--- a/js/src/devtools/rootAnalysis/annotations.js
+++ b/js/src/devtools/rootAnalysis/annotations.js
@@ -46,16 +46,19 @@ var ignoreClasses = {
 
 var ignoreCallees = {
     "js::Class.trace" : true,
     "js::Class.finalize" : true,
     "JSRuntime.destroyPrincipals" : true,
     "nsISupports.AddRef" : true,
     "nsISupports.Release" : true, // makes me a bit nervous; this is a bug but can happen
     "nsAXPCNativeCallContext.GetJSContext" : true,
+    "js::ion::MDefinition.op" : true, // macro generated virtuals just return a constant
+    "js::ion::LInstruction.getDef" : true, // virtual but no implementation can GC
+    "js::ion::IonCache.kind" : true, // macro generated virtuals just return a constant
 };
 
 function fieldCallCannotGC(csu, fullfield)
 {
     if (csu in ignoreClasses)
         return true;
     if (fullfield in ignoreCallees)
         return true;
@@ -113,31 +116,34 @@ function ignoreGCFunction(fun)
     if (/refillFreeList/.test(fun) && /\(js::AllowGC\)0u/.test(fun))
         return true;
     return false;
 }
 
 function isRootedTypeName(name)
 {
     if (name == "mozilla::ErrorResult" ||
+        name == "js::frontend::TokenStream" ||
         name == "js::frontend::TokenStream::Position")
     {
         return true;
     }
     return false;
 }
 
 function isRootedPointerTypeName(name)
 {
     if (name.startsWith('struct '))
         name = name.substr(7);
     if (name.startsWith('class '))
         name = name.substr(6);
     if (name.startsWith('const '))
         name = name.substr(6);
+    if (name.startsWith('js::ctypes::'))
+        name = name.substr(12);
     if (name.startsWith('js::'))
         name = name.substr(4);
     if (name.startsWith('JS::'))
         name = name.substr(4);
 
     if (name.startsWith('MaybeRooted<'))
         return /\(js::AllowGC\)1u>::RootType/.test(name);