--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@@ -5019,26 +5019,26 @@ void CallIRGenerator::emitNativeCalleeGu
 
 AttachDecision CallIRGenerator::tryAttachArrayPush(HandleFunction callee) {
   // Only optimize on obj.push(val);
   if (argc_ != 1 || !thisval_.isObject()) {
     return AttachDecision::NoAction;
   }
 
   // Where |obj| is a native array.
-  RootedObject thisobj(cx_, &thisval_.toObject());
+  JSObject* thisobj = &thisval_.toObject();
   if (!thisobj->is<ArrayObject>()) {
     return AttachDecision::NoAction;
   }
 
   if (thisobj->hasLazyGroup()) {
     return AttachDecision::NoAction;
   }
 
-  RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
+  auto* thisarray = &thisobj->as<ArrayObject>();
 
   // Check for other indexed properties or class hooks.
   if (!CanAttachAddElement(thisarray, /* isInit = */ false)) {
     return AttachDecision::NoAction;
   }
 
   // Can't add new elements to arrays with non-writable length.
   if (!thisarray->lengthIsWritable()) {
@@ -5161,22 +5161,22 @@ AttachDecision CallIRGenerator::tryAttac
   }
 
   // Only optimize on obj.join(...);
   if (!thisval_.isObject()) {
     return AttachDecision::NoAction;
   }
 
   // Where |obj| is a native array.
-  RootedObject thisobj(cx_, &thisval_.toObject());
+  JSObject* thisobj = &thisval_.toObject();
   if (!thisobj->is<ArrayObject>()) {
     return AttachDecision::NoAction;
   }
 
-  RootedArrayObject thisarray(cx_, &thisobj->as<ArrayObject>());
+  auto* thisarray = &thisobj->as<ArrayObject>();
 
   // And the array is of length 0 or 1.
   if (thisarray->length() > 1) {
     return AttachDecision::NoAction;
   }
 
   // And the array is packed.
   if (thisarray->getDenseInitializedLength() != thisarray->length()) {
@@ -8186,17 +8186,17 @@ AttachDecision CallIRGenerator::tryAttac
 
   if (argc_ != 2) {
     return AttachDecision::NoAction;
   }
 
   if (!thisval_.isObject() || !thisval_.toObject().is<JSFunction>()) {
     return AttachDecision::NoAction;
   }
-  RootedFunction target(cx_, &thisval_.toObject().as<JSFunction>());
+  auto* target = &thisval_.toObject().as<JSFunction>();
 
   bool isScripted = target->hasJitEntry();
   MOZ_ASSERT_IF(!isScripted, target->isNativeWithoutJitEntry());
 
   if (target->isClassConstructor()) {
     return AttachDecision::NoAction;
   }
 
@@ -9008,17 +9008,17 @@ AttachDecision CallIRGenerator::tryAttac
     return AttachDecision::NoAction;
   }
 
   RootedObject calleeObj(cx_, &callee_.toObject());
   if (!calleeObj->is<JSFunction>()) {
     return tryAttachCallHook(calleeObj);
   }
 
-  RootedFunction calleeFunc(cx_, &calleeObj->as<JSFunction>());
+  HandleFunction calleeFunc = calleeObj.as<JSFunction>();
 
   // Check for scripted optimizations.
   if (calleeFunc->hasJitEntry()) {
     return tryAttachCallScripted(calleeFunc);
   }
 
   // Check for native-function optimizations.
   MOZ_ASSERT(calleeFunc->isNativeWithoutJitEntry());
@@ -10720,18 +10720,18 @@ AttachDecision NewObjectIRGenerator::try
 
   trackAttached("NewObjectWithTemplate");
   return AttachDecision::Attach;
 }
 
 #ifdef JS_SIMULATOR
 bool js::jit::CallAnyNative(JSContext* cx, unsigned argc, Value* vp) {
   CallArgs args = CallArgsFromVp(argc, vp);
-  RootedObject calleeObj(cx, &args.callee());
+  JSObject* calleeObj = &args.callee();
 
   MOZ_ASSERT(calleeObj->is<JSFunction>());
-  RootedFunction calleeFunc(cx, &calleeObj->as<JSFunction>());
+  auto* calleeFunc = &calleeObj->as<JSFunction>();
   MOZ_ASSERT(calleeFunc->isNativeWithoutJitEntry());
 
   JSNative native = calleeFunc->native();
   return native(cx, args.length(), args.base());
 }
 #endif