--- a/js/src/builtin/ParallelArray.cpp
+++ b/js/src/builtin/ParallelArray.cpp
@@ -88,17 +88,17 @@ GetElementFromArrayLikeObject(JSContext 
 {
     // Fast path getting an element from parallel and dense arrays. For dense
     // arrays, we only do this if the prototype doesn't have indexed
     // properties. In this case holes = undefined.
     if (pa && pa->getParallelArrayElement(cx, i, &iv, vp))
         return true;
 
     if (obj->isDenseArray() && i < obj->getDenseArrayInitializedLength() &&
-        !js_PrototypeHasIndexedProperties(cx, obj))
+        !js_PrototypeHasIndexedProperties(obj))
     {
         vp.set(obj->getDenseArrayElement(i));
         if (vp.isMagic(JS_ARRAY_HOLE))
             vp.setUndefined();
         return true;
     }
 
     if (obj->isArguments()) {
@@ -130,17 +130,17 @@ NewDenseCopiedArrayWithType(JSContext *c
     if (!buffer)
         return NULL;
     JS_ASSERT(buffer->getDenseArrayCapacity() >= length);
     buffer->setDenseArrayInitializedLength(length);
 
     uint32_t srclen;
     uint32_t copyUpTo;
 
-    if (source->isDenseArray() && !js_PrototypeHasIndexedProperties(cx, source)) {
+    if (source->isDenseArray() && !js_PrototypeHasIndexedProperties(source)) {
         // Optimize for the common case: if we have a dense array source, copy
         // whatever we can, truncating to length. This path doesn't trigger
         // GC, so we don't need to initialize all the array's slots before
         // copying.
         const Value *srcvp = source->getDenseArrayElements();
 
         srclen = source->getDenseArrayInitializedLength();
         copyUpTo = Min(length, srclen);

--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -1217,21 +1217,20 @@ ScriptAnalysis::analyzeSSA(JSContext *cx
      * untracked entries, i.e. escaping locals and arguments.
      */
     SSAValueInfo *values = cx->pod_calloc<SSAValueInfo>(numSlots + maxDepth);
     if (!values) {
         setOOM(cx);
         return;
     }
     struct FreeSSAValues {
-        JSContext *cx;
         SSAValueInfo *values;
-        FreeSSAValues(JSContext *cx, SSAValueInfo *values) : cx(cx), values(values) {}
+        FreeSSAValues(SSAValueInfo *values) : values(values) {}
         ~FreeSSAValues() { js_free(values); }
-    } free(cx, values);
+    } free(values);
 
     SSAValueInfo *stack = values + numSlots;
     uint32_t stackDepth = 0;
 
     for (uint32_t slot = ArgSlot(0); slot < numSlots; slot++) {
         if (trackSlot(slot))
             values[slot].v.initInitial(slot);
     }

--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -1061,17 +1061,17 @@ class ScriptAnalysis
     types::StackTypeSet *poppedTypes(uint32_t offset, uint32_t which) {
         return getValueTypes(poppedValue(offset, which));
     }
     types::StackTypeSet *poppedTypes(const jsbytecode *pc, uint32_t which) {
         return getValueTypes(poppedValue(pc, which));
     }
 
     /* Whether an arithmetic operation is operating on integers, with an integer result. */
-    bool integerOperation(JSContext *cx, jsbytecode *pc);
+    bool integerOperation(jsbytecode *pc);
 
     bool trackUseChain(const SSAValue &v) {
         JS_ASSERT_IF(v.kind() == SSAValue::VAR, trackSlot(v.varSlot()));
         return v.kind() != SSAValue::EMPTY &&
                (v.kind() != SSAValue::VAR || !v.varInitial());
     }
 
     /*

--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -359,17 +359,17 @@ GetElementsSlow(JSContext *cx, HandleObj
 
     return true;
 }
 
 bool
 GetElements(JSContext *cx, HandleObject aobj, uint32_t length, Value *vp)
 {
     if (aobj->isDenseArray() && length <= aobj->getDenseArrayInitializedLength() &&
-        !js_PrototypeHasIndexedProperties(cx, aobj)) {
+        !js_PrototypeHasIndexedProperties(aobj)) {
         /* The prototype does not have indexed properties so hole = undefined */
         const Value *srcbeg = aobj->getDenseArrayElements();
         const Value *srcend = srcbeg + length;
         const Value *src = srcbeg;
         for (Value *dst = vp; src < srcend; ++dst, ++src)
             *dst = src->isMagic(JS_ARRAY_HOLE) ? UndefinedValue() : *src;
         return true;
     }
@@ -815,17 +815,17 @@ array_setGeneric(JSContext *cx, HandleOb
 
     if (!obj->isDenseArray())
         return baseops::SetPropertyHelper(cx, obj, obj, id, 0, vp, strict);
 
     do {
         uint32_t i;
         if (!js_IdIsIndex(id, &i))
             break;
-        if (js_PrototypeHasIndexedProperties(cx, obj))
+        if (js_PrototypeHasIndexedProperties(obj))
             break;
 
         JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, i, 1);
         if (result != JSObject::ED_OK) {
             if (result == JSObject::ED_FAILED)
                 return false;
             JS_ASSERT(result == JSObject::ED_SPARSE);
             break;
@@ -863,17 +863,17 @@ array_setElement(JSContext *cx, HandleOb
 
     do {
         /*
          * UINT32_MAX is not an array index and must not affect the length
          * property, so specifically reject it.
          */
         if (index == UINT32_MAX)
             break;
-        if (js_PrototypeHasIndexedProperties(cx, obj))
+        if (js_PrototypeHasIndexedProperties(obj))
             break;
 
         JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, index, 1);
         if (result != JSObject::ED_OK) {
             if (result == JSObject::ED_FAILED)
                 return false;
             JS_ASSERT(result == JSObject::ED_SPARSE);
             break;
@@ -894,17 +894,17 @@ static JSBool
 array_setSpecial(JSContext *cx, HandleObject obj, HandleSpecialId sid,
                  MutableHandleValue vp, JSBool strict)
 {
     Rooted<jsid> id(cx, SPECIALID_TO_JSID(sid));
     return array_setGeneric(cx, obj, id, vp, strict);
 }
 
 JSBool
-js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj)
+js_PrototypeHasIndexedProperties(JSObject *obj)
 {
     JS_ASSERT(obj->isDenseArray());
 
     /*
      * Walk up the prototype chain and see if this indexed element already
      * exists. If we hit the end of the prototype chain, it's safe to set the
      * element on the original object.
      */
@@ -1490,17 +1490,17 @@ array_join_sub(JSContext *cx, CallArgs &
         seplen = 1;
     }
 
     // Step 6 is implicit in the loops below
 
     StringBuffer sb(cx);
 
     // Various optimized versions of steps 7-10
-    if (!locale && !seplen && obj->isDenseArray() && !js_PrototypeHasIndexedProperties(cx, obj)) {
+    if (!locale && !seplen && obj->isDenseArray() && !js_PrototypeHasIndexedProperties(obj)) {
         const Value *start = obj->getDenseArrayElements();
         const Value *end = start + obj->getDenseArrayInitializedLength();
         const Value *elem;
         for (elem = start; elem < end; elem++) {
             if (!JS_CHECK_OPERATION_LIMIT(cx))
                 return false;
 
             /*
@@ -1666,17 +1666,17 @@ InitArrayElements(JSContext *cx, HandleO
 
     /*
      * Optimize for dense arrays so long as adding the given set of elements
      * wouldn't otherwise make the array slow.
      */
     do {
         if (!obj->isDenseArray())
             break;
-        if (js_PrototypeHasIndexedProperties(cx, obj))
+        if (js_PrototypeHasIndexedProperties(obj))
             break;
 
         JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, start, count);
         if (result != JSObject::ED_OK) {
             if (result == JSObject::ED_FAILED)
                 return false;
             JS_ASSERT(result == JSObject::ED_SPARSE);
             break;
@@ -1732,17 +1732,17 @@ array_reverse(JSContext *cx, unsigned ar
 
     uint32_t len;
     if (!GetLengthProperty(cx, obj, &len))
         return false;
 
     do {
         if (!obj->isDenseArray())
             break;
-        if (js_PrototypeHasIndexedProperties(cx, obj))
+        if (js_PrototypeHasIndexedProperties(obj))
             break;
 
         /* An empty array or an array with no elements is already reversed. */
         if (len == 0 || obj->getDenseArrayCapacity() == 0) {
             args.rval().setObject(*obj);
             return true;
         }
 
@@ -2394,17 +2394,17 @@ js::array_shift(JSContext *cx, unsigned 
     if (!GetLengthProperty(cx, obj, &length))
         return JS_FALSE;
 
     if (length == 0) {
         args.rval().setUndefined();
     } else {
         length--;
 
-        if (obj->isDenseArray() && !js_PrototypeHasIndexedProperties(cx, obj) &&
+        if (obj->isDenseArray() && !js_PrototypeHasIndexedProperties(obj) &&
             length < obj->getDenseArrayCapacity() &&
             0 < obj->getDenseArrayInitializedLength()) {
             args.rval().set(obj->getDenseArrayElement(0));
             if (args.rval().isMagic(JS_ARRAY_HOLE))
                 args.rval().setUndefined();
             obj->moveDenseArrayElements(0, 1, obj->getDenseArrayInitializedLength() - 1);
             obj->setDenseArrayInitializedLength(obj->getDenseArrayInitializedLength() - 1);
             JSObject::setArrayLength(cx, obj, length);
@@ -2449,17 +2449,17 @@ array_unshift(JSContext *cx, unsigned ar
     double newlen = length;
     if (args.length() > 0) {
         /* Slide up the array to make room for all args at the bottom. */
         if (length > 0) {
             bool optimized = false;
             do {
                 if (!obj->isDenseArray())
                     break;
-                if (js_PrototypeHasIndexedProperties(cx, obj))
+                if (js_PrototypeHasIndexedProperties(obj))
                     break;
                 JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, length, args.length());
                 if (result != JSObject::ED_OK) {
                     if (result == JSObject::ED_FAILED)
                         return false;
                     JS_ASSERT(result == JSObject::ED_SPARSE);
                     break;
                 }
@@ -2544,17 +2544,17 @@ CanOptimizeForDenseStorage(JSObject *arr
      * object which merely has |arr| on its prototype chain?  It turns out this
      * case can't happen, because any dense array used as the prototype of
      * another object is first slowified, for type inference's sake.
      */
     if (JS_UNLIKELY(arr->getType(cx)->hasAllFlags(OBJECT_FLAG_ITERATED)))
         return false;
 
     /* Now just watch out for getters and setters along the prototype chain. */
-    return !js_PrototypeHasIndexedProperties(cx, arr) &&
+    return !js_PrototypeHasIndexedProperties(arr) &&
            startingIndex + count <= arr->getDenseArrayInitializedLength();
 }
 
 /* ES5 15.4.4.12. */
 static JSBool
 array_splice(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
@@ -2895,17 +2895,17 @@ array_slice(JSContext *cx, unsigned argc
     }
 
     if (begin > end)
         begin = end;
 
     RootedObject nobj(cx);
 
     if (obj->isDenseArray() && end <= obj->getDenseArrayInitializedLength() &&
-        !js_PrototypeHasIndexedProperties(cx, obj)) {
+        !js_PrototypeHasIndexedProperties(obj)) {
         nobj = NewDenseCopiedArray(cx, end - begin, obj->getDenseArrayElements() + begin);
         if (!nobj)
             return JS_FALSE;
         TryReuseArrayType(obj, nobj);
         args.rval().setObject(*nobj);
         return JS_TRUE;
     }
 

--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -127,17 +127,17 @@ js_ArrayInfo(JSContext *cx, unsigned arg
  * arbitrary manipulation.  (This method optimizes on the assumption that
  * extending the array to accommodate the element will never make the array
  * sparse, which requires that the array be completely filled.)
  */
 extern JSBool
 js_NewbornArrayPush(JSContext *cx, js::HandleObject obj, const js::Value &v);
 
 JSBool
-js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj);
+js_PrototypeHasIndexedProperties(JSObject *obj);
 
 /*
  * Utility to access the value from the id returned by array_lookupProperty.
  */
 JSBool
 js_GetDenseArrayElementValue(JSContext *cx, js::HandleObject obj, jsid id,
                              js::Value *vp);
 

--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -243,17 +243,17 @@ struct SuppressErrorsGuard
     ~SuppressErrorsGuard()
     {
         JS_RestoreExceptionState(cx, prevState);
         JS_SetErrorReporter(cx, prevReporter);
     }
 };
 
 static void
-SetExnPrivate(JSContext *cx, JSObject *exnObject, JSExnPrivate *priv);
+SetExnPrivate(JSObject *exnObject, JSExnPrivate *priv);
 
 static bool
 InitExnPrivate(JSContext *cx, HandleObject exnObject, HandleString message,
                HandleString filename, unsigned lineno, unsigned column,
                JSErrorReport *report, int exnType)
 {
     JS_ASSERT(exnObject->isError());
     JS_ASSERT(!exnObject->getPrivate());
@@ -331,17 +331,17 @@ InitExnPrivate(JSContext *cx, HandleObje
     priv->stackDepth = frames.length();
     priv->exnType = exnType;
     for (size_t i = 0; i < frames.length(); ++i) {
         priv->stackElems[i].funName.init(frames[i].funName);
         priv->stackElems[i].filename = frames[i].filename;
         priv->stackElems[i].ulineno = frames[i].ulineno;
     }
 
-    SetExnPrivate(cx, exnObject, priv);
+    SetExnPrivate(exnObject, priv);
     return true;
 }
 
 static inline JSExnPrivate *
 GetExnPrivate(JSObject *obj)
 {
     JS_ASSERT(obj->isError());
     return (JSExnPrivate *) obj->getPrivate();
@@ -363,17 +363,17 @@ exn_trace(JSTracer *trc, JSObject *obj)
             if (IS_GC_MARKING_TRACER(trc) && elem.filename)
                 MarkScriptFilename(trc->runtime, elem.filename);
         }
     }
 }
 
 /* NB: An error object's private must be set through this function. */
 static void
-SetExnPrivate(JSContext *cx, JSObject *exnObject, JSExnPrivate *priv)
+SetExnPrivate(JSObject *exnObject, JSExnPrivate *priv)
 {
     JS_ASSERT(!exnObject->getPrivate());
     JS_ASSERT(exnObject->isError());
     if (JSErrorReport *report = priv->errorReport) {
         if (JSPrincipals *prin = report->originPrincipals)
             JS_HoldPrincipals(prin);
     }
     exnObject->setPrivate(priv);
@@ -1201,13 +1201,13 @@ js_CopyErrorObject(JSContext *cx, Handle
 
     // Create the Error object.
     JSObject *proto = scope->global().getOrCreateCustomErrorPrototype(cx, copy->exnType);
     if (!proto)
         return NULL;
     JSObject *copyobj = NewObjectWithGivenProto(cx, &ErrorClass, proto, NULL);
     if (!copyobj)
         return NULL;
-    SetExnPrivate(cx, copyobj, copy);
+    SetExnPrivate(copyobj, copy);
     autoFreePrivate.forget();
     autoFreeErrorReport.forget();
     return copyobj;
 }

--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -53,21 +53,16 @@ using namespace js::types;
 using namespace js::analyze;
 
 static inline jsid
 id_prototype(JSContext *cx) {
     return NameToId(cx->names().classPrototype);
 }
 
 static inline jsid
-id_arguments(JSContext *cx) {
-    return NameToId(cx->names().arguments);
-}
-
-static inline jsid
 id_length(JSContext *cx) {
     return NameToId(cx->names().length);
 }
 
 static inline jsid
 id___proto__(JSContext *cx) {
     return NameToId(cx->names().proto);
 }
@@ -77,28 +72,16 @@ id_constructor(JSContext *cx) {
     return NameToId(cx->names().constructor);
 }
 
 static inline jsid
 id_caller(JSContext *cx) {
     return NameToId(cx->names().caller);
 }
 
-static inline jsid
-id_toString(JSContext *cx)
-{
-    return NameToId(cx->names().toString);
-}
-
-static inline jsid
-id_toSource(JSContext *cx)
-{
-    return NameToId(cx->names().toSource);
-}
-
 #ifdef DEBUG
 const char *
 types::TypeIdStringImpl(jsid id)
 {
     if (JSID_IS_VOID(id))
         return "(index)";
     if (JSID_IS_EMPTY(id))
         return "(new)";
@@ -397,17 +380,17 @@ TypeSet::add(JSContext *cx, TypeConstrai
     constraint->next = constraintList;
     constraintList = constraint;
 
     if (callExisting)
         addTypesToConstraint(cx, constraint);
 }
 
 void
-TypeSet::print(JSContext *cx)
+TypeSet::print()
 {
     if (flags & TYPE_FLAG_OWN_PROPERTY)
         printf(" [own]");
     if (flags & TYPE_FLAG_CONFIGURED_PROPERTY)
         printf(" [configured]");
 
     if (definiteProperty())
         printf(" [definite:%d]", definiteSlot());
@@ -2781,17 +2764,17 @@ TypeCompartment::print(JSContext *cx, bo
         RootedScript script(cx, i.get<JSScript>());
         if (script->hasAnalysis() && script->analysis()->ranInference())
             script->analysis()->printTypes(cx);
     }
 
 #ifdef DEBUG
     for (gc::CellIter i(compartment, gc::FINALIZE_TYPE_OBJECT); !i.done(); i.next()) {
         TypeObject *object = i.get<TypeObject>();
-        object->print(cx);
+        object->print();
     }
 #endif
 
     printf("Counts: ");
     for (unsigned count = 0; count < TYPE_COUNT_LIMIT; count++) {
         if (count)
             printf("/");
         printf("%u", typeCounts[count]);
@@ -3498,17 +3481,17 @@ TypeObject::clearNewScript(JSContext *cx
     TypeNewScript *savedNewScript = newScript;
     newScript = NULL;
     js_free(savedNewScript);
 
     markStateChange(cx);
 }
 
 void
-TypeObject::print(JSContext *cx)
+TypeObject::print()
 {
     printf("%s : %s",
            TypeObjectString(this),
            proto ? TypeString(Type::ObjectType(proto)) : "(null)");
 
     if (unknownProperties()) {
         printf(" unknown");
     } else {
@@ -3534,17 +3517,17 @@ TypeObject::print(JSContext *cx)
     }
 
     printf(" {");
 
     for (unsigned i = 0; i < count; i++) {
         Property *prop = getProperty(i);
         if (prop) {
             printf("\n    %s:", TypeIdString(prop->id));
-            prop->types.print(cx);
+            prop->types.print();
         }
     }
 
     printf("\n}\n");
 }
 
 /////////////////////////////////////////////////////////////////////
 // Type Analysis
@@ -4493,17 +4476,17 @@ ScriptAnalysis::analyzeTypes(JSContext *
     if (!script_->hasFreezeConstraints) {
         RootedScript script(cx, script_);
         TypeScript::AddFreezeConstraints(cx, script);
         script_->hasFreezeConstraints = true;
     }
 }
 
 bool
-ScriptAnalysis::integerOperation(JSContext *cx, jsbytecode *pc)
+ScriptAnalysis::integerOperation(jsbytecode *pc)
 {
     JS_ASSERT(uint32_t(pc - script_->code) < script_->length);
 
     switch (JSOp(*pc)) {
 
       case JSOP_INCARG:
       case JSOP_DECARG:
       case JSOP_ARGINC:
@@ -5061,28 +5044,28 @@ ScriptAnalysis::printTypes(JSContext *cx
     else if (script_->isCachedEval)
         printf("Eval");
     else
         printf("Main");
     printf(" #%u %s (line %d):\n", script_->id(), script_->filename, script_->lineno);
 
     printf("locals:");
     printf("\n    return:");
-    TypeScript::ReturnTypes(script_)->print(cx);
+    TypeScript::ReturnTypes(script_)->print();
     printf("\n    this:");
-    TypeScript::ThisTypes(script_)->print(cx);
+    TypeScript::ThisTypes(script_)->print();
 
     for (unsigned i = 0; script_->function() && i < script_->function()->nargs; i++) {
         printf("\n    arg%u:", i);
-        TypeScript::ArgTypes(script_, i)->print(cx);
+        TypeScript::ArgTypes(script_, i)->print();
     }
     for (unsigned i = 0; i < script_->nfixed; i++) {
         if (!trackSlot(LocalSlot(script_, i))) {
             printf("\n    local%u:", i);
-            TypeScript::LocalTypes(script_, i)->print(cx);
+            TypeScript::LocalTypes(script_, i)->print();
         }
     }
     printf("\n");
 
     for (unsigned offset = 0; offset < script_->length; offset++) {
         if (!maybeCode(offset))
             continue;
 
@@ -5091,24 +5074,24 @@ ScriptAnalysis::printTypes(JSContext *cx
         PrintBytecode(cx, script_, pc);
 
         if (js_CodeSpec[*pc].format & JOF_DECOMPOSE)
             continue;
 
         if (js_CodeSpec[*pc].format & JOF_TYPESET) {
             TypeSet *types = script_->analysis()->bytecodeTypes(pc);
             printf("  typeset %d:", (int) (types - script_->types->typeArray()));
-            types->print(cx);
+            types->print();
             printf("\n");
         }
 
         unsigned defCount = GetDefCount(script_, offset);
         for (unsigned i = 0; i < defCount; i++) {
             printf("  type %d:", i);
-            pushedTypes(offset, i)->print(cx);
+            pushedTypes(offset, i)->print();
             printf("\n");
         }
 
         if (getCode(offset).monitoredTypes)
             printf("  monitored\n");
 
         TypeBarrier *barrier = getCode(offset).typeBarriers;
         if (barrier != NULL) {

--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -434,17 +434,17 @@ class TypeSet
 
     /* Chain of constraints which propagate changes out from this type set. */
     TypeConstraint *constraintList;
 
     TypeSet()
         : flags(0), objectSet(NULL), constraintList(NULL)
     {}
 
-    void print(JSContext *cx);
+    void print();
 
     inline void sweep(JSCompartment *compartment);
     inline size_t computedSizeOfExcludingThis();
 
     /* Whether this set contains a specific type. */
     inline bool hasType(Type type);
 
     TypeFlags baseFlags() const { return flags & TYPE_FLAG_BASE_MASK; }
@@ -1002,17 +1002,17 @@ struct TypeObject : gc::Cell
     void addPropertyType(JSContext *cx, const char *name, const Value &value);
     void markPropertyConfigured(JSContext *cx, jsid id);
     void markStateChange(JSContext *cx);
     void setFlags(JSContext *cx, TypeObjectFlags flags);
     void markUnknown(JSContext *cx);
     void clearNewScript(JSContext *cx);
     void getFromPrototypes(JSContext *cx, jsid id, TypeSet *types, bool force = false);
 
-    void print(JSContext *cx);
+    void print();
 
     inline void clearProperties();
     inline void sweep(FreeOp *fop);
 
     inline size_t computedSizeOfExcludingThis();
 
     void sizeOfExcludingThis(TypeInferenceSizes *sizes, JSMallocSizeOfFun mallocSizeOf);
 

--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -500,19 +500,19 @@ js::ExecuteKernel(JSContext *cx, HandleS
     ExecuteFrameGuard efg;
     if (!cx->stack.pushExecuteFrame(cx, script, thisv, scopeChain, type, evalInFrame, &efg))
         return false;
 
     if (!script->ensureRanAnalysis(cx))
         return false;
     TypeScript::SetThis(cx, script, efg.fp()->thisValue());
 
-    Probes::startExecution(cx, script);
+    Probes::startExecution(script);
     bool ok = RunScript(cx, script, efg.fp());
-    Probes::stopExecution(cx, script);
+    Probes::stopExecution(script);
 
     /* Propgate the return value out. */
     if (result)
         *result = efg.fp()->returnValue();
     return ok;
 }
 
 bool

--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -808,17 +808,17 @@ SetObjectElementOperation(JSContext *cx,
     types::TypeScript::MonitorAssign(cx, obj, id);
 
     do {
         if (obj->isDenseArray() && JSID_IS_INT(id)) {
             uint32_t length = obj->getDenseArrayInitializedLength();
             int32_t i = JSID_TO_INT(id);
             if ((uint32_t)i < length) {
                 if (obj->getDenseArrayElement(i).isMagic(JS_ARRAY_HOLE)) {
-                    if (js_PrototypeHasIndexedProperties(cx, obj))
+                    if (js_PrototypeHasIndexedProperties(obj))
                         break;
                     if ((uint32_t)i >= obj->getArrayLength())
                         JSObject::setArrayLength(cx, obj, i + 1);
                 }
                 JSObject::setDenseArrayElementWithType(cx, obj, i, value);
                 return true;
             } else {
                 if (!cx->fp()->beginsIonActivation()) {

--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -1157,29 +1157,29 @@ SuppressDeletedPropertyHelper(JSContext 
         iterobj = ni->next;
     }
     return true;
 }
 
 class SingleStringPredicate {
     Handle<JSFlatString*> str;
 public:
-    SingleStringPredicate(JSContext *cx, Handle<JSFlatString*> str) : str(str) {}
+    SingleStringPredicate(Handle<JSFlatString*> str) : str(str) {}
 
     bool operator()(JSFlatString *str) { return EqualStrings(str, this->str); }
     bool matchesAtMostOne() { return true; }
 };
 
 bool
 js_SuppressDeletedProperty(JSContext *cx, HandleObject obj, jsid id)
 {
     Rooted<JSFlatString*> str(cx, IdToString(cx, id));
     if (!str)
         return false;
-    return SuppressDeletedPropertyHelper(cx, obj, SingleStringPredicate(cx, str));
+    return SuppressDeletedPropertyHelper(cx, obj, SingleStringPredicate(str));
 }
 
 bool
 js_SuppressDeletedElement(JSContext *cx, HandleObject obj, uint32_t index)
 {
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;

--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -134,17 +134,17 @@ class BinaryDigitReader
  * happens if the addition in value * 2 + digit causes a round-down to an even
  * least significant mantissa bit when the first dropped bit is a one.  If any
  * of the following digits in the number (which haven't been added in yet) are
  * nonzero, then the correct action would have been to round up instead of
  * down.  An example occurs when reading the number 0x1000000000000081, which
  * rounds to 0x1000000000000000 instead of 0x1000000000000100.
  */
 static double
-ComputeAccurateBinaryBaseInteger(JSContext *cx, const jschar *start, const jschar *end, int base)
+ComputeAccurateBinaryBaseInteger(const jschar *start, const jschar *end, int base)
 {
     BinaryDigitReader bdr(base, start, end);
 
     /* Skip leading zeroes. */
     int bit;
     do {
         bit = bdr.nextDigit();
     } while (bit == 0);
@@ -215,17 +215,17 @@ GetPrefixInteger(JSContext *cx, const js
     /*
      * Otherwise compute the correct integer from the prefix of valid digits
      * if we're computing for base ten or a power of two.  Don't worry about
      * other bases; see 15.1.2.2 step 13.
      */
     if (base == 10)
         return ComputeAccurateDecimalInteger(cx, start, s, dp);
     if ((base & (base - 1)) == 0)
-        *dp = ComputeAccurateBinaryBaseInteger(cx, start, s, base);
+        *dp = ComputeAccurateBinaryBaseInteger(start, s, base);
 
     return true;
 }
 
 } // namespace js
 
 static JSBool
 num_isNaN(JSContext *cx, unsigned argc, Value *vp)

--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -775,17 +775,17 @@ obj_getPrototypeOf(JSContext *cx, unsign
 
     if (args[0].isPrimitive()) {
         RootedValue val(cx, args[0]);
         char *bytes = DecompileValueGenerator(cx, JSDVG_SEARCH_STACK, val, NullPtr());
         if (!bytes)
             return false;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_UNEXPECTED_TYPE, bytes, "not an object");
-        JS_free(cx, bytes);
+        js_free(bytes);
         return false;
     }
 
     /* Step 2. */
 
     /*
      * Implement [[Prototype]]-getting -- particularly across compartment
      * boundaries -- by calling a cached __proto__ getter function.
@@ -947,17 +947,17 @@ GetFirstArgumentAsObject(JSContext *cx, 
 
     RootedValue v(cx, vp[2]);
     if (!v.isObject()) {
         char *bytes = DecompileValueGenerator(cx, JSDVG_SEARCH_STACK, v, NullPtr());
         if (!bytes)
             return false;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                              bytes, "not an object");
-        JS_free(cx, bytes);
+        js_free(bytes);
         return false;
     }
 
     objp.set(&v.toObject());
     return true;
 }
 
 } /* namespace js */
@@ -1757,17 +1757,17 @@ obj_create(JSContext *cx, unsigned argc,
     CallArgs args = CallArgsFromVp(argc, vp);
     RootedValue v(cx, args[0]);
     if (!v.isObjectOrNull()) {
         char *bytes = DecompileValueGenerator(cx, JSDVG_SEARCH_STACK, v, NullPtr());
         if (!bytes)
             return false;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                              bytes, "not an object or null");
-        JS_free(cx, bytes);
+        js_free(bytes);
         return false;
     }
 
     JSObject *proto = v.toObjectOrNull();
 #if JS_HAS_XML_SUPPORT
     if (proto && proto->isXML()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_XML_PROTO_FORBIDDEN);
         return false;
@@ -2076,32 +2076,46 @@ JSFunctionSpec object_static_methods[] =
     JS_FN("preventExtensions",         obj_preventExtensions,       1,0),
     JS_FN("freeze",                    obj_freeze,                  1,0),
     JS_FN("isFrozen",                  obj_isFrozen,                1,0),
     JS_FN("seal",                      obj_seal,                    1,0),
     JS_FN("isSealed",                  obj_isSealed,                1,0),
     JS_FS_END
 };
 
+/*
+ * Get the GC kind to use for scripted 'new' on the given class.
+ * FIXME bug 547327: estimate the size from the allocation site.
+ */
+static inline gc::AllocKind
+NewObjectGCKind(js::Class *clasp)
+{
+    if (clasp == &ArrayClass || clasp == &SlowArrayClass)
+        return gc::FINALIZE_OBJECT8;
+    if (clasp == &FunctionClass)
+        return gc::FINALIZE_OBJECT2;
+    return gc::FINALIZE_OBJECT4;
+}
+
 JSBool
 js_Object(JSContext *cx, unsigned argc, Value *vp)
 {
     RootedObject obj(cx);
     if (argc == 0) {
         /* Trigger logic below to construct a blank object. */
         obj = NULL;
     } else {
         /* If argv[0] is null or undefined, obj comes back null. */
         if (!js_ValueToObjectOrNull(cx, vp[2], &obj))
             return JS_FALSE;
     }
     if (!obj) {
         /* Make an object whether this was called with 'new' or not. */
         JS_ASSERT(!argc || vp[2].isNull() || vp[2].isUndefined());
-        gc::AllocKind kind = NewObjectGCKind(cx, &ObjectClass);
+        gc::AllocKind kind = NewObjectGCKind(&ObjectClass);
         obj = NewBuiltinClassInstance(cx, &ObjectClass, kind);
         if (!obj)
             return JS_FALSE;
         jsbytecode *pc;
         RootedScript script(cx, cx->stack.currentScript(&pc));
         if (script) {
             /* Try to specialize the type of the object to the scripted call site. */
             if (!types::SetInitializerObjectType(cx, script, pc, obj))
@@ -2323,17 +2337,17 @@ JSObject*
 js_CreateThis(JSContext *cx, Class *newclasp, HandleObject callee)
 {
     RootedValue protov(cx);
     if (!JSObject::getProperty(cx, callee, callee, cx->names().classPrototype, &protov))
         return NULL;
 
     JSObject *proto = protov.isObjectOrNull() ? protov.toObjectOrNull() : NULL;
     JSObject *parent = callee->getParent();
-    gc::AllocKind kind = NewObjectGCKind(cx, newclasp);
+    gc::AllocKind kind = NewObjectGCKind(newclasp);
     return NewObjectWithClassProto(cx, newclasp, proto, parent, kind);
 }
 
 static inline JSObject *
 CreateThisForFunctionWithType(JSContext *cx, HandleTypeObject type, JSObject *parent)
 {
     if (type->newScript) {
         /*
@@ -2344,32 +2358,32 @@ CreateThisForFunctionWithType(JSContext 
         gc::AllocKind kind = type->newScript->allocKind;
         RootedObject res(cx, NewObjectWithType(cx, type, parent, kind));
         if (res)
             JS_ALWAYS_TRUE(JSObject::setLastProperty(cx, res,
                                                      (Shape *) type->newScript->shape.get()));
         return res;
     }
 
-    gc::AllocKind kind = NewObjectGCKind(cx, &ObjectClass);
+    gc::AllocKind kind = NewObjectGCKind(&ObjectClass);
     return NewObjectWithType(cx, type, parent, kind);
 }
 
 JSObject *
 js_CreateThisForFunctionWithProto(JSContext *cx, HandleObject callee, JSObject *proto)
 {
     JSObject *res;
 
     if (proto) {
         RootedTypeObject type(cx, proto->getNewType(cx, callee->toFunction()));
         if (!type)
             return NULL;
         res = CreateThisForFunctionWithType(cx, type, callee->getParent());
     } else {
-        gc::AllocKind kind = NewObjectGCKind(cx, &ObjectClass);
+        gc::AllocKind kind = NewObjectGCKind(&ObjectClass);
         res = NewObjectWithClassProto(cx, &ObjectClass, proto, callee->getParent(), kind);
     }
 
     if (res && cx->typeInferenceEnabled()) {
         RootedScript script(cx, callee->toFunction()->script());
         TypeScript::SetThis(cx, script, types::Type::ObjectType(res));
     }
 
@@ -2634,28 +2648,27 @@ js::CloneObject(JSContext *cx, HandleObj
         if (!CopySlots(cx, obj, clone))
             return NULL;
     }
 
     return clone;
 }
 
 struct JSObject::TradeGutsReserved {
-    JSContext *cx;
     Vector<Value> avals;
     Vector<Value> bvals;
     int newafixed;
     int newbfixed;
     Shape *newashape;
     Shape *newbshape;
     HeapSlot *newaslots;
     HeapSlot *newbslots;
 
     TradeGutsReserved(JSContext *cx)
-        : cx(cx), avals(cx), bvals(cx),
+        : avals(cx), bvals(cx),
           newafixed(0), newbfixed(0),
           newashape(NULL), newbshape(NULL),
           newaslots(NULL), newbslots(NULL)
     {}
 
     ~TradeGutsReserved()
     {
         if (newaslots)
@@ -2974,17 +2987,17 @@ SetClassObject(JSObject *obj, JSProtoKey
     if (!obj->isGlobal())
         return;
 
     obj->setReservedSlot(key, ObjectOrNullValue(cobj));
     obj->setReservedSlot(JSProto_LIMIT + key, ObjectOrNullValue(proto));
 }
 
 static void
-ClearClassObject(JSContext *cx, JSObject *obj, JSProtoKey key)
+ClearClassObject(JSObject *obj, JSProtoKey key)
 {
     JS_ASSERT(!obj->getParent());
     if (!obj->isGlobal())
         return;
 
     obj->setSlot(key, UndefinedValue());
     obj->setSlot(JSProto_LIMIT + key, UndefinedValue());
 }
@@ -3122,17 +3135,17 @@ DefineConstructorAndPrototype(JSContext 
     return proto;
 
 bad:
     if (named) {
         RootedValue rval(cx);
         JSObject::deleteByValue(cx, obj, StringValue(atom), &rval, false);
     }
     if (cached)
-        ClearClassObject(cx, obj, key);
+        ClearClassObject(obj, key);
     return NULL;
 }
 
 /*
  * Lazy standard classes need a way to indicate if they have been initialized.
  * Otherwise, when we delete them, we might accidentally recreate them via a
  * lazy initialization. We use the presence of a ctor or proto in the
  * global object's slot to indicate that they've been constructed, but this only
@@ -3731,17 +3744,17 @@ JSObject::allocSlot(JSContext *cx, uint3
 
     if (inDictionaryMode() && !setSlotSpan(cx, slot + 1))
         return false;
 
     return true;
 }
 
 void
-JSObject::freeSlot(JSContext *cx, uint32_t slot)
+JSObject::freeSlot(uint32_t slot)
 {
     JS_ASSERT(slot < slotSpan());
 
     if (inDictionaryMode()) {
         uint32_t &last = lastProperty()->table().freelist;
 
         /* Can't afford to check the whole freelist, but let's check the head. */
         JS_ASSERT_IF(last != SHAPE_INVALID_SLOT, last < slotSpan() && last != slot);

--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -720,17 +720,17 @@ struct JSObject : public js::ObjectImpl
     /*
      * Allocate and free an object slot.
      *
      * FIXME: bug 593129 -- slot allocation should be done by object methods
      * after calling object-parameter-free shape methods, avoiding coupling
      * logic across the object vs. shape module wall.
      */
     bool allocSlot(JSContext *cx, uint32_t *slotp);
-    void freeSlot(JSContext *cx, uint32_t slot);
+    void freeSlot(uint32_t slot);
 
   public:
     static bool reportReadOnly(JSContext *cx, jsid id, unsigned report = JSREPORT_ERROR);
     bool reportNotConfigurable(JSContext* cx, jsid id, unsigned report = JSREPORT_ERROR);
     bool reportNotExtensible(JSContext *cx, unsigned report = JSREPORT_ERROR);
 
     /*
      * Get the property with the given id, then call it as a function with the

--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1536,30 +1536,16 @@ static inline gc::AllocKind
 GuessArrayGCKind(size_t numSlots)
 {
     if (numSlots)
         return gc::GetGCArrayKind(numSlots);
     return gc::FINALIZE_OBJECT8;
 }
 
 /*
- * Get the GC kind to use for scripted 'new' on the given class.
- * FIXME bug 547327: estimate the size from the allocation site.
- */
-static inline gc::AllocKind
-NewObjectGCKind(JSContext *cx, js::Class *clasp)
-{
-    if (clasp == &ArrayClass || clasp == &SlowArrayClass)
-        return gc::FINALIZE_OBJECT8;
-    if (clasp == &FunctionClass)
-        return gc::FINALIZE_OBJECT2;
-    return gc::FINALIZE_OBJECT4;
-}
-
-/*
  * Fill slots with the initial slot array to use for a newborn object which
  * may or may not need dynamic slots.
  */
 inline bool
 PreallocateObjectDynamicSlots(JSContext *cx, Shape *shape, HeapSlot **slots)
 {
     if (size_t count = JSObject::dynamicSlotsCount(shape->numFixedSlots(), shape->slotSpan())) {
         *slots = cx->pod_malloc<HeapSlot>(count);

--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -1337,18 +1337,17 @@ CopyDecompiledTextForDecomposedOp(JSPrin
  * current operand stack.
  *
  * This function cannot raise an exception or error. However, due to a risk of
  * potential bugs when modeling the stack, the function returns -1 if it
  * detects an inconsistency in the model. Such an inconsistency triggers an
  * assert in a debug build.
  */
 static int
-ReconstructPCStack(JSContext *cx, JSScript *script, jsbytecode *pc,
-                   jsbytecode **pcstack);
+ReconstructPCStack(JSContext *cx, JSScript *script, jsbytecode *pc, jsbytecode **pcstack);
 
 #define FAILED_EXPRESSION_DECOMPILER ((char *) 1)
 
 /*
  * Decompile a part of expression up to the given pc. The function returns
  * NULL on out-of-memory, or the FAILED_EXPRESSION_DECOMPILER sentinel when
  * the decompiler fails due to a bug and/or unimplemented feature, or the
  * decompiled string on success.
@@ -2347,47 +2346,47 @@ GetBlockNames(JSContext *cx, StaticBlock
                       : JSID_TO_ATOM(shape.propid());
     }
 
     LOCAL_ASSERT(i == 0);
     return true;
 }
 
 static bool
-PushBlockNames(JSContext *cx, SprintStack *ss, const AtomVector &atoms)
+PushBlockNames(SprintStack *ss, const AtomVector &atoms)
 {
     for (size_t i = 0; i < atoms.length(); i++) {
         const char *name = QuoteString(&ss->sprinter, atoms[i], 0);
         if (!name || !PushOff(ss, ss->sprinter.getOffsetOf(name), JSOP_ENTERBLOCK))
             return false;
     }
     return true;
 }
 
 /*
  * In the scope of a let, the variables' (decompiler) stack slots must contain
  * the corresponding variable's name. This function updates the N top slots
  * with the N variable names stored in 'atoms'.
  */
 static bool
-AssignBlockNamesToPushedSlots(JSContext *cx, SprintStack *ss, const AtomVector &atoms)
+AssignBlockNamesToPushedSlots(SprintStack *ss, const AtomVector &atoms)
 {
     /* For simplicity, just pop and push. */
     LOCAL_ASSERT(atoms.length() <= (unsigned)ss->top);
     for (size_t i = 0; i < atoms.length(); ++i)
         PopStr(ss, JSOP_NOP);
-    return PushBlockNames(cx, ss, atoms);
+    return PushBlockNames(ss, atoms);
 }
 
 static const char SkipString[] = "/*skip*/";
 static const char DestructuredString[] = "/*destructured*/";
 static const unsigned DestructuredStringLength = ArrayLength(DestructuredString) - 1;
 
 static ptrdiff_t
-SprintLetBody(JSContext *cx, JSPrinter *jp, SprintStack *ss, jsbytecode *pc, ptrdiff_t bodyLength,
+SprintLetBody(JSPrinter *jp, SprintStack *ss, jsbytecode *pc, ptrdiff_t bodyLength,
               const char *headChars)
 {
     if (pc[bodyLength] == JSOP_LEAVEBLOCK) {
         js_printf(jp, "\tlet (%s) {\n", headChars);
         jp->indent += 4;
         if (!Decompile(ss, pc, bodyLength))
             return -1;
         jp->indent -= 4;
@@ -3261,17 +3260,17 @@ Decompile(SprintStack *ss, jsbytecode *p
                 break;
 
               case JSOP_ENTERBLOCK:
               {
                 obj = jp->script->getObject(GET_UINT32_INDEX(pc));
                 AtomVector atoms(cx);
                 StaticBlockObject &blockObj = obj->asStaticBlock();
 
-                if (!GetBlockNames(cx, blockObj, &atoms) || !PushBlockNames(cx, ss, atoms))
+                if (!GetBlockNames(cx, blockObj, &atoms) || !PushBlockNames(ss, atoms))
                     return NULL;
 
                 sn = js_GetSrcNote(jp->script, pc);
                 switch (sn ? SN_TYPE(sn) : SRC_NULL) {
 #if JS_HAS_BLOCK_SCOPE
                   case SRC_BRACE:
                     js_printf(jp, "\t{\n");
                     jp->indent += 4;
@@ -3484,17 +3483,17 @@ Decompile(SprintStack *ss, jsbytecode *p
 
                 if (groupAssign && Sprint(&ss->sprinter, "]") < 0)
                     return NULL;
 
                 /* Clone the let head chars before clobbering the stack. */
                 DupBuffer head(cx);
                 if (!Dup(ss->sprinter.stringAt(headBegin), &head))
                     return NULL;
-                if (!AssignBlockNamesToPushedSlots(cx, ss, atoms))
+                if (!AssignBlockNamesToPushedSlots(ss, atoms))
                     return NULL;
 
                 /* Detect 'for (let ...)' desugared into 'let (...) {for}'. */
                 jsbytecode *nextpc = pc + JSOP_ENTERLET0_LENGTH;
                 if (*nextpc == JSOP_NOP) {
                     jssrcnote *nextsn = js_GetSrcNote(jp->script, nextpc);
                     if (nextsn && SN_TYPE(nextsn) == SRC_FOR) {
                         pc = nextpc;
@@ -3502,17 +3501,17 @@ Decompile(SprintStack *ss, jsbytecode *p
                         break;
                     }
                 }
 
                 /* Decompile the body and then complete the let block/expr. */
                 len = LetDataToOffset(letData);
                 pc = nextpc;
                 saveop = (JSOp) pc[len];
-                todo = SprintLetBody(cx, jp, ss, pc, len, head.begin());
+                todo = SprintLetBody(jp, ss, pc, len, head.begin());
                 break;
               }
 
               /*
                * With 'for (let lhs in rhs)' and 'switch (c) { let-decl }',
                * placeholder slots have already been pushed (by JSOP_UNDEFINED).
                * In both the for-let-in and switch-hoisted-let cases:
                *  - there is a non-let slot on top of the stack (hence enterlet1)
@@ -3542,17 +3541,17 @@ Decompile(SprintStack *ss, jsbytecode *p
                     LOCAL_ASSERT(*nextpc == JSOP_CONDSWITCH ||
                                  *nextpc == JSOP_TABLESWITCH ||
                                  *nextpc == JSOP_LOOKUPSWITCH);
                 }
 
                 DupBuffer rhs(cx);
                 if (!Dup(PopStr(ss, JSOP_NOP), &rhs))
                     return NULL;
-                if (!AssignBlockNamesToPushedSlots(cx, ss, atoms))
+                if (!AssignBlockNamesToPushedSlots(ss, atoms))
                     return NULL;
                 if (!PushStr(ss, rhs.begin(), op))
                     return NULL;
                 todo = -2;
                 break;
               }
 
               case JSOP_CALLALIASEDVAR:
@@ -6234,18 +6233,17 @@ js::DecompileValueGenerator(JSContext *c
     size_t length = fallback->length();
     const jschar *chars = fallback->getChars(cx);
     if (!chars)
         return NULL;
     return DeflateString(cx, chars, length);
 }
 
 static char *
-DecompileExpression(JSContext *cx, JSScript *script, JSFunction *fun,
-                    jsbytecode *pc)
+DecompileExpression(JSContext *cx, JSScript *script, JSFunction *fun, jsbytecode *pc)
 {
     JS_ASSERT(script->code <= pc && pc < script->code + script->length);
 
     JSOp op = (JSOp) *pc;
 
     /* None of these stack-writing ops generates novel values. */
     JS_ASSERT(op != JSOP_CASE && op != JSOP_DUP && op != JSOP_DUP2);
 
@@ -6341,17 +6339,17 @@ unsigned
 js_ReconstructStackDepth(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
     return ReconstructPCStack(cx, script, pc, NULL);
 }
 
 #define LOCAL_ASSERT(expr)      LOCAL_ASSERT_RV(expr, -1);
 
 static int
-SimulateOp(JSContext *cx, JSScript *script, JSOp op, const JSCodeSpec *cs,
+SimulateOp(JSScript *script, JSOp op, const JSCodeSpec *cs,
            jsbytecode *pc, jsbytecode **pcstack, unsigned &pcdepth)
 {
     unsigned nuses = StackUses(script, pc);
     unsigned ndefs = StackDefs(script, pc);
     LOCAL_ASSERT(pcdepth >= nuses);
     pcdepth -= nuses;
     LOCAL_ASSERT(pcdepth + ndefs <= StackDepth(script));
 
@@ -6396,18 +6394,17 @@ SimulateOp(JSContext *cx, JSScript *scri
         }
         break;
     }
     pcdepth += ndefs;
     return pcdepth;
 }
 
 static int
-ReconstructPCStack(JSContext *cx, JSScript *script, jsbytecode *target,
-                   jsbytecode **pcstack)
+ReconstructPCStack(JSContext *cx, JSScript *script, jsbytecode *target, jsbytecode **pcstack)
 {
     /*
      * Walk forward from script->main and compute the stack depth and stack of
      * operand-generating opcode PCs in pcstack.
      *
      * FIXME: Code to compute oplen copied from js_Disassemble1 and reduced.
      * FIXME: Optimize to use last empty-stack sequence point.
      */
@@ -6512,21 +6509,21 @@ ReconstructPCStack(JSContext *cx, JSScri
         /*
          * SRC_HIDDEN instructions annotate early-exit paths and do not affect
          * the stack depth when not taken. However, when pc points into an
          * early-exit path, hidden instructions need to be taken into account.
          */
         if (sn && SN_TYPE(sn) == SRC_HIDDEN) {
             if (hpcdepth == unsigned(-1))
                 hpcdepth = pcdepth;
-            if (SimulateOp(cx, script, op, cs, pc, pcstack, hpcdepth) < 0)
+            if (SimulateOp(script, op, cs, pc, pcstack, hpcdepth) < 0)
                 return -1;
         } else {
             hpcdepth = unsigned(-1);
-            if (SimulateOp(cx, script, op, cs, pc, pcstack, pcdepth) < 0)
+            if (SimulateOp(script, op, cs, pc, pcstack, pcdepth) < 0)
                 return -1;
         }
 
     }
     LOCAL_ASSERT(pc == target);
     if (hpcdepth != unsigned(-1))
         return hpcdepth;
     return pcdepth;

--- a/js/src/jsprobes.cpp
+++ b/js/src/jsprobes.cpp
@@ -208,17 +208,17 @@ current_location(JSContext *cx, int* lin
 
 /*
  * ETW (Event Tracing for Windows)
  *
  * These are here rather than in the .h file to avoid having to include
  * windows.h in a header.
  */
 bool
-Probes::ETWCallTrackingActive(JSContext *cx)
+Probes::ETWCallTrackingActive()
 {
     return MCGEN_ENABLE_CHECK(MozillaSpiderMonkey_Context, EvtFunctionEntry);
 }
 
 bool
 Probes::ETWCreateRuntime(JSRuntime *rt)
 {
     static bool registered = false;
@@ -420,24 +420,24 @@ Probes::ETWCustomMark(const char *string
 
 bool
 Probes::ETWCustomMark(int marker)
 {
     return EventWriteEvtCustomInt(marker) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWStartExecution(JSContext *cx, JSScript *script)
+Probes::ETWStartExecution(JSScript *script)
 {
     int lineno = script ? script->lineno : -1;
     return EventWriteEvtExecuteStart(ScriptFilename(script), lineno) == ERROR_SUCCESS;
 }
 
 bool
-Probes::ETWStopExecution(JSContext *cx, JSScript *script)
+Probes::ETWStopExecution(JSScript *script)
 {
     int lineno = script ? script->lineno : -1;
     return EventWriteEvtExecuteDone(ScriptFilename(script), lineno) == ERROR_SUCCESS;
 }
 
 bool
 Probes::ETWResizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize)
 {

--- a/js/src/jsprobes.h
+++ b/js/src/jsprobes.h
@@ -93,20 +93,20 @@ bool wantNativeAddressInfo(JSContext *);
 
 /* Entering a JS function */
 bool enterScript(JSContext *, JSScript *, JSFunction *, StackFrame *);
 
 /* About to leave a JS function */
 bool exitScript(JSContext *, JSScript *, JSFunction *, StackFrame *);
 
 /* Executing a script */
-bool startExecution(JSContext *cx, JSScript *script);
+bool startExecution(JSScript *script);
 
 /* Script has completed execution */
-bool stopExecution(JSContext *cx, JSScript *script);
+bool stopExecution(JSScript *script);
 
 /* Heap has been resized */
 bool resizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize);
 
 /*
  * Object has been created. |obj| must exist (its class and size are read)
  */
 bool createObject(JSContext *cx, JSObject *obj);
@@ -246,17 +246,17 @@ void DTraceExitJSFun(JSContext *cx, JSFu
 /*
  * Internal: ETW-specific probe functions
  */
 #ifdef MOZ_ETW
 // ETW Handlers
 bool ETWCreateRuntime(JSRuntime *rt);
 bool ETWDestroyRuntime(JSRuntime *rt);
 bool ETWShutdown();
-bool ETWCallTrackingActive(JSContext *cx);
+bool ETWCallTrackingActive();
 bool ETWEnterJSFun(JSContext *cx, JSFunction *fun, JSScript *script, int counter);
 bool ETWExitJSFun(JSContext *cx, JSFunction *fun, JSScript *script, int counter);
 bool ETWCreateObject(JSContext *cx, JSObject *obj);
 bool ETWFinalizeObject(JSObject *obj);
 bool ETWResizeObject(JSContext *cx, JSObject *obj, size_t oldSize, size_t newSize);
 bool ETWCreateString(JSContext *cx, JSString *string, size_t length);
 bool ETWFinalizeString(JSString *string);
 bool ETWCompileScriptBegin(const char *filename, int lineno);
@@ -269,17 +269,17 @@ bool ETWGCStart();
 bool ETWGCEnd();
 bool ETWGCStartMarkPhase();
 bool ETWGCEndMarkPhase();
 bool ETWGCStartSweepPhase();
 bool ETWGCEndSweepPhase();
 bool ETWCustomMark(JSString *string);
 bool ETWCustomMark(const char *string);
 bool ETWCustomMark(int marker);
-bool ETWStartExecution(JSContext *cx, JSScript *script);
+bool ETWStartExecution(JSScript *script);
 bool ETWStopExecution(JSContext *cx, JSScript *script);
 bool ETWResizeHeap(JSCompartment *compartment, size_t oldSize, size_t newSize);
 #endif
 
 } /* namespace Probes */
 
 /*
  * Many probe handlers are implemented inline for minimal performance impact,
@@ -293,17 +293,17 @@ Probes::callTrackingActive(JSContext *cx
     if (JAVASCRIPT_FUNCTION_ENTRY_ENABLED() || JAVASCRIPT_FUNCTION_RETURN_ENABLED())
         return true;
 #endif
 #ifdef MOZ_TRACE_JSCALLS
     if (cx->functionCallback)
         return true;
 #endif
 #ifdef MOZ_ETW
-    if (ProfilingActive && ETWCallTrackingActive(cx))
+    if (ProfilingActive && ETWCallTrackingActive())
         return true;
 #endif
     return false;
 }
 
 inline bool
 Probes::wantNativeAddressInfo(JSContext *cx)
 {
@@ -676,45 +676,45 @@ Probes::CustomMark(int marker)
     if (ProfilingActive && !ETWCustomMark(marker))
         ok = false;
 #endif
 
     return ok;
 }
 
 inline bool
-Probes::startExecution(JSContext *cx, JSScript *script)
+Probes::startExecution(JSScript *script)
 {
     bool ok = true;
 
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_EXECUTE_START_ENABLED())
         JAVASCRIPT_EXECUTE_START((script->filename ? (char *)script->filename : nullName),
                                  script->lineno);
 #endif
 #ifdef MOZ_ETW
-    if (ProfilingActive && !ETWStartExecution(cx, script))
+    if (ProfilingActive && !ETWStartExecution(script))
         ok = false;
 #endif
 
     return ok;
 }
 
 inline bool
-Probes::stopExecution(JSContext *cx, JSScript *script)
+Probes::stopExecution(JSScript *script)
 {
     bool ok = true;
 
 #ifdef INCLUDE_MOZILLA_DTRACE
     if (JAVASCRIPT_EXECUTE_DONE_ENABLED())
         JAVASCRIPT_EXECUTE_DONE((script->filename ? (char *)script->filename : nullName),
                                 script->lineno);
 #endif
 #ifdef MOZ_ETW
-    if (ProfilingActive && !ETWStopExecution(cx, script))
+    if (ProfilingActive && !ETWStopExecution(script))
         ok = false;
 #endif
 
     return ok;
 }
 
 } /* namespace js */
 

--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -692,24 +692,24 @@ ParsePropertyDescriptorObject(JSContext 
     desc->attrs = d->attributes();
     desc->getter = d->getter();
     desc->setter = d->setter();
     desc->shortid = 0;
     return true;
 }
 
 static bool
-IndicatePropertyNotFound(JSContext *cx, PropertyDescriptor *desc)
+IndicatePropertyNotFound(PropertyDescriptor *desc)
 {
     desc->obj = NULL;
     return true;
 }
 
 static bool
-ValueToBool(JSContext *cx, const Value &v, bool *bp)
+ValueToBool(const Value &v, bool *bp)
 {
     *bp = ToBoolean(v);
     return true;
 }
 
 static bool
 ArrayToIdVector(JSContext *cx, const Value &array, AutoIdVector &props)
 {
@@ -797,132 +797,132 @@ ReturnedValueMustNotBePrimitive(JSContex
                                  JSDVG_SEARCH_STACK, val, NullPtr(), bytes.ptr());
         }
         return false;
     }
     return true;
 }
 
 static JSObject *
-GetIndirectProxyHandlerObject(JSContext *cx, JSObject *proxy)
+GetIndirectProxyHandlerObject(JSObject *proxy)
 {
     return GetProxyPrivate(proxy).toObjectOrNull();
 }
 
 bool
 ScriptedIndirectProxyHandler::getPropertyDescriptor(JSContext *cx, JSObject *proxy_, jsid id_, bool set,
                                                     PropertyDescriptor *desc)
 {
     RootedId id(cx, id_);
     RootedObject proxy(cx, proxy_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue fval(cx), value(cx);
     return GetFundamentalTrap(cx, handler, cx->names().getPropertyDescriptor, &fval) &&
            Trap1(cx, handler, fval, id, value.address()) &&
-           ((value.get().isUndefined() && IndicatePropertyNotFound(cx, desc)) ||
+           ((value.get().isUndefined() && IndicatePropertyNotFound(desc)) ||
             (ReturnedValueMustNotBePrimitive(cx, proxy, cx->names().getPropertyDescriptor, value) &&
              ParsePropertyDescriptorObject(cx, proxy, value, desc)));
 }
 
 bool
 ScriptedIndirectProxyHandler::getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy_, jsid id_, bool set,
                                                        PropertyDescriptor *desc)
 {
     RootedId id(cx, id_);
     RootedObject proxy(cx, proxy_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue fval(cx), value(cx);
     return GetFundamentalTrap(cx, handler, cx->names().getOwnPropertyDescriptor, &fval) &&
            Trap1(cx, handler, fval, id, value.address()) &&
-           ((value.get().isUndefined() && IndicatePropertyNotFound(cx, desc)) ||
+           ((value.get().isUndefined() && IndicatePropertyNotFound(desc)) ||
             (ReturnedValueMustNotBePrimitive(cx, proxy, cx->names().getPropertyDescriptor, value) &&
              ParsePropertyDescriptorObject(cx, proxy, value, desc)));
 }
 
 bool
 ScriptedIndirectProxyHandler::defineProperty(JSContext *cx, JSObject *proxy, jsid id_,
                                              PropertyDescriptor *desc)
 {
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue fval(cx), value(cx);
     RootedId id(cx, id_);
     return GetFundamentalTrap(cx, handler, cx->names().defineProperty, &fval) &&
            NewPropertyDescriptorObject(cx, desc, value.address()) &&
            Trap2(cx, handler, fval, id, value, value.address());
 }
 
 bool
 ScriptedIndirectProxyHandler::getOwnPropertyNames(JSContext *cx, JSObject *proxy,
                                                   AutoIdVector &props)
 {
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue fval(cx), value(cx);
     return GetFundamentalTrap(cx, handler, cx->names().getOwnPropertyNames, &fval) &&
            Trap(cx, handler, fval, 0, NULL, value.address()) &&
            ArrayToIdVector(cx, value, props);
 }
 
 bool
 ScriptedIndirectProxyHandler::delete_(JSContext *cx, JSObject *proxy, jsid id_, bool *bp)
 {
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedId id(cx, id_);
     RootedValue fval(cx), value(cx);
     return GetFundamentalTrap(cx, handler, cx->names().delete_, &fval) &&
            Trap1(cx, handler, fval, id, value.address()) &&
-           ValueToBool(cx, value, bp);
+           ValueToBool(value, bp);
 }
 
 bool
 ScriptedIndirectProxyHandler::enumerate(JSContext *cx, JSObject *proxy, AutoIdVector &props)
 {
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue fval(cx), value(cx);
     return GetFundamentalTrap(cx, handler, cx->names().enumerate, &fval) &&
            Trap(cx, handler, fval, 0, NULL, value.address()) &&
            ArrayToIdVector(cx, value, props);
 }
 
 bool
 ScriptedIndirectProxyHandler::has(JSContext *cx, JSObject *proxy_, jsid id_, bool *bp)
 {
     RootedObject proxy(cx, proxy_);
     RootedId id(cx, id_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue fval(cx), value(cx);
     if (!GetDerivedTrap(cx, handler, cx->names().has, &fval))
         return false;
     if (!js_IsCallable(fval))
         return BaseProxyHandler::has(cx, proxy, id, bp);
     return Trap1(cx, handler, fval, id, value.address()) &&
-           ValueToBool(cx, value, bp);
+           ValueToBool(value, bp);
 }
 
 bool
 ScriptedIndirectProxyHandler::hasOwn(JSContext *cx, JSObject *proxy_, jsid id_, bool *bp)
 {
     RootedObject proxy(cx, proxy_);
     RootedId id(cx, id_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue fval(cx), value(cx);
     if (!GetDerivedTrap(cx, handler, cx->names().hasOwn, &fval))
         return false;
     if (!js_IsCallable(fval))
         return BaseProxyHandler::hasOwn(cx, proxy, id, bp);
     return Trap1(cx, handler, fval, id, value.address()) &&
-           ValueToBool(cx, value, bp);
+           ValueToBool(value, bp);
 }
 
 bool
 ScriptedIndirectProxyHandler::get(JSContext *cx, JSObject *proxy_, JSObject *receiver_, jsid id_,
                                   Value *vp)
 {
     RootedId id(cx, id_);
     RootedObject proxy(cx, proxy_), receiver(cx, receiver_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     JSString *str = ToString(cx, IdToValue(id));
     if (!str)
         return false;
     RootedValue value(cx, StringValue(str));
     Value argv[] = { ObjectOrNullValue(receiver), value };
     AutoValueArray ava(cx, argv, 2);
     RootedValue fval(cx);
     if (!GetDerivedTrap(cx, handler, cx->names().get, &fval))
@@ -933,17 +933,17 @@ ScriptedIndirectProxyHandler::get(JSCont
 }
 
 bool
 ScriptedIndirectProxyHandler::set(JSContext *cx, JSObject *proxy_, JSObject *receiver_, jsid id_, bool strict,
                                   Value *vp)
 {
     RootedId id(cx, id_);
     RootedObject proxy(cx, proxy_), receiver(cx, receiver_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     JSString *str = ToString(cx, IdToValue(id));
     if (!str)
         return false;
     RootedValue value(cx, StringValue(str));
     Value argv[] = { ObjectOrNullValue(receiver), value, *vp };
     AutoValueArray ava(cx, argv, 3);
     RootedValue fval(cx);
     if (!GetDerivedTrap(cx, handler, cx->names().set, &fval))
@@ -952,31 +952,31 @@ ScriptedIndirectProxyHandler::set(JSCont
         return BaseProxyHandler::set(cx, proxy, receiver, id, strict, vp);
     return Trap(cx, handler, fval, 3, argv, value.address());
 }
 
 bool
 ScriptedIndirectProxyHandler::keys(JSContext *cx, JSObject *proxy_, AutoIdVector &props)
 {
     RootedObject proxy(cx, proxy_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue value(cx);
     if (!GetDerivedTrap(cx, handler, cx->names().keys, &value))
         return false;
     if (!js_IsCallable(value))
         return BaseProxyHandler::keys(cx, proxy, props);
     return Trap(cx, handler, value, 0, NULL, value.address()) &&
            ArrayToIdVector(cx, value, props);
 }
 
 bool
 ScriptedIndirectProxyHandler::iterate(JSContext *cx, JSObject *proxy_, unsigned flags, Value *vp)
 {
     RootedObject proxy(cx, proxy_);
-    RootedObject handler(cx, GetIndirectProxyHandlerObject(cx, proxy));
+    RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
     RootedValue value(cx);
     if (!GetDerivedTrap(cx, handler, cx->names().iterate, &value))
         return false;
     if (!js_IsCallable(value))
         return BaseProxyHandler::iterate(cx, proxy, flags, vp);
     return Trap(cx, handler, value, 0, NULL, vp) &&
            ReturnedValueMustNotBePrimitive(cx, proxy, cx->names().iterate, *vp);
 }

--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -427,17 +427,17 @@ JSObject::toDictionaryMode(JSContext *cx
     return true;
 }
 
 /*
  * Normalize stub getter and setter values for faster is-stub testing in the
  * SHAPE_CALL_[GS]ETTER macros.
  */
 static inline bool
-NormalizeGetterAndSetter(JSContext *cx, JSObject *obj,
+NormalizeGetterAndSetter(JSObject *obj,
                          jsid id, unsigned attrs, unsigned flags,
                          PropertyOp &getter,
                          StrictPropertyOp &setter)
 {
     if (setter == JS_StrictPropertyStub) {
         JS_ASSERT(!(attrs & JSPROP_SETTER));
         setter = NULL;
     }
@@ -457,17 +457,17 @@ JSObject::addProperty(JSContext *cx, jsi
 {
     JS_ASSERT(!JSID_IS_VOID(id));
 
     if (!isExtensible()) {
         reportNotExtensible(cx);
         return NULL;
     }
 
-    NormalizeGetterAndSetter(cx, this, id, attrs, flags, getter, setter);
+    NormalizeGetterAndSetter(this, id, attrs, flags, getter, setter);
 
     RootedObject self(cx, this);
 
     Shape **spp = NULL;
     if (inDictionaryMode())
         spp = lastProperty()->table().search(id, true);
 
     return self->addPropertyInternal(cx, id, getter, setter, slot, attrs, flags, shortid,
@@ -587,17 +587,17 @@ Shape *
 JSObject::putProperty(JSContext *cx, jsid id_,
                       PropertyOp getter, StrictPropertyOp setter,
                       uint32_t slot, unsigned attrs,
                       unsigned flags, int shortid)
 {
     RootedId id(cx, id_);
     JS_ASSERT(!JSID_IS_VOID(id));
 
-    NormalizeGetterAndSetter(cx, this, id, attrs, flags, getter, setter);
+    NormalizeGetterAndSetter(this, id, attrs, flags, getter, setter);
 
     RootedObject self(cx, this);
     AutoRooterGetterSetter gsRoot(cx, attrs, &getter, &setter);
 
     /* Search for id in order to claim its entry if table has been allocated. */
     Shape **spp;
     RootedShape shape(cx, Shape::search(cx, lastProperty(), id, &spp, true));
     if (!shape) {
@@ -720,17 +720,17 @@ JSObject::putProperty(JSContext *cx, jsi
     /*
      * Can't fail now, so free the previous incarnation's slot if the new shape
      * has no slot. But we do not need to free oldSlot (and must not, as trying
      * to will botch an assertion in JSObject::freeSlot) if the new last
      * property (shape here) has a slotSpan that does not cover it.
      */
     if (hadSlot && !shape->hasSlot()) {
         if (oldSlot < self->slotSpan())
-            self->freeSlot(cx, oldSlot);
+            self->freeSlot(oldSlot);
         JS_ATOMIC_INCREMENT(&cx->runtime->propertyRemovals);
     }
 
     self->checkShapeConsistency();
 
     return shape;
 }
 
@@ -823,17 +823,17 @@ JSObject::removeProperty(JSContext *cx, 
             if (!nbase)
                 return false;
             previous->base_ = nbase;
         }
     }
 
     /* If shape has a slot, free its slot number. */
     if (shape->hasSlot()) {
-        self->freeSlot(cx, shape->slot());
+        self->freeSlot(shape->slot());
         JS_ATOMIC_INCREMENT(&cx->runtime->propertyRemovals);
     }
 
     /*
      * A dictionary-mode object owns mutable, unique shapes on a non-circular
      * doubly linked list, hashed by lastProperty()->table. So we can edit the
      * list and hash in place.
      */

--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -1025,17 +1025,17 @@ void
 SourceCompressorThread::abort(SourceCompressionToken *userTok)
 {
     JS_ASSERT(userTok == tok);
     stop = true;
 }
 #endif /* JS_THREADSAFE */
 
 void
-JSScript::setScriptSource(JSContext *cx, ScriptSource *ss)
+JSScript::setScriptSource(ScriptSource *ss)
 {
     JS_ASSERT(ss);
     ss->incref();
     scriptSource_ = ss;
 }
 
 bool
 JSScript::loadSource(JSContext *cx, bool *worked)
@@ -1518,17 +1518,17 @@ JSScript::Create(JSContext *cx, HandleOb
     // stack if we nest functions more than a few hundred deep, so this will
     // never trigger.  Oh well.
     if (staticLevel > UINT16_MAX) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_TOO_DEEP, js_function_str);
         return NULL;
     }
     script->staticLevel = uint16_t(staticLevel);
 
-    script->setScriptSource(cx, ss);
+    script->setScriptSource(ss);
     script->sourceStart = bufStart;
     script->sourceEnd = bufEnd;
 
     return script;
 }
 
 static inline uint8_t *
 AllocScriptData(JSContext *cx, size_t size)

--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -575,17 +575,17 @@ struct JSScript : public js::gc::Cell
     JSFlatString *sourceData(JSContext *cx);
 
     bool loadSource(JSContext *cx, bool *worked);
 
     js::ScriptSource *scriptSource() {
         return scriptSource_;
     }
 
-    void setScriptSource(JSContext *cx, js::ScriptSource *ss);
+    void setScriptSource(js::ScriptSource *ss);
 
   public:
 
     /* Return whether this script was compiled for 'eval' */
     bool isForEval() { return isCachedEval || isActiveEval; }
 
 #ifdef DEBUG
     unsigned id();

--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1858,17 +1858,17 @@ struct ReplaceData
     int                leftIndex;      /* left context index in str->chars */
     JSSubString        dollarStr;      /* for "$$" InterpretDollar result */
     bool               calledBack;     /* record whether callback has been called */
     InvokeArgsGuard    args;           /* arguments for lambda call */
     StringBuffer       sb;             /* buffer built during DoMatch */
 };
 
 static bool
-InterpretDollar(JSContext *cx, RegExpStatics *res, const jschar *dp, const jschar *ep,
+InterpretDollar(RegExpStatics *res, const jschar *dp, const jschar *ep,
                 ReplaceData &rdata, JSSubString *out, size_t *skip)
 {
     JS_ASSERT(*dp == '$');
 
     /* If there is only a dollar, bail now */
     if (dp + 1 >= ep)
         return false;
 
@@ -2023,49 +2023,49 @@ FindReplaceLength(JSContext *cx, RegExpS
     }
 
     JSString *repstr = rdata.repstr;
     size_t replen = repstr->length();
     for (const jschar *dp = rdata.dollar, *ep = rdata.dollarEnd; dp;
          dp = js_strchr_limit(dp, '$', ep)) {
         JSSubString sub;
         size_t skip;
-        if (InterpretDollar(cx, res, dp, ep, rdata, &sub, &skip)) {
+        if (InterpretDollar(res, dp, ep, rdata, &sub, &skip)) {
             replen += sub.length - skip;
             dp += skip;
         } else {
             dp++;
         }
     }
     *sizep = replen;
     return true;
 }
 
 /*
  * Precondition: |rdata.sb| already has necessary growth space reserved (as
  * derived from FindReplaceLength).
  */
 static void
-DoReplace(JSContext *cx, RegExpStatics *res, ReplaceData &rdata)
+DoReplace(RegExpStatics *res, ReplaceData &rdata)
 {
     JSLinearString *repstr = rdata.repstr;
     const jschar *cp;
     const jschar *bp = cp = repstr->chars();
 
     const jschar *dp = rdata.dollar;
     const jschar *ep = rdata.dollarEnd;
     for (; dp; dp = js_strchr_limit(dp, '$', ep)) {
         /* Move one of the constant portions of the replacement value. */
         size_t len = dp - cp;
         rdata.sb.infallibleAppend(cp, len);
         cp = dp;
 
         JSSubString sub;
         size_t skip;
-        if (InterpretDollar(cx, res, dp, ep, rdata, &sub, &skip)) {
+        if (InterpretDollar(res, dp, ep, rdata, &sub, &skip)) {
             len = sub.length;
             rdata.sb.infallibleAppend(sub.chars, len);
             cp += skip;
             dp += skip;
         } else {
             dp++;
         }
     }
@@ -2089,17 +2089,17 @@ ReplaceRegExpCallback(JSContext *cx, Reg
     size_t growth = leftlen + replen;
     if (!rdata.sb.reserve(rdata.sb.length() + growth))
         return false;
 
     JSLinearString &str = rdata.str->asLinear();  /* flattened for regexp */
     const jschar *left = str.chars() + leftoff;
 
     rdata.sb.infallibleAppend(left, leftlen); /* skipped-over portion of the search value */
-    DoReplace(cx, res, rdata);
+    DoReplace(res, rdata);
     return true;
 }
 
 static bool
 BuildFlatReplacement(JSContext *cx, HandleString textstr, HandleString repstr,
                      const FlatMatch &fm, CallArgs *args)
 {
     RopeBuilder builder(cx);
@@ -2351,17 +2351,17 @@ static const uint32_t ReplaceOptArg = 2;
 /*
  * Pattern match the script to check if it is is indexing into a particular
  * object, e.g. 'function(a) { return b[a]; }'. Avoid calling the script in
  * such cases, which are used by javascript packers (particularly the popular
  * Dean Edwards packer) to efficiently encode large scripts. We only handle the
  * code patterns generated by such packers here.
  */
 static JSObject *
-LambdaIsGetElem(JSObject &lambda, JSContext *cx)
+LambdaIsGetElem(JSObject &lambda)
 {
     if (!lambda.isFunction())
         return NULL;
 
     JSFunction *fun = lambda.toFunction();
     if (!fun->isInterpreted())
         return NULL;
 
@@ -2423,17 +2423,17 @@ js::str_replace(JSContext *cx, unsigned 
 
     /* Extract replacement string/function. */
     if (args.length() >= ReplaceOptArg && js_IsCallable(args[1])) {
         rdata.lambda = &args[1].toObject();
         rdata.elembase = NULL;
         rdata.repstr = NULL;
         rdata.dollar = rdata.dollarEnd = NULL;
 
-        if (JSObject *base = LambdaIsGetElem(*rdata.lambda, cx))
+        if (JSObject *base = LambdaIsGetElem(*rdata.lambda))
             rdata.elembase = base;
     } else {
         rdata.lambda = NULL;
         rdata.elembase = NULL;
         rdata.repstr = ArgToRootedString(cx, args, 1);
         if (!rdata.repstr)
             return false;
 
@@ -4011,17 +4011,17 @@ const bool js_isspace[] = {
 /* 12 */ ____, ____, ____, ____, ____, ____, ____, ____
 };
 
 #undef ____
 
 #define URI_CHUNK 64U
 
 static inline bool
-TransferBufferToString(JSContext *cx, StringBuffer &sb, Value *rval)
+TransferBufferToString(StringBuffer &sb, Value *rval)
 {
     JSString *str = sb.finishString();
     if (!str)
         return false;
     rval->setString(str);
     return true;
 }
 
@@ -4088,17 +4088,17 @@ Encode(JSContext *cx, JSString *str, con
                 hexBuf[1] = HexDigits[utf8buf[j] >> 4];
                 hexBuf[2] = HexDigits[utf8buf[j] & 0xf];
                 if (!sb.append(hexBuf, 3))
                     return JS_FALSE;
             }
         }
     }
 
-    return TransferBufferToString(cx, sb, rval);
+    return TransferBufferToString(sb, rval);
 }
 
 static JSBool
 Decode(JSContext *cx, JSString *str, const jschar *reservedSet, Value *rval)
 {
     size_t length = str->length();
     const jschar *chars = str->getChars(cx);
     if (!chars)
@@ -4165,17 +4165,17 @@ Decode(JSContext *cx, JSString *str, con
                     return JS_FALSE;
             }
         } else {
             if (!sb.append(c))
                 return JS_FALSE;
         }
     }
 
-    return TransferBufferToString(cx, sb, rval);
+    return TransferBufferToString(sb, rval);
 
   report_bad_uri:
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_URI);
     /* FALL THROUGH */
 
     return JS_FALSE;
 }
 

--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -48,17 +48,17 @@ using namespace js::types;
 /*
  * Allocate array buffers with the maximum number of fixed slots marked as
  * reserved, so that the fixed slots may be used for the buffer's contents.
  * The last fixed slot is kept for the object's private data.
  */
 static const uint8_t ARRAYBUFFER_RESERVED_SLOTS = JSObject::MAX_FIXED_SLOTS - 1;
 
 static bool
-ValueIsLength(JSContext *cx, const Value &v, uint32_t *len)
+ValueIsLength(const Value &v, uint32_t *len)
 {
     if (v.isInt32()) {
         int32_t i = v.toInt32();
         if (i < 0)
             return false;
         *len = i;
         return true;
     }
@@ -349,17 +349,17 @@ BufferLink(JSObject *view)
 
 static void
 SetBufferLink(JSObject *view, JSObject *buffer)
 {
     view->setFixedSlot(BufferView::NEXT_BUFFER_SLOT, PrivateValue(buffer));
 }
 
 void
-ArrayBufferObject::addView(JSContext *cx, RawObject view)
+ArrayBufferObject::addView(RawObject view)
 {
     // This view should never have been associated with a buffer before
     JS_ASSERT(BufferLink(view) == UNSET_BUFFER_LINK);
 
     // Note that pre-barriers are not needed here because either the list was
     // previously empty, in which case no pointer is being overwritten, or the
     // list was nonempty and will be made weak during this call (and weak
     // pointers cannot violate the snapshot-at-the-beginning invariant.)
@@ -483,17 +483,17 @@ ArrayBufferObject::stealContents(JSConte
         ArrayBufferObject::setElementsHeader(newheader, length);
         *contents = newheader;
     }
 
     // Neuter the donor ArrayBuffer and all views of it
     ArrayBufferObject::setElementsHeader(header, 0);
     *GetViewList(&buffer) = views;
     for (JSObject *view = views; view; view = NextView(view))
-        TypedArray::neuter(cx, view);
+        TypedArray::neuter(view);
 
     return true;
 }
 
 void
 ArrayBufferObject::obj_trace(JSTracer *trc, JSObject *obj)
 {
     /*
@@ -903,17 +903,17 @@ ArrayBufferObject::obj_enumerate(JSConte
  * TypedArray
  *
  * The non-templated base class for the specific typed implementations.
  * This class holds all the member variables that are used by
  * the subclasses.
  */
 
 inline bool
-TypedArray::isArrayIndex(JSContext *cx, JSObject *obj, jsid id, uint32_t *ip)
+TypedArray::isArrayIndex(JSObject *obj, jsid id, uint32_t *ip)
 {
     uint32_t index;
     if (js_IdIsIndex(id, &index) && index < length(obj)) {
         if (ip)
             *ip = index;
         return true;
     }
 
@@ -923,32 +923,32 @@ TypedArray::isArrayIndex(JSContext *cx, 
 bool
 js::IsDataView(JSObject* obj)
 {
     JS_ASSERT(obj);
     return obj->isDataView();
 }
 
 void
-TypedArray::neuter(JSContext *cx, RawObject tarray)
+TypedArray::neuter(RawObject tarray)
 {
     JS_ASSERT(tarray->isTypedArray());
     tarray->setSlot(LENGTH_SLOT, Int32Value(0));
     tarray->setSlot(BYTELENGTH_SLOT, Int32Value(0));
     tarray->setSlot(BYTEOFFSET_SLOT, Int32Value(0));
     tarray->setPrivate(NULL);
 }
 
 JSBool
 TypedArray::obj_lookupGeneric(JSContext *cx, HandleObject tarray, HandleId id,
                               MutableHandleObject objp, MutableHandleShape propp)
 {
     JS_ASSERT(tarray->isTypedArray());
 
-    if (isArrayIndex(cx, tarray, id)) {
+    if (isArrayIndex(tarray, id)) {
         MarkNonNativePropertyFound(tarray, propp);
         objp.set(tarray);
         return true;
     }
 
     RootedObject proto(cx, tarray->getProto());
     if (!proto) {
         objp.set(NULL);
@@ -1170,17 +1170,17 @@ class TypedArrayTemplate
 
     static JSBool
     obj_getElement(JSContext *cx, HandleObject tarray, HandleObject receiver, uint32_t index,
                    MutableHandleValue vp)
     {
         JS_ASSERT(tarray->isTypedArray());
 
         if (index < length(tarray)) {
-            copyIndexToValue(cx, tarray, index, vp);
+            copyIndexToValue(tarray, index, vp);
             return true;
         }
 
         RootedObject proto(cx, tarray->getProto());
         if (!proto) {
             vp.setUndefined();
             return true;
         }
@@ -1230,17 +1230,17 @@ class TypedArrayTemplate
     obj_getElementIfPresent(JSContext *cx, HandleObject tarray, HandleObject receiver, uint32_t index,
                             MutableHandleValue vp, bool *present)
     {
         JS_ASSERT(tarray->isTypedArray());
 
         // Fast-path the common case of index < length
         if (index < length(tarray)) {
             // this inline function is specialized for each type
-            copyIndexToValue(cx, tarray, index, vp);
+            copyIndexToValue(tarray, index, vp);
             *present = true;
             return true;
         }
 
         RootedObject proto(cx, tarray->getProto());
         if (!proto) {
             vp.setUndefined();
             return true;
@@ -1317,17 +1317,17 @@ class TypedArrayTemplate
     static JSBool
     obj_setGeneric(JSContext *cx, HandleObject tarray, HandleId id,
                    MutableHandleValue vp, JSBool strict)
     {
         JS_ASSERT(tarray->isTypedArray());
 
         uint32_t index;
         // We can't just chain to js_SetPropertyHelper, because we're not a normal object.
-        if (!isArrayIndex(cx, tarray, id, &index)) {
+        if (!isArrayIndex(tarray, id, &index)) {
             // Silent ignore is better than an exception here, because
             // at some point we may want to support other properties on
             // these objects.  This is especially true when these arrays
             // are used to implement HTML Canvas 2D's PixelArray objects,
             // which used to be plain old arrays.
             vp.setUndefined();
             return true;
         }
@@ -1528,17 +1528,17 @@ class TypedArrayTemplate
         JS_ASSERT(buffer->dataPointer() <= viewData(obj));
         JS_ASSERT(bufferByteLength - byteOffsetValue(obj).toInt32() >= arrayByteLength);
         JS_ASSERT(arrayByteOffset <= bufferByteLength);
 
         // Verify that the private slot is at the expected place
         JS_ASSERT(obj->numFixedSlots() == DATA_SLOT);
 #endif
 
-        buffer->addView(cx, obj);
+        buffer->addView(obj);
 
         return obj;
     }
 
     static JSObject *
     makeInstance(JSContext *cx, HandleObject bufobj, uint32_t byteOffset, uint32_t len)
     {
         RootedObject nullproto(cx, NULL);
@@ -1564,17 +1564,17 @@ class TypedArrayTemplate
 
     static JSObject *
     create(JSContext *cx, unsigned argc, Value *argv)
     {
         /* N.B. there may not be an argv[-2]/argv[-1]. */
 
         /* () or (number) */
         uint32_t len = 0;
-        if (argc == 0 || ValueIsLength(cx, argv[0], &len))
+        if (argc == 0 || ValueIsLength(argv[0], &len))
             return fromLength(cx, len);
 
         /* (not an object) */
         if (!argv[0].isObject()) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_TYPED_ARRAY_BAD_ARGS);
             return NULL;
         }
 
@@ -1984,18 +1984,17 @@ class TypedArrayTemplate
     }
 
     static void
     setIndex(JSObject *obj, uint32_t index, NativeType val)
     {
         *(static_cast<NativeType*>(viewData(obj)) + index) = val;
     }
 
-    static void copyIndexToValue(JSContext *cx, JSObject *tarray, uint32_t index,
-                                 MutableHandleValue vp);
+    static void copyIndexToValue(JSObject *tarray, uint32_t index, MutableHandleValue vp);
 
     static JSObject *
     createSubarray(JSContext *cx, HandleObject tarray, uint32_t begin, uint32_t end)
     {
         JS_ASSERT(tarray);
 
         JS_ASSERT(begin <= length(tarray));
         JS_ASSERT(end <= length(tarray));
@@ -2341,46 +2340,46 @@ ArrayBufferObject::createTypedArrayFromB
     CallArgs args = CallArgsFromVp(argc, vp);
     return CallNonGenericMethod<IsArrayBuffer, createTypedArrayFromBufferImpl<T> >(cx, args);
 }
 
 // this default implementation is only valid for integer types
 // less than 32-bits in size.
 template<typename NativeType>
 void
-TypedArrayTemplate<NativeType>::copyIndexToValue(JSContext *cx, JSObject *tarray, uint32_t index,
+TypedArrayTemplate<NativeType>::copyIndexToValue(JSObject *tarray, uint32_t index,
                                                  MutableHandleValue vp)
 {
     JS_STATIC_ASSERT(sizeof(NativeType) < 4);
 
     vp.setInt32(getIndex(tarray, index));
 }
 
 // and we need to specialize for 32-bit integers and floats
 template<>
 void
-TypedArrayTemplate<int32_t>::copyIndexToValue(JSContext *cx, JSObject *tarray, uint32_t index,
+TypedArrayTemplate<int32_t>::copyIndexToValue(JSObject *tarray, uint32_t index,
                                               MutableHandleValue vp)
 {
     int32_t val = getIndex(tarray, index);
     vp.setInt32(val);
 }
 
 template<>
 void
-TypedArrayTemplate<uint32_t>::copyIndexToValue(JSContext *cx, JSObject *tarray, uint32_t index,
+TypedArrayTemplate<uint32_t>::copyIndexToValue(JSObject *tarray, uint32_t index,
                                                MutableHandleValue vp)
 {
     uint32_t val = getIndex(tarray, index);
     vp.setNumber(val);
 }
 
 template<>
 void
-TypedArrayTemplate<float>::copyIndexToValue(JSContext *cx, JSObject *tarray, uint32_t index,
+TypedArrayTemplate<float>::copyIndexToValue(JSObject *tarray, uint32_t index,
                                             MutableHandleValue vp)
 {
     float val = getIndex(tarray, index);
     double dval = val;
 
     /*
      * Doubles in typed arrays could be typed-punned arrays of integers. This
      * could allow user code to break the engine-wide invariant that only
@@ -2391,17 +2390,17 @@ TypedArrayTemplate<float>::copyIndexToVa
      * This could be removed for platforms/compilers known to convert a 32-bit
      * non-canonical nan to a 64-bit canonical nan.
      */
     vp.setDouble(JS_CANONICALIZE_NAN(dval));
 }
 
 template<>
 void
-TypedArrayTemplate<double>::copyIndexToValue(JSContext *cx, JSObject *tarray, uint32_t index,
+TypedArrayTemplate<double>::copyIndexToValue(JSObject *tarray, uint32_t index,
                                              MutableHandleValue vp)
 {
     double val = getIndex(tarray, index);
 
     /*
      * Doubles in typed arrays could be typed-punned arrays of integers. This
      * could allow user code to break the engine-wide invariant that only
      * canonical nans are stored into jsvals, which means user code could

--- a/js/src/jstypedarray.h
+++ b/js/src/jstypedarray.h
@@ -131,17 +131,17 @@ class ArrayBufferObject : public JSObjec
                                 MutableHandleValue statep, MutableHandleId idp);
 
     static void sweepAll(JSRuntime *rt);
 
     static bool stealContents(JSContext *cx, JSObject *obj, void **contents);
 
     static inline void setElementsHeader(js::ObjectElements *header, uint32_t bytes);
 
-    void addView(JSContext *cx, RawObject view);
+    void addView(RawObject view);
 
     bool allocateSlots(JSContext *cx, uint32_t size, uint8_t *contents = NULL);
 
     /*
      * Ensure that the data is not stored inline. Used when handing back a
      * GC-safe pointer.
      */
     bool uninlineData(JSContext *cx);
@@ -264,19 +264,19 @@ struct TypedArray : public BufferView {
     static inline uint32_t byteOffset(JSObject *obj);
     static inline uint32_t byteLength(JSObject *obj);
     static inline uint32_t length(JSObject *obj);
 
     static inline uint32_t type(JSObject *obj);
     static inline void * viewData(JSObject *obj);
 
   public:
-    static bool isArrayIndex(JSContext *cx, JSObject *obj, jsid id, uint32_t *ip = NULL);
+    static bool isArrayIndex(JSObject *obj, jsid id, uint32_t *ip = NULL);
 
-    static void neuter(JSContext *cx, RawObject tarray);
+    static void neuter(RawObject tarray);
 
     static inline uint32_t slotWidth(int atype);
     static inline int slotWidth(JSObject *obj);
 
     /*
      * Byte length above which created typed arrays and data views will have
      * singleton types regardless of the context in which they are created.
      */

--- a/js/src/jstypedarrayinlines.h
+++ b/js/src/jstypedarrayinlines.h
@@ -252,17 +252,17 @@ DataViewObject::create(JSContext *cx, ui
     dvobj.setFixedSlot(NEXT_VIEW_SLOT, PrivateValue(NULL));
     dvobj.setFixedSlot(NEXT_BUFFER_SLOT, PrivateValue(UNSET_BUFFER_LINK));
     InitTypedArrayDataPointer(obj, arrayBuffer, byteOffset);
     JS_ASSERT(byteOffset + byteLength <= arrayBuffer->byteLength());
 
     // Verify that the private slot is at the expected place
     JS_ASSERT(dvobj.numFixedSlots() == DATA_SLOT);
 
-    arrayBuffer->asArrayBuffer().addView(cx, &dvobj);
+    arrayBuffer->asArrayBuffer().addView(&dvobj);
 
     return &dvobj;
 }
 
 inline uint32_t
 DataViewObject::byteLength()
 {
     JS_ASSERT(isDataView());

--- a/js/src/methodjit/LoopState.cpp
+++ b/js/src/methodjit/LoopState.cpp
@@ -917,17 +917,17 @@ LoopState::cannotIntegerOverflow(const C
      * Compute a slot and constant such that the result of the binary op is
      * 'slot + constant', where slot is expressed in terms of its value at
      * the head of the loop.
      */
     JS_ASSERT(pushed.v.kind() == SSAValue::PUSHED);
     jsbytecode *PC = ssa->getFrame(pushed.frame).script->code + pushed.v.pushedOffset();
     ScriptAnalysis *analysis = ssa->getFrame(pushed.frame).script->analysis();
 
-    if (!analysis->integerOperation(cx, PC))
+    if (!analysis->integerOperation(PC))
         return false;
 
     uint32_t baseSlot = UNASSIGNED;
     int32_t baseConstant = 0;
     JSOp op = JSOp(*PC);
     switch (op) {
 
       case JSOP_INCLOCAL:
@@ -1462,17 +1462,17 @@ LoopState::getLoopTestAccess(const SSAVa
       case JSOP_INCLOCAL:
       case JSOP_DECLOCAL:
       case JSOP_LOCALINC:
       case JSOP_LOCALDEC:
       case JSOP_INCARG:
       case JSOP_DECARG:
       case JSOP_ARGINC:
       case JSOP_ARGDEC: {
-        if (!outerAnalysis->integerOperation(cx, pc))
+        if (!outerAnalysis->integerOperation(pc))
             return false;
         uint32_t slot = GetBytecodeSlot(outerScript, pc);
         if (outerAnalysis->slotEscapes(slot))
             return false;
 
         *pslot = slot;
         if (cs->format & JOF_POST) {
             if (cs->format & JOF_INC)
@@ -1605,17 +1605,17 @@ LoopState::analyzeLoopIncrements()
         uint32_t offset = outerAnalysis->liveness(slot).onlyWrite(lifetime);
         if (offset == UINT32_MAX || offset < lifetime->lastBlock)
             continue;
 
         jsbytecode *pc = outerScript->code + offset;
         JSOp op = JSOp(*pc);
         const JSCodeSpec *cs = &js_CodeSpec[op];
         if (cs->format & (JOF_INC | JOF_DEC)) {
-            if (!outerAnalysis->integerOperation(cx, pc))
+            if (!outerAnalysis->integerOperation(pc))
                 continue;
 
             Increment inc;
             inc.slot = slot;
             inc.offset = offset;
             increments.append(inc);
         }
     }
@@ -2066,17 +2066,17 @@ LoopState::getEntryValue(const CrossSSAV
     switch (op) {
 
       case JSOP_GETLOCAL:
       case JSOP_LOCALINC:
       case JSOP_INCLOCAL:
       case JSOP_GETARG:
       case JSOP_ARGINC:
       case JSOP_INCARG: {
-        if (cv.frame != CrossScriptSSA::OUTER_FRAME || !analysis->integerOperation(cx, pc))
+        if (cv.frame != CrossScriptSSA::OUTER_FRAME || !analysis->integerOperation(pc))
             return false;
         uint32_t slot = GetBytecodeSlot(outerScript, pc);
         if (outerAnalysis->slotEscapes(slot))
             return false;
         uint32_t write = outerAnalysis->liveness(slot).firstWrite(lifetime);
         if (write != UINT32_MAX && write < v.pushedOffset()) {
             /* Variable has been modified since the start of the loop. */
             return false;

--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -2722,17 +2722,17 @@ SetElementIC::attachHoleStub(VMFrame &f,
 
     if (keyval < 0)
         return disable(f, "negative key index");
 
     // We may have failed a capacity check instead of a dense array check.
     // However we should still build the IC in this case, since it could
     // be in a loop that is filling in the array.
 
-    if (js_PrototypeHasIndexedProperties(cx, obj))
+    if (js_PrototypeHasIndexedProperties(obj))
         return disable(f, "prototype has indexed properties");
 
     MJITInstrumentation sps(&f.cx->runtime->spsProfiler);
     Assembler masm(&sps, &f);
 
     Vector<Jump, 8> fails(cx);
 
     if (!GeneratePrototypeGuards(cx, fails, masm, obj, NULL, objReg, objReg))

--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -130,17 +130,17 @@ stubs::SetElem(VMFrame &f)
     TypeScript::MonitorAssign(cx, obj, id);
 
     do {
         if (obj->isDenseArray() && JSID_IS_INT(id)) {
             uint32_t length = obj->getDenseArrayInitializedLength();
             int32_t i = JSID_TO_INT(id);
             if ((uint32_t)i < length) {
                 if (obj->getDenseArrayElement(i).isMagic(JS_ARRAY_HOLE)) {
-                    if (js_PrototypeHasIndexedProperties(cx, obj))
+                    if (js_PrototypeHasIndexedProperties(obj))
                         break;
                     if ((uint32_t)i >= obj->getArrayLength())
                         JSObject::setArrayLength(cx, obj, i + 1);
                 }
                 JSObject::setDenseArrayElementWithType(cx, obj, i, rval);
                 goto end_setelem;
             } else {
                 if (f.script()->hasAnalysis())