--- a/js/src/vm/ObjectImpl-inl.h
+++ b/js/src/vm/ObjectImpl-inl.h
@@ -18,17 +18,17 @@
 
 #include "js/TemplateLib.h"
 
 #include "ObjectImpl.h"
 
 namespace js {
 
 static MOZ_ALWAYS_INLINE void
-Debug_SetSlotRangeToCrashOnTouch(HeapSlot *vec, size_t len)
+Debug_SetSlotRangeToCrashOnTouch(HeapSlot *vec, uint32_t len)
 {
 #ifdef DEBUG
     Debug_SetValueRangeToCrashOnTouch((Value *) vec, len);
 #endif
 }
 
 static MOZ_ALWAYS_INLINE void
 Debug_SetSlotRangeToCrashOnTouch(HeapSlot *begin, HeapSlot *end)
@@ -78,167 +78,167 @@ js::ObjectImpl::getDenseArrayInitialized
 inline js::HeapSlotArray
 js::ObjectImpl::getDenseArrayElements()
 {
     MOZ_ASSERT(isDenseArray());
     return HeapSlotArray(elements);
 }
 
 inline const js::Value &
-js::ObjectImpl::getDenseArrayElement(unsigned idx)
+js::ObjectImpl::getDenseArrayElement(uint32_t idx)
 {
     MOZ_ASSERT(isDenseArray() && idx < getDenseArrayInitializedLength());
     return elements[idx];
 }
 
 inline void
-js::ObjectImpl::getSlotRangeUnchecked(size_t start, size_t length,
+js::ObjectImpl::getSlotRangeUnchecked(uint32_t start, uint32_t length,
                                       HeapSlot **fixedStart, HeapSlot **fixedEnd,
                                       HeapSlot **slotsStart, HeapSlot **slotsEnd)
 {
     MOZ_ASSERT(!isDenseArray());
     MOZ_ASSERT(start + length >= start);
 
-    size_t fixed = numFixedSlots();
+    uint32_t fixed = numFixedSlots();
     if (start < fixed) {
         if (start + length < fixed) {
             *fixedStart = &fixedSlots()[start];
             *fixedEnd = &fixedSlots()[start + length];
             *slotsStart = *slotsEnd = NULL;
         } else {
-            size_t localCopy = fixed - start;
+            uint32_t localCopy = fixed - start;
             *fixedStart = &fixedSlots()[start];
             *fixedEnd = &fixedSlots()[start + localCopy];
             *slotsStart = &slots[0];
             *slotsEnd = &slots[length - localCopy];
         }
     } else {
         *fixedStart = *fixedEnd = NULL;
         *slotsStart = &slots[start - fixed];
         *slotsEnd = &slots[start - fixed + length];
     }
 }
 
 inline void
-js::ObjectImpl::getSlotRange(size_t start, size_t length,
+js::ObjectImpl::getSlotRange(uint32_t start, uint32_t length,
                              HeapSlot **fixedStart, HeapSlot **fixedEnd,
                              HeapSlot **slotsStart, HeapSlot **slotsEnd)
 {
     MOZ_ASSERT(slotInRange(start + length, SENTINEL_ALLOWED));
     getSlotRangeUnchecked(start, length, fixedStart, fixedEnd, slotsStart, slotsEnd);
 }
 
 inline bool
-js::ObjectImpl::hasContiguousSlots(size_t start, size_t count) const
+js::ObjectImpl::hasContiguousSlots(uint32_t start, uint32_t count) const
 {
     /*
      * Check that the range [start, start+count) is either all inline or all
      * out of line.
      */
     MOZ_ASSERT(slotInRange(start + count, SENTINEL_ALLOWED));
     return start + count <= numFixedSlots() || start >= numFixedSlots();
 }
 
 inline void
-js::ObjectImpl::invalidateSlotRange(size_t start, size_t length)
+js::ObjectImpl::invalidateSlotRange(uint32_t start, uint32_t length)
 {
 #ifdef DEBUG
     MOZ_ASSERT(!isDenseArray());
 
     HeapSlot *fixedStart, *fixedEnd, *slotsStart, *slotsEnd;
     getSlotRange(start, length, &fixedStart, &fixedEnd, &slotsStart, &slotsEnd);
     Debug_SetSlotRangeToCrashOnTouch(fixedStart, fixedEnd);
     Debug_SetSlotRangeToCrashOnTouch(slotsStart, slotsEnd);
 #endif /* DEBUG */
 }
 
 inline void
-js::ObjectImpl::initializeSlotRange(size_t start, size_t length)
+js::ObjectImpl::initializeSlotRange(uint32_t start, uint32_t length)
 {
     /*
      * No bounds check, as this is used when the object's shape does not
      * reflect its allocated slots (updateSlotsForSpan).
      */
     HeapSlot *fixedStart, *fixedEnd, *slotsStart, *slotsEnd;
     getSlotRangeUnchecked(start, length, &fixedStart, &fixedEnd, &slotsStart, &slotsEnd);
 
     JSCompartment *comp = compartment();
-    size_t offset = start;
+    uint32_t offset = start;
     for (HeapSlot *sp = fixedStart; sp < fixedEnd; sp++)
         sp->init(comp, this->asObjectPtr(), offset++, UndefinedValue());
     for (HeapSlot *sp = slotsStart; sp < slotsEnd; sp++)
         sp->init(comp, this->asObjectPtr(), offset++, UndefinedValue());
 }
 
 inline bool
 js::ObjectImpl::isNative() const
 {
     return lastProperty()->isNative();
 }
 
 inline js::HeapSlot &
-js::ObjectImpl::nativeGetSlotRef(unsigned slot)
+js::ObjectImpl::nativeGetSlotRef(uint32_t slot)
 {
     MOZ_ASSERT(isNative());
     MOZ_ASSERT(slot < slotSpan());
     return getSlotRef(slot);
 }
 
 inline const js::Value &
-js::ObjectImpl::nativeGetSlot(unsigned slot) const
+js::ObjectImpl::nativeGetSlot(uint32_t slot) const
 {
     MOZ_ASSERT(isNative());
     MOZ_ASSERT(slot < slotSpan());
     return getSlot(slot);
 }
 
 inline void
-js::ObjectImpl::setSlot(unsigned slot, const js::Value &value)
+js::ObjectImpl::setSlot(uint32_t slot, const js::Value &value)
 {
     MOZ_ASSERT(slotInRange(slot));
     getSlotRef(slot).set(this->asObjectPtr(), slot, value);
 }
 
 inline void
-js::ObjectImpl::initSlot(unsigned slot, const js::Value &value)
+js::ObjectImpl::initSlot(uint32_t slot, const js::Value &value)
 {
     MOZ_ASSERT(getSlot(slot).isUndefined() || getSlot(slot).isMagic(JS_ARRAY_HOLE));
     MOZ_ASSERT(slotInRange(slot));
     initSlotUnchecked(slot, value);
 }
 
 inline void
-js::ObjectImpl::initSlotUnchecked(unsigned slot, const js::Value &value)
+js::ObjectImpl::initSlotUnchecked(uint32_t slot, const js::Value &value)
 {
     getSlotAddressUnchecked(slot)->init(this->asObjectPtr(), slot, value);
 }
 
 inline void
-js::ObjectImpl::setFixedSlot(unsigned slot, const js::Value &value)
+js::ObjectImpl::setFixedSlot(uint32_t slot, const js::Value &value)
 {
     MOZ_ASSERT(slot < numFixedSlots());
     fixedSlots()[slot].set(this->asObjectPtr(), slot, value);
 }
 
 inline void
-js::ObjectImpl::initFixedSlot(unsigned slot, const js::Value &value)
+js::ObjectImpl::initFixedSlot(uint32_t slot, const js::Value &value)
 {
     MOZ_ASSERT(slot < numFixedSlots());
     fixedSlots()[slot].init(this->asObjectPtr(), slot, value);
 }
 
 inline uint32_t
 js::ObjectImpl::slotSpan() const
 {
     if (inDictionaryMode())
         return lastProperty()->base()->slotSpan();
     return lastProperty()->slotSpan();
 }
 
-inline size_t
+inline uint32_t
 js::ObjectImpl::numDynamicSlots() const
 {
     return dynamicSlotsCount(numFixedSlots(), slotSpan());
 }
 
 inline js::Class *
 js::ObjectImpl::getClass() const
 {
@@ -270,26 +270,26 @@ js::ObjectImpl::isDelegate() const
 }
 
 inline bool
 js::ObjectImpl::inDictionaryMode() const
 {
     return lastProperty()->inDictionary();
 }
 
-/* static */ inline size_t
-js::ObjectImpl::dynamicSlotsCount(size_t nfixed, size_t span)
+/* static */ inline uint32_t
+js::ObjectImpl::dynamicSlotsCount(uint32_t nfixed, uint32_t span)
 {
     if (span <= nfixed)
         return 0;
     span -= nfixed;
     if (span <= SLOT_CAPACITY_MIN)
         return SLOT_CAPACITY_MIN;
 
-    size_t slots = RoundUpPow2(span);
+    uint32_t slots = RoundUpPow2(span);
     MOZ_ASSERT(slots >= span);
     return slots;
 }
 
 inline size_t
 js::ObjectImpl::sizeOfThis() const
 {
     return arenaHeader()->getThingSize();
@@ -374,17 +374,17 @@ js::ObjectImpl::privateRef(uint32_t nfix
 
 inline void *
 js::ObjectImpl::getPrivate() const
 {
     return privateRef(numFixedSlots());
 }
 
 inline void *
-js::ObjectImpl::getPrivate(size_t nfixed) const
+js::ObjectImpl::getPrivate(uint32_t nfixed) const
 {
     return privateRef(nfixed);
 }
 
 inline void
 js::ObjectImpl::setPrivate(void *data)
 {
     void **pprivate = &privateRef(numFixedSlots());

--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -87,44 +87,44 @@ js::ObjectImpl::checkShapeConsistency()
             }
             prev = shape;
         }
     }
 }
 #endif
 
 void
-js::ObjectImpl::initSlotRange(size_t start, const Value *vector, size_t length)
+js::ObjectImpl::initSlotRange(uint32_t start, const Value *vector, uint32_t length)
 {
     JSCompartment *comp = compartment();
     HeapSlot *fixedStart, *fixedEnd, *slotsStart, *slotsEnd;
     getSlotRange(start, length, &fixedStart, &fixedEnd, &slotsStart, &slotsEnd);
     for (HeapSlot *sp = fixedStart; sp < fixedEnd; sp++)
         sp->init(comp, this->asObjectPtr(), start++, *vector++);
     for (HeapSlot *sp = slotsStart; sp < slotsEnd; sp++)
         sp->init(comp, this->asObjectPtr(), start++, *vector++);
 }
 
 void
-js::ObjectImpl::copySlotRange(size_t start, const Value *vector, size_t length)
+js::ObjectImpl::copySlotRange(uint32_t start, const Value *vector, uint32_t length)
 {
     JSCompartment *comp = compartment();
     HeapSlot *fixedStart, *fixedEnd, *slotsStart, *slotsEnd;
     getSlotRange(start, length, &fixedStart, &fixedEnd, &slotsStart, &slotsEnd);
     for (HeapSlot *sp = fixedStart; sp < fixedEnd; sp++)
         sp->set(comp, this->asObjectPtr(), start++, *vector++);
     for (HeapSlot *sp = slotsStart; sp < slotsEnd; sp++)
         sp->set(comp, this->asObjectPtr(), start++, *vector++);
 }
 
 #ifdef DEBUG
 bool
-js::ObjectImpl::slotInRange(unsigned slot, SentinelAllowed sentinel) const
+js::ObjectImpl::slotInRange(uint32_t slot, SentinelAllowed sentinel) const
 {
-    size_t capacity = numFixedSlots() + numDynamicSlots();
+    uint32_t capacity = numFixedSlots() + numDynamicSlots();
     if (sentinel == SENTINEL_ALLOWED)
         return slot <= capacity;
     return slot < capacity;
 }
 #endif /* DEBUG */
 
 #if defined(_MSC_VER) && _MSC_VER >= 1500
 /*

--- a/js/src/vm/ObjectImpl.h
+++ b/js/src/vm/ObjectImpl.h
@@ -187,71 +187,71 @@ class ObjectImpl : public gc::Cell
      * XXX Once the property/element split of bug 586842 is complete, these
      *     methods should move back to JSObject.
      */
     inline bool isDenseArray() const;
     inline bool isSlowArray() const;
     inline bool isArray() const;
 
     inline HeapSlotArray getDenseArrayElements();
-    inline const Value & getDenseArrayElement(unsigned idx);
+    inline const Value & getDenseArrayElement(uint32_t idx);
     inline uint32_t getDenseArrayInitializedLength();
 
   protected:
 #ifdef DEBUG
     void checkShapeConsistency();
 #else
     void checkShapeConsistency() { }
 #endif
 
   private:
     /*
      * Get internal pointers to the range of values starting at start and
      * running for length.
      */
-    inline void getSlotRangeUnchecked(size_t start, size_t length,
+    inline void getSlotRangeUnchecked(uint32_t start, uint32_t length,
                                       HeapSlot **fixedStart, HeapSlot **fixedEnd,
                                       HeapSlot **slotsStart, HeapSlot **slotsEnd);
-    inline void getSlotRange(size_t start, size_t length,
+    inline void getSlotRange(uint32_t start, uint32_t length,
                              HeapSlot **fixedStart, HeapSlot **fixedEnd,
                              HeapSlot **slotsStart, HeapSlot **slotsEnd);
 
   protected:
     friend struct GCMarker;
     friend struct Shape;
     friend class NewObjectCache;
 
-    inline bool hasContiguousSlots(size_t start, size_t count) const;
+    inline bool hasContiguousSlots(uint32_t start, uint32_t count) const;
 
-    inline void invalidateSlotRange(size_t start, size_t count);
-    inline void initializeSlotRange(size_t start, size_t count);
+    inline void invalidateSlotRange(uint32_t start, uint32_t count);
+    inline void initializeSlotRange(uint32_t start, uint32_t count);
 
     /*
      * Initialize a flat array of slots to this object at a start slot.  The
      * caller must ensure that are enough slots.
      */
-    void initSlotRange(size_t start, const Value *vector, size_t length);
+    void initSlotRange(uint32_t start, const Value *vector, uint32_t length);
 
     /*
      * Copy a flat array of slots to this object at a start slot. Caller must
      * ensure there are enough slots in this object.
      */
-    void copySlotRange(size_t start, const Value *vector, size_t length);
+    void copySlotRange(uint32_t start, const Value *vector, uint32_t length);
 
 #ifdef DEBUG
     enum SentinelAllowed {
         SENTINEL_NOT_ALLOWED,
         SENTINEL_ALLOWED
     };
 
     /*
      * Check that slot is in range for the object's allocated slots.
      * If sentinelAllowed then slot may equal the slot capacity.
      */
-    bool slotInRange(unsigned slot, SentinelAllowed sentinel = SENTINEL_NOT_ALLOWED) const;
+    bool slotInRange(uint32_t slot, SentinelAllowed sentinel = SENTINEL_NOT_ALLOWED) const;
 #endif
 
     /* Minimum size for dynamically allocated slots. */
     static const uint32_t SLOT_CAPACITY_MIN = 8;
 
     HeapSlot *fixedSlots() const {
         return reinterpret_cast<HeapSlot *>(uintptr_t(this) + sizeof(ObjectImpl));
     }
@@ -269,17 +269,17 @@ class ObjectImpl : public gc::Cell
 
     inline bool isNative() const;
 
     types::TypeObject *type() const {
         MOZ_ASSERT(!hasLazyType());
         return type_;
     }
 
-    size_t numFixedSlots() const {
+    uint32_t numFixedSlots() const {
         return reinterpret_cast<const shadow::Object *>(this)->numFixedSlots();
     }
 
     /*
      * Whether this is the only object which has its specified type. This
      * object will have its type constructed lazily as needed by analysis.
      */
     bool hasSingletonType() const { return !!type_->singleton; }
@@ -288,17 +288,17 @@ class ObjectImpl : public gc::Cell
      * Whether the object's type has not been constructed yet. If an object
      * might have a lazy type, use getType() below, otherwise type().
      */
     bool hasLazyType() const { return type_->lazy(); }
 
     inline uint32_t slotSpan() const;
 
     /* Compute dynamicSlotsCount() for this object. */
-    inline size_t numDynamicSlots() const;
+    inline uint32_t numDynamicSlots() const;
 
     const Shape * nativeLookup(JSContext *cx, jsid id);
 
     inline Class *getClass() const;
     inline JSClass *getJSClass() const;
     inline bool hasClass(const Class *c) const;
     inline const ObjectOps *getOps() const;
 
@@ -315,75 +315,75 @@ class ObjectImpl : public gc::Cell
 
     /*
      * Return true if this object is a native one that has been converted from
      * shared-immutable prototype-rooted shape storage to dictionary-shapes in
      * a doubly-linked list.
      */
     inline bool inDictionaryMode() const;
 
-    const Value &getSlot(unsigned slot) const {
+    const Value &getSlot(uint32_t slot) const {
         MOZ_ASSERT(slotInRange(slot));
-        size_t fixed = numFixedSlots();
+        uint32_t fixed = numFixedSlots();
         if (slot < fixed)
             return fixedSlots()[slot];
         return slots[slot - fixed];
     }
 
-    HeapSlot *getSlotAddressUnchecked(unsigned slot) {
-        size_t fixed = numFixedSlots();
+    HeapSlot *getSlotAddressUnchecked(uint32_t slot) {
+        uint32_t fixed = numFixedSlots();
         if (slot < fixed)
             return fixedSlots() + slot;
         return slots + (slot - fixed);
     }
 
-    HeapSlot *getSlotAddress(unsigned slot) {
+    HeapSlot *getSlotAddress(uint32_t slot) {
         /*
          * This can be used to get the address of the end of the slots for the
          * object, which may be necessary when fetching zero-length arrays of
          * slots (e.g. for callObjVarArray).
          */
         MOZ_ASSERT(slotInRange(slot, SENTINEL_ALLOWED));
         return getSlotAddressUnchecked(slot);
     }
 
-    HeapSlot &getSlotRef(unsigned slot) {
+    HeapSlot &getSlotRef(uint32_t slot) {
         MOZ_ASSERT(slotInRange(slot));
         return *getSlotAddress(slot);
     }
 
-    inline HeapSlot &nativeGetSlotRef(unsigned slot);
-    inline const Value &nativeGetSlot(unsigned slot) const;
+    inline HeapSlot &nativeGetSlotRef(uint32_t slot);
+    inline const Value &nativeGetSlot(uint32_t slot) const;
 
-    inline void setSlot(unsigned slot, const Value &value);
-    inline void initSlot(unsigned slot, const Value &value);
-    inline void initSlotUnchecked(unsigned slot, const Value &value);
+    inline void setSlot(uint32_t slot, const Value &value);
+    inline void initSlot(uint32_t slot, const Value &value);
+    inline void initSlotUnchecked(uint32_t slot, const Value &value);
 
     /* For slots which are known to always be fixed, due to the way they are allocated. */
 
-    HeapSlot &getFixedSlotRef(unsigned slot) {
+    HeapSlot &getFixedSlotRef(uint32_t slot) {
         MOZ_ASSERT(slot < numFixedSlots());
         return fixedSlots()[slot];
     }
 
-    const Value &getFixedSlot(unsigned slot) const {
+    const Value &getFixedSlot(uint32_t slot) const {
         MOZ_ASSERT(slot < numFixedSlots());
         return fixedSlots()[slot];
     }
 
-    inline void setFixedSlot(unsigned slot, const Value &value);
-    inline void initFixedSlot(unsigned slot, const Value &value);
+    inline void setFixedSlot(uint32_t slot, const Value &value);
+    inline void initFixedSlot(uint32_t slot, const Value &value);
 
     /*
      * Get the number of dynamic slots to allocate to cover the properties in
      * an object with the given number of fixed slots and slot span. The slot
      * capacity is not stored explicitly, and the allocated size of the slot
      * array is kept in sync with this count.
      */
-    static inline size_t dynamicSlotsCount(size_t nfixed, size_t span);
+    static inline uint32_t dynamicSlotsCount(uint32_t nfixed, uint32_t span);
 
     /* Memory usage functions. */
     inline size_t sizeOfThis() const;
 
     /* Elements accessors. */
 
     ObjectElements * getElementsHeader() const {
         return ObjectElements::fromElements(elements);
@@ -423,17 +423,17 @@ class ObjectImpl : public gc::Cell
 
     inline bool hasPrivate() const;
     inline void *getPrivate() const;
     inline void setPrivate(void *data);
     inline void setPrivateUnbarriered(void *data);
     inline void initPrivate(void *data);
 
     /* Access private data for an object with a known number of fixed slots. */
-    inline void *getPrivate(size_t nfixed) const;
+    inline void *getPrivate(uint32_t nfixed) const;
 
     /* JIT Accessors */
     static size_t offsetOfShape() { return offsetof(ObjectImpl, shape_); }
     HeapPtrShape *addressOfShape() { return &shape_; }
 
     static size_t offsetOfType() { return offsetof(ObjectImpl, type_); }
     HeapPtrTypeObject *addressOfType() { return &type_; }