--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -221,16 +221,17 @@ EXPORTS_NAMESPACES += ds gc
 
 EXPORTS_ds = \
 		BitArray.h \
 		$(NULL)
 
 EXPORTS_gc = \
 		Statistics.h \
 		Barrier.h \
+		Root.h \
 		$(NULL)
 
 ######################################################
 # BEGIN include exported headers from the JS engine
 #
 #       Ultimately, after cleansing INSTALLED_HEADERS,
 #       these will be the ONLY headers exported by
 #       the js engine

--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -49,25 +49,25 @@
 #include "vm/RegExpStatics-inl.h"
 
 using namespace js;
 using namespace js::types;
 
 class RegExpMatchBuilder
 {
     JSContext   * const cx;
-    JSObject    * const array;
+    RootedVarObject array;
 
     bool setProperty(JSAtom *name, Value v) {
         return !!js_DefineProperty(cx, array, ATOM_TO_JSID(name), &v,
                                    JS_PropertyStub, JS_StrictPropertyStub, JSPROP_ENUMERATE);
     }
 
   public:
-    RegExpMatchBuilder(JSContext *cx, JSObject *array) : cx(cx), array(array) {}
+    RegExpMatchBuilder(JSContext *cx, JSObject *array) : cx(cx), array(cx, array) {}
 
     bool append(uint32_t index, Value v) {
         JS_ASSERT(!array->getOps()->getElement);
         return !!js_DefineElement(cx, array, index, &v, JS_PropertyStub, JS_StrictPropertyStub,
                                   JSPROP_ENUMERATE);
     }
 
     bool setIndex(int index) {
@@ -76,29 +76,31 @@ class RegExpMatchBuilder
 
     bool setInput(JSString *str) {
         JS_ASSERT(str);
         return setProperty(cx->runtime->atomState.inputAtom, StringValue(str));
     }
 };
 
 static bool
-CreateRegExpMatchResult(JSContext *cx, JSString *input, const jschar *chars, size_t length,
+CreateRegExpMatchResult(JSContext *cx, JSString *input_, const jschar *chars, size_t length,
                         MatchPairs *matchPairs, Value *rval)
 {
+    RootedVarString input(cx, input_);
+
     /*
      * Create the (slow) result array for a match.
      *
      * Array contents:
      *  0:              matched string
      *  1..pairCount-1: paren matches
      *  input:          input string
      *  index:          start index for the match
      */
-    JSObject *array = NewSlowEmptyArray(cx);
+    RootedVarObject array(cx, NewSlowEmptyArray(cx));
     if (!array)
         return false;
 
     if (!input) {
         input = js_NewStringCopyN(cx, chars, length);
         if (!input)
             return false;
     }
@@ -220,17 +222,18 @@ EscapeNakedForwardSlashes(JSContext *cx,
  *  _ => pattern := ToString(pattern) if defined(pattern) else ''
  *       flags := ToString(flags) if defined(flags) else ''
  */
 static bool
 CompileRegExpObject(JSContext *cx, RegExpObjectBuilder &builder, CallArgs args)
 {
     if (args.length() == 0) {
         RegExpStatics *res = cx->regExpStatics();
-        RegExpObject *reobj = builder.build(cx->runtime->emptyString, res->getFlags());
+        RegExpObject *reobj = builder.build(RootedVarAtom(cx, cx->runtime->emptyString),
+                                            res->getFlags());
         if (!reobj)
             return false;
         args.rval() = ObjectValue(*reobj);
         return true;
     }
 
     Value sourceValue = args[0];
 
@@ -267,17 +270,17 @@ CompileRegExpObject(JSContext *cx, RegEx
         /*
          * 'toSource' is a permanent read-only property, so this is equivalent
          * to executing RegExpObject::getSource on the unwrapped object.
          */
         Value v;
         if (!sourceObj.getProperty(cx, cx->runtime->atomState.sourceAtom, &v))
             return false;
 
-        RegExpObject *reobj = builder.build(&v.toString()->asAtom(), flags);
+        RegExpObject *reobj = builder.build(RootedVarAtom(cx, &v.toString()->asAtom()), flags);
         if (!reobj)
             return false;
 
         args.rval() = ObjectValue(*reobj);
         return true;
     }
 
     JSAtom *source;
@@ -299,17 +302,17 @@ CompileRegExpObject(JSContext *cx, RegEx
         JSString *flagStr = ToString(cx, args[1]);
         if (!flagStr)
             return false;
         args[1].setString(flagStr);
         if (!ParseRegExpFlags(cx, flagStr, &flags))
             return false;
     }
 
-    JSAtom *escapedSourceStr = EscapeNakedForwardSlashes(cx, source);
+    RootedVarAtom escapedSourceStr(cx, EscapeNakedForwardSlashes(cx, source));
     if (!escapedSourceStr)
         return false;
 
     if (!js::detail::RegExpCode::checkSyntax(cx, NULL, escapedSourceStr))
         return false;
 
     RegExpStatics *res = cx->regExpStatics();
     RegExpObject *reobj = builder.build(escapedSourceStr, RegExpFlag(flags | res->getFlags()));
@@ -477,32 +480,32 @@ static JSPropertySpec regexp_static_prop
     {0,0,0,0,0}
 };
 
 JSObject *
 js_InitRegExpClass(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(obj->isNative());
 
-    GlobalObject *global = &obj->asGlobal();
+    RootedVar<GlobalObject*> global(cx, &obj->asGlobal());
 
-    JSObject *proto = global->createBlankPrototype(cx, &RegExpClass);
+    RootedVarObject proto(cx, global->createBlankPrototype(cx, &RegExpClass));
     if (!proto)
         return NULL;
     proto->setPrivate(NULL);
 
-    RegExpObject *reproto = &proto->asRegExp();
-    RegExpObjectBuilder builder(cx, reproto);
-    if (!builder.build(cx->runtime->emptyString, RegExpFlag(0)))
+    RegExpObjectBuilder builder(cx, &proto->asRegExp());
+    if (!builder.build(RootedVarAtom(cx, cx->runtime->emptyString), RegExpFlag(0)))
         return NULL;
 
     if (!DefinePropertiesAndBrand(cx, proto, NULL, regexp_methods))
         return NULL;
 
-    JSFunction *ctor = global->createConstructor(cx, regexp_construct, CLASS_ATOM(cx, RegExp), 2);
+    RootedVarFunction ctor(cx);
+    ctor = global->createConstructor(cx, regexp_construct, CLASS_ATOM(cx, RegExp), 2);
     if (!ctor)
         return NULL;
 
     if (!LinkConstructorAndPrototype(cx, ctor, proto))
         return NULL;
 
     /* Add static properties to the RegExp constructor. */
     if (!JS_DefineProperties(cx, ctor, regexp_static_props))
@@ -570,24 +573,24 @@ ExecuteRegExp(JSContext *cx, Native nati
     CallArgs args = CallArgsFromVp(argc, vp);
 
     /* Step 1. */
     bool ok;
     JSObject *obj = NonGenericMethodGuard(cx, args, native, &RegExpClass, &ok);
     if (!obj)
         return ok;
 
-    RegExpObject &reobj = obj->asRegExp();
+    RootedVar<RegExpObject*> reobj(cx, &obj->asRegExp());
 
     RegExpGuard re;
-    if (StartsWithGreedyStar(reobj.getSource())) {
-        if (!GetSharedForGreedyStar(cx, reobj.getSource(), reobj.getFlags(), &re))
+    if (StartsWithGreedyStar(reobj->getSource())) {
+        if (!GetSharedForGreedyStar(cx, reobj->getSource(), reobj->getFlags(), &re))
             return false;
     } else {
-        if (!reobj.getShared(cx, &re))
+        if (!reobj->getShared(cx, &re))
             return false;
     }
 
     RegExpStatics *res = cx->regExpStatics();
 
     /* Step 2. */
     JSString *input = ToString(cx, (args.length() > 0) ? args[0] : UndefinedValue());
     if (!input)
@@ -596,48 +599,48 @@ ExecuteRegExp(JSContext *cx, Native nati
     /* Step 3. */
     JSLinearString *linearInput = input->ensureLinear(cx);
     if (!linearInput)
         return false;
     const jschar *chars = linearInput->chars();
     size_t length = input->length();
 
     /* Step 4. */
-    const Value &lastIndex = reobj.getLastIndex();
+    const Value &lastIndex = reobj->getLastIndex();
 
     /* Step 5. */
     double i;
     if (!ToInteger(cx, lastIndex, &i))
         return false;
 
     /* Steps 6-7 (with sticky extension). */
     if (!re->global() && !re->sticky())
         i = 0;
 
     /* Step 9a. */
     if (i < 0 || i > length) {
-        reobj.zeroLastIndex();
+        reobj->zeroLastIndex();
         args.rval() = NullValue();
         return true;
     }
 
     /* Steps 8-21. */
     RegExpExecType execType = (native == regexp_test) ? RegExpTest : RegExpExec;
     size_t lastIndexInt(i);
     if (!ExecuteRegExp(cx, res, *re, linearInput, chars, length, &lastIndexInt, execType,
                        &args.rval())) {
         return false;
     }
 
     /* Step 11 (with sticky extension). */
     if (re->global() || (!args.rval().isNull() && re->sticky())) {
         if (args.rval().isNull())
-            reobj.zeroLastIndex();
+            reobj->zeroLastIndex();
         else
-            reobj.setLastIndex(lastIndexInt);
+            reobj->setLastIndex(lastIndexInt);
     }
 
     return true;
 }
 
 /* ES5 15.10.6.2. */
 JSBool
 js::regexp_exec(JSContext *cx, unsigned argc, Value *vp)

--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -4150,17 +4150,17 @@ MOZ_ARG_ENABLE_BOOL(gcgenerational,
     JSGC_GENERATIONAL= )
 if test -n "$JSGC_GENERATIONAL"; then
     AC_DEFINE(JSGC_GENERATIONAL)
 fi
 
 dnl ========================================================
 dnl = Perform moving GC stack rooting analysis
 dnl ========================================================
-MOZ_ARG_ENABLE_BOOL(gcrootanalysis,
+MOZ_ARG_ENABLE_BOOL(root-analysis,
 [  --enable-root-analysis Enable moving GC stack root analysis],
     JSGC_ROOT_ANALYSIS=1,
     JSGC_ROOT_ANALYSIS= )
 if test -n "$JSGC_ROOT_ANALYSIS"; then
     AC_DEFINE(JSGC_ROOT_ANALYSIS)
 fi
 
 dnl ========================================================

--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -48,19 +48,21 @@
 #include "vm/GlobalObject.h"
 
 #include "jsinferinlines.h"
 
 using namespace js;
 using namespace js::frontend;
 
 bool
-DefineGlobals(JSContext *cx, GlobalScope &globalScope, JSScript *script)
+DefineGlobals(JSContext *cx, GlobalScope &globalScope, JSScript* script)
 {
-    JSObject *globalObj = globalScope.globalObj;
+    Root<JSScript*> root(cx, &script);
+
+    HandleObject globalObj = globalScope.globalObj;
 
     /* Define and update global properties. */
     for (size_t i = 0; i < globalScope.defs.length(); i++) {
         GlobalScope::GlobalDef &def = globalScope.defs[i];
 
         /* Names that could be resolved ahead of time can be skipped. */
         if (!def.atom)
             continue;
@@ -160,17 +162,16 @@ frontend::CompileScript(JSContext *cx, J
                         uint32_t tcflags,
                         const jschar *chars, size_t length,
                         const char *filename, unsigned lineno, JSVersion version,
                         JSString *source /* = NULL */,
                         unsigned staticLevel /* = 0 */)
 {
     TokenKind tt;
     ParseNode *pn;
-    JSScript *script;
     bool inDirectivePrologue;
 
     JS_ASSERT(!(tcflags & ~(TCF_COMPILE_N_GO | TCF_NO_SCRIPT_RVAL | TCF_COMPILE_FOR_EVAL
                             | TCF_NEED_SCRIPT_GLOBAL)));
 
     /*
      * The scripted callerFrame can only be given for compile-and-go scripts
      * and non-zero static level requires callerFrame.
@@ -194,18 +195,17 @@ frontend::CompileScript(JSContext *cx, J
     // We can specialize a bit for the given scope chain if that scope chain is the global object.
     JSObject *globalObj = scopeChain && scopeChain == &scopeChain->global()
                           ? &scopeChain->global()
                           : NULL;
 
     JS_ASSERT_IF(globalObj, globalObj->isNative());
     JS_ASSERT_IF(globalObj, JSCLASS_HAS_GLOBAL_FLAG_AND_SLOTS(globalObj->getClass()));
 
-    /* Null script early in case of error, to reduce our code footprint. */
-    script = NULL;
+    RootedVar<JSScript*> script(cx);
 
     GlobalScope globalScope(cx, globalObj, &bce);
     bce.flags |= tcflags;
     bce.setScopeChain(scopeChain);
     bce.globalScope = &globalScope;
     if (!SetStaticLevel(&bce, staticLevel))
         goto out;
 

--- a/js/src/frontend/BytecodeEmitter-inl.h
+++ b/js/src/frontend/BytecodeEmitter-inl.h
@@ -44,18 +44,19 @@
 #include "frontend/ParseNode.h"
 #include "frontend/TokenStream.h"
 
 namespace js {
 
 inline
 TreeContext::TreeContext(Parser *prs)
   : flags(0), bodyid(0), blockidGen(0), parenDepth(0), yieldCount(0),
-    topStmt(NULL), topScopeStmt(NULL), blockChain(NULL), blockNode(NULL),
-    decls(prs->context), parser(prs), yieldNode(NULL), argumentsNode(NULL), scopeChain_(NULL),
+    topStmt(NULL), topScopeStmt(NULL), blockChain(prs->context), blockNode(NULL),
+    decls(prs->context), parser(prs), yieldNode(NULL), argumentsNode(NULL),
+    fun_(prs->context), scopeChain_(prs->context),
     lexdeps(prs->context), parent(prs->tc), staticLevel(0), funbox(NULL), functionList(NULL),
     innermostWith(NULL), bindings(prs->context), bindingsRoot(prs->context, &bindings),
     funcStmts(NULL)
 {
     prs->tc = this;
 }
 
 /*

--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -421,17 +421,17 @@ frontend::GenerateBlockId(TreeContext *t
 void
 frontend::PushStatement(TreeContext *tc, StmtInfo *stmt, StmtType type, ptrdiff_t top)
 {
     stmt->type = type;
     stmt->flags = 0;
     stmt->blockid = tc->blockid();
     SET_STATEMENT_TOP(stmt, top);
     stmt->label = NULL;
-    JS_ASSERT(!stmt->blockObj);
+    stmt->blockObj = NULL;
     stmt->down = tc->topStmt;
     tc->topStmt = stmt;
     if (STMT_LINKS_SCOPE(stmt)) {
         stmt->downScope = tc->topScopeStmt;
         tc->topScopeStmt = stmt;
     } else {
         stmt->downScope = NULL;
     }
@@ -1358,17 +1358,16 @@ BindGlobal(JSContext *cx, BytecodeEmitte
  * to update the special cases in EmitFor (for-in) and EmitAssignment (= and
  * op=, e.g. +=).
  */
 static JSBool
 BindNameToSlot(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     Definition *dn;
     JSOp op;
-    JSAtom *atom;
     Definition::Kind dn_kind;
 
     JS_ASSERT(pn->isKind(PNK_NAME));
 
     /* Idempotency tests come first, since we may be called more than once. */
     if (pn->pn_dflags & PND_BOUND)
         return JS_TRUE;
 
@@ -1392,17 +1391,17 @@ BindNameToSlot(JSContext *cx, BytecodeEm
         dn = (Definition *) pn;
     }
 
     op = pn->getOp();
     if (op == JSOP_NOP)
         return JS_TRUE;
 
     JS_ASSERT(JOF_OPTYPE(op) == JOF_ATOM);
-    atom = pn->pn_atom;
+    RootedVarAtom atom(cx, pn->pn_atom);
     UpvarCookie cookie = dn->pn_cookie;
     dn_kind = dn->kind();
 
     /*
      * Turn attempts to mutate const-declared bindings into get ops (for
      * pre-increment and pre-decrement ops, our caller will have to emit
      * JSOP_POS, JSOP_ONE, and JSOP_ADD as well).
      *
@@ -2367,17 +2366,17 @@ EmitSwitch(JSContext *cx, BytecodeEmitte
     ptrdiff_t top, off, defaultOffset;
     ParseNode *pn2, *pn3, *pn4;
     uint32_t caseCount, tableLength;
     ParseNode **table;
     int32_t i, low, high;
     int noteIndex;
     size_t switchSize, tableSize;
     jsbytecode *pc, *savepc;
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
 
     /* Try for most optimal, fall back if not dense ints, and per ECMAv2. */
     switchOp = JSOP_TABLESWITCH;
     ok = JS_TRUE;
     hasDefault = constPropagated = JS_FALSE;
     defaultOffset = -1;
 
     pn2 = pn->pn_right;
@@ -3980,17 +3979,17 @@ ParseNode::getConstantValue(JSContext *c
         types::FixArrayType(cx, obj);
         vp->setObject(*obj);
         return true;
       }
       case PNK_RC: {
         JS_ASSERT(isOp(JSOP_NEWINIT) && !(pn_xflags & PNX_NONCONST));
 
         gc::AllocKind kind = GuessObjectGCKind(pn_count);
-        JSObject *obj = NewBuiltinClassInstance(cx, &ObjectClass, kind);
+        RootedVarObject obj(cx, NewBuiltinClassInstance(cx, &ObjectClass, kind));
         if (!obj)
             return false;
 
         for (ParseNode *pn = pn_head; pn; pn = pn->pn_next) {
             Value value;
             if (!pn->pn_right->getConstantValue(cx, strictChecks, &value))
                 return false;
 
@@ -4139,17 +4138,17 @@ EmitCatch(JSContext *cx, BytecodeEmitter
 
 /*
  * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr12127. See
  * the comment on EmitSwitch.
  */
 MOZ_NEVER_INLINE static bool
 EmitTry(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     ptrdiff_t catchJump = -1;
 
     /*
      * Push stmtInfo to track jumps-over-catches and gosubs-to-finally
      * for later fixup.
      *
      * When a finally block is active (STMT_FINALLY in our tree context),
      * non-local jumps (including jumps-over-catches) result in a GOSUB
@@ -4371,17 +4370,17 @@ EmitTry(JSContext *cx, BytecodeEmitter *
         return false;
 
     return true;
 }
 
 static bool
 EmitIf(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
 
     /* Initialize so we can detect else-if chains and avoid recursion. */
     stmtInfo.type = STMT_IF;
     ptrdiff_t beq = -1;
     ptrdiff_t jmp = -1;
     ptrdiff_t noteIndex = -1;
 
   if_again:
@@ -4528,17 +4527,17 @@ EmitLet(JSContext *cx, BytecodeEmitter *
     for (uint32_t i = alreadyPushed; i < blockObjCount; ++i) {
         /* Tell the decompiler not to print the decl in the let head. */
         if (NewSrcNote(cx, bce, SRC_CONTINUE) < 0)
             return false;
         if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)
             return false;
     }
 
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushBlockScope(bce, &stmtInfo, blockObj, bce->offset());
 
     if (!letNotes.update(cx, bce, bce->offset()))
         return false;
 
     ptrdiff_t declNote = NewSrcNote(cx, bce, SRC_DECL);
     if (declNote < 0)
         return false;
@@ -4654,17 +4653,17 @@ EmitXMLProcessingInstruction(JSContext *
  * the comment on EmitSwitch.
  */
 MOZ_NEVER_INLINE static bool
 EmitLexicalScope(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
     JS_ASSERT(pn->isKind(PNK_LEXICALSCOPE));
     JS_ASSERT(pn->getOp() == JSOP_LEAVEBLOCK);
 
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     ObjectBox *objbox = pn->pn_objbox;
     StaticBlockObject &blockObj = objbox->object->asStaticBlock();
     PushBlockScope(bce, &stmtInfo, blockObj, bce->offset());
 
     /*
      * For compound statements (i.e. { stmt-list }), the decompiler does not
      * emit curlies by default. However, if this stmt-list contains a let
      * declaration, this is semantically invalid so we need to add a srcnote to
@@ -4703,34 +4702,34 @@ EmitLexicalScope(JSContext *cx, Bytecode
     EMIT_UINT16_IMM_OP(JSOP_LEAVEBLOCK, blockObj.slotCount());
 
     return PopStatementBCE(cx, bce);
 }
 
 static bool
 EmitWith(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     if (!EmitTree(cx, bce, pn->pn_left))
         return false;
     PushStatement(bce, &stmtInfo, STMT_WITH, bce->offset());
     if (Emit1(cx, bce, JSOP_ENTERWITH) < 0)
         return false;
 
     if (!EmitTree(cx, bce, pn->pn_right))
         return false;
     if (Emit1(cx, bce, JSOP_LEAVEWITH) < 0)
         return false;
     return PopStatementBCE(cx, bce);
 }
 
 static bool
 EmitForIn(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushStatement(bce, &stmtInfo, STMT_FOR_IN_LOOP, top);
 
     ParseNode *forHead = pn->pn_left;
     ParseNode *forBody = pn->pn_right;
 
     ParseNode *pn1 = forHead->pn_kid1;
     bool letDecl = pn1 && pn1->isKind(PNK_LEXICALSCOPE);
     JS_ASSERT_IF(letDecl, pn1->isLet());
@@ -4786,17 +4785,17 @@ EmitForIn(JSContext *cx, BytecodeEmitter
      * object depending on the loop variant (for-in, for-each-in, or
      * destructuring for-in).
      */
     JS_ASSERT(pn->isOp(JSOP_ITER));
     if (Emit2(cx, bce, JSOP_ITER, (uint8_t) pn->pn_iflags) < 0)
         return false;
 
     /* Enter the block before the loop body, after evaluating the obj. */
-    StmtInfo letStmt;
+    StmtInfo letStmt(cx);
     if (letDecl) {
         PushBlockScope(bce, &letStmt, *blockObj, bce->offset());
         letStmt.flags |= SIF_FOR_BLOCK;
         if (!EmitEnterBlock(cx, bce, pn1, JSOP_ENTERLET1))
             return false;
     }
 
     /* Annotate so the decompiler can find the loop-closing jump. */
@@ -4896,17 +4895,17 @@ EmitForIn(JSContext *cx, BytecodeEmitter
     }
 
     return true;
 }
 
 static bool
 EmitNormalFor(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushStatement(bce, &stmtInfo, STMT_FOR_LOOP, top);
 
     ParseNode *forHead = pn->pn_left;
     ParseNode *forBody = pn->pn_right;
 
     /* C-style for (init; cond; update) ... loop. */
     JSOp op = JSOP_POP;
     ParseNode *pn3 = forHead->pn_kid1;
@@ -5053,17 +5052,17 @@ EmitFor(JSContext *cx, BytecodeEmitter *
 static JS_NEVER_INLINE bool
 EmitFunc(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
 {
 #if JS_HAS_XML_SUPPORT
     if (pn->isArity(PN_NULLARY))
         return Emit1(cx, bce, JSOP_GETFUNNS) >= 0;
 #endif
 
-    JSFunction *fun = pn->pn_funbox->function();
+    RootedVarFunction fun(cx, pn->pn_funbox->function());
     JS_ASSERT(fun->isInterpreted());
     if (fun->script()) {
         /*
          * This second pass is needed to emit JSOP_NOP with a source note
          * for the already-emitted function definition prolog opcode. See
          * comments in the PNK_STATEMENTLIST case.
          */
         JS_ASSERT(pn->isOp(JSOP_NOP));
@@ -5176,17 +5175,17 @@ EmitDo(JSContext *cx, BytecodeEmitter *b
 
     /* Compile the loop body. */
     ptrdiff_t top = EmitLoopHead(cx, bce, pn->pn_left);
     if (top < 0)
         return false;
     if (!EmitLoopEntry(cx, bce, NULL))
         return false;
 
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushStatement(bce, &stmtInfo, STMT_DO_LOOP, top);
     if (!EmitTree(cx, bce, pn->pn_left))
         return false;
 
     /* Set loop and enclosing label update offsets, for continue. */
     ptrdiff_t off = bce->offset();
     StmtInfo *stmt = &stmtInfo;
     do {
@@ -5229,17 +5228,17 @@ EmitWhile(JSContext *cx, BytecodeEmitter
      *  i    test at the top                 test at the bottom
      *  =    ===============                 ==================
      *  0    ifeq-pass                       goto; ifne-fail
      *  1    ifeq-fail; goto; ifne-pass      goto; ifne-pass; ifne-fail
      *  2    2*(ifeq-fail; goto); ifeq-pass  goto; 2*ifne-pass; ifne-fail
      *  . . .
      *  N    N*(ifeq-fail; goto); ifeq-pass  goto; N*ifne-pass; ifne-fail
      */
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushStatement(bce, &stmtInfo, STMT_WHILE_LOOP, top);
 
     ptrdiff_t noteIndex = NewSrcNote(cx, bce, SRC_WHILE);
     if (noteIndex < 0)
         return false;
 
     ptrdiff_t jmp = EmitJump(cx, bce, JSOP_GOTO, 0);
     if (jmp < 0)
@@ -5367,17 +5366,17 @@ EmitStatementList(JSContext *cx, Bytecod
     ptrdiff_t noteIndex = -1;
     ptrdiff_t tmp = bce->offset();
     if (pn->pn_xflags & PNX_NEEDBRACES) {
         noteIndex = NewSrcNote2(cx, bce, SRC_BRACE, 0);
         if (noteIndex < 0 || Emit1(cx, bce, JSOP_NOP) < 0)
             return false;
     }
 
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushStatement(bce, &stmtInfo, STMT_BLOCK, top);
 
     ParseNode *pnchild = pn->pn_head;
     if (pn->pn_xflags & PNX_FUNCDEFS) {
         /*
          * This block contains top-level function definitions. To ensure
          * that we emit the bytecode defining them before the rest of code
          * in the block we use a separate pass over functions. During the
@@ -5848,17 +5847,17 @@ EmitLabel(JSContext *cx, BytecodeEmitter
     if (noteIndex < 0)
         return false;
 
     ptrdiff_t top = EmitJump(cx, bce, JSOP_LABEL, 0);
     if (top < 0)
         return false;
 
     /* Emit code for the labeled statement. */
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushStatement(bce, &stmtInfo, STMT_LABEL, bce->offset());
     stmtInfo.label = atom;
     if (!EmitTree(cx, bce, pn2))
         return false;
     if (!PopStatementBCE(cx, bce))
         return false;
 
     /* Patch the JSOP_LABEL offset. */
@@ -5872,17 +5871,17 @@ EmitLabel(JSContext *cx, BytecodeEmitter
 
     return true;
 }
 
 static bool
 EmitSyntheticStatements(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, ptrdiff_t top)
 {
     JS_ASSERT(pn->isArity(PN_LIST));
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(cx);
     PushStatement(bce, &stmtInfo, STMT_SEQ, top);
     for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
         if (!EmitTree(cx, bce, pn2))
             return false;
     }
     return PopStatementBCE(cx, bce);
 }
 
@@ -5948,17 +5947,17 @@ EmitObject(JSContext *cx, BytecodeEmitte
     ptrdiff_t offset = bce->next() - bce->base();
     if (!EmitNewInit(cx, bce, JSProto_Object, pn))
         return false;
 
     /*
      * Try to construct the shape of the object as we go, so we can emit a
      * JSOP_NEWOBJECT with the final shape instead.
      */
-    JSObject *obj = NULL;
+    RootedVarObject obj(cx);
     if (bce->compileAndGo()) {
         gc::AllocKind kind = GuessObjectGCKind(pn->pn_count);
         obj = NewBuiltinClassInstance(cx, &ObjectClass, kind);
         if (!obj)
             return false;
     }
 
     for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {

--- a/js/src/frontend/BytecodeEmitter.h
+++ b/js/src/frontend/BytecodeEmitter.h
@@ -49,16 +49,18 @@
 #include "jsopcode.h"
 #include "jsscript.h"
 #include "jsprvtd.h"
 #include "jspubtd.h"
 
 #include "frontend/Parser.h"
 #include "frontend/ParseMaps.h"
 
+#include "vm/ScopeObject.h"
+
 namespace js {
 
 typedef HashSet<JSAtom *> FuncStmtSet;
 
 /*
  * NB: If you add enumerators for scope statements, add them between STMT_WITH
  * and STMT_CATCH, or you will break the STMT_TYPE_IS_SCOPE macro. If you add
  * non-looping statement enumerators, add them before STMT_DO_LOOP or you will
@@ -131,22 +133,22 @@ STMT_TYPE_IN_RANGE(uint16_t type, StmtTy
 
 struct StmtInfo {
     uint16_t        type;           /* statement type */
     uint16_t        flags;          /* flags, see below */
     uint32_t        blockid;        /* for simplified dominance computation */
     ptrdiff_t       update;         /* loop update offset (top if none) */
     ptrdiff_t       breaks;         /* offset of last break in loop */
     ptrdiff_t       continues;      /* offset of last continue in loop */
-    union {
-        JSAtom      *label;         /* name of LABEL */
-        StaticBlockObject *blockObj;/* block scope object */
-    };
+    RootedVarAtom   label;          /* name of LABEL */
+    RootedVar<StaticBlockObject *> blockObj; /* block scope object */
     StmtInfo        *down;          /* info for enclosing statement */
     StmtInfo        *downScope;     /* next enclosing lexical scope */
+
+    StmtInfo(JSContext *cx) : label(cx), blockObj(cx) {}
 };
 
 #define SIF_SCOPE        0x0001     /* statement has its own lexical scope */
 #define SIF_BODY_BLOCK   0x0002     /* STMT_BLOCK type is a function body */
 #define SIF_FOR_BLOCK    0x0004     /* for (let ...) induced block scope */
 
 /*
  * To reuse space in StmtInfo, rename breaks and continues for use during
@@ -331,36 +333,35 @@ struct TreeContext {                /* t
     uint32_t        bodyid;         /* block number of program/function body */
     uint32_t        blockidGen;     /* preincremented block number generator */
     uint32_t        parenDepth;     /* nesting depth of parens that might turn out
                                        to be generator expressions */
     uint32_t        yieldCount;     /* number of |yield| tokens encountered at
                                        non-zero depth in current paren tree */
     StmtInfo        *topStmt;       /* top of statement info stack */
     StmtInfo        *topScopeStmt;  /* top lexical scope statement */
-    StaticBlockObject *blockChain;  /* compile block scope chain (NB: one
+    RootedVar<StaticBlockObject *> blockChain;
+                                    /* compile time block scope chain (NB: one
                                        deeper than the topScopeStmt/downScope
                                        chain when in head of let block/expr) */
     ParseNode       *blockNode;     /* parse node for a block with let declarations
                                        (block with its own lexical scope)  */
     AtomDecls       decls;          /* function, const, and var declarations */
     Parser          *parser;        /* ptr to common parsing and lexing data */
     ParseNode       *yieldNode;     /* parse node for a yield expression that might
                                        be an error if we turn out to be inside a
                                        generator expression */
     ParseNode       *argumentsNode; /* parse node for an arguments variable that
                                        might be an error if we turn out to be
                                        inside a generator expression */
 
   private:
-    union {
-        JSFunction  *fun_;          /* function to store argument and variable
+    RootedVarFunction fun_;         /* function to store argument and variable
                                        names when flags & TCF_IN_FUNCTION */
-        JSObject    *scopeChain_;   /* scope chain object for the script */
-    };
+    RootedVarObject   scopeChain_;  /* scope chain object for the script */
 
   public:
     JSFunction *fun() const {
         JS_ASSERT(inFunction());
         return fun_;
     }
     void setFunction(JSFunction *fun) {
         JS_ASSERT(inFunction());
@@ -539,43 +540,51 @@ class GCConstList {
     GCConstList(JSContext *cx) : list(cx) {}
     bool append(Value v) { return list.append(v); }
     size_t length() const { return list.length(); }
     void finish(JSConstArray *array);
 };
 
 struct GlobalScope {
     GlobalScope(JSContext *cx, JSObject *globalObj, BytecodeEmitter *bce)
-      : globalObj(globalObj), bce(bce), defs(cx), names(cx)
+      : globalObj(cx, globalObj), bce(bce), defs(cx), names(cx),
+        defsRoot(cx, &defs), namesRoot(cx, &names)
     { }
 
     struct GlobalDef {
         JSAtom        *atom;        // If non-NULL, specifies the property name to add.
         FunctionBox   *funbox;      // If non-NULL, function value for the property.
                                     // This value is only set/used if atom is non-NULL.
         uint32_t      knownSlot;    // If atom is NULL, this is the known shape slot.
 
         GlobalDef() { }
         GlobalDef(uint32_t knownSlot) : atom(NULL), knownSlot(knownSlot) { }
         GlobalDef(JSAtom *atom, FunctionBox *box) : atom(atom), funbox(box) { }
     };
 
-    JSObject        *globalObj;
+    RootedVarObject globalObj;
     BytecodeEmitter *bce;
 
     /*
      * This is the table of global names encountered during parsing. Each
      * global name appears in the list only once, and the |names| table
      * maps back into |defs| for fast lookup.
      *
      * A definition may either specify an existing global property, or a new
      * one that must be added after compilation succeeds.
      */
     Vector<GlobalDef, 16> defs;
     AtomIndexMap      names;
+
+    /*
+     * Protect the inline elements within defs/names from being clobbered by
+     * root analysis. The atoms in this structure must be separately rooted.
+     */
+    JS::SkipRoot      defsRoot;
+    JS::SkipRoot      namesRoot;
 };
 
 struct BytecodeEmitter : public TreeContext
 {
     struct {
         jsbytecode  *base;          /* base of JS bytecode vector */
         jsbytecode  *limit;         /* one byte beyond end of bytecode */
         jsbytecode  *next;          /* pointer to next free bytecode */

--- a/js/src/frontend/FoldConstants.cpp
+++ b/js/src/frontend/FoldConstants.cpp
@@ -227,18 +227,18 @@ FoldBinaryNumeric(JSContext *cx, JSOp op
 
 static JSBool
 FoldXMLConstants(JSContext *cx, ParseNode *pn, TreeContext *tc)
 {
     JS_ASSERT(pn->isArity(PN_LIST));
     ParseNodeKind kind = pn->getKind();
     ParseNode **pnp = &pn->pn_head;
     ParseNode *pn1 = *pnp;
-    JSString *accum = NULL;
-    JSString *str = NULL;
+    RootedVarString accum(cx);
+    RootedVarString str(cx);
     if ((pn->pn_xflags & PNX_CANTFOLD) == 0) {
         if (kind == PNK_XMLETAGO)
             accum = cx->runtime->atomState.etagoAtom;
         else if (kind == PNK_XMLSTAGO || kind == PNK_XMLPTAGC)
             accum = cx->runtime->atomState.stagoAtom;
     }
 
     /*
@@ -742,25 +742,23 @@ js::FoldConstants(JSContext *cx, ParseNo
             pn->setOp(JSOP_STRING);
             pn->setArity(PN_NULLARY);
             break;
         }
 
         /* Handle a binary string concatenation. */
         JS_ASSERT(pn->isArity(PN_BINARY));
         if (pn1->isKind(PNK_STRING) || pn2->isKind(PNK_STRING)) {
-            JSString *left, *right, *str;
-
             if (!FoldType(cx, !pn1->isKind(PNK_STRING) ? pn1 : pn2, PNK_STRING))
                 return false;
             if (!pn1->isKind(PNK_STRING) || !pn2->isKind(PNK_STRING))
                 return true;
-            left = pn1->pn_atom;
-            right = pn2->pn_atom;
-            str = js_ConcatStrings(cx, left, right);
+            RootedVarString left(cx, pn1->pn_atom);
+            RootedVarString right(cx, pn2->pn_atom);
+            RootedVarString str(cx, js_ConcatStrings(cx, left, right));
             if (!str)
                 return false;
             pn->pn_atom = js_AtomizeString(cx, str);
             if (!pn->pn_atom)
                 return false;
             pn->setKind(PNK_STRING);
             pn->setOp(JSOP_STRING);
             pn->setArity(PN_NULLARY);

--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -169,16 +169,18 @@ Parser::setPrincipals(JSPrincipals *prin
     originPrincipals = originPrin;
     if (originPrincipals)
         JS_HoldPrincipals(originPrincipals);
 }
 
 ObjectBox *
 Parser::newObjectBox(JSObject *obj)
 {
+    JS_ASSERT(obj && !IsPoisonedPtr(obj));
+
     /*
      * We use JSContext.tempLifoAlloc to allocate parsed objects and place them
      * on a list in this Parser to ensure GC safety. Thus the tempLifoAlloc
      * arenas containing the entries must be alive until we are done with
      * scanning, parsing and code generation for the whole script or top-level
      * function.
      */
     ObjectBox *objbox = context->tempLifoAlloc().new_<ObjectBox>();
@@ -192,17 +194,17 @@ Parser::newObjectBox(JSObject *obj)
     objbox->object = obj;
     objbox->isFunctionBox = false;
     return objbox;
 }
 
 FunctionBox *
 Parser::newFunctionBox(JSObject *obj, ParseNode *fn, TreeContext *tc)
 {
-    JS_ASSERT(obj);
+    JS_ASSERT(obj && !IsPoisonedPtr(obj));
     JS_ASSERT(obj->isFunction());
 
     /*
      * We use JSContext.tempLifoAlloc to allocate parsed objects and place them
      * on a list in this Parser to ensure GC safety. Thus the tempLifoAlloc
      * arenas containing the entries must be alive until we are done with
      * scanning, parsing and code generation for the whole script or top-level
      * function.
@@ -578,30 +580,30 @@ CheckStrictParameters(JSContext *cx, Tre
 }
 
 static bool
 BindLocalVariable(JSContext *cx, TreeContext *tc, ParseNode *pn, BindingKind kind)
 {
     JS_ASSERT(kind == VARIABLE || kind == CONSTANT);
 
     unsigned index = tc->bindings.numVars();
-    if (!tc->bindings.add(cx, pn->pn_atom, kind))
+    if (!tc->bindings.add(cx, RootedVarAtom(cx, pn->pn_atom), kind))
         return false;
 
     pn->pn_cookie.set(tc->staticLevel, index);
     pn->pn_dflags |= PND_BOUND;
     return true;
 }
 
 ParseNode *
 Parser::functionBody(FunctionBodyType type)
 {
     JS_ASSERT(tc->inFunction());
 
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(context);
     PushStatement(tc, &stmtInfo, STMT_BLOCK, -1);
     stmtInfo.flags = SIF_BODY_BLOCK;
 
     unsigned oldflags = tc->flags;
     tc->flags &= ~(TCF_RETURN_EXPR | TCF_RETURN_VOID);
 
     ParseNode *pn;
     if (type == StatementListBody) {
@@ -641,17 +643,17 @@ Parser::functionBody(FunctionBodyType ty
 
     /*
      * Check CheckStrictParameters before arguments logic below adds
      * 'arguments' to bindings.
      */
     if (!CheckStrictParameters(context, tc))
         return NULL;
 
-    PropertyName * const arguments = context->runtime->atomState.argumentsAtom;
+    RootedVar<PropertyName*> const arguments(context, context->runtime->atomState.argumentsAtom);
 
     /*
      * Non-top-level functions use JSOP_DEFFUN which is a dynamic scope
      * operation which means it aliases any bindings with the same name.
      * Due to the implicit declaration mechanism (below), 'arguments' will not
      * have decls and, even if it did, they will not be noted as closed in the
      * emitter. Thus, in the corner case of function-statement-overridding-
      * arguments, flag the whole scope as dynamic.
@@ -1349,17 +1351,17 @@ Parser::functionArguments(TreeContext &f
                 }
                 list->append(item);
                 break;
               }
 #endif /* JS_HAS_DESTRUCTURING */
 
               case TOK_NAME:
               {
-                PropertyName *name = tokenStream.currentToken().name();
+                RootedVar<PropertyName*> name(context, tokenStream.currentToken().name());
 
 #ifdef JS_HAS_DESTRUCTURING
                 /*
                  * ECMA-262 requires us to support duplicate parameter names,
                  * but if the parameter list includes destructuring, we
                  * consider the code to have "opted in" to higher standards and
                  * forbid duplicates. We may see a destructuring parameter
                  * later, so always note duplicates now.
@@ -1409,17 +1411,17 @@ Parser::functionArguments(TreeContext &f
             return false;
         }
     }
 
     return true;
 }
 
 ParseNode *
-Parser::functionDef(PropertyName *funName, FunctionType type, FunctionSyntaxKind kind)
+Parser::functionDef(HandlePropertyName funName, FunctionType type, FunctionSyntaxKind kind)
 {
     JS_ASSERT_IF(kind == Statement, funName);
 
     /* Make a TOK_FUNCTION node. */
     ParseNode *pn = FunctionNode::create(PNK_FUNCTION, tc);
     if (!pn)
         return NULL;
     pn->pn_body = NULL;
@@ -1532,17 +1534,17 @@ Parser::functionDef(PropertyName *funNam
     TreeContext funtc(tc->parser);
     if (!funtc.init(context))
         return NULL;
 
     FunctionBox *funbox = EnterFunction(pn, &funtc, funName, kind);
     if (!funbox)
         return NULL;
 
-    JSFunction *fun = funbox->function();
+    RootedVarFunction fun(context, funbox->function());
 
     /* Now parse formal argument list and compute fun->nargs. */
     ParseNode *prelude = NULL;
     if (!functionArguments(funtc, funbox, &prelude))
         return NULL;
 
     fun->setArgCount(funtc.bindings.numArgs());
 
@@ -1722,17 +1724,17 @@ Parser::functionDef(PropertyName *funNam
         tokenStream.setStrictMode(false);
 
     return pn;
 }
 
 ParseNode *
 Parser::functionStmt()
 {
-    PropertyName *name = NULL;
+    RootedVarPropertyName name(context);
     if (tokenStream.getToken(TSF_KEYWORD_IS_NAME) == TOK_NAME) {
         name = tokenStream.currentToken().name();
     } else {
         /* Unnamed function expressions are forbidden in statement context. */
         reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_UNNAMED_FUNCTION_STMT);
         return NULL;
     }
 
@@ -1743,17 +1745,17 @@ Parser::functionStmt()
     }
 
     return functionDef(name, Normal, Statement);
 }
 
 ParseNode *
 Parser::functionExpr()
 {
-    PropertyName *name = NULL;
+    RootedVarPropertyName name(context);
     if (tokenStream.getToken(TSF_KEYWORD_IS_NAME) == TOK_NAME)
         name = tokenStream.currentToken().name();
     else
         tokenStream.ungetToken();
     return functionDef(name, Normal, Expression);
 }
 
 /*
@@ -1963,18 +1965,18 @@ ReportRedeclaration(JSContext *cx, TreeC
  */
 static JSBool
 BindLet(JSContext *cx, BindData *data, JSAtom *atom, TreeContext *tc)
 {
     ParseNode *pn = data->pn;
     if (!CheckStrictBinding(cx, tc, atom->asPropertyName(), pn))
         return false;
 
-    StaticBlockObject &blockObj = *data->let.blockObj;
-    unsigned blockCount = blockObj.slotCount();
+    RootedVar<StaticBlockObject *> blockObj(cx, data->let.blockObj);
+    unsigned blockCount = blockObj->slotCount();
     if (blockCount == JS_BIT(16)) {
         ReportCompileErrorNumber(cx, TS(tc->parser), pn,
                                  JSREPORT_ERROR, data->let.overflow);
         return false;
     }
 
     /*
      * For bindings that are hoisted to the beginning of the block/function,
@@ -2001,25 +2003,25 @@ BindLet(JSContext *cx, BindData *data, J
     pn->pn_dflags |= PND_LET | PND_BOUND;
 
     /*
      * Define the let binding's property before storing pn in the the binding's
      * slot indexed by blockCount off the class-reserved slot base.
      */
     bool redeclared;
     jsid id = ATOM_TO_JSID(atom);
-    const Shape *shape = blockObj.addVar(cx, id, blockCount, &redeclared);
+    const Shape *shape = blockObj->addVar(cx, id, blockCount, &redeclared);
     if (!shape) {
         if (redeclared)
             ReportRedeclaration(cx, tc, pn, false, atom);
         return false;
     }
 
     /* Store pn in the static block object. */
-    blockObj.setDefinitionParseNode(blockCount, reinterpret_cast<Definition *>(pn));
+    blockObj->setDefinitionParseNode(blockCount, reinterpret_cast<Definition *>(pn));
     return true;
 }
 
 template <class Op>
 static inline bool
 ForEachLetDef(TreeContext *tc, StaticBlockObject &blockObj, Op op)
 {
     for (Shape::Range r = blockObj.lastProperty()->all(); !r.empty(); r.popFront()) {
@@ -2080,21 +2082,22 @@ OuterLet(TreeContext *tc, StmtInfo *stmt
  * gets its own script and frame. The eval-from-function-code case is harder,
  * since functions do not atomize gvars and then reserve their atom indexes as
  * stack frame slots.
  */
 static bool
 DefineGlobal(ParseNode *pn, BytecodeEmitter *bce, PropertyName *name)
 {
     GlobalScope *globalScope = bce->globalScope;
-    JSObject *globalObj = globalScope->globalObj;
+    HandleObject globalObj = globalScope->globalObj;
 
     if (!bce->compileAndGo() || !globalObj || bce->compilingForEval())
         return true;
 
+    JS_ASSERT(!IsPoisonedPtr(name));
     AtomIndexAddPtr p = globalScope->names.lookupForAdd(name);
     if (!p) {
         JSContext *cx = bce->parser->context;
 
         JSObject *holder;
         JSProperty *prop;
         if (!globalObj->lookupProperty(cx, name, &holder, &prop))
             return false;
@@ -2122,16 +2125,18 @@ DefineGlobal(ParseNode *pn, BytecodeEmit
             def = GlobalScope::GlobalDef(shape->slot());
         } else {
             def = GlobalScope::GlobalDef(name, funbox);
         }
 
         if (!globalScope->defs.append(def))
             return false;
 
+        JS_ASSERT(!IsPoisonedPtr(name));
+
         jsatomid index = globalScope->names.count();
         if (!globalScope->names.add(p, name, index))
             return false;
 
         JS_ASSERT(index == globalScope->defs.length() - 1);
     } else {
         /*
          * Functions can be redeclared, and the last one takes effect. Check
@@ -2586,17 +2591,18 @@ CheckDestructuring(JSContext *cx, BindDa
     bool ok;
 
     if (left->isKind(PNK_ARRAYCOMP)) {
         ReportCompileErrorNumber(cx, TS(tc->parser), left, JSREPORT_ERROR,
                                  JSMSG_ARRAY_COMP_LEFTSIDE);
         return false;
     }
 
-    StaticBlockObject *blockObj = data && data->binder == BindLet ? data->let.blockObj : NULL;
+    RootedVar<StaticBlockObject *> blockObj(cx);
+    blockObj = data && data->binder == BindLet ? data->let.blockObj : NULL;
     uint32_t blockCountBefore = blockObj ? blockObj->slotCount() : 0;
 
     if (left->isKind(PNK_RB)) {
         for (ParseNode *pn = left->pn_head; pn; pn = pn->pn_next) {
             /* Nullary comma is an elision; binary comma is an expression.*/
             if (!pn->isArrayHole()) {
                 if (pn->isKind(PNK_RB) || pn->isKind(PNK_RC)) {
                     ok = CheckDestructuring(cx, data, pn, tc, false);
@@ -2897,17 +2903,17 @@ Parser::letBlock(LetContext letContext)
     MUST_MATCH_TOKEN(TOK_LP, JSMSG_PAREN_BEFORE_LET);
 
     ParseNode *vars = variables(PNK_LET, blockObj, DontHoistVars);
     if (!vars)
         return NULL;
 
     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_LET);
 
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(context);
     ParseNode *block = PushLetScope(context, tc, *blockObj, &stmtInfo);
     if (!block)
         return NULL;
 
     pnlet->pn_left = vars;
     pnlet->pn_right = block;
 
     ParseNode *ret;
@@ -3032,17 +3038,17 @@ Parser::switchStatement()
 
     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_SWITCH);
     MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_SWITCH);
 
     /*
      * NB: we must push stmtInfo before calling GenerateBlockIdForStmtNode
      * because that function states tc->topStmt->blockid.
      */
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(context);
     PushStatement(tc, &stmtInfo, STMT_SWITCH, -1);
 
     /* pn2 is a list of case nodes. The default case has pn_left == NULL */
     ParseNode *pn2 = ListNode::create(PNK_STATEMENTLIST, tc);
     if (!pn2)
         return NULL;
     pn2->makeEmpty();
     if (!GenerateBlockIdForStmtNode(pn2, tc))
@@ -3154,17 +3160,17 @@ Parser::forStatement()
 {
     JS_ASSERT(tokenStream.isCurrentTokenType(TOK_FOR));
 
     /* A FOR node is binary, left is loop control and right is the body. */
     ParseNode *pn = BinaryNode::create(PNK_FOR, tc);
     if (!pn)
         return NULL;
 
-    StmtInfo forStmt;
+    StmtInfo forStmt(context);
     PushStatement(tc, &forStmt, STMT_FOR_LOOP, -1);
 
     pn->setOp(JSOP_ITER);
     pn->pn_iflags = 0;
     if (tokenStream.matchToken(TOK_NAME)) {
         if (tokenStream.currentToken().name() == context->runtime->atomState.eachAtom)
             pn->pn_iflags = JSITER_FOREACH;
         else
@@ -3246,19 +3252,19 @@ Parser::forStatement()
     ParseNode *forParent = NULL;
 
     /*
      * We can be sure that it's a for/in loop if there's still an 'in'
      * keyword here, even if JavaScript recognizes 'in' as an operator,
      * as we've excluded 'in' from being parsed in RelExpr by setting
      * the TCF_IN_FOR_INIT flag in our TreeContext.
      */
-    ParseNode *forHead;     /* initialized by both branches. */
-    StmtInfo letStmt;       /* used if blockObj != NULL. */
-    ParseNode *pn2, *pn3;   /* forHead->pn_kid1 and pn_kid2. */
+    ParseNode *forHead;        /* initialized by both branches. */
+    StmtInfo letStmt(context); /* used if blockObj != NULL. */
+    ParseNode *pn2, *pn3;      /* forHead->pn_kid1 and pn_kid2. */
     bool forOf;
     if (pn1 && matchInOrOf(&forOf)) {
         /*
          * Parse the rest of the for/in or for/of head.
          *
          * Here pn1 is everything to the left of 'in' or 'of'. At the end of
          * this block, pn1 is a decl or NULL, pn2 is the assignment target that
          * receives the enumeration value each iteration, and pn3 is the rhs of
@@ -3547,17 +3553,17 @@ Parser::tryStatement()
      * finally nodes are TOK_LC statement lists.
      */
     ParseNode *pn = TernaryNode::create(PNK_TRY, tc);
     if (!pn)
         return NULL;
     pn->setOp(JSOP_NOP);
 
     MUST_MATCH_TOKEN(TOK_LC, JSMSG_CURLY_BEFORE_TRY);
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(context);
     if (!PushBlocklikeStatement(&stmtInfo, STMT_TRY, tc))
         return NULL;
     pn->pn_kid1 = statements();
     if (!pn->pn_kid1)
         return NULL;
     MUST_MATCH_TOKEN(TOK_RC, JSMSG_CURLY_AFTER_TRY);
     PopStatement(tc);
 
@@ -3714,17 +3720,17 @@ Parser::withStatement()
     if (!pn2)
         return NULL;
     MUST_MATCH_TOKEN(TOK_RP, JSMSG_PAREN_AFTER_WITH);
     pn->pn_left = pn2;
 
     ParseNode *oldWith = tc->innermostWith;
     tc->innermostWith = pn;
 
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(context);
     PushStatement(tc, &stmtInfo, STMT_WITH, -1);
     pn2 = statement();
     if (!pn2)
         return NULL;
     PopStatement(tc);
 
     pn->pn_pos.end = pn2->pn_pos.end;
     pn->pn_right = pn2;
@@ -3885,17 +3891,17 @@ Parser::expressionStatement()
                 return NULL;
             }
         }
         ForgetUse(pn2);
 
         (void) tokenStream.getToken();
 
         /* Push a label struct and parse the statement. */
-        StmtInfo stmtInfo;
+        StmtInfo stmtInfo(context);
         PushStatement(tc, &stmtInfo, STMT_LABEL, -1);
         stmtInfo.label = label;
         ParseNode *pn = statement();
         if (!pn)
             return NULL;
 
         /* Normalize empty statement to empty block for the decompiler. */
         if (pn->isKind(PNK_SEMI) && !pn->pn_kid) {
@@ -3966,17 +3972,17 @@ Parser::statement()
         /* An IF node has three kids: condition, then, and optional else. */
         pn = TernaryNode::create(PNK_IF, tc);
         if (!pn)
             return NULL;
         ParseNode *pn1 = condition();
         if (!pn1)
             return NULL;
 
-        StmtInfo stmtInfo;
+        StmtInfo stmtInfo(context);
         PushStatement(tc, &stmtInfo, STMT_IF, -1);
         ParseNode *pn2 = statement();
         if (!pn2)
             return NULL;
 
         if (pn2->isKind(PNK_SEMI) &&
             !pn2->pn_kid &&
             !reportErrorNumber(NULL, JSREPORT_WARNING | JSREPORT_STRICT, JSMSG_EMPTY_CONSEQUENT))
@@ -4005,17 +4011,17 @@ Parser::statement()
       case TOK_SWITCH:
         return switchStatement();
 
       case TOK_WHILE:
       {
         pn = BinaryNode::create(PNK_WHILE, tc);
         if (!pn)
             return NULL;
-        StmtInfo stmtInfo;
+        StmtInfo stmtInfo(context);
         PushStatement(tc, &stmtInfo, STMT_WHILE_LOOP, -1);
         ParseNode *pn2 = condition();
         if (!pn2)
             return NULL;
         pn->pn_left = pn2;
         ParseNode *pn3 = statement();
         if (!pn3)
             return NULL;
@@ -4025,17 +4031,17 @@ Parser::statement()
         return pn;
       }
 
       case TOK_DO:
       {
         pn = BinaryNode::create(PNK_DOWHILE, tc);
         if (!pn)
             return NULL;
-        StmtInfo stmtInfo;
+        StmtInfo stmtInfo(context);
         PushStatement(tc, &stmtInfo, STMT_DO_LOOP, -1);
         ParseNode *pn2 = statement();
         if (!pn2)
             return NULL;
         pn->pn_left = pn2;
         MUST_MATCH_TOKEN(TOK_WHILE, JSMSG_WHILE_AFTER_DO);
         ParseNode *pn3 = condition();
         if (!pn3)
@@ -4202,17 +4208,17 @@ Parser::statement()
         break;
 
       case TOK_LC:
       {
         unsigned oldflags;
 
         oldflags = tc->flags;
         tc->flags = oldflags & ~TCF_HAS_FUNCTION_STMT;
-        StmtInfo stmtInfo;
+        StmtInfo stmtInfo(context);
         if (!PushBlocklikeStatement(&stmtInfo, STMT_BLOCK, tc))
             return NULL;
         pn = statements();
         if (!pn)
             return NULL;
 
         MUST_MATCH_TOKEN(TOK_RC, JSMSG_CURLY_IN_COMPOUND);
         PopStatement(tc);
@@ -5303,17 +5309,17 @@ CompExprTransplanter::transplant(ParseNo
  * (possibly nested) for-loop, initialized by |kind, op, kid|.
  */
 ParseNode *
 Parser::comprehensionTail(ParseNode *kid, unsigned blockid, bool isGenexp,
                           ParseNodeKind kind, JSOp op)
 {
     unsigned adjust;
     ParseNode *pn, *pn2, *pn3, **pnp;
-    StmtInfo stmtInfo;
+    StmtInfo stmtInfo(context);
     BindData data;
     TokenKind tt;
 
     JS_ASSERT(tokenStream.currentToken().type == TOK_FOR);
 
     if (kind == PNK_SEMI) {
         /*
          * Generator expression desugars to an immediately applied lambda that
@@ -5752,17 +5758,17 @@ Parser::memberExpr(JSBool allowCallSynta
 #if JS_HAS_XML_SUPPORT
             else if (!tc->inStrictMode()) {
                 TokenPtr begin = lhs->pn_pos.begin;
                 if (tt == TOK_LP) {
                     /* Filters are effectively 'with', so deoptimize names. */
                     tc->flags |= TCF_FUN_HEAVYWEIGHT;
                     tc->noteBindingsAccessedDynamically();
 
-                    StmtInfo stmtInfo;
+                    StmtInfo stmtInfo(context);
                     ParseNode *oldWith = tc->innermostWith;
                     tc->innermostWith = lhs;
                     PushStatement(tc, &stmtInfo, STMT_WITH, -1);
 
                     ParseNode *filter = bracketedExpr();
                     if (!filter)
                         return NULL;
                     filter->setInParens(true);
@@ -6929,17 +6935,18 @@ Parser::primaryExpr(TokenKind tt, bool a
                             return NULL;
                         pn3->pn_atom = atom;
                         break;
                     }
 
                     pn->pn_xflags |= PNX_NONCONST;
 
                     /* NB: Getter function in { get x(){} } is unnamed. */
-                    pn2 = functionDef(NULL, op == JSOP_GETTER ? Getter : Setter, Expression);
+                    pn2 = functionDef(RootedVarPropertyName(context, NULL),
+                                      op == JSOP_GETTER ? Getter : Setter, Expression);
                     if (!pn2)
                         return NULL;
                     TokenPos pos = {begin, pn2->pn_pos.end};
                     pn2 = new_<BinaryNode>(PNK_COLON, op, pos, pn3, pn2);
                     goto skip;
                 }
               case TOK_STRING: {
                 atom = tokenStream.currentToken().atom();
@@ -7142,17 +7149,17 @@ Parser::primaryExpr(TokenKind tt, bool a
         if (!pn)
             return NULL;
 
         const jschar *chars = tokenStream.getTokenbuf().begin();
         size_t length = tokenStream.getTokenbuf().length();
         RegExpFlag flags = tokenStream.currentToken().regExpFlags();
         RegExpStatics *res = context->regExpStatics();
 
-        RegExpObject *reobj;
+        RootedVar<RegExpObject*> reobj(context);
         if (context->hasfp())
             reobj = RegExpObject::create(context, res, chars, length, flags, &tokenStream);
         else
             reobj = RegExpObject::createNoStatics(context, chars, length, flags, &tokenStream);
 
         if (!reobj)
             return NULL;
 

--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -238,17 +238,17 @@ struct Parser : private AutoGCRooter
     ParseNode *parenExpr(JSBool *genexp = NULL);
 
     /*
      * Additional JS parsers.
      */
     enum FunctionType { Getter, Setter, Normal };
     bool functionArguments(TreeContext &funtc, FunctionBox *funbox, ParseNode **list);
 
-    ParseNode *functionDef(PropertyName *name, FunctionType type, FunctionSyntaxKind kind);
+    ParseNode *functionDef(HandlePropertyName name, FunctionType type, FunctionSyntaxKind kind);
 
     ParseNode *unaryOpExpr(ParseNodeKind kind, JSOp op);
 
     ParseNode *condition();
     ParseNode *comprehensionTail(ParseNode *kid, unsigned blockid, bool isGenexp,
                                  ParseNodeKind kind = PNK_SEMI, JSOp op = JSOP_NOP);
     ParseNode *generatorExpr(ParseNode *kid);
     JSBool argumentList(ParseNode *listNode);

--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -149,17 +149,18 @@ js::IsIdentifier(JSLinearString *str)
 
 #ifdef _MSC_VER
 #pragma warning(push)
 #pragma warning(disable:4351)
 #endif
 
 /* Initialize members that aren't initialized in |init|. */
 TokenStream::TokenStream(JSContext *cx, JSPrincipals *prin, JSPrincipals *originPrin)
-  : tokens(), cursor(), lookahead(), flags(), listenerTSData(), tokenbuf(cx),
+  : tokens(), tokensRoot(cx, &tokens),
+    cursor(), lookahead(), flags(), userbufRoot(cx, &userbuf), listenerTSData(), tokenbuf(cx),
     cx(cx), originPrincipals(JSScript::normalizeOriginPrincipals(prin, originPrin))
 {
     if (originPrincipals)
         JS_HoldPrincipals(originPrincipals);
 }
 
 #ifdef _MSC_VER
 #pragma warning(pop)

--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -331,30 +331,34 @@ struct Token {
 
     /*
      * FIXME: Init type early enough such that all mutators can assert
      *        type-safety.  See bug 697000.
      */
 
     void setName(JSOp op, PropertyName *name) {
         JS_ASSERT(op == JSOP_NAME);
+        JS_ASSERT(!IsPoisonedPtr(name));
         u.s.op = op;
         u.s.n.name = name;
     }
 
     void setAtom(JSOp op, JSAtom *atom) {
         JS_ASSERT(op == JSOP_STRING || op == JSOP_XMLCOMMENT || JSOP_XMLCDATA);
+        JS_ASSERT(!IsPoisonedPtr(atom));
         u.s.op = op;
         u.s.n.atom = atom;
     }
 
     void setProcessingInstruction(PropertyName *target, JSAtom *data) {
         JS_ASSERT(target);
         JS_ASSERT(data);
         JS_ASSERT(!target->empty());
+        JS_ASSERT(!IsPoisonedPtr(target));
+        JS_ASSERT(!IsPoisonedPtr(data));
         u.xmlpi.target = target;
         u.xmlpi.data = data;
     }
 
     void setRegExpFlags(js::RegExpFlag flags) {
         JS_ASSERT((flags & AllFlags) == flags);
         u.reflags = flags;
     }
@@ -803,23 +807,25 @@ class TokenStream
         while (--n >= 0)
             getChar();
     }
 
     void updateLineInfoForEOL();
     void updateFlagsForEOL();
 
     Token               tokens[ntokens];/* circular token buffer */
-    unsigned               cursor;         /* index of last parsed token */
-    unsigned               lookahead;      /* count of lookahead tokens */
-    unsigned               lineno;         /* current line number */
-    unsigned               flags;          /* flags -- see above */
+    JS::SkipRoot        tokensRoot;     /* prevent overwriting of token buffer */
+    unsigned            cursor;         /* index of last parsed token */
+    unsigned            lookahead;      /* count of lookahead tokens */
+    unsigned            lineno;         /* current line number */
+    unsigned            flags;          /* flags -- see above */
     const jschar        *linebase;      /* start of current line;  points into userbuf */
     const jschar        *prevLinebase;  /* start of previous line;  NULL if on the first line */
     TokenBuf            userbuf;        /* user input buffer */
+    JS::SkipRoot        userbufRoot;    /* prevent overwriting of char pointers within userbuf */
     const char          *filename;      /* input filename or null */
     jschar              *sourceMap;     /* source map's filename or null */
     void                *listenerTSData;/* listener data for this TokenStream */
     CharBuffer          tokenbuf;       /* current token string buffer */
     int8_t              oneCharTokens[128];  /* table of one-char tokens */
     bool                maybeEOL[256];       /* probabilistic EOL lookup table */
     bool                maybeStrSpecial[256];/* speeds up string scanning */
     JSVersion           version;        /* (i.e. to identify keywords) */

--- a/js/src/gc/Barrier-inl.h
+++ b/js/src/gc/Barrier-inl.h
@@ -119,16 +119,17 @@ HeapValue::init(const Value &v)
     JS_ASSERT(!IsPoisonedValue(v));
     value = v;
     post();
 }
 
 inline void
 HeapValue::init(JSCompartment *comp, const Value &v)
 {
+    JS_ASSERT(!IsPoisonedValue(v));
     value = v;
     post(comp);
 }
 
 inline HeapValue &
 HeapValue::operator=(const Value &v)
 {
     pre();

--- a/js/src/gc/Root.h
+++ b/js/src/gc/Root.h
@@ -35,20 +35,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef jsgc_root_h__
 #define jsgc_root_h__
 
-#include "jsapi.h"
-#include "jsprvtd.h"
+#include "jspubtd.h"
 
-namespace js {
+#ifdef __cplusplus
+
+namespace JS {
 
 /*
  * Moving GC Stack Rooting
  *
  * A moving GC may change the physical location of GC allocated things, even
  * when they are rooted, updating all pointers to the thing to refer to its new
  * location. The GC must therefore know about all live pointers to a thing,
  * not just one of them, in order to behave correctly.
@@ -87,43 +88,65 @@ namespace js {
  *   should generally replace those arguments with handles and avoid any
  *   explicit rooting. This has two benefits. First, when several such
  *   functions call each other then redundant rooting of multiple copies of the
  *   GC thing can be avoided. Second, if the caller does not pass a rooted
  *   value a compile error will be generated, which is quicker and easier to
  *   fix than when relying on a separate rooting analysis.
  */
 
-template <> struct RootMethods<const jsid>
+template <typename T> class Root;
+template <typename T> class RootedVar;
+
+template <typename T>
+struct RootMethods { };
+
+/*
+ * Reference to a stack location rooted for GC. See "Moving GC Stack Rooting"
+ * comment in jscntxt.h.
+ */
+template <typename T>
+class Handle
 {
-    static jsid initial() { return JSID_VOID; }
-    static ThingRootKind kind() { return THING_ROOT_ID; }
-    static bool poisoned(jsid id) { return IsPoisonedId(id); }
-};
+  public:
+    /* Copy handles of different types, with implicit coercion. */
+    template <typename S> Handle(Handle<S> handle) {
+        testAssign<S>();
+        ptr = reinterpret_cast<const T *>(handle.address());
+    }
+
+    /* Get a handle from a rooted stack location, with implicit coercion. */
+    template <typename S> inline Handle(const Root<S> &root);
+    template <typename S> inline Handle(const RootedVar<S> &root);
+
+    const T *address() { return ptr; }
 
-template <> struct RootMethods<jsid>
-{
-    static jsid initial() { return JSID_VOID; }
-    static ThingRootKind kind() { return THING_ROOT_ID; }
-    static bool poisoned(jsid id) { return IsPoisonedId(id); }
+    operator T () { return value(); }
+    T operator ->() { return value(); }
+
+  private:
+    const T *ptr;
+    T value() { return *ptr; }
+
+    template <typename S>
+    void testAssign() {
+#ifdef DEBUG
+        T a = RootMethods<T>::initial();
+        S b = RootMethods<S>::initial();
+        a = b;
+        (void)a;
+#endif
+    }
 };
 
-template <> struct RootMethods<const Value>
-{
-    static Value initial() { return UndefinedValue(); }
-    static ThingRootKind kind() { return THING_ROOT_VALUE; }
-    static bool poisoned(const Value &v) { return IsPoisonedValue(v); }
-};
-
-template <> struct RootMethods<Value>
-{
-    static Value initial() { return UndefinedValue(); }
-    static ThingRootKind kind() { return THING_ROOT_VALUE; }
-    static bool poisoned(const Value &v) { return IsPoisonedValue(v); }
-};
+typedef Handle<JSObject*>    HandleObject;
+typedef Handle<JSFunction*>  HandleFunction;
+typedef Handle<JSString*>    HandleString;
+typedef Handle<jsid>         HandleId;
+typedef Handle<Value>        HandleValue;
 
 template <typename T>
 struct RootMethods<T *>
 {
     static T *initial() { return NULL; }
     static ThingRootKind kind() { return T::rootKind(); }
     static bool poisoned(T *v) { return IsPoisonedPtr(v); }
 };
@@ -137,20 +160,22 @@ struct RootMethods<T *>
  * initialized, as otherwise the GC may try to use the the uninitialized value.
  * It is generally preferable to use either RootedVar for local variables, or
  * Handle for arguments.
  */
 template <typename T>
 class Root
 {
   public:
-    Root(JSContext *cx, const T *ptr
+    Root(JSContext *cx_, const T *ptr
          JS_GUARD_OBJECT_NOTIFIER_PARAM)
     {
 #ifdef JSGC_ROOT_ANALYSIS
+        ContextFriendFields *cx = ContextFriendFields::get(cx_);
+
         ThingRootKind kind = RootMethods<T>::kind();
         this->stack = reinterpret_cast<Root<T>**>(&cx->thingGCRooters[kind]);
         this->prev = *stack;
         *stack = this;
 #endif
 
         JS_ASSERT(!RootMethods<T>::poisoned(*ptr));
 
@@ -186,63 +211,68 @@ class Root
 template<typename T> template <typename S>
 inline
 Handle<T>::Handle(const Root<S> &root)
 {
     testAssign<S>();
     ptr = reinterpret_cast<const T *>(root.address());
 }
 
-typedef Root<JSObject*>          RootObject;
-typedef Root<JSFunction*>        RootFunction;
-typedef Root<Shape*>             RootShape;
-typedef Root<BaseShape*>         RootBaseShape;
-typedef Root<types::TypeObject*> RootTypeObject;
-typedef Root<JSString*>          RootString;
-typedef Root<JSAtom*>            RootAtom;
-typedef Root<jsid>               RootId;
-typedef Root<Value>              RootValue;
+typedef Root<JSObject*>    RootObject;
+typedef Root<JSFunction*>  RootFunction;
+typedef Root<JSString*>    RootString;
+typedef Root<jsid>         RootId;
+typedef Root<Value>        RootValue;
 
-/* Mark a stack location as a root for a rooting analysis. */
-class CheckRoot
+/*
+ * Mark a stack location as a root for the rooting analysis, without actually
+ * rooting it in release builds. This should only be used for stack locations
+ * of GC things that cannot be relocated by a garbage collection, and that
+ * are definitely reachable via another path.
+ */
+class SkipRoot
 {
 #if defined(DEBUG) && defined(JSGC_ROOT_ANALYSIS)
 
-    CheckRoot **stack, *prev;
-    const uint8_t *ptr;
+    SkipRoot **stack, *prev;
+    const uint8_t *start;
+    const uint8_t *end;
 
   public:
     template <typename T>
-    CheckRoot(JSContext *cx, const T *ptr
+    SkipRoot(JSContext *cx_, const T *ptr
               JS_GUARD_OBJECT_NOTIFIER_PARAM)
     {
-        this->stack = &cx->checkGCRooters;
+        ContextFriendFields *cx = ContextFriendFields::get(cx_);
+
+        this->stack = &cx->skipGCRooters;
         this->prev = *stack;
         *stack = this;
-        this->ptr = static_cast<const uint8_t*>(ptr);
+        this->start = (const uint8_t *) ptr;
+        this->end = this->start + sizeof(T);
         JS_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
-    ~CheckRoot()
+    ~SkipRoot()
     {
         JS_ASSERT(*stack == this);
         *stack = prev;
     }
 
-    CheckRoot *previous() { return prev; }
+    SkipRoot *previous() { return prev; }
 
     bool contains(const uint8_t *v, size_t len) {
-        return ptr >= v && ptr < v + len;
+        return v >= start && v + len <= end;
     }
 
 #else /* DEBUG && JSGC_ROOT_ANALYSIS */
 
   public:
     template <typename T>
-    CheckRoot(JSContext *cx, const T *ptr
+    SkipRoot(JSContext *cx, const T *ptr
               JS_GUARD_OBJECT_NOTIFIER_PARAM)
     {
         JS_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
 #endif /* DEBUG && JSGC_ROOT_ANALYSIS */
 
     JS_DECL_USE_GUARD_OBJECT_NOTIFIER
@@ -256,45 +286,54 @@ class RootedVar
     RootedVar(JSContext *cx)
         : ptr(RootMethods<T>::initial()), root(cx, &ptr)
     {}
 
     RootedVar(JSContext *cx, T initial)
         : ptr(initial), root(cx, &ptr)
     {}
 
-    operator T () { return ptr; }
-    T operator ->() { return ptr; }
+    RootedVar() MOZ_DELETE;
+    RootedVar(const RootedVar &) MOZ_DELETE;
+
+    operator T () const { return ptr; }
+    T operator ->() const { return ptr; }
     T * address() { return &ptr; }
     const T * address() const { return &ptr; }
+    T & reference() { return ptr; }
     T raw() { return ptr; }
 
     T & operator =(T value)
     {
         JS_ASSERT(!RootMethods<T>::poisoned(value));
         ptr = value;
         return ptr;
     }
 
+    T & operator =(const RootedVar &value)
+    {
+        ptr = value;
+        return ptr;
+    }
+
   private:
     T ptr;
     Root<T> root;
 };
 
 template <typename T> template <typename S>
 inline
 Handle<T>::Handle(const RootedVar<S> &root)
 {
     ptr = reinterpret_cast<const T *>(root.address());
 }
 
-typedef RootedVar<JSObject*>          RootedVarObject;
-typedef RootedVar<JSFunction*>        RootedVarFunction;
-typedef RootedVar<Shape*>             RootedVarShape;
-typedef RootedVar<BaseShape*>         RootedVarBaseShape;
-typedef RootedVar<types::TypeObject*> RootedVarTypeObject;
-typedef RootedVar<JSString*>          RootedVarString;
-typedef RootedVar<JSAtom*>            RootedVarAtom;
-typedef RootedVar<jsid>               RootedVarId;
-typedef RootedVar<Value>              RootedVarValue;
+typedef RootedVar<JSObject*>    RootedVarObject;
+typedef RootedVar<JSFunction*>  RootedVarFunction;
+typedef RootedVar<JSString*>    RootedVarString;
+typedef RootedVar<jsid>         RootedVarId;
+typedef RootedVar<Value>        RootedVarValue;
 
-}  /* namespace js */
+}  /* namespace JS */
+
+#endif  /* __cplusplus */
+
 #endif  /* jsgc_root_h___ */

--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3078,17 +3078,17 @@ JS_ResolveStub(JSContext *cx, JSObject *
     return JS_TRUE;
 }
 
 JS_PUBLIC_API(JSBool)
 JS_ConvertStub(JSContext *cx, JSObject *obj, JSType type, jsval *vp)
 {
     JS_ASSERT(type != JSTYPE_OBJECT && type != JSTYPE_FUNCTION);
     JS_ASSERT(obj);
-    return DefaultValue(cx, obj, type, vp);
+    return DefaultValue(cx, RootedVarObject(cx, obj), type, vp);
 }
 
 JS_PUBLIC_API(JSObject *)
 JS_InitClass(JSContext *cx, JSObject *obj, JSObject *parent_proto,
              JSClass *clasp, JSNative constructor, unsigned nargs,
              JSPropertySpec *ps, JSFunctionSpec *fs,
              JSPropertySpec *static_ps, JSFunctionSpec *static_fs)
 {
@@ -3618,17 +3618,17 @@ JS_PUBLIC_API(JSBool)
 JS_AlreadyHasOwnUCProperty(JSContext *cx, JSObject *obj, const jschar *name, size_t namelen,
                            JSBool *foundp)
 {
     JSAtom *atom = js_AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen));
     return atom && JS_AlreadyHasOwnPropertyById(cx, obj, ATOM_TO_JSID(atom), foundp);
 }
 
 static JSBool
-DefinePropertyById(JSContext *cx, JSObject *obj, jsid id, const Value &value,
+DefinePropertyById(JSContext *cx, HandleObject obj, jsid id, const Value &value,
                    PropertyOp getter, StrictPropertyOp setter, unsigned attrs,
                    unsigned flags, int tinyid)
 {
     /*
      * JSPROP_READONLY has no meaning when accessors are involved. Ideally we'd
      * throw if this happens, but we've accepted it for long enough that it's
      * not worth trying to make callers change their ways. Just flip it off on
      * its way through the API layer so that we can enforce this internally.
@@ -3678,44 +3678,46 @@ DefinePropertyById(JSContext *cx, JSObje
     if (flags != 0 && obj->isNative()) {
         return !!DefineNativeProperty(cx, obj, id, value, getter, setter,
                                       attrs, flags, tinyid);
     }
     return obj->defineGeneric(cx, id, value, getter, setter, attrs);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_DefinePropertyById(JSContext *cx, JSObject *obj, jsid id, jsval value,
+JS_DefinePropertyById(JSContext *cx, JSObject *obj_, jsid id, jsval value,
                       JSPropertyOp getter, JSStrictPropertyOp setter, unsigned attrs)
 {
+    RootedVarObject obj(cx, obj_);
     return DefinePropertyById(cx, obj, id, value, getter, setter, attrs, 0, 0);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_DefineElement(JSContext *cx, JSObject *obj, uint32_t index, jsval value,
+JS_DefineElement(JSContext *cx, JSObject *obj_, uint32_t index, jsval value,
                  JSPropertyOp getter, JSStrictPropertyOp setter, unsigned attrs)
 {
+    RootedVarObject obj(cx, obj_);
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;
     return DefinePropertyById(cx, obj, id, value, getter, setter, attrs, 0, 0);
 }
 
 static JSBool
-DefineProperty(JSContext *cx, JSObject *obj, const char *name, const Value &value,
+DefineProperty(JSContext *cx, JSObject *obj_, const char *name, const Value &value_,
                PropertyOp getter, StrictPropertyOp setter, unsigned attrs,
                unsigned flags, int tinyid)
 {
     jsid id;
     JSAtom *atom;
 
-    RootObject objRoot(cx, &obj);
-    RootValue valueRoot(cx, &value);
+    RootedVarObject obj(cx, obj_);
+    RootedVarValue value(cx, value_);
 
     if (attrs & JSPROP_INDEX) {
         id = INT_TO_JSID(intptr_t(name));
         atom = NULL;
         attrs &= ~JSPROP_INDEX;
     } else {
         atom = js_Atomize(cx, name, strlen(name));
         if (!atom)
@@ -3736,20 +3738,21 @@ JS_DefineProperty(JSContext *cx, JSObjec
 JS_PUBLIC_API(JSBool)
 JS_DefinePropertyWithTinyId(JSContext *cx, JSObject *obj, const char *name, int8_t tinyid,
                             jsval value, PropertyOp getter, JSStrictPropertyOp setter, unsigned attrs)
 {
     return DefineProperty(cx, obj, name, value, getter, setter, attrs, Shape::HAS_SHORTID, tinyid);
 }
 
 static JSBool
-DefineUCProperty(JSContext *cx, JSObject *obj, const jschar *name, size_t namelen,
+DefineUCProperty(JSContext *cx, JSObject *obj_, const jschar *name, size_t namelen,
                  const Value &value, PropertyOp getter, StrictPropertyOp setter, unsigned attrs,
                  unsigned flags, int tinyid)
 {
+    RootObject obj(cx, &obj_);
     JSAtom *atom = js_AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen));
     return atom && DefinePropertyById(cx, obj, ATOM_TO_JSID(atom), value, getter, setter, attrs,
                                       flags, tinyid);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_DefineUCProperty(JSContext *cx, JSObject *obj, const jschar *name, size_t namelen,
                     jsval value, JSPropertyOp getter, JSStrictPropertyOp setter, unsigned attrs)
@@ -3767,17 +3770,17 @@ JS_DefineUCPropertyWithTinyId(JSContext 
 }
 
 JS_PUBLIC_API(JSBool)
 JS_DefineOwnProperty(JSContext *cx, JSObject *obj, jsid id, jsval descriptor, JSBool *bp)
 {
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, id, descriptor);
-    return js_DefineOwnProperty(cx, obj, id, descriptor, bp);
+    return js_DefineOwnProperty(cx, RootedVarObject(cx, obj), RootedVarId(cx, id), descriptor, bp);
 }
 
 JS_PUBLIC_API(JSObject *)
 JS_DefineObject(JSContext *cx, JSObject *obj, const char *name, JSClass *jsclasp,
                 JSObject *proto, unsigned attrs)
 {
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
@@ -3796,18 +3799,20 @@ JS_DefineObject(JSContext *cx, JSObject 
 
     if (!DefineProperty(cx, obj, name, ObjectValue(*nobj), NULL, NULL, attrs, 0, 0))
         return NULL;
 
     return nobj;
 }
 
 JS_PUBLIC_API(JSBool)
-JS_DefineConstDoubles(JSContext *cx, JSObject *obj, JSConstDoubleSpec *cds)
-{
+JS_DefineConstDoubles(JSContext *cx, JSObject *obj_, JSConstDoubleSpec *cds)
+{
+    RootedVarObject obj(cx, obj_);
+
     JSBool ok;
     unsigned attrs;
 
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
     for (ok = JS_TRUE; cds->name; cds++) {
         Value value = DoubleValue(cds->dval);
         attrs = cds->flags;
@@ -3944,17 +3949,17 @@ JS_GetUCPropertyAttrsGetterAndSetter(JSC
                                                           attrsp, foundp, getterp, setterp);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetOwnPropertyDescriptor(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
-    return GetOwnPropertyDescriptor(cx, obj, id, vp);
+    return GetOwnPropertyDescriptor(cx, RootedVarObject(cx, obj), RootedVarId(cx, id), vp);
 }
 
 static JSBool
 SetPropertyAttributesById(JSContext *cx, JSObject *obj, jsid id, unsigned attrs, JSBool *foundp)
 {
     JSObject *obj2;
     JSProperty *prop;
 
@@ -4004,17 +4009,17 @@ JS_ForwardGetPropertyTo(JSContext *cx, J
     assertSameCompartment(cx, onBehalfOf);
     JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED);
     return obj->getGeneric(cx, onBehalfOf, id, vp);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetPropertyByIdDefault(JSContext *cx, JSObject *obj, jsid id, jsval def, jsval *vp)
 {
-    return GetPropertyDefault(cx, obj, id, def, vp);
+    return GetPropertyDefault(cx, RootedVarObject(cx, obj), RootedVarId(cx, id), def, vp);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetElement(JSContext *cx, JSObject *obj, uint32_t index, jsval *vp)
 {
     return JS_ForwardGetElementTo(cx, obj, index, obj, vp);
 }
 
@@ -4064,17 +4069,17 @@ JS_GetUCProperty(JSContext *cx, JSObject
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetMethodById(JSContext *cx, JSObject *obj, jsid id, JSObject **objp, jsval *vp)
 {
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, id);
-    if (!js_GetMethod(cx, obj, id, 0, vp))
+    if (!js_GetMethod(cx, RootedVarObject(cx, obj), id, 0, vp))
         return JS_FALSE;
     if (objp)
         *objp = obj;
     return JS_TRUE;
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetMethod(JSContext *cx, JSObject *obj, const char *name, JSObject **objp, jsval *vp)
@@ -4519,21 +4524,24 @@ JS_NewFunctionById(JSContext *cx, JSNati
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, parent);
 
     RootObject parentRoot(cx, &parent);
     return js_NewFunction(cx, NULL, native, nargs, flags, parentRoot, JSID_TO_ATOM(id));
 }
 
 JS_PUBLIC_API(JSObject *)
-JS_CloneFunctionObject(JSContext *cx, JSObject *funobj, JSObject *parent)
-{
-    AssertNoGC(cx);
-    CHECK_REQUEST(cx);
-    assertSameCompartment(cx, parent);  // XXX no funobj for now
+JS_CloneFunctionObject(JSContext *cx, JSObject *funobj, JSObject *parent_)
+{
+    AssertNoGC(cx);
+    CHECK_REQUEST(cx);
+    assertSameCompartment(cx, parent_);  // XXX no funobj for now
+
+    RootedVarObject parent(cx, parent_);
+
     if (!parent) {
         if (cx->hasfp())
             parent = &cx->fp()->scopeChain();
         if (!parent)
             parent = cx->globalObject;
         JS_ASSERT(parent);
     }
 
@@ -4542,17 +4550,17 @@ JS_CloneFunctionObject(JSContext *cx, JS
          * We cannot clone this object, so fail (we used to return funobj, bad
          * idea, but we changed incompatibly to teach any abusers a lesson!).
          */
         Value v = ObjectValue(*funobj);
         js_ReportIsNotFunction(cx, &v, 0);
         return NULL;
     }
 
-    JSFunction *fun = funobj->toFunction();
+    RootedVarFunction fun(cx, funobj->toFunction());
     if (fun->isInterpreted() && fun->script()->compileAndGo) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_BAD_CLONE_FUNOBJ_SCOPE);
         return NULL;
     }
 
 
     return CloneFunctionObject(cx, fun, parent, fun->getAllocKind());
@@ -5060,29 +5068,27 @@ CompileUCFunctionForPrincipalsCommon(JSC
     RootObject objRoot(cx, &obj);
 
     JS_THREADSAFE_ASSERT(cx->compartment != cx->runtime->atomsCompartment);
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, principals);
     AutoLastFrameCheck lfc(cx);
 
-    JSAtom *funAtom;
-    if (!name) {
-        funAtom = NULL;
-    } else {
+    RootedVarAtom funAtom(cx);
+    if (name) {
         funAtom = js_Atomize(cx, name, strlen(name));
         if (!funAtom)
             return NULL;
     }
 
     Bindings bindings(cx);
     for (unsigned i = 0; i < nargs; i++) {
         uint16_t dummy;
-        JSAtom *argAtom = js_Atomize(cx, argnames[i], strlen(argnames[i]));
+        RootedVarAtom argAtom(cx, js_Atomize(cx, argnames[i], strlen(argnames[i])));
         if (!argAtom || !bindings.addArgument(cx, argAtom, &dummy))
             return NULL;
     }
 
     JSFunction *fun = js_NewFunction(cx, NULL, NULL, 0, JSFUN_INTERPRETED, objRoot, funAtom);
     if (!fun)
         return NULL;
 
@@ -5253,24 +5259,26 @@ JS_PUBLIC_API(JSBool)
 JS_ExecuteScriptVersion(JSContext *cx, JSObject *obj, JSScript *script, jsval *rval,
                         JSVersion version)
 {
     AutoVersionAPI ava(cx, version);
     return JS_ExecuteScript(cx, obj, script, rval);
 }
 
 bool
-EvaluateUCScriptForPrincipalsCommon(JSContext *cx, JSObject *obj,
+EvaluateUCScriptForPrincipalsCommon(JSContext *cx, JSObject *obj_,
                                     JSPrincipals *principals, JSPrincipals *originPrincipals,
                                     const jschar *chars, unsigned length,
                                     const char *filename, unsigned lineno,
                                     jsval *rval, JSVersion compileVersion)
 {
     JS_THREADSAFE_ASSERT(cx->compartment != cx->runtime->atomsCompartment);
 
+    RootedVarObject obj(cx, obj_);
+
     uint32_t flags = TCF_COMPILE_N_GO | TCF_NEED_SCRIPT_GLOBAL;
     if (!rval)
         flags |= TCF_NO_SCRIPT_RVAL;
 
     CHECK_REQUEST(cx);
     AutoLastFrameCheck lfc(cx);
     JSScript *script = frontend::CompileScript(cx, obj, NULL, principals, originPrincipals,
                                                flags, chars, length, filename, lineno,
@@ -5372,25 +5380,27 @@ JS_CallFunction(JSContext *cx, JSObject 
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, fun, JSValueArray(argv, argc));
     AutoLastFrameCheck lfc(cx);
 
     return Invoke(cx, ObjectOrNullValue(obj), ObjectValue(*fun), argc, argv, rval);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_CallFunctionName(JSContext *cx, JSObject *obj, const char *name, unsigned argc, jsval *argv,
+JS_CallFunctionName(JSContext *cx, JSObject *obj_, const char *name, unsigned argc, jsval *argv,
                     jsval *rval)
 {
     JS_THREADSAFE_ASSERT(cx->compartment != cx->runtime->atomsCompartment);
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
-    assertSameCompartment(cx, obj, JSValueArray(argv, argc));
+    assertSameCompartment(cx, obj_, JSValueArray(argv, argc));
     AutoLastFrameCheck lfc(cx);
 
+    RootedVarObject obj(cx, obj_);
+
     Value v;
     JSAtom *atom = js_Atomize(cx, name, strlen(name));
     return atom &&
            js_GetMethod(cx, obj, ATOM_TO_JSID(atom), 0, &v) &&
            Invoke(cx, ObjectOrNullValue(obj), v, argc, argv, rval);
 }
 
 JS_PUBLIC_API(JSBool)
@@ -5754,17 +5764,17 @@ JS_NewDependentString(JSContext *cx, JSS
     return js_NewDependentString(cx, str, start, length);
 }
 
 JS_PUBLIC_API(JSString *)
 JS_ConcatStrings(JSContext *cx, JSString *left, JSString *right)
 {
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
-    return js_ConcatStrings(cx, left, right);
+    return js_ConcatStrings(cx, RootedVarString(cx, left), RootedVarString(cx, right));
 }
 
 JS_PUBLIC_API(const jschar *)
 JS_UndependString(JSContext *cx, JSString *str)
 {
     AssertNoGC(cx);
     CHECK_REQUEST(cx);
     return str->getCharsZ(cx);

--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -51,16 +51,17 @@
 #include <stddef.h>
 #include <stdio.h>
 #include "js-config.h"
 #include "jspubtd.h"
 #include "jsutil.h"
 #include "jsval.h"
 
 #include "js/Utility.h"
+#include "gc/Root.h"
 
 #ifdef __cplusplus
 #include "jsalloc.h"
 #include "js/Vector.h"
 #endif
 
 /************************************************************************/
 
@@ -765,16 +766,30 @@ PrivateUint32Value(uint32_t ui)
 }
 
 JS_ALWAYS_INLINE bool
 SameType(const Value &lhs, const Value &rhs)
 {
     return JSVAL_SAME_TYPE_IMPL(lhs.data, rhs.data);
 }
 
+template <> struct RootMethods<const Value>
+{
+    static Value initial() { return UndefinedValue(); }
+    static ThingRootKind kind() { return THING_ROOT_VALUE; }
+    static bool poisoned(const Value &v) { return IsPoisonedValue(v); }
+};
+
+template <> struct RootMethods<Value>
+{
+    static Value initial() { return UndefinedValue(); }
+    static ThingRootKind kind() { return THING_ROOT_VALUE; }
+    static bool poisoned(const Value &v) { return IsPoisonedValue(v); }
+};
+
 /************************************************************************/
 
 #ifndef __GNUC__
 
 /*
  * The default assignment operator for |struct C| has the signature:
  *
  *   C& C::operator=(const C&)
@@ -1048,17 +1063,17 @@ class AutoEnumStateRooter : private Auto
 };
 
 template<class T>
 class AutoVectorRooter : protected AutoGCRooter
 {
   public:
     explicit AutoVectorRooter(JSContext *cx, ptrdiff_t tag
                               JS_GUARD_OBJECT_NOTIFIER_PARAM)
-        : AutoGCRooter(cx, tag), vector(cx)
+      : AutoGCRooter(cx, tag), vector(cx), vectorRoot(cx, &vector)
     {
         JS_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     size_t length() const { return vector.length(); }
 
     bool append(const T &v) { return vector.append(v); }
 
@@ -1111,16 +1126,20 @@ class AutoVectorRooter : protected AutoG
     void makeRangeGCSafe(size_t oldLength) {
         T *t = vector.begin() + oldLength;
         for (size_t i = oldLength; i < vector.length(); ++i, ++t)
             memset(t, 0, sizeof(T));
     }
 
     typedef js::Vector<T, 8> VectorImpl;
     VectorImpl vector;
+
+    /* Prevent overwriting of inline elements in vector. */
+    SkipRoot vectorRoot;
+
     JS_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 class AutoValueVector : public AutoVectorRooter<Value>
 {
   public:
     explicit AutoValueVector(JSContext *cx
                              JS_GUARD_OBJECT_NOTIFIER_PARAM)
@@ -2453,26 +2472,44 @@ extern JS_PUBLIC_API(JSBool)
 JS_IsInRequest(JSRuntime *rt);
 
 extern JS_PUBLIC_API(JSBool)
 JS_IsInSuspendedRequest(JSRuntime *rt);
 
 #ifdef __cplusplus
 JS_END_EXTERN_C
 
+namespace JS {
+
 inline bool
 IsPoisonedId(jsid iden)
 {
     if (JSID_IS_STRING(iden))
         return JS::IsPoisonedPtr(JSID_TO_STRING(iden));
     if (JSID_IS_OBJECT(iden))
         return JS::IsPoisonedPtr(JSID_TO_OBJECT(iden));
     return false;
 }
 
+template <> struct RootMethods<const jsid>
+{
+    static jsid initial() { return JSID_VOID; }
+    static ThingRootKind kind() { return THING_ROOT_ID; }
+    static bool poisoned(jsid id) { return IsPoisonedId(id); }
+};
+
+template <> struct RootMethods<jsid>
+{
+    static jsid initial() { return JSID_VOID; }
+    static ThingRootKind kind() { return THING_ROOT_ID; }
+    static bool poisoned(jsid id) { return IsPoisonedId(id); }
+};
+
+} /* namespace JS */
+
 class JSAutoRequest {
   public:
     JSAutoRequest(JSContext *cx JS_GUARD_OBJECT_NOTIFIER_PARAM)
         : mContext(cx), mSaveDepth(0) {
         JS_GUARD_OBJECT_NOTIFIER_INIT;
         JS_BeginRequest(mContext);
     }
     ~JSAutoRequest() {

--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -478,17 +478,17 @@ GetElements(JSContext *cx, JSObject *aob
 }
 
 }
 
 /*
  * Set the value of the property at the given index to v assuming v is rooted.
  */
 static JSBool
-SetArrayElement(JSContext *cx, JSObject *obj, double index, const Value &v)
+SetArrayElement(JSContext *cx, HandleObject obj, double index, const Value &v)
 {
     JS_ASSERT(index >= 0);
 
     if (obj->isDenseArray()) {
         /* Predicted/prefetched code should favor the remains-dense case. */
         JSObject::EnsureDenseResult result = JSObject::ED_SPARSE;
         do {
             if (index > uint32_t(-1))
@@ -501,17 +501,17 @@ SetArrayElement(JSContext *cx, JSObject 
                 obj->setDenseArrayLength(idx + 1);
             obj->setDenseArrayElementWithType(cx, idx, v);
             return true;
         } while (false);
 
         if (result == JSObject::ED_FAILED)
             return false;
         JS_ASSERT(result == JSObject::ED_SPARSE);
-        if (!obj->makeDenseArraySlow(cx))
+        if (!JSObject::makeDenseArraySlow(cx, obj))
             return JS_FALSE;
     }
 
     AutoIdRooter idr(cx);
 
     if (!IndexToId(cx, obj, index, NULL, idr.addr(), JS_TRUE))
         return JS_FALSE;
     JS_ASSERT(!JSID_IS_VOID(idr.id()));
@@ -529,17 +529,17 @@ SetArrayElement(JSContext *cx, JSObject 
  *
  * - Return 0 if the deletion fails because the property is not
  *   configurable (that is, [[Delete]] would return false). Note that if
  *   |strict| is true we will throw, not return zero.
  *
  * - Return -1 if an exception occurs (that is, [[Delete]] would throw).
  */
 static int
-DeleteArrayElement(JSContext *cx, JSObject *obj, double index, bool strict)
+DeleteArrayElement(JSContext *cx, HandleObject obj, double index, bool strict)
 {
     JS_ASSERT(index >= 0);
     JS_ASSERT(floor(index) == index);
 
     if (obj->isDenseArray()) {
         if (index <= UINT32_MAX) {
             uint32_t idx = uint32_t(index);
             if (idx < obj->getDenseArrayInitializedLength()) {
@@ -564,17 +564,17 @@ DeleteArrayElement(JSContext *cx, JSObje
     return v.isTrue() ? 1 : 0;
 }
 
 /*
  * When hole is true, delete the property at the given index. Otherwise set
  * its value to v assuming v is rooted.
  */
 static JSBool
-SetOrDeleteArrayElement(JSContext *cx, JSObject *obj, double index,
+SetOrDeleteArrayElement(JSContext *cx, HandleObject obj, double index,
                         JSBool hole, const Value &v)
 {
     if (hole) {
         JS_ASSERT(v.isUndefined());
         return DeleteArrayElement(cx, obj, index, true) >= 0;
     }
     return SetArrayElement(cx, obj, index, v);
 }
@@ -603,18 +603,20 @@ array_length_getter(JSContext *cx, JSObj
             vp->setNumber(obj->getArrayLength());
             return JS_TRUE;
         }
     } while ((obj = obj->getProto()) != NULL);
     return JS_TRUE;
 }
 
 static JSBool
-array_length_setter(JSContext *cx, JSObject *obj, jsid id, JSBool strict, Value *vp)
+array_length_setter(JSContext *cx, JSObject *obj_, jsid id, JSBool strict, Value *vp)
 {
+    RootedVarObject obj(cx, obj_);
+
     if (!obj->isArray()) {
         return obj->defineProperty(cx, cx->runtime->atomState.lengthAtom, *vp,
                                    NULL, NULL, JSPROP_ENUMERATE);
     }
 
     uint32_t newlen;
     if (!ToUint32(cx, *vp, &newlen))
         return false;
@@ -800,32 +802,44 @@ array_getProperty(JSContext *cx, JSObjec
     }
 
     if (name == cx->runtime->atomState.protoAtom) {
         vp->setObjectOrNull(obj->getProto());
         return true;
     }
 
     if (!obj->isDenseArray())
-        return js_GetProperty(cx, obj, receiver, ATOM_TO_JSID(name), vp);
+    {
+        return js_GetProperty(cx,
+                              RootedVarObject(cx, obj),
+                              RootedVarObject(cx, receiver),
+                              ATOM_TO_JSID(name),
+                              vp);
+    }
 
     JSObject *proto = obj->getProto();
     if (!proto) {
         vp->setUndefined();
         return true;
     }
 
     return proto->getProperty(cx, receiver, name, vp);
 }
 
 static JSBool
 array_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32_t index, Value *vp)
 {
     if (!obj->isDenseArray())
-        return js_GetElement(cx, obj, receiver, index, vp);
+    {
+        return js_GetElement(cx,
+                             RootedVarObject(cx, obj),
+                             RootedVarObject(cx, receiver),
+                             index,
+                             vp);
+    }
 
     if (index < obj->getDenseArrayInitializedLength()) {
         *vp = obj->getDenseArrayElement(index);
         if (!vp->isMagic(JS_ARRAY_HOLE)) {
             /* Type information for dense array elements must be correct. */
             JS_ASSERT_IF(!obj->hasSingletonType(),
                          js::types::TypeHasProperty(cx, obj->type(), JSID_VOID, *vp));
 
@@ -845,17 +859,21 @@ array_getElement(JSContext *cx, JSObject
 static JSBool
 array_getSpecial(JSContext *cx, JSObject *obj, JSObject *receiver, SpecialId sid, Value *vp)
 {
     if (obj->isDenseArray() && !obj->getProto()) {
         vp->setUndefined();
         return true;
     }
 
-    return js_GetProperty(cx, obj, receiver, SPECIALID_TO_JSID(sid), vp);
+    return js_GetProperty(cx,
+                          RootedVarObject(cx, obj),
+                          RootedVarObject(cx, receiver),
+                          SPECIALID_TO_JSID(sid),
+                          vp);
 }
 
 static JSBool
 array_getGeneric(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp)
 {
     Value idval = IdToValue(id);
 
     uint32_t index;
@@ -891,27 +909,29 @@ slowarray_addProperty(JSContext *cx, JSO
 
 static JSType
 array_typeOf(JSContext *cx, JSObject *obj)
 {
     return JSTYPE_OBJECT;
 }
 
 static JSBool
-array_setGeneric(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
+array_setGeneric(JSContext *cx, JSObject *obj_, jsid id_, Value *vp, JSBool strict)
 {
-    uint32_t i;
+    RootedVarObject obj(cx, obj_);
+    RootedVarId id(cx, id_);
 
     if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom))
         return array_length_setter(cx, obj, id, strict, vp);
 
     if (!obj->isDenseArray())
         return js_SetPropertyHelper(cx, obj, id, 0, vp, strict);
 
     do {
+        uint32_t i;
         if (!js_IdIsIndex(id, &i))
             break;
         if (js_PrototypeHasIndexedProperties(cx, obj))
             break;
 
         JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, i, 1);
         if (result != JSObject::ED_OK) {
             if (result == JSObject::ED_FAILED)
@@ -921,30 +941,32 @@ array_setGeneric(JSContext *cx, JSObject
         }
 
         if (i >= obj->getArrayLength())
             obj->setDenseArrayLength(i + 1);
         obj->setDenseArrayElementWithType(cx, i, *vp);
         return true;
     } while (false);
 
-    if (!obj->makeDenseArraySlow(cx))
+    if (!JSObject::makeDenseArraySlow(cx, obj))
         return false;
     return js_SetPropertyHelper(cx, obj, id, 0, vp, strict);
 }
 
 static JSBool
 array_setProperty(JSContext *cx, JSObject *obj, PropertyName *name, Value *vp, JSBool strict)
 {
     return array_setGeneric(cx, obj, ATOM_TO_JSID(name), vp, strict);
 }
 
 static JSBool
-array_setElement(JSContext *cx, JSObject *obj, uint32_t index, Value *vp, JSBool strict)
+array_setElement(JSContext *cx, JSObject *obj_, uint32_t index, Value *vp, JSBool strict)
 {
+    RootedVarObject obj(cx, obj_);
+
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;
 
     if (!obj->isDenseArray())
         return js_SetPropertyHelper(cx, obj, id, 0, vp, strict);
 
     do {
@@ -966,17 +988,17 @@ array_setElement(JSContext *cx, JSObject
         }
 
         if (index >= obj->getArrayLength())
             obj->setDenseArrayLength(index + 1);
         obj->setDenseArrayElementWithType(cx, index, *vp);
         return true;
     } while (false);
 
-    if (!obj->makeDenseArraySlow(cx))
+    if (!JSObject::makeDenseArraySlow(cx, obj))
         return false;
     return js_SetPropertyHelper(cx, obj, id, 0, vp, strict);
 }
 
 static JSBool
 array_setSpecial(JSContext *cx, JSObject *obj, SpecialId sid, Value *vp, JSBool strict)
 {
     return array_setGeneric(cx, obj, SPECIALID_TO_JSID(sid), vp, strict);
@@ -1000,19 +1022,21 @@ js_PrototypeHasIndexedProperties(JSConte
             return JS_TRUE;
         if (obj->isIndexed())
             return JS_TRUE;
     }
     return JS_FALSE;
 }
 
 static JSBool
-array_defineGeneric(JSContext *cx, JSObject *obj, jsid id, const Value *value,
+array_defineGeneric(JSContext *cx, JSObject *obj_, jsid id, const Value *value,
                     JSPropertyOp getter, StrictPropertyOp setter, unsigned attrs)
 {
+    RootedVarObject obj(cx, obj_);
+
     if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom))
         return JS_TRUE;
 
     if (!obj->isDenseArray())
         return js_DefineProperty(cx, obj, id, value, getter, setter, attrs);
 
     do {
         uint32_t i = 0;       // init to shut GCC up
@@ -1029,35 +1053,37 @@ array_defineGeneric(JSContext *cx, JSObj
         }
 
         if (i >= obj->getArrayLength())
             obj->setDenseArrayLength(i + 1);
         obj->setDenseArrayElementWithType(cx, i, *value);
         return true;
     } while (false);
 
-    if (!obj->makeDenseArraySlow(cx))
+    if (!JSObject::makeDenseArraySlow(cx, obj))
         return false;
     return js_DefineProperty(cx, obj, id, value, getter, setter, attrs);
 }
 
 static JSBool
 array_defineProperty(JSContext *cx, JSObject *obj, PropertyName *name, const Value *value,
                      JSPropertyOp getter, StrictPropertyOp setter, unsigned attrs)
 {
     return array_defineGeneric(cx, obj, ATOM_TO_JSID(name), value, getter, setter, attrs);
 }
 
 namespace js {
 
 /* non-static for direct definition of array elements within the engine */
 JSBool
-array_defineElement(JSContext *cx, JSObject *obj, uint32_t index, const Value *value,
+array_defineElement(JSContext *cx, JSObject *obj_, uint32_t index, const Value *value,
                     PropertyOp getter, StrictPropertyOp setter, unsigned attrs)
 {
+    RootedVarObject obj(cx, obj_);
+
     if (!obj->isDenseArray())
         return js_DefineElement(cx, obj, index, value, getter, setter, attrs);
 
     jsid id;
     if (!IndexToId(cx, index, &id))
         return false;
 
     do {
@@ -1077,17 +1103,17 @@ array_defineElement(JSContext *cx, JSObj
         }
 
         if (index >= obj->getArrayLength())
             obj->setDenseArrayLength(index + 1);
         obj->setDenseArrayElementWithType(cx, index, *value);
         return true;
     } while (false);
 
-    if (!obj->makeDenseArraySlow(cx))
+    if (!JSObject::makeDenseArraySlow(cx, obj))
         return false;
     return js_DefineElement(cx, obj, index, value, getter, setter, attrs);
 }
 
 } // namespace js
 
 static JSBool
 array_defineSpecial(JSContext *cx, JSObject *obj, SpecialId sid, const Value *value,
@@ -1208,25 +1234,27 @@ array_trace(JSTracer *trc, JSObject *obj
 {
     JS_ASSERT(obj->isDenseArray());
 
     uint32_t initLength = obj->getDenseArrayInitializedLength();
     MarkArraySlots(trc, initLength, obj->getDenseArrayElements(), "element");
 }
 
 static JSBool
-array_fix(JSContext *cx, JSObject *obj, bool *success, AutoIdVector *props)
+array_fix(JSContext *cx, JSObject *obj_, bool *success, AutoIdVector *props)
 {
+    RootedVarObject obj(cx, obj_);
+
     JS_ASSERT(obj->isDenseArray());
 
     /*
      * We must slowify dense arrays; otherwise, we'd need to detect assignments to holes,
      * since that is effectively adding a new property to the array.
      */
-    if (!obj->makeDenseArraySlow(cx) ||
+    if (!JSObject::makeDenseArraySlow(cx, obj) ||
         !GetPropertyNames(cx, obj, JSITER_HIDDEN | JSITER_OWNONLY, props))
         return false;
 
     *success = true;
     return true;
 }
 
 Class js::ArrayClass = {
@@ -1349,100 +1377,100 @@ AddLengthProperty(JSContext *cx, JSObjec
 
     return obj->addProperty(cx, lengthId, array_length_getter, array_length_setter,
                             SHAPE_INVALID_SLOT, JSPROP_PERMANENT | JSPROP_SHARED, 0, 0);
 }
 
 /*
  * Convert an array object from fast-and-dense to slow-and-flexible.
  */
-JSBool
-JSObject::makeDenseArraySlow(JSContext *cx)
+/* static */ bool
+JSObject::makeDenseArraySlow(JSContext *cx, HandleObject obj)
 {
-    JS_ASSERT(isDenseArray());
-
-    MarkTypeObjectFlags(cx, this,
+    JS_ASSERT(obj->isDenseArray());
+
+    MarkTypeObjectFlags(cx, obj,
                         OBJECT_FLAG_NON_PACKED_ARRAY |
                         OBJECT_FLAG_NON_DENSE_ARRAY);
 
-    uint32_t arrayCapacity = getDenseArrayCapacity();
-    uint32_t arrayInitialized = getDenseArrayInitializedLength();
+    uint32_t arrayCapacity = obj->getDenseArrayCapacity();
+    uint32_t arrayInitialized = obj->getDenseArrayInitializedLength();
 
     /*
      * Get an allocated array of the existing elements, evicting from the fixed
      * slots if necessary.
      */
-    if (!hasDynamicElements()) {
-        if (!growElements(cx, arrayCapacity))
+    if (!obj->hasDynamicElements()) {
+        if (!obj->growElements(cx, arrayCapacity))
             return false;
-        JS_ASSERT(hasDynamicElements());
+        JS_ASSERT(obj->hasDynamicElements());
     }
 
     /*
      * Save old map now, before calling InitScopeForObject. We'll have to undo
      * on error. This is gross, but a better way is not obvious. Note: the
      * exact contents of the array are not preserved on error.
      */
-    js::Shape *oldShape = lastProperty();
+    js::Shape *oldShape = obj->lastProperty();
 
     /* Create a native scope. */
-    gc::AllocKind kind = getAllocKind();
-    Shape *shape = EmptyShape::getInitialShape(cx, &SlowArrayClass, getProto(),
+    gc::AllocKind kind = obj->getAllocKind();
+    Shape *shape = EmptyShape::getInitialShape(cx, &SlowArrayClass, obj->getProto(),
                                                oldShape->getObjectParent(), kind);
     if (!shape)
         return false;
-    this->shape_ = shape;
+    obj->shape_ = shape;
 
     /* Take ownership of the dense elements, reset to an empty dense array. */
-    HeapSlot *elems = elements;
-    elements = emptyObjectElements;
+    HeapSlot *elems = obj->elements;
+    obj->elements = emptyObjectElements;
 
     /* Root all values in the array during conversion. */
     AutoValueArray autoArray(cx, (Value *) elems, arrayInitialized);
 
     /*
      * Begin with the length property to share more of the property tree.
      * The getter/setter here will directly access the object's private value.
      */
-    if (!AddLengthProperty(cx, this)) {
-        this->shape_ = oldShape;
-        if (elements != emptyObjectElements)
-            cx->free_(getElementsHeader());
-        elements = elems;
+    if (!AddLengthProperty(cx, obj)) {
+        obj->shape_ = oldShape;
+        if (obj->elements != emptyObjectElements)
+            cx->free_(obj->getElementsHeader());
+        obj->elements = elems;
         return false;
     }
 
     /*
      * Create new properties pointing to existing elements. Pack the array to
      * remove holes, so that shapes use successive slots (as for other objects).
      */
     uint32_t next = 0;
     for (uint32_t i = 0; i < arrayInitialized; i++) {
         /* Dense array indexes can always fit in a jsid. */
         jsid id;
         JS_ALWAYS_TRUE(ValueToId(cx, Int32Value(i), &id));
 
         if (elems[i].isMagic(JS_ARRAY_HOLE))
             continue;
 
-        if (!addDataProperty(cx, id, next, JSPROP_ENUMERATE)) {
-            this->shape_ = oldShape;
-            cx->free_(getElementsHeader());
-            elements = elems;
+        if (!obj->addDataProperty(cx, id, next, JSPROP_ENUMERATE)) {
+            obj->shape_ = oldShape;
+            cx->free_(obj->getElementsHeader());
+            obj->elements = elems;
             return false;
         }
 
-        initSlot(next, elems[i]);
+        obj->initSlot(next, elems[i]);
 
         next++;
     }
 
     ObjectElements *oldheader = ObjectElements::fromElements(elems);
 
-    getElementsHeader()->length = oldheader->length;
+    obj->getElementsHeader()->length = oldheader->length;
     cx->free_(oldheader);
 
     return true;
 }
 
 #if JS_HAS_TOSOURCE
 class ArraySharpDetector
 {
@@ -1703,17 +1731,17 @@ array_toString_sub(JSContext *cx, JSObje
 
 /* ES5 15.4.4.2. NB: The algorithm here differs from the one in ES3. */
 static JSBool
 array_toString(JSContext *cx, unsigned argc, Value *vp)
 {
     JS_CHECK_RECURSION(cx, return false);
 
     CallArgs args = CallArgsFromVp(argc, vp);
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return false;
 
     Value join = args.calleev();
     if (!obj->getProperty(cx, cx->runtime->atomState.joinAtom, &join))
         return false;
 
     if (!js_IsCallable(join)) {
@@ -1777,17 +1805,17 @@ InitArrayTypes(JSContext *cx, TypeObject
 
 enum ShouldUpdateTypes
 {
     UpdateTypes = true,
     DontUpdateTypes = false
 };
 
 static bool
-InitArrayElements(JSContext *cx, JSObject *obj, uint32_t start, uint32_t count, const Value *vector, ShouldUpdateTypes updateTypes)
+InitArrayElements(JSContext *cx, HandleObject obj, uint32_t start, uint32_t count, const Value *vector, ShouldUpdateTypes updateTypes)
 {
     JS_ASSERT(count <= MAX_ARRAY_INDEX);
 
     if (count == 0)
         return true;
 
     if (updateTypes && !InitArrayTypes(cx, obj->getType(cx), vector, count))
         return false;
@@ -1826,17 +1854,17 @@ InitArrayElements(JSContext *cx, JSObjec
             return false;
         }
     }
 
     if (vector == end)
         return true;
 
     /* Finish out any remaining elements past the max array index. */
-    if (obj->isDenseArray() && !obj->makeDenseArraySlow(cx))
+    if (obj->isDenseArray() && !JSObject::makeDenseArraySlow(cx, obj))
         return false;
 
     JS_ASSERT(start == MAX_ARRAY_INDEX + 1);
     AutoValueRooter tvr(cx);
     AutoIdRooter idr(cx);
     Value idval = DoubleValue(MAX_ARRAY_INDEX + 1);
     do {
         *tvr.addr() = *vector++;
@@ -1905,17 +1933,17 @@ array_join(JSContext *cx, unsigned argc,
         return false;
     return array_toString_sub(cx, obj, JS_FALSE, str, args);
 }
 
 static JSBool
 array_reverse(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return false;
 
     uint32_t len;
     if (!js_GetLengthProperty(cx, obj, &len))
         return false;
 
     do {
@@ -2209,17 +2237,17 @@ js::array_sort(JSContext *cx, unsigned a
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_SORT_ARG);
             return false;
         }
         fval = args[0];     /* non-default compare function */
     } else {
         fval.setNull();
     }
 
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return false;
 
     uint32_t len;
     if (!js_GetLengthProperty(cx, obj, &len))
         return false;
     if (len == 0) {
         args.rval().setObject(*obj);
@@ -2375,43 +2403,43 @@ js::array_sort(JSContext *cx, unsigned a
     args.rval().setObject(*obj);
     return true;
 }
 
 /*
  * Perl-inspired push, pop, shift, unshift, and splice methods.
  */
 static bool
-array_push_slowly(JSContext *cx, JSObject *obj, CallArgs &args)
+array_push_slowly(JSContext *cx, HandleObject obj, CallArgs &args)
 {
     uint32_t length;
 
     if (!js_GetLengthProperty(cx, obj, &length))
         return false;
     if (!InitArrayElements(cx, obj, length, args.length(), args.array(), UpdateTypes))
         return false;
 
     /* Per ECMA-262, return the new array length. */
     double newlength = length + double(args.length());
     args.rval().setNumber(newlength);
     return js_SetLengthProperty(cx, obj, newlength);
 }
 
 static bool
-array_push1_dense(JSContext* cx, JSObject* obj, CallArgs &args)
+array_push1_dense(JSContext* cx, HandleObject obj, CallArgs &args)
 {
     JS_ASSERT(args.length() == 1);
 
     uint32_t length = obj->getArrayLength();
     JSObject::EnsureDenseResult result = obj->ensureDenseArrayElements(cx, length, 1);
     if (result != JSObject::ED_OK) {
         if (result == JSObject::ED_FAILED)
             return false;
         JS_ASSERT(result == JSObject::ED_SPARSE);
-        if (!obj->makeDenseArraySlow(cx))
+        if (!JSObject::makeDenseArraySlow(cx, obj))
             return false;
         return array_push_slowly(cx, obj, args);
     }
 
     obj->setDenseArrayLength(length + 1);
     obj->setDenseArrayElementWithType(cx, length, args[0]);
     args.rval().setNumber(obj->getArrayLength());
     return true;
@@ -2447,29 +2475,29 @@ js_NewbornArrayPush(JSContext *cx, JSObj
 {
     return NewbornArrayPushImpl(cx, obj, vp);
 }
 
 JSBool
 js::array_push(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return false;
 
     /* Insist on one argument and obj of the expected class. */
     if (args.length() != 1 || !obj->isDenseArray())
         return array_push_slowly(cx, obj, args);
 
     return array_push1_dense(cx, obj, args);
 }
 
 static JSBool
-array_pop_slowly(JSContext *cx, JSObject* obj, CallArgs &args)
+array_pop_slowly(JSContext *cx, HandleObject obj, CallArgs &args)
 {
     uint32_t index;
     if (!js_GetLengthProperty(cx, obj, &index))
         return false;
 
     if (index == 0) {
         args.rval().setUndefined();
         return js_SetLengthProperty(cx, obj, index);
@@ -2485,17 +2513,17 @@ array_pop_slowly(JSContext *cx, JSObject
     if (!hole && DeleteArrayElement(cx, obj, index, true) < 0)
         return false;
 
     args.rval() = elt;
     return js_SetLengthProperty(cx, obj, index);
 }
 
 static JSBool
-array_pop_dense(JSContext *cx, JSObject* obj, CallArgs &args)
+array_pop_dense(JSContext *cx, HandleObject obj, CallArgs &args)
 {
     uint32_t index = obj->getArrayLength();
     if (index == 0) {
         args.rval().setUndefined();
         return JS_TRUE;
     }
 
     index--;
@@ -2515,17 +2543,17 @@ array_pop_dense(JSContext *cx, JSObject*
     args.rval() = elt;
     return JS_TRUE;
 }
 
 JSBool
 js::array_pop(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return false;
     if (obj->isDenseArray())
         return array_pop_dense(cx, obj, args);
     return array_pop_slowly(cx, obj, args);
 }
 
 #ifdef JS_METHODJIT
@@ -2544,17 +2572,17 @@ mjit::stubs::ArrayShift(VMFrame &f)
     obj->moveDenseArrayElementsUnbarriered(0, 1, initlen);
 }
 #endif /* JS_METHODJIT */
 
 JSBool
 js::array_shift(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return JS_FALSE;
 
     uint32_t length;
     if (!js_GetLengthProperty(cx, obj, &length))
         return JS_FALSE;
 
     if (length == 0) {
@@ -2596,17 +2624,17 @@ js::array_shift(JSContext *cx, unsigned 
     }
     return js_SetLengthProperty(cx, obj, length);
 }
 
 static JSBool
 array_unshift(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return false;
 
     uint32_t length;
     if (!js_GetLengthProperty(cx, obj, &length))
         return JS_FALSE;
 
     double newlen = length;
@@ -2718,17 +2746,17 @@ CanOptimizeForDenseStorage(JSObject *arr
 
 /* ES5 15.4.4.12. */
 static JSBool
 array_splice(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
     /* Step 1. */
-    JSObject *obj = ToObject(cx, &args.thisv());
+    RootedVarObject obj(cx, ToObject(cx, &args.thisv()));
     if (!obj)
         return false;
 
     /* Steps 3-4. */
     uint32_t len;
     if (!js_GetLengthProperty(cx, obj, &len))
         return false;
 
@@ -2849,17 +2877,17 @@ array_splice(JSContext *cx, unsigned arg
         if (obj->isDenseArray()) {
             JSObject::EnsureDenseResult res =
                 obj->ensureDenseArrayElements(cx, obj->getArrayLength(),
                                               itemCount - actualDeleteCount);
             if (res == JSObject::ED_FAILED)
                 return false;
 
             if (res == JSObject::ED_SPARSE) {
-                if (!obj->makeDenseArraySlow(cx))
+                if (!JSObject::makeDenseArraySlow(cx, obj))
                     return false;
             } else {
                 JS_ASSERT(res == JSObject::ED_OK);
             }
         }
 
         if (CanOptimizeForDenseStorage(obj, len, itemCount - actualDeleteCount, cx)) {
             obj->moveDenseArrayElements(actualStart + itemCount,
@@ -2941,21 +2969,21 @@ mjit::stubs::ArrayConcatTwoArrays(VMFram
  */
 JSBool
 js::array_concat(JSContext *cx, unsigned argc, Value *vp)
 {
     /* Treat our |this| object as the first argument; see ECMA 15.4.4.4. */
     Value *p = JS_ARGV(cx, vp) - 1;
 
     /* Create a new Array object and root it using *vp. */
-    JSObject *aobj = ToObject(cx, &vp[1]);
+    RootedVarObject aobj(cx, ToObject(cx, &vp[1]));
     if (!aobj)
         return false;
 
-    JSObject *nobj;
+    RootedVarObject nobj(cx);
     uint32_t length;
     if (aobj->isDenseArray()) {
         length = aobj->getArrayLength();
         const Value *vector = aobj->getDenseArrayElements();
         uint32_t initlen = aobj->getDenseArrayInitializedLength();
         nobj = NewDenseCopiedArray(cx, initlen, vector);
         if (!nobj)
             return JS_FALSE;
@@ -3009,17 +3037,16 @@ js::array_concat(JSContext *cx, unsigned
     }
 
     return js_SetLengthProperty(cx, nobj, length);
 }
 
 static JSBool
 array_slice(JSContext *cx, unsigned argc, Value *vp)
 {
-    JSObject *nobj;
     uint32_t length, begin, end, slot;
     JSBool hole;
 
     CallArgs args = CallArgsFromVp(argc, vp);
 
     JSObject *obj = ToObject(cx, &args.thisv());
     if (!obj)
         return false;
@@ -3054,16 +3081,18 @@ array_slice(JSContext *cx, unsigned argc
             }
             end = (uint32_t)d;
         }
     }
 
     if (begin > end)
         begin = end;
 
+    RootedVarObject nobj(cx);
+
     if (obj->isDenseArray() && end <= obj->getDenseArrayInitializedLength() &&
         !js_PrototypeHasIndexedProperties(cx, obj)) {
         nobj = NewDenseCopiedArray(cx, end - begin, obj->getDenseArrayElements() + begin);
         if (!nobj)
             return JS_FALSE;
         TryReuseArrayType(obj, nobj);
         args.rval().setObject(*nobj);
         return JS_TRUE;
@@ -3333,17 +3362,17 @@ array_map(JSContext *cx, unsigned argc, 
     JSObject *callable = js_ValueToCallableObject(cx, &args[0], JSV2F_SEARCH_STACK);
     if (!callable)
         return false;
 
     /* Step 5. */
     Value thisv = args.length() >= 2 ? args[1] : UndefinedValue();
 
     /* Step 6. */
-    JSObject *arr = NewDenseAllocatedArray(cx, len);
+    RootedVarObject arr(cx, NewDenseAllocatedArray(cx, len));
     if (!arr)
         return false;
     TypeObject *newtype = GetTypeCallerInitObject(cx, JSProto_Array);
     if (!newtype)
         return false;
     arr->setType(newtype);
 
     /* Step 7. */
@@ -3409,17 +3438,17 @@ array_filter(JSContext *cx, unsigned arg
     JSObject *callable = js_ValueToCallableObject(cx, &args[0], JSV2F_SEARCH_STACK);
     if (!callable)
         return false;
 
     /* Step 5. */
     Value thisv = args.length() >= 2 ? args[1] : UndefinedValue();
 
     /* Step 6. */
-    JSObject *arr = NewDenseAllocatedArray(cx, 0);
+    RootedVarObject arr(cx, NewDenseAllocatedArray(cx, 0));
     if (!arr)
         return false;
     TypeObject *newtype = GetTypeCallerInitObject(cx, JSProto_Array);
     if (!newtype)
         return false;
     arr->setType(newtype);
 
     /* Step 7. */
@@ -3648,17 +3677,17 @@ static JSFunctionSpec array_static_metho
     JS_FS_END
 };
 
 /* ES5 15.4.2 */
 JSBool
 js_Array(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    TypeObject *type = GetTypeCallerInitObject(cx, JSProto_Array);
+    RootedVarTypeObject type(cx, GetTypeCallerInitObject(cx, JSProto_Array));
     if (!type)
         return JS_FALSE;
 
     if (args.length() != 1 || !args[0].isNumber()) {
         if (!InitArrayTypes(cx, type, args.array(), args.length()))
             return false;
         JSObject *obj = (args.length() == 0)
                         ? NewDenseEmptyArray(cx)
@@ -3789,17 +3818,17 @@ NewArray(JSContext *cx, uint32_t length,
         /* Fixup the elements pointer and length, which may be incorrect. */
         obj->setFixedElements();
         obj->setArrayLength(cx, length);
         if (allocateCapacity && !EnsureNewArrayElements(cx, obj, length))
             return NULL;
         return obj;
     }
 
-    Root<GlobalObject*> parentRoot(cx, &parent);
+    JS::Root<GlobalObject*> parentRoot(cx, &parent);
 
     if (!proto && !FindProto(cx, &ArrayClass, parentRoot, &proto))
         return NULL;
 
     RootObject protoRoot(cx, &proto);
     RootedVarTypeObject type(cx);
 
     type = proto->getNewType(cx);
@@ -3882,17 +3911,17 @@ NewDenseCopiedArray(JSContext *cx, uint3
         obj->initDenseArrayElements(0, vp, length);
 
     return obj;
 }
 
 JSObject *
 NewSlowEmptyArray(JSContext *cx)
 {
-    JSObject *obj = NewBuiltinClassInstance(cx, &SlowArrayClass);
+    RootedVarObject obj(cx, NewBuiltinClassInstance(cx, &SlowArrayClass));
     if (!obj || !AddLengthProperty(cx, obj))
         return NULL;
 
     obj->setArrayLength(cx, 0);
     return obj;
 }
 
 }

--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -68,38 +68,16 @@ js_IdIsIndex(jsid id, uint32_t *indexp)
     }
 
     if (JS_UNLIKELY(!JSID_IS_STRING(id)))
         return JS_FALSE;
 
     return js::StringIsArrayIndex(JSID_TO_ATOM(id), indexp);
 }
 
-/*
- * Dense arrays are not native -- aobj->isNative() for a dense array aobj
- * results in false, meaning aobj->map does not point to a js::Shape.
- *
- * But Array methods are called via aobj.sort(), e.g., and the interpreter and
- * the trace recorder must consult the property cache in order to perform well.
- * The cache works only for native objects.
- *
- * Therefore the interpreter (js_Interpret in JSOP_GETPROP and JSOP_CALLPROP)
- * and js_GetPropertyHelper use this inline function to skip up one link in the
- * prototype chain when obj is a dense array, in order to find a native object
- * (to wit, Array.prototype) in which to probe for cached methods.
- *
- * Note that setting aobj.__proto__ for a dense array aobj turns aobj into a
- * slow array, avoiding the neede to skip.
- *
- * Callers of js_GetProtoIfDenseArray must take care to use the original object
- * (obj) for the |this| value of a getter, setter, or method call (bug 476447).
- */
-inline JSObject *
-js_GetProtoIfDenseArray(JSObject *obj);
-
 extern JSObject *
 js_InitArrayClass(JSContext *cx, JSObject *obj);
 
 extern bool
 js_InitContextBusyArrayTable(JSContext *cx);
 
 namespace js {
 

--- a/js/src/jsbool.cpp
+++ b/js/src/jsbool.cpp
@@ -154,24 +154,25 @@ Boolean(JSContext *cx, unsigned argc, Va
     return true;
 }
 
 JSObject *
 js_InitBooleanClass(JSContext *cx, JSObject *obj)
 {
     JS_ASSERT(obj->isNative());
 
-    GlobalObject *global = &obj->asGlobal();
+    RootedVar<GlobalObject*> global(cx, &obj->asGlobal());
 
-    JSObject *booleanProto = global->createBlankPrototype(cx, &BooleanClass);
+    RootedVarObject booleanProto (cx, global->createBlankPrototype(cx, &BooleanClass));
     if (!booleanProto)
         return NULL;
     booleanProto->setFixedSlot(BooleanObject::PRIMITIVE_VALUE_SLOT, BooleanValue(false));
 
-    JSFunction *ctor = global->createConstructor(cx, Boolean, CLASS_ATOM(cx, Boolean), 1);
+    RootedVarFunction ctor(cx);
+    ctor = global->createConstructor(cx, Boolean, CLASS_ATOM(cx, Boolean), 1);
     if (!ctor)
         return NULL;
 
     if (!LinkConstructorAndPrototype(cx, ctor, booleanProto))
         return NULL;
 
     if (!DefinePropertiesAndBrand(cx, booleanProto, NULL, boolean_methods))
         return NULL;

--- a/js/src/jsclone.cpp
+++ b/js/src/jsclone.cpp
@@ -601,26 +601,26 @@ JSStructuredCloneWriter::startWrite(cons
 
 bool
 JSStructuredCloneWriter::write(const Value &v)
 {
     if (!startWrite(v))
         return false;
 
     while (!counts.empty()) {
-        JSObject *obj = &objs.back().toObject();
+        RootedVarObject obj(context(), &objs.back().toObject());
 
         // The objects in |obj| can live in other compartments.
         AutoEnterCompartmentAndPushPrincipal ac;
         if (!ac.enter(context(), obj))
             return false;
 
         if (counts.back()) {
             counts.back()--;
-            jsid id = ids.back();
+            RootedVarId id(context(), ids.back());
             ids.popBack();
             checkStack();
             if (JSID_IS_STRING(id) || JSID_IS_INT(id)) {
                 /*
                  * If obj still has an own property named id, write it out.
                  * The cost of re-checking could be avoided by using
                  * NativeIterators.
                  */