--- a/caps/src/nsScriptSecurityManager.cpp
+++ b/caps/src/nsScriptSecurityManager.cpp
@@ -2383,17 +2383,17 @@ nsScriptSecurityManager::doGetObjectPrin
 {
     NS_ASSERTION(aObj, "Bad call to doGetObjectPrincipal()!");
     nsIPrincipal* result = nsnull;
 
 #ifdef DEBUG
     JSObject* origObj = aObj;
 #endif
     
-    const JSClass *jsClass = aObj->getClass();
+    js::Class *jsClass = aObj->getClass();
 
     // A common case seen in this code is that we enter this function
     // with aObj being a Function object, whose parent is a Call
     // object. Neither of those have object principals, so we can skip
     // those objects here before we enter the below loop. That way we
     // avoid wasting time checking properties of their classes etc in
     // the loop.
 

--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -5608,29 +5608,20 @@ CloneSimpleValues(JSContext* cx,
                   jsval* rval,
                   PRBool* wasCloned,
                   JSObject* robj = nsnull,
                   jsid rid = INT_TO_JSID(0))
 {
   *wasCloned = PR_TRUE;
 
   // No cloning necessary for these non-GC'd jsvals.
-  if (!JSVAL_IS_GCTHING(val) || JSVAL_IS_NULL(val)) {
+  if (!JSVAL_IS_GCTHING(val)) {
     return SetPropertyOnValueOrObject(cx, val, rval, robj, rid);
   }
 
-  // Clone doubles.
-  if (JSVAL_IS_DOUBLE(val)) {
-    jsval newVal;
-    if (!JS_NewDoubleValue(cx, *JSVAL_TO_DOUBLE(val), &newVal)) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-    return SetPropertyOnValueOrObject(cx, newVal, rval, robj, rid);
-  }
-
   // We'll use immutable strings to prevent copying if we can.
   if (JSVAL_IS_STRING(val)) {
     if (!JS_MakeStringImmutable(cx, JSVAL_TO_STRING(val))) {
       return NS_ERROR_FAILURE;
     }
     return SetPropertyOnValueOrObject(cx, val, rval, robj, rid);
   }
 
@@ -5751,17 +5742,17 @@ nsContentUtils::CreateStructuredClone(JS
 
   NS_ASSERTION(JSVAL_IS_OBJECT(val), "Not an object?!");
   JSObject* obj = CreateEmptyObjectOrArray(cx, JSVAL_TO_OBJECT(val));
   if (!obj) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   jsval output = OBJECT_TO_JSVAL(obj);
-  js::AutoValueRooter tvr(cx, output);
+  js::AutoObjectRooter tvr(cx, obj);
 
   CloneStack stack(cx);
   if (!stack.Push(val, OBJECT_TO_JSVAL(obj),
                   JS_Enumerate(cx, JSVAL_TO_OBJECT(val)))) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   while (!stack.IsEmpty()) {

--- a/content/canvas/src/NativeJSContext.cpp
+++ b/content/canvas/src/NativeJSContext.cpp
@@ -1,14 +1,14 @@
 #include "NativeJSContext.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIJSRuntimeService.h"
 
 PRBool
-NativeJSContext::AddGCRoot(void *aPtr, const char *aName)
+NativeJSContext::AddGCRoot(JSObject **aPtr, const char *aName)
 {
   NS_ASSERTION(NS_SUCCEEDED(error), "class failed to initialize and caller used class without checking!");
 
   PRBool ok;
   return ok = ::JS_AddNamedObjectRoot(ctx, aPtr, aName);
 }
 
 void

--- a/content/canvas/src/NativeJSContext.h
+++ b/content/canvas/src/NativeJSContext.h
@@ -54,105 +54,89 @@ public:
         if (!JSVAL_IS_NULL(val) &&
             JSVAL_IS_OBJECT(val) &&
             ::JS_IsArrayObject(ctx, JSVAL_TO_OBJECT(val)) &&
             ::JS_GetArrayLength(ctx, JSVAL_TO_OBJECT(val), sz))
             return PR_TRUE;
         return PR_FALSE;
     }
 
-    PRBool AddGCRoot (void *aPtr, const char *aName);
-    void ReleaseGCRoot (void *aPtr);
+    PRBool AddGCRoot (JSObject **aPtr, const char *aName);
+    void ReleaseGCRoot (JSObject **aPtr);
 
     void SetRetVal (PRInt32 val) {
-        if (INT_FITS_IN_JSVAL(val))
-            SetRetValAsJSVal(INT_TO_JSVAL(val));
-        else
-            SetRetVal((double) val);
+        SetRetValAsJSVal(INT_TO_JSVAL(val));
     }
 
     void SetRetVal (PRUint32 val) {
-        if (INT_FITS_IN_JSVAL(val))
-            SetRetValAsJSVal(INT_TO_JSVAL((int) val));
-        else
-            SetRetVal((double) val);
+        SetRetValAsJSVal(UINT_TO_JSVAL(val));
     }
 
     void SetRetVal (double val) {
-        jsval *vp;
-        ncc->GetRetValPtr(&vp);
-        JS_NewDoubleValue(ctx, val, vp);
+        SetRetValAsJSVal(DOUBLE_TO_JSVAL(val));
     }
 
     void SetBoolRetVal (PRBool val) {
-        if (val)
-            SetRetValAsJSVal(JSVAL_TRUE);
-        else
-            SetRetValAsJSVal(JSVAL_FALSE);
+        SetRetValAsJSVal(BOOLEAN_TO_JSVAL(val));
     }
 
     void SetRetVal (PRInt32 *vp, PRUint32 len) {
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
-        for (PRUint32 i = 0; i < len; i++) {
-            if (INT_FITS_IN_JSVAL(vp[i])) {
-                jsvector[i] = INT_TO_JSVAL(vp[i]);
-            } else {
-                JS_NewDoubleValue(ctx, vp[i], &jsvector[i]);
-            }
-        }
+        for (PRUint32 i = 0; i < len; i++)
+            jsvector[i] = INT_TO_JSVAL(vp[i]);
 
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetVal (PRUint32 *vp, PRUint32 len) {
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
-        for (PRUint32 i = 0; i < len; i++) {
-            JS_NewNumberValue(ctx, vp[i], &jsvector[i]);
-        }
+        for (PRUint32 i = 0; i < len; i++)
+            jsvector[i] = UINT_TO_JSVAL(vp[i]);
 
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetVal (double *dp, PRUint32 len) {
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
         for (PRUint32 i = 0; i < len; i++)
-            JS_NewDoubleValue(ctx, (jsdouble) dp[i], &jsvector[i]);
-            
+            jsvector[i] = DOUBLE_TO_JSVAL(dp[i]);
+
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetVal (float *fp, PRUint32 len) {
         nsAutoArrayPtr<jsval> jsvector(new jsval[len]);
 
         if (!JS_EnterLocalRootScope(ctx))
             return; // XXX ???
 
         for (PRUint32 i = 0; i < len; i++)
-            JS_NewDoubleValue(ctx, (jsdouble) fp[i], &jsvector[i]);
+            jsvector[i] = DOUBLE_TO_JSVAL(fp[i]);
+
         JSObject *jsarr = JS_NewArrayObject(ctx, len, jsvector.get());
         SetRetVal(jsarr);
 
         JS_LeaveLocalRootScope(ctx);
     }
 
     void SetRetValAsJSVal (jsval val) {
         jsval *vp;
@@ -324,21 +308,17 @@ public:
     PRBool DefineProperty(const char *name, PRUint32 val) {
         // XXX handle too big ints
         if (!JS_DefineProperty(mCtx->ctx, mObject, name, INT_TO_JSVAL((int)val), NULL, NULL, JSPROP_ENUMERATE))
             return PR_FALSE;
         return PR_TRUE;
     }
 
     PRBool DefineProperty(const char *name, double val) {
-        jsval dv;
-
-        if (!JS_NewDoubleValue(mCtx->ctx, val, &dv))
-            return PR_FALSE;
-
+        jsval dv = DOUBLE_TO_JSVAL(val);
         if (!JS_DefineProperty(mCtx->ctx, mObject, name, dv, NULL, NULL, JSPROP_ENUMERATE))
             return PR_FALSE;
         return PR_TRUE;
     }
 
     PRBool DefineProperty(const char *name, JSObject *val) {
         if (!JS_DefineProperty(mCtx->ctx, mObject, name, OBJECT_TO_JSVAL(val), NULL, NULL, JSPROP_ENUMERATE))
             return PR_FALSE;

--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1530,17 +1530,17 @@ FindObjectClass(JSObject* aGlobalObject)
   NS_ASSERTION(!sObjectClass,
                "Double set of sObjectClass");
   JSObject *obj, *proto = aGlobalObject;
   do {
     obj = proto;
     proto = obj->getProto();
   } while (proto);
 
-  sObjectClass = obj->getClass();
+  sObjectClass = obj->getJSClass();
 }
 
 static void
 PrintWarningOnConsole(JSContext *cx, const char *stringBundleProperty)
 {
   nsCOMPtr<nsIStringBundleService>
     stringService(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
   if (!stringService) {
@@ -6856,17 +6856,17 @@ nsWindowSH::NewResolve(nsIXPConnectWrapp
       // know here we're dealing with an undefined property set, so
       // we're not declaring readonly or permanent properties.
       //
       // Since we always create the undeclared property here without given a
       // chance for the interpreter to report applicable strict mode warnings,
       // we must take care to check those warnings here.
       JSString *str = JSVAL_TO_STRING(id);
       if ((!(flags & JSRESOLVE_QUALIFIED) &&
-           !js_CheckUndeclaredVarAssignment(cx, id)) ||
+           !js_CheckUndeclaredVarAssignment(cx, str)) ||
           !::JS_DefineUCProperty(cx, obj, ::JS_GetStringChars(str),
                                  ::JS_GetStringLength(str), JSVAL_VOID,
                                  JS_PropertyStub, JS_PropertyStub,
                                  JSPROP_ENUMERATE)) {
         *_retval = JS_FALSE;
 
         return NS_OK;
       }
@@ -8565,17 +8565,17 @@ nsHTMLDocumentSH::DocumentAllGetProperty
   // document.all.item and .namedItem get their value in the
   // newResolve hook, so nothing to do for those properties here. And
   // we need to return early to prevent <div id="item"> from shadowing
   // document.all.item(), etc.
   if (id == sItem_id || id == sNamedItem_id) {
     return JS_TRUE;
   }
 
-  while (obj->getClass() != &sHTMLDocumentAllClass) {
+  while (obj->getJSClass() != &sHTMLDocumentAllClass) {
     obj = obj->getProto();
 
     if (!obj) {
       NS_ERROR("The JS engine lies!");
 
       return JS_TRUE;
     }
   }

--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -1208,17 +1208,17 @@ nsJSContext::DOMOperationCallback(JSCont
   else if ((buttonPressed == 2) && debugPossible) {
     // Debug the script
     jsval rval;
     switch(cx->debugHooks->debuggerHandler(cx, script, ::JS_GetFramePC(cx, fp),
                                            &rval,
                                            cx->debugHooks->
                                            debuggerHandlerData)) {
       case JSTRAP_RETURN:
-        fp->rval = rval;
+        fp->rval = js::Valueify(rval);
         return JS_TRUE;
       case JSTRAP_ERROR:
         cx->throwing = JS_FALSE;
         return JS_FALSE;
       case JSTRAP_THROW:
         JS_SetPendingException(cx, rval);
         return JS_FALSE;
       case JSTRAP_CONTINUE:

--- a/js/jsd/jsd.h
+++ b/js/jsd/jsd.h
@@ -961,17 +961,17 @@ jsd_IsValueNative(JSDContext* jsdc, JSDV
 /**************************************************/
 
 extern JSBool
 jsd_GetValueBoolean(JSDContext* jsdc, JSDValue* jsdval);
 
 extern int32
 jsd_GetValueInt(JSDContext* jsdc, JSDValue* jsdval);
 
-extern jsdouble*
+extern jsdouble
 jsd_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval);
 
 extern JSString*
 jsd_GetValueString(JSDContext* jsdc, JSDValue* jsdval);
 
 extern const char*
 jsd_GetValueFunctionName(JSDContext* jsdc, JSDValue* jsdval);
 

--- a/js/jsd/jsd_val.c
+++ b/js/jsd/jsd_val.c
@@ -198,22 +198,22 @@ int32
 jsd_GetValueInt(JSDContext* jsdc, JSDValue* jsdval)
 {
     jsval val = jsdval->val;
     if(!JSVAL_IS_INT(val))
         return 0;
     return JSVAL_TO_INT(val);
 }
 
-jsdouble*
+jsdouble
 jsd_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval)
 {
     if(!JSVAL_IS_DOUBLE(jsdval->val))
         return 0;
-    return JSVAL_PTR_TO_DOUBLE_PTR(&jsdval->val);
+    return JSVAL_TO_DOUBLE(jsdval->val);
 }
 
 JSString*
 jsd_GetValueString(JSDContext* jsdc, JSDValue* jsdval)
 {
     JSContext* cx = jsdc->dumbContext;
     JSExceptionState* exceptionState;
 
@@ -336,24 +336,24 @@ static JSDProperty* _newProperty(JSDCont
     if(!(jsdprop = (JSDProperty*) calloc(1, sizeof(JSDProperty))))
         return NULL;
 
     JS_INIT_CLIST(&jsdprop->links);
     jsdprop->nref = 1;
     jsdprop->flags = pd->flags | additionalFlags;
     jsdprop->slot = pd->slot;
 
-    if(!(jsdprop->name = jsd_NewValue(jsdc, JSID_TO_JSVAL(pd->id))))
+    if(!(jsdprop->name = jsd_NewValue(jsdc, ID_TO_JSVAL(pd->id))))
         goto new_prop_fail;
 
     if(!(jsdprop->val = jsd_NewValue(jsdc, pd->value)))
         goto new_prop_fail;
 
     if((jsdprop->flags & JSDPD_ALIAS) &&
-       !(jsdprop->alias = jsd_NewValue(jsdc, JSID_TO_JSVAL(pd->alias))))
+       !(jsdprop->alias = jsd_NewValue(jsdc, ID_TO_JSVAL(pd->alias))))
         goto new_prop_fail;
 
     return jsdprop;
 new_prop_fail:
     jsd_DropProperty(jsdc, jsdprop);
     return NULL;
 }
 
@@ -543,20 +543,20 @@ jsd_GetValueProperty(JSDContext* jsdc, J
     else
     {
         pd.value = val;
     }
 
     JS_EndRequest(cx);
 
     nameval = STRING_TO_JSVAL(name);
-    if (!JS_ValueToId(cx, &nameval, &pd.id))
+    if (!JS_ValueToId(cx, nameval, &pd.id))
         return NULL;
     pd.slot = pd.spare = 0;
-    pd.alias = JSID_NULL;
+    pd.alias = JSVAL_NULL;
     pd.flags |= (attrs & JSPROP_ENUMERATE) ? JSPD_ENUMERATE : 0
         | (attrs & JSPROP_READONLY)  ? JSPD_READONLY  : 0
         | (attrs & JSPROP_PERMANENT) ? JSPD_PERMANENT : 0;
 
     return _newProperty(jsdc, &pd, JSDPD_HINTED);
 }
 
 

--- a/js/jsd/jsd_xpc.cpp
+++ b/js/jsd/jsd_xpc.cpp
@@ -2183,20 +2183,17 @@ jsdValue::GetBooleanValue(PRBool *_rval)
     *_rval = JSD_GetValueBoolean (mCx, mValue);
     return NS_OK;
 }
 
 NS_IMETHODIMP
 jsdValue::GetDoubleValue(double *_rval)
 {
     ASSERT_VALID_EPHEMERAL;
-    double *dp = JSD_GetValueDouble (mCx, mValue);
-    if (!dp)
-        return NS_ERROR_FAILURE;
-    *_rval = *dp;
+    *_rval = JSD_GetValueDouble (mCx, mValue);
     return NS_OK;
 }
 
 NS_IMETHODIMP
 jsdValue::GetIntValue(PRInt32 *_rval)
 {
     ASSERT_VALID_EPHEMERAL;
     *_rval = JSD_GetValueInt (mCx, mValue);

--- a/js/jsd/jsdebug.c
+++ b/js/jsd/jsdebug.c
@@ -1107,17 +1107,17 @@ JSD_GetValueBoolean(JSDContext* jsdc, JS
 JSD_PUBLIC_API(int32)
 JSD_GetValueInt(JSDContext* jsdc, JSDValue* jsdval)
 {
     JSD_ASSERT_VALID_CONTEXT(jsdc);
     JSD_ASSERT_VALID_VALUE(jsdval);
     return jsd_GetValueInt(jsdc, jsdval);
 }
 
-JSD_PUBLIC_API(jsdouble*)
+JSD_PUBLIC_API(jsdouble)
 JSD_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval)
 {
     JSD_ASSERT_VALID_CONTEXT(jsdc);
     JSD_ASSERT_VALID_VALUE(jsdval);
     return jsd_GetValueDouble(jsdc, jsdval);
 }
 
 JSD_PUBLIC_API(JSString*)

--- a/js/jsd/jsdebug.h
+++ b/js/jsd/jsdebug.h
@@ -49,23 +49,21 @@
 extern "C"
 {
 #endif
 #include "jstypes.h"
 #ifdef __cplusplus
 }
 #endif
 
-JS_BEGIN_EXTERN_C
 #include "jsapi.h"
 #include "jsdbgapi.h"
 #ifdef LIVEWIRE
 #include "lwdbgapi.h"
 #endif
-JS_END_EXTERN_C
 
 JS_BEGIN_EXTERN_C
 
 /*
  * The linkage of JSD API functions differs depending on whether the file is
  * used within the JSD library or not.  Any source file within the JSD
  * libraray should define EXPORT_JSD_API whereas any client of the library
  * should not.
@@ -1265,17 +1263,17 @@ JSD_GetValueBoolean(JSDContext* jsdc, JS
 */
 extern JSD_PUBLIC_API(int32)
 JSD_GetValueInt(JSDContext* jsdc, JSDValue* jsdval);
 
 /*
 * Return double value (does NOT do conversion).
 * *** new for version 1.1 ****
 */
-extern JSD_PUBLIC_API(jsdouble*)
+extern JSD_PUBLIC_API(jsdouble)
 JSD_GetValueDouble(JSDContext* jsdc, JSDValue* jsdval);
 
 /*
 * Return JSString value (DOES do conversion if necessary).
 * NOTE that the JSString returned is not protected from garbage
 * collection. It should be immediately read or wrapped using
 * JSD_NewValue(jsdc,STRING_TO_JSVAL(str)) if necessary.
 * *** new for version 1.1 ****

--- a/js/src/jsapi-tests/testNewObject.cpp
+++ b/js/src/jsapi-tests/testNewObject.cpp
@@ -62,17 +62,16 @@ BEGIN_TEST(testNewObject_1)
     obj = JS_New(cx, Array, 1, argv);
     CHECK(obj);
     rt = OBJECT_TO_JSVAL(obj);
     CHECK(JS_IsArrayObject(cx, obj));
     CHECK(JS_GetArrayLength(cx, obj, &len));
     CHECK(len == 4);
 
     // With N arguments.
-    JS_ASSERT(INT_FITS_IN_JSVAL(N));
     for (size_t i = 0; i < N; i++)
         argv[i] = INT_TO_JSVAL(i);
     obj = JS_New(cx, Array, N, argv);
     CHECK(obj);
     rt = OBJECT_TO_JSVAL(obj);
     CHECK(JS_IsArrayObject(cx, obj));
     CHECK(JS_GetArrayLength(cx, obj, &len));
     CHECK(len == N);

--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -59,188 +59,208 @@ JS_BEGIN_EXTERN_C
 #define JSVAL_TRUE   BUILD_JSVAL(JSVAL_MASK32_BOOLEAN,   JS_TRUE)
 #define JSVAL_VOID   BUILD_JSVAL(JSVAL_MASK32_UNDEFINED, 0)
 
 /* Predicates for type testing. */
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_NULL(jsval v)
 {
-    jsval_layout l = { v };
+    jsval_layout l;
+    l.asBits = v;
     return JSVAL_IS_NULL_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_VOID(jsval v)
 {
-    jsval_layout l = { v };
+    jsval_layout l;
+    l.asBits = v;
     return JSVAL_IS_UNDEFINED_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_INT(jsval v)
 {
-    jsval_layout l = { v };
-    return l.s.mask32 == JSVAL_MASK32_INT32;
+    jsval_layout l;
+    l.asBits = v;
+    return l.s.u.mask32 == JSVAL_MASK32_INT32;
 }
 
 static JS_ALWAYS_INLINE jsint
 JSVAL_TO_INT(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_INT(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return l.s.payload.i32;
 }
 
 #define JSVAL_INT_BITS          32
 #define JSVAL_INT_MIN           ((jsint)0x80000000)
 #define JSVAL_INT_MAX           ((jsint)0x7fffffff)
 
-static JS_ALWAYS_INLINE bool
-INT_FITS_IN_JSVAL(jsint i)
-{
-    return JS_TRUE;
-}
-
 static JS_ALWAYS_INLINE jsval
 INT_TO_JSVAL(int32 i)
 {
     return INT32_TO_JSVAL_IMPL(i).asBits;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_DOUBLE(jsval v)
 {
-    jsval_layout l = { v };
+    jsval_layout l;
+    l.asBits = v;
     return JSVAL_IS_DOUBLE_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE jsdouble
 JSVAL_TO_DOUBLE(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_DOUBLE(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return l.asDouble;
 }
 
 static JS_ALWAYS_INLINE jsval
 DOUBLE_TO_JSVAL(jsdouble d)
 {
     return DOUBLE_TO_JSVAL_IMPL(d).asBits;
 }
 
+static JS_ALWAYS_INLINE jsval
+UINT_TO_JSVAL(uint32 i)
+{
+    if (i <= JSVAL_INT_MAX)
+        return INT_TO_JSVAL((int32)i);
+    return DOUBLE_TO_JSVAL((jsdouble)i);
+}
+
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_NUMBER(jsval v)
 {
-    jsval_layout l = { v };
+    jsval_layout l;
+    l.asBits = v;
     return JSVAL_IS_NUMBER_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_STRING(jsval v)
 {
-    jsval_layout l = { v };
-    return l.s.mask32 == JSVAL_MASK32_STRING;
+    jsval_layout l;
+    l.asBits = v;
+    return l.s.u.mask32 == JSVAL_MASK32_STRING;
 }
 
 static JS_ALWAYS_INLINE JSString *
 JSVAL_TO_STRING(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_STRING(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return JSVAL_TO_STRING_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE jsval
 STRING_TO_JSVAL(JSString *str)
 {
     return STRING_TO_JSVAL_IMPL(str).asBits;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_OBJECT(jsval v)
 {
-    jsval_layout l = { v };
+    jsval_layout l;
+    l.asBits = v;
     return JSVAL_IS_OBJECT_OR_NULL_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE JSObject *
 JSVAL_TO_OBJECT(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_OBJECT(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return JSVAL_TO_OBJECT_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE jsval
 OBJECT_TO_JSVAL(JSObject *obj)
 {
+    JSValueMask32 mask;
     if (!obj)
         return JSVAL_NULL;
-    JSValueMask32 mask = JS_OBJ_IS_FUN_IMPL(obj) ? JSVAL_MASK32_FUNOBJ
-                                                 : JSVAL_MASK32_NONFUNOBJ;
+    mask = JS_OBJ_IS_FUN_IMPL(obj) ? JSVAL_MASK32_FUNOBJ
+                                   : JSVAL_MASK32_NONFUNOBJ;
     return OBJECT_TO_JSVAL_IMPL(mask, obj).asBits;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_BOOLEAN(jsval v)
 {
-    jsval_layout l = { v };
-    return l.s.mask32 == JSVAL_MASK32_BOOLEAN;
+    jsval_layout l;
+    l.asBits = v;
+    return l.s.u.mask32 == JSVAL_MASK32_BOOLEAN;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_TO_BOOLEAN(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_BOOLEAN(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return l.s.payload.boo;
 }
 
 static JS_ALWAYS_INLINE jsval
 BOOLEAN_TO_JSVAL(JSBool b)
 {
     return BOOLEAN_TO_JSVAL_IMPL(b).asBits;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_PRIMITIVE(jsval v)
 {
-    jsval_layout l = { v };
+    jsval_layout l;
+    l.asBits = v;
     return JSVAL_IS_PRIMITIVE_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_GCTHING(jsval v)
 {
-    jsval_layout l = { v };
+    jsval_layout l;
+    l.asBits = v;
     return JSVAL_IS_GCTHING_IMPL(l);
 }
 
 static JS_ALWAYS_INLINE void *
 JSVAL_TO_GCTHING(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_GCTHING(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return JSVAL_TO_GCTHING_IMPL(l);
 }
 
 /* To be GC-safe, privates are tagged as doubles. */
 
 static JS_ALWAYS_INLINE jsval
 PRIVATE_TO_JSVAL(void *ptr)
 {
     return PRIVATE_TO_JSVAL_IMPL(ptr).asBits;
 }
 
 static JS_ALWAYS_INLINE void *
 JSVAL_TO_PRIVATE(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_DOUBLE(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return JSVAL_TO_PRIVATE_IMPL(l);
 }
 
 /* Lock and unlock the GC thing held by a jsval. */
 #define JSVAL_LOCK(cx,v)        (JSVAL_IS_GCTHING(v)                          \
                                  ? JS_LockGCThing(cx, JSVAL_TO_GCTHING(v))    \
                                  : JS_TRUE)
 #define JSVAL_UNLOCK(cx,v)      (JSVAL_IS_GCTHING(v)                          \
@@ -1154,18 +1174,19 @@ static JS_ALWAYS_INLINE void *
 JSVAL_TO_TRACEABLE(jsval v)
 {
     return JSVAL_TO_GCTHING(v);
 }
 
 static JS_ALWAYS_INLINE uint32
 JSVAL_TRACE_KIND(jsval v)
 {
+    jsval_layout l;
     JS_ASSERT(JSVAL_IS_GCTHING(v));
-    jsval_layout l = { v };
+    l.asBits = v;
     return JSVAL_TRACE_KIND_IMPL(l);
 }
 
 struct JSTracer {
     JSContext           *context;
     JSTraceCallback     callback;
     JSTraceNamePrinter  debugPrinter;
     const void          *debugPrintArg;
@@ -3132,41 +3153,41 @@ class Value
         return JSVAL_IS_NULL_IMPL(data);
     }
 
     bool isNullOrUndefined() const {
         return JSVAL_IS_SINGLETON_IMPL(data);
     }
 
     bool isInt32() const {
-        return data.s.mask32 == JSVAL_MASK32_INT32;
+        return data.s.u.mask32 == JSVAL_MASK32_INT32;
     }
 
     bool isInt32(int32 i32) const {
         return JSVAL_IS_SPECIFIC_INT32_IMPL(data, i32);
     }
 
     bool isDouble() const {
         return JSVAL_IS_DOUBLE_IMPL(data);
     }
 
     bool isNumber() const {
         return JSVAL_IS_NUMBER_IMPL(data);
     }
 
     bool isString() const {
-        return data.s.mask32 == JSVAL_MASK32_STRING;
+        return data.s.u.mask32 == JSVAL_MASK32_STRING;
     }
 
     bool isNonFunObj() const {
-        return data.s.mask32 == JSVAL_MASK32_NONFUNOBJ;
+        return data.s.u.mask32 == JSVAL_MASK32_NONFUNOBJ;
     }
 
     bool isFunObj() const {
-        return data.s.mask32 == JSVAL_MASK32_FUNOBJ;
+        return data.s.u.mask32 == JSVAL_MASK32_FUNOBJ;
     }
 
     bool isObject() const {
         return JSVAL_IS_OBJECT_IMPL(data);
     }
 
     bool isPrimitive() const {
         return JSVAL_IS_PRIMITIVE_IMPL(data);
@@ -3176,29 +3197,29 @@ class Value
         return JSVAL_IS_OBJECT_OR_NULL_IMPL(data);
     }
 
     bool isGCThing() const {
         return JSVAL_IS_GCTHING_IMPL(data);
     }
 
     bool isBoolean() const {
-        return data.s.mask32 == JSVAL_MASK32_BOOLEAN;
+        return data.s.u.mask32 == JSVAL_MASK32_BOOLEAN;
     }
 
     bool isTrue() const {
         return JSVAL_IS_SPECIFIC_BOOLEAN(data, true);
     }
 
     bool isFalse() const {
         return JSVAL_IS_SPECIFIC_BOOLEAN(data, false);
     }
 
     bool isMagic() const {
-        return data.s.mask32 == JSVAL_MASK32_MAGIC;
+        return data.s.u.mask32 == JSVAL_MASK32_MAGIC;
     }
 
     bool isMagic(JSWhyMagic why) const {
         JS_ASSERT_IF(isMagic(), data.s.payload.why == why);
         return isMagic();
     }
 
     int32 traceKind() const {
@@ -3405,18 +3426,12 @@ struct ExtendedClass {
 
 JS_STATIC_ASSERT(sizeof(JSExtendedClass) == sizeof(ExtendedClass));
 
 static JS_ALWAYS_INLINE JSClass *         Jsvalify(Class *c)           { return (JSClass *)c; }
 static JS_ALWAYS_INLINE Class *           Valueify(JSClass *c)         { return (Class *)c; }
 static JS_ALWAYS_INLINE JSExtendedClass * Jsvalify(ExtendedClass *c)   { return (JSExtendedClass *)c; }
 static JS_ALWAYS_INLINE ExtendedClass *   Valueify(JSExtendedClass *c) { return (ExtendedClass *)c; }
 
-static const PropertyOp PropertyStub     = (PropertyOp)JS_PropertyStub;
-static const JSEnumerateOp EnumerateStub = JS_EnumerateStub;
-static const JSResolveOp ResolveStub     = JS_ResolveStub;
-static const ConvertOp ConvertStub       = (ConvertOp)JS_ConvertStub;
-static const JSFinalizeOp FinalizeStub   = JS_FinalizeStub;
-
 } /* namespace js */
 #endif  /* __cplusplus */
 
 #endif /* jsapi_h___ */

--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -2127,17 +2127,17 @@ js_ReportIsNotDefined(JSContext *cx, con
 
 JSBool
 js_ReportIsNullOrUndefined(JSContext *cx, intN spindex, const Value &v,
                            JSString *fallback)
 {
     char *bytes;
     JSBool ok;
 
-    bytes = js_DecompileValueGenerator(cx, spindex, v, fallback);
+    bytes = DecompileValueGenerator(cx, spindex, v, fallback);
     if (!bytes)
         return JS_FALSE;
 
     if (strcmp(bytes, js_undefined_str) == 0 ||
         strcmp(bytes, js_null_str) == 0) {
         ok = JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR,
                                           js_GetErrorMessage, NULL,
                                           JSMSG_NO_PROPERTIES, bytes,
@@ -2165,18 +2165,18 @@ js_ReportMissingArg(JSContext *cx, const
     char argbuf[11];
     char *bytes;
     JSAtom *atom;
 
     JS_snprintf(argbuf, sizeof argbuf, "%u", arg);
     bytes = NULL;
     if (v.isFunObj()) {
         atom = GET_FUNCTION_PRIVATE(cx, &v.asFunObj())->atom;
-        bytes = js_DecompileValueGenerator(cx, JSDVG_SEARCH_STACK,
-                                           v, ATOM_TO_STRING(atom));
+        bytes = DecompileValueGenerator(cx, JSDVG_SEARCH_STACK,
+                                        v, ATOM_TO_STRING(atom));
         if (!bytes)
             return;
     }
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                          JSMSG_MISSING_FUN_ARG, argbuf,
                          bytes ? bytes : "");
     cx->free(bytes);
 }
@@ -2186,17 +2186,17 @@ js_ReportValueErrorFlags(JSContext *cx, 
                          intN spindex, const Value &v, JSString *fallback,
                          const char *arg1, const char *arg2)
 {
     char *bytes;
     JSBool ok;
 
     JS_ASSERT(js_ErrorFormatString[errorNumber].argCount >= 1);
     JS_ASSERT(js_ErrorFormatString[errorNumber].argCount <= 3);
-    bytes = js_DecompileValueGenerator(cx, spindex, v, fallback);
+    bytes = js::DecompileValueGenerator(cx, spindex, v, fallback);
     if (!bytes)
         return JS_FALSE;
 
     ok = JS_ReportErrorFlagsAndNumber(cx, flags, js_GetErrorMessage,
                                       NULL, errorNumber, bytes, arg1, arg2);
     cx->free(bytes);
     return ok;
 }

--- a/js/src/jsgcchunk.h
+++ b/js/src/jsgcchunk.h
@@ -35,18 +35,18 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef jsgchunk_h__
 #define jsgchunk_h__
 
+#include "jsapi.h"
 #include "jsprvtd.h"
-#include "jspubtd.h"
 #include "jsutil.h"
 
 namespace js {
 
 #if defined(WINCE) && !defined(MOZ_MEMORY_WINCE6)
 const size_t GC_CHUNK_SHIFT = 21;
 #else
 const size_t GC_CHUNK_SHIFT = 20;

--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -1317,17 +1317,17 @@ js_TraceOpcode(JSContext *cx)
         /*
          * If there aren't that many elements on the stack, then we have
          * probably entered a new frame, and printing output would just be
          * misleading.
          */
         if (ndefs != 0 &&
             ndefs < regs->sp - fp->slots()) {
             for (n = -ndefs; n < 0; n++) {
-                char *bytes = js_DecompileValueGenerator(cx, n, regs->sp[n], NULL);
+                char *bytes = DecompileValueGenerator(cx, n, regs->sp[n], NULL);
                 if (bytes) {
                     fprintf(tracefp, "%s %s",
                             (n == -ndefs) ? "  output:" : ",",
                             bytes);
                     cx->free(bytes);
                 } else {
                     JS_ClearPendingException(cx);
                 }
@@ -1352,17 +1352,17 @@ js_TraceOpcode(JSContext *cx)
             js_PCToLineNumber(cx, fp->script, fp->imacpc ? fp->imacpc : regs->pc));
     js_Disassemble1(cx, fp->script, regs->pc,
                     regs->pc - fp->script->code,
                     JS_FALSE, tracefp);
     op = (JSOp) *regs->pc;
     nuses = js_GetStackUses(&js_CodeSpec[op], op, regs->pc);
     if (nuses != 0) {
         for (n = -nuses; n < 0; n++) {
-            char *bytes = js_DecompileValueGenerator(cx, n, regs->sp[n], NULL);
+            char *bytes = DecompileValueGenerator(cx, n, regs->sp[n], NULL);
             if (bytes) {
                 fprintf(tracefp, "%s %s",
                         (n == -nuses) ? "  inputs:" : ",",
                         bytes);
                 cx->free(bytes);
             } else {
                 JS_ClearPendingException(cx);
             }

--- a/js/src/jsinterp.h
+++ b/js/src/jsinterp.h
@@ -283,17 +283,17 @@ class PrimitiveValue
     static const uint32 Masks[THISP_ARRAY_SIZE];
 
   public:
     static const uint32 DOUBLE_MASK = 0xFFFF8000;
 
     static bool test(JSFunction *fun, const Value &v) {
         uint32 mask = Masks[(fun->flags >> THISP_SHIFT) & THISP_MASK];
         return (((mask & DOUBLE_MASK) != 0) & v.isDouble()) |
-               ((mask & v.data.s.mask32) > JSVAL_MASK32_CLEAR);
+               ((mask & v.data.s.u.mask32) > JSVAL_MASK32_CLEAR);
     }
 };
 
 /*
  * The js::InvokeArgumentsGuard passed to js_Invoke must come from an
  * immediately-enclosing successful call to js::StackSpace::pushInvokeArgs,
  * i.e., there must have been no un-popped pushes to cx->stack(). Furthermore,
  * |args.getvp()[0]| should be the callee, |args.getvp()[1]| should be |this|,

--- a/js/src/jslock.h
+++ b/js/src/jslock.h
@@ -35,18 +35,18 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 #ifndef jslock_h__
 #define jslock_h__
 
 #include "jstypes.h"
-#include "jsprvtd.h"    /* for JSScope, etc. */
-#include "jspubtd.h"    /* for JSRuntime, etc. */
+#include "jsapi.h"
+#include "jsprvtd.h"
 
 #ifdef JS_THREADSAFE
 # include "pratom.h"
 # include "prlock.h"
 # include "prcvar.h"
 # include "prthread.h"
 #endif
 

--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1763,17 +1763,17 @@ JSBool
 obj_getPrototypeOf(JSContext *cx, uintN argc, Value *vp)
 {
     if (argc == 0) {
         js_ReportMissingArg(cx, *vp, 0);
         return JS_FALSE;
     }
 
     if (vp[2].isPrimitive()) {
-        char *bytes = js_DecompileValueGenerator(cx, 0 - argc, vp[2], NULL);
+        char *bytes = DecompileValueGenerator(cx, 0 - argc, vp[2], NULL);
         if (!bytes)
             return JS_FALSE;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                              JSMSG_UNEXPECTED_TYPE, bytes, "not an object");
         JS_free(cx, bytes);
         return JS_FALSE;
     }
 
@@ -2502,17 +2502,17 @@ obj_create(JSContext *cx, uintN argc, Va
     if (argc == 0) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_MORE_ARGS_NEEDED,
                              "Object.create", "0", "s");
         return JS_FALSE;
     }
 
     const Value &v = vp[2];
     if (!v.isObjectOrNull()) {
-        char *bytes = js_DecompileValueGenerator(cx, JSDVG_SEARCH_STACK, v, NULL);
+        char *bytes = DecompileValueGenerator(cx, JSDVG_SEARCH_STACK, v, NULL);
         if (!bytes)
             return JS_FALSE;
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                              bytes, "not an object or null");
         JS_free(cx, bytes);
         return JS_FALSE;
     }
 
@@ -6160,17 +6160,17 @@ js_ReportGetterOnlyAssignment(JSContext 
     return JS_ReportErrorFlagsAndNumber(cx,
                                         JSREPORT_WARNING | JSREPORT_STRICT |
                                         JSREPORT_STRICT_MODE_ERROR,
                                         js_GetErrorMessage, NULL,
                                         JSMSG_GETTER_ONLY);
 }
 
 JS_FRIEND_API(JSBool)
-js_GetterOnlyPropertyStub(JSContext *cx, JSObject *obj, jsid id, Value *vp)
+js_GetterOnlyPropertyStub(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
 {
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_GETTER_ONLY);
     return JS_FALSE;
 }
 
 #ifdef DEBUG
 
 namespace js {

--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -5098,23 +5098,25 @@ js_DecompileFunction(JSPrinter *jp)
 
     if (!jp->pretty && !jp->grouped && (fun->flags & JSFUN_LAMBDA))
         js_puts(jp, ")");
 
     return JS_TRUE;
 }
 
 char *
-js_DecompileValueGenerator(JSContext *cx, intN spindex, const Value &v,
+js_DecompileValueGenerator(JSContext *cx, intN spindex, jsval v_in,
                            JSString *fallback)
 {
     JSStackFrame *fp;
     jsbytecode *pc;
     JSScript *script;
 
+    Value v = Valueify(v_in);
+
     JS_ASSERT(spindex < 0 ||
               spindex == JSDVG_IGNORE_STACK ||
               spindex == JSDVG_SEARCH_STACK);
 
     LeaveTrace(cx);
     
     /* Get scripted caller */
     FrameRegsIter i(cx);

--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -451,22 +451,35 @@ js_DecompileToString(JSContext *cx, cons
  * Search the current stack frame if spindex is JSDVG_SEARCH_STACK.  Don't
  * look for v on the stack if spindex is JSDVG_IGNORE_STACK.  Otherwise,
  * spindex is the negative index of v, measured from cx->fp->sp, or from a
  * lower frame's sp if cx->fp is native.
  *
  * The caller must call JS_free on the result after a succsesful call.
  */
 extern char *
-js_DecompileValueGenerator(JSContext *cx, intN spindex, const js::Value &v,
+js_DecompileValueGenerator(JSContext *cx, intN spindex, jsval v,
                            JSString *fallback);
 
 #define JSDVG_IGNORE_STACK      0
 #define JSDVG_SEARCH_STACK      1
 
+#ifdef __cplusplus
+namespace js {
+
+static inline char *
+DecompileValueGenerator(JSContext *cx, intN spindex, Value v,
+                        JSString *fallback)
+{
+    return js_DecompileValueGenerator(cx, spindex, Jsvalify(v), fallback);
+}
+
+}
+#endif
+
 /*
  * Given bytecode address pc in script's main program code, return the operand
  * stack depth just before (JSOp) *pc executes.
  */
 extern uintN
 js_ReconstructStackDepth(JSContext *cx, JSScript *script, jsbytecode *pc);
 
 #ifdef _MSC_VER

--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -81,17 +81,17 @@
 
 /*
  * Convenience constants.
  */
 #define JS_BITS_PER_UINT32_LOG2 5
 #define JS_BITS_PER_UINT32      32
 
 /* The alignment required of objects stored in GC arenas. */
-const uintN JS_GCTHING_ALIGN = 8;
+static const uintN JS_GCTHING_ALIGN = 8;
 
 /* Scalar typedefs. */
 typedef uint8  jsbytecode;
 typedef uint8  jssrcnote;
 typedef uint32 jsatomid;
 
 #ifdef __cplusplus
 
@@ -416,12 +416,18 @@ typedef JSBool
 
 static inline DefinePropOp        Valueify(JSDefinePropOp f)      { return (DefinePropOp)f; }
 static inline JSDefinePropOp      Jsvalify(DefinePropOp f)        { return (JSDefinePropOp)f; }
 static inline CheckAccessIdOp     Valueify(JSCheckAccessIdOp f)   { return (CheckAccessIdOp)f; }
 static inline JSCheckAccessIdOp   Jsvalify(CheckAccessIdOp f)     { return (JSCheckAccessIdOp)f; }
 static inline PropertyIdOp        Valueify(JSPropertyIdOp f);     /* Same type as JSPropertyOp */
 static inline JSPropertyIdOp      Jsvalify(PropertyIdOp f);       /* Same type as PropertyOp */
 
+static const PropertyOp    PropertyStub  = (PropertyOp)JS_PropertyStub;
+static const JSEnumerateOp EnumerateStub = JS_EnumerateStub;
+static const JSResolveOp   ResolveStub   = JS_ResolveStub;
+static const ConvertOp     ConvertStub   = (ConvertOp)JS_ConvertStub;
+static const JSFinalizeOp  FinalizeStub  = JS_FinalizeStub;
+
 }  /* namespace js */
 #endif /* __cplusplus */
 
 #endif /* jsprvtd_h___ */

--- a/js/src/jspubtd.h
+++ b/js/src/jspubtd.h
@@ -187,46 +187,33 @@ typedef enum JSValueMask16
      */
     JSVAL_NANBOX_PATTERN   = ((uint16)0xFFFF)
 }
 #if defined(__GNUC__)
 __attribute__((packed))
 #endif
 JSValueMask16;
 
-typedef enum JSValueMask32
-#if defined(_MSC_VER)
-                           : uint32
-#endif
-{
-    /*
-     * This enumerator value plus __attribute__((packed)) plus the static
-     * assert that sizeof(JSValueMask32) == 4 should guarantee that enumerators
-     * are uint32 in GCC.
-     */
-    JSVAL_MASK32_CLEAR     = ((uint32)0xFFFF0000),
+#define JSVAL_MASK32_CLEAR      ((uint32)0xFFFF0000)
 
-    JSVAL_MASK32_NULL      = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_NULL)),
-    JSVAL_MASK32_UNDEFINED = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_UNDEFINED)),
-    JSVAL_MASK32_INT32     = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_INT32)),
-    JSVAL_MASK32_STRING    = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_STRING)),
-    JSVAL_MASK32_NONFUNOBJ = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_NONFUNOBJ)),
-    JSVAL_MASK32_FUNOBJ    = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_FUNOBJ)),
-    JSVAL_MASK32_BOOLEAN   = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_BOOLEAN)),
-    JSVAL_MASK32_MAGIC     = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_MAGIC)),
+#define JSVAL_MASK32_NULL       ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_NULL))
+#define JSVAL_MASK32_UNDEFINED  ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_UNDEFINED))
+#define JSVAL_MASK32_INT32      ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_INT32))
+#define JSVAL_MASK32_STRING     ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_STRING))
+#define JSVAL_MASK32_NONFUNOBJ  ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_NONFUNOBJ))
+#define JSVAL_MASK32_FUNOBJ     ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_FUNOBJ))
+#define JSVAL_MASK32_BOOLEAN    ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_BOOLEAN))
+#define JSVAL_MASK32_MAGIC      ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_MAGIC))
 
-    JSVAL_MASK32_SINGLETON = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_SINGLETON)),
-    JSVAL_MASK32_OBJECT    = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_OBJECT)),
-    JSVAL_MASK32_OBJORNULL = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_OBJORNULL)),
-    JSVAL_MASK32_GCTHING   = ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_GCTHING))
-}
-#if defined(__GNUC__)
-__attribute__((packed))
-#endif
-JSValueMask32;
+#define JSVAL_MASK32_SINGLETON  ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_SINGLETON))
+#define JSVAL_MASK32_OBJECT     ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_OBJECT))
+#define JSVAL_MASK32_OBJORNULL  ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_OBJORNULL))
+#define JSVAL_MASK32_GCTHING    ((uint32)(JSVAL_MASK32_CLEAR | JSVAL_MASK16_GCTHING))
+
+typedef uint32 JSValueMask32;
 
 #ifdef __GNUC__
 # define VALUE_ALIGNMENT        __attribute__((aligned (8)))
 # define ASSERT_DOUBLE_ALIGN()  JS_ASSERT(size_t(this) % sizeof(double) == 0)
 #elif defined(_MSC_VER)
   /*
    * Structs can be aligned with MSVC, but not if they are used as parameters,
    * so we just don't try to align.
@@ -255,17 +242,16 @@ typedef enum JSWhyMagic
 } JSWhyMagic;
 
 #if !defined(IS_LITTLE_ENDIAN)
 # error "Unsupported configuration"
 #endif
 
 typedef union jsval_layout
 {
-    uint64 asBits;
     struct {
         union {
             int32          i32;
             uint32         u32;
             JSBool         boo;
 #if JS_BITS_PER_WORD == 32
             JSString       *str;
             JSObject       *obj;
@@ -278,70 +264,71 @@ typedef union jsval_layout
             JSWhyMagic     why;
         } payload;
         union {
             struct {
                 JSValueMask16 mask16;
                 uint16 nanBits;
             } tag;
             JSValueMask32 mask32;
-        };
+        } u;
     } s;
     double asDouble;
+    uint64 asBits;
 } jsval_layout;
 
 #if JS_BITS_PER_WORD == 32
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_NULL_IMPL(jsval_layout l)
 {
-    return l.s.mask32 == JSVAL_MASK32_NULL;
+    return l.s.u.mask32 == JSVAL_MASK32_NULL;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_UNDEFINED_IMPL(jsval_layout l)
 {
-    return l.s.mask32 == JSVAL_MASK32_UNDEFINED;
+    return l.s.u.mask32 == JSVAL_MASK32_UNDEFINED;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_SPECIFIC_INT32_IMPL(jsval_layout l, int32 i32)
 {
-    return l.s.mask32 == JSVAL_MASK32_INT32 && l.s.payload.i32 == i32;
+    return l.s.u.mask32 == JSVAL_MASK32_INT32 && l.s.payload.i32 == i32;
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 INT32_TO_JSVAL_IMPL(int32 i)
 {
     jsval_layout l;
-    l.s.mask32 = JSVAL_MASK32_INT32;
+    l.s.u.mask32 = JSVAL_MASK32_INT32;
     l.s.payload.i32 = i;
     return l;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_DOUBLE_IMPL(jsval_layout l)
 {
-    return l.s.mask32 < JSVAL_MASK32_CLEAR;
+    return l.s.u.mask32 < JSVAL_MASK32_CLEAR;
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 DOUBLE_TO_JSVAL_IMPL(jsdouble d)
 {
     jsval_layout l;
     l.asDouble = d;
-    JS_ASSERT(l.s.tag.nanBits != JSVAL_NANBOX_PATTERN);
+    JS_ASSERT(l.s.u.tag.nanBits != JSVAL_NANBOX_PATTERN);
     return l;
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 STRING_TO_JSVAL_IMPL(JSString *str)
 {
     jsval_layout l;
-    l.s.mask32 = JSVAL_MASK32_STRING;
+    l.s.u.mask32 = JSVAL_MASK32_STRING;
     l.s.payload.str = str;
     return l;
 }
 
 static JS_ALWAYS_INLINE JSString *
 JSVAL_TO_STRING_IMPL(jsval_layout l)
 {
     return l.s.payload.str;
@@ -352,84 +339,84 @@ JSVAL_TO_OBJECT_IMPL(jsval_layout l)
 {
     return l.s.payload.obj;
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 OBJECT_TO_JSVAL_IMPL(JSValueMask32 mask, JSObject *obj)
 {
     jsval_layout l;
-    l.s.mask32 = mask;
+    l.s.u.mask32 = mask;
     l.s.payload.obj = obj;
     return l;
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 BOOLEAN_TO_JSVAL_IMPL(JSBool b)
 {
     jsval_layout l;
-    l.s.mask32 = JSVAL_MASK32_BOOLEAN;
+    l.s.u.mask32 = JSVAL_MASK32_BOOLEAN;
     l.s.payload.boo = b;
     return l;
 }
 
 static JS_ALWAYS_INLINE void *
 JSVAL_TO_GCTHING_IMPL(jsval_layout l)
 {
     return l.s.payload.ptr;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_SPECIFIC_BOOLEAN(jsval_layout l, JSBool b)
 {
-    return (l.s.mask32 == JSVAL_MASK32_BOOLEAN) && (l.s.payload.boo == b);
+    return (l.s.u.mask32 == JSVAL_MASK32_BOOLEAN) && (l.s.payload.boo == b);
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 PRIVATE_TO_JSVAL_IMPL(void *ptr)
 {
+    jsval_layout l;
     JS_ASSERT(((uint32)ptr & 1) == 0);
-    jsval_layout l;
-    l.s.tag.nanBits = 0;
+    l.s.u.tag.nanBits = 0;
     l.s.payload.ptr = ptr;
     return l;
 }
 
 static JS_ALWAYS_INLINE void *
 JSVAL_TO_PRIVATE_IMPL(jsval_layout l)
 {
     return l.s.payload.ptr;
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 MAGIC_TO_JSVAL_IMPL(JSWhyMagic why)
 {
     jsval_layout l;
-    l.s.mask32 = JSVAL_MASK32_MAGIC;
+    l.s.u.mask32 = JSVAL_MASK32_MAGIC;
     l.s.payload.why = why;
     return l;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_SAME_PRIMITIVE_TYPE_OR_BOTH_OBJECTS_IMPL(jsval_layout lhs, jsval_layout rhs)
 {
-    return ((lhs.s.mask32 ^ rhs.s.mask32) & ~(uint32)JSVAL_MASK16_OBJECT) == 0 ||
-           (lhs.s.mask32 < JSVAL_MASK32_CLEAR && rhs.s.mask32 < JSVAL_MASK32_CLEAR);
+    return ((lhs.s.u.mask32 ^ rhs.s.u.mask32) & ~(uint32)JSVAL_MASK16_OBJECT) == 0 ||
+           (lhs.s.u.mask32 < JSVAL_MASK32_CLEAR && rhs.s.u.mask32 < JSVAL_MASK32_CLEAR);
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_BOTH_STRING_IMPL(jsval_layout lhs, jsval_layout rhs)
 {
-    return (lhs.s.mask32 & rhs.s.mask32) == JSVAL_MASK32_STRING;
+    return (lhs.s.u.mask32 & rhs.s.u.mask32) == JSVAL_MASK32_STRING;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_BOTH_INT32_IMPL(jsval_layout lhs, jsval_layout rhs)
 {
-    return (lhs.s.mask32 & rhs.s.mask32) == JSVAL_MASK32_INT32;
+    return (lhs.s.u.mask32 & rhs.s.u.mask32) == JSVAL_MASK32_INT32;
 }
 
 #elif JS_BITS_PER_WORD == 64
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_NULL_IMPL(jsval_layout l)
 {
     return l.asBits == BUILD_JSVAL(JSVAL_MASK32_NULL, 0);
@@ -461,17 +448,17 @@ JSVAL_IS_DOUBLE_IMPL(jsval_layout l)
     return l.asBits < BUILD_JSVAL(JSVAL_MASK32_CLEAR, 0);
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 DOUBLE_TO_JSVAL_IMPL(jsdouble d)
 {
     jsval_layout l;
     l.asDouble = d;
-    JS_ASSERT(l.s.tag.nanBits != JSVAL_NANBOX_PATTERN);
+    JS_ASSERT(l.s.u.tag.nanBits != JSVAL_NANBOX_PATTERN);
     return l;
 }
 
 static JS_ALWAYS_INLINE jsval_layout
 STRING_TO_JSVAL_IMPL(JSString *str)
 {
     JS_ASSERT((size_t)str < (size_t)0xFFFFFFFF);
     jsval_layout l;
@@ -565,54 +552,54 @@ JSVAL_BOTH_INT32_IMPL(jsval_layout lhs, 
 
 #else
 # error "Unsupported configuration"
 #endif
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_SINGLETON_IMPL(jsval_layout l)
 {
-    return (l.s.mask32 & JSVAL_MASK32_SINGLETON) > JSVAL_MASK32_CLEAR;
+    return (l.s.u.mask32 & JSVAL_MASK32_SINGLETON) > JSVAL_MASK32_CLEAR;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_NUMBER_IMPL(jsval_layout l)
 {
-    JSValueMask32 mask = l.s.mask32;
+    JSValueMask32 mask = l.s.u.mask32;
     return mask < JSVAL_MASK32_CLEAR || mask == JSVAL_MASK32_INT32;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_OBJECT_IMPL(jsval_layout l)
 {
-    return (l.s.mask32 & JSVAL_MASK32_OBJECT) > JSVAL_MASK32_CLEAR;
+    return (l.s.u.mask32 & JSVAL_MASK32_OBJECT) > JSVAL_MASK32_CLEAR;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_OBJECT_OR_NULL_IMPL(jsval_layout l)
 {
-    return (l.s.mask32 & JSVAL_MASK32_OBJORNULL) > JSVAL_MASK32_CLEAR;
+    return (l.s.u.mask32 & JSVAL_MASK32_OBJORNULL) > JSVAL_MASK32_CLEAR;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_PRIMITIVE_IMPL(jsval_layout l)
 {
-    return (l.s.mask32 & JSVAL_MASK32_OBJECT) <= JSVAL_MASK32_CLEAR;
+    return (l.s.u.mask32 & JSVAL_MASK32_OBJECT) <= JSVAL_MASK32_CLEAR;
 }
 
 static JS_ALWAYS_INLINE JSBool
 JSVAL_IS_GCTHING_IMPL(jsval_layout l)
 {
-    return (l.s.mask32 & JSVAL_MASK32_GCTHING) > JSVAL_MASK32_CLEAR;
+    return (l.s.u.mask32 & JSVAL_MASK32_GCTHING) > JSVAL_MASK32_CLEAR;
 }
 
 static JS_ALWAYS_INLINE uint32
 JSVAL_TRACE_KIND_IMPL(jsval_layout l)
 {
-    return (uint32)(l.s.mask32 == JSVAL_MASK32_STRING);
+    return (uint32)(l.s.u.mask32 == JSVAL_MASK32_STRING);
 }
 
 /* JSClass (and JSObjectOps where appropriate) function pointer typedefs. */
 
 /*
  * Add, delete, get or set a property named by id in obj.  Note the jsval id
  * type -- id may be a string (Unicode property identifier) or an int (element
  * index).  The *vp out parameter, on success, is the new property value after

--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -44,17 +44,17 @@
  *
  * A JS string is a counted array of unicode characters.  To support handoff
  * of API client memory, the chars are allocated separately from the length,
  * necessitating a pointer after the count, to form a separately allocated
  * string descriptor.  String descriptors are GC'ed, while their chars are
  * allocated from the malloc heap.
  */
 #include <ctype.h>
-#include "jspubtd.h"
+#include "jsapi.h"
 #include "jsprvtd.h"
 #include "jshashtable.h"
 #include "jslock.h"
 #include "jsobj.h"
 
 #define JSSTRING_BIT(n)             ((size_t)1 << (n))
 #define JSSTRING_BITMASK(n)         (JSSTRING_BIT(n) - 1)
 

--- a/js/src/jstypes.h
+++ b/js/src/jstypes.h
@@ -298,18 +298,20 @@
 # include "jscpucfg.h"  /* We can't auto-detect MSVC configuration */
 # if _MSC_VER < 1400
 #  define NJ_NO_VARIADIC_MACROS
 # endif
 #else
 # include "jsautocfg.h" /* Use auto-detected configuration */
 #endif
 
-// Define JS_64BIT iff we are building in an environment with 64-bit
-// addresses.
+/*
+ * Define JS_64BIT iff we are building in an environment with 64-bit
+ * addresses.
+ */
 #ifdef _MSC_VER
 # if defined(_M_X64) || defined(_M_AMD64)
 #  define JS_64BIT
 # endif
 #elif defined(__GNUC__)
 # ifdef __x86_64__
 #  define JS_64BIT
 # endif

--- a/js/src/xpconnect/src/XPCDispTearOff.cpp
+++ b/js/src/xpconnect/src/XPCDispTearOff.cpp
@@ -436,17 +436,17 @@ pre_call_clean_up:
             goto done;
 
         // do the deed - note exceptions
 
         JS_ClearPendingException(cx);
 
         if(!JSVAL_IS_PRIMITIVE(fval))
         {
-            success = js_Invoke(cx, args, 0);
+            success = js::InvokeFriendAPI(cx, args, 0);
             result = stackbase[0];
         }
         else
         {
             // The property was not an object so can't be a function.
             // Let's build and 'throw' an exception.
 
             static const nsresult code =

--- a/js/src/xpconnect/src/xpcquickstubs.cpp
+++ b/js/src/xpconnect/src/xpcquickstubs.cpp
@@ -321,34 +321,35 @@ SharedLookupGetter(JSContext *cx, uintN 
 
 static JSBool
 SharedLookupSetter(JSContext *cx, uintN argc, jsval *vp)
 {
     return LookupGetterOrSetter(cx, PR_FALSE, argc, vp);
 }
 
 // XXX Hack! :-/
-JS_FRIEND_API(JSBool) js_obj_defineGetter(JSContext *cx, uintN argc, jsval *vp);
-JS_FRIEND_API(JSBool) js_obj_defineSetter(JSContext *cx, uintN argc, jsval *vp);
+JS_FRIEND_API(JSBool) js_obj_defineGetter(JSContext *cx, uintN argc, js::Value *vp);
+JS_FRIEND_API(JSBool) js_obj_defineSetter(JSContext *cx, uintN argc, js::Value *vp);
 
 static JSBool
 DefineGetterOrSetter(JSContext *cx, uintN argc, JSBool wantGetter, jsval *vp)
 {
     uintN attrs;
     JSBool found;
     JSPropertyOp getter, setter;
     JSObject *obj2;
     jsval v;
     jsid interned_id;
 
     XPC_QS_ASSERT_CONTEXT_OK(cx);
     JSObject *obj = JS_THIS_OBJECT(cx, vp);
     if (!obj)
         return JS_FALSE;
-    JSFastNative forward = wantGetter ? js_obj_defineGetter : js_obj_defineSetter;
+    JSFastNative forward = wantGetter ? Jsvalify(js_obj_defineGetter)
+                                      : Jsvalify(js_obj_defineSetter);
     jsval id = (argc >= 1) ? JS_ARGV(cx, vp)[0] : JSVAL_VOID;
     if(!JSVAL_IS_STRING(id))
         return forward(cx, argc, vp);
     JSString *str = JSVAL_TO_STRING(id);
 
     const char *name = JS_GetStringBytes(str);
     if(!JS_ValueToId(cx, id, &interned_id) ||
        !JS_LookupPropertyWithFlagsById(cx, obj, interned_id,

--- a/js/src/xpconnect/src/xpcvariant.cpp
+++ b/js/src/xpconnect/src/xpcvariant.cpp
@@ -81,18 +81,17 @@ XPCTraceableVariant::~XPCTraceableVarian
 {
     NS_ASSERTION(JSVAL_IS_GCTHING(mJSVal), "Must be traceable or unlinked");
 
     // If mJSVal is JSVAL_STRING, we don't need to clean anything up;
     // simply removing the string from the root set is good.
     if(!JSVAL_IS_STRING(mJSVal))
         nsVariant::Cleanup(&mData);
 
-    if(!JSVAL_IS_NULL(mJSVal))
-        RemoveFromRootSet(nsXPConnect::GetRuntimeInstance()->GetJSRuntime());
+    RemoveFromRootSet(nsXPConnect::GetRuntimeInstance()->GetJSRuntime());
 }
 
 void XPCTraceableVariant::TraceJS(JSTracer* trc)
 {
     NS_ASSERTION(JSVAL_IS_TRACEABLE(mJSVal), "Must be traceable");
     JS_SET_TRACING_DETAILS(trc, PrintTraceName, this, 0);
     JS_CallTracer(trc, JSVAL_TO_TRACEABLE(mJSVal), JSVAL_TRACE_KIND(mJSVal));
 }

--- a/js/src/xpconnect/src/xpcwrappedjsclass.cpp
+++ b/js/src/xpconnect/src/xpcwrappedjsclass.cpp
@@ -1682,17 +1682,17 @@ pre_call_clean_up:
     if(XPT_MD_IS_GETTER(info->flags))
         success = JS_GetProperty(cx, obj, name, stackbase);
     else if(XPT_MD_IS_SETTER(info->flags))
         success = JS_SetProperty(cx, obj, name, stackbase);
     else
     {
         if(!JSVAL_IS_PRIMITIVE(fval))
         {
-            success = js::Invoke(cx, args, 0);
+            success = js::InvokeFriendAPI(cx, args, 0);
         }
         else
         {
             // The property was not an object so can't be a function.
             // Let's build and 'throw' an exception.
 
             static const nsresult code =
                     NS_ERROR_XPC_JSOBJECT_HAS_NO_FUNCTION_NAMED;

--- a/modules/plugin/base/src/nsJSNPRuntime.cpp
+++ b/modules/plugin/base/src/nsJSNPRuntime.cpp
@@ -452,17 +452,17 @@ JSValToNPVariant(NPP npp, JSContext *cx,
       VOID_TO_NPVARIANT(*variant);
     } else if (JSVAL_IS_NULL(val)) {
       NULL_TO_NPVARIANT(*variant);
     } else if (JSVAL_IS_BOOLEAN(val)) {
       BOOLEAN_TO_NPVARIANT(JSVAL_TO_BOOLEAN(val), *variant);
     } else if (JSVAL_IS_INT(val)) {
       INT32_TO_NPVARIANT(JSVAL_TO_INT(val), *variant);
     } else if (JSVAL_IS_DOUBLE(val)) {
-      DOUBLE_TO_NPVARIANT(*JSVAL_TO_DOUBLE(val), *variant);
+      DOUBLE_TO_NPVARIANT(JSVAL_TO_DOUBLE(val), *variant);
     } else if (JSVAL_IS_STRING(val)) {
       JSString *jsstr = JSVAL_TO_STRING(val);
       nsDependentString str((PRUnichar *)::JS_GetStringChars(jsstr),
                             ::JS_GetStringLength(jsstr));
 
       PRUint32 len;
       char *p = ToNewUTF8String(str, &len);
 
@@ -851,17 +851,17 @@ nsJSObjWrapper::NP_SetProperty(NPObject 
   jsval id = (jsval)identifier;
   JSBool ok = JS_FALSE;
 
   AutoCXPusher pusher(cx);
   JSAutoRequest ar(cx);
   AutoJSExceptionReporter reporter(cx);
 
   jsval v = NPVariantToJSVal(npp, cx, value);
-  js::AutoValueRooter tvr(cx, v);
+  js::AutoValueRooter tvr(cx, js::Valueify(v));
 
   if (JSVAL_IS_STRING(id)) {
     JSString *str = JSVAL_TO_STRING(id);
 
     ok = ::JS_SetUCProperty(cx, npjsobj->mJSObj, ::JS_GetStringChars(str),
                             ::JS_GetStringLength(str), &v);
   } else {
     NS_ASSERTION(JSVAL_IS_INT(id), "id must be either string or int!\n");
@@ -2309,22 +2309,22 @@ NPObjectMember_Mark(JSContext *cx, JSObj
   NPObjectMemberPrivate *memberPrivate =
     (NPObjectMemberPrivate *)::JS_GetInstancePrivate(cx, obj,
                                                      &sNPObjectMemberClass,
                                                      nsnull);
   if (!memberPrivate)
     return 0;
 
   if (!JSVAL_IS_PRIMITIVE(memberPrivate->fieldValue)) {
-    ::JS_MarkGCThing(cx, JSVAL_TO_OBJECT(memberPrivate->fieldValue),
+    ::JS_MarkGCThing(cx, memberPrivate->fieldValue,
                      "NPObject Member => fieldValue", arg);
   }
 
   // There's no strong reference from our private data to the
   // NPObject, so make sure to mark the NPObject wrapper to keep the
   // NPObject alive as long as this NPObjectMember is alive.
   if (memberPrivate->npobjWrapper) {
-    ::JS_MarkGCThing(cx, memberPrivate->npobjWrapper,
+    ::JS_MarkGCThing(cx, OBJECT_TO_JSVAL(memberPrivate->npobjWrapper),
                      "NPObject Member => npobjWrapper", arg);
   }
 
   return 0;
 }