDoc1, {});
+    MinimalIDService.RP.request(mockedDoc1.id, {});
+
+    MinimalIDService.RP.watch(mockedDoc2, {});
+    MinimalIDService.RP.request(mockedDoc2.id, {});
+
+    // Logs out of both docs because they share the
+    // same origin.
+    MinimalIDService.RP.logout(mockedDoc2.id, {});
+  });
+}
+
 function test_options_pass_through() {
   do_test_pending();
 
   // An meaningless structure for testing that RP messages preserve
   // objects and their parameters as they are passed back and forth.
   let randomMixedParams = {
     loggedInUser: "juanita@mozilla.com",
     forceAuthentication: true,
@@ -225,16 +283,18 @@ function test_options_pass_through() {
       case "identity-delegate-watch":
         MinimalIDService.RP.request(mockedDoc.id, {});
         break;
       case "identity-delegate-request":
         MinimalIDService.RP.logout(mockedDoc.id, {});
         break;
       case "identity-delegate-logout":
         do_test_finished();
+        controller.uninit();
+        MinimalIDService.RP.unwatch(mockedDoc.id);
         run_next_test();
         break;
     }
   }
 
   let controller = SignInToWebsiteController;
   controller.init({pipe: mockSendingPipe(pipeOtherEnd)});
 
@@ -245,16 +305,17 @@ let TESTS = [
   test_overall,
   test_mock_doc,
   test_object_contains,
 
   test_watch,
   test_request_login,
   test_request_logout,
   test_request_login_logout,
+  test_logout_everywhere,
 
   test_options_pass_through
 ];
 
 TESTS.forEach(add_test);
 
 function run_test() {
   run_next_test();
--- a/browser/devtools/webconsole/test/browser_webconsole_bug_602572_log_bodies_checkbox.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_bug_602572_log_bodies_checkbox.js
@@ -7,16 +7,20 @@
  *   Mihai Șucan <mihai.sucan@gmail.com>
  *
  * ***** END LICENSE BLOCK ***** */
 
 let menuitems = [], menupopups = [], huds = [], tabs = [], runCount = 0;
 
 function test()
 {
+  if (runCount == 0) {
+    requestLongerTimeout(2);
+  }
+
   // open tab 1
   addTab("data:text/html;charset=utf-8,Web Console test for bug 602572: log bodies checkbox. tab 1");
   tabs.push(tab);
 
   browser.addEventListener("load", function onLoad1(aEvent) {
     browser.removeEventListener(aEvent.type, onLoad1, true);
 
     openConsole(null, (hud) => hud.iframeWindow.mozRequestAnimationFrame(() => {
--- a/browser/installer/windows/nsis/stub.nsi
+++ b/browser/installer/windows/nsis/stub.nsi
@@ -259,23 +259,23 @@ ChangeUI all "nsisui.exe"
   LoadLanguageFile "locale.nlf"
 !endif
 
 !include "nsisstrings.nlf"
 
 !if "${AB_CD}" == "en-US"
   ; Custom strings for en-US. This is done here so they aren't translated.
   !define INDENT "     "
-  !define INTRO_BLURB "Thanks for choosing $BrandFullName. We’re not just designed to be different, we’re different by design. Click to install."
+  !define INTRO_BLURB "Thanks for choosing $BrandFullName. We’re not just designed to be different, we’re different by design."
   !define INSTALL_BLURB1 "You're about to enjoy the very latest in speed, flexibility and security so you're always in control."
   !define INSTALL_BLURB2 "And you're joining a global community of users, contributors and developers working to make the best browser in the world."
   !define INSTALL_BLURB3 "You even get a haiku:$\n${INDENT}Proudly non-profit$\n${INDENT}Free to innovate for you$\n${INDENT}And a better Web"
   !undef INDENT
 !else
-  !define INTRO_BLURB "$(INTRO_BLURB)"
+  !define INTRO_BLURB "$(INTRO_BLURB1)"
   !define INSTALL_BLURB1 "$(INSTALL_BLURB1)"
   !define INSTALL_BLURB2 "$(INSTALL_BLURB2)"
   !define INSTALL_BLURB3 "$(INSTALL_BLURB3)"
 !endif
 
 Caption "$(WIN_CAPTION)"
 
 Page custom createDummy ; Needed to enable the Intro page's back button
@@ -693,17 +693,21 @@ Function createIntro
   Pop $2
   ${SetStretchedTransparentImage} $2 $PLUGINSDIR\appname.bmp $0
 
   ${NSD_CreateBitmap} 0 0 100% 100% ""
   Pop $2
   ${NSD_SetStretchedImage} $2 $PLUGINSDIR\bgintro.bmp $1
 
   GetDlgItem $0 $HWNDPARENT 1 ; Install button
-  SendMessage $0 ${WM_SETTEXT} 0 "STR:$(INSTALL_BUTTON)"
+  ${If} ${FileExists} "$INSTDIR\${FileMainEXE}"
+    SendMessage $0 ${WM_SETTEXT} 0 "STR:$(UPGRADE_BUTTON)"
+  ${Else}
+    SendMessage $0 ${WM_SETTEXT} 0 "STR:$(INSTALL_BUTTON)"
+  ${EndIf}
   ${NSD_SetFocus} $0
 
   GetDlgItem $0 $HWNDPARENT 2 ; Cancel button
   SendMessage $0 ${WM_SETTEXT} 0 "STR:$(CANCEL_BUTTON)"
 
   GetDlgItem $0 $HWNDPARENT 3 ; Back button used for Options
   SendMessage $0 ${WM_SETTEXT} 0 "STR:$(OPTIONS_BUTTON)"
 
@@ -944,17 +948,21 @@ Function createOptions
       SetCtlColors $CheckboxInstallMaintSvc ${OPTIONS_TEXT_COLOR_NORMAL} ${OPTIONS_BKGRD_COLOR}
       SendMessage $CheckboxInstallMaintSvc ${WM_SETFONT} $FontNormal 0
       ${NSD_Check} $CheckboxInstallMaintSvc
     ${EndIf}
   ${EndIf}
 !endif
 
   GetDlgItem $0 $HWNDPARENT 1 ; Install button
-  SendMessage $0 ${WM_SETTEXT} 0 "STR:$(INSTALL_BUTTON)"
+  ${If} ${FileExists} "$INSTDIR\${FileMainEXE}"
+    SendMessage $0 ${WM_SETTEXT} 0 "STR:$(UPGRADE_BUTTON)"
+  ${Else}
+    SendMessage $0 ${WM_SETTEXT} 0 "STR:$(INSTALL_BUTTON)"
+  ${EndIf}
   ${NSD_SetFocus} $0
 
   GetDlgItem $0 $HWNDPARENT 2 ; Cancel button
   SendMessage $0 ${WM_SETTEXT} 0 "STR:$(CANCEL_BUTTON)"
 
   GetDlgItem $0 $HWNDPARENT 3 ; Back button used for Options
   EnableWindow $0 0
   ShowWindow $0 ${SW_HIDE}
@@ -964,17 +972,17 @@ Function createOptions
   ${If} "$WasOptionsButtonClicked" != "1"
     ${If} "$CanWriteToInstallDir" == "false"
       MessageBox MB_OK|MB_ICONEXCLAMATION "$(WARN_WRITE_ACCESS)"
     ${ElseIf} "$HasRequiredSpaceAvailable" == "false"
       MessageBox MB_OK|MB_ICONEXCLAMATION "$(WARN_DISK_SPACE)"
     ${EndIf}
   ${EndIf}
 
-  IntOp $OptionsPageShownCount $OptionsPageShownCount + 1
+  StrCpy $OptionsPageShownCount "1"
 
   System::Call "kernel32::GetTickCount()l .s"
   Pop $StartOptionsPhaseTickCount
 
   LockWindow off
   nsDialogs::Show
 FunctionEnd
 
@@ -1676,16 +1684,23 @@ Function UpdateFreeSpaceLabel
 
 FunctionEnd
 
 Function OnChange_DirRequest
   Pop $0
   System::Call 'user32::GetWindowTextW(i $DirRequest, w .r0, i ${NSIS_MAX_STRLEN})'
   StrCpy $INSTDIR "$0"
   Call UpdateFreeSpaceLabel
+
+  GetDlgItem $0 $HWNDPARENT 1 ; Install button
+  ${If} ${FileExists} "$INSTDIR\${FileMainEXE}"
+    SendMessage $0 ${WM_SETTEXT} 0 "STR:$(UPGRADE_BUTTON)"
+  ${Else}
+    SendMessage $0 ${WM_SETTEXT} 0 "STR:$(INSTALL_BUTTON)"
+  ${EndIf}
 FunctionEnd
 
 Function OnClick_ButtonBrowse
   ; The call to GetLongPath returns a long path without a trailing
   ; back-slash. Append a \ to the path to prevent the directory
   ; name from being appended when using the NSIS create new folder.
   ; http://www.nullsoft.com/free/nsis/makensis.htm#InstallDir
   StrCpy $0 "$INSTDIR" "" -1 ; the last character
--- a/browser/locales/en-US/installer/nsisstrings.properties
+++ b/browser/locales/en-US/installer/nsisstrings.properties
@@ -15,17 +15,17 @@
 # for double ampersand) and prevents the letter following the ampersand from
 # being used as an accesskey.
 
 # You can use \n to create a newline in the string but only when the string
 # from en-US contains a \n.
 
 WIN_CAPTION=$BrandShortName Setup
 
-INTRO_BLURB=Thanks for choosing $BrandFullName, the browser that chooses you above everything else. Click to install.
+INTRO_BLURB1=Thanks for choosing $BrandFullName, the browser that chooses you above everything else.
 INSTALL_BLURB1=You're about to enjoy the very latest in speed, flexibility and security so you're always in control.
 INSTALL_BLURB2=That's because $BrandShortName is made by a non-profit to make browsing and the Web better for you.
 INSTALL_BLURB3=You're also joining a global community of users, contributors and developers working to make the best browser in the world.
 
 WARN_MIN_SUPPORTED_OS_MSG=Sorry, $BrandShortName can't be installed. This version of $BrandShortName requires ${MinSupportedVer} or newer.
 WARN_WRITE_ACCESS=You don't have access to write to the installation directory.\n\nClick OK to select a different directory.
 WARN_DISK_SPACE=You don't have sufficient disk space to install to this location.\n\nClick OK to select a different location.
 WARN_ROOT_INSTALL=Unable to install to the root of your disk.\n\nClick OK to select a different location.
--- a/build/valgrind/cross-architecture.sup
+++ b/build/valgrind/cross-architecture.sup
@@ -302,14 +302,8 @@
 {
    Bug 824323
    Memcheck:Leak
    fun:malloc
    ...
    fun:_ZN7mozilla3dom7workers13WorkerPrivate9DoRunLoopEP9JSContext
    ...
 }
-{
-   Bug 866959
-   Memcheck:Cond
-   fun:_ZN16imgStatusTracker27CalculateAndApplyDifferenceEPS_
-   ...
-}
--- a/configure.in
+++ b/configure.in
@@ -2161,17 +2161,17 @@ ia64*-hpux*)
         MOZ_DEBUG_LDFLAGS='-DEBUG -DEBUGTYPE:CV'
         WARNINGS_AS_ERRORS='-WX'
         MOZ_OPTIMIZE_FLAGS='-O1'
         MOZ_FIX_LINK_PATHS=
         DYNAMIC_XPCOM_LIBS='$(LIBXUL_DIST)/lib/xul.lib $(LIBXUL_DIST)/lib/xpcom_core.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         XPCOM_FROZEN_LDOPTS='$(LIBXUL_DIST)/lib/xul.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         LIBXUL_LIBS='$(LIBXUL_DIST)/lib/xul.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         MOZ_COMPONENT_NSPR_LIBS='$(NSPR_LIBS)'
-        LDFLAGS="$LDFLAGS -LARGEADDRESSAWARE -NXCOMPAT"
+        LDFLAGS="$LDFLAGS -LARGEADDRESSAWARE -NXCOMPAT -RELEASE"
         dnl For profile-guided optimization
         PROFILE_GEN_CFLAGS="-GL"
         PROFILE_GEN_LDFLAGS="-LTCG:PGINSTRUMENT"
         dnl XXX: PGO builds can fail with warnings treated as errors,
         dnl specifically "no profile data available" appears to be
         dnl treated as an error sometimes. This might be a consequence
         dnl of using WARNINGS_AS_ERRORS in some modules, combined
         dnl with the linker doing most of the work in the whole-program
@@ -3532,44 +3532,16 @@ if test "$GNU_CC"; then
     else
         ARM_ABI_PREFIX=oabi-
     fi
   fi
 
   TARGET_COMPILER_ABI="${TARGET_COMPILER_ABI-${ARM_ABI_PREFIX}gcc3}"
 fi
 
-dnl Check for support of modern template specialization syntax
-dnl Test code and requirement from scc@netscape.com.
-dnl Autoconf cut-and-paste job by waterson@netscape.com
-AC_CACHE_CHECK(for modern C++ template specialization syntax support,
-               ac_cv_cpp_modern_specialize_template_syntax,
-               [AC_TRY_COMPILE(template <class T> struct X { int a; };
-                               class Y {};
-                               template <> struct X<Y> { double a; };,
-                               X<int> int_x;
-                               X<Y> y_x;,
-                               ac_cv_cpp_modern_specialize_template_syntax=yes,
-                               ac_cv_cpp_modern_specialize_template_syntax=no)])
-if test "$ac_cv_cpp_modern_specialize_template_syntax" = no ; then
-  AC_MSG_ERROR([The C++ compiler does not support template specialization])
-fi
-
-dnl Some compilers support only full specialization, and some don't.
-AC_CACHE_CHECK(whether partial template specialization works,
-               ac_cv_cpp_partial_specialization,
-               [AC_TRY_COMPILE(template <class T> class Foo {};
-                               template <class T> class Foo<T*> {};,
-                               return 0;,
-                               ac_cv_cpp_partial_specialization=yes,
-                               ac_cv_cpp_partial_specialization=no)])
-if test "$ac_cv_cpp_partial_specialization" = yes ; then
-  AC_DEFINE(HAVE_CPP_PARTIAL_SPECIALIZATION)
-fi
-
 dnl Check to see if we can resolve ambiguity with |using|.
 AC_CACHE_CHECK(whether the C++ \"using\" keyword resolves ambiguity,
                ac_cv_cpp_ambiguity_resolving_using,
                [AC_TRY_COMPILE(class X {
                                  public: int go(const X&) {return 3;}
                                          int jo(const X&) {return 3;}
                                };
                                class Y : public X {
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -967,67 +967,31 @@ struct NormalizeNewlinesCharTraits {
     void writechar(typename OutputIterator::value_type aChar) {
       *mIterator++ = aChar;
     }
 
   private:
     OutputIterator mIterator;
 };
 
-#ifdef HAVE_CPP_PARTIAL_SPECIALIZATION
-
 template <class CharT>
 struct NormalizeNewlinesCharTraits<CharT*> {
   public:
     typedef CharT value_type;
 
   public:
     NormalizeNewlinesCharTraits(CharT* aCharPtr) : mCharPtr(aCharPtr) { }
     void writechar(CharT aChar) {
       *mCharPtr++ = aChar;
     }
 
   private:
     CharT* mCharPtr;
 };
 
-#else
-
-template <>
-struct NormalizeNewlinesCharTraits<char*> {
-  public:
-    typedef char value_type;
-
-  public:
-    NormalizeNewlinesCharTraits(char* aCharPtr) : mCharPtr(aCharPtr) { }
-    void writechar(char aChar) {
-      *mCharPtr++ = aChar;
-    }
-
-  private:
-    char* mCharPtr;
-};
-
-template <>
-struct NormalizeNewlinesCharTraits<PRUnichar*> {
-  public:
-    typedef PRUnichar value_type;
-
-  public:
-    NormalizeNewlinesCharTraits(PRUnichar* aCharPtr) : mCharPtr(aCharPtr) { }
-    void writechar(PRUnichar aChar) {
-      *mCharPtr++ = aChar;
-    }
-
-  private:
-    PRUnichar* mCharPtr;
-};
-
-#endif
-
 template <class OutputIterator>
 class CopyNormalizeNewlines
 {
   public:
     typedef typename OutputIterator::value_type value_type;
 
   public:
     CopyNormalizeNewlines(OutputIterator* aDestination,
--- a/content/canvas/test/webgl/skipped_tests_winxp.txt
+++ b/content/canvas/test/webgl/skipped_tests_winxp.txt
@@ -1,1 +1,3 @@
-conformance/more/conformance/quickCheckAPI-B2.html
\ No newline at end of file
+conformance/more/conformance/quickCheckAPI-B2.html
+conformance/more/conformance/quickCheckAPI-B3.html
+conformance/more/functions/bufferSubDataBadArgs.html
--- a/content/events/src/nsIMEStateManager.cpp
+++ b/content/events/src/nsIMEStateManager.cpp
@@ -485,18 +485,22 @@ nsIMEStateManager::SetIMEState(const IME
       (aContent->Tag() == nsGkAtoms::input ||
        aContent->Tag() == nsGkAtoms::textarea)) {
     if (aContent->Tag() != nsGkAtoms::textarea) {
       aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::type,
                         context.mHTMLInputType);
     } else {
       context.mHTMLInputType.Assign(nsGkAtoms::textarea->GetUTF16String());
     }
-    aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::inputmode,
-                      context.mHTMLInputInputmode);
+
+    if (Preferences::GetBool("dom.forms.inputmode", false)) {
+      aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::inputmode,
+                        context.mHTMLInputInputmode);
+    }
+
     aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::moz_action_hint,
                       context.mActionHint);
 
     // if we don't have an action hint and  return won't submit the form use "next"
     if (context.mActionHint.IsEmpty() && aContent->Tag() == nsGkAtoms::input) {
       bool willSubmit = false;
       nsCOMPtr<nsIFormControl> control(do_QueryInterface(aContent));
       mozilla::dom::Element* formElement = control->GetFormElement();
--- a/content/html/content/test/forms/test_input_attributes_reflection.html
+++ b/content/html/content/test/forms/test_input_attributes_reflection.html
@@ -105,23 +105,25 @@ reflectUnsignedInt({
   element: document.createElement("input"),
   attribute: "height",
   nonZero: false
 });
 
 // .indeterminate doesn't reflect a content attribute.
 
 // .inputmode
+if (SpecialPowers.getBoolPref("dom.forms.inputmode")) {
 reflectLimitedEnumerated({
   element: document.createElement("input"),
   attribute: "inputMode",
   validValues: [ "numeric", "digit", "uppercase", "lowercase", "titlecase", "autocapitalized", "auto" ],
   invalidValues: [ "", "foo", "tulip" ],
   defaultValue: "auto"
 });
+}
 
 // TODO: list (HTMLElement)
 
 // .max
 reflectString({
   element: document.createElement('input'),
   attribute: 'max',
 });
--- a/content/media/webaudio/AnalyserNode.h
+++ b/content/media/webaudio/AnalyserNode.h
@@ -19,21 +19,16 @@ class AnalyserNode : public AudioNode
 public:
   explicit AnalyserNode(AudioContext* aContext);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
-
   void GetFloatFrequencyData(Float32Array& aArray);
   void GetByteFrequencyData(Uint8Array& aArray);
   void GetByteTimeDomainData(Uint8Array& aArray);
   uint32_t FftSize() const
   {
     return mFFTSize;
   }
   void SetFftSize(uint32_t aValue, ErrorResult& aRv);
--- a/content/media/webaudio/AudioBufferSourceNode.h
+++ b/content/media/webaudio/AudioBufferSourceNode.h
@@ -24,20 +24,16 @@ public:
 
   virtual void DestroyMediaStream() MOZ_OVERRIDE
   {
     if (mStream) {
       mStream->RemoveMainThreadListener(this);
     }
     AudioNode::DestroyMediaStream();
   }
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
   virtual uint32_t NumberOfInputs() const MOZ_FINAL MOZ_OVERRIDE
   {
     return 0;
   }
   virtual AudioBufferSourceNode* AsAudioBufferSourceNode() MOZ_OVERRIDE
   {
     return this;
   }
--- a/content/media/webaudio/AudioNode.cpp
+++ b/content/media/webaudio/AudioNode.cpp
@@ -141,17 +141,17 @@ AudioNode::Connect(AudioNode& aDestinati
   // The MediaStreamGraph will handle cycle detection. We don't need to do it
   // here.
 
   mOutputNodes.AppendElement(&aDestination);
   InputNode* input = aDestination.mInputNodes.AppendElement();
   input->mInputNode = this;
   input->mInputPort = aInput;
   input->mOutputPort = aOutput;
-  if (SupportsMediaStreams() && aDestination.mStream) {
+  if (aDestination.mStream) {
     // Connect streams in the MediaStreamGraph
     MOZ_ASSERT(aDestination.mStream->AsProcessedStream());
     ProcessedMediaStream* ps =
       static_cast<ProcessedMediaStream*>(aDestination.mStream.get());
     input->mStreamPort =
       ps->AllocateInputPort(mStream, MediaInputPort::FLAG_BLOCK_INPUT);
   }
 
--- a/content/media/webaudio/AudioNode.h
+++ b/content/media/webaudio/AudioNode.h
@@ -82,23 +82,16 @@ public:
   AudioNode(AudioContext* aContext,
             uint32_t aChannelCount,
             ChannelCountMode aChannelCountMode,
             ChannelInterpretation aChannelInterpretation);
 
   // This should be idempotent (safe to call multiple times).
   virtual void DestroyMediaStream();
 
-  // This method should be overridden to return true in nodes
-  // which support being hooked up to the Media Stream graph.
-  virtual bool SupportsMediaStreams() const
-  {
-    return false;
-  }
-
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(AudioNode,
                                            nsDOMEventTargetHelper)
 
   virtual AudioBufferSourceNode* AsAudioBufferSourceNode() {
     return nullptr;
   }
 
--- a/content/media/webaudio/BiquadFilterNode.h
+++ b/content/media/webaudio/BiquadFilterNode.h
@@ -22,21 +22,16 @@ public:
   explicit BiquadFilterNode(AudioContext* aContext);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(BiquadFilterNode, AudioNode)
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
-
   BiquadFilterType Type() const
   {
     return mType;
   }
   void SetType(BiquadFilterType aType);
 
   AudioParam* Frequency() const
   {
--- a/content/media/webaudio/DelayNode.h
+++ b/content/media/webaudio/DelayNode.h
@@ -26,21 +26,16 @@ public:
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
   AudioParam* DelayTime() const
   {
     return mDelay;
   }
 
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
-
 private:
   static void SendDelayToStream(AudioNode* aNode);
   friend class DelayNodeEngine;
 
 private:
   nsRefPtr<AudioParam> mDelay;
   SelfReference<DelayNode> mPlayingRef;
 };
--- a/content/media/webaudio/DynamicsCompressorNode.h
+++ b/content/media/webaudio/DynamicsCompressorNode.h
@@ -21,21 +21,16 @@ public:
   explicit DynamicsCompressorNode(AudioContext* aContext);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DynamicsCompressorNode, AudioNode)
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
-
   AudioParam* Threshold() const
   {
     return mThreshold;
   }
 
   AudioParam* Knee() const
   {
     return mKnee;
--- a/content/media/webaudio/GainNode.h
+++ b/content/media/webaudio/GainNode.h
@@ -26,21 +26,16 @@ public:
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
   AudioParam* Gain() const
   {
     return mGain;
   }
 
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
-
 private:
   static void SendGainToStream(AudioNode* aNode);
 
 private:
   nsRefPtr<AudioParam> mGain;
 };
 
 }
--- a/content/media/webaudio/PannerNode.h
+++ b/content/media/webaudio/PannerNode.h
@@ -28,21 +28,16 @@ class PannerNode : public AudioNode,
 {
 public:
   explicit PannerNode(AudioContext* aContext);
   virtual ~PannerNode();
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
-
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(PannerNode, AudioNode)
 
   PanningModelType PanningModel() const
   {
     return mPanningModel;
   }
   void SetPanningModel(PanningModelType aPanningModel)
--- a/content/media/webaudio/ScriptProcessorNode.h
+++ b/content/media/webaudio/ScriptProcessorNode.h
@@ -32,21 +32,16 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(ScriptProcessorNode, AudioNode)
 
   IMPL_EVENT_HANDLER(audioprocess)
 
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
-  virtual bool SupportsMediaStreams() const MOZ_OVERRIDE
-  {
-    return true;
-  }
-
   virtual void Connect(AudioNode& aDestination, uint32_t aOutput,
                        uint32_t aInput, ErrorResult& aRv) MOZ_OVERRIDE
   {
     AudioNode::Connect(aDestination, aOutput, aInput, aRv);
     if (!aRv.Failed()) {
       mPlayingRef.Take(this);
     }
   }
--- a/dom/alarm/AlarmService.jsm
+++ b/dom/alarm/AlarmService.jsm
@@ -29,47 +29,62 @@ XPCOMUtils.defineLazyGetter(this, "messe
 });
 
 XPCOMUtils.defineLazyGetter(this, "powerManagerService", function() {
   return Cc["@mozilla.org/power/powermanagerservice;1"].getService(Ci.nsIPowerManagerService);
 });
 
 let myGlobal = this;
 
+/**
+ * AlarmService provides an API to schedule alarms using the device's RTC.
+ *
+ * AlarmService is primarily used by the mozAlarms API (navigator.mozAlarms)
+ * which uses IPC to communicate with the service.
+ *
+ * AlarmService can also be used by Gecko code by importing the module and then
+ * using AlarmService.add() and AlarmService.remove(). Only Gecko code running
+ * in the parent process should do this.
+ */
+
 this.AlarmService = {
   init: function init() {
     debug("init()");
 
     this._currentTimezoneOffset = (new Date()).getTimezoneOffset();
 
-    let alarmHalService = this._alarmHalService = Cc["@mozilla.org/alarmHalService;1"].getService(Ci.nsIAlarmHalService);
+    let alarmHalService =
+      this._alarmHalService = Cc["@mozilla.org/alarmHalService;1"]
+                              .getService(Ci.nsIAlarmHalService);
+
     alarmHalService.setAlarmFiredCb(this._onAlarmFired.bind(this));
     alarmHalService.setTimezoneChangedCb(this._onTimezoneChanged.bind(this));
 
-    // add the messages to be listened
+    // Add the messages to be listened to.
     const messages = ["AlarmsManager:GetAll",
                       "AlarmsManager:Add",
                       "AlarmsManager:Remove"];
     messages.forEach(function addMessage(msgName) {
         ppmm.addMessageListener(msgName, this);
     }.bind(this));
 
-    // set the indexeddb database
-    let idbManager = Cc["@mozilla.org/dom/indexeddb/manager;1"].getService(Ci.nsIIndexedDatabaseManager);
+    // Set the indexeddb database.
+    let idbManager = Cc["@mozilla.org/dom/indexeddb/manager;1"]
+                     .getService(Ci.nsIIndexedDatabaseManager);
     idbManager.initWindowless(myGlobal);
     this._db = new AlarmDB(myGlobal);
     this._db.init(myGlobal);
 
-    // variable to save alarms waiting to be set
+    // Variable to save alarms waiting to be set.
     this._alarmQueue = [];
 
     this._restoreAlarmsFromDb();
   },
 
-  // getter/setter to access the current alarm set in system
+  // Getter/setter to access the current alarm set in system.
   _alarm: null,
   get _currentAlarm() {
     return this._alarm;
   },
   set _currentAlarm(aAlarm) {
     this._alarm = aAlarm;
     if (!aAlarm)
       return;
@@ -97,221 +112,166 @@ this.AlarmService = {
     }
 
     let mm = aMessage.target.QueryInterface(Ci.nsIMessageSender);
     switch (aMessage.name) {
       case "AlarmsManager:GetAll":
         this._db.getAll(
           json.manifestURL,
           function getAllSuccessCb(aAlarms) {
-            debug("Callback after getting alarms from database: " + JSON.stringify(aAlarms));
+            debug("Callback after getting alarms from database: " +
+                  JSON.stringify(aAlarms));
             this._sendAsyncMessage(mm, "GetAll", true, json.requestId, aAlarms);
           }.bind(this),
           function getAllErrorCb(aErrorMsg) {
             this._sendAsyncMessage(mm, "GetAll", false, json.requestId, aErrorMsg);
           }.bind(this)
         );
         break;
 
       case "AlarmsManager:Add":
-        // prepare a record for the new alarm to be added
+        // Prepare a record for the new alarm to be added.
         let newAlarm = {
-          date: json.date, 
-          ignoreTimezone: json.ignoreTimezone, 
-          timezoneOffset: this._currentTimezoneOffset, 
+          date: json.date,
+          ignoreTimezone: json.ignoreTimezone,
           data: json.data,
           pageURL: json.pageURL,
           manifestURL: json.manifestURL
         };
 
-        let newAlarmTime = this._getAlarmTime(newAlarm);
-        if (newAlarmTime <= Date.now()) {
-          debug("Adding a alarm that has past time. Return DOMError.");
-          this._debugCurrentAlarm();
-          this._sendAsyncMessage(mm, "Add", false, json.requestId, "InvalidStateError");
-          break;
-        }
-
-        this._db.add(
-          newAlarm,
-          function addSuccessCb(aNewId) {
-            debug("Callback after adding alarm in database.");
-
-            newAlarm['id'] = aNewId;
-
-            // if there is no alarm being set in system, set the new alarm
-            if (this._currentAlarm == null) {
-              this._currentAlarm = newAlarm;
-              this._debugCurrentAlarm();
-              this._sendAsyncMessage(mm, "Add", true, json.requestId, aNewId);
-              return;
-            }
-
-            // if the new alarm is earlier than the current alarm
-            // swap them and push the previous alarm back to queue
-            let alarmQueue = this._alarmQueue;
-            let currentAlarmTime = this._getAlarmTime(this._currentAlarm);
-            if (newAlarmTime < currentAlarmTime) {
-              alarmQueue.unshift(this._currentAlarm);
-              this._currentAlarm = newAlarm;
-              this._debugCurrentAlarm();
-              this._sendAsyncMessage(mm, "Add", true, json.requestId, aNewId);
-              return;
-            }
-
-            //push the new alarm in the queue
-            alarmQueue.push(newAlarm);
-            alarmQueue.sort(this._sortAlarmByTimeStamps.bind(this));
-            this._debugCurrentAlarm();
-            this._sendAsyncMessage(mm, "Add", true, json.requestId, aNewId);
-          }.bind(this),
-          function addErrorCb(aErrorMsg) {
-            this._sendAsyncMessage(mm, "Add", false, json.requestId, aErrorMsg);
-          }.bind(this)
+        this.add(newAlarm, null,
+          // Receives the alarm ID as the last argument.
+          this._sendAsyncMessage.bind(this, mm, "Add", true, json.requestId),
+          // Receives the error message as the last argument.
+          this._sendAsyncMessage.bind(this, mm, "Add", false, json.requestId)
         );
         break;
 
       case "AlarmsManager:Remove":
-        this._removeAlarmFromDb(
-          json.id,
-          json.manifestURL,
-          function removeSuccessCb() {
-            debug("Callback after removing alarm from database.");
-
-            // if there is no alarm being set
-            if (!this._currentAlarm) {
-              this._debugCurrentAlarm();
-              return;
-            }
-
-            // check if the alarm to be removed is in the queue
-            // by ID and whether it belongs to the requesting app
-            let alarmQueue = this._alarmQueue;
-            if (this._currentAlarm.id != json.id || 
-                this._currentAlarm.manifestURL != json.manifestURL) {
-              for (let i = 0; i < alarmQueue.length; i++) {
-                if (alarmQueue[i].id == json.id && 
-                    alarmQueue[i].manifestURL == json.manifestURL) {
-                  alarmQueue.splice(i, 1);
-                  break;
-                }
-              }
-              this._debugCurrentAlarm();
-              return;
-            }
-
-            // the alarm to be removed is the current alarm
-            // reset the next alarm from queue if any
-            if (alarmQueue.length) {
-              this._currentAlarm = alarmQueue.shift();
-              this._debugCurrentAlarm();
-              return;
-            }
-
-            // no alarm waiting to be set in the queue
-            this._currentAlarm = null;
-            this._debugCurrentAlarm();
-          }.bind(this)
-        );
+        this.remove(json.id, json.manifestURL);
         break;
 
       default:
         throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
         break;
     }
   },
 
-  _sendAsyncMessage: function _sendAsyncMessage(aMessageManager, aMessageName, aSuccess, aRequestId, aData) {
+  _sendAsyncMessage: function _sendAsyncMessage(aMessageManager, aMessageName,
+                                                aSuccess, aRequestId, aData) {
     debug("_sendAsyncMessage()");
 
     if (!aMessageManager) {
       debug("Invalid message manager: null");
       throw Components.results.NS_ERROR_FAILURE;
     }
 
     let json = null;
     switch (aMessageName)
     {
       case "Add":
-        json = aSuccess ? 
-          { requestId: aRequestId, id: aData } : 
+        json = aSuccess ?
+          { requestId: aRequestId, id: aData } :
           { requestId: aRequestId, errorMsg: aData };
         break;
 
       case "GetAll":
-        json = aSuccess ? 
-          { requestId: aRequestId, alarms: aData } : 
+        json = aSuccess ?
+          { requestId: aRequestId, alarms: aData } :
           { requestId: aRequestId, errorMsg: aData };
         break;
 
       default:
         throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
         break;
     }
 
-    aMessageManager.sendAsyncMessage("AlarmsManager:" + aMessageName + ":Return:" + (aSuccess ? "OK" : "KO"), json);
+    aMessageManager.sendAsyncMessage("AlarmsManager:" + aMessageName +
+                                     ":Return:" + (aSuccess ? "OK" : "KO"), json);
   },
 
-  _removeAlarmFromDb: function _removeAlarmFromDb(aId, aManifestURL, aRemoveSuccessCb) {
+  _removeAlarmFromDb: function _removeAlarmFromDb(aId, aManifestURL,
+                                                  aRemoveSuccessCb) {
     debug("_removeAlarmFromDb()");
 
-    // If the aRemoveSuccessCb is undefined or null, set a 
-    // dummy callback for it which is needed for _db.remove()
+    // If the aRemoveSuccessCb is undefined or null, set a dummy callback for
+    // it which is needed for _db.remove().
     if (!aRemoveSuccessCb) {
       aRemoveSuccessCb = function removeSuccessCb() {
         debug("Remove alarm from DB successfully.");
       };
     }
 
     this._db.remove(
       aId,
       aManifestURL,
       aRemoveSuccessCb,
       function removeErrorCb(aErrorMsg) {
         throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
       }
     );
   },
 
+  /**
+   * Create a copy of the alarm that does not expose internal fields to
+   * receivers and sticks to the public |respectTimezone| API rather than the
+   * boolean |ignoreTimezone| field.
+   */
+  _publicAlarm: function _publicAlarm(aAlarm) {
+    let alarm = {
+      "id":              aAlarm.id,
+      "date":            aAlarm.date,
+      "respectTimezone": aAlarm.ignoreTimezone ?
+                           "ignoreTimezone" : "honorTimezone",
+      "data":            aAlarm.data
+    };
+
+    return alarm;
+  },
+
   _fireSystemMessage: function _fireSystemMessage(aAlarm) {
     debug("Fire system message: " + JSON.stringify(aAlarm));
 
     let manifestURI = Services.io.newURI(aAlarm.manifestURL, null, null);
     let pageURI = Services.io.newURI(aAlarm.pageURL, null, null);
 
-    // We don't need to expose everything to the web content.
-    let alarm = { "id":              aAlarm.id,
-                  "date":            aAlarm.date,
-                  "respectTimezone": aAlarm.ignoreTimezone ?
-                                       "ignoreTimezone" : "honorTimezone", 
-                  "data":            aAlarm.data };
+    messenger.sendMessage("alarm", this._publicAlarm(aAlarm),
+                          pageURI, manifestURI);
+  },
 
-    messenger.sendMessage("alarm", alarm, pageURI, manifestURI);
+  _notifyAlarmObserver: function _notifyAlarmObserver(aAlarm) {
+    debug("_notifyAlarmObserver()");
+
+    if (aAlarm.manifestURL) {
+      this._fireSystemMessage(aAlarm);
+    } else if (typeof aAlarm.alarmFiredCb === "function") {
+      aAlarm.alarmFiredCb(this._publicAlarm(aAlarm));
+    }
   },
 
   _onAlarmFired: function _onAlarmFired() {
     debug("_onAlarmFired()");
 
     if (this._currentAlarm) {
-      this._fireSystemMessage(this._currentAlarm);
       this._removeAlarmFromDb(this._currentAlarm.id, null);
+      this._notifyAlarmObserver(this._currentAlarm);
       this._currentAlarm = null;
     }
 
     // Reset the next alarm from the queue.
     let alarmQueue = this._alarmQueue;
     while (alarmQueue.length > 0) {
       let nextAlarm = alarmQueue.shift();
       let nextAlarmTime = this._getAlarmTime(nextAlarm);
 
-      // If the next alarm has been expired, directly 
-      // fire system message for it instead of setting it.
+      // If the next alarm has been expired, directly notify the observer.
+      // it instead of setting it.
       if (nextAlarmTime <= Date.now()) {
-        this._fireSystemMessage(nextAlarm);
         this._removeAlarmFromDb(nextAlarm.id, null);
+        this._notifyAlarmObserver(nextAlarm);
       } else {
         this._currentAlarm = nextAlarm;
         break;
       }
     }
     this._debugCurrentAlarm();
   },
 
@@ -323,68 +283,214 @@ this.AlarmService = {
   },
 
   _restoreAlarmsFromDb: function _restoreAlarmsFromDb() {
     debug("_restoreAlarmsFromDb()");
 
     this._db.getAll(
       null,
       function getAllSuccessCb(aAlarms) {
-        debug("Callback after getting alarms from database: " + JSON.stringify(aAlarms));
+        debug("Callback after getting alarms from database: " +
+              JSON.stringify(aAlarms));
 
-        // clear any alarms set or queued in the cache
+        // Clear any alarms set or queued in the cache.
         let alarmQueue = this._alarmQueue;
         alarmQueue.length = 0;
         this._currentAlarm = null;
 
-        // Only restore the alarm that's not yet expired; otherwise,
-        // fire a system message for it and remove it from database.
+        // Only restore the alarm that's not yet expired; otherwise, remove it
+        // from the database and notify the observer.
         aAlarms.forEach(function addAlarm(aAlarm) {
           if (this._getAlarmTime(aAlarm) > Date.now()) {
             alarmQueue.push(aAlarm);
           } else {
-            this._fireSystemMessage(aAlarm);
             this._removeAlarmFromDb(aAlarm.id, null);
+            this._notifyAlarmObserver(aAlarm);
           }
         }.bind(this));
 
-        // set the next alarm from queue
+        // Set the next alarm from queue.
         if (alarmQueue.length) {
           alarmQueue.sort(this._sortAlarmByTimeStamps.bind(this));
           this._currentAlarm = alarmQueue.shift();
         }
 
         this._debugCurrentAlarm();
       }.bind(this),
       function getAllErrorCb(aErrorMsg) {
         throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
       }
     );
   },
 
   _getAlarmTime: function _getAlarmTime(aAlarm) {
     let alarmTime = (new Date(aAlarm.date)).getTime();
 
-    // For an alarm specified with "ignoreTimezone",
-    // it must be fired respect to the user's timezone.
-    // Supposing an alarm was set at 7:00pm at Tokyo,
-    // it must be gone off at 7:00pm respect to Paris' 
-    // local time when the user is located at Paris.
-    // We can adjust the alarm UTC time by calculating
-    // the difference of the orginal timezone and the 
-    // current timezone.
+    // For an alarm specified with "ignoreTimezone", it must be fired respect
+    // to the user's timezone.  Supposing an alarm was set at 7:00pm at Tokyo,
+    // it must be gone off at 7:00pm respect to Paris' local time when the user
+    // is located at Paris.  We can adjust the alarm UTC time by calculating
+    // the difference of the orginal timezone and the current timezone.
     if (aAlarm.ignoreTimezone)
        alarmTime += (this._currentTimezoneOffset - aAlarm.timezoneOffset) * 60000;
 
     return alarmTime;
   },
 
   _sortAlarmByTimeStamps: function _sortAlarmByTimeStamps(aAlarm1, aAlarm2) {
     return this._getAlarmTime(aAlarm1) - this._getAlarmTime(aAlarm2);
   },
 
   _debugCurrentAlarm: function _debugCurrentAlarm() {
     debug("Current alarm: " + JSON.stringify(this._currentAlarm));
     debug("Alarm queue: " + JSON.stringify(this._alarmQueue));
   },
+
+  /**
+   *
+   * Add a new alarm. This will set the RTC to fire at the selected date and
+   * notify the caller. Notifications are delivered via System Messages if the
+   * alarm is added on behalf of a app. Otherwise aAlarmFiredCb is called.
+   *
+   * @param object aNewAlarm
+   *        Should contain the following literal properties:
+   *          - |date| date: when the alarm should timeout.
+   *          - |ignoreTimezone| boolean: See [1] for the details.
+   *          - |manifestURL| string: Manifest of app on whose behalf the alarm
+   *                                  is added.
+   *          - |pageURL| string: The page in the app that receives the system
+   *                              message.
+   *          - |data| object [optional]: Data that can be stored in DB.
+   * @param function aAlarmFiredCb
+   *        Callback function invoked when the alarm is fired.
+   *        It receives a single argument, the alarm object.
+   *        May be null.
+   * @param function aSuccessCb
+   *        Callback function to receive an alarm ID (number).
+   * @param function aErrorCb
+   *        Callback function to receive an error message (string).
+   * @returns void
+   *
+   * Notes:
+   * [1] https://wiki.mozilla.org/WebAPI/AlarmAPI#Proposed_API
+   */
+
+  add: function(aNewAlarm, aAlarmFiredCb, aSuccessCb, aErrorCb) {
+    debug("add(" + aNewAlarm.date + ")");
+
+    aSuccessCb = aSuccessCb || function() {};
+    aErrorCb = aErrorCb || function() {};
+
+    if (!aNewAlarm) {
+      aErrorCb("alarm is null");
+      return;
+    }
+
+    aNewAlarm['timezoneOffset'] = this._currentTimezoneOffset;
+    let aNewAlarmTime = this._getAlarmTime(aNewAlarm);
+    if (aNewAlarmTime <= Date.now()) {
+      debug("Adding a alarm that has past time.");
+      this._debugCurrentAlarm();
+      aErrorCb("InvalidStateError");
+      return;
+    }
+
+    this._db.add(
+      aNewAlarm,
+      function addSuccessCb(aNewId) {
+        debug("Callback after adding alarm in database.");
+
+        aNewAlarm['id'] = aNewId;
+
+        // Now that the alarm has been added to the database, we can tack on
+        // the non-serializable callback to the in-memory object.
+        aNewAlarm['alarmFiredCb'] = aAlarmFiredCb;
+
+        // If there is no alarm being set in system, set the new alarm.
+        if (this._currentAlarm == null) {
+          this._currentAlarm = aNewAlarm;
+          this._debugCurrentAlarm();
+          aSuccessCb(aNewId);
+          return;
+        }
+
+        // If the new alarm is earlier than the current alarm, swap them and
+        // push the previous alarm back to queue.
+        let alarmQueue = this._alarmQueue;
+        let currentAlarmTime = this._getAlarmTime(this._currentAlarm);
+        if (aNewAlarmTime < currentAlarmTime) {
+          alarmQueue.unshift(this._currentAlarm);
+          this._currentAlarm = aNewAlarm;
+          this._debugCurrentAlarm();
+          aSuccessCb(aNewId);
+          return;
+        }
+
+        // Push the new alarm in the queue.
+        alarmQueue.push(aNewAlarm);
+        alarmQueue.sort(this._sortAlarmByTimeStamps.bind(this));
+        this._debugCurrentAlarm();
+        aSuccessCb(aNewId);
+      }.bind(this),
+      function addErrorCb(aErrorMsg) {
+        aErrorCb(aErrorMsg);
+      }.bind(this)
+    );
+  },
+
+  /*
+   * Remove the alarm associated with an ID.
+   *
+   * @param number aAlarmId
+   *        The ID of the alarm to be removed.
+   * @param string aManifestURL
+   *        Manifest URL for application which added the alarm. (Optional)
+   * @returns void
+   */
+  remove: function(aAlarmId, aManifestURL) {
+    debug("remove(" + aAlarmId + ", " + aManifestURL + ")");
+    this._removeAlarmFromDb(
+      aAlarmId,
+      aManifestURL,
+      function removeSuccessCb() {
+        debug("Callback after removing alarm from database.");
+
+        // If there are no alarms set, nothing to do.
+        if (!this._currentAlarm) {
+          debug("No alarms set.");
+          return;
+        }
+
+        // Check if the alarm to be removed is in the queue and whether it
+        // belongs to the requesting app.
+        let alarmQueue = this._alarmQueue;
+        if (this._currentAlarm.id != aAlarmId ||
+            this._currentAlarm.manifestURL != aManifestURL) {
+
+          for (let i = 0; i < alarmQueue.length; i++) {
+            if (alarmQueue[i].id == aAlarmId &&
+                alarmQueue[i].manifestURL == aManifestURL) {
+
+              alarmQueue.splice(i, 1);
+              break;
+            }
+          }
+          this._debugCurrentAlarm();
+          return;
+        }
+
+        // The alarm to be removed is the current alarm reset the next alarm
+        // from queue if any.
+        if (alarmQueue.length) {
+          this._currentAlarm = alarmQueue.shift();
+          this._debugCurrentAlarm();
+          return;
+        }
+
+        // No alarm waiting to be set in the queue.
+        this._currentAlarm = null;
+        this._debugCurrentAlarm();
+      }.bind(this)
+    );
+  }
 }
 
 AlarmService.init();
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -7723,16 +7723,18 @@ class CGBindingRoot(CGThing):
     """
     Root codegen class for binding generation. Instantiate the class, and call
     declare or define to generate header or cpp code (respectively).
     """
     def __init__(self, config, prefix, webIDLFile):
         descriptors = config.getDescriptors(webIDLFile=webIDLFile,
                                             hasInterfaceOrInterfacePrototypeObject=True,
                                             skipGen=False)
+        hasWorkerStuff = len(config.getDescriptors(webIDLFile=webIDLFile,
+                                                   workers=True)) != 0
         mainDictionaries = config.getDictionaries(webIDLFile=webIDLFile,
                                                   workers=False)
         workerDictionaries = config.getDictionaries(webIDLFile=webIDLFile,
                                                     workers=True)
         mainCallbacks = config.getCallbacks(webIDLFile=webIDLFile,
                                             workers=False)
         workerCallbacks = config.getCallbacks(webIDLFile=webIDLFile,
                                               workers=True)
@@ -7834,23 +7836,22 @@ class CGBindingRoot(CGThing):
                          ['mozilla/dom/BindingUtils.h',
                           'mozilla/dom/NonRefcountedDOMObject.h',
                           'mozilla/dom/Nullable.h',
                           'PrimitiveConversions.h',
                           'XPCQuickStubs.h',
                           'XPCWrapper.h',
                           'nsDOMQS.h',
                           'AccessCheck.h',
-                          'WorkerPrivate.h',
                           'nsContentUtils.h',
                           'mozilla/Preferences.h',
                           # Have to include nsDOMQS.h to get fast arg unwrapping
                           # for old-binding things with castability.
                           'nsDOMQS.h'
-                          ],
+                          ] + (['WorkerPrivate.h'] if hasWorkerStuff else []),
                          curr,
                          config,
                          jsImplemented)
 
         # Add include guards.
         curr = CGIncludeGuard(prefix, curr)
 
         # Add the auto-generated comment.
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -10,17 +10,16 @@
 
 #include "nsIFile.h"
 #include "nsIPrincipal.h"
 #include "nsIScriptContext.h"
 #include "nsIXPConnect.h"
 #include "nsIXPCScriptable.h"
 
 #include <algorithm>
-#include "jsdbgapi.h"
 #include "mozilla/dom/ContentParent.h"
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/dom/IDBFactoryBinding.h"
 #include "mozilla/dom/PBrowserChild.h"
 #include "mozilla/dom/quota/OriginOrPatternString.h"
 #include "mozilla/dom/quota/QuotaManager.h"
 #include "mozilla/dom/TabChild.h"
 #include "mozilla/storage.h"
@@ -220,17 +219,17 @@ IDBFactory::Create(ContentParent* aConte
   NS_ENSURE_SUCCESS(rv, rv);
 
   JSObject* global;
   rv = globalHolder->GetJSObject(&global);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // The CreateSandbox call returns a proxy to the actual sandbox object. We
   // don't need a proxy here.
-  global = JS_UnwrapObject(global);
+  global = js::UncheckedUnwrap(global);
 
   JSAutoCompartment ac(cx, global);
 
   nsRefPtr<IDBFactory> factory;
   rv = Create(cx, global, aContentParent, getter_AddRefs(factory));
   NS_ENSURE_SUCCESS(rv, rv);
 
   NS_HOLD_JS_OBJECTS(factory, IDBFactory);
--- a/dom/src/offline/nsDOMOfflineResourceList.cpp
+++ b/dom/src/offline/nsDOMOfflineResourceList.cpp
@@ -81,16 +81,17 @@ NS_IMPL_EVENT_HANDLER(nsDOMOfflineResour
 
 nsDOMOfflineResourceList::nsDOMOfflineResourceList(nsIURI *aManifestURI,
                                                    nsIURI *aDocumentURI,
                                                    nsPIDOMWindow *aWindow)
   : mInitialized(false)
   , mManifestURI(aManifestURI)
   , mDocumentURI(aDocumentURI)
   , mExposeCacheUpdateStatus(true)
+  , mDontSetDocumentCache(false)
   , mStatus(nsIDOMOfflineResourceList::IDLE)
   , mCachedKeys(nullptr)
   , mCachedKeysCount(0)
 {
   BindToOwner(aWindow);
 }
 
 nsDOMOfflineResourceList::~nsDOMOfflineResourceList()
@@ -444,16 +445,20 @@ nsDOMOfflineResourceList::Update()
   nsCOMPtr<nsIDOMWindow> window = 
     do_QueryInterface(GetOwner());
 
   nsCOMPtr<nsIOfflineCacheUpdate> update;
   rv = updateService->ScheduleUpdate(mManifestURI, mDocumentURI,
                                      window, getter_AddRefs(update));
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // Since we are invoking the cache update, cache on the document must not
+  // be updated until swapCache() method is called on applicationCache object.
+  mDontSetDocumentCache = true;
+
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMOfflineResourceList::SwapCache()
 {
   nsresult rv = Init();
   NS_ENSURE_SUCCESS(rv, rv);
@@ -615,16 +620,25 @@ nsDOMOfflineResourceList::UpdateStateCha
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsDOMOfflineResourceList::ApplicationCacheAvailable(nsIApplicationCache *aApplicationCache)
 {
   mAvailableApplicationCache = aApplicationCache;
+
+  if (!mDontSetDocumentCache) {
+    nsCOMPtr<nsIApplicationCacheContainer> appCacheContainer =
+      GetDocumentAppCacheContainer();
+
+    if (appCacheContainer)
+      appCacheContainer->SetApplicationCache(aApplicationCache);
+  }
+
   return NS_OK;
 }
 
 nsresult
 nsDOMOfflineResourceList::GetCacheKey(const nsAString &aURI, nsCString &aKey)
 {
   nsCOMPtr<nsIURI> requestedURI;
   nsresult rv = NS_NewURI(getter_AddRefs(requestedURI), aURI);
@@ -713,16 +727,17 @@ nsDOMOfflineResourceList::UpdateComplete
   bool isUpgrade;
   mCacheUpdate->GetIsUpgrade(&isUpgrade);
 
   bool succeeded;
   nsresult rv = mCacheUpdate->GetSucceeded(&succeeded);
 
   mCacheUpdate->RemoveObserver(this);
   mCacheUpdate = nullptr;
+  mDontSetDocumentCache = false;
 
   if (NS_SUCCEEDED(rv) && succeeded && !partial) {
     if (isUpgrade) {
       mStatus = nsIDOMOfflineResourceList::UPDATEREADY;
       SendEvent(NS_LITERAL_STRING(UPDATEREADY_STR));
     } else {
       mStatus = nsIDOMOfflineResourceList::IDLE;
       SendEvent(NS_LITERAL_STRING(CACHED_STR));
--- a/dom/src/offline/nsDOMOfflineResourceList.h
+++ b/dom/src/offline/nsDOMOfflineResourceList.h
@@ -74,16 +74,17 @@ private:
   // AsciiSpec of mManifestURI
   nsCString mManifestSpec;
 
   nsCOMPtr<nsIURI> mDocumentURI;
   nsCOMPtr<nsIApplicationCacheService> mApplicationCacheService;
   nsCOMPtr<nsIApplicationCache> mAvailableApplicationCache;
   nsCOMPtr<nsIOfflineCacheUpdate> mCacheUpdate;
   bool mExposeCacheUpdateStatus;
+  bool mDontSetDocumentCache;
   uint16_t mStatus;
 
   // The set of dynamic keys for this application cache object.
   char **mCachedKeys;
   uint32_t mCachedKeysCount;
 
   nsCOMArray<nsIDOMEvent> mPendingEvents;
 };
--- a/dom/webidl/HTMLInputElement.webidl
+++ b/dom/webidl/HTMLInputElement.webidl
@@ -42,17 +42,17 @@ interface HTMLInputElement : HTMLElement
   [Pure, SetterThrows]
            attribute boolean formNoValidate;
   [Pure, SetterThrows]
            attribute DOMString formTarget;
   [Pure, SetterThrows]
            attribute unsigned long height;
   [Pure]
            attribute boolean indeterminate;
-  [Pure, SetterThrows]
+  [Pure, SetterThrows, Pref="dom.forms.inputmode"]
            attribute DOMString inputMode;
   [Pure]
   readonly attribute HTMLElement? list;
   [Pure, SetterThrows]
            attribute DOMString max;
   [Pure, SetterThrows]
            attribute long maxLength;
   [Pure, SetterThrows]
--- a/gfx/layers/composite/AsyncCompositionManager.cpp
+++ b/gfx/layers/composite/AsyncCompositionManager.cpp
@@ -339,32 +339,38 @@ AsyncCompositionManager::ApplyAsyncConte
   if (!container) {
     return appliedTransform;
   }
 
   if (AsyncPanZoomController* controller = aLayer->GetAsyncPanZoomController()) {
     LayerComposite* layerComposite = aLayer->AsLayerComposite();
 
     ViewTransform treeTransform;
-    gfxPoint scrollOffset;
+    gfx::Point scrollOffset;
     *aWantNextFrame |=
       controller->SampleContentTransformForFrame(aCurrentFrame,
                                                  container,
                                                  &treeTransform,
-                                                 &scrollOffset);
+                                                 scrollOffset);
 
+    const gfx3DMatrix& rootTransform = mLayerManager->GetRoot()->GetTransform();
+    const FrameMetrics& metrics = container->GetFrameMetrics();
+    gfx::Rect displayPortLayersPixels(metrics.mCriticalDisplayPort.IsEmpty() ?
+                                      metrics.mDisplayPort : metrics.mCriticalDisplayPort);
     gfx::Margin fixedLayerMargins(0, 0, 0, 0);
-    float offsetX = 0, offsetY = 0;
-    SyncFrameMetrics(aLayer, treeTransform, scrollOffset, fixedLayerMargins,
-                     offsetX, offsetY, mIsFirstPaint, mLayersUpdated);
+    gfx::Point offset(0, 0);
+    SyncFrameMetrics(scrollOffset, treeTransform.mScale.width, metrics.mScrollableRect,
+                     mLayersUpdated, displayPortLayersPixels, 1 / rootTransform.GetXScale(),
+                     mIsFirstPaint, fixedLayerMargins, offset);
+
     mIsFirstPaint = false;
     mLayersUpdated = false;
 
     // Apply the render offset
-    mLayerManager->GetCompositor()->SetScreenRenderOffset(gfx::Point(offsetX, offsetY));
+    mLayerManager->GetCompositor()->SetScreenRenderOffset(offset);
 
     gfx3DMatrix transform(gfx3DMatrix(treeTransform) * aLayer->GetTransform());
     // The transform already takes the resolution scale into account.  Since we
     // will apply the resolution scale again when computing the effective
     // transform, we must apply the inverse resolution scale here.
     transform.Scale(1.0f/container->GetPreXScale(),
                     1.0f/container->GetPreYScale(),
                     1);
@@ -393,21 +399,16 @@ AsyncCompositionManager::TransformScroll
 
   const FrameMetrics& metrics = container->GetFrameMetrics();
   // We must apply the resolution scale before a pan/zoom transform, so we call
   // GetTransform here.
   const gfx3DMatrix& currentTransform = aLayer->GetTransform();
 
   gfx3DMatrix treeTransform;
 
-  // Translate fixed position layers so that they stay in the correct position
-  // when mScrollOffset and metricsScrollOffset differ.
-  gfxPoint offset;
-  gfxSize scaleDiff;
-
   float rootScaleX = aRootTransform.GetXScale(),
         rootScaleY = aRootTransform.GetYScale();
   // The ratio of layers pixels to device pixels.  The Java
   // compositor wants to see values in units of device pixels, so we
   // map our FrameMetrics values to that space.  This is not exposed
   // as a FrameMetrics helper because it's a deprecated conversion.
   float devPixelRatioX = 1 / rootScaleX, devPixelRatioY = 1 / rootScaleY;
 
@@ -438,24 +439,24 @@ AsyncCompositionManager::TransformScroll
     NS_lround(displayPortLayersPixels.y * devPixelRatioY),
     NS_lround(displayPortLayersPixels.width * devPixelRatioX),
     NS_lround(displayPortLayersPixels.height * devPixelRatioY));
 
   displayPortDevPixels.x += scrollOffsetDevPixels.x;
   displayPortDevPixels.y += scrollOffsetDevPixels.y;
 
   gfx::Margin fixedLayerMargins(0, 0, 0, 0);
-  float offsetX = 0, offsetY = 0;
+  gfx::Point offset(0, 0);
   SyncViewportInfo(displayPortDevPixels, 1/rootScaleX, mLayersUpdated,
                    mScrollOffset, mXScale, mYScale, fixedLayerMargins,
-                   offsetX, offsetY);
+                   offset);
   mLayersUpdated = false;
 
   // Apply the render offset
-  mLayerManager->GetCompositor()->SetScreenRenderOffset(gfx::Point(offsetX, offsetY));
+  mLayerManager->GetCompositor()->SetScreenRenderOffset(offset);
 
   // Handle transformations for asynchronous panning and zooming. We determine the
   // zoom used by Gecko from the transformation set on the root layer, and we
   // determine the scroll offset used by Gecko from the frame metrics of the
   // primary scrollable layer. We compare this to the desired zoom and scroll
   // offset in the view transform we obtained from Java in order to compute the
   // transformation we need to apply.
   float tempScaleDiffX = rootScaleX * mXScale;
@@ -467,51 +468,56 @@ AsyncCompositionManager::TransformScroll
   }
 
   nsIntPoint scrollCompensation(
     (mScrollOffset.x / tempScaleDiffX - metricsScrollOffset.x) * mXScale,
     (mScrollOffset.y / tempScaleDiffY - metricsScrollOffset.y) * mYScale);
   treeTransform = gfx3DMatrix(ViewTransform(-scrollCompensation,
                                             gfxSize(mXScale, mYScale)));
 
+  // Translate fixed position layers so that they stay in the correct position
+  // when mScrollOffset and metricsScrollOffset differ.
+  gfxPoint fixedOffset;
+  gfxSize scaleDiff;
+
   // If the contents can fit entirely within the widget area on a particular
   // dimenson, we need to translate and scale so that the fixed layers remain
   // within the page boundaries.
   if (mContentRect.width * tempScaleDiffX < metrics.mCompositionBounds.width) {
-    offset.x = -metricsScrollOffset.x;
+    fixedOffset.x = -metricsScrollOffset.x;
     scaleDiff.width = std::min(1.0f, metrics.mCompositionBounds.width / (float)mContentRect.width);
   } else {
-    offset.x = clamped(mScrollOffset.x / tempScaleDiffX, (float)mContentRect.x,
+    fixedOffset.x = clamped(mScrollOffset.x / tempScaleDiffX, (float)mContentRect.x,
                        mContentRect.XMost() - metrics.mCompositionBounds.width / tempScaleDiffX) -
                metricsScrollOffset.x;
     scaleDiff.width = tempScaleDiffX;
   }
 
   if (mContentRect.height * tempScaleDiffY < metrics.mCompositionBounds.height) {
-    offset.y = -metricsScrollOffset.y;
+    fixedOffset.y = -metricsScrollOffset.y;
     scaleDiff.height = std::min(1.0f, metrics.mCompositionBounds.height / (float)mContentRect.height);
   } else {
-    offset.y = clamped(mScrollOffset.y / tempScaleDiffY, (float)mContentRect.y,
+    fixedOffset.y = clamped(mScrollOffset.y / tempScaleDiffY, (float)mContentRect.y,
                        mContentRect.YMost() - metrics.mCompositionBounds.height / tempScaleDiffY) -
                metricsScrollOffset.y;
     scaleDiff.height = tempScaleDiffY;
   }
 
   // The transform already takes the resolution scale into account.  Since we
   // will apply the resolution scale again when computing the effective
   // transform, we must apply the inverse resolution scale here.
   gfx3DMatrix computedTransform = treeTransform * currentTransform;
   computedTransform.Scale(1.0f/container->GetPreXScale(),
                           1.0f/container->GetPreYScale(),
                           1);
   computedTransform.ScalePost(1.0f/container->GetPostXScale(),
                               1.0f/container->GetPostYScale(),
                               1);
   layerComposite->SetShadowTransform(computedTransform);
-  TransformFixedLayers(aLayer, offset, scaleDiff, fixedLayerMargins);
+  TransformFixedLayers(aLayer, fixedOffset, scaleDiff, fixedLayerMargins);
 }
 
 bool
 AsyncCompositionManager::TransformShadowTree(TimeStamp aCurrentFrame)
 {
   bool wantNextFrame = false;
   Layer* root = mLayerManager->GetRoot();
 
@@ -571,23 +577,42 @@ AsyncCompositionManager::SetPageRect(con
 
 void
 AsyncCompositionManager::SyncViewportInfo(const nsIntRect& aDisplayPort,
                                           float aDisplayResolution,
                                           bool aLayersUpdated,
                                           nsIntPoint& aScrollOffset,
                                           float& aScaleX, float& aScaleY,
                                           gfx::Margin& aFixedLayerMargins,
-                                          float& aOffsetX, float& aOffsetY)
+                                          gfx::Point& aOffset)
 {
 #ifdef MOZ_WIDGET_ANDROID
   AndroidBridge::Bridge()->SyncViewportInfo(aDisplayPort,
                                             aDisplayResolution,
                                             aLayersUpdated,
                                             aScrollOffset,
                                             aScaleX, aScaleY,
                                             aFixedLayerMargins,
-                                            aOffsetX, aOffsetY);
+                                            aOffset);
+#endif
+}
+
+void
+AsyncCompositionManager::SyncFrameMetrics(const gfx::Point& aScrollOffset,
+                                          float aZoom,
+                                          const gfx::Rect& aCssPageRect,
+                                          bool aLayersUpdated,
+                                          const gfx::Rect& aDisplayPort,
+                                          float aDisplayResolution,
+                                          bool aIsFirstPaint,
+                                          gfx::Margin& aFixedLayerMargins,
+                                          gfx::Point& aOffset)
+{
+#ifdef MOZ_WIDGET_ANDROID
+  AndroidBridge::Bridge()->SyncFrameMetrics(aScrollOffset, aZoom, aCssPageRect,
+                                            aLayersUpdated, aDisplayPort,
+                                            aDisplayResolution, aIsFirstPaint,
+                                            aFixedLayerMargins, aOffset);
 #endif
 }
 
 } // namespace layers
 } // namespace mozilla
--- a/gfx/layers/composite/AsyncCompositionManager.h
+++ b/gfx/layers/composite/AsyncCompositionManager.h
@@ -124,22 +124,26 @@ private:
                              const gfx::Rect& aCssPageRect);
   void SetPageRect(const gfx::Rect& aCssPageRect);
   void SyncViewportInfo(const nsIntRect& aDisplayPort,
                         float aDisplayResolution,
                         bool aLayersUpdated,
                         nsIntPoint& aScrollOffset,
                         float& aScaleX, float& aScaleY,
                         gfx::Margin& aFixedLayerMargins,
-                        float& aOffsetX, float& aOffsetY);
-  virtual void SyncFrameMetrics(Layer* aLayer, const ViewTransform& aTreeTransform,
-                                const gfxPoint& aScrollOffset, gfx::Margin& aFixedLayerMargins,
-                                float& aOffsetX, float& aOffsetY,
-                                bool aIsFirstPaint, bool aLayersUpdated)
-  {}
+                        gfx::Point& aOffset);
+  void SyncFrameMetrics(const gfx::Point& aScrollOffset,
+                        float aZoom,
+                        const gfx::Rect& aCssPageRect,
+                        bool aLayersUpdated,
+                        const gfx::Rect& aDisplayPort,
+                        float aDisplayResolution,
+                        bool aIsFirstPaint,
+                        gfx::Margin& aFixedLayerMargins,
+                        gfx::Point& aOffset);
 
   /**
    * Recursively applies the given translation to all top-level fixed position
    * layers that are descendants of the given layer.
    * aScaleDiff is considered to be the scale transformation applied when
    * displaying the layers, and is used to make sure the anchor points of
    * fixed position layers remain in the same position.
    */
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -1110,17 +1110,17 @@ AsyncPanZoomController::FireAsyncScrollO
     SendAsyncScrollEvent();
   }
   mAsyncScrollTimeoutTask = nullptr;
 }
 
 bool AsyncPanZoomController::SampleContentTransformForFrame(const TimeStamp& aSampleTime,
                                                             ContainerLayer* aLayer,
                                                             ViewTransform* aNewTransform,
-                                                            gfxPoint* aScrollOffset) {
+                                                            gfx::Point& aScrollOffset) {
   // The eventual return value of this function. The compositor needs to know
   // whether or not to advance by a frame as soon as it can. For example, if a
   // fling is happening, it has to keep compositing so that the animation is
   // smooth. If an animation frame is requested, it is the compositor's
   // responsibility to schedule a composite.
   bool requestAnimationFrame = false;
 
   const gfx3DMatrix& currentTransform = aLayer->GetTransform();
@@ -1219,17 +1219,18 @@ bool AsyncPanZoomController::SampleConte
     MessageLoop::current()->PostDelayedTask(FROM_HERE,
                                             mAsyncScrollTimeoutTask,
                                             mAsyncScrollTimeout);
   }
 
   gfxPoint scrollCompensation(
     (scrollOffset / rootScale - metricsScrollOffset) * localScale);
   *aNewTransform = ViewTransform(-scrollCompensation, localScale);
-  *aScrollOffset = scrollOffset * localScale;
+  aScrollOffset.x = scrollOffset.x * localScale.width;
+  aScrollOffset.y = scrollOffset.y * localScale.height;
 
   mLastSampleTime = aSampleTime;
 
   return requestAnimationFrame;
 }
 
 void AsyncPanZoomController::NotifyLayersUpdated(const FrameMetrics& aViewportFrame, bool aIsFirstPaint) {
   MonitorAutoLock monitor(mMonitor);
--- a/gfx/layers/ipc/AsyncPanZoomController.h
+++ b/gfx/layers/ipc/AsyncPanZoomController.h
@@ -173,17 +173,17 @@ public:
    *
    * Return value indicates whether or not any currently running animation
    * should continue. That is, if true, the compositor should schedule another
    * composite.
    */
   bool SampleContentTransformForFrame(const TimeStamp& aSampleTime,
                                       ContainerLayer* aLayer,
                                       ViewTransform* aNewTransform,
-                                      gfxPoint* aScrollOffset);
+                                      gfx::Point& aScrollOffset);
 
   /**
    * A shadow layer update has arrived. |aViewportFrame| is the new FrameMetrics
    * for the top-level frame. |aIsFirstPaint| is a flag passed from the shadow
    * layers code indicating that the frame metrics being sent with this call are
    * the initial metrics and the initial paint of the frame has just happened.
    */
   void NotifyLayersUpdated(const FrameMetrics& aViewportFrame, bool aIsFirstPaint);
--- a/gfx/thebes/gfxDWriteFontList.cpp
+++ b/gfx/thebes/gfxDWriteFontList.cpp
@@ -240,44 +240,46 @@ gfxDWriteFontEntry::IsSymbolFont()
     if (mFont) {
         return mFont->IsSymbolFont();
     } else {
         return false;
     }
 }
 
 static bool
-UsingArabicScriptSystemLocale()
+UsingArabicOrHebrewScriptSystemLocale()
 {
     LANGID langid = PRIMARYLANGID(::GetSystemDefaultLangID());
     switch (langid) {
     case LANG_ARABIC:
     case LANG_DARI:
     case LANG_PASHTO:
     case LANG_PERSIAN:
     case LANG_SINDHI:
     case LANG_UIGHUR:
     case LANG_URDU:
+    case LANG_HEBREW:
         return true;
     default:
         return false;
     }
 }
 
 nsresult
 gfxDWriteFontEntry::GetFontTable(uint32_t aTableTag,
                                  FallibleTArray<uint8_t> &aBuffer)
 {
     gfxDWriteFontList *pFontList = gfxDWriteFontList::PlatformFontList();
 
-    // don't use GDI table loading for symbol fonts or for
+    // Don't use GDI table loading for symbol fonts or for
     // italic fonts in Arabic-script system locales because of
-    // potential cmap discrepancies, see bug 629386
+    // potential cmap discrepancies, see bug 629386.
+    // Ditto for Hebrew, bug 837498.
     if (mFont && pFontList->UseGDIFontTableAccess() &&
-        !(mItalic && UsingArabicScriptSystemLocale()) &&
+        !(mItalic && UsingArabicOrHebrewScriptSystemLocale()) &&
         !mFont->IsSymbolFont())
     {
         LOGFONTW logfont = { 0 };
         if (!InitLogFont(mFont, &logfont))
             return NS_ERROR_FAILURE;
 
         AutoDC dc;
         AutoSelectFont font(dc.GetDC(), &logfont);
--- a/js/ductwork/debugger/JSDebugger.cpp
+++ b/js/ductwork/debugger/JSDebugger.cpp
@@ -4,16 +4,17 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "JSDebugger.h"
 #include "nsIXPConnect.h"
 #include "nsThreadUtils.h"
 #include "jsapi.h"
 #include "jsfriendapi.h"
 #include "jsdbgapi.h"
+#include "jswrapper.h"
 #include "mozilla/ModuleUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsMemory.h"
 
 #define JSDEBUGGER_CONTRACTID \
   "@mozilla.org/jsdebugger;1"
 
 #define JSDEBUGGER_CID \
@@ -40,17 +41,17 @@ JSDebugger::AddClass(const JS::Value &gl
   nsresult rv;
   nsCOMPtr<nsIXPConnect> xpc = do_GetService(nsIXPConnect::GetCID(), &rv);
 
   if (!global.isObject()) {
     return NS_ERROR_INVALID_ARG;
   }
   
   JSObject* obj = &global.toObject();
-  obj = JS_UnwrapObjectAndInnerize(obj);
+  obj = js::UncheckedUnwrap(obj, /* stopAtOuter = */ false);
   if (!obj) {
     return NS_ERROR_FAILURE;
   }
 
   JSAutoCompartment ac(cx, obj);
   if (JS_GetGlobalForObject(cx, obj) != obj) {
     return NS_ERROR_INVALID_ARG;
   }
--- a/js/jsd/jsd_val.cpp
+++ b/js/jsd/jsd_val.cpp
@@ -6,16 +6,17 @@
 
 /*
  * JavaScript Debugging support - Value and Property support
  */
 
 #include "jsd.h"
 #include "jsapi.h"
 #include "jsfriendapi.h"
+#include "jswrapper.h"
 
 #ifdef DEBUG
 void JSD_ASSERT_VALID_VALUE(JSDValue* jsdval)
 {
     JS_ASSERT(jsdval);
     JS_ASSERT(jsdval->nref > 0);
     if(!JS_CLIST_IS_EMPTY(&jsdval->props))
     {
@@ -600,17 +601,17 @@ jsd_GetValueFunction(JSDContext* jsdc, J
 {
     JSObject *obj;
     JSFunction *fun;
 
     JSCompartment* oldCompartment = NULL;
     if (JSVAL_IS_PRIMITIVE(jsdval->val))
         return NULL;
 
-    obj = JS_UnwrapObject(JSVAL_TO_OBJECT(jsdval->val));
+    obj = js::UncheckedUnwrap(JSVAL_TO_OBJECT(jsdval->val));
     oldCompartment = JS_EnterCompartment(jsdc->dumbContext, obj);
     fun = JS_ValueToFunction(jsdc->dumbContext, OBJECT_TO_JSVAL(obj));
     JS_LeaveCompartment(jsdc->dumbContext, oldCompartment);
 
     return fun;
 }
 
 JSDValue*
--- a/js/public/RootingAPI.h
+++ b/js/public/RootingAPI.h
@@ -309,25 +309,16 @@ typedef MutableHandle<JSString*>   Mutab
 typedef MutableHandle<jsid>        MutableHandleId;
 typedef MutableHandle<Value>       MutableHandleValue;
 
 } /* namespace JS */
 
 namespace js {
 
 /*
- * Raw pointer used as documentation that a parameter does not need to be
- * rooted.
- */
-typedef JSObject *                  RawObject;
-typedef JSString *                  RawString;
-typedef jsid                        RawId;
-typedef JS::Value                   RawValue;
-
-/*
  * InternalHandle is a handle to an internal pointer into a gcthing. Use
  * InternalHandle when you have a pointer to a direct field of a gcthing, or
  * when you need a parameter type for something that *may* be a pointer to a
  * direct field of a gcthing.
  */
 template <typename T>
 class InternalHandle {};
 
@@ -376,30 +367,16 @@ class InternalHandle<T*>
      */
     InternalHandle(T *field)
       : holder(reinterpret_cast<void * const *>(&js::NullPtr::constNullValue)),
         offset(uintptr_t(field))
     {}
 };
 
 /*
- * This macro simplifies forward declaration of a class and its matching raw-pointer.
- */
-# define ForwardDeclare(type)              \
-    class type;                            \
-    typedef type * Raw##type
-
-# define ForwardDeclareJS(type)            \
-    class JS##type;                        \
-    namespace js {                         \
-        typedef JS##type * Raw##type;      \
-    }                                      \
-    class JS##type
-
-/*
  * By default, pointers should use the inheritance hierarchy to find their
  * ThingRootKind. Some pointer types are explicitly set in jspubtd.h so that
  * Rooted<T> may be used without the class definition being available.
  */
 template <typename T>
 struct RootKind<T *>
 {
     static ThingRootKind rootKind() { return T::rootKind(); }
@@ -819,13 +796,9 @@ class CompilerRootNode
     CompilerRootNode *next;
 
   protected:
     js::gc::Cell *ptr_;
 };
 
 }  /* namespace js */
 
-ForwardDeclareJS(Script);
-ForwardDeclareJS(Function);
-ForwardDeclareJS(Object);
-
 #endif  /* jsgc_root_h___ */
--- a/js/public/Utility.h
+++ b/js/public/Utility.h
@@ -4,16 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef js_utility_h__
 #define js_utility_h__
 
 #include "mozilla/Assertions.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/Compiler.h"
 #include "mozilla/Scoped.h"
 
 #include <stdlib.h>
 #include <string.h>
 
 #ifdef JS_OOM_DO_BACKTRACES
 #include <stdio.h>
 #include <execinfo.h>
@@ -224,27 +225,42 @@ unsigned char _BitScanReverse64(unsigned
 
     _BitScanReverse64(&idx, val);
     return (int)(63-idx);
 }
 # define js_bitscan_ctz64(val)  __BitScanForward64(val)
 # define js_bitscan_clz64(val)  __BitScanReverse64(val)
 # define JS_HAS_BUILTIN_BITSCAN64
 #endif
-#elif (__GNUC__ >= 4) || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4)
+#elif MOZ_IS_GCC
+
+#if MOZ_GCC_VERSION_AT_LEAST(3, 4, 0)
+# define USE_BUILTIN_CTZ
+#endif
+
+#elif defined(__clang__)
 
+#if __has_builtin(__builtin_ctz)
+# define USE_BUILTIN_CTZ
+#endif
+
+#endif
+
+#if defined(USE_BUILTIN_CTZ)
 # define js_bitscan_ctz32(val)  __builtin_ctz(val)
 # define js_bitscan_clz32(val)  __builtin_clz(val)
 # define JS_HAS_BUILTIN_BITSCAN32
 # if (JS_BYTES_PER_WORD == 8)
 #  define js_bitscan_ctz64(val)  __builtin_ctzll(val)
 #  define js_bitscan_clz64(val)  __builtin_clzll(val)
 #  define JS_HAS_BUILTIN_BITSCAN64
 # endif
 
+# undef USE_BUILTIN_CTZ
+
 #endif
 
 /*
 ** Macro version of JS_CeilingLog2: Compute the log of the least power of
 ** 2 greater than or equal to _n. The result is returned in _log2.
 */
 #ifdef JS_HAS_BUILTIN_BITSCAN32
 /*
--- a/js/src/builtin/Eval.cpp
+++ b/js/src/builtin/Eval.cpp
@@ -29,17 +29,17 @@ AssertInnerizedScopeChain(JSContext *cx,
         if (JSObjectOp op = obj->getClass()->ext.innerObject) {
             JS_ASSERT(op(cx, obj) == obj);
         }
     }
 #endif
 }
 
 static bool
-IsEvalCacheCandidate(RawScript script)
+IsEvalCacheCandidate(JSScript *script)
 {
     // Make sure there are no inner objects which might use the wrong parent
     // and/or call scope by reusing the previous eval's script. Skip the
     // script's first object, which entrains the eval's scope.
     return script->savedCallerFun &&
            !script->hasSingletons &&
            script->objects()->length == 1 &&
            !script->hasRegexps();
@@ -118,17 +118,17 @@ class EvalScriptGuard
             script_ = p_->script;
             cx_->runtime->evalCache.remove(p_);
             CallNewScriptHook(cx_, script_, NullPtr());
             script_->isCachedEval = false;
             script_->isActiveEval = true;
         }
     }
 
-    void setNewScript(RawScript script) {
+    void setNewScript(JSScript *script) {
         // JSScript::initFromEmitter has already called js_CallNewScriptHook.
         JS_ASSERT(!script_ && script);
         script_ = script;
         script_->isActiveEval = true;
     }
 
     bool foundScript() {
         return !!script_;
@@ -284,17 +284,17 @@ EvalKernel(JSContext *cx, const CallArgs
                                                             : NOT_CALLED_FROM_JSOP_EVAL);
 
         CompileOptions options(cx);
         options.setFileAndLine(filename, lineno)
                .setCompileAndGo(true)
                .setNoScriptRval(false)
                .setPrincipals(principals)
                .setOriginPrincipals(originPrincipals);
-        RawScript compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
+        JSScript *compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
                                                      chars.get(), length, stableStr, staticLevel);
         if (!compiled)
             return false;
 
         esg.setNewScript(compiled);
     }
 
     return ExecuteKernel(cx, esg.script(), *scopeobj, thisv, ExecuteType(evalType),
@@ -345,17 +345,17 @@ js::DirectEvalFromIon(JSContext *cx,
                                     CALLED_FROM_JSOP_EVAL);
 
         CompileOptions options(cx);
         options.setFileAndLine(filename, lineno)
                .setCompileAndGo(true)
                .setNoScriptRval(false)
                .setPrincipals(principals)
                .setOriginPrincipals(originPrincipals);
-        RawScript compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
+        JSScript *compiled = frontend::CompileScript(cx, scopeobj, callerScript, options,
                                                      chars.get(), length, stableStr, staticLevel);
         if (!compiled)
             return false;
 
         esg.setNewScript(compiled);
     }
 
     // Primitive 'this' values should have been filtered out by Ion. If boxed,
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -845,17 +845,17 @@ HashableValue::mark(JSTracer *trc) const
 
 class js::MapIteratorObject : public JSObject
 {
   public:
     enum { TargetSlot, KindSlot, RangeSlot, SlotCount };
     static const JSFunctionSpec methods[];
     static MapIteratorObject *create(JSContext *cx, HandleObject mapobj, ValueMap *data,
                                      MapObject::IteratorKind kind);
-    static void finalize(FreeOp *fop, RawObject obj);
+    static void finalize(FreeOp *fop, JSObject *obj);
 
   private:
     static inline bool is(const Value &v);
     inline ValueMap::Range *range();
     inline MapObject::IteratorKind kind() const;
     static bool next_impl(JSContext *cx, CallArgs args);
     static JSBool next(JSContext *cx, unsigned argc, Value *vp);
 };
@@ -937,17 +937,17 @@ MapIteratorObject::create(JSContext *cx,
     }
     iterobj->setSlot(TargetSlot, ObjectValue(*mapobj));
     iterobj->setSlot(KindSlot, Int32Value(int32_t(kind)));
     iterobj->setSlot(RangeSlot, PrivateValue(range));
     return static_cast<MapIteratorObject *>(iterobj);
 }
 
 void
-MapIteratorObject::finalize(FreeOp *fop, RawObject obj)
+MapIteratorObject::finalize(FreeOp *fop, JSObject *obj)
 {
     fop->delete_(obj->asMapIterator().range());
 }
 
 bool
 MapIteratorObject::is(const Value &v)
 {
     return v.isObject() && v.toObject().hasClass(&MapIteratorClass);
@@ -1094,17 +1094,17 @@ MarkKey(Range &r, const HashableValue &k
 
             JS_ASSERT(newKey.get().isObject());
             r.rekeyFront(newKey);
         }
     }
 }
 
 void
-MapObject::mark(JSTracer *trc, RawObject obj)
+MapObject::mark(JSTracer *trc, JSObject *obj)
 {
     if (ValueMap *map = obj->asMap().getData()) {
         for (ValueMap::Range r = map->all(); !r.empty(); r.popFront()) {
             MarkKey(r, r.front().key, trc);
             gc::MarkValue(trc, &r.front().value, "value");
         }
     }
 }
@@ -1142,17 +1142,17 @@ static void
 WriteBarrierPost(JSRuntime *rt, TableType *table, const HashableValue &key)
 {
 #ifdef JSGC_GENERATIONAL
     rt->gcStoreBuffer.putGeneric(OrderedHashTableRef<TableType>(table, key));
 #endif
 }
 
 void
-MapObject::finalize(FreeOp *fop, RawObject obj)
+MapObject::finalize(FreeOp *fop, JSObject *obj)
 {
     if (ValueMap *map = obj->asMap().getData())
         fop->delete_(map);
 }
 
 JSBool
 MapObject::construct(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -1417,17 +1417,17 @@ js_InitMapClass(JSContext *cx, HandleObj
 /*** SetIterator *********************************************************************************/
 
 class js::SetIteratorObject : public JSObject
 {
   public:
     enum { TargetSlot, RangeSlot, SlotCount };
     static const JSFunctionSpec methods[];
     static SetIteratorObject *create(JSContext *cx, HandleObject setobj, ValueSet *data);
-    static void finalize(FreeOp *fop, RawObject obj);
+    static void finalize(FreeOp *fop, JSObject *obj);
 
   private:
     static inline bool is(const Value &v);
     inline ValueSet::Range *range();
     static bool next_impl(JSContext *cx, CallArgs args);
     static JSBool next(JSContext *cx, unsigned argc, Value *vp);
 };
 
@@ -1497,17 +1497,17 @@ SetIteratorObject::create(JSContext *cx,
         return NULL;
     }
     iterobj->setSlot(TargetSlot, ObjectValue(*setobj));
     iterobj->setSlot(RangeSlot, PrivateValue(range));
     return static_cast<SetIteratorObject *>(iterobj);
 }
 
 void
-SetIteratorObject::finalize(FreeOp *fop, RawObject obj)
+SetIteratorObject::finalize(FreeOp *fop, JSObject *obj)
 {
     fop->delete_(obj->asSetIterator().range());
 }
 
 bool
 SetIteratorObject::is(const Value &v)
 {
     return v.isObject() && v.toObject().hasClass(&SetIteratorClass);
@@ -1584,27 +1584,27 @@ const JSFunctionSpec SetObject::methods[
 JSObject *
 SetObject::initClass(JSContext *cx, JSObject *obj)
 {
     Rooted<GlobalObject*> global(cx, &obj->asGlobal());
     return InitClass(cx, global, &class_, JSProto_Set, construct, properties, methods);
 }
 
 void
-SetObject::mark(JSTracer *trc, RawObject obj)
+SetObject::mark(JSTracer *trc, JSObject *obj)
 {
     SetObject *setobj = static_cast<SetObject *>(obj);
     if (ValueSet *set = setobj->getData()) {
         for (ValueSet::Range r = set->all(); !r.empty(); r.popFront())
             MarkKey(r, r.front(), trc);
     }
 }
 
 void
-SetObject::finalize(FreeOp *fop, RawObject obj)
+SetObject::finalize(FreeOp *fop, JSObject *obj)
 {
     SetObject *setobj = static_cast<SetObject *>(obj);
     if (ValueSet *set = setobj->getData())
         fop->delete_(set);
 }
 
 JSBool
 SetObject::construct(JSContext *cx, unsigned argc, Value *vp)
--- a/js/src/builtin/MapObject.h
+++ b/js/src/builtin/MapObject.h
@@ -92,18 +92,18 @@ class MapObject : public JSObject {
 
     static JSObject *initClass(JSContext *cx, JSObject *obj);
     static Class class_;
   private:
     static const JSPropertySpec properties[];
     static const JSFunctionSpec methods[];
     ValueMap *getData() { return static_cast<ValueMap *>(getPrivate()); }
     static ValueMap & extract(CallReceiver call);
-    static void mark(JSTracer *trc, RawObject obj);
-    static void finalize(FreeOp *fop, RawObject obj);
+    static void mark(JSTracer *trc, JSObject *obj);
+    static void finalize(FreeOp *fop, JSObject *obj);
     static JSBool construct(JSContext *cx, unsigned argc, Value *vp);
 
     static bool is(const Value &v);
 
     static bool iterator_impl(JSContext *cx, CallArgs args, IteratorKind kind);
 
     static bool size_impl(JSContext *cx, CallArgs args);
     static JSBool size(JSContext *cx, unsigned argc, Value *vp);
@@ -129,18 +129,18 @@ class SetObject : public JSObject {
   public:
     static JSObject *initClass(JSContext *cx, JSObject *obj);
     static Class class_;
   private:
     static const JSPropertySpec properties[];
     static const JSFunctionSpec methods[];
     ValueSet *getData() { return static_cast<ValueSet *>(getPrivate()); }
     static ValueSet & extract(CallReceiver call);
-    static void mark(JSTracer *trc, RawObject obj);
-    static void finalize(FreeOp *fop, RawObject obj);
+    static void mark(JSTracer *trc, JSObject *obj);
+    static void finalize(FreeOp *fop, JSObject *obj);
     static JSBool construct(JSContext *cx, unsigned argc, Value *vp);
 
     static bool is(const Value &v);
 
     static bool size_impl(JSContext *cx, CallArgs args);
     static JSBool size(JSContext *cx, unsigned argc, Value *vp);
     static bool has_impl(JSContext *cx, CallArgs args);
     static JSBool has(JSContext *cx, unsigned argc, Value *vp);
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -178,17 +178,17 @@ obj_toSource(JSContext *cx, unsigned arg
                 valcnt = 1;
                 gsop[0].set(NULL);
                 if (!JSObject::getGeneric(cx, obj, obj, id, val[0]))
                     return false;
             }
         }
 
         /* Convert id to a linear string. */
-        RawString s = ToString<CanGC>(cx, IdToValue(id));
+        JSString *s = ToString<CanGC>(cx, IdToValue(id));
         if (!s)
             return false;
         Rooted<JSLinearString*> idstr(cx, s->ensureLinear(cx));
         if (!idstr)
             return false;
 
         /*
          * If id is a string that's not an identifier, or if it's a negative
@@ -273,17 +273,17 @@ obj_toSource(JSContext *cx, unsigned arg
         }
     }
 
     if (!buf.append('}'))
         return false;
     if (outermost && !buf.append(')'))
         return false;
 
-    RawString str = buf.finishString();
+    JSString *str = buf.finishString();
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 #endif /* JS_HAS_TOSOURCE */
 
 JSString *
@@ -319,17 +319,17 @@ obj_toString(JSContext *cx, unsigned arg
     }
 
     /* Step 3. */
     RootedObject obj(cx, ToObject(cx, args.thisv()));
     if (!obj)
         return false;
 
     /* Steps 4-5. */
-    RawString str = JS_BasicObjectToString(cx, obj);
+    JSString *str = JS_BasicObjectToString(cx, obj);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 
 /* ES5 15.2.4.3. */
 static JSBool
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -195,17 +195,17 @@ EscapeNakedForwardSlashes(JSContext *cx,
             if (!sb.append('\\'))
                 return NULL;
         }
 
         if (!sb.empty() && !sb.append(*it))
             return NULL;
     }
 
-    return sb.empty() ? RawAtom(unescaped) : sb.finishAtom();
+    return sb.empty() ? (JSAtom *)unescaped : sb.finishAtom();
 }
 
 /*
  * Compile a new |RegExpShared| for the |RegExpObject|.
  *
  * Per ECMAv5 15.10.4.1, we act on combinations of (pattern, flags) as
  * arguments:
  *
@@ -361,17 +361,17 @@ regexp_construct(JSContext *cx, unsigned
     return CompileRegExpObject(cx, builder, args);
 }
 
 JS_ALWAYS_INLINE bool
 regexp_toString_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsRegExp(args.thisv()));
 
-    RawString str = args.thisv().toObject().asRegExp().toString(cx);
+    JSString *str = args.thisv().toObject().asRegExp().toString(cx);
     if (!str)
         return false;
 
     args.rval().setString(str);
     return true;
 }
 
 JSBool
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -1745,17 +1745,17 @@ ia64*-hpux*)
         MOZ_DEBUG_LDFLAGS='-DEBUG -DEBUGTYPE:CV'
         WARNINGS_AS_ERRORS='-WX'
         MOZ_OPTIMIZE_FLAGS="-O2"
         MOZ_FIX_LINK_PATHS=
         DYNAMIC_XPCOM_LIBS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xpcom_core.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         XPCOM_FROZEN_LDOPTS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         LIBXUL_LIBS='$(LIBXUL_DIST)/lib/xpcom.lib $(LIBXUL_DIST)/lib/xul.lib $(LIBXUL_DIST)/lib/mozalloc.lib'
         MOZ_COMPONENT_NSPR_LIBS='$(NSPR_LIBS)'
-        LDFLAGS="$LDFLAGS -LARGEADDRESSAWARE -NXCOMPAT"
+        LDFLAGS="$LDFLAGS -LARGEADDRESSAWARE -NXCOMPAT -RELEASE"
         dnl For profile-guided optimization
         PROFILE_GEN_CFLAGS="-GL"
         PROFILE_GEN_LDFLAGS="-LTCG:PGINSTRUMENT"
         dnl XXX: PGO builds can fail with warnings treated as errors,
         dnl specifically "no profile data available" appears to be
         dnl treated as an error sometimes. This might be a consequence
         dnl of using WARNINGS_AS_ERRORS in some modules, combined
         dnl with the linker doing most of the work in the whole-program
@@ -2289,19 +2289,16 @@ MOZ_SIZE_OF_TYPE(JS_BYTES_PER_WORD, void
 if test "$moz_cv_size_of_JS_BYTES_PER_WORD" -eq "4"; then
   AC_DEFINE(JS_BITS_PER_WORD_LOG2, 5)
 elif test "$moz_cv_size_of_JS_BYTES_PER_WORD" -eq "8"; then
   AC_DEFINE(JS_BITS_PER_WORD_LOG2, 6)
 else
   AC_MSG_ERROR([Unexpected JS_BYTES_PER_WORD])
 fi
 
-MOZ_ALIGN_OF_TYPE(JS_ALIGN_OF_POINTER, void*, 2 4 8 16)
-MOZ_SIZE_OF_TYPE(JS_BYTES_PER_DOUBLE, double, 6 8 10 12 14)
-
 MOZ_CHECK_HEADERS(endian.h)
 if test "$ac_cv_header_endian_h" = yes; then
     AC_DEFINE(JS_HAVE_ENDIAN_H)
 fi
 
 MOZ_CHECK_HEADERS([machine/endian.h],[],[],[#include <sys/types.h>])
 if test "$ac_cv_header_machine_endian_h" = yes; then
     AC_DEFINE(JS_HAVE_MACHINE_ENDIAN_H)
@@ -2909,44 +2906,16 @@ if test "$GNU_CC"; then
     else
         ARM_ABI_PREFIX=oabi-
     fi
   fi
 
   TARGET_COMPILER_ABI="${TARGET_COMPILER_ABI-${ARM_ABI_PREFIX}gcc3}"
 fi
 
-dnl Check for support of modern template specialization syntax
-dnl Test code and requirement from scc@netscape.com.
-dnl Autoconf cut-and-paste job by waterson@netscape.com
-AC_CACHE_CHECK(for modern C++ template specialization syntax support,
-               ac_cv_cpp_modern_specialize_template_syntax,
-               [AC_TRY_COMPILE(template <class T> struct X { int a; };
-                               class Y {};
-                               template <> struct X<Y> { double a; };,
-                               X<int> int_x;
-                               X<Y> y_x;,
-                               ac_cv_cpp_modern_specialize_template_syntax=yes,
-                               ac_cv_cpp_modern_specialize_template_syntax=no)])
-if test "$ac_cv_cpp_modern_specialize_template_syntax" = no ; then
-  AC_MSG_ERROR([The C++ compiler does not support template specialization])
-fi
-
-dnl Some compilers support only full specialization, and some don't.
-AC_CACHE_CHECK(whether partial template specialization works,
-               ac_cv_cpp_partial_specialization,
-               [AC_TRY_COMPILE(template <class T> class Foo {};
-                               template <class T> class Foo<T*> {};,
-                               return 0;,
-                               ac_cv_cpp_partial_specialization=yes,
-                               ac_cv_cpp_partial_specialization=no)])
-if test "$ac_cv_cpp_partial_specialization" = yes ; then
-  AC_DEFINE(HAVE_CPP_PARTIAL_SPECIALIZATION)
-fi
-
 dnl Check to see if we can resolve ambiguity with |using|.
 AC_CACHE_CHECK(whether the C++ \"using\" keyword resolves ambiguity,
                ac_cv_cpp_ambiguity_resolving_using,
                [AC_TRY_COMPILE(class X {
                                  public: int go(const X&) {return 3;}
                                          int jo(const X&) {return 3;}
                                };
                                class Y : public X {
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -33,17 +33,17 @@ CheckLength(JSContext *cx, size_t length
     if (length > UINT32_MAX) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_SOURCE_TOO_LONG);
         return false;
     }
     return true;
 }
 
 static bool
-SetSourceMap(JSContext *cx, TokenStream &tokenStream, ScriptSource *ss, RawScript script)
+SetSourceMap(JSContext *cx, TokenStream &tokenStream, ScriptSource *ss, JSScript *script)
 {
     if (tokenStream.hasSourceMap()) {
         if (!ss->setSourceMap(cx, tokenStream.releaseSourceMap(), script->filename()))
             return false;
     }
     return true;
 }
 
@@ -69,17 +69,17 @@ CheckArgumentsWithinEval(JSContext *cx, 
     if (script->isGeneratorExp) {
         parser.report(ParseError, false, NULL, JSMSG_BAD_GENEXP_BODY, js_arguments_str);
         return false;
     }
 
     return true;
 }
 
-RawScript
+JSScript *
 frontend::CompileScript(JSContext *cx, HandleObject scopeChain,
                         HandleScript evalCaller,
                         const CompileOptions &options,
                         const jschar *chars, size_t length,
                         JSString *source_ /* = NULL */,
                         unsigned staticLevel /* = 0 */,
                         SourceCompressionToken *extraSct /* = NULL */)
 {
--- a/js/src/frontend/BytecodeCompiler.h
+++ b/js/src/frontend/BytecodeCompiler.h
@@ -7,17 +7,17 @@
 #ifndef BytecodeCompiler_h__
 #define BytecodeCompiler_h__
 
 #include "frontend/Parser.h"
 
 namespace js {
 namespace frontend {
 
-RawScript
+JSScript *
 CompileScript(JSContext *cx, HandleObject scopeChain, HandleScript evalCaller,
               const CompileOptions &options, const jschar *chars, size_t length,
               JSString *source_ = NULL, unsigned staticLevel = 0,
               SourceCompressionToken *extraSct = NULL);
 
 bool
 ParseScript(JSContext *cx, HandleObject scopeChain,
             const CompileOptions &options, StableCharPtr chars, size_t length);
--- a/js/src/frontend/NameFunctions.cpp
+++ b/js/src/frontend/NameFunctions.cpp
@@ -240,17 +240,17 @@ class NameResolver
          * other namespace are rather considered as "contributing" to the outer
          * function, so give them a contribution symbol here.
          */
         if (!buf.empty() && *(buf.end() - 1) == '/' && !buf.append("<"))
             return NULL;
         if (buf.empty())
             return NULL;
 
-        RawAtom atom = buf.finishAtom();
+        JSAtom *atom = buf.finishAtom();
         fun->setGuessedAtom(atom);
         return atom;
     }
 
     /*
      * Tests whether parents[pos] is a function call whose callee is cur.
      * This is the case for functions which do things like simply create a scope
      * for new variables and then return an anonymous function using this scope.
--- a/js/src/frontend/SharedContext-inl.h
+++ b/js/src/frontend/SharedContext-inl.h
@@ -118,17 +118,17 @@ frontend::LexicalLookup(ContextT *ct, Ha
         if (stmt->type == STMT_WITH)
             break;
 
         // Skip statements that do not introduce a new scope
         if (!stmt->isBlockScope)
             continue;
 
         StaticBlockObject &blockObj = *stmt->blockObj;
-        RawShape shape = blockObj.nativeLookup(ct->sc->context, id);
+        Shape *shape = blockObj.nativeLookup(ct->sc->context, id);
         if (shape) {
             JS_ASSERT(shape->hasShortID());
 
             if (slotp)
                 *slotp = blockObj.stackDepth() + shape->shortid();
             return stmt;
         }
     }
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -61,34 +61,34 @@ JS_PUBLIC_DATA(void * const) JS::NullPtr
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSObject *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSFunction *thing);
 
 static inline void
-PushMarkStack(GCMarker *gcmarker, RawScript thing);
+PushMarkStack(GCMarker *gcmarker, JSScript *thing);
 
 static inline void
-PushMarkStack(GCMarker *gcmarker, RawShape thing);
+PushMarkStack(GCMarker *gcmarker, Shape *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSString *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, types::TypeObject *thing);
 
 namespace js {
 namespace gc {
 
 static void MarkChildren(JSTracer *trc, JSString *str);
-static void MarkChildren(JSTracer *trc, RawScript script);
-static void MarkChildren(JSTracer *trc, RawShape shape);
-static void MarkChildren(JSTracer *trc, RawBaseShape base);
+static void MarkChildren(JSTracer *trc, JSScript *script);
+static void MarkChildren(JSTracer *trc, Shape *shape);
+static void MarkChildren(JSTracer *trc, BaseShape *base);
 static void MarkChildren(JSTracer *trc, types::TypeObject *type);
 static void MarkChildren(JSTracer *trc, ion::IonCode *code);
 
 } /* namespace gc */
 } /* namespace js */
 
 /*** Object Marking ***/
 
@@ -378,29 +378,29 @@ void
 gc::MarkKind(JSTracer *trc, void **thingp, JSGCTraceKind kind)
 {
     JS_ASSERT(thingp);
     JS_ASSERT(*thingp);
     DebugOnly<Cell *> cell = static_cast<Cell *>(*thingp);
     JS_ASSERT_IF(cell->isTenured(), kind == MapAllocToTraceKind(cell->tenuredGetAllocKind()));
     switch (kind) {
       case JSTRACE_OBJECT:
-        MarkInternal(trc, reinterpret_cast<RawObject *>(thingp));
+        MarkInternal(trc, reinterpret_cast<JSObject **>(thingp));
         break;
       case JSTRACE_STRING:
-        MarkInternal(trc, reinterpret_cast<RawString *>(thingp));
+        MarkInternal(trc, reinterpret_cast<JSString **>(thingp));
         break;
       case JSTRACE_SCRIPT:
-        MarkInternal(trc, reinterpret_cast<RawScript *>(thingp));
+        MarkInternal(trc, reinterpret_cast<JSScript **>(thingp));
         break;
       case JSTRACE_SHAPE:
-        MarkInternal(trc, reinterpret_cast<RawShape *>(thingp));
+        MarkInternal(trc, reinterpret_cast<Shape **>(thingp));
         break;
       case JSTRACE_BASE_SHAPE:
-        MarkInternal(trc, reinterpret_cast<RawBaseShape *>(thingp));
+        MarkInternal(trc, reinterpret_cast<BaseShape **>(thingp));
         break;
       case JSTRACE_TYPE_OBJECT:
         MarkInternal(trc, reinterpret_cast<types::TypeObject **>(thingp));
         break;
       case JSTRACE_IONCODE:
         MarkInternal(trc, reinterpret_cast<ion::IonCode **>(thingp));
         break;
     }
@@ -647,17 +647,17 @@ gc::MarkObjectSlots(JSTracer *trc, JSObj
     JS_ASSERT(obj->isNative());
     for (uint32_t i = start; i < (start + nslots); ++i) {
         JS_SET_TRACING_DETAILS(trc, js_GetObjectSlotName, obj, i);
         MarkValueInternal(trc, obj->nativeGetSlotRef(i).unsafeGet());
     }
 }
 
 static bool
-ShouldMarkCrossCompartment(JSTracer *trc, RawObject src, Cell *cell)
+ShouldMarkCrossCompartment(JSTracer *trc, JSObject *src, Cell *cell)
 {
     if (!IS_GC_MARKING_TRACER(trc))
         return true;
 
     JS::Zone *zone = cell->tenuredZone();
     uint32_t color = AsGCMarker(trc)->getMarkColor();
 
     JS_ASSERT(color == BLACK || color == GRAY);
@@ -685,41 +685,41 @@ ShouldMarkCrossCompartment(JSTracer *trc
                 DelayCrossCompartmentGrayMarking(src);
             return false;
         }
         return zone->isGCMarkingGray();
     }
 }
 
 void
-gc::MarkCrossCompartmentObjectUnbarriered(JSTracer *trc, RawObject src, JSObject **dst, const char *name)
+gc::MarkCrossCompartmentObjectUnbarriered(JSTracer *trc, JSObject *src, JSObject **dst, const char *name)
 {
     if (ShouldMarkCrossCompartment(trc, src, *dst))
         MarkObjectUnbarriered(trc, dst, name);
 }
 
 void
-gc::MarkCrossCompartmentScriptUnbarriered(JSTracer *trc, RawObject src, JSScript **dst,
-                                      const char *name)
+gc::MarkCrossCompartmentScriptUnbarriered(JSTracer *trc, JSObject *src, JSScript **dst,
+                                          const char *name)
 {
     if (ShouldMarkCrossCompartment(trc, src, *dst))
         MarkScriptUnbarriered(trc, dst, name);
 }
 
 void
-gc::MarkCrossCompartmentSlot(JSTracer *trc, RawObject src, HeapSlot *dst, const char *name)
+gc::MarkCrossCompartmentSlot(JSTracer *trc, JSObject *src, HeapSlot *dst, const char *name)
 {
     if (dst->isMarkable() && ShouldMarkCrossCompartment(trc, src, (Cell *)dst->toGCThing()))
         MarkSlot(trc, dst, name);
 }
 
 /*** Special Marking ***/
 
 void
-gc::MarkObject(JSTracer *trc, HeapPtr<GlobalObject, RawScript> *thingp, const char *name)
+gc::MarkObject(JSTracer *trc, HeapPtr<GlobalObject, JSScript *> *thingp, const char *name)
 {
     JS_SET_TRACING_NAME(trc, name);
     MarkInternal(trc, thingp->unsafeGet());
 }
 
 void
 gc::MarkValueUnbarriered(JSTracer *trc, Value *v, const char *name)
 {
@@ -774,35 +774,35 @@ PushMarkStack(GCMarker *gcmarker, types:
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
     JS_ASSERT(!IsInsideNursery(thing->runtime(), thing));
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushType(thing);
 }
 
 static void
-PushMarkStack(GCMarker *gcmarker, RawScript thing)
+PushMarkStack(GCMarker *gcmarker, JSScript *thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
     JS_ASSERT(!IsInsideNursery(thing->runtime(), thing));
 
     /*
      * We mark scripts directly rather than pushing on the stack as they can
      * refer to other scripts only indirectly (like via nested functions) and
      * we cannot get to deep recursion.
      */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         MarkChildren(gcmarker, thing);
 }
 
 static void
-ScanShape(GCMarker *gcmarker, RawShape shape);
+ScanShape(GCMarker *gcmarker, Shape *shape);
 
 static void
-PushMarkStack(GCMarker *gcmarker, RawShape thing)
+PushMarkStack(GCMarker *gcmarker, Shape *thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
     JS_ASSERT(!IsInsideNursery(thing->runtime(), thing));
 
     /* We mark shapes directly rather than pushing on the stack. */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         ScanShape(gcmarker, thing);
 }
@@ -813,48 +813,48 @@ PushMarkStack(GCMarker *gcmarker, ion::I
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
     JS_ASSERT(!IsInsideNursery(thing->runtime(), thing));
 
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         gcmarker->pushIonCode(thing);
 }
 
 static inline void
-ScanBaseShape(GCMarker *gcmarker, RawBaseShape base);
+ScanBaseShape(GCMarker *gcmarker, BaseShape *base);
 
 static void
-PushMarkStack(GCMarker *gcmarker, RawBaseShape thing)
+PushMarkStack(GCMarker *gcmarker, BaseShape *thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
     JS_ASSERT(!IsInsideNursery(thing->runtime(), thing));
 
     /* We mark base shapes directly rather than pushing on the stack. */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         ScanBaseShape(gcmarker, thing);
 }
 
 static void
-ScanShape(GCMarker *gcmarker, RawShape shape)
+ScanShape(GCMarker *gcmarker, Shape *shape)
 {
   restart:
     PushMarkStack(gcmarker, shape->base());
 
     const EncapsulatedId &id = shape->propidRef();
     if (JSID_IS_STRING(id))
         PushMarkStack(gcmarker, JSID_TO_STRING(id));
     else if (JS_UNLIKELY(JSID_IS_OBJECT(id)))
         PushMarkStack(gcmarker, JSID_TO_OBJECT(id));
 
     shape = shape->previous();
     if (shape && shape->markIfUnmarked(gcmarker->getMarkColor()))
         goto restart;
 }
 
 static inline void
-ScanBaseShape(GCMarker *gcmarker, RawBaseShape base)
+ScanBaseShape(GCMarker *gcmarker, BaseShape *base)
 {
     base->assertConsistency();
 
     base->compartment()->mark();
 
     if (base->hasGetterObject())
         PushMarkStack(gcmarker, base->getterObject());
 
@@ -868,17 +868,17 @@ ScanBaseShape(GCMarker *gcmarker, RawBas
     }
 
     /*
      * All children of the owned base shape are consistent with its
      * unowned one, thus we do not need to trace through children of the
      * unowned base shape.
      */
     if (base->isOwned()) {
-        RawUnownedBaseShape unowned = base->baseUnowned();
+        UnownedBaseShape *unowned = base->baseUnowned();
         JS_ASSERT(base->compartment() == unowned->compartment());
         unowned->markIfUnmarked(gcmarker->getMarkColor());
     }
 }
 
 static inline void
 ScanLinearString(GCMarker *gcmarker, JSLinearString *str)
 {
@@ -988,43 +988,43 @@ gc::MarkChildren(JSTracer *trc, JSString
 {
     if (str->hasBase())
         str->markBase(trc);
     else if (str->isRope())
         str->asRope().markChildren(trc);
 }
 
 static void
-gc::MarkChildren(JSTracer *trc, RawScript script)
+gc::MarkChildren(JSTracer *trc, JSScript *script)
 {
     script->markChildren(trc);
 }
 
 static void
-gc::MarkChildren(JSTracer *trc, RawShape shape)
+gc::MarkChildren(JSTracer *trc, Shape *shape)
 {
     shape->markChildren(trc);
 }
 
 static void
-gc::MarkChildren(JSTracer *trc, RawBaseShape base)
+gc::MarkChildren(JSTracer *trc, BaseShape *base)
 {
     base->markChildren(trc);
 }
 
 /*
  * This function is used by the cycle collector to trace through the
  * children of a BaseShape (and its baseUnowned(), if any). The cycle
  * collector does not directly care about BaseShapes, so only the
  * getter, setter, and parent are marked. Furthermore, the parent is
  * marked only if it isn't the same as prevParent, which will be
  * updated to the current shape's parent.
  */
 static inline void
-MarkCycleCollectorChildren(JSTracer *trc, RawBaseShape base, JSObject **prevParent)
+MarkCycleCollectorChildren(JSTracer *trc, BaseShape *base, JSObject **prevParent)
 {
     JS_ASSERT(base);
 
     /*
      * The cycle collector does not need to trace unowned base shapes,
      * as they have the same getter, setter and parent as the original
      * base shape.
      */
@@ -1054,17 +1054,17 @@ MarkCycleCollectorChildren(JSTracer *trc
  * This function is used by the cycle collector to trace through a
  * shape. The cycle collector does not care about shapes or base
  * shapes, so those are not marked. Instead, any shapes or base shapes
  * that are encountered have their children marked. Stack space is
  * bounded. If two shapes in a row have the same parent pointer, the
  * parent pointer will only be marked once.
  */
 void
-gc::MarkCycleCollectorChildren(JSTracer *trc, RawShape shape)
+gc::MarkCycleCollectorChildren(JSTracer *trc, Shape *shape)
 {
     JSObject *prevParent = NULL;
     do {
         MarkCycleCollectorChildren(trc, shape->base(), &prevParent);
         MarkId(trc, &shape->propidRef(), "propid");
         shape = shape->previous();
     } while (shape);
 }
@@ -1395,17 +1395,17 @@ GCMarker::processMarkStackTop(SliceBudge
         if (budget.isOverBudget()) {
             pushObject(obj);
             return;
         }
 
         types::TypeObject *type = obj->typeFromGC();
         PushMarkStack(this, type);
 
-        RawShape shape = obj->lastProperty();
+        Shape *shape = obj->lastProperty();
         PushMarkStack(this, shape);
 
         /* Call the trace hook if necessary. */
         Class *clasp = type->clasp;
         if (clasp->trace) {
             JS_ASSERT_IF(runtime->gcMode == JSGC_MODE_INCREMENTAL &&
                          runtime->gcIncrementalEnabled,
                          clasp->flags & JSCLASS_IMPLEMENTS_BARRIERS);
@@ -1486,37 +1486,37 @@ GCMarker::drainMarkStack(SliceBudget &bu
     return true;
 }
 
 void
 js::TraceChildren(JSTracer *trc, void *thing, JSGCTraceKind kind)
 {
     switch (kind) {
       case JSTRACE_OBJECT:
-        MarkChildren(trc, static_cast<RawObject>(thing));
+        MarkChildren(trc, static_cast<JSObject *>(thing));
         break;
 
       case JSTRACE_STRING:
-        MarkChildren(trc, static_cast<RawString>(thing));
+        MarkChildren(trc, static_cast<JSString *>(thing));
         break;
 
       case JSTRACE_SCRIPT:
-        MarkChildren(trc, static_cast<RawScript>(thing));
+        MarkChildren(trc, static_cast<JSScript *>(thing));
         break;
 
       case JSTRACE_SHAPE:
-        MarkChildren(trc, static_cast<RawShape>(thing));
+        MarkChildren(trc, static_cast<Shape *>(thing));
         break;
 
       case JSTRACE_IONCODE:
         MarkChildren(trc, (js::ion::IonCode *)thing);
         break;
 
       case JSTRACE_BASE_SHAPE:
-        MarkChildren(trc, static_cast<RawBaseShape>(thing));
+        MarkChildren(trc, static_cast<BaseShape *>(thing));
         break;
 
       case JSTRACE_TYPE_OBJECT:
         MarkChildren(trc, (types::TypeObject *)thing);
         break;
     }
 }
 
--- a/js/src/gc/Marking.h
+++ b/js/src/gc/Marking.h
@@ -199,29 +199,29 @@ MarkSlot(JSTracer *trc, HeapSlot *s, con
 
 void
 MarkArraySlots(JSTracer *trc, size_t len, HeapSlot *vec, const char *name);
 
 void
 MarkObjectSlots(JSTracer *trc, JSObject *obj, uint32_t start, uint32_t nslots);
 
 void
-MarkCrossCompartmentObjectUnbarriered(JSTracer *trc, RawObject src, JSObject **dst_obj,
+MarkCrossCompartmentObjectUnbarriered(JSTracer *trc, JSObject *src, JSObject **dst_obj,
                                       const char *name);
 
 void
-MarkCrossCompartmentScriptUnbarriered(JSTracer *trc, RawObject src, JSScript **dst_script,
+MarkCrossCompartmentScriptUnbarriered(JSTracer *trc, JSObject *src, JSScript **dst_script,
                                       const char *name);
 
 /*
  * Mark a value that may be in a different compartment from the compartment
  * being GC'd. (Although it won't be marked if it's in the wrong compartment.)
  */
 void
-MarkCrossCompartmentSlot(JSTracer *trc, RawObject src, HeapSlot *dst_slot, const char *name);
+MarkCrossCompartmentSlot(JSTracer *trc, JSObject *src, HeapSlot *dst_slot, const char *name);
 
 
 /*** Special Cases ***/
 
 /*
  * The unioned HeapPtr stored in script->globalObj needs special treatment to
  * typecheck correctly.
  */
@@ -240,17 +240,17 @@ void
 MarkChildren(JSTracer *trc, JSObject *obj);
 
 /*
  * Trace through the shape and any shapes it contains to mark
  * non-shape children. This is exposed to the JS API as
  * JS_TraceShapeCycleCollectorChildren.
  */
 void
-MarkCycleCollectorChildren(JSTracer *trc, RawShape shape);
+MarkCycleCollectorChildren(JSTracer *trc, Shape *shape);
 
 void
 PushArena(GCMarker *gcmarker, ArenaHeader *aheader);
 
 /*** Generic ***/
 
 /*
  * The Mark() functions interface should only be used by code that must be
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -479,41 +479,41 @@ AutoGCRooter::trace(JSTracer *trc)
         AutoScriptVector::VectorImpl &vector = static_cast<AutoScriptVector *>(this)->vector;
         MarkScriptRootRange(trc, vector.length(), vector.begin(), "js::AutoScriptVector.vector");
         return;
       }
 
       case OBJOBJHASHMAP: {
         AutoObjectObjectHashMap::HashMapImpl &map = static_cast<AutoObjectObjectHashMap *>(this)->map;
         for (AutoObjectObjectHashMap::Enum e(map); !e.empty(); e.popFront()) {
-            mozilla::DebugOnly<RawObject> key = e.front().key;
-            MarkObjectRoot(trc, (RawObject *) &e.front().key, "AutoObjectObjectHashMap key");
+            mozilla::DebugOnly<JSObject *> key = e.front().key;
+            MarkObjectRoot(trc, const_cast<JSObject **>(&e.front().key), "AutoObjectObjectHashMap key");
             JS_ASSERT(key == e.front().key);  // Needs rewriting for moving GC, see bug 726687.
             MarkObjectRoot(trc, &e.front().value, "AutoObjectObjectHashMap value");
         }
         return;
       }
 
       case OBJU32HASHMAP: {
         AutoObjectUnsigned32HashMap *self = static_cast<AutoObjectUnsigned32HashMap *>(this);
         AutoObjectUnsigned32HashMap::HashMapImpl &map = self->map;
         for (AutoObjectUnsigned32HashMap::Enum e(map); !e.empty(); e.popFront()) {
-            mozilla::DebugOnly<RawObject> key = e.front().key;
-            MarkObjectRoot(trc, (RawObject *) &e.front().key, "AutoObjectUnsignedHashMap key");
+            mozilla::DebugOnly<JSObject *> key = e.front().key;
+            MarkObjectRoot(trc, const_cast<JSObject **>(&e.front().key), "AutoObjectUnsignedHashMap key");
             JS_ASSERT(key == e.front().key);  // Needs rewriting for moving GC, see bug 726687.
         }
         return;
       }
 
       case OBJHASHSET: {
         AutoObjectHashSet *self = static_cast<AutoObjectHashSet *>(this);
         AutoObjectHashSet::HashSetImpl &set = self->set;
         for (AutoObjectHashSet::Enum e(set); !e.empty(); e.popFront()) {
-            mozilla::DebugOnly<RawObject> obj = e.front();
-            MarkObjectRoot(trc, (RawObject *) &e.front(), "AutoObjectHashSet value");
+            mozilla::DebugOnly<JSObject *> obj = e.front();
+            MarkObjectRoot(trc, const_cast<JSObject **>(&e.front()), "AutoObjectHashSet value");
             JS_ASSERT(obj == e.front());  // Needs rewriting for moving GC, see bug 726687.
         }
         return;
       }
 
       case HASHABLEVALUE: {
         AutoHashableValueRooter *rooter = static_cast<AutoHashableValueRooter *>(this);
         rooter->trace(trc);
@@ -644,16 +644,40 @@ JSPropertyDescriptor::trace(JSTracer *tr
     }
     if ((attrs & JSPROP_SETTER) && setter) {
         JSObject *tmp = JS_FUNC_TO_DATA_PTR(JSObject *, setter);
         MarkObjectRoot(trc, &tmp, "Descriptor::set");
         setter = JS_DATA_TO_FUNC_PTR(JSStrictPropertyOp, tmp);
     }
 }
 
+static inline void
+MarkGlobalForMinorGC(JSTracer *trc, JSCompartment *compartment)
+{
+#ifdef JS_ION
+    /*
+     * Named properties of globals which have had Ion activity are treated as
+     * roots during minor GCs. This allows writes to globals to occur without
+     * needing a write barrier.
+     */
+    JS_ASSERT(trc->runtime->isHeapMinorCollecting());
+
+    if (!compartment->ionCompartment())
+        return;
+
+    GlobalObject *global = compartment->maybeGlobal();
+    if (!global)
+        return;
+
+    /* Global reserved slots never hold nursery things. */
+    for (size_t i = JSCLASS_RESERVED_SLOTS(global->getClass()); i < global->slotSpan(); ++i)
+        MarkValueRoot(trc, global->nativeGetSlotRef(i).unsafeGet(), "MinorGlobalRoot");
+#endif /* JS_ION */
+}
+
 void
 js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
 {
     JSRuntime *rt = trc->runtime;
     JS_ASSERT(trc->callback != GCMarker::GrayCallback);
 
     JS_ASSERT(!rt->mainThread.suppressGC);
 
@@ -732,16 +756,19 @@ js::gc::MarkRuntime(JSTracer *trc, bool 
         }
     }
 
     /* We can't use GCCompartmentsIter if we're called from TraceRuntime. */
     for (CompartmentsIter c(rt); !c.done(); c.next()) {
         if (IS_GC_MARKING_TRACER(trc) && !c->zone()->isCollecting())
             continue;
 
+        if (trc->runtime->isHeapMinorCollecting())
+            MarkGlobalForMinorGC(trc, c);
+
         /* During a GC, these are treated as weak pointers. */
         if (!IS_GC_MARKING_TRACER(trc)) {
             if (c->watchpointMap)
                 c->watchpointMap->markAll(trc);
         }
 
         /* Mark debug scopes, if present */
         if (c->debugScopes)
--- a/js/src/gdb/tests/test-JSObject.cpp
+++ b/js/src/gdb/tests/test-JSObject.cpp
@@ -7,33 +7,33 @@ FRAGMENT(JSObject, simple) {
                                                               JS_GetGlobalObject(cx), "dys"));
   JS::Rooted<JSObject *> anon(cx, (JSObject *) JS_NewFunction(cx, (JSNative) 1, 0, 0,
                                                               JS_GetGlobalObject(cx), 0));
   JS::Rooted<JSFunction *> funcPtr(cx, JS_NewFunction(cx, (JSNative) 1, 0, 0,
                                                       JS_GetGlobalObject(cx), "formFollows"));
 
   JSObject &plainRef = *plain;
   JSFunction &funcRef = *funcPtr;
-  js::RawObject plainRaw = plain;
-  js::RawObject funcRaw = func;
+  JSObject *plainRaw = plain;
+  JSObject *funcRaw = func;
 
   breakpoint();
 
   (void) glob;
   (void) plain;
   (void) func;
   (void) anon;
   (void) funcPtr;
   (void) &plainRef;
   (void) &funcRef;
   (void) plainRaw;
   (void) funcRaw;
 }
 
 FRAGMENT(JSObject, null) {
   JS::Rooted<JSObject *> null(cx, NULL);
-  js::RawObject nullRaw = null;
+  JSObject *nullRaw = null;
 
   breakpoint();
 
   (void) null;
   (void) nullRaw;
 }
--- a/js/src/gdb/tests/test-JSObject.py
+++ b/js/src/gdb/tests/test-JSObject.py
@@ -13,10 +13,8 @@ run_fragment('JSObject.simple')
 assert_pretty('glob', '(JSObject *)  [object global] delegate')
 assert_pretty('plain', '(JSObject *)  [object Object]')
 assert_pretty('func', '(JSObject *)  [object Function "dys"]')
 assert_pretty('anon', '(JSObject *)  [object Function <unnamed>]')
 assert_pretty('funcPtr', '(JSFunction *)  [object Function "formFollows"]')
 
 assert_pretty('plainRef', '(JSObject &) @ [object Object]')
 assert_pretty('funcRef', '(JSFunction &) @ [object Function "formFollows"]')
-assert_pretty('plainRaw', '(js::RawObject)  [object Object]')
-assert_pretty('funcRaw', '(js::RawObject)  [object Function "dys"]')
--- a/js/src/gdb/tests/test-JSString.cpp
+++ b/js/src/gdb/tests/test-JSString.cpp
@@ -19,32 +19,32 @@ FRAGMENT(JSString, simple) {
 
   // This may well be an inlined string.
   JS::Rooted<JSString *> xz(cx, JS_ConcatStrings(cx, x, z));
 
   // This will probably be a rope.
   JS::Rooted<JSString *> doubleStars(cx, JS_ConcatStrings(cx, stars, stars));
 
   // Ensure we're not confused by typedefs for pointer types.
-  js::RawString xRaw = x;
+  JSString *xRaw = x;
 
   breakpoint();
 
   (void) empty;
   (void) x;
   (void) z;
   (void) stars;
   (void) xz;
   (void) doubleStars;
   (void) xRaw;
 }
 
 FRAGMENT(JSString, null) {
   JS::Rooted<JSString *> null(cx, NULL);
-  js::RawString nullRaw = null;
+  JSString *nullRaw = null;
 
   breakpoint();
 
   (void) null;
   (void) nullRaw;
 }
 
 FRAGMENT(JSString, subclasses) {
--- a/js/src/ion/AsmJS.cpp
+++ b/js/src/ion/AsmJS.cpp
@@ -2276,17 +2276,17 @@ class FunctionCompiler
 
 /*****************************************************************************/
 // An AsmJSModule contains the persistent results of asm.js module compilation,
 // viz., the jit code and dynamic link information.
 //
 // An AsmJSModule object is created at the end of module compilation and
 // subsequently owned by an AsmJSModuleClass JSObject.
 
-static void AsmJSModuleObject_finalize(FreeOp *fop, RawObject obj);
+static void AsmJSModuleObject_finalize(FreeOp *fop, JSObject *obj);
 static void AsmJSModuleObject_trace(JSTracer *trc, JSObject *obj);
 
 static const unsigned ASM_CODE_RESERVED_SLOT = 0;
 static const unsigned ASM_CODE_NUM_RESERVED_SLOTS = 1;
 
 static Class AsmJSModuleClass = {
     "AsmJSModuleObject",
     JSCLASS_IS_ANONYMOUS | JSCLASS_IMPLEMENTS_BARRIERS |
@@ -2329,17 +2329,17 @@ js::AsmJSModuleObject(JSFunction *module
 
 void
 js::SetAsmJSModuleObject(JSFunction *moduleFun, JSObject *moduleObj)
 {
     moduleFun->setExtendedSlot(ASM_MODULE_FUNCTION_MODULE_OBJECT_SLOT, OBJECT_TO_JSVAL(moduleObj));
 }
 
 static void
-AsmJSModuleObject_finalize(FreeOp *fop, RawObject obj)
+AsmJSModuleObject_finalize(FreeOp *fop, JSObject *obj)
 {
     fop->delete_(&AsmJSModuleObjectToModule(obj));
 }
 
 static void
 AsmJSModuleObject_trace(JSTracer *trc, JSObject *obj)
 {
     AsmJSModuleObjectToModule(obj).trace(trc);
--- a/js/src/ion/AsmJSModule.h
+++ b/js/src/ion/AsmJSModule.h
@@ -429,17 +429,17 @@ class AsmJSModule
     bool addExit(unsigned ffiIndex, unsigned *exitIndex) {
         *exitIndex = unsigned(exits_.length());
         return exits_.append(Exit(ffiIndex));
     }
     bool addFunctionCounts(ion::IonScriptCounts *counts) {
         return functionCounts_.append(counts);
     }
 
-    bool addExportedFunction(RawFunction fun, PropertyName *maybeFieldName,
+    bool addExportedFunction(JSFunction *fun, PropertyName *maybeFieldName,
                              MoveRef<ArgCoercionVector> argCoercions, ReturnType returnType)
     {
         ExportedFunction func(fun, maybeFieldName, argCoercions, returnType);
         return exports_.append(Move(func));
     }
     unsigned numExportedFunctions() const {
         return exports_.length();
     }
--- a/js/src/ion/Bailouts.cpp
+++ b/js/src/ion/Bailouts.cpp
@@ -57,17 +57,17 @@ IonBailoutIterator::dump() const
                 break;
             ++frames;
         }
     } else {
         IonFrameIterator::dump();
     }
 }
 
-static RawScript
+static JSScript *
 GetBailedJSScript(JSContext *cx)
 {
     // Just after the frame conversion, we can safely interpret the ionTop as JS
     // frame because it targets the bailed JS frame converted to an exit frame.
     IonJSFrameLayout *frame = reinterpret_cast<IonJSFrameLayout*>(cx->mainThread().ionTop);
     switch (GetCalleeTokenTag(frame->calleeToken())) {
       case CalleeToken_Function: {
         JSFunction *fun = CalleeTokenToFunction(frame->calleeToken());
@@ -525,17 +525,17 @@ ion::EnsureHasScopeObjects(JSContext *cx
     }
     return true;
 }
 
 uint32_t
 ion::BoundsCheckFailure()
 {
     JSContext *cx = GetIonContext()->cx;
-    RawScript script = GetBailedJSScript(cx);
+    JSScript *script = GetBailedJSScript(cx);
 
     IonSpew(IonSpew_Bailouts, "Bounds check failure %s:%d", script->filename(),
             script->lineno);
 
     if (!script->failedBoundsCheck) {
         script->failedBoundsCheck = true;
 
         // Invalidate the script to force a recompile.
@@ -546,32 +546,32 @@ ion::BoundsCheckFailure()
 
     return true;
 }
 
 uint32_t
 ion::ShapeGuardFailure()
 {
     JSContext *cx = GetIonContext()->cx;
-    RawScript script = GetBailedJSScript(cx);
+    JSScript *script = GetBailedJSScript(cx);
 
     JS_ASSERT(!script->ionScript()->invalidated());
 
     script->failedShapeGuard = true;
 
     IonSpew(IonSpew_Invalidate, "Invalidating due to shape guard failure");
 
     return Invalidate(cx, script);
 }
 
 uint32_t
 ion::CachedShapeGuardFailure()
 {
     JSContext *cx = GetIonContext()->cx;
-    RawScript script = GetBailedJSScript(cx);
+    JSScript *script = GetBailedJSScript(cx);
 
     JS_ASSERT(!script->ionScript()->invalidated());
 
     script->failedShapeGuard = true;
 
     // Purge JM caches in the script and all inlined script, to avoid baking in
     // the same shape guard next time.
     for (size_t i = 0; i < script->ionScript()->scriptEntries(); i++)
--- a/js/src/ion/BaselineCompiler.cpp
+++ b/js/src/ion/BaselineCompiler.cpp
@@ -1684,17 +1684,17 @@ Address
 BaselineCompiler::getScopeCoordinateAddress(Register reg)
 {
     ScopeCoordinate sc(pc);
 
     masm.loadPtr(frame.addressOfScopeChain(), reg);
     for (unsigned i = sc.hops; i; i--)
         masm.extractObject(Address(reg, ScopeObject::offsetOfEnclosingScope()), reg);
 
-    RawShape shape = ScopeCoordinateToStaticScopeShape(cx, script, pc);
+    Shape *shape = ScopeCoordinateToStaticScopeShape(cx, script, pc);
     Address addr;
     if (shape->numFixedSlots() <= sc.slot) {
         masm.loadPtr(Address(reg, JSObject::offsetOfSlots()), reg);
         return Address(reg, (sc.slot - shape->numFixedSlots()) * sizeof(Value));
     }
 
     return Address(reg, JSObject::getFixedSlotOffset(sc.slot));
 }
--- a/js/src/ion/BaselineIC.cpp
+++ b/js/src/ion/BaselineIC.cpp
@@ -776,17 +776,17 @@ PrepareOsrTempData(JSContext *cx, ICUseC
     // Initialize ScopeChain, Exec, and Flags fields in StackFrame struct.
     uint8_t *stackFrame = info->stackFrame;
     *((JSObject **) (stackFrame + StackFrame::offsetOfScopeChain())) = frame->scopeChain();
     if (frame->isFunctionFrame()) {
         // Store the function in exec field, and StackFrame::FUNCTION for flags.
         *((JSFunction **) (stackFrame + StackFrame::offsetOfExec())) = frame->fun();
         *((uint32_t *) (stackFrame + StackFrame::offsetOfFlags())) = StackFrame::FUNCTION;
     } else {
-        *((RawScript *) (stackFrame + StackFrame::offsetOfExec())) = frame->script();
+        *((JSScript **) (stackFrame + StackFrame::offsetOfExec())) = frame->script();
         *((uint32_t *) (stackFrame + StackFrame::offsetOfFlags())) = 0;
     }
 
     // Do locals and stack values.  Note that in the fake StackFrame, these go from
     // low to high addresses, while on the C stack, they go from high to low addresses.
     // So we can't use memcpy on this, but must copy the values in reverse order.
     Value *stackFrameLocalsStart = (Value *) (stackFrame + sizeof(StackFrame));
     for (size_t i = 0; i < numLocalsAndStackVals; i++)
@@ -1263,17 +1263,17 @@ ICTypeMonitor_TypeObject::Compiler::gene
 
     masm.bind(&failure);
     EmitStubGuardFailure(masm);
     return true;
 }
 
 bool
 ICUpdatedStub::addUpdateStubForValue(JSContext *cx, HandleScript script, HandleObject obj,
-                                     RawId id, HandleValue val)
+                                     jsid id, HandleValue val)
 {
     if (numOptimizedStubs_ >= MAX_OPTIMIZED_STUBS) {
         // TODO: if the TypeSet becomes unknown or has the AnyObject type,
         // replace stubs with a single stub to handle these.
         return true;
     }
 
     types::EnsureTrackPropertyTypes(cx, obj, id);
@@ -1526,17 +1526,17 @@ ICThis_Fallback::Compiler::generateStubC
 //
 
 static bool
 DoNewArray(JSContext *cx, ICNewArray_Fallback *stub, uint32_t length,
            HandleTypeObject type, MutableHandleValue res)
 {
     FallbackICSpew(cx, stub, "NewArray");
 
-    RawObject obj = NewInitArray(cx, length, type);
+    JSObject *obj = NewInitArray(cx, length, type);
     if (!obj)
         return false;
 
     res.setObject(*obj);
     return true;
 }
 
 typedef bool(*DoNewArrayFn)(JSContext *, ICNewArray_Fallback *, uint32_t, HandleTypeObject,
@@ -1560,17 +1560,17 @@ ICNewArray_Fallback::Compiler::generateS
 //
 
 static bool
 DoNewObject(JSContext *cx, ICNewObject_Fallback *stub, HandleObject templateObject,
             MutableHandleValue res)
 {
     FallbackICSpew(cx, stub, "NewObject");
 
-    RawObject obj = NewInitObject(cx, templateObject);
+    JSObject *obj = NewInitObject(cx, templateObject);
     if (!obj)
         return false;
 
     res.setObject(*obj);
     return true;
 }
 
 typedef bool(*DoNewObjectFn)(JSContext *, ICNewObject_Fallback *, HandleObject,
@@ -1654,17 +1654,17 @@ DoCompareFallback(JSContext *cx, Baselin
 
     // Check to see if a new stub should be generated.
     if (stub->numOptimizedStubs() >= ICCompare_Fallback::MAX_OPTIMIZED_STUBS) {
         // TODO: Discard all stubs in this IC and replace with inert megamorphic stub.
         // But for now we just bail.
         return true;
     }
 
-    RawScript script = frame->script();
+    JSScript *script = frame->script();
 
     // Try to generate new stubs.
     if (lhs.isInt32() && rhs.isInt32()) {
         IonSpew(IonSpew_BaselineIC, "  Generating %s(Int32, Int32) stub", js_CodeName[op]);
         ICCompare_Int32::Compiler compiler(cx, op);
         ICStub *int32Stub = compiler.getStub(compiler.getStubSpace(script));
         if (!int32Stub)
             return false;
@@ -2065,17 +2065,17 @@ DoToBoolFallback(JSContext *cx, Baseline
     if (stub->numOptimizedStubs() >= ICToBool_Fallback::MAX_OPTIMIZED_STUBS) {
         // TODO: Discard all stubs in this IC and replace with inert megamorphic stub.
         // But for now we just bail.
         return true;
     }
 
     JS_ASSERT(!arg.isBoolean());
 
-    RawScript script = frame->script();
+    JSScript *script = frame->script();
 
     // Try to generate new stubs.
     if (arg.isInt32()) {
         IonSpew(IonSpew_BaselineIC, "  Generating ToBool(Int32) stub.");
         ICToBool_Int32::Compiler compiler(cx);
         ICStub *int32Stub = compiler.getStub(compiler.getStubSpace(script));
         if (!int32Stub)
             return false;
@@ -2563,19 +2563,19 @@ ICBinaryArith_Fallback::Compiler::genera
     return tailCallVM(DoBinaryArithFallbackInfo, masm);
 }
 
 static bool
 DoConcatStrings(JSContext *cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
 {
     JS_ASSERT(lhs.isString());
     JS_ASSERT(rhs.isString());
-    RawString lstr = lhs.toString();
-    RawString rstr = rhs.toString();
-    RawString result = ConcatStrings<NoGC>(cx, lstr, rstr);
+    JSString *lstr = lhs.toString();
+    JSString *rstr = rhs.toString();
+    JSString *result = ConcatStrings<NoGC>(cx, lstr, rstr);
     if (result) {
         res.set(StringValue(result));
         return true;
     }
 
     RootedString rootedl(cx, lstr), rootedr(cx, rstr);
     result = ConcatStrings<CanGC>(cx, rootedl, rootedr);
     if (!result)
@@ -2604,32 +2604,32 @@ ICBinaryArith_StringConcat::Compiler::ge
         return false;
 
     // Failure case - jump to next stub
     masm.bind(&failure);
     EmitStubGuardFailure(masm);
     return true;
 }
 
-static RawString
+static JSString *
 ConvertObjectToStringForConcat(JSContext *cx, HandleValue obj)
 {
     JS_ASSERT(obj.isObject());
     RootedValue rootedObj(cx, obj);
     if (!ToPrimitive(cx, &rootedObj))
         return NULL;
     return ToString<CanGC>(cx, rootedObj);
 }
 
 static bool
 DoConcatStringObject(JSContext *cx, bool lhsIsString, HandleValue lhs, HandleValue rhs,
                      MutableHandleValue res)
 {
-    RawString lstr = NULL;
-    RawString rstr = NULL;
+    JSString *lstr = NULL;
+    JSString *rstr = NULL;
     if (lhsIsString) {
         // Convert rhs first.
         JS_ASSERT(lhs.isString() && rhs.isObject());
         rstr = ConvertObjectToStringForConcat(cx, rhs);
         if (!rstr)
             return false;
 
         // lhs is already string.
--- a/js/src/ion/BaselineIC.h
+++ b/js/src/ion/BaselineIC.h
@@ -910,17 +910,17 @@ class ICUpdatedStub : public ICStub
       : ICStub(kind, ICStub::Updated, stubCode),
         firstUpdateStub_(NULL),
         numOptimizedStubs_(0)
     {}
 
   public:
     bool initUpdatingChain(JSContext *cx, ICStubSpace *space);
 
-    bool addUpdateStubForValue(JSContext *cx, HandleScript script, HandleObject obj, RawId id,
+    bool addUpdateStubForValue(JSContext *cx, HandleScript script, HandleObject obj, jsid id,
                                HandleValue val);
 
     void addOptimizedUpdateStub(ICStub *stub) {
         if (firstUpdateStub_->isTypeUpdate_Fallback()) {
             stub->setNext(firstUpdateStub_);
             firstUpdateStub_ = stub;
         } else {
             ICStub *iter = firstUpdateStub_;
@@ -2975,17 +2975,17 @@ class ICGetElem_Dense : public ICMonitor
     class Compiler : public ICStubCompiler {
       ICStub *firstMonitorStub_;
       RootedShape shape_;
 
       protected:
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx, ICStub *firstMonitorStub, RawShape shape)
+        Compiler(JSContext *cx, ICStub *firstMonitorStub, Shape *shape)
           : ICStubCompiler(cx, ICStub::GetElem_Dense),
             firstMonitorStub_(firstMonitorStub),
             shape_(cx, shape)
         {}
 
         ICStub *getStub(ICStubSpace *space) {
             return ICGetElem_Dense::New(space, getStubCode(), firstMonitorStub_, shape_);
         }
@@ -3025,17 +3025,17 @@ class ICGetElem_TypedArray : public ICSt
       protected:
         bool generateStubCode(MacroAssembler &masm);
 
         virtual int32_t getKey() const {
             return static_cast<int32_t>(kind) | (static_cast<int32_t>(type_) << 16);
         }
 
       public:
-        Compiler(JSContext *cx, RawShape shape, uint32_t type)
+        Compiler(JSContext *cx, Shape *shape, uint32_t type)
           : ICStubCompiler(cx, ICStub::GetElem_TypedArray),
             shape_(cx, shape),
             type_(type)
         {}
 
         ICStub *getStub(ICStubSpace *space) {
             return ICGetElem_TypedArray::New(space, getStubCode(), shape_, type_);
         }
@@ -3166,17 +3166,17 @@ class ICSetElem_Dense : public ICUpdated
         // Compiler is only live on stack during compilation, it should
         // outlive any RootedTypeObject it's passed.  So it can just
         // use the handle.
         HandleTypeObject type_;
 
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx, RawShape shape, HandleTypeObject type)
+        Compiler(JSContext *cx, Shape *shape, HandleTypeObject type)
           : ICStubCompiler(cx, ICStub::SetElem_Dense),
             shape_(cx, shape),
             type_(type)
         {}
 
         ICUpdatedStub *getStub(ICStubSpace *space) {
             ICSetElem_Dense *stub = ICSetElem_Dense::New(space, getStubCode(), shape_, type_);
             if (!stub || !stub->initUpdatingChain(cx, space))
@@ -3333,17 +3333,17 @@ class ICSetElem_TypedArray : public ICSt
         bool generateStubCode(MacroAssembler &masm);
 
         virtual int32_t getKey() const {
             return static_cast<int32_t>(kind) | (static_cast<int32_t>(type_) << 16) |
                    (static_cast<int32_t>(expectOutOfBounds_) << 24);
         }
 
       public:
-        Compiler(JSContext *cx, RawShape shape, uint32_t type, bool expectOutOfBounds)
+        Compiler(JSContext *cx, Shape *shape, uint32_t type, bool expectOutOfBounds)
           : ICStubCompiler(cx, ICStub::SetElem_TypedArray),
             shape_(cx, shape),
             type_(type),
             expectOutOfBounds_(expectOutOfBounds)
         {}
 
         ICStub *getStub(ICStubSpace *space) {
             return ICSetElem_TypedArray::New(space, getStubCode(), shape_, type_,
--- a/js/src/ion/BaselineInspector.cpp
+++ b/js/src/ion/BaselineInspector.cpp
@@ -37,17 +37,17 @@ BaselineInspector::maybeShapesForPropert
     if (!hasBaselineScript())
         return true;
 
     JS_ASSERT(isValidPC(pc));
     const ICEntry &entry = icEntryFromPC(pc);
 
     ICStub *stub = entry.firstStub();
     while (stub->next()) {
-        RawShape shape;
+        Shape *shape;
         if (stub->isGetProp_Native()) {
             shape = stub->toGetProp_Native()->shape();
         } else if (stub->isSetProp_Native()) {
             shape = stub->toSetProp_Native()->shape();
         } else {
             shapes.clear();
             return true;
         }
--- a/js/src/ion/BaselineInspector.h
+++ b/js/src/ion/BaselineInspector.h
@@ -44,17 +44,17 @@ class SetElemICInspector : public ICInsp
 
 class BaselineInspector
 {
   private:
     RootedScript script;
     ICEntry *prevLookedUpEntry;
 
   public:
-    BaselineInspector(JSContext *cx, RawScript rawScript)
+    BaselineInspector(JSContext *cx, JSScript *rawScript)
       : script(cx, rawScript), prevLookedUpEntry(NULL)
     {
         JS_ASSERT(script);
     }
 
     bool hasBaselineScript() const {
         return script->hasBaselineScript();
     }
--- a/js/src/ion/BaselineJIT.cpp
+++ b/js/src/ion/BaselineJIT.cpp
@@ -654,17 +654,17 @@ BaselineScript::pcForReturnAddress(JSScr
 {
     JS_ASSERT(script->baselineScript() == this);
     JS_ASSERT(nativeAddress >= method_->raw());
     JS_ASSERT(nativeAddress < method_->raw() + method_->instructionsSize());
     return pcForReturnOffset(script, uint32_t(nativeAddress - method_->raw()));
 }
 
 void
-BaselineScript::toggleDebugTraps(RawScript script, jsbytecode *pc)
+BaselineScript::toggleDebugTraps(JSScript *script, jsbytecode *pc)
 {
     JS_ASSERT(script->baselineScript() == this);
 
     SrcNoteLineScanner scanner(script->notes(), script->lineno);
 
     IonContext ictx(script->compartment(), NULL);
     AutoFlushCache afc("DebugTraps");
 
@@ -774,17 +774,17 @@ BaselineScript::purgeOptimizedStubs(Zone
             JS_ASSERT(stub->allocatedInFallbackSpace());
             stub = stub->next();
         }
     }
 #endif
 }
 
 void
-ion::FinishDiscardBaselineScript(FreeOp *fop, RawScript script)
+ion::FinishDiscardBaselineScript(FreeOp *fop, JSScript *script)
 {
     if (!script->hasBaselineScript())
         return;
 
     if (script->baselineScript()->active()) {
         // Script is live on the stack. Keep the BaselineScript, but destroy
         // stubs allocated in the optimized stub space.
         script->baselineScript()->purgeOptimizedStubs(script->zone());
--- a/js/src/ion/BaselineJIT.h
+++ b/js/src/ion/BaselineJIT.h
@@ -238,17 +238,17 @@ struct BaselineScript
     void copyPCMappingEntries(const CompactBufferWriter &entries);
     uint8_t *nativeCodeForPC(JSScript *script, jsbytecode *pc, PCMappingSlotInfo *slotInfo = NULL);
     jsbytecode *pcForReturnOffset(JSScript *script, uint32_t nativeOffset);
     jsbytecode *pcForReturnAddress(JSScript *script, uint8_t *nativeAddress);
 
     // Toggle debug traps (used for breakpoints and step mode) in the script.
     // If |pc| is NULL, toggle traps for all ops in the script. Else, only
     // toggle traps at |pc|.
-    void toggleDebugTraps(RawScript script, jsbytecode *pc);
+    void toggleDebugTraps(JSScript *script, jsbytecode *pc);
 
     void toggleSPS(bool enable);
 
     static size_t offsetOfFlags() {
         return offsetof(BaselineScript, flags_);
     }
 };
 
@@ -263,17 +263,17 @@ CanEnterBaselineJIT(JSContext *cx, JSScr
 
 IonExecStatus
 EnterBaselineMethod(JSContext *cx, StackFrame *fp);
 
 IonExecStatus
 EnterBaselineAtBranch(JSContext *cx, StackFrame *fp, jsbytecode *pc);
 
 void
-FinishDiscardBaselineScript(FreeOp *fop, RawScript script);
+FinishDiscardBaselineScript(FreeOp *fop, JSScript *script);
 
 void
 SizeOfBaselineData(JSScript *script, JSMallocSizeOfFun mallocSizeOf, size_t *data,
                    size_t *fallbackStubs);
 
 void
 ToggleBaselineSPS(JSRuntime *runtime, bool enable);
 
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -934,17 +934,17 @@ CodeGenerator::emitGetPropertyPolymorphi
 
     masm.loadObjShape(obj, scratch);
 
     Label done;
     for (size_t i = 0; i < mir->numShapes(); i++) {
         Label next;
         masm.branchPtr(Assembler::NotEqual, scratch, ImmGCPtr(mir->objShape(i)), &next);
 
-        RawShape shape = mir->shape(i);
+        Shape *shape = mir->shape(i);
         if (shape->slot() < shape->numFixedSlots()) {
             // Fixed slot.
             masm.loadTypedOrValue(Address(obj, JSObject::getFixedSlotOffset(shape->slot())),
                                   output);
         } else {
             // Dynamic slot.
             uint32_t offset = (shape->slot() - shape->numFixedSlots()) * sizeof(js::Value);
             masm.loadPtr(Address(obj, JSObject::offsetOfSlots()), scratch);
@@ -991,17 +991,17 @@ CodeGenerator::emitSetPropertyPolymorphi
 
     masm.loadObjShape(obj, scratch);
 
     Label done;
     for (size_t i = 0; i < mir->numShapes(); i++) {
         Label next;
         masm.branchPtr(Assembler::NotEqual, scratch, ImmGCPtr(mir->objShape(i)), &next);
 
-        RawShape shape = mir->shape(i);
+        Shape *shape = mir->shape(i);
         if (shape->slot() < shape->numFixedSlots()) {
             // Fixed slot.
             Address addr(obj, JSObject::getFixedSlotOffset(shape->slot()));
             if (mir->needsBarrier())
                 emitPreBarrier(addr, MIRType_Value);
             masm.storeConstantOrRegister(value, addr);
         } else {
             // Dynamic slot.
@@ -1526,31 +1526,31 @@ CodeGenerator::emitParCallToUncompiledSc
 }
 
 bool
 CodeGenerator::visitCallKnown(LCallKnown *call)
 {
     Register calleereg = ToRegister(call->getFunction());
     Register objreg    = ToRegister(call->getTempObject());
     uint32_t unusedStack = StackOffsetOfPassedArg(call->argslot());
-    RawFunction target = call->getSingleTarget();
+    JSFunction *target = call->getSingleTarget();
     ExecutionMode executionMode = gen->info().executionMode();
     Label end, uncompiled;
 
     // Native single targets are handled by LCallNative.
     JS_ASSERT(!target->isNative());
     // Missing arguments must have been explicitly appended by the IonBuilder.
     JS_ASSERT(target->nargs <= call->numStackArgs());
 
     masm.checkStackAlignment();
 
     // If the function is known to be uncompilable, just emit the call to
     // Invoke in sequential mode, else mark as cannot compile.
     JS_ASSERT(call->mir()->hasRootedScript());
-    RawScript targetScript = target->nonLazyScript();
+    JSScript *targetScript = target->nonLazyScript();
     if (GetIonScript(targetScript, executionMode) == ION_DISABLED_SCRIPT) {
         if (executionMode == ParallelExecution)
             return false;
 
         if (!emitCallInvokeFunction(call, calleereg, call->numActualArgs(), unusedStack))
             return false;
 
         if (call->mir()->isConstructing()) {
@@ -1746,17 +1746,17 @@ CodeGenerator::visitApplyArgsGeneric(LAp
     // Copy the arguments of the current function.
     emitPushArguments(apply, copyreg);
 
     masm.checkStackAlignment();
 
     // If the function is known to be uncompilable, only emit the call to InvokeFunction.
     ExecutionMode executionMode = gen->info().executionMode();
     if (apply->hasSingleTarget()) {
-        RawFunction target = apply->getSingleTarget();
+        JSFunction *target = apply->getSingleTarget();
         if (!CanIonCompile(target, executionMode)) {
             if (!emitCallInvokeFunction(apply, copyreg))
                 return false;
             emitPopArguments(apply, copyreg);
             return true;
         }
     }
 
@@ -2215,17 +2215,17 @@ CodeGenerator::maybeCreateScriptCounts()
     // it to the script. This must be done on the main thread.
     JSContext *cx = GetIonContext()->cx;
     if (!cx)
         return NULL;
 
     IonScriptCounts *counts = NULL;
 
     CompileInfo *outerInfo = &gen->info();
-    RawScript script = outerInfo->script();
+    JSScript *script = outerInfo->script();
 
     if (cx->runtime->profilingScripts) {
         if (script && !script->hasScriptCounts && !script->initScriptCounts(cx))
             return NULL;
     } else if (!script) {
         return NULL;
     }
 
@@ -4924,17 +4924,17 @@ CodeGenerator::link()
     Linker linker(masm);
     IonCode *code = linker.newCode(cx, JSC::ION_CODE);
     if (!code)
         return false;
 
     // We encode safepoints after the OSI-point offsets have been determined.
     encodeSafepoints();
 
-    RawScript script = gen->info().script();
+    JSScript *script = gen->info().script();
     ExecutionMode executionMode = gen->info().executionMode();
     JS_ASSERT(!HasIonScript(script, executionMode));
 
     uint32_t scriptFrameSize = frameClass_ == FrameSizeClass::None()
                            ? frameDepth_
                            : FrameSizeClass::FromDepth(frameDepth_).frameSize();
 
     // Check to make sure we didn't have a mid-build invalidation. If so, we
@@ -6079,17 +6079,17 @@ IsDelegateObject(JSContext *cx, HandleOb
     *res = nres;
     return true;
 }
 
 typedef bool (*IsDelegateObjectFn)(JSContext *, HandleObject, HandleObject, JSBool *);
 static const VMFunction IsDelegateObjectInfo = FunctionInfo<IsDelegateObjectFn>(IsDelegateObject);
 
 bool
-CodeGenerator::emitInstanceOf(LInstruction *ins, RawObject prototypeObject)
+CodeGenerator::emitInstanceOf(LInstruction *ins, JSObject *prototypeObject)
 {
     // This path implements fun_hasInstance when the function's prototype is
     // known to be prototypeObject.
 
     Label done;
     Register output = ToRegister(ins->getDef(0));
 
     // If the lhs is a primitive, the result is false.
--- a/js/src/ion/CodeGenerator.h
+++ b/js/src/ion/CodeGenerator.h
@@ -210,17 +210,17 @@ class CodeGenerator : public CodeGenerat
     bool visitIteratorMore(LIteratorMore *lir);
     bool visitIteratorEnd(LIteratorEnd *lir);
     bool visitArgumentsLength(LArgumentsLength *lir);
     bool visitGetArgument(LGetArgument *lir);
     bool visitCallSetProperty(LCallSetProperty *ins);
     bool visitCallDeleteProperty(LCallDeleteProperty *lir);
     bool visitBitNotV(LBitNotV *lir);
     bool visitBitOpV(LBitOpV *lir);
-    bool emitInstanceOf(LInstruction *ins, RawObject prototypeObject);
+    bool emitInstanceOf(LInstruction *ins, JSObject *prototypeObject);
     bool visitIn(LIn *ins);
     bool visitInArray(LInArray *ins);
     bool visitInstanceOfO(LInstanceOfO *ins);
     bool visitInstanceOfV(LInstanceOfV *ins);
     bool visitCallInstanceOf(LCallInstanceOf *ins);
     bool visitFunctionBoundary(LFunctionBoundary *lir);
     bool visitGetDOMProperty(LGetDOMProperty *lir);
     bool visitSetDOMProperty(LSetDOMProperty *lir);
--- a/js/src/ion/CompileInfo.h
+++ b/js/src/ion/CompileInfo.h
@@ -8,25 +8,25 @@
 #define jsion_compileinfo_h__
 
 #include "Registers.h"
 
 namespace js {
 namespace ion {
 
 inline unsigned
-StartArgSlot(RawScript script, JSFunction *fun)
+StartArgSlot(JSScript *script, JSFunction *fun)
 {
     // First slot is for scope chain.
     // Second one may be for arguments object.
     return 1 + (script->argumentsHasVarBinding() ? 1 : 0);
 }
 
 inline unsigned
-CountArgSlots(RawScript script, JSFunction *fun)
+CountArgSlots(JSScript *script, JSFunction *fun)
 {
     return StartArgSlot(script, fun) + (fun ? fun->nargs + 1 : 0);
 }
 
 enum ExecutionMode {
     // Normal JavaScript execution
     SequentialExecution = 0,
 
@@ -34,17 +34,17 @@ enum ExecutionMode {
     // e.g. by ParallelArray
     ParallelExecution
 };
 
 // Contains information about the compilation source for IR being generated.
 class CompileInfo
 {
   public:
-    CompileInfo(RawScript script, JSFunction *fun, jsbytecode *osrPc, bool constructing,
+    CompileInfo(JSScript *script, JSFunction *fun, jsbytecode *osrPc, bool constructing,
                 ExecutionMode executionMode)
       : script_(script), fun_(fun), osrPc_(osrPc), constructing_(constructing),
         executionMode_(executionMode)
     {
         JS_ASSERT_IF(osrPc, JSOp(*osrPc) == JSOP_LOOPENTRY);
         nimplicit_ = StartArgSlot(script, fun)              /* scope chain and argument obj */
                    + (fun ? 1 : 0);                         /* this */
         nargs_ = fun ? fun->nargs : 0;
@@ -58,17 +58,17 @@ class CompileInfo
     {
         nimplicit_ = 0;
         nargs_ = 0;
         nlocals_ = nlocals;
         nstack_ = 1;  /* For FunctionCompiler::pushPhiInput/popPhiOutput */
         nslots_ = nlocals_ + nstack_;
     }
 
-    RawScript script() const {
+    JSScript *script() const {
         return script_;
     }
     JSFunction *fun() const {
         return fun_;
     }
     bool constructing() const {
         return constructing_;
     }
--- a/js/src/ion/ExecutionModeInlines.h
+++ b/js/src/ion/ExecutionModeInlines.h
@@ -6,39 +6,39 @@
 
 #ifndef jsion_compilemode_h__
 #define jsion_compilemode_h__
 
 namespace js {
 namespace ion {
 
 static inline bool
-HasIonScript(RawScript script, ExecutionMode cmode)
+HasIonScript(JSScript *script, ExecutionMode cmode)
 {
     switch (cmode) {
       case SequentialExecution: return script->hasIonScript();
       case ParallelExecution: return script->hasParallelIonScript();
     }
     JS_NOT_REACHED("No such execution mode");
     return false;
 }
 
 static inline IonScript *
-GetIonScript(RawScript script, ExecutionMode cmode)
+GetIonScript(JSScript *script, ExecutionMode cmode)
 {
     switch (cmode) {
       case SequentialExecution: return script->maybeIonScript();
       case ParallelExecution: return script->maybeParallelIonScript();
     }
     JS_NOT_REACHED("No such execution mode");
     return NULL;
 }
 
 static inline void
-SetIonScript(RawScript script, ExecutionMode cmode, IonScript *ionScript)
+SetIonScript(JSScript *script, ExecutionMode cmode, IonScript *ionScript)
 {
     switch (cmode) {
       case SequentialExecution: script->setIonScript(ionScript); return;
       case ParallelExecution: script->setParallelIonScript(ionScript); return;
     }
     JS_NOT_REACHED("No such execution mode");
 }
 
@@ -48,34 +48,34 @@ OffsetOfIonInJSScript(ExecutionMode cmod
     switch (cmode) {
       case SequentialExecution: return JSScript::offsetOfIonScript();
       case ParallelExecution: return JSScript::offsetOfParallelIonScript();
     }
     JS_NOT_REACHED("No such execution mode");
 }
 
 static inline bool
-CanIonCompile(RawScript script, ExecutionMode cmode)
+CanIonCompile(JSScript *script, ExecutionMode cmode)
 {
     switch (cmode) {
       case SequentialExecution: return script->canIonCompile();
       case ParallelExecution: return script->canParallelIonCompile();
     }
     JS_NOT_REACHED("No such execution mode");
     return false;
 }
 
 static inline bool
-CanIonCompile(RawFunction fun, ExecutionMode cmode)
+CanIonCompile(JSFunction *fun, ExecutionMode cmode)
 {
     return fun->isInterpreted() && CanIonCompile(fun->nonLazyScript(), cmode);
 }
 
 static inline bool
-CompilingOffThread(RawScript script, ExecutionMode cmode)
+CompilingOffThread(JSScript *script, ExecutionMode cmode)
 {
     switch (cmode) {
       case SequentialExecution: return script->isIonCompilingOffThread();
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
     }
     JS_NOT_REACHED("No such execution mode");
     return false;
 }
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -604,18 +604,18 @@ IonScript::New(JSContext *cx, uint32_t f
     size_t paddedSnapshotsSize = AlignBytes(snapshotsSize, DataAlignment);
     size_t paddedBailoutSize = AlignBytes(bailoutEntries * sizeof(uint32_t), DataAlignment);
     size_t paddedConstantsSize = AlignBytes(constants * sizeof(Value), DataAlignment);
     size_t paddedSafepointIndicesSize = AlignBytes(safepointIndices * sizeof(SafepointIndex), DataAlignment);
     size_t paddedOsiIndicesSize = AlignBytes(osiIndices * sizeof(OsiIndex), DataAlignment);
     size_t paddedCacheEntriesSize = AlignBytes(cacheEntries * sizeof(uint32_t), DataAlignment);
     size_t paddedRuntimeSize = AlignBytes(runtimeSize, DataAlignment);
     size_t paddedSafepointSize = AlignBytes(safepointsSize, DataAlignment);
-    size_t paddedScriptSize = AlignBytes(scriptEntries * sizeof(RawScript), DataAlignment);
-    size_t paddedCallTargetSize = AlignBytes(callTargetEntries * sizeof(RawScript), DataAlignment);
+    size_t paddedScriptSize = AlignBytes(scriptEntries * sizeof(JSScript *), DataAlignment);
+    size_t paddedCallTargetSize = AlignBytes(callTargetEntries * sizeof(JSScript *), DataAlignment);
     size_t bytes = paddedSnapshotsSize +
                    paddedBailoutSize +
                    paddedConstantsSize +
                    paddedSafepointIndicesSize+
                    paddedOsiIndicesSize +
                    paddedCacheEntriesSize +
                    paddedRuntimeSize +
                    paddedSafepointSize +
@@ -899,17 +899,17 @@ void
 ion::ToggleBarriers(JS::Zone *zone, bool needs)
 {
     IonContext ictx(zone->rt);
     if (!zone->rt->hasIonRuntime())
         return;
 
     AutoFlushCache afc("ToggleBarriers", zone->rt->ionRuntime());
     for (gc::CellIterUnderGC i(zone, gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
-        RawScript script = i.get<JSScript>();
+        JSScript *script = i.get<JSScript>();
         if (script->hasIonScript())
             script->ionScript()->toggleBarriers(needs);
         if (script->hasBaselineScript())
             script->baselineScript()->toggleBarriers(needs);
     }
 
     for (CompartmentsInZoneIter comp(zone); !comp.done(); comp.next()) {
         if (comp->ionCompartment())
@@ -1236,17 +1236,17 @@ CompileBackEnd(MIRGenerator *mir, MacroA
 }
 
 class SequentialCompileContext {
 public:
     ExecutionMode executionMode() {
         return SequentialExecution;
     }
 
-    MethodStatus checkScriptSize(JSContext *cx, RawScript script);
+    MethodStatus checkScriptSize(JSContext *cx, JSScript *script);
     AbortReason compile(IonBuilder *builder, MIRGraph *graph,
                         ScopedJSDeletePtr<LifoAlloc> &autoDelete);
 };
 
 void
 AttachFinishedCompilations(JSContext *cx)
 {
 #ifdef JS_THREADSAFE
@@ -1468,34 +1468,34 @@ CheckFrame(AbstractFramePtr fp)
         IonSpew(IonSpew_Abort, "too many actual args");
         return false;
     }
 
     return true;
 }
 
 static bool
-CheckScript(RawScript script, bool osr)
+CheckScript(JSScript *script, bool osr)
 {
     if (osr && script->needsArgsObj()) {
         // OSR-ing into functions with arguments objects is not supported.
         IonSpew(IonSpew_Abort, "OSR script has argsobj");
         return false;
     }
 
     if (!script->compileAndGo) {
         IonSpew(IonSpew_Abort, "not compile-and-go");
         return false;
     }
 
     return true;
 }
 
 MethodStatus
-SequentialCompileContext::checkScriptSize(JSContext *cx, RawScript script)
+SequentialCompileContext::checkScriptSize(JSContext *cx, JSScript *script)
 {
     if (!js_IonOptions.limitScriptSize)
         return Method_Compiled;
 
     // Longer scripts can only be compiled off thread, as these compilations
     // can be expensive and stall the main thread for too long.
     static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2000;
     static const uint32_t MAX_OFF_THREAD_SCRIPT_SIZE = 20000;
@@ -1737,17 +1737,17 @@ ion::CompileFunctionForBaseline(JSContex
             ForbidCompilation(cx, script);
         return status;
     }
 
     return Method_Compiled;
 }
 
 MethodStatus
-ParallelCompileContext::checkScriptSize(JSContext *cx, RawScript script)
+ParallelCompileContext::checkScriptSize(JSContext *cx, JSScript *script)
 {
     if (!js_IonOptions.limitScriptSize)
         return Method_Compiled;
 
     // When compiling for parallel execution we don't have off-thread
     // compilation. We also up the max script size of the kernels.
     static const uint32_t MAX_SCRIPT_SIZE = 5000;
     static const uint32_t MAX_LOCALS_AND_ARGS = 256;
@@ -2150,17 +2150,17 @@ InvalidateActivation(FreeOp *fop, uint8_
             break;
           case IonFrame_BaselineJS:
           case IonFrame_OptimizedJS:
           {
             JS_ASSERT(it.isScripted());
             const char *type = it.isOptimizedJS() ? "Optimized" : "Baseline";
             IonSpew(IonSpew_Invalidate, "#%d %s JS frame @ %p, %s:%d (fun: %p, script: %p, pc %p)",
                     frameno, type, it.fp(), it.script()->filename(), it.script()->lineno,
-                    it.maybeCallee(), (RawScript)it.script(), it.returnAddressToFp());
+                    it.maybeCallee(), (JSScript *)it.script(), it.returnAddressToFp());
             break;
           }
           case IonFrame_BaselineStub:
             IonSpew(IonSpew_Invalidate, "#%d baseline stub frame @ %p", frameno, it.fp());
             break;
           case IonFrame_Rectifier:
             IonSpew(IonSpew_Invalidate, "#%d rectifier frame @ %p", frameno, it.fp());
             break;
@@ -2182,17 +2182,17 @@ InvalidateActivation(FreeOp *fop, uint8_
 
         if (!it.isOptimizedJS())
             continue;
 
         // See if the frame has already been invalidated.
         if (it.checkInvalidation())
             continue;
 
-        RawScript script = it.script();
+        JSScript *script = it.script();
         if (!script->hasIonScript())
             continue;
 
         if (!invalidateAll && !script->ionScript()->invalidated())
             continue;
 
         IonScript *ionScript = script->ionScript();
 
@@ -2328,17 +2328,17 @@ ion::Invalidate(types::TypeCompartment &
             continue;
           case types::CompilerOutput::Ion:
             break;
           case types::CompilerOutput::ParallelIon:
             executionMode = ParallelExecution;
             break;
         }
         JS_ASSERT(co.isValid());
-        RawScript script = co.script;
+        JSScript *script = co.script;
         IonScript *ionScript = GetIonScript(script, executionMode);
 
         Zone *zone = script->zone();
         if (zone->needsBarrier()) {
             // We're about to remove edges from the JSScript to gcthings
             // embedded in the IonScript. Perform one final trace of the
             // IonScript for the incremental GC, as it must know about
             // those edges.
@@ -2367,17 +2367,17 @@ ion::Invalidate(types::TypeCompartment &
 
 void
 ion::Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses)
 {
     ion::Invalidate(cx->compartment->types, cx->runtime->defaultFreeOp(), invalid, resetUses);
 }
 
 bool
-ion::Invalidate(JSContext *cx, RawScript script, ExecutionMode mode, bool resetUses)
+ion::Invalidate(JSContext *cx, JSScript *script, ExecutionMode mode, bool resetUses)
 {
     JS_ASSERT(script->hasIonScript());
 
     Vector<types::RecompileInfo> scripts(cx);
 
     switch (mode) {
       case SequentialExecution:
         JS_ASSERT(script->hasIonScript());
@@ -2391,23 +2391,23 @@ ion::Invalidate(JSContext *cx, RawScript
         break;
     }
 
     Invalidate(cx, scripts, resetUses);
     return true;
 }
 
 bool
-ion::Invalidate(JSContext *cx, RawScript script, bool resetUses)
+ion::Invalidate(JSContext *cx, JSScript *script, bool resetUses)
 {
     return Invalidate(cx, script, SequentialExecution, resetUses);
 }
 
 static void
-FinishInvalidationOf(FreeOp *fop, RawScript script, IonScript *ionScript, bool parallel)
+FinishInvalidationOf(FreeOp *fop, JSScript *script, IonScript *ionScript, bool parallel)
 {
     // If this script has Ion code on the stack, invalidation() will return
     // true. In this case we have to wait until destroying it.
     if (!ionScript->invalidated()) {
         types::TypeCompartment &types = script->compartment()->types;
         ionScript->recompileInfo().compilerOutput(types)->invalidate();
 
         ion::IonScript::Destroy(fop, ionScript);
@@ -2417,17 +2417,17 @@ FinishInvalidationOf(FreeOp *fop, RawScr
     // re-entry.
     if (parallel)
         script->setParallelIonScript(NULL);
     else
         script->setIonScript(NULL);
 }
 
 void
-ion::FinishInvalidation(FreeOp *fop, RawScript script)
+ion::FinishInvalidation(FreeOp *fop, JSScript *script)
 {
     if (script->hasIonScript())
         FinishInvalidationOf(fop, script, script->ionScript(), false);
 
     if (script->hasParallelIonScript())
         FinishInvalidationOf(fop, script, script->parallelIonScript(), true);
 }
 
@@ -2439,23 +2439,23 @@ ion::MarkValueFromIon(JSRuntime *rt, Val
 
 void
 ion::MarkShapeFromIon(JSRuntime *rt, Shape **shapep)
 {
     gc::MarkShapeUnbarriered(&rt->gcMarker, shapep, "write barrier");
 }
 
 void
-ion::ForbidCompilation(JSContext *cx, RawScript script)
+ion::ForbidCompilation(JSContext *cx, JSScript *script)
 {
     ForbidCompilation(cx, script, SequentialExecution);
 }
 
 void
-ion::ForbidCompilation(JSContext *cx, RawScript script, ExecutionMode mode)
+ion::ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode)
 {
     IonSpew(IonSpew_Abort, "Disabling Ion mode %d compilation of script %s:%d",
             mode, script->filename(), script->lineno);
 
     CancelOffThreadIonCompile(cx->compartment, script);
 
     switch (mode) {
       case SequentialExecution:
@@ -2481,17 +2481,17 @@ ion::ForbidCompilation(JSContext *cx, Ra
         script->setParallelIonScript(ION_DISABLED_SCRIPT);
         return;
     }
 
     JS_NOT_REACHED("No such execution mode");
 }
 
 uint32_t
-ion::UsesBeforeIonRecompile(RawScript script, jsbytecode *pc)
+ion::UsesBeforeIonRecompile(JSScript *script, jsbytecode *pc)
 {
     JS_ASSERT(pc == script->code || JSOp(*pc) == JSOP_LOOPENTRY);
 
     uint32_t minUses = js_IonOptions.usesBeforeCompile;
     if (JSOp(*pc) != JSOP_LOOPENTRY || !script->hasAnalysis() || js_IonOptions.eagerCompilation)
         return minUses;
 
     analyze::LoopAnalysis *loop = script->analysis()->getLoop(pc);
@@ -2559,54 +2559,54 @@ AutoFlushInhibitor::~AutoFlushInhibitor(
     ic_->setFlusher(afc);
     if (afc)
         IonSpewCont(IonSpew_CacheFlush, "{");
 }
 
 int js::ion::LabelBase::id_count = 0;
 
 void
-ion::PurgeCaches(RawScript script, Zone *zone)
+ion::PurgeCaches(JSScript *script, Zone *zone)
 {
     if (script->hasIonScript())
         script->ionScript()->purgeCaches(zone);
 
     if (script->hasParallelIonScript())
         script->parallelIonScript()->purgeCaches(zone);
 }
 
 size_t
-ion::SizeOfIonData(RawScript script, JSMallocSizeOfFun mallocSizeOf)
+ion::SizeOfIonData(JSScript *script, JSMallocSizeOfFun mallocSizeOf)
 {
     size_t result = 0;
 
     if (script->hasIonScript())
         result += script->ionScript()->sizeOfIncludingThis(mallocSizeOf);
 
     if (script->hasParallelIonScript())
         result += script->parallelIonScript()->sizeOfIncludingThis(mallocSizeOf);
 
     return result;
 }
 
 void
-ion::DestroyIonScripts(FreeOp *fop, RawScript script)
+ion::DestroyIonScripts(FreeOp *fop, JSScript *script)
 {
     if (script->hasIonScript())
         ion::IonScript::Destroy(fop, script->ionScript());
 
     if (script->hasParallelIonScript())
         ion::IonScript::Destroy(fop, script->parallelIonScript());
 
     if (script->hasBaselineScript())
         ion::BaselineScript::Destroy(fop, script->baselineScript());
 }
 
 void
-ion::TraceIonScripts(JSTracer* trc, RawScript script)
+ion::TraceIonScripts(JSTracer* trc, JSScript *script)
 {
     if (script->hasIonScript())
         ion::IonScript::Trace(trc, script->ionScript());
 
     if (script->hasParallelIonScript())
         ion::IonScript::Trace(trc, script->parallelIonScript());
 
     if (script->hasBaselineScript())
--- a/js/src/ion/Ion.h
+++ b/js/src/ion/Ion.h
@@ -313,18 +313,18 @@ IonExecStatus SideCannon(JSContext *cx, 
 
 // Used to enter Ion from C++ natives like Array.map. Called from FastInvokeGuard.
 IonExecStatus FastInvoke(JSContext *cx, HandleFunction fun, CallArgsList &args);
 
 // Walk the stack and invalidate active Ion frames for the invalid scripts.
 void Invalidate(types::TypeCompartment &types, FreeOp *fop,
                 const Vector<types::RecompileInfo> &invalid, bool resetUses = true);
 void Invalidate(JSContext *cx, const Vector<types::RecompileInfo> &invalid, bool resetUses = true);
-bool Invalidate(JSContext *cx, RawScript script, ExecutionMode mode, bool resetUses = true);
-bool Invalidate(JSContext *cx, RawScript script, bool resetUses = true);
+bool Invalidate(JSContext *cx, JSScript *script, ExecutionMode mode, bool resetUses = true);
+bool Invalidate(JSContext *cx, JSScript *script, bool resetUses = true);
 
 void MarkValueFromIon(JSRuntime *rt, Value *vp);
 void MarkShapeFromIon(JSRuntime *rt, Shape **shapep);
 
 void ToggleBarriers(JS::Zone *zone, bool needs);
 
 class IonBuilder;
 class MIRGenerator;
@@ -339,22 +339,22 @@ CodeGenerator *CompileBackEnd(MIRGenerat
 void AttachFinishedCompilations(JSContext *cx);
 void FinishOffThreadBuilder(IonBuilder *builder);
 
 static inline bool IsEnabled(JSContext *cx)
 {
     return cx->hasOption(JSOPTION_ION) && cx->typeInferenceEnabled();
 }
 
-void ForbidCompilation(JSContext *cx, RawScript script);
-void ForbidCompilation(JSContext *cx, RawScript script, ExecutionMode mode);
-uint32_t UsesBeforeIonRecompile(RawScript script, jsbytecode *pc);
+void ForbidCompilation(JSContext *cx, JSScript *script);
+void ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode);
+uint32_t UsesBeforeIonRecompile(JSScript *script, jsbytecode *pc);
 
-void PurgeCaches(RawScript script, JS::Zone *zone);
-size_t SizeOfIonData(RawScript script, JSMallocSizeOfFun mallocSizeOf);
-void DestroyIonScripts(FreeOp *fop, RawScript script);
-void TraceIonScripts(JSTracer* trc, RawScript script);
+void PurgeCaches(JSScript *script, JS::Zone *zone);
+size_t SizeOfIonData(JSScript *script, JSMallocSizeOfFun mallocSizeOf);
+void DestroyIonScripts(FreeOp *fop, JSScript *script);
+void TraceIonScripts(JSTracer* trc, JSScript *script);
 
 } // namespace ion
 } // namespace js
 
 #endif // jsion_ion_h__
 
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -146,17 +146,17 @@ IonBuilder::CFGState::TableSwitch(jsbyte
 }
 
 JSFunction *
 IonBuilder::getSingleCallTarget(types::StackTypeSet *calleeTypes)
 {
     if (!calleeTypes)
         return NULL;
 
-    RawObject obj = calleeTypes->getSingleton();
+    JSObject *obj = calleeTypes->getSingleton();
     if (!obj || !obj->isFunction())
         return NULL;
 
     return obj->toFunction();
 }
 
 bool
 IonBuilder::getPolyCallTargets(types::StackTypeSet *calleeTypes,
@@ -4318,16 +4318,19 @@ IonBuilder::getSingletonPrototype(JSFunc
 MDefinition *
 IonBuilder::createThisScriptedSingleton(HandleFunction target, MDefinition *callee)
 {
     // Get the singleton prototype (if exists)
     RootedObject proto(cx, getSingletonPrototype(target));
     if (!proto)
         return NULL;
 
+    if (!target->nonLazyScript()->types)
+        return NULL;
+
     // Generate an inline path to create a new |this| object with
     // the given singleton prototype.
     types::TypeObject *type = proto->getNewType(cx, &ObjectClass, target);
     if (!type)
         return NULL;
     if (!types::TypeScript::ThisTypes(target->nonLazyScript())->hasType(types::Type::ObjectType(type)))
         return NULL;
 
@@ -6761,17 +6764,17 @@ GetDefiniteSlot(JSContext *cx, types::St
 {
     if (!types || types->unknownObject() || types->getObjectCount() != 1)
         return NULL;
 
     types::TypeObject *type = types->getTypeObject(0);
     if (!type || type->unknownProperties())
         return NULL;
 
-    RawId id = AtomToId(atom);
+    jsid id = AtomToId(atom);
     if (id != types::IdToTypeId(id))
         return NULL;
 
     types::HeapTypeSet *propertyTypes = type->getProperty(cx, id, false);
     if (!propertyTypes ||
         !propertyTypes->definiteProperty() ||
         propertyTypes->isOwnProperty(cx, type, true))
     {
@@ -6954,17 +6957,17 @@ IonBuilder::TestCommonPropFunc(JSContext
                 return false;
         }
 
         // If we found a Singleton object's own-property, there's nothing to
         // freeze.
         if (obj != foundProto) {
             // Walk the prototype chain. Everyone has to have the property, since we
             // just checked, so propSet cannot be NULL.
-            RawId typeId = types::IdToTypeId(id);
+            jsid typeId = types::IdToTypeId(id);
             while (true) {
                 types::HeapTypeSet *propSet = curType->getProperty(cx, typeId, false);
                 // This assert is now assured, since we have faulted them in
                 // above.
                 JS_ASSERT(propSet);
                 // Asking, freeze by asking.
                 DebugOnly<bool> isOwn = propSet->isOwnProperty(cx, curType, false);
                 JS_ASSERT(!isOwn);
@@ -7095,17 +7098,17 @@ IonBuilder::invalidatedIdempotentCache()
             return true;
         builder = builder->callerBuilder_;
     } while (builder);
 
     return false;
 }
 
 bool
-IonBuilder::loadSlot(MDefinition *obj, RawShape shape, MIRType rvalType,
+IonBuilder::loadSlot(MDefinition *obj, Shape *shape, MIRType rvalType,
                      bool barrier, types::StackTypeSet *types)
 {
     JS_ASSERT(shape->hasDefaultGetter());
     JS_ASSERT(shape->hasSlot());
 
     if (shape->slot() < shape->numFixedSlots()) {
         MLoadFixedSlot *load = MLoadFixedSlot::New(obj, shape->slot());
         current->add(load);
@@ -7122,17 +7125,17 @@ IonBuilder::loadSlot(MDefinition *obj, R
     current->add(load);
     current->push(load);
 
     load->setResultType(rvalType);
     return pushTypeBarrier(load, types, barrier);
 }
 
 bool
-IonBuilder::storeSlot(MDefinition *obj, RawShape shape, MDefinition *value, bool needsBarrier)
+IonBuilder::storeSlot(MDefinition *obj, Shape *shape, MDefinition *value, bool needsBarrier)
 {
     JS_ASSERT(shape->hasDefaultSetter());
     JS_ASSERT(shape->writable());
     JS_ASSERT(shape->hasSlot());
 
     if (shape->slot() < shape->numFixedSlots()) {
         MStoreFixedSlot *store = MStoreFixedSlot::New(obj, shape->slot(), value);
         current->add(store);
@@ -7363,17 +7366,17 @@ bool
 IonBuilder::getPropTryInlineAccess(bool *emitted, HandlePropertyName name, HandleId id,
                                    bool barrier, types::StackTypeSet *types)
 {
     JS_ASSERT(*emitted == false);
     if (current->peek(-1)->type() != MIRType_Object)
         return true;
 
     Vector<Shape *> shapes(cx);
-    if (RawShape objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
+    if (Shape *objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
         if (!shapes.append(objShape))
             return false;
     } else {
         if (!inspector->maybeShapesForPropertyOp(pc, shapes))
             return false;
     }
 
     if (shapes.empty() || !CanInlinePropertyOpShapes(shapes))
@@ -7384,35 +7387,35 @@ IonBuilder::getPropTryInlineAccess(bool 
         rvalType = MIRType_Value;
 
     MDefinition *obj = current->pop();
     if (shapes.length() == 1) {
         // In the monomorphic case, use separate ShapeGuard and LoadSlot
         // instructions.
         spew("Inlining monomorphic GETPROP");
 
-        RawShape objShape = shapes[0];
+        Shape *objShape = shapes[0];
         obj = addShapeGuard(obj, objShape, Bailout_CachedShapeGuard);
 
-        RawShape shape = objShape->search(cx, id);
+        Shape *shape = objShape->search(cx, id);
         JS_ASSERT(shape);
 
         if (!loadSlot(obj, shape, rvalType, barrier, types))
             return false;
     } else {
         JS_ASSERT(shapes.length() > 1);
         spew("Inlining polymorphic GETPROP");
 
         MGetPropertyPolymorphic *load = MGetPropertyPolymorphic::New(obj, name);
         current->add(load);
         current->push(load);
 
         for (size_t i = 0; i < shapes.length(); i++) {
-            RawShape objShape = shapes[i];
-            RawShape shape =  objShape->search(cx, id);
+            Shape *objShape = shapes[i];
+            Shape *shape =  objShape->search(cx, id);
             JS_ASSERT(shape);
             if (!load->addShape(objShape, shape))
                 return false;
         }
 
         if (failedShapeGuard_)
             load->setNotMovable();
 
@@ -7563,51 +7566,51 @@ IonBuilder::jsop_setprop(HandlePropertyN
         current->add(fixed);
         current->push(value);
         if (propTypes->needsBarrier(cx))
             fixed->setNeedsBarrier();
         return resumeAfter(fixed);
     }
 
     Vector<Shape *> shapes(cx);
-    if (RawShape objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
+    if (Shape *objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
         if (!shapes.append(objShape))
             return false;
     } else {
         if (!inspector->maybeShapesForPropertyOp(pc, shapes))
             return false;
     }
 
     if (!shapes.empty() && CanInlinePropertyOpShapes(shapes)) {
         if (shapes.length() == 1) {
             spew("Inlining monomorphic SETPROP");
 
             // The JM IC was monomorphic, so we inline the property access as
             // long as the shape is not in dictionary mode. We cannot be sure
             // that the shape is still a lastProperty, and calling Shape::search
             // on dictionary mode shapes that aren't lastProperty is invalid.
-            RawShape objShape = shapes[0];
+            Shape *objShape = shapes[0];
             obj = addShapeGuard(obj, objShape, Bailout_CachedShapeGuard);
 
-            RawShape shape = objShape->search(cx, NameToId(name));
+            Shape *shape = objShape->search(cx, NameToId(name));
             JS_ASSERT(shape);
 
             bool needsBarrier = objTypes->propertyNeedsBarrier(cx, id);
             return storeSlot(obj, shape, value, needsBarrier);
         } else {
             JS_ASSERT(shapes.length() > 1);
             spew("Inlining polymorphic SETPROP");
 
             MSetPropertyPolymorphic *ins = MSetPropertyPolymorphic::New(obj, value);
             current->add(ins);
             current->push(value);
 
             for (size_t i = 0; i < shapes.length(); i++) {
-                RawShape objShape = shapes[i];
-                RawShape shape =  objShape->search(cx, id);
+                Shape *objShape = shapes[i];
+                Shape *shape =  objShape->search(cx, id);
                 JS_ASSERT(shape);
                 if (!ins->addShape(objShape, shape))
                     return false;
             }
 
             if (objTypes->propertyNeedsBarrier(cx, id))
                 ins->setNeedsBarrier();
 
@@ -7960,27 +7963,27 @@ IonBuilder::jsop_instanceof()
 {
     MDefinition *rhs = current->pop();
     MDefinition *obj = current->pop();
 
     // If this is an 'x instanceof function' operation and we can determine the
     // exact function and prototype object being tested for, use a typed path.
     do {
         types::StackTypeSet *rhsTypes = rhs->resultTypeSet();
-        RawObject rhsObject = rhsTypes ? rhsTypes->getSingleton() : NULL;
+        JSObject *rhsObject = rhsTypes ? rhsTypes->getSingleton() : NULL;
         if (!rhsObject || !rhsObject->isFunction() || rhsObject->isBoundFunction())
             break;
 
         types::TypeObject *rhsType = rhsObject->getType(cx);
         if (!rhsType || rhsType->unknownProperties())
             break;
 
         types::HeapTypeSet *protoTypes =
             rhsType->getProperty(cx, NameToId(cx->names().classPrototype), false);
-        RawObject protoObject = protoTypes ? protoTypes->getSingleton(cx) : NULL;
+        JSObject *protoObject = protoTypes ? protoTypes->getSingleton(cx) : NULL;
         if (!protoObject)
             break;
 
         MInstanceOf *ins = new MInstanceOf(obj, protoObject);
 
         current->add(ins);
         current->push(ins);
 
@@ -8012,17 +8015,17 @@ IonBuilder::addBoundsCheck(MDefinition *
     // If a bounds check failed in the past, don't optimize bounds checks.
     if (failedBoundsCheck_)
         check->setNotMovable();
 
     return check;
 }
 
 MInstruction *
-IonBuilder::addShapeGuard(MDefinition *obj, const RawShape shape, BailoutKind bailoutKind)
+IonBuilder::addShapeGuard(MDefinition *obj, Shape *const shape, BailoutKind bailoutKind)
 {
     MGuardShape *guard = MGuardShape::New(obj, shape, bailoutKind);
     current->add(guard);
 
     // If a shape guard failed in the past, don't optimize shape guard.
     if (failedShapeGuard_)
         guard->setNotMovable();
 
--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -316,27 +316,27 @@ class IonBuilder : public MIRGenerator
     MDefinition *createThis(HandleFunction target, MDefinition *callee);
     MInstruction *createDeclEnvObject(MDefinition *callee, MDefinition *scopeObj);
     MInstruction *createCallObject(MDefinition *callee, MDefinition *scopeObj);
 
     MDefinition *walkScopeChain(unsigned hops);
 
     MInstruction *addConvertElementsToDoubles(MDefinition *elements);
     MInstruction *addBoundsCheck(MDefinition *index, MDefinition *length);
-    MInstruction *addShapeGuard(MDefinition *obj, const RawShape shape, BailoutKind bailoutKind);
+    MInstruction *addShapeGuard(MDefinition *obj, Shape *const shape, BailoutKind bailoutKind);
 
     JSObject *getNewArrayTemplateObject(uint32_t count);
     MDefinition *convertShiftToMaskForStaticTypedArray(MDefinition *id,
                                                        ArrayBufferView::ViewType viewType);
 
     bool invalidatedIdempotentCache();
 
-    bool loadSlot(MDefinition *obj, RawShape shape, MIRType rvalType,
+    bool loadSlot(MDefinition *obj, Shape *shape, MIRType rvalType,
                   bool barrier, types::StackTypeSet *types);
-    bool storeSlot(MDefinition *obj, RawShape shape, MDefinition *value, bool needsBarrier);
+    bool storeSlot(MDefinition *obj, Shape *shape, MDefinition *value, bool needsBarrier);
 
     // jsop_getprop() helpers.
     bool getPropTryArgumentsLength(bool *emitted);
     bool getPropTryConstant(bool *emitted, HandleId id, types::StackTypeSet *types);
     bool getPropTryDefiniteSlot(bool *emitted, HandlePropertyName name,
                                 bool barrier, types::StackTypeSet *types);
     bool getPropTryCommonGetter(bool *emitted, HandleId id,
                                 bool barrier, types::StackTypeSet *types);
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -476,29 +476,29 @@ IsCacheableProtoChain(JSObject *obj, JSO
         if (!proto || !proto->isNative())
             return false;
         obj = proto;
     }
     return true;
 }
 
 static bool
-IsCacheableGetPropReadSlot(JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableGetPropReadSlot(JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (!shape->hasSlot() || !shape->hasDefaultGetter())
         return false;
 
     return true;
 }
 
 static bool
-IsCacheableNoProperty(JSObject *obj, JSObject *holder, RawShape shape, jsbytecode *pc,
+IsCacheableNoProperty(JSObject *obj, JSObject *holder, Shape *shape, jsbytecode *pc,
                       const TypedOrValueRegister &output)
 {
     if (shape)
         return false;
 
     JS_ASSERT(!holder);
 
     // Just because we didn't find the property on the object doesn't mean it
@@ -539,30 +539,30 @@ IsCacheableNoProperty(JSObject *obj, JSO
     // monitor and invalidate the script.
     if (!output.hasValue())
         return false;
 
     return true;
 }
 
 static bool
-IsCacheableGetPropCallNative(JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableGetPropCallNative(JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (!shape->hasGetterValue() || !shape->getterValue().isObject())
         return false;
 
     return shape->getterValue().toObject().isFunction() &&
            shape->getterValue().toObject().toFunction()->isNative();
 }
 
 static bool
-IsCacheableGetPropCallPropertyOp(JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableGetPropCallPropertyOp(JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (shape->hasSlot() || shape->hasGetterValue() || shape->hasDefaultGetter())
         return false;
 
     return true;
@@ -1683,17 +1683,17 @@ SetPropertyIC::attachNativeAdding(JSCont
     masm.branchTestObjShape(Assembler::NotEqual, object(), oldShape, &failures);
 
     Label protoFailures;
     masm.push(object());    // save object reg because we clobber it
 
     JSObject *proto = obj->getProto();
     Register protoReg = object();
     while (proto) {
-        RawShape protoShape = proto->lastProperty();
+        Shape *protoShape = proto->lastProperty();
 
         // load next prototype
         masm.loadPtr(Address(protoReg, JSObject::offsetOfType()), protoReg);
         masm.loadPtr(Address(protoReg, offsetof(types::TypeObject, proto)), protoReg);
 
         // Ensure that its shape matches.
         masm.branchTestObjShape(Assembler::NotEqual, protoReg, protoShape, &protoFailures);
 
@@ -1744,17 +1744,17 @@ IsPropertyInlineable(JSObject *obj)
         return false;
 
     return true;
 }
 
 static bool
 IsPropertySetInlineable(JSContext *cx, HandleObject obj, HandleId id, MutableHandleShape pshape)
 {
-    RawShape shape = obj->nativeLookup(cx, id);
+    Shape *shape = obj->nativeLookup(cx, id);
 
     if (!shape)
         return false;
 
     if (!shape->hasSlot())
         return false;
 
     if (!shape->hasDefaultSetter())
@@ -1818,17 +1818,17 @@ IsPropertyAddInlineable(JSContext *cx, H
     // are native, and that all prototypes have no getter or setter
     // defined on the property
     for (JSObject *proto = obj->getProto(); proto; proto = proto->getProto()) {
         // if prototype is non-native, don't optimize
         if (!proto->isNative())
             return false;
 
         // if prototype defines this property in a non-plain way, don't optimize
-        RawShape protoShape = proto->nativeLookup(cx, id);
+        Shape *protoShape = proto->nativeLookup(cx, id);
         if (protoShape && !protoShape->hasDefaultSetter())
             return false;
 
         // Otherise, if there's no such property, watch out for a resolve hook that would need
         // to be invoked and thus prevent inlining of property addition.
         if (proto->getClass()->resolve != JS_ResolveStub)
              return false;
     }
@@ -2211,26 +2211,26 @@ BindNameIC::attachGlobal(JSContext *cx, 
 
     attacher.jumpRejoin(masm);
 
     return linkAndAttachStub(cx, masm, attacher, ion, "global");
 }
 
 static inline void
 GenerateScopeChainGuard(MacroAssembler &masm, JSObject *scopeObj,
-                        Register scopeObjReg, RawShape shape, Label *failures)
+                        Register scopeObjReg, Shape *shape, Label *failures)
 {
     if (scopeObj->isCall()) {
         // We can skip a guard on the call object if the script's bindings are
         // guaranteed to be immutable (and thus cannot introduce shadowing
         // variables).
         CallObject *callObj = &scopeObj->asCall();
         if (!callObj->isForEval()) {
-            RawFunction fun = &callObj->callee();
-            RawScript script = fun->nonLazyScript();
+            JSFunction *fun = &callObj->callee();
+            JSScript *script = fun->nonLazyScript();
             if (!script->funHasExtensibleScope)
                 return;
         }
     } else if (scopeObj->isGlobal()) {
         // If this is the last object on the scope walk, and the property we've
         // found is not configurable, then we don't need a shape guard because
         // the shape cannot be removed.
         if (shape && !shape->configurable())
@@ -2447,17 +2447,17 @@ NameIC::attachCallGetter(JSContext *cx, 
          return false;
     }
 
     const char *attachKind = "name getter";
     return linkAndAttachStub(cx, masm, attacher, ion, attachKind);
 }
 
 static bool
-IsCacheableNameCallGetter(JSObject *scopeChain, JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableNameCallGetter(JSObject *scopeChain, JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (obj != scopeChain)
         return false;
 
     if (!obj->isGlobal())
         return false;
 
     return IsCacheableGetPropCallNative(obj, holder, shape) ||
--- a/js/src/ion/IonCaches.h
+++ b/js/src/ion/IonCaches.h
@@ -246,17 +246,17 @@ class IonCache
     }
     void setIdempotent() {
         JS_ASSERT(!idempotent_);
         JS_ASSERT(!script);
         JS_ASSERT(!pc);
         idempotent_ = true;
     }
 
-    void setScriptedLocation(RawScript script, jsbytecode *pc) {
+    void setScriptedLocation(JSScript *script, jsbytecode *pc) {
         JS_ASSERT(!idempotent_);
         this->script = script;
         this->pc = pc;
     }
 
     void getScriptedLocation(MutableHandleScript pscript, jsbytecode **ppc) {
         pscript.set(script);
         *ppc = pc;
--- a/js/src/ion/IonCode.h
+++ b/js/src/ion/IonCode.h
@@ -376,17 +376,17 @@ struct IonScript
         return snapshotsSize_;
     }
     const uint8_t *safepoints() const {
         return reinterpret_cast<const uint8_t *>(this) + safepointsStart_;
     }
     size_t safepointsSize() const {
         return safepointsSize_;
     }
-    RawScript getScript(size_t i) const {
+    JSScript *getScript(size_t i) const {
         JS_ASSERT(i < scriptEntries_);
         return scriptList()[i];
     }
     size_t scriptEntries() const {
         return scriptEntries_;
     }
     size_t callTargetEntries() const {
         return callTargetEntries_;
--- a/js/src/ion/IonCompartment.h
+++ b/js/src/ion/IonCompartment.h
@@ -384,15 +384,15 @@ class IonActivation
     }
     static inline size_t offsetOfEntryFp() {
         return offsetof(IonActivation, entryfp_);
     }
 };
 
 // Called from JSCompartment::discardJitCode().
 void InvalidateAll(FreeOp *fop, JS::Zone *zone);
-void FinishInvalidation(FreeOp *fop, RawScript script);
+void FinishInvalidation(FreeOp *fop, JSScript *script);
 
 } // namespace ion
 } // namespace js
 
 #endif // jsion_ion_compartment_h__
 
--- a/js/src/ion/IonFrameIterator-inl.h
+++ b/js/src/ion/IonFrameIterator-inl.h
@@ -14,17 +14,17 @@
 
 namespace js {
 namespace ion {
 
 template <class Op>
 inline void
 SnapshotIterator::readFrameArgs(Op &op, const Value *argv, Value *scopeChain, Value *thisv,
                                 unsigned start, unsigned formalEnd, unsigned iterEnd,
-                                RawScript script)
+                                JSScript *script)
 {
     if (scopeChain)
         *scopeChain = read();
     else
         skip();
 
     if (thisv)
         *thisv = read();
--- a/js/src/ion/IonFrameIterator.h
+++ b/js/src/ion/IonFrameIterator.h
@@ -148,17 +148,17 @@ class IonFrameIterator
     bool isConstructing() const;
 
     bool isEntryJSFrame() const;
 
     void *calleeToken() const;
     JSFunction *callee() const;
     JSFunction *maybeCallee() const;
     unsigned numActualArgs() const;
-    RawScript script() const;
+    JSScript *script() const;
     void baselineScriptAndPc(JSScript **scriptRes, jsbytecode **pcRes) const;
     Value *nativeVp() const;
     Value *actualArgs() const;
 
     // Returns the return address of the frame above this one (that is, the
     // return address that returns back to the current frame).
     uint8_t *returnAddressToFp() const {
         return returnAddressToFp_;
@@ -265,17 +265,17 @@ class SnapshotIterator : public Snapshot
         if (!silentFailure)
             warnUnreadableSlot();
         return UndefinedValue();
     }
 
     template <class Op>
     inline void readFrameArgs(Op &op, const Value *argv, Value *scopeChain, Value *thisv,
                               unsigned start, unsigned formalEnd, unsigned iterEnd,
-                              RawScript script);
+                              JSScript *script);
 
     Value maybeReadSlotByIndex(size_t index) {
         while (index--) {
             JS_ASSERT(moreSlots());
             skip();
         }
 
         Value s = maybeRead(true);
@@ -319,17 +319,17 @@ class InlineFrameIteratorMaybeGC
     JSFunction *maybeCallee() const {
         return callee_;
     }
     inline unsigned numActualArgs() const;
 
     template <class Op>
     inline void forEachCanonicalActualArg(JSContext *cx, Op op, unsigned start, unsigned count) const;
 
-    RawScript script() const {
+    JSScript *script() const {
         return script_;
     }
     jsbytecode *pc() const {
         return pc_;
     }
     SnapshotIterator snapshotIterator() const {
         return si_;
     }
--- a/js/src/ion/IonFrames-inl.h
+++ b/js/src/ion/IonFrames-inl.h
@@ -96,17 +96,17 @@ IonFrameIterator::exitFrame() const
 size_t
 IonFrameIterator::frameSize() const
 {
     JS_ASSERT(type_ != IonFrame_Exit);
     return frameSize_;
 }
 
 // Returns the JSScript associated with the topmost Ion frame.
-inline RawScript
+inline JSScript *
 GetTopIonJSScript(PerThreadData *pt, const SafepointIndex **safepointIndexOut, void **returnAddrOut)
 {
     IonFrameIterator iter(pt->ionTop);
     JS_ASSERT(iter.type() == IonFrame_Exit);
     ++iter;
 
     // If needed, grab the safepoint index.
     if (safepointIndexOut)
@@ -121,17 +121,17 @@ GetTopIonJSScript(PerThreadData *pt, con
         JS_ASSERT(iter.isBaselineJS());
     }
 
     JS_ASSERT(iter.isScripted());
     return iter.script();
 }
 
 
-inline RawScript
+inline JSScript *
 GetTopIonJSScript(JSContext *cx, const SafepointIndex **safepointIndexOut, void **returnAddrOut)
 {
     return GetTopIonJSScript(&cx->mainThread(), safepointIndexOut, returnAddrOut);
 }
 
 inline BaselineFrame *
 GetTopBaselineFrame(JSContext *cx)
 {
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -54,17 +54,17 @@ IonFrameIterator::checkInvalidation() co
     IonScript *dummy;
     return checkInvalidation(&dummy);
 }
 
 bool
 IonFrameIterator::checkInvalidation(IonScript **ionScriptOut) const
 {
     uint8_t *returnAddr = returnAddressToFp();
-    RawScript script = this->script();
+    JSScript *script = this->script();
     // N.B. the current IonScript is not the same as the frame's
     // IonScript if the frame has since been invalidated.
     bool invalidated;
     if (isParallelFunctionFrame()) {
         invalidated = !script->hasParallelIonScript() ||
             !script->parallelIonScript()->containsReturnAddress(returnAddr);
     } else {
         invalidated = !script->hasIonScript() ||
@@ -169,32 +169,32 @@ IonFrameIterator::isEntryJSFrame() const
     ++iter;
     for (; !iter.done(); ++iter) {
         if (iter.isScripted())
             return false;
     }
     return true;
 }
 
-RawScript
+JSScript *
 IonFrameIterator::script() const
 {
     JS_ASSERT(isScripted());
     if (isBaselineJS())
         return baselineFrame()->script();
-    RawScript script = ScriptFromCalleeToken(calleeToken());
+    JSScript *script = ScriptFromCalleeToken(calleeToken());
     JS_ASSERT(script);
     return script;
 }
 
 void
 IonFrameIterator::baselineScriptAndPc(JSScript **scriptRes, jsbytecode **pcRes) const
 {
     JS_ASSERT(isBaselineJS());
-    RawScript script = this->script();
+    JSScript *script = this->script();
     if (scriptRes)
         *scriptRes = script;
     uint8_t *retAddr = returnAddressToFp();
     if (pcRes) {
         // If the return address is into the prologue entry addr, then assume PC 0.
         if (retAddr == script->baselineScript()->prologueEntryAddr()) {
             *pcRes = 0;
             return;
@@ -469,17 +469,17 @@ HandleException(ResumeFromException *rfe
             // them.
             InlineFrameIterator frames(cx, &iter);
             for (;;) {
                 CloseLiveIterators(cx, frames);
 
                 // When profiling, each frame popped needs a notification that
                 // the function has exited, so invoke the probe that a function
                 // is exiting.
-                RawScript script = frames.script();
+                JSScript *script = frames.script();
                 Probes::exitScript(cx, script, script->function(), NULL);
                 if (!frames.more())
                     break;
                 ++frames;
             }
 
             IonScript *ionScript = NULL;
             if (iter.checkInvalidation(&ionScript))
@@ -489,17 +489,17 @@ HandleException(ResumeFromException *rfe
             // It's invalid to call DebugEpilogue twice for the same frame.
             bool calledDebugEpilogue = false;
 
             HandleException(cx, iter, rfe, &calledDebugEpilogue);
             if (rfe->kind != ResumeFromException::RESUME_ENTRY_FRAME)
                 return;
 
             // Unwind profiler pseudo-stack
-            RawScript script = iter.script();
+            JSScript *script = iter.script();
             Probes::exitScript(cx, script, script->function(), NULL);
 
             if (cx->compartment->debugMode() && !calledDebugEpilogue) {
                 // If DebugEpilogue returns |true|, we have to perform a forced
                 // return, e.g. return frame->returnValue() to the caller.
                 BaselineFrame *frame = iter.baselineFrame();
                 if (ion::DebugEpilogue(cx, frame, false)) {
                     JS_ASSERT(frame->hasReturnValue());
@@ -628,17 +628,17 @@ MarkCalleeToken(JSTracer *trc, CalleeTok
       {
         JSFunction *fun = CalleeTokenToFunction(token);
         MarkObjectRoot(trc, &fun, "ion-callee");
         JS_ASSERT(fun == CalleeTokenToFunction(token));
         break;
       }
       case CalleeToken_Script:
       {
-        RawScript script = CalleeTokenToScript(token);
+        JSScript *script = CalleeTokenToScript(token);
         MarkScriptRoot(trc, &script, "ion-entry");
         JS_ASSERT(script == CalleeTokenToScript(token));
         break;
       }
       default:
         JS_NOT_REACHED("unknown callee token type");
     }
 }
--- a/js/src/ion/IonFrames.h
+++ b/js/src/ion/IonFrames.h
@@ -44,45 +44,45 @@ CalleeToToken(JSFunction *fun)
     return CalleeToken(uintptr_t(fun) | uintptr_t(CalleeToken_Function));
 }
 static inline CalleeToken
 CalleeToParallelToken(JSFunction *fun)
 {
     return CalleeToken(uintptr_t(fun) | uintptr_t(CalleeToken_ParallelFunction));
 }
 static inline CalleeToken
-CalleeToToken(RawScript script)
+CalleeToToken(JSScript *script)
 {
     return CalleeToken(uintptr_t(script) | uintptr_t(CalleeToken_Script));
 }
 static inline bool
 CalleeTokenIsFunction(CalleeToken token)
 {
     return GetCalleeTokenTag(token) == CalleeToken_Function;
 }
 static inline JSFunction *
 CalleeTokenToFunction(CalleeToken token)
 {
     JS_ASSERT(CalleeTokenIsFunction(token));
     return (JSFunction *)token;
 }
-static inline RawFunction
+static inline JSFunction *
 CalleeTokenToParallelFunction(CalleeToken token)
 {
     JS_ASSERT(GetCalleeTokenTag(token) == CalleeToken_ParallelFunction);
     return (JSFunction *)(uintptr_t(token) & ~uintptr_t(0x3));
 }
-static inline RawScript
+static inline JSScript *
 CalleeTokenToScript(CalleeToken token)
 {
     JS_ASSERT(GetCalleeTokenTag(token) == CalleeToken_Script);
-    return (RawScript)(uintptr_t(token) & ~uintptr_t(0x3));
+    return (JSScript *)(uintptr_t(token) & ~uintptr_t(0x3));
 }
 
-static inline RawScript
+static inline JSScript *
 ScriptFromCalleeToken(CalleeToken token)
 {
     switch (GetCalleeTokenTag(token)) {
       case CalleeToken_Script:
         return CalleeTokenToScript(token);
       case CalleeToken_Function:
         return CalleeTokenToFunction(token)->nonLazyScript();
       case CalleeToken_ParallelFunction:
@@ -288,17 +288,17 @@ MakeFrameDescriptor(uint32_t frameSize, 
 # include "ion/arm/IonFrames-arm.h"
 #else
 # error "unsupported architecture"
 #endif
 
 namespace js {
 namespace ion {
 
-RawScript
+JSScript *
 GetTopIonJSScript(JSContext *cx,
                   const SafepointIndex **safepointIndexOut = NULL,
                   void **returnAddrOut = NULL);
 
 void
 GetPcScript(JSContext *cx, JSScript **scriptRes, jsbytecode **pcRes);
 
 // Given a slot index, returns the offset, in bytes, of that slot from an
--- a/js/src/ion/IonMacroAssembler.h
+++ b/js/src/ion/IonMacroAssembler.h
@@ -758,17 +758,17 @@ class MacroAssembler : public MacroAssem
 
     void spsUpdatePCIdx(SPSProfiler *p, Register idx, Register temp) {
         Label stackFull;
         spsProfileEntryAddress(p, -1, temp, &stackFull);
         store32(idx, Address(temp, ProfileEntry::offsetOfPCIdx()));
         bind(&stackFull);
     }
 
-    void spsPushFrame(SPSProfiler *p, const char *str, RawScript s, Register temp) {
+    void spsPushFrame(SPSProfiler *p, const char *str, JSScript *s, Register temp) {
         Label stackFull;
         spsProfileEntryAddress(p, 0, temp, &stackFull);
 
         storePtr(ImmWord(str),    Address(temp, ProfileEntry::offsetOfString()));
         storePtr(ImmGCPtr(s),     Address(temp, ProfileEntry::offsetOfScript()));
         storePtr(ImmWord((void*) NULL), Address(temp, ProfileEntry::offsetOfStackAddress()));
         store32(Imm32(ProfileEntry::NullPCIndex), Address(temp, ProfileEntry::offsetOfPCIdx()));
 
--- a/js/src/ion/JSONSpewer.cpp
+++ b/js/src/ion/JSONSpewer.cpp
@@ -171,17 +171,17 @@ JSONSpewer::init(const char *path)
         return false;
 
     beginObject();
     beginListProperty("functions");
     return true;
 }
 
 void
-JSONSpewer::beginFunction(RawScript script)
+JSONSpewer::beginFunction(JSScript *script)
 {
     if (inFunction_)
         endFunction();
 
     beginObject();
     if (script)
         stringProperty("name", "%s:%d", script->filename(), script->lineno);
     else
--- a/js/src/ion/JSONSpewer.h
+++ b/js/src/ion/JSONSpewer.h
@@ -55,17 +55,17 @@ class JSONSpewer
       : inFunction_(false),
         indentLevel_(0),
         first_(true),
         fp_(NULL)
     { }
     ~JSONSpewer();
 
     bool init(const char *path);
-    void beginFunction(RawScript script);
+    void beginFunction(JSScript *script);
     void beginPass(const char * pass);
     void spewMDef(MDefinition *def);
     void spewMResumePoint(MResumePoint *rp);
     void spewMIR(MIRGraph *mir);
     void spewLIns(LInstruction *ins);
     void spewLIR(MIRGraph *mir);
     void spewIntervals(LinearScanAllocator *regalloc);
     void endPass();
--- a/js/src/ion/LIR-Common.h
+++ b/js/src/ion/LIR-Common.h
@@ -4349,17 +4349,17 @@ class LFunctionBoundary : public LInstru
     LFunctionBoundary(const LDefinition &temp) {
         setTemp(0, temp);
     }
 
     const LDefinition *temp() {
         return getTemp(0);
     }
 
-    RawScript script() {
+    JSScript *script() {
         return mir_->toFunctionBoundary()->script();
     }
 
     MFunctionBoundary::Type type() {
         return mir_->toFunctionBoundary()->type();
     }
 
     unsigned inlineLevel() {
--- a/js/src/ion/MCallOptimize.cpp
+++ b/js/src/ion/MCallOptimize.cpp
@@ -1092,17 +1092,17 @@ IonBuilder::inlineNewParallelArray(CallI
     //    x = MNewParallelArray()
     //    ParallelArrayView(x, arg0, ..., argN)
 
     uint32_t argc = callInfo.argc();
     if (argc < 1 || callInfo.constructing())
         return InliningStatus_NotInlined;
 
     types::StackTypeSet *ctorTypes = callInfo.getArg(0)->resultTypeSet();
-    RawObject targetObj = ctorTypes ? ctorTypes->getSingleton() : NULL;
+    JSObject *targetObj = ctorTypes ? ctorTypes->getSingleton() : NULL;
     RootedFunction target(cx);
     if (targetObj && targetObj->isFunction())
         target = targetObj->toFunction();
     if (target && target->isInterpreted() && target->nonLazyScript()->shouldCloneAtCallsite) {
         RootedScript scriptRoot(cx, script());
         target = CloneFunctionAtCallsite(cx, target, scriptRoot, pc);
         if (!target)
             return InliningStatus_Error;
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -390,17 +390,17 @@ MConstant::printOpcode(FILE *fp)
             JSFunction *fun = value().toObject().toFunction();
             if (fun->displayAtom()) {
                 fputs("function ", fp);
                 FileEscapedString(fp, fun->displayAtom(), 0);
             } else {
                 fputs("unnamed function", fp);
             }
             if (fun->hasScript()) {
-                RawScript script = fun->nonLazyScript();
+                JSScript *script = fun->nonLazyScript();
                 fprintf(fp, " (%s:%u)",
                         script->filename() ? script->filename() : "", script->lineno);
             }
             fprintf(fp, " at %p", (void *) fun);
             break;
         }
         fprintf(fp, "object %p (%s)", (void *)&value().toObject(),
                 value().toObject().getClass()->name);
@@ -2239,17 +2239,17 @@ MGetPropertyPolymorphic::mightAlias(MDef
 {
     // Allow hoisting this instruction if the store does not write to a
     // slot read by this instruction.
 
     if (!store->isStoreFixedSlot() && !store->isStoreSlot())
         return true;
 
     for (size_t i = 0; i < numShapes(); i++) {
-        RawShape shape = this->shape(i);
+        Shape *shape = this->shape(i);
         if (shape->slot() < shape->numFixedSlots()) {
             // Fixed slot.
             uint32_t slot = shape->slot();
             if (store->isStoreFixedSlot() && store->toStoreFixedSlot()->slot() != slot)
                 continue;
             if (store->isStoreSlot())
                 continue;
         } else {
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -5368,20 +5368,20 @@ class MGetPropertyCache
 // Emit code to load a value from an object's slots if its shape matches
 // one of the shapes observed by the baseline IC, else bails out.
 class MGetPropertyPolymorphic
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
     struct Entry {
         // The shape to guard against.
-        RawShape objShape;
+        Shape *objShape;
 
         // The property to laod.
-        RawShape shape;
+        Shape *shape;
     };
 
     Vector<Entry, 4, IonAllocPolicy> shapes_;
     CompilerRootPropertyName name_;
 
     MGetPropertyPolymorphic(MDefinition *obj, HandlePropertyName name)
       : MUnaryInstruction(obj),
         name_(name)
@@ -5407,29 +5407,29 @@ class MGetPropertyPolymorphic
         if (name() != ins->toGetPropertyPolymorphic()->name())
             return false;
         return congruentIfOperandsEqual(ins);
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
-    bool addShape(RawShape objShape, RawShape shape) {
+    bool addShape(Shape *objShape, Shape *shape) {
         Entry entry;
         entry.objShape = objShape;
         entry.shape = shape;
         return shapes_.append(entry);
     }
     size_t numShapes() const {
         return shapes_.length();
     }
-    RawShape objShape(size_t i) const {
+    Shape *objShape(size_t i) const {
         return shapes_[i].objShape;
     }
-    RawShape shape(size_t i) const {
+    Shape *shape(size_t i) const {
         return shapes_[i].shape;
     }
     MDefinition *obj() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const {
         return AliasSet::Load(AliasSet::ObjectFields | AliasSet::FixedSlot | AliasSet::DynamicSlot);
     }
@@ -5440,20 +5440,20 @@ class MGetPropertyPolymorphic
 // Emit code to store a value to an object's slots if its shape matches
 // one of the shapes observed by the baseline IC, else bails out.
 class MSetPropertyPolymorphic
   : public MBinaryInstruction,
     public SingleObjectPolicy
 {
     struct Entry {
         // The shape to guard against.
-        RawShape objShape;
+        Shape *objShape;
 
         // The property to laod.
-        RawShape shape;
+        Shape *shape;
     };
 
     Vector<Entry, 4, IonAllocPolicy> shapes_;
     bool needsBarrier_;
 
     MSetPropertyPolymorphic(MDefinition *obj, MDefinition *value)
       : MBinaryInstruction(obj, value),
         needsBarrier_(false)
@@ -5465,29 +5465,29 @@ class MSetPropertyPolymorphic
 
     static MSetPropertyPolymorphic *New(MDefinition *obj, MDefinition *value) {
         return new MSetPropertyPolymorphic(obj, value);
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
-    bool addShape(RawShape objShape, RawShape shape) {
+    bool addShape(Shape *objShape, Shape *shape) {
         Entry entry;
         entry.objShape = objShape;
         entry.shape = shape;
         return shapes_.append(entry);
     }
     size_t numShapes() const {
         return shapes_.length();
     }
-    RawShape objShape(size_t i) const {
+    Shape *objShape(size_t i) const {
         return shapes_[i].objShape;
     }
-    RawShape shape(size_t i) const {
+    Shape *shape(size_t i) const {
         return shapes_[i].shape;
     }
     MDefinition *obj() const {
         return getOperand(0);
     }
     MDefinition *value() const {
         return getOperand(1);
     }
@@ -5844,40 +5844,40 @@ class MGetElementCache
 class MBindNameCache
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
     CompilerRootPropertyName name_;
     CompilerRootScript script_;
     jsbytecode *pc_;
 
-    MBindNameCache(MDefinition *scopeChain, PropertyName *name, RawScript script, jsbytecode *pc)
+    MBindNameCache(MDefinition *scopeChain, PropertyName *name, JSScript *script, jsbytecode *pc)
       : MUnaryInstruction(scopeChain), name_(name), script_(script), pc_(pc)
     {
         setResultType(MIRType_Object);
     }
 
   public:
     INSTRUCTION_HEADER(BindNameCache)
 
-    static MBindNameCache *New(MDefinition *scopeChain, PropertyName *name, RawScript script,
+    static MBindNameCache *New(MDefinition *scopeChain, PropertyName *name, JSScript *script,
                                jsbytecode *pc) {
         return new MBindNameCache(scopeChain, name, script, pc);
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
     MDefinition *scopeChain() const {
         return getOperand(0);
     }
     PropertyName *name() const {
         return name_;
     }
-    RawScript script() const {
+    JSScript *script() const {
         return script_;
     }
     jsbytecode *pc() const {
         return pc_;
     }
 };
 
 // Guard on an object's shape.
@@ -5906,17 +5906,17 @@ class MGuardShape
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
     MDefinition *obj() const {
         return getOperand(0);
     }
-    const RawShape shape() const {
+    const Shape *shape() const {
         return shape_;
     }
     BailoutKind bailoutKind() const {
         return bailoutKind_;
     }
     bool congruentTo(MDefinition * const &ins) const {
         if (!ins->isGuardShape())
             return false;
@@ -6911,30 +6911,30 @@ class MInArray
 // Implementation for instanceof operator with specific rhs.
 class MInstanceOf
   : public MUnaryInstruction,
     public InstanceOfPolicy
 {
     CompilerRootObject protoObj_;
 
   public:
-    MInstanceOf(MDefinition *obj, RawObject proto)
+    MInstanceOf(MDefinition *obj, JSObject *proto)
       : MUnaryInstruction(obj),
         protoObj_(proto)
     {
         setResultType(MIRType_Boolean);
     }
 
     INSTRUCTION_HEADER(InstanceOf)
 
     TypePolicy *typePolicy() {
         return this;
     }
 
-    RawObject prototypeObject() {
+    JSObject *prototypeObject() {
         return protoObj_;
     }
 };
 
 // Implementation for instanceof operator with unknown rhs.
 class MCallInstanceOf
   : public MBinaryInstruction,
     public MixPolicy<BoxPolicy<0>, ObjectPolicy<1> >
@@ -7119,17 +7119,17 @@ class MTypeBarrier
     virtual bool neverHoist() const {
         return resultTypeSet()->empty();
     }
 };
 
 // Like MTypeBarrier, guard that the value is in the given type set. This is
 // used before property writes to ensure the value being written is represented
 // in the property types for the object.
-class MMonitorTypes : public MUnaryInstruction
+class MMonitorTypes : public MUnaryInstruction, public BoxInputsPolicy
 {
     const types::StackTypeSet *typeSet_;
 
     MMonitorTypes(MDefinition *def, const types::StackTypeSet *types)
       : MUnaryInstruction(def),
         typeSet_(types)
     {
         setGuard();
@@ -7137,16 +7137,21 @@ class MMonitorTypes : public MUnaryInstr
     }
 
   public:
     INSTRUCTION_HEADER(MonitorTypes)
 
     static MMonitorTypes *New(MDefinition *def, const types::StackTypeSet *types) {
         return new MMonitorTypes(def, types);
     }
+
+    TypePolicy *typePolicy() {
+        return this;
+    }
+
     MDefinition *input() const {
         return getOperand(0);
     }
     const types::StackTypeSet *typeSet() const {
         return typeSet_;
     }
     AliasSet getAliasSet() const {
         return AliasSet::None();
@@ -7324,33 +7329,33 @@ class MFunctionBoundary : public MNullar
                       // before this boundary
     };
 
   private:
     JSScript *script_;
     Type type_;
     unsigned inlineLevel_;
 
-    MFunctionBoundary(RawScript script, Type type, unsigned inlineLevel)
+    MFunctionBoundary(JSScript *script, Type type, unsigned inlineLevel)
       : script_(script), type_(type), inlineLevel_(inlineLevel)
     {
         JS_ASSERT_IF(type != Inline_Exit, script != NULL);
         JS_ASSERT_IF(type == Inline_Enter, inlineLevel != 0);
         setGuard();
     }
 
   public:
     INSTRUCTION_HEADER(FunctionBoundary)
 
-    static MFunctionBoundary *New(RawScript script, Type type,
+    static MFunctionBoundary *New(JSScript *script, Type type,
                                   unsigned inlineLevel = 0) {
         return new MFunctionBoundary(script, type, inlineLevel);
     }
 
-    RawScript script() {
+    JSScript *script() {
         return script_;
     }
 
     Type type() {
         return type_;
     }
 
     unsigned inlineLevel() {
--- a/js/src/ion/MIRGraph.h
+++ b/js/src/ion/MIRGraph.h
@@ -505,21 +505,21 @@ class MIRGraph
     TempAllocator *alloc_;
     MIRGraphExits *exitAccumulator_;
     uint32_t blockIdGen_;
     uint32_t idGen_;
     MBasicBlock *osrBlock_;
     MStart *osrStart_;
 
     // List of compiled/inlined scripts.
-    Vector<RawScript, 4, IonAllocPolicy> scripts_;
+    Vector<JSScript *, 4, IonAllocPolicy> scripts_;
 
     // List of possible scripts that this graph may call. Currently this is
     // only tracked when compiling for parallel execution.
-    Vector<RawScript, 4, IonAllocPolicy> callTargets_;
+    Vector<JSScript *, 4, IonAllocPolicy> callTargets_;
 
     size_t numBlocks_;
 
   public:
     MIRGraph(TempAllocator *alloc)
       : alloc_(alloc),
         exitAccumulator_(NULL),
         blockIdGen_(0),
@@ -629,31 +629,31 @@ class MIRGraph
         return osrBlock_;
     }
     void setOsrStart(MStart *osrStart) {
         osrStart_ = osrStart;
     }
     MStart *osrStart() {
         return osrStart_;
     }
-    bool addScript(RawScript script) {
+    bool addScript(JSScript *script) {
         // The same script may be inlined multiple times, add it only once.
         for (size_t i = 0; i < scripts_.length(); i++) {
             if (scripts_[i] == script)
                 return true;
         }
         return scripts_.append(script);
     }
     size_t numScripts() const {
         return scripts_.length();
     }
     JSScript **scripts() {
         return scripts_.begin();
     }
-    bool addCallTarget(RawScript script) {
+    bool addCallTarget(JSScript *script) {
         for (size_t i = 0; i < callTargets_.length(); i++) {
             if (callTargets_[i] == script)
                 return true;
         }
         return callTargets_.append(script);
     }
     size_t numCallTargets() const {
         return callTargets_.length();
--- a/js/src/ion/ParallelArrayAnalysis.cpp
+++ b/js/src/ion/ParallelArrayAnalysis.cpp
@@ -754,17 +754,17 @@ GetPossibleCallees(JSContext *cx, Handle
 
     unsigned objCount = calleeTypes->getObjectCount();
 
     if (objCount == 0)
         return true;
 
     RootedFunction fun(cx);
     for (unsigned i = 0; i < objCount; i++) {
-        RawObject obj = calleeTypes->getSingleObject(i);
+        JSObject *obj = calleeTypes->getSingleObject(i);
         if (obj && obj->isFunction()) {
             fun = obj->toFunction();
         } else {
             types::TypeObject *typeObj = calleeTypes->getTypeObject(i);
             if (!typeObj)
                 continue;
             fun = typeObj->interpretedFunction;
             if (!fun)
--- a/js/src/ion/ParallelArrayAnalysis.h
+++ b/js/src/ion/ParallelArrayAnalysis.h
@@ -42,17 +42,17 @@ class ParallelCompileContext
     // Should we append a script to the worklist?
     bool appendToWorklist(HandleScript script);
 
     ExecutionMode executionMode() {
         return ParallelExecution;
     }
 
     // Defined in Ion.cpp, so that they can make use of static fns defined there
-    MethodStatus checkScriptSize(JSContext *cx, RawScript script);
+    MethodStatus checkScriptSize(JSContext *cx, JSScript *script);
     MethodStatus compileTransitively();
     AbortReason compile(IonBuilder *builder, MIRGraph *graph,
                         ScopedJSDeletePtr<LifoAlloc> &autoDelete);
 };
 
 
 } // namespace ion
 } // namespace js
--- a/js/src/ion/PcScriptCache.h
+++ b/js/src/ion/PcScriptCache.h
@@ -14,17 +14,17 @@ struct JSRuntime;
 
 namespace js {
 namespace ion {
 
 struct PcScriptCacheEntry
 {
     uint8_t *returnAddress; // Key into the hash table.
     jsbytecode *pc;         // Cached PC.
-    RawScript script;       // Cached script.
+    JSScript *script;       // Cached script.
 };
 
 struct PcScriptCache
 {
     static const uint32_t Length = 73;
 
     // GC number at the time the cache was filled or created.
     // Storing and checking against this number allows us to not bother
@@ -40,17 +40,17 @@ struct PcScriptCache
         this->gcNumber = gcNumber;
     }
 
     // Get a value from the cache. May perform lazy allocation.
     // Defined in PcScriptCache-inl.h.
     bool get(JSRuntime *rt, uint32_t hash, uint8_t *addr,
              JSScript **scriptRes, jsbytecode **pcRes);
 
-    void add(uint32_t hash, uint8_t *addr, jsbytecode *pc, RawScript script) {
+    void add(uint32_t hash, uint8_t *addr, jsbytecode *pc, JSScript *script) {
         entries[hash].returnAddress = addr;
         entries[hash].pc = pc;
         entries[hash].script = script;
     }
 
     static uint32_t Hash(uint8_t *addr) {
         uint32_t key = (uint32_t)((uintptr_t)addr);
         return ((key >> 3) * 2654435761u) % Length;
--- a/js/src/ion/SnapshotWriter.h
+++ b/js/src/ion/SnapshotWriter.h
@@ -28,17 +28,17 @@ class SnapshotWriter
     uint32_t nframes_;
     uint32_t framesWritten_;
     SnapshotOffset lastStart_;
 
     void writeSlotHeader(JSValueType type, uint32_t regCode);
 
   public:
     SnapshotOffset startSnapshot(uint32_t frameCount, BailoutKind kind, bool resumeAfter);
-    void startFrame(JSFunction *fun, RawScript script, jsbytecode *pc, uint32_t exprStack);
+    void startFrame(JSFunction *fun, JSScript *script, jsbytecode *pc, uint32_t exprStack);
 #ifdef TRACK_SNAPSHOTS
     void trackFrame(uint32_t pcOpcode, uint32_t mirOpcode, uint32_t mirId,
                                      uint32_t lirOpcode, uint32_t lirId);
 #endif
     void endFrame();
 
     void addSlot(const FloatRegister &reg);
     void addSlot(JSValueType type, const Register &reg);
--- a/js/src/ion/Snapshots.cpp
+++ b/js/src/ion/Snapshots.cpp
@@ -25,17 +25,17 @@ using namespace js::ion;
 // Snapshot header:
 //
 //   [vwu] bits (n-31]: frame count
 //         bits [0,n):  bailout kind (n = BAILOUT_KIND_BITS)
 //
 // Snapshot body, repeated "frame count" times, from oldest frame to newest frame.
 // Note that the first frame doesn't have the "parent PC" field.
 //
-//   [ptr] Debug only: RawScript
+//   [ptr] Debug only: JSScript *
 //   [vwu] pc offset
 //   [vwu] # of slots, including nargs
 // [slot*] N slot entries, where N = nargs + nfixed + stackDepth
 //
 // Encodings:
 //   [ptr] A fixed-size pointer.
 //   [vwu] A variable-width unsigned integer.
 //   [vws] A variable-width signed integer.
@@ -291,17 +291,17 @@ SnapshotWriter::startSnapshot(uint32_t f
     if (resumeAfter)
         bits |= (1 << BAILOUT_RESUME_SHIFT);
 
     writer_.writeUnsigned(bits);
     return lastStart_;
 }
 
 void
-SnapshotWriter::startFrame(JSFunction *fun, RawScript script, jsbytecode *pc, uint32_t exprStack)
+SnapshotWriter::startFrame(JSFunction *fun, JSScript *script, jsbytecode *pc, uint32_t exprStack)
 {
     JS_ASSERT(CountArgSlots(script, fun) < SNAPSHOT_MAX_NARGS);
 
     uint32_t implicit = StartArgSlot(script, fun);
     uint32_t formalArgs = CountArgSlots(script, fun);
 
     nslots_ = formalArgs + script->nfixed + exprStack;
     slotsWritten_ = 0;
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -238,17 +238,17 @@ StringsEqual(JSContext *cx, HandleString
     *res = (equal == Equal);
     return true;
 }
 
 template bool StringsEqual<true>(JSContext *cx, HandleString lhs, HandleString rhs, JSBool *res);
 template bool StringsEqual<false>(JSContext *cx, HandleString lhs, HandleString rhs, JSBool *res);
 
 JSBool
-ObjectEmulatesUndefined(RawObject obj)
+ObjectEmulatesUndefined(JSObject *obj)
 {
     return EmulatesUndefined(obj);
 }
 
 bool
 IteratorMore(JSContext *cx, HandleObject obj, JSBool *res)
 {
     RootedValue tmp(cx);
--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@@ -249,17 +249,17 @@ template <> struct TypeToArgProperties<H
 };
 template <> struct TypeToArgProperties<HandleFunction> {
     static const uint32_t result = TypeToArgProperties<JSFunction *>::result | VMFunction::ByRef;
 };
 template <> struct TypeToArgProperties<Handle<StaticBlockObject *> > {
     static const uint32_t result = TypeToArgProperties<StaticBlockObject *>::result | VMFunction::ByRef;
 };
 template <> struct TypeToArgProperties<HandleScript> {
-    static const uint32_t result = TypeToArgProperties<RawScript>::result | VMFunction::ByRef;
+    static const uint32_t result = TypeToArgProperties<JSScript *>::result | VMFunction::ByRef;
 };
 template <> struct TypeToArgProperties<HandleValue> {
     static const uint32_t result = TypeToArgProperties<Value>::result | VMFunction::ByRef;
 };
 template <> struct TypeToArgProperties<MutableHandleValue> {
     static const uint32_t result = TypeToArgProperties<Value>::result | VMFunction::ByRef;
 };
 template <> struct TypeToArgProperties<HandleShape> {
@@ -486,17 +486,17 @@ bool StrictlyEqual(JSContext *cx, Mutabl
 bool LessThan(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, JSBool *res);
 bool LessThanOrEqual(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, JSBool *res);
 bool GreaterThan(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, JSBool *res);
 bool GreaterThanOrEqual(JSContext *cx, MutableHandleValue lhs, MutableHandleValue rhs, JSBool *res);
 
 template<bool Equal>
 bool StringsEqual(JSContext *cx, HandleString left, HandleString right, JSBool *res);
 
-JSBool ObjectEmulatesUndefined(RawObject obj);
+JSBool ObjectEmulatesUndefined(JSObject *obj);
 
 bool IteratorMore(JSContext *cx, HandleObject obj, JSBool *res);
 
 // Allocation functions for JSOP_NEWARRAY and JSOP_NEWOBJECT and parallel array inlining
 JSObject *NewInitParallelArray(JSContext *cx, HandleObject templateObj);
 JSObject *NewInitArray(JSContext *cx, uint32_t count, types::TypeObject *type);
 JSObject *NewInitObject(JSContext *cx, HandleObject templateObject);
 
--- a/js/src/ion/ValueNumbering.h
+++ b/js/src/ion/ValueNumbering.h
@@ -104,18 +104,23 @@ class ValueNumberData : public TempObjec
     }
 
     uint32_t valueNumber() {
         return number;
     }
     // Set the class of this to the given representative value.
     void setClass(MDefinition *thisDef, MDefinition *rep) {
         JS_ASSERT(thisDef->valueNumberData() == this);
-        // If this value should already be in the given set, don't do anything
-        if (number == rep->valueNumber())
+        // If we are attempting to insert ourself, then nothing needs to be done.
+        // However, if the definition to be inserted already has the correct value number,
+        // it still needs to be inserted, since the value number needs to be updated lazily.
+        // this updating tactic can leave the world in a state where thisDef is not in the
+        // equivalence class of rep, but it has the same value number. Defs in this state
+        // need to be re-processed.
+        if (this == rep->valueNumberData())
             return;
 
         if (classNext)
             classNext->valueNumberData()->classPrev = classPrev;
         if (classPrev)
             classPrev->valueNumberData()->classNext = classNext;
 
 
--- a/js/src/ion/shared/CodeGenerator-shared.h
+++ b/js/src/ion/shared/CodeGenerator-shared.h
@@ -369,24 +369,24 @@ class OutOfLineCode : public TempObject
         return &rejoin_;
     }
     void setFramePushed(uint32_t framePushed) {
         framePushed_ = framePushed;
     }
     uint32_t framePushed() const {
         return framePushed_;
     }
-    void setSource(RawScript script, jsbytecode *pc) {
+    void setSource(JSScript *script, jsbytecode *pc) {
         script_ = script;
         pc_ = pc;
     }
     jsbytecode *pc() {
         return pc_;
     }
-    RawScript script() {
+    JSScript *script() {
         return script_;
     }
 };
 
 // For OOL paths that want a specific-typed code generator.
 template <typename T>
 class OutOfLineCodeBase : public OutOfLineCode
 {
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/testBug863867.js
@@ -0,0 +1,34 @@
+assertEq((function() {
+  'use asm';
+  function _main() {
+    var $1=0, $2=0, $3=0, $4=0, $5=0, $6=0, $7=0, $8=0, $9=0, $10=0, label=0;
+    label = 1;
+    while (1) {
+      switch (label | 0) {
+       case 1:
+        $2 = $1 + 14 | 0;
+        $3 = $1;
+        label = 20;
+        break;
+       case 20:
+        $5 = $2;
+        $4 = $3;
+        label = 24;
+        break;
+       case 24:
+        $7 = $5 + 1 | 0;
+        $8 = $4 + 1 | 0;
+        return $8|0;
+       case 49:
+        $9 = $6 + 1 | 0;
+        if ($10) {
+          $6 = $9;
+          break;
+        }
+        return 0;
+      }
+    }
+    return 0;
+  }
+  return _main;
+})()(), 1);
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -1953,17 +1953,17 @@ ScriptAnalysis::needsArgsObj(JSContext *
 }
 
 CrossSSAValue
 CrossScriptSSA::foldValue(const CrossSSAValue &cv)
 {
     const Frame &frame = getFrame(cv.frame);
     const SSAValue &v = cv.v;
 
-    RawScript parentScript = NULL;
+    JSScript *parentScript = NULL;
     ScriptAnalysis *parentAnalysis = NULL;
     if (frame.parent != INVALID_FRAME) {
         parentScript = getFrame(frame.parent).script;
         parentAnalysis = parentScript->analysis();
     }
 
     if (v.kind() == SSAValue::VAR && v.varInitial() && parentScript) {
         uint32_t slot = v.varSlot();
@@ -1986,17 +1986,17 @@ CrossScriptSSA::foldValue(const CrossSSA
             }
             break;
 
           case JSOP_CALL: {
             /*
              * If there is a single inline callee with a single return site,
              * propagate back to that.
              */
-            RawScript callee = NULL;
+            JSScript *callee = NULL;
             uint32_t calleeFrame = INVALID_FRAME;
             for (unsigned i = 0; i < numFrames(); i++) {
                 if (iterFrame(i).parent == cv.frame && iterFrame(i).parentpc == pc) {
                     if (callee)
                         return cv;  /* Multiple callees */
                     callee = iterFrame(i).script;
                     calleeFrame = iterFrame(i).index;
                 }
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -167,17 +167,17 @@ class Bytecode
     /* Types for all values pushed by this bytecode. */
     types::StackTypeSet *pushedTypes;
 
     /* Any type barriers in place at this bytecode. */
     types::TypeBarrier *typeBarriers;
 };
 
 static inline unsigned
-GetDefCount(RawScript script, unsigned offset)
+GetDefCount(JSScript *script, unsigned offset)
 {
     JS_ASSERT(offset < script->length);
     jsbytecode *pc = script->code + offset;
 
     /*
      * Add an extra pushed value for OR/AND opcodes, so that they are included
      * in the pushed array of stack values for type inference.
      */
@@ -194,17 +194,17 @@ GetDefCount(RawScript script, unsigned o
          */
         return (pc[1] + 1);
       default:
         return StackDefs(script, pc);
     }
 }
 
 static inline unsigned
-GetUseCount(RawScript script, unsigned offset)
+GetUseCount(JSScript *script, unsigned offset)
 {
     JS_ASSERT(offset < script->length);
     jsbytecode *pc = script->code + offset;
 
     if (JSOp(*pc) == JSOP_PICK)
         return (pc[1] + 1);
     if (js_CodeSpec[*pc].nuses == -1)
         return StackUses(script, pc);
@@ -321,17 +321,17 @@ NegateCompareOp(JSOp op)
         return JSOP_STRICTNE;
       default:
         JS_NOT_REACHED("unrecognized op");
         return op;
     }
 }
 
 static inline unsigned
-FollowBranch(JSContext *cx, RawScript script, unsigned offset)
+FollowBranch(JSContext *cx, JSScript *script, unsigned offset)
 {
     /*
      * Get the target offset of a branch. For GOTO opcodes implementing
      * 'continue' statements, short circuit any artificial backwards jump
      * inserted by the emitter.
      */
     jsbytecode *pc = script->code + offset;
     unsigned targetOffset = offset + GET_JUMP_OFFSET(pc);
@@ -349,28 +349,28 @@ static inline uint32_t CalleeSlot() {
     return 0;
 }
 static inline uint32_t ThisSlot() {
     return 1;
 }
 static inline uint32_t ArgSlot(uint32_t arg) {
     return 2 + arg;
 }
-static inline uint32_t LocalSlot(RawScript script, uint32_t local) {
+static inline uint32_t LocalSlot(JSScript *script, uint32_t local) {
     return 2 + (script->function() ? script->function()->nargs : 0) + local;
 }
-static inline uint32_t TotalSlots(RawScript script) {
+static inline uint32_t TotalSlots(JSScript *script) {
     return LocalSlot(script, 0) + script->nfixed;
 }
 
-static inline uint32_t StackSlot(RawScript script, uint32_t index) {
+static inline uint32_t StackSlot(JSScript *script, uint32_t index) {
     return TotalSlots(script) + index;
 }
 
-static inline uint32_t GetBytecodeSlot(RawScript script, jsbytecode *pc)
+static inline uint32_t GetBytecodeSlot(JSScript *script, jsbytecode *pc)
 {
     switch (JSOp(*pc)) {
 
       case JSOP_GETARG:
       case JSOP_CALLARG:
       case JSOP_SETARG:
         return ArgSlot(GET_SLOTNO(pc));
 
@@ -536,17 +536,17 @@ struct LifetimeVariable
         }
         return UINT32_MAX;
     }
     uint32_t firstWrite(LoopAnalysis *loop) const {
         return firstWrite(loop->head, loop->backedge);
     }
 
     /* Return true if the variable cannot decrease during the body of a loop. */
-    bool nonDecreasing(RawScript script, LoopAnalysis *loop) const {
+    bool nonDecreasing(JSScript *script, LoopAnalysis *loop) const {
         Lifetime *segment = lifetime ? lifetime : saved;
         while (segment && segment->start <= loop->backedge) {
             if (segment->start >= loop->head && segment->write) {
                 switch (JSOp(script->code[segment->start])) {
                   case JSOP_INCLOCAL:
                   case JSOP_LOCALINC:
                   case JSOP_INCARG:
                   case JSOP_ARGINC:
@@ -853,17 +853,17 @@ class ScriptAnalysis
     uint32_t numReturnSites_;
 
     /* --------- Lifetime analysis --------- */
 
     LifetimeVariable *lifetimes;
 
   public:
 
-    ScriptAnalysis(RawScript script) {
+    ScriptAnalysis(JSScript *script) {
         mozilla::PodZero(this);
         this->script_ = script;
 #ifdef DEBUG
         this->originalDebugMode_ = script_->compartment()->debugMode();
 #endif
     }
 
     bool ranBytecode() { return ranBytecode_; }
@@ -1226,17 +1226,17 @@ class CrossScriptSSA
 
     struct Frame {
         uint32_t index;
         JSScript *script;
         uint32_t depth;  /* Distance from outer frame to this frame, in sizeof(Value) */
         uint32_t parent;
         jsbytecode *parentpc;
 
-        Frame(uint32_t index, RawScript script, uint32_t depth, uint32_t parent,
+        Frame(uint32_t index, JSScript *script, uint32_t depth, uint32_t parent,
               jsbytecode *parentpc)
           : index(index), script(script), depth(depth), parent(parent), parentpc(parentpc)
         {}
     };
 
     const Frame &getFrame(uint32_t index) {
         if (index == OUTER_FRAME)
             return outerFrame;
@@ -1245,40 +1245,40 @@ class CrossScriptSSA
 
     unsigned numFrames() { return 1 + inlineFrames.length(); }
     const Frame &iterFrame(unsigned i) {
         if (i == 0)
             return outerFrame;
         return inlineFrames[i - 1];
     }
 
-    RawScript outerScript() { return outerFrame.script; }
+    JSScript *outerScript() { return outerFrame.script; }
 
     /* Total length of scripts preceding a frame. */
     size_t frameLength(uint32_t index) {
         if (index == OUTER_FRAME)
             return 0;
         size_t res = outerFrame.script->length;
         for (unsigned i = 0; i < index; i++)
             res += inlineFrames[i].script->length;
         return res;
     }
 
     types::StackTypeSet *getValueTypes(const CrossSSAValue &cv) {
         return getFrame(cv.frame).script->analysis()->getValueTypes(cv.v);
     }
 
-    bool addInlineFrame(RawScript script, uint32_t depth, uint32_t parent,
+    bool addInlineFrame(JSScript *script, uint32_t depth, uint32_t parent,
                         jsbytecode *parentpc)
     {
         uint32_t index = inlineFrames.length();
         return inlineFrames.append(Frame(index, script, depth, parent, parentpc));
     }
 
-    CrossScriptSSA(JSContext *cx, RawScript outer)
+    CrossScriptSSA(JSContext *cx, JSScript *outer)
         : outerFrame(OUTER_FRAME, outer, 0, INVALID_FRAME, NULL), inlineFrames(cx)
     {}
 
     CrossSSAValue foldValue(const CrossSSAValue &cv);
 
   private:
     Frame outerFrame;
     Vector<Frame> inlineFrames;
--- a/js/src/jsapi-tests/testTypedArrays.cpp
+++ b/js/src/jsapi-tests/testTypedArrays.cpp
@@ -54,16 +54,21 @@ BEGIN_TEST(testTypedArrays)
 }
 
 template<JSObject *Create(JSContext *, uint32_t),
          typename Element,
          Element *GetData(JSObject *)>
 bool
 TestPlainTypedArray(JSContext *cx)
 {
+    {
+        RootedObject notArray(cx, Create(cx, UINT32_MAX));
+        CHECK(!notArray);
+    }
+
     RootedObject array(cx, Create(cx, 7));
     CHECK(JS_IsTypedArrayObject(array));
     RootedObject proto(cx);
     JS_GetPrototype(cx, array, proto.address());
     CHECK(!JS_IsTypedArrayObject(proto));
     RootedObject dummy(cx, JS_GetParent(proto));
     CHECK(!JS_IsTypedArrayObject(dummy));
 
@@ -90,16 +95,21 @@ TestArrayFromBuffer(JSContext *cx)
 {
     size_t elts = 8;
     size_t nbytes = elts * sizeof(Element);
     RootedObject buffer(cx, JS_NewArrayBuffer(cx, nbytes));
     uint8_t *bufdata;
     CHECK(bufdata = JS_GetArrayBufferData(buffer));
     memset(bufdata, 1, nbytes);
 
+    {
+        RootedObject notArray(cx, CreateWithBuffer(cx, buffer, UINT32_MAX, -1));
+        CHECK(!notArray);
+    }
+
     RootedObject array(cx, CreateWithBuffer(cx, buffer, 0, -1));
     CHECK_EQUAL(JS_GetTypedArrayLength(array), elts);
     CHECK_EQUAL(JS_GetTypedArrayByteOffset(array), 0);
     CHECK_EQUAL(JS_GetTypedArrayByteLength(array), nbytes);
     CHECK_EQUAL(JS_GetArrayBufferViewBuffer(array), (JSObject*) buffer);
 
     Element *data;
     CHECK(data = GetData(array));
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3230,17 +3230,17 @@ JS_PUBLIC_API(JSBool)
 JS_LinkConstructorAndPrototype(JSContext *cx, JSObject *ctorArg, JSObject *protoArg)
 {
     RootedObject ctor(cx, ctorArg);
     RootedObject proto(cx, protoArg);
     return LinkConstructorAndPrototype(cx, ctor, proto);
 }
 
 JS_PUBLIC_API(JSClass *)
-JS_GetClass(RawObject obj)
+JS_GetClass(JSObject *obj)
 {
     return obj->getJSClass();
 }
 
 JS_PUBLIC_API(JSBool)
 JS_InstanceOf(JSContext *cx, JSObject *objArg, JSClass *clasp, jsval *argv)
 {
     RootedObject obj(cx, objArg);
@@ -3266,24 +3266,24 @@ JS_HasInstance(JSContext *cx, JSObject *
     RootedObject obj(cx, objArg);
     RootedValue value(cx, valueArg);
     AssertHeapIsIdle(cx);
     assertSameCompartment(cx, obj, value);
     return HasInstance(cx, obj, value, bp);
 }
 
 JS_PUBLIC_API(void *)
-JS_GetPrivate(RawObject obj)
+JS_GetPrivate(JSObject *obj)
 {
     /* This function can be called by a finalizer. */
     return obj->getPrivate();
 }
 
 JS_PUBLIC_API(void)
-JS_SetPrivate(RawObject obj, void *data)
+JS_SetPrivate(JSObject *obj, void *data)
 {
     /* This function can be called by a finalizer. */
     obj->setPrivate(data);
 }
 
 JS_PUBLIC_API(void *)
 JS_GetInstancePrivate(JSContext *cx, JSObject *objArg, JSClass *clasp, jsval *argv)
 {
@@ -3311,17 +3311,17 @@ JS_SetPrototype(JSContext *cx, JSObject 
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, proto);
 
     return SetClassAndProto(cx, obj, obj->getClass(), proto, JS_FALSE);
 }
 
 JS_PUBLIC_API(JSObject *)
-JS_GetParent(RawObject obj)
+JS_GetParent(JSObject *obj)
 {
     JS_ASSERT(!obj->isScope());
     return obj->getParent();
 }
 
 JS_PUBLIC_API(JSBool)
 JS_SetParent(JSContext *cx, JSObject *objArg, JSObject *parentArg)
 {
@@ -4485,17 +4485,17 @@ JS_DeleteElement(JSContext *cx, JSObject
 
 JS_PUBLIC_API(JSBool)
 JS_DeleteProperty(JSContext *cx, JSObject *objArg, const char *name)
 {
     jsval junk;
     return JS_DeleteProperty2(cx, objArg, name, &junk);
 }
 
-static RawShape
+static Shape *
 LastConfigurableShape(JSObject *obj)
 {
     for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
         Shape *shape = &r.front();
         if (shape->configurable())
             return shape;
     }
     return NULL;
@@ -4572,43 +4572,43 @@ JS_Enumerate(JSContext *cx, JSObject *ob
  *     prop_iterator_class somehow...
  * + preserve the obj->enumerate API while optimizing the native object case
  * + native case here uses a JSShape *, but that iterates in reverse!
  * + so we make non-native match, by reverse-iterating after JS_Enumerating
  */
 const uint32_t JSSLOT_ITER_INDEX = 0;
 
 static void
-prop_iter_finalize(FreeOp *fop, RawObject obj)
+prop_iter_finalize(FreeOp *fop, JSObject *obj)
 {
     void *pdata = obj->getPrivate();
     if (!pdata)
         return;
 
     if (obj->getSlot(JSSLOT_ITER_INDEX).toInt32() >= 0) {
         /* Non-native case: destroy the ida enumerated when obj was created. */
         JSIdArray *ida = (JSIdArray *) pdata;
         DestroyIdArray(fop, ida);
     }
 }
 
 static void
-prop_iter_trace(JSTracer *trc, RawObject obj)
+prop_iter_trace(JSTracer *trc, JSObject *obj)
 {
     void *pdata = obj->getPrivate();
     if (!pdata)
         return;
 
     if (obj->getSlot(JSSLOT_ITER_INDEX).toInt32() < 0) {
         /*
          * Native case: just mark the next property to visit. We don't need a
          * barrier here because the pointer is updated via setPrivate, which
          * always takes a barrier.
          */
-        RawShape tmp = static_cast<RawShape>(pdata);
+        Shape *tmp = static_cast<Shape *>(pdata);
         MarkShapeUnbarriered(trc, &tmp, "prop iter shape");
         obj->setPrivateUnbarriered(tmp);
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;
         MarkIdRange(trc, ida->length, ida->vector, "prop iter");
     }
 }
@@ -4670,26 +4670,26 @@ JS_NextProperty(JSContext *cx, JSObject 
 
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, iterobj);
     int32_t i = iterobj->getSlot(JSSLOT_ITER_INDEX).toInt32();
     if (i < 0) {
         /* Native case: private data is a property tree node pointer. */
         JS_ASSERT(iterobj->getParent()->isNative());
-        RawShape shape = static_cast<RawShape>(iterobj->getPrivate());
+        Shape *shape = static_cast<Shape *>(iterobj->getPrivate());
 
         while (shape->previous() && !shape->enumerable())
             shape = shape->previous();
 
         if (!shape->previous()) {
             JS_ASSERT(shape->isEmptyShape());
             *idp = JSID_VOID;
         } else {
-            iterobj->setPrivateGCThing(const_cast<RawShape>(shape->previous().get()));
+            iterobj->setPrivateGCThing(const_cast<Shape *>(shape->previous().get()));
             *idp = shape->propid();
         }
     } else {
         /* Non-native case: use the ida enumerated when iterobj was created. */
         JSIdArray *ida = (JSIdArray *) iterobj->getPrivate();
         JS_ASSERT(i <= ida->length);
         STATIC_ASSUME(i <= ida->length);
         if (i == 0) {
@@ -4714,23 +4714,23 @@ JS_ArrayIterator(JSContext *cx, unsigned
     JSObject *iterobj = ElementIteratorObject::create(cx, target);
     if (!iterobj)
         return false;
     vp->setObject(*iterobj);
     return true;
 }
 
 JS_PUBLIC_API(jsval)
-JS_GetReservedSlot(RawObject obj, uint32_t index)
+JS_GetReservedSlot(JSObject *obj, uint32_t index)
 {
     return obj->getReservedSlot(index);
 }
 
 JS_PUBLIC_API(void)
-JS_SetReservedSlot(RawObject obj, uint32_t index, RawValue value)
+JS_SetReservedSlot(JSObject *obj, uint32_t index, Value value)
 {
     obj->setReservedSlot(index, value);
 }
 
 JS_PUBLIC_API(JSObject *)
 JS_NewArrayObject(JSContext *cx, int length, jsval *vector)
 {
     AutoArrayRooter tvr(cx, length, vector);
@@ -4930,23 +4930,23 @@ JS_GetFunctionDisplayId(JSFunction *fun)
 
 JS_PUBLIC_API(uint16_t)
 JS_GetFunctionArity(JSFunction *fun)
 {
     return fun->nargs;
 }
 
 JS_PUBLIC_API(JSBool)
-JS_ObjectIsFunction(JSContext *cx, RawObject obj)
+JS_ObjectIsFunction(JSContext *cx, JSObject *obj)
 {
     return obj->isFunction();
 }
 
 JS_PUBLIC_API(JSBool)
-JS_ObjectIsCallable(JSContext *cx, RawObject obj)
+JS_ObjectIsCallable(JSContext *cx, JSObject *obj)
 {
     return obj->isCallable();
 }
 
 JS_PUBLIC_API(JSBool)
 JS_IsNativeFunction(JSObject *funobj, JSNative call)
 {
     if (!funobj->isFunction())
@@ -5068,17 +5068,17 @@ JS_DefineFunctions(JSContext *cx, JSObje
                 return JS_FALSE;
             if (!funVal.isUndefined()) {
                 if (!JSObject::defineProperty(cx, obj, atom->asPropertyName(), funVal,
                                              NULL, NULL, flags & ~JSFUN_FLAGS_MASK))
                 {
                     return JS_FALSE;
                 }
             } else {
-                RawFunction fun = DefineFunction(cx, obj, id, /* native = */ NULL, fs->nargs, 0,
+                JSFunction *fun = DefineFunction(cx, obj, id, /* native = */ NULL, fs->nargs, 0,
                                                  JSFunction::ExtendedFinalizeKind, SingletonObject);
                 if (!fun)
                     return JS_FALSE;
                 fun->setIsSelfHostedBuiltin();
                 fun->setExtendedSlot(0, PrivateValue(const_cast<JSFunctionSpec*>(fs)));
                 funVal.setObject(*fun);
             }
             RootedObject holder(cx, cx->global()->intrinsicsHolder());
@@ -7193,17 +7193,17 @@ JS::AssertArgumentsAreSane(JSContext *cx
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, value);
 }
 #endif /* DEBUG */
 
 JS_PUBLIC_API(void *)
-JS_EncodeScript(JSContext *cx, RawScript scriptArg, uint32_t *lengthp)
+JS_EncodeScript(JSContext *cx, JSScript *scriptArg, uint32_t *lengthp)
 {
     XDREncoder encoder(cx);
     RootedScript script(cx, scriptArg);
     if (!encoder.codeScript(&script))
         return NULL;
     return encoder.forgetData(lengthp);
 }
 
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -1312,25 +1312,25 @@ JSID_TO_GCTHING(jsid id)
 /*
  * A void jsid is not a valid id and only arises as an exceptional API return
  * value, such as in JS_NextProperty. Embeddings must not pass JSID_VOID into
  * JSAPI entry points expecting a jsid and do not need to handle JSID_VOID in
  * hooks receiving a jsid except when explicitly noted in the API contract.
  */
 
 static JS_ALWAYS_INLINE JSBool
-JSID_IS_VOID(const js::RawId id)
+JSID_IS_VOID(const jsid id)
 {
     JS_ASSERT_IF(((size_t)JSID_BITS(id) & JSID_TYPE_MASK) == JSID_TYPE_VOID,
                  JSID_BITS(id) == JSID_TYPE_VOID);
     return ((size_t)JSID_BITS(id) == JSID_TYPE_VOID);
 }
 
 static JS_ALWAYS_INLINE JSBool
-JSID_IS_EMPTY(const js::RawId id)
+JSID_IS_EMPTY(const jsid id)
 {
     return ((size_t)JSID_BITS(id) == JSID_TYPE_OBJECT);
 }
 
 #undef id
 
 #ifdef JS_USE_JSID_STRUCT_TYPES
 extern JS_PUBLIC_DATA(jsid) JSID_VOID;
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -128,17 +128,17 @@ js::StringIsArrayIndex(JSLinearString *s
         JS_ASSERT(index <= MAX_ARRAY_INDEX);
         *indexp = index;
         return true;
     }
 
     return false;
 }
 
-RawShape
+Shape *
 js::GetDenseArrayShape(JSContext *cx, HandleObject globalObj)
 {
     JS_ASSERT(globalObj);
 
     JSObject *proto = globalObj->global().getOrCreateArrayPrototype(cx);
     if (!proto)
         return NULL;
 
@@ -1547,17 +1547,17 @@ MatchNumericComparator(const Value &v)
     JSObject &obj = v.toObject();
     if (!obj.isFunction())
         return Match_None;
 
     JSFunction *fun = obj.toFunction();
     if (!fun->hasScript())
         return Match_None;
 
-    RawScript script = fun->nonLazyScript();
+    JSScript *script = fun->nonLazyScript();
     jsbytecode *pc = script->code;
 
     uint16_t arg0, arg1;
     if (JSOp(*pc) != JSOP_GETARG)
         return Match_None;
     arg0 = GET_ARGNO(pc);
     pc += JSOP_GETARG_LENGTH;
 
@@ -2897,17 +2897,17 @@ EnsureNewArrayElements(JSContext *cx, JS
 
     JS_ASSERT_IF(cap, !obj->hasDynamicElements());
 
     return true;
 }
 
 template<bool allocateCapacity>
 static JS_ALWAYS_INLINE JSObject *
-NewArray(JSContext *cx, uint32_t length, RawObject protoArg, NewObjectKind newKind = GenericObject)
+NewArray(JSContext *cx, uint32_t length, JSObject *protoArg, NewObjectKind newKind = GenericObject)
 {
     gc::AllocKind allocKind = GuessArrayGCKind(length);
     JS_ASSERT(CanBeFinalizedInBackground(allocKind, &ArrayClass));
     allocKind = GetBackgroundAllocKind(allocKind);
 
     NewObjectCache &cache = cx->runtime->newObjectCache;
 
     NewObjectCache::EntryIndex entry = -1;
@@ -2966,51 +2966,51 @@ NewArray(JSContext *cx, uint32_t length,
     if (allocateCapacity && !EnsureNewArrayElements(cx, obj, length))
         return NULL;
 
     Probes::createObject(cx, obj);
     return obj;
 }
 
 JSObject * JS_FASTCALL
-js::NewDenseEmptyArray(JSContext *cx, RawObject proto /* = NULL */,
+js::NewDenseEmptyArray(JSContext *cx, JSObject *proto /* = NULL */,
                        NewObjectKind newKind /* = GenericObject */)
 {
     return NewArray<false>(cx, 0, proto, newKind);
 }
 
 JSObject * JS_FASTCALL
-js::NewDenseAllocatedArray(JSContext *cx, uint32_t length, RawObject proto /* = NULL */,
+js::NewDenseAllocatedArray(JSContext *cx, uint32_t length, JSObject *proto /* = NULL */,
                            NewObjectKind newKind /* = GenericObject */)
 {
     return NewArray<true>(cx, length, proto, newKind);
 }
 
 JSObject * JS_FASTCALL
-js::NewDenseUnallocatedArray(JSContext *cx, uint32_t length, RawObject proto /* = NULL */,
+js::NewDenseUnallocatedArray(JSContext *cx, uint32_t length, JSObject *proto /* = NULL */,
                              NewObjectKind newKind /* = GenericObject */)
 {
     return NewArray<false>(cx, length, proto, newKind);
 }
 
 #ifdef JS_METHODJIT
 JSObject * JS_FASTCALL
 mjit::stubs::NewDenseUnallocatedArray(VMFrame &f, uint32_t length)
 {
-    JSObject *obj = NewArray<false>(f.cx, length, (RawObject)f.scratch);
+    JSObject *obj = NewArray<false>(f.cx, length, (JSObject *)f.scratch);
     if (!obj)
         THROWV(NULL);
 
     return obj;
 }
 #endif
 
 JSObject *
 js::NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32_t elementOffset,
-                        RawObject proto /* = NULL */)
+                        JSObject *proto /* = NULL */)
 {
     JS_ASSERT(!src->isIndexed());
 
     JSObject* obj = NewArray<true>(cx, length, proto);
     if (!obj)
         return NULL;
 
     JS_ASSERT(obj->getDenseCapacity() >= length);
@@ -3022,17 +3022,17 @@ js::NewDenseCopiedArray(JSContext *cx, u
         obj->initDenseElements(0, vp, length);
 
     return obj;
 }
 
 // values must point at already-rooted Value objects
 JSObject *
 js::NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values,
-                        RawObject proto /* = NULL */, NewObjectKind newKind /* = GenericObject */)
+                        JSObject *proto /* = NULL */, NewObjectKind newKind /* = GenericObject */)
 {
     JSObject* obj = NewArray<true>(cx, length, proto);
     if (!obj)
         return NULL;
 
     JS_ASSERT(obj->getDenseCapacity() >= length);
 
     obj->setDenseInitializedLength(values ? length : 0);
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -41,39 +41,39 @@ js_InitArrayClass(JSContext *cx, js::Han
 
 extern bool
 js_InitContextBusyArrayTable(JSContext *cx);
 
 namespace js {
 
 /* Create a dense array with no capacity allocated, length set to 0. */
 extern JSObject * JS_FASTCALL
-NewDenseEmptyArray(JSContext *cx, RawObject proto = NULL,
+NewDenseEmptyArray(JSContext *cx, JSObject *proto = NULL,
                    NewObjectKind newKind = GenericObject);
 
 /* Create a dense array with length and capacity == 'length', initialized length set to 0. */
 extern JSObject * JS_FASTCALL
-NewDenseAllocatedArray(JSContext *cx, uint32_t length, RawObject proto = NULL,
+NewDenseAllocatedArray(JSContext *cx, uint32_t length, JSObject *proto = NULL,
                        NewObjectKind newKind = GenericObject);
 
 /*
  * Create a dense array with a set length, but without allocating space for the
  * contents. This is useful, e.g., when accepting length from the user.
  */
 extern JSObject * JS_FASTCALL
-NewDenseUnallocatedArray(JSContext *cx, uint32_t length, RawObject proto = NULL,
+NewDenseUnallocatedArray(JSContext *cx, uint32_t length, JSObject *proto = NULL,
                          NewObjectKind newKind = GenericObject);
 
 /* Create a dense array with a copy of the dense array elements in src. */
 extern JSObject *
-NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32_t elementOffset, RawObject proto = NULL);
+NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32_t elementOffset, JSObject *proto = NULL);
 
 /* Create a dense array from the given array values, which must be rooted */
 extern JSObject *
-NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, RawObject proto = NULL,
+NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, JSObject *proto = NULL,
                     NewObjectKind newKind = GenericObject);
 
 /*
  * Determines whether a write to the given element on |obj| should fail because
  * |obj| is an Array with a non-writable length, and writing that element would
  * increase the length of the array.
  */
 extern bool
@@ -83,17 +83,17 @@ WouldDefinePastNonwritableLength(JSConte
 /*
  * Canonicalize |vp| to a uint32_t value potentially suitable for use as an
  * array length.
  */
 extern bool
 CanonicalizeArrayLengthValue(JSContext *cx, HandleValue v, uint32_t *canonicalized);
 
 /* Get the common shape used by all dense arrays with a prototype at globalObj. */
-extern RawShape
+extern Shape *
 GetDenseArrayShape(JSContext *cx, HandleObject globalObj);
 
 extern JSBool
 GetLengthProperty(JSContext *cx, HandleObject obj, uint32_t *lengthp);
 
 extern JSBool
 SetLengthProperty(JSContext *cx, HandleObject obj, double length);
 
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -228,106 +228,106 @@ enum OwnCharsBehavior
 };
 
 /*
  * When the jschars reside in a freshly allocated buffer the memory can be used
  * as a new JSAtom's storage without copying. The contract is that the caller no
  * longer owns the memory and this method is responsible for freeing the memory.
  */
 JS_ALWAYS_INLINE
-static RawAtom
+static JSAtom *
 AtomizeAndTakeOwnership(JSContext *cx, const jschar *tbchars, size_t length,
                            InternBehavior ib)
 {
     JS_ASSERT(tbchars[length] == 0);
 
-    if (RawAtom s = cx->runtime->staticStrings.lookup(tbchars, length)) {
+    if (JSAtom *s = cx->runtime->staticStrings.lookup(tbchars, length)) {
         js_free((void*)tbchars);
         return s;
     }
 
     /*
      * If a GC occurs at js_NewStringCopy then |p| will still have the correct
      * hash, allowing us to avoid rehashing it. Even though the hash is
      * unchanged, we need to re-lookup the table position because a last-ditch
      * GC will potentially free some table entries.
      */
     AtomSet& atoms = cx->runtime->atoms;
     AtomSet::AddPtr p = atoms.lookupForAdd(AtomHasher::Lookup(tbchars, length));
     SkipRoot skipHash(cx, &p); /* Prevent the hash from being poisoned. */
     if (p) {
-        RawAtom atom = p->asPtr();
+        JSAtom *atom = p->asPtr();
         p->setTagged(bool(ib));
         js_free((void*)tbchars);
         return atom;
     }
 
     AutoEnterAtomsCompartment ac(cx);
 
-    RawFlatString flat = js_NewString<CanGC>(cx, const_cast<jschar*>(tbchars), length);
+    JSFlatString *flat = js_NewString<CanGC>(cx, const_cast<jschar*>(tbchars), length);
     if (!flat) {
         js_free((void*)tbchars);
         return NULL;
     }
 
-    RawAtom atom = flat->morphAtomizedStringIntoAtom();
+    JSAtom *atom = flat->morphAtomizedStringIntoAtom();
 
     if (!atoms.relookupOrAdd(p, AtomHasher::Lookup(tbchars, length),
                              AtomStateEntry(atom, bool(ib)))) {
         JS_ReportOutOfMemory(cx); /* SystemAllocPolicy does not report OOM. */
         return NULL;
     }
 
     return atom;
 }
 
 /* |tbchars| must not point into an inline or short string. */
 template <AllowGC allowGC>
 JS_ALWAYS_INLINE
-static RawAtom
+static JSAtom *
 AtomizeAndCopyChars(JSContext *cx, const jschar *tbchars, size_t length, InternBehavior ib)
 {
-    if (RawAtom s = cx->runtime->staticStrings.lookup(tbchars, length))
+    if (JSAtom *s = cx->runtime->staticStrings.lookup(tbchars, length))
          return s;
 
     /*
      * If a GC occurs at js_NewStringCopy then |p| will still have the correct
      * hash, allowing us to avoid rehashing it. Even though the hash is
      * unchanged, we need to re-lookup the table position because a last-ditch
      * GC will potentially free some table entries.
      */
 
     AtomSet& atoms = cx->runtime->atoms;
     AtomSet::AddPtr p = atoms.lookupForAdd(AtomHasher::Lookup(tbchars, length));
     SkipRoot skipHash(cx, &p); /* Prevent the hash from being poisoned. */
     if (p) {
-        RawAtom atom = p->asPtr();
+        JSAtom *atom = p->asPtr();
         p->setTagged(bool(ib));
         return atom;
     }
 
     AutoEnterAtomsCompartment ac(cx);
 
-    RawFlatString flat = js_NewStringCopyN<allowGC>(cx, tbchars, length);
+    JSFlatString *flat = js_NewStringCopyN<allowGC>(cx, tbchars, length);
     if (!flat)
         return NULL;
 
-    RawAtom atom = flat->morphAtomizedStringIntoAtom();
+    JSAtom *atom = flat->morphAtomizedStringIntoAtom();
 
     if (!atoms.relookupOrAdd(p, AtomHasher::Lookup(tbchars, length),
                              AtomStateEntry(atom, bool(ib)))) {
         JS_ReportOutOfMemory(cx); /* SystemAllocPolicy does not report OOM. */
         return NULL;
     }
 
     return atom;
 }
 
 template <AllowGC allowGC>
-RawAtom
+JSAtom *
 js::AtomizeString(JSContext *cx, JSString *str, js::InternBehavior ib /* = js::DoNotInternAtom */)
 {
     if (str->isAtom()) {
         JSAtom &atom = str->asAtom();
         /* N.B. static atoms are effectively always interned. */
         if (ib != InternAtom || js::StaticStrings::isStatic(&atom))
             return &atom;
 
@@ -352,23 +352,23 @@ js::AtomizeString(JSContext *cx, JSStrin
     JSLinearString *linear = str->ensureLinear(cx);
     if (!linear)
         return NULL;
 
     JS_ASSERT(linear->length() <= JSString::MAX_LENGTH);
     return AtomizeAndCopyChars<CanGC>(cx, linear->chars(), linear->length(), ib);
 }
 
-template RawAtom
+template JSAtom *
 js::AtomizeString<CanGC>(JSContext *cx, JSString *str, js::InternBehavior ib);
 
-template RawAtom
+template JSAtom *
 js::AtomizeString<NoGC>(JSContext *cx, JSString *str, js::InternBehavior ib);
 
-RawAtom
+JSAtom *
 js::Atomize(JSContext *cx, const char *bytes, size_t length, InternBehavior ib)
 {
     CHECK_REQUEST(cx);
 
     if (!JSString::validateLength(cx, length))
         return NULL;
 
     static const unsigned ATOMIZE_BUF_MAX = 32;
@@ -388,31 +388,31 @@ js::Atomize(JSContext *cx, const char *b
 
     jschar *tbcharsZ = InflateString(cx, bytes, &length);
     if (!tbcharsZ)
         return NULL;
     return AtomizeAndTakeOwnership(cx, tbcharsZ, length, ib);
 }
 
 template <AllowGC allowGC>
-RawAtom
+JSAtom *
 js::AtomizeChars(JSContext *cx, const jschar *chars, size_t length, InternBehavior ib)
 {
     CHECK_REQUEST(cx);
 
     if (!JSString::validateLength(cx, length))
         return NULL;
 
     return AtomizeAndCopyChars<allowGC>(cx, chars, length, ib);
 }
 
-template RawAtom
+template JSAtom *
 js::AtomizeChars<CanGC>(JSContext *cx, const jschar *chars, size_t length, InternBehavior ib);
 
-template RawAtom
+template JSAtom *
 js::AtomizeChars<NoGC>(JSContext *cx, const jschar *chars, size_t length, InternBehavior ib);
 
 template <AllowGC allowGC>
 bool
 js::IndexToIdSlow(JSContext *cx, uint32_t index,
                   typename MaybeRooted<jsid, allowGC>::MutableHandleType idp)
 {
     JS_ASSERT(index > JSID_INT_MAX);
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -18,18 +18,16 @@
 #include "jspubtd.h"
 #include "jslock.h"
 #include "jsversion.h"
 
 #include "gc/Barrier.h"
 #include "js/HashTable.h"
 #include "vm/CommonPropertyNames.h"
 
-ForwardDeclareJS(Atom);
-
 struct JSIdArray {
     int length;
     js::HeapId vector[1];    /* actually, length jsid words */
 };
 
 namespace js {
 
 JS_STATIC_ASSERT(sizeof(HashNumber) == 4);
@@ -76,17 +74,17 @@ class AtomStateEntry
 {
     uintptr_t bits;
 
     static const uintptr_t NO_TAG_MASK = uintptr_t(-1) - 1;
 
   public:
     AtomStateEntry() : bits(0) {}
     AtomStateEntry(const AtomStateEntry &other) : bits(other.bits) {}
-    AtomStateEntry(RawAtom ptr, bool tagged)
+    AtomStateEntry(JSAtom *ptr, bool tagged)
       : bits(uintptr_t(ptr) | uintptr_t(tagged))
     {
         JS_ASSERT((uintptr_t(ptr) & 0x1) == 0);
     }
 
     bool isTagged() const {
         return bits & 0x1;
     }
@@ -217,27 +215,27 @@ FinishCommonNames(JSRuntime *rt);
 
 /* N.B. must correspond to boolean tagging behavior. */
 enum InternBehavior
 {
     DoNotInternAtom = false,
     InternAtom = true
 };
 
-extern RawAtom
+extern JSAtom *
 Atomize(JSContext *cx, const char *bytes, size_t length,
         js::InternBehavior ib = js::DoNotInternAtom);
 
 template <AllowGC allowGC>
-extern RawAtom
+extern JSAtom *
 AtomizeChars(JSContext *cx, const jschar *chars, size_t length,
              js::InternBehavior ib = js::DoNotInternAtom);
 
 template <AllowGC allowGC>
-extern RawAtom
+extern JSAtom *
 AtomizeString(JSContext *cx, JSString *str, js::InternBehavior ib = js::DoNotInternAtom);
 
 template <AllowGC allowGC>
 inline JSAtom *
 ToAtom(JSContext *cx, const js::Value &v);
 
 template<XDRMode mode>
 bool
--- a/js/src/jsboolinlines.h
+++ b/js/src/jsboolinlines.h
@@ -27,19 +27,19 @@ BooleanGetPrimitiveValue(JSContext *cx, 
         *vp = BooleanValue(obj->asBoolean().unbox());
         return true;
     }
 
     return BooleanGetPrimitiveValueSlow(cx, obj, vp);
 }
 
 inline bool
-EmulatesUndefined(RawObject obj)
+EmulatesUndefined(JSObject *obj)
 {
-    RawObject actual = MOZ_LIKELY(!obj->isWrapper()) ? obj : UncheckedUnwrap(obj);
+    JSObject *actual = MOZ_LIKELY(!obj->isWrapper()) ? obj : UncheckedUnwrap(obj);
     bool emulatesUndefined = actual->getClass()->emulatesUndefined();
     MOZ_ASSERT_IF(emulatesUndefined, obj->type()->flags & types::OBJECT_FLAG_EMULATES_UNDEFINED);
     return emulatesUndefined;
 }
 
 } /* namespace js */
 
 #endif /* jsboolinlines_h___ */
--- a/js/src/jsclass.h
+++ b/js/src/jsclass.h
@@ -184,17 +184,17 @@ typedef JSBool
 (* DeleteElementOp)(JSContext *cx, HandleObject obj, uint32_t index, JSBool *succeeded);
 typedef JSBool
 (* DeleteSpecialOp)(JSContext *cx, HandleObject obj, HandleSpecialId sid, JSBool *succeeded);
 
 
 typedef JSObject *
 (* ObjectOp)(JSContext *cx, HandleObject obj);
 typedef void
-(* FinalizeOp)(FreeOp *fop, RawObject obj);
+(* FinalizeOp)(FreeOp *fop, JSObject *obj);
 
 #define JS_CLASS_MEMBERS                                                      \
     const char          *name;                                                \
     uint32_t            flags;                                                \
                                                                               \
     /* Mandatory non-null function pointer members. */                        \
     JSPropertyOp        addProperty;                                          \
     JSDeletePropertyOp  delProperty;                                          \
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -235,17 +235,17 @@ JSCompartment::sweepCallsiteClones()
             CallsiteCloneKey key = e.front().key;
             JSFunction *fun = e.front().value;
             if (!IsScriptMarked(&key.script) || !IsObjectMarked(&fun))
                 e.removeFront();
         }
     }
 }
 
-RawFunction
+JSFunction *
 js::CloneFunctionAtCallsite(JSContext *cx, HandleFunction fun, HandleScript script, jsbytecode *pc)
 {
     JS_ASSERT(cx->typeInferenceEnabled());
     JS_ASSERT(fun->nonLazyScript()->shouldCloneAtCallsite);
     JS_ASSERT(!fun->nonLazyScript()->enclosingStaticScope());
     JS_ASSERT(types::UseNewTypeForClone(fun));
 
     typedef CallsiteCloneKey Key;
@@ -560,17 +560,17 @@ static bool
 checkReportFlags(JSContext *cx, unsigned *flags)
 {
     if (JSREPORT_IS_STRICT_MODE_ERROR(*flags)) {
         /*
          * Error in strict code; warning with strict option; okay otherwise.
          * We assume that if the top frame is a native, then it is strict if
          * the nearest scripted frame is strict, see bug 536306.
          */
-        RawScript script = cx->stack.currentScript();
+        JSScript *script = cx->stack.currentScript();
         if (script && script->strict)
             *flags &= ~JSREPORT_WARNING;
         else if (cx->hasStrictOption())
             *flags |= JSREPORT_WARNING;
         else
             return true;
     } else if (JSREPORT_IS_STRICT(*flags)) {
         /* Warning/error only when JSOPTION_STRICT is set. */
@@ -618,17 +618,17 @@ js_ReportErrorVA(JSContext *cx, unsigned
 
 /* |callee| requires a usage string provided by JS_DefineFunctionsWithHelp. */
 void
 js::ReportUsageError(JSContext *cx, HandleObject callee, const char *msg)
 {
     const char *usageStr = "usage";
     PropertyName *usageAtom = Atomize(cx, usageStr, strlen(usageStr))->asPropertyName();
     RootedId id(cx, NameToId(usageAtom));
-    DebugOnly<RawShape> shape = static_cast<RawShape>(callee->nativeLookup(cx, id));
+    DebugOnly<Shape *> shape = static_cast<Shape *>(callee->nativeLookup(cx, id));
     JS_ASSERT(!shape->configurable());
     JS_ASSERT(!shape->writable());
     JS_ASSERT(shape->hasDefaultGetter());
 
     RootedValue usage(cx);
     if (!JS_LookupProperty(cx, callee, "usage", usage.address()))
         return;
 
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -84,17 +84,17 @@ struct CallsiteCloneKey {
     }
 };
 
 typedef HashMap<CallsiteCloneKey,
                 ReadBarriered<JSFunction>,
                 CallsiteCloneKey,
                 SystemAllocPolicy> CallsiteCloneTable;
 
-RawFunction CloneFunctionAtCallsite(JSContext *cx, HandleFunction fun,
+JSFunction *CloneFunctionAtCallsite(JSContext *cx, HandleFunction fun,
                                     HandleScript script, jsbytecode *pc);
 
 typedef HashSet<JSObject *> ObjectSet;
 typedef HashSet<Shape *> ShapeSet;
 
 /* Detects cycles when traversing an object graph. */
 class AutoCycleDetector
 {
@@ -2225,118 +2225,118 @@ SetValueRangeToNull(Value *beg, Value *e
 }
 
 static JS_ALWAYS_INLINE void
 SetValueRangeToNull(Value *vec, size_t len)
 {
     SetValueRangeToNull(vec, vec + len);
 }
 
-class AutoObjectVector : public AutoVectorRooter<RawObject>
+class AutoObjectVector : public AutoVectorRooter<JSObject *>
 {
   public:
     explicit AutoObjectVector(JSContext *cx
                               MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-        : AutoVectorRooter<RawObject>(cx, OBJVECTOR)
+        : AutoVectorRooter<JSObject *>(cx, OBJVECTOR)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-class AutoStringVector : public AutoVectorRooter<RawString>
+class AutoStringVector : public AutoVectorRooter<JSString *>
 {
   public:
     explicit AutoStringVector(JSContext *cx
                               MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-        : AutoVectorRooter<RawString>(cx, STRINGVECTOR)
+        : AutoVectorRooter<JSString *>(cx, STRINGVECTOR)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-class AutoShapeVector : public AutoVectorRooter<RawShape>
+class AutoShapeVector : public AutoVectorRooter<Shape *>
 {
   public:
     explicit AutoShapeVector(JSContext *cx
                              MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-        : AutoVectorRooter<RawShape>(cx, SHAPEVECTOR)
+        : AutoVectorRooter<Shape *>(cx, SHAPEVECTOR)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 class AutoValueArray : public AutoGCRooter
 {
-    RawValue *start_;
+    Value *start_;
     unsigned length_;
     SkipRoot skip;
 
   public:
-    AutoValueArray(JSContext *cx, RawValue *start, unsigned length
+    AutoValueArray(JSContext *cx, Value *start, unsigned length
                    MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : AutoGCRooter(cx, VALARRAY), start_(start), length_(length), skip(cx, start, length)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
-    RawValue *start() { return start_; }
+    Value *start() { return start_; }
     unsigned length() const { return length_; }
 
     MutableHandleValue handleAt(unsigned i)
     {
         JS_ASSERT(i < length_);
         return MutableHandleValue::fromMarkedLocation(&start_[i]);
     }
     HandleValue handleAt(unsigned i) const
     {
         JS_ASSERT(i < length_);
         return HandleValue::fromMarkedLocation(&start_[i]);
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-class AutoObjectObjectHashMap : public AutoHashMapRooter<RawObject, RawObject>
+class AutoObjectObjectHashMap : public AutoHashMapRooter<JSObject *, JSObject *>
 {
   public:
     explicit AutoObjectObjectHashMap(JSContext *cx
                                      MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoHashMapRooter<RawObject, RawObject>(cx, OBJOBJHASHMAP)
+      : AutoHashMapRooter<JSObject *, JSObject *>(cx, OBJOBJHASHMAP)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-class AutoObjectUnsigned32HashMap : public AutoHashMapRooter<RawObject, uint32_t>
+class AutoObjectUnsigned32HashMap : public AutoHashMapRooter<JSObject *, uint32_t>
 {
   public:
     explicit AutoObjectUnsigned32HashMap(JSContext *cx
                                          MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoHashMapRooter<RawObject, uint32_t>(cx, OBJU32HASHMAP)
+      : AutoHashMapRooter<JSObject *, uint32_t>(cx, OBJU32HASHMAP)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-class AutoObjectHashSet : public AutoHashSetRooter<RawObject>
+class AutoObjectHashSet : public AutoHashSetRooter<JSObject *>
 {
   public:
     explicit AutoObjectHashSet(JSContext *cx
                                MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoHashSetRooter<RawObject>(cx, OBJHASHSET)
+      : AutoHashSetRooter<JSObject *>(cx, OBJHASHSET)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 class AutoAssertNoException
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -201,17 +201,17 @@ JSCompartment::wrap(JSContext *cx, Mutab
 
     AutoDisableProxyCheck adpc(rt);
 
     /* Only GC things have to be wrapped or copied. */
     if (!vp.isMarkable())
         return true;
 
     if (vp.isString()) {
-        RawString str = vp.toString();
+        JSString *str = vp.toString();
 
         /* If the string is already in this compartment, we are done. */
         if (str->zone() == zone())
             return true;
 
         /* If the string is an atom, we don't have to copy. */
         if (str->isAtom()) {
             JS_ASSERT(str->zone() == cx->runtime->atomsCompartment->zone());
@@ -264,29 +264,29 @@ JSCompartment::wrap(JSContext *cx, Mutab
     }
 
     RootedValue key(cx, vp);
 
     /* If we already have a wrapper for this value, use it. */
     if (WrapperMap::Ptr p = crossCompartmentWrappers.lookup(key)) {
         vp.set(p->value);
         if (vp.isObject()) {
-            DebugOnly<RawObject> obj = &vp.toObject();
+            DebugOnly<JSObject *> obj = &vp.toObject();
             JS_ASSERT(obj->isCrossCompartmentWrapper());
             JS_ASSERT(obj->getParent() == global);
         }
         return true;
     }
 
     if (vp.isString()) {
         Rooted<JSLinearString *> str(cx, vp.toString()->ensureLinear(cx));
         if (!str)
             return false;
 
-        RawString wrapped = js_NewStringCopyN<CanGC>(cx, str->chars(), str->length());
+        JSString *wrapped = js_NewStringCopyN<CanGC>(cx, str->chars(), str->length());
         if (!wrapped)
             return false;
 
         vp.setString(wrapped);
         if (!putWrapper(key, vp))
             return false;
 
         if (str->zone()->isGCMarking()) {
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -237,17 +237,17 @@ struct JSCompartment
 
     /*
      * During GC, stores the head of a list of incoming pointers from gray cells.
      *
      * The objects in the list are either cross-compartment wrappers, or
      * debugger wrapper objects.  The list link is either in the second extra
      * slot for the former, or a special slot for the latter.
      */
-    js::RawObject                gcIncomingGrayPointers;
+    JSObject                     *gcIncomingGrayPointers;
 
     /* Linked list of live array buffers with >1 view. */
     JSObject                     *gcLiveArrayBuffers;
 
     /* Linked list of live weakmaps in this compartment. */
     js::WeakMapBase              *gcWeakMapList;
 
   private:
--- a/js/src/jscpucfg.h
+++ b/js/src/jscpucfg.h
@@ -9,36 +9,32 @@
 
 #define JS_HAVE_LONG_LONG
 
 #if defined(_WIN64)
 
 # if defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)
 #  define IS_LITTLE_ENDIAN 1
 #  undef  IS_BIG_ENDIAN
-#  define JS_BYTES_PER_DOUBLE 8
 #  define JS_BYTES_PER_WORD   8
 #  define JS_BITS_PER_WORD_LOG2   6
-#  define JS_ALIGN_OF_POINTER 8
 # else  /* !(defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)) */
 #  error "CPU type is unknown"
 # endif /* !(defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)) */
 
 #elif defined(_WIN32) || defined(XP_OS2)
 
 # ifdef __WATCOMC__
 #  define HAVE_VA_LIST_AS_ARRAY 1
 # endif
 
 # define IS_LITTLE_ENDIAN 1
 # undef  IS_BIG_ENDIAN
-# define JS_BYTES_PER_DOUBLE 8
 # define JS_BYTES_PER_WORD   4
 # define JS_BITS_PER_WORD_LOG2   5
-# define JS_ALIGN_OF_POINTER 4
 
 #elif defined(__APPLE__)
 # if __LITTLE_ENDIAN__
 #  define IS_LITTLE_ENDIAN 1
 #  undef  IS_BIG_ENDIAN
 # elif __BIG_ENDIAN__
 #  undef  IS_LITTLE_ENDIAN
 #  define IS_BIG_ENDIAN 1
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -758,17 +758,17 @@ DaysInMonth(int year, int month)
  *   hh   = two digits of hour (00 through 23) (am/pm NOT allowed)
  *   mm   = two digits of minute (00 through 59)
  *   ss   = two digits of second (00 through 59)
  *   s    = one or more digits representing a decimal fraction of a second
  *   TZD  = time zone designator (Z or +hh:mm or -hh:mm or missing for local)
  */
 
 static JSBool
-date_parseISOString(RawLinearString str, double *result, DateTimeInfo *dtInfo)
+date_parseISOString(JSLinearString *str, double *result, DateTimeInfo *dtInfo)
 {
     double msec;
 
     const jschar *s;
     size_t limit;
     size_t i = 0;
     int tzMul = 1;
     int dateMul = 1;
@@ -897,17 +897,17 @@ date_parseISOString(RawLinearString str,
 
 #undef PEEK
 #undef NEED
 #undef DONE_UNLESS
 #undef NEED_NDIGITS
 }
 
 static JSBool
-date_parseString(RawLinearString str, double *result, DateTimeInfo *dtInfo)
+date_parseString(JSLinearString *str, double *result, DateTimeInfo *dtInfo)
 {
     double msec;
 
     const jschar *s;
     size_t limit;
     size_t i = 0;
     int year = -1;
     int mon = -1;
@@ -1177,21 +1177,21 @@ static JSBool
 date_parse(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() == 0) {
         vp->setDouble(js_NaN);
         return true;
     }
 
-    RawString str = ToString<CanGC>(cx, args[0]);
+    JSString *str = ToString<CanGC>(cx, args[0]);
     if (!str)
         return false;
 
-    RawLinearString linearStr = str->ensureLinear(cx);
+    JSLinearString *linearStr = str->ensureLinear(cx);
     if (!linearStr)
         return false;
 
     double result;
     if (!date_parseString(linearStr, &result, &cx->runtime->dateTimeInfo)) {
         vp->setDouble(js_NaN);
         return true;
     }
@@ -1213,17 +1213,17 @@ date_now(JSContext *cx, unsigned argc, V
     vp->setDouble(NowAsMillis());
     return JS_TRUE;
 }
 
 /*
  * Set UTC time to a given time and invalidate cached local time.
  */
 static void
-SetUTCTime(RawObject obj, double t, Value *vp = NULL)
+SetUTCTime(JSObject *obj, double t, Value *vp = NULL)
 {
     JS_ASSERT(obj->isDate());
 
     for (size_t ind = JSObject::JSSLOT_DATE_COMPONENTS_START;
          ind < JSObject::DATE_CLASS_RESERVED_SLOTS;
          ind++) {
         obj->setSlot(ind, UndefinedValue());
     }
@@ -1234,17 +1234,17 @@ SetUTCTime(RawObject obj, double t, Valu
 }
 
 /*
  * Cache the local time, year, month, and so forth of the object.
  * If UTC time is not finite (e.g., NaN), the local time
  * slots will be set to the UTC time without conversion.
  */
 static void
-FillLocalTimeSlots(DateTimeInfo *dtInfo, RawObject obj)
+FillLocalTimeSlots(DateTimeInfo *dtInfo, JSObject *obj)
 {
     JS_ASSERT(obj->isDate());
 
     /* Check if the cache is already populated. */
     if (!obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_TIME).isUndefined() &&
         obj->getSlot(JSObject::JSSLOT_DATE_TZA).toDouble() == dtInfo->localTZA())
     {
         return;
@@ -1369,17 +1369,17 @@ FillLocalTimeSlots(DateTimeInfo *dtInfo,
     int minutes = (yearSeconds / 60) % 60;
     obj->setSlot(JSObject::JSSLOT_DATE_LOCAL_MINUTES, Int32Value(minutes));
 
     int hours = (yearSeconds / (60 * 60)) % 24;
     obj->setSlot(JSObject::JSSLOT_DATE_LOCAL_HOURS, Int32Value(hours));
 }
 
 inline double
-GetCachedLocalTime(DateTimeInfo *dtInfo, RawObject obj)
+GetCachedLocalTime(DateTimeInfo *dtInfo, JSObject *obj)
 {
     JS_ASSERT(obj);
     FillLocalTimeSlots(dtInfo, obj);
     return obj->getSlot(JSObject::JSSLOT_DATE_LOCAL_TIME).toDouble();
 }
 
 JS_ALWAYS_INLINE bool
 IsDate(const Value &v)
@@ -1405,17 +1405,17 @@ date_getTime(JSContext *cx, unsigned arg
     return CallNonGenericMethod<IsDate, date_getTime_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getYear_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     Value yearVal = thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR);
     if (yearVal.isInt32()) {
         /* Follow ECMA-262 to the letter, contrary to IE JScript. */
         int year = yearVal.toInt32() - 1900;
         args.rval().setInt32(year);
     } else {
@@ -1432,17 +1432,17 @@ date_getYear(JSContext *cx, unsigned arg
     return CallNonGenericMethod<IsDate, date_getYear_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getFullYear_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_YEAR));
     return true;
 }
 
 static JSBool
 date_getFullYear(JSContext *cx, unsigned argc, Value *vp)
@@ -1471,17 +1471,17 @@ date_getUTCFullYear(JSContext *cx, unsig
     return CallNonGenericMethod<IsDate, date_getUTCFullYear_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getMonth_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MONTH));
     return true;
 }
 
 static JSBool
 date_getMonth(JSContext *cx, unsigned argc, Value *vp)
@@ -1507,17 +1507,17 @@ date_getUTCMonth(JSContext *cx, unsigned
     return CallNonGenericMethod<IsDate, date_getUTCMonth_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getDate_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DATE));
     return true;
 }
 
 static JSBool
 date_getDate(JSContext *cx, unsigned argc, Value *vp)
@@ -1546,17 +1546,17 @@ date_getUTCDate(JSContext *cx, unsigned 
     return CallNonGenericMethod<IsDate, date_getUTCDate_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getDay_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_DAY));
     return true;
 }
 
 static JSBool
 date_getDay(JSContext *cx, unsigned argc, Value *vp)
@@ -1585,17 +1585,17 @@ date_getUTCDay(JSContext *cx, unsigned a
     return CallNonGenericMethod<IsDate, date_getUTCDay_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getHours_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_HOURS));
     return true;
 }
 
 static JSBool
 date_getHours(JSContext *cx, unsigned argc, Value *vp)
@@ -1624,17 +1624,17 @@ date_getUTCHours(JSContext *cx, unsigned
     return CallNonGenericMethod<IsDate, date_getUTCHours_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getMinutes_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_MINUTES));
     return true;
 }
 
 static JSBool
 date_getMinutes(JSContext *cx, unsigned argc, Value *vp)
@@ -1665,17 +1665,17 @@ date_getUTCMinutes(JSContext *cx, unsign
 
 /* Date.getSeconds is mapped to getUTCSeconds */
 
 JS_ALWAYS_INLINE bool
 date_getUTCSeconds_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     FillLocalTimeSlots(&cx->runtime->dateTimeInfo, thisObj);
 
     args.rval().set(thisObj->getSlot(JSObject::JSSLOT_DATE_LOCAL_SECONDS));
     return true;
 }
 
 static JSBool
 date_getUTCSeconds(JSContext *cx, unsigned argc, Value *vp)
@@ -1706,17 +1706,17 @@ date_getUTCMilliseconds(JSContext *cx, u
     return CallNonGenericMethod<IsDate, date_getUTCMilliseconds_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_getTimezoneOffset_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
     double utctime = thisObj->getDateUTCTime().toNumber();
     double localtime = GetCachedLocalTime(&cx->runtime->dateTimeInfo, thisObj);
 
     /*
      * Return the time zone offset in minutes for the current locale that is
      * appropriate for this time. This value would be a constant except for
      * daylight savings time.
      */
@@ -2482,17 +2482,17 @@ date_toGMTString_impl(JSContext *cx, Cal
     double utctime = args.thisv().toObject().getDateUTCTime().toNumber();
 
     char buf[100];
     if (!MOZ_DOUBLE_IS_FINITE(utctime))
         JS_snprintf(buf, sizeof buf, js_NaN_date_str);
     else
         print_gmt_string(buf, sizeof buf, utctime);
 
-    RawString str = JS_NewStringCopyZ(cx, buf);
+    JSString *str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 
 /* ES5 15.9.5.43. */
 static JSBool
@@ -2511,17 +2511,17 @@ date_toISOString_impl(JSContext *cx, Cal
     if (!MOZ_DOUBLE_IS_FINITE(utctime)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_INVALID_DATE);
         return false;
     }
 
     char buf[100];
     print_iso_string(buf, sizeof buf, utctime);
 
-    RawString str = JS_NewStringCopyZ(cx, buf);
+    JSString *str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 
 }
 
 static JSBool
@@ -2708,17 +2708,17 @@ date_format(JSContext *cx, double date, 
                         int(SecFromTime(local)),
                         offset,
                         usetz ? " " : "",
                         usetz ? tzbuf : "");
             break;
         }
     }
 
-    RawString str = JS_NewStringCopyZ(cx, buf);
+    JSString *str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     rval.setString(str);
     return true;
 }
 
 static bool
 ToLocaleFormatHelper(JSContext *cx, HandleObject obj, const char *format, MutableHandleValue rval)
@@ -2754,17 +2754,17 @@ ToLocaleFormatHelper(JSContext *cx, Hand
                         "%d", js_DateGetYear(cx, obj));
         }
 
     }
 
     if (cx->runtime->localeCallbacks && cx->runtime->localeCallbacks->localeToUnicode)
         return cx->runtime->localeCallbacks->localeToUnicode(cx, buf, rval);
 
-    RawString str = JS_NewStringCopyZ(cx, buf);
+    JSString *str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
     rval.setString(str);
     return true;
 }
 
 #if !ENABLE_INTL_API
 static bool
@@ -2929,17 +2929,17 @@ date_toSource_impl(JSContext *cx, CallAr
     StringBuffer sb(cx);
     if (!sb.append("(new Date(") ||
         !NumberValueToStringBuffer(cx, args.thisv().toObject().getDateUTCTime(), sb) ||
         !sb.append("))"))
     {
         return false;
     }
 
-    RawString str = sb.finishString();
+    JSString *str = sb.finishString();
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 
 static JSBool
 date_toSource(JSContext *cx, unsigned argc, Value *vp)
@@ -2964,17 +2964,17 @@ date_toString(JSContext *cx, unsigned ar
     return CallNonGenericMethod<IsDate, date_toString_impl>(cx, args);
 }
 
 JS_ALWAYS_INLINE bool
 date_valueOf_impl(JSContext *cx, CallArgs args)
 {
     JS_ASSERT(IsDate(args.thisv()));
 
-    RawObject thisObj = &args.thisv().toObject();
+    JSObject *thisObj = &args.thisv().toObject();
 
     args.rval().set(thisObj->getDateUTCTime());
     return true;
 }
 
 static JSBool
 date_valueOf(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -3066,21 +3066,21 @@ js_Date(JSContext *cx, unsigned argc, Va
         /* ES5 15.9.3.2. */
 
         /* Step 1. */
         if (!ToPrimitive(cx, args.handleAt(0)))
             return false;
 
         if (args[0].isString()) {
             /* Step 2. */
-            RawString str = args[0].toString();
+            JSString *str = args[0].toString();
             if (!str)
                 return false;
 
-            RawLinearString linearStr = str->ensureLinear(cx);
+            JSLinearString *linearStr = str->ensureLinear(cx);
             if (!linearStr)
                 return false;
 
             if (!date_parseString(linearStr, &d, &cx->runtime->dateTimeInfo))
                 d = js_NaN;
             else
                 d = TimeClip(d);
         } else {
@@ -3096,17 +3096,17 @@ js_Date(JSContext *cx, unsigned argc, Va
 
         if (MOZ_DOUBLE_IS_FINITE(msec_time)) {
             msec_time = UTC(msec_time, &cx->runtime->dateTimeInfo);
             msec_time = TimeClip(msec_time);
         }
         d = msec_time;
     }
 
-    RawObject obj = js_NewDateObjectMsec(cx, d);
+    JSObject *obj = js_NewDateObjectMsec(cx, d);
     if (!obj)
         return false;
 
     args.rval().setObject(*obj);
     return true;
 }
 
 JSObject *
@@ -3153,108 +3153,108 @@ js_InitDateClass(JSContext *cx, HandleOb
         return NULL;
 
     return dateProto;
 }
 
 JS_FRIEND_API(JSObject *)
 js_NewDateObjectMsec(JSContext *cx, double msec_time)
 {
-    RawObject obj = NewBuiltinClassInstance(cx, &DateClass);
+    JSObject *obj = NewBuiltinClassInstance(cx, &DateClass);
     if (!obj)
         return NULL;
     SetUTCTime(obj, msec_time);
     return obj;
 }
 
 JS_FRIEND_API(JSObject *)
 js_NewDateObject(JSContext *cx, int year, int mon, int mday,
                  int hour, int min, int sec)
 {
     JS_ASSERT(mon < 12);
     double msec_time = date_msecFromDate(year, mon, mday, hour, min, sec, 0);
     return js_NewDateObjectMsec(cx, UTC(msec_time, &cx->runtime->dateTimeInfo));
 }
 
 JS_FRIEND_API(JSBool)
-js_DateIsValid(RawObject obj)
+js_DateIsValid(JSObject *obj)
 {
     return obj->isDate() && !MOZ_DOUBLE_IS_NaN(obj->getDateUTCTime().toNumber());
 }
 
 JS_FRIEND_API(int)
-js_DateGetYear(JSContext *cx, RawObject obj)
+js_DateGetYear(JSContext *cx, JSObject *obj)
 {
     /* Preserve legacy API behavior of returning 0 for invalid dates. */
     JS_ASSERT(obj);
     double localtime = GetCachedLocalTime(&cx->runtime->dateTimeInfo, obj);
     if (MOZ_DOUBLE_IS_NaN(localtime))
         return 0;
 
     return (int) YearFromTime(localtime);
 }
 
 JS_FRIEND_API(int)
-js_DateGetMonth(JSContext *cx, RawObject obj)
+js_DateGetMonth(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(obj);
     double localtime = GetCachedLocalTime(&cx->runtime->dateTimeInfo, obj);
     if (MOZ_DOUBLE_IS_NaN(localtime))
         return 0;
 
     return (int) MonthFromTime(localtime);
 }
 
 JS_FRIEND_API(int)
-js_DateGetDate(JSContext *cx, RawObject obj)
+js_DateGetDate(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(obj);
     double localtime = GetCachedLocalTime(&cx->runtime->dateTimeInfo, obj);
     if (MOZ_DOUBLE_IS_NaN(localtime))
         return 0;
 
     return (int) DateFromTime(localtime);
 }
 
 JS_FRIEND_API(int)
-js_DateGetHours(JSContext *cx, RawObject obj)
+js_DateGetHours(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(obj);
     double localtime = GetCachedLocalTime(&cx->runtime->dateTimeInfo, obj);
     if (MOZ_DOUBLE_IS_NaN(localtime))
         return 0;
 
     return (int) HourFromTime(localtime);
 }
 
 JS_FRIEND_API(int)
-js_DateGetMinutes(JSContext *cx, RawObject obj)
+js_DateGetMinutes(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(obj);
     double localtime = GetCachedLocalTime(&cx->runtime->dateTimeInfo, obj);
     if (MOZ_DOUBLE_IS_NaN(localtime))
         return 0;
 
     return (int) MinFromTime(localtime);
 }
 
 JS_FRIEND_API(int)
-js_DateGetSeconds(RawObject obj)
+js_DateGetSeconds(JSObject *obj)
 {
     if (!obj->isDate())
         return 0;
 
     double utctime = obj->getDateUTCTime().toNumber();
     if (MOZ_DOUBLE_IS_NaN(utctime))
         return 0;
     return (int) SecFromTime(utctime);
 }
 
 JS_FRIEND_API(double)
-js_DateGetMsecSinceEpoch(RawObject obj)
+js_DateGetMsecSinceEpoch(JSObject *obj)
 {
     return obj->isDate() ? obj->getDateUTCTime().toNumber() : 0;
 }
 
 
 static const NativeImpl sReadOnlyDateMethods[] = {
     date_getTime_impl,
     date_getYear_impl,
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -378,17 +378,17 @@ JS_ClearAllWatchPoints(JSContext *cx)
             wpmap->clear();
     }
     return true;
 }
 
 /************************************************************************/
 
 JS_PUBLIC_API(unsigned)
-JS_PCToLineNumber(JSContext *cx, RawScript script, jsbytecode *pc)
+JS_PCToLineNumber(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
     return js::PCToLineNumber(script, pc);
 }
 
 JS_PUBLIC_API(jsbytecode *)
 JS_LineNumberToPC(JSContext *cx, JSScript *script, unsigned lineno)
 {
     return js_LineNumberToPC(script, lineno);
@@ -512,17 +512,17 @@ JS_ReleaseFunctionLocalNameArray(JSConte
 JS_PUBLIC_API(JSScript *)
 JS_GetFunctionScript(JSContext *cx, JSFunction *fun)
 {
     if (fun->isNative())
         return NULL;
     if (fun->isInterpretedLazy()) {
         RootedFunction rootedFun(cx, fun);
         AutoCompartment funCompartment(cx, rootedFun);
-        RawScript script = rootedFun->getOrCreateScript(cx);
+        JSScript *script = rootedFun->getOrCreateScript(cx);
         if (!script)
             MOZ_CRASH();
         return script;
     }
     return fun->nonLazyScript();
 }
 
 JS_PUBLIC_API(JSNative)
@@ -946,28 +946,16 @@ JS_DumpCompartmentPCCounts(JSContext *cx
                 fputs(sprinter.string(), stdout);
                 fprintf(stdout, "--- END Asm.js Module ---\n");
             }
         }
     }
 #endif
 }
 
-JS_PUBLIC_API(JSObject *)
-JS_UnwrapObject(JSObject *obj)
-{
-    return UncheckedUnwrap(obj);
-}
-
-JS_PUBLIC_API(JSObject *)
-JS_UnwrapObjectAndInnerize(JSObject *obj)
-{
-    return UncheckedUnwrap(obj, /* stopAtOuter = */ false);
-}
-
 JS_FRIEND_API(JSBool)
 js_CallContextDebugHandler(JSContext *cx)
 {
     NonBuiltinScriptFrameIter iter(cx);
     JS_ASSERT(!iter.done());
 
     RootedValue rval(cx);
     RootedScript script(cx, iter.script());
--- a/js/src/jsdbgapi.h
+++ b/js/src/jsdbgapi.h
@@ -135,19 +135,19 @@ JS_ClearWatchPoint(JSContext *cx, JSObje
 extern JS_PUBLIC_API(JSBool)
 JS_ClearWatchPointsForObject(JSContext *cx, JSObject *obj);
 
 extern JS_PUBLIC_API(JSBool)
 JS_ClearAllWatchPoints(JSContext *cx);
 
 /************************************************************************/
 
-// RawScript because this needs to be callable from a signal handler
+// Raw JSScript* because this needs to be callable from a signal handler.
 extern JS_PUBLIC_API(unsigned)
-JS_PCToLineNumber(JSContext *cx, js::RawScript script, jsbytecode *pc);
+JS_PCToLineNumber(JSContext *cx, JSScript *script, jsbytecode *pc);
 
 extern JS_PUBLIC_API(jsbytecode *)
 JS_LineNumberToPC(JSContext *cx, JSScript *script, unsigned lineno);
 
 extern JS_PUBLIC_API(jsbytecode *)
 JS_EndPC(JSContext *cx, JSScript *script);
 
 extern JS_PUBLIC_API(JSBool)
@@ -456,19 +456,13 @@ extern JS_PUBLIC_API(void)
 JS_DumpCompartmentBytecode(JSContext *cx);
 
 extern JS_PUBLIC_API(void)
 JS_DumpPCCounts(JSContext *cx, JSScript *script);
 
 extern JS_PUBLIC_API(void)
 JS_DumpCompartmentPCCounts(JSContext *cx);
 
-extern JS_PUBLIC_API(JSObject *)
-JS_UnwrapObject(JSObject *obj);
-
-extern JS_PUBLIC_API(JSObject *)
-JS_UnwrapObjectAndInnerize(JSObject *obj);
-
 /* Call the context debug handler on the topmost scripted frame. */
 extern JS_FRIEND_API(JSBool)
 js_CallContextDebugHandler(JSContext *cx);
 
 #endif /* jsdbgapi_h___ */
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -39,20 +39,20 @@ using mozilla::ArrayLength;
 using mozilla::PodArrayZero;
 using mozilla::PodZero;
 
 /* Forward declarations for ErrorClass's initializer. */
 static JSBool
 Exception(JSContext *cx, unsigned argc, Value *vp);
 
 static void
-exn_trace(JSTracer *trc, RawObject obj);
+exn_trace(JSTracer *trc, JSObject *obj);
 
 static void
-exn_finalize(FreeOp *fop, RawObject obj);
+exn_finalize(FreeOp *fop, JSObject *obj);
 
 static JSBool
 exn_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
             MutableHandleObject objp);
 
 Class js::ErrorClass = {
     js_Error_str,
     JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS | JSCLASS_NEW_RESOLVE |
@@ -237,17 +237,17 @@ struct SuppressErrorsGuard
     ~SuppressErrorsGuard()
     {
         JS_RestoreExceptionState(cx, prevState);
         JS_SetErrorReporter(cx, prevReporter);
     }
 };
 
 static void
-SetExnPrivate(RawObject exnObject, JSExnPrivate *priv);
+SetExnPrivate(JSObject *exnObject, JSExnPrivate *priv);
 
 static bool
 InitExnPrivate(JSContext *cx, HandleObject exnObject, HandleString message,
                HandleString filename, unsigned lineno, unsigned column,
                JSErrorReport *report, int exnType)
 {
     JS_ASSERT(exnObject->isError());
     JS_ASSERT(!exnObject->getPrivate());
@@ -267,17 +267,17 @@ InitExnPrivate(JSContext *cx, HandleObje
                 if (!checkAccess(cx, obj, callerid, JSACC_READ, &v))
                     break;
             }
 
             if (!frames.growBy(1))
                 return false;
             JSStackTraceStackElem &frame = frames.back();
             if (i.isNonEvalFunctionFrame()) {
-                RawAtom atom = i.callee()->displayAtom();
+                JSAtom *atom = i.callee()->displayAtom();
                 if (atom == NULL)
                     atom = cx->runtime->emptyString;
                 frame.funName = atom;
             } else {
                 frame.funName = NULL;
             }
             RootedScript script(cx, i.script());
             const char *cfilename = script->filename();
@@ -331,24 +331,24 @@ InitExnPrivate(JSContext *cx, HandleObje
         priv->stackElems[i].ulineno = frames[i].ulineno;
     }
 
     SetExnPrivate(exnObject, priv);
     return true;
 }
 
 static inline JSExnPrivate *
-GetExnPrivate(RawObject obj)
+GetExnPrivate(JSObject *obj)
 {
     JS_ASSERT(obj->isError());
     return (JSExnPrivate *) obj->getPrivate();
 }
 
 static void
-exn_trace(JSTracer *trc, RawObject obj)
+exn_trace(JSTracer *trc, JSObject *obj)
 {
     if (JSExnPrivate *priv = GetExnPrivate(obj)) {
         if (priv->message)
             MarkString(trc, &priv->message, "exception message");
         if (priv->filename)
             MarkString(trc, &priv->filename, "exception filename");
 
         for (size_t i = 0; i != priv->stackDepth; ++i) {
@@ -356,29 +356,29 @@ exn_trace(JSTracer *trc, RawObject obj)
             if (elem.funName)
                 MarkString(trc, &elem.funName, "stack trace function name");
         }
     }
 }
 
 /* NB: An error object's private must be set through this function. */
 static void
-SetExnPrivate(RawObject exnObject, JSExnPrivate *priv)
+SetExnPrivate(JSObject *exnObject, JSExnPrivate *priv)
 {
     JS_ASSERT(!exnObject->getPrivate());
     JS_ASSERT(exnObject->isError());
     if (JSErrorReport *report = priv->errorReport) {
         if (JSPrincipals *prin = report->originPrincipals)
             JS_HoldPrincipals(prin);
     }
     exnObject->setPrivate(priv);
 }
 
 static void
-exn_finalize(FreeOp *fop, RawObject obj)
+exn_finalize(FreeOp *fop, JSObject *obj)
 {
     if (JSExnPrivate *priv = GetExnPrivate(obj)) {
         if (JSErrorReport *report = priv->errorReport) {
             /* HOLD called by SetExnPrivate. */
             if (JSPrincipals *prin = report->originPrincipals)
                 JS_DropPrincipals(fop->runtime(), prin);
             fop->free_(report);
         }
@@ -440,17 +440,17 @@ exn_resolve(JSContext *cx, HandleObject 
             prop = js_columnNumber_str;
             v = UINT_TO_JSVAL(priv->column);
             attrs = JSPROP_ENUMERATE;
             goto define;
         }
 
         atom = cx->names().stack;
         if (str == atom) {
-            RawString stack = StackTraceToString(cx, priv);
+            JSString *stack = StackTraceToString(cx, priv);
             if (!stack)
                 return false;
 
             prop = js_stack_str;
             v = STRING_TO_JSVAL(stack);
             attrs = JSPROP_ENUMERATE;
             goto define;
         }
@@ -465,17 +465,17 @@ exn_resolve(JSContext *cx, HandleObject 
 }
 
 JSErrorReport *
 js_ErrorFromException(jsval exn)
 {
     if (JSVAL_IS_PRIMITIVE(exn))
         return NULL;
 
-    RawObject obj = JSVAL_TO_OBJECT(exn);
+    JSObject *obj = JSVAL_TO_OBJECT(exn);
     if (!obj->isError())
         return NULL;
 
     JSExnPrivate *priv = GetExnPrivate(obj);
     if (!priv)
         return NULL;
 
     return priv->errorReport;
@@ -664,17 +664,17 @@ exn_toString(JSContext *cx, unsigned arg
         return true;
     }
 
     /* Step 10. */
     StringBuffer sb(cx);
     if (!sb.append(name) || !sb.append(": ") || !sb.append(message))
         return false;
 
-    RawString str = sb.finishString();
+    JSString *str = sb.finishString();
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 
 #if JS_HAS_TOSOURCE
 /*
@@ -733,27 +733,27 @@ exn_toSource(JSContext *cx, unsigned arg
         if (!sb.append(", ") || !sb.append(filename))
             return false;
     }
     if (lineno != 0) {
         /* We have a line, but no filename, add empty string */
         if (filename->empty() && !sb.append(", \"\""))
                 return false;
 
-        RawString linenumber = ToString<CanGC>(cx, linenoVal);
+        JSString *linenumber = ToString<CanGC>(cx, linenoVal);
         if (!linenumber)
             return false;
         if (!sb.append(", ") || !sb.append(linenumber))
             return false;
     }
 
     if (!sb.append("))"))
         return false;
 
-    RawString str = sb.finishString();
+    JSString *str = sb.finishString();
     if (!str)
         return false;
     args.rval().setString(str);
     return true;
 }
 #endif
 
 static const JSFunctionSpec exception_methods[] = {
@@ -1072,17 +1072,17 @@ js_ReportUncaughtException(JSContext *cx
                 return false;
         } else if (name) {
             str = name;
         } else if (msg) {
             str = msg;
         }
 
         if (JS_GetProperty(cx, exnObject, filename_str, &roots[4])) {
-            RawString tmp = ToString<CanGC>(cx, roots[4]);
+            JSString *tmp = ToString<CanGC>(cx, roots[4]);
             if (tmp)
                 filename.encodeLatin1(cx, tmp);
         }
 
         uint32_t lineno;
         if (!JS_GetProperty(cx, exnObject, js_lineNumber_str, &roots[5]) ||
             !ToUint32(cx, roots[5], &lineno))
         {
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -57,17 +57,17 @@ JS_SetGrayGCRootsTracer(JSRuntime *rt, J
 JS_FRIEND_API(JSString *)
 JS_GetAnonymousString(JSRuntime *rt)
 {
     JS_ASSERT(rt->hasContexts());
     return rt->atomState.anonymous;
 }
 
 JS_FRIEND_API(JSObject *)
-JS_FindCompilationScope(JSContext *cx, RawObject objArg)
+JS_FindCompilationScope(JSContext *cx, JSObject *objArg)
 {
     RootedObject obj(cx, objArg);
 
     /*
      * We unwrap wrappers here. This is a little weird, but it's what's being
      * asked of us.
      */
     if (obj->isWrapper())
@@ -78,17 +78,17 @@ JS_FindCompilationScope(JSContext *cx, R
      * scope.
      */
     if (JSObjectOp op = obj->getClass()->ext.innerObject)
         obj = op(cx, obj);
     return obj;
 }
 
 JS_FRIEND_API(JSFunction *)
-JS_GetObjectFunction(RawObject obj)
+JS_GetObjectFunction(JSObject *obj)
 {
     if (obj->isFunction())
         return obj->toFunction();
     return NULL;
 }
 
 JS_FRIEND_API(JSBool)
 JS_SplicePrototype(JSContext *cx, JSObject *objArg, JSObject *protoArg)
@@ -248,17 +248,17 @@ JS_FRIEND_API(JSBool)
 JS_WrapAutoIdVector(JSContext *cx, js::AutoIdVector &props)
 {
     return cx->compartment->wrap(cx, props);
 }
 
 JS_FRIEND_API(void)
 JS_TraceShapeCycleCollectorChildren(JSTracer *trc, void *shape)
 {
-    MarkCycleCollectorChildren(trc, static_cast<RawShape>(shape));
+    MarkCycleCollectorChildren(trc, static_cast<Shape *>(shape));
 }
 
 static bool
 DefineHelpProperty(JSContext *cx, HandleObject obj, const char *prop, const char *value)
 {
     JSAtom *atom = Atomize(cx, value, strlen(value));
     if (!atom)
         return false;
@@ -342,47 +342,47 @@ js::IsSystemZone(Zone *zone)
 
 JS_FRIEND_API(bool)
 js::IsAtomsCompartment(JSCompartment *comp)
 {
     return comp == comp->rt->atomsCompartment;
 }
 
 JS_FRIEND_API(bool)
-js::IsScopeObject(RawObject obj)
+js::IsScopeObject(JSObject *obj)
 {
     return obj->isScope();
 }
 
 JS_FRIEND_API(JSObject *)
-js::GetObjectParentMaybeScope(RawObject obj)
+js::GetObjectParentMaybeScope(JSObject *obj)
 {
     return obj->enclosingScope();
 }
 
 JS_FRIEND_API(JSObject *)
-js::GetGlobalForObjectCrossCompartment(RawObject obj)
+js::GetGlobalForObjectCrossCompartment(JSObject *obj)
 {
     return &obj->global();
 }
 
 JS_FRIEND_API(void)
-js::NotifyAnimationActivity(RawObject obj)
+js::NotifyAnimationActivity(JSObject *obj)
 {
     obj->compartment()->lastAnimationTime = PRMJ_Now();
 }
 
 JS_FRIEND_API(uint32_t)
-js::GetObjectSlotSpan(RawObject obj)
+js::GetObjectSlotSpan(JSObject *obj)
 {
     return obj->slotSpan();
 }
 
 JS_FRIEND_API(bool)
-js::IsObjectInContextCompartment(RawObject obj, const JSContext *cx)
+js::IsObjectInContextCompartment(JSObject *obj, const JSContext *cx)
 {
     return obj->compartment() == cx->compartment;
 }
 
 JS_FRIEND_API(bool)
 js::IsOriginalScriptFunction(JSFunction *fun)
 {
     return fun->nonLazyScript()->function() == fun;
@@ -471,31 +471,31 @@ js::InitClassWithReserved(JSContext *cx,
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, parent_proto);
     return js_InitClass(cx, obj, parent_proto, Valueify(clasp), constructor,
                         nargs, ps, fs, static_ps, static_fs, NULL,
                         JSFunction::ExtendedFinalizeKind);
 }
 
 JS_FRIEND_API(const Value &)
-js::GetFunctionNativeReserved(RawObject fun, size_t which)
+js::GetFunctionNativeReserved(JSObject *fun, size_t which)
 {
     JS_ASSERT(fun->toFunction()->isNative());
     return fun->toFunction()->getExtendedSlot(which);
 }
 
 JS_FRIEND_API(void)
-js::SetFunctionNativeReserved(RawObject fun, size_t which, const Value &val)
+js::SetFunctionNativeReserved(JSObject *fun, size_t which, const Value &val)
 {
     JS_ASSERT(fun->toFunction()->isNative());
     fun->toFunction()->setExtendedSlot(which, val);
 }
 
 JS_FRIEND_API(void)
-js::SetReservedSlotWithBarrier(RawObject obj, size_t slot, const js::Value &value)
+js::SetReservedSlotWithBarrier(JSObject *obj, size_t slot, const js::Value &value)
 {
     obj->setSlot(slot, value);
 }
 
 JS_FRIEND_API(bool)
 js::GetGeneric(JSContext *cx, JSObject *objArg, JSObject *receiverArg, jsid idArg,
                Value *vp)
 {
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -375,61 +375,61 @@ extern JS_FRIEND_DATA(js::Class) CallCla
 extern JS_FRIEND_DATA(js::Class) DeclEnvClass;
 extern JS_FRIEND_DATA(js::Class) FunctionClass;
 extern JS_FRIEND_DATA(js::Class) FunctionProxyClass;
 extern JS_FRIEND_DATA(js::Class) OuterWindowProxyClass;
 extern JS_FRIEND_DATA(js::Class) ObjectProxyClass;
 extern JS_FRIEND_DATA(js::Class) ObjectClass;
 
 inline js::Class *
-GetObjectClass(RawObject obj)
+GetObjectClass(JSObject *obj)
 {
     return reinterpret_cast<const shadow::Object*>(obj)->type->clasp;
 }
 
 inline JSClass *
-GetObjectJSClass(RawObject obj)
+GetObjectJSClass(JSObject *obj)
 {
     return js::Jsvalify(GetObjectClass(obj));
 }
 
 inline bool
 IsInnerObject(JSObject *obj) {
     return !!GetObjectClass(obj)->ext.outerObject;
 }
 
 inline bool
 IsOuterObject(JSObject *obj) {
     return !!GetObjectClass(obj)->ext.innerObject;
 }
 
 JS_FRIEND_API(bool)
-IsScopeObject(RawObject obj);
+IsScopeObject(JSObject *obj);
 
 inline JSObject *
-GetObjectParent(RawObject obj)
+GetObjectParent(JSObject *obj)
 {
     JS_ASSERT(!IsScopeObject(obj));
     return reinterpret_cast<shadow::Object*>(obj)->shape->base->parent;
 }
 
 static JS_ALWAYS_INLINE JSCompartment *
 GetObjectCompartment(JSObject *obj)
 {
     return reinterpret_cast<shadow::Object*>(obj)->shape->base->compartment;
 }
 
 JS_FRIEND_API(JSObject *)
-GetObjectParentMaybeScope(RawObject obj);
+GetObjectParentMaybeScope(JSObject *obj);
 
 JS_FRIEND_API(JSObject *)
-GetGlobalForObjectCrossCompartment(RawObject obj);
+GetGlobalForObjectCrossCompartment(JSObject *obj);
 
 JS_FRIEND_API(void)
-NotifyAnimationActivity(RawObject obj);
+NotifyAnimationActivity(JSObject *obj);
 
 JS_FRIEND_API(bool)
 IsOriginalScriptFunction(JSFunction *fun);
 
 /*
  * Return the outermost enclosing function (script) of the scripted caller.
  * This function returns NULL in several cases:
  *  - no script is running on the context
@@ -455,20 +455,20 @@ NewFunctionByIdWithReserved(JSContext *c
 
 JS_FRIEND_API(JSObject *)
 InitClassWithReserved(JSContext *cx, JSObject *obj, JSObject *parent_proto,
                       JSClass *clasp, JSNative constructor, unsigned nargs,
                       const JSPropertySpec *ps, const JSFunctionSpec *fs,
                       const JSPropertySpec *static_ps, const JSFunctionSpec *static_fs);
 
 JS_FRIEND_API(const Value &)
-GetFunctionNativeReserved(RawObject fun, size_t which);
+GetFunctionNativeReserved(JSObject *fun, size_t which);
 
 JS_FRIEND_API(void)
-SetFunctionNativeReserved(RawObject fun, size_t which, const Value &val);
+SetFunctionNativeReserved(JSObject *fun, size_t which, const Value &val);
 
 inline bool
 GetObjectProto(JSContext *cx, JSObject *obj, JSObject **proto)
 {
     js::Class *clasp = GetObjectClass(obj);
     if (clasp == &js::ObjectProxyClass ||
         clasp == &js::OuterWindowProxyClass ||
         clasp == &js::FunctionProxyClass)
@@ -476,59 +476,59 @@ GetObjectProto(JSContext *cx, JSObject *
         return JS_GetPrototype(cx, obj, proto);
     }
 
     *proto = reinterpret_cast<const shadow::Object*>(obj)->type->proto;
     return true;
 }
 
 inline void *
-GetObjectPrivate(RawObject obj)
+GetObjectPrivate(JSObject *obj)
 {
     const shadow::Object *nobj = reinterpret_cast<const shadow::Object*>(obj);
     void **addr = reinterpret_cast<void**>(&nobj->fixedSlots()[nobj->numFixedSlots()]);
     return *addr;
 }
 
 /*
  * Get a slot that is both reserved for object's clasp *and* is fixed (fits
  * within the maximum capacity for the object's fixed slots).
  */
 inline const Value &
-GetReservedSlot(RawObject obj, size_t slot)
+GetReservedSlot(JSObject *obj, size_t slot)
 {
     JS_ASSERT(slot < JSCLASS_RESERVED_SLOTS(GetObjectClass(obj)));
     return reinterpret_cast<const shadow::Object *>(obj)->slotRef(slot);
 }
 
 JS_FRIEND_API(void)
-SetReservedSlotWithBarrier(RawObject obj, size_t slot, const Value &value);
+SetReservedSlotWithBarrier(JSObject *obj, size_t slot, const Value &value);
 
 inline void
-SetReservedSlot(RawObject obj, size_t slot, const Value &value)
+SetReservedSlot(JSObject *obj, size_t slot, const Value &value)
 {
     JS_ASSERT(slot < JSCLASS_RESERVED_SLOTS(GetObjectClass(obj)));
     shadow::Object *sobj = reinterpret_cast<shadow::Object *>(obj);
     if (sobj->slotRef(slot).isMarkable()
 #ifdef JSGC_GENERATIONAL
         || value.isMarkable()
 #endif
        )
     {
         SetReservedSlotWithBarrier(obj, slot, value);
     } else {
         sobj->slotRef(slot) = value;
     }
 }
 
 JS_FRIEND_API(uint32_t)
-GetObjectSlotSpan(RawObject obj);
+GetObjectSlotSpan(JSObject *obj);
 
 inline const Value &
-GetObjectSlot(RawObject obj, size_t slot)
+GetObjectSlot(JSObject *obj, size_t slot)
 {
     JS_ASSERT(slot < GetObjectSlotSpan(obj));
     return reinterpret_cast<const shadow::Object *>(obj)->slotRef(slot);
 }
 
 inline const jschar *
 GetAtomChars(JSAtom *atom)
 {
@@ -537,44 +537,44 @@ GetAtomChars(JSAtom *atom)
 
 inline JSLinearString *
 AtomToLinearString(JSAtom *atom)
 {
     return reinterpret_cast<JSLinearString *>(atom);
 }
 
 static inline js::PropertyOp
-CastAsJSPropertyOp(RawObject object)
+CastAsJSPropertyOp(JSObject *object)
 {
     return JS_DATA_TO_FUNC_PTR(js::PropertyOp, object);
 }
 
 static inline js::StrictPropertyOp
-CastAsJSStrictPropertyOp(RawObject object)
+CastAsJSStrictPropertyOp(JSObject *object)
 {
     return JS_DATA_TO_FUNC_PTR(js::StrictPropertyOp, object);
 }
 
 JS_FRIEND_API(bool)
-GetPropertyNames(JSContext *cx, RawObject obj, unsigned flags, js::AutoIdVector *props);
+GetPropertyNames(JSContext *cx, JSObject *obj, unsigned flags, js::AutoIdVector *props);
 
 JS_FRIEND_API(bool)
 AppendUnique(JSContext *cx, AutoIdVector &base, AutoIdVector &others);
 
 JS_FRIEND_API(bool)
 GetGeneric(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp);
 
 JS_FRIEND_API(bool)
 StringIsArrayIndex(JSLinearString *str, uint32_t *indexp);
 
 JS_FRIEND_API(void)
 SetPreserveWrapperCallback(JSRuntime *rt, PreserveWrapperCallback callback);
 
 JS_FRIEND_API(bool)
-IsObjectInContextCompartment(RawObject obj, const JSContext *cx);
+IsObjectInContextCompartment(JSObject *obj, const JSContext *cx);
 
 /*
  * NB: these flag bits are encoded into the bytecode stream in the immediate
  * operand of JSOP_ITER, so don't change them without advancing vm/Xdr.h's
  * XDR_BYTECODE_VERSION.
  */
 #define JSITER_ENUMERATE  0x1   /* for-in compatible hidden default iterator */
 #define JSITER_FOREACH    0x2   /* return [key, value] pair rather than key */
@@ -715,17 +715,17 @@ class ProfileEntry
 JS_FRIEND_API(void)
 SetRuntimeProfilingStack(JSRuntime *rt, ProfileEntry *stack, uint32_t *size,
                          uint32_t max);
 
 JS_FRIEND_API(void)
 EnableRuntimeProfilingStack(JSRuntime *rt, bool enabled);
 
 JS_FRIEND_API(jsbytecode*)
-ProfilingGetPC(JSRuntime *rt, RawScript script, void *ip);
+ProfilingGetPC(JSRuntime *rt, JSScript *script, void *ip);
 
 #ifdef JS_THREADSAFE
 JS_FRIEND_API(void *)
 GetOwnerThread(const JSContext *cx);
 
 JS_FRIEND_API(bool)
 ContextHasOutstandingRequests(const JSContext *cx);
 #endif
@@ -981,20 +981,19 @@ JS_NewInt32ArrayFromArray(JSContext *cx,
 extern JS_FRIEND_API(JSObject *)
 JS_NewUint32ArrayFromArray(JSContext *cx, JSObject *array);
 extern JS_FRIEND_API(JSObject *)
 JS_NewFloat32ArrayFromArray(JSContext *cx, JSObject *array);
 extern JS_FRIEND_API(JSObject *)
 JS_NewFloat64ArrayFromArray(JSContext *cx, JSObject *array);
 
 /*
- * Create a new typed array using the given ArrayBuffer for storage. byteOffset
- * must not exceed (signed) INT32_MAX. The length value is optional; if -1 is
- * passed, enough elements to use up the remainder of the byte array is used as
- * the default value.
+ * Create a new typed array using the given ArrayBuffer for storage.  The
+ * length value is optional; if -1 is passed, enough elements to use up the
+ * remainder of the byte array is used as the default value.
  */
 
 extern JS_FRIEND_API(JSObject *)
 JS_NewInt8ArrayWithBuffer(JSContext *cx, JSObject *arrayBuffer,
                           uint32_t byteOffset, int32_t length);
 extern JS_FRIEND_API(JSObject *)
 JS_NewUint8ArrayWithBuffer(JSContext *cx, JSObject *arrayBuffer,
                            uint32_t byteOffset, int32_t length);
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -121,17 +121,17 @@ fun_getProperty(JSContext *cx, HandleObj
         if (!argsobj)
             return false;
 
 #ifdef JS_ION
         // Disabling compiling of this script in IonMonkey.
         // IonMonkey does not guarantee |f.arguments| can be
         // fully recovered, so we try to mitigate observing this behavior by
         // detecting its use early.
-        RawScript script = iter.script();
+        JSScript *script = iter.script();
         ion::ForbidCompilation(cx, script);
 #endif
 
         vp.setObject(*argsobj);
         return true;
     }
 
 #ifdef JS_METHODJIT
@@ -144,17 +144,17 @@ fun_getProperty(JSContext *cx, HandleObj
          * If the frame was called from within an inlined frame, mark the
          * innermost function as uninlineable to expand its frame and allow us
          * to recover its callee object.
          */
         InlinedSite *inlined;
         jsbytecode *prevpc = fp->prevpc(&inlined);
         if (inlined) {
             mjit::JITChunk *chunk = fp->prev()->jit()->chunk(prevpc);
-            RawFunction fun = chunk->inlineFrames()[inlined->inlineIndex].fun;
+            JSFunction *fun = chunk->inlineFrames()[inlined->inlineIndex].fun;
             fun->nonLazyScript()->uninlineable = true;
             MarkTypeObjectFlags(cx, fun, OBJECT_FLAG_UNINLINEABLE);
         }
     }
 #endif
 
     if (JSID_IS_ATOM(id, cx->names().caller)) {
         ++iter;
@@ -252,17 +252,17 @@ ResolveInterpretedFunctionPrototype(JSCo
      */
     JS_ASSERT(!IsInternalFunctionObject(obj));
     JS_ASSERT(!obj->isBoundFunction());
 
     /*
      * Make the prototype object an instance of Object with the same parent
      * as the function object itself.
      */
-    RawObject objProto = obj->global().getOrCreateObjectPrototype(cx);
+    JSObject *objProto = obj->global().getOrCreateObjectPrototype(cx);
     if (!objProto)
         return NULL;
     RootedObject proto(cx, NewObjectWithGivenProto(cx, &ObjectClass, objProto, NULL, SingletonObject));
     if (!proto)
         return NULL;
 
     /*
      * Per ES5 15.3.5.2 a user-defined function's .prototype property is
@@ -519,17 +519,17 @@ JSFunction::trace(JSTracer *trc)
         if (hasScript())
             MarkScriptUnbarriered(trc, &u.i.script_, "script");
         if (u.i.env_)
             MarkObjectUnbarriered(trc, &u.i.env_, "fun_callscope");
     }
 }
 
 static void
-fun_trace(JSTracer *trc, RawObject obj)
+fun_trace(JSTracer *trc, JSObject *obj)
 {
     obj->toFunction()->trace(trc);
 }
 
 JS_FRIEND_DATA(Class) js::FunctionClass = {
     js_Function_str,
     JSCLASS_NEW_RESOLVE | JSCLASS_IMPLEMENTS_BARRIERS |
     JSCLASS_HAS_CACHED_PROTO(JSProto_Function),
@@ -1151,25 +1151,25 @@ js::CallOrConstructBoundFunction(JSConte
     *vp = args.rval();
     return true;
 }
 
 #if JS_HAS_GENERATORS
 static JSBool
 fun_isGenerator(JSContext *cx, unsigned argc, Value *vp)
 {
-    RawFunction fun;
+    JSFunction *fun;
     if (!IsFunctionObject(vp[1], &fun)) {
         JS_SET_RVAL(cx, vp, BooleanValue(false));
         return true;
     }
 
     bool result = false;
     if (fun->hasScript()) {
-        RawScript script = fun->nonLazyScript();
+        JSScript *script = fun->nonLazyScript();
         JS_ASSERT(script->length != 0);
         result = script->isGenerator;
     }
 
     JS_SET_RVAL(cx, vp, BooleanValue(result));
     return true;
 }
 #endif
@@ -1195,17 +1195,17 @@ fun_bind(JSContext *cx, unsigned argc, V
     if (args.length() > 1) {
         boundArgs = args.array() + 1;
         argslen = args.length() - 1;
     }
 
     /* Steps 7-9. */
     RootedValue thisArg(cx, args.length() >= 1 ? args[0] : UndefinedValue());
     RootedObject target(cx, &thisv.toObject());
-    RawObject boundFunction = js_fun_bind(cx, target, thisArg, boundArgs, argslen);
+    JSObject *boundFunction = js_fun_bind(cx, target, thisArg, boundArgs, argslen);
     if (!boundFunction)
         return false;
 
     /* Step 22. */
     args.rval().setObject(*boundFunction);
     return true;
 }
 
@@ -1419,17 +1419,17 @@ js::Function(JSContext *cx, unsigned arg
                     return OnBadFormal(cx, tt);
                 tt = ts.getToken();
             }
         }
     }
 
 #ifdef DEBUG
     for (unsigned i = 0; i < formals.length(); ++i) {
-        RawString str = formals[i];
+        JSString *str = formals[i];
         JS_ASSERT(str->asAtom().asPropertyName() == formals[i]);
     }
 #endif
 
     RootedString str(cx);
     if (!args.length())
         str = cx->runtime->emptyString;
     else
@@ -1670,17 +1670,17 @@ js::ReportIncompatible(JSContext *cx, Ca
     }
 }
 
 bool
 JSObject::hasIdempotentProtoChain() const
 {
     // Return false if obj (or an object on its proto chain) is non-native or
     // has a resolve or lookup hook.
-    RawObject obj = const_cast<RawObject>(this);
+    JSObject *obj = const_cast<JSObject *>(this);
     while (true) {
         if (!obj->isNative())
             return false;
 
         JSResolveOp resolve = obj->getClass()->resolve;
         if (resolve != JS_ResolveStub && resolve != (JSResolveOp) fun_resolve)
             return false;
 
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -12,18 +12,16 @@
 #include "jsprvtd.h"
 #include "jspubtd.h"
 #include "jsobj.h"
 #include "jsatom.h"
 #include "jsstr.h"
 
 #include "gc/Barrier.h"
 
-ForwardDeclareJS(Atom);
-
 namespace js { class FunctionExtended; }
 
 class JSFunction : public JSObject
 {
   public:
     enum Flags {
         INTERPRETED      = 0x0001,  /* function has a JSScript and environment. */
         NATIVE_CTOR      = 0x0002,  /* native that can be called as a constructor */
@@ -187,17 +185,17 @@ class JSFunction : public JSObject
         flags &= ~INTERPRETED_LAZY;
     }
 
     JSAtom *atom() const { return hasGuessedAtom() ? NULL : atom_.get(); }
     js::PropertyName *name() const { return hasGuessedAtom() || !atom_ ? NULL : atom_->asPropertyName(); }
     inline void initAtom(JSAtom *atom);
     JSAtom *displayAtom() const { return atom_; }
 
-    inline void setGuessedAtom(js::RawAtom atom);
+    inline void setGuessedAtom(JSAtom *atom);
 
     /* uint16_t representation bounds number of call object dynamic slots. */
     enum { MAX_ARGS_AND_VARS = 2 * ((1U << 16) - 1) };
 
     /*
      * For an interpreted function, accessors for the initial scope object of
      * activations (stack frames) of the function.
      */
@@ -205,17 +203,17 @@ class JSFunction : public JSObject
     inline void setEnvironment(JSObject *obj);
     inline void initEnvironment(JSObject *obj);
 
     static inline size_t offsetOfEnvironment() { return offsetof(JSFunction, u.i.env_); }
     static inline size_t offsetOfAtom() { return offsetof(JSFunction, atom_); }
 
     bool initializeLazyScript(JSContext *cx);
 
-    js::RawScript getOrCreateScript(JSContext *cx) {
+    JSScript *getOrCreateScript(JSContext *cx) {
         JS_ASSERT(isInterpreted());
         JS_ASSERT(cx);
         if (isInterpretedLazy()) {
             JS::RootedFunction self(cx, this);
             js::MaybeCheckStackRoots(cx);
             if (!self->initializeLazyScript(cx))
                 return NULL;
             return self->u.i.script_;
@@ -230,22 +228,22 @@ class JSFunction : public JSObject
         if (fun->isNative()) {
             script.set(NULL);
             return true;
         }
         script.set(fun->getOrCreateScript(cx));
         return fun->hasScript();
     }
 
-    js::RawScript nonLazyScript() const {
+    JSScript *nonLazyScript() const {
         JS_ASSERT(hasScript());
         return JS::HandleScript::fromMarkedLocation(&u.i.script_);
     }
 
-    js::RawScript maybeNonLazyScript() const {
+    JSScript *maybeNonLazyScript() const {
         return isInterpreted() ? nonLazyScript() : NULL;
     }
 
     js::HeapPtrScript &mutableScript() {
         JS_ASSERT(isInterpreted());
         return *(js::HeapPtrScript *)&u.i.script_;
     }
 
--- a/js/src/jsfuninlines.h
+++ b/js/src/jsfuninlines.h
@@ -23,17 +23,17 @@ JSFunction::strict() const
 
 inline void
 JSFunction::initAtom(JSAtom *atom)
 {
     atom_.init(atom);
 }
 
 inline void
-JSFunction::setGuessedAtom(js::RawAtom atom)
+JSFunction::setGuessedAtom(JSAtom *atom)
 {
     JS_ASSERT(atom_ == NULL);
     JS_ASSERT(atom != NULL);
     JS_ASSERT(!hasGuessedAtom());
     atom_ = atom;
     flags |= HAS_GUESSED_ATOM;
 }
 
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -3353,61 +3353,61 @@ GetNextZoneGroup(JSRuntime *rt)
  * current compartent group.  This calls DelayCrossCompartmentGrayMarking to
  * push the referring object onto the list.
  *
  * The list is traversed and then unlinked in
  * MarkIncomingCrossCompartmentPointers.
  */
 
 static bool
-IsGrayListObject(RawObject obj)
+IsGrayListObject(JSObject *obj)
 {
     JS_ASSERT(obj);
     return IsCrossCompartmentWrapper(obj) && !IsDeadProxyObject(obj);
 }
 
 const unsigned JSSLOT_GC_GRAY_LINK = JSSLOT_PROXY_EXTRA + 1;
 
 static unsigned
-GrayLinkSlot(RawObject obj)
+GrayLinkSlot(JSObject *obj)
 {
     JS_ASSERT(IsGrayListObject(obj));
     return JSSLOT_GC_GRAY_LINK;
 }
 
 #ifdef DEBUG
 static void
-AssertNotOnGrayList(RawObject obj)
+AssertNotOnGrayList(JSObject *obj)
 {
     JS_ASSERT_IF(IsGrayListObject(obj), obj->getReservedSlot(GrayLinkSlot(obj)).isUndefined());
 }
 #endif
 
 static JSObject *
-CrossCompartmentPointerReferent(RawObject obj)
+CrossCompartmentPointerReferent(JSObject *obj)
 {
     JS_ASSERT(IsGrayListObject(obj));
     return &GetProxyPrivate(obj).toObject();
 }
 
-static RawObject
-NextIncomingCrossCompartmentPointer(RawObject prev, bool unlink)
+static JSObject *
+NextIncomingCrossCompartmentPointer(JSObject *prev, bool unlink)
 {
     unsigned slot = GrayLinkSlot(prev);
-    RawObject next = prev->getReservedSlot(slot).toObjectOrNull();
+    JSObject *next = prev->getReservedSlot(slot).toObjectOrNull();
     JS_ASSERT_IF(next, IsGrayListObject(next));
 
     if (unlink)
         prev->setSlot(slot, UndefinedValue());
 
     return next;
 }
 
 void
-js::DelayCrossCompartmentGrayMarking(RawObject src)
+js::DelayCrossCompartmentGrayMarking(JSObject *src)
 {
     JS_ASSERT(IsGrayListObject(src));
 
     /* Called from MarkCrossCompartmentXXX functions. */
     unsigned slot = GrayLinkSlot(src);
     JSObject *dest = CrossCompartmentPointerReferent(src);
     JSCompartment *comp = dest->compartment();
 
@@ -3418,17 +3418,17 @@ js::DelayCrossCompartmentGrayMarking(Raw
         JS_ASSERT(src->getReservedSlot(slot).isObjectOrNull());
     }
 
 #ifdef DEBUG
     /*
      * Assert that the object is in our list, also walking the list to check its
      * integrity.
      */
-    RawObject obj = comp->gcIncomingGrayPointers;
+    JSObject *obj = comp->gcIncomingGrayPointers;
     bool found = false;
     while (obj) {
         if (obj == src)
             found = true;
         obj = NextIncomingCrossCompartmentPointer(obj, false);
     }
     JS_ASSERT(found);
 #endif
@@ -3448,17 +3448,17 @@ MarkIncomingCrossCompartmentPointers(JSR
 
     bool unlinkList = color == GRAY;
 
     for (GCCompartmentGroupIter c(rt); !c.done(); c.next()) {
         JS_ASSERT_IF(color == GRAY, c->zone()->isGCMarkingGray());
         JS_ASSERT_IF(color == BLACK, c->zone()->isGCMarkingBlack());
         JS_ASSERT_IF(c->gcIncomingGrayPointers, IsGrayListObject(c->gcIncomingGrayPointers));
 
-        for (RawObject src = c->gcIncomingGrayPointers;
+        for (JSObject *src = c->gcIncomingGrayPointers;
              src;
              src = NextIncomingCrossCompartmentPointer(src, unlinkList))
         {
             JSObject *dst = CrossCompartmentPointerReferent(src);
             JS_ASSERT(dst->compartment() == c);
 
             if (color == GRAY) {
                 if (IsObjectMarked(&src) && src->isMarked(GRAY))
@@ -3475,87 +3475,87 @@ MarkIncomingCrossCompartmentPointers(JSR
             c->gcIncomingGrayPointers = NULL;
     }
 
     SliceBudget budget;
     rt->gcMarker.drainMarkStack(budget);
 }
 
 static bool
-RemoveFromGrayList(RawObject wrapper)
+RemoveFromGrayList(JSObject *wrapper)
 {
     if (!IsGrayListObject(wrapper))
         return false;
 
     unsigned slot = GrayLinkSlot(wrapper);
     if (wrapper->getReservedSlot(slot).isUndefined())
         return false;  /* Not on our list. */
 
-    RawObject tail = wrapper->getReservedSlot(slot).toObjectOrNull();
+    JSObject *tail = wrapper->getReservedSlot(slot).toObjectOrNull();
     wrapper->setReservedSlot(slot, UndefinedValue());
 
     JSCompartment *comp = CrossCompartmentPointerReferent(wrapper)->compartment();
-    RawObject obj = comp->gcIncomingGrayPointers;
+    JSObject *obj = comp->gcIncomingGrayPointers;
     if (obj == wrapper) {
         comp->gcIncomingGrayPointers = tail;
         return true;
     }
 
     while (obj) {
         unsigned slot = GrayLinkSlot(obj);
-        RawObject next = obj->getReservedSlot(slot).toObjectOrNull();
+        JSObject *next = obj->getReservedSlot(slot).toObjectOrNull();
         if (next == wrapper) {
             obj->setCrossCompartmentSlot(slot, ObjectOrNullValue(tail));
             return true;
         }
         obj = next;
     }
 
     JS_NOT_REACHED("object not found in gray link list");
     return false;
 }
 
 static void
 ResetGrayList(JSCompartment *comp)
 {
-    RawObject src = comp->gcIncomingGrayPointers;
+    JSObject *src = comp->gcIncomingGrayPointers;
     while (src)
         src = NextIncomingCrossCompartmentPointer(src, true);
     comp->gcIncomingGrayPointers = NULL;
 }
 
 void
-js::NotifyGCNukeWrapper(RawObject obj)
+js::NotifyGCNukeWrapper(JSObject *obj)
 {
     /*
      * References to target of wrapper are being removed, we no longer have to
      * remember to mark it.
      */
     RemoveFromGrayList(obj);
 }
 
 enum {
     JS_GC_SWAP_OBJECT_A_REMOVED = 1 << 0,
     JS_GC_SWAP_OBJECT_B_REMOVED = 1 << 1
 };
 
 unsigned
-js::NotifyGCPreSwap(RawObject a, RawObject b)
+js::NotifyGCPreSwap(JSObject *a, JSObject *b)
 {
     /*
      * Two objects in the same compartment are about to have had their contents
      * swapped.  If either of them are in our gray pointer list, then we remove
      * them from the lists, returning a bitset indicating what happened.
      */
     return (RemoveFromGrayList(a) ? JS_GC_SWAP_OBJECT_A_REMOVED : 0) |
            (RemoveFromGrayList(b) ? JS_GC_SWAP_OBJECT_B_REMOVED : 0);
 }
 
 void
-js::NotifyGCPostSwap(RawObject a, RawObject b, unsigned removedFlags)
+js::NotifyGCPostSwap(JSObject *a, JSObject *b, unsigned removedFlags)
 {
     /*
      * Two objects in the same compartment have had their contents swapped.  If
      * either of them were in our gray pointer list, we re-add them again.
      */
     if (removedFlags & JS_GC_SWAP_OBJECT_A_REMOVED)
         DelayCrossCompartmentGrayMarking(b);
     if (removedFlags & JS_GC_SWAP_OBJECT_B_REMOVED)
@@ -4940,17 +4940,17 @@ js::StopPCCountProfiling(JSContext *cx)
     ReleaseAllJITCode(rt->defaultFreeOp());
 
     ScriptAndCountsVector *vec = cx->new_<ScriptAndCountsVector>(SystemAllocPolicy());
     if (!vec)
         return;
 
     for (ZonesIter zone(rt); !zone.done(); zone.next()) {
         for (CellIter i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
-            RawScript script = i.get<JSScript>();
+            JSScript *script = i.get<JSScript>();
             if (script->hasScriptCounts && script->types) {
                 ScriptAndCounts sac;
                 sac.script = script;
                 sac.scriptCounts.set(script->releaseScriptCounts());
                 if (!vec->append(sac))
                     sac.scriptCounts.destroy(rt->defaultFreeOp());
             }
         }
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -613,26 +613,26 @@ MinorGC(JSRuntime *rt, JS::gcreason::Rea
 #ifdef JS_GC_ZEAL
 extern void
 SetGCZeal(JSRuntime *rt, uint8_t zeal, uint32_t frequency);
 #endif
 
 /* Functions for managing cross compartment gray pointers. */
 
 extern void
-DelayCrossCompartmentGrayMarking(RawObject src);
+DelayCrossCompartmentGrayMarking(JSObject *src);
 
 extern void
-NotifyGCNukeWrapper(RawObject o);
+NotifyGCNukeWrapper(JSObject *o);
 
 extern unsigned
-NotifyGCPreSwap(RawObject a, RawObject b);
+NotifyGCPreSwap(JSObject *a, JSObject *b);
 
 extern void
-NotifyGCPostSwap(RawObject a, RawObject b, unsigned preResult);
+NotifyGCPostSwap(JSObject *a, JSObject *b, unsigned preResult);
 
 void
 InitTracer(JSTracer *trc, JSRuntime *rt, JSTraceCallback callback);
 
 /*
  * Helper that implements sweeping and allocation for kinds that can be swept
  * and allocated off the main thread.
  *
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -586,24 +586,24 @@ js_NewGCExternalString(JSContext *cx)
 
 inline JSScript *
 js_NewGCScript(JSContext *cx)
 {
     return js::gc::NewGCThing<JSScript, js::CanGC>(cx, js::gc::FINALIZE_SCRIPT,
                                                    sizeof(JSScript), js::gc::TenuredHeap);
 }
 
-inline js::RawShape
+inline js::Shape *
 js_NewGCShape(JSContext *cx)
 {
     return js::gc::NewGCThing<js::Shape, js::CanGC>(cx, js::gc::FINALIZE_SHAPE,
                                                     sizeof(js::Shape), js::gc::TenuredHeap);
 }
 
 template <js::AllowGC allowGC>
-inline js::RawBaseShape
+inline js::BaseShape *
 js_NewGCBaseShape(JSContext *cx)
 {
     return js::gc::NewGCThing<js::BaseShape, allowGC>(cx, js::gc::FINALIZE_BASE_SHAPE,
                                                       sizeof(js::BaseShape), js::gc::TenuredHeap);
 }
 
 #endif /* jsgcinlines_h___ */
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -74,17 +74,17 @@ id_constructor(JSContext *cx) {
 
 static inline jsid
 id_caller(JSContext *cx) {
     return NameToId(cx->names().caller);
 }
 
 #ifdef DEBUG
 const char *
-types::TypeIdStringImpl(RawId id)
+types::TypeIdStringImpl(jsid id)
 {
     if (JSID_IS_VOID(id))
         return "(index)";
     if (JSID_IS_EMPTY(id))
         return "(new)";
     static char bufs[4][100];
     static unsigned which = 0;
     which = (which + 1) & 3;
@@ -666,92 +666,92 @@ enum PropertyAccessKind {
     PROPERTY_READ,
     PROPERTY_READ_EXISTING
 };
 
 /* Constraints for reads/writes on object properties. */
 template <PropertyAccessKind access>
 class TypeConstraintProp : public TypeConstraint
 {
-    RawScript script_;
+    JSScript *script_;
 
   public:
     jsbytecode *pc;
 
     /*
      * If assign is true, the target is used to update a property of the object.
      * If assign is false, the target is assigned the value of the property.
      */
     StackTypeSet *target;
 
     /* Property being accessed. This is unrooted. */
-    RawId id;
-
-    TypeConstraintProp(RawScript script, jsbytecode *pc, StackTypeSet *target, RawId id)
+    jsid id;
+
+    TypeConstraintProp(JSScript *script, jsbytecode *pc, StackTypeSet *target, jsid id)
         : script_(script), pc(pc), target(target), id(id)
     {
         JS_ASSERT(script && pc && target);
     }
 
     const char *kind() { return "prop"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
 typedef TypeConstraintProp<PROPERTY_WRITE> TypeConstraintSetProperty;
 typedef TypeConstraintProp<PROPERTY_READ>  TypeConstraintGetProperty;
 typedef TypeConstraintProp<PROPERTY_READ_EXISTING> TypeConstraintGetPropertyExisting;
 
 void
 StackTypeSet::addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                             StackTypeSet *target, RawId id)
+                             StackTypeSet *target, jsid id)
 {
     /*
      * GetProperty constraints are normally used with property read input type
      * sets, except for array_pop/array_shift special casing.
      */
     JS_ASSERT(js_CodeSpec[*pc].format & JOF_INVOKE);
 
     add(cx, cx->analysisLifoAlloc().new_<TypeConstraintGetProperty>(script, pc, target, id));
 }
 
 void
 StackTypeSet::addSetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                             StackTypeSet *target, RawId id)
+                             StackTypeSet *target, jsid id)
 {
     add(cx, cx->analysisLifoAlloc().new_<TypeConstraintSetProperty>(script, pc, target, id));
 }
 
 void
 HeapTypeSet::addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                            StackTypeSet *target, RawId id)
+                            StackTypeSet *target, jsid id)
 {
     JS_ASSERT(!target->purged());
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintGetProperty>(script, pc, target, id));
 }
 
 /*
  * Constraints for updating the 'this' types of callees on CALLPROP/CALLELEM.
  * These are derived from the types on the properties themselves, rather than
  * those pushed in the 'this' slot at the call site, which allows us to retain
  * correlations between the type of the 'this' object and the associated
  * callee scripts at polymorphic call sites.
  */
 template <PropertyAccessKind access>
 class TypeConstraintCallProp : public TypeConstraint
 {
-    RawScript script_;
+    JSScript *script_;
 
   public:
     jsbytecode *callpc;
 
     /* Property being accessed. */
     jsid id;
 
-    TypeConstraintCallProp(RawScript script, jsbytecode *callpc, jsid id)
+    TypeConstraintCallProp(JSScript *script, jsbytecode *callpc, jsid id)
         : script_(script), callpc(callpc), id(id)
     {
         JS_ASSERT(script && callpc);
     }
 
     const char *kind() { return "callprop"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
@@ -778,25 +778,25 @@ HeapTypeSet::addCallProperty(JSContext *
 /*
  * Constraints for generating 'set' property constraints on a SETELEM only if
  * the element type may be a number. For SETELEM we only account for integer
  * indexes, and if the element cannot be an integer (e.g. it must be a string)
  * then we lose precision by treating it like one.
  */
 class TypeConstraintSetElement : public TypeConstraint
 {
-    RawScript script_;
+    JSScript *script_;
 
   public:
     jsbytecode *pc;
 
     StackTypeSet *objectTypes;
     StackTypeSet *valueTypes;
 
-    TypeConstraintSetElement(RawScript script, jsbytecode *pc,
+    TypeConstraintSetElement(JSScript *script, jsbytecode *pc,
                              StackTypeSet *objectTypes, StackTypeSet *valueTypes)
         : script_(script), pc(pc),
           objectTypes(objectTypes), valueTypes(valueTypes)
     {
         JS_ASSERT(script && pc);
     }
 
     const char *kind() { return "setelement"; }
@@ -836,28 +836,28 @@ void
 StackTypeSet::addCall(JSContext *cx, TypeCallsite *site)
 {
     add(cx, cx->analysisLifoAlloc().new_<TypeConstraintCall>(site));
 }
 
 /* Constraints for arithmetic operations. */
 class TypeConstraintArith : public TypeConstraint
 {
-    RawScript script_;
+    JSScript *script_;
 
   public:
     jsbytecode *pc;
 
     /* Type set receiving the result of the arithmetic. */
     TypeSet *target;
 
     /* For addition operations, the other operand. */
     TypeSet *other;
 
-    TypeConstraintArith(RawScript script, jsbytecode *pc, TypeSet *target, TypeSet *other)
+    TypeConstraintArith(JSScript *script, jsbytecode *pc, TypeSet *target, TypeSet *other)
         : script_(script), pc(pc), target(target), other(other)
     {
         JS_ASSERT(target);
     }
 
     const char *kind() { return "arith"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
@@ -868,22 +868,22 @@ StackTypeSet::addArith(JSContext *cx, JS
                        TypeSet *other)
 {
     add(cx, cx->analysisLifoAlloc().new_<TypeConstraintArith>(script, pc, target, other));
 }
 
 /* Subset constraint which transforms primitive values into appropriate objects. */
 class TypeConstraintTransformThis : public TypeConstraint
 {
-    RawScript script_;
+    JSScript *script_;
 
   public:
     TypeSet *target;
 
-    TypeConstraintTransformThis(RawScript script, TypeSet *target)
+    TypeConstraintTransformThis(JSScript *script, TypeSet *target)
         : script_(script), target(target)
     {}
 
     const char *kind() { return "transformthis"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
@@ -894,24 +894,24 @@ StackTypeSet::addTransformThis(JSContext
 }
 
 /*
  * Constraint which adds a particular type to the 'this' types of all
  * discovered scripted functions.
  */
 class TypeConstraintPropagateThis : public TypeConstraint
 {
-    RawScript script_;
+    JSScript *script_;
 
   public:
     jsbytecode *callpc;
     Type type;
     StackTypeSet *types;
 
-    TypeConstraintPropagateThis(RawScript script, jsbytecode *callpc, Type type, StackTypeSet *types)
+    TypeConstraintPropagateThis(JSScript *script, jsbytecode *callpc, Type type, StackTypeSet *types)
         : script_(script), callpc(callpc), type(type), types(types)
     {}
 
     const char *kind() { return "propagatethis"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type);
 };
 
@@ -945,23 +945,23 @@ class TypeConstraintFilterPrimitive : pu
 
 void
 HeapTypeSet::addFilterPrimitives(JSContext *cx, TypeSet *target)
 {
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintFilterPrimitive>(target));
 }
 
 /* If id is a normal slotful 'own' property of an object, get its shape. */
-static inline RawShape
-GetSingletonShape(JSContext *cx, RawObject obj, RawId idArg)
+static inline Shape *
+GetSingletonShape(JSContext *cx, JSObject *obj, jsid idArg)
 {
     if (!obj->isNative())
         return NULL;
     RootedId id(cx, idArg);
-    RawShape shape = obj->nativeLookup(cx, id);
+    Shape *shape = obj->nativeLookup(cx, id);
     if (shape && shape->hasDefaultGetter() && shape->hasSlot())
         return shape;
     return NULL;
 }
 
 void
 ScriptAnalysis::pruneTypeBarriers(JSContext *cx, uint32_t offset)
 {
@@ -970,17 +970,17 @@ ScriptAnalysis::pruneTypeBarriers(JSCont
         TypeBarrier *barrier = *pbarrier;
         if (barrier->target->hasType(barrier->type)) {
             /* Barrier is now obsolete, it can be removed. */
             *pbarrier = barrier->next;
             continue;
         }
         if (barrier->singleton) {
             JS_ASSERT(barrier->type.isPrimitive(JSVAL_TYPE_UNDEFINED));
-            RawShape shape = GetSingletonShape(cx, barrier->singleton, barrier->singletonId);
+            Shape *shape = GetSingletonShape(cx, barrier->singleton, barrier->singletonId);
             if (shape && !barrier->singleton->nativeGetSlot(shape->slot()).isUndefined()) {
                 /*
                  * When we analyzed the script the singleton had an 'own'
                  * property which was undefined (probably a 'var' variable
                  * added to a global object), but now it is defined. The only
                  * way it can become undefined again is if an explicit assign
                  * or deletion on the property occurs, which will update the
                  * type set for the property directly and trigger construction
@@ -1055,21 +1055,21 @@ void ScriptAnalysis::breakTypeBarriersSS
 
 /*
  * Subset constraint for property reads and argument passing which can add type
  * barriers on the read instead of passing types along.
  */
 class TypeConstraintSubsetBarrier : public TypeConstraint
 {
   public:
-    RawScript script;
+    JSScript *script;
     jsbytecode *pc;
     TypeSet *target;
 
-    TypeConstraintSubsetBarrier(RawScript script, jsbytecode *pc, TypeSet *target)
+    TypeConstraintSubsetBarrier(JSScript *script, jsbytecode *pc, TypeSet *target)
         : script(script), pc(pc), target(target)
     {}
 
     const char *kind() { return "subsetBarrier"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
         if (!target->hasType(type)) {
@@ -1159,17 +1159,17 @@ MarkPropertyAccessUnknown(JSContext *cx,
 }
 
 /*
  * Get a value for reading id from obj or its prototypes according to the
  * current VM state, returning the unknown type on failure or an undefined
  * property.
  */
 static inline Type
-GetSingletonPropertyType(JSContext *cx, RawObject rawObjArg, HandleId id)
+GetSingletonPropertyType(JSContext *cx, JSObject *rawObjArg, HandleId id)
 {
     RootedObject obj(cx, rawObjArg);    // Root this locally because it's assigned to.
 
     JS_ASSERT(id == IdToTypeId(id));
 
     if (JSID_IS_VOID(id))
         return Type::UnknownType();
 
@@ -1198,17 +1198,17 @@ GetSingletonPropertyType(JSContext *cx, 
 
 /*
  * Handle a property access on a specific object. All property accesses go through
  * here, whether via x.f, x[f], or global name accesses.
  */
 template <PropertyAccessKind access>
 static inline void
 PropertyAccess(JSContext *cx, JSScript *script, jsbytecode *pc, TypeObject *object,
-               StackTypeSet *target, RawId idArg)
+               StackTypeSet *target, jsid idArg)
 {
     RootedId id(cx, idArg);
 
     /* Reads from objects with unknown properties are unknown, writes to such objects are ignored. */
     if (object->unknownProperties()) {
         if (access != PROPERTY_WRITE)
             MarkPropertyAccessUnknown(cx, script, pc, target);
         return;
@@ -1392,24 +1392,24 @@ TypeConstraintSetElement::newType(JSCont
     RootedScript script(cx, script_);
     if (type.isUnknown() ||
         type.isPrimitive(JSVAL_TYPE_INT32) ||
         type.isPrimitive(JSVAL_TYPE_DOUBLE)) {
         objectTypes->addSetProperty(cx, script, pc, valueTypes, JSID_VOID);
     }
 }
 
-static inline RawFunction
+static inline JSFunction *
 CloneCallee(JSContext *cx, HandleFunction fun, HandleScript script, jsbytecode *pc)
 {
     /*
      * Clone called functions at appropriate callsites to match interpreter
      * behavior.
      */
-    RawFunction callee = CloneFunctionAtCallsite(cx, fun, script, pc);
+    JSFunction *callee = CloneFunctionAtCallsite(cx, fun, script, pc);
     if (!callee)
         return NULL;
 
     InferSpew(ISpewOps, "callsiteCloneType: #%u:%05u: %s",
               script->id(), pc - script->code, TypeString(Type::ObjectType(callee)));
 
     return callee;
 }
@@ -2180,17 +2180,17 @@ StackTypeSet::getKnownClass()
     if (unknownObject())
         return NULL;
 
     Class *clasp = NULL;
     unsigned count = getObjectCount();
 
     for (unsigned i = 0; i < count; i++) {
         Class *nclasp;
-        if (RawObject object = getSingleObject(i))
+        if (JSObject *object = getSingleObject(i))
             nclasp = object->getClass();
         else if (TypeObject *object = getTypeObject(i))
             nclasp = object->clasp;
         else
             continue;
 
         if (clasp && clasp != nclasp)
             return NULL;
@@ -2214,17 +2214,17 @@ bool
 StackTypeSet::isDOMClass()
 {
     if (unknownObject())
         return false;
 
     unsigned count = getObjectCount();
     for (unsigned i = 0; i < count; i++) {
         Class *clasp;
-        if (RawObject object = getSingleObject(i))
+        if (JSObject *object = getSingleObject(i))
             clasp = object->getClass();
         else if (TypeObject *object = getTypeObject(i))
             clasp = object->clasp;
         else
             continue;
 
         if (!(clasp->flags & JSCLASS_IS_DOMJSCLASS))
             return false;
@@ -2239,17 +2239,17 @@ StackTypeSet::getCommonPrototype()
     if (unknownObject())
         return NULL;
 
     JSObject *proto = NULL;
     unsigned count = getObjectCount();
 
     for (unsigned i = 0; i < count; i++) {
         TaggedProto nproto;
-        if (RawObject object = getSingleObject(i))
+        if (JSObject *object = getSingleObject(i))
             nproto = object->getProto();
         else if (TypeObject *object = getTypeObject(i))
             nproto = object->proto.get();
         else
             continue;
 
         if (proto) {
             if (nproto != proto)
@@ -2294,17 +2294,17 @@ HeapTypeSet::needsBarrier(JSContext *cx)
                || getObjectCount() > 0
                || hasAnyFlag(TYPE_FLAG_STRING);
     if (!result)
         addFreeze(cx);
     return result;
 }
 
 bool
-StackTypeSet::propertyNeedsBarrier(JSContext *cx, RawId id)
+StackTypeSet::propertyNeedsBarrier(JSContext *cx, jsid id)
 {
     RootedId typeId(cx, IdToTypeId(id));
 
     if (unknownObject())
         return true;
 
     for (unsigned i = 0; i < getObjectCount(); i++) {
         if (getSingleObject(i))
@@ -2333,17 +2333,17 @@ enum RecompileKind {
 /*
  * Whether all jitcode for a given pc was compiled with monitoring or barriers.
  * If we reanalyze the script after generating jitcode, new monitoring and
  * barriers will be added which may be duplicating information available when
  * the script was originally compiled, and which should not invalidate that
  * compilation.
  */
 static inline bool
-JITCodeHasCheck(RawScript script, jsbytecode *pc, RecompileKind kind)
+JITCodeHasCheck(JSScript *script, jsbytecode *pc, RecompileKind kind)
 {
     if (kind == RECOMPILE_NONE)
         return false;
 
 #ifdef JS_METHODJIT
     for (int constructing = 0; constructing <= 1; constructing++) {
         for (int barriers = 0; barriers <= 1; barriers++) {
             mjit::JITScript *jit = script->getJIT((bool) constructing, (bool) barriers);
@@ -2375,17 +2375,17 @@ JITCodeHasCheck(RawScript script, jsbyte
     return true;
 }
 
 /*
  * Force recompilation of any jitcode for script at pc, or of any other script
  * which this script was inlined into.
  */
 static inline void
-AddPendingRecompile(JSContext *cx, RawScript script, jsbytecode *pc,
+AddPendingRecompile(JSContext *cx, JSScript *script, jsbytecode *pc,
                     RecompileKind kind = RECOMPILE_NONE)
 {
     /*
      * Trigger recompilation of the script itself, if code was not previously
      * compiled with the specified information.
      */
     if (!JITCodeHasCheck(script, pc, kind))
         cx->compartment->types.addPendingRecompile(cx, script, pc);
@@ -2425,20 +2425,20 @@ AddPendingRecompile(JSContext *cx, RawSc
 
 /*
  * As for TypeConstraintFreeze, but describes an implicit freeze constraint
  * added for stack types within a script. Applies to all compilations of the
  * script, not just a single one.
  */
 class TypeConstraintFreezeStack : public TypeConstraint
 {
-    RawScript script_;
+    JSScript *script_;
 
   public:
-    TypeConstraintFreezeStack(RawScript script)
+    TypeConstraintFreezeStack(JSScript *script)
         : script_(script)
     {}
 
     const char *kind() { return "freezeStack"; }
 
     void newType(JSContext *cx, TypeSet *source, Type type)
     {
         /*
@@ -2631,18 +2631,18 @@ TypeCompartment::addAllocationSiteTypeOb
     if (!allocationSiteTable->add(p, key, res)) {
         cx->compartment->types.setPendingNukeTypes(cx);
         return NULL;
     }
 
     return res;
 }
 
-static inline RawId
-GetAtomId(JSContext *cx, RawScript script, const jsbytecode *pc, unsigned offset)
+static inline jsid
+GetAtomId(JSContext *cx, JSScript *script, const jsbytecode *pc, unsigned offset)
 {
     PropertyName *name = script->getName(GET_UINT32_INDEX(pc + offset));
     return IdToTypeId(NameToId(name));
 }
 
 bool
 types::UseNewType(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
@@ -2886,17 +2886,17 @@ TypeZone::nukeTypes(FreeOp *fop)
     mjit::ClearAllFrames(zone());
 # ifdef JS_ION
     ion::InvalidateAll(fop, zone());
 # endif
 
     /* Throw away all JIT code in the compartment, but leave everything else alone. */
 
     for (gc::CellIter i(zone(), gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
-        RawScript script = i.get<JSScript>();
+        JSScript *script = i.get<JSScript>();
         mjit::ReleaseScriptCode(fop, script);
 # ifdef JS_ION
         ion::FinishInvalidation(fop, script);
 # endif
     }
 #endif /* JS_METHODJIT */
 
     pendingNukeTypes = false;
@@ -2953,17 +2953,17 @@ TypeCompartment::addPendingRecompile(JSC
         cx->compartment->types.setPendingNukeTypes(cx);
         return;
     }
 
     co->setPendingRecompilation();
 }
 
 void
-TypeCompartment::addPendingRecompile(JSContext *cx, RawScript script, jsbytecode *pc)
+TypeCompartment::addPendingRecompile(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
     JS_ASSERT(script);
     if (!constrainedOutputs)
         return;
 
 #ifdef JS_METHODJIT
     for (int constructing = 0; constructing <= 1; constructing++) {
         for (int barriers = 0; barriers <= 1; barriers++) {
@@ -3632,17 +3632,17 @@ TypeObject::getFromPrototypes(JSContext 
         return;
 
     protoTypes->addSubset(cx, types);
 
     protoType->getFromPrototypes(cx, id, protoTypes);
 }
 
 static inline void
-UpdatePropertyType(JSContext *cx, TypeSet *types, RawObject obj, RawShape shape,
+UpdatePropertyType(JSContext *cx, TypeSet *types, JSObject *obj, Shape *shape,
                    bool force)
 {
     types->setOwnProperty(cx, false);
     if (!shape->writable())
         types->setOwnProperty(cx, true);
 
     if (shape->hasGetterValue() || shape->hasSetterValue()) {
         types->setOwnProperty(cx, true);
@@ -3657,17 +3657,17 @@ UpdatePropertyType(JSContext *cx, TypeSe
         if (force || !value.isUndefined()) {
             Type type = GetValueType(cx, value);
             types->addType(cx, type);
         }
     }
 }
 
 bool
-TypeObject::addProperty(JSContext *cx, RawId id, Property **pprop)
+TypeObject::addProperty(JSContext *cx, jsid id, Property **pprop)
 {
     JS_ASSERT(!*pprop);
     Property *base = cx->typeLifoAlloc().new_<Property>(id);
     if (!base) {
         cx->compartment->types.setPendingNukeTypes(cx);
         return false;
     }
 
@@ -3695,17 +3695,17 @@ TypeObject::addProperty(JSContext *cx, R
                 if (!value.isMagic(JS_ELEMENTS_HOLE)) {
                     Type type = GetValueType(cx, value);
                     base->types.setOwnProperty(cx, false);
                     base->types.addType(cx, type);
                 }
             }
         } else if (!JSID_IS_EMPTY(id)) {
             RootedId rootedId(cx, id);
-            RawShape shape = singleton->nativeLookup(cx, rootedId);
+            Shape *shape = singleton->nativeLookup(cx, rootedId);
             if (shape)
                 UpdatePropertyType(cx, &base->types, rSingleton, shape, false);
         }
 
         if (singleton->watched()) {
             /*
              * Mark the property as configured, to inhibit optimizations on it
              * and avoid bypassing the watchpoint handler.
@@ -3729,17 +3729,17 @@ TypeObject::addDefiniteProperties(JSCont
     if (unknownProperties())
         return true;
 
     /* Mark all properties of obj as definite properties of this type. */
     AutoEnterAnalysis enter(cx);
 
     RootedShape shape(cx, obj->lastProperty());
     while (!shape->isEmptyShape()) {
-        RawId id = IdToTypeId(shape->propid());
+        jsid id = IdToTypeId(shape->propid());
         if (!JSID_IS_VOID(id) && obj->isFixedSlot(shape->slot()) &&
             shape->slot() <= (TYPE_FLAG_DEFINITE_MASK >> TYPE_FLAG_DEFINITE_SHIFT)) {
             TypeSet *types = getProperty(cx, id, true);
             if (!types)
                 return false;
             types->setDefinite(shape->slot());
         }
         shape = shape->previous();
@@ -3755,17 +3755,17 @@ TypeObject::matchDefiniteProperties(Hand
     for (unsigned i = 0; i < count; i++) {
         Property *prop = getProperty(i);
         if (!prop)
             continue;
         if (prop->types.definiteProperty()) {
             unsigned slot = prop->types.definiteSlot();
 
             bool found = false;
-            RawShape shape = obj->lastProperty();
+            Shape *shape = obj->lastProperty();
             while (!shape->isEmptyShape()) {
                 if (shape->slot() == slot && shape->propid() == prop->id) {
                     found = true;
                     break;
                 }
                 shape = shape->previous();
             }
             if (!found)
@@ -3802,17 +3802,17 @@ void
 TypeObject::addPropertyType(JSContext *cx, jsid id, const Value &value)
 {
     InlineAddTypeProperty(cx, this, id, GetValueType(cx, value));
 }
 
 void
 TypeObject::addPropertyType(JSContext *cx, const char *name, Type type)
 {
-    RawId id = JSID_VOID;
+    jsid id = JSID_VOID;
     if (name) {
         JSAtom *atom = Atomize(cx, name, strlen(name));
         if (!atom) {
             AutoEnterAnalysis enter(cx);
             cx->compartment->types.setPendingNukeTypes(cx);
             return;
         }
         id = AtomToId(atom);
@@ -4290,17 +4290,17 @@ ScriptAnalysis::analyzeTypesBytecode(JSC
         poppedTypes(pc, pickedDepth)->addSubset(cx, &pushed[pickedDepth]);
         for (unsigned i = 0; i < pickedDepth; i++)
             poppedTypes(pc, i)->addSubset(cx, &pushed[pickedDepth - 1 - i]);
         break;
       }
 
       case JSOP_GETGNAME:
       case JSOP_CALLGNAME: {
-        RawId id = GetAtomId(cx, script, pc, 0);
+        jsid id = GetAtomId(cx, script, pc, 0);
 
         StackTypeSet *seen = bytecodeTypes(pc);
         seen->addSubset(cx, &pushed[0]);
 
         /*
          * Normally we rely on lazy standard class initialization to fill in
          * the types of global properties the script can access. In a few cases
          * the method JIT will bypass this, and we need to add the types
@@ -5345,18 +5345,18 @@ AnalyzePoppedThis(JSContext *cx, Vector<
             analysis->breakTypeBarriers(cx, calleepc - script->code, true);
 
             StackTypeSet *funcallTypes = analysis->poppedTypes(pc, GET_ARGC(pc) + 1);
             StackTypeSet *scriptTypes = analysis->poppedTypes(pc, GET_ARGC(pc));
 
             /* Need to definitely be calling Function.call/apply on a specific script. */
             RootedFunction function(cx);
             {
-                RawObject funcallObj = funcallTypes->getSingleton();
-                RawObject scriptObj = scriptTypes->getSingleton();
+                JSObject *funcallObj = funcallTypes->getSingleton();
+                JSObject *scriptObj = scriptTypes->getSingleton();
                 if (!funcallObj || !funcallObj->isFunction() ||
                     funcallObj->toFunction()->isInterpreted() ||
                     !scriptObj || !scriptObj->isFunction() ||
                     !scriptObj->toFunction()->isInterpreted()) {
                     return false;
                 }
                 Native native = funcallObj->toFunction()->native();
                 if (native != js_fun_call && native != js_fun_apply)
@@ -5975,17 +5975,17 @@ JSScript::makeTypes(JSContext *cx)
         /*
          * For callsite clones, flow the types from the specific clone back to
          * the original function.
          */
         JS_ASSERT(function());
         JS_ASSERT(originalFunction());
         JS_ASSERT(function()->nargs == originalFunction()->nargs);
 
-        RawScript original = originalFunction()->nonLazyScript();
+        JSScript *original = originalFunction()->nonLazyScript();
         if (!original->ensureHasTypes(cx))
             return false;
 
         TypeScript::ReturnTypes(this)->addSubset(cx, TypeScript::ReturnTypes(original));
         TypeScript::ThisTypes(this)->addSubset(cx, TypeScript::ThisTypes(original));
         for (unsigned i = 0; i < function()->nargs; i++)
             TypeScript::ArgTypes(this, i)->addSubset(cx, TypeScript::ArgTypes(original, i));
     }
@@ -6736,17 +6736,17 @@ TypeCompartment::~TypeCompartment()
     if (objectTypeTable)
         js_delete(objectTypeTable);
 
     if (allocationSiteTable)
         js_delete(allocationSiteTable);
 }
 
 /* static */ void
-TypeScript::Sweep(FreeOp *fop, RawScript script)
+TypeScript::Sweep(FreeOp *fop, JSScript *script)
 {
     JSCompartment *compartment = script->compartment();
     JS_ASSERT(compartment->zone()->isGCSweeping());
     JS_ASSERT(compartment->zone()->types.inferenceEnabled);
 
     unsigned num = NumTypeSets(script);
     TypeSet *typeArray = script->types->typeArray();
 
@@ -6916,17 +6916,17 @@ TypeCompartment::maybePurgeAnalysis(JSCo
             return;
         }
 
         cx->runtime->analysisPurgeCallback(cx->runtime, &desc->asFlat());
     }
 }
 
 static void
-SizeOfScriptTypeInferenceData(RawScript script, JS::TypeInferenceSizes *sizes,
+SizeOfScriptTypeInferenceData(JSScript *script, JS::TypeInferenceSizes *sizes,
                               JSMallocSizeOfFun mallocSizeOf)
 {
     TypeScript *typeScript = script->types;
     if (!typeScript)
         return;
 
     /* If TI is disabled, a single TypeScript is still present. */
     if (!script->compartment()->zone()->types.inferenceEnabled) {
@@ -7034,17 +7034,17 @@ TypeZone::sweep(FreeOp *fop, bool releas
      * Sweep analysis information and everything depending on it from the
      * compartment, including all remaining mjit code if inference is
      * enabled in the compartment.
      */
     if (inferenceEnabled) {
         gcstats::AutoPhase ap2(rt->gcStats, gcstats::PHASE_DISCARD_TI);
 
         for (CellIterUnderGC i(zone(), FINALIZE_SCRIPT); !i.done(); i.next()) {
-            RawScript script = i.get<JSScript>();
+            JSScript *script = i.get<JSScript>();
             if (script->types) {
                 types::TypeScript::Sweep(fop, script);
 
                 if (releaseTypes) {
                     script->types->destroy();
                     script->types = NULL;
                 }
             }
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -15,17 +15,17 @@
 #include "jsfriendapi.h"
 
 #include "ds/LifoAlloc.h"
 #include "gc/Barrier.h"
 #include "gc/Heap.h"
 #include "js/HashTable.h"
 #include "js/Vector.h"
 
-ForwardDeclareJS(Script);
+class JSScript;
 
 namespace js {
 
 class TaggedProto
 {
   public:
     TaggedProto() : proto(NULL) {}
     TaggedProto(JSObject *proto) : proto(proto) {}
@@ -163,17 +163,17 @@ class Type
     inline TypeObjectKey *objectKey() const;
 
     /* Accessors for JSObject types */
 
     bool isSingleObject() const {
         return isObject() && !!(data & 1);
     }
 
-    inline RawObject singleObject() const;
+    inline JSObject *singleObject() const;
 
     /* Accessors for TypeObject types */
 
     bool isTypeObject() const {
         return isObject() && !(data & 1);
     }
 
     inline TypeObject *typeObject() const;
@@ -191,17 +191,17 @@ class Type
     static inline Type AnyObjectType() { return Type(JSVAL_TYPE_OBJECT); }
     static inline Type UnknownType()   { return Type(JSVAL_TYPE_UNKNOWN); }
 
     static inline Type PrimitiveType(JSValueType type) {
         JS_ASSERT(type < JSVAL_TYPE_UNKNOWN);
         return Type(type);
     }
 
-    static inline Type ObjectType(RawObject obj);
+    static inline Type ObjectType(JSObject *obj);
     static inline Type ObjectType(TypeObject *obj);
     static inline Type ObjectType(TypeObjectKey *obj);
 };
 
 /* Get the type of a jsval, or zero for an unknown special value. */
 inline Type GetValueType(JSContext *cx, const Value &val);
 
 /*
@@ -492,17 +492,17 @@ class TypeSet
 
     /*
      * Iterate through the objects in this set. getObjectCount overapproximates
      * in the hash case (see SET_ARRAY_SIZE in jsinferinlines.h), and getObject
      * may return NULL.
      */
     inline unsigned getObjectCount() const;
     inline TypeObjectKey *getObject(unsigned i) const;
-    inline RawObject getSingleObject(unsigned i) const;
+    inline JSObject *getSingleObject(unsigned i) const;
     inline TypeObject *getTypeObject(unsigned i) const;
 
     void setOwnProperty(bool configurable) {
         flags |= TYPE_FLAG_OWN_PROPERTY;
         if (configurable)
             flags |= TYPE_FLAG_CONFIGURED_PROPERTY;
     }
     void setDefinite(unsigned slot) {
@@ -561,19 +561,19 @@ class StackTypeSet : public TypeSet
      * another structure.
      */
     static StackTypeSet *make(JSContext *cx, const char *name);
 
     /* Constraints for type inference. */
 
     void addSubset(JSContext *cx, TypeSet *target);
     void addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                        StackTypeSet *target, RawId id);
+                        StackTypeSet *target, jsid id);
     void addSetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                        StackTypeSet *target, RawId id);
+                        StackTypeSet *target, jsid id);
     void addSetElement(JSContext *cx, JSScript *script, jsbytecode *pc,
                        StackTypeSet *objectTypes, StackTypeSet *valueTypes);
     void addCall(JSContext *cx, TypeCallsite *site);
     void addArith(JSContext *cx, JSScript *script, jsbytecode *pc,
                   TypeSet *target, TypeSet *other = NULL);
     void addTransformThis(JSContext *cx, JSScript *script, TypeSet *target);
     void addPropagateThis(JSContext *cx, JSScript *script, jsbytecode *pc,
                           Type type, StackTypeSet *types = NULL);
@@ -623,20 +623,20 @@ class StackTypeSet : public TypeSet
 
     /* Get the typed array type of all objects in this set, or TypedArray::TYPE_MAX. */
     int getTypedArrayType();
 
     /* Whether all objects have JSCLASS_IS_DOMJSCLASS set. */
     bool isDOMClass();
 
     /* Get the single value which can appear in this type set, otherwise NULL. */
-    RawObject getSingleton();
+    JSObject *getSingleton();
 
     /* Whether any objects in the type set needs a barrier on id. */
-    bool propertyNeedsBarrier(JSContext *cx, RawId id);
+    bool propertyNeedsBarrier(JSContext *cx, jsid id);
 
     /*
      * Whether this set contains all types in other, except (possibly) the
      * specified type.
      */
     bool filtersType(const StackTypeSet *other, Type type) const;
 
     /*
@@ -675,17 +675,17 @@ class StackTypeSet : public TypeSet
 class HeapTypeSet : public TypeSet
 {
   public:
 
     /* Constraints for type inference. */
 
     void addSubset(JSContext *cx, TypeSet *target);
     void addGetProperty(JSContext *cx, JSScript *script, jsbytecode *pc,
-                        StackTypeSet *target, RawId id);
+                        StackTypeSet *target, jsid id);
     void addCallProperty(JSContext *cx, JSScript *script, jsbytecode *pc, jsid id);
     void addFilterPrimitives(JSContext *cx, TypeSet *target);
     void addSubsetBarrier(JSContext *cx, JSScript *script, jsbytecode *pc, TypeSet *target);
 
     /* Constraints for JIT compilation. */
 
     /* Completely freeze the contents of this type set. */
     void addFreeze(JSContext *cx);
@@ -711,17 +711,17 @@ class HeapTypeSet : public TypeSet
 
     /* Get whether this type set is non-empty. */
     bool knownNonEmpty(JSContext *cx);
 
     /* Get whether this type set is known to be a subset of other. */
     bool knownSubset(JSContext *cx, TypeSet *other);
 
     /* Get the single value which can appear in this type set, otherwise NULL. */
-    RawObject getSingleton(JSContext *cx);
+    JSObject *getSingleton(JSContext *cx);
 
     /*
      * Whether a location with this TypeSet needs a write barrier (i.e., whether
      * it can hold GC things). The type set is frozen if no barrier is needed.
      */
     bool needsBarrier(JSContext *cx);
 
     /* Get any type tag which all values in this set must have. */
@@ -854,17 +854,17 @@ struct Property
     HeapId id;
 
     /* Possible types for this property, including types inherited from prototypes. */
     HeapTypeSet types;
 
     inline Property(jsid id);
     inline Property(const Property &o);
 
-    static uint32_t keyBits(RawId id) { return uint32_t(JSID_BITS(id)); }
+    static uint32_t keyBits(jsid id) { return uint32_t(JSID_BITS(id)); }
     static jsid getKey(Property *p) { return p->id; }
 };
 
 /*
  * Information attached to a TypeObject if it is always constructed using 'new'
  * on a particular script. This is used to manage state related to the definite
  * properties on the type object: these definite properties depend on type
  * information which could change as the script executes (e.g. a scripted
@@ -954,17 +954,17 @@ struct TypeObject : gc::Cell
      */
     HeapPtrObject singleton;
 
     /*
      * Value held by singleton if this is a standin type for a singleton JS
      * object whose type has not been constructed yet.
      */
     static const size_t LAZY_SINGLETON = 1;
-    bool lazy() const { return singleton == (RawObject) LAZY_SINGLETON; }
+    bool lazy() const { return singleton == (JSObject *) LAZY_SINGLETON; }
 
     /* Flags for this object. */
     TypeObjectFlags flags;
 
     static inline size_t offsetOfFlags() { return offsetof(TypeObject, flags); }
 
     /*
      * Estimate of the contribution of this object to the type sets it appears in.
@@ -1042,33 +1042,33 @@ struct TypeObject : gc::Cell
     }
 
     /*
      * Get or create a property of this object. Only call this for properties which
      * a script accesses explicitly. 'assign' indicates whether this is for an
      * assignment, and the own types of the property will be used instead of
      * aggregate types.
      */
-    inline HeapTypeSet *getProperty(JSContext *cx, RawId id, bool own);
+    inline HeapTypeSet *getProperty(JSContext *cx, jsid id, bool own);
 
     /* Get a property only if it already exists. */
-    inline HeapTypeSet *maybeGetProperty(RawId id, JSContext *cx);
+    inline HeapTypeSet *maybeGetProperty(jsid id, JSContext *cx);
 
     inline unsigned getPropertyCount();
     inline Property *getProperty(unsigned i);
 
     /*
      * Get the global object which all objects of this type are parented to,
      * or NULL if there is none known.
      */
     //inline JSObject *getGlobal();
 
     /* Helpers */
 
-    bool addProperty(JSContext *cx, RawId id, Property **pprop);
+    bool addProperty(JSContext *cx, jsid id, Property **pprop);
     bool addDefiniteProperties(JSContext *cx, JSObject *obj);
     bool matchDefiniteProperties(HandleObject obj);
     void addPrototype(JSContext *cx, TypeObject *proto);
     void addPropertyType(JSContext *cx, jsid id, Type type);
     void addPropertyType(JSContext *cx, jsid id, const Value &value);
     void addPropertyType(JSContext *cx, const char *name, Type type);
     void addPropertyType(JSContext *cx, const char *name, const Value &value);
     void markPropertyConfigured(JSContext *cx, jsid id);
@@ -1160,17 +1160,17 @@ struct TypeCallsite
     StackTypeSet **argumentTypes;
 
     /* Types of the this variable. */
     StackTypeSet *thisTypes;
 
     /* Type set receiving the return value of this call. */
     StackTypeSet *returnTypes;
 
-    inline TypeCallsite(JSContext *cx, RawScript script, jsbytecode *pc,
+    inline TypeCallsite(JSContext *cx, JSScript *script, jsbytecode *pc,
                         bool isNew, unsigned argumentCount);
 };
 
 /* Persistent type information for a script, retained across GCs. */
 class TypeScript
 {
     friend class ::JSScript;
 
@@ -1186,25 +1186,25 @@ class TypeScript
      * Generated the first time the script is analyzed by inference and kept
      * after analysis purges.
      */
     HeapTypeSet *propertyReadTypes;
 
     /* Array of type type sets for variables and JOF_TYPESET ops. */
     TypeSet *typeArray() { return (TypeSet *) (uintptr_t(this) + sizeof(TypeScript)); }
 
-    static inline unsigned NumTypeSets(RawScript script);
+    static inline unsigned NumTypeSets(JSScript *script);
 
-    static inline HeapTypeSet  *ReturnTypes(RawScript script);
-    static inline StackTypeSet *ThisTypes(RawScript script);
-    static inline StackTypeSet *ArgTypes(RawScript script, unsigned i);
-    static inline StackTypeSet *LocalTypes(RawScript script, unsigned i);
+    static inline HeapTypeSet  *ReturnTypes(JSScript *script);
+    static inline StackTypeSet *ThisTypes(JSScript *script);
+    static inline StackTypeSet *ArgTypes(JSScript *script, unsigned i);
+    static inline StackTypeSet *LocalTypes(JSScript *script, unsigned i);
 
     /* Follows slot layout in jsanalyze.h, can get this/arg/local type sets. */
-    static inline StackTypeSet *SlotTypes(RawScript script, unsigned slot);
+    static inline StackTypeSet *SlotTypes(JSScript *script, unsigned slot);
 
     /* Get the default 'new' object for a given standard class, per the script's global. */
     static inline TypeObject *StandardType(JSContext *cx, JSProtoKey kind);
 
     /* Get a type object for an allocation site in this script. */
     static inline TypeObject *InitObject(JSContext *cx, JSScript *script, jsbytecode *pc,
                                          JSProtoKey kind);
 
@@ -1243,17 +1243,17 @@ class TypeScript
                                 const js::Value &value);
     static inline void SetArgument(JSContext *cx, JSScript *script, unsigned arg, Type type);
     static inline void SetArgument(JSContext *cx, JSScript *script, unsigned arg,
                                    const js::Value &value);
 
     static void AddFreezeConstraints(JSContext *cx, JSScript *script);
     static void Purge(JSContext *cx, HandleScript script);
 
-    static void Sweep(FreeOp *fop, RawScript script);
+    static void Sweep(FreeOp *fop, JSScript *script);
     void destroy();
 };
 
 struct ArrayTableKey;
 typedef HashMap<ArrayTableKey,ReadBarriered<TypeObject>,ArrayTableKey,SystemAllocPolicy> ArrayTypeTable;
 
 struct ObjectTableKey;
 struct ObjectTableEntry;
@@ -1426,17 +1426,17 @@ struct TypeCompartment
 
     void processPendingRecompiles(FreeOp *fop);
 
     /* Mark all types as needing destruction once inference has 'finished'. */
     void setPendingNukeTypes(JSContext *cx);
 
     /* Mark a script as needing recompilation once inference has finished. */
     void addPendingRecompile(JSContext *cx, const RecompileInfo &info);
-    void addPendingRecompile(JSContext *cx, RawScript script, jsbytecode *pc);
+    void addPendingRecompile(JSContext *cx, JSScript *script, jsbytecode *pc);
 
     /* Monitor future effects on a bytecode. */
     void monitorBytecode(JSContext *cx, JSScript *script, uint32_t offset,
                          bool returnOnly = false);
 
     /* Mark any type set containing obj as having a generic object type. */
     void markSetsUnknown(JSContext *cx, TypeObject *obj);
 
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -187,17 +187,17 @@ RecompileInfo::compilerOutput(JSContext 
     return compilerOutput(cx->compartment->types);
 }
 
 /////////////////////////////////////////////////////////////////////
 // Types
 /////////////////////////////////////////////////////////////////////
 
 /* static */ inline Type
-Type::ObjectType(RawObject obj)
+Type::ObjectType(JSObject *obj)
 {
     if (obj->hasSingletonType())
         return Type(uintptr_t(obj) | 1);
     return Type(uintptr_t(obj->type()));
 }
 
 /* static */ inline Type
 Type::ObjectType(TypeObject *obj)
@@ -272,18 +272,18 @@ TypeFlagPrimitive(TypeFlags flags)
     }
 }
 
 /*
  * Get the canonical representation of an id to use when doing inference.  This
  * maintains the constraint that if two different jsids map to the same property
  * in JS (e.g. 3 and "3"), they have the same type representation.
  */
-inline RawId
-IdToTypeId(RawId id)
+inline jsid
+IdToTypeId(jsid id)
 {
     JS_ASSERT(!JSID_IS_EMPTY(id));
 
     /*
      * All integers must map to the aggregate property for index types, including
      * negative integers.
      */
     if (JSID_IS_INT(id))
@@ -308,17 +308,17 @@ IdToTypeId(RawId id)
 
     return JSID_VOID;
 }
 
 const char * TypeIdStringImpl(jsid id);
 
 /* Convert an id for printing during debug. */
 static inline const char *
-TypeIdString(RawId id)
+TypeIdString(jsid id)
 {
 #ifdef DEBUG
     return TypeIdStringImpl(id);
 #else
     return "(missing)";
 #endif
 }
 
@@ -413,17 +413,17 @@ struct AutoEnterCompilation
       : cx(cx),
         info(cx->compartment->types.compiledInfo),
         kind(kind)
     {
         JS_ASSERT(cx->compartment->activeAnalysis);
         JS_ASSERT(info.outputIndex == RecompileInfo::NoCompilerRunning);
     }
 
-    bool init(RawScript script, bool constructing, unsigned chunkIndex)
+    bool init(JSScript *script, bool constructing, unsigned chunkIndex)
     {
         CompilerOutput co;
         co.script = script;
         co.setKind(kind);
         co.constructing = constructing;
         co.barriers = cx->zone()->compileBarriers();
         co.chunkIndex = chunkIndex;
 
@@ -592,29 +592,29 @@ TypeMonitorCall(JSContext *cx, const js:
                 TypeMonitorCallSlow(cx, &args.callee(), args, constructing);
         }
     }
 
     return true;
 }
 
 inline bool
-TrackPropertyTypes(JSContext *cx, RawObject obj, RawId id)
+TrackPropertyTypes(JSContext *cx, JSObject *obj, jsid id)
 {
     if (!cx->typeInferenceEnabled() || obj->hasLazyType() || obj->type()->unknownProperties())
         return false;
 
     if (obj->hasSingletonType() && !obj->type()->maybeGetProperty(id, cx))
         return false;
 
     return true;
 }
 
 inline void
-EnsureTrackPropertyTypes(JSContext *cx, RawObject obj, RawId id)
+EnsureTrackPropertyTypes(JSContext *cx, JSObject *obj, jsid id)
 {
     JS_ASSERT(!obj->hasLazyType());
 
     if (!cx->typeInferenceEnabled() || obj->type()->unknownProperties())
         return;
 
     id = IdToTypeId(id);
 
@@ -656,17 +656,17 @@ inline void
 AddTypeProperty(JSContext *cx, TypeObject *obj, const char *name, const Value &value)
 {
     if (cx->typeInferenceEnabled() && !obj->unknownProperties())
         obj->addPropertyType(cx, name, value);
 }
 
 /* Set one or more dynamic flags on a type object. */
 inline void
-MarkTypeObjectFlags(JSContext *cx, RawObject obj, TypeObjectFlags flags)
+MarkTypeObjectFlags(JSContext *cx, JSObject *obj, TypeObjectFlags flags)
 {
     if (cx->typeInferenceEnabled() && !obj->hasLazyType() && !obj->type()->hasAllFlags(flags))
         obj->type()->setFlags(cx, flags);
 }
 
 /*
  * Mark all properties of a type object as unknown. If markSetsUnknown is set,
  * scan the entire compartment and mark all type sets containing it as having
@@ -685,27 +685,27 @@ MarkTypeObjectUnknownProperties(JSContex
     }
 }
 
 /*
  * Mark any property which has been deleted or configured to be non-writable or
  * have a getter/setter.
  */
 inline void
-MarkTypePropertyConfigured(JSContext *cx, HandleObject obj, RawId id)
+MarkTypePropertyConfigured(JSContext *cx, HandleObject obj, jsid id)
 {
     if (cx->typeInferenceEnabled())
         id = IdToTypeId(id);
     if (TrackPropertyTypes(cx, obj, id))
         obj->type()->markPropertyConfigured(cx, id);
 }
 
 /* Mark a state change on a particular object. */
 inline void
-MarkObjectStateChange(JSContext *cx, RawObject obj)
+MarkObjectStateChange(JSContext *cx, JSObject *obj)
 {
     if (cx->typeInferenceEnabled() && !obj->hasLazyType() && !obj->type()->unknownProperties())
         obj->type()->markStateChange(cx);
 }
 
 /*
  * For an array or object which has not yet escaped and been referenced elsewhere,
  * pick a new type based on the object's current contents.
@@ -720,17 +720,17 @@ FixArrayType(JSContext *cx, HandleObject
 
 inline void
 FixObjectType(JSContext *cx, HandleObject obj)
 {
     if (cx->typeInferenceEnabled())
         cx->compartment->types.fixObjectType(cx, obj);
 }
 
-/* Interface helpers for RawScript */
+/* Interface helpers for JSScript*. */
 extern void TypeMonitorResult(JSContext *cx, JSScript *script, jsbytecode *pc,
                               const js::Value &rval);
 extern void TypeDynamicResult(JSContext *cx, JSScript *script, jsbytecode *pc,
                               js::types::Type type);
 
 inline bool
 UseNewTypeAtEntry(JSContext *cx, StackFrame *fp)
 {
@@ -775,17 +775,17 @@ UseNewTypeForClone(JSFunction *fun)
      *
      * Each instance of the innermost function will have a different wrapped
      * initialize method. We capture this, along with similar cases, by looking
      * for short scripts which use both .apply and arguments. For such scripts,
      * whenever creating a new instance of the function we both give that
      * instance a singleton type and clone the underlying script.
      */
 
-    RawScript script = fun->nonLazyScript();
+    JSScript *script = fun->nonLazyScript();
 
     if (script->length >= 50)
         return false;
 
     if (script->hasConsts() || script->hasObjects() || script->hasRegexps() || fun->isHeavyweight())
         return false;
 
     bool hasArguments = false;
@@ -804,59 +804,59 @@ UseNewTypeForClone(JSFunction *fun)
     return hasArguments && hasApply;
 }
 
 /////////////////////////////////////////////////////////////////////
 // Script interface functions
 /////////////////////////////////////////////////////////////////////
 
 /* static */ inline unsigned
-TypeScript::NumTypeSets(RawScript script)
+TypeScript::NumTypeSets(JSScript *script)
 {
     return script->nTypeSets + analyze::TotalSlots(script);
 }
 
 /* static */ inline HeapTypeSet *
-TypeScript::ReturnTypes(RawScript script)
+TypeScript::ReturnTypes(JSScript *script)
 {
     TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::CalleeSlot();
     return types->toHeapTypeSet();
 }
 
 /* static */ inline StackTypeSet *
-TypeScript::ThisTypes(RawScript script)
+TypeScript::ThisTypes(JSScript *script)
 {
     TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::ThisSlot();
     return types->toStackTypeSet();
 }
 
 /*
  * Note: for non-escaping arguments and locals, argTypes/localTypes reflect
  * only the initial type of the variable (e.g. passed values for argTypes,
  * or undefined for localTypes) and not types from subsequent assignments.
  */
 
 /* static */ inline StackTypeSet *
-TypeScript::ArgTypes(RawScript script, unsigned i)
+TypeScript::ArgTypes(JSScript *script, unsigned i)
 {
     JS_ASSERT(i < script->function()->nargs);
     TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::ArgSlot(i);
     return types->toStackTypeSet();
 }
 
 /* static */ inline StackTypeSet *
-TypeScript::LocalTypes(RawScript script, unsigned i)
+TypeScript::LocalTypes(JSScript *script, unsigned i)
 {
     JS_ASSERT(i < script->nfixed);
     TypeSet *types = script->types->typeArray() + script->nTypeSets + js::analyze::LocalSlot(script, i);
     return types->toStackTypeSet();
 }
 
 /* static */ inline StackTypeSet *
-TypeScript::SlotTypes(RawScript script, unsigned slot)
+TypeScript::SlotTypes(JSScript *script, unsigned slot)
 {
     JS_ASSERT(slot < js::analyze::TotalSlots(script));
     TypeSet *types = script->types->typeArray() + script->nTypeSets + slot;
     return types->toStackTypeSet();
 }
 
 /* static */ inline TypeObject *
 TypeScript::StandardType(JSContext *cx, JSProtoKey key)
@@ -1355,17 +1355,17 @@ Type::objectKey() const
     JS_ASSERT(isObject());
     if (isTypeObject())
         TypeObject::readBarrier((TypeObject *) data);
     else
         JSObject::readBarrier((JSObject *) (data ^ 1));
     return (TypeObjectKey *) data;
 }
 
-inline RawObject
+inline JSObject *
 Type::singleObject() const
 {
     JS_ASSERT(isSingleObject());
     JSObject::readBarrier((JSObject *) (data ^ 1));
     return (JSObject *) (data ^ 1);
 }
 
 inline TypeObject *
@@ -1529,17 +1529,17 @@ TypeSet::getObject(unsigned i) const
     JS_ASSERT(i < getObjectCount());
     if (baseObjectCount() == 1) {
         JS_ASSERT(i == 0);
         return (TypeObjectKey *) objectSet;
     }
     return objectSet[i];
 }
 
-inline RawObject
+inline JSObject *
 TypeSet::getSingleObject(unsigned i) const
 {
     TypeObjectKey *key = getObject(i);
     return (uintptr_t(key) & 1) ? (JSObject *)(uintptr_t(key) ^ 1) : NULL;
 }
 
 inline TypeObject *
 TypeSet::getTypeObject(unsigned i) const
@@ -1548,17 +1548,17 @@ TypeSet::getTypeObject(unsigned i) const
     return (key && !(uintptr_t(key) & 1)) ? (TypeObject *) key : NULL;
 }
 
 /////////////////////////////////////////////////////////////////////
 // TypeCallsite
 /////////////////////////////////////////////////////////////////////
 
 inline
-TypeCallsite::TypeCallsite(JSContext *cx, RawScript script, jsbytecode *pc,
+TypeCallsite::TypeCallsite(JSContext *cx, JSScript *script, jsbytecode *pc,
                            bool isNew, unsigned argumentCount)
     : script(script), pc(pc), isNew(isNew), argumentCount(argumentCount),
       thisTypes(NULL), returnTypes(NULL)
 {
     /* Caller must check for failure. */
     argumentTypes = cx->analysisLifoAlloc().newArray<StackTypeSet*>(argumentCount);
 }
 
@@ -1594,17 +1594,17 @@ inline void
 TypeObject::setBasePropertyCount(uint32_t count)
 {
     JS_ASSERT(count <= OBJECT_FLAG_PROPERTY_COUNT_LIMIT);
     flags = (flags & ~OBJECT_FLAG_PROPERTY_COUNT_MASK)
           | (count << OBJECT_FLAG_PROPERTY_COUNT_SHIFT);
 }
 
 inline HeapTypeSet *
-TypeObject::getProperty(JSContext *cx, RawId id, bool own)
+TypeObject::getProperty(JSContext *cx, jsid id, bool own)
 {
     JS_ASSERT(cx->compartment->activeAnalysis);
 
     JS_ASSERT(JSID_IS_VOID(id) || JSID_IS_EMPTY(id) || JSID_IS_STRING(id));
     JS_ASSERT_IF(!JSID_IS_EMPTY(id), id == IdToTypeId(id));
     JS_ASSERT(!unknownProperties());
 
     uint32_t propertyCount = basePropertyCount();
@@ -1643,23 +1643,23 @@ TypeObject::getProperty(JSContext *cx, R
     HeapTypeSet *types = &(*pprop)->types;
     if (own)
         types->setOwnProperty(cx, false);
 
     return types;
 }
 
 inline HeapTypeSet *
-TypeObject::maybeGetProperty(RawId id, JSContext *cx)
+TypeObject::maybeGetProperty(jsid id, JSContext *cx)
 {
     JS_ASSERT(JSID_IS_VOID(id) || JSID_IS_EMPTY(id) || JSID_IS_STRING(id));
     JS_ASSERT_IF(!JSID_IS_EMPTY(id), id == IdToTypeId(id));
     JS_ASSERT(!unknownProperties());
 
-    Property *prop = HashSetLookup<RawId,Property,Property>
+    Property *prop = HashSetLookup<jsid,Property,Property>
         (propertySet, basePropertyCount(), id);
 
     return prop ? &prop->types : NULL;
 }
 
 inline unsigned
 TypeObject::getPropertyCount()
 {
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -307,17 +307,17 @@ js::RunScript(JSContext *cx, StackFrame 
     // Check to see if useNewType flag should be set for this frame.
     if (fp->isFunctionFrame() && fp->isConstructing() && !fp->isGeneratorFrame() &&
         cx->typeInferenceEnabled())
     {
         StackIter iter(cx);
         if (!iter.done()) {
             ++iter;
             if (iter.isScript()) {
-                RawScript script = iter.script();
+                JSScript *script = iter.script();
                 jsbytecode *pc = iter.pc();
                 if (UseNewType(cx, script, pc))
                     fp->setUseNewType();
             }
         }
     }
 
 #ifdef DEBUG
@@ -585,17 +585,17 @@ js::Execute(JSContext *cx, HandleScript 
     /* The scope chain could be anything, so innerize just in case. */
     RootedObject scopeChain(cx, &scopeChainArg);
     scopeChain = GetInnerObject(cx, scopeChain);
     if (!scopeChain)
         return false;
 
     /* Ensure the scope chain is all same-compartment and terminates in a global. */
 #ifdef DEBUG
-    RawObject s = scopeChain;
+    JSObject *s = scopeChain;
     do {
         assertSameCompartment(cx, s);
         JS_ASSERT_IF(!s->enclosingScope(), s->isGlobal());
     } while ((s = s->enclosingScope()));
 #endif
 
     /* The VAROBJFIX option makes varObj == globalObj in global code. */
     if (!cx->hasOption(JSOPTION_VAROBJFIX)) {
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -68,17 +68,17 @@ ComputeImplicitThis(JSContext *cx, Handl
     vp.setUndefined();
 
     if (obj->isGlobal())
         return true;
 
     if (IsCacheableNonGlobalScope(obj))
         return true;
 
-    RawObject nobj = JSObject::thisObject(cx, obj);
+    JSObject *nobj = JSObject::thisObject(cx, obj);
     if (!nobj)
         return false;
 
     vp.setObject(*nobj);
     return true;
 }
 
 inline bool
@@ -882,17 +882,17 @@ GetElementOperation(JSContext *cx, JSOp 
     JSObject *obj = ToObjectFromStack(cx, lref);
     if (!obj)
         return false;
     return GetObjectElementOperation(cx, op, obj, isObject, rref, res);
 }
 
 static JS_ALWAYS_INLINE bool
 SetObjectElementOperation(JSContext *cx, Handle<JSObject*> obj, HandleId id, const Value &value,
-                          bool strict, RawScript maybeScript = NULL, jsbytecode *pc = NULL)
+                          bool strict, JSScript *maybeScript = NULL, jsbytecode *pc = NULL)
 {
     RootedScript script(cx, maybeScript);
     types::TypeScript::MonitorAssign(cx, obj, id);
 
     if (obj->isNative() && JSID_IS_INT(id)) {
         uint32_t length = obj->getDenseInitializedLength();
         int32_t i = JSID_TO_INT(id);
         if ((uint32_t)i >= length) {
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -72,17 +72,17 @@ struct IdHashPolicy {
 typedef HashSet<jsid, IdHashPolicy> IdSet;
 
 static inline bool
 NewKeyValuePair(JSContext *cx, jsid id, const Value &val, MutableHandleValue rval)
 {
     Value vec[2] = { IdToValue(id), val };
     AutoArrayRooter tvr(cx, ArrayLength(vec), vec);
 
-    RawObject aobj = NewDenseCopiedArray(cx, 2, vec);
+    JSObject *aobj = NewDenseCopiedArray(cx, 2, vec);
     if (!aobj)
         return false;
     rval.setObject(*aobj);
     return true;
 }
 
 static inline bool
 Enumerate(JSContext *cx, HandleObject pobj, jsid id,
@@ -176,17 +176,17 @@ struct SortComparatorIds
         *lessOrEqualp = (result <= 0);
         return true;
     }
 };
 
 #endif /* JS_MORE_DETERMINISTIC */
 
 static bool
-Snapshot(JSContext *cx, RawObject pobj_, unsigned flags, AutoIdVector *props)
+Snapshot(JSContext *cx, JSObject *pobj_, unsigned flags, AutoIdVector *props)
 {
     IdSet ht(cx);
     if (!ht.init(32))
         return false;
 
     RootedObject pobj(cx, pobj_);
 
     do {
@@ -373,17 +373,17 @@ NewPropertyIteratorObject(JSContext *cx,
             return NULL;
 
         Class *clasp = &PropertyIteratorObject::class_;
         RootedShape shape(cx, EmptyShape::getInitialShape(cx, clasp, NULL, NULL,
                                                           ITERATOR_FINALIZE_KIND));
         if (!shape)
             return NULL;
 
-        RawObject obj = JSObject::create(cx, ITERATOR_FINALIZE_KIND,
+        JSObject *obj = JSObject::create(cx, ITERATOR_FINALIZE_KIND,
                                          GetInitialHeap(GenericObject, clasp), shape, type);
         if (!obj)
             return NULL;
 
         JS_ASSERT(obj->numFixedSlots() == JSObject::ITER_CLASS_NFIXED_SLOTS);
         return &obj->asPropertyIterator();
     }
 
@@ -391,18 +391,18 @@ NewPropertyIteratorObject(JSContext *cx,
 }
 
 NativeIterator *
 NativeIterator::allocateIterator(JSContext *cx, uint32_t slength, const AutoIdVector &props)
 {
     size_t plength = props.length();
     NativeIterator *ni = (NativeIterator *)
         cx->malloc_(sizeof(NativeIterator)
-                    + plength * sizeof(RawString)
-                    + slength * sizeof(RawShape));
+                    + plength * sizeof(JSString *)
+                    + slength * sizeof(Shape *));
     if (!ni)
         return NULL;
     AutoValueVector strings(cx);
     ni->props_array = ni->props_cursor = (HeapPtr<JSFlatString> *) (ni + 1);
     ni->props_end = ni->props_array + plength;
     if (plength) {
         for (size_t i = 0; i < plength; i++) {
             JSFlatString *str = IdToString(cx, props[i]);
@@ -426,17 +426,17 @@ NativeIterator::allocateSentinel(JSConte
     PodZero(ni);
 
     ni->next_ = ni;
     ni->prev_ = ni;
     return ni;
 }
 
 inline void
-NativeIterator::init(RawObject obj, RawObject iterObj, unsigned flags, uint32_t slength, uint32_t key)
+NativeIterator::init(JSObject *obj, JSObject *iterObj, unsigned flags, uint32_t slength, uint32_t key)
 {
     this->obj.init(obj);
     this->iterObj_ = iterObj;
     this->flags = flags;
     this->shapes_array = (Shape **) this->props_end;
     this->shapes_length = slength;
     this->shapes_key = key;
 }
@@ -477,17 +477,17 @@ VectorToKeyIterator(JSContext *cx, Handl
     if (slength) {
         /*
          * Fill in the shape array from scratch.  We can't use the array that was
          * computed for the cache lookup earlier, as constructing iterobj could
          * have triggered a shape-regenerating GC.  Don't bother with regenerating
          * the shape key; if such a GC *does* occur, we can only get hits through
          * the one-slot lastNativeIterator cache.
          */
-        RawObject pobj = obj;
+        JSObject *pobj = obj;
         size_t ind = 0;
         do {
             ni->shapes_array[ind++] = pobj->lastProperty();
             pobj = pobj->getProto();
         } while (pobj);
         JS_ASSERT(ind == slength);
     }
 
@@ -539,17 +539,17 @@ js::EnumeratedIdVectorToIterator(JSConte
 {
     if (!(flags & JSITER_FOREACH))
         return VectorToKeyIterator(cx, obj, flags, props, vp);
 
     return VectorToValueIterator(cx, obj, flags, props, vp);
 }
 
 static inline void
-UpdateNativeIterator(NativeIterator *ni, RawObject obj)
+UpdateNativeIterator(NativeIterator *ni, JSObject *obj)
 {
     // Update the object for which the native iterator is associated, so
     // SuppressDeletedPropertyHelper will recognize the iterator as a match.
     ni->obj = obj;
 }
 
 bool
 js::GetIterator(JSContext *cx, HandleObject obj, unsigned flags, MutableHandleValue vp)
@@ -571,31 +571,31 @@ js::GetIterator(JSContext *cx, HandleObj
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NOT_ITERABLE, bytes);
             js_free(bytes);
             return false;
         }
 
         if (!Invoke(cx, ObjectOrNullValue(obj), method, 0, NULL, vp.address()))
             return false;
 
-        RawObject resultObj = ToObject(cx, vp);
+        JSObject *resultObj = ToObject(cx, vp);
         if (!resultObj)
             return false;
         vp.setObject(*resultObj);
         return true;
     }
 
-    Vector<RawShape, 8> shapes(cx);
+    Vector<Shape *, 8> shapes(cx);
     uint32_t key = 0;
 
     bool keysOnly = (flags == JSITER_ENUMERATE);
 
     if (obj) {
         if (JSIteratorOp op = obj->getClass()->ext.iteratorObject) {
-            RawObject iterobj = op(cx, obj, !(flags & JSITER_FOREACH));
+            JSObject *iterobj = op(cx, obj, !(flags & JSITER_FOREACH));
             if (!iterobj)
                 return false;
             vp.setObject(*iterobj);
             types::MarkIteratorUnknown(cx);
             return true;
         }
 
         if (keysOnly) {
@@ -629,27 +629,27 @@ js::GetIterator(JSContext *cx, HandleObj
 
             /*
              * The iterator object for JSITER_ENUMERATE never escapes, so we
              * don't care for the proper parent/proto to be set. This also
              * allows us to re-use a previous iterator object that is not
              * currently active.
              */
             {
-                RawObject pobj = obj;
+                JSObject *pobj = obj;
                 do {
                     if (!pobj->isNative() ||
                         !pobj->hasEmptyElements() ||
                         pobj->hasUncacheableProto() ||
                         obj->getOps()->enumerate ||
                         pobj->getClass()->enumerate != JS_EnumerateStub) {
                         shapes.clear();
                         goto miss;
                     }
-                    RawShape shape = pobj->lastProperty();
+                    Shape *shape = pobj->lastProperty();
                     key = (key + (key << 16)) ^ (uintptr_t(shape) >> 3);
                     if (!shapes.append(shape))
                         return false;
                     pobj = pobj->getProto();
                 } while (pobj);
             }
 
             PropertyIteratorObject *iterobj = cx->runtime->nativeIterCache.get(key);
@@ -804,24 +804,24 @@ iterator_iteratorObject(JSContext *cx, H
 
 size_t
 PropertyIteratorObject::sizeOfMisc(JSMallocSizeOfFun mallocSizeOf) const
 {
     return mallocSizeOf(getPrivate());
 }
 
 void
-PropertyIteratorObject::trace(JSTracer *trc, RawObject obj)
+PropertyIteratorObject::trace(JSTracer *trc, JSObject *obj)
 {
     if (NativeIterator *ni = obj->asPropertyIterator().getNativeIterator())
         ni->mark(trc);
 }
 
 void
-PropertyIteratorObject::finalize(FreeOp *fop, RawObject obj)
+PropertyIteratorObject::finalize(FreeOp *fop, JSObject *obj)
 {
     if (NativeIterator *ni = obj->asPropertyIterator().getNativeIterator()) {
         obj->asPropertyIterator().setNativeIterator(NULL);
         fop->free_(ni);
     }
 }
 
 Class PropertyIteratorObject::class_ = {
@@ -1029,17 +1029,17 @@ js::UnwindIteratorForException(JSContext
     cx->clearPendingException();
     if (!CloseIterator(cx, obj))
         return false;
     cx->setPendingException(v);
     return true;
 }
 
 void
-js::UnwindIteratorForUncatchableException(JSContext *cx, RawObject obj)
+js::UnwindIteratorForUncatchableException(JSContext *cx, JSObject *obj)
 {
     if (obj->isPropertyIterator()) {
         NativeIterator *ni = obj->asPropertyIterator().getNativeIterator();
         if (ni->flags & JSITER_ENUMERATE)
             ni->unlink();
     }
 }
 
@@ -1305,17 +1305,17 @@ Class js::StopIterationClass = {
     NULL                     /* construct   */
 };
 
 /*** Generators **********************************************************************************/
 
 #if JS_HAS_GENERATORS
 
 static void
-generator_finalize(FreeOp *fop, RawObject obj)
+generator_finalize(FreeOp *fop, JSObject *obj)
 {
     JSGenerator *gen = (JSGenerator *) obj->getPrivate();
     if (!gen)
         return;
 
     /*
      * gen is open when a script has not called its close method while
      * explicitly manipulating it.
@@ -1370,17 +1370,17 @@ SetGeneratorClosed(JSContext *cx, JSGene
 {
     JS_ASSERT(gen->state != JSGEN_CLOSED);
     if (GeneratorHasMarkableFrame(gen))
         GeneratorWriteBarrierPre(cx, gen);
     gen->state = JSGEN_CLOSED;
 }
 
 static void
-generator_trace(JSTracer *trc, RawObject obj)
+generator_trace(JSTracer *trc, JSObject *obj)
 {
     JSGenerator *gen = (JSGenerator *) obj->getPrivate();
     if (!gen)
         return;
 
     if (GeneratorHasMarkableFrame(gen))
         MarkGeneratorFrame(trc, gen);
 }
@@ -1421,17 +1421,17 @@ js_NewGenerator(JSContext *cx)
 {
     FrameRegs &stackRegs = cx->regs();
     JS_ASSERT(stackRegs.stackDepth() == 0);
     StackFrame *stackfp = stackRegs.fp();
 
     Rooted<GlobalObject*> global(cx, &stackfp->global());
     RootedObject obj(cx);
     {
-        RawObject proto = global->getOrCreateGeneratorPrototype(cx);
+        JSObject *proto = global->getOrCreateGeneratorPrototype(cx);
         if (!proto)
             return NULL;
         obj = NewObjectWithGivenProto(cx, &GeneratorClass, proto, global);
     }
     if (!obj)
         return NULL;
 
     /* Load and compute stack slot counts. */
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -100,17 +100,17 @@ struct NativeIterator
         prev_->next_ = next_;
         next_ = NULL;
         prev_ = NULL;
     }
 
     static NativeIterator *allocateSentinel(JSContext *cx);
     static NativeIterator *allocateIterator(JSContext *cx, uint32_t slength,
                                             const js::AutoIdVector &props);
-    void init(RawObject obj, RawObject iterObj, unsigned flags, uint32_t slength, uint32_t key);
+    void init(JSObject *obj, JSObject *iterObj, unsigned flags, uint32_t slength, uint32_t key);
 
     void mark(JSTracer *trc);
 
     static void destroy(NativeIterator *iter) {
         js_free(iter);
     }
 };
 
@@ -120,18 +120,18 @@ class PropertyIteratorObject : public JS
     static Class class_;
 
     inline NativeIterator *getNativeIterator() const;
     inline void setNativeIterator(js::NativeIterator *ni);
 
     size_t sizeOfMisc(JSMallocSizeOfFun mallocSizeOf) const;
 
   private:
-    static void trace(JSTracer *trc, RawObject obj);
-    static void finalize(FreeOp *fop, RawObject obj);
+    static void trace(JSTracer *trc, JSObject *obj);
+    static void finalize(FreeOp *fop, JSObject *obj);
 };
 
 /*
  * Array iterators are roughly like this:
  *
  *   Array.prototype.iterator = function iterator() {
  *       for (var i = 0; i < (this.length >>> 0); i++)
  *           yield this[i];
@@ -192,17 +192,17 @@ ValueToIterator(JSContext *cx, unsigned 
 
 bool
 CloseIterator(JSContext *cx, HandleObject iterObj);
 
 bool
 UnwindIteratorForException(JSContext *cx, js::HandleObject obj);
 
 void
-UnwindIteratorForUncatchableException(JSContext *cx, RawObject obj);
+UnwindIteratorForUncatchableException(JSContext *cx, JSObject *obj);
 
 JSBool
 IteratorConstructor(JSContext *cx, unsigned argc, Value *vp);
 
 }
 
 extern bool
 js_SuppressDeletedProperty(JSContext *cx, js::HandleObject obj, jsid id);
--- a/js/src/jsmemorymetrics.cpp
+++ b/js/src/jsmemorymetrics.cpp
@@ -216,17 +216,17 @@ StatsCellCallback(JSRuntime *rt, void *d
         } else {
             zStats->gcHeapStringsNormal += thingSize;
             zStats->stringCharsNonHuge += strSize;
         }
         break;
       }
 
       case JSTRACE_SHAPE: {
-        RawShape shape = static_cast<RawShape>(thing);
+        Shape *shape = static_cast<Shape *>(thing);
         CompartmentStats *cStats = GetCompartmentStats(shape->compartment());
         size_t propTableSize, kidsSize;
         shape->sizeOfExcludingThis(rtStats->mallocSizeOf_, &propTableSize, &kidsSize);
         if (shape->inDictionary()) {
             cStats->gcHeapShapesDict += thingSize;
             cStats->shapesExtraDictTables += propTableSize;
             JS_ASSERT(kidsSize == 0);
         } else {
@@ -237,17 +237,17 @@ StatsCellCallback(JSRuntime *rt, void *d
             }
             cStats->shapesExtraTreeTables += propTableSize;
             cStats->shapesExtraTreeShapeKids += kidsSize;
         }
         break;
       }
 
       case JSTRACE_BASE_SHAPE: {
-        RawBaseShape base = static_cast<RawBaseShape>(thing);
+        BaseShape *base = static_cast<BaseShape *>(thing);
         CompartmentStats *cStats = GetCompartmentStats(base->compartment());
         cStats->gcHeapShapesBase += thingSize;
         break;
       }
 
       case JSTRACE_SCRIPT: {
         JSScript *script = static_cast<JSScript *>(thing);
         CompartmentStats *cStats = GetCompartmentStats(script->compartment());
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1441,17 +1441,17 @@ js::NewReshapedObject(JSContext *cx, Han
 
     /* Get all the ids in the object, in order. */
     js::AutoIdVector ids(cx);
     {
         for (unsigned i = 0; i <= shape->slot(); i++) {
             if (!ids.append(JSID_VOID))
                 return NULL;
         }
-        RawShape nshape = shape;
+        Shape *nshape = shape;
         while (!nshape->isEmptyShape()) {
             ids[nshape->slot()] = nshape->propid();
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape. */
     RootedId id(cx);
@@ -1558,17 +1558,17 @@ js::CreateThisForFunction(JSContext *cx,
 }
 
 /*
  * Given pc pointing after a property accessing bytecode, return true if the
  * access is "object-detecting" in the sense used by web scripts, e.g., when
  * checking whether document.all is defined.
  */
 static bool
-Detecting(JSContext *cx, RawScript script, jsbytecode *pc)
+Detecting(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
     /* General case: a branch or equality op follows the access. */
     JSOp op = JSOp(*pc);
     if (js_CodeSpec[op].format & JOF_DETECTING)
         return true;
 
     jsbytecode *endpc = script->code + script->length;
     JS_ASSERT(script->code <= pc && pc < endpc);
@@ -1609,17 +1609,17 @@ Detecting(JSContext *cx, RawScript scrip
 unsigned
 js_InferFlags(JSContext *cx, unsigned defaultFlags)
 {
     /*
      * We intentionally want to look across compartment boundaries to correctly
      * handle the case of cross-compartment property access.
      */
     jsbytecode *pc;
-    RawScript script = cx->stack.currentScript(&pc, ContextStack::ALLOW_CROSS_COMPARTMENT);
+