Change asX to toX, asXRef to getXRef, XTag to XValue
authorLuke Wagner <lw@mozilla.com>
Mon, 05 Jul 2010 13:44:59 -0700
changeset 53076 18554cc9fc70510f1af91b65c0684c11e9752281
parent 53075 630b97638c8cd321c29228a6695379fa84e32f8d
child 53077 2cc0cec87973f3d0845bc7b2fb1918dabe8256b6
push idunknown
push userunknown
push dateunknown
milestone2.0b2pre
Change asX to toX, asXRef to getXRef, XTag to XValue
js/src/ctypes/CTypes.cpp
js/src/jsapi.cpp
js/src/jsarray.cpp
js/src/jsarray.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jsatominlines.h
js/src/jsbool.cpp
js/src/jsbuiltins.cpp
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jscntxtinlines.h
js/src/jsdate.cpp
js/src/jsdbgapi.cpp
js/src/jsdtracef.cpp
js/src/jsemit.cpp
js/src/jsexn.cpp
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsinterp.cpp
js/src/jsinterp.h
js/src/jsiter.cpp
js/src/jsiter.h
js/src/jslock.cpp
js/src/jsnum.cpp
js/src/jsnum.h
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/json.cpp
js/src/jsopcode.h
js/src/jsops.cpp
js/src/jsparse.cpp
js/src/jspropertycache.cpp
js/src/jsproxy.cpp
js/src/jsproxy.h
js/src/jsregexp.cpp
js/src/jsregexp.h
js/src/jsscope.cpp
js/src/jsscope.h
js/src/jsscopeinlines.h
js/src/jsstr.cpp
js/src/jstracer.cpp
js/src/jstypedarray.cpp
js/src/jsvalue.h
js/src/jswrapper.cpp
js/src/jswrapper.h
js/src/jsxml.cpp
js/src/jsxml.h
js/src/shell/js.cpp
js/src/xpconnect/src/xpcprivate.h
js/src/xpconnect/src/xpcwrappednativejsops.cpp
js/src/xpconnect/wrappers/XrayWrapper.cpp
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -1910,21 +1910,21 @@ ImplicitConvert(JSContext* cx,
       AutoPtr<char>::Array intermediate(new char[arraySize]);
       if (!intermediate) {
         JS_ReportAllocationOverflow(cx);
         return false;
       }
 
       for (jsuint i = 0; i < sourceLength; ++i) {
         js::AutoValueRooter item(cx);
-        if (!JS_GetElement(cx, sourceArray, i, Jsvalify(item.addr())))
+        if (!JS_GetElement(cx, sourceArray, i, item.jsval_addr()))
           return false;
 
         char* data = intermediate.get() + elementSize * i;
-        if (!ImplicitConvert(cx, Jsvalify(item.value()), baseType, data, false, NULL))
+        if (!ImplicitConvert(cx, item.jsval_value(), baseType, data, false, NULL))
           return false;
       }
 
       memcpy(buffer, intermediate.get(), arraySize);
 
     } else {
       // Don't implicitly convert to string. Users can implicitly convert
       // with `String(x)` or `""+x`.
@@ -1954,35 +1954,35 @@ ImplicitConvert(JSContext* cx,
       size_t i = 0;
       while (1) {
         if (!JS_NextProperty(cx, iter, &id))
           return false;
         if (JSID_IS_VOID(id))
           break;
 
         js::AutoValueRooter fieldVal(cx);
-        JS_IdToValue(cx, id, Jsvalify(fieldVal.addr()));
-        if (!fieldVal.value().isString()) {
+        JS_IdToValue(cx, id, fieldVal.jsval_addr());
+        if (!JSVAL_IS_STRING(fieldVal.jsval_value())) {
           JS_ReportError(cx, "property name is not a string");
           return false;
         }
 
         const FieldInfo* field = StructType::LookupField(cx, targetType,
-                                                         fieldVal.value().asString());
+                                                         JSVAL_TO_STRING(fieldVal.jsval_value()));
         if (!field)
           return false;
 
-        JSString* name = fieldVal.value().asString();
+        JSString* name = JSVAL_TO_STRING(fieldVal.jsval_value());
         js::AutoValueRooter prop(cx);
-        if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), Jsvalify(prop.addr())))
+        if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), prop.jsval_addr()))
           return false;
 
         // Convert the field via ImplicitConvert().
         char* fieldData = intermediate.get() + field->mOffset;
-        if (!ImplicitConvert(cx, Jsvalify(prop.value()), field->mType, fieldData, false, NULL))
+        if (!ImplicitConvert(cx, prop.jsval_value(), field->mType, fieldData, false, NULL))
           return false;
 
         ++i;
       }
 
       const FieldInfoHash* fields = StructType::GetFieldInfo(cx, targetType);
       if (i != fields->count()) {
         JS_ReportError(cx, "missing fields");
@@ -2013,17 +2013,17 @@ ExplicitConvert(JSContext* cx, jsval val
   // If ImplicitConvert succeeds, use that result.
   if (ImplicitConvert(cx, val, targetType, buffer, false, NULL))
     return true;
 
   // If ImplicitConvert failed, and there is no pending exception, then assume
   // hard failure (out of memory, or some other similarly serious condition).
   // We store any pending exception in case we need to re-throw it.
   js::AutoValueRooter ex(cx);
-  if (!JS_GetPendingException(cx, Jsvalify(ex.addr())))
+  if (!JS_GetPendingException(cx, ex.jsval_addr()))
     return false;
 
   // Otherwise, assume soft failure. Clear the pending exception so that we
   // can throw a different one as required.
   JS_ClearPendingException(cx);
 
   TypeCode type = CType::GetTypeCode(cx, targetType);
 
@@ -2061,17 +2061,17 @@ ExplicitConvert(JSContext* cx, jsval val
   }
   case TYPE_float32_t:
   case TYPE_float64_t:
   case TYPE_float:
   case TYPE_double:
   case TYPE_array:
   case TYPE_struct:
     // ImplicitConvert is sufficient. Re-throw the exception it generated.
-    JS_SetPendingException(cx, Jsvalify(ex.value()));
+    JS_SetPendingException(cx, ex.jsval_value());
     return false;
   case TYPE_void_t:
   case TYPE_function:
     JS_NOT_REACHED("invalid type");
     return false;
   }
   return true;
 }
@@ -3528,18 +3528,18 @@ ArrayType::ConstructData(JSContext* cx,
       // Have a length, rather than an object to initialize from.
       convertObject = false;
 
     } else if (!JSVAL_IS_PRIMITIVE(argv[0])) {
       // We were given an object with a .length property.
       // This could be a JS array, or a CData array.
       JSObject* arg = JSVAL_TO_OBJECT(argv[0]);
       js::AutoValueRooter lengthVal(cx);
-      if (!JS_GetProperty(cx, arg, "length", Jsvalify(lengthVal.addr())) ||
-          !jsvalToSize(cx, Jsvalify(lengthVal.value()), false, &length)) {
+      if (!JS_GetProperty(cx, arg, "length", lengthVal.jsval_addr()) ||
+          !jsvalToSize(cx, lengthVal.jsval_value(), false, &length)) {
         JS_ReportError(cx, "argument must be an array object or length");
         return JS_FALSE;
       }
 
     } else if (JSVAL_IS_STRING(argv[0])) {
       // We were given a string. Size the array to the appropriate length,
       // including space for the terminator.
       JSString* sourceString = JSVAL_TO_STRING(argv[0]);
@@ -3867,45 +3867,45 @@ ExtractStructField(JSContext* cx, jsval 
   if (!JS_NextProperty(cx, iter, &id))
     return NULL;
   if (JSID_IS_VOID(id)) {
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
 
   js::AutoValueRooter nameVal(cx);
-  JS_IdToValue(cx, id, Jsvalify(nameVal.addr()));
-  if (!nameVal.value().isString()) {
+  JS_IdToValue(cx, id, nameVal.jsval_addr());
+  if (!JSVAL_IS_STRING(nameVal.jsval_value())) {
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
-  JSString* name = nameVal.value().asString();
+  JSString* name = JSVAL_TO_STRING(nameVal.jsval_value());
 
   // make sure we have one, and only one, property
   if (!JS_NextProperty(cx, iter, &id))
     return NULL;
   if (!JSID_IS_VOID(id)) {
     JS_ReportError(cx, "struct field descriptors must contain one property");
     return NULL;
   }
 
   js::AutoValueRooter propVal(cx);
-  if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), Jsvalify(propVal.addr())))
+  if (!JS_GetUCProperty(cx, obj, name->chars(), name->length(), propVal.jsval_addr()))
     return NULL;
 
   if (propVal.value().isPrimitive() ||
-      !CType::IsCType(cx, &propVal.value().asObject())) {
+      !CType::IsCType(cx, JSVAL_TO_OBJECT(propVal.jsval_value()))) {
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
 
   // Undefined size or zero size struct members are illegal.
   // (Zero-size arrays are legal as struct members in C++, but libffi will
   // choke on a zero-size struct, so we disallow them.)
-  *typeObj = &propVal.value().asObject();
+  *typeObj = JSVAL_TO_OBJECT(propVal.jsval_value());
   size_t size;
   if (!CType::GetSafeSize(cx, *typeObj, &size) || size == 0) {
     JS_ReportError(cx, "struct field types must have defined and nonzero size");
     return NULL;
   }
 
   return name;
 }
@@ -4021,21 +4021,21 @@ StructType::DefineInternal(JSContext* cx
   // Process the field types.
   size_t structSize, structAlign;
   if (len != 0) {
     structSize = 0;
     structAlign = 0;
 
     for (jsuint i = 0; i < len; ++i) {
       js::AutoValueRooter item(cx);
-      if (!JS_GetElement(cx, fieldsObj, i, Jsvalify(item.addr())))
+      if (!JS_GetElement(cx, fieldsObj, i, item.jsval_addr()))
         return JS_FALSE;
 
       JSObject* fieldType;
-      JSString* name = ExtractStructField(cx, Jsvalify(item.value()), &fieldType);
+      JSString* name = ExtractStructField(cx, item.jsval_value(), &fieldType);
       if (!name)
         return JS_FALSE;
 
       // Make sure each field name is unique, and add it to the hash.
       FieldInfoHash::AddPtr entryPtr = fields->lookupForAdd(name);
       if (entryPtr) {
         JS_ReportError(cx, "struct fields must have unique names");
         return JS_FALSE;
@@ -4743,17 +4743,17 @@ FunctionType::Create(JSContext* cx, uint
     }
 
     for (jsuint i = 0; i < len; ++i)
       argTypes[i] = JSVAL_VOID;
   }
 
   // Pull out the argument types from the array, if any.
   JS_ASSERT(!argTypes.length() || arrayObj);
-  js::AutoArrayRooter items(cx, argTypes.length(), Valueify(argTypes.begin()));
+  js::AutoArrayRooter items(cx, argTypes.length(), argTypes.begin());
   for (jsuint i = 0; i < argTypes.length(); ++i) {
     if (!JS_GetElement(cx, arrayObj, i, &argTypes[i]))
       return JS_FALSE;
   }
 
   JSObject* result = CreateInternal(cx, argv[0], argv[1],
       argTypes.begin(), argTypes.length());
   if (!result)
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1180,17 +1180,17 @@ js_InitFunctionAndObjectClasses(JSContex
         JSObject *ctor;
 
         ctor = JS_GetConstructor(cx, fun_proto);
         if (!ctor) {
             fun_proto = NULL;
             goto out;
         }
         obj->defineProperty(cx, ATOM_TO_JSID(CLASS_ATOM(cx, Function)),
-                            ObjectTag(*ctor), 0, 0, 0);
+                            ObjectValue(*ctor), 0, 0, 0);
     }
 
     /* Initialize the object class next so Object.prototype works. */
     if (!js_GetClassPrototype(cx, obj, JSProto_Object, &obj_proto)) {
         fun_proto = NULL;
         goto out;
     }
     if (!obj_proto)
@@ -1225,17 +1225,17 @@ JS_InitStandardClasses(JSContext *cx, JS
 
     if (cx->globalObject)
         assertSameCompartment(cx, obj);
     else
         JS_SetGlobalObject(cx, obj);
 
     /* Define a top-level property 'undefined' with the undefined value. */
     JSAtom *atom = cx->runtime->atomState.typeAtoms[JSTYPE_VOID];
-    if (!obj->defineProperty(cx, ATOM_TO_JSID(atom), UndefinedTag(),
+    if (!obj->defineProperty(cx, ATOM_TO_JSID(atom), UndefinedValue(),
                              PropertyStub, PropertyStub,
                              JSPROP_PERMANENT | JSPROP_READONLY)) {
         return JS_FALSE;
     }
 
     /* Function and Object require cooperative bootstrapping magic. */
     if (!js_InitFunctionAndObjectClasses(cx, obj))
         return JS_FALSE;
@@ -1433,17 +1433,17 @@ JS_ResolveStandardClass(JSContext *cx, J
         return JS_TRUE;
 
     idstr = JSID_TO_STRING(id);
 
     /* Check whether we're resolving 'undefined', and define it if so. */
     atom = rt->atomState.typeAtoms[JSTYPE_VOID];
     if (idstr == ATOM_TO_STRING(atom)) {
         *resolved = JS_TRUE;
-        return obj->defineProperty(cx, ATOM_TO_JSID(atom), UndefinedTag(),
+        return obj->defineProperty(cx, ATOM_TO_JSID(atom), UndefinedValue(),
                                    PropertyStub, PropertyStub,
                                    JSPROP_PERMANENT | JSPROP_READONLY);
     }
 
     /* Try for class constructors/prototypes named by well-known atoms. */
     stdnm = NULL;
     for (i = 0; standard_class_atoms[i].init; i++) {
         JS_ASSERT(standard_class_atoms[i].clasp);
@@ -1525,17 +1525,17 @@ JS_EnumerateStandardClasses(JSContext *c
 
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj);
     rt = cx->runtime;
 
     /* Check whether we need to bind 'undefined' and define it if so. */
     atom = rt->atomState.typeAtoms[JSTYPE_VOID];
     if (!AlreadyHasOwnProperty(cx, obj, atom) &&
-        !obj->defineProperty(cx, ATOM_TO_JSID(atom), UndefinedTag(),
+        !obj->defineProperty(cx, ATOM_TO_JSID(atom), UndefinedValue(),
                              PropertyStub, PropertyStub,
                              JSPROP_PERMANENT | JSPROP_READONLY)) {
         return JS_FALSE;
     }
 
     /* Initialize any classes that have not been resolved yet. */
     for (i = 0; standard_class_atoms[i].init; i++) {
         atom = OFFSET_TO_ATOM(rt, standard_class_atoms[i].atomOffset);
@@ -2784,17 +2784,17 @@ JS_GetConstructor(JSContext *cx, JSObjec
             return NULL;
     }
     JSObject *funobj;
     if (!IsFunctionObject(cval, &funobj)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NO_CONSTRUCTOR,
                              proto->getClass()->name);
         return NULL;
     }
-    return &cval.asObject();
+    return &cval.toObject();
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetObjectId(JSContext *cx, JSObject *obj, jsid *idp)
 {
     assertSameCompartment(cx, obj);
     *idp = OBJECT_TO_JSID(obj);
     return JS_TRUE;
@@ -2802,17 +2802,17 @@ JS_GetObjectId(JSContext *cx, JSObject *
 
 JS_PUBLIC_API(JSObject *)
 JS_NewGlobalObject(JSContext *cx, JSClass *clasp)
 {
     CHECK_REQUEST(cx);
     JS_ASSERT(clasp->flags & JSCLASS_IS_GLOBAL);
     JSObject *obj = NewObjectWithGivenProto(cx, Valueify(clasp), NULL, NULL);
     if (obj && !js_SetReservedSlot(cx, obj, JSRESERVED_GLOBAL_COMPARTMENT,
-                                   PrivateTag(cx->compartment)))
+                                   PrivateValue(cx->compartment)))
         return false;
     return obj;
 }
 
 JS_PUBLIC_API(JSObject *)
 JS_NewCompartmentAndGlobalObject(JSContext *cx, JSClass *clasp, JSPrincipals *principals)
 {
     CHECK_REQUEST(cx);
@@ -2912,17 +2912,17 @@ JS_SealObject(JSContext *cx, JSObject *o
     /* Walk slots in obj and if any value is a non-null object, seal it. */
     nslots = scope->freeslot;
     for (i = 0; i != nslots; ++i) {
         const Value &v = obj->getSlot(i);
         if (i == JSSLOT_PRIVATE && (obj->getClass()->flags & JSCLASS_HAS_PRIVATE))
             continue;
         if (v.isPrimitive())
             continue;
-        if (!JS_SealObject(cx, &v.asObject(), deep))
+        if (!JS_SealObject(cx, &v.toObject(), deep))
             return JS_FALSE;
     }
     return JS_TRUE;
 }
 
 JS_PUBLIC_API(JSObject *)
 JS_ConstructObject(JSContext *cx, JSClass *jsclasp, JSObject *proto, JSObject *parent)
 {
@@ -3253,47 +3253,47 @@ JS_DefineObject(JSContext *cx, JSObject 
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, proto);
     Class *clasp = Valueify(jsclasp);
     if (!clasp)
         clasp = &js_ObjectClass;    /* default class is Object */
     nobj = NewObject(cx, clasp, proto, obj);
     if (!nobj)
         return NULL;
-    if (!DefineProperty(cx, obj, name, ObjectTag(*nobj), NULL, NULL, attrs, 0, 0))
+    if (!DefineProperty(cx, obj, name, ObjectValue(*nobj), NULL, NULL, attrs, 0, 0))
         return NULL;
     return nobj;
 }
 
 JS_PUBLIC_API(JSBool)
 JS_DefineConstDoubles(JSContext *cx, JSObject *obj, JSConstDoubleSpec *cds)
 {
     JSBool ok;
     uintN attrs;
 
     CHECK_REQUEST(cx);
     for (ok = JS_TRUE; cds->name; cds++) {
-        Value value = DoubleTag(cds->dval);
+        Value value = DoubleValue(cds->dval);
         attrs = cds->flags;
         if (!attrs)
             attrs = JSPROP_READONLY | JSPROP_PERMANENT;
         ok = DefineProperty(cx, obj, cds->name, value, NULL, NULL, attrs, 0, 0);
         if (!ok)
             break;
     }
     return ok;
 }
 
 JS_PUBLIC_API(JSBool)
 JS_DefineProperties(JSContext *cx, JSObject *obj, JSPropertySpec *ps)
 {
     JSBool ok;
 
     for (ok = true; ps->name; ps++) {
-        ok = DefineProperty(cx, obj, ps->name, UndefinedTag(),
+        ok = DefineProperty(cx, obj, ps->name, UndefinedValue(),
                             Valueify(ps->getter), Valueify(ps->setter),
                             ps->flags, JSScopeProperty::HAS_SHORTID, ps->tinyid);
         if (!ok)
             break;
     }
     return ok;
 }
 
@@ -3712,31 +3712,31 @@ JS_STATIC_ASSERT(JSSLOT_ITER_INDEX < JS_
 
 static void
 prop_iter_finalize(JSContext *cx, JSObject *obj)
 {
     void *pdata = obj->getPrivate();
     if (!pdata)
         return;
 
-    if (obj->fslots[JSSLOT_ITER_INDEX].asInt32() >= 0) {
+    if (obj->fslots[JSSLOT_ITER_INDEX].toInt32() >= 0) {
         /* Non-native case: destroy the ida enumerated when obj was created. */
         JSIdArray *ida = (JSIdArray *) pdata;
         JS_DestroyIdArray(cx, ida);
     }
 }
 
 static void
 prop_iter_trace(JSTracer *trc, JSObject *obj)
 {
     void *pdata = obj->getPrivate();
     if (!pdata)
         return;
 
-    if (obj->fslots[JSSLOT_ITER_INDEX].asInt32() < 0) {
+    if (obj->fslots[JSSLOT_ITER_INDEX].toInt32() < 0) {
         /* Native case: just mark the next property to visit. */
         ((JSScopeProperty *) pdata)->trace(trc);
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;
         MarkIdRange(trc, ida->length, ida->vector, "prop iter");
     }
 }
@@ -3798,17 +3798,17 @@ JS_NextProperty(JSContext *cx, JSObject 
     jsint i;
     JSObject *obj;
     JSScope *scope;
     JSScopeProperty *sprop;
     JSIdArray *ida;
 
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, iterobj);
-    i = iterobj->fslots[JSSLOT_ITER_INDEX].asInt32();
+    i = iterobj->fslots[JSSLOT_ITER_INDEX].toInt32();
     if (i < 0) {
         /* Native case: private data is a property tree node pointer. */
         obj = iterobj->getParent();
         JS_ASSERT(obj->isNative());
         scope = obj->scope();
         sprop = (JSScopeProperty *) iterobj->getPrivate();
 
         /*
@@ -3828,17 +3828,17 @@ JS_NextProperty(JSContext *cx, JSObject 
     } else {
         /* Non-native case: use the ida enumerated when iterobj was created. */
         ida = (JSIdArray *) iterobj->getPrivate();
         JS_ASSERT(i <= ida->length);
         if (i == 0) {
             *idp = JSID_VOID;
         } else {
             *idp = ida->vector[--i];
-            iterobj->setSlot(JSSLOT_ITER_INDEX, Int32Tag(i));
+            iterobj->setSlot(JSSLOT_ITER_INDEX, Int32Value(i));
         }
     }
     return JS_TRUE;
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetReservedSlot(JSContext *cx, JSObject *obj, uint32 index, jsval *vp)
 {
@@ -3987,17 +3987,17 @@ JS_CloneFunctionObject(JSContext *cx, JS
         JS_ASSERT(parent);
     }
 
     if (funobj->getClass() != &js_FunctionClass) {
         /*
          * We cannot clone this object, so fail (we used to return funobj, bad
          * idea, but we changed incompatibly to teach any abusers a lesson!).
          */
-        Value v = ObjectTag(*funobj);
+        Value v = ObjectValue(*funobj);
         js_ReportIsNotFunction(cx, &v, 0);
         return NULL;
     }
 
     JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
     JSObject *clone = CloneFunctionObject(cx, fun, parent);
     if (!clone)
         return NULL;
@@ -4017,17 +4017,17 @@ JS_CloneFunctionObject(JSContext *cx, JS
     if (FUN_FLAT_CLOSURE(fun)) {
         JS_ASSERT(funobj->dslots);
         if (!js_EnsureReservedSlots(cx, clone,
                                     fun->countInterpretedReservedSlots())) {
             return NULL;
         }
 
         JSUpvarArray *uva = fun->u.i.script->upvars();
-        JS_ASSERT(uva->length <= clone->dslots[-1].asPrivateUint32());
+        JS_ASSERT(uva->length <= clone->dslots[-1].toPrivateUint32());
 
         void *mark = JS_ARENA_MARK(&cx->tempPool);
         jsuword *names = js_GetLocalNameArray(cx, fun, &cx->tempPool);
         if (!names)
             return NULL;
 
         uint32 i = 0, n = uva->length;
         for (; i < n; i++) {
@@ -4096,17 +4096,17 @@ JS_ObjectIsFunction(JSContext *cx, JSObj
 
 static JSBool
 js_generic_fast_native_method_dispatcher(JSContext *cx, uintN argc, Value *vp)
 {
     JSFunctionSpec *fs;
     JSObject *tmp;
     FastNative native;
 
-    fs = (JSFunctionSpec *) vp->asObject().getReservedSlot(0).asPrivate();
+    fs = (JSFunctionSpec *) vp->toObject().getReservedSlot(0).toPrivate();
     JS_ASSERT((~fs->flags & (JSFUN_FAST_NATIVE | JSFUN_GENERIC_NATIVE)) == 0);
 
     if (argc < 1) {
         js_ReportMissingArg(cx, *vp, 0);
         return JS_FALSE;
     }
 
     if (vp[2].isPrimitive()) {
@@ -4149,17 +4149,17 @@ js_generic_fast_native_method_dispatcher
 
 static JSBool
 js_generic_native_method_dispatcher(JSContext *cx, JSObject *obj,
                                     uintN argc, Value *argv, Value *rval)
 {
     JSFunctionSpec *fs;
     JSObject *tmp;
 
-    fs = (JSFunctionSpec *) argv[-2].asObject().getReservedSlot(0).asPrivate();
+    fs = (JSFunctionSpec *) argv[-2].toObject().getReservedSlot(0).toPrivate();
     JS_ASSERT((fs->flags & (JSFUN_FAST_NATIVE | JSFUN_GENERIC_NATIVE)) ==
               JSFUN_GENERIC_NATIVE);
 
     if (argc < 1) {
         js_ReportMissingArg(cx, *(argv - 2), 0);
         return JS_FALSE;
     }
 
@@ -4188,17 +4188,17 @@ js_generic_native_method_dispatcher(JSCo
     if (!ComputeThisFromArgv(cx, argv))
         return JS_FALSE;
     js_GetTopStackFrame(cx)->thisv = argv[-1];
     JS_ASSERT(cx->fp->argv == argv);
 
     /* Clear the last parameter in case too few arguments were passed. */
     argv[--argc].setUndefined();
 
-    return fs->call(cx, &argv[-1].asObject(), argc, Jsvalify(argv), Jsvalify(rval));
+    return fs->call(cx, &argv[-1].toObject(), argc, Jsvalify(argv), Jsvalify(rval));
 }
 
 JS_PUBLIC_API(JSBool)
 JS_DefineFunctions(JSContext *cx, JSObject *obj, JSFunctionSpec *fs)
 {
     uintN flags;
     JSObject *ctor;
     JSFunction *fun;
@@ -4230,17 +4230,17 @@ JS_DefineFunctions(JSContext *cx, JSObje
             if (!fun)
                 return JS_FALSE;
             fun->u.n.extra = (uint16)fs->extra;
 
             /*
              * As jsapi.h notes, fs must point to storage that lives as long
              * as fun->object lives.
              */
-            Value priv = PrivateTag(fs);
+            Value priv = PrivateValue(fs);
             if (!js_SetReservedSlot(cx, FUN_OBJECT(fun), 0, priv))
                 return JS_FALSE;
         }
 
         JS_ASSERT(!(flags & JSFUN_FAST_NATIVE) ||
                   (uint16)(fs->extra >> 16) <= fs->nargs);
         fun = JS_DefineFunction(cx, obj, fs->name, fs->call, fs->nargs, flags);
         if (!fun)
@@ -4517,17 +4517,17 @@ JS_CompileUCFunctionForPrincipals(JSCont
 
         if (!Compiler::compileFunctionBody(cx, fun, principals,
                                            chars, length, filename, lineno)) {
             fun = NULL;
             goto out;
         }
 
         if (obj && funAtom &&
-            !obj->defineProperty(cx, ATOM_TO_JSID(funAtom), ObjectTag(*fun),
+            !obj->defineProperty(cx, ATOM_TO_JSID(funAtom), ObjectValue(*fun),
                                  NULL, NULL, JSPROP_ENUMERATE)) {
             fun = NULL;
         }
 
 #ifdef JS_SCOPE_DEPTH_METER
         if (fun && obj) {
             JSObject *pobj = obj;
             uintN depth = 1;
@@ -4699,17 +4699,17 @@ JS_EvaluateScript(JSContext *cx, JSObjec
 JS_PUBLIC_API(JSBool)
 JS_CallFunction(JSContext *cx, JSObject *obj, JSFunction *fun, uintN argc, jsval *argv,
                 jsval *rval)
 {
     JSBool ok;
 
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, fun, JSValueArray(argv, argc));
-    ok = InternalCall(cx, obj, ObjectTag(*fun), argc, Valueify(argv), Valueify(rval));
+    ok = InternalCall(cx, obj, ObjectValue(*fun), argc, Valueify(argv), Valueify(rval));
     LAST_FRAME_CHECKS(cx, ok);
     return ok;
 }
 
 JS_PUBLIC_API(JSBool)
 JS_CallFunctionName(JSContext *cx, JSObject *obj, const char *name, uintN argc, jsval *argv,
                     jsval *rval)
 {
@@ -4753,17 +4753,17 @@ JS_New(JSContext *cx, JSObject *ctor, ui
         return NULL;
 
     Value *vp = args.getvp();
     vp[0].setObject(*ctor);
     vp[1].setNull();
     memcpy(vp + 2, argv, argc * sizeof(jsval));
 
     bool ok = InvokeConstructor(cx, args);
-    JSObject *obj = ok ? vp[0].asObjectOrNull() : NULL;
+    JSObject *obj = ok ? vp[0].toObjectOrNull() : NULL;
 
     LAST_FRAME_CHECKS(cx, ok);
     return obj;
 }
 
 JS_PUBLIC_API(JSOperationCallback)
 JS_SetOperationCallback(JSContext *cx, JSOperationCallback callback)
 {
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -188,17 +188,17 @@ js_StringIsIndex(JSString *str, jsuint *
     }
     return JS_FALSE;
 }
 
 static jsuint
 ValueIsLength(JSContext *cx, Value* vp)
 {
     if (vp->isInt32()) {
-        int32_t i = vp->asInt32();
+        int32_t i = vp->toInt32();
         if (i < 0)
             goto error;
         return (jsuint) i;
     }
 
     jsdouble d;
     if (!ValueToNumber(cx, *vp, &d))
         goto error;
@@ -232,17 +232,17 @@ js_GetLengthProperty(JSContext *cx, JSOb
         return true;
     }
 
     AutoValueRooter tvr(cx);
     if (!obj->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom), tvr.addr()))
         return false;
 
     if (tvr.value().isInt32()) {
-        *lengthp = jsuint(jsint(tvr.value().asInt32())); /* jsuint cast does ToUint32 */
+        *lengthp = jsuint(jsint(tvr.value().toInt32())); /* jsuint cast does ToUint32 */
         return true;
     }
 
     JS_STATIC_ASSERT(sizeof(jsuint) == sizeof(uint32_t));
     return ValueToECMAUint32(cx, tvr.value(), (uint32_t *)lengthp);
 }
 
 JSBool JS_FASTCALL
@@ -252,17 +252,17 @@ js_IndexToId(JSContext *cx, jsuint index
 
     if (index <= JSID_INT_MAX) {
         *idp = INT_TO_JSID(index);
         return JS_TRUE;
     }
     str = js_NumberToString(cx, index);
     if (!str)
         return JS_FALSE;
-    return js_ValueToStringId(cx, StringTag(str), idp);
+    return js_ValueToStringId(cx, StringValue(str), idp);
 }
 
 static JSBool
 BigIndexToId(JSContext *cx, JSObject *obj, jsuint index, JSBool createAtom,
              jsid *idp)
 {
     jschar buf[10], *start;
     Class *clasp;
@@ -384,27 +384,27 @@ JSObject::ensureDenseArrayElements(JSCon
         if (!resizeDenseArrayElements(cx, oldcap, actualCapacity, initializeAllSlots))
             return false;
 
         if (!initializeAllSlots) {
             /*
              * Initialize the slots caller didn't actually ask for.
              */
             for (uint32 i = newcap; i < actualCapacity; i++) {
-                setDenseArrayElement(i, JS_ARRAY_HOLE);
+                setDenseArrayElement(i, MagicValue(JS_ARRAY_HOLE));
             }
         }
     }
     return true;
 }
 
 static bool
 ReallyBigIndexToId(JSContext* cx, jsdouble index, jsid* idp)
 {
-    return js_ValueToStringId(cx, DoubleTag(index), idp);
+    return js_ValueToStringId(cx, DoubleValue(index), idp);
 }
 
 static bool
 IndexToId(JSContext* cx, JSObject* obj, jsdouble index, JSBool* hole, jsid* idp,
           JSBool createAtom = JS_FALSE)
 {
     if (index <= JSID_INT_MAX) {
         *idp = INT_TO_JSID(int(index));
@@ -509,17 +509,17 @@ DeleteArrayElement(JSContext *cx, JSObje
 {
     JS_ASSERT(index >= 0);
     if (obj->isDenseArray()) {
         if (index <= jsuint(-1)) {
             jsuint idx = jsuint(index);
             if (!INDEX_TOO_SPARSE(obj, idx) && idx < obj->getDenseArrayCapacity()) {
                 if (!obj->getDenseArrayElement(idx).isMagic(JS_ARRAY_HOLE))
                     obj->decDenseArrayCountBy(1);
-                obj->setDenseArrayElement(idx, JS_ARRAY_HOLE);
+                obj->setDenseArrayElement(idx, MagicValue(JS_ARRAY_HOLE));
                 return JS_TRUE;
             }
         }
         return JS_TRUE;
     }
 
     AutoIdRooter idr(cx);
 
@@ -897,25 +897,25 @@ js_Array_dense_setelem(JSContext* cx, JS
     return dense_grow(cx, obj, i, ValueArgToConstRef(v));
 }
 JS_DEFINE_CALLINFO_4(extern, BOOL, js_Array_dense_setelem, CONTEXT, OBJECT, INT32, VALUE, 0,
                      nanojit::ACC_STORE_ANY)
 
 JSBool FASTCALL
 js_Array_dense_setelem_int(JSContext* cx, JSObject* obj, jsint i, int32 j)
 {
-    return dense_grow(cx, obj, i, Int32Tag(j));
+    return dense_grow(cx, obj, i, Int32Value(j));
 }
 JS_DEFINE_CALLINFO_4(extern, BOOL, js_Array_dense_setelem_int, CONTEXT, OBJECT, INT32, INT32, 0,
                      nanojit::ACC_STORE_ANY)
 
 JSBool FASTCALL
 js_Array_dense_setelem_double(JSContext* cx, JSObject* obj, jsint i, jsdouble d)
 {
-    return dense_grow(cx, obj, i, NumberTag(d));
+    return dense_grow(cx, obj, i, NumberValue(d));
 }
 JS_DEFINE_CALLINFO_4(extern, BOOL, js_Array_dense_setelem_double, CONTEXT, OBJECT, INT32, DOUBLE,
                      0, nanojit::ACC_STORE_ANY)
 #endif
 
 static JSBool
 array_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *value,
                      PropertyOp getter, PropertyOp setter, uintN attrs)
@@ -964,17 +964,17 @@ array_deleteProperty(JSContext *cx, JSOb
     if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
         rval->setBoolean(false);
         return JS_TRUE;
     }
 
     if (js_IdIsIndex(id, &i) && i < obj->getDenseArrayCapacity() &&
         !obj->getDenseArrayElement(i).isMagic(JS_ARRAY_HOLE)) {
         obj->decDenseArrayCountBy(1);
-        obj->setDenseArrayElement(i, JS_ARRAY_HOLE);
+        obj->setDenseArrayElement(i, MagicValue(JS_ARRAY_HOLE));
     }
 
     if (!js_SuppressDeletedProperty(cx, obj, id))
         return false;
 
     rval->setBoolean(true);
     return JS_TRUE;
 }
@@ -1087,21 +1087,21 @@ JSObject::makeDenseArraySlow(JSContext *
                             array_length_getter, array_length_setter,
                             JSSLOT_ARRAY_LENGTH, JSPROP_PERMANENT | JSPROP_SHARED, 0, 0)) {
         goto out_bad;
     }
 
     /* Create new properties pointing to existing elements. */
     for (uint32 i = 0; i < capacity; i++) {
         jsid id;
-        if (!ValueToId(cx, Int32Tag(i), &id))
+        if (!ValueToId(cx, Int32Value(i), &id))
             goto out_bad;
 
         if (obj->getDenseArrayElement(i).isMagic(JS_ARRAY_HOLE)) {
-            obj->setDenseArrayElement(i, UndefinedTag());
+            obj->setDenseArrayElement(i, UndefinedValue());
             continue;
         }
 
         if (!scope->addDataProperty(cx, id, JS_INITIAL_NSLOTS + i, JSPROP_ENUMERATE))
             goto out_bad;
     }
 
     /*
@@ -1457,24 +1457,24 @@ InitArrayElements(JSContext *cx, JSObjec
 
     /* Finish out any remaining elements past the max array index. */
     if (obj->isDenseArray() && !ENSURE_SLOW_ARRAY(cx, obj))
         return JS_FALSE;
 
     JS_ASSERT(start == MAXINDEX);
     AutoValueRooter tvr(cx);
     AutoIdRooter idr(cx);
-    Value idval = DoubleTag(MAXINDEX);
+    Value idval = DoubleValue(MAXINDEX);
     do {
         *tvr.addr() = *vector++;
         if (!js_ValueToStringId(cx, idval, idr.addr()) ||
             !obj->setProperty(cx, idr.id(), tvr.addr())) {
             return JS_FALSE;
         }
-        idval.asDoubleRef() += 1;
+        idval.getDoubleRef() += 1;
     } while (vector != end);
 
     return JS_TRUE;
 }
 
 static JSBool
 InitArrayObject(JSContext *cx, JSObject *obj, jsuint length, const Value *vector,
                 bool holey = false)
@@ -1760,17 +1760,17 @@ sort_compare(void *arg, const void *a, c
     JS_ASSERT(!av->isMagic() && !bv->isUndefined());
 
     if (!JS_CHECK_OPERATION_LIMIT(cx))
         return JS_FALSE;
 
     Value *invokevp = ca->args.getvp();
     Value *sp = invokevp;
     *sp++ = ca->fval;
-    sp++->setNull();
+    *sp++ = NullValue();
     *sp++ = *av;
     *sp++ = *bv;
 
     if (!Invoke(cx, ca->args, 0))
         return JS_FALSE;
 
     jsdouble cmp;
     if (!ValueToNumber(cx, *invokevp, &cmp))
@@ -1804,17 +1804,17 @@ sort_compare_strings(void *arg, const vo
 {
     const Value *av = (const Value *)a, *bv = (const Value *)b;
 
     JS_ASSERT(av->isString());
     JS_ASSERT(bv->isString());
     if (!JS_CHECK_OPERATION_LIMIT((JSContext *)arg))
         return JS_FALSE;
 
-    *result = (int) js_CompareStrings(av->asString(), bv->asString());
+    *result = (int) js_CompareStrings(av->toString(), bv->toString());
     return JS_TRUE;
 }
 
 static JSBool
 array_sort(JSContext *cx, uintN argc, Value *vp)
 {
     jsuint len, newlen, i, undefs;
     size_t elemsize;
@@ -2036,17 +2036,17 @@ array_sort(JSContext *cx, uintN argc, Va
             return false;
         }
     }
 
     /* Set undefs that sorted after the rest of elements. */
     while (undefs != 0) {
         --undefs;
         if (!JS_CHECK_OPERATION_LIMIT(cx) ||
-            !SetArrayElement(cx, obj, newlen++, Value(UndefinedTag()))) {
+            !SetArrayElement(cx, obj, newlen++, UndefinedValue())) {
             return false;
         }
     }
 
     /* Re-create any holes that sorted to the end of the array. */
     while (len > newlen) {
         if (!JS_CHECK_OPERATION_LIMIT(cx) || !DeleteArrayElement(cx, obj, --len))
             return JS_FALSE;
@@ -2220,17 +2220,17 @@ array_shift(JSContext *cx, uintN argc, V
             length < obj->getDenseArrayCapacity()) {
             *vp = obj->getDenseArrayElement(0);
             if (vp->isMagic(JS_ARRAY_HOLE))
                 vp->setUndefined();
             else
                 obj->decDenseArrayCountBy(1);
             Value *elems = obj->getDenseArrayElements();
             memmove(elems, elems + 1, length * sizeof(jsval));
-            obj->setDenseArrayElement(length, JS_ARRAY_HOLE);
+            obj->setDenseArrayElement(length, MagicValue(JS_ARRAY_HOLE));
             obj->setDenseArrayLength(length);
             return JS_TRUE;
         }
 
         /* Get the to-be-deleted property's value into vp ASAP. */
         if (!GetArrayElement(cx, obj, 0, &hole, vp))
             return JS_FALSE;
 
@@ -2270,17 +2270,17 @@ array_unshift(JSContext *cx, uintN argc,
             if (obj->isDenseArray() && !js_PrototypeHasIndexedProperties(cx, obj) &&
                 !INDEX_TOO_SPARSE(obj, unsigned(newlen + argc))) {
                 JS_ASSERT(newlen + argc == length + argc);
                 if (!obj->ensureDenseArrayElements(cx, length + argc))
                     return JS_FALSE;
                 Value *elems = obj->getDenseArrayElements();
                 memmove(elems + argc, elems, length * sizeof(jsval));
                 for (uint32 i = 0; i < argc; i++)
-                    obj->setDenseArrayElement(i, JS_ARRAY_HOLE);
+                    obj->setDenseArrayElement(i, MagicValue(JS_ARRAY_HOLE));
             } else {
                 last = length;
                 jsdouble upperIndex = last + argc;
                 AutoValueRooter tvr(cx);
                 do {
                     --last, --upperIndex;
                     if (!JS_CHECK_OPERATION_LIMIT(cx) ||
                         !GetArrayElement(cx, obj, last, &hole, tvr.addr()) ||
@@ -2502,17 +2502,17 @@ array_concat(JSContext *cx, uintN argc, 
     /* Loop over [0, argc] to concat args into nobj, expanding all Arrays. */
     for (uintN i = 0; i <= argc; i++) {
         if (!JS_CHECK_OPERATION_LIMIT(cx))
             return false;
         const Value &v = p[i];
         if (v.isObject()) {
             JSObject *wobj;
 
-            aobj = &v.asObject();
+            aobj = &v.toObject();
             wobj = aobj->wrappedObject(cx);
             if (wobj->isArray()) {
                 jsid id = ATOM_TO_JSID(cx->runtime->atomState.lengthAtom);
                 if (!aobj->getProperty(cx, id, tvr.addr()))
                     return false;
                 jsuint alength = ValueIsLength(cx, tvr.addr());
                 if (tvr.value().isNull())
                     return false;
@@ -2635,17 +2635,17 @@ array_indexOfHelper(JSContext *cx, JSBoo
     JSObject *obj = ComputeThisFromVp(cx, vp);
     if (!obj || !js_GetLengthProperty(cx, obj, &length))
         return JS_FALSE;
     if (length == 0)
         goto not_found;
 
     if (argc <= 1) {
         i = isLast ? length - 1 : 0;
-        tosearch = (argc != 0) ? vp[2] : Value(UndefinedTag());
+        tosearch = (argc != 0) ? vp[2] : UndefinedValue();
     } else {
         jsdouble start;
 
         tosearch = vp[2];
         if (!ValueToNumber(cx, vp[3], &start))
             return JS_FALSE;
         start = js_DoubleToInteger(start);
         if (start < 0) {
@@ -3045,17 +3045,17 @@ js_NewEmptyArray(JSContext* cx, JSObject
 
     JSObject* obj = js_NewGCObject(cx);
     if (!obj)
         return NULL;
 
     /* Initialize all fields of JSObject. */
     obj->map = const_cast<JSObjectMap *>(&SharedArrayMap);
 
-    obj->init(&js_ArrayClass, proto, proto->getParent(), NullTag());
+    obj->init(&js_ArrayClass, proto, proto->getParent(), NullValue());
     obj->setDenseArrayLength(0);
     obj->setDenseArrayCount(0);
     return obj;
 }
 #ifdef JS_TRACER
 JS_DEFINE_CALLINFO_2(extern, OBJECT, js_NewEmptyArray, CONTEXT, OBJECT, 0, nanojit::ACC_STORE_ANY)
 #endif
 
@@ -3182,22 +3182,22 @@ js_CoerceArrayToCanvasImageData(JSObject
     length = obj->getArrayLength();
     if (length < offset + count)
         return JS_FALSE;
 
     JSUint8 *dp = dest;
     for (uintN i = offset; i < offset+count; i++) {
         const Value &v = obj->getDenseArrayElement(i);
         if (v.isInt32()) {
-            jsint vi = v.asInt32();
+            jsint vi = v.toInt32();
             if (jsuint(vi) > 255)
                 vi = (vi < 0) ? 0 : 255;
             *dp++ = JSUint8(vi);
         } else if (v.isDouble()) {
-            jsdouble vd = v.asDouble();
+            jsdouble vd = v.toDouble();
             if (!(vd >= 0)) /* Not < so that NaN coerces to 0 */
                 *dp++ = 0;
             else if (vd > 255)
                 *dp++ = 255;
             else {
                 jsdouble toTruncate = vd + 0.5;
                 JSUint8 val = JSUint8(toTruncate);
 
@@ -3294,17 +3294,17 @@ js_CloneDensePrimitiveArray(JSContext *c
 
     jsuint holeCount = 0;
 
     for (jsuint i = 0; i < jsvalCount; i++) {
         const Value &val = obj->dslots[i];
 
         if (val.isString()) {
             // Strings must be made immutable before being copied to a clone.
-            if (!js_MakeStringImmutable(cx, val.asString()))
+            if (!js_MakeStringImmutable(cx, val.toString()))
                 return JS_FALSE;
         } else if (val.isMagic(JS_ARRAY_HOLE)) {
             holeCount++;
         } else if (val.isObject()) {
             /*
              * This wasn't an array of primitives. Return JS_TRUE but a null
              * clone to signal that no exception was encountered.
              */
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -247,16 +247,21 @@ js_Array(JSContext* cx, JSObject* obj, u
  * given capacity.  Non-null return value means allocation of the internal
  * buffer for a capacity of at least |capacity| succeeded.  A pointer to the
  * first element of this internal buffer is returned in the |vector| out
  * parameter.  The caller promises to fill in the first |capacity| values
  * starting from that pointer immediately after this function returns and
  * without triggering GC (so this method is allowed to leave those
  * uninitialized) and to set them to non-JSVAL_HOLE values, so that the
  * resulting array has length and count both equal to |capacity|.
+ *
+ * FIXME: for some strange reason, when this file is included from
+ * dom/ipc/TabParent.cpp in MSVC, jsuint resolves to a slightly different
+ * builtin than when mozjs.dll is built, resulting in a link error in xul.dll.
+ * It would be useful to find out what is causing this insanity.
  */
 JS_FRIEND_API(JSObject *)
 js_NewArrayObjectWithCapacity(JSContext *cx, uint32_t capacity, jsval **vector);
 
 /*
  * Makes a fast clone of a dense array as long as the array only contains
  * primitive values.
  *
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -90,17 +90,17 @@ JS_STATIC_ASSERT(ATOM_OFFSET_LIMIT % siz
 JS_STATIC_ASSERT(1 * sizeof(JSAtom *) ==
                  offsetof(JSAtomState, booleanAtoms) - ATOM_OFFSET_START);
 JS_STATIC_ASSERT((1 + 2) * sizeof(JSAtom *) ==
                  offsetof(JSAtomState, typeAtoms) - ATOM_OFFSET_START);
 
 const char *
 js_AtomToPrintableString(JSContext *cx, JSAtom *atom)
 {
-    return js_ValueToPrintableString(cx, StringTag(ATOM_TO_STRING(atom)));
+    return js_ValueToPrintableString(cx, StringValue(ATOM_TO_STRING(atom)));
 }
 
 #define JS_PROTO(name,code,init) const char js_##name##_str[] = #name;
 #include "jsproto.tbl"
 #undef JS_PROTO
 
 /*
  * String constants for common atoms defined in JSAtomState starting from
@@ -1152,41 +1152,41 @@ js_InitAtomMap(JSContext *cx, JSAtomMap 
 
 #if JS_HAS_XML_SUPPORT
 bool
 js_InternNonIntElementIdSlow(JSContext *cx, JSObject *obj, const Value &idval,
                              jsid *idp)
 {
     JS_ASSERT(idval.isObject());
     if (obj->isXML()) {
-        *idp = OBJECT_TO_JSID(&idval.asObject());
+        *idp = OBJECT_TO_JSID(&idval.toObject());
         return true;
     }
 
-    if (!js_IsFunctionQName(cx, &idval.asObject(), idp))
+    if (!js_IsFunctionQName(cx, &idval.toObject(), idp))
         return JS_FALSE;
     if (!JSID_IS_VOID(*idp))
         return true;
 
     return js_ValueToStringId(cx, idval, idp);
 }
 
 bool
 js_InternNonIntElementIdSlow(JSContext *cx, JSObject *obj, const Value &idval,
                              jsid *idp, Value *vp)
 {
     JS_ASSERT(idval.isObject());
     if (obj->isXML()) {
-        JSObject &idobj = idval.asObject();
+        JSObject &idobj = idval.toObject();
         *idp = OBJECT_TO_JSID(&idobj);
         vp->setObject(idobj);
         return true;
     }
 
-    if (!js_IsFunctionQName(cx, &idval.asObject(), idp))
+    if (!js_IsFunctionQName(cx, &idval.toObject(), idp))
         return JS_FALSE;
     if (!JSID_IS_VOID(*idp)) {
         *vp = IdToValue(*idp);
         return true;
     }
 
     if (js_ValueToStringId(cx, idval, idp)) {
         vp->setString(JSID_TO_STRING(*idp));
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -100,23 +100,23 @@ JSID_TO_ATOM(jsid id)
 }
 
 namespace js {
 
 static JS_ALWAYS_INLINE Value
 IdToValue(jsid id)
 {
     if (JSID_IS_STRING(id))
-        return StringTag(JSID_TO_STRING(id));
+        return StringValue(JSID_TO_STRING(id));
     if (JS_LIKELY(JSID_IS_INT(id)))
-        return Int32Tag(JSID_TO_INT(id));
+        return Int32Value(JSID_TO_INT(id));
     if (JS_LIKELY(JSID_IS_OBJECT(id)))
-        return ObjectTag(*JSID_TO_OBJECT(id));
+        return ObjectValue(*JSID_TO_OBJECT(id));
     JS_ASSERT(JSID_IS_DEFAULT_XML_NAMESPACE(id) || JSID_IS_VOID(id));
-    return UndefinedTag();
+    return UndefinedValue();
 }
 
 static JS_ALWAYS_INLINE jsval
 IdToJsval(jsid id)
 {
     return Jsvalify(IdToValue(id));
 }
 
--- a/js/src/jsatominlines.h
+++ b/js/src/jsatominlines.h
@@ -55,17 +55,17 @@ js_ValueToAtom(JSContext *cx, const js::
     /*
      * Optimize for the common case where v is an already-atomized string. The
      * comment in jsstr.h before JSString::flatSetAtomized explains why this is
      * thread-safe. The extra rooting via lastAtom (which would otherwise be
      * done in js_js_AtomizeString) ensures the caller that the resulting id at
      * is least weakly rooted.
      */
     if (v.isString()) {
-        str = v.asString();
+        str = v.toString();
         if (str->isAtomized()) {
             cx->weakRoots.lastAtom = *atomp = STRING_TO_ATOM(str);
             return true;
         }
     } else {
         str = js_ValueToString(cx, v);
         if (!str)
             return false;
@@ -87,33 +87,33 @@ js_ValueToStringId(JSContext *cx, const 
     }
     return false;
 }
 
 inline bool
 js_InternNonIntElementId(JSContext *cx, JSObject *obj, const js::Value &idval,
                          jsid *idp)
 {
-    JS_ASSERT(!idval.isInt32() || !INT_FITS_IN_JSID(idval.asInt32()));
+    JS_ASSERT(!idval.isInt32() || !INT_FITS_IN_JSID(idval.toInt32()));
 
 #if JS_HAS_XML_SUPPORT
     extern bool js_InternNonIntElementIdSlow(JSContext *, JSObject *,
                                              const js::Value &, jsid *);
     if (idval.isObject())
         return js_InternNonIntElementIdSlow(cx, obj, idval, idp);
 #endif
 
     return js_ValueToStringId(cx, idval, idp);
 }
 
 inline bool
 js_InternNonIntElementId(JSContext *cx, JSObject *obj, const js::Value &idval,
                          jsid *idp, js::Value *vp)
 {
-    JS_ASSERT(!idval.isInt32() || !INT_FITS_IN_JSID(idval.asInt32()));
+    JS_ASSERT(!idval.isInt32() || !INT_FITS_IN_JSID(idval.toInt32()));
 
 #if JS_HAS_XML_SUPPORT
     extern bool js_InternNonIntElementIdSlow(JSContext *, JSObject *,
                                              const js::Value &,
                                              jsid *, js::Value *);
     if (idval.isObject())
         return js_InternNonIntElementIdSlow(cx, obj, idval, idp, vp);
 #endif
@@ -134,12 +134,12 @@ js_Int32ToId(JSContext* cx, int32 index,
         *id = INT_TO_JSID(index);
         return true;
     }
 
     JSString* str = js_NumberToString(cx, index);
     if (!str)
         return false;
 
-    return js_ValueToStringId(cx, js::StringTag(str), id);
+    return js_ValueToStringId(cx, js::StringValue(str), id);
 }
 
 #endif /* jsatominlines_h___ */
--- a/js/src/jsbool.cpp
+++ b/js/src/jsbool.cpp
@@ -76,32 +76,32 @@ static JSBool
 bool_toSource(JSContext *cx, uintN argc, Value *vp)
 {
     const Value *primp;
     if (!js_GetPrimitiveThis(cx, vp, &js_BooleanClass, &primp))
         return JS_FALSE;
     char buf[32];
     JS_snprintf(buf, sizeof buf, "(new %s(%s))",
                 js_BooleanClass.name,
-                JS_BOOLEAN_STR(primp->asBoolean()));
+                JS_BOOLEAN_STR(primp->toBoolean()));
     JSString *str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return JS_FALSE;
     vp->setString(str);
     return JS_TRUE;
 }
 #endif
 
 static JSBool
 bool_toString(JSContext *cx, uintN argc, Value *vp)
 {
     const Value *primp;
     if (!js_GetPrimitiveThis(cx, vp, &js_BooleanClass, &primp))
         return JS_FALSE;
-    JSAtom *atom = cx->runtime->atomState.booleanAtoms[primp->asBoolean() ? 1 : 0];
+    JSAtom *atom = cx->runtime->atomState.booleanAtoms[primp->toBoolean() ? 1 : 0];
     JSString *str = ATOM_TO_STRING(atom);
     if (!str)
         return JS_FALSE;
     vp->setString(str);
     return JS_TRUE;
 }
 
 static JSBool
@@ -144,17 +144,17 @@ JSObject *
 js_InitBooleanClass(JSContext *cx, JSObject *obj)
 {
     JSObject *proto;
 
     proto = js_InitClass(cx, obj, NULL, &js_BooleanClass, Boolean, 1,
                          NULL, boolean_methods, NULL, NULL);
     if (!proto)
         return NULL;
-    proto->setPrimitiveThis(BooleanTag(false));
+    proto->setPrimitiveThis(BooleanValue(false));
     return proto;
 }
 
 JSString *
 js_BooleanToString(JSContext *cx, JSBool b)
 {
     return ATOM_TO_STRING(cx->runtime->atomState.booleanAtoms[b ? 1 : 0]);
 }
@@ -169,20 +169,20 @@ js_BooleanToCharBuffer(JSContext *cx, JS
 JSBool
 js_ValueToBoolean(const Value &v)
 {
     if (v.isNullOrUndefined())
         return JS_FALSE;
     if (v.isObject())
         return JS_TRUE;
     if (v.isString())
-        return v.asString()->length() != 0;
+        return v.toString()->length() != 0;
     if (v.isInt32())
-        return v.asInt32() != 0;
+        return v.toInt32() != 0;
     if (v.isDouble()) {
         jsdouble d;
 
-        d = v.asDouble();
+        d = v.toDouble();
         return !JSDOUBLE_IS_NaN(d) && d != 0;
     }
     JS_ASSERT(v.isBoolean());
-    return v.asBoolean();
+    return v.toBoolean();
 }
--- a/js/src/jsbuiltins.cpp
+++ b/js/src/jsbuiltins.cpp
@@ -132,27 +132,27 @@ js_UnboxInt32(uint32 tag, uint32 payload
 JS_DEFINE_CALLINFO_2(extern, INT32, js_UnboxInt32, UINT32, UINT32, 1, ACC_NONE)
 
 #elif JS_BITS_PER_WORD == 64
 
 jsdouble FASTCALL
 js_UnboxDouble(Value v)
 {
     if (v.isInt32())
-        return (jsdouble)v.asInt32();
-    return v.asDouble();
+        return (jsdouble)v.toInt32();
+    return v.toDouble();
 }
 JS_DEFINE_CALLINFO_1(extern, DOUBLE, js_UnboxDouble, JSVAL, 1, ACC_NONE)
 
 int32 FASTCALL
 js_UnboxInt32(Value v)
 {
     if (v.isInt32())
-        return v.asInt32();
-    return js_DoubleToECMAInt32(v.asDouble());
+        return v.toInt32();
+    return js_DoubleToECMAInt32(v.toDouble());
 }
 JS_DEFINE_CALLINFO_1(extern, INT32, js_UnboxInt32, VALUE, 1, ACC_NONE)
 
 #endif
 
 int32 FASTCALL
 js_DoubleToInt32(jsdouble d)
 {
@@ -319,17 +319,17 @@ js_NewNullClosure(JSContext* cx, JSObjec
 
     JSFunction *fun = (JSFunction*) funobj;
     JS_ASSERT(GET_FUNCTION_PRIVATE(cx, funobj) == fun);
 
     JSObject* closure = js_NewGCObject(cx);
     if (!closure)
         return NULL;
 
-    closure->initSharingEmptyScope(&js_FunctionClass, proto, parent, PrivateTag(fun));
+    closure->initSharingEmptyScope(&js_FunctionClass, proto, parent, PrivateValue(fun));
     return closure;
 }
 JS_DEFINE_CALLINFO_4(extern, OBJECT, js_NewNullClosure, CONTEXT, OBJECT, OBJECT, OBJECT, 0,
                      ACC_STORE_ANY)
 
 JS_REQUIRES_STACK JSBool FASTCALL
 js_PopInterpFrame(JSContext* cx, TracerState* state)
 {
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -1819,17 +1819,17 @@ js_ReportMissingArg(JSContext *cx, const
 {
     char argbuf[11];
     char *bytes;
     JSAtom *atom;
 
     JS_snprintf(argbuf, sizeof argbuf, "%u", arg);
     bytes = NULL;
     if (IsFunctionObject(v)) {
-        atom = GET_FUNCTION_PRIVATE(cx, &v.asObject())->atom;
+        atom = GET_FUNCTION_PRIVATE(cx, &v.toObject())->atom;
         bytes = DecompileValueGenerator(cx, JSDVG_SEARCH_STACK,
                                         v, ATOM_TO_STRING(atom));
         if (!bytes)
             return;
     }
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                          JSMSG_MISSING_FUN_ARG, argbuf,
                          bytes ? bytes : "");
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -2291,17 +2291,17 @@ class AutoPreserveWeakRoots : private Au
 };
 
 /* FIXME(bug 332648): Move this into a public header. */
 class AutoValueRooter : private AutoGCRooter
 {
   public:
     explicit AutoValueRooter(JSContext *cx
                              JS_GUARD_OBJECT_NOTIFIER_PARAM)
-      : AutoGCRooter(cx, JSVAL), val(js::NullTag())
+      : AutoGCRooter(cx, JSVAL), val(js::NullValue())
     {
         JS_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     AutoValueRooter(JSContext *cx, const Value &v
                     JS_GUARD_OBJECT_NOTIFIER_PARAM)
       : AutoGCRooter(cx, JSVAL), val(v)
     {
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -236,17 +236,17 @@ class CompartmentChecker
 
     void check(JSObject *obj) {
         if (obj)
             check(obj->getCompartment(context));
     }
 
     void check(const js::Value &v) {
         if (v.isObject())
-            check(&v.asObject());
+            check(&v.toObject());
     }
 
     void check(jsval v) {
         check(Valueify(v));
     }
 
     void check(const ValueArray &arr) {
         for (size_t i = 0; i < arr.length; i++)
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -1193,17 +1193,17 @@ date_now_tn(JSContext*)
  * Get UTC time from the date object. Returns false if the object is not
  * Date type.
  */
 static JSBool
 GetUTCTime(JSContext *cx, JSObject *obj, Value *vp, jsdouble *dp)
 {
     if (!InstanceOf(cx, obj, &js_DateClass, vp ? vp + 2 : NULL))
         return JS_FALSE;
-    *dp = obj->getDateUTCTime().asNumber();
+    *dp = obj->getDateUTCTime().toNumber();
     return JS_TRUE;
 }
 
 static void
 SetDateToNaN(JSContext *cx, JSObject *obj, Value *vp = NULL)
 {
     JS_ASSERT(obj->getClass() == &js_DateClass);
 
@@ -1217,41 +1217,41 @@ SetDateToNaN(JSContext *cx, JSObject *ob
  * Set UTC time to a given time and invalidate cached local time.
  */
 static JSBool
 SetUTCTime(JSContext *cx, JSObject *obj, jsdouble t, Value *vp = NULL)
 {
     JS_ASSERT(obj->getClass() == &js_DateClass);
 
     obj->setDateLocalTime(cx->runtime->NaNValue);
-    obj->setDateUTCTime(DoubleTag(t));
+    obj->setDateUTCTime(DoubleValue(t));
     if (vp)
         vp->setDouble(t);
     return true;
 }
 
 /*
  * Get the local time, cache it if necessary. If UTC time is not finite
  * (e.g., NaN), the local time slot is set to the UTC time without conversion.
  */
 static JSBool
 GetAndCacheLocalTime(JSContext *cx, JSObject *obj, Value *vp, jsdouble *dp)
 {
     if (!obj || !InstanceOf(cx, obj, &js_DateClass, vp ? vp + 2 : NULL))
         return false;
 
-    jsdouble result = obj->getDateLocalTime().asNumber();
+    jsdouble result = obj->getDateLocalTime().toNumber();
     if (JSDOUBLE_IS_NaN(result)) {
-        result = obj->getDateUTCTime().asDouble();
+        result = obj->getDateUTCTime().toDouble();
 
         /* if result is NaN, it couldn't be finite. */
         if (JSDOUBLE_IS_FINITE(result))
             result = LocalTime(result, cx);
 
-        obj->setDateLocalTime(DoubleTag(result));
+        obj->setDateLocalTime(DoubleValue(result));
     }
 
     *dp = result;
     return true;
 }
 
 /*
  * See ECMA 15.9.5.4 thru 15.9.5.23
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -675,17 +675,17 @@ js_watch_set(JSContext *cx, JSObject *ob
                     DropWatchPointAndUnlock(cx, wp, JSWP_HELD);
                     return JS_FALSE;
                 }
 
                 /* Initialize slots/frame. */
                 Value *vp = frame.getvp();
                 MakeValueRangeGCSafe(vp, vplen);
                 vp[0].setObject(*closure);
-                vp[1] = NullTag();  // satisfy LeaveTree assert
+                vp[1].setNull();  // satisfy LeaveTree assert
                 JSStackFrame *fp = frame.getFrame();
                 PodZero(fp);
                 MakeValueRangeGCSafe(fp->slots(), nfixed);
                 fp->script = script;
                 fp->fun = fun;
                 fp->argv = vp + 2;
                 fp->scopeChain = closure->getParent();
                 fp->argsobj = NULL;
@@ -704,17 +704,17 @@ js_watch_set(JSContext *cx, JSObject *ob
                     DropWatchPointAndUnlock(cx, wp, JSWP_HELD);
                     return JS_FALSE;
                 }
             }
 
             JSBool ok = !wp->setter ||
                         (sprop->hasSetterValue()
                          ? InternalCall(cx, obj,
-                                        ObjectTag(*CastAsObject(wp->setter)),
+                                        ObjectValue(*CastAsObject(wp->setter)),
                                         1, vp, vp)
                          : callJSPropertyOpSetter(cx, wp->setter, obj, userid, vp));
 
             /* Evil code can cause us to have an arguments object. */
             if (frame.getFrame())
                 frame.getFrame()->putActivationObjects(cx);
 
             DBG_LOCK(rt);
@@ -728,17 +728,17 @@ js_watch_set(JSContext *cx, JSObject *ob
 JSBool
 js_watch_set_wrapper(JSContext *cx, JSObject *obj, uintN argc, Value *argv,
                      Value *rval)
 {
     JSObject *funobj;
     JSFunction *wrapper;
     jsid userid;
 
-    funobj = &argv[-2].asObject();
+    funobj = &argv[-2].toObject();
     wrapper = GET_FUNCTION_PRIVATE(cx, funobj);
     userid = ATOM_TO_JSID(wrapper->atom);
     *rval = argv[0];
     return js_watch_set(cx, obj, userid, rval);
 }
 
 static bool
 IsWatchedProperty(JSContext *cx, JSScopeProperty *sprop)
@@ -829,33 +829,33 @@ JS_SetWatchPoint(JSContext *cx, JSObject
         return JS_FALSE;
     sprop = (JSScopeProperty *) prop;
     rt = cx->runtime;
     if (!sprop) {
         /* Check for a deleted symbol watchpoint, which holds its property. */
         sprop = js_FindWatchPoint(rt, obj->scope(), propid);
         if (!sprop) {
             /* Make a new property in obj so we can watch for the first set. */
-            if (!js_DefineNativeProperty(cx, obj, propid, Value(UndefinedTag()), NULL, NULL,
+            if (!js_DefineNativeProperty(cx, obj, propid, UndefinedValue(), NULL, NULL,
                                          JSPROP_ENUMERATE, 0, 0, &prop)) {
                 return JS_FALSE;
             }
             sprop = (JSScopeProperty *) prop;
         }
     } else if (pobj != obj) {
         /* Clone the prototype property so we can watch the right object. */
         AutoValueRooter valroot(cx);
         PropertyOp getter, setter;
         uintN attrs, flags;
         intN shortid;
 
         if (pobj->isNative()) {
             valroot.set(SPROP_HAS_VALID_SLOT(sprop, pobj->scope())
                         ? pobj->lockedGetSlot(sprop->slot)
-                        : Value(UndefinedTag()));
+                        : UndefinedValue());
             getter = sprop->getter();
             setter = sprop->setter();
             attrs = sprop->attributes();
             flags = sprop->getFlags();
             shortid = sprop->shortid;
             JS_UNLOCK_OBJ(cx, pobj);
         } else {
             if (!pobj->getProperty(cx, propid, valroot.addr()) ||
@@ -1584,17 +1584,17 @@ SetupFakeFrame(JSContext *cx, ExecuteFra
     const uintN vplen = 2;
     const uintN nfixed = 0;
     if (!cx->stack().getExecuteFrame(cx, js_GetTopStackFrame(cx), vplen, nfixed, frame))
         return false;
 
     Value *vp = frame.getvp();
     PodZero(vp, vplen);
     vp[0].setObject(*scopeobj);
-    vp[1] = NullTag();  // satisfy LeaveTree assert
+    vp[1].setNull();  // satisfy LeaveTree assert
 
     JSStackFrame *fp = frame.getFrame();
     PodZero(fp);
     fp->fun = fun;
     fp->argv = vp + 2;
     fp->scopeChain = scopeobj->getGlobal();
 
     regs.pc = NULL;
@@ -1734,17 +1734,17 @@ JS_SetDebugErrorHook(JSRuntime *rt, JSDe
 JS_PUBLIC_API(size_t)
 JS_GetObjectTotalSize(JSContext *cx, JSObject *obj)
 {
     size_t nbytes;
     JSScope *scope;
 
     nbytes = sizeof *obj;
     if (obj->dslots) {
-        nbytes += (obj->dslots[-1].asPrivateUint32() - JS_INITIAL_NSLOTS + 1)
+        nbytes += (obj->dslots[-1].toPrivateUint32() - JS_INITIAL_NSLOTS + 1)
                   * sizeof obj->dslots[0];
     }
     if (obj->isNative()) {
         scope = obj->scope();
         if (!scope->isSharedEmpty()) {
             nbytes += sizeof *scope;
             nbytes += SCOPE_CAPACITY(scope) * sizeof(JSScopeProperty *);
         }
--- a/js/src/jsdtracef.cpp
+++ b/js/src/jsdtracef.cpp
@@ -110,26 +110,26 @@ jsdtrace_jsvaltovoid(JSContext *cx, cons
 {
     if (argval.isNull())
         return (void *)JS_TYPE_STR(JSTYPE_NULL);
 
     if (argval.isUndefined())
         return (void *)JS_TYPE_STR(JSTYPE_VOID);
 
     if (argval.isBoolean())
-        return (void *)argval.asBoolean();
+        return (void *)argval.toBoolean();
 
     if (argval.isString())
-        return (void *)js_GetStringBytes(cx, argval.asString());
+        return (void *)js_GetStringBytes(cx, argval.toString());
 
     if (argval.isNumber()) {
         if (argval.isInt32())
-            return (void *)argval.asInt32();
+            return (void *)argval.toInt32();
         // FIXME Now what?
-        //return (void *)argval.asDouble();
+        //return (void *)argval.toDouble();
     }
 
     return argval.asGCThing();
 }
 
 static char *
 jsdtrace_fun_name(JSContext *cx, const JSFunction *fun)
 {
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -1549,17 +1549,17 @@ js_PopStatementCG(JSContext *cx, JSCodeG
 }
 
 JSBool
 js_DefineCompileTimeConstant(JSContext *cx, JSCodeGenerator *cg, JSAtom *atom,
                              JSParseNode *pn)
 {
     /* XXX just do numbers for now */
     if (pn->pn_type == TOK_NUMBER) {
-        if (!cg->constMap.put(atom, NumberTag(pn->pn_dval)))
+        if (!cg->constMap.put(atom, NumberValue(pn->pn_dval)))
             return JS_FALSE;
     }
     return JS_TRUE;
 }
 
 JSStmtInfo *
 js_LexicalLookup(JSTreeContext *tc, JSAtom *atom, jsint *slotp, JSStmtInfo *stmt)
 {
@@ -1581,17 +1581,17 @@ js_LexicalLookup(JSTreeContext *tc, JSAt
         JS_ASSERT(obj->getClass() == &js_BlockClass);
         scope = obj->scope();
         sprop = scope->lookup(ATOM_TO_JSID(atom));
         if (sprop) {
             JS_ASSERT(sprop->hasShortID());
 
             if (slotp) {
                 JS_ASSERT(obj->fslots[JSSLOT_BLOCK_DEPTH].isInt32());
-                *slotp = obj->fslots[JSSLOT_BLOCK_DEPTH].asInt32() +
+                *slotp = obj->fslots[JSSLOT_BLOCK_DEPTH].toInt32() +
                          sprop->shortid;
             }
             return stmt;
         }
     }
 
     if (slotp)
         *slotp = -1;
@@ -1836,17 +1836,17 @@ EmitEnterBlock(JSContext *cx, JSParseNod
         const Value &v = blockObj->getSlot(slot);
 
         /* Beware the empty destructuring dummy. */
         if (v.isUndefined()) {
             JS_ASSERT(slot + 1 <= limit);
             continue;
         }
 
-        JSDefinition *dn = (JSDefinition *) v.asPrivate();
+        JSDefinition *dn = (JSDefinition *) v.toPrivate();
         JS_ASSERT(dn->pn_defn);
         JS_ASSERT(uintN(dn->frameSlot() + depth) < JS_BIT(16));
         dn->pn_cookie.set(dn->pn_cookie.level(), dn->frameSlot() + depth);
 #ifdef DEBUG
         for (JSParseNode *pnu = dn->dn_uses; pnu; pnu = pnu->pn_link) {
             JS_ASSERT(pnu->pn_lexdef == dn);
             JS_ASSERT(!(pnu->pn_dflags & PND_BOUND));
             JS_ASSERT(pnu->pn_cookie.isFree());
@@ -2949,17 +2949,17 @@ EmitNumberOp(JSContext *cx, jsdouble dva
             if (off < 0)
                 return JS_FALSE;
             pc = CG_CODE(cg, off);
             SET_INT32(pc, ival);
         }
         return JS_TRUE;
     }
 
-    if (!cg->constList.append(DoubleTag(dval)))
+    if (!cg->constList.append(DoubleValue(dval)))
         return JS_FALSE;
 
     return EmitIndexOp(cx, JSOP_DOUBLE, cg->constList.length() - 1, cg);
 }
 
 /*
  * To avoid bloating all parse nodes for the special case of switch, values are
  * allocated in the temp pool and pointed to by the parse node. These values
@@ -3157,17 +3157,17 @@ EmitSwitch(JSContext *cx, JSCodeGenerato
             *pn3->pn_pval = constVal;
 
             if (switchOp != JSOP_TABLESWITCH)
                 continue;
             if (!pn3->pn_pval->isInt32()) {
                 switchOp = JSOP_LOOKUPSWITCH;
                 continue;
             }
-            i = pn3->pn_pval->asInt32();
+            i = pn3->pn_pval->toInt32();
             if ((jsuint)(i + (jsint)JS_BIT(15)) >= (jsuint)JS_BIT(16)) {
                 switchOp = JSOP_LOOKUPSWITCH;
                 continue;
             }
             if (i < low)
                 low = i;
             if (high < i)
                 high = i;
@@ -3352,17 +3352,17 @@ EmitSwitch(JSContext *cx, JSCodeGenerato
                 tableSize = (size_t)tableLength * sizeof *table;
                 table = (JSParseNode **) cx->malloc(tableSize);
                 if (!table)
                     return JS_FALSE;
                 memset(table, 0, tableSize);
                 for (pn3 = pn2->pn_head; pn3; pn3 = pn3->pn_next) {
                     if (pn3->pn_type == TOK_DEFAULT)
                         continue;
-                    i = pn3->pn_pval->asInt32();
+                    i = pn3->pn_pval->toInt32();
                     i -= low;
                     JS_ASSERT((uint32)i < tableLength);
                     table[i] = pn3;
                 }
             }
         } else {
             JS_ASSERT(switchOp == JSOP_LOOKUPSWITCH);
 
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -280,17 +280,17 @@ InitExnPrivate(JSContext *cx, JSObject *
     older = JS_SetErrorReporter(cx, NULL);
     state = JS_SaveExceptionState(cx);
 
     callerid = ATOM_TO_JSID(cx->runtime->atomState.callerAtom);
     stackDepth = 0;
     valueCount = 0;
     for (fp = js_GetTopStackFrame(cx); fp; fp = fp->down) {
         if (fp->fun && fp->argv) {
-            Value v = NullTag();
+            Value v = NullValue();
             if (checkAccess &&
                 !checkAccess(cx, fp->callee(), callerid, JSACC_READ, &v)) {
                 break;
             }
             valueCount += fp->argc;
         }
         ++stackDepth;
     }
@@ -695,23 +695,23 @@ Exception(JSContext *cx, JSObject *obj, 
     if (!JS_IsConstructing(cx)) {
         /*
          * ECMA ed. 3, 15.11.1 requires Error, etc., to construct even when
          * called as functions, without operator new.  But as we do not give
          * each constructor a distinct JSClass, whose .name member is used by
          * NewNativeClassInstance to find the class prototype, we must get the
          * class prototype ourselves.
          */
-        if (!argv[-2].asObject().getProperty(cx,
+        if (!argv[-2].toObject().getProperty(cx,
                                              ATOM_TO_JSID(cx->runtime->atomState
                                                           .classPrototypeAtom),
                                              rval)) {
             return JS_FALSE;
         }
-        JSObject *errProto = &rval->asObject();
+        JSObject *errProto = &rval->toObject();
         obj = NewNativeClassInstance(cx, &js_ErrorClass, errProto, errProto->getParent());
         if (!obj)
             return JS_FALSE;
         rval->setObject(*obj);
     }
 
     /*
      * If it's a new object of class Exception, then null out the private
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -126,17 +126,17 @@ js_GetArgsProperty(JSContext *cx, JSStac
             return false;
 
         JSObject *obj;
         if (v.isPrimitive()) {
             obj = js_ValueToNonNullObject(cx, v);
             if (!obj)
                 return false;
         } else {
-            obj = &v.asObject();
+            obj = &v.toObject();
         }
         return obj->getProperty(cx, id, vp);
     }
 
     vp->setUndefined();
     if (JSID_IS_INT(id)) {
         uint32 arg = uint32(JSID_TO_INT(id));
         JSObject *argsobj = fp->argsobj;
@@ -178,18 +178,18 @@ NewArguments(JSContext *cx, JSObject *pa
     if (!js_GetClassPrototype(cx, parent, JSProto_Object, &proto))
         return NULL;
 
     JSObject *argsobj = js_NewGCObject(cx);
     if (!argsobj)
         return NULL;
 
     /* Init immediately to avoid GC seeing a half-init'ed object. */
-    argsobj->init(&js_ArgumentsClass, proto, parent, PrivateTag(NULL));
-    argsobj->setArgsCallee(ObjectOrNullTag(callee));
+    argsobj->init(&js_ArgumentsClass, proto, parent, PrivateValue(NULL));
+    argsobj->setArgsCallee(ObjectOrNullValue(callee));
     argsobj->setArgsLength(argc);
 
     argsobj->map = cx->runtime->emptyArgumentsScope->hold();
 
     /* This must come after argsobj->map has been set. */
     if (!js_EnsureReservedSlots(cx, argsobj, argc))
         return NULL;
     return argsobj;
@@ -222,17 +222,17 @@ js_GetArgsObject(JSContext *cx, JSStackF
 
     /* Create an arguments object for fp only if it lacks one. */
     JSObject *argsobj = fp->argsobj;
     if (argsobj)
         return argsobj;
 
     /* Compute the arguments object's parent slot from fp's scope chain. */
     JSObject *global = fp->scopeChain->getGlobal();
-    argsobj = NewArguments(cx, global, fp->argc, &fp->argv[-2].asObject());
+    argsobj = NewArguments(cx, global, fp->argc, &fp->argv[-2].toObject());
     if (!argsobj)
         return argsobj;
 
     /* Link the new object to fp so it can get actual argument values. */
     argsobj->setPrivate(fp);
     fp->argsobj = argsobj;
     return argsobj;
 }
@@ -284,21 +284,21 @@ JS_DEFINE_CALLINFO_3(extern, BOOL, js_Pu
 static JSBool
 args_delProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     JS_ASSERT(obj->isArguments());
 
     if (JSID_IS_INT(id)) {
         uintN arg = uintN(JSID_TO_INT(id));
         if (arg < obj->getArgsLength())
-            obj->setArgsElement(arg, Value(JS_ARGS_HOLE));
+            obj->setArgsElement(arg, MagicValue(JS_ARGS_HOLE));
     } else if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
         obj->setArgsLengthOverridden();
     } else if (JSID_IS_ATOM(id, cx->runtime->atomState.calleeAtom)) {
-        obj->setArgsCallee(Value(JS_ARGS_HOLE));
+        obj->setArgsCallee(MagicValue(JS_ARGS_HOLE));
     }
     return true;
 }
 
 static JS_REQUIRES_STACK JSObject *
 WrapEscapingClosure(JSContext *cx, JSStackFrame *fp, JSObject *funobj, JSFunction *fun)
 {
     JS_ASSERT(GET_FUNCTION_PRIVATE(cx, funobj) == fun);
@@ -517,17 +517,17 @@ ArgGetter(JSContext *cx, JSObject *obj, 
             /*
              * If this function or one in it needs upvars that reach above it
              * in the scope chain, it must not be a null closure (it could be a
              * flat closure, or an unoptimized closure -- the latter itself not
              * necessarily heavyweight). Rather than wrap here, we simply throw
              * to reduce code size and tell debugger users the truth instead of
              * passing off a fibbing wrapper.
              */
-            if (GET_FUNCTION_PRIVATE(cx, &v.asObject())->needsWrapper()) {
+            if (GET_FUNCTION_PRIVATE(cx, &v.toObject())->needsWrapper()) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                      JSMSG_OPTIMIZED_CLOSURE_LEAK);
                 return false;
             }
             *vp = v;
         }
     }
     return true;
@@ -595,17 +595,17 @@ args_resolve(JSContext *cx, JSObject *ob
             valid = true;
     }
 
     if (valid) {
         /*
          * XXX ECMA specs DontEnum even for indexed properties, contrary to
          * other array-like objects.
          */
-        Value tmp = UndefinedTag();
+        Value tmp = UndefinedValue();
         if (!js_DefineProperty(cx, obj, id, &tmp, ArgGetter, ArgSetter, JSPROP_SHARED))
             return JS_FALSE;
         *objp = obj;
     }
     return true;
 }
 
 static JSBool
@@ -755,34 +755,34 @@ CalleeGetter(JSContext *cx, JSObject *ob
 static JSObject *
 NewCallObject(JSContext *cx, JSFunction *fun, JSObject *scopeChain)
 {
     JSObject *callobj = js_NewGCObject(cx);
     if (!callobj)
         return NULL;
 
     /* Init immediately to avoid GC seeing a half-init'ed object. */
-    callobj->init(&js_CallClass, NULL, scopeChain, PrivateTag(NULL));
+    callobj->init(&js_CallClass, NULL, scopeChain, PrivateValue(NULL));
     callobj->map = cx->runtime->emptyCallScope->hold();
 
     /* This must come after callobj->map has been set. */
     if (!js_EnsureReservedSlots(cx, callobj, fun->countArgsAndVars()))
         return NULL;
     return callobj;
 }
 
 static inline JSObject *
 NewDeclEnvObject(JSContext *cx, JSStackFrame *fp)
 {
     JSObject *envobj = js_NewGCObject(cx);
     if (!envobj)
         return NULL;
 
     /* Init immediately to avoid GC seeing a half-init'ed object. */
-    envobj->init(&js_DeclEnvClass, NULL, fp->scopeChain, PrivateTag(fp));
+    envobj->init(&js_DeclEnvClass, NULL, fp->scopeChain, PrivateValue(fp));
     envobj->map = cx->runtime->emptyDeclEnvScope->hold();
     return envobj;
 }
 
 JSObject *
 js_GetCallObject(JSContext *cx, JSStackFrame *fp)
 {
     JSObject *callobj;
@@ -846,34 +846,34 @@ js_GetCallObject(JSContext *cx, JSStackF
 
 JSObject * JS_FASTCALL
 js_CreateCallObjectOnTrace(JSContext *cx, JSFunction *fun, JSObject *callee, JSObject *scopeChain)
 {
     JS_ASSERT(!js_IsNamedLambda(fun));
     JSObject *callobj = NewCallObject(cx, fun, scopeChain);
     if (!callobj)
         return NULL;
-    callobj->setSlot(JSSLOT_CALLEE, ObjectTag(*callee));
+    callobj->setSlot(JSSLOT_CALLEE, ObjectValue(*callee));
     return callobj;
 }
 
 JS_DEFINE_CALLINFO_4(extern, OBJECT, js_CreateCallObjectOnTrace, CONTEXT, FUNCTION, OBJECT, OBJECT,
                      0, nanojit::ACC_STORE_ANY)
 
 JSFunction *
 js_GetCallObjectFunction(JSObject *obj)
 {
     JS_ASSERT(obj->getClass() == &js_CallClass);
     const Value &v = obj->getSlot(JSSLOT_CALLEE);
     if (v.isUndefined()) {
         /* Newborn or prototype object. */
         return NULL;
     }
     JS_ASSERT(v.isObject());
-    return GET_FUNCTION_PRIVATE(cx, &v.asObject());
+    return GET_FUNCTION_PRIVATE(cx, &v.toObject());
 }
 
 inline static void
 CopyValuesToCallObject(JSObject *callobj, int nargs, Value *argv, int nvars, Value *slots)
 {
     memcpy(callobj->dslots, argv, nargs * sizeof(Value));
     memcpy(callobj->dslots + nargs, slots, nvars * sizeof(Value));
 }
@@ -882,17 +882,17 @@ void
 js_PutCallObject(JSContext *cx, JSStackFrame *fp)
 {
     JSObject *callobj = fp->callobj;
     JS_ASSERT(callobj);
 
     /* Get the arguments object to snapshot fp's actual argument values. */
     if (fp->argsobj) {
         if (!(fp->flags & JSFRAME_OVERRIDE_ARGS))
-            callobj->setSlot(JSSLOT_CALL_ARGUMENTS, ObjectOrNullTag(fp->argsobj));
+            callobj->setSlot(JSSLOT_CALL_ARGUMENTS, ObjectOrNullValue(fp->argsobj));
         js_PutArgsObject(cx, fp);
     }
 
     JSFunction *fun = fp->fun;
     JS_ASSERT(fun == js_GetCallObjectFunction(callobj));
     uintN n = fun->countArgsAndVars();
 
     /*
@@ -1008,17 +1008,17 @@ CallPropertyOp(JSContext *cx, JSObject *
     uintN i = 0;
     if (kind != JSCPK_ARGUMENTS) {
         JS_ASSERT((int16) JSID_TO_INT(id) == JSID_TO_INT(id));
         i = (uint16) JSID_TO_INT(id);
     }
 
     Value *array;
     if (kind == JSCPK_UPVAR) {
-        JSObject *callee = &obj->getSlot(JSSLOT_CALLEE).asObject();
+        JSObject *callee = &obj->getSlot(JSSLOT_CALLEE).toObject();
 
 #ifdef DEBUG
         JSFunction *callee_fun = (JSFunction *) callee->getPrivate();
         JS_ASSERT(FUN_FLAT_CLOSURE(callee_fun));
         JS_ASSERT(i < callee_fun->u.i.nupvars);
 #endif
 
         array = callee->dslots;
@@ -1167,17 +1167,17 @@ call_resolve(JSContext *cx, JSObject *ob
     JS_ASSERT(!obj->getProto());
 
     if (!JSID_IS_ATOM(id))
         return JS_TRUE;
 
     const Value &callee = obj->getSlot(JSSLOT_CALLEE);
     if (callee.isUndefined())
         return JS_TRUE;
-    fun = GET_FUNCTION_PRIVATE(cx, &callee.asObject());
+    fun = GET_FUNCTION_PRIVATE(cx, &callee.toObject());
 
     /*
      * Check whether the id refers to a formal parameter, local variable or
      * the arguments special name.
      *
      * We define all such names using JSDNP_DONT_PURGE to avoid an expensive
      * shape invalidation in js_DefineNativeProperty. If such an id happens to
      * shadow a global or upvar of the same name, any inner functions can
@@ -1225,31 +1225,31 @@ call_resolve(JSContext *cx, JSObject *ob
             if (!CallPropertyOp(cx, obj, INT_TO_JSID((int16)slot), &v, cpkind))
                 return JS_FALSE;
             JSObject *funobj;
             if (IsFunctionObject(v, &funobj) &&
                 GET_FUNCTION_PRIVATE(cx, funobj)->needsWrapper()) {
                 getter = js_GetCallVarChecked;
             }
         }
-        if (!js_DefineNativeProperty(cx, obj, id, Value(UndefinedTag()), getter, setter,
+        if (!js_DefineNativeProperty(cx, obj, id, UndefinedValue(), getter, setter,
                                      attrs, JSScopeProperty::HAS_SHORTID, (int16) slot,
                                      NULL, JSDNP_DONT_PURGE)) {
             return JS_FALSE;
         }
         *objp = obj;
         return JS_TRUE;
     }
 
     /*
      * Resolve arguments so that we never store a particular Call object's
      * arguments object reference in a Call prototype's |arguments| slot.
      */
     if (JSID_IS_ATOM(id, cx->runtime->atomState.argumentsAtom)) {
-        if (!js_DefineNativeProperty(cx, obj, id, Value(UndefinedTag()),
+        if (!js_DefineNativeProperty(cx, obj, id, UndefinedValue(),
                                      GetCallArguments, SetCallArguments,
                                      JSPROP_PERMANENT | JSPROP_SHARED,
                                      0, 0, NULL, JSDNP_DONT_PURGE)) {
             return JS_FALSE;
         }
         *objp = obj;
         return JS_TRUE;
     }
@@ -1376,17 +1376,17 @@ fun_getProperty(JSContext *cx, JSObject 
             JS_ASSERT(fp->down->argv);
             *vp = fp->down->calleeValue();
         } else {
             vp->setNull();
         }
 
         /* Censor the caller if it is from another compartment. */
         if (vp->isObject()) {
-            if (vp->asObject().getCompartment(cx) != cx->compartment)
+            if (vp->toObject().getCompartment(cx) != cx->compartment)
                 vp->setNull();
         }
         break;
 
       default:
         /* XXX fun[0] and fun.arguments[0] are equivalent. */
         if (fp && fp->fun && (uintN)slot < fp->fun->nargs)
             *vp = fp->argv[slot];
@@ -1491,34 +1491,34 @@ fun_resolve(JSContext *cx, JSObject *obj
 
         *objp = obj;
         return JS_TRUE;
     }
 
     atom = cx->runtime->atomState.lengthAtom;
     if (id == ATOM_TO_JSID(atom)) {
         JS_ASSERT(!IsInternalFunctionObject(obj));
-        if (!js_DefineNativeProperty(cx, obj, ATOM_TO_JSID(atom), Int32Tag(fun->nargs),
+        if (!js_DefineNativeProperty(cx, obj, ATOM_TO_JSID(atom), Int32Value(fun->nargs),
                                      PropertyStub, PropertyStub,
                                      JSPROP_PERMANENT | JSPROP_READONLY, 0, 0, NULL)) {
             return JS_FALSE;
         }
         *objp = obj;
         return JS_TRUE;
     }
 
     for (uintN i = 0; i < JS_ARRAY_LENGTH(lazy_function_props); i++) {
         LazyFunctionProp *lfp = &lazy_function_props[i];
 
         atom = OFFSET_TO_ATOM(cx->runtime, lfp->atomOffset);
         if (id == ATOM_TO_JSID(atom)) {
             JS_ASSERT(!IsInternalFunctionObject(obj));
 
             if (!js_DefineNativeProperty(cx, obj,
-                                         ATOM_TO_JSID(atom), Value(UndefinedTag()),
+                                         ATOM_TO_JSID(atom), UndefinedValue(),
                                          fun_getProperty, PropertyStub,
                                          lfp->attrs, JSScopeProperty::HAS_SHORTID,
                                          lfp->tinyid, NULL)) {
                 return JS_FALSE;
             }
             *objp = obj;
             return JS_TRUE;
         }
@@ -1732,21 +1732,21 @@ fun_hasInstance(JSContext *cx, JSObject 
     if (!obj->getProperty(cx, id, &pval))
         return JS_FALSE;
 
     if (pval.isPrimitive()) {
         /*
          * Throw a runtime error if instanceof is called on a function that
          * has a non-object as its .prototype value.
          */
-        js_ReportValueError(cx, JSMSG_BAD_PROTOTYPE, -1, ObjectTag(*obj), NULL);
+        js_ReportValueError(cx, JSMSG_BAD_PROTOTYPE, -1, ObjectValue(*obj), NULL);
         return JS_FALSE;
     }
 
-    *bp = js_IsDelegate(cx, &pval.asObject(), *v);
+    *bp = js_IsDelegate(cx, &pval.toObject(), *v);
     return JS_TRUE;
 }
 
 static void
 TraceLocalNames(JSTracer *trc, JSFunction *fun);
 
 static void
 DestroyLocalNames(JSContext *cx, JSFunction *fun);
@@ -1927,31 +1927,31 @@ js_fun_call(JSContext *cx, uintN argc, V
 
     Value *argv = vp + 2;
     if (argc == 0) {
         /* Call fun with its global object as the 'this' param if no args. */
         obj = NULL;
     } else {
         /* Otherwise convert the first arg to 'this' and skip over it. */
         if (argv[0].isObject())
-            obj = &argv[0].asObject();
+            obj = &argv[0].toObject();
         else if (!js_ValueToObjectOrNull(cx, argv[0], &obj))
             return JS_FALSE;
         argc--;
         argv++;
     }
 
     /* Allocate stack space for fval, obj, and the args. */
     InvokeArgsGuard args;
     if (!cx->stack().pushInvokeArgs(cx, argc, args))
         return JS_FALSE;
 
     /* Push fval, obj, and the args. */
     args.getvp()[0] = fval;
-    args.getvp()[1] = ObjectOrNullTag(obj);
+    args.getvp()[1] = ObjectOrNullValue(obj);
     memcpy(args.getvp() + 2, argv, argc * sizeof *argv);
 
     bool ok = Invoke(cx, args, 0);
     *vp = *args.getvp();
     return ok;
 }
 
 JSBool
@@ -1991,45 +1991,45 @@ js_fun_apply(JSContext *cx, uintN argc, 
     if (argc >= 2) {
         /* If the 2nd arg is null or void, call the function with 0 args. */
         if (vp[3].isNullOrUndefined()) {
             argc = 0;
         } else {
             /* The second arg must be an array (or arguments object). */
             JSBool arraylike = JS_FALSE;
             if (vp[3].isObject()) {
-                aobj = &vp[3].asObject();
+                aobj = &vp[3].toObject();
                 if (!js_IsArrayLike(cx, aobj, &arraylike, &length))
                     return JS_FALSE;
             }
             if (!arraylike) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                      JSMSG_BAD_APPLY_ARGS, js_apply_str);
                 return JS_FALSE;
             }
         }
     }
 
     /* Convert the first arg to 'this' and skip over it. */
     if (vp[2].isObject())
-        obj = &vp[2].asObject();
+        obj = &vp[2].toObject();
     else if (!js_ValueToObjectOrNull(cx, vp[2], &obj))
         return JS_FALSE;
 
     /* Allocate stack space for fval, obj, and the args. */
     argc = (uintN)JS_MIN(length, JS_ARGS_LENGTH_MAX);
 
     InvokeArgsGuard args;
     if (!cx->stack().pushInvokeArgs(cx, argc, args))
         return JS_FALSE;
 
     /* Push fval, obj, and aobj's elements as args. */
     Value *sp = args.getvp();
     *sp++ = fval;
-    *sp++ = ObjectOrNullTag(obj);
+    *sp++ = ObjectOrNullValue(obj);
     if (aobj && aobj->isArguments() && !aobj->isArgsLengthOverridden()) {
         /*
          * Two cases, two loops: note how in the case of an active stack frame
          * backing aobj, even though we copy from fp->argv, we still must check
          * aobj->getArgsElement(i) for a hole, to handle a delete on the
          * corresponding arguments element. See args_delProperty.
          */
         JSStackFrame *fp = (JSStackFrame *) aobj->getPrivate();
@@ -2062,17 +2062,17 @@ js_fun_apply(JSContext *cx, uintN argc, 
 #ifdef NARCISSUS
 static JS_REQUIRES_STACK JSBool
 fun_applyConstructor(JSContext *cx, uintN argc, Value *vp)
 {
     JSObject *aobj;
     uintN length, i;
 
     if (vp[2].isPrimitive() ||
-        (aobj = &vp[2].asObject(),
+        (aobj = &vp[2].toObject(),
          !aobj->isArray() &&
          !aobj->isArguments())) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_BAD_APPLY_ARGS, "__applyConstruct__");
         return JS_FALSE;
     }
 
     if (!js_GetLengthProperty(cx, aobj, &length))
@@ -2082,17 +2082,17 @@ fun_applyConstructor(JSContext *cx, uint
         length = JS_ARGS_LENGTH_MAX;
 
     InvokeArgsGuard args;
     if (!cx->stack().pushInvokeArgs(cx, length, args))
         return JS_FALSE;
 
     Value *sp = args.getvp();
     *sp++ = vp[1];
-    *sp++ = NullTag(); /* this is filled automagically */
+    *sp++ = NullValue(); /* this is filled automagically */
     for (i = 0; i < length; i++) {
         if (!aobj->getProperty(cx, INT_TO_JSID(jsint(i)), sp))
             return JS_FALSE;
         sp++;
     }
 
     JSBool ok = InvokeConstructor(cx, args);
     *vp = *args.getvp();
@@ -2150,17 +2150,17 @@ Function(JSContext *cx, JSObject *obj, u
      * anonymous function in the top-level scope that its constructor inhabits.
      * Thus 'var x = 42; f = new Function("return x"); print(f())' prints 42,
      * and so would a call to f from another top-level's script or function.
      *
      * In older versions, before call objects, a new Function was adopted by
      * its running context's globalObject, which might be different from the
      * top-level reachable from scopeChain (in HTML frames, e.g.).
      */
-    parent = argv[-2].asObject().getParent();
+    parent = argv[-2].toObject().getParent();
 
     fun = js_NewFunction(cx, obj, NULL, 0, JSFUN_LAMBDA | JSFUN_INTERPRETED,
                          parent, cx->runtime->atomState.anonymousAtom);
 
     if (!fun)
         return JS_FALSE;
 
     /*
@@ -2256,17 +2256,17 @@ Function(JSContext *cx, JSObject *obj, u
             return JS_FALSE;
         }
         collected_args = cp;
 
         /*
          * Concatenate the arguments into the new string, separated by commas.
          */
         for (i = 0; i < n; i++) {
-            arg = argv[i].asString();
+            arg = argv[i].toString();
             arg_length = arg->length();
             (void) js_strncpy(cp, arg->chars(), arg_length);
             cp += arg_length;
 
             /* Add separating comma or terminating 0. */
             *cp++ = (i + 1 < n) ? ',' : 0;
         }
 
@@ -2488,17 +2488,17 @@ js_NewFlatClosure(JSContext *cx, JSFunct
     if (!scopeChain)
         return NULL;
 
     JSObject *closure = js_AllocFlatClosure(cx, fun, scopeChain);
     if (!closure || fun->u.i.nupvars == 0)
         return closure;
 
     JSUpvarArray *uva = fun->u.i.script->upvars();
-    JS_ASSERT(uva->length <= closure->dslots[-1].asPrivateUint32());
+    JS_ASSERT(uva->length <= closure->dslots[-1].toPrivateUint32());
 
     uintN level = fun->u.i.script->staticLevel;
     for (uint32 i = 0, n = uva->length; i < n; i++)
         closure->dslots[i] = js_GetUpvar(cx, level, uva->vector[i]);
 
     return closure;
 }
 
@@ -2529,17 +2529,17 @@ js_DefineFunction(JSContext *cx, JSObjec
         attrs &= ~JSFUN_STUB_GSOPS;
         gsop = PropertyStub;
     } else {
         gsop = NULL;
     }
     fun = js_NewFunction(cx, NULL, native, nargs, attrs, obj, atom);
     if (!fun)
         return NULL;
-    if (!obj->defineProperty(cx, ATOM_TO_JSID(atom), ObjectTag(*fun),
+    if (!obj->defineProperty(cx, ATOM_TO_JSID(atom), ObjectValue(*fun),
                              gsop, gsop, attrs & ~JSFUN_FLAGS_MASK)) {
         return NULL;
     }
     return fun;
 }
 
 #if (JSV2F_CONSTRUCT & JSV2F_SEARCH_STACK)
 # error "JSINVOKE_CONSTRUCT and JSV2F_SEARCH_STACK are not disjoint!"
@@ -2588,17 +2588,17 @@ js_ValueToFunctionObject(JSContext *cx, 
     }
     return FUN_OBJECT(fun);
 }
 
 JSObject *
 js_ValueToCallableObject(JSContext *cx, Value *vp, uintN flags)
 {
     if (vp->isObject()) {
-        JSObject *callable = &vp->asObject();
+        JSObject *callable = &vp->toObject();
         if (callable->isCallable())
             return callable;
     }
     return js_ValueToFunctionObject(cx, vp, flags);
 }
 
 void
 js_ReportIsNotFunction(JSContext *cx, const Value *vp, uintN flags)
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -260,35 +260,35 @@ JSObject::isCallable()
         return isFunction() || getClass()->call;
 
     return !!map->ops->call;
 }
 
 static inline bool
 js_IsCallable(const js::Value &v)
 {
-    return v.isObject() && v.asObject().isCallable();
+    return v.isObject() && v.toObject().isCallable();
 }
 
 /*
  * NB: jsapi.h and jsobj.h must be included before any call to this macro.
  */
 #define VALUE_IS_FUNCTION(cx, v)                                              \
     (!JSVAL_IS_PRIMITIVE(v) && JSVAL_TO_OBJECT(v)->isFunction())
 
 static JS_ALWAYS_INLINE bool
 IsFunctionObject(const js::Value &v)
 {
-    return v.isObject() && v.asObject().isFunction();
+    return v.isObject() && v.toObject().isFunction();
 }
 
 static JS_ALWAYS_INLINE bool
 IsFunctionObject(const js::Value &v, JSObject **funobj)
 {
-    return v.isObject() && (*funobj = &v.asObject())->isFunction();
+    return v.isObject() && (*funobj = &v.toObject())->isFunction();
 }
 
 /*
  * Macro to access the private slot of the function object after the slot is
  * initialized.
  */
 #define GET_FUNCTION_PRIVATE(cx, funobj)                                      \
     (JS_ASSERT((funobj)->isFunction()),                                       \
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -266,41 +266,41 @@ CallThisObjectHook(JSContext *cx, JSObje
  *
  * The alert should display "true".
  */
 JS_STATIC_INTERPRET JSObject *
 ComputeGlobalThis(JSContext *cx, Value *argv)
 {
     /* Find the inner global. */
     JSObject *inner;
-    if (argv[-2].isPrimitive() || !argv[-2].asObject().getParent()) {
+    if (argv[-2].isPrimitive() || !argv[-2].toObject().getParent()) {
         inner = cx->globalObject;
         OBJ_TO_INNER_OBJECT(cx, inner);
         if (!inner)
             return NULL;
     } else {
-        inner = argv[-2].asObject().getGlobal();
+        inner = argv[-2].toObject().getGlobal();
     }
     JS_ASSERT(inner->getClass()->flags & JSCLASS_IS_GLOBAL);
 
     JSObject *scope = JS_GetGlobalForScopeChain(cx);
     if (scope == inner) {
         /*
          * The outer object has not moved along to a new inner object.
          * This means we qualify for the cache slot in the global.
          */
         const Value &thisv = inner->getReservedSlot(JSRESERVED_GLOBAL_THIS);
         if (!thisv.isUndefined()) {
             argv[-1] = thisv;
-            return thisv.asObjectOrNull();
+            return thisv.toObjectOrNull();
         }
 
         JSObject *stuntThis = CallThisObjectHook(cx, inner, argv);
         JS_ALWAYS_TRUE(js_SetReservedSlot(cx, inner, JSRESERVED_GLOBAL_THIS,
-                                          ObjectOrNullTag(stuntThis)));
+                                          ObjectOrNullValue(stuntThis)));
         return stuntThis;
     }
 
     return CallThisObjectHook(cx, inner, argv);
 }
 
 namespace js {
 
@@ -312,21 +312,21 @@ ComputeThisFromArgv(JSContext *cx, Value
         return ComputeGlobalThis(cx, argv);
 
     JSObject *thisp;
 
     JS_ASSERT(!argv[-1].isNull());
     if (argv[-1].isPrimitive()) {
         if (!js_PrimitiveToObject(cx, &argv[-1]))
             return NULL;
-        thisp = argv[-1].asObjectOrNull();
+        thisp = argv[-1].toObjectOrNull();
         return thisp;
     } 
 
-    thisp = &argv[-1].asObject();
+    thisp = &argv[-1].toObject();
     if (thisp->getClass() == &js_CallClass || thisp->getClass() == &js_BlockClass)
         return ComputeGlobalThis(cx, argv);
 
     return CallThisObjectHook(cx, thisp, argv);
 }
 
 }
 
@@ -357,28 +357,28 @@ Class js_NoSuchMethodClass = {
  * call by name, and args is an Array containing this invocation's actual
  * parameters.
  */
 JS_STATIC_INTERPRET JSBool
 js_OnUnknownMethod(JSContext *cx, Value *vp)
 {
     JS_ASSERT(!vp[1].isPrimitive());
 
-    JSObject *obj = &vp[1].asObject();
+    JSObject *obj = &vp[1].toObject();
     jsid id = ATOM_TO_JSID(cx->runtime->atomState.noSuchMethodAtom);
     AutoValueRooter tvr(cx);
     if (!js_GetMethod(cx, obj, id, JSGET_NO_METHOD_BARRIER, tvr.addr()))
         return false;
     if (tvr.value().isPrimitive()) {
         vp[0] = tvr.value();
     } else {
 #if JS_HAS_XML_SUPPORT
         /* Extract the function name from function::name qname. */
         if (vp[0].isObject()) {
-            obj = &vp[0].asObject();
+            obj = &vp[0].toObject();
             if (!js_IsFunctionQName(cx, obj, &id))
                 return false;
             if (!JSID_IS_VOID(id))
                 vp[0] = IdToValue(id);
         }
 #endif
         obj = js_NewGCObject(cx);
         if (!obj)
@@ -402,17 +402,17 @@ static JS_REQUIRES_STACK JSBool
 NoSuchMethod(JSContext *cx, uintN argc, Value *vp, uint32 flags)
 {
     InvokeArgsGuard args;
     if (!cx->stack().pushInvokeArgs(cx, 2, args))
         return JS_FALSE;
 
     JS_ASSERT(vp[0].isObject());
     JS_ASSERT(vp[1].isObject());
-    JSObject *obj = &vp[0].asObject();
+    JSObject *obj = &vp[0].toObject();
     JS_ASSERT(obj->getClass() == &js_NoSuchMethodClass);
 
     Value *invokevp = args.getvp();
     invokevp[0] = obj->fslots[JSSLOT_FOUND_FUNCTION];
     invokevp[1] = vp[1];
     invokevp[2] = obj->fslots[JSSLOT_SAVED_ID];
     JSObject *argsobj = js_NewArrayObject(cx, argc, vp + 2);
     if (!argsobj)
@@ -515,17 +515,17 @@ InvokeCommon(JSContext *cx, JSFunction *
     /* Initialize frame. */
     fp->thisv = vp[1];
     fp->callobj = NULL;
     fp->argsobj = NULL;
     fp->script = script;
     fp->fun = fun;
     fp->argc = argc;
     fp->argv = vp + 2;
-    fp->rval = (flags & JSINVOKE_CONSTRUCT) ? fp->thisv : Value(UndefinedTag());
+    fp->rval = (flags & JSINVOKE_CONSTRUCT) ? fp->thisv : UndefinedValue();
     fp->annotation = NULL;
     fp->scopeChain = NULL;
     fp->blockChain = NULL;
     fp->imacpc = NULL;
     fp->flags = flags;
     fp->displaySave = NULL;
 
     /* Initialize regs. */
@@ -536,17 +536,17 @@ InvokeCommon(JSContext *cx, JSFunction *
         regs.pc = NULL;
         regs.sp = fp->slots();
     }
 
     /* Officially push |fp|. |frame|'s destructor pops. */
     cx->stack().pushInvokeFrame(cx, args, frame, regs);
 
     /* Now that the frame has been pushed, fix up the scope chain. */
-    JSObject *parent = vp[0].asObject().getParent();
+    JSObject *parent = vp[0].toObject().getParent();
     if (native) {
         /* Slow natives and call ops expect the caller's scopeChain as their scopeChain. */
         if (JSStackFrame *down = fp->down)
             fp->scopeChain = down->scopeChain;
 
         /* Ensure that we have a scope chain. */
         if (!fp->scopeChain)
             fp->scopeChain = parent;
@@ -567,17 +567,17 @@ InvokeCommon(JSContext *cx, JSFunction *
 
     /* Call the function, either a native method or an interpreted script. */
     JSBool ok;
     if (native) {
 #ifdef DEBUG_NOT_THROWING
         JSBool alreadyThrowing = cx->throwing;
 #endif
 
-        JSObject *thisp = fp->thisv.asObjectOrNull();
+        JSObject *thisp = fp->thisv.toObjectOrNull();
         ok = callJSNative(cx, native, thisp, fp->argc, fp->argv, &fp->rval);
 
         JS_ASSERT(cx->fp == fp);
         JS_RUNTIME_METER(cx->runtime, nativeCalls);
 #ifdef DEBUG_NOT_THROWING
         if (ok && !alreadyThrowing)
             ASSERT_NOT_THROWING(cx);
 #endif
@@ -614,17 +614,17 @@ Invoke(JSContext *cx, const InvokeArgsGu
     JS_ASSERT(argc <= JS_ARGS_LENGTH_MAX);
 
     const Value &v = vp[0];
     if (v.isPrimitive()) {
         js_ReportIsNotFunction(cx, vp, flags & JSINVOKE_FUNFLAGS);
         return false;
     }
 
-    JSObject *funobj = &v.asObject();
+    JSObject *funobj = &v.toObject();
     Class *clasp = funobj->getClass();
 
     if (clasp == &js_FunctionClass) {
         /* Get private data and set derived locals from it. */
         JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
         Native native;
         JSScript *script;
         if (FUN_INTERPRETED(fun)) {
@@ -1016,48 +1016,48 @@ EqualObjects(JSContext *cx, JSObject *lo
 }
 
 bool
 StrictlyEqual(JSContext *cx, const Value &lref, const Value &rref)
 {
     Value lval = lref, rval = rref;
     if (SameType(lval, rval)) {
         if (lval.isString())
-            return js_EqualStrings(lval.asString(), rval.asString());
+            return js_EqualStrings(lval.toString(), rval.toString());
         if (lval.isDouble())
-            return JSDOUBLE_COMPARE(lval.asDouble(), ==, rval.asDouble(), JS_FALSE);
+            return JSDOUBLE_COMPARE(lval.toDouble(), ==, rval.toDouble(), JS_FALSE);
         if (lval.isObject())
-            return EqualObjects(cx, &lval.asObject(), &rval.asObject());
-        return lval.asRawUint32() == rval.asRawUint32();
+            return EqualObjects(cx, &lval.toObject(), &rval.toObject());
+        return lval.payloadAsRawUint32() == rval.payloadAsRawUint32();
     }
 
     if (lval.isDouble() && rval.isInt32()) {
-        double ld = lval.asDouble();
-        double rd = rval.asInt32();
+        double ld = lval.toDouble();
+        double rd = rval.toInt32();
         return JSDOUBLE_COMPARE(ld, ==, rd, JS_FALSE);
     }
     if (lval.isInt32() && rval.isDouble()) {
-        double ld = lval.asInt32();
-        double rd = rval.asDouble();
+        double ld = lval.toInt32();
+        double rd = rval.toDouble();
         return JSDOUBLE_COMPARE(ld, ==, rd, JS_FALSE);
     }
 
     return false;
 }
 
 static inline bool
 IsNegativeZero(const Value &v)
 {
-    return v.isDouble() && JSDOUBLE_IS_NEGZERO(v.asDouble());
+    return v.isDouble() && JSDOUBLE_IS_NEGZERO(v.toDouble());
 }
 
 static inline bool
 IsNaN(const Value &v)
 {
-    return v.isDouble() && JSDOUBLE_IS_NaN(v.asDouble());
+    return v.isDouble() && JSDOUBLE_IS_NaN(v.toDouble());
 }
 
 bool
 SameValue(const Value &v1, const Value &v2, JSContext *cx)
 {
     if (IsNegativeZero(v1))
         return IsNegativeZero(v2);
     if (IsNegativeZero(v2))
@@ -1075,17 +1075,17 @@ TypeOfValue(JSContext *cx, const Value &
         return JSTYPE_NUMBER;
     if (v.isString())
         return JSTYPE_STRING;
     if (v.isNull())
         return JSTYPE_OBJECT;
     if (v.isUndefined())
         return JSTYPE_VOID;
     if (v.isObject())
-        return v.asObject().map->ops->typeOf(cx, &v.asObject());
+        return v.toObject().map->ops->typeOf(cx, &v.toObject());
     JS_ASSERT(v.isBoolean());
     return JSTYPE_BOOLEAN;
 }
 
 bool
 InstanceOfSlow(JSContext *cx, JSObject *obj, Class *clasp, Value *argv)
 {
     JS_ASSERT(!obj || obj->getClass() != clasp);
@@ -1106,17 +1106,17 @@ InstanceOfSlow(JSContext *cx, JSObject *
 JS_REQUIRES_STACK bool
 InvokeConstructor(JSContext *cx, const InvokeArgsGuard &args)
 {
     JSFunction *fun = NULL;
     JSObject *obj2 = NULL;
     Value *vp = args.getvp();
 
     /* XXX clean up to avoid special cases above ObjectOps layer */
-    if (vp->isPrimitive() || (obj2 = &vp->asObject())->isFunction() ||
+    if (vp->isPrimitive() || (obj2 = &vp->toObject())->isFunction() ||
         !obj2->map->ops->construct)
     {
         fun = js_ValueToFunction(cx, vp, JSV2F_CONSTRUCT);
         if (!fun)
             return JS_FALSE;
     }
 
     JSObject *proto, *parent;
@@ -1127,24 +1127,24 @@ InvokeConstructor(JSContext *cx, const I
         fun = NULL;
     } else {
         /*
          * Get the constructor prototype object for this function.
          * Use the nominal 'this' parameter slot, vp[1], as a local
          * root to protect this prototype, in case it has no other
          * strong refs.
          */
-        JSObject *obj2 = &vp->asObject();
+        JSObject *obj2 = &vp->toObject();
         if (!obj2->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom),
                                &vp[1])) {
             return JS_FALSE;
         }
         const Value &v = vp[1];
         if (v.isObjectOrNull())
-            proto = v.asObjectOrNull();
+            proto = v.toObjectOrNull();
         else
             proto = NULL;
         parent = obj2->getParent();
 
         if (obj2->getClass() == &js_FunctionClass) {
             JSFunction *f = GET_FUNCTION_PRIVATE(cx, obj2);
             if (!f->isInterpreted() && f->u.n.clasp)
                 clasp = f->u.n.clasp;
@@ -1185,17 +1185,17 @@ ValueToId(JSContext *cx, const Value &v,
     int32_t i;
     if (ValueFitsInInt32(v, &i) && INT_FITS_IN_JSID(i)) {
         *idp = INT_TO_JSID(i);
         return true;
     }
 
 #if JS_HAS_XML_SUPPORT
     if (v.isObject()) {
-        JSObject *obj = &v.asObject();
+        JSObject *obj = &v.toObject();
         if (obj->isXML()) {
             *idp = OBJECT_TO_JSID(obj);
             return JS_TRUE;
         }
         if (!js_IsFunctionQName(cx, obj, idp))
             return JS_FALSE;
         if (!JSID_IS_VOID(*idp))
             return JS_TRUE;
@@ -1216,17 +1216,17 @@ js_EnterWith(JSContext *cx, jsint stackI
 {
     JSStackFrame *fp = cx->fp;
     Value *sp = cx->regs->sp;
     JS_ASSERT(stackIndex < 0);
     JS_ASSERT(fp->base() <= sp + stackIndex);
 
     JSObject *obj;
     if (sp[-1].isObject()) {
-        obj = &sp[-1].asObject();
+        obj = &sp[-1].toObject();
     } else {
         obj = js_ValueToNonNullObject(cx, sp[-1]);
         if (!obj)
             return JS_FALSE;
         sp[-1].setObject(*obj);
     }
 
     JSObject *parent = js_GetScopeChain(cx, fp);
@@ -1767,27 +1767,27 @@ namespace reprmeter {
 #define POP_COPY_TO(v)           v = *--regs.sp
 
 #define POP_BOOLEAN(cx, vp, b)                                                \
     JS_BEGIN_MACRO                                                            \
         vp = &regs.sp[-1];                                                    \
         if (vp->isNull()) {                                                   \
             b = false;                                                        \
         } else if (vp->isBoolean()) {                                         \
-            b = vp->asBoolean();                                              \
+            b = vp->toBoolean();                                              \
         } else {                                                              \
             b = !!js_ValueToBoolean(*vp);                                     \
         }                                                                     \
         regs.sp--;                                                            \
     JS_END_MACRO
 
 #define VALUE_TO_OBJECT(cx, vp, obj)                                          \
     JS_BEGIN_MACRO                                                            \
         if ((vp)->isObject()) {                                               \
-            obj = &(vp)->asObject();                                          \
+            obj = &(vp)->toObject();                                          \
         } else {                                                              \
             obj = js_ValueToNonNullObject(cx, *(vp));                         \
             if (!obj)                                                         \
                 goto error;                                                   \
             (vp)->setObject(*obj);                                            \
         }                                                                     \
     JS_END_MACRO
 
@@ -1796,17 +1796,17 @@ namespace reprmeter {
         Value *vp_ = &regs.sp[n];                                             \
         VALUE_TO_OBJECT(cx, vp_, obj);                                        \
     JS_END_MACRO
 
 #define DEFAULT_VALUE(cx, n, hint, v)                                         \
     JS_BEGIN_MACRO                                                            \
         JS_ASSERT(v.isObject());                                              \
         JS_ASSERT(v == regs.sp[n]);                                           \
-        if (!v.asObject().defaultValue(cx, hint, &regs.sp[n]))                \
+        if (!v.toObject().defaultValue(cx, hint, &regs.sp[n]))                \
             goto error;                                                       \
         v = regs.sp[n];                                                       \
     JS_END_MACRO
 
 /* Test whether v is an int in the range [-2^31 + 1, 2^31 - 2] */
 static JS_ALWAYS_INLINE bool
 CanIncDecWithoutOverflow(int32_t i)
 {
@@ -1926,30 +1926,30 @@ AssertValidPropertyCacheHit(JSContext *c
 
     JSScopeProperty *sprop = (JSScopeProperty *) prop;
     if (entry->vword.isSlot()) {
         JS_ASSERT(entry->vword.toSlot() == sprop->slot);
         JS_ASSERT(!sprop->isMethod());
     } else if (entry->vword.isSprop()) {
         JS_ASSERT(entry->vword.toSprop() == sprop);
         JS_ASSERT_IF(sprop->isMethod(),
-                     &sprop->methodObject() == &pobj->lockedGetSlot(sprop->slot).asObject());
+                     &sprop->methodObject() == &pobj->lockedGetSlot(sprop->slot).toObject());
     } else {
         Value v;
         JS_ASSERT(entry->vword.isFunObj());
         JS_ASSERT(!entry->vword.isNull());
         JS_ASSERT(pobj->scope()->brandedOrHasMethodBarrier());
         JS_ASSERT(sprop->hasDefaultGetterOrIsMethod());
         JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, pobj->scope()));
         v = pobj->lockedGetSlot(sprop->slot);
-        JS_ASSERT(&entry->vword.toFunObj() == &v.asObject());
+        JS_ASSERT(&entry->vword.toFunObj() == &v.toObject());
 
         if (sprop->isMethod()) {
             JS_ASSERT(js_CodeSpec[*regs.pc].format & JOF_CALLOP);
-            JS_ASSERT(&sprop->methodObject() == &v.asObject());
+            JS_ASSERT(&sprop->methodObject() == &v.toObject());
         }
     }
 
     pobj->dropProperty(cx, prop);
     return true;
 }
 
 #else
@@ -2210,17 +2210,17 @@ Interpret(JSContext *cx)
 
 #define LOAD_OBJECT(PCOFF, obj)                                               \
     (obj = script->getObject(GET_FULL_INDEX(PCOFF)))
 
 #define LOAD_FUNCTION(PCOFF)                                                  \
     (fun = script->getFunction(GET_FULL_INDEX(PCOFF)))
 
 #define LOAD_DOUBLE(PCOFF, dbl)                                               \
-    (dbl = script->getConst(GET_FULL_INDEX(PCOFF)).asDouble())
+    (dbl = script->getConst(GET_FULL_INDEX(PCOFF)).toDouble())
 
 #ifdef JS_TRACER
 
 #ifdef MOZ_TRACEVIS
 #if JS_THREADED_INTERP
 #define MONITOR_BRANCH_TRACEVIS                                               \
     JS_BEGIN_MACRO                                                            \
         if (jumpTable != interruptJumpTable)                                  \
--- a/js/src/jsinterp.h
+++ b/js/src/jsinterp.h
@@ -177,17 +177,17 @@ struct JSStackFrame
     }
 
     const js::Value &calleeValue() {
         JS_ASSERT(argv);
         return argv[-2];
     }
 
     JSObject *callee() {
-        return argv ? &argv[-2].asObject() : NULL;
+        return argv ? &argv[-2].toObject() : NULL;
     }
 
     /*
      * Get the object associated with the Execution Context's
      * VariableEnvironment (ES5 10.3). The given CallStack must contain this
      * stack frame.
      */
     JSObject *varobj(js::CallStack *cs) const;
@@ -314,24 +314,24 @@ InvokeFriendAPI(JSContext *cx, const Inv
 extern JSBool
 InternalInvoke(JSContext *cx, const Value &thisv, const Value &fval, uintN flags,
                uintN argc, Value *argv, Value *rval);
 
 static JS_ALWAYS_INLINE bool
 InternalCall(JSContext *cx, JSObject *obj, const Value &fval,
              uintN argc, Value *argv, Value *rval)
 {
-    return InternalInvoke(cx, ObjectOrNullTag(obj), fval, 0, argc, argv, rval);
+    return InternalInvoke(cx, ObjectOrNullValue(obj), fval, 0, argc, argv, rval);
 }
 
 static JS_ALWAYS_INLINE bool
 InternalConstruct(JSContext *cx, JSObject *obj, const Value &fval,
                   uintN argc, Value *argv, Value *rval)
 {
-    return InternalInvoke(cx, ObjectOrNullTag(obj), fval, JSINVOKE_CONSTRUCT, argc, argv, rval);
+    return InternalInvoke(cx, ObjectOrNullValue(obj), fval, JSINVOKE_CONSTRUCT, argc, argv, rval);
 }
 
 extern bool
 InternalGetOrSet(JSContext *cx, JSObject *obj, jsid id, const Value &fval,
                  JSAccessMode mode, uintN argc, Value *argv, Value *rval);
 
 extern JS_FORCES_STACK bool
 Execute(JSContext *cx, JSObject *chain, JSScript *script,
@@ -459,17 +459,17 @@ extern void
 js_MeterSlotOpcode(JSOp op, uint32 slot);
 
 #endif /* JS_LONE_INTERPRET */
 
 inline JSObject *
 JSStackFrame::getThisObject(JSContext *cx)
 {
     if (flags & JSFRAME_COMPUTED_THIS)
-        return &thisv.asObject();
+        return &thisv.toObject();
     if (!js::ComputeThisFromArgv(cx, argv))
         return NULL;
     thisv = argv[-1];
     flags |= JSFRAME_COMPUTED_THIS;
-    return &thisv.asObject();
+    return &thisv.toObject();
 }
 
 #endif /* jsinterp_h___ */
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -395,26 +395,26 @@ GetCustomIterator(JSContext *cx, JSObjec
         return false;
 
     /* If there is no custom __iterator__ method, we are done here. */
     if (vp->isUndefined())
         return true;
 
     /* Otherwise call it and return that object. */
     LeaveTrace(cx);
-    Value arg = BooleanTag((flags & JSITER_FOREACH) == 0);
+    Value arg = BooleanValue((flags & JSITER_FOREACH) == 0);
     if (!InternalCall(cx, obj, *vp, 1, &arg, vp))
         return false;
     if (vp->isPrimitive()) {
         /*
          * We are always coming from js_ValueToIterator, and we are no longer on
          * trace, so the object we are iterating over is on top of the stack (-1).
          */
         js_ReportValueError2(cx, JSMSG_BAD_TRAP_RETURN_VALUE,
-                             -1, ObjectTag(*obj), NULL,
+                             -1, ObjectValue(*obj), NULL,
                              js_AtomToPrintableString(cx, atom));
         return false;
     }
     return true;
 }
 
 template <typename T>
 static inline bool
@@ -446,17 +446,17 @@ NewIteratorObject(JSContext *cx, uintN f
          * are not stillborn, with the exception of "NoSuchMethod" internal
          * helper objects) expect it to have a non-null map pointer, so we
          * share an empty Enumerator scope in the runtime.
          */
         JSObject *obj = js_NewGCObject(cx);
         if (!obj)
             return false;
         obj->map = cx->runtime->emptyEnumeratorScope->hold();
-        obj->init(&js_IteratorClass.base, NULL, NULL, NullTag());
+        obj->init(&js_IteratorClass.base, NULL, NULL, NullValue());
         return obj;
     }
 
     return NewBuiltinClassInstance(cx, &js_IteratorClass.base);
 }
 
 NativeIterator *
 NativeIterator::allocateKeyIterator(JSContext *cx, uint32 slength, const AutoIdVector &props)
@@ -700,17 +700,17 @@ iterator_next(JSContext *cx, uintN argc,
     JSObject *obj;
 
     obj = ComputeThisFromVp(cx, vp);
     if (!InstanceOf(cx, obj, &js_IteratorClass.base, vp + 2))
         return false;
 
     if (!js_IteratorMore(cx, obj, vp))
         return false;
-    if (!vp->asBoolean()) {
+    if (!vp->toBoolean()) {
         js_ThrowStopIteration(cx);
         return false;
     }
     return js_IteratorNext(cx, obj, vp);
 }
 
 #define JSPROP_ROPERM   (JSPROP_READONLY | JSPROP_PERMANENT)
 
@@ -734,17 +734,17 @@ js_ValueToIterator(JSContext *cx, uintN 
      * left in iterValue when a trace is left due to an operation time-out after
      * JSOP_MOREITER but before the value is picked up by FOR*.
      */
     cx->iterValue.setMagic(JS_NO_ITER_VALUE);
 
     JSObject *obj;
     if (vp->isObject()) {
         /* Common case. */
-        obj = &vp->asObject();
+        obj = &vp->toObject();
     } else {
         /*
          * Enumerating over null and undefined gives an empty enumerator.
          * This is contrary to ECMA-262 9.9 ToObject, invoked from step 3 of
          * the first production in 12.6.4 and step 4 of the second production,
          * but it's "web JS" compatible. ES5 fixed for-in to match this de-facto
          * standard.
          */
@@ -785,17 +785,17 @@ CloseGenerator(JSContext *cx, JSObject *
 #endif
 
 JS_FRIEND_API(JSBool)
 js_CloseIterator(JSContext *cx, const Value &v)
 {
     cx->iterValue.setMagic(JS_NO_ITER_VALUE);
 
     JS_ASSERT(v.isObject());
-    JSObject *obj = &v.asObject();
+    JSObject *obj = &v.toObject();
     Class *clasp = obj->getClass();
 
     if (clasp == &js_IteratorClass.base) {
         /* Remove enumerators from the active list, which is a stack. */
         NativeIterator *ni = obj->getNativeIterator();
         if (ni->flags & JSITER_ENUMERATE) {
             JS_ASSERT(cx->enumerators == obj);
             cx->enumerators = ni->next;
@@ -957,17 +957,17 @@ js_IteratorNext(JSContext *cx, JSObject 
             ni->incValueCursor();
         }
 
         if (rval->isString() || !ni->isKeyIter())
             return true;
 
         JSString *str;
         jsint i;
-        if (rval->isInt32() && (jsuint(i = rval->asInt32()) < INT_STRING_LIMIT)) {
+        if (rval->isInt32() && (jsuint(i = rval->toInt32()) < INT_STRING_LIMIT)) {
             str = JSString::intString(i);
         } else {
             str = js_ValueToString(cx, *rval);
             if (!str)
                 return false;
         }
 
         rval->setString(str);
@@ -1157,17 +1157,17 @@ typedef enum JSGeneratorOp {
  * operation inside its frame.
  */
 static JS_REQUIRES_STACK JSBool
 SendToGenerator(JSContext *cx, JSGeneratorOp op, JSObject *obj,
                 JSGenerator *gen, const Value &arg)
 {
     if (gen->state == JSGEN_RUNNING || gen->state == JSGEN_CLOSING) {
         js_ReportValueError(cx, JSMSG_NESTING_GENERATOR,
-                            JSDVG_SEARCH_STACK, ObjectOrNullTag(obj),
+                            JSDVG_SEARCH_STACK, ObjectOrNullValue(obj),
                             JS_GetFunctionId(gen->getFloatingFrame()->fun));
         return JS_FALSE;
     }
 
     /* Check for OOM errors here, where we can fail easily. */
     if (!cx->ensureGeneratorStackSpace())
         return JS_FALSE;
 
@@ -1187,17 +1187,17 @@ SendToGenerator(JSContext *cx, JSGenerat
 
       case JSGENOP_THROW:
         SetPendingException(cx, arg);
         gen->state = JSGEN_RUNNING;
         break;
 
       default:
         JS_ASSERT(op == JSGENOP_CLOSE);
-        SetPendingException(cx, JS_GENERATOR_CLOSING);
+        SetPendingException(cx, MagicValue(JS_GENERATOR_CLOSING));
         gen->state = JSGEN_CLOSING;
         break;
     }
 
     JSStackFrame *genfp = gen->getFloatingFrame();
     JSBool ok;
     {
         Value *genVp = gen->floatingStack;
@@ -1316,17 +1316,17 @@ CloseGenerator(JSContext *cx, JSObject *
     if (!gen) {
         /* Generator prototype object. */
         return JS_TRUE;
     }
 
     if (gen->state == JSGEN_CLOSED)
         return JS_TRUE;
 
-    return SendToGenerator(cx, JSGENOP_CLOSE, obj, gen, UndefinedTag());
+    return SendToGenerator(cx, JSGENOP_CLOSE, obj, gen, UndefinedValue());
 }
 
 /*
  * Common subroutine of generator_(next|send|throw|close) methods.
  */
 static JSBool
 generator_op(JSContext *cx, JSGeneratorOp op, Value *vp, uintN argc)
 {
@@ -1364,26 +1364,26 @@ generator_op(JSContext *cx, JSGeneratorO
         }
     } else if (gen->state == JSGEN_CLOSED) {
       closed_generator:
         switch (op) {
           case JSGENOP_NEXT:
           case JSGENOP_SEND:
             return js_ThrowStopIteration(cx);
           case JSGENOP_THROW:
-            SetPendingException(cx, argc >= 1 ? vp[2] : Value(UndefinedTag()));
+            SetPendingException(cx, argc >= 1 ? vp[2] : UndefinedValue());
             return JS_FALSE;
           default:
             JS_ASSERT(op == JSGENOP_CLOSE);
             return JS_TRUE;
         }
     }
 
     bool undef = ((op == JSGENOP_SEND || op == JSGENOP_THROW) && argc != 0);
-    if (!SendToGenerator(cx, op, obj, gen, undef ? vp[2] : Value(UndefinedTag())))
+    if (!SendToGenerator(cx, op, obj, gen, undef ? vp[2] : UndefinedValue()))
         return JS_FALSE;
     *vp = gen->getFloatingFrame()->rval;
     return JS_TRUE;
 }
 
 static JSBool
 generator_send(JSContext *cx, uintN argc, Value *vp)
 {
--- a/js/src/jsiter.h
+++ b/js/src/jsiter.h
@@ -251,15 +251,15 @@ js_LiveFrameIfGenerator(JSStackFrame *fp
 
 extern js::ExtendedClass js_GeneratorClass;
 extern js::ExtendedClass js_IteratorClass;
 extern js::Class         js_StopIterationClass;
 
 static inline bool
 js_ValueIsStopIteration(const js::Value &v)
 {
-    return v.isObject() && v.asObject().getClass() == &js_StopIterationClass;
+    return v.isObject() && v.toObject().getClass() == &js_StopIterationClass;
 }
 
 extern JSObject *
 js_InitIteratorClasses(JSContext *cx, JSObject *obj);
 
 #endif /* jsiter_h___ */
--- a/js/src/jslock.cpp
+++ b/js/src/jslock.cpp
@@ -497,24 +497,24 @@ FinishSharingTitle(JSContext *cx, JSTitl
     JSScope *scope = TITLE_TO_SCOPE(title);
     JSObject *obj = scope->object;
     if (obj) {
         uint32 nslots = scope->freeslot;
         JS_ASSERT(nslots >= JSSLOT_START(obj->getClass()));
         for (uint32 i = JSSLOT_START(obj->getClass()); i != nslots; ++i) {
             Value v = obj->getSlot(i);
             if (v.isString() &&
-                !js_MakeStringImmutable(cx, v.asString())) {
+                !js_MakeStringImmutable(cx, v.toString())) {
                 /*
                  * FIXME bug 363059: The following error recovery changes
                  * runtime execution semantics, arbitrarily and silently
                  * ignoring errors except out-of-memory, which should have been
                  * reported through JS_ReportOutOfMemory at this point.
                  */
-                obj->setSlot(i, UndefinedTag());
+                obj->setSlot(i, UndefinedValue());
             }
         }
     }
 
     title->ownercx = NULL;  /* NB: set last, after lock init */
     JS_RUNTIME_METER(cx->runtime, sharedTitles);
 }
 
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -301,17 +301,17 @@ num_toSource(JSContext *cx, uintN argc, 
 {
     char numBuf[DTOSTR_STANDARD_BUFFER_SIZE], *numStr;
     char buf[64];
     JSString *str;
 
     const Value *primp;
     if (!js_GetPrimitiveThis(cx, vp, &js_NumberClass, &primp))
         return JS_FALSE;
-    double d = primp->asNumber();
+    double d = primp->toNumber();
     numStr = js_dtostr(JS_THREAD_DATA(cx)->dtoaState, numBuf, sizeof numBuf,
                        DTOSTR_STANDARD, 0, d);
     if (!numStr) {
         JS_ReportOutOfMemory(cx);
         return JS_FALSE;
     }
     JS_snprintf(buf, sizeof buf, "(new %s(%s))", js_NumberClass.name, numStr);
     str = JS_NewStringCopyZ(cx, buf);
@@ -373,17 +373,17 @@ static JSString * JS_FASTCALL
 js_NumberToStringWithBase(JSContext *cx, jsdouble d, jsint base);
 
 static JSBool
 num_toString(JSContext *cx, uintN argc, Value *vp)
 {
     const Value *primp;
     if (!js_GetPrimitiveThis(cx, vp, &js_NumberClass, &primp))
         return JS_FALSE;
-    double d = primp->asNumber();
+    double d = primp->toNumber();
     int32_t base = 10;
     if (argc != 0 && !vp[2].isUndefined()) {
         if (!ValueToECMAInt32(cx, vp[2], &base))
             return JS_FALSE;
 
         if (base < 2 || base > 36) {
             char numBuf[12];
             char *numStr = IntToCString(base, 10, numBuf, sizeof numBuf);
@@ -415,17 +415,17 @@ num_toLocaleString(JSContext *cx, uintN 
 
     /*
      * Create the string, move back to bytes to make string twiddling
      * a bit easier and so we can insert platform charset seperators.
      */
     if (!num_toString(cx, 0, vp))
         return JS_FALSE;
     JS_ASSERT(vp->isString());
-    num = js_GetStringBytes(cx, vp->asString());
+    num = js_GetStringBytes(cx, vp->toString());
     if (!num)
         return JS_FALSE;
 
     /*
      * Find the first non-integer value, whether it be a letter as in
      * 'Infinity', a decimal point, or an 'e' from exponential notation.
      */
     nint = num;
@@ -532,17 +532,17 @@ num_to(JSContext *cx, JSDToStrMode zeroA
 {
     /* Use MAX_PRECISION+1 because precisionOffset can be 1. */
     char buf[DTOSTR_VARIABLE_BUFFER_SIZE(MAX_PRECISION+1)];
     char *numStr;
 
     const Value *primp;
     if (!js_GetPrimitiveThis(cx, vp, &js_NumberClass, &primp))
         return JS_FALSE;
-    double d = primp->asNumber();
+    double d = primp->toNumber();
 
     double precision;
     if (argc == 0) {
         precision = 0.0;
         oneArgMode = zeroArgMode;
     } else {
         if (!ValueToNumber(cx, vp[2], &precision))
             return JS_FALSE;
@@ -737,17 +737,17 @@ js_InitNumberClass(JSContext *cx, JSObje
 
     if (!JS_DefineFunctions(cx, obj, number_functions))
         return NULL;
 
     proto = js_InitClass(cx, obj, NULL, &js_NumberClass, Number, 1,
                          NULL, number_methods, NULL, NULL);
     if (!proto || !(ctor = JS_GetConstructor(cx, proto)))
         return NULL;
-    proto->setPrimitiveThis(Int32Tag(0));
+    proto->setPrimitiveThis(Int32Value(0));
     if (!JS_DefineConstDoubles(cx, ctor, number_constants))
         return NULL;
 
     /* ECMA 15.1.1.1 */
     rt = cx->runtime;
     if (!JS_DefineProperty(cx, obj, js_NaN_str, Jsvalify(rt->NaNValue),
                            JS_PropertyStub, JS_PropertyStub,
                            JSPROP_PERMANENT | JSPROP_READONLY)) {
@@ -857,20 +857,20 @@ js_NumberToString(JSContext *cx, jsdoubl
 JSBool JS_FASTCALL
 js_NumberValueToCharBuffer(JSContext *cx, const Value &v, JSCharBuffer &cb)
 {
     /* Convert to C-string. */
     static const size_t arrSize = DTOSTR_STANDARD_BUFFER_SIZE;
     char arr[arrSize];
     const char *cstr;
     if (v.isInt32()) {
-        cstr = IntToCString(v.asInt32(), 10, arr, arrSize);
+        cstr = IntToCString(v.toInt32(), 10, arr, arrSize);
     } else {
         cstr = js_dtostr(JS_THREAD_DATA(cx)->dtoaState, arr, arrSize,
-                         DTOSTR_STANDARD, 0, v.asDouble());
+                         DTOSTR_STANDARD, 0, v.toDouble());
     }
     if (!cstr)
         return JS_FALSE;
 
     /*
      * Inflate to jschar string.  The input C-string characters are < 127, so
      * even if jschars are UTF-8, all chars should map to one jschar.
      */
@@ -893,44 +893,44 @@ namespace js {
 
 bool
 ValueToNumberSlow(JSContext *cx, Value v, double *out)
 {
     JS_ASSERT(!v.isNumber());
     goto skip_int_double;
     for (;;) {
         if (v.isNumber()) {
-            *out = v.asNumber();
+            *out = v.toNumber();
             return true;
         }
       skip_int_double:
         if (v.isString()) {
-            jsdouble d = StringToNumberType<jsdouble>(cx, v.asString());
+            jsdouble d = StringToNumberType<jsdouble>(cx, v.toString());
             if (JSDOUBLE_IS_NaN(d))
                 break;
             *out = d;
             return true;
         }
         if (v.isBoolean()) {
-            if (v.asBoolean()) {
+            if (v.toBoolean()) {
                 *out = 1.0;
                 return true;
             }
             *out = 0.0;
             return true;
         }
         if (v.isNull()) {
             *out = 0.0;
             return true;
         }
         if (v.isUndefined())
             break;
 
         JS_ASSERT(v.isObject());
-        JSObject *obj = &v.asObject();
+        JSObject *obj = &v.toObject();
 
         /*
          * defaultValue has a special contract whereby the callee may not
          * assume vp is rooted. Since obj is rooted elsewhere and no GC may
          * occur after calling defaultValue, we can just use v.
          */
         if (!obj->defaultValue(cx, JSTYPE_NUMBER, &v))
             return false;
@@ -943,32 +943,32 @@ ValueToNumberSlow(JSContext *cx, Value v
 }
 
 bool
 ValueToECMAInt32Slow(JSContext *cx, const Value &v, int32_t *out)
 {
     JS_ASSERT(!v.isInt32());
     jsdouble d;
     if (v.isDouble()) {
-        d = v.asDouble();
+        d = v.toDouble();
     } else {
         if (!ValueToNumberSlow(cx, v, &d))
             return false;
     }
     *out = js_DoubleToECMAInt32(d);
     return true;
 }
 
 bool
 ValueToECMAUint32Slow(JSContext *cx, const Value &v, uint32_t *out)
 {
     JS_ASSERT(!v.isInt32());
     jsdouble d;
     if (v.isDouble()) {
-        d = v.asDouble();
+        d = v.toDouble();
     } else {
         if (!ValueToNumberSlow(cx, v, &d))
             return false;
     }
     *out = js_DoubleToECMAUint32(d);
     return true;
 }
 
@@ -1006,17 +1006,17 @@ js_DoubleToECMAUint32(jsdouble d)
 namespace js {
 
 bool
 ValueToInt32Slow(JSContext *cx, const Value &v, int32_t *out)
 {
     JS_ASSERT(!v.isInt32());
     jsdouble d;
     if (v.isDouble()) {
-        d = v.asDouble();
+        d = v.toDouble();
     } else if (!ValueToNumberSlow(cx, v, &d)) {
         return false;
     }
 
     if (JSDOUBLE_IS_NaN(d) || d <= -2147483649.0 || 2147483648.0 <= d) {
         js_ReportValueError(cx, JSMSG_CANT_CONVERT,
                             JSDVG_SEARCH_STACK, v, NULL);
         return false;
@@ -1026,17 +1026,17 @@ ValueToInt32Slow(JSContext *cx, const Va
 }
 
 bool
 ValueToUint16Slow(JSContext *cx, const Value &v, uint16_t *out)
 {
     JS_ASSERT(!v.isInt32());
     jsdouble d;
     if (v.isDouble()) {
-        d = v.asDouble();
+        d = v.toDouble();
     } else if (!ValueToNumberSlow(cx, v, &d)) {
         return false;
     }
 
     if (d == 0 || !JSDOUBLE_IS_FINITE(d)) {
         *out = 0;
         return true;
     }
--- a/js/src/jsnum.h
+++ b/js/src/jsnum.h
@@ -202,17 +202,17 @@ namespace js {
 /*
  * Convert a value to a number, returning the converted value in 'out' if the
  * conversion succeeds.
  */
 JS_ALWAYS_INLINE bool
 ValueToNumber(JSContext *cx, const js::Value &v, double *out)
 {
     if (v.isNumber()) {
-        *out = v.asNumber();
+        *out = v.toNumber();
         return true;
     }
     extern bool ValueToNumberSlow(JSContext *, js::Value, double *);
     return ValueToNumberSlow(cx, v, out);
 }
 
 /* Convert a value to a number, replacing 'vp' with the converted value. */
 JS_ALWAYS_INLINE bool
@@ -232,60 +232,60 @@ ValueToNumber(JSContext *cx, js::Value *
  * Convert a value to an int32 or uint32, according to the ECMA rules for
  * ToInt32 and ToUint32. Return converted value in *out on success, !ok on
  * failure.
  */
 JS_ALWAYS_INLINE bool
 ValueToECMAInt32(JSContext *cx, const js::Value &v, int32_t *out)
 {
     if (v.isInt32()) {
-        *out = v.asInt32();
+        *out = v.toInt32();
         return true;
     }
     extern bool ValueToECMAInt32Slow(JSContext *, const js::Value &, int32_t *);
     return ValueToECMAInt32Slow(cx, v, out);
 }
 
 JS_ALWAYS_INLINE bool
 ValueToECMAUint32(JSContext *cx, const js::Value &v, uint32_t *out)
 {
     if (v.isInt32()) {
-        *out = (uint32_t)v.asInt32();
+        *out = (uint32_t)v.toInt32();
         return true;
     }
     extern bool ValueToECMAUint32Slow(JSContext *, const js::Value &, uint32_t *);
     return ValueToECMAUint32Slow(cx, v, out);
 }
 
 /*
  * Convert a value to a number, then to an int32 if it fits by rounding to
  * nearest. Return converted value in *out on success, !ok on failure. As a
  * side effect, *vp will be mutated to match *out.
  */
 JS_ALWAYS_INLINE bool
 ValueToInt32(JSContext *cx, const js::Value &v, int32_t *out)
 {
     if (v.isInt32()) {
-        *out = v.asInt32();
+        *out = v.toInt32();
         return true;
     }
     extern bool ValueToInt32Slow(JSContext *, const js::Value &, int32_t *);
     return ValueToInt32Slow(cx, v, out);
 }
 
 /*
  * Convert a value to a number, then to a uint16 according to the ECMA rules
  * for ToUint16. Return converted value on success, !ok on failure. v must be a
  * copy of a rooted value.
  */
 JS_ALWAYS_INLINE bool
 ValueToUint16(JSContext *cx, const js::Value &v, uint16_t *out)
 {
     if (v.isInt32()) {
-        *out = (uint16_t)v.asInt32();
+        *out = (uint16_t)v.toInt32();
         return true;
     }
     extern bool ValueToUint16Slow(JSContext *, const js::Value &, uint16_t *);
     return ValueToUint16Slow(cx, v, out);
 }
 
 }  /* namespace js */
 
@@ -570,20 +570,20 @@ js_strtointeger(JSContext *cx, const jsc
                 const jschar **ep, jsint radix, jsdouble *dp);
 
 namespace js {
 
 static JS_ALWAYS_INLINE bool
 ValueFitsInInt32(const Value &v, int32_t *pi)
 {
     if (v.isInt32()) {
-        *pi = v.asInt32();
+        *pi = v.toInt32();
         return true;
     }
-    return v.isDouble() && JSDOUBLE_IS_INT32(v.asDouble(), pi);
+    return v.isDouble() && JSDOUBLE_IS_INT32(v.toDouble(), pi);
 }
 
 template<typename T> struct NumberTraits { };
 template<> struct NumberTraits<int32> {
   static JS_ALWAYS_INLINE int32 NaN() { return 0; }
   static JS_ALWAYS_INLINE int32 toSelfType(int32 i) { return i; }
   static JS_ALWAYS_INLINE int32 toSelfType(jsdouble d) { return js_DoubleToECMAUint32(d); }
 };
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -155,17 +155,17 @@ obj_getProto(JSContext *cx, JSObject *ob
 }
 
 static JSBool
 obj_setProto(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     if (!vp->isObjectOrNull())
         return JS_TRUE;
 
-    JSObject *pobj = vp->asObjectOrNull();
+    JSObject *pobj = vp->toObjectOrNull();
     if (pobj) {
         /*
          * Innerize pobj here to avoid sticking unwanted properties on the
          * outer object. This ensures that any with statements only grant
          * access to the inner object.
          */
         OBJ_TO_INNER_OBJECT(cx, pobj);
         if (!pobj)
@@ -249,28 +249,28 @@ MarkSharpObjects(JSContext *cx, JSObject
                     setter.set(sprop->setterValue());
                 JS_UNLOCK_OBJ(cx, obj2);
             } else {
                 hasGetter = hasSetter = false;
             }
             if (hasSetter) {
                 /* Mark the getter, then set val to setter. */
                 if (hasGetter && v.value().isObject()) {
-                    ok = !!MarkSharpObjects(cx, &v.value().asObject(), NULL);
+                    ok = !!MarkSharpObjects(cx, &v.value().toObject(), NULL);
                     if (!ok)
                         break;
                 }
                 v.set(setter.value());
             } else if (!hasGetter) {
                 ok = obj->getProperty(cx, id, v.addr());
                 if (!ok)
                     break;
             }
             if (v.value().isObject() &&
-                !MarkSharpObjects(cx, &v.value().asObject(), NULL)) {
+                !MarkSharpObjects(cx, &v.value().toObject(), NULL)) {
                 ok = JS_FALSE;
                 break;
             }
         }
         if (!ok || !idap)
             JS_DestroyIdArray(cx, ida);
         if (!ok)
             return NULL;
@@ -647,17 +647,17 @@ obj_toSource(JSContext *cx, uintN argc, 
              * If val[j] is a non-sharp object, and we're not serializing an
              * accessor (ECMA syntax can't accommodate sharpened accessors),
              * consider sharpening it.
              */
             vsharp = NULL;
             vsharplength = 0;
 #if JS_HAS_SHARP_VARS
             if (!gsop[j] && val[j].isObject() && vchars[0] != '#') {
-                he = js_EnterSharpObject(cx, &val[j].asObject(), NULL, &vsharp);
+                he = js_EnterSharpObject(cx, &val[j].toObject(), NULL, &vsharp);
                 if (!he) {
                     ok = JS_FALSE;
                     goto error;
                 }
                 if (IS_SHARP(he)) {
                     vchars = vsharp;
                     vlength = js_strlen(vchars);
                 } else {
@@ -1191,22 +1191,22 @@ obj_eval(JSContext *cx, uintN argc, Valu
 
     // CSP check: is eval() allowed at all?
     // report errors via CSP is done in the script security mgr.
     if (!js_CheckContentSecurityPolicy(cx)) {
         JS_ReportError(cx, "call to eval() blocked by CSP");
         return  JS_FALSE;
     }
 
-    JSObject *callee = &vp[0].asObject();
+    JSObject *callee = &vp[0].toObject();
     JSPrincipals *principals = js_EvalFramePrincipals(cx, callee, caller);
     uintN line;
     const char *file = js_ComputeFilename(cx, caller, principals, &line);
 
-    JSString *str = argv[0].asString();
+    JSString *str = argv[0].toString();
     JSScript *script = NULL;
 
     /*
      * Cache local eval scripts indexed by source qualified by scope.
      *
      * An eval cache entry should never be considered a hit unless its
      * strictness matches that of the new eval code. The existing code takes
      * care of this, because hits are qualified by the function from which
@@ -1357,17 +1357,17 @@ obj_watch_handler(JSContext *cx, JSObjec
         return JS_FALSE;
     if (!entry)
         return JS_TRUE;
     generation = cx->resolvingTable->generation;
 
     argv[0] = IdToValue(id);
     argv[1] = Valueify(old);
     argv[2] = Valueify(*nvp);
-    ok = InternalCall(cx, obj, ObjectOrNullTag(callable), 3, argv, Valueify(nvp));
+    ok = InternalCall(cx, obj, ObjectOrNullValue(callable), 3, argv, Valueify(nvp));
     js_StopResolving(cx, &key, JSRESFLAG_WATCH, entry, generation);
     return ok;
 }
 
 static JSBool
 obj_watch(JSContext *cx, uintN argc, Value *vp)
 {
     if (argc <= 1) {
@@ -1432,17 +1432,17 @@ obj_hasOwnProperty(JSContext *cx, uintN 
            js_HasOwnPropertyHelper(cx, obj->map->ops->lookupProperty, argc, vp);
 }
 
 JSBool
 js_HasOwnPropertyHelper(JSContext *cx, JSLookupPropOp lookup, uintN argc,
                         Value *vp)
 {
     jsid id;
-    if (!ValueToId(cx, argc != 0 ? vp[2] : Value(UndefinedTag()), &id))
+    if (!ValueToId(cx, argc != 0 ? vp[2] : UndefinedValue(), &id))
         return JS_FALSE;
 
     JSObject *obj = ComputeThisFromVp(cx, vp);
     JSObject *obj2;
     JSProperty *prop;
     if (!obj)
         return false;
     if (obj->isProxy()) {
@@ -1518,27 +1518,27 @@ js_HasOwnProperty(JSContext *cx, JSLooku
 
 /* Proposed ECMA 15.2.4.6. */
 static JSBool
 obj_isPrototypeOf(JSContext *cx, uintN argc, Value *vp)
 {
     JSObject *obj = ComputeThisFromVp(cx, vp);
     if (!obj)
         return JS_FALSE;
-    const Value &v = argc != 0 ? vp[2] : Value(UndefinedTag());
+    const Value &v = argc != 0 ? vp[2] : UndefinedValue();
     vp->setBoolean(js_IsDelegate(cx, obj, v));
     return JS_TRUE;
 }
 
 /* Proposed ECMA 15.2.4.7. */
 static JSBool
 obj_propertyIsEnumerable(JSContext *cx, uintN argc, Value *vp)
 {
     jsid id;
-    if (!ValueToId(cx, argc != 0 ? vp[2] : Value(UndefinedTag()), &id))
+    if (!ValueToId(cx, argc != 0 ? vp[2] : UndefinedValue(), &id))
         return JS_FALSE;
 
     JSObject *obj = ComputeThisFromVp(cx, vp);
     return obj && js_PropertyIsEnumerable(cx, obj, id, vp);
 }
 
 JSBool
 js_PropertyIsEnumerable(JSContext *cx, JSObject *obj, jsid id, Value *vp)
@@ -1595,72 +1595,72 @@ JS_FRIEND_API(JSBool)
 js_obj_defineGetter(JSContext *cx, uintN argc, Value *vp)
 {
     if (argc <= 1 || !js_IsCallable(vp[3])) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_BAD_GETTER_OR_SETTER,
                              js_getter_str);
         return JS_FALSE;
     }
-    PropertyOp getter = CastAsPropertyOp(&vp[3].asObject());
+    PropertyOp getter = CastAsPropertyOp(&vp[3].toObject());
 
     jsid id;
     if (!ValueToId(cx, vp[2], &id))
         return JS_FALSE;
     JSObject *obj = ComputeThisFromVp(cx, vp);
     if (!obj || !CheckRedeclaration(cx, obj, id, JSPROP_GETTER, NULL, NULL))
         return JS_FALSE;
     /*
      * Getters and setters are just like watchpoints from an access
      * control point of view.
      */
     Value junk;
     uintN attrs;
     if (!CheckAccess(cx, obj, id, JSACC_WATCH, &junk, &attrs))
         return JS_FALSE;
-    *vp = UndefinedTag();
-    return obj->defineProperty(cx, id, UndefinedTag(), getter, PropertyStub,
+    vp->setUndefined();
+    return obj->defineProperty(cx, id, UndefinedValue(), getter, PropertyStub,
                                JSPROP_ENUMERATE | JSPROP_GETTER | JSPROP_SHARED);
 }
 
 JS_FRIEND_API(JSBool)
 js_obj_defineSetter(JSContext *cx, uintN argc, Value *vp)
 {
     if (argc <= 1 || !js_IsCallable(vp[3])) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_BAD_GETTER_OR_SETTER,
                              js_setter_str);
         return JS_FALSE;
     }
-    PropertyOp setter = CastAsPropertyOp(&vp[3].asObject());
+    PropertyOp setter = CastAsPropertyOp(&vp[3].toObject());
 
     jsid id;
     if (!ValueToId(cx, vp[2], &id))
         return JS_FALSE;
     JSObject *obj = ComputeThisFromVp(cx, vp);
     if (!obj || !CheckRedeclaration(cx, obj, id, JSPROP_SETTER, NULL, NULL))
         return JS_FALSE;
     /*
      * Getters and setters are just like watchpoints from an access
      * control point of view.
      */
     Value junk;
     uintN attrs;
     if (!CheckAccess(cx, obj, id, JSACC_WATCH, &junk, &attrs))
         return JS_FALSE;
-    *vp = UndefinedTag();
-    return obj->defineProperty(cx, id, UndefinedTag(), PropertyStub, setter,
+    vp->setUndefined();
+    return obj->defineProperty(cx, id, UndefinedValue(), PropertyStub, setter,
                                JSPROP_ENUMERATE | JSPROP_SETTER | JSPROP_SHARED);
 }
 
 static JSBool
 obj_lookupGetter(JSContext *cx, uintN argc, Value *vp)
 {
     jsid id;
-    if (!ValueToId(cx, argc != 0 ? vp[2] : Value(UndefinedTag()), &id))
+    if (!ValueToId(cx, argc != 0 ? vp[2] : UndefinedValue(), &id))
         return JS_FALSE;
     JSObject *obj = ComputeThisFromVp(cx, vp);
     JSObject *pobj;
     JSProperty *prop;
     if (!obj || !obj->lookupProperty(cx, id, &pobj, &prop))
         return JS_FALSE;
     vp->setUndefined();
     if (prop) {
@@ -1673,17 +1673,17 @@ obj_lookupGetter(JSContext *cx, uintN ar
     }
     return JS_TRUE;
 }
 
 static JSBool
 obj_lookupSetter(JSContext *cx, uintN argc, Value *vp)
 {
     jsid id;
-    if (!ValueToId(cx, argc != 0 ? vp[2] : Value(UndefinedTag()), &id))
+    if (!ValueToId(cx, argc != 0 ? vp[2] : UndefinedValue(), &id))
         return JS_FALSE;
     JSObject *obj = ComputeThisFromVp(cx, vp);
     JSObject *pobj;
     JSProperty *prop;
     if (!obj || !obj->lookupProperty(cx, id, &pobj, &prop))
         return JS_FALSE;
     vp->setUndefined();
     if (prop) {
@@ -1711,17 +1711,17 @@ obj_getPrototypeOf(JSContext *cx, uintN 
         if (!bytes)
             return JS_FALSE;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_UNEXPECTED_TYPE, bytes, "not an object");
         JS_free(cx, bytes);
         return JS_FALSE;
     }
 
-    JSObject *obj = &vp[2].asObject();
+    JSObject *obj = &vp[2].toObject();
     uintN attrs;
     return CheckAccess(cx, obj, ATOM_TO_JSID(cx->runtime->atomState.protoAtom),
                        JSACC_PROTO, vp, &attrs);
 }
 
 extern JSBool
 js_NewPropertyDescriptorObject(JSContext *cx, jsid id, uintN attrs,
                                const Value &getter, const Value &setter,
@@ -1740,27 +1740,27 @@ js_NewPropertyDescriptorObject(JSContext
             !desc->defineProperty(cx, ATOM_TO_JSID(atomState.setAtom), setter,
                                   PropertyStub, PropertyStub, JSPROP_ENUMERATE)) {
             return false;
         }
     } else {
         if (!desc->defineProperty(cx, ATOM_TO_JSID(atomState.valueAtom), value,
                                   PropertyStub, PropertyStub, JSPROP_ENUMERATE) ||
             !desc->defineProperty(cx, ATOM_TO_JSID(atomState.writableAtom),
-                                  BooleanTag((attrs & JSPROP_READONLY) == 0),
+                                  BooleanValue((attrs & JSPROP_READONLY) == 0),
                                   PropertyStub, PropertyStub, JSPROP_ENUMERATE)) {
             return false;
         }
     }
 
     return desc->defineProperty(cx, ATOM_TO_JSID(atomState.enumerableAtom),
-                                BooleanTag((attrs & JSPROP_ENUMERATE) != 0),
+                                BooleanValue((attrs & JSPROP_ENUMERATE) != 0),
                                 PropertyStub, PropertyStub, JSPROP_ENUMERATE) &&
            desc->defineProperty(cx, ATOM_TO_JSID(atomState.configurableAtom),
-                                BooleanTag((attrs & JSPROP_PERMANENT) == 0),
+                                BooleanValue((attrs & JSPROP_PERMANENT) == 0),
                                 PropertyStub, PropertyStub, JSPROP_ENUMERATE);
 }
 
 JSBool
 js_GetOwnPropertyDescriptor(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     if (obj->isProxy()) {
         if (!JSProxy::getOwnPropertyDescriptor(cx, obj, id, vp))
@@ -1771,17 +1771,17 @@ js_GetOwnPropertyDescriptor(JSContext *c
     JSProperty *prop;
     if (!js_HasOwnProperty(cx, obj->map->ops->lookupProperty, obj, id, &pobj, &prop))
         return false;
     if (!prop) {
         vp->setUndefined();
         return true;
     }
 
-    Value roots[] = { UndefinedTag(), UndefinedTag(), UndefinedTag() };
+    Value roots[] = { UndefinedValue(), UndefinedValue(), UndefinedValue() };
     AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(roots), roots);
     unsigned attrs;
     bool doGet = true;
     if (pobj->isNative()) {
         JSScopeProperty *sprop = (JSScopeProperty *) prop;
         attrs = sprop->attributes();
         if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
             doGet = false;
@@ -1821,28 +1821,28 @@ GetFirstArgumentAsObject(JSContext *cx, 
         if (!bytes)
             return false;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                              bytes, "not an object");
         JS_free(cx, bytes);
         return false;
     }
 
-    *objp = &v.asObject();
+    *objp = &v.toObject();
     return true;
 }
 
 static JSBool
 obj_getOwnPropertyDescriptor(JSContext *cx, uintN argc, Value *vp)
 {
     JSObject *obj;
     if (!GetFirstArgumentAsObject(cx, argc, vp, "Object.getOwnPropertyDescriptor", &obj))
         return JS_FALSE;
     AutoIdRooter nameidr(cx);
-    if (!ValueToId(cx, argc >= 2 ? vp[3] : Value(UndefinedTag()), nameidr.addr()))
+    if (!ValueToId(cx, argc >= 2 ? vp[3] : UndefinedValue(), nameidr.addr()))
         return JS_FALSE;
     return js_GetOwnPropertyDescriptor(cx, obj, nameidr.id(), vp);
 }
 
 static JSBool
 obj_keys(JSContext *cx, uintN argc, Value *vp)
 {
     JSObject *obj;
@@ -1864,21 +1864,21 @@ obj_keys(JSContext *cx, uintN argc, Valu
         return JS_FALSE;
     vp->setObject(*aobj);
 
     size_t len = ida.length();
     JS_ASSERT(aobj->getDenseArrayCapacity() >= len);
     for (size_t i = 0; i < len; i++) {
         jsid id = ida[i];
         if (JSID_IS_INT(id)) {
-            Value idval(Int32Tag(JSID_TO_INT(id)));
+            Value idval(Int32Value(JSID_TO_INT(id)));
             jsid id;
             if (!js_ValueToStringId(cx, idval, &id))
                 return JS_FALSE;
-            aobj->setDenseArrayElement(i, StringTag(JSID_TO_STRING(id)));
+            aobj->setDenseArrayElement(i, StringValue(JSID_TO_STRING(id)));
         } else {
             /*
              * Object-valued ids are a possibility admitted by SpiderMonkey for
              * the purposes of E4X.  It's unclear whether they could ever be
              * detected here -- the "obvious" possibility, a property referred
              * to by a QName, actually appears as a string jsid -- but in the
              * interests of fidelity we pass object jsids through unchanged.
              */
@@ -1900,21 +1900,21 @@ HasProperty(JSContext* cx, JSObject* obj
     if (!*answerp) {
         vp->setUndefined();
         return JS_TRUE;
     }
     return JS_GetPropertyById(cx, obj, id, Jsvalify(vp));
 }
 
 PropDesc::PropDesc()
-  : pd(UndefinedTag()),
+  : pd(UndefinedValue()),
     id(INT_TO_JSID(0)),
-    value(UndefinedTag()),
-    get(UndefinedTag()),
-    set(UndefinedTag()),
+    value(UndefinedValue()),
+    get(UndefinedValue()),
+    set(UndefinedValue()),
     attrs(0),
     hasGet(false),
     hasSet(false),
     hasValue(false),
     hasWritable(false),
     hasEnumerable(false),
     hasConfigurable(false)
 {
@@ -1926,17 +1926,17 @@ PropDesc::initialize(JSContext* cx, jsid
     Value v = origval;
     this->id = id;
 
     /* 8.10.5 step 1 */
     if (v.isPrimitive()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NOT_NONNULL_OBJECT);
         return false;
     }
-    JSObject* desc = &v.asObject();
+    JSObject* desc = &v.toObject();
 
     /* Make a copy of the descriptor. We might need it later. */
     pd = v;
 
     /* Start with the proper defaults. */
     attrs = JSPROP_PERMANENT | JSPROP_READONLY;
 
     JSBool hasProperty;
@@ -2086,23 +2086,23 @@ DefinePropertyOnObject(JSContext *cx, JS
          * Getters and setters are just like watchpoints from an access
          * control point of view.
          */
         Value dummy;
         uintN dummyAttrs;
         if (!CheckAccess(cx, obj, desc.id, JSACC_WATCH, &dummy, &dummyAttrs))
             return JS_FALSE;
 
-        Value tmp = UndefinedTag();
+        Value tmp = UndefinedValue();
         return js_DefineProperty(cx, obj, desc.id, &tmp,
                                  desc.getter(), desc.setter(), desc.attrs);
     }
 
     /* 8.12.9 steps 5-6 (note 5 is merely a special case of 6). */
-    Value v = UndefinedTag();
+    Value v = UndefinedValue();
 
     /*
      * In the special case of shared permanent properties, the "own" property
      * can be found on a different object.  In that case the returned property
      * might not be native, except: the shared permanent property optimization
      * is not applied if the objects have different classes (bug 320854), as
      * must be enforced by js_HasOwnProperty for the JSScopeProperty cast below
      * to be safe.
@@ -2411,21 +2411,21 @@ obj_defineProperty(JSContext* cx, uintN 
     /* 15.2.3.6 steps 1 and 5. */
     JSObject *obj;
     if (!GetFirstArgumentAsObject(cx, argc, vp, "Object.defineProperty", &obj))
         return JS_FALSE;
     vp->setObject(*obj);
 
     /* 15.2.3.6 step 2. */
     AutoIdRooter nameidr(cx);
-    if (!ValueToId(cx, argc >= 2 ? vp[3] : Value(UndefinedTag()), nameidr.addr()))
+    if (!ValueToId(cx, argc >= 2 ? vp[3] : UndefinedValue(), nameidr.addr()))
         return JS_FALSE;
 
     /* 15.2.3.6 step 3. */
-    const Value &descval = argc >= 3 ? vp[4] : Value(UndefinedTag());
+    const Value &descval = argc >= 3 ? vp[4] : UndefinedValue();
 
     /* 15.2.3.6 step 4 */
     JSBool junk;
     return js_DefineOwnProperty(cx, obj, nameidr.id(), descval, &junk);
 }
 
 static bool
 DefineProperties(JSContext *cx, JSObject *obj, JSObject *props)
@@ -2506,30 +2506,30 @@ obj_create(JSContext *cx, uintN argc, Va
         JS_free(cx, bytes);
         return JS_FALSE;
     }
 
     /*
      * Use the callee's global as the parent of the new object to avoid dynamic
      * scoping (i.e., using the caller's global).
      */
-    JSObject *obj = NewObjectWithGivenProto(cx, &js_ObjectClass, v.asObjectOrNull(),
-                                            vp->asObject().getGlobal());
+    JSObject *obj = NewObjectWithGivenProto(cx, &js_ObjectClass, v.toObjectOrNull(),
+                                            vp->toObject().getGlobal());
     if (!obj)
         return JS_FALSE;
     vp->setObject(*obj); /* Root and prepare for eventual return. */
 
     /* 15.2.3.5 step 4. */
     if (argc > 1 && !vp[3].isUndefined()) {
         if (vp[3].isPrimitive()) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NOT_NONNULL_OBJECT);
             return JS_FALSE;
         }
 
-        JSObject *props = &vp[3].asObject();
+        JSObject *props = &vp[3].toObject();
         AutoIdArray ida(cx, JS_Enumerate(cx, props));
         if (!ida)
             return JS_FALSE;
 
         AutoPropDescArrayRooter descs(cx);
         size_t len = ida.length();
         for (size_t i = 0; i < len; i++) {
             jsid id = ida[i];
@@ -2564,17 +2564,17 @@ obj_getOwnPropertyNames(JSContext *cx, u
 
     AutoValueVector vals(cx);
     if (!vals.resize(keys.length()))
         return false;
 
     for (size_t i = 0, len = keys.length(); i < len; i++) {
          jsid id = keys[i];
          if (JSID_IS_INT(id)) {
-             JSString *str = js_ValueToString(cx, Int32Tag(JSID_TO_INT(id)));
+             JSString *str = js_ValueToString(cx, Int32Value(JSID_TO_INT(id)));
              if (!str)
                  return false;
              vals[i].setString(str);
          } else if (JSID_IS_ATOM(id)) {
              vals[i].setString(JSID_TO_STRING(id));
          } else {
              vals[i].setObject(*JSID_TO_OBJECT(id));
          }
@@ -2670,28 +2670,28 @@ js_NewObjectWithClassProto(JSContext *cx
     obj->initSharingEmptyScope(clasp, proto, proto->getParent(), privateSlotValue);
     return obj;
 }
 
 JSObject* FASTCALL
 js_Object_tn(JSContext* cx, JSObject* proto)
 {
     JS_ASSERT(!(js_ObjectClass.flags & JSCLASS_HAS_PRIVATE));
-    return js_NewObjectWithClassProto(cx, &js_ObjectClass, proto, UndefinedTag());
+    return js_NewObjectWithClassProto(cx, &js_ObjectClass, proto, UndefinedValue());
 }
 
 JS_DEFINE_TRCINFO_1(js_Object,
     (2, (extern, CONSTRUCTOR_RETRY, js_Object_tn, CONTEXT, CALLEE_PROTOTYPE, 0,
          nanojit::ACC_STORE_ANY)))
 
 JSObject* FASTCALL
 js_NonEmptyObject(JSContext* cx, JSObject* proto)
 {
     JS_ASSERT(!(js_ObjectClass.flags & JSCLASS_HAS_PRIVATE));
-    JSObject *obj = js_NewObjectWithClassProto(cx, &js_ObjectClass, proto, UndefinedTag());
+    JSObject *obj = js_NewObjectWithClassProto(cx, &js_ObjectClass, proto, UndefinedValue());
     if (!obj)
         return NULL;
     JS_LOCK_OBJ(cx, obj);
     JSScope *scope = js_GetMutableScope(cx, obj);
     if (!scope) {
         JS_UNLOCK_OBJ(cx, obj);
         return NULL;
     }
@@ -2722,23 +2722,23 @@ js_NewInstance(JSContext *cx, Class *cla
 #endif
     if (scope->isSharedEmpty()) {
         scope = js_GetMutableScope(cx, ctor);
         if (!scope)
             return NULL;
     }
 
     JSScopeProperty *sprop = scope->lookup(ATOM_TO_JSID(atom));
-    Value pval = sprop ? ctor->getSlot(sprop->slot) : Value(JS_GENERIC_MAGIC);
+    Value pval = sprop ? ctor->getSlot(sprop->slot) : MagicValue(JS_GENERIC_MAGIC);
 
     JSObject *parent = ctor->getParent();
     JSObject *proto;
     if (pval.isObject()) {
         /* An object in ctor.prototype, let's use it as the new instance's proto. */
-        proto = &pval.asObject();
+        proto = &pval.toObject();
     } else {
         /* A hole or a primitive: either way, we need to get Object.prototype. */
         if (!js_GetClassPrototype(cx, parent, JSProto_Object, &proto))
             return NULL;
 
         if (pval.isMagic(JS_GENERIC_MAGIC)) {
             /*
              * No ctor.prototype was set, so we inline-expand and optimize
@@ -2986,17 +2986,17 @@ JS_REQUIRES_STACK JSObject *
 js_NewWithObject(JSContext *cx, JSObject *proto, JSObject *parent, jsint depth)
 {
     JSObject *obj;
 
     obj = js_NewGCObject(cx);
     if (!obj)
         return NULL;
     obj->init(&js_WithClass, proto, parent,
-              PrivateTag(js_FloatingFrameIfGenerator(cx, cx->fp)));
+              PrivateValue(js_FloatingFrameIfGenerator(cx, cx->fp)));
     OBJ_SET_BLOCK_DEPTH(cx, obj, depth);
     obj->map = cx->runtime->emptyWithScope->hold();
 
     AutoObjectRooter tvr(cx, obj);
     JSObject *thisp = proto->thisObject(cx);
     if (!thisp)
         return NULL;
     obj->setWithThis(thisp);
@@ -3009,32 +3009,32 @@ js_NewBlockObject(JSContext *cx)
 {
     /*
      * Null obj's proto slot so that Object.prototype.* does not pollute block
      * scopes and to give the block object its own scope.
      */
     JSObject *blockObj = js_NewGCObject(cx);
     if (!blockObj)
         return NULL;
-    blockObj->init(&js_BlockClass, NULL, NULL, NullTag());
+    blockObj->init(&js_BlockClass, NULL, NULL, NullValue());
     blockObj->map = cx->runtime->emptyBlockScope->hold();
     return blockObj;
 }
 
 JSObject *
 js_CloneBlockObject(JSContext *cx, JSObject *proto, JSStackFrame *fp)
 {
     JS_ASSERT(!OBJ_IS_CLONED_BLOCK(proto));
     JS_ASSERT(proto->getClass() == &js_BlockClass);
 
     JSObject *clone = js_NewGCObject(cx);
     if (!clone)
         return NULL;
 
-    Value privateValue = PrivateTag(js_FloatingFrameIfGenerator(cx, fp));
+    Value privateValue = PrivateValue(js_FloatingFrameIfGenerator(cx, fp));
 
     /* The caller sets parent on its own. */
     clone->init(&js_BlockClass, proto, NULL, privateValue);
     clone->fslots[JSSLOT_BLOCK_DEPTH] = proto->fslots[JSSLOT_BLOCK_DEPTH];
 
     JS_ASSERT(cx->runtime->emptyBlockScope->freeslot == JSSLOT_BLOCK_DEPTH + 1);
     clone->map = cx->runtime->emptyBlockScope->hold();
     JS_ASSERT(OBJ_IS_CLONED_BLOCK(clone));
@@ -3148,17 +3148,17 @@ block_setProperty(JSContext *cx, JSObjec
 
 JSBool
 js_DefineBlockVariable(JSContext *cx, JSObject *obj, jsid id, intN index)
 {
     JS_ASSERT(obj->getClass() == &js_BlockClass);
     JS_ASSERT(!OBJ_IS_CLONED_BLOCK(obj));
 
     /* Use JSPROP_ENUMERATE to aid the disassembler. */
-    return js_DefineNativeProperty(cx, obj, id, Value(UndefinedTag()),
+    return js_DefineNativeProperty(cx, obj, id, UndefinedValue(),
                                    block_getProperty,
                                    block_setProperty,
                                    JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_SHARED,
                                    JSScopeProperty::HAS_SHORTID, index, NULL);
 }
 
 static size_t
 GetObjectSize(JSObject *obj)
@@ -3276,17 +3276,17 @@ js_XDRBlockObject(JSXDRState *xdr, JSObj
     AutoObjectRooter tvr(cx, obj);
 
     if (!JS_XDRUint32(xdr, &tmp))
         return false;
 
     if (xdr->mode == JSXDR_DECODE) {
         depth = (uint16)(tmp >> 16);
         count = (uint16)tmp;
-        obj->setSlot(JSSLOT_BLOCK_DEPTH, Value(Int32Tag(depth)));
+        obj->setSlot(JSSLOT_BLOCK_DEPTH, Value(Int32Value(depth)));
     }
 
     /*
      * XDR the block object's properties. We know that there are 'count'
      * properties to XDR, stored as id/shortid pairs. We do not XDR any
      * non-native properties, only those that the compiler created.
      */
     sprop = NULL;
@@ -3472,27 +3472,27 @@ js_InitClass(JSContext *cx, JSObject *ob
          */
         if (!(clasp->flags & JSCLASS_IS_ANONYMOUS) ||
             !(obj->getClass()->flags & JSCLASS_IS_GLOBAL) ||
             key == JSProto_Null)
         {
             uint32 attrs = (clasp->flags & JSCLASS_IS_ANONYMOUS)
                            ? JSPROP_READONLY | JSPROP_PERMANENT
                            : 0;
-            if (!DefineStandardSlot(cx, obj, key, atom, ObjectTag(*proto), attrs, named))
+            if (!DefineStandardSlot(cx, obj, key, atom, ObjectValue(*proto), attrs, named))
                 goto bad;
         }
 
         ctor = proto;
     } else {
         fun = js_NewFunction(cx, NULL, constructor, nargs, 0, obj, atom);
         if (!fun)
             goto bad;
 
-        AutoValueRooter tvr2(cx, ObjectTag(*fun));
+        AutoValueRooter tvr2(cx, ObjectValue(*fun));
         if (!DefineStandardSlot(cx, obj, key, atom, tvr2.value(), 0, named))
             goto bad;
 
         /*
          * Remember the class this function is a constructor for so that
          * we know to create an object of this class when we call the
          * constructor.
          */
@@ -3502,20 +3502,20 @@ js_InitClass(JSContext *cx, JSObject *ob
          * Optionally construct the prototype object, before the class has
          * been fully initialized.  Allow the ctor to replace proto with a
          * different object, as is done for operator new -- and as at least
          * XML support requires.
          */
         ctor = FUN_OBJECT(fun);
         if (clasp->flags & JSCLASS_CONSTRUCT_PROTOTYPE) {
             Value rval;
-            if (!InternalConstruct(cx, proto, ObjectOrNullTag(ctor), 0, NULL, &rval))
+            if (!InternalConstruct(cx, proto, ObjectOrNullValue(ctor), 0, NULL, &rval))
                 goto bad;
-            if (rval.isObject() && &rval.asObject() != proto)
-                proto = &rval.asObject();
+            if (rval.isObject() && &rval.toObject() != proto)
+                proto = &rval.toObject();
         }
 
         /* Connect constructor and prototype by named properties. */
         if (!js_SetClassPrototype(cx, ctor, proto,
                                   JSPROP_READONLY | JSPROP_PERMANENT)) {
             goto bad;
         }
 
@@ -3611,17 +3611,17 @@ JSObject::growSlots(JSContext *cx, size_
 
     /*
      * If nothing was allocated yet, treat it as initial allocation (but with
      * the exponential growth algorithm applied).
      */
     if (!dslots)
         return allocSlots(cx, nslots);
 
-    size_t oldnslots = dslots[-1].asPrivateUint32();
+    size_t oldnslots = dslots[-1].toPrivateUint32();
 
     Value *tmpdslots = (Value*) cx->realloc(dslots - 1, nwords * sizeof(Value));
     if (!tmpdslots)
         return false;   /* Leave dslots at its old size. */
     dslots = tmpdslots;
 
     dslots++;
     dslots[-1].setPrivateUint32(nslots);
@@ -3637,18 +3637,18 @@ JSObject::growSlots(JSContext *cx, size_
 
 void
 JSObject::shrinkSlots(JSContext *cx, size_t nslots)
 {
     /* Nothing to shrink? */
     if (!dslots)
         return;
 
-    JS_ASSERT(dslots[-1].asPrivateUint32() > JS_INITIAL_NSLOTS);
-    JS_ASSERT(nslots <= dslots[-1].asPrivateUint32());
+    JS_ASSERT(dslots[-1].toPrivateUint32() > JS_INITIAL_NSLOTS);
+    JS_ASSERT(nslots <= dslots[-1].toPrivateUint32());
 
     if (nslots <= JS_INITIAL_NSLOTS) {
         freeSlotsArray(cx);
         dslots = NULL;
     } else {
         size_t nwords = slotsToDynamicWords(nslots);
         Value *tmpdslots = (Value*) cx->realloc(dslots - 1, nwords * sizeof(Value));
         if (!tmpdslots)
@@ -3754,17 +3754,17 @@ js_GetClassObject(JSContext *cx, JSObjec
         obj = tmp;
     if (!(obj->getClass()->flags & JSCLASS_IS_GLOBAL)) {
         *objp = NULL;
         return JS_TRUE;
     }
 
     v = obj->getReservedSlot(key);
     if (v.isObject()) {
-        *objp = &v.asObject();
+        *objp = &v.toObject();
         return JS_TRUE;
     }
 
     rkey.obj = obj;
     rkey.id = ATOM_TO_JSID(cx->runtime->atomState.classAtoms[key]);
     if (!js_StartResolving(cx, &rkey, JSRESFLAG_LOOKUP, &rentry))
         return JS_FALSE;
     if (!rentry) {
@@ -3778,34 +3778,34 @@ js_GetClassObject(JSContext *cx, JSObjec
     cobj = NULL;
     init = lazy_prototype_init[key];
     if (init) {
         if (!init(cx, obj)) {
             ok = JS_FALSE;
         } else {
             v = obj->getReservedSlot(key);
             if (v.isObject())
-                cobj = &v.asObject();
+                cobj = &v.toObject();
         }
     }
 
     js_StopResolving(cx, &rkey, JSRESFLAG_LOOKUP, rentry, generation);
     *objp = cobj;
     return ok;
 }
 
 JSBool
 js_SetClassObject(JSContext *cx, JSObject *obj, JSProtoKey key, JSObject *cobj, JSObject *proto)
 {
     JS_ASSERT(!obj->getParent());
     if (!(obj->getClass()->flags & JSCLASS_IS_GLOBAL))
         return JS_TRUE;
 
-    return js_SetReservedSlot(cx, obj, key, ObjectOrNullTag(cobj)) &&
-           js_SetReservedSlot(cx, obj, JSProto_LIMIT + key, ObjectOrNullTag(proto));
+    return js_SetReservedSlot(cx, obj, key, ObjectOrNullValue(cobj)) &&
+           js_SetReservedSlot(cx, obj, JSProto_LIMIT + key, ObjectOrNullValue(proto));
 }
 
 JSBool
 js_FindClassObject(JSContext *cx, JSObject *start, JSProtoKey protoKey,
                    Value *vp, Class *clasp)
 {
     JSStackFrame *fp;
     JSObject *obj, *cobj, *pobj;
@@ -3857,17 +3857,17 @@ js_FindClassObject(JSContext *cx, JSObje
         id = ATOM_TO_JSID(atom);
     }
 
     JS_ASSERT(obj->isNative());
     if (js_LookupPropertyWithFlags(cx, obj, id, JSRESOLVE_CLASSNAME,
                                    &pobj, &prop) < 0) {
         return JS_FALSE;
     }
-    Value v = UndefinedTag();
+    Value v = UndefinedValue();
     if (prop && pobj->isNative()) {
         sprop = (JSScopeProperty *) prop;
         if (SPROP_HAS_VALID_SLOT(sprop, pobj->scope())) {
             v = pobj->lockedGetSlot(sprop->slot);
             if (v.isPrimitive())
                 v.setUndefined();
         }
         JS_UNLOCK_OBJ(cx, pobj);
@@ -3894,27 +3894,27 @@ js_ConstructObject(JSContext *cx, Class 
         js_ReportIsNotFunction(cx, tvr.addr(), JSV2F_CONSTRUCT | JSV2F_SEARCH_STACK);
         return NULL;
     }
 
     /*
      * If proto is NULL, set it to Constructor.prototype, just like JSOP_NEW
      * does, likewise for the new object's parent.
      */
-    JSObject *ctor = &cval.asObject();
+    JSObject *ctor = &cval.toObject();
     if (!parent)
         parent = ctor->getParent();
     if (!proto) {
         Value rval;
         if (!ctor->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom),
                                &rval)) {
             return NULL;
         }
         if (rval.isObjectOrNull())
-            proto = rval.asObjectOrNull();
+            proto = rval.toObjectOrNull();
     }
 
     JSObject *obj = NewObject(cx, clasp, proto, parent);
     if (!obj)
         return NULL;
 
     Value rval;
     if (!InternalConstruct(cx, obj, cval, argc, argv, &rval))
@@ -3925,17 +3925,17 @@ js_ConstructObject(JSContext *cx, Class 
 
     /*
      * If the instance's class differs from what was requested, throw a type
      * error.  If the given class has both the JSCLASS_HAS_PRIVATE and the
      * JSCLASS_CONSTRUCT_PROTOTYPE flags, and the instance does not have its
      * private data set at this point, then the constructor was replaced and
      * we should throw a type error.
      */
-    obj = &rval.asObject();
+    obj = &rval.toObject();
     if (obj->getClass() != clasp ||
         (!(~clasp->flags & (JSCLASS_HAS_PRIVATE |
                             JSCLASS_CONSTRUCT_PROTOTYPE)) &&
          !obj->getPrivate())) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_WRONG_CONSTRUCTOR, clasp->name);
         return NULL;
     }
@@ -3963,17 +3963,17 @@ js_AllocSlot(JSContext *cx, JSObject *ob
     return JS_TRUE;
 }
 
 void
 js_FreeSlot(JSContext *cx, JSObject *obj, uint32 slot)
 {
     JSScope *scope = obj->scope();
     JS_ASSERT(scope->object == obj);
-    obj->lockedSetSlot(slot, Value(UndefinedTag()));
+    obj->lockedSetSlot(slot, UndefinedValue());
     if (scope->freeslot == slot + 1)
         scope->freeslot = slot;
 }
 
 
 /* JSBOXEDWORD_INT_MAX as a string */
 #define JSBOXEDWORD_INT_MAX_STRING "1073741823"
 
@@ -4268,17 +4268,17 @@ js_DefineNativeProperty(JSContext *cx, J
     if (!sprop) {
         /* Add a new property, or replace an existing one of the same id. */
         if (defineHow & JSDNP_SET_METHOD) {
             JS_ASSERT(clasp == &js_ObjectClass);
             JS_ASSERT(IsFunctionObject(value));
             JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
             JS_ASSERT(!getter && !setter);
 
-            JSObject *funobj = &value.asObject();
+            JSObject *funobj = &value.toObject();
             if (FUN_OBJECT(GET_FUNCTION_PRIVATE(cx, funobj)) == funobj) {
                 flags |= JSScopeProperty::METHOD;
                 getter = CastAsPropertyOp(funobj);
             }
         }
 
         added = !scope->hasProperty(id);
         uint32 oldShape = scope->shape;
@@ -4729,17 +4729,17 @@ js_NativeGet(JSContext *cx, JSObject *ob
     if (slot != SPROP_INVALID_SLOT)
         *vp = pobj->lockedGetSlot(slot);
     else
         vp->setUndefined();
     if (sprop->hasDefaultGetter())
         return true;
 
     if (JS_UNLIKELY(sprop->isMethod()) && (getHow & JSGET_NO_METHOD_BARRIER)) {
-        JS_ASSERT(&sprop->methodObject() == &vp->asObject());
+        JS_ASSERT(&sprop->methodObject() == &vp->toObject());
         return true;
     }
 
     sample = cx->runtime->propertyRemovals;
     JS_UNLOCK_SCOPE(cx, scope);
     {
         AutoScopePropertyRooter tvr(cx, sprop);
         AutoObjectRooter tvr2(cx, pobj);
@@ -5165,17 +5165,17 @@ js_SetPropertyHelper(JSContext *cx, JSOb
          * Check for Object class here to avoid defining a method on a class
          * with magic resolve, addProperty, getProperty, etc. hooks.
          */
         if ((defineHow & JSDNP_SET_METHOD) &&
             obj->getClass() == &js_ObjectClass) {
             JS_ASSERT(IsFunctionObject(*vp));
             JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
 
-            JSObject *funobj = &vp->asObject();
+            JSObject *funobj = &vp->toObject();
             if (FUN_OBJECT(GET_FUNCTION_PRIVATE(cx, funobj)) == funobj) {
                 flags |= JSScopeProperty::METHOD;
                 getter = CastAsPropertyOp(funobj);
             }
         }
 
         sprop = scope->putProperty(cx, id, getter, setter, SPROP_INVALID_SLOT,
                                    attrs, flags, shortid);
@@ -5185,17 +5185,17 @@ js_SetPropertyHelper(JSContext *cx, JSOb
         }
 
         /*
          * Initialize the new property value (passed to setter) to undefined.
          * Note that we store before calling addProperty, to match the order
          * in js_DefineNativeProperty.
          */
         if (SPROP_HAS_VALID_SLOT(sprop, scope))
-            obj->lockedSetSlot(sprop->slot, Value(UndefinedTag()));
+            obj->lockedSetSlot(sprop->slot, UndefinedValue());
 
         /* XXXbe called with obj locked */
         if (!AddPropertyHelper(cx, clasp, obj, scope, sprop, vp)) {
             scope->removeProperty(cx, id);
             JS_UNLOCK_SCOPE(cx, scope);
             return JS_FALSE;
         }
         added = true;
@@ -5291,17 +5291,17 @@ js_DeleteProperty(JSContext *cx, JSObjec
          */
         if (prop) {
             if (proto->isNative()) {
                 sprop = (JSScopeProperty *)prop;
                 if (sprop->isSharedPermanent())
                     rval->setBoolean(false);
                 JS_UNLOCK_OBJ(cx, proto);
             }
-            if (rval->isBoolean() && rval->asBoolean() == false)
+            if (rval->isBoolean() && rval->toBoolean() == false)
                 return JS_TRUE;
         }
 
         /*
          * If no property, or the property comes unshared or impermanent from
          * a prototype, call the class's delProperty hook, passing rval as the
          * result parameter.
          */
@@ -5331,17 +5331,17 @@ js_DeleteProperty(JSContext *cx, JSObjec
     return ok && js_SuppressDeletedProperty(cx, obj, id);
 }
 
 JSBool
 js_DefaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp)
 {
     JS_ASSERT(hint != JSTYPE_OBJECT && hint != JSTYPE_FUNCTION);
 
-    Value v = ObjectTag(*obj);
+    Value v = ObjectValue(*obj);
     if (hint == JSTYPE_STRING) {
         /*
          * Optimize for String objects with standard toString methods. Support
          * new String(...) instances whether mutated to have their own scope or
          * not, as well as direct String.prototype references.
          */
         if (obj->getClass() == &js_StringClass) {
             jsid toStringId = ATOM_TO_JSID(cx->runtime->atomState.toStringAtom);
@@ -5583,34 +5583,34 @@ GetCurrentExecutionContext(JSContext *cx
     while ((tmp = obj->getParent()) != NULL)
         obj = tmp;
     if (!obj->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.ExecutionContextAtom), &xcval))
         return JS_FALSE;
     if (xcval.isPrimitive()) {
         JS_ReportError(cx, "invalid ExecutionContext in global object");
         return JS_FALSE;
     }
-    if (!xcval.asObject().getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.currentAtom),
+    if (!xcval.toObject().getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.currentAtom),
                                       rval)) {
         return JS_FALSE;
     }
     return JS_TRUE;
 }
 #endif
 
 JSBool
 js_Call(JSContext *cx, uintN argc, Value *vp)
 {
     JSStackFrame *fp = cx->fp;
     JSObject *obj = fp->getThisObject(cx);
     if (!obj)
         return false;
-    JS_ASSERT(Value(ObjectTag(*obj)) == fp->thisv);
-
-    JSObject *callee = &JS_CALLEE(cx, vp).asObject();
+    JS_ASSERT(ObjectValue(*obj) == fp->thisv);
+
+    JSObject *callee = &JS_CALLEE(cx, vp).toObject();
     Class *clasp = callee->getClass();
     if (!clasp->call) {
 #ifdef NARCISSUS
         JSObject *args;
         Value fval, nargv[3];
         JSBool ok;
 
         if (!callee->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.__call__Atom), &fval))
@@ -5620,17 +5620,17 @@ js_Call(JSContext *cx, uintN argc, Value
                 return JS_FALSE;
             args = js_GetArgsObject(cx, js_GetTopStackFrame(cx));
             if (!args)
                 return JS_FALSE;
             nargv[0].setObject(*obj);
             nargv[1].setObject(*args);
             return InternalCall(cx, callee, fval, 3, nargv, rval);
         }
-        if (fval.isObjectOrNull() && fval.asObjectOrNull() != callee) {
+        if (fval.isObjectOrNull() && fval.toObjectOrNull() != callee) {
             vp[0] = fval;
             ok = js_Call(cx, argc, vp);
             vp[0].setObject(*callee);
             return ok;
         }
 #endif
         js_ReportIsNotFunction(cx, &vp[0], 0);
         return JS_FALSE;
@@ -5641,38 +5641,38 @@ js_Call(JSContext *cx, uintN argc, Value
         JS_SET_RVAL(cx, vp, rval.value());
     return ok;
 }
 
 JSBool
 js_Construct(JSContext *cx, JSObject *obj, uintN argc, Value *argv, Value *rval)
 {
 
-    Class *clasp = argv[-2].asObject().getClass();
+    Class *clasp = argv[-2].toObject().getClass();
     if (!clasp->construct) {
 #ifdef NARCISSUS
         JSObject *callee, *args;
         Value cval, nargv[2];
         JSBool ok;
 
-        callee = &argv[-2].asObject();
+        callee = &argv[-2].toObject();
         if (!callee->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.__construct__Atom),
                                  &cval)) {
             return JS_FALSE;
         }
         if (IsFunctionObject(cval)) {
             if (!GetCurrentExecutionContext(cx, obj, &nargv[1]))
                 return JS_FALSE;
             args = js_GetArgsObject(cx, js_GetTopStackFrame(cx));
             if (!args)
                 return JS_FALSE;
             nargv[0].setObject(*args);
             return InternalCall(cx, callee, cval, 2, nargv, rval);
         }
-        if (cval.isObjectOrNull() && cval.asObjectOrNull() != callee) {
+        if (cval.isObjectOrNull() && cval.toObjectOrNull() != callee) {
             argv[-2] = cval;
             ok = js_Call(cx, argc, argv - 2);
             if (ok)
                 *rval = argv[-2];
             argv[-2] = OBJECT_TO_JSVAL(callee);
             return ok;
         }
 #endif
@@ -5698,48 +5698,48 @@ js_HasInstance(JSContext *cx, JSObject *
             if (!InternalCall(cx, obj, fval, 1, v, &rval))
                 return JS_FALSE;
             *bp = js_ValueToBoolean(rval);
             return JS_TRUE;
         }
     }
 #endif
     js_ReportValueError(cx, JSMSG_BAD_INSTANCEOF_RHS,
-                        JSDVG_SEARCH_STACK, ObjectTag(*obj), NULL);
+                        JSDVG_SEARCH_STACK, ObjectValue(*obj), NULL);
     return JS_FALSE;
 }
 
 bool
 js_IsDelegate(JSContext *cx, JSObject *obj, const Value &v)
 {
     if (v.isPrimitive())
         return false;
-    JSObject *obj2 = v.asObject().wrappedObject(cx);
+    JSObject *obj2 = v.toObject().wrappedObject(cx);
     while ((obj2 = obj2->getProto()) != NULL) {
         if (obj2 == obj)
             return true;
     }
     return false;
 }
 
 bool
 js::FindClassPrototype(JSContext *cx, JSObject *scope, JSProtoKey protoKey, JSObject **protop,
                        Class *clasp)
 {
     Value v;
     if (!js_FindClassObject(cx, scope, protoKey, &v, clasp))
         return false;
 
     if (IsFunctionObject(v)) {
-        JSObject *ctor = &v.asObject();
+        JSObject *ctor = &v.toObject();
         if (!ctor->getProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom), &v))
             return false;
     }
 
-    *protop = v.isObject() ? &v.asObject() : NULL;
+    *protop = v.isObject() ? &v.toObject() : NULL;
     return true;
 }
 
 /*
  * The first part of this function has been hand-expanded and optimized into
  * NewBuiltinClassInstance in jsobjinlines.h.
  */
 JSBool
@@ -5761,17 +5761,17 @@ js_GetClassPrototype(JSContext *cx, JSOb
                     return true;
                 }
             }
         }
         scope = scope->getGlobal();
         if (scope->getClass()->flags & JSCLASS_IS_GLOBAL) {
             const Value &v = scope->getReservedSlot(JSProto_LIMIT + protoKey);
             if (v.isObject()) {
-                *protop = &v.asObject();
+                *protop = &v.toObject();
                 return true;
             }
         }
     }
 
     return FindClassPrototype(cx, scope, protoKey, protop, clasp);
 }
 
@@ -5813,26 +5813,26 @@ js_SetClassPrototype(JSContext *cx, JSOb
 {
     /*
      * Use the given attributes for the prototype property of the constructor,
      * as user-defined constructors have a DontDelete prototype (which may be
      * reset), while native or "system" constructors have DontEnum | ReadOnly |
      * DontDelete.
      */
     if (!ctor->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom),
-                              ObjectOrNullTag(proto), PropertyStub, PropertyStub, attrs)) {
+                              ObjectOrNullValue(proto), PropertyStub, PropertyStub, attrs)) {
         return JS_FALSE;
     }
 
     /*
      * ECMA says that Object.prototype.constructor, or f.prototype.constructor
      * for a user-defined function f, is DontEnum.
      */
     return proto->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.constructorAtom),
-                                 ObjectOrNullTag(ctor), CheckCtorGetAccess, CheckCtorSetAccess, 0);
+                                 ObjectOrNullValue(ctor), CheckCtorGetAccess, CheckCtorSetAccess, 0);
 }
 
 JSBool
 js_PrimitiveToObject(JSContext *cx, Value *vp)
 {
     Value v = *vp;
     JS_ASSERT(v.isPrimitive());
 
@@ -5854,24 +5854,24 @@ js_PrimitiveToObject(JSContext *cx, Valu
 }
 
 JSBool
 js_ValueToObjectOrNull(JSContext *cx, const Value &v, JSObject **objp)
 {
     JSObject *obj;
 
     if (v.isObjectOrNull()) {
-        obj = v.asObjectOrNull();
+        obj = v.toObjectOrNull();
     } else if (v.isUndefined()) {
         obj = NULL;
     } else {
         Value tmp = v;
         if (!js_PrimitiveToObject(cx, &tmp))
             return JS_FALSE;
-        obj = &tmp.asObject();
+        obj = &tmp.toObject();
     }
     *objp = obj;
     return JS_TRUE;
 }
 
 JSObject *
 js_ValueToNonNullObject(JSContext *cx, const Value &v)
 {
@@ -6162,17 +6162,17 @@ js_Clear(JSContext *cx, JSObject *obj)
     if (!scope->isSharedEmpty()) {
         /* Now that we're done using scope->lastProp/table, clear scope. */
         scope->clear(cx);
 
         /* Clear slot values and reset freeslot so we're consistent. */
         i = obj->numSlots();
         n = JSSLOT_FREE(obj->getClass());
         while (--i >= n)
-            obj->setSlot(i, Value(UndefinedTag()));
+            obj->setSlot(i, UndefinedValue());
         scope->freeslot = n;
     }
     JS_UNLOCK_OBJ(cx, obj);
 }
 
 bool
 js_GetReservedSlot(JSContext *cx, JSObject *obj, uint32 index, Value *vp)
 {
@@ -6285,17 +6285,17 @@ JSObject::getCompartment(JSContext *cx)
         // Compile-time Function, Block, and RegExp objects are not parented.
         if (clasp == &js_FunctionClass || clasp == &js_BlockClass || clasp == &js_RegExpClass) {
             // This is a bogus answer, but it'll do for now.
             return cx->runtime->defaultCompartment;
         }
         JS_NOT_REACHED("non-global object at end of scope chain");
     }
     const Value &v = obj->getReservedSlot(JSRESERVED_GLOBAL_COMPARTMENT);
-    return (JSCompartment *)v.asPrivate();
+    return (JSCompartment *)v.toPrivate();
 }
 
 JS_FRIEND_API(JSBool)
 js_GetterOnlyPropertyStub(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
 {
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_GETTER_ONLY);
     return JS_FALSE;
 }
@@ -6366,38 +6366,38 @@ js_DumpAtom(JSAtom *atom)
 void
 dumpValue(const Value &v)
 {
     if (v.isNull())
         fprintf(stderr, "null");
     else if (v.isUndefined())
         fprintf(stderr, "undefined");
     else if (v.isInt32())
-        fprintf(stderr, "%d", v.asInt32());
+        fprintf(stderr, "%d", v.toInt32());
     else if (v.isDouble())
-        fprintf(stderr, "%g", v.asDouble());
+        fprintf(stderr, "%g", v.toDouble());
     else if (v.isString())
-        dumpString(v.asString());
-    else if (v.isObject() && v.asObject().isFunction()) {
-        JSObject *funobj = &v.asObject();
+        dumpString(v.toString());
+    else if (v.isObject() && v.toObject().isFunction()) {
+        JSObject *funobj = &v.toObject();
         JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
         fprintf(stderr, "<%s %s at %p (JSFunction at %p)>",
                 fun->atom ? "function" : "unnamed",
                 fun->atom ? JS_GetStringBytes(ATOM_TO_STRING(fun->atom)) : "function",
                 (void *) funobj,
                 (void *) fun);
     } else if (v.isObject()) {
-        JSObject *obj = &v.asObject();
+        JSObject *obj = &v.toObject();
         Class *clasp = obj->getClass();
         fprintf(stderr, "<%s%s at %p>",
                 clasp->name,
                 clasp == &js_ObjectClass ? "" : " object",
                 (void *) obj);
     } else if (v.isBoolean()) {
-        if (v.asBoolean())
+        if (v.toBoolean())
             fprintf(stderr, "true");
         else
             fprintf(stderr, "false");
     } else if (v.isMagic()) {
         fprintf(stderr, "<invalid");
 #ifdef DEBUG
         switch (v.whyMagic()) {
           case JS_ARRAY_HOLE:        fprintf(stderr, " array hole");         break;
@@ -6487,21 +6487,21 @@ js_DumpObject(JSObject *obj)
             dumpScopeProp(sprop);
         }
     } else {
         if (!obj->isNative())
             fprintf(stderr, "not native\n");
     }
 
     fprintf(stderr, "proto ");
-    dumpValue(ObjectOrNullTag(obj->getProto()));
+    dumpValue(ObjectOrNullValue(obj->getProto()));
     fputc('\n', stderr);
 
     fprintf(stderr, "parent ");
-    dumpValue(ObjectOrNullTag(obj->getParent()));
+    dumpValue(ObjectOrNullValue(obj->getParent()));
     fputc('\n', stderr);
 
     i = JSSLOT_PRIVATE;
     if (clasp->flags & JSCLASS_HAS_PRIVATE) {
         i = JSSLOT_PRIVATE + 1;
         fprintf(stderr, "private %p\n", obj->getPrivate());
     }
 
@@ -6521,17 +6521,17 @@ js_DumpObject(JSObject *obj)
     fputc('\n', stderr);
 }
 
 static void
 MaybeDumpObject(const char *name, JSObject *obj)
 {
     if (obj) {
         fprintf(stderr, "  %s: ", name);
-        dumpValue(ObjectTag(*obj));
+        dumpValue(ObjectValue(*obj));
         fputc('\n', stderr);
     }
 }
 
 static void
 MaybeDumpValue(const char *name, const Value &v)
 {
     if (!v.isNull()) {
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -76,17 +76,17 @@ inline JSObject *
 CastAsObject(PropertyOp op)
 {
     return JS_FUNC_TO_DATA_PTR(JSObject *, op);
 }
 
 inline Value
 CastAsObjectJsval(PropertyOp op)
 {
-    return ObjectTag(*CastAsObject(op));
+    return ObjectValue(*CastAsObject(op));
 }
 
 } /* namespace js */
 
 /*
  * A representation of ECMA-262 ed. 5's internal property descriptor data
  * structure.
  */
@@ -122,20 +122,20 @@ struct PropDesc {
         return (attrs & JSPROP_ENUMERATE) != 0;
     }
 
     bool writable() const {
         return (attrs & JSPROP_READONLY) == 0;
     }
 
     JSObject* getterObject() const {
-        return get.isUndefined() ? NULL : &get.asObject();
+        return get.isUndefined() ? NULL : &get.toObject();
     }
     JSObject* setterObject() const {
-        return set.isUndefined() ? NULL : &set.asObject();
+        return set.isUndefined() ? NULL : &set.toObject();
     }
 
     const js::Value &getterValue() const {
         return get;
     }
     const js::Value &setterValue() const {
         return set;
     }
@@ -326,17 +326,17 @@ struct JSObject {
         return (flags & jsuword(2)) != jsuword(0);
     }
 
     void setSystem() {
         flags |= jsuword(2);
     }
 
     uint32 numSlots(void) const {
-        return dslots ? dslots[-1].asPrivateUint32() : (uint32)JS_INITIAL_NSLOTS;
+        return dslots ? dslots[-1].toPrivateUint32() : (uint32)JS_INITIAL_NSLOTS;
     }
 
   private:
     static size_t slotsToDynamicWords(size_t nslots) {
         JS_ASSERT(nslots > JS_INITIAL_NSLOTS);
         return nslots + 1 - JS_INITIAL_NSLOTS;
     }
 
@@ -348,32 +348,32 @@ struct JSObject {
   public:
     bool allocSlots(JSContext *cx, size_t nslots);
     bool growSlots(JSContext *cx, size_t nslots);
     void shrinkSlots(JSContext *cx, size_t nslots);
 
     js::Value& getSlotRef(uintN slot) {
         return (slot < JS_INITIAL_NSLOTS)
                ? fslots[slot]
-               : (JS_ASSERT(slot < dslots[-1].asPrivateUint32()),
+               : (JS_ASSERT(slot < dslots[-1].toPrivateUint32()),
                   dslots[slot - JS_INITIAL_NSLOTS]);
     }
 
     const js::Value &getSlot(uintN slot) const {
         return (slot < JS_INITIAL_NSLOTS)
                ? fslots[slot]
-               : (JS_ASSERT(slot < dslots[-1].asPrivateUint32()),
+               : (JS_ASSERT(slot < dslots[-1].toPrivateUint32()),
                   dslots[slot - JS_INITIAL_NSLOTS]);
     }
 
     void setSlot(uintN slot, const js::Value &value) {
         if (slot < JS_INITIAL_NSLOTS) {
             fslots[slot] = value;
         } else {
-            JS_ASSERT(slot < dslots[-1].asPrivateUint32());
+            JS_ASSERT(slot < dslots[-1].toPrivateUint32());
             dslots[slot - JS_INITIAL_NSLOTS] = value;
         }
     }
 
     inline const js::Value &lockedGetSlot(uintN slot) const;
     inline void lockedSetSlot(uintN slot, const js::Value &value);
 
     /*
@@ -400,17 +400,17 @@ struct JSObject {
         for (JSObject *obj = newProto; obj; obj = obj->getProto())
             JS_ASSERT(obj != this);
 #endif
         setDelegateNullSafe(newProto);
         proto = newProto;
     }
 
     JSObject *getParent() const {
-        return fslots[JSSLOT_PARENT].asObjectOrNull();
+        return fslots[JSSLOT_PARENT].toObjectOrNull();
     }
 
     void clearParent() {
         fslots[JSSLOT_PARENT].setNull();
     }
 
     void setParent(JSObject *newParent) {
 #ifdef DEBUG
@@ -427,30 +427,30 @@ struct JSObject {
         if (JSObject *parent = getParent())
             JS_CALL_OBJECT_TRACER(trc, parent, "parent");
     }
 
     JSObject *getGlobal();
 
     void *getPrivate() const {
         JS_ASSERT(getClass()->flags & JSCLASS_HAS_PRIVATE);
-        void *priv = fslots[JSSLOT_PRIVATE].asPrivate();
+        void *priv = fslots[JSSLOT_PRIVATE].toPrivate();
         return priv;
     }
 
     void setPrivate(void *data) {
         JS_ASSERT(getClass()->flags & JSCLASS_HAS_PRIVATE);
         JS_ASSERT((size_t(data) & 1) == 0);
         fslots[JSSLOT_PRIVATE].setPrivate(data);
     }
 
     static js::Value defaultPrivate(js::Class *clasp) {
         if (clasp->flags & JSCLASS_HAS_PRIVATE)
-            return js::PrivateTag(NULL);
-        return js::UndefinedTag();
+            return js::PrivateValue(NULL);
+        return js::UndefinedValue();
     }
 
     /*
      * Primitive-specific getters and setters.
      */
 
   private:
     static const uint32 JSSLOT_PRIMITIVE_THIS = JSSLOT_PRIVATE;
@@ -868,19 +868,19 @@ OBJ_IS_CLONED_BLOCK(JSObject *obj)
 static const uint32 JSSLOT_WITH_THIS = JSSLOT_PRIVATE + 2;
 
 extern JSBool
 js_DefineBlockVariable(JSContext *cx, JSObject *obj, jsid id, intN index);
 
 #define OBJ_BLOCK_COUNT(cx,obj)                                               \
     ((OBJ_IS_CLONED_BLOCK(obj) ? obj->getProto() : obj)->scope()->entryCount)
 #define OBJ_BLOCK_DEPTH(cx,obj)                                               \
-    obj->getSlot(JSSLOT_BLOCK_DEPTH).asInt32()
+    obj->getSlot(JSSLOT_BLOCK_DEPTH).toInt32()
 #define OBJ_SET_BLOCK_DEPTH(cx,obj,depth)                                     \
-    obj->setSlot(JSSLOT_BLOCK_DEPTH, Value(Int32Tag(depth)))
+    obj->setSlot(JSSLOT_BLOCK_DEPTH, Value(Int32Value(depth)))
 
 /*
  * To make sure this slot is well-defined, always call js_NewWithObject to
  * create a With object, don't call js_NewObject directly.  When creating a
  * With object that does not correspond to a stack slot, pass -1 for depth.
  *
  * When popping the stack across this object's "with" statement, client code
  * must call withobj->setPrivate(NULL).
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -98,17 +98,17 @@ JSObject::setSlotMT(JSContext *cx, uintN
     this->lockedSetSlot(slot, value);
 #endif
 }
 
 inline js::Value
 JSObject::getReservedSlot(uintN index) const
 {
     uint32 slot = JSSLOT_START(getClass()) + index;
-    return (slot < numSlots()) ? getSlot(slot) : js::Value(js::UndefinedTag());
+    return (slot < numSlots()) ? getSlot(slot) : js::UndefinedValue();
 }
 
 inline bool
 JSObject::isPrimitive() const
 {
     return isNumber() || isString() || isBoolean();
 }
 
@@ -143,24 +143,24 @@ JSObject::isDenseArrayMinLenCapOk(bool s
     if (!strictAboutLength &&
         fslots[JSSLOT_ARRAY_LENGTH].isUndefined() &&
         uncheckedGetDenseArrayCapacity() == 0) {
         return true;
     }
 
     uint32 length = uncheckedGetArrayLength();
     uint32 capacity = uncheckedGetDenseArrayCapacity();
-    uint32 minLenCap = fslots[JSSLOT_DENSE_ARRAY_MINLENCAP].asPrivateUint32();
+    uint32 minLenCap = fslots[JSSLOT_DENSE_ARRAY_MINLENCAP].toPrivateUint32();
     return minLenCap == JS_MIN(length, capacity);
 }
 
 inline uint32
 JSObject::uncheckedGetArrayLength() const
 {
-    return fslots[JSSLOT_ARRAY_LENGTH].asPrivateUint32();
+    return fslots[JSSLOT_ARRAY_LENGTH].toPrivateUint32();
 }
 
 inline uint32
 JSObject::getArrayLength() const
 {
     JS_ASSERT(isArray());
     JS_ASSERT_IF(isDenseArray(), isDenseArrayMinLenCapOk());
     return uncheckedGetArrayLength();
@@ -181,44 +181,44 @@ JSObject::setSlowArrayLength(uint32 leng
     JS_ASSERT(isSlowArray());
     fslots[JSSLOT_ARRAY_LENGTH].setPrivateUint32(length);
 }
 
 inline uint32 
 JSObject::getDenseArrayCount() const
 {
     JS_ASSERT(isDenseArray());
-    return fslots[JSSLOT_DENSE_ARRAY_COUNT].asPrivateUint32();
+    return fslots[JSSLOT_DENSE_ARRAY_COUNT].toPrivateUint32();
 }
 
 inline void 
 JSObject::setDenseArrayCount(uint32 count)
 {
     JS_ASSERT(isDenseArray());
     fslots[JSSLOT_DENSE_ARRAY_COUNT].setPrivateUint32(count);
 }
 
 inline void 
 JSObject::incDenseArrayCountBy(uint32 posDelta)
 {
     JS_ASSERT(isDenseArray());
-    fslots[JSSLOT_DENSE_ARRAY_COUNT].asPrivateUint32Ref() += posDelta;
+    fslots[JSSLOT_DENSE_ARRAY_COUNT].getPrivateUint32Ref() += posDelta;
 }
 
 inline void 
 JSObject::decDenseArrayCountBy(uint32 negDelta)
 {
     JS_ASSERT(isDenseArray());
-    fslots[JSSLOT_DENSE_ARRAY_COUNT].asPrivateUint32Ref() -= negDelta;
+    fslots[JSSLOT_DENSE_ARRAY_COUNT].getPrivateUint32Ref() -= negDelta;
 }
 
 inline uint32
 JSObject::uncheckedGetDenseArrayCapacity() const
 {
-    return dslots ? dslots[-1].asPrivateUint32Ref() : 0;
+    return dslots ? dslots[-1].toPrivateUint32() : 0;
 }
 
 inline uint32
 JSObject::getDenseArrayCapacity() const
 {
     JS_ASSERT(isDenseArray());
     JS_ASSERT(isDenseArrayMinLenCapOk(/* strictAboutLength = */false));
     return uncheckedGetDenseArrayCapacity();
@@ -293,34 +293,34 @@ JSObject::setArgsLength(uint32 argc)
     fslots[JSSLOT_ARGS_LENGTH].setInt32(argc << 1);
     JS_ASSERT(!isArgsLengthOverridden());
 }
 
 inline uint32
 JSObject::getArgsLength() const
 {
     JS_ASSERT(isArguments());
-    uint32 argc = uint32(fslots[JSSLOT_ARGS_LENGTH].asInt32()) >> 1;
+    uint32 argc = uint32(fslots[JSSLOT_ARGS_LENGTH].toInt32()) >> 1;
     JS_ASSERT(argc <= JS_ARGS_LENGTH_MAX);
     return argc;
 }
 
 inline void
 JSObject::setArgsLengthOverridden()
 {
     JS_ASSERT(isArguments());
-    fslots[JSSLOT_ARGS_LENGTH].asInt32Ref() |= 1;
+    fslots[JSSLOT_ARGS_LENGTH].getInt32Ref() |= 1;
 }
 
 inline bool
 JSObject::isArgsLengthOverridden() const
 {
     JS_ASSERT(isArguments());
     const js::Value &v = fslots[JSSLOT_ARGS_LENGTH];
-    return (v.asInt32() & 1) != 0;
+    return (v.toInt32() & 1) != 0;
 }
 
 inline const js::Value & 
 JSObject::getArgsCallee() const
 {
     JS_ASSERT(isArguments());
     return fslots[JSSLOT_ARGS_CALLEE];
 }
@@ -471,17 +471,17 @@ JSObject::setQNameLocalName(jsval name)
 {
     JS_ASSERT(isQName());
     fslots[JSSLOT_QNAME_LOCAL_NAME] = js::Valueify(name);
 }
 
 inline JSObject *
 JSObject::getWithThis() const
 {
-    return &fslots[JSSLOT_WITH_THIS].asObject();
+    return &fslots[JSSLOT_WITH_THIS].toObject();
 }
 
 inline void
 JSObject::setWithThis(JSObject *thisp)
 {
     fslots[JSSLOT_WITH_THIS].setObject(*thisp);
 }
 
@@ -495,17 +495,17 @@ JSObject::initSharingEmptyScope(js::Clas
     JS_ASSERT(emptyScope->clasp == clasp);
     map = emptyScope->hold();
 }
 
 inline void
 JSObject::freeSlotsArray(JSContext *cx)
 {
     JS_ASSERT(hasSlotsArray());
-    JS_ASSERT(dslots[-1].asPrivateUint32() > JS_INITIAL_NSLOTS);
+    JS_ASSERT(dslots[-1].toPrivateUint32() > JS_INITIAL_NSLOTS);
     cx->free(dslots - 1);
 }
 
 inline bool
 JSObject::unbrand(JSContext *cx)
 {
     if (this->isNative()) {
         JS_LOCK_OBJ(cx, this);
@@ -600,17 +600,17 @@ InitScopeForObject(JSContext* cx, JSObje
             goto bad;
         uint32 freeslot = JSSLOT_FREE(clasp);
         JS_ASSERT(freeslot >= scope->freeslot);
         if (freeslot > JS_INITIAL_NSLOTS && !obj->allocSlots(cx, freeslot))
             goto bad;
         scope->freeslot = freeslot;
 #ifdef DEBUG
         if (freeslot < obj->numSlots())
-            obj->setSlot(freeslot, UndefinedTag());
+            obj->setSlot(freeslot, UndefinedValue());
 #endif
     }
 
     obj->map = scope;
     return true;
 
   bad:
     /* The GC nulls map initially. It should still be null on error. */
@@ -703,17 +703,17 @@ NewBuiltinClassInstance(JSContext *cx, C
     } else {
         global = cx->fp->scopeChain->getGlobal();
     }
     JS_ASSERT(global->getClass()->flags & JSCLASS_IS_GLOBAL);
 
     const Value &v = global->getReservedSlot(JSProto_LIMIT + protoKey);
     JSObject *proto;
     if (v.isObject()) {
-        proto = &v.asObject();
+        proto = &v.toObject();
         JS_ASSERT(proto->getParent() == global);
     } else {
         if (!FindClassPrototype(cx, global, protoKey, &proto, clasp))
             return NULL;
     }
 
     return NewNativeClassInstance(cx, clasp, proto, global);
 }
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -498,18 +498,18 @@ InitializeGap(JSContext *cx, jsval space
         if (!js_ValueToCharBuffer(cx, gap.value(), cb))
             return JS_FALSE;
         if (cb.length() > 10)
             cb.resize(10);
     }
 
     if (gap.value().isNumber()) {
         jsdouble d = gap.value().isInt32()
-                     ? gap.value().asInt32()
-                     : js_DoubleToInteger(gap.value().asDouble());
+                     ? gap.value().toInt32()
+                     : js_DoubleToInteger(gap.value().toDouble());
         d = JS_MIN(10, d);
         if (d >= 1 && !cb.appendN(' ', uint32(d)))
             return JS_FALSE;
     }
 
     return JS_TRUE;
 }
 
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -337,17 +337,17 @@ js_GetIndexFromBytecode(JSContext *cx, J
  * might be string or double atoms. Those opcodes cannot be used from imacros.
  * See the assertions in the JSOP_DOUBLE and JSOP_LOOKUPSWTICH* opcode cases in
  * jsops.cpp.
  */
 #define GET_DOUBLE_FROM_BYTECODE(script, pc, pcoff, dbl)                      \
     JS_BEGIN_MACRO                                                            \
         uintN index_ = js_GetIndexFromBytecode(cx, (script), (pc), (pcoff));  \
         JS_ASSERT(index_ < (script)->consts()->length);                       \
-        (dbl) = (script)->getConst(index_).asDouble();                        \
+        (dbl) = (script)->getConst(index_).toDouble();                        \
     JS_END_MACRO
 
 #define GET_OBJECT_FROM_BYTECODE(script, pc, pcoff, obj)                      \
     JS_BEGIN_MACRO                                                            \
         uintN index_ = js_GetIndexFromBytecode(cx, (script), (pc), (pcoff));  \
         obj = (script)->getObject(index_);                                    \
     JS_END_MACRO
 
--- a/js/src/jsops.cpp
+++ b/js/src/jsops.cpp
@@ -183,17 +183,17 @@ BEGIN_CASE(JSOP_ENTERWITH)
      *
      * We set sp[-1] to the current "with" object to help asserting the
      * enter/leave balance in [leavewith].
      */
     regs.sp[-1].setObject(*fp->scopeChain);
 END_CASE(JSOP_ENTERWITH)
 
 BEGIN_CASE(JSOP_LEAVEWITH)
-    JS_ASSERT(&regs.sp[-1].asObject() == fp->scopeChain);
+    JS_ASSERT(&regs.sp[-1].toObject() == fp->scopeChain);
     regs.sp--;
     js_LeaveWith(cx);
 END_CASE(JSOP_LEAVEWITH)
 
 BEGIN_CASE(JSOP_RETURN)
     POP_COPY_TO(fp->rval);
     /* FALL THROUGH */
 
@@ -470,17 +470,17 @@ END_CASE(JSOP_ANDX)
 
 BEGIN_CASE(JSOP_IN)
 {
     const Value &rref = regs.sp[-1];
     if (!rref.isObject()) {
         js_ReportValueError(cx, JSMSG_IN_NOT_OBJECT, -1, rref, NULL);
         goto error;
     }
-    JSObject *obj = &rref.asObject();
+    JSObject *obj = &rref.toObject();
     jsid id;
     FETCH_ELEMENT_ID(obj, -2, id);
     JSObject *obj2;
     JSProperty *prop;
     if (!obj->lookupProperty(cx, id, &obj2, &prop))
         goto error;
     bool cond = prop != NULL;
     if (prop)
@@ -503,17 +503,17 @@ BEGIN_CASE(JSOP_ITER)
 END_CASE(JSOP_ITER)
 
 BEGIN_CASE(JSOP_MOREITER)
 {
     JS_ASSERT(regs.sp - 1 >= fp->base());
     JS_ASSERT(regs.sp[-1].isObject());
     PUSH_NULL();
     bool cond;
-    if (!IteratorMore(cx, &regs.sp[-2].asObject(), &cond, &regs.sp[-1]))
+    if (!IteratorMore(cx, &regs.sp[-2].toObject(), &cond, &regs.sp[-1]))
         goto error;
     CHECK_INTERRUPT_HANDLER();
     TRY_BRANCH_AFTER_COND(cond, 1);
     JS_ASSERT(regs.pc[1] == JSOP_IFNEX);
     regs.sp[-1].setBoolean(cond);
 }
 END_CASE(JSOP_MOREITER)
 
@@ -528,28 +528,28 @@ BEGIN_CASE(JSOP_ENDITER)
 END_CASE(JSOP_ENDITER)
 
 BEGIN_CASE(JSOP_FORARG)
 {
     JS_ASSERT(regs.sp - 1 >= fp->base());
     uintN slot = GET_ARGNO(regs.pc);
     JS_ASSERT(slot < fp->fun->nargs);
     JS_ASSERT(regs.sp[-1].isObject());
-    if (!IteratorNext(cx, &regs.sp[-1].asObject(), &fp->argv[slot]))
+    if (!IteratorNext(cx, &regs.sp[-1].toObject(), &fp->argv[slot]))
         goto error;
 }
 END_CASE(JSOP_FORARG)
 
 BEGIN_CASE(JSOP_FORLOCAL)
 {
     JS_ASSERT(regs.sp - 1 >= fp->base());
     uintN slot = GET_SLOTNO(regs.pc);
     JS_ASSERT(slot < fp->script->nslots);
     JS_ASSERT(regs.sp[-1].isObject());
-    if (!IteratorNext(cx, &regs.sp[-1].asObject(), &fp->slots()[slot]))
+    if (!IteratorNext(cx, &regs.sp[-1].toObject(), &fp->slots()[slot]))
         goto error;
 }
 END_CASE(JSOP_FORLOCAL)
 
 BEGIN_CASE(JSOP_FORNAME)
 {
     JS_ASSERT(regs.sp - 1 >= fp->base());
     JSAtom *atom;
@@ -559,17 +559,17 @@ BEGIN_CASE(JSOP_FORNAME)
     JSProperty *prop;
     if (!js_FindProperty(cx, id, &obj, &obj2, &prop))
         goto error;
     if (prop)
         obj2->dropProperty(cx, prop);
     {
         AutoValueRooter tvr(cx);
         JS_ASSERT(regs.sp[-1].isObject());
-        if (!IteratorNext(cx, &regs.sp[-1].asObject(), tvr.addr()))
+        if (!IteratorNext(cx, &regs.sp[-1].toObject(), tvr.addr()))
             goto error;
         if (!obj->setProperty(cx, id, tvr.addr()))
             goto error;
     }
 }
 END_CASE(JSOP_FORNAME)
 
 BEGIN_CASE(JSOP_FORPROP)
@@ -578,17 +578,17 @@ BEGIN_CASE(JSOP_FORPROP)
     JSAtom *atom;
     LOAD_ATOM(0, atom);
     jsid id = ATOM_TO_JSID(atom);
     JSObject *obj;
     FETCH_OBJECT(cx, -1, obj);
     {
         AutoValueRooter tvr(cx);
         JS_ASSERT(regs.sp[-2].isObject());
-        if (!IteratorNext(cx, &regs.sp[-2].asObject(), tvr.addr()))
+        if (!IteratorNext(cx, &regs.sp[-2].toObject(), tvr.addr()))
             goto error;
         if (!obj->setProperty(cx, id, tvr.addr()))
             goto error;
     }
     regs.sp--;
 }
 END_CASE(JSOP_FORPROP)
 
@@ -597,17 +597,17 @@ BEGIN_CASE(JSOP_FORELEM)
      * JSOP_FORELEM simply dups the property identifier at top of stack and
      * lets the subsequent JSOP_ENUMELEM opcode sequence handle the left-hand
      * side expression evaluation and assignment. This opcode exists solely to
      * help the decompiler.
      */
     JS_ASSERT(regs.sp - 1 >= fp->base());
     JS_ASSERT(regs.sp[-1].isObject());
     PUSH_NULL();
-    if (!IteratorNext(cx, &regs.sp[-2].asObject(), &regs.sp[-1]))
+    if (!IteratorNext(cx, &regs.sp[-2].toObject(), &regs.sp[-1]))
         goto error;
 END_CASE(JSOP_FORELEM)
 
 BEGIN_CASE(JSOP_DUP)
 {
     JS_ASSERT(regs.sp > fp->base());
     const Value &rref = regs.sp[-1];
     PUSH_COPY(rref);
@@ -812,18 +812,18 @@ END_CASE(JSOP_BITAND)
 
 /*
  * NB: These macros can't use JS_BEGIN_MACRO/JS_END_MACRO around their bodies
  * because they begin if/else chains, so callers must not put semicolons after
  * the call expressions!
  */
 #if JS_HAS_XML_SUPPORT
 #define XML_EQUALITY_OP(OP)                                                   \
-    if ((lval.isObject() && lval.asObject().isXML()) ||                       \
-        (rval.isObject() && rval.asObject().isXML())) {                       \
+    if ((lval.isObject() && lval.toObject().isXML()) ||                       \
+        (rval.isObject() && rval.toObject().isXML())) {                       \
         if (!js_TestXMLEquality(cx, lval, rval, &cond))                       \
             goto error;                                                       \
         cond = cond OP JS_TRUE;                                               \
     } else
 
 #define EXTENDED_EQUALITY_OP(OP)                                              \
     if (((clasp = l->getClass())->flags & JSCLASS_IS_EXTENDED) &&             \
         ((ExtendedClass *)clasp)->equality) {                                 \
@@ -840,40 +840,40 @@ END_CASE(JSOP_BITAND)
     JS_BEGIN_MACRO                                                            \
         Class *clasp;                                                         \
         JSBool cond;                                                          \
         Value rval = regs.sp[-1];                                             \
         Value lval = regs.sp[-2];                                             \
         XML_EQUALITY_OP(OP)                                                   \
         if (SameType(lval, rval)) {                                           \
             if (lval.isString()) {                                            \
-                JSString *l = lval.asString(), *r = rval.asString();          \
+                JSString *l = lval.toString(), *r = rval.toString();          \
                 cond = js_EqualStrings(l, r) OP JS_TRUE;                      \
             } else if (lval.isDouble()) {                                     \
-                double l = lval.asDouble(), r = rval.asDouble();              \
+                double l = lval.toDouble(), r = rval.toDouble();              \
                 cond = JSDOUBLE_COMPARE(l, OP, r, IFNAN);                     \
             } else if (lval.isObject()) {                                     \
-                JSObject *l = &lval.asObject(), *r = &rval.asObject();        \
+                JSObject *l = &lval.toObject(), *r = &rval.toObject();        \
                 EXTENDED_EQUALITY_OP(OP)                                      \
                 cond = l OP r;                                                \
             } else {                                                          \
-                cond = lval.asRawUint32() OP rval.asRawUint32();              \
+                cond = lval.payloadAsRawUint32() OP rval.payloadAsRawUint32();\
             }                                                                 \
         } else {                                                              \
             if (lval.isNullOrUndefined()) {                                   \
                 cond = rval.isNullOrUndefined() OP true;                      \
             } else if (rval.isNullOrUndefined()) {                            \
                 cond = true OP false;                                         \
             } else {                                                          \
                 if (lval.isObject())                                          \
                     DEFAULT_VALUE(cx, -2, JSTYPE_VOID, lval);                 \
                 if (rval.isObject())                                          \
                     DEFAULT_VALUE(cx, -1, JSTYPE_VOID, rval);                 \
                 if (lval.isString() && rval.isString()) {                     \
-                    JSString *l = lval.asString(), *r = rval.asString();      \
+                    JSString *l = lval.toString(), *r = rval.toString();      \
                     cond = js_EqualStrings(l, r) OP JS_TRUE;                  \
                 } else {                                                      \
                     double l, r;                                              \
                     if (!ValueToNumber(cx, lval, &l) ||                       \
                         !ValueToNumber(cx, rval, &r)) {                       \
                         goto error;                                           \
                     }                                                         \
                     cond = JSDOUBLE_COMPARE(l, OP, r, IFNAN);                 \
@@ -949,24 +949,24 @@ END_CASE(JSOP_CASEX)
 
 #define RELATIONAL_OP(OP)                                                     \
     JS_BEGIN_MACRO                                                            \
         Value rval = regs.sp[-1];                                             \
         Value lval = regs.sp[-2];                                             \
         bool cond;                                                            \
         /* Optimize for two int-tagged operands (typical loop control). */    \
         if (lval.isInt32() && rval.isInt32()) {                               \
-            cond = lval.asInt32() OP rval.asInt32();                          \
+            cond = lval.toInt32() OP rval.toInt32();                          \
         } else {                                                              \
             if (lval.isObject())                                              \
                 DEFAULT_VALUE(cx, -2, JSTYPE_NUMBER, lval);                   \
             if (rval.isObject())                                              \
                 DEFAULT_VALUE(cx, -1, JSTYPE_NUMBER, rval);                   \
             if (lval.isString() && rval.isString()) {                         \
-                JSString *l = lval.asString(), *r = rval.asString();          \
+                JSString *l = lval.toString(), *r = rval.toString();          \
                 cond = js_CompareStrings(l, r) OP 0;                          \
             } else {                                                          \
                 double l, r;                                                  \
                 if (!ValueToNumber(cx, lval, &l) ||                           \
                     !ValueToNumber(cx, rval, &r)) {                           \
                     goto error;                                               \
                 }                                                             \
                 cond = JSDOUBLE_COMPARE(l, OP, r, false);                     \
@@ -1034,50 +1034,50 @@ BEGIN_CASE(JSOP_URSH)
 END_CASE(JSOP_URSH)
 
 BEGIN_CASE(JSOP_ADD)
 {
     Value rval = regs.sp[-1];
     Value lval = regs.sp[-2];
 
     if (lval.isInt32() && rval.isInt32()) {
-        int32_t l = lval.asInt32(), r = rval.asInt32();
+        int32_t l = lval.toInt32(), r = rval.toInt32();
         int32_t sum = l + r;
         regs.sp--;
         if (JS_UNLIKELY(bool((l ^ sum) & (r ^ sum) & 0x80000000)))
             regs.sp[-1].setDouble(double(l) + double(r));
         else
             regs.sp[-1].setInt32(sum);
     } else
 #if JS_HAS_XML_SUPPORT
     if (IsXML(lval) && IsXML(rval)) {
-        if (!js_ConcatenateXML(cx, &lval.asObject(), &rval.asObject(), &rval))
+        if (!js_ConcatenateXML(cx, &lval.toObject(), &rval.toObject(), &rval))
             goto error;
         regs.sp--;
         regs.sp[-1] = rval;
     } else
 #endif
     {
         if (lval.isObject()) 
             DEFAULT_VALUE(cx, -2, JSTYPE_VOID, lval);
         if (rval.isObject())
             DEFAULT_VALUE(cx, -1, JSTYPE_VOID, rval);
         bool lIsString, rIsString;
         if ((lIsString = lval.isString()) | (rIsString = rval.isString())) {
             JSString *lstr, *rstr;
             if (lIsString) {
-                lstr = lval.asString();
+                lstr = lval.toString();
             } else {
                 lstr = js_ValueToString(cx, lval);
                 if (!lstr)
                     goto error;
                 regs.sp[-2].setString(lstr);
             }
             if (rIsString) {
-                rstr = rval.asString();
+                rstr = rval.toString();
             } else {
                 rstr = js_ValueToString(cx, rval);
                 if (!rstr)
                     goto error;
                 regs.sp[-1].setString(rstr);
             }
             JSString *str = js_ConcatStrings(cx, lstr, rstr);
             if (!str)
@@ -1178,17 +1178,17 @@ BEGIN_CASE(JSOP_DIV)
 END_CASE(JSOP_DIV)
 
 BEGIN_CASE(JSOP_MOD)
 {
     Value &lref = regs.sp[-2];
     Value &rref = regs.sp[-1];
     int32_t l, r;
     if (lref.isInt32() && rref.isInt32() &&
-        (l = lref.asInt32()) >= 0 && (r = rref.asInt32()) > 0) {
+        (l = lref.toInt32()) >= 0 && (r = rref.toInt32()) > 0) {
         int32_t mod = l % r;
         regs.sp--;
         regs.sp[-1].setInt32(mod);
     } else {
         double d1, d2;
         if (!ValueToNumber(cx, regs.sp[-2], &d1) ||
             !ValueToNumber(cx, regs.sp[-1], &d2)) {
             goto error;
@@ -1227,17 +1227,17 @@ BEGIN_CASE(JSOP_NEG)
 {
     /*
      * When the operand is int jsval, INT32_FITS_IN_JSVAL(i) implies
      * INT32_FITS_IN_JSVAL(-i) unless i is 0 or INT32_MIN when the
      * results, -0.0 or INT32_MAX + 1, are jsdouble values.
      */
     const Value &ref = regs.sp[-1];
     int32_t i;
-    if (ref.isInt32() && (i = ref.asInt32()) != 0 && i != INT32_MIN) {
+    if (ref.isInt32() && (i = ref.toInt32()) != 0 && i != INT32_MIN) {
         i = -i;
         regs.sp[-1].setInt32(i);
     } else {
         double d;
         if (!ValueToNumber(cx, regs.sp[-1], &d))
             goto error;
         d = -d;
         regs.sp[-1].setDouble(d);
@@ -1364,21 +1364,21 @@ BEGIN_CASE(JSOP_NAMEDEC)
     JS_PROPERTY_CACHE(cx).test(cx, regs.pc, obj, obj2, entry, atom);
     if (!atom) {
         ASSERT_VALID_PROPERTY_CACHE_HIT(0, obj, obj2, entry);
         if (obj == obj2 && entry->vword.isSlot()) {
             uint32 slot = entry->vword.toSlot();
             JS_ASSERT(slot < obj->scope()->freeslot);
             Value &rref = obj->getSlotRef(slot);
             int32_t tmp;
-            if (JS_LIKELY(rref.isInt32() && CanIncDecWithoutOverflow(tmp = rref.asInt32()))) {
+            if (JS_LIKELY(rref.isInt32() && CanIncDecWithoutOverflow(tmp = rref.toInt32()))) {
                 int32_t inc = tmp + ((js_CodeSpec[op].format & JOF_INC) ? 1 : -1);
                 if (!(js_CodeSpec[op].format & JOF_POST))
                     tmp = inc;
-                rref.asInt32Ref() = inc;
+                rref.getInt32Ref() = inc;
                 PUSH_INT32(tmp);
                 len = JSOP_INCNAME_LENGTH;
                 DO_NEXT_OP(len);
             }
         }
         LOAD_ATOM(0, atom);
     }
 
@@ -1403,22 +1403,22 @@ do_incop:
     if (!obj->getProperty(cx, id, &regs.sp[-1]))
         goto error;
 
     const JSCodeSpec *cs = &js_CodeSpec[op];
     JS_ASSERT(cs->ndefs == 1);
     JS_ASSERT((cs->format & JOF_TMPSLOT_MASK) == JOF_TMPSLOT2);
     Value &ref = regs.sp[-1];
     int32_t tmp;
-    if (JS_LIKELY(ref.isInt32() && CanIncDecWithoutOverflow(tmp = ref.asInt32()))) {
+    if (JS_LIKELY(ref.isInt32() && CanIncDecWithoutOverflow(tmp = ref.toInt32()))) {
         int incr = (cs->format & JOF_INC) ? 1 : -1;
         if (cs->format & JOF_POST)
-            ref.asInt32Ref() = tmp + incr;
+            ref.getInt32Ref() = tmp + incr;
         else
-            ref.asInt32Ref() = tmp += incr;
+            ref.getInt32Ref() = tmp += incr;
         fp->flags |= JSFRAME_ASSIGNING;
         JSBool ok = obj->setProperty(cx, id, &ref);
         fp->flags &= ~JSFRAME_ASSIGNING;
         if (!ok)
             goto error;
 
         /*
          * We must set regs.sp[-1] to tmp for both post and pre increments
@@ -1490,18 +1490,18 @@ BEGIN_CASE(JSOP_LOCALINC)
     slot = GET_SLOTNO(regs.pc);
     JS_ASSERT(slot < fp->script->nslots);
     vp = fp->slots() + slot;
     METER_SLOT_OP(op, slot);
     vp = fp->slots() + slot;
 
   do_int_fast_incop:
     int32_t tmp;
-    if (JS_LIKELY(vp->isInt32() && CanIncDecWithoutOverflow(tmp = vp->asInt32()))) {
-        vp->asInt32Ref() = tmp + incr;
+    if (JS_LIKELY(vp->isInt32() && CanIncDecWithoutOverflow(tmp = vp->toInt32()))) {
+        vp->getInt32Ref() = tmp + incr;
         JS_ASSERT(JSOP_INCARG_LENGTH == js_CodeSpec[op].length);
         SKIP_POP_AFTER_SET(JSOP_INCARG_LENGTH, 0);
         PUSH_INT32(tmp + incr2);
     } else {
         PUSH_COPY(*vp);
         if (!js_DoIncDec(cx, &js_CodeSpec[op], &regs.sp[-1], vp))
             goto error;
     }
@@ -1538,29 +1538,29 @@ BEGIN_CASE(JSOP_GVARINC)
     uint32 slot = GET_SLOTNO(regs.pc);
     JS_ASSERT(slot < GlobalVarCount(fp));
     METER_SLOT_OP(op, slot);
     const Value &lref = fp->slots()[slot];
     if (lref.isNull()) {
         op = op2;
         DO_OP();
     }
-    slot = (uint32)lref.asInt32();
+    slot = (uint32)lref.toInt32();
     JS_ASSERT(fp->varobj(cx) == cx->activeCallStack()->getInitialVarObj());
     JSObject *varobj = cx->activeCallStack()->getInitialVarObj();
 
     /* XXX all this code assumes that varobj is either a callobj or global and
      * that it cannot be accessed in a MT way. This is either true now or
      * coming soon. */
 
     Value &rref = varobj->getSlotRef(slot);
     int32_t tmp;
-    if (JS_LIKELY(rref.isInt32() && CanIncDecWithoutOverflow(tmp = rref.asInt32()))) {
+    if (JS_LIKELY(rref.isInt32() && CanIncDecWithoutOverflow(tmp = rref.toInt32()))) {
         PUSH_INT32(tmp + incr2);
-        rref.asInt32Ref() = tmp + incr;
+        rref.getInt32Ref() = tmp + incr;
     } else {
         PUSH_COPY(rref);
         if (!js_DoIncDec(cx, &js_CodeSpec[op], &regs.sp[-1], &rref))
             goto error;
     }
     len = JSOP_INCGVAR_LENGTH;  /* all gvar incops are same length */
     JS_ASSERT(len == js_CodeSpec[op].length);
     DO_NEXT_OP(len);
@@ -1672,19 +1672,19 @@ BEGIN_CASE(JSOP_GETXPROP)
         JS_ASSERT(JSOP_GETPROP_LENGTH + i == js_CodeSpec[op].length);
         len = JSOP_GETPROP_LENGTH + i;
     }
 END_VARLEN_CASE
 
 BEGIN_CASE(JSOP_LENGTH)
     vp = &regs.sp[-1];
     if (vp->isString()) {
-        vp->setInt32(vp->asString()->length());
+        vp->setInt32(vp->toString()->length());
     } else if (vp->isObject()) {
-        JSObject *obj = &vp->asObject();
+        JSObject *obj = &vp->toObject();
         if (obj->isArray()) {
             jsuint length = obj->getArrayLength();
             regs.sp[-1].setNumber(length);
         } else if (obj->isArguments() && !obj->isArgsLengthOverridden()) {
             uint32 length = obj->getArgsLength();
             JS_ASSERT(length < INT32_MAX);
             regs.sp[-1].setInt32(int32_t(length));
         } else {
@@ -1720,17 +1720,17 @@ BEGIN_CASE(JSOP_CALLPROP)
             goto error;
         }
         JSObject *pobj;
         if (!js_GetClassPrototype(cx, NULL, protoKey, &pobj))
             goto error;
         objv.setObject(*pobj);
     }
 
-    JSObject *aobj = js_GetProtoIfDenseArray(&objv.asObject());
+    JSObject *aobj = js_GetProtoIfDenseArray(&objv.toObject());
     Value rval;
 
     PropertyCacheEntry *entry;
     JSObject *obj2;
     JSAtom *atom;
     JS_PROPERTY_CACHE(cx).test(cx, regs.pc, aobj, obj2, entry, atom);
     if (!atom) {
         ASSERT_VALID_PROPERTY_CACHE_HIT(0, aobj, obj2, entry);
@@ -1738,44 +1738,44 @@ BEGIN_CASE(JSOP_CALLPROP)
             rval.setObject(entry->vword.toFunObj());
         } else if (entry->vword.isSlot()) {
             uint32 slot = entry->vword.toSlot();
             JS_ASSERT(slot < obj2->scope()->freeslot);
             rval = obj2->lockedGetSlot(slot);
         } else {
             JS_ASSERT(entry->vword.isSprop());
             JSScopeProperty *sprop = entry->vword.toSprop();
-            NATIVE_GET(cx, &objv.asObject(), obj2, sprop, JSGET_NO_METHOD_BARRIER, &rval);
+            NATIVE_GET(cx, &objv.toObject(), obj2, sprop, JSGET_NO_METHOD_BARRIER, &rval);
         }
         regs.sp[-1] = rval;
         PUSH_COPY(lval);
         goto end_callprop;
     }
 
     /*
      * Cache miss: use the immediate atom that was loaded for us under
      * PropertyCache::test.
      */
     jsid id;
     id = ATOM_TO_JSID(atom);
 
     PUSH_NULL();
     if (lval.isObject()) {
-        if (!js_GetMethod(cx, &objv.asObject(), id,
+        if (!js_GetMethod(cx, &objv.toObject(), id,
                           JS_LIKELY(aobj->map->ops->getProperty == js_GetProperty)
                           ? JSGET_CACHE_RESULT | JSGET_NO_METHOD_BARRIER
                           : JSGET_NO_METHOD_BARRIER,
                           &rval)) {
             goto error;
         }
         regs.sp[-1] = objv;
         regs.sp[-2] = rval;
     } else {
-        JS_ASSERT(objv.asObject().map->ops->getProperty == js_GetProperty);
-        if (!js_GetPropertyHelper(cx, &objv.asObject(), id,
+        JS_ASSERT(objv.toObject().map->ops->getProperty == js_GetProperty);
+        if (!js_GetPropertyHelper(cx, &objv.toObject(), id,
                                   JSGET_CACHE_RESULT | JSGET_NO_METHOD_BARRIER,
                                   &rval)) {
             goto error;
         }
         regs.sp[-1] = lval;
         regs.sp[-2] = rval;
     }
 
@@ -1798,17 +1798,17 @@ BEGIN_CASE(JSOP_CALLPROP)
             goto error;
     }
 #endif
 }
 END_CASE(JSOP_CALLPROP)
 
 BEGIN_CASE(JSOP_UNBRAND)
     JS_ASSERT(regs.sp - fp->slots() >= 1);
-    if (!regs.sp[-1].asObject().unbrand(cx))
+    if (!regs.sp[-1].toObject().unbrand(cx))
         goto error;
 END_CASE(JSOP_UNBRAND)
 
 BEGIN_CASE(JSOP_SETNAME)
 BEGIN_CASE(JSOP_SETPROP)
 BEGIN_CASE(JSOP_SETMETHOD)
 {
     Value &rref = regs.sp[-1];
@@ -2012,18 +2012,18 @@ BEGIN_CASE(JSOP_SETMETHOD)
 }
 END_SET_CASE_STORE_RVAL(JSOP_SETPROP, 2);
 
 BEGIN_CASE(JSOP_GETELEM)
 {
     Value &lref = regs.sp[-2];
     Value &rref = regs.sp[-1];
     if (lref.isString() && rref.isInt32()) {
-        JSString *str = lref.asString();
-        int32_t i = rref.asInt32();
+        JSString *str = lref.toString();
+        int32_t i = rref.toInt32();
         if (size_t(i) < str->length()) {
             str = JSString::getUnitString(cx, str, size_t(i));
             if (!str)
                 goto error;
             regs.sp--;
             regs.sp[-1].setString(str);
             len = JSOP_GETELEM_LENGTH;
             DO_NEXT_OP(len);
@@ -2032,17 +2032,17 @@ BEGIN_CASE(JSOP_GETELEM)
 
     JSObject *obj;
     VALUE_TO_OBJECT(cx, &lref, obj);
 
     const Value *copyFrom;
     Value rval;
     jsid id;
     if (rref.isInt32()) {
-        int32_t i = rref.asInt32();
+        int32_t i = rref.toInt32();
         if (obj->isDenseArray()) {
             jsuint idx = jsuint(i);
 
             if (idx < obj->getArrayLength() &&
                 idx < obj->getDenseArrayCapacity()) {
                 copyFrom = obj->addressOfDenseArrayElement(idx);
                 if (!copyFrom->isMagic())
                     goto end_getelem;
@@ -2182,17 +2182,17 @@ BEGIN_CASE(JSOP_NEW)
         fun = GET_FUNCTION_PRIVATE(cx, obj);
         if (fun->isInterpreted()) {
             /* Root as we go using vp[1]. */
             if (!obj->getProperty(cx,
                                   ATOM_TO_JSID(cx->runtime->atomState.classPrototypeAtom),
                                   &vp[1])) {
                 goto error;
             }
-            JSObject *proto = vp[1].isObject() ? &vp[1].asObject() : NULL;
+            JSObject *proto = vp[1].isObject() ? &vp[1].toObject() : NULL;
             JSObject *obj2 = NewObject(cx, &js_ObjectClass, proto, obj->getParent());
             if (!obj2)
                 goto error;
 
             if (fun->u.i.script->isEmpty()) {
                 vp[0].setObject(*obj2);
                 regs.sp = vp + 1;
                 goto end_new;
@@ -2264,17 +2264,17 @@ BEGIN_CASE(JSOP_APPLY)
 
             /* Initialize stack frame. */
             newfp->callobj = NULL;
             newfp->argsobj = NULL;
             newfp->script = newscript;
             newfp->fun = fun;
             newfp->argc = argc;
             newfp->argv = vp + 2;
-            newfp->rval.setUndefined();
+            newfp->rval = UndefinedValue();
             newfp->annotation = NULL;
             newfp->scopeChain = obj->getParent();
             newfp->flags = flags;
             newfp->blockChain = NULL;
             if (JS_LIKELY(newscript->staticLevel < JS_DISPLAY_SIZE)) {
                 JSStackFrame **disp = &cx->display[newscript->staticLevel];
                 newfp->displaySave = *disp;
                 *disp = newfp;
@@ -2572,18 +2572,18 @@ BEGIN_CASE(JSOP_TABLESWITCH)
     /*
      * ECMAv2+ forbids conversion of discriminant, so we will skip to the
      * default case if the discriminant isn't already an int jsval.  (This
      * opcode is emitted only for dense jsint-domain switches.)
      */
     const Value &rref = *--regs.sp;
     int32_t i;
     if (rref.isInt32()) {
-        i = rref.asInt32();
-    } else if (rref.isDouble() && rref.asDouble() == 0) {
+        i = rref.toInt32();
+    } else if (rref.isDouble() && rref.toDouble() == 0) {
         /* Treat -0 (double) as 0. */
         i = 0;
     } else {
         DO_NEXT_OP(len);
     }
 
     pc2 += JUMP_OFFSET_LEN;
     jsint low = GET_JUMP_OFFSET(pc2);
@@ -2610,18 +2610,18 @@ BEGIN_CASE(JSOP_TABLESWITCHX)
     /*
      * ECMAv2+ forbids conversion of discriminant, so we will skip to the
      * default case if the discriminant isn't already an int jsval.  (This
      * opcode is emitted only for dense jsint-domain switches.)
      */
     const Value &rref = *--regs.sp;
     int32_t i;
     if (rref.isInt32()) {
-        i = rref.asInt32();
-    } else if (rref.isDouble() && rref.asDouble() == 0) {
+        i = rref.toInt32();
+    } else if (rref.isDouble() && rref.toDouble() == 0) {
         /* Treat -0 (double) as 0. */
         i = 0;
     } else {
         DO_NEXT_OP(len);
     }
 
     pc2 += JUMPX_OFFSET_LEN;
     jsint low = GET_JUMP_OFFSET(pc2);
@@ -2681,27 +2681,27 @@ BEGIN_CASE(JSOP_LOOKUPSWITCH)
         pc2 += off;                                                           \
         if (--npairs == 0) {                                                  \
             pc2 = regs.pc;                                                    \
             break;                                                            \
         }                                                                     \
     }
 
     if (lval.isString()) {
-        JSString *str = lval.asString();
+        JSString *str = lval.toString();
         JSString *str2;
         SEARCH_PAIRS(
             match = (rval.isString() &&
-                     ((str2 = rval.asString()) == str ||
+                     ((str2 = rval.toString()) == str ||
                       js_EqualStrings(str2, str)));
         )
     } else if (lval.isNumber()) {
-        double ldbl = lval.asNumber();
+        double ldbl = lval.toNumber();
         SEARCH_PAIRS(
-            match = rval.isNumber() && ldbl == rval.asNumber();
+            match = rval.isNumber() && ldbl == rval.toNumber();
         )
     } else {
         SEARCH_PAIRS(
             match = (lval == rval);
         )
     }
 #undef SEARCH_PAIRS
 
@@ -2729,17 +2729,17 @@ BEGIN_CASE(JSOP_TRAP)
         cx->exception = rval;
         goto error;
       default:
         break;
     }
     JS_ASSERT(status == JSTRAP_CONTINUE);
     CHECK_INTERRUPT_HANDLER();
     JS_ASSERT(rval.isInt32());
-    op = (JSOp) rval.asInt32();
+    op = (JSOp) rval.toInt32();
     JS_ASSERT((uintN)op < (uintN)JSOP_LIMIT);
     DO_OP();
 }
 
 BEGIN_CASE(JSOP_ARGUMENTS)
 {
     Value rval;
     if (!js_GetArgsValue(cx, fp, &rval))
@@ -2874,22 +2874,22 @@ BEGIN_CASE(JSOP_CALLUPVAR_DBG)
         PUSH_NULL();
 }
 END_CASE(JSOP_GETUPVAR_DBG)
 
 BEGIN_CASE(JSOP_GETDSLOT)
 BEGIN_CASE(JSOP_CALLDSLOT)
 {
     JS_ASSERT(fp->argv);
-    JSObject *obj = &fp->argv[-2].asObject();
+    JSObject *obj = &fp->argv[-2].toObject();
     JS_ASSERT(obj);
     JS_ASSERT(obj->dslots);
 
     uintN index = GET_UINT16(regs.pc);
-    JS_ASSERT(JS_INITIAL_NSLOTS + index < obj->dslots[-1].asPrivateUint32());
+    JS_ASSERT(JS_INITIAL_NSLOTS + index < obj->dslots[-1].toPrivateUint32());
     JS_ASSERT_IF(obj->scope()->object == obj,
                  JS_INITIAL_NSLOTS + index < obj->scope()->freeslot);
 
     PUSH_COPY(obj->dslots[index]);
     if (op == JSOP_CALLDSLOT)
         PUSH_NULL();
 }
 END_CASE(JSOP_GETDSLOT)
@@ -2907,17 +2907,17 @@ BEGIN_CASE(JSOP_CALLGVAR)
     }
     JS_ASSERT(fp->varobj(cx) == cx->activeCallStack()->getInitialVarObj());
     JSObject *varobj = cx->activeCallStack()->getInitialVarObj();
 
     /* XXX all this code assumes that varobj is either a callobj or global and
      * that it cannot be accessed in a MT way. This is either true now or
      * coming soon. */
 
-    slot = (uint32)lval.asInt32();
+    slot = (uint32)lval.toInt32();
     const Value &rref = varobj->lockedGetSlot(slot);
     PUSH_COPY(rref);
     if (op == JSOP_CALLGVAR)
         PUSH_NULL();
 }
 END_CASE(JSOP_GETGVAR)
 
 BEGIN_CASE(JSOP_SETGVAR)
@@ -2941,17 +2941,17 @@ BEGIN_CASE(JSOP_SETGVAR)
 #endif
         JSAtom *atom;
         LOAD_ATOM(0, atom);
         jsid id = ATOM_TO_JSID(atom);
         Value rval = rref;
         if (!obj->setProperty(cx, id, &rval))
             goto error;
     } else {
-        uint32 slot = (uint32)lref.asInt32();
+        uint32 slot = (uint32)lref.toInt32();
         JS_LOCK_OBJ(cx, obj);
         JSScope *scope = obj->scope();
         if (!scope->methodWriteBarrier(cx, slot, rref)) {
             JS_UNLOCK_SCOPE(cx, scope);
             goto error;
         }
         obj->lockedSetSlot(slot, rref);
         JS_UNLOCK_SCOPE(cx, scope);
@@ -2991,17 +2991,17 @@ BEGIN_CASE(JSOP_DEFVAR)
             goto error;
     } else {
         if (!CheckRedeclaration(cx, obj, id, attrs, &obj2, &prop))
             goto error;
     }
 
     /* Bind a variable only if it's not yet defined. */
     if (!prop) {
-        if (!js_DefineNativeProperty(cx, obj, id, Value(UndefinedTag()), PropertyStub, PropertyStub,
+        if (!js_DefineNativeProperty(cx, obj, id, UndefinedValue(), PropertyStub, PropertyStub,
                                      attrs, 0, 0, &prop)) {
             goto error;
         }
         JS_ASSERT(prop);
         obj2 = obj;
     }
 
     /*
@@ -3093,17 +3093,17 @@ BEGIN_CASE(JSOP_DEFFUN)
     /*
      * Protect obj from any GC hiding below JSObject::setProperty or
      * JSObject::defineProperty.  All paths from here must flow through the
      * fp->scopeChain code below the parent->defineProperty call.
      */
     MUST_FLOW_THROUGH("restore_scope");
     fp->scopeChain = obj;
 
-    Value rval = ObjectTag(*obj);
+    Value rval = ObjectValue(*obj);
 
     /*
      * ECMA requires functions defined when entering Eval code to be
      * impermanent.
      */
     uintN attrs = (fp->flags & JSFRAME_EVAL)
                   ? JSPROP_ENUMERATE
                   : JSPROP_ENUMERATE | JSPROP_PERMANENT;
@@ -3193,17 +3193,17 @@ BEGIN_CASE(JSOP_DEFFUN_DBGFC)
     LOAD_FUNCTION(0);
 
     JSObject *obj = (op == JSOP_DEFFUN_FC)
                     ? js_NewFlatClosure(cx, fun)
                     : js_NewDebuggableFlatClosure(cx, fun);
     if (!obj)
         goto error;
 
-    Value rval = ObjectTag(*obj);
+    Value rval = ObjectValue(*obj);
 
     uintN attrs = (fp->flags & JSFRAME_EVAL)
                   ? JSPROP_ENUMERATE
                   : JSPROP_ENUMERATE | JSPROP_PERMANENT;
 
     uintN flags = JSFUN_GSFLAG2ATTR(fun->flags);
     if (flags) {
         attrs |= flags | JSPROP_SHARED;
@@ -3333,24 +3333,24 @@ BEGIN_CASE(JSOP_LAMBDA)
                 if (op == JSOP_SETMETHOD) {
 #ifdef DEBUG
                     JSOp op2 = JSOp(regs.pc[JSOP_LAMBDA_LENGTH + JSOP_SETMETHOD_LENGTH]);
                     JS_ASSERT(op2 == JSOP_POP || op2 == JSOP_POPV);
 #endif
 
                     const Value &lref = regs.sp[-1];
                     if (lref.isObject() &&
-                        lref.asObject().getClass() == &js_ObjectClass) {
+                        lref.toObject().getClass() == &js_ObjectClass) {
                         break;
                     }
                 } else if (op == JSOP_INITMETHOD) {
 #ifdef DEBUG
                     const Value &lref = regs.sp[-1];
                     JS_ASSERT(lref.isObject());
-                    JSObject *obj2 = &lref.asObject();
+                    JSObject *obj2 = &lref.toObject();
                     JS_ASSERT(obj2->getClass() == &js_ObjectClass);
                     JS_ASSERT(obj2->scope()->object == obj2);
 #endif
                     break;
                 }
             }
         } else {
             parent = js_GetScopeChain(cx, fp);
@@ -3451,17 +3451,17 @@ BEGIN_CASE(JSOP_SETTER)
         JS_ASSERT(regs.sp - fp->base() >= 3);
         rval = regs.sp[-1];
         id = JSID_VOID;
         i = -2;
       gs_get_lval:
       {
         const Value &lref = regs.sp[i-1];
         JS_ASSERT(lref.isObject());
-        obj = &lref.asObject();
+        obj = &lref.toObject();
         break;
       }
     }
 
     /* Ensure that id has a type suitable for use with obj. */
     if (JSID_IS_VOID(id))
         FETCH_ELEMENT_ID(obj, i, id);
 
@@ -3480,31 +3480,31 @@ BEGIN_CASE(JSOP_SETTER)
      */
     Value rtmp;
     uintN attrs;
     if (!CheckAccess(cx, obj, id, JSACC_WATCH, &rtmp, &attrs))
         goto error;
 
     PropertyOp getter, setter;
     if (op == JSOP_GETTER) {
-        getter = CastAsPropertyOp(&rval.asObject());
+        getter = CastAsPropertyOp(&rval.toObject());
         setter = PropertyStub;
         attrs = JSPROP_GETTER;
     } else {
         getter = PropertyStub;
-        setter = CastAsPropertyOp(&rval.asObject());
+        setter = CastAsPropertyOp(&rval.toObject());
         attrs = JSPROP_SETTER;
     }
     attrs |= JSPROP_ENUMERATE | JSPROP_SHARED;
 
     /* Check for a readonly or permanent property of the same name. */
     if (!CheckRedeclaration(cx, obj, id, attrs, NULL, NULL))
         goto error;
 
-    if (!obj->defineProperty(cx, id, Value(UndefinedTag()), getter, setter, attrs))
+    if (!obj->defineProperty(cx, id, UndefinedValue(), getter, setter, attrs))
         goto error;
 
     regs.sp += i;
     if (js_CodeSpec[op2].ndefs > js_CodeSpec[op2].nuses) {
         JS_ASSERT(js_CodeSpec[op2].ndefs == js_CodeSpec[op2].nuses + 1);
         regs.sp[-1] = rval;
     }
     len = js_CodeSpec[op2].length;
@@ -3565,29 +3565,29 @@ BEGIN_CASE(JSOP_NEWINIT)
 END_CASE(JSOP_NEWINIT)
 
 BEGIN_CASE(JSOP_ENDINIT)
 {
     /* Re-set the newborn root to the top of this object tree. */
     JS_ASSERT(regs.sp - fp->base() >= 1);
     const Value &lref = regs.sp[-1];
     JS_ASSERT(lref.isObject());
-    cx->weakRoots.finalizableNewborns[FINALIZE_OBJECT] = &lref.asObject();
+    cx->weakRoots.finalizableNewborns[FINALIZE_OBJECT] = &lref.toObject();
 }
 END_CASE(JSOP_ENDINIT)
 
 BEGIN_CASE(JSOP_INITPROP)
 BEGIN_CASE(JSOP_INITMETHOD)
 {
     /* Load the property's initial value into rval. */
     JS_ASSERT(regs.sp - fp->base() >= 2);
     Value rval = regs.sp[-1];
 
     /* Load the object being initialized into lval/obj. */
-    JSObject *obj = &regs.sp[-2].asObject();
+    JSObject *obj = &regs.sp[-2].toObject();
     JS_ASSERT(obj->isNative());
 
     JSScope *scope = obj->scope();
 
     /*
      * Probe the property cache. 
      *
      * We can not assume that the object created by JSOP_NEWINIT is still
@@ -3672,17 +3672,17 @@ BEGIN_CASE(JSOP_INITELEM)
 {
     /* Pop the element's value into rval. */
     JS_ASSERT(regs.sp - fp->base() >= 3);
     const Value &rref = regs.sp[-1];
 
     /* Find the object being initialized at top of stack. */
     const Value &lref = regs.sp[-3];
     JS_ASSERT(lref.isObject());
-    JSObject *obj = &lref.asObject();
+    JSObject *obj = &lref.toObject();
 
     /* Fetch id now that we have obj. */
     jsid id;
     FETCH_ELEMENT_ID(obj, -2, id);
 
     /*
      * Check for property redeclaration strict warning (we may be in an object
      * initialiser, not an array initialiser).
@@ -3715,17 +3715,17 @@ END_CASE(JSOP_INITELEM)
 
 BEGIN_CASE(JSOP_DEFSHARP)
 {
     uint32 slot = GET_UINT16(regs.pc);
     JS_ASSERT(slot + 1 < fp->script->nfixed);
     const Value &lref = fp->slots()[slot];
     JSObject *obj;
     if (lref.isObject()) {
-        obj = &lref.asObject();
+        obj = &lref.toObject();
     } else {
         JS_ASSERT(lref.isUndefined());
         obj = js_NewArrayObject(cx, 0, NULL);
         if (!obj)
             goto error;
         fp->slots()[slot].setObject(*obj);
     }
     jsint i = (jsint) GET_UINT16(regs.pc + UINT16_LEN);
@@ -3748,17 +3748,17 @@ BEGIN_CASE(JSOP_USESHARP)
     uint32 slot = GET_UINT16(regs.pc);
     JS_ASSERT(slot + 1 < fp->script->nfixed);
     const Value &lref = fp->slots()[slot];
     jsint i = (jsint) GET_UINT16(regs.pc + UINT16_LEN);
     Value rval;
     if (lref.isUndefined()) {
         rval.setUndefined();
     } else {
-        JSObject *obj = &fp->slots()[slot].asObject();
+        JSObject *obj = &fp->slots()[slot].toObject();
         jsid id = INT_TO_JSID(i);
         if (!obj->getProperty(cx, id, &rval))
             goto error;
     }
     if (!rval.isObjectOrNull()) {
         char numBuf[12];
 
         JS_snprintf(numBuf, sizeof numBuf, "%u", (unsigned) i);
@@ -3779,21 +3779,21 @@ BEGIN_CASE(JSOP_SHARPINIT)
 
     /*
      * We peek ahead safely here because empty initialisers get zero
      * JSOP_SHARPINIT ops, and non-empty ones get two: the first comes
      * immediately after JSOP_NEWINIT followed by one or more property
      * initialisers; and the second comes directly before JSOP_ENDINIT.
      */
     if (regs.pc[JSOP_SHARPINIT_LENGTH] != JSOP_ENDINIT) {
-        rval.setInt32(rval.isUndefined() ? 1 : rval.asInt32() + 1);
+        rval.setInt32(rval.isUndefined() ? 1 : rval.toInt32() + 1);
     } else {
         JS_ASSERT(rval.isInt32());
-        rval.asInt32Ref() -= 1;
-        if (rval.asInt32() == 0)
+        rval.getInt32Ref() -= 1;
+        if (rval.toInt32() == 0)
             vp[0].setUndefined();
     }
     vp[1] = rval;
 }
 END_CASE(JSOP_SHARPINIT)
 
 #endif /* JS_HAS_SHARP_VARS */
 
@@ -3817,29 +3817,29 @@ END_VARLEN_CASE
 
 {
 BEGIN_CASE(JSOP_RETSUB)
     /* Pop [exception or hole, retsub pc-index]. */
     Value rval, lval;
     POP_COPY_TO(rval);
     POP_COPY_TO(lval);
     JS_ASSERT(lval.isBoolean());
-    if (lval.asBoolean()) {
+    if (lval.toBoolean()) {
         /*
          * Exception was pending during finally, throw it *before* we adjust
          * pc, because pc indexes into script->trynotes.  This turns out not to
          * be necessary, but it seems clearer.  And it points out a FIXME:
          * 350509, due to Igor Bukanov.
          */
         cx->throwing = JS_TRUE;
         cx->exception = rval;
         goto error;
     }
     JS_ASSERT(rval.isInt32());
-    len = rval.asInt32();
+    len = rval.toInt32();
     regs.pc = script->main;
 END_VARLEN_CASE
 }
 
 BEGIN_CASE(JSOP_EXCEPTION)
     JS_ASSERT(cx->throwing);
     PUSH_COPY(cx->exception);
     cx->throwing = JS_FALSE;
@@ -3906,17 +3906,17 @@ BEGIN_CASE(JSOP_OBJTOP)
     }
 END_CASE(JSOP_OBJTOP)
 
 BEGIN_CASE(JSOP_INSTANCEOF)
 {
     const Value &rref = regs.sp[-1];
     JSObject *obj;
     if (rref.isPrimitive() ||
-        !(obj = &rref.asObject())->map->ops->hasInstance) {
+        !(obj = &rref.toObject())->map->ops->hasInstance) {
         js_ReportValueError(cx, JSMSG_BAD_INSTANCEOF_RHS,
                             -1, rref, NULL);
         goto error;
     }
     const Value &lref = regs.sp[-2];
     JSBool cond = JS_FALSE;
     if (!obj->map->ops->hasInstance(cx, obj, &lref, &cond))
         goto error;
@@ -3978,17 +3978,17 @@ BEGIN_CASE(JSOP_QNAMEPART)
     PUSH_STRING(ATOM_TO_STRING(atom));
 }
 END_CASE(JSOP_QNAMEPART)
 
 BEGIN_CASE(JSOP_QNAMECONST)
 {
     JSAtom *atom;
     LOAD_ATOM(0, atom);
-    Value rval = StringTag(ATOM_TO_STRING(atom));
+    Value rval = StringValue(ATOM_TO_STRING(atom));
     Value lval = regs.sp[-1];
     JSObject *obj = js_ConstructXMLQNameObject(cx, lval, rval);
     if (!obj)
         goto error;
     regs.sp[-1].setObject(*obj);
 }
 END_CASE(JSOP_QNAMECONST)
 
@@ -4014,30 +4014,30 @@ BEGIN_CASE(JSOP_TOATTRNAME)
 }
 END_CASE(JSOP_TOATTRNAME)
 
 BEGIN_CASE(JSOP_TOATTRVAL)
 {
     Value rval;
     rval = regs.sp[-1];
     JS_ASSERT(rval.isString());
-    JSString *str = js_EscapeAttributeValue(cx, rval.asString(), JS_FALSE);
+    JSString *str = js_EscapeAttributeValue(cx, rval.toString(), JS_FALSE);
     if (!str)
         goto error;
     regs.sp[-1].setString(str);
 }
 END_CASE(JSOP_TOATTRVAL)
 
 BEGIN_CASE(JSOP_ADDATTRNAME)
 BEGIN_CASE(JSOP_ADDATTRVAL)
 {
     Value rval = regs.sp[-1];
     Value lval = regs.sp[-2];
-    JSString *str = lval.asString();
-    JSString *str2 = rval.asString();
+    JSString *str = lval.toString();
+    JSString *str2 = rval.toString();
     str = js_AddAttributePart(cx, op == JSOP_ADDATTRNAME, str, str2);
     if (!str)
         goto error;
     regs.sp--;
     regs.sp[-1].setString(str);
 }
 END_CASE(JSOP_ADDATTRNAME)
 
@@ -4051,17 +4051,17 @@ BEGIN_CASE(JSOP_BINDXMLNAME)
         goto error;
     regs.sp[-1].setObjectOrNull(obj);
     PUSH_COPY(IdToValue(id));
 }
 END_CASE(JSOP_BINDXMLNAME)
 
 BEGIN_CASE(JSOP_SETXMLNAME)
 {
-    JSObject *obj = &regs.sp[-3].asObject();
+    JSObject *obj = &regs.sp[-3].toObject();
     Value rval = regs.sp[-1];
     jsid id;
     FETCH_ELEMENT_ID(obj, -2, id);
     if (!obj->setProperty(cx, id, &rval))
         goto error;
     rval = regs.sp[-1];
     regs.sp -= 2;
     regs.sp[-1] = rval;
@@ -4217,17 +4217,17 @@ BEGIN_CASE(JSOP_XMLCOMMENT)
 END_CASE(JSOP_XMLCOMMENT)
 
 BEGIN_CASE(JSOP_XMLPI)
 {
     JSAtom *atom;
     LOAD_ATOM(0, atom);
     JSString *str = ATOM_TO_STRING(atom);
     Value rval = regs.sp[-1];
-    JSString *str2 = rval.asString();
+    JSString *str2 = rval.toString();
     JSObject *obj = js_NewXMLSpecialObject(cx, JSXML_CLASS_PROCESSING_INSTRUCTION, str, str2);
     if (!obj)
         goto error;
     regs.sp[-1].setObject(*obj);
 }
 END_CASE(JSOP_XMLPI)
 
 BEGIN_CASE(JSOP_GETFUNNS)
@@ -4347,17 +4347,17 @@ BEGIN_CASE(JSOP_YIELD)
     interpReturnOK = JS_TRUE;
     goto exit;
 
 BEGIN_CASE(JSOP_ARRAYPUSH)
 {
     uint32 slot = GET_UINT16(regs.pc);
     JS_ASSERT(script->nfixed <= slot);
     JS_ASSERT(slot < script->nslots);
-    JSObject *obj = &fp->slots()[slot].asObject();
+    JSObject *obj = &fp->slots()[slot].toObject();
     if (!js_ArrayCompPush(cx, obj, regs.sp[-1]))
         goto error;
     regs.sp--;
 }
 END_CASE(JSOP_ARRAYPUSH)
 #endif /* JS_HAS_GENERATORS */
 
   L_JSOP_UNUSED180:
--- a/js/src/jsparse.cpp
+++ b/js/src/jsparse.cpp
@@ -3187,17 +3187,17 @@ BindLet(JSContext *cx, BindData *data, J
      * object (once the prototype's final population is known, after all 'let'
      * bindings for this block have been parsed). We will free these reserved
      * slots in jsemit.cpp:EmitEnterBlock.
      */
     uintN slot = JSSLOT_FREE(&js_BlockClass) + n;
     if (slot >= blockObj->numSlots() && !blockObj->growSlots(cx, slot + 1))
         return false;
     blockObj->scope()->freeslot = slot + 1;
-    blockObj->setSlot(slot, PrivateTag(pn));
+    blockObj->setSlot(slot, PrivateValue(pn));
     return true;
 }
 
 static void
 PopStatement(JSTreeContext *tc)
 {
     JSStmtInfo *stmt = tc->topStmt;
 
@@ -3903,17 +3903,17 @@ CheckDestructuring(JSContext *cx, BindDa
      * not the fastest runtime performance with empty [] or {}.
      */
     if (data &&
         data->binder == BindLet &&
         OBJ_BLOCK_COUNT(cx, tc->blockChain) == 0) {
         ok = !!js_DefineNativeProperty(cx, tc->blockChain,
                                        ATOM_TO_JSID(cx->runtime->
                                                     atomState.emptyAtom),
-                                       Value(UndefinedTag()), NULL, NULL,
+                                       UndefinedValue(), NULL, NULL,
                                        JSPROP_ENUMERATE |
                                        JSPROP_PERMANENT |
                                        JSPROP_SHARED,
                                        JSScopeProperty::HAS_SHORTID, 0, NULL);
         if (!ok)
             goto out;
     }
 
@@ -7886,17 +7886,17 @@ Parser::primaryExpr(TokenKind tt, JSBool
                 if (!pn3)
                     return NULL;
                 pn3->pn_dval = tokenStream.currentToken().t_dval;
                 if (tc->needStrictChecks()) {
                     /*
                      * Use string-valued atoms for detecting duplicate
                      * properties so that 1 and "1" properly collide.
                      */
-                    if (!js_ValueToAtom(context, DoubleTag(pn3->pn_dval), &atom))
+                    if (!js_ValueToAtom(context, DoubleValue(pn3->pn_dval), &atom))
                         return NULL;
                 } else {
                     atom = NULL; /* for the compiler */
                 }
                 break;
               case TOK_NAME:
                 {
                     atom = tokenStream.currentToken().t_atom;
@@ -7918,17 +7918,17 @@ Parser::primaryExpr(TokenKind tt, JSBool
                         if (!pn3)
                             return NULL;
                         pn3->pn_dval = tokenStream.currentToken().t_dval;
                         if (tc->needStrictChecks()) {
                             /*
                              * Use string-valued atoms for detecting duplicate
                              * properties so that 1 and "1" properly collide.
                              */
-                            if (!js_ValueToAtom(context, DoubleTag(pn3->pn_dval), &atom))
+                            if (!js_ValueToAtom(context, DoubleValue(pn3->pn_dval), &atom))
                                 return NULL;
                         } else {
                             atom = NULL; /* for the compiler */
                         }
                     } else {
                         tokenStream.ungetToken();
                         goto property_name;
                     }
@@ -8378,17 +8378,17 @@ Parser::parenExpr(JSParseNode *pn1, JSBo
 static JSBool
 FoldType(JSContext *cx, JSParseNode *pn, TokenKind type)
 {
     if (PN_TYPE(pn) != type) {
         switch (type) {
           case TOK_NUMBER:
             if (pn->pn_type == TOK_STRING) {
                 jsdouble d;
-                if (!ValueToNumber(cx, StringTag(ATOM_TO_STRING(pn->pn_atom)), &d))
+                if (!ValueToNumber(cx, StringValue(ATOM_TO_STRING(pn->pn_atom)), &d))
                     return JS_FALSE;
                 pn->pn_dval = d;
                 pn->pn_type = TOK_NUMBER;
                 pn->pn_op = JSOP_DOUBLE;
             }
             break;
 
           case TOK_STRING:
@@ -9139,22 +9139,22 @@ js_FoldConstants(JSContext *cx, JSParseN
                 return JS_FALSE;
         }
         break;
 
       case TOK_AT:
         if (pn1->pn_type == TOK_XMLNAME) {
             JSObjectBox *xmlbox;
 
-            Value v = StringTag(ATOM_TO_STRING(pn1->pn_atom));
+            Value v = StringValue(ATOM_TO_STRING(pn1->pn_atom));
             if (!js_ToAttributeName(cx, &v))
                 return JS_FALSE;
             JS_ASSERT(v.isObject());
 
-            xmlbox = tc->parser->newObjectBox(&v.asObject());
+            xmlbox = tc->parser->newObjectBox(&v.toObject());
             if (!xmlbox)
                 return JS_FALSE;
 
             pn->pn_type = TOK_XMLNAME;
             pn->pn_op = JSOP_OBJECT;
             pn->pn_arity = PN_NULLARY;
             pn->pn_objbox = xmlbox;
             RecycleTree(pn1, tc);
--- a/js/src/jspropertycache.cpp
+++ b/js/src/jspropertycache.cpp
@@ -141,17 +141,17 @@ PropertyCache::fill(JSContext *cx, JSObj
         if (cs->format & JOF_CALLOP) {
             if (sprop->isMethod()) {
                 /*
                  * A compiler-created function object, AKA a method, already
                  * memoized in the property tree.
                  */
                 JS_ASSERT(scope->hasMethodBarrier());
                 JSObject &funobj = sprop->methodObject();
-                JS_ASSERT(&funobj == &pobj->lockedGetSlot(sprop->slot).asObject());
+                JS_ASSERT(&funobj == &pobj->lockedGetSlot(sprop->slot).toObject());
                 vword.setFunObj(funobj);
                 break;
             }
 
             if (!scope->generic() &&
                 sprop->hasDefaultGetter() &&
                 SPROP_HAS_VALID_SLOT(sprop, scope)) {
                 const Value &v = pobj->lockedGetSlot(sprop->slot);
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -58,17 +58,17 @@ static inline const Value &
 GetCall(JSObject *proxy) {
     JS_ASSERT(proxy->isFunctionProxy());
     return proxy->getSlot(JSSLOT_PROXY_CALL);
 }
 
 static inline Value
 GetConstruct(JSObject *proxy) {
     if (proxy->numSlots() <= JSSLOT_PROXY_CONSTRUCT)
-        return UndefinedTag();
+        return UndefinedValue();
     return proxy->getSlot(JSSLOT_PROXY_CONSTRUCT);
 }
 
 static bool
 OperationInProgress(JSContext *cx, JSObject *proxy)
 {
     JSPendingProxyOperation *op = JS_THREAD_DATA(cx)->pendingProxyOperation;
     while (op) {
@@ -229,24 +229,24 @@ JSProxyHandler::obj_toString(JSContext *
 }
 
 JSString *
 JSProxyHandler::fun_toString(JSContext *cx, JSObject *proxy, uintN indent)
 {
     JS_ASSERT(proxy->isProxy());
     Value fval = GetCall(proxy);
     if (proxy->isFunctionProxy() &&
-        (fval.isPrimitive() || !fval.asObject().isFunction())) {
+        (fval.isPrimitive() || !fval.toObject().isFunction())) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_INCOMPATIBLE_PROTO,
                              js_Function_str, js_toString_str,
                              "object");
         return NULL;
     }
-    return fun_toStringHelper(cx, &fval.asObject(), indent);
+    return fun_toStringHelper(cx, &fval.toObject(), indent);
 }
 
 bool
 JSProxyHandler::call(JSContext *cx, JSObject *proxy, uintN argc, Value *vp)
 {
     JS_ASSERT(OperationInProgress(cx, proxy));
     AutoValueRooter rval(cx);
     JSBool ok = InternalInvoke(cx, vp[1], GetCall(proxy), 0, argc, JS_ARGV(cx, vp),
@@ -259,29 +259,29 @@ JSProxyHandler::call(JSContext *cx, JSOb
 bool
 JSProxyHandler::construct(JSContext *cx, JSObject *proxy,
                           uintN argc, Value *argv, Value *rval)
 {
     JS_ASSERT(OperationInProgress(cx, proxy));
     Value fval = GetConstruct(proxy);
     if (fval.isUndefined()) {
         fval = GetCall(proxy);
-        JSObject *obj = JS_New(cx, &fval.asObject(), argc, Jsvalify(argv));
+        JSObject *obj = JS_New(cx, &fval.toObject(), argc, Jsvalify(argv));
         if (!obj)
             return false;
         rval->setObject(*obj);
         return true;
     }
 
     /*
      * FIXME: The Proxy proposal says to pass undefined as the this argument,
      * but primitive this is not supported yet. See bug 576644.
      */
     JS_ASSERT(fval.isObject());
-    JSObject *thisobj = fval.asObject().getGlobal();
+    JSObject *thisobj = fval.toObject().getGlobal();
     return InternalCall(cx, thisobj, fval, argc, argv, rval);
 }
 
 void
 JSProxyHandler::finalize(JSContext *cx, JSObject *proxy)
 {
 }
 
@@ -374,18 +374,18 @@ ParsePropertyDescriptorObject(JSContext 
 static bool
 MakePropertyDescriptorObject(JSContext *cx, jsid id, PropertyDescriptor *desc, Value *vp)
 {
     if (!desc->obj) {
         vp->setUndefined();
         return true;
     }
     uintN attrs = desc->attrs;
-    Value getter = (attrs & JSPROP_GETTER) ? CastAsObjectJsval(desc->getter) : Value(UndefinedTag());
-    Value setter = (attrs & JSPROP_SETTER) ? CastAsObjectJsval(desc->setter) : Value(UndefinedTag());
+    Value getter = (attrs & JSPROP_GETTER) ? CastAsObjectJsval(desc->getter) : UndefinedValue();
+    Value setter = (attrs & JSPROP_SETTER) ? CastAsObjectJsval(desc->setter) : UndefinedValue();
     return js_NewPropertyDescriptorObject(cx, id, attrs, getter, setter, desc->value, vp);
 }
 
 static bool
 ValueToBool(JSContext *cx, const Value &v, bool *bp)
 {
     *bp = !!js_ValueToBoolean(v);
     return true;
@@ -394,17 +394,17 @@ ValueToBool(JSContext *cx, const Value &
 bool
 ArrayToIdVector(JSContext *cx, const Value &array, AutoIdVector &props)
 {
     JS_ASSERT(props.length() == 0);
 
     if (array.isPrimitive())
         return true;
 
-    JSObject *obj = &array.asObject();
+    JSObject *obj = &array.toObject();
     jsuint length;
     if (!js_GetLengthProperty(cx, obj, &length)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_ARRAY_LENGTH);
         return false;
     }
 
     AutoIdRooter idr(cx);
     AutoValueRooter tvr(cx);
@@ -461,28 +461,28 @@ JSScriptedProxyHandler::~JSScriptedProxy
 {
 }
 
 static bool
 ReturnedValueMustNotBePrimitive(JSContext *cx, JSObject *proxy, JSAtom *atom, const Value &v)
 {
     if (v.isPrimitive()) {
         js_ReportValueError2(cx, JSMSG_BAD_TRAP_RETURN_VALUE,
-                             JSDVG_SEARCH_STACK, ObjectOrNullTag(proxy), NULL,
+                             JSDVG_SEARCH_STACK, ObjectOrNullValue(proxy), NULL,
                              js_AtomToPrintableString(cx, atom));
         return false;
     }
     return true;
 }
 
 static JSObject *
 GetProxyHandlerObject(JSContext *cx, JSObject *proxy)
 {
     JS_ASSERT(OperationInProgress(cx, proxy));
-    return proxy->getProxyPrivate().asObjectOrNull();
+    return proxy->getProxyPrivate().toObjectOrNull();
 }
 
 bool
 JSScriptedProxyHandler::getPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id,
                                               PropertyDescriptor *desc)
 {
     JSObject *handler = GetProxyHandlerObject(cx, proxy);
     AutoValueRooter tvr(cx);
@@ -582,35 +582,35 @@ JSScriptedProxyHandler::hasOwn(JSContext
 
 bool
 JSScriptedProxyHandler::get(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, Value *vp)
 {
     JSObject *handler = GetProxyHandlerObject(cx, proxy);
     JSString *str = js_ValueToString(cx, IdToValue(id));
     if (!str)
         return false;
-    AutoValueRooter tvr(cx, StringTag(str));
-    Value argv[] = { ObjectOrNullTag(receiver), tvr.value() };
+    AutoValueRooter tvr(cx, StringValue(str));
+    Value argv[] = { ObjectOrNullValue(receiver), tvr.value() };
     AutoValueRooter fval(cx);
     if (!DerivedTrap(cx, handler, ATOM(get), fval.addr()))
         return false;
     if (!js_IsCallable(fval.value()))
         return JSProxyHandler::get(cx, proxy, receiver, id, vp);
     return Trap(cx, handler, fval.value(), 2, argv, vp);
 }
 
 bool
 JSScriptedProxyHandler::set(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, Value *vp)
 {
     JSObject *handler = GetProxyHandlerObject(cx, proxy);
     JSString *str = js_ValueToString(cx, IdToValue(id));
     if (!str)
         return false;
-    AutoValueRooter tvr(cx, StringTag(str));
-    Value argv[] = { ObjectOrNullTag(receiver), tvr.value(), *vp };
+    AutoValueRooter tvr(cx, StringValue(str));
+    Value argv[] = { ObjectOrNullValue(receiver), tvr.value(), *vp };
     AutoValueRooter fval(cx);
     if (!DerivedTrap(cx, handler, ATOM(set), fval.addr()))
         return false;
     if (!js_IsCallable(fval.value()))
         return JSProxyHandler::set(cx, proxy, receiver, id, vp);
     return Trap(cx, handler, fval.value(), 3, argv, tvr.addr());
 }
 
@@ -956,25 +956,25 @@ JS_FRIEND_API(Class) ObjectProxyClass = 
     EnumerateStub,          ResolveStub,     ConvertStub,     NULL,
     obj_proxy_getObjectOps, NULL,            NULL,            NULL,
     NULL,                   NULL,            NULL,            NULL
 };
 
 JSBool
 proxy_Call(JSContext *cx, uintN argc, Value *vp)
 {
-    JSObject *proxy = &JS_CALLEE(cx, vp).asObject();
+    JSObject *proxy = &JS_CALLEE(cx, vp).toObject();
     JS_ASSERT(proxy->isProxy());
     return JSProxy::call(cx, proxy, argc, vp);
 }
 
 JSBool
 proxy_Construct(JSContext *cx, JSObject * /*obj*/, uintN argc, Value *argv, Value *rval)
 {
-    JSObject *proxy = &argv[-2].asObject();
+    JSObject *proxy = &argv[-2].toObject();
     JS_ASSERT(proxy->isProxy());
     return JSProxy::construct(cx, proxy, argc, argv, rval);
 }
 
 static JSType
 proxy_TypeOf_fun(JSContext *cx, JSObject *obj)
 {
     return JSTYPE_FUNCTION;
@@ -1025,58 +1025,58 @@ JS_FRIEND_API(JSObject *)
 NewProxyObject(JSContext *cx, JSProxyHandler *handler, const Value &priv, JSObject *proto, JSObject *parent,
                JSObject *call, JSObject *construct)
 {
     bool fun = call || construct;
     Class *clasp = fun ? &FunctionProxyClass : &ObjectProxyClass;
     JSObject *obj = NewObjectWithGivenProto(cx, clasp, proto, parent);
     if (!obj || (construct && !js_EnsureReservedSlots(cx, obj, 0)))
         return NULL;
-    obj->setSlot(JSSLOT_PROXY_HANDLER, PrivateTag(handler));
+    obj->setSlot(JSSLOT_PROXY_HANDLER, PrivateValue(handler));
     obj->setSlot(JSSLOT_PROXY_PRIVATE, priv);
     if (fun) {
-        obj->setSlot(JSSLOT_PROXY_CALL, call ? Value(ObjectTag(*call)) : Value(UndefinedTag()));
+        obj->setSlot(JSSLOT_PROXY_CALL, call ? ObjectValue(*call) : UndefinedValue());
         if (construct)
-            obj->setSlot(JSSLOT_PROXY_CONSTRUCT, construct ? Value(ObjectTag(*construct)) : Value(UndefinedTag()));
+            obj->setSlot(JSSLOT_PROXY_CONSTRUCT, construct ? ObjectValue(*construct) : UndefinedValue());
     }
     return obj;
 }
 
 static JSObject *
 NonNullObject(JSContext *cx, const Value &v)
 {
     if (v.isPrimitive()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NOT_NONNULL_OBJECT);
         return NULL;
     }
-    return &v.asObject();
+    return &v.toObject();
 }
 
 static JSBool
 proxy_create(JSContext *cx, uintN argc, Value *vp)
 {
     if (argc < 1) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
                              "create", "0", "s");
         return false;
     }
     JSObject *handler;
     if (!(handler = NonNullObject(cx, vp[2])))
         return false;
     JSObject *proto, *parent;
     if (argc > 1 && vp[3].isObject()) {
-        proto = &vp[3].asObject();
+        proto = &vp[3].toObject();
         parent = proto->getParent();
     } else {
         JS_ASSERT(IsFunctionObject(vp[0]));
         proto = NULL;
-        parent = vp[0].asObject().getParent();
+        parent = vp[0].toObject().getParent();
     }
-    JSObject *proxy = NewProxyObject(cx, &JSScriptedProxyHandler::singleton, ObjectTag(*handler),
-                                     proto, parent);
+    JSObject *proxy = NewProxyObject(cx, &JSScriptedProxyHandler::singleton,
+                                     ObjectValue(*handler), proto, parent);
     if (!proxy)
         return false;
 
     vp->setObject(*proxy);
     return true;
 }
 
 static JSBool
@@ -1086,32 +1086,33 @@ proxy_createFunction(JSContext *cx, uint
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
                              "createFunction", "1", "");
         return false;
     }
     JSObject *handler;
     if (!(handler = NonNullObject(cx, vp[2])))
         return false;
     JSObject *proto, *parent;
-    parent = vp[0].asObject().getParent();
+    parent = vp[0].toObject().getParent();
     if (!js_GetClassPrototype(cx, parent, JSProto_Function, &proto))
         return false;
     parent = proto->getParent();
 
     JSObject *call = js_ValueToCallableObject(cx, &vp[3], JSV2F_SEARCH_STACK);
     if (!call)
         return false;
     JSObject *construct = NULL;
     if (argc > 2) {
         construct = js_ValueToCallableObject(cx, &vp[4], JSV2F_SEARCH_STACK);
         if (!construct)
             return false;
     }
 
-    JSObject *proxy = NewProxyObject(cx, &JSScriptedProxyHandler::singleton, ObjectTag(*handler),
+    JSObject *proxy = NewProxyObject(cx, &JSScriptedProxyHandler::singleton,
+                                     ObjectValue(*handler),
                                      proto, parent, call, construct);
     if (!proxy)
         return false;
 
     vp->setObject(*proxy);
     return true;
 }
 
@@ -1169,40 +1170,40 @@ static JSFunctionSpec static_methods[] =
 extern Class CallableObjectClass;
 
 static const uint32 JSSLOT_CALLABLE_CALL = JSSLOT_PRIVATE;
 static const uint32 JSSLOT_CALLABLE_CONSTRUCT = JSSLOT_PRIVATE + 1;
 
 static JSBool
 callable_Call(JSContext *cx, JSObject *obj, uintN argc, Value *argv, Value *rval)
 {
-    JSObject *callable = &argv[-2].asObject();
+    JSObject *callable = &argv[-2].toObject();
     JS_ASSERT(callable->getClass() == &CallableObjectClass);
     const Value &fval = callable->fslots[JSSLOT_CALLABLE_CALL];
     return InternalCall(cx, obj, fval, argc, argv, rval);
 }
 
 static JSBool
 callable_Construct(JSContext *cx, JSObject *obj, uintN argc, Value *argv, Value *rval)
 {
-    JSObject *callable = &argv[-2].asObject();
+    JSObject *callable = &argv[-2].toObject();
     JS_ASSERT(callable->getClass() == &CallableObjectClass);
     Value fval = callable->fslots[JSSLOT_CALLABLE_CONSTRUCT];
     if (fval.isUndefined()) {
         /* We don't have an explicit constructor so allocate a new object and use the call. */
         fval = callable->fslots[JSSLOT_CALLABLE_CALL];
         JS_ASSERT(fval.isObject());
 
         /* callable is the constructor, so get callable.prototype is the proto of the new object. */
         if (!callable->getProperty(cx, ATOM_TO_JSID(ATOM(classPrototype)), rval))
             return false;
 
         JSObject *proto;
         if (rval->isObject()) {
-            proto = &rval->asObject();
+            proto = &rval->toObject();
         } else {
             if (!js_GetClassPrototype(cx, NULL, JSProto_Object, &proto))
                 return false;
         }
 
         JSObject *newobj = NewNativeClassInstance(cx, &js_ObjectClass, proto, proto->getParent());
         if (!newobj)
             return false;
--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@@ -151,17 +151,17 @@ JSObject::isProxy() const
 {
     return isObjectProxy() || isFunctionProxy();
 }
 
 inline js::JSProxyHandler *
 JSObject::getProxyHandler() const
 {
     JS_ASSERT(isProxy());
-    return (js::JSProxyHandler *) getSlot(js::JSSLOT_PROXY_HANDLER).asPrivate();
+    return (js::JSProxyHandler *) getSlot(js::JSSLOT_PROXY_HANDLER).toPrivate();
 }
 
 inline const js::Value &
 JSObject::getProxyPrivate() const
 {
     JS_ASSERT(isProxy());
     return getSlot(js::JSSLOT_PROXY_PRIVATE);
 }
--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@@ -4998,17 +4998,17 @@ js_ExecuteRegExp(JSContext *cx, JSRegExp
 
         matchstr = js_NewDependentString(cx, str, cp - str->chars(),
                                          matchlen);
         if (!matchstr) {
             ok = JS_FALSE;
             goto out;
         }
         
-        DEFVAL(StringTag(matchstr), INT_TO_JSID(0));
+        DEFVAL(StringValue(matchstr), INT_TO_JSID(0));
     }
 
     res = &cx->regExpStatics;
     res->input = str;
     if (!res->parens.resize(re->parenCount)) {
         ok = JS_FALSE;
         goto out;
     }
@@ -5023,29 +5023,29 @@ js_ExecuteRegExp(JSContext *cx, JSRegExp
                 sub->length = 0;
             } else {
                 sub->chars = gData.cpbegin + parsub->index;
                 sub->length = parsub->length;
             }
             if (test)
                 continue;
             if (parsub->index == -1) {
-                Value tmp = UndefinedTag();
+                Value tmp = UndefinedValue();
                 ok = js_DefineProperty(cx, obj, INT_TO_JSID(num + 1),
                                        &tmp, NULL, NULL, JSPROP_ENUMERATE);
             } else {
                 parstr = js_NewDependentString(cx, str,
                                                gData.cpbegin + parsub->index -
                                                str->chars(),
                                                parsub->length);
                 if (!parstr) {
                     ok = JS_FALSE;
                     goto out;
                 }
-                Value tmp = StringTag(parstr);
+                Value tmp = StringValue(parstr);
                 ok = js_DefineProperty(cx, obj, INT_TO_JSID(num + 1),
                                        &tmp, NULL, NULL, JSPROP_ENUMERATE);
             }
             if (!ok)
                 goto out;
         }
         if (parsub->index == -1) {
             res->lastParen = js_EmptySubString;
@@ -5055,19 +5055,19 @@ js_ExecuteRegExp(JSContext *cx, JSRegExp
         }
     }
 
     if (!test) {
         /*
          * Define the index and input properties last for better for/in loop
          * order (so they come after the elements).
          */
-        DEFVAL(Int32Tag(start + gData.skipped),
+        DEFVAL(Int32Value(start + gData.skipped),
                ATOM_TO_JSID(cx->runtime->atomState.indexAtom));
-        DEFVAL(StringTag(str),
+        DEFVAL(StringValue(str),
                ATOM_TO_JSID(cx->runtime->atomState.inputAtom));
     }
 
 #undef DEFVAL
 
     res->lastMatch.chars = cp;
     res->lastMatch.length = matchlen;
 
@@ -5087,17 +5087,17 @@ out:
 }
 
 /************************************************************************/
 
 static void
 SetRegExpLastIndex(JSContext *cx, JSObject *obj, jsdouble lastIndex)
 {
     JS_ASSERT(obj->isRegExp());
-    obj->setRegExpLastIndex(NumberTag(lastIndex));
+    obj->setRegExpLastIndex(NumberValue(lastIndex));
 }
 
 #define DEFINE_GETTER(name, code)                                              \
     static JSBool                                                              \
     name(JSContext *cx, JSObject *obj, jsid id, Value *vp)                     \
     {                                                                          \
         while (obj->getClass() != &js_RegExpClass) {                           \
             obj = obj->getProto();                                             \
@@ -5170,30 +5170,30 @@ static JSBool
 regexp_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags, JSObject **objp)
 {
     JS_ASSERT(obj->isRegExp());
 
     if (!JSID_IS_ATOM(id))
         return JS_TRUE;
 
     if (id == ATOM_TO_JSID(cx->runtime->atomState.lastIndexAtom)) {
-        if (!js_DefineNativeProperty(cx, obj, id, UndefinedTag(),
+        if (!js_DefineNativeProperty(cx, obj, id, UndefinedValue(),
                                      lastIndex_getter, lastIndex_setter,
                                      JSPROP_PERMANENT | JSPROP_SHARED, 0, 0, NULL)) {
             return JS_FALSE;
         }
         *objp = obj;
         return JS_TRUE;
     }
 
     for (size_t i = 0; i < JS_ARRAY_LENGTH(lazyRegExpProps); i++) {
         const LazyProp &lazy = lazyRegExpProps[i];
         JSAtom *atom = OFFSET_TO_ATOM(cx->runtime, lazy.atomOffset);
         if (id == ATOM_TO_JSID(atom)) {
-            if (!js_DefineNativeProperty(cx, obj, id, UndefinedTag(),
+            if (!js_DefineNativeProperty(cx, obj, id, UndefinedValue(),
                                          lazy.getter, NULL,
                                          JSPROP_PERMANENT | JSPROP_SHARED | JSPROP_READONLY,
                                          0, 0, NULL)) {
                 return JS_FALSE;
             }
             *objp = obj;
             return JS_TRUE;
         }
@@ -5365,17 +5365,17 @@ regexp_finalize(JSContext *cx, JSObject 
 /* Forward static prototype. */
 static JSBool
 regexp_exec_sub(JSContext *cx, JSObject *obj, uintN argc, Value *argv,
                 JSBool test, Value *rval);
 
 static JSBool
 regexp_call(JSContext *cx, JSObject *obj, uintN argc, Value *argv, Value *rval)
 {
-    return regexp_exec_sub(cx, &argv[-2].asObject(), argc, argv, JS_FALSE, rval);
+    return regexp_exec_sub(cx, &argv[-2].toObject(), argc, argv, JS_FALSE, rval);
 }
 
 #if JS_HAS_XDR
 
 #include "jsxdrapi.h"
 
 JSBool
 js_XDRRegExpObject(JSXDRState *xdr, JSObject **objp)
@@ -5530,17 +5530,17 @@ regexp_compile_sub(JSContext *cx, JSObje
         if (argv[0].isObjectOrNull()) {
             /*
              * If we get passed in a RegExp object we construct a new
              * RegExp that is a duplicate of it by re-compiling the
              * original source code. ECMA requires that it be an error
              * here if the flags are specified. (We must use the flags
              * from the original RegExp also).
              */
-            obj2 = argv[0].asObjectOrNull();
+            obj2 = argv[0].toObjectOrNull();
             if (obj2 && obj2->getClass() == &js_RegExpClass) {
                 if (argc >= 2 && !argv[1].isUndefined()) { /* 'flags' passed */
                     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                          JSMSG_NEWREGEXP_FLAGGED);
                     return JS_FALSE;
                 }
                 JS_LOCK_OBJ(cx, obj2);
                 re = (JSRegExp *) obj2->getPrivate();
@@ -5650,17 +5650,17 @@ regexp_exec_sub(JSContext *cx, JSObject 
         JS_UNLOCK_OBJ(cx, obj);
         return JS_TRUE;
     }
 
     /* NB: we must reach out: after this paragraph, in order to drop re. */
     HOLD_REGEXP(cx, re);
     sticky = (re->flags & JSREG_STICKY) != 0;
     if (re->flags & (JSREG_GLOB | JSREG_STICKY)) {
-        lastIndex = obj->getRegExpLastIndex().asNumber();
+        lastIndex = obj->getRegExpLastIndex().toNumber();
     } else {
         lastIndex = 0;
     }
     JS_UNLOCK_OBJ(cx, obj);
 
     /* Now that obj is unlocked, it's safe to (potentially) grab the GC lock. */
     if (argc == 0) {
         str = cx->regExpStatics.input;
@@ -5742,17 +5742,17 @@ RegExp(JSContext *cx, JSObject *obj, uin
 {
     if (!JS_IsConstructing(cx)) {
         /*
          * If first arg is regexp and no flags are given, just return the arg.
          * (regexp_compile_sub detects the regexp + flags case and throws a
          * TypeError.)  See 10.15.3.1.
          */
         if ((argc < 2 || argv[1].isUndefined()) && argv[0].isObject() &&
-            argv[0].asObject().getClass() == &js_RegExpClass) {
+            argv[0].toObject().getClass() == &js_RegExpClass) {
             *rval = argv[0];
             return JS_TRUE;
         }
 
         /* Otherwise, replace obj with a new RegExp object. */
         obj = NewBuiltinClassInstance(cx, &js_RegExpClass);
         if (!obj)
             return JS_FALSE;
--- a/js/src/jsregexp.h
+++ b/js/src/jsregexp.h
@@ -120,17 +120,17 @@ js_InitRegExpStatics(JSContext *cx);
 
 extern void
 js_TraceRegExpStatics(JSTracer *trc, JSContext *acx);
 
 extern void
 js_FreeRegExpStatics(JSContext *cx);
 
 #define VALUE_IS_REGEXP(cx, v)                                                \
-    ((v).isObject() && v.asObject().isRegExp())
+    ((v).isObject() && v.toObject().isRegExp())
 
 extern js::Class js_RegExpClass;
 
 inline bool
 JSObject::isRegExp() const
 {
     return getClass() == &js_RegExpClass;
 }
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -129,17 +129,17 @@ js_GetMutableScope(JSContext *cx, JSObje
         obj->map = scope;
         return NULL;
     }
 
     if (nslots > JS_INITIAL_NSLOTS && nslots > newscope->freeslot)
         newscope->freeslot = nslots;
 #ifdef DEBUG
     if (newscope->freeslot < nslots)
-        obj->setSlot(newscope->freeslot, UndefinedTag());
+        obj->setSlot(newscope->freeslot, UndefinedValue());
 #endif
 
     JS_DROP_ALL_EMPTY_SCOPE_LOCKS(cx, scope);
     static_cast<JSEmptyScope *>(scope)->drop(cx);
     return newscope;
 }
 
 /*
@@ -637,17 +637,17 @@ CheckAncestorLine(JSScope *scope)
 #endif
 
 void
 JSScope::reportReadOnlyScope(JSContext *cx)
 {
     JSString *str;
     const char *bytes;
 
-    str = js_ValueToString(cx, ObjectOrNullTag(object));
+    str = js_ValueToString(cx, ObjectOrNullValue(object));
     if (!str)
         return;
     bytes = js_GetStringBytes(cx, str);
     if (!bytes)
         return;
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_READ_ONLY, bytes);
 }
 
@@ -1209,17 +1209,17 @@ JSScope::deletingShapeChange(JSContext *
 
 bool
 JSScope::methodShapeChange(JSContext *cx, JSScopeProperty *sprop)
 {
     JS_ASSERT(!JSID_IS_VOID(sprop->id));
     if (sprop->isMethod()) {
 #ifdef DEBUG
         const Value &prev = object->lockedGetSlot(sprop->slot);
-        JS_ASSERT(&sprop->methodObject() == &prev.asObject());
+        JS_ASSERT(&sprop->methodObject() == &prev.toObject());
         JS_ASSERT(hasMethodBarrier());
         JS_ASSERT(object->getClass() == &js_ObjectClass);
         JS_ASSERT(!sprop->rawSetter || sprop->rawSetter == js_watch_set);
 #endif
 
         /*
          * Pass null to make a stub getter, but pass along sprop->setter to
          * preserve watchpoints. Clear JSScopeProperty::METHOD from flags as we
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -710,38 +710,39 @@ struct JSScopeProperty {
     JSObject &methodObject() const { JS_ASSERT(isMethod()); return *getterObj; }
 
     js::PropertyOp getter() const { return rawGetter; }
     bool hasDefaultGetter() const  { return !rawGetter; }
     js::PropertyOp getterOp() const { JS_ASSERT(!hasGetterValue()); return rawGetter; }
     JSObject *getterObject() const { JS_ASSERT(hasGetterValue()); return getterObj; }
 
     // Per ES5, decode null getterObj as the undefined value, which encodes as null.
-    js::ObjectOrUndefinedTag getterValue() const {
+    js::Value getterValue() const {
         JS_ASSERT(hasGetterValue());
-        return js::ObjectOrUndefinedTag(getterObj);
+        return getterObj ? js::ObjectValue(*getterObj) : js::UndefinedValue();
     }
 
-    js::ObjectOrUndefinedTag getterOrUndefined() const {
-        return js::ObjectOrUndefinedTag(hasGetterValue() ? getterObj : NULL);
+    js::Value getterOrUndefined() const {
+        JSObject *obj = hasGetterValue() ? getterObj : NULL;
+        return obj ? js::ObjectValue(*obj) : js::UndefinedValue();
     }
 
     js::PropertyOp setter() const { return rawSetter; }
     bool hasDefaultSetter() const  { return !rawSetter; }
     js::PropertyOp setterOp() const { JS_ASSERT(!hasSetterValue()); return rawSetter; }
     JSObject *setterObject() const { JS_ASSERT(hasSetterValue()); return setterObj; }
 
     // Per ES5, decode null setterObj as the undefined value, which encodes as null.
-    js::ObjectOrUndefinedTag setterValue() const {
+    js::Value setterValue() const {
         JS_ASSERT(hasSetterValue());
-        return js::ObjectOrUndefinedTag(setterObj);
+        return setterObj ? js::ObjectValue(*setterObj) : js::UndefinedValue();
     }
 
-    js::ObjectOrUndefinedTag setterOrUndefined() const {
-        return js::ObjectOrUndefinedTag(hasSetterValue() ? setterObj : NULL);
+    js::Value setterOrUndefined() const {
+        return setterObj ? js::ObjectValue(*setterObj) : js::UndefinedValue();
     }
 
     inline JSDHashNumber hash() const;
     inline bool matches(const JSScopeProperty *p) const;
     inline bool matchesParamsAfterId(js::PropertyOp agetter, js::PropertyOp asetter,
                                      uint32 aslot, uintN aattrs, uintN aflags,
                                      intN ashortid) const;
 
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -115,36 +115,36 @@ JSScope::extend(JSContext *cx, JSScopePr
  * objects optimized as typically non-escaping, ad-hoc methods in obj.
  */
 inline bool
 JSScope::methodReadBarrier(JSContext *cx, JSScopeProperty *sprop, js::Value *vp)
 {
     JS_ASSERT(hasMethodBarrier());
     JS_ASSERT(hasProperty(sprop));
     JS_ASSERT(sprop->isMethod());
-    JS_ASSERT(&vp->asObject() == &sprop->methodObject());
+    JS_ASSERT(&vp->toObject() == &sprop->methodObject());
     JS_ASSERT(object->getClass() == &js_ObjectClass);
 
-    JSObject *funobj = &vp->asObject();
+    JSObject *funobj = &vp->toObject();
     JSFunction *fun = GET_FUNCTION_PRIVATE(cx, funobj);
     JS_ASSERT(FUN_OBJECT(fun) == funobj && FUN_NULL_CLOSURE(fun));
 
     funobj = CloneFunctionObject(cx, fun, funobj->getParent());
     if (!funobj)
         return false;
     vp->setObject(*funobj);
     return !!js_SetPropertyHelper(cx, object, sprop->id, 0, vp);
 }
 
 static JS_ALWAYS_INLINE bool
 ChangesMethodValue(const js::Value &prev, const js::Value &v)
 {
     JSObject *prevObj;
-    return prev.isObject() && (prevObj = &prev.asObject())->isFunction() &&
-           (!v.isObject() || &v.asObject() != prevObj);
+    return prev.isObject() && (prevObj = &prev.toObject())->isFunction() &&
+           (!v.isObject() || &v.toObject() != prevObj);
 }
 
 inline bool
 JSScope::methodWriteBarrier(JSContext *cx, JSScopeProperty *sprop,
                             const js::Value &v)
 {
     if (flags & (BRANDED | METHOD_BARRIER)) {
         const js::Value &prev = object->lockedGetSlot(sprop->slot);
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -255,32 +255,32 @@ js_MakeStringImmutable(JSContext *cx, JS
 
 static JSString *
 ArgToRootedString(JSContext *cx, uintN argc, Value *vp, uintN arg)
 {
     if (arg >= argc)
         return ATOM_TO_STRING(cx->runtime->atomState.typeAtoms[JSTYPE_VOID]);
     vp += 2 + arg;
 
-    if (vp->isObject() && !vp->asObject().defaultValue(cx, JSTYPE_STRING, vp))
+    if (vp->isObject() && !vp->toObject().defaultValue(cx, JSTYPE_STRING, vp))
         return NULL;
 
     JSString *str;
     if (vp->isString()) {
-        str = vp->asString();
+        str = vp->toString();
     } else if (vp->isBoolean()) {
         str = ATOM_TO_STRING(cx->runtime->atomState.booleanAtoms[
-                                  (int)vp->asBoolean()]);
+                                  (int)vp->toBoolean()]);
     } else if (vp->isNull()) {
         str = ATOM_TO_STRING(cx->runtime->atomState.nullAtom);
     } else if (vp->isUndefined()) {
         str = ATOM_TO_STRING(cx->runtime->atomState.typeAtoms[JSTYPE_VOID]);
     }
     else {
-        str = js_NumberToString(cx, vp->asNumber());
+        str = js_NumberToString(cx, vp->toNumber());
         if (str)
             vp->setString(str);
     }
     return str;
 }
 
 /*
  * Forward declarations for URI encode/decode and helper routines
@@ -502,17 +502,17 @@ str_unescape(JSContext *cx, uintN argc, 
 }
 
 #if JS_HAS_UNEVAL
 static JSBool
 str_uneval(JSContext *cx, uintN argc, Value *vp)
 {
     JSString *str;
 
-    str = js_ValueToSource(cx, argc != 0 ? vp[2] : Value(UndefinedTag()));
+    str = js_ValueToSource(cx, argc != 0 ? vp[2] : UndefinedValue());
     if (!str)
         return JS_FALSE;
     vp->setString(str);
     return JS_TRUE;
 }
 #endif
 
 const char js_escape_str[] = "escape";
@@ -545,20 +545,20 @@ JSSubString js_EmptySubString = {0, js_e
 static JSBool
 str_getProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     JSString *str;
 
     if (JSID_IS_ATOM(id, cx->runtime->atomState.lengthAtom)) {
         if (obj->getClass() == &js_StringClass) {
             /* Follow ECMA-262 by fetching intrinsic length of our string. */
-            str = obj->getPrimitiveThis().asString();
+            str = obj->getPrimitiveThis().toString();
         } else {
             /* Preserve compatibility: convert obj to a string primitive. */
-            str = js_ValueToString(cx, ObjectTag(*obj));
+            str = js_ValueToString(cx, ObjectValue(*obj));
             if (!str)
                 return JS_FALSE;
         }
 
         vp->setInt32(str->length());
     }
 
     return JS_TRUE;
@@ -567,50 +567,50 @@ str_getProperty(JSContext *cx, JSObject 
 #define STRING_ELEMENT_ATTRS (JSPROP_ENUMERATE|JSPROP_READONLY|JSPROP_PERMANENT)
 
 static JSBool
 str_enumerate(JSContext *cx, JSObject *obj)
 {
     JSString *str, *str1;
     size_t i, length;
 
-    str = obj->getPrimitiveThis().asString();
+    str = obj->getPrimitiveThis().toString();
 
     length = str->length();
     for (i = 0; i < length; i++) {
         str1 = js_NewDependentString(cx, str, i, 1);
         if (!str1)
             return JS_FALSE;
-        if (!obj->defineProperty(cx, INT_TO_JSID(i), StringTag(str1),
+        if (!obj->defineProperty(cx, INT_TO_JSID(i), StringValue(str1),
                                  PropertyStub, PropertyStub,
                                  STRING_ELEMENT_ATTRS)) {
             return JS_FALSE;
         }
     }
 
     return obj->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom),
-                               UndefinedTag(), NULL, NULL,
+                               UndefinedValue(), NULL, NULL,
                                JSPROP_PERMANENT | JSPROP_READONLY | JSPROP_SHARED);
 }
 
 static JSBool
 str_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
             JSObject **objp)
 {
     if (!JSID_IS_INT(id) || (flags & JSRESOLVE_ASSIGNING))
         return JS_TRUE;
 
-    JSString *str = obj->getPrimitiveThis().asString();
+    JSString *str = obj->getPrimitiveThis().toString();
 
     jsint slot = JSID_TO_INT(id);
     if ((size_t)slot < str->length()) {
         JSString *str1 = JSString::getUnitString(cx, str, size_t(slot));
         if (!str1)
             return JS_FALSE;
-        if (!obj->defineProperty(cx, id, StringTag(str1), NULL, NULL,
+        if (!obj->defineProperty(cx, id, StringValue(str1), NULL, NULL,
                                  STRING_ELEMENT_ATTRS)) {
             return JS_FALSE;
         }
         *objp = obj;
     }
     return JS_TRUE;
 }
 
@@ -621,17 +621,17 @@ Class js_StringClass = {
     PropertyStub,    PropertyStub,     str_getProperty,     PropertyStub,
     str_enumerate,   (JSResolveOp)str_resolve, ConvertStub, NULL,
     JSCLASS_NO_OPTIONAL_MEMBERS
 };
 
 #define NORMALIZE_THIS(cx,vp,str)                                             \
     JS_BEGIN_MACRO                                                            \
         if (vp[1].isString()) {                                               \
-            str = vp[1].asString();                                           \
+            str = vp[1].toString();                                           \
         } else {                                                              \
             str = NormalizeThis(cx, vp);                                      \
             if (!str)                                                         \
                 return JS_FALSE;                                              \
         }                                                                     \
     JS_END_MACRO
 
 static JSString *
@@ -642,20 +642,20 @@ NormalizeThis(JSContext *cx, Value *vp)
 
     /*
      * js_GetPrimitiveThis seems to do a bunch of work (like calls to
      * JS_THIS_OBJECT) which we don't need in the common case (where
      * vp[1] is a String object) here.  Note that vp[1] can still be a
      * primitive value at this point.
      */
     if (vp[1].isObject()) {
-        JSObject *obj = &vp[1].asObject();
+        JSObject *obj = &vp[1].toObject();
         if (obj->getClass() == &js_StringClass) {
             vp[1] = obj->getPrimitiveThis();
-            return vp[1].asString();
+            return vp[1].toString();
         }
     }
 
     JSString *str = js_ValueToString(cx, vp[1]);
     if (!str)
         return NULL;
     vp[1].setString(str);
     return str;
@@ -687,17 +687,17 @@ str_toSource(JSContext *cx, uintN argc, 
     size_t i, j, k, n;
     char buf[16];
     const jschar *s;
     jschar *t;
 
     const Value *primp;
     if (!js_GetPrimitiveThis(cx, vp, &js_StringClass, &primp))
         return JS_FALSE;
-    str = js_QuoteString(cx, primp->asString(), '"');
+    str = js_QuoteString(cx, primp->toString(), '"');
     if (!str)
         return JS_FALSE;
     j = JS_snprintf(buf, sizeof buf, "(new %s(", js_StringClass.name);
     str->getCharsAndLength(s, k);
     n = j + k + 2;
     t = (jschar *) cx->malloc((n + 1) * sizeof(jschar));
     if (!t)
         return JS_FALSE;
@@ -786,17 +786,17 @@ str_substring(JSContext *cx, uintN argc,
 
 #ifdef JS_TRACER
 static JSString* FASTCALL
 String_p_toString(JSContext* cx, JSObject* obj)
 {
     if (!InstanceOf(cx, obj, &js_StringClass, NULL))
         return NULL;
     Value v = obj->getPrimitiveThis();
-    return v.asString();
+    return v.toString();
 }
 #endif
 
 JSString* JS_FASTCALL
 js_toLowerCase(JSContext *cx, JSString *str)
 {
     size_t i, n;
     const jschar *s;
@@ -921,18 +921,18 @@ str_localeCompare(JSContext *cx, uintN a
 static JSBool
 str_charAt(JSContext *cx, uintN argc, Value *vp)
 {
     JSString *str;
     jsint i;
     jsdouble d;
 
     if (vp[1].isString() && argc != 0 && vp[2].isInt32()) {
-        str = vp[1].asString();
-        i = vp[2].asInt32();
+        str = vp[1].toString();
+        i = vp[2].toInt32();
         if ((size_t)i >= str->length())
             goto out_of_range;
     } else {
         NORMALIZE_THIS(cx, vp, str);
 
         if (argc == 0) {
             d = 0.0;
         } else {
@@ -961,18 +961,18 @@ static JSBool
 str_charCodeAt(JSContext *cx, uintN argc, Value *vp)
 {
     Value t;
     JSString *str;
     jsint i;
     jsdouble d;
 
     if (vp[1].isString() && argc != 0 && vp[2].isInt32()) {
-        str = vp[1].asString();
-        i = vp[2].asInt32();
+        str = vp[1].toString();
+        i = vp[2].toInt32();
         if ((size_t)i >= str->length())
             goto out_of_range;
     } else {
         NORMALIZE_THIS(cx, vp, str);
 
         if (argc == 0) {
             d = 0.0;
         } else {
@@ -1223,17 +1223,17 @@ str_indexOf(JSContext *cx, uintN argc, V
     const jschar *text = str->chars();
     jsuint textlen = str->length();
     const jschar *pat = patstr->chars();
     jsuint patlen = patstr->length();
 
     jsuint start;
     if (argc > 1) {
         if (vp[3].isInt32()) {
-            jsint i = vp[3].asInt32();
+            jsint i = vp[3].toInt32();
             if (i <= 0) {
                 start = 0;
             } else if (jsuint(i) > textlen) {
                 start = 0;
                 textlen = 0;
             } else {
                 start = i;
                 text += start;
@@ -1272,34 +1272,34 @@ str_lastIndexOf(JSContext *cx, uintN arg
     jsint i, j, textlen, patlen;
     jsdouble d;
 
     NORMALIZE_THIS(cx, vp, str);
     text = str->chars();
     textlen = (jsint) str->length();
 
     if (argc != 0 && vp[2].isString()) {
-        str2 = vp[2].asString();
+        str2 = vp[2].toString();
     } else {
         str2 = ArgToRootedString(cx, argc, vp, 0);
         if (!str2)
             return JS_FALSE;
     }
     pat = str2->chars();
     patlen = (jsint) str2->length();
 
     i = textlen - patlen; // Start searching here
     if (i < 0) {
         vp->setInt32(-1);
         return JS_TRUE;
     }
 
     if (argc > 1) {
         if (vp[3].isInt32()) {
-            j = vp[3].asInt32();
+            j = vp[3].toInt32();
             if (j <= 0)
                 i = 0;
             else if (j < i)
                 i = j;
         } else {
             if (!ValueToNumber(cx, vp[3], &d))
                 return JS_FALSE;
             if (!JSDOUBLE_IS_NaN(d)) {
@@ -1422,17 +1422,17 @@ class RegExpGuard
 
     JSContext* cx() const { return mCx; }
 
     /* init must succeed in order to call tryFlatMatch or normalizeRegExp. */
     bool
     init(uintN argc, Value *vp)
     {
         if (argc != 0 && VALUE_IS_REGEXP(mCx, vp[2])) {
-            mReobj = &vp[2].asObject();
+            mReobj = &vp[2].toObject();
             mRe = (JSRegExp *) mReobj->getPrivate();
             HOLD_REGEXP(mCx, mRe);
         } else {
             patstr = ArgToRootedString(mCx, argc, vp, 0);
             if (!patstr)
                 return false;
         }
         return true;
@@ -1578,17 +1578,17 @@ MatchCallback(JSContext *cx, size_t coun
     JSString *str = cx->regExpStatics.input;
     JSSubString &match = cx->regExpStatics.lastMatch;
     ptrdiff_t off = match.chars - str->chars();
     JS_ASSERT(off >= 0 && size_t(off) <= str->length());
     JSString *matchstr = js_NewDependentString(cx, str, off, match.length);
     if (!matchstr)
         return false;
 
-    Value v = StringTag(matchstr);
+    Value v = StringValue(matchstr);
 
     JSAutoResolveFlags rf(cx, JSRESOLVE_QUALIFIED | JSRESOLVE_ASSIGNING);
     return !!arrayobj->setProperty(cx, INT_TO_JSID(count), &v);
 }
 
 static bool
 BuildFlatMatchArray(JSContext *cx, JSString *textstr, const RegExpGuard &g,
                     Value *vp)
@@ -1599,21 +1599,21 @@ BuildFlatMatchArray(JSContext *cx, JSStr
     }
 
     /* For this non-global match, produce a RegExp.exec-style array. */
     JSObject *obj = js_NewSlowArrayObject(cx);
     if (!obj)
         return false;
     vp->setObject(*obj);
 
-    return obj->defineProperty(cx, INT_TO_JSID(0), StringTag(g.patstr)) &&
+    return obj->defineProperty(cx, INT_TO_JSID(0), StringValue(g.patstr)) &&
            obj->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.indexAtom),
-                               Int32Tag(g.match)) &&
+                               Int32Value(g.match)) &&
            obj->defineProperty(cx, ATOM_TO_JSID(cx->runtime->atomState.inputAtom),
-                               StringTag(textstr));
+                               StringValue(textstr));
 }
 
 static JSBool
 str_match(JSContext *cx, uintN argc, Value *vp)
 {
     JSString *str;
     NORMALIZE_THIS(cx, vp, str);
 
@@ -1812,17 +1812,17 @@ FindReplaceLength(JSContext *cx, Replace
         uintN i = 0;
         for (uintN n = cx->regExpStatics.parens.length(); i < n; i++) {
             if (!PushRegExpSubstr(cx, cx->regExpStatics.parens[i], sp))
                 return false;
         }
 
         /* Make sure to push undefined for any unmatched parens. */
         for (; i < p; i++)
-            sp++->setUndefined();
+            *sp++ = UndefinedValue();
 
         /* Push match index and input string. */
         sp++->setInt32(cx->regExpStatics.leftContext.length);
         sp++->setString(rdata.str);
 
         if (!Invoke(cx, rdata.args, 0))
             return false;
 
@@ -1947,17 +1947,17 @@ BuildFlatReplacement(JSContext *cx, JSSt
 static JSBool
 str_replace(JSContext *cx, uintN argc, Value *vp)
 {
     ReplaceData rdata(cx);
     NORMALIZE_THIS(cx, vp, rdata.str);
 
     /* Extract replacement string/function. */
     if (argc >= 2 && js_IsCallable(vp[3])) {
-        rdata.lambda = &vp[3].asObject();
+        rdata.lambda = &vp[3].toObject();
         rdata.repstr = NULL;
         rdata.dollar = rdata.dollarEnd = NULL;
     } else {
         rdata.lambda = NULL;
         rdata.repstr = ArgToRootedString(cx, argc, vp, 1);
         if (!rdata.repstr)
             return false;
 
@@ -2108,28 +2108,28 @@ find_split(JSContext *cx, JSString *str,
 
 static JSBool
 str_split(JSContext *cx, uintN argc, Value *vp)
 {
     JSString *str;
     NORMALIZE_THIS(cx, vp, str);
 
     if (argc == 0) {
-        Value v = StringTag(str);
+        Value v = StringValue(str);
         JSObject *aobj = js_NewArrayObject(cx, 1, &v);
         if (!aobj)
             return false;
         vp->setObject(*aobj);
         return true;
     }
 
     JSRegExp *re;
     JSSubString *sep, tmp;
     if (VALUE_IS_REGEXP(cx, vp[2])) {
-        re = (JSRegExp *) vp[2].asObject().getPrivate();
+        re = (JSRegExp *) vp[2].toObject().getPrivate();
         sep = &tmp;
 
         /* Set a magic value so we can detect a successful re match. */
         sep->chars = NULL;
         sep->length = 0;
     } else {
         JSString *str2 = js_ValueToString(cx, vp[2]);
         if (!str2)
@@ -2163,33 +2163,33 @@ str_split(JSContext *cx, uintN argc, Val
 
     jsint i, j;
     uint32 len = i = 0;
     while ((j = find_split(cx, str, re, &i, sep)) >= 0) {
         if (limited && len >= limit)
             break;
 
         JSString *sub = js_NewDependentString(cx, str, i, size_t(j - i));
-        if (!sub || !splits.append(StringTag(sub)))
+        if (!sub || !splits.append(StringValue(sub)))
             return false;
         len++;
 
         /*
          * Imitate perl's feature of including parenthesized substrings that
          * matched part of the delimiter in the new array, after the split
          * substring that was delimited.
          */
         if (re && sep->chars) {
             JSRegExpStatics *res = &cx->regExpStatics;
             for (uintN num = 0; num < res->parens.length(); num++) {
                 if (limited && len >= limit)
                     break;
                 JSSubString *parsub = &res->parens[num];
                 sub = js_NewStringCopyN(cx, parsub->chars, parsub->length);
-                if (!sub || !splits.append(StringTag(sub)))
+                if (!sub || !splits.append(StringValue(sub)))
                     return false;
                 len++;
             }
             sep->chars = NULL;
         }
         i = j + sep->length;
     }
 
@@ -2280,18 +2280,18 @@ str_concat(JSContext *cx, uintN argc, Va
 }
 
 static JSBool
 str_slice(JSContext *cx, uintN argc, Value *vp)
 {
     if (argc == 1 && vp[1].isString() && vp[2].isInt32()) {
         size_t begin, end, length;
 
-        JSString *str = vp[1].asString();
-        begin = vp[2].asInt32();
+        JSString *str = vp[1].toString();
+        begin = vp[2].toInt32();
         end = str->length();
         if (begin <= end) {
             length = end - begin;
             if (length == 0) {
                 str = cx->runtime->emptyString;
             } else {
                 str = (length == 1)
                       ? JSString::getUnitString(cx, str, begin)
@@ -2916,27 +2916,27 @@ js_String(JSContext *cx, JSObject *obj, 
         argv[0].setString(str);
     } else {
         str = cx->runtime->emptyString;
     }
     if (!JS_IsConstructing(cx)) {
         rval->setString(str);
         return JS_TRUE;
     }
-    obj->setPrimitiveThis(StringTag(str));
+    obj->setPrimitiveThis(StringValue(str));
     return JS_TRUE;
 }
 
 #ifdef JS_TRACER
 
 JSObject* FASTCALL
 js_String_tn(JSContext* cx, JSObject* proto, JSString* str)
 {
     JS_ASSERT(JS_ON_TRACE(cx));
-    return js_NewObjectWithClassProto(cx, &js_StringClass, proto, StringTag(str));
+    return js_NewObjectWithClassProto(cx, &js_StringClass, proto, StringValue(str));
 }
 JS_DEFINE_CALLINFO_3(extern, OBJECT, js_String_tn, CONTEXT, CALLEE_PROTOTYPE, STRING, 0,
                      nanojit::ACC_STORE_ANY)
 
 #endif /* !JS_TRACER */
 
 static JSBool
 str_fromCharCode(JSContext *cx, uintN argc, Value *vp)
@@ -3011,19 +3011,19 @@ js_InitStringClass(JSContext *cx, JSObje
     if (!JS_DefineFunctions(cx, obj, string_functions))
         return NULL;
 
     proto = js_InitClass(cx, obj, NULL, &js_StringClass, js_String, 1,
                          NULL, string_methods,
                          NULL, string_static_methods);
     if (!proto)
         return NULL;
-    proto->setPrimitiveThis(StringTag(cx->runtime->emptyString));
+    proto->setPrimitiveThis(StringValue(cx->runtime->emptyString));
     if (!js_DefineNativeProperty(cx, proto, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom),
-                                 UndefinedTag(), NULL, NULL,
+                                 UndefinedValue(), NULL, NULL,
                                  JSPROP_READONLY | JSPROP_PERMANENT | JSPROP_SHARED, 0, 0,
                                  NULL)) {
         return JS_FALSE;
     }
 
     return proto;
 }
 
@@ -3204,28 +3204,28 @@ js_ValueToPrintable(JSContext *cx, const
         return NULL;
     return js_GetStringBytes(cx, str);
 }
 
 JSString *
 js_ValueToString(JSContext *cx, const Value &arg)
 {
     Value v = arg;
-    if (v.isObject() && !v.asObject().defaultValue(cx, JSTYPE_STRING, &v))
+    if (v.isObject() && !v.toObject().defaultValue(cx, JSTYPE_STRING, &v))
         return NULL;
 
     JSString *str;
     if (v.isString()) {
-        str = v.asString();
+        str = v.toString();
     } else if (v.isInt32()) {
-        str = js_NumberToString(cx, v.asInt32());
+        str = js_NumberToString(cx, v.toInt32());
     } else if (v.isDouble()) {
-        str = js_NumberToString(cx, v.asDouble());
+        str = js_NumberToString(cx, v.toDouble());
     } else if (v.isBoolean()) {
-        str = js_BooleanToString(cx, v.asBoolean());
+        str = js_BooleanToString(cx, v.toBoolean());
     } else if (v.isNull()) {
         str = ATOM_TO_STRING(cx->runtime->atomState.nullAtom);
     } else {
         str = ATOM_TO_STRING(cx->runtime->atomState.typeAtoms[JSTYPE_VOID]);
     }
     return str;
 }
 
@@ -3239,56 +3239,56 @@ AppendAtom(JSAtom *atom, JSCharBuffer &c
     return cb.append(chars, length);
 }
 
 /* This function implements E-262-3 section 9.8, toString. */
 JSBool
 js_ValueToCharBuffer(JSContext *cx, const Value &arg, JSCharBuffer &cb)
 {
     Value v = arg;
-    if (v.isObject() && !v.asObject().defaultValue(cx, JSTYPE_STRING, &v))
+    if (v.isObject() && !v.toObject().defaultValue(cx, JSTYPE_STRING, &v))
         return JS_FALSE;
 
     if (v.isString()) {
         const jschar *chars;
         size_t length;
-        v.asString()->getCharsAndLength(chars, length);
+        v.toString()->getCharsAndLength(chars, length);
         return cb.append(chars, length);
     }
     if (v.isNumber())
         return js_NumberValueToCharBuffer(cx, v, cb);
     if (v.isBoolean())
-        return js_BooleanToCharBuffer(cx, v.asBoolean(), cb);
+        return js_BooleanToCharBuffer(cx, v.toBoolean(), cb);
     if (v.isNull())
         return AppendAtom(cx->runtime->atomState.nullAtom, cb);
     JS_ASSERT(v.isUndefined());
     return AppendAtom(cx->runtime->atomState.typeAtoms[JSTYPE_VOID], cb);
 }
 
 JS_FRIEND_API(JSString *)
 js_ValueToSource(JSContext *cx, const Value &v)
 {
     if (v.isUndefined())
         return ATOM_TO_STRING(cx->runtime->atomState.void0Atom);
     if (v.isString())
-        return js_QuoteString(cx, v.asString(), '"');
+        return js_QuoteString(cx, v.toString(), '"');
     if (v.isPrimitive()) {
         /* Special case to preserve negative zero, _contra_ toString. */
-        if (v.isDouble() && JSDOUBLE_IS_NEGZERO(v.asDouble())) {
+        if (v.isDouble() && JSDOUBLE_IS_NEGZERO(v.toDouble())) {
             /* NB: _ucNstr rather than _ucstr to indicate non-terminated. */
             static const jschar js_negzero_ucNstr[] = {'-', '0'};
 
             return js_NewStringCopyN(cx, js_negzero_ucNstr, 2);
         }
         return js_ValueToString(cx, v);
     }
 
     JSAtom *atom = cx->runtime->atomState.toSourceAtom;
     AutoValueRooter tvr(cx);
-    if (!js_TryMethod(cx, &v.asObject(), atom, 0, NULL, tvr.addr()))
+    if (!js_TryMethod(cx, &v.toObject(), atom, 0, NULL, tvr.addr()))
         return NULL;
     return js_ValueToString(cx, tvr.value());
 }
 
 /*
  * str is not necessarily a GC thing here.
  */
 uint32
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -183,17 +183,17 @@ JS_DEFINE_CALLINFO_2(extern, STRING, js_
 
 namespace js {
 
 using namespace nanojit;
 
 #if JS_HAS_XML_SUPPORT
 #define RETURN_VALUE_IF_XML(val, ret)                                         \
     JS_BEGIN_MACRO                                                            \
-        if (!val.isPrimitive() && val.asObject().isXML())        \
+        if (!val.isPrimitive() && val.toObject().isXML())        \
             RETURN_VALUE("xml detected", ret);                                \
     JS_END_MACRO
 #else
 #define RETURN_IF_XML(val, ret) ((void) 0)
 #endif
 
 #define RETURN_IF_XML_A(val) RETURN_VALUE_IF_XML(val, ARECORD_STOP)
 #define RETURN_IF_XML(val)   RETURN_VALUE_IF_XML(val, RECORD_STOP)
@@ -224,17 +224,17 @@ TypeToChar(JSValueType type)
 }
 
 static char
 ValueToTypeChar(const Value &v)
 {
     if (v.isInt32()) return 'I';
     if (v.isDouble()) return 'D';
     if (v.isString()) return 'S';
-    if (v.isObject()) return v.asObject().isFunction() ? 'F' : 'O';
+    if (v.isObject()) return v.toObject().isFunction() ? 'F' : 'O';
     if (v.isBoolean()) return 'B';
     if (v.isNull()) return 'N';
     if (v.isUndefined()) return 'U';
     if (v.isMagic()) return 'M';
     return '?';
 }
 #endif
 
@@ -1048,55 +1048,55 @@ argSlots(JSStackFrame* fp)
 static inline bool
 hasInt32Repr(const Value &v)
 {
     if (!v.isNumber())
         return false;
     if (v.isInt32())
         return true;
     int32_t _;
-    return JSDOUBLE_IS_INT32(v.asDouble(), &_);
+    return JSDOUBLE_IS_INT32(v.toDouble(), &_);
 }
 
 static inline jsint
 asInt32(const Value &v)
 {
     JS_ASSERT(v.isNumber());
     if (v.isInt32())
-        return v.asInt32();
+        return v.toInt32();
 #ifdef DEBUG
     int32_t _;
-    JS_ASSERT(JSDOUBLE_IS_INT32(v.asDouble(), &_));
-#endif
-    return jsint(v.asDouble());
+    JS_ASSERT(JSDOUBLE_IS_INT32(v.toDouble(), &_));
+#endif
+    return jsint(v.toDouble());
 }
 
 /* Return JSVAL_TYPE_DOUBLE for all numbers (int and double) and the tag otherwise. */
 static inline JSValueType
 GetPromotedType(const Value &v)
 {
     if (v.isNumber())
         return JSVAL_TYPE_DOUBLE;
     if (v.isObject())
-        return v.asObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
+        return v.toObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
     return v.extractNonDoubleObjectTraceType();
 }
 
 /* Return JSVAL_TYPE_INT32 for all whole numbers that fit into signed 32-bit and the tag otherwise. */
 static inline JSValueType
 getCoercedType(const Value &v)
 {
     if (v.isNumber()) {
         int32_t _;
-        return (v.isInt32() || JSDOUBLE_IS_INT32(v.asDouble(), &_))
+        return (v.isInt32() || JSDOUBLE_IS_INT32(v.toDouble(), &_))
                ? JSVAL_TYPE_INT32
                : JSVAL_TYPE_DOUBLE;
     }
     if (v.isObject())
-        return v.asObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
+        return v.toObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
     return v.extractNonDoubleObjectTraceType();
 }
 
 static inline JSValueType
 getFrameObjPtrTraceType(JSObject *obj)
 {
     JS_ASSERT_IF(obj, !obj->isFunction());
     return obj ? JSVAL_TYPE_NONFUNOBJ : JSVAL_TYPE_NULL;
@@ -2477,31 +2477,31 @@ TraceRecorder::addName(LIns* ins, const 
         lirbuf->printer->lirNameMap->addName(ins, name);
 #endif
     return ins;
 }
 
 inline LIns*
 TraceRecorder::insImmObj(JSObject* obj)
 {
-    tree->gcthings.addUnique(ObjectTag(*obj));
+    tree->gcthings.addUnique(ObjectValue(*obj));
     return lir->insImmP((void*)obj);
 }
 
 inline LIns*
 TraceRecorder::insImmFun(JSFunction* fun)
 {
-    tree->gcthings.addUnique(ObjectTag(*fun));
+    tree->gcthings.addUnique(ObjectValue(*fun));
     return lir->insImmP((void*)fun);
 }
 
 inline LIns*
 TraceRecorder::insImmStr(JSString* str)
 {
-    tree->gcthings.addUnique(StringTag(str));
+    tree->gcthings.addUnique(StringValue(str));
     return lir->insImmP((void*)str);
 }
 
 inline LIns*
 TraceRecorder::insImmSprop(JSScopeProperty* sprop)
 {
     tree->sprops.addUnique(sprop);
     return lir->insImmP((void*)sprop);
@@ -2629,34 +2629,34 @@ TraceRecorder::trackNativeStackUse(unsig
  * type checking. The caller must ensure the types are compatible.
  */
 static inline void
 ValueToNative(const Value &v, JSValueType type, double* slot)
 {
     if (type > JSVAL_UPPER_INCL_TYPE_OF_NUMBER_SET) {
         v.unboxNonDoubleTo((uint64 *)slot);
     } else if (type == JSVAL_TYPE_INT32) {
-        *(int32_t *)slot = v.isInt32() ? v.asInt32() : (int32_t)v.asDouble();
+        *(int32_t *)slot = v.isInt32() ? v.toInt32() : (int32_t)v.toDouble();
     } else {
-        *(double *)slot = v.asNumber();
+        *(double *)slot = v.toNumber();
     }
 
 #ifdef DEBUG
     int32_t _;
     switch (type) {
       case JSVAL_TYPE_NONFUNOBJ: {
         JS_ASSERT(!IsFunctionObject(v));
         debug_only_printf(LC_TMTracer,
                           "object<%p:%s> ", (void*)*(JSObject **)slot,
-                          v.asObject().getClass()->name);
+                          v.toObject().getClass()->name);
         return;
       }
 
       case JSVAL_TYPE_INT32:
-        JS_ASSERT(v.isInt32() || (v.isDouble() && JSDOUBLE_IS_INT32(v.asDouble(), &_)));
+        JS_ASSERT(v.isInt32() || (v.isDouble() && JSDOUBLE_IS_INT32(v.toDouble(), &_)));
         debug_only_printf(LC_TMTracer, "int<%d> ", *(jsint *)slot);
         return;
 
       case JSVAL_TYPE_DOUBLE:
         JS_ASSERT(v.isNumber());
         debug_only_printf(LC_TMTracer, "double<%g> ", *(jsdouble *)slot);
         return;
 
@@ -2686,17 +2686,17 @@ ValueToNative(const Value &v, JSValueTyp
 
       case JSVAL_TYPE_MAGIC:
         JS_ASSERT(v.isMagic());
         debug_only_print0(LC_TMTracer, "hole ");
         return;
 
       case JSVAL_TYPE_FUNOBJ: {
         JS_ASSERT(IsFunctionObject(v));
-        JSFunction* fun = GET_FUNCTION_PRIVATE(cx, &v.asObject());
+        JSFunction* fun = GET_FUNCTION_PRIVATE(cx, &v.toObject());
         debug_only_printf(LC_TMTracer,
                           "function<%p:%s> ", (void*)*(JSObject **)slot,
                           fun->atom
                           ? JS_GetStringBytes(ATOM_TO_STRING(fun->atom))
                           : "unnamed");
         return;
       }
       default:
@@ -2811,45 +2811,45 @@ NativeToValue(JSContext* cx, Value& v, J
     }
 
 #ifdef DEBUG
     switch (type) {
       case JSVAL_TYPE_NONFUNOBJ:
         JS_ASSERT(!IsFunctionObject(v));
         debug_only_printf(LC_TMTracer,
                           "object<%p:%s> ",
-                          (void*) &v.asObject(),
-                          v.asObject().getClass()->name);
+                          (void*) &v.toObject(),
+                          v.toObject().getClass()->name);
         break;
       case JSVAL_TYPE_INT32:
-        debug_only_printf(LC_TMTracer, "int<%d> ", v.asInt32());
+        debug_only_printf(LC_TMTracer, "int<%d> ", v.toInt32());
         break;
       case JSVAL_TYPE_DOUBLE:
-        debug_only_printf(LC_TMTracer, "double<%g> ", v.asNumber());
+        debug_only_printf(LC_TMTracer, "double<%g> ", v.toNumber());
         break;
       case JSVAL_TYPE_STRING:
-        debug_only_printf(LC_TMTracer, "string<%p> ", (void*)v.asString());
+        debug_only_printf(LC_TMTracer, "string<%p> ", (void*)v.toString());
         break;
       case JSVAL_TYPE_NULL:
         debug_only_print0(LC_TMTracer, "null ");
         break;
       case JSVAL_TYPE_BOOLEAN:
-        debug_only_printf(LC_TMTracer, "bool<%d> ", v.asBoolean());
+        debug_only_printf(LC_TMTracer, "bool<%d> ", v.toBoolean());
         break;
       case JSVAL_TYPE_UNDEFINED:
         debug_only_print0(LC_TMTracer, "undefined ");
         break;
       case JSVAL_TYPE_MAGIC:
         debug_only_printf(LC_TMTracer, "magic<%d> ", v.whyMagic());
         break;
       case JSVAL_TYPE_FUNOBJ: {
         JS_ASSERT(IsFunctionObject(v));
-        JSFunction* fun = GET_FUNCTION_PRIVATE(cx, &v.asObject());
+        JSFunction* fun = GET_FUNCTION_PRIVATE(cx, &v.toObject());
         debug_only_printf(LC_TMTracer,
-                          "function<%p:%s> ", (void*) &v.asObject(),
+                          "function<%p:%s> ", (void*) &v.toObject(),
                           fun->atom
                           ? JS_GetStringBytes(ATOM_TO_STRING(fun->atom))
                           : "unnamed");
         break;
       }
       case JSVAL_TYPE_BOXED:
         debug_only_printf(LC_TMTracer, "box<%llx> ", v.asRawBits());
         break;
@@ -3843,17 +3843,17 @@ TraceRecorder::known(JSObject** p)
 JS_REQUIRES_STACK void
 TraceRecorder::checkForGlobalObjectReallocation()
 {
     if (global_dslots != globalObj->dslots) {
         debug_only_print0(LC_TMTracer,
                           "globalObj->dslots relocated, updating tracker\n");
         Value* src = global_dslots;
         Value* dst = globalObj->dslots;
-        jsuint length = globalObj->dslots[-1].asPrivateUint32() - JS_INITIAL_NSLOTS;
+        jsuint length = globalObj->dslots[-1].toPrivateUint32() - JS_INITIAL_NSLOTS;
         LIns** map = (LIns**)alloca(sizeof(LIns*) * length);
         for (jsuint n = 0; n < length; ++n) {
             map[n] = tracker.get(src);
             tracker.set(src++, NULL);
         }
         for (jsuint n = 0; n < length; ++n)
             tracker.set(dst++, map[n]);
         global_dslots = globalObj->dslots;
@@ -4009,17 +4009,17 @@ TraceRecorder::determineSlotType(Value* 
             t = importTypeMap[nativeStackSlot(vp)];
         }
         JS_ASSERT(t != JSVAL_TYPE_UNINITIALIZED);
         JS_ASSERT_IF(t == JSVAL_TYPE_INT32, hasInt32Repr(*vp));
         return t;
     }
 
     if (vp->isObject())
-        return vp->asObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
+        return vp->toObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
     return vp->extractNonDoubleObjectTraceType();
 }
 
 class DetermineTypesVisitor : public SlotVisitorBase
 {
     TraceRecorder &mRecorder;
     JSValueType *mTypeMap;
 public:
@@ -4194,17 +4194,17 @@ TraceRecorder::snapshot(ExitType exitTyp
     exit->numGlobalSlots = ngslots;
     exit->numStackSlots = stackSlots;
     exit->numStackSlotsBelowCurrentFrame = cx->fp->argv ?
                                            nativeStackOffset(&cx->fp->argv[-2]) / sizeof(double) :
                                            0;
     exit->exitType = exitType;
     exit->block = fp->blockChain;
     if (fp->blockChain)
-        tree->gcthings.addUnique(ObjectTag(*fp->blockChain));
+        tree->gcthings.addUnique(ObjectValue(*fp->blockChain));
     exit->pc = pc;
     exit->imacpc = fp->imacpc;
     exit->sp_adj = (stackSlots * sizeof(double)) - tree->nativeStackBase;
     exit->rp_adj = exit->calldepth * sizeof(FrameInfo*);
     exit->nativeCalleeWord = 0;
     exit->lookupFlags = js_InferFlags(cx, 0);
     memcpy(exit->fullTypeMap(), typemap, typemap_size);
 
@@ -5627,17 +5627,17 @@ SynthesizeFrame(JSContext* cx, const Fra
     newfp->fun = fun;
     newfp->argc = argc;
     newfp->argv = argv;
 #ifdef DEBUG
     // Initialize argv[-1] to a known-bogus value so we'll catch it if
     // someone forgets to initialize it later.
     newfp->argv[-1].setMagic(JS_THIS_POISON);
 #endif
-    newfp->rval.setUndefined();
+    newfp->rval = UndefinedValue();
     newfp->annotation = NULL;
     newfp->scopeChain = NULL; // will be updated in FlushNativeStackFrame
     newfp->flags = fi.is_constructing() ? JSFRAME_CONSTRUCTING : 0;
     newfp->blockChain = NULL;
     newfp->thisv.setNull(); // will be updated in FlushNativeStackFrame
     newfp->imacpc = NULL;
     if (newscript->staticLevel < JS_DISPLAY_SIZE) {
         JSStackFrame **disp = &cx->display[newscript->staticLevel];
@@ -5690,31 +5690,31 @@ SynthesizeSlowNativeFrame(TracerState& s
      * no space (which will try to deep bail, which is bad), however we already
      * check on entry to ExecuteTree that there is enough space.
      */
     CallStack *cs;
     JSStackFrame *fp;
     cx->stack().getSynthesizedSlowNativeFrame(cx, cs, fp);
 
 #ifdef DEBUG
-    JSObject *callee = &state.nativeVp[0].asObject();
+    JSObject *callee = &state.nativeVp[0].toObject();
     JSFunction *fun = GET_FUNCTION_PRIVATE(cx, callee);
     JS_ASSERT(!fun->isInterpreted() && !fun->isFastNative());
     JS_ASSERT(fun->u.n.extra == 0);
 #endif
 
     fp->imacpc = NULL;
     fp->callobj = NULL;
     fp->argsobj = NULL;
     fp->script = NULL;
     fp->thisv = state.nativeVp[1];
     fp->argc = state.nativeVpLen - 2;
     fp->argv = state.nativeVp + 2;
     fp->fun = GET_FUNCTION_PRIVATE(cx, fp->callee());
-    fp->rval.setUndefined();
+    fp->rval = UndefinedValue();
     fp->annotation = NULL;
     JS_ASSERT(cx->fp->scopeChain);
     fp->scopeChain = cx->fp->scopeChain;
     fp->blockChain = NULL;
     fp->flags = exit->constructing() ? JSFRAME_CONSTRUCTING : 0;
     fp->displaySave = NULL;
 
     state.bailedSlowNativeRegs = *cx->regs;
@@ -6247,17 +6247,17 @@ IsEntryTypeCompatible(const Value &v, JS
     switch (type) {
       case JSVAL_TYPE_DOUBLE:
         if (v.isNumber())
             return true;
         debug_only_printf(LC_TMTracer, "double != tag%c ", tag);
         break;
       case JSVAL_TYPE_INT32: {
         int32_t _;
-        if (v.isInt32() || (v.isDouble() && JSDOUBLE_IS_INT32(v.asDouble(), &_)))
+        if (v.isInt32() || (v.isDouble() && JSDOUBLE_IS_INT32(v.toDouble(), &_)))
             return true;
         debug_only_printf(LC_TMTracer, "int != tag%c ", tag);
         break;
       }
       case JSVAL_TYPE_UNDEFINED:
         if (v.isUndefined())
             return true;
         debug_only_printf(LC_TMTracer, "undefined != tag%c ", tag);
@@ -6281,22 +6281,22 @@ IsEntryTypeCompatible(const Value &v, JS
         if (v.isNull())
             return true;
         debug_only_printf(LC_TMTracer, "null != tag%c ", tag);
         break;
       case JSVAL_TYPE_OBJECT:
         JS_NOT_REACHED("JSVAL_TYPE_OBJECT does not belong in a type map");
         break;
       case JSVAL_TYPE_NONFUNOBJ:
-        if (v.isObject() && !v.asObject().isFunction())
+        if (v.isObject() && !v.toObject().isFunction())
             return true;
         debug_only_printf(LC_TMTracer, "object != tag%c ", tag);
         break;
       case JSVAL_TYPE_FUNOBJ:
-        if (v.isObject() && v.asObject().isFunction())
+        if (v.isObject() && v.toObject().isFunction())
             return true;
         debug_only_printf(LC_TMTracer, "fun != tag%c ", tag);
         break;
       default:
         JS_NOT_REACHED("unexpected type");
     }
     return false;
 }
@@ -6351,17 +6351,17 @@ public:
             mStackSlotNum++;
         }
         return true;
     }
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE bool
     visitFrameObjPtr(JSObject **p, JSStackFrame* fp) {
         debug_only_printf(LC_TMTracer, "%s%u=", stackSlotKind(), 0);
-        if (!IsEntryTypeCompatible(ObjectOrNullTag(*p), *mTypeMap))
+        if (!IsEntryTypeCompatible(ObjectOrNullValue(*p), *mTypeMap))
             mOk = false;
         mTypeMap++;
         mStackSlotNum++;
         return true;
     }
 
     bool isOk() {
         return mOk;
@@ -6434,17 +6434,17 @@ public:
                 break;
             checkSlot(*vp++, stackSlotKind(), i);
         }
         return mOk;
     }
 
     JS_REQUIRES_STACK JS_ALWAYS_INLINE bool
     visitFrameObjPtr(JSObject **p, JSStackFrame *fp) {
-        checkSlot(ObjectOrNullTag(*p), stackSlotKind(), 0);
+        checkSlot(ObjectOrNullValue(*p), stackSlotKind(), 0);
         return mOk;
     }
 
     bool isOk() {
         return mOk;
     }
 };
 
@@ -8606,23 +8606,23 @@ TraceRecorder::ifop()
     } else if (!v.isPrimitive()) {
         cond = true;
         x = lir->insImmI(1);
     } else if (v.isBoolean()) {
         /* Test for boolean is true, negate later if we are testing for false. */
         cond = v.isTrue();
         x = lir->ins2ImmI(LIR_eqi, v_ins, 1);
     } else if (v.isNumber()) {
-        jsdouble d = v.asNumber();
+        jsdouble d = v.toNumber();
         cond = !JSDOUBLE_IS_NaN(d) && d;
         x = lir->ins2(LIR_andi,
                       lir->ins2(LIR_eqd, v_ins, v_ins),
                       lir->insEqI_0(lir->ins2(LIR_eqd, v_ins, lir->insImmD(0))));
     } else if (v.isString()) {
-        cond = v.asString()->length() != 0;
+        cond = v.toString()->length() != 0;
         x = lir->insLoad(LIR_ldp, v_ins, offsetof(JSString, mLength), ACC_OTHER);
     } else {
         JS_NOT_REACHED("ifop");
         return ARECORD_STOP;
     }
 
     jsbytecode* pc = cx->regs->pc;
     emitIf(pc, cond, x);
@@ -8698,23 +8698,23 @@ TraceRecorder::switchop()
 {
     Value& v = stackval(-1);
     LIns* v_ins = get(&v);
 
     /* No need to guard if the condition is constant. */
     if (v_ins->isImmAny())
         return RECORD_CONTINUE;
     if (v.isNumber()) {
-        jsdouble d = v.asNumber();
+        jsdouble d = v.toNumber();
         guard(true,
               addName(lir->ins2(LIR_eqd, v_ins, lir->insImmD(d)),
                       "guard(switch on numeric)"),
               BRANCH_EXIT);
     } else if (v.isString()) {
-        LIns* args[] = { INS_CONSTSTR(v.asString()), v_ins };
+        LIns* args[] = { INS_CONSTSTR(v.toString()), v_ins };
         guard(true,
               addName(lir->insEqI_0(lir->insEqI_0(lir->insCall(&js_EqualStrings_ci, args))),
                       "guard(switch on string)"),
               BRANCH_EXIT);
     } else if (v.isBoolean()) {
         guard(true,
               addName(lir->ins2(LIR_eqi, v_ins, lir->insImmI(v.isTrue())),
                       "guard(switch on boolean)"),
@@ -8756,28 +8756,28 @@ TraceRecorder::inc(const Value &v, LIns*
 /*
  * Do an increment operation without storing anything to the stack.
  */
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::incHelper(const Value &v, LIns* v_ins, LIns*& v_after, jsint incr)
 {
     if (!v.isNumber())
         RETURN_STOP("can only inc numbers");
-    v_after = alu(LIR_addd, v.asNumber(), incr, v_ins, lir->insImmD(incr));
+    v_after = alu(LIR_addd, v.toNumber(), incr, v_ins, lir->insImmD(incr));
     return RECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::incProp(jsint incr, bool pre)
 {
     Value& l = stackval(-1);
     if (l.isPrimitive())
         RETURN_STOP_A("incProp on primitive");
 
-    JSObject* obj = &l.asObject();
+    JSObject* obj = &l.toObject();
     LIns* obj_ins = get(&l);
 
     uint32 slot;
     LIns* v_ins;
     CHECK_STATUS_A(prop(obj, obj_ins, &slot, &v_ins, NULL));
 
     if (slot == SPROP_INVALID_SLOT)
         RETURN_STOP_A("incProp on invalid slot");
@@ -8794,17 +8794,17 @@ JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::incElem(jsint incr, bool pre)
 {
     Value& r = stackval(-1);
     Value& l = stackval(-2);
     Value* vp;
     LIns* v_ins;
     LIns* addr_ins;
 
-    if (!l.isPrimitive() && l.asObject().isDenseArray() && r.isInt32()) {
+    if (!l.isPrimitive() && l.toObject().isDenseArray() && r.isInt32()) {
         guardDenseArray(get(&l), MISMATCH_EXIT);
         CHECK_STATUS(denseArrayElement(l, r, vp, v_ins, addr_ins));
         if (!addr_ins) // if we read a hole, abort
             return RECORD_STOP;
         CHECK_STATUS(inc(*vp, v_ins, incr, pre));
         box_value_into(*vp, v_ins, addr_ins, 0, ACC_OTHER);
         return RECORD_CONTINUE;
     }
@@ -8861,30 +8861,30 @@ TraceRecorder::strictEquality(bool equal
 
     JSValueType ltag = GetPromotedType(l);
     if (ltag != GetPromotedType(r)) {
         cond = !equal;
         x = lir->insImmI(cond);
     } else if (ltag == JSVAL_TYPE_STRING) {
         LIns* args[] = { r_ins, l_ins };
         x = lir->ins2ImmI(LIR_eqi, lir->insCall(&js_EqualStrings_ci, args), equal);
-        cond = !!js_EqualStrings(l.asString(), r.asString());
+        cond = !!js_EqualStrings(l.toString(), r.toString());
     } else {
         LOpcode op;
         if (ltag == JSVAL_TYPE_DOUBLE)
             op = LIR_eqd;
         else if (ltag == JSVAL_TYPE_NULL || ltag == JSVAL_TYPE_NONFUNOBJ || ltag == JSVAL_TYPE_FUNOBJ)
             op = LIR_eqp;
         else
             op = LIR_eqi;
         x = lir->ins2(op, l_ins, r_ins);
         if (!equal)
             x = lir->insEqI_0(x);
         cond = (ltag == JSVAL_TYPE_DOUBLE)
-               ? l.asNumber() == r.asNumber()
+               ? l.toNumber() == r.toNumber()
                : l == r;
     }
     cond = (cond == equal);
 
     if (cmpCase) {
         /* Only guard if the same path may not always be taken. */
         if (!x->isImmI())
             guard(cond, x, BRANCH_EXIT);
@@ -8926,49 +8926,49 @@ TraceRecorder::equalityHelper(Value& l, 
      */
 
     if (GetPromotedType(l) == GetPromotedType(r)) {
         if (l.isUndefined() || l.isNull()) {
             cond = true;
             if (l.isNull())
                 op = LIR_eqp;
         } else if (l.isObject()) {
-            Class *clasp = l.asObject().getClass();
+            Class *clasp = l.toObject().getClass();
             if ((clasp->flags & JSCLASS_IS_EXTENDED) && ((JSExtendedClass*) clasp)->equality)
                 RETURN_STOP_A("Can't trace extended class equality operator");
             op = LIR_eqp;
             cond = (l == r);
         } else if (l.isBoolean()) {
             JS_ASSERT(r.isBoolean());
             cond = (l == r);
         } else if (l.isString()) {
             args[0] = r_ins, args[1] = l_ins;
             l_ins = lir->insCall(&js_EqualStrings_ci, args);
             r_ins = lir->insImmI(1);
-            cond = !!js_EqualStrings(l.asString(), r.asString());
+            cond = !!js_EqualStrings(l.toString(), r.toString());
         } else {
             JS_ASSERT(l.isNumber() && r.isNumber());
-            cond = (l.asNumber() == r.asNumber());
+            cond = (l.toNumber() == r.toNumber());
             op = LIR_eqd;
         }
     } else if (l.isNull() && r.isUndefined()) {
         l_ins = INS_UNDEFINED();
         cond = true;
     } else if (l.isUndefined() && r.isNull()) {
         r_ins = INS_UNDEFINED();
         cond = true;
     } else if (l.isNumber() && r.isString()) {
         args[0] = r_ins, args[1] = cx_ins;
         r_ins = lir->insCall(&js_StringToNumber_ci, args);
-        cond = (l.asNumber() == js_StringToNumber(cx, r.asString()));
+        cond = (l.toNumber() == js_StringToNumber(cx, r.toString()));
         op = LIR_eqd;
     } else if (l.isString() && r.isNumber()) {
         args[0] = l_ins, args[1] = cx_ins;
         l_ins = lir->insCall(&js_StringToNumber_ci, args);
-        cond = (js_StringToNumber(cx, l.asString()) == r.asNumber());
+        cond = (js_StringToNumber(cx, l.toString()) == r.toNumber());
         op = LIR_eqd;
     } else {
         // Below we may assign to l or r, which modifies the interpreter state.
         // This is fine as long as we also update the tracker.
         if (l.isBoolean()) {
             l_ins = i2d(l_ins);
             set(&l, l_ins);
             l.setInt32(l.isTrue());
@@ -9061,17 +9061,17 @@ TraceRecorder::relational(LOpcode op, bo
         return InjectStatus(callImacro(binary_imacros.any_obj));
     }
 
     /* 11.8.5 steps 3, 16-21. */
     if (l.isString() && r.isString()) {
         LIns* args[] = { r_ins, l_ins };
         l_ins = lir->insCall(&js_CompareStrings_ci, args);
         r_ins = lir->insImmI(0);
-        cond = EvalCmp(op, l.asString(), r.asString());
+        cond = EvalCmp(op, l.toString(), r.toString());
         goto do_comparison;
     }
 
     /* 11.8.5 steps 4-5. */
     if (!l.isNumber()) {
         LIns* args[] = { l_ins, cx_ins };
         if (l.isBoolean()) {
             l_ins = i2d(l_ins);
@@ -9190,47 +9190,47 @@ TraceRecorder::binary(LOpcode op)
         return callImacro(binary_imacros.any_obj);
     }
 
     bool intop = retTypes[op] == LTy_I;
     LIns* a = get(&l);
     LIns* b = get(&r);
 
     bool leftIsNumber = l.isNumber();
-    jsdouble lnum = leftIsNumber ? l.asNumber() : 0;
+    jsdouble lnum = leftIsNumber ? l.toNumber() : 0;
 
     bool rightIsNumber = r.isNumber();
-    jsdouble rnum = rightIsNumber ? r.asNumber() : 0;
+    jsdouble rnum = rightIsNumber ? r.toNumber() : 0;
 
     if (l.isString()) {
         NanoAssert(op != LIR_addd); // LIR_addd/IS_STRING case handled by record_JSOP_ADD()
         LIns* args[] = { a, cx_ins };
         a = lir->insCall(&js_StringToNumber_ci, args);
-        lnum = js_StringToNumber(cx, l.asString());
+        lnum = js_StringToNumber(cx, l.toString());
         leftIsNumber = true;
     }
     if (r.isString()) {
         NanoAssert(op != LIR_addd); // LIR_addd/IS_STRING case handled by record_JSOP_ADD()
         LIns* args[] = { b, cx_ins };
         b = lir->insCall(&js_StringToNumber_ci, args);
-        rnum = js_StringToNumber(cx, r.asString());
+        rnum = js_StringToNumber(cx, r.toString());
         rightIsNumber = true;
     }
     if (l.isBoolean()) {
         a = i2d(a);
-        lnum = l.asBoolean();
+        lnum = l.toBoolean();
         leftIsNumber = true;
     } else if (l.isUndefined()) {
         a = lir->insImmD(js_NaN);
         lnum = js_NaN;
         leftIsNumber = true;
     }
     if (r.isBoolean()) {
         b = i2d(b);
-        rnum = r.asBoolean();
+        rnum = r.toBoolean();
         rightIsNumber = true;
     } else if (r.isUndefined()) {
         b = lir->insImmD(js_NaN);
         rnum = js_NaN;
         rightIsNumber = true;
     }
     if (leftIsNumber && rightIsNumber) {
         if (intop) {
@@ -9685,17 +9685,17 @@ TraceRecorder::unbox_value(const Value &
     }
 
     if (v.isDouble()) {
         guard(true, lir->ins2(LIR_ltui, tag_ins, INS_CONSTU(JSVAL_TAG_CLEAR)), exit);
         return lir->insLoad(LIR_ldd, vaddr_ins, offset + sPayloadOffset, accSet);
     }
 
     if (v.isObject()) {
-        JSValueType type = v.asObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
+        JSValueType type = v.toObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
         return unbox_object(vaddr_ins, offset, tag_ins, type, exit, accSet);
     }
 
     JSValueType type = v.extractNonDoubleObjectTraceType();
     return unbox_non_double_object(vaddr_ins, offset, tag_ins, type, exit, accSet);
 }
 
 void
@@ -9867,17 +9867,17 @@ TraceRecorder::unbox_value(const Value &
 
     if (v.isDouble()) {
         guard(true, lir->ins2(LIR_leuq, v_ins, INS_CONSTQWORD(JSVAL_SHIFTED_TAG_MAX_DOUBLE)), exit);
         /* Without LIR_q2d, we need to re-load the value. */
         return lir->insLoad(LIR_ldd, vaddr_ins, offset, accSet);
     }
 
     if (v.isObject()) {
-        JSValueType type = v.asObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
+        JSValueType type = v.toObject().isFunction() ? JSVAL_TYPE_FUNOBJ : JSVAL_TYPE_NONFUNOBJ;
         return unbox_object(v_ins, type, exit);
     }
 
     JSValueType type = v.extractNonDoubleObjectTraceType();
     return unbox_non_double_object(v_ins, type, exit);
 }
 
 void
@@ -9984,21 +9984,21 @@ TraceRecorder::unbox_int_id(LIns *id_ins
 }
 
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::getThis(LIns*& this_ins)
 {
     /*
      * JSStackFrame::getThisObject updates cx->fp->argv[-1], so sample it into 'original' first.
      */
-    Value original = NullTag();
+    Value original = NullValue();
     if (cx->fp->argv) {
         original = cx->fp->argv[-1];
         if (!original.isPrimitive()) {
-            if (original.asObject().hasClass(&js_WithClass))
+            if (original.toObject().hasClass(&js_WithClass))
                 RETURN_STOP("can't trace getThis on With object");
             guardNotClass(get(&cx->fp->argv[-1]), &js_WithClass, snapshot(MISMATCH_EXIT),
                           ACC_OTHER);
         }
     }
 
     JSObject* thisObj = cx->fp->getThisObject(cx);
     if (!thisObj)
@@ -10024,17 +10024,17 @@ TraceRecorder::getThis(LIns*& this_ins)
      * a null value in argv[-1], this trace will only match if we see null at
      * runtime as well.  Bake in the global object as 'this' object, updating
      * the tracker as well. We can only detect this condition prior to calling
      * JSStackFrame::getThisObject, since it updates the interpreter's copy of
      * argv[-1].
      */
     Class* clasp = NULL;
     if (original.isNull() ||
-        (((clasp = original.asObject().getClass()) == &js_CallClass) ||
+        (((clasp = original.toObject().getClass()) == &js_CallClass) ||
          (clasp == &js_BlockClass))) {
         if (clasp)
             guardClass(get(&thisv), clasp, snapshot(BRANCH_EXIT), ACC_OTHER);
         JS_ASSERT(!thisv.isPrimitive());
         if (thisObj != globalObj)
             RETURN_STOP("global object was wrapped while recording");
         this_ins = INS_CONSTOBJ(thisObj);
         set(&thisv, this_ins);
@@ -10129,17 +10129,17 @@ TraceRecorder::guardPrototypeHasNoIndexe
 
 /*
  * Guard that the object stored in v has the ECMA standard [[DefaultValue]]
  * method. Several imacros require this.
  */
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::guardNativeConversion(Value& v)
 {
-    JSObject* obj = &v.asObject();
+    JSObject* obj = &v.toObject();
     LIns* obj_ins = get(&v);
 
     if (obj->map->ops->defaultValue != js_DefaultValue)
         RETURN_STOP("operand has non-native defaultValue op");
     ConvertOp convert = obj->getClass()->convert;
     if (convert != Valueify(JS_ConvertStub) && convert != js_TryValueOf)
         RETURN_STOP("operand has convert hook");
 
@@ -10831,19 +10831,19 @@ TraceRecorder::record_JSOP_NEG()
         /*
          * If we're a promoted integer, we have to watch out for 0s since -0 is
          * a double. Only follow this path if we're not an integer that's 0 and
          * we're not a double that's zero.
          */
         if (oracle &&
             !oracle->isInstructionUndemotable(cx->regs->pc) &&
             isPromoteInt(a) &&
-            (!v.isInt32() || v.asInt32() != 0) &&
-            (!v.isDouble() || !JSDOUBLE_IS_NEGZERO(v.asDouble())) &&
-            -v.asNumber() == (int)-v.asNumber())
+            (!v.isInt32() || v.toInt32() != 0) &&
+            (!v.isDouble() || !JSDOUBLE_IS_NEGZERO(v.toDouble())) &&
+            -v.toNumber() == (int)-v.toNumber())
         {
             VMSideExit* exit = snapshot(OVERFLOW_EXIT);
             a = guard_xov(LIR_subi, lir->insImmI(0), demote(lir, a), exit);
             if (!a->isImmI() && a->isop(LIR_subxovi)) {
                 guard(false, lir->ins2ImmI(LIR_eqi, a, 0), exit); // make sure we don't lose a -0
             }
             a = lir->ins1(LIR_i2d, a);
         } else {
@@ -10951,17 +10951,17 @@ TraceRecorder::getClassPrototype(JSObjec
     JS_ASSERT(ok);
     JS_ASSERT(found);
     JS_ASSERT((~attrs & (JSPROP_READONLY | JSPROP_PERMANENT)) == 0);
 #endif
 
     // Since ctor was built by js_InitClass, we can assert (rather than check)
     // that pval is usable.
     JS_ASSERT(!pval.isPrimitive());
-    JSObject *proto = &pval.asObject();
+    JSObject *proto = &pval.toObject();
     JS_ASSERT_IF(clasp != &js_ArrayClass, proto->scope()->emptyScope->clasp == clasp);
 
     proto_ins = INS_CONSTOBJ(proto);
     return RECORD_CONTINUE;
 }
 
 RecordingStatus
 TraceRecorder::getClassPrototype(JSProtoKey key, LIns*& proto_ins)
@@ -11127,20 +11127,20 @@ TraceRecorder::emitNativeCall(JSSpeciali
         // This needs to capture the pre-call state of the stack. So do not set
         // pendingSpecializedNative before taking this snapshot.
         JS_ASSERT(!pendingSpecializedNative);
 
         // Take snapshot for DeepBail and store it in cx->bailExit.
         // If we are calling a slow native, add information to the side exit
         // for SynthesizeSlowNativeFrame.
         VMSideExit* exit = enterDeepBailCall();
-        JSObject* funobj = &stackval(0 - (2 + argc)).asObject();
+        JSObject* funobj = &stackval(0 - (2 + argc)).toObject();
         if (FUN_SLOW_NATIVE(GET_FUNCTION_PRIVATE(cx, funobj))) {
             exit->setNativeCallee(funobj, constructing);
-            tree->gcthings.addUnique(ObjectTag(*funobj));
+            tree->gcthings.addUnique(ObjectValue(*funobj));
         }
     }
 
     LIns* res_ins = lir->insCall(sn->builtin, args);
 
     // Immediately unroot the vp as soon we return since we might deep bail next.
     if (rooted)
         lir->insStore(INS_NULL(), lirbuf->state, offsetof(TracerState, nativeVp), ACC_OTHER);
@@ -11217,19 +11217,19 @@ TraceRecorder::callSpecializedNative(JSN
                 if (tval.isPrimitive())
                     goto next_specialization;
                 *argp = this_ins;
             } else if (argtype == 'S') { /* this, as a string */
                 if (!tval.isString())
                     goto next_specialization;
                 *argp = this_ins;
             } else if (argtype == 'f') {
-                *argp = INS_CONSTOBJ(&fval.asObject());
+                *argp = INS_CONSTOBJ(&fval.toObject());
             } else if (argtype == 'p') {
-                CHECK_STATUS(getClassPrototype(&fval.asObject(), *argp));
+                CHECK_STATUS(getClassPrototype(&fval.toObject(), *argp));
             } else if (argtype == 'R') {
                 *argp = INS_CONSTPTR(cx->runtime);
             } else if (argtype == 'P') {
                 // FIXME: Set pc to imacpc when recording JSOP_CALL inside the
                 //        JSOP_GETELEM imacro (bug 476559).
                 if ((*pc == JSOP_CALL) &&
                     fp->imacpc && *fp->imacpc == JSOP_GETELEM)
                     *argp = INS_CONSTPTR(fp->imacpc);
@@ -11288,17 +11288,17 @@ next_specialization:;
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::callNative(uintN argc, JSOp mode)
 {
     LIns* args[5];
 
     JS_ASSERT(mode == JSOP_CALL || mode == JSOP_NEW || mode == JSOP_APPLY);
 
     Value* vp = &stackval(0 - (2 + argc));
-    JSObject* funobj = &vp[0].asObject();
+    JSObject* funobj = &vp[0].toObject();
     JSFunction* fun = GET_FUNCTION_PRIVATE(cx, funobj);
     FastNative native = (FastNative)fun->u.n.native;
 
     switch (argc) {
       case 1:
         if (vp[2].isNumber() &&
             (native == js_math_ceil || native == js_math_floor || native == js_math_round)) {
             LIns* a = get(&vp[2]);
@@ -11397,17 +11397,17 @@ TraceRecorder::callNative(uintN argc, JS
             if (vp[1].isNull()) {
                 JSObject* thisObj = ComputeThisFromVp(cx, vp + 2);
                 if (!thisObj)
                     RETURN_ERROR("error in js_ComputeGlobalThis");
                 this_ins = INS_CONSTOBJ(thisObj);
             } else if (!vp[1].isObject()) {
                 RETURN_STOP("slow native(primitive, args)");
             } else {
-                if (vp[1].asObject().hasClass(&js_WithClass))
+                if (vp[1].toObject().hasClass(&js_WithClass))
                     RETURN_STOP("can't trace slow native invocation on With object");
                 guardNotClass(this_ins, &js_WithClass, snapshot(MISMATCH_EXIT), ACC_READONLY);
 
                 this_ins = lir->insChoose(lir->insEqP_0(stobj_get_parent(this_ins)),
                                            INS_CONSTOBJ(globalObj),
                                            this_ins, avmplus::AvmCore::use_cmov());
             }
         }
@@ -11513,36 +11513,36 @@ TraceRecorder::functionCall(uintN argc, 
      * or JSOP_CALLPROP that callee is a *particular* function, since these hit
      * the property cache and guard on the object (this) in which the callee
      * was found. So it's sufficient to test here that the particular function
      * is interpreted, not guard on that condition.
      *
      * Bytecode sequences that push shapeless callees must guard on the callee
      * class being Function and the function being interpreted.
      */
-    JSFunction* fun = GET_FUNCTION_PRIVATE(cx, &fval.asObject());
+    JSFunction* fun = GET_FUNCTION_PRIVATE(cx, &fval.toObject());
 
     if (FUN_INTERPRETED(fun)) {
         if (mode == JSOP_NEW) {
             LIns* args[] = { get(&fval), INS_CONSTPTR(&js_ObjectClass), cx_ins };
             LIns* tv_ins = lir->insCall(&js_NewInstance_ci, args);
             guard(false, lir->insEqP_0(tv_ins), OOM_EXIT);
             set(&tval, tv_ins);
         }
         return interpretedFunctionCall(fval, fun, argc, mode == JSOP_NEW);
     }
 
     if (FUN_SLOW_NATIVE(fun)) {
         Native native = fun->u.n.native;
         Value* argv = &tval + 1;
         if (native == js_Array)
-            return newArray(&fval.asObject(), argc, argv, &fval);
+            return newArray(&fval.toObject(), argc, argv, &fval);
         if (native == js_String && argc == 1) {
             if (mode == JSOP_NEW)
-                return newString(&fval.asObject(), 1, argv, &fval);
+                return newString(&fval.toObject(), 1, argv, &fval);
             if (!argv[0].isPrimitive()) {
                 CHECK_STATUS(guardNativeConversion(argv[0]));
                 return callImacro(call_imacros.String);
             }
             set(&fval, stringify(argv[0]));
             pendingSpecializedNative = IGNORE_NATIVE_CALL_COMPLETE_CALLBACK;
             return RECORD_CONTINUE;
         }
@@ -11564,49 +11564,49 @@ TraceRecorder::record_JSOP_DELNAME()
 {
     return ARECORD_STOP;
 }
 
 JSBool JS_FASTCALL
 DeleteIntKey(JSContext* cx, JSObject* obj, int32 i)
 {
     LeaveTraceIfGlobalObject(cx, obj);
-    Value v = BooleanTag(false);
+    Value v = BooleanValue(false);
     jsid id = INT_TO_JSID(i);
     if (!obj->deleteProperty(cx, id, &v))
         SetBuiltinError(cx);
-    return v.asBoolean();
+    return v.toBoolean();
 }
 JS_DEFINE_CALLINFO_3(extern, BOOL_FAIL, DeleteIntKey, CONTEXT, OBJECT, INT32, 0, ACC_STORE_ANY)
 
 JSBool JS_FASTCALL
 DeleteStrKey(JSContext* cx, JSObject* obj, JSString* str)
 {
     LeaveTraceIfGlobalObject(cx, obj);
-    Value v = BooleanTag(false);
+    Value v = BooleanValue(false);
     jsid id;
 
     /*
      * NB: JSOP_DELPROP does not need js_ValueToStringId to atomize, but (see
      * jsatominlines.h) that helper early-returns if the computed property name
      * string is already atomized, and we are *not* on a perf-critical path!
      */
-    if (!js_ValueToStringId(cx, StringTag(str), &id) || !obj->deleteProperty(cx, id, &v))
+    if (!js_ValueToStringId(cx, StringValue(str), &id) || !obj->deleteProperty(cx, id, &v))
         SetBuiltinError(cx);
-    return v.asBoolean();
+    return v.toBoolean();
 }
 JS_DEFINE_CALLINFO_3(extern, BOOL_FAIL, DeleteStrKey, CONTEXT, OBJECT, STRING, 0, ACC_STORE_ANY)
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_DELPROP()
 {
     Value& lval = stackval(-1);
     if (lval.isPrimitive())
         RETURN_STOP_A("JSOP_DELPROP on primitive base expression");
-    if (&lval.asObject() == globalObj)
+    if (&lval.toObject() == globalObj)
         RETURN_STOP_A("JSOP_DELPROP on global property");
 
     JSAtom* atom = atoms[GET_INDEX(cx->regs->pc)];
 
     enterDeepBailCall();
     LIns* args[] = { INS_ATOM(atom), get(&lval), cx_ins };
     LIns* rval_ins = lir->insCall(&DeleteStrKey_ci, args);
 
@@ -11621,17 +11621,17 @@ TraceRecorder::record_JSOP_DELPROP()
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_DELELEM()
 {
     Value& lval = stackval(-2);
     if (lval.isPrimitive())
         RETURN_STOP_A("JSOP_DELELEM on primitive base expression");
-    if (&lval.asObject() == globalObj)
+    if (&lval.toObject() == globalObj)
         RETURN_STOP_A("JSOP_DELELEM on global property");
 
     Value& idx = stackval(-1);
     LIns* rval_ins;
 
     enterDeepBailCall();
     if (hasInt32Repr(idx)) {
         LIns* args[] = { makeNumberInt32(get(&idx)), get(&lval), cx_ins };
@@ -11664,17 +11664,17 @@ TraceRecorder::record_JSOP_TYPEOF()
         type = INS_ATOM(cx->runtime->atomState.typeAtoms[JSTYPE_NUMBER]);
     } else if (r.isUndefined()) {
         type = INS_ATOM(cx->runtime->atomState.typeAtoms[JSTYPE_VOID]);
     } else if (r.isBoolean()) {
         type = INS_ATOM(cx->runtime->atomState.typeAtoms[JSTYPE_BOOLEAN]);
     } else if (r.isNull()) {
         type = INS_ATOM(cx->runtime->atomState.typeAtoms[JSTYPE_OBJECT]);
     } else {
-        if (r.asObject().isFunction()) {
+        if (r.toObject().isFunction()) {
             type = INS_ATOM(cx->runtime->atomState.typeAtoms[JSTYPE_FUNCTION]);
         } else {
             LIns* args[] = { get(&r), cx_ins };
             type = lir->insCall(&js_TypeOfObject_ci, args);
         }
     }
     set(&r, type);
     return ARECORD_CONTINUE;
@@ -11794,17 +11794,17 @@ TraceRecorder::record_JSOP_GETPROP()
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_SETPROP()
 {
     Value& l = stackval(-2);
     if (l.isPrimitive())
         RETURN_STOP_A("primitive this for SETPROP");
 
-    JSObject* obj = &l.asObject();
+    JSObject* obj = &l.toObject();
     if (obj->map->ops->setProperty != js_SetProperty)
         RETURN_STOP_A("non-native JSObjectOps::setProperty");
     return ARECORD_CONTINUE;
 }
 
 /* Emit a specialized, inlined copy of js_NativeSet. */
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::nativeSet(JSObject* obj, LIns* obj_ins, JSScopeProperty* sprop,
@@ -11854,17 +11854,17 @@ TraceRecorder::nativeSet(JSObject* obj, 
     return RECORD_CONTINUE;
 }
 
 static JSBool FASTCALL
 MethodWriteBarrier(JSContext* cx, JSObject* obj, JSScopeProperty* sprop, JSObject* funobj)
 {
     AutoObjectRooter tvr(cx, funobj);
 
-    return obj->scope()->methodWriteBarrier(cx, sprop, ObjectTag(*tvr.object()));
+    return obj->scope()->methodWriteBarrier(cx, sprop, ObjectValue(*tvr.object()));
 }
 JS_DEFINE_CALLINFO_4(static, BOOL_FAIL, MethodWriteBarrier, CONTEXT, OBJECT, SCOPEPROP, OBJECT,
                      0, ACC_STORE_ANY)
 
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::setProp(Value &l, PropertyCacheEntry* entry, JSScopeProperty* sprop,
                        Value &v, LIns*& v_ins, bool isDefinitelyAtom)
 {
@@ -11878,17 +11878,17 @@ TraceRecorder::setProp(Value &l, Propert
 
     // These two cases are errors and can't be traced.
     if (sprop->hasGetterValue())
         RETURN_STOP("can't assign to property with script getter but no setter");
     if (!sprop->writable())
         RETURN_STOP("can't assign to readonly property");
 
     JS_ASSERT(!l.isPrimitive());
-    JSObject* obj = &l.asObject();
+    JSObject* obj = &l.toObject();
     LIns* obj_ins = get(&l);
 
     JS_ASSERT_IF(entry->directHit(), obj->scope()->hasProperty(sprop));
 
     // Fast path for CallClass. This is about 20% faster than the general case.
     v_ins = get(&v);
     if (obj->getClass() == &js_CallClass)
         return setCallProp(obj, obj_ins, sprop, v_ins, v);
@@ -12374,34 +12374,34 @@ TraceRecorder::getPropertyWithScriptGett
     Value getter = sprop->getterValue();
     Value*& sp = cx->regs->sp;
     switch (*cx->regs->pc) {
       case JSOP_GETPROP:
         sp++;
         sp[-1] = sp[-2];
         set(&sp[-1], get(&sp[-2]));
         sp[-2] = getter;
-        set(&sp[-2], INS_CONSTOBJ(&getter.asObject()));
+        set(&sp[-2], INS_CONSTOBJ(&getter.toObject()));
         return callImacroInfallibly(getprop_imacros.scriptgetter);
 
       case JSOP_CALLPROP:
         sp += 2;
         sp[-2] = getter;
-        set(&sp[-2], INS_CONSTOBJ(&getter.asObject()));
+        set(&sp[-2], INS_CONSTOBJ(&getter.toObject()));
         sp[-1] = sp[-3];
         set(&sp[-1], get(&sp[-3]));
         return callImacroInfallibly(callprop_imacros.scriptgetter);
 
       case JSOP_GETTHISPROP:
       case JSOP_GETARGPROP:
       case JSOP_GETLOCALPROP:
         sp += 2;
         sp[-2] = getter;
-        set(&sp[-2], INS_CONSTOBJ(&getter.asObject()));
-        sp[-1] = ObjectTag(*obj);
+        set(&sp[-2], INS_CONSTOBJ(&getter.toObject()));
+        sp[-1] = ObjectValue(*obj);
         set(&sp[-1], obj_ins);
         return callImacroInfallibly(getthisprop_imacros.scriptgetter);
 
       default:
         RETURN_STOP("cannot trace script getter for this opcode");
     }
 }
 
@@ -12423,48 +12423,48 @@ TraceRecorder::record_JSOP_GETELEM()
     LIns* obj_ins = get(&lval);
     LIns* idx_ins = get(&idx);
 
     // Special case for array-like access of strings.
     if (lval.isString() && hasInt32Repr(idx)) {
         if (call)
             RETURN_STOP_A("JSOP_CALLELEM on a string");
         int i = asInt32(idx);
-        if (size_t(i) >= lval.asString()->length())
+        if (size_t(i) >= lval.toString()->length())
             RETURN_STOP_A("Invalid string index in JSOP_GETELEM");
         idx_ins = makeNumberInt32(idx_ins);
         LIns* args[] = { idx_ins, obj_ins, cx_ins };
         LIns* unitstr_ins = lir->insCall(&js_String_getelem_ci, args);
         guard(false, lir->insEqP_0(unitstr_ins), MISMATCH_EXIT);
         set(&lval, unitstr_ins);
         return ARECORD_CONTINUE;
     }
 
     if (lval.isPrimitive())
         RETURN_STOP_A("JSOP_GETLEM on a primitive");
     RETURN_IF_XML_A(lval);
 
-    JSObject* obj = &lval.asObject();
+    JSObject* obj = &lval.toObject();
     if (obj == globalObj)
         RETURN_STOP_A("JSOP_GETELEM on global");
     LIns* v_ins;
 
     /* Property access using a string name or something we have to stringify. */
     if (!idx.isInt32()) {
         if (!idx.isPrimitive())
             RETURN_STOP_A("object used as index");
 
         return InjectStatus(getPropertyByName(obj_ins, &idx, &lval));
     }
 
     if (obj->isArguments()) {
         unsigned depth;
         JSStackFrame *afp = guardArguments(obj, obj_ins, &depth);
         if (afp) {
-            uintN int_idx = idx.asInt32();
+            uintN int_idx = idx.toInt32();
             Value* vp = &afp->argv[int_idx];
             if (idx_ins->isImmD()) {
                 if (int_idx < 0 || int_idx >= afp->argc)
                     RETURN_STOP_A("cannot trace arguments with out of range index");
                 v_ins = get(vp);
             } else {
                 // If the index is not a constant expression, we generate LIR to load the value from
                 // the native stack area. The guard on js_ArgumentClass above ensures the up-to-date
@@ -12687,17 +12687,17 @@ TraceRecorder::setElem(int lval_spindex,
     Value& v = stackval(v_spindex);
     Value& idx = stackval(idx_spindex);
     Value& lval = stackval(lval_spindex);
 
     if (lval.isPrimitive())
         RETURN_STOP_A("left JSOP_SETELEM operand is not an object");
     RETURN_IF_XML_A(lval);
 
-    JSObject* obj = &lval.asObject();
+    JSObject* obj = &lval.toObject();
     LIns* obj_ins = get(&lval);
     LIns* idx_ins = get(&idx);
     LIns* v_ins = get(&v);
 
     if (InstanceOf(cx, obj, &js_ArgumentsClass, NULL))
         RETURN_STOP_A("can't trace setting elements of the |arguments| object");
 
     if (obj == globalObj)
@@ -12815,17 +12815,17 @@ TraceRecorder::setElem(int lval_spindex,
             break;
           case js::TypedArray::TYPE_FLOAT64:
             addr_ins = lir->ins2(LIR_addp, data_ins, lir->ins2ImmI(LIR_lshp, pidx_ins, 3));
             lir->insStore(LIR_std, typed_v_ins, addr_ins, 0, ACC_OTHER);
             break;
           default:
             JS_NOT_REACHED("Unknown typed array type in tracer");       
         }
-    } else if (idx.asInt32() < 0 || !obj->isDenseArray()) {
+    } else if (idx.toInt32() < 0 || !obj->isDenseArray()) {
         CHECK_STATUS_A(initOrSetPropertyByIndex(obj_ins, idx_ins, &v,
                                                 *cx->regs->pc == JSOP_INITELEM));
     } else {
         // Fast path: assigning to element of dense array.
 
         // Make sure the array is actually dense.
         if (!obj->isDenseArray()) 
             return ARECORD_STOP;
@@ -13057,17 +13057,17 @@ TraceRecorder::record_JSOP_CALLDSLOT()
     CHECK_STATUS_A(record_JSOP_GETDSLOT());
     stack(1, INS_NULL());
     return ARECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::guardCallee(Value& callee)
 {
-    JSObject* callee_obj = &callee.asObject();
+    JSObject* callee_obj = &callee.toObject();
     JS_ASSERT(callee_obj->isFunction());
     JSFunction* callee_fun = (JSFunction*) callee_obj->getPrivate();
 
     /*
      * First, guard on the callee's function (JSFunction*) identity. This is
      * necessary since tracing always inlines function calls. But note that
      * TR::functionCall avoids calling TR::guardCallee for constant methods
      * (those hit in the property cache from JSOP_CALLPROP).
@@ -13158,17 +13158,17 @@ TraceRecorder::interpretedFunctionCall(V
      * and does not call any TR::record_*CallComplete hook.
      */
     if (fun->u.i.script->isEmpty()) {
         LIns* rval_ins = constructing ? stack(-1 - argc) : INS_UNDEFINED();
         stack(-2 - argc, rval_ins);
         return RECORD_CONTINUE;
     }
 
-    if (fval.asObject().getGlobal() != globalObj)
+    if (fval.toObject().getGlobal() != globalObj)
         RETURN_STOP("JSOP_CALL or JSOP_NEW crosses global scopes");
 
     JSStackFrame* const fp = cx->fp;
 
     // Generate a type map for the outgoing frame and stash it in the LIR
     unsigned stackSlots = NativeStackSlots(cx, 0 /* callDepth */);
     FrameInfo* fi = (FrameInfo*)
         tempAlloc().alloc(sizeof(FrameInfo) + stackSlots * sizeof(JSValueType));
@@ -13177,17 +13177,17 @@ TraceRecorder::interpretedFunctionCall(V
     DetermineTypesVisitor detVisitor(*this, typemap);
     VisitStackSlots(detVisitor, cx, 0);
 
     JS_ASSERT(argc < FrameInfo::CONSTRUCTING_FLAG);
 
     tree->gcthings.addUnique(fval);
     fi->block = fp->blockChain;
     if (fp->blockChain)
-        tree->gcthings.addUnique(ObjectTag(*fp->blockChain));
+        tree->gcthings.addUnique(ObjectValue(*fp->blockChain));
     fi->pc = cx->regs->pc;
     fi->imacpc = fp->imacpc;
     fi->spdist = cx->regs->sp - fp->slots();
     fi->set_argc(uint16(argc), constructing);
     fi->callerHeight = stackSlots - (2 + argc);
     fi->callerArgc = fp->argc;
 
     if (callDepth >= tree->maxCallDepth)
@@ -13258,17 +13258,17 @@ TraceRecorder::record_JSOP_APPLY()
     LIns* aobj_ins = NULL;
 
     JS_ASSERT(!cx->fp->imacpc);
 
     if (!IsFunctionObject(vp[0]))
         return record_JSOP_CALL();
     RETURN_IF_XML_A(vp[0]);
 
-    JSObject* obj = &vp[0].asObject();
+    JSObject* obj = &vp[0].toObject();
     JSFunction* fun = GET_FUNCTION_PRIVATE(cx, obj);
     if (FUN_INTERPRETED(fun))
         return record_JSOP_CALL();
 
     bool apply = (FastNative)fun->u.n.native == js_fun_apply;
     if (!apply && (FastNative)fun->u.n.native != js_fun_call)
         return record_JSOP_CALL();
 
@@ -13286,17 +13286,17 @@ TraceRecorder::record_JSOP_APPLY()
         RETURN_STOP_A("callee is not a function");
     CHECK_STATUS_A(guardCallee(vp[1]));
 
     if (apply && argc >= 2) {
         if (argc != 2)
             RETURN_STOP_A("apply with excess arguments");
         if (vp[3].isPrimitive())
             RETURN_STOP_A("arguments parameter of apply is primitive");
-        aobj = &vp[3].asObject();
+        aobj = &vp[3].toObject();
         aobj_ins = get(&vp[3]);
 
         /*
          * We trace dense arrays and arguments objects. The code we generate
          * for apply uses imacros to handle a specific number of arguments.
          */
         if (aobj->isDenseArray()) {
             guardDenseArray(aobj_ins, MISMATCH_EXIT);
@@ -13464,22 +13464,22 @@ TraceRecorder::name(Value*& vp, LIns*& i
     ins = get(vp);
     nr.tracked = true;
     return ARECORD_CONTINUE;
 }
 
 static JSObject* FASTCALL
 MethodReadBarrier(JSContext* cx, JSObject* obj, JSScopeProperty* sprop, JSObject* funobj)
 {
-    Value v = ObjectTag(*funobj);
+    Value v = ObjectValue(*funobj);
     AutoValueRooter tvr(cx, v);
 
     if (!obj->scope()->methodReadBarrier(cx, sprop, tvr.addr()))
         return NULL;
-    return &tvr.value().asObject();
+    return &tvr.value().toObject();
 }
 JS_DEFINE_CALLINFO_4(static, OBJECT_FAIL, MethodReadBarrier, CONTEXT, OBJECT, SCOPEPROP, OBJECT,
                      0, ACC_STORE_ANY)
 
 /*
  * Get a property. The current opcode has JOF_ATOM.
  *
  * There are two modes. The caller must pass nonnull pointers for either outp
@@ -13644,19 +13644,19 @@ TraceRecorder::propTail(JSObject* obj, L
 }
 
 JS_REQUIRES_STACK RecordingStatus
 TraceRecorder::denseArrayElement(Value& oval, Value& ival, Value*& vp, LIns*& v_ins,
                                  LIns*& addr_ins)
 {
     JS_ASSERT(oval.isObject() && ival.isInt32());
 
-    JSObject* obj = &oval.asObject();
+    JSObject* obj = &oval.toObject();
     LIns* obj_ins = get(&oval);
-    jsint idx = ival.asInt32();
+    jsint idx = ival.toInt32();
     LIns* idx_ins = makeNumberInt32(get(&ival));
 
     VMSideExit* exit = snapshot(BRANCH_EXIT);
     /* check that the index is within bounds */
     LIns* dslots_ins =
         addName(lir->insLoad(LIR_ldp, obj_ins, offsetof(JSObject, dslots), ACC_OTHER), "dslots");
     jsuint capacity = obj->getDenseArrayCapacity();
     bool within = (jsuint(idx) < obj->getArrayLength() && jsuint(idx) < capacity);
@@ -13703,19 +13703,19 @@ TraceRecorder::denseArrayElement(Value& 
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::typedArrayElement(Value& oval, Value& ival, Value*& vp, LIns*& v_ins,
                                  LIns*& addr_ins)
 {
     JS_ASSERT(oval.isObject() && ival.isInt32());
 
-    JSObject* obj = &oval.asObject();
+    JSObject* obj = &oval.toObject();
     LIns* obj_ins = get(&oval);
-    jsint idx = ival.asInt32();
+    jsint idx = ival.toInt32();
     LIns* idx_ins = makeNumberInt32(get(&ival));
     LIns* pidx_ins = lir->insUI2P(idx_ins);
 
     js::TypedArray* tarray = js::TypedArray::fromJSObject(obj);
     JS_ASSERT(tarray);
 
     /* priv_ins will load the TypedArray* */
     LIns* priv_ins = stobj_get_const_private_ptr(obj_ins);
@@ -13802,34 +13802,34 @@ TraceRecorder::getProp(JSObject* obj, LI
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::getProp(Value& v)
 {
     if (v.isPrimitive())
         RETURN_STOP_A("primitive lhs");
 
-    return getProp(&v.asObject(), get(&v));
+    return getProp(&v.toObject(), get(&v));
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_NAME()
 {
     Value* vp;
     LIns* v_ins;
     NameResult nr;
     CHECK_STATUS_A(name(vp, v_ins, nr));
     stack(0, v_ins);
     return ARECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_DOUBLE()
 {
-    double d = consts[GET_INDEX(cx->regs->pc)].asDouble();
+    double d = consts[GET_INDEX(cx->regs->pc)].toDouble();
     stack(0, lir->insImmD(d));
     return ARECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_STRING()
 {
     JSAtom* atom = atoms[GET_INDEX(cx->regs->pc)];
@@ -14091,23 +14091,23 @@ TraceRecorder::record_JSOP_IMACOP()
 {
     JS_ASSERT(cx->fp->imacpc);
     return ARECORD_CONTINUE;
 }
 
 static JSBool FASTCALL
 ObjectToIterator(JSContext* cx, JSObject *obj, int32 flags, JSObject **objp)
 {
-    AutoValueRooter tvr(cx, ObjectTag(*obj));
+    AutoValueRooter tvr(cx, ObjectValue(*obj));
     bool ok = js_ValueToIterator(cx, flags, tvr.addr());
     if (!ok) {
         SetBuiltinError(cx);
         return false;
     }
-    *objp = &tvr.value().asObject();
+    *objp = &tvr.value().toObject();
     return cx->tracerState->builtinStatus == 0;
 }
 JS_DEFINE_CALLINFO_4(static, BOOL_FAIL, ObjectToIterator, CONTEXT, OBJECT, INT32, OBJECTPTR, 0,
                      ACC_STORE_ANY)
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_ITER()
 {
@@ -14154,17 +14154,17 @@ JS_REQUIRES_STACK AbortableRecordingStat
 TraceRecorder::record_JSOP_MOREITER()
 {
     Value& iterobj_val = stackval(-1);
     if (iterobj_val.isPrimitive())
         RETURN_STOP_A("for-in on a primitive value");
 
     RETURN_IF_XML_A(iterobj_val);
 
-    JSObject* iterobj = &iterobj_val.asObject();
+    JSObject* iterobj = &iterobj_val.toObject();
     LIns* iterobj_ins = get(&iterobj_val);
     bool cond;
     LIns* cond_ins;
 
     /* JSOP_FOR* already guards on this, but in certain rare cases we might record misformed loop traces. */
     if (iterobj->hasClass(&js_IteratorClass.base)) {
         guardClass(iterobj_ins, &js_IteratorClass.base, snapshot(BRANCH_EXIT), ACC_OTHER);
         NativeIterator *ni = (NativeIterator *) iterobj->getPrivate();
@@ -14222,17 +14222,17 @@ TraceRecorder::record_JSOP_MOREITER()
     stack(0, cond_ins);
 
     return ARECORD_CONTINUE;
 }
 
 static JSBool FASTCALL
 CloseIterator(JSContext *cx, JSObject *iterobj)
 {
-    if (!js_CloseIterator(cx, ObjectTag(*iterobj))) {
+    if (!js_CloseIterator(cx, ObjectValue(*iterobj))) {
         SetBuiltinError(cx);
         return false;
     }
     return cx->tracerState->builtinStatus == 0;
 }
 JS_DEFINE_CALLINFO_2(extern, BOOL_FAIL, CloseIterator, CONTEXT, OBJECT, 0, nanojit::ACC_STORE_ANY)
 
 JS_REQUIRES_STACK AbortableRecordingStatus
@@ -14269,17 +14269,17 @@ TraceRecorder::storeMagic(JSWhyMagic why
     lir->insStore(magic, addr_ins, offset, accSet);
 }
 #endif
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::unboxNextValue(LIns* &v_ins)
 {
     Value &iterobj_val = stackval(-1);
-    JSObject *iterobj = &iterobj_val.asObject();
+    JSObject *iterobj = &iterobj_val.toObject();
     LIns* iterobj_ins = get(&iterobj_val);
 
     if (iterobj->hasClass(&js_IteratorClass.base)) {
         guardClass(iterobj_ins, &js_IteratorClass.base, snapshot(BRANCH_EXIT), ACC_OTHER);
         NativeIterator *ni = (NativeIterator *) iterobj->getPrivate();
 
         LIns *ni_ins = stobj_get_const_private_ptr(iterobj_ins);
         LIns *cursor_ins = addName(lir->insLoad(LIR_ldp, ni_ins, offsetof(NativeIterator, props_cursor), ACC_OTHER), "cursor");
@@ -14539,17 +14539,17 @@ TraceRecorder::record_JSOP_BINDNAME()
     // to see.
     if (JSFUN_HEAVYWEIGHT_TEST(fp->fun->flags))
         RETURN_STOP_A("BINDNAME in heavyweight function.");
 
     // We don't have the scope chain on trace, so instead we get a start object
     // that is on the scope chain and doesn't skip the target object (the one
     // that contains the property).
     Value *callee = &cx->fp->argv[-2];
-    obj = callee->asObject().getParent();
+    obj = callee->toObject().getParent();
     if (obj == globalObj) {
         stack(0, INS_CONSTOBJ(obj));
         return ARECORD_CONTINUE;
     }
     LIns *obj_ins = stobj_get_parent(get(callee));
 
     // Find the target object.
     JSAtom *atom = atoms[GET_INDEX(cx->regs->pc)];
@@ -14589,23 +14589,23 @@ TraceRecorder::record_JSOP_THROW()
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_IN()
 {
     Value& rval = stackval(-1);
     Value& lval = stackval(-2);
 
     if (rval.isPrimitive())
         RETURN_STOP_A("JSOP_IN on non-object right operand");
-    JSObject* obj = &rval.asObject();
+    JSObject* obj = &rval.toObject();
     LIns* obj_ins = get(&rval);
 
     jsid id;
     LIns* x;
     if (lval.isInt32()) {
-        if (!js_Int32ToId(cx, lval.asInt32(), &id))
+        if (!js_Int32ToId(cx, lval.toInt32(), &id))
             RETURN_ERROR_A("OOM converting left operand of JSOP_IN to string");
         LIns* args[] = { makeNumberInt32(get(&lval)), obj_ins, cx_ins };
         x = lir->insCall(&js_HasNamedPropertyInt32_ci, args);
     } else if (lval.isString()) {
         if (!js_ValueToStringId(cx, lval, &id))
             RETURN_ERROR_A("left operand of JSOP_IN didn't convert to a string-id");
         LIns* args[] = { get(&lval), obj_ins, cx_ins };
         x = lir->insCall(&js_HasNamedProperty_ci, args);
@@ -14817,17 +14817,17 @@ TraceRecorder::record_JSOP_LAMBDA()
         if (FUN_OBJECT(fun)->getParent() != globalObj)
             RETURN_STOP_A("Null closure function object parent must be global object");
         JSOp op2 = JSOp(cx->regs->pc[JSOP_LAMBDA_LENGTH]);
 
         if (op2 == JSOP_SETMETHOD) {
             Value lval = stackval(-1);
 
             if (!lval.isPrimitive() &&
-                lval.asObject().getClass() == &js_ObjectClass) {
+                lval.toObject().getClass() == &js_ObjectClass) {
                 stack(0, INS_CONSTOBJ(FUN_OBJECT(fun)));
                 return ARECORD_CONTINUE;
             }
         } else if (op2 == JSOP_INITMETHOD) {
             stack(0, INS_CONSTOBJ(FUN_OBJECT(fun)));
             return ARECORD_CONTINUE;
         }
 
@@ -15112,98 +15112,98 @@ TraceRecorder::record_JSOP_RETRVAL()
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_GETGVAR()
 {
     Value slotval = cx->fp->slots()[GET_SLOTNO(cx->regs->pc)];
     if (slotval.isNull())
         return ARECORD_CONTINUE; // We will see JSOP_NAME from the interpreter's jump, so no-op here.
 
-    uint32 slot = slotval.asInt32();
+    uint32 slot = slotval.toInt32();
 
     if (!lazilyImportGlobalSlot(slot))
          RETURN_STOP_A("lazy import of global slot failed");
 
     stack(0, get(&globalObj->getSlotRef(slot)));
     return ARECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_SETGVAR()
 {
     Value slotval = cx->fp->slots()[GET_SLOTNO(cx->regs->pc)];
     if (slotval.isNull())
         return ARECORD_CONTINUE; // We will see JSOP_NAME from the interpreter's jump, so no-op here.
 
-    uint32 slot = slotval.asInt32();
+    uint32 slot = slotval.toInt32();
 
     if (!lazilyImportGlobalSlot(slot))
          RETURN_STOP_A("lazy import of global slot failed");
 
     set(&globalObj->getSlotRef(slot), stack(-1));
     return ARECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_INCGVAR()
 {
     Value slotval = cx->fp->slots()[GET_SLOTNO(cx->regs->pc)];
     if (slotval.isNull())
         // We will see JSOP_INCNAME from the interpreter's jump, so no-op here.
         return ARECORD_CONTINUE;
 
-    uint32 slot = slotval.asInt32();
+    uint32 slot = slotval.toInt32();
 
     if (!lazilyImportGlobalSlot(slot))
          RETURN_STOP_A("lazy import of global slot failed");
 
     return InjectStatus(inc(globalObj->getSlotRef(slot), 1));
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_DECGVAR()
 {
     Value slotval = cx->fp->slots()[GET_SLOTNO(cx->regs->pc)];
     if (slotval.isNull())
         // We will see JSOP_INCNAME from the interpreter's jump, so no-op here.
         return ARECORD_CONTINUE;
 
-    uint32 slot = slotval.asInt32();
+    uint32 slot = slotval.toInt32();
 
     if (!lazilyImportGlobalSlot(slot))
          RETURN_STOP_A("lazy import of global slot failed");
 
     return InjectStatus(inc(globalObj->getSlotRef(slot), -1));
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_GVARINC()
 {
     Value slotval = cx->fp->slots()[GET_SLOTNO(cx->regs->pc)];
     if (slotval.isNull())
         // We will see JSOP_INCNAME from the interpreter's jump, so no-op here.
         return ARECORD_CONTINUE;
 
-    uint32 slot = slotval.asInt32();
+    uint32 slot = slotval.toInt32();
 
     if (!lazilyImportGlobalSlot(slot))
          RETURN_STOP_A("lazy import of global slot failed");
 
     return InjectStatus(inc(globalObj->getSlotRef(slot), 1, false));
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_GVARDEC()
 {
     Value slotval = cx->fp->slots()[GET_SLOTNO(cx->regs->pc)];
     if (slotval.isNull())
         // We will see JSOP_INCNAME from the interpreter's jump, so no-op here.
         return ARECORD_CONTINUE;
 
-    uint32 slot = slotval.asInt32();
+    uint32 slot = slotval.toInt32();
 
     if (!lazilyImportGlobalSlot(slot))
          RETURN_STOP_A("lazy import of global slot failed");
 
     return InjectStatus(inc(globalObj->getSlotRef(slot), -1, false));
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
@@ -15392,17 +15392,17 @@ TraceRecorder::record_JSOP_STARTXMLEXPR(
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_CALLPROP()
 {
     Value& l = stackval(-1);
     JSObject* obj;
     LIns* obj_ins;
     LIns* this_ins;
     if (!l.isPrimitive()) {
-        obj = &l.asObject();
+        obj = &l.toObject();
         obj_ins = get(&l);
         this_ins = obj_ins; // |this| for subsequent call
     } else {
         JSProtoKey protoKey;
         debug_only_stmt(const char* protoname = NULL;)
         if (l.isString()) {
             protoKey = JSProto_String;
             debug_only_stmt(protoname = "String.prototype";)
@@ -15592,17 +15592,17 @@ TraceRecorder::record_JSOP_YIELD()
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_ARRAYPUSH()
 {
     uint32_t slot = GET_UINT16(cx->regs->pc);
     JS_ASSERT(cx->fp->script->nfixed <= slot);
     JS_ASSERT(cx->fp->slots() + slot < cx->regs->sp - 1);
     Value &arrayval = cx->fp->slots()[slot];
     JS_ASSERT(arrayval.isObject());
-    JS_ASSERT(arrayval.asObject().isDenseArray());
+    JS_ASSERT(arrayval.toObject().isDenseArray());
     LIns *array_ins = get(&arrayval);
     Value &elt = stackval(-1);
     LIns *elt_ins = box_value_for_native_call(elt, get(&elt));
 
     LIns *args[] = { elt_ins, array_ins, cx_ins };
     LIns *ok_ins = lir->insCall(&js_ArrayCompPush_tn_ci, args);
     guard(false, lir->insEqI_0(ok_ins), OOM_EXIT);
     return ARECORD_CONTINUE;
@@ -15630,17 +15630,17 @@ TraceRecorder::record_JSOP_GETTHISPROP()
 
     CHECK_STATUS_A(getThis(this_ins));
 
     /*
      * It's safe to just use cx->fp->thisv here because getThis() returns
      * ARECORD_STOP if thisv is not available.
      */
     JS_ASSERT(cx->fp->flags & JSFRAME_COMPUTED_THIS);
-    CHECK_STATUS_A(getProp(&cx->fp->thisv.asObject(), this_ins));
+    CHECK_STATUS_A(getProp(&cx->fp->thisv.toObject(), this_ins));
     return ARECORD_CONTINUE;
 }
 
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_GETARGPROP()
 {
     return getProp(argval(GET_ARGNO(cx->regs->pc)));
 }
@@ -15675,17 +15675,17 @@ TraceRecorder::record_JSOP_INDEXBASE3()
 JS_REQUIRES_STACK AbortableRecordingStatus
 TraceRecorder::record_JSOP_CALLGVAR()
 {
     Value slotval = cx->fp->slots()[GET_SLOTNO(cx->regs->pc)];
     if (slotval.isNull())
         // We will see JSOP_CALLNAME from the interpreter's jump, so no-op here.
         return ARECORD_CONTINUE;
 
-    uint32 slot = slotval.asInt32();
+    uint32 slot = slotval.toInt32();
 
     if (!lazilyImportGlobalSlot(slot))
          RETURN_STOP_A("lazy import of global slot failed");
 
     Value& v = globalObj->getSlotRef(slot);
     stack(0, get(&v));
     stack(1, INS_NULL());
     return ARECORD_CONTINUE;
@@ -15737,17 +15737,17 @@ TraceRecorder::record_JSOP_LENGTH()
         if (!l.isString())
             RETURN_STOP_A("non-string primitive JSOP_LENGTH unsupported");
         set(&l, lir->ins1(LIR_i2d,
                           p2i(lir->insLoad(LIR_ldp, get(&l),
                                            offsetof(JSString, mLength), ACC_OTHER))));
         return ARECORD_CONTINUE;
     }
 
-    JSObject* obj = &l.asObject();
+    JSObject* obj = &l.toObject();
     LIns* obj_ins = get(&l);
 
     if (obj->isArguments()) {
         unsigned depth;
         JSStackFrame *afp = guardArguments(obj, obj_ins, &depth);
         if (!afp)
             RETURN_STOP_A("can't reach arguments object's frame");
 
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -242,53 +242,53 @@ class TypedArrayGetter {
         } while ((obj = obj->getProto()) != NULL);
         return true;
     }
 };
 
 inline Value
 getBuffer(TypedArray *tarray)
 {
-    return ObjectTag(*tarray->bufferJS);
+    return ObjectValue(*tarray->bufferJS);
 }
 
 JSBool
 TypedArray::prop_getBuffer(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     return TypedArrayGetter<getBuffer>::get(cx, obj, id, vp);
 }
 
 inline Value
 getByteOffset(TypedArray *tarray)
 {
-    return Int32Tag(tarray->byteOffset);
+    return Int32Value(tarray->byteOffset);
 }
 
 JSBool
 TypedArray::prop_getByteOffset(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     return TypedArrayGetter<getByteOffset>::get(cx, obj, id, vp);
 }
 
 inline Value
 getByteLength(TypedArray *tarray)
 {
-    return Int32Tag(tarray->byteLength);
+    return Int32Value(tarray->byteLength);
 }
 
 JSBool
 TypedArray::prop_getByteLength(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     return TypedArrayGetter<getByteLength>::get(cx, obj, id, vp);
 }
 
 inline Value
 getLength(TypedArray *tarray)
 {
-    return Int32Tag(tarray->length);
+    return Int32Value(tarray->length);
 }
 
 JSBool
 TypedArray::prop_getLength(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     return TypedArrayGetter<getLength>::get(cx, obj, id, vp);
 }
 
@@ -581,35 +581,35 @@ class TypedArrayTemplate
             // these objects.  This is especially true when these arrays
             // are used to implement HTML Canvas 2D's PixelArray objects,
             // which used to be plain old arrays.
             vp->setUndefined();
             return true;
         }
 
         if (vp->isInt32()) {
-            tarray->setIndex(index, NativeType(vp->asInt32()));
+            tarray->setIndex(index, NativeType(vp->toInt32()));
             return true;
         }
 
         jsdouble d;
 
         if (vp->isDouble()) {
-            d = vp->asDouble();
+            d = vp->toDouble();
         } else if (vp->isNull()) {
             d = 0.0f;
         } else if (vp->isPrimitive()) {
             JS_ASSERT(vp->isString() || vp->isUndefined() || vp->isBoolean());
             if (vp->isString()) {
                 // note that ValueToNumber will always succeed with a string arg
                 ValueToNumber(cx, *vp, &d);
             } else if (vp->isUndefined()) {
                 d = js_NaN;
             } else {
-                d = (double) vp->asBoolean();
+                d = (double) vp->toBoolean();
             }
         } else {
             // non-primitive assignments become NaN or 0 (for float/int arrays)
             d = js_NaN;
         }
 
         // If the array is an integer array, we only handle up to
         // 32-bit ints from this point on.  if we want to handle
@@ -691,17 +691,17 @@ class TypedArrayTemplate
                 *idp = INT_TO_JSID(tarray->length);
             break;
 
           case JSENUMERATE_NEXT:
             if (statep->isTrue()) {
                 *idp = ATOM_TO_JSID(cx->runtime->atomState.lengthAtom);
                 statep->setInt32(0);
             } else {
-                uint32 index = statep->asInt32();
+                uint32 index = statep->toInt32();
                 if (index < uint32(tarray->length)) {
                     *idp = INT_TO_JSID(index);
                     statep->setInt32(index + 1);
                 } else {
                     JS_ASSERT(index == tarray->length);
                     statep->setNull();
                 }
             }
@@ -761,17 +761,17 @@ class TypedArrayTemplate
         if (argc == 0) {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                  JSMSG_TYPED_ARRAY_BAD_ARGS);
             return false;
         }
 
         // figure out the type of the first argument
         if (argv[0].isInt32()) {
-            int32 len = argv[0].asInt32();
+            int32 len = argv[0].toInt32();
             if (len < 0) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                      JSMSG_BAD_ARRAY_LENGTH);
 
                 return false;
             }
 
             tarray = new ThisTypeArray();
@@ -809,17 +809,17 @@ class TypedArrayTemplate
             }
 
             tarray = new ThisTypeArray();
             if (!tarray) {
                 JS_ReportOutOfMemory(cx);
                 return false;
             }
 
-            if (!tarray->init(cx, &argv[0].asObject(), byteOffset, length)) {
+            if (!tarray->init(cx, &argv[0].toObject(), byteOffset, length)) {
                 delete tarray;
                 return false;
             }
         } else {
             JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                  JSMSG_TYPED_ARRAY_BAD_ARGS);
             return false;
         }
@@ -1046,20 +1046,20 @@ class TypedArrayTemplate
         return tarray;
     }
 
   protected:
     static NativeType
     nativeFromValue(JSContext *cx, const Value &v)
     {
         if (v.isInt32())
-            return NativeType(v.asInt32());
+            return NativeType(v.toInt32());
 
         if (v.isDouble())
-            return NativeType(v.asDouble());
+            return NativeType(v.toDouble());
 
         if (v.isPrimitive() && !v.isMagic()) {
             jsdouble dval;
             ValueToNumber(cx, v, &dval);
             return NativeType(dval);
         }
 
         if (ArrayTypeIsFloatingPoint())
@@ -1179,22 +1179,22 @@ class TypedArrayTemplate
 
         length = count;
         return true;
     }
 
     bool
     createBufferWithByteLength(JSContext *cx, int32 bytes)
     {
-        Value argv = Int32Tag(bytes);
+        Value argv = Int32Value(bytes);
         AutoValueRooter tvr(cx);
         if (!ArrayBuffer::create(cx, NULL, 1, &argv, tvr.addr()))
             return false;
 
-        JSObject *obj = &tvr.value().asObject();
+        JSObject *obj = &tvr.value().toObject();
 
         bufferJS = obj;
         buffer = ArrayBuffer::fromJSObject(obj);
 
         byteOffset = 0;
         byteLength = bytes;
         data = buffer->data;
 
@@ -1441,17 +1441,17 @@ js_CreateArrayBuffer(JSContext *cx, jsui
     Value vals[2];
     vals[0].setNumber(nbytes);
     vals[1].setUndefined();
 
     AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
     if (!ArrayBuffer::create(cx, NULL, 1, &vals[0], &vals[1]))
         return NULL;
 
-    return &vals[1].asObject();
+    return &vals[1].toObject();
 }
 
 static inline JSBool
 TypedArrayConstruct(JSContext *cx, jsint atype, uintN argc, Value *argv, Value *rv)
 {
     switch (atype) {
       case TypedArray::TYPE_INT8:
         return !!Int8Array::create(cx, NULL, argc, argv, rv);
@@ -1494,33 +1494,33 @@ js_CreateTypedArray(JSContext *cx, jsint
     Value vals[2];
     vals[0].setInt32(nelements);
     vals[1].setUndefined();
 
     AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
     if (!TypedArrayConstruct(cx, atype, 1, &vals[0], &vals[1]))
         return NULL;
 
-    return &vals[1].asObject();
+    return &vals[1].toObject();
 }
 
 JS_FRIEND_API(JSObject *)
 js_CreateTypedArrayWithArray(JSContext *cx, jsint atype, JSObject *arrayArg)
 {
     JS_ASSERT(atype >= 0 && atype < TypedArray::TYPE_MAX);
 
     Value vals[2];
     vals[0].setObject(*arrayArg);
     vals[1].setUndefined();
 
     AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
     if (!TypedArrayConstruct(cx, atype, 1, &vals[0], &vals[1]))
         return NULL;
 
-    return &vals[1].asObject();
+    return &vals[1].toObject();
 }
 
 JS_FRIEND_API(JSObject *)
 js_CreateTypedArrayWithBuffer(JSContext *cx, jsint atype, JSObject *bufArg,
                               jsint byteoffset, jsint length)
 {
     JS_ASSERT(atype >= 0 && atype < TypedArray::TYPE_MAX);
     JS_ASSERT(bufArg && ArrayBuffer::fromJSObject(bufArg));
@@ -1541,17 +1541,17 @@ js_CreateTypedArrayWithBuffer(JSContext 
         vals[argc].setInt32(length);
         argc++;
     }
 
     AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
     if (!TypedArrayConstruct(cx, atype, argc, &vals[0], &vals[3]))
         return NULL;
 
-    return &vals[3].asObject();
+    return &vals[3].toObject();
 }
 
 JS_FRIEND_API(JSBool)
 js_ReparentTypedArrayToScope(JSContext *cx, JSObject *obj, JSObject *scope)
 {
     JS_ASSERT(obj);
 
     scope = JS_GetGlobalForObject(cx, scope);
--- a/js/src/jsvalue.h
+++ b/js/src/jsvalue.h
@@ -54,17 +54,17 @@
  *   types, function pointer types differing only in these types, and structs
  *   differing only in these types can be converted back and forth at no cost
  *   using the Jsvalify() and Valueify(). See Jsvalify comment below.
  *
  * - js::Value has setX() and isX() members for X in
  *
  *     { Int32, Double, String, Boolean, Undefined, Null, Object, Magic }
  *
- *   js::Value also contains asX() for each of the the non-singleton types.
+ *   js::Value also contains toX() for each of the non-singleton types.
  *
  * - Magic is a singleton type whose payload contains a JSWhyMagic "reason" for
  *   the magic value. By providing JSWhyMagic values when creating and checking
  *   for magic values, it is possible to assert, at runtime, that only magic
  *   values with the expected reason flow through a particular value. For
  *   example, if cx->exception has a magic value, the reason must be
  *   JS_GENERATOR_CLOSING.
  *
@@ -73,26 +73,16 @@
  *
  *           JSVAL_IS_OBJECT(v) === v.isObjectOrNull()
  *       !JSVAL_IS_PRIMITIVE(v) === v.isObject()
  *
  *   To help prevent mistakenly boxing a nullable JSObject* as an object,
  *   Value::setObject takes a JSObject&. (Conversely, Value::asObject returns a
  *   JSObject&. A convenience member Value::setObjectOrNull is provided.
  *
- * - js::Value does not have constructors that accepts the above set of types
- *   since this was found to be a significant source of errors involving
- *   implicit conversions. Instead, the desired type is explicitly stated using
- *   a set of js::XTag classes, where X is one of the above set of types. The
- *   js::XTag constructors are marked 'explicit' which allows the js::Value
- *   constructors to safely be implicit. E.g.:
- *
- *     js::Value v = js::Int32Tag(0);
- *     js_ValueToString(cx, js::DoubleTag(3.5));
- *
  * - JSVAL_VOID is the same as the singleton value of the Undefined type.
  *
  * - Note that js::Value is always 64-bit. Thus, on 32-bit user code should
  *   avoid copying jsval/js::Value as much as possible, preferring to pass by
  *   const Value &.
  */
 
 /******************************************************************************/
@@ -317,118 +307,48 @@ UNBOX_NON_DOUBLE_JSVAL(jsval_layout l, u
 }
 
 #endif
 
 /******************************************************************************/
 
 namespace js {
 
-struct NullTag {
-    explicit NullTag() {}
-};
-
-struct UndefinedTag {
-    explicit UndefinedTag() {}
-};
-
-struct Int32Tag {
-    explicit Int32Tag(int32 i32) : i32(i32) {}
-    int32 i32;
-};
-
-struct DoubleTag {
-    explicit DoubleTag(double dbl) : dbl(dbl) {}
-    double dbl;
-};
-
-struct NumberTag {
-    explicit NumberTag(double dbl) : dbl(dbl) {}
-    double dbl;
-};
-
-struct StringTag {
-    explicit StringTag(JSString *str) : str(str) {}
-    JSString *str;
-};
-
-struct ObjectTag {
-    explicit ObjectTag(JSObject &obj) : obj(obj) {}
-    JSObject &obj;
-};
-
-struct ObjectOrNullTag {
-    explicit ObjectOrNullTag(JSObject *obj) : obj(obj) {}
-    JSObject *obj;
-};
-
-struct ObjectOrUndefinedTag {
-    /* Interpret null JSObject* as undefined value */
-    explicit ObjectOrUndefinedTag(JSObject *obj) : obj(obj) {}
-    JSObject *obj;
-};
-
-struct BooleanTag {
-    explicit BooleanTag(bool boo) : boo(boo) {}
-    bool boo;
-};
-
-struct PrivateTag {
-    explicit PrivateTag(void *ptr) : ptr(ptr) {}
-    void *ptr;
-};
-
-/******************************************************************************/
-
 class Value
 {
   public:
     /*** Constructors ***/
 
-    /* N.B. Value's default constructor leaves Value uninitialized */
+    /* N.B. the default constructor creates a double. */
     Value() { data.asBits = 0; }
 
-    Value(NullTag)                  { setNull(); }
-    Value(UndefinedTag)             { setUndefined(); }
-    Value(Int32Tag arg)             { setInt32(arg.i32); }
-    Value(DoubleTag arg)            { setDouble(arg.dbl); }
-    Value(StringTag arg)            { setString(arg.str); }
-    Value(BooleanTag arg)           { setBoolean(arg.boo); }
-    Value(ObjectTag arg)            { setObject(arg.obj); }
-    Value(JSWhyMagic arg)           { setMagic(arg); }
-
-    /* Constructers that perform dynamic checks to determine the type */
-    Value(NumberTag arg)            { setNumber(arg.dbl); }
-    Value(ObjectOrNullTag arg)      { setObjectOrNull(arg.obj); }
-    Value(ObjectOrUndefinedTag arg) { setObjectOrUndefined(arg.obj); }
-
     /*** Mutatators ***/
 
     void setNull() {
         data.asBits = JSVAL_BITS(JSVAL_NULL);
     }
 
     void setUndefined() {
         data.asBits = JSVAL_BITS(JSVAL_VOID);
     }
 
     void setInt32(int32 i) {
         data = INT32_TO_JSVAL_IMPL(i);
     }
 
-    int32 &asInt32Ref() {
+    int32 &getInt32Ref() {
         JS_ASSERT(isInt32());
         return data.s.payload.i32;
     }
 
     void setDouble(double d) {
         data = DOUBLE_TO_JSVAL_IMPL(d);
     }
 
-    double &asDoubleRef() {
+    double &getDoubleRef() {
         JS_ASSERT(isDouble());
         return data.asDouble;
     }
 
     void setString(JSString *str) {
         data = STRING_TO_JSVAL_IMPL(str);
     }
 
@@ -578,57 +498,57 @@ class Value
     }
 
     friend bool SameType(const Value &lhs, const Value &rhs) {
         return JSVAL_SAME_TYPE_IMPL(lhs.data, rhs.data);
     }
 
     /*** Extract the value's typed payload ***/
 
-    int32 asInt32() const {
+    int32 toInt32() const {
         JS_ASSERT(isInt32());
         return JSVAL_TO_INT32_IMPL(data);
     }
 
-    double asDouble() const {
+    double toDouble() const {
         JS_ASSERT(isDouble());
         return data.asDouble;
     }
 
-    double asNumber() const {
+    double toNumber() const {
         JS_ASSERT(isNumber());
-        return isDouble() ? asDouble() : double(asInt32());
+        return isDouble() ? toDouble() : double(toInt32());
     }
 
-    JSString *asString() const {
+    JSString *toString() const {
         JS_ASSERT(isString());
         return JSVAL_TO_STRING_IMPL(data);
     }
 
-    JSObject &asObject() const {
+    JSObject &toObject() const {
         JS_ASSERT(isObject());
         return *JSVAL_TO_OBJECT_IMPL(data);
     }
 
-    JSObject *asObjectOrNull() const {
+    JSObject *toObjectOrNull() const {
         JS_ASSERT(isObjectOrNull());
         return JSVAL_TO_OBJECT_IMPL(data);
     }
 
     void *asGCThing() const {
         JS_ASSERT(isGCThing());
         return JSVAL_TO_GCTHING_IMPL(data);
     }
 
-    bool asBoolean() const {
+    bool toBoolean() const {
         JS_ASSERT(isBoolean());
         return JSVAL_TO_BOOLEAN_IMPL(data);
     }
 
-    uint32 asRawUint32() const {
+    uint32 payloadAsRawUint32() const {
         JS_ASSERT(!isDouble());
         return data.s.payload.u32;
     }
 
     uint64 asRawBits() const {
         return data.asBits;
     }
 
@@ -673,59 +593,143 @@ class Value
      * Private API
      *
      * Private setters/getters allow the caller to read/write arbitrary types
      * that fit in the 64-bit payload. It is the caller's responsibility, after
      * storing to a value with setPrivateX to only read with getPrivateX.
      * Privates values are given a type type which ensures they are not marked.
      */
 
-    Value(PrivateTag arg) {
-        setPrivate(arg.ptr);
-    }
-
     bool isUnderlyingTypeOfPrivate() const {
         return JSVAL_IS_UNDERLYING_TYPE_OF_PRIVATE_IMPL(data);
     }
 
     void setPrivate(void *ptr) {
         data = PRIVATE_PTR_TO_JSVAL_IMPL(ptr);
     }
 
-    void *asPrivate() const {
+    void *toPrivate() const {
         JS_ASSERT(JSVAL_IS_UNDERLYING_TYPE_OF_PRIVATE_IMPL(data));
         return JSVAL_TO_PRIVATE_PTR_IMPL(data);
     }
 
     void setPrivateUint32(uint32 ui) {
         data = PRIVATE_UINT32_TO_JSVAL_IMPL(ui);
     }
 
-    uint32 asPrivateUint32() const {
+    uint32 toPrivateUint32() const {
         JS_ASSERT(JSVAL_IS_UNDERLYING_TYPE_OF_PRIVATE_IMPL(data));
         return JSVAL_TO_PRIVATE_UINT32_IMPL(data);
     }
 
-    uint32 &asPrivateUint32Ref() {
+    uint32 &getPrivateUint32Ref() {
         JS_ASSERT(isDouble());
         return data.s.payload.u32;
     }
 
   private:
     void staticAssertions() {
         JS_STATIC_ASSERT(sizeof(JSValueType) == 1);
         JS_STATIC_ASSERT(sizeof(JSValueTag) == 4);
         JS_STATIC_ASSERT(sizeof(JSBool) == 4);
         JS_STATIC_ASSERT(sizeof(JSWhyMagic) <= 4);
         JS_STATIC_ASSERT(sizeof(jsval) == 8);
     }
 
     jsval_layout data;
 } JSVAL_ALIGNMENT;
 
+static JS_ALWAYS_INLINE Value
+NullValue()
+{
+    Value v;
+    v.setNull();
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+UndefinedValue()
+{
+    Value v;
+    v.setUndefined();
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+Int32Value(int32 i32)
+{
+    Value v;
+    v.setInt32(i32);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+DoubleValue(double dbl)
+{
+    Value v;
+    v.setDouble(dbl);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+StringValue(JSString *str)
+{
+    Value v;
+    v.setString(str);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+BooleanValue(bool boo)
+{
+    Value v;
+    v.setBoolean(boo);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+ObjectValue(JSObject &obj)
+{
+    Value v;
+    v.setObject(obj);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+MagicValue(JSWhyMagic why)
+{
+    Value v;
+    v.setMagic(why);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+NumberValue(double dbl)
+{
+    Value v;
+    v.setNumber(dbl);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+ObjectOrNullValue(JSObject *obj)
+{
+    Value v;
+    v.setObjectOrNull(obj);
+    return v;
+}
+
+static JS_ALWAYS_INLINE Value
+PrivateValue(void *ptr)
+{
+    Value v;
+    v.setPrivate(ptr);
+    return v;
+}
+
 /******************************************************************************/
 
 /*
  * As asserted above, js::Value and jsval are layout equivalent. This means:
  *  - an instance of jsval may be reinterpreted as a js::Value and vice versa;
  *  - a pointer to a function taking jsval arguments may be reinterpreted as a
  *    function taking the same arguments, s/jsval/js::Value/, and vice versa;
  *  - a struct containing jsval members may be reinterpreted as a struct with
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -60,17 +60,17 @@ JSObject::isWrapper() const
 
 JSObject *
 JSObject::unwrap(uintN *flagsp)
 {
     JSObject *wrapped = this;
     uintN flags = 0;
     if (wrapped->isWrapper()) {
         flags |= static_cast<JSWrapper *>(wrapped->getProxyHandler())->flags();
-        wrapped = wrapped->getProxyPrivate().asObjectOrNull();
+        wrapped = wrapped->getProxyPrivate().toObjectOrNull();
     }
     if (flagsp)
         *flagsp = flags;
     return wrapped;
 }
 
 JSWrapper::JSWrapper(uintN flags) : JSProxyHandler(&sWrapperFamily), mFlags(flags)
 {
@@ -266,17 +266,17 @@ JSWrapper::leave(JSContext *cx, JSObject
 }
 
 JSWrapper JSWrapper::singleton(0);
 
 JSObject *
 JSWrapper::New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent,
                JSWrapper *handler)
 {
-    return NewProxyObject(cx, handler, ObjectTag(*obj), proto, parent,
+    return NewProxyObject(cx, handler, ObjectValue(*obj), proto, parent,
                           obj->isCallable() ? obj : NULL, NULL);
 }
 
 /* Compartments. */
 
 namespace js {
 
 extern JSObject *
@@ -312,45 +312,45 @@ JSCompartment::wrap(JSContext *cx, Value
 
     JS_CHECK_RECURSION(cx, return false);
 
     /* Only GC things have to be wrapped or copied. */
     if (!vp->isMarkable())
         return true;
 
     /* Static strings do not have to be wrapped. */
-    if (vp->isString() && JSString::isStatic(vp->asString()))
+    if (vp->isString() && JSString::isStatic(vp->toString()))
         return true;
 
     /* Unwrap incoming objects. */
     if (vp->isObject()) {
-        JSObject *obj = vp->asObject().unwrap(&flags);
+        JSObject *obj = vp->toObject().unwrap(&flags);
         vp->setObject(*obj);
         /* If the wrapped object is already in this compartment, we are done. */
         if (obj->getCompartment(cx) == this)
             return true;
     }
 
     /* If we already have a wrapper for this value, use it. */
     if (WrapperMap::Ptr p = crossCompartmentWrappers.lookup(*vp)) {
         *vp = p->value;
         return true;
     }
 
     if (vp->isString()) {
         Value orig = *vp;
-        JSString *str = vp->asString();
+        JSString *str = vp->toString();
         JSString *wrapped = js_NewStringCopyN(cx, str->chars(), str->length());
         if (!wrapped)
             return false;
         vp->setString(wrapped);
         return crossCompartmentWrappers.put(orig, *vp);
     }
 
-    JSObject *obj = &vp->asObject();
+    JSObject *obj = &vp->toObject();
 
     /*
      * Recurse to wrap the prototype. Long prototype chains will run out of
      * stack, causing an error in CHECK_RECURSE.
      *
      * Wrapping the proto before creating the new wrapper and adding it to the
      * cache helps avoid leaving a bad entry in the cache on OOM. But note that
      * if we wrapped both proto and parent, we would get infinite recursion
@@ -384,32 +384,32 @@ JSCompartment::wrap(JSContext *cx, Value
     JSObject *global = cx->fp ? cx->fp->scopeChain->getGlobal() : cx->globalObject;
     wrapper->setParent(global);
     return true;
 }
 
 bool
 JSCompartment::wrap(JSContext *cx, JSString **strp)
 {
-    AutoValueRooter tvr(cx, StringTag(*strp));
+    AutoValueRooter tvr(cx, StringValue(*strp));
     if (!wrap(cx, tvr.addr()))
         return false;
-    *strp = tvr.value().asString();
+    *strp = tvr.value().toString();
     return true;
 }
 
 bool
 JSCompartment::wrap(JSContext *cx, JSObject **objp)
 {
     if (!*objp)
         return true;
-    AutoValueRooter tvr(cx, ObjectTag(**objp));
+    AutoValueRooter tvr(cx, ObjectValue(**objp));
     if (!wrap(cx, tvr.addr()))
         return false;
-    *objp = &tvr.value().asObject();
+    *objp = &tvr.value().toObject();
     return true;
 }
 
 bool
 JSCompartment::wrapId(JSContext *cx, jsid *idp) {
     if (JSID_IS_INT(*idp))
         return true;
     AutoValueRooter tvr(cx, IdToValue(*idp));
@@ -453,17 +453,17 @@ JSCompartment::wrap(JSContext *cx, AutoI
 
 bool
 JSCompartment::wrapException(JSContext *cx) {
     JS_ASSERT(cx->compartment == this);
 
     if (cx->throwing) {
         AutoValueRooter tvr(cx, cx->exception);
         cx->throwing = false;
-        cx->exception = NullTag();
+        cx->exception.setNull();
         if (wrap(cx, tvr.addr())) {
             cx->throwing = true;
             cx->exception = tvr.value();
         }
         return false;
     }
     return true;
 }
@@ -482,18 +482,18 @@ static bool
 SetupFakeFrame(JSContext *cx, ExecuteFrameGuard &frame, JSFrameRegs &regs, JSObject *obj)
 {
     const uintN vplen = 2;
     const uintN nfixed = 0;
     if (!cx->stack().getExecuteFrame(cx, js_GetTopStackFrame(cx), vplen, nfixed, frame))
         return false;
 
     Value *vp = frame.getvp();
-    vp[0] = UndefinedTag();
-    vp[1] = NullTag();  // satisfy LeaveTree assert
+    vp[0].setUndefined();
+    vp[1].setNull();  // satisfy LeaveTree assert
 
     JSStackFrame *fp = frame.getFrame();
     PodZero(fp);  // fp->fun and fp->script are both NULL
     fp->argv = vp + 2;
     fp->scopeChain = obj->getGlobal();
 
     regs.pc = NULL;
     regs.sp = fp->slots();
@@ -677,24 +677,24 @@ JSCrossCompartmentWrapper::enumerateOwn(
  * We can reify non-escaping iterator objects instead of having to wrap them. This
  * allows fast iteration over objects across a compartment boundary.
  */
 static bool
 CanReify(Value *vp)
 {
     JSObject *obj;
     return vp->isObject() &&
-           (obj = &vp->asObject())->getClass() == &js_IteratorClass.base &&
+           (obj = &vp->toObject())->getClass() == &js_IteratorClass.base &&
            (obj->getNativeIterator()->flags & JSITER_ENUMERATE);
 }
 
 static bool
 Reify(JSContext *cx, JSCompartment *origin, Value *vp)
 {
-    JSObject *iterObj = &vp->asObject();
+    JSObject *iterObj = &vp->toObject();
     NativeIterator *ni = iterObj->getNativeIterator();
 
     /* Wrap the iteratee. */
     JSObject *obj = ni->obj;
     if (!origin->wrap(cx, &obj))
         return false;
 
     /* Wrap the elements in the iterator's snapshot. */
@@ -745,17 +745,17 @@ JSCrossCompartmentWrapper::iterate(JSCon
 
 bool
 JSCrossCompartmentWrapper::call(JSContext *cx, JSObject *wrapper, uintN argc, Value *vp)
 {
     AutoCompartment call(cx, wrappedObject(wrapper));
     if (!call.enter())
         return false;
 
-    vp[0] = ObjectTag(*call.target);
+    vp[0] = ObjectValue(*call.target);
     if (!call.destination->wrap(cx, &vp[1]))
         return false;
     Value *argv = JS_ARGV(cx, vp);
     for (size_t n = 0; n < argc; ++n) {
         if (!call.destination->wrap(cx, &argv[n]))
             return false;
     }
     Value *fakevp = call.getvp();
@@ -776,17 +776,17 @@ JSCrossCompartmentWrapper::construct(JSC
     if (!call.enter())
         return false;
 
     for (size_t n = 0; n < argc; ++n) {
         if (!call.destination->wrap(cx, &argv[n]))
             return false;
     }
     Value *vp = call.getvp();
-    vp[0] = ObjectTag(*call.target);
+    vp[0] = ObjectValue(*call.target);
     if (!JSWrapper::construct(cx, wrapper, argc, argv, rval))
         return false;
 
     call.leave();
     return call.origin->wrap(cx, rval) &&
            call.origin->wrapException(cx);
 }
 
--- a/js/src/jswrapper.h
+++ b/js/src/jswrapper.h
@@ -95,17 +95,17 @@ class JSWrapper : public js::JSProxyHand
 
     static JS_FRIEND_API(JSWrapper) singleton;
 
     static JS_FRIEND_API(JSObject *) New(JSContext *cx, JSObject *obj,
                                          JSObject *proto, JSObject *parent,
                                          JSWrapper *handler);
 
     static inline JSObject *wrappedObject(JSObject *wrapper) {
-        return wrapper->getProxyPrivate().asObjectOrNull();
+        return wrapper->getProxyPrivate().toObjectOrNull();
     }
 };
 
 /* Base class for all cross compartment wrapper handlers. */
 class JSCrossCompartmentWrapper : public JSWrapper {
   public:
     JS_FRIEND_API(JSCrossCompartmentWrapper(uintN flags));
 
--- a/js/src/jsxml.cpp
+++ b/js/src/jsxml.cpp
@@ -238,17 +238,17 @@ namespace_finalize(JSContext *cx, JSObje
 }
 
 static JSBool
 namespace_equality(JSContext *cx, JSObject *obj, const Value *v, JSBool *bp)
 {
     JSObject *obj2;
 
     JS_ASSERT(v->isObjectOrNull());
-    obj2 = v->asObjectOrNull();
+    obj2 = v->toObjectOrNull();
     *bp = (!obj2 || obj2->getClass() != &js_NamespaceClass.base)
           ? JS_FALSE
           : js_EqualStrings(GetURI(obj), GetURI(obj2));
     return JS_TRUE;
 }
 
 JS_FRIEND_DATA(ExtendedClass) js_NamespaceClass = {
   { "Namespace",
@@ -341,17 +341,17 @@ qname_identity(JSObject *qna, JSObject *
     return js_EqualStrings(GetLocalName(qna), GetLocalName(qnb));
 }
 
 static JSBool
 qname_equality(JSContext *cx, JSObject *qn, const Value *v, JSBool *bp)
 {
     JSObject *obj2;
 
-    obj2 = v->asObjectOrNull();
+    obj2 = v->toObjectOrNull();
     *bp = (!obj2 || obj2->getClass() != &js_QNameClass.base)
           ? JS_FALSE
           : qname_identity(qn, obj2);
     return JS_TRUE;
 }
 
 JS_FRIEND_DATA(ExtendedClass) js_QNameClass = {
   { "QName",
@@ -498,17 +498,17 @@ js_ConstructXMLQNameObject(JSContext *cx
     Value argv[2];
 
     /*
      * ECMA-357 11.1.2,
      * The _QualifiedIdentifier : PropertySelector :: PropertySelector_
      * production, step 2.
      */
     if (nsval.isObject() &&
-        nsval.asObject().getClass() == &js_AnyNameClass) {
+        nsval.toObject().getClass() == &js_AnyNameClass) {
         argv[0].setNull();
     } else {
         argv[0] = nsval;
     }
     argv[1] = lnval;
     return js_ConstructObject(cx, &js_QNameClass.base, NULL, NULL, 2, argv);
 }
 
@@ -632,17 +632,17 @@ NamespaceHelper(JSContext *cx, JSObject 
 
         prefixval = argv[0];
         if (uri->empty()) {
             if (!JSVAL_IS_VOID(prefixval)) {
                 prefix = js_ValueToString(cx, Valueify(prefixval));
                 if (!prefix)
                     return JS_FALSE;
                 if (!prefix->empty()) {
-                    Value v = StringTag(prefix);
+                    Value v = StringValue(prefix);
                     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                          JSMSG_BAD_XML_NAMESPACE,
                                          js_ValueToPrintableString(cx, v));
                     return JS_FALSE;
                 }
             }
         } else if (JSVAL_IS_VOID(prefixval) || !js_IsXMLName(cx, prefixval)) {
             obj->setNamePrefix(JSVAL_VOID);
@@ -1161,17 +1161,17 @@ ParseNodeToQName(Parser *parser, JSParse
                 if (nsprefix && js_EqualStrings(nsprefix, prefix)) {
                     uri = GetURI(ns);
                     break;
                 }
             }
         }
 
         if (!uri) {
-            Value v = StringTag(prefix);
+            Value v = StringValue(prefix);
             ReportCompileErrorNumber(parser->context, &parser->tokenStream, pn,
                                      JSREPORT_ERROR, JSMSG_BAD_XML_NAMESPACE,
                                      js_ValueToPrintableString(parser->context, v));
             return NULL;
         }
 
         localName = js_NewStringCopyN(parser->context, colon + 1, length - (offset + 1));
         if (!localName)
@@ -1380,17 +1380,17 @@ ParseNodeToXML(Parser *parser, JSParseNo
             const jschar *chars;
 
             if (pn2->pn_type != TOK_XMLNAME || pn2->pn_arity != PN_NULLARY)
                 goto syntax;
 
             /* Enforce "Well-formedness constraint: Unique Att Spec". */
             for (pn3 = head; pn3 != pn2; pn3 = pn3->pn_next->pn_next) {
                 if (pn3->pn_atom == pn2->pn_atom) {
-                    Value v = StringTag(ATOM_TO_STRING(pn2->pn_atom));
+                    Value v = StringValue(ATOM_TO_STRING(pn2->pn_atom));
                     ReportCompileErrorNumber(cx, &parser->tokenStream, pn2,
                                              JSREPORT_ERROR, JSMSG_DUPLICATE_XML_ATTR,
                                              js_ValueToPrintableString(cx, v));
                     goto fail;
                 }
             }
 
             str = ATOM_TO_STRING(pn2->pn_atom);
@@ -1474,17 +1474,17 @@ ParseNodeToXML(Parser *parser, JSParseNo
              * Enforce "Well-formedness constraint: Unique Att Spec", part 2:
              * this time checking local name and namespace URI.
              */
             for (j = 0; j < i; j++) {
                 attrj = XMLARRAY_MEMBER(&xml->xml_attrs, j, JSXML);
                 attrjqn = attrj->name;
                 if (js_EqualStrings(GetURI(attrjqn), GetURI(qn)) &&
                     js_EqualStrings(GetLocalName(attrjqn), GetLocalName(qn))) {
-                    Value v = StringTag(ATOM_TO_STRING(pn2->pn_atom));
+                    Value v = StringValue(ATOM_TO_STRING(pn2->pn_atom));
                     ReportCompileErrorNumber(cx, &parser->tokenStream, pn2,
                                              JSREPORT_ERROR, JSMSG_DUPLICATE_XML_ATTR,
                                              js_ValueToPrintableString(cx, v));
                     goto fail;
                 }
             }
 
             pn2 = pn2->pn_next;
@@ -1514,17 +1514,17 @@ ParseNodeToXML(Parser *parser, JSParseNo
         str = ATOM_TO_STRING(pn->pn_atom);
         qn = NULL;
         if (pn->pn_type == TOK_XMLCOMMENT) {
             if (flags & XSF_IGNORE_COMMENTS)
                 goto skip_child;
             xml_class = JSXML_CLASS_COMMENT;
         } else if (pn->pn_type == TOK_XMLPI) {
             if (IS_XML(str)) {
-                Value v = StringTag(str);
+                Value v = StringValue(str);
                 ReportCompileErrorNumber(cx, &parser->tokenStream, pn,
                                          JSREPORT_ERROR, JSMSG_RESERVED_ID,
                                          js_ValueToPrintableString(cx, v));
                 goto fail;
             }
 
             if (flags & XSF_IGNORE_PROCESSING_INSTRUCTIONS)
                 goto skip_child;
@@ -2095,17 +2095,17 @@ GetNamespace(JSContext *cx, JSObject *qn
     JSObject *match, *ns;
     uint32 i, n;
     jsval argv[2];
 
     uri = GetURI(qn);
     prefix = GetPrefix(qn);
     JS_ASSERT(uri);
     if (!uri) {
-        Value v = StringTag(prefix);
+        Value v = StringValue(prefix);
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_BAD_XML_NAMESPACE,
                              prefix
                              ? js_ValueToPrintableString(cx, v)
                              : js_undefined_str);
         return NULL;
     }
 
@@ -2838,17 +2838,17 @@ construct:
 out:
     if (!IsFunctionQName(cx, obj, funidp))
         return NULL;
     return obj;
 
 bad:
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                          JSMSG_BAD_XML_NAME,
-                         js_ValueToPrintableString(cx, StringTag(name)));
+                         js_ValueToPrintableString(cx, StringValue(name)));
     return NULL;
 }
 
 /* ECMA-357 9.1.1.13 XML [[AddInScopeNamespace]]. */
 static JSBool
 AddInScopeNamespace(JSContext *cx, JSXML *xml, JSObject *ns)
 {
     JSString *prefix, *prefix2;
@@ -3269,17 +3269,17 @@ retry:
                 vkid = (JSXML *) vcursor.getNext();
                 if (!kid || !vkid) {
                     *bp = !kid && !vkid;
                     break;
                 }
                 xobj = js_GetXMLObject(cx, kid);
                 vobj = js_GetXMLObject(cx, vkid);
                 if (!xobj || !vobj ||
-                    !js_TestXMLEquality(cx, ObjectTag(*xobj), ObjectTag(*vobj), bp))
+                    !js_TestXMLEquality(cx, ObjectValue(*xobj), ObjectValue(*vobj), bp))
                     return JS_FALSE;
                 if (!*bp)
                     break;
             }
         }
 
         if (*bp && xml->xml_class == JSXML_CLASS_ELEMENT) {
             n = xml->xml_attrs.length;
@@ -3317,17 +3317,17 @@ Equals(JSContext *cx, JSXML *xml, jsval 
         if (xml->xml_class == JSXML_CLASS_LIST) {
             if (xml->xml_kids.length == 1) {
                 vxml = XMLARRAY_MEMBER(&xml->xml_kids, 0, JSXML);
                 if (!vxml)
                     return JS_TRUE;
                 vobj = js_GetXMLObject(cx, vxml);
                 if (!vobj)
                     return JS_FALSE;
-                return js_TestXMLEquality(cx, ObjectTag(*vobj), Valueify(v), bp);
+                return js_TestXMLEquality(cx, ObjectValue(*vobj), Valueify(v), bp);
             }
             if (JSVAL_IS_VOID(v) && xml->xml_kids.length == 0)
                 *bp = JS_TRUE;
         }
     } else {
         vobj = JSVAL_TO_OBJECT(v);
         if (!vobj->isXML()) {
             *bp = JS_FALSE;
@@ -3752,17 +3752,17 @@ KidToString(JSContext *cx, JSXML *xml, u
     JSObject *kidobj;
 
     kid = XMLARRAY_MEMBER(&xml->xml_kids, index, JSXML);
     if (!kid)
         return cx->runtime->emptyString;
     kidobj = js_GetXMLObject(cx, kid);
     if (!kidobj)
         return NULL;
-    return js_ValueToString(cx, ObjectTag(*kidobj));
+    return js_ValueToString(cx, ObjectValue(*kidobj));
 }
 
 /* Forward declared -- its implementation uses other statics that call it. */
 static JSBool
 ResolveValue(JSContext *cx, JSXML *list, JSXML **result);
 
 /* ECMA-357 9.1.1.2 XML [[Put]] and 9.2.1.2 XMLList [[Put]]. */
 static JSBool
@@ -4813,27 +4813,27 @@ xml_enumerate(JSContext *cx, JSObject *o
             *idp = INT_TO_JSID(length);
         break;
 
       case JSENUMERATE_NEXT:
         if (statep->isInt32(0)) {
             statep->setNull();
             break;
         }
-        cursor = (JSXMLArrayCursor *) statep->asPrivate();
+        cursor = (JSXMLArrayCursor *) statep->toPrivate();
         if (cursor && cursor->array && (index = cursor->index) < length) {
             *idp = INT_TO_JSID(index);
             cursor->index = index + 1;
             break;
         }
         /* FALL THROUGH */
 
       case JSENUMERATE_DESTROY:
         if (!statep->isInt32(0)) {
-            cursor = (JSXMLArrayCursor *) statep->asPrivate();
+            cursor = (JSXMLArrayCursor *) statep->toPrivate();
             if (cursor)
                 cx->destroy(cursor);
         }
         statep->setNull();
         break;
     }
     return JS_TRUE;
 }
@@ -4932,22 +4932,22 @@ js_TestXMLEquality(JSContext *cx, const 
     JSXML *xml, *vxml;
     JSObject *vobj;
     JSBool ok;
     JSString *str, *vstr;
     jsdouble d, d2;
 
     JSObject *obj;
     jsval v;
-    if (v1.isObject() && v1.asObject().isXML()) {
-        obj = &v1.asObject();
+    if (v1.isObject() && v1.toObject().isXML()) {
+        obj = &v1.toObject();
         v = Jsvalify(v2);
     } else {
         v = Jsvalify(v1);
-        obj = &v2.asObject();
+        obj = &v2.toObject();
     }
 
     JS_ASSERT(JS_InstanceOf(cx, obj, Jsvalify(&js_XMLClass), NULL));
 
     xml = (JSXML *) obj->getPrivate();
     vxml = NULL;
     if (!JSVAL_IS_PRIMITIVE(v)) {
         vobj = JSVAL_TO_OBJECT(v);
@@ -4964,36 +4964,36 @@ js_TestXMLEquality(JSContext *cx, const 
             if (((xml->xml_class == JSXML_CLASS_TEXT ||
                   xml->xml_class == JSXML_CLASS_ATTRIBUTE) &&
                  HasSimpleContent(vxml)) ||
                 ((vxml->xml_class == JSXML_CLASS_TEXT ||
                   vxml->xml_class == JSXML_CLASS_ATTRIBUTE) &&
                  HasSimpleContent(xml))) {
                 ok = js_EnterLocalRootScope(cx);
                 if (ok) {