--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -807,38 +807,26 @@ class MOZ_NON_PARAM alignas(8) Value
 #endif
         data.asBits = bitsFromTagAndPayload(JSVAL_TAG_PRIVATE_GCTHING, PayloadType(cell));
     }
 
     bool isPrivateGCThing() const {
         return toTag() == JSVAL_TAG_PRIVATE_GCTHING;
     }
 
-    const uintptr_t* payloadUIntPtr() const {
-#if defined(JS_NUNBOX32)
-        return &data.s.payload.uintptr;
-#elif defined(JS_PUNBOX64)
-        return &data.asUIntPtr;
-#endif
-    }
-
 #if !defined(_MSC_VER) && !defined(__sparc)
   // Value must be POD so that MSVC will pass it by value and not in memory
   // (bug 689101); the same is true for SPARC as well (bug 737344).  More
   // precisely, we don't want Value return values compiled as out params.
   private:
 #endif
 
     union layout {
         uint64_t asBits;
         double asDouble;
-        void* asPtr;
-#if defined(JS_PUNBOX64)
-        uintptr_t asUIntPtr;
-#endif // defined(JS_PUNBOX64)
 
 #if defined(JS_PUNBOX64) && !defined(_WIN64)
         /* MSVC does not pack these correctly :-( */
         struct {
 #  if MOZ_LITTLE_ENDIAN
             uint64_t   payload47 : 47;
             JSValueTag tag : 17;
 #  else
@@ -867,17 +855,16 @@ class MOZ_NON_PARAM alignas(8) Value
                 uint32_t       u32;
                 uint32_t       boo;     // Don't use |bool| -- it must be four bytes.
                 JSString*      str;
                 JS::Symbol*    sym;
                 JSObject*      obj;
                 js::gc::Cell*  cell;
                 void*          ptr;
                 JSWhyMagic     why;
-                uintptr_t      uintptr;
             } payload;
 #  if MOZ_LITTLE_ENDIAN
             JSValueTag tag;
 #  endif // MOZ_LITTLE_ENDIAN
 #endif // defined(JS_PUNBOX64)
         } s;
 
         layout() : asBits(JSVAL_RAW64_UNDEFINED) {}

--- a/js/src/jit/JitFrames.cpp
+++ b/js/src/jit/JitFrames.cpp
@@ -926,17 +926,17 @@ TraceIonJSFrame(JSTracer* trc, const JSJ
         JSValueTag tag = JSValueTag(ReadAllocation(frame, &type));
         uintptr_t rawPayload = ReadAllocation(frame, &payload);
 
         Value v = Value::fromTagAndPayload(tag, rawPayload);
         TraceRoot(trc, &v, "ion-torn-value");
 
         if (v != Value::fromTagAndPayload(tag, rawPayload)) {
             // GC moved the value, replace the stored payload.
-            rawPayload = *v.payloadUIntPtr();
+            rawPayload = v.toNunboxPayload();
             WriteAllocation(frame, &payload, rawPayload);
         }
     }
 #endif
 }
 
 static void
 TraceBailoutFrame(JSTracer* trc, const JSJitFrameIter& frame)