Bug 867426 - Remove RawShape typedef; r=jonco
authorTerrence Cole <terrence@mozilla.com>
Tue, 30 Apr 2013 15:40:09 -0700
changeset 141446 e578b67ec2fa08851581b4d9eaad8540d4f9f74b
parent 141445 566bd5b45961f08504690ee88d5ccaaf278eff83
child 141447 a559bb362a2bcd31168b1272515f1534062d8804
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjonco
bugs867426
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 867426 - Remove RawShape typedef; r=jonco
js/src/frontend/SharedContext-inl.h
js/src/gc/Marking.cpp
js/src/gc/Marking.h
js/src/ion/BaselineCompiler.cpp
js/src/ion/BaselineIC.h
js/src/ion/BaselineInspector.cpp
js/src/ion/CodeGenerator.cpp
js/src/ion/IonBuilder.cpp
js/src/ion/IonBuilder.h
js/src/ion/IonCaches.cpp
js/src/ion/MIR.cpp
js/src/ion/MIR.h
js/src/jsapi.cpp
js/src/jsarray.cpp
js/src/jsarray.h
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jsfriendapi.cpp
js/src/jsgcinlines.h
js/src/jsinfer.cpp
js/src/jsiter.cpp
js/src/jsmemorymetrics.cpp
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/jspropertycacheinlines.h
js/src/jspropertytree.cpp
js/src/jspropertytree.h
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jsstr.cpp
js/src/jswatchpoint.cpp
js/src/methodjit/BaseAssembler.h
js/src/methodjit/Compiler.cpp
js/src/methodjit/FastOps.cpp
js/src/methodjit/MethodJIT.cpp
js/src/methodjit/MethodJIT.h
js/src/methodjit/MonoIC.cpp
js/src/methodjit/MonoIC.h
js/src/methodjit/PolyIC.cpp
js/src/methodjit/PolyIC.h
js/src/vm/ObjectImpl-inl.h
js/src/vm/ObjectImpl.cpp
js/src/vm/ObjectImpl.h
js/src/vm/RegExpObject.cpp
js/src/vm/RegExpObject.h
js/src/vm/ScopeObject.cpp
js/src/vm/ScopeObject.h
js/src/vm/Shape-inl.h
js/src/vm/Shape.cpp
js/src/vm/Shape.h
js/src/vm/StringObject.h
--- a/js/src/frontend/SharedContext-inl.h
+++ b/js/src/frontend/SharedContext-inl.h
@@ -118,17 +118,17 @@ frontend::LexicalLookup(ContextT *ct, Ha
         if (stmt->type == STMT_WITH)
             break;
 
         // Skip statements that do not introduce a new scope
         if (!stmt->isBlockScope)
             continue;
 
         StaticBlockObject &blockObj = *stmt->blockObj;
-        RawShape shape = blockObj.nativeLookup(ct->sc->context, id);
+        Shape *shape = blockObj.nativeLookup(ct->sc->context, id);
         if (shape) {
             JS_ASSERT(shape->hasShortID());
 
             if (slotp)
                 *slotp = blockObj.stackDepth() + shape->shortid();
             return stmt;
         }
     }
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -64,30 +64,30 @@ PushMarkStack(GCMarker *gcmarker, JSObje
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSFunction *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, RawScript thing);
 
 static inline void
-PushMarkStack(GCMarker *gcmarker, RawShape thing);
+PushMarkStack(GCMarker *gcmarker, Shape *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, JSString *thing);
 
 static inline void
 PushMarkStack(GCMarker *gcmarker, types::TypeObject *thing);
 
 namespace js {
 namespace gc {
 
 static void MarkChildren(JSTracer *trc, JSString *str);
 static void MarkChildren(JSTracer *trc, RawScript script);
-static void MarkChildren(JSTracer *trc, RawShape shape);
+static void MarkChildren(JSTracer *trc, Shape *shape);
 static void MarkChildren(JSTracer *trc, BaseShape *base);
 static void MarkChildren(JSTracer *trc, types::TypeObject *type);
 static void MarkChildren(JSTracer *trc, ion::IonCode *code);
 
 } /* namespace gc */
 } /* namespace js */
 
 /*** Object Marking ***/
@@ -387,17 +387,17 @@ gc::MarkKind(JSTracer *trc, void **thing
         break;
       case JSTRACE_STRING:
         MarkInternal(trc, reinterpret_cast<RawString *>(thingp));
         break;
       case JSTRACE_SCRIPT:
         MarkInternal(trc, reinterpret_cast<RawScript *>(thingp));
         break;
       case JSTRACE_SHAPE:
-        MarkInternal(trc, reinterpret_cast<RawShape *>(thingp));
+        MarkInternal(trc, reinterpret_cast<Shape **>(thingp));
         break;
       case JSTRACE_BASE_SHAPE:
         MarkInternal(trc, reinterpret_cast<BaseShape **>(thingp));
         break;
       case JSTRACE_TYPE_OBJECT:
         MarkInternal(trc, reinterpret_cast<types::TypeObject **>(thingp));
         break;
       case JSTRACE_IONCODE:
@@ -789,20 +789,20 @@ PushMarkStack(GCMarker *gcmarker, RawScr
      * refer to other scripts only indirectly (like via nested functions) and
      * we cannot get to deep recursion.
      */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         MarkChildren(gcmarker, thing);
 }
 
 static void
-ScanShape(GCMarker *gcmarker, RawShape shape);
+ScanShape(GCMarker *gcmarker, Shape *shape);
 
 static void
-PushMarkStack(GCMarker *gcmarker, RawShape thing)
+PushMarkStack(GCMarker *gcmarker, Shape *thing)
 {
     JS_COMPARTMENT_ASSERT(gcmarker->runtime, thing);
     JS_ASSERT(!IsInsideNursery(thing->runtime(), thing));
 
     /* We mark shapes directly rather than pushing on the stack. */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         ScanShape(gcmarker, thing);
 }
@@ -827,17 +827,17 @@ PushMarkStack(GCMarker *gcmarker, BaseSh
     JS_ASSERT(!IsInsideNursery(thing->runtime(), thing));
 
     /* We mark base shapes directly rather than pushing on the stack. */
     if (thing->markIfUnmarked(gcmarker->getMarkColor()))
         ScanBaseShape(gcmarker, thing);
 }
 
 static void
-ScanShape(GCMarker *gcmarker, RawShape shape)
+ScanShape(GCMarker *gcmarker, Shape *shape)
 {
   restart:
     PushMarkStack(gcmarker, shape->base());
 
     const EncapsulatedId &id = shape->propidRef();
     if (JSID_IS_STRING(id))
         PushMarkStack(gcmarker, JSID_TO_STRING(id));
     else if (JS_UNLIKELY(JSID_IS_OBJECT(id)))
@@ -994,17 +994,17 @@ gc::MarkChildren(JSTracer *trc, JSString
 
 static void
 gc::MarkChildren(JSTracer *trc, RawScript script)
 {
     script->markChildren(trc);
 }
 
 static void
-gc::MarkChildren(JSTracer *trc, RawShape shape)
+gc::MarkChildren(JSTracer *trc, Shape *shape)
 {
     shape->markChildren(trc);
 }
 
 static void
 gc::MarkChildren(JSTracer *trc, BaseShape *base)
 {
     base->markChildren(trc);
@@ -1054,17 +1054,17 @@ MarkCycleCollectorChildren(JSTracer *trc
  * This function is used by the cycle collector to trace through a
  * shape. The cycle collector does not care about shapes or base
  * shapes, so those are not marked. Instead, any shapes or base shapes
  * that are encountered have their children marked. Stack space is
  * bounded. If two shapes in a row have the same parent pointer, the
  * parent pointer will only be marked once.
  */
 void
-gc::MarkCycleCollectorChildren(JSTracer *trc, RawShape shape)
+gc::MarkCycleCollectorChildren(JSTracer *trc, Shape *shape)
 {
     JSObject *prevParent = NULL;
     do {
         MarkCycleCollectorChildren(trc, shape->base(), &prevParent);
         MarkId(trc, &shape->propidRef(), "propid");
         shape = shape->previous();
     } while (shape);
 }
@@ -1395,17 +1395,17 @@ GCMarker::processMarkStackTop(SliceBudge
         if (budget.isOverBudget()) {
             pushObject(obj);
             return;
         }
 
         types::TypeObject *type = obj->typeFromGC();
         PushMarkStack(this, type);
 
-        RawShape shape = obj->lastProperty();
+        Shape *shape = obj->lastProperty();
         PushMarkStack(this, shape);
 
         /* Call the trace hook if necessary. */
         Class *clasp = type->clasp;
         if (clasp->trace) {
             JS_ASSERT_IF(runtime->gcMode == JSGC_MODE_INCREMENTAL &&
                          runtime->gcIncrementalEnabled,
                          clasp->flags & JSCLASS_IMPLEMENTS_BARRIERS);
@@ -1498,17 +1498,17 @@ js::TraceChildren(JSTracer *trc, void *t
         MarkChildren(trc, static_cast<RawString>(thing));
         break;
 
       case JSTRACE_SCRIPT:
         MarkChildren(trc, static_cast<RawScript>(thing));
         break;
 
       case JSTRACE_SHAPE:
-        MarkChildren(trc, static_cast<RawShape>(thing));
+        MarkChildren(trc, static_cast<Shape *>(thing));
         break;
 
       case JSTRACE_IONCODE:
         MarkChildren(trc, (js::ion::IonCode *)thing);
         break;
 
       case JSTRACE_BASE_SHAPE:
         MarkChildren(trc, static_cast<BaseShape *>(thing));
--- a/js/src/gc/Marking.h
+++ b/js/src/gc/Marking.h
@@ -240,17 +240,17 @@ void
 MarkChildren(JSTracer *trc, JSObject *obj);
 
 /*
  * Trace through the shape and any shapes it contains to mark
  * non-shape children. This is exposed to the JS API as
  * JS_TraceShapeCycleCollectorChildren.
  */
 void
-MarkCycleCollectorChildren(JSTracer *trc, RawShape shape);
+MarkCycleCollectorChildren(JSTracer *trc, Shape *shape);
 
 void
 PushArena(GCMarker *gcmarker, ArenaHeader *aheader);
 
 /*** Generic ***/
 
 /*
  * The Mark() functions interface should only be used by code that must be
--- a/js/src/ion/BaselineCompiler.cpp
+++ b/js/src/ion/BaselineCompiler.cpp
@@ -1684,17 +1684,17 @@ Address
 BaselineCompiler::getScopeCoordinateAddress(Register reg)
 {
     ScopeCoordinate sc(pc);
 
     masm.loadPtr(frame.addressOfScopeChain(), reg);
     for (unsigned i = sc.hops; i; i--)
         masm.extractObject(Address(reg, ScopeObject::offsetOfEnclosingScope()), reg);
 
-    RawShape shape = ScopeCoordinateToStaticScopeShape(cx, script, pc);
+    Shape *shape = ScopeCoordinateToStaticScopeShape(cx, script, pc);
     Address addr;
     if (shape->numFixedSlots() <= sc.slot) {
         masm.loadPtr(Address(reg, JSObject::offsetOfSlots()), reg);
         return Address(reg, (sc.slot - shape->numFixedSlots()) * sizeof(Value));
     }
 
     return Address(reg, JSObject::getFixedSlotOffset(sc.slot));
 }
--- a/js/src/ion/BaselineIC.h
+++ b/js/src/ion/BaselineIC.h
@@ -2975,17 +2975,17 @@ class ICGetElem_Dense : public ICMonitor
     class Compiler : public ICStubCompiler {
       ICStub *firstMonitorStub_;
       RootedShape shape_;
 
       protected:
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx, ICStub *firstMonitorStub, RawShape shape)
+        Compiler(JSContext *cx, ICStub *firstMonitorStub, Shape *shape)
           : ICStubCompiler(cx, ICStub::GetElem_Dense),
             firstMonitorStub_(firstMonitorStub),
             shape_(cx, shape)
         {}
 
         ICStub *getStub(ICStubSpace *space) {
             return ICGetElem_Dense::New(space, getStubCode(), firstMonitorStub_, shape_);
         }
@@ -3025,17 +3025,17 @@ class ICGetElem_TypedArray : public ICSt
       protected:
         bool generateStubCode(MacroAssembler &masm);
 
         virtual int32_t getKey() const {
             return static_cast<int32_t>(kind) | (static_cast<int32_t>(type_) << 16);
         }
 
       public:
-        Compiler(JSContext *cx, RawShape shape, uint32_t type)
+        Compiler(JSContext *cx, Shape *shape, uint32_t type)
           : ICStubCompiler(cx, ICStub::GetElem_TypedArray),
             shape_(cx, shape),
             type_(type)
         {}
 
         ICStub *getStub(ICStubSpace *space) {
             return ICGetElem_TypedArray::New(space, getStubCode(), shape_, type_);
         }
@@ -3166,17 +3166,17 @@ class ICSetElem_Dense : public ICUpdated
         // Compiler is only live on stack during compilation, it should
         // outlive any RootedTypeObject it's passed.  So it can just
         // use the handle.
         HandleTypeObject type_;
 
         bool generateStubCode(MacroAssembler &masm);
 
       public:
-        Compiler(JSContext *cx, RawShape shape, HandleTypeObject type)
+        Compiler(JSContext *cx, Shape *shape, HandleTypeObject type)
           : ICStubCompiler(cx, ICStub::SetElem_Dense),
             shape_(cx, shape),
             type_(type)
         {}
 
         ICUpdatedStub *getStub(ICStubSpace *space) {
             ICSetElem_Dense *stub = ICSetElem_Dense::New(space, getStubCode(), shape_, type_);
             if (!stub || !stub->initUpdatingChain(cx, space))
@@ -3333,17 +3333,17 @@ class ICSetElem_TypedArray : public ICSt
         bool generateStubCode(MacroAssembler &masm);
 
         virtual int32_t getKey() const {
             return static_cast<int32_t>(kind) | (static_cast<int32_t>(type_) << 16) |
                    (static_cast<int32_t>(expectOutOfBounds_) << 24);
         }
 
       public:
-        Compiler(JSContext *cx, RawShape shape, uint32_t type, bool expectOutOfBounds)
+        Compiler(JSContext *cx, Shape *shape, uint32_t type, bool expectOutOfBounds)
           : ICStubCompiler(cx, ICStub::SetElem_TypedArray),
             shape_(cx, shape),
             type_(type),
             expectOutOfBounds_(expectOutOfBounds)
         {}
 
         ICStub *getStub(ICStubSpace *space) {
             return ICSetElem_TypedArray::New(space, getStubCode(), shape_, type_,
--- a/js/src/ion/BaselineInspector.cpp
+++ b/js/src/ion/BaselineInspector.cpp
@@ -37,17 +37,17 @@ BaselineInspector::maybeShapesForPropert
     if (!hasBaselineScript())
         return true;
 
     JS_ASSERT(isValidPC(pc));
     const ICEntry &entry = icEntryFromPC(pc);
 
     ICStub *stub = entry.firstStub();
     while (stub->next()) {
-        RawShape shape;
+        Shape *shape;
         if (stub->isGetProp_Native()) {
             shape = stub->toGetProp_Native()->shape();
         } else if (stub->isSetProp_Native()) {
             shape = stub->toSetProp_Native()->shape();
         } else {
             shapes.clear();
             return true;
         }
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -934,17 +934,17 @@ CodeGenerator::emitGetPropertyPolymorphi
 
     masm.loadObjShape(obj, scratch);
 
     Label done;
     for (size_t i = 0; i < mir->numShapes(); i++) {
         Label next;
         masm.branchPtr(Assembler::NotEqual, scratch, ImmGCPtr(mir->objShape(i)), &next);
 
-        RawShape shape = mir->shape(i);
+        Shape *shape = mir->shape(i);
         if (shape->slot() < shape->numFixedSlots()) {
             // Fixed slot.
             masm.loadTypedOrValue(Address(obj, JSObject::getFixedSlotOffset(shape->slot())),
                                   output);
         } else {
             // Dynamic slot.
             uint32_t offset = (shape->slot() - shape->numFixedSlots()) * sizeof(js::Value);
             masm.loadPtr(Address(obj, JSObject::offsetOfSlots()), scratch);
@@ -991,17 +991,17 @@ CodeGenerator::emitSetPropertyPolymorphi
 
     masm.loadObjShape(obj, scratch);
 
     Label done;
     for (size_t i = 0; i < mir->numShapes(); i++) {
         Label next;
         masm.branchPtr(Assembler::NotEqual, scratch, ImmGCPtr(mir->objShape(i)), &next);
 
-        RawShape shape = mir->shape(i);
+        Shape *shape = mir->shape(i);
         if (shape->slot() < shape->numFixedSlots()) {
             // Fixed slot.
             Address addr(obj, JSObject::getFixedSlotOffset(shape->slot()));
             if (mir->needsBarrier())
                 emitPreBarrier(addr, MIRType_Value);
             masm.storeConstantOrRegister(value, addr);
         } else {
             // Dynamic slot.
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -7095,17 +7095,17 @@ IonBuilder::invalidatedIdempotentCache()
             return true;
         builder = builder->callerBuilder_;
     } while (builder);
 
     return false;
 }
 
 bool
-IonBuilder::loadSlot(MDefinition *obj, RawShape shape, MIRType rvalType,
+IonBuilder::loadSlot(MDefinition *obj, Shape *shape, MIRType rvalType,
                      bool barrier, types::StackTypeSet *types)
 {
     JS_ASSERT(shape->hasDefaultGetter());
     JS_ASSERT(shape->hasSlot());
 
     if (shape->slot() < shape->numFixedSlots()) {
         MLoadFixedSlot *load = MLoadFixedSlot::New(obj, shape->slot());
         current->add(load);
@@ -7122,17 +7122,17 @@ IonBuilder::loadSlot(MDefinition *obj, R
     current->add(load);
     current->push(load);
 
     load->setResultType(rvalType);
     return pushTypeBarrier(load, types, barrier);
 }
 
 bool
-IonBuilder::storeSlot(MDefinition *obj, RawShape shape, MDefinition *value, bool needsBarrier)
+IonBuilder::storeSlot(MDefinition *obj, Shape *shape, MDefinition *value, bool needsBarrier)
 {
     JS_ASSERT(shape->hasDefaultSetter());
     JS_ASSERT(shape->writable());
     JS_ASSERT(shape->hasSlot());
 
     if (shape->slot() < shape->numFixedSlots()) {
         MStoreFixedSlot *store = MStoreFixedSlot::New(obj, shape->slot(), value);
         current->add(store);
@@ -7363,17 +7363,17 @@ bool
 IonBuilder::getPropTryInlineAccess(bool *emitted, HandlePropertyName name, HandleId id,
                                    bool barrier, types::StackTypeSet *types)
 {
     JS_ASSERT(*emitted == false);
     if (current->peek(-1)->type() != MIRType_Object)
         return true;
 
     Vector<Shape *> shapes(cx);
-    if (RawShape objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
+    if (Shape *objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
         if (!shapes.append(objShape))
             return false;
     } else {
         if (!inspector->maybeShapesForPropertyOp(pc, shapes))
             return false;
     }
 
     if (shapes.empty() || !CanInlinePropertyOpShapes(shapes))
@@ -7384,35 +7384,35 @@ IonBuilder::getPropTryInlineAccess(bool 
         rvalType = MIRType_Value;
 
     MDefinition *obj = current->pop();
     if (shapes.length() == 1) {
         // In the monomorphic case, use separate ShapeGuard and LoadSlot
         // instructions.
         spew("Inlining monomorphic GETPROP");
 
-        RawShape objShape = shapes[0];
+        Shape *objShape = shapes[0];
         obj = addShapeGuard(obj, objShape, Bailout_CachedShapeGuard);
 
-        RawShape shape = objShape->search(cx, id);
+        Shape *shape = objShape->search(cx, id);
         JS_ASSERT(shape);
 
         if (!loadSlot(obj, shape, rvalType, barrier, types))
             return false;
     } else {
         JS_ASSERT(shapes.length() > 1);
         spew("Inlining polymorphic GETPROP");
 
         MGetPropertyPolymorphic *load = MGetPropertyPolymorphic::New(obj, name);
         current->add(load);
         current->push(load);
 
         for (size_t i = 0; i < shapes.length(); i++) {
-            RawShape objShape = shapes[i];
-            RawShape shape =  objShape->search(cx, id);
+            Shape *objShape = shapes[i];
+            Shape *shape =  objShape->search(cx, id);
             JS_ASSERT(shape);
             if (!load->addShape(objShape, shape))
                 return false;
         }
 
         if (failedShapeGuard_)
             load->setNotMovable();
 
@@ -7563,51 +7563,51 @@ IonBuilder::jsop_setprop(HandlePropertyN
         current->add(fixed);
         current->push(value);
         if (propTypes->needsBarrier(cx))
             fixed->setNeedsBarrier();
         return resumeAfter(fixed);
     }
 
     Vector<Shape *> shapes(cx);
-    if (RawShape objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
+    if (Shape *objShape = mjit::GetPICSingleShape(cx, script(), pc, info().constructing())) {
         if (!shapes.append(objShape))
             return false;
     } else {
         if (!inspector->maybeShapesForPropertyOp(pc, shapes))
             return false;
     }
 
     if (!shapes.empty() && CanInlinePropertyOpShapes(shapes)) {
         if (shapes.length() == 1) {
             spew("Inlining monomorphic SETPROP");
 
             // The JM IC was monomorphic, so we inline the property access as
             // long as the shape is not in dictionary mode. We cannot be sure
             // that the shape is still a lastProperty, and calling Shape::search
             // on dictionary mode shapes that aren't lastProperty is invalid.
-            RawShape objShape = shapes[0];
+            Shape *objShape = shapes[0];
             obj = addShapeGuard(obj, objShape, Bailout_CachedShapeGuard);
 
-            RawShape shape = objShape->search(cx, NameToId(name));
+            Shape *shape = objShape->search(cx, NameToId(name));
             JS_ASSERT(shape);
 
             bool needsBarrier = objTypes->propertyNeedsBarrier(cx, id);
             return storeSlot(obj, shape, value, needsBarrier);
         } else {
             JS_ASSERT(shapes.length() > 1);
             spew("Inlining polymorphic SETPROP");
 
             MSetPropertyPolymorphic *ins = MSetPropertyPolymorphic::New(obj, value);
             current->add(ins);
             current->push(value);
 
             for (size_t i = 0; i < shapes.length(); i++) {
-                RawShape objShape = shapes[i];
-                RawShape shape =  objShape->search(cx, id);
+                Shape *objShape = shapes[i];
+                Shape *shape =  objShape->search(cx, id);
                 JS_ASSERT(shape);
                 if (!ins->addShape(objShape, shape))
                     return false;
             }
 
             if (objTypes->propertyNeedsBarrier(cx, id))
                 ins->setNeedsBarrier();
 
@@ -8012,17 +8012,17 @@ IonBuilder::addBoundsCheck(MDefinition *
     // If a bounds check failed in the past, don't optimize bounds checks.
     if (failedBoundsCheck_)
         check->setNotMovable();
 
     return check;
 }
 
 MInstruction *
-IonBuilder::addShapeGuard(MDefinition *obj, const RawShape shape, BailoutKind bailoutKind)
+IonBuilder::addShapeGuard(MDefinition *obj, Shape *const shape, BailoutKind bailoutKind)
 {
     MGuardShape *guard = MGuardShape::New(obj, shape, bailoutKind);
     current->add(guard);
 
     // If a shape guard failed in the past, don't optimize shape guard.
     if (failedShapeGuard_)
         guard->setNotMovable();
 
--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -316,27 +316,27 @@ class IonBuilder : public MIRGenerator
     MDefinition *createThis(HandleFunction target, MDefinition *callee);
     MInstruction *createDeclEnvObject(MDefinition *callee, MDefinition *scopeObj);
     MInstruction *createCallObject(MDefinition *callee, MDefinition *scopeObj);
 
     MDefinition *walkScopeChain(unsigned hops);
 
     MInstruction *addConvertElementsToDoubles(MDefinition *elements);
     MInstruction *addBoundsCheck(MDefinition *index, MDefinition *length);
-    MInstruction *addShapeGuard(MDefinition *obj, const RawShape shape, BailoutKind bailoutKind);
+    MInstruction *addShapeGuard(MDefinition *obj, Shape *const shape, BailoutKind bailoutKind);
 
     JSObject *getNewArrayTemplateObject(uint32_t count);
     MDefinition *convertShiftToMaskForStaticTypedArray(MDefinition *id,
                                                        ArrayBufferView::ViewType viewType);
 
     bool invalidatedIdempotentCache();
 
-    bool loadSlot(MDefinition *obj, RawShape shape, MIRType rvalType,
+    bool loadSlot(MDefinition *obj, Shape *shape, MIRType rvalType,
                   bool barrier, types::StackTypeSet *types);
-    bool storeSlot(MDefinition *obj, RawShape shape, MDefinition *value, bool needsBarrier);
+    bool storeSlot(MDefinition *obj, Shape *shape, MDefinition *value, bool needsBarrier);
 
     // jsop_getprop() helpers.
     bool getPropTryArgumentsLength(bool *emitted);
     bool getPropTryConstant(bool *emitted, HandleId id, types::StackTypeSet *types);
     bool getPropTryDefiniteSlot(bool *emitted, HandlePropertyName name,
                                 bool barrier, types::StackTypeSet *types);
     bool getPropTryCommonGetter(bool *emitted, HandleId id,
                                 bool barrier, types::StackTypeSet *types);
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -476,29 +476,29 @@ IsCacheableProtoChain(JSObject *obj, JSO
         if (!proto || !proto->isNative())
             return false;
         obj = proto;
     }
     return true;
 }
 
 static bool
-IsCacheableGetPropReadSlot(JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableGetPropReadSlot(JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (!shape->hasSlot() || !shape->hasDefaultGetter())
         return false;
 
     return true;
 }
 
 static bool
-IsCacheableNoProperty(JSObject *obj, JSObject *holder, RawShape shape, jsbytecode *pc,
+IsCacheableNoProperty(JSObject *obj, JSObject *holder, Shape *shape, jsbytecode *pc,
                       const TypedOrValueRegister &output)
 {
     if (shape)
         return false;
 
     JS_ASSERT(!holder);
 
     // Just because we didn't find the property on the object doesn't mean it
@@ -539,30 +539,30 @@ IsCacheableNoProperty(JSObject *obj, JSO
     // monitor and invalidate the script.
     if (!output.hasValue())
         return false;
 
     return true;
 }
 
 static bool
-IsCacheableGetPropCallNative(JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableGetPropCallNative(JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (!shape->hasGetterValue() || !shape->getterValue().isObject())
         return false;
 
     return shape->getterValue().toObject().isFunction() &&
            shape->getterValue().toObject().toFunction()->isNative();
 }
 
 static bool
-IsCacheableGetPropCallPropertyOp(JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableGetPropCallPropertyOp(JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (!shape || !IsCacheableProtoChain(obj, holder))
         return false;
 
     if (shape->hasSlot() || shape->hasGetterValue() || shape->hasDefaultGetter())
         return false;
 
     return true;
@@ -1683,17 +1683,17 @@ SetPropertyIC::attachNativeAdding(JSCont
     masm.branchTestObjShape(Assembler::NotEqual, object(), oldShape, &failures);
 
     Label protoFailures;
     masm.push(object());    // save object reg because we clobber it
 
     JSObject *proto = obj->getProto();
     Register protoReg = object();
     while (proto) {
-        RawShape protoShape = proto->lastProperty();
+        Shape *protoShape = proto->lastProperty();
 
         // load next prototype
         masm.loadPtr(Address(protoReg, JSObject::offsetOfType()), protoReg);
         masm.loadPtr(Address(protoReg, offsetof(types::TypeObject, proto)), protoReg);
 
         // Ensure that its shape matches.
         masm.branchTestObjShape(Assembler::NotEqual, protoReg, protoShape, &protoFailures);
 
@@ -1744,17 +1744,17 @@ IsPropertyInlineable(JSObject *obj)
         return false;
 
     return true;
 }
 
 static bool
 IsPropertySetInlineable(JSContext *cx, HandleObject obj, HandleId id, MutableHandleShape pshape)
 {
-    RawShape shape = obj->nativeLookup(cx, id);
+    Shape *shape = obj->nativeLookup(cx, id);
 
     if (!shape)
         return false;
 
     if (!shape->hasSlot())
         return false;
 
     if (!shape->hasDefaultSetter())
@@ -1818,17 +1818,17 @@ IsPropertyAddInlineable(JSContext *cx, H
     // are native, and that all prototypes have no getter or setter
     // defined on the property
     for (JSObject *proto = obj->getProto(); proto; proto = proto->getProto()) {
         // if prototype is non-native, don't optimize
         if (!proto->isNative())
             return false;
 
         // if prototype defines this property in a non-plain way, don't optimize
-        RawShape protoShape = proto->nativeLookup(cx, id);
+        Shape *protoShape = proto->nativeLookup(cx, id);
         if (protoShape && !protoShape->hasDefaultSetter())
             return false;
 
         // Otherise, if there's no such property, watch out for a resolve hook that would need
         // to be invoked and thus prevent inlining of property addition.
         if (proto->getClass()->resolve != JS_ResolveStub)
              return false;
     }
@@ -2211,17 +2211,17 @@ BindNameIC::attachGlobal(JSContext *cx, 
 
     attacher.jumpRejoin(masm);
 
     return linkAndAttachStub(cx, masm, attacher, ion, "global");
 }
 
 static inline void
 GenerateScopeChainGuard(MacroAssembler &masm, JSObject *scopeObj,
-                        Register scopeObjReg, RawShape shape, Label *failures)
+                        Register scopeObjReg, Shape *shape, Label *failures)
 {
     if (scopeObj->isCall()) {
         // We can skip a guard on the call object if the script's bindings are
         // guaranteed to be immutable (and thus cannot introduce shadowing
         // variables).
         CallObject *callObj = &scopeObj->asCall();
         if (!callObj->isForEval()) {
             RawFunction fun = &callObj->callee();
@@ -2447,17 +2447,17 @@ NameIC::attachCallGetter(JSContext *cx, 
          return false;
     }
 
     const char *attachKind = "name getter";
     return linkAndAttachStub(cx, masm, attacher, ion, attachKind);
 }
 
 static bool
-IsCacheableNameCallGetter(JSObject *scopeChain, JSObject *obj, JSObject *holder, RawShape shape)
+IsCacheableNameCallGetter(JSObject *scopeChain, JSObject *obj, JSObject *holder, Shape *shape)
 {
     if (obj != scopeChain)
         return false;
 
     if (!obj->isGlobal())
         return false;
 
     return IsCacheableGetPropCallNative(obj, holder, shape) ||
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -2239,17 +2239,17 @@ MGetPropertyPolymorphic::mightAlias(MDef
 {
     // Allow hoisting this instruction if the store does not write to a
     // slot read by this instruction.
 
     if (!store->isStoreFixedSlot() && !store->isStoreSlot())
         return true;
 
     for (size_t i = 0; i < numShapes(); i++) {
-        RawShape shape = this->shape(i);
+        Shape *shape = this->shape(i);
         if (shape->slot() < shape->numFixedSlots()) {
             // Fixed slot.
             uint32_t slot = shape->slot();
             if (store->isStoreFixedSlot() && store->toStoreFixedSlot()->slot() != slot)
                 continue;
             if (store->isStoreSlot())
                 continue;
         } else {
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -5368,20 +5368,20 @@ class MGetPropertyCache
 // Emit code to load a value from an object's slots if its shape matches
 // one of the shapes observed by the baseline IC, else bails out.
 class MGetPropertyPolymorphic
   : public MUnaryInstruction,
     public SingleObjectPolicy
 {
     struct Entry {
         // The shape to guard against.
-        RawShape objShape;
+        Shape *objShape;
 
         // The property to laod.
-        RawShape shape;
+        Shape *shape;
     };
 
     Vector<Entry, 4, IonAllocPolicy> shapes_;
     CompilerRootPropertyName name_;
 
     MGetPropertyPolymorphic(MDefinition *obj, HandlePropertyName name)
       : MUnaryInstruction(obj),
         name_(name)
@@ -5407,29 +5407,29 @@ class MGetPropertyPolymorphic
         if (name() != ins->toGetPropertyPolymorphic()->name())
             return false;
         return congruentIfOperandsEqual(ins);
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
-    bool addShape(RawShape objShape, RawShape shape) {
+    bool addShape(Shape *objShape, Shape *shape) {
         Entry entry;
         entry.objShape = objShape;
         entry.shape = shape;
         return shapes_.append(entry);
     }
     size_t numShapes() const {
         return shapes_.length();
     }
-    RawShape objShape(size_t i) const {
+    Shape *objShape(size_t i) const {
         return shapes_[i].objShape;
     }
-    RawShape shape(size_t i) const {
+    Shape *shape(size_t i) const {
         return shapes_[i].shape;
     }
     MDefinition *obj() const {
         return getOperand(0);
     }
     AliasSet getAliasSet() const {
         return AliasSet::Load(AliasSet::ObjectFields | AliasSet::FixedSlot | AliasSet::DynamicSlot);
     }
@@ -5440,20 +5440,20 @@ class MGetPropertyPolymorphic
 // Emit code to store a value to an object's slots if its shape matches
 // one of the shapes observed by the baseline IC, else bails out.
 class MSetPropertyPolymorphic
   : public MBinaryInstruction,
     public SingleObjectPolicy
 {
     struct Entry {
         // The shape to guard against.
-        RawShape objShape;
+        Shape *objShape;
 
         // The property to laod.
-        RawShape shape;
+        Shape *shape;
     };
 
     Vector<Entry, 4, IonAllocPolicy> shapes_;
     bool needsBarrier_;
 
     MSetPropertyPolymorphic(MDefinition *obj, MDefinition *value)
       : MBinaryInstruction(obj, value),
         needsBarrier_(false)
@@ -5465,29 +5465,29 @@ class MSetPropertyPolymorphic
 
     static MSetPropertyPolymorphic *New(MDefinition *obj, MDefinition *value) {
         return new MSetPropertyPolymorphic(obj, value);
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
-    bool addShape(RawShape objShape, RawShape shape) {
+    bool addShape(Shape *objShape, Shape *shape) {
         Entry entry;
         entry.objShape = objShape;
         entry.shape = shape;
         return shapes_.append(entry);
     }
     size_t numShapes() const {
         return shapes_.length();
     }
-    RawShape objShape(size_t i) const {
+    Shape *objShape(size_t i) const {
         return shapes_[i].objShape;
     }
-    RawShape shape(size_t i) const {
+    Shape *shape(size_t i) const {
         return shapes_[i].shape;
     }
     MDefinition *obj() const {
         return getOperand(0);
     }
     MDefinition *value() const {
         return getOperand(1);
     }
@@ -5906,17 +5906,17 @@ class MGuardShape
     }
 
     TypePolicy *typePolicy() {
         return this;
     }
     MDefinition *obj() const {
         return getOperand(0);
     }
-    const RawShape shape() const {
+    const Shape *shape() const {
         return shape_;
     }
     BailoutKind bailoutKind() const {
         return bailoutKind_;
     }
     bool congruentTo(MDefinition * const &ins) const {
         if (!ins->isGuardShape())
             return false;
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4485,17 +4485,17 @@ JS_DeleteElement(JSContext *cx, JSObject
 
 JS_PUBLIC_API(JSBool)
 JS_DeleteProperty(JSContext *cx, JSObject *objArg, const char *name)
 {
     jsval junk;
     return JS_DeleteProperty2(cx, objArg, name, &junk);
 }
 
-static RawShape
+static Shape *
 LastConfigurableShape(JSObject *obj)
 {
     for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront()) {
         Shape *shape = &r.front();
         if (shape->configurable())
             return shape;
     }
     return NULL;
@@ -4598,17 +4598,17 @@ prop_iter_trace(JSTracer *trc, RawObject
         return;
 
     if (obj->getSlot(JSSLOT_ITER_INDEX).toInt32() < 0) {
         /*
          * Native case: just mark the next property to visit. We don't need a
          * barrier here because the pointer is updated via setPrivate, which
          * always takes a barrier.
          */
-        RawShape tmp = static_cast<RawShape>(pdata);
+        Shape *tmp = static_cast<Shape *>(pdata);
         MarkShapeUnbarriered(trc, &tmp, "prop iter shape");
         obj->setPrivateUnbarriered(tmp);
     } else {
         /* Non-native case: mark each id in the JSIdArray private. */
         JSIdArray *ida = (JSIdArray *) pdata;
         MarkIdRange(trc, ida->length, ida->vector, "prop iter");
     }
 }
@@ -4670,26 +4670,26 @@ JS_NextProperty(JSContext *cx, JSObject 
 
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, iterobj);
     int32_t i = iterobj->getSlot(JSSLOT_ITER_INDEX).toInt32();
     if (i < 0) {
         /* Native case: private data is a property tree node pointer. */
         JS_ASSERT(iterobj->getParent()->isNative());
-        RawShape shape = static_cast<RawShape>(iterobj->getPrivate());
+        Shape *shape = static_cast<Shape *>(iterobj->getPrivate());
 
         while (shape->previous() && !shape->enumerable())
             shape = shape->previous();
 
         if (!shape->previous()) {
             JS_ASSERT(shape->isEmptyShape());
             *idp = JSID_VOID;
         } else {
-            iterobj->setPrivateGCThing(const_cast<RawShape>(shape->previous().get()));
+            iterobj->setPrivateGCThing(const_cast<Shape *>(shape->previous().get()));
             *idp = shape->propid();
         }
     } else {
         /* Non-native case: use the ida enumerated when iterobj was created. */
         JSIdArray *ida = (JSIdArray *) iterobj->getPrivate();
         JS_ASSERT(i <= ida->length);
         STATIC_ASSUME(i <= ida->length);
         if (i == 0) {
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -128,17 +128,17 @@ js::StringIsArrayIndex(JSLinearString *s
         JS_ASSERT(index <= MAX_ARRAY_INDEX);
         *indexp = index;
         return true;
     }
 
     return false;
 }
 
-RawShape
+Shape *
 js::GetDenseArrayShape(JSContext *cx, HandleObject globalObj)
 {
     JS_ASSERT(globalObj);
 
     JSObject *proto = globalObj->global().getOrCreateArrayPrototype(cx);
     if (!proto)
         return NULL;
 
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -83,17 +83,17 @@ WouldDefinePastNonwritableLength(JSConte
 /*
  * Canonicalize |vp| to a uint32_t value potentially suitable for use as an
  * array length.
  */
 extern bool
 CanonicalizeArrayLengthValue(JSContext *cx, HandleValue v, uint32_t *canonicalized);
 
 /* Get the common shape used by all dense arrays with a prototype at globalObj. */
-extern RawShape
+extern Shape *
 GetDenseArrayShape(JSContext *cx, HandleObject globalObj);
 
 extern JSBool
 GetLengthProperty(JSContext *cx, HandleObject obj, uint32_t *lengthp);
 
 extern JSBool
 SetLengthProperty(JSContext *cx, HandleObject obj, double length);
 
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -618,17 +618,17 @@ js_ReportErrorVA(JSContext *cx, unsigned
 
 /* |callee| requires a usage string provided by JS_DefineFunctionsWithHelp. */
 void
 js::ReportUsageError(JSContext *cx, HandleObject callee, const char *msg)
 {
     const char *usageStr = "usage";
     PropertyName *usageAtom = Atomize(cx, usageStr, strlen(usageStr))->asPropertyName();
     RootedId id(cx, NameToId(usageAtom));
-    DebugOnly<RawShape> shape = static_cast<RawShape>(callee->nativeLookup(cx, id));
+    DebugOnly<Shape *> shape = static_cast<Shape *>(callee->nativeLookup(cx, id));
     JS_ASSERT(!shape->configurable());
     JS_ASSERT(!shape->writable());
     JS_ASSERT(shape->hasDefaultGetter());
 
     RootedValue usage(cx);
     if (!JS_LookupProperty(cx, callee, "usage", usage.address()))
         return;
 
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -2251,22 +2251,22 @@ class AutoStringVector : public AutoVect
         : AutoVectorRooter<RawString>(cx, STRINGVECTOR)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
-class AutoShapeVector : public AutoVectorRooter<RawShape>
+class AutoShapeVector : public AutoVectorRooter<Shape *>
 {
   public:
     explicit AutoShapeVector(JSContext *cx
                              MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-        : AutoVectorRooter<RawShape>(cx, SHAPEVECTOR)
+        : AutoVectorRooter<Shape *>(cx, SHAPEVECTOR)
     {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 class AutoValueArray : public AutoGCRooter
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -248,17 +248,17 @@ JS_FRIEND_API(JSBool)
 JS_WrapAutoIdVector(JSContext *cx, js::AutoIdVector &props)
 {
     return cx->compartment->wrap(cx, props);
 }
 
 JS_FRIEND_API(void)
 JS_TraceShapeCycleCollectorChildren(JSTracer *trc, void *shape)
 {
-    MarkCycleCollectorChildren(trc, static_cast<RawShape>(shape));
+    MarkCycleCollectorChildren(trc, static_cast<Shape *>(shape));
 }
 
 static bool
 DefineHelpProperty(JSContext *cx, HandleObject obj, const char *prop, const char *value)
 {
     JSAtom *atom = Atomize(cx, value, strlen(value));
     if (!atom)
         return false;
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -586,17 +586,17 @@ js_NewGCExternalString(JSContext *cx)
 
 inline JSScript *
 js_NewGCScript(JSContext *cx)
 {
     return js::gc::NewGCThing<JSScript, js::CanGC>(cx, js::gc::FINALIZE_SCRIPT,
                                                    sizeof(JSScript), js::gc::TenuredHeap);
 }
 
-inline js::RawShape
+inline js::Shape *
 js_NewGCShape(JSContext *cx)
 {
     return js::gc::NewGCThing<js::Shape, js::CanGC>(cx, js::gc::FINALIZE_SHAPE,
                                                     sizeof(js::Shape), js::gc::TenuredHeap);
 }
 
 template <js::AllowGC allowGC>
 inline js::BaseShape *
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -945,23 +945,23 @@ class TypeConstraintFilterPrimitive : pu
 
 void
 HeapTypeSet::addFilterPrimitives(JSContext *cx, TypeSet *target)
 {
     add(cx, cx->typeLifoAlloc().new_<TypeConstraintFilterPrimitive>(target));
 }
 
 /* If id is a normal slotful 'own' property of an object, get its shape. */
-static inline RawShape
+static inline Shape *
 GetSingletonShape(JSContext *cx, RawObject obj, RawId idArg)
 {
     if (!obj->isNative())
         return NULL;
     RootedId id(cx, idArg);
-    RawShape shape = obj->nativeLookup(cx, id);
+    Shape *shape = obj->nativeLookup(cx, id);
     if (shape && shape->hasDefaultGetter() && shape->hasSlot())
         return shape;
     return NULL;
 }
 
 void
 ScriptAnalysis::pruneTypeBarriers(JSContext *cx, uint32_t offset)
 {
@@ -970,17 +970,17 @@ ScriptAnalysis::pruneTypeBarriers(JSCont
         TypeBarrier *barrier = *pbarrier;
         if (barrier->target->hasType(barrier->type)) {
             /* Barrier is now obsolete, it can be removed. */
             *pbarrier = barrier->next;
             continue;
         }
         if (barrier->singleton) {
             JS_ASSERT(barrier->type.isPrimitive(JSVAL_TYPE_UNDEFINED));
-            RawShape shape = GetSingletonShape(cx, barrier->singleton, barrier->singletonId);
+            Shape *shape = GetSingletonShape(cx, barrier->singleton, barrier->singletonId);
             if (shape && !barrier->singleton->nativeGetSlot(shape->slot()).isUndefined()) {
                 /*
                  * When we analyzed the script the singleton had an 'own'
                  * property which was undefined (probably a 'var' variable
                  * added to a global object), but now it is defined. The only
                  * way it can become undefined again is if an explicit assign
                  * or deletion on the property occurs, which will update the
                  * type set for the property directly and trigger construction
@@ -3632,17 +3632,17 @@ TypeObject::getFromPrototypes(JSContext 
         return;
 
     protoTypes->addSubset(cx, types);
 
     protoType->getFromPrototypes(cx, id, protoTypes);
 }
 
 static inline void
-UpdatePropertyType(JSContext *cx, TypeSet *types, RawObject obj, RawShape shape,
+UpdatePropertyType(JSContext *cx, TypeSet *types, RawObject obj, Shape *shape,
                    bool force)
 {
     types->setOwnProperty(cx, false);
     if (!shape->writable())
         types->setOwnProperty(cx, true);
 
     if (shape->hasGetterValue() || shape->hasSetterValue()) {
         types->setOwnProperty(cx, true);
@@ -3695,17 +3695,17 @@ TypeObject::addProperty(JSContext *cx, R
                 if (!value.isMagic(JS_ELEMENTS_HOLE)) {
                     Type type = GetValueType(cx, value);
                     base->types.setOwnProperty(cx, false);
                     base->types.addType(cx, type);
                 }
             }
         } else if (!JSID_IS_EMPTY(id)) {
             RootedId rootedId(cx, id);
-            RawShape shape = singleton->nativeLookup(cx, rootedId);
+            Shape *shape = singleton->nativeLookup(cx, rootedId);
             if (shape)
                 UpdatePropertyType(cx, &base->types, rSingleton, shape, false);
         }
 
         if (singleton->watched()) {
             /*
              * Mark the property as configured, to inhibit optimizations on it
              * and avoid bypassing the watchpoint handler.
@@ -3755,17 +3755,17 @@ TypeObject::matchDefiniteProperties(Hand
     for (unsigned i = 0; i < count; i++) {
         Property *prop = getProperty(i);
         if (!prop)
             continue;
         if (prop->types.definiteProperty()) {
             unsigned slot = prop->types.definiteSlot();
 
             bool found = false;
-            RawShape shape = obj->lastProperty();
+            Shape *shape = obj->lastProperty();
             while (!shape->isEmptyShape()) {
                 if (shape->slot() == slot && shape->propid() == prop->id) {
                     found = true;
                     break;
                 }
                 shape = shape->previous();
             }
             if (!found)
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -392,17 +392,17 @@ NewPropertyIteratorObject(JSContext *cx,
 
 NativeIterator *
 NativeIterator::allocateIterator(JSContext *cx, uint32_t slength, const AutoIdVector &props)
 {
     size_t plength = props.length();
     NativeIterator *ni = (NativeIterator *)
         cx->malloc_(sizeof(NativeIterator)
                     + plength * sizeof(RawString)
-                    + slength * sizeof(RawShape));
+                    + slength * sizeof(Shape *));
     if (!ni)
         return NULL;
     AutoValueVector strings(cx);
     ni->props_array = ni->props_cursor = (HeapPtr<JSFlatString> *) (ni + 1);
     ni->props_end = ni->props_array + plength;
     if (plength) {
         for (size_t i = 0; i < plength; i++) {
             JSFlatString *str = IdToString(cx, props[i]);
@@ -578,17 +578,17 @@ js::GetIterator(JSContext *cx, HandleObj
 
         RawObject resultObj = ToObject(cx, vp);
         if (!resultObj)
             return false;
         vp.setObject(*resultObj);
         return true;
     }
 
-    Vector<RawShape, 8> shapes(cx);
+    Vector<Shape *, 8> shapes(cx);
     uint32_t key = 0;
 
     bool keysOnly = (flags == JSITER_ENUMERATE);
 
     if (obj) {
         if (JSIteratorOp op = obj->getClass()->ext.iteratorObject) {
             RawObject iterobj = op(cx, obj, !(flags & JSITER_FOREACH));
             if (!iterobj)
@@ -639,17 +639,17 @@ js::GetIterator(JSContext *cx, HandleObj
                     if (!pobj->isNative() ||
                         !pobj->hasEmptyElements() ||
                         pobj->hasUncacheableProto() ||
                         obj->getOps()->enumerate ||
                         pobj->getClass()->enumerate != JS_EnumerateStub) {
                         shapes.clear();
                         goto miss;
                     }
-                    RawShape shape = pobj->lastProperty();
+                    Shape *shape = pobj->lastProperty();
                     key = (key + (key << 16)) ^ (uintptr_t(shape) >> 3);
                     if (!shapes.append(shape))
                         return false;
                     pobj = pobj->getProto();
                 } while (pobj);
             }
 
             PropertyIteratorObject *iterobj = cx->runtime->nativeIterCache.get(key);
--- a/js/src/jsmemorymetrics.cpp
+++ b/js/src/jsmemorymetrics.cpp
@@ -216,17 +216,17 @@ StatsCellCallback(JSRuntime *rt, void *d
         } else {
             zStats->gcHeapStringsNormal += thingSize;
             zStats->stringCharsNonHuge += strSize;
         }
         break;
       }
 
       case JSTRACE_SHAPE: {
-        RawShape shape = static_cast<RawShape>(thing);
+        Shape *shape = static_cast<Shape *>(thing);
         CompartmentStats *cStats = GetCompartmentStats(shape->compartment());
         size_t propTableSize, kidsSize;
         shape->sizeOfExcludingThis(rtStats->mallocSizeOf_, &propTableSize, &kidsSize);
         if (shape->inDictionary()) {
             cStats->gcHeapShapesDict += thingSize;
             cStats->shapesExtraDictTables += propTableSize;
             JS_ASSERT(kidsSize == 0);
         } else {
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -1441,17 +1441,17 @@ js::NewReshapedObject(JSContext *cx, Han
 
     /* Get all the ids in the object, in order. */
     js::AutoIdVector ids(cx);
     {
         for (unsigned i = 0; i <= shape->slot(); i++) {
             if (!ids.append(JSID_VOID))
                 return NULL;
         }
-        RawShape nshape = shape;
+        Shape *nshape = shape;
         while (!nshape->isEmptyShape()) {
             ids[nshape->slot()] = nshape->propid();
             nshape = nshape->previous();
         }
     }
 
     /* Construct the new shape. */
     RootedId id(cx);
@@ -3179,30 +3179,30 @@ js_PurgeScopeChainHelper(JSContext *cx, 
             if (!PurgeProtoChain(cx, obj, id))
                 return false;
         }
     }
 
     return true;
 }
 
-RawShape
+Shape *
 js_AddNativeProperty(JSContext *cx, HandleObject obj, HandleId id,
                      PropertyOp getter, StrictPropertyOp setter, uint32_t slot,
                      unsigned attrs, unsigned flags, int shortid)
 {
     /*
      * Purge the property cache of now-shadowed id in obj's scope chain. Do
      * this optimistically (assuming no failure below) before locking obj, so
      * we can lock the shadowed scope.
      */
     if (!js_PurgeScopeChain(cx, obj, id))
         return NULL;
 
-    RawShape shape =
+    Shape *shape =
         JSObject::putProperty(cx, obj, id, getter, setter, slot, attrs, flags, shortid);
     if (!shape)
         return shape;
 
     if (JSID_IS_INT(id))
         JSObject::removeDenseElementForSparseIndex(cx, obj, JSID_TO_INT(id));
 
     return shape;
@@ -3537,17 +3537,17 @@ CallResolveOp(JSContext *cx, HandleObjec
         objp.set(obj);
     }
 
     if (JSID_IS_INT(id) && objp->containsDenseElement(JSID_TO_INT(id))) {
         MarkDenseElementFound<CanGC>(propp);
         return true;
     }
 
-    RawShape shape;
+    Shape *shape;
     if (!objp->nativeEmpty() && (shape = objp->nativeLookup(cx, id)))
         propp.set(shape);
     else
         objp.set(NULL);
 
     return true;
 }
 
@@ -3567,17 +3567,17 @@ LookupPropertyWithFlagsInline(JSContext 
         /* Search for a native dense element or property. */
         {
             if (JSID_IS_INT(id) && current->containsDenseElement(JSID_TO_INT(id))) {
                 objp.set(current);
                 MarkDenseElementFound<allowGC>(propp);
                 return true;
             }
 
-            RawShape shape = current->nativeLookup(cx, id);
+            Shape *shape = current->nativeLookup(cx, id);
             if (shape) {
                 objp.set(current);
                 propp.set(shape);
                 return true;
             }
         }
 
         /* Try obj's class resolve hook if id was not found in obj's scope. */
@@ -4550,17 +4550,17 @@ baseops::DeleteSpecial(JSContext *cx, Ha
 bool
 js::HasDataProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     if (JSID_IS_INT(id) && obj->containsDenseElement(JSID_TO_INT(id))) {
         *vp = obj->getDenseElement(JSID_TO_INT(id));
         return true;
     }
 
-    if (RawShape shape = obj->nativeLookup(cx, id)) {
+    if (Shape *shape = obj->nativeLookup(cx, id)) {
         if (shape->hasDefaultGetter() && shape->hasSlot()) {
             *vp = obj->nativeGetSlot(shape->slot());
             return true;
         }
     }
 
     return false;
 }
@@ -4905,17 +4905,17 @@ js_ValueToNonNullObject(JSContext *cx, c
 void
 js_GetObjectSlotName(JSTracer *trc, char *buf, size_t bufsize)
 {
     JS_ASSERT(trc->debugPrinter == js_GetObjectSlotName);
 
     JSObject *obj = (JSObject *)trc->debugPrintArg;
     uint32_t slot = uint32_t(trc->debugPrintIndex);
 
-    RawShape shape;
+    Shape *shape;
     if (obj->isNative()) {
         shape = obj->lastProperty();
         while (shape && (!shape->hasSlot() || shape->slot() != slot))
             shape = shape->previous();
     } else {
         shape = NULL;
     }
 
@@ -5143,17 +5143,17 @@ JSObject::dump()
             fprintf(stderr, "(reserved) ");
         fprintf(stderr, "= ");
         dumpValue(obj->getSlot(i));
         fputc('\n', stderr);
     }
 
     if (obj->isNative()) {
         fprintf(stderr, "properties:\n");
-        Vector<RawShape, 8, SystemAllocPolicy> props;
+        Vector<Shape *, 8, SystemAllocPolicy> props;
         for (Shape::Range<NoGC> r(obj->lastProperty()); !r.empty(); r.popFront())
             props.append(&r.front());
         for (size_t i = props.length(); i-- != 0;)
             DumpProperty(obj, *props[i]);
     }
     fputc('\n', stderr);
 }
 
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -35,17 +35,17 @@ struct ObjectsExtraSizes;
 namespace js {
 
 class AutoPropDescArrayRooter;
 class BaseProxyHandler;
 class CallObject;
 struct GCMarker;
 struct NativeIterator;
 class Nursery;
-ForwardDeclare(Shape);
+class Shape;
 struct StackShape;
 
 namespace mjit { class Compiler; }
 
 inline JSObject *
 CastAsObject(PropertyOp op)
 {
     return JS_FUNC_TO_DATA_PTR(JSObject *, op);
@@ -290,17 +290,17 @@ class JSObject : public js::ObjectImpl
   public:
     /*
      * Update the last property, keeping the number of allocated slots in sync
      * with the object's new slot span.
      */
     static bool setLastProperty(JSContext *cx, JS::HandleObject obj, js::HandleShape shape);
 
     /* As above, but does not change the slot span. */
-    inline void setLastPropertyInfallible(js::RawShape shape);
+    inline void setLastPropertyInfallible(js::Shape *shape);
 
     /*
      * Make a non-array object with the specified initial state. This method
      * takes ownership of any extantSlots it is passed.
      */
     static inline JSObject *create(JSContext *cx,
                                    js::gc::AllocKind kind,
                                    js::gc::InitialHeap heap,
@@ -726,81 +726,81 @@ class JSObject : public js::ObjectImpl
      * given arguments, providing this object as |this|. If the property isn't
      * callable a TypeError will be thrown. On success the value returned by
      * the call is stored in *vp.
      */
     bool callMethod(JSContext *cx, js::HandleId id, unsigned argc, js::Value *argv,
                     js::MutableHandleValue vp);
 
   private:
-    static js::RawShape getChildProperty(JSContext *cx, JS::HandleObject obj,
+    static js::Shape *getChildProperty(JSContext *cx, JS::HandleObject obj,
                                          js::HandleShape parent, js::StackShape &child);
 
   protected:
     /*
      * Internal helper that adds a shape not yet mapped by this object.
      *
      * Notes:
      * 1. getter and setter must be normalized based on flags (see jsscope.cpp).
      * 2. !isExtensible() checking must be done by callers.
      */
-    static js::RawShape addPropertyInternal(JSContext *cx,
+    static js::Shape *addPropertyInternal(JSContext *cx,
                                             JS::HandleObject obj, JS::HandleId id,
                                             JSPropertyOp getter, JSStrictPropertyOp setter,
                                             uint32_t slot, unsigned attrs,
                                             unsigned flags, int shortid, js::Shape **spp,
                                             bool allowDictionary);
 
   private:
     struct TradeGutsReserved;
     static bool ReserveForTradeGuts(JSContext *cx, JSObject *a, JSObject *b,
                                     TradeGutsReserved &reserved);
 
     static void TradeGuts(JSContext *cx, JSObject *a, JSObject *b,
                           TradeGutsReserved &reserved);
 
   public:
     /* Add a property whose id is not yet in this scope. */
-    static js::RawShape addProperty(JSContext *cx, JS::HandleObject, JS::HandleId id,
+    static js::Shape *addProperty(JSContext *cx, JS::HandleObject, JS::HandleId id,
                                     JSPropertyOp getter, JSStrictPropertyOp setter,
                                     uint32_t slot, unsigned attrs, unsigned flags,
                                     int shortid, bool allowDictionary = true);
 
     /* Add a data property whose id is not yet in this scope. */
-    js::RawShape addDataProperty(JSContext *cx, jsid id_, uint32_t slot, unsigned attrs) {
+    js::Shape *addDataProperty(JSContext *cx, jsid id_, uint32_t slot, unsigned attrs) {
         JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
         JS::RootedObject self(cx, this);
         JS::RootedId id(cx, id_);
         return addProperty(cx, self, id, NULL, NULL, slot, attrs, 0, 0);
     }
 
-    js::RawShape addDataProperty(JSContext *cx, js::HandlePropertyName name, uint32_t slot, unsigned attrs) {
+    js::Shape *addDataProperty(JSContext *cx, js::HandlePropertyName name, uint32_t slot, unsigned attrs) {
         JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
         JS::RootedObject self(cx, this);
         JS::RootedId id(cx, NameToId(name));
         return addProperty(cx, self, id, NULL, NULL, slot, attrs, 0, 0);
     }
 
     /* Add or overwrite a property for id in this scope. */
-    static js::RawShape putProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
+    static js::Shape *putProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
                                     JSPropertyOp getter, JSStrictPropertyOp setter,
                                     uint32_t slot, unsigned attrs,
                                     unsigned flags, int shortid);
-    static js::RawShape putProperty(JSContext *cx, JS::HandleObject obj,
+    static js::Shape *putProperty(JSContext *cx, JS::HandleObject obj,
                                     js::PropertyName *name,
                                     JSPropertyOp getter, JSStrictPropertyOp setter,
                                     uint32_t slot, unsigned attrs,
                                     unsigned flags, int shortid)
     {
         JS::RootedId id(cx, js::NameToId(name));
         return putProperty(cx, obj, id, getter, setter, slot, attrs, flags, shortid);
     }
 
     /* Change the given property into a sibling with the same id in this scope. */
-    static js::RawShape changeProperty(JSContext *cx, js::HandleObject obj,
+    static js::Shape *changeProperty(JSContext *cx, js::HandleObject obj,
                                        js::HandleShape shape, unsigned attrs, unsigned mask,
                                        JSPropertyOp getter, JSStrictPropertyOp setter);
 
     static inline bool changePropertyAttributes(JSContext *cx, js::HandleObject obj,
                                                 js::HandleShape shape, unsigned attrs);
 
     /* Remove the property named by id from this object. */
     bool removeProperty(JSContext *cx, jsid id);
@@ -1151,17 +1151,17 @@ js_IdentifyClassPrototype(JSObject *obj)
 bool
 js_FindClassObject(JSContext *cx, JSProtoKey protoKey, js::MutableHandleValue vp,
                    js::Class *clasp = NULL);
 
 /*
  * Find or create a property named by id in obj's scope, with the given getter
  * and setter, slot, attributes, and other members.
  */
-extern js::RawShape
+extern js::Shape *
 js_AddNativeProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
                      JSPropertyOp getter, JSStrictPropertyOp setter, uint32_t slot,
                      unsigned attrs, unsigned flags, int shortid);
 
 extern JSBool
 js_DefineOwnProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
                      const JS::Value &descriptor, JSBool *bp);
 
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -270,17 +270,17 @@ JSObject::isFixedSlot(size_t slot)
 inline size_t
 JSObject::dynamicSlotIndex(size_t slot)
 {
     JS_ASSERT(slot >= numFixedSlots());
     return slot - numFixedSlots();
 }
 
 inline void
-JSObject::setLastPropertyInfallible(js::RawShape shape)
+JSObject::setLastPropertyInfallible(js::Shape *shape)
 {
     JS_ASSERT(!shape->inDictionary());
     JS_ASSERT(shape->compartment() == compartment());
     JS_ASSERT(!inDictionaryMode());
     JS_ASSERT(slotSpan() == shape->slotSpan());
     JS_ASSERT(numFixedSlots() == shape->numFixedSlots());
 
     shape_ = shape;
@@ -301,17 +301,17 @@ JSObject::canRemoveLastProperty()
     /*
      * Check that the information about the object stored in the last
      * property's base shape is consistent with that stored in the previous
      * shape. If not consistent, then the last property cannot be removed as it
      * will induce a change in the object itself, and the object must be
      * converted to dictionary mode instead. See BaseShape comment in jsscope.h
      */
     JS_ASSERT(!inDictionaryMode());
-    js::RawShape previous = lastProperty()->previous().get();
+    js::Shape *previous = lastProperty()->previous().get();
     return previous->getObjectParent() == lastProperty()->getObjectParent()
         && previous->getObjectFlags() == lastProperty()->getObjectFlags();
 }
 
 inline const js::HeapSlot *
 JSObject::getRawSlots()
 {
     JS_ASSERT(isGlobal());
--- a/js/src/jspropertycacheinlines.h
+++ b/js/src/jspropertycacheinlines.h
@@ -28,17 +28,17 @@
  * caches (on all threads) by re-generating JSObject::shape().
  */
 JS_ALWAYS_INLINE void
 js::PropertyCache::test(JSContext *cx, jsbytecode *pc, JSObject **obj,
                         JSObject **pobj, PropertyCacheEntry **entry, PropertyName **name)
 {
     JS_ASSERT(this == &cx->propertyCache());
 
-    RawShape kshape = (*obj)->lastProperty();
+    Shape *kshape = (*obj)->lastProperty();
     *entry = &table[hash(pc, kshape)];
     PCMETER(pctestentry = *entry);
     PCMETER(tests++);
     JS_ASSERT(obj != pobj);
     if ((*entry)->kpc == pc && (*entry)->kshape == kshape) {
         JSObject *tmp;
         *pobj = *obj;
         if ((*entry)->isPrototypePropertyHit() &&
@@ -59,17 +59,17 @@ js::PropertyCache::test(JSContext *cx, j
 }
 
 JS_ALWAYS_INLINE bool
 js::PropertyCache::testForSet(JSContext *cx, jsbytecode *pc, JSObject *obj,
                               PropertyCacheEntry **entryp, JSObject **obj2p, PropertyName **namep)
 {
     JS_ASSERT(this == &cx->propertyCache());
 
-    RawShape kshape = obj->lastProperty();
+    Shape *kshape = obj->lastProperty();
     PropertyCacheEntry *entry = &table[hash(pc, kshape)];
     *entryp = entry;
     PCMETER(pctestentry = entry);
     PCMETER(tests++);
     PCMETER(settests++);
     if (entry->kpc == pc && entry->kshape == kshape)
         return true;
 
--- a/js/src/jspropertytree.cpp
+++ b/js/src/jspropertytree.cpp
@@ -26,58 +26,58 @@ ShapeHasher::hash(const Lookup &l)
 }
 
 inline bool
 ShapeHasher::match(const Key k, const Lookup &l)
 {
     return k->matches(l);
 }
 
-RawShape
+Shape *
 PropertyTree::newShape(JSContext *cx)
 {
-    RawShape shape = js_NewGCShape(cx);
+    Shape *shape = js_NewGCShape(cx);
     if (!shape)
         JS_ReportOutOfMemory(cx);
     return shape;
 }
 
 static KidsHash *
-HashChildren(RawShape kid1, RawShape kid2)
+HashChildren(Shape *kid1, Shape *kid2)
 {
     KidsHash *hash = js_new<KidsHash>();
     if (!hash || !hash->init(2)) {
         js_delete(hash);
         return NULL;
     }
 
     JS_ALWAYS_TRUE(hash->putNew(kid1, kid1));
     JS_ALWAYS_TRUE(hash->putNew(kid2, kid2));
     return hash;
 }
 
 bool
-PropertyTree::insertChild(JSContext *cx, RawShape parent, RawShape child)
+PropertyTree::insertChild(JSContext *cx, Shape *parent, Shape *child)
 {
     JS_ASSERT(!parent->inDictionary());
     JS_ASSERT(!child->parent);
     JS_ASSERT(!child->inDictionary());
     JS_ASSERT(cx->compartment == compartment);
     JS_ASSERT(child->compartment() == parent->compartment());
 
     KidsPointer *kidp = &parent->kids;
 
     if (kidp->isNull()) {
         child->setParent(parent);
         kidp->setShape(child);
         return true;
     }
 
     if (kidp->isShape()) {
-        RawShape shape = kidp->toShape();
+        Shape *shape = kidp->toShape();
         JS_ASSERT(shape != child);
         JS_ASSERT(!shape->matches(child));
 
         KidsHash *hash = HashChildren(shape, child);
         if (!hash) {
             JS_ReportOutOfMemory(cx);
             return false;
         }
@@ -91,17 +91,17 @@ PropertyTree::insertChild(JSContext *cx,
         return false;
     }
 
     child->setParent(parent);
     return true;
 }
 
 void
-Shape::removeChild(RawShape child)
+Shape::removeChild(Shape *child)
 {
     JS_ASSERT(!child->inDictionary());
     JS_ASSERT(child->parent == this);
 
     KidsPointer *kidp = &kids;
 
     if (kidp->isShape()) {
         JS_ASSERT(kidp->toShape() == child);
@@ -121,35 +121,35 @@ Shape::removeChild(RawShape child)
         KidsHash::Range r = hash->all();
         Shape *otherChild = r.front();
         JS_ASSERT((r.popFront(), r.empty()));    /* No more elements! */
         kidp->setShape(otherChild);
         js_delete(hash);
     }
 }
 
-RawShape
+Shape *
 PropertyTree::getChild(JSContext *cx, Shape *parent_, uint32_t nfixed, const StackShape &child)
 {
     {
-        RawShape shape = NULL;
+        Shape *shape = NULL;
 
         JS_ASSERT(parent_);
 
         /*
          * The property tree has extremely low fan-out below its root in
          * popular embeddings with real-world workloads. Patterns such as
          * defining closures that capture a constructor's environment as
          * getters or setters on the new object that is passed in as
          * |this| can significantly increase fan-out below the property
          * tree root -- see bug 335700 for details.
          */
         KidsPointer *kidp = &parent_->kids;
         if (kidp->isShape()) {
-            RawShape kid = kidp->toShape();
+            Shape *kid = kidp->toShape();
             if (kid->matches(child))
                 shape = kid;
         } else if (kidp->isHash()) {
             if (KidsHash::Ptr p = kidp->toHash()->lookup(child))
                 shape = *p;
         } else {
             /* If kidp->isNull(), we always insert. */
         }
@@ -181,17 +181,17 @@ PropertyTree::getChild(JSContext *cx, Sh
 
         if (shape)
             return shape;
     }
 
     StackShape::AutoRooter childRoot(cx, &child);
     RootedShape parent(cx, parent_);
 
-    RawShape shape = newShape(cx);
+    Shape *shape = newShape(cx);
     if (!shape)
         return NULL;
 
     new (shape) Shape(child, nfixed);
 
     if (!insertChild(cx, parent, shape))
         return NULL;
 
@@ -235,17 +235,17 @@ Shape::finalize(FreeOp *fop)
 {
     if (!inDictionary() && kids.isHash())
         fop->delete_(kids.toHash());
 }
 
 #ifdef DEBUG
 
 void
-KidsPointer::checkConsistency(RawShape aKid) const
+KidsPointer::checkConsistency(Shape *aKid) const
 {
     if (isShape()) {
         JS_ASSERT(toShape() == aKid);
     } else {
         JS_ASSERT(isHash());
         KidsHash *hash = toHash();
         KidsHash::Ptr ptr = hash->lookup(aKid);
         JS_ASSERT(*ptr == aKid);
@@ -320,23 +320,23 @@ Shape::dumpSubtree(JSContext *cx, int le
     } else {
         fprintf(fp, "%*sid ", level, "");
         dump(cx, fp);
     }
 
     if (!kids.isNull()) {
         ++level;
         if (kids.isShape()) {
-            RawShape kid = kids.toShape();
+            Shape *kid = kids.toShape();
             JS_ASSERT(kid->parent == this);
             kid->dumpSubtree(cx, level, fp);
         } else {
             const KidsHash &hash = *kids.toHash();
             for (KidsHash::Range range = hash.all(); !range.empty(); range.popFront()) {
-                RawShape kid = range.front();
+                Shape *kid = range.front();
 
                 JS_ASSERT(kid->parent == this);
                 kid->dumpSubtree(cx, level, fp);
             }
         }
     }
 }
 
@@ -360,16 +360,16 @@ js::PropertyTree::dumpShapes(JSRuntime *
 
     for (gc::GCCompartmentsIter c(rt); !c.done(); c.next()) {
         fprintf(dumpfp, "*** Compartment %p ***\n", (void *)c.get());
 
         /*
         typedef JSCompartment::EmptyShapeSet HS;
         HS &h = c->emptyShapes;
         for (HS::Range r = h.all(); !r.empty(); r.popFront()) {
-            RawShape empty = r.front();
+            Shape *empty = r.front();
             empty->dumpSubtree(rt, 0, dumpfp);
             putc('\n', dumpfp);
         }
         */
     }
 }
 #endif
--- a/js/src/jspropertytree.h
+++ b/js/src/jspropertytree.h
@@ -9,90 +9,90 @@
 
 #include "jsalloc.h"
 
 #include "js/HashTable.h"
 #include "js/RootingAPI.h"
 
 namespace js {
 
-ForwardDeclare(Shape);
+class Shape;
 struct StackShape;
 
 struct ShapeHasher {
-    typedef RawShape Key;
+    typedef Shape *Key;
     typedef StackShape Lookup;
 
     static inline HashNumber hash(const Lookup &l);
     static inline bool match(Key k, const Lookup &l);
 };
 
-typedef HashSet<RawShape, ShapeHasher, SystemAllocPolicy> KidsHash;
+typedef HashSet<Shape *, ShapeHasher, SystemAllocPolicy> KidsHash;
 
 class KidsPointer {
   private:
     enum {
         SHAPE = 0,
         HASH  = 1,
         TAG   = 1
     };
 
     uintptr_t w;
 
   public:
     bool isNull() const { return !w; }
     void setNull() { w = 0; }
 
     bool isShape() const { return (w & TAG) == SHAPE && !isNull(); }
-    RawShape toShape() const {
+    Shape *toShape() const {
         JS_ASSERT(isShape());
-        return reinterpret_cast<RawShape>(w & ~uintptr_t(TAG));
+        return reinterpret_cast<Shape *>(w & ~uintptr_t(TAG));
     }
-    void setShape(RawShape shape) {
+    void setShape(Shape *shape) {
         JS_ASSERT(shape);
-        JS_ASSERT((reinterpret_cast<uintptr_t>(static_cast<RawShape>(shape)) & TAG) == 0);
-        w = reinterpret_cast<uintptr_t>(static_cast<RawShape>(shape)) | SHAPE;
+        JS_ASSERT((reinterpret_cast<uintptr_t>(static_cast<Shape *>(shape)) & TAG) == 0);
+        w = reinterpret_cast<uintptr_t>(static_cast<Shape *>(shape)) | SHAPE;
     }
 
     bool isHash() const { return (w & TAG) == HASH; }
     KidsHash *toHash() const {
         JS_ASSERT(isHash());
         return reinterpret_cast<KidsHash *>(w & ~uintptr_t(TAG));
     }
     void setHash(KidsHash *hash) {
         JS_ASSERT(hash);
         JS_ASSERT((reinterpret_cast<uintptr_t>(hash) & TAG) == 0);
         w = reinterpret_cast<uintptr_t>(hash) | HASH;
     }
 
 #ifdef DEBUG
-    void checkConsistency(RawShape aKid) const;
+    void checkConsistency(Shape *aKid) const;
 #endif
 };
 
 class PropertyTree
 {
     friend class ::JSFunction;
 
     JSCompartment *compartment;
 
-    bool insertChild(JSContext *cx, RawShape parent, RawShape child);
+    bool insertChild(JSContext *cx, Shape *parent, Shape *child);
 
     PropertyTree();
 
   public:
     enum { MAX_HEIGHT = 128 };
 
     PropertyTree(JSCompartment *comp)
         : compartment(comp)
     {
     }
 
-    RawShape newShape(JSContext *cx);
-    RawShape getChild(JSContext *cx, Shape *parent, uint32_t nfixed, const StackShape &child);
+    Shape *newShape(JSContext *cx);
+    Shape *getChild(JSContext *cx, Shape *parent, uint32_t nfixed, const StackShape &child);
 
 #ifdef DEBUG
     static void dumpShapes(JSRuntime *rt);
 #endif
 };
 
 } /* namespace js */
 
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -128,17 +128,17 @@ Bindings::initWithTemporaryStorage(JSCon
             return false;
 
         RootedId id(cx, NameToId(bi->name()));
         unsigned attrs = JSPROP_PERMANENT | JSPROP_ENUMERATE |
                          (bi->kind() == CONSTANT ? JSPROP_READONLY : 0);
         unsigned frameIndex = bi.frameIndex();
         StackShape child(nbase, id, slot++, 0, attrs, Shape::HAS_SHORTID, frameIndex);
 
-        RawShape shape = self->callObjShape_->getChildBinding(cx, child);
+        Shape *shape = self->callObjShape_->getChildBinding(cx, child);
         if (!shape)
             return false;
 
         self->callObjShape_ = shape;
     }
     JS_ASSERT(!bi);
 
     return true;
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -190,17 +190,17 @@ class Bindings
     static bool clone(JSContext *cx, InternalBindingsHandle self, uint8_t *dstScriptData,
                       HandleScript srcScript);
 
     unsigned numArgs() const { return numArgs_; }
     unsigned numVars() const { return numVars_; }
     unsigned count() const { return numArgs() + numVars(); }
 
     /* Return the initial shape of call objects created for this scope. */
-    RawShape callObjShape() const { return callObjShape_; }
+    Shape *callObjShape() const { return callObjShape_; }
 
     /* Convenience method to get the var index of 'arguments'. */
     static unsigned argumentsVarIndex(JSContext *cx, InternalBindingsHandle);
 
     /* Return whether the binding at bindingIndex is aliased. */
     bool bindingIsAliased(unsigned bindingIndex);
 
     /* Return whether this scope has any aliased bindings. */
@@ -209,17 +209,17 @@ class Bindings
     void trace(JSTracer *trc);
 };
 
 template <>
 struct RootMethods<Bindings> {
     static Bindings initial();
     static ThingRootKind kind() { return THING_ROOT_BINDINGS; }
     static bool poisoned(const Bindings &bindings) {
-        return IsPoisonedPtr(static_cast<RawShape>(bindings.callObjShape()));
+        return IsPoisonedPtr(static_cast<Shape *>(bindings.callObjShape()));
     }
 };
 
 class ScriptCounts
 {
     friend class ::JSScript;
     friend struct ScriptAndCounts;
 
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -3486,17 +3486,17 @@ static const JSFunctionSpec string_stati
     // This must be at the end because of bug 853075: functions listed after
     // self-hosted methods aren't available in self-hosted code.
 #if ENABLE_INTL_API
          {"localeCompare",     {NULL, NULL},          2,0, "String_static_localeCompare"},
 #endif
     JS_FS_END
 };
 
-RawShape
+Shape *
 StringObject::assignInitialShape(JSContext *cx)
 {
     JS_ASSERT(nativeEmpty());
 
     return addDataProperty(cx, cx->names().length, LENGTH_SLOT,
                            JSPROP_PERMANENT | JSPROP_READONLY);
 }
 
--- a/js/src/jswatchpoint.cpp
+++ b/js/src/jswatchpoint.cpp
@@ -141,17 +141,17 @@ WatchpointMap::triggerWatchpoint(JSConte
     /* Copy the entry, since GC would invalidate p. */
     JSWatchPointHandler handler = p->value.handler;
     RootedObject closure(cx, p->value.closure);
 
     /* Determine the property's old value. */
     Value old;
     old.setUndefined();
     if (obj->isNative()) {
-        if (RawShape shape = obj->nativeLookup(cx, id)) {
+        if (Shape *shape = obj->nativeLookup(cx, id)) {
             if (shape->hasSlot())
                 old = obj->nativeGetSlot(shape->slot());
         }
     }
 
     // Read barrier to prevent an incorrectly gray closure from escaping the
     // watchpoint. See the comment before UnmarkGrayChildren in gc/Marking.cpp
     JS::ExposeGCThingToActiveJS(closure, JSTRACE_OBJECT);
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@@ -193,17 +193,17 @@ static const JSC::MacroAssembler::Regist
     void loadPtrFromImm(void *ptr, RegisterID reg) {
         loadPtr(ptr, reg);
     }
 
     void loadShape(RegisterID obj, RegisterID shape) {
         loadPtr(Address(obj, JSObject::offsetOfShape()), shape);
     }
 
-    Jump guardShape(RegisterID objReg, RawShape shape) {
+    Jump guardShape(RegisterID objReg, Shape *shape) {
         return branchPtr(NotEqual, Address(objReg, JSObject::offsetOfShape()), ImmPtr(shape));
     }
 
     Jump guardShape(RegisterID objReg, JSObject *obj) {
         return guardShape(objReg, obj->lastProperty());
     }
 
     /*
@@ -977,17 +977,17 @@ static const JSC::MacroAssembler::Regist
 
     void loadDynamicSlot(RegisterID objReg, uint32_t index,
                          RegisterID typeReg, RegisterID dataReg) {
         loadPtr(Address(objReg, JSObject::offsetOfSlots()), dataReg);
         loadValueAsComponents(Address(dataReg, index * sizeof(Value)), typeReg, dataReg);
     }
 
     void loadObjProp(JSObject *obj, RegisterID objReg,
-                     js::RawShape shape,
+                     js::Shape *shape,
                      RegisterID typeReg, RegisterID dataReg)
     {
         if (obj->isFixedSlot(shape->slot()))
             loadInlineSlot(objReg, shape->slot(), typeReg, dataReg);
         else
             loadDynamicSlot(objReg, obj->dynamicSlotIndex(shape->slot()), typeReg, dataReg);
     }
 
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -6103,17 +6103,17 @@ mjit::Compiler::jsop_aliasedArg(unsigned
 void
 mjit::Compiler::jsop_aliasedVar(ScopeCoordinate sc, bool get, bool poppedAfter)
 {
     RegisterID reg = frame.allocReg(Registers::SavedRegs).reg();
     masm.loadPtr(Address(JSFrameReg, StackFrame::offsetOfScopeChain()), reg);
     for (unsigned i = 0; i < sc.hops; i++)
         masm.loadPayload(Address(reg, ScopeObject::offsetOfEnclosingScope()), reg);
 
-    RawShape shape = ScopeCoordinateToStaticScopeShape(cx, script_, PC);
+    Shape *shape = ScopeCoordinateToStaticScopeShape(cx, script_, PC);
     Address addr;
     if (shape->numFixedSlots() <= sc.slot) {
         masm.loadPtr(Address(reg, JSObject::offsetOfSlots()), reg);
         addr = Address(reg, (sc.slot - shape->numFixedSlots()) * sizeof(Value));
     } else {
         addr = Address(reg, JSObject::getFixedSlotOffset(sc.slot));
     }
 
@@ -6251,17 +6251,17 @@ mjit::Compiler::iter(unsigned flags)
     Jump mismatchedObject = masm.branchPtr(Assembler::NotEqual, T1, T2);
     stubcc.linkExit(mismatchedObject, Uses(1));
 
     /* Compare shape of object's prototype with iterator. */
     masm.loadPtr(Address(reg, JSObject::offsetOfType()), T1);
     masm.loadPtr(Address(T1, offsetof(types::TypeObject, proto)), T1);
     masm.loadShape(T1, T1);
     masm.loadPtr(Address(nireg, offsetof(NativeIterator, shapes_array)), T2);
-    masm.loadPtr(Address(T2, sizeof(RawShape)), T2);
+    masm.loadPtr(Address(T2, sizeof(Shape *)), T2);
     Jump mismatchedProto = masm.branchPtr(Assembler::NotEqual, T1, T2);
     stubcc.linkExit(mismatchedProto, Uses(1));
 
     /*
      * Compare object's prototype's prototype with NULL. The last native
      * iterator will always have a prototype chain length of one
      * (i.e. it must be a plain object), so we do not need to generate
      * a loop here.
@@ -6558,17 +6558,17 @@ mjit::Compiler::jsop_getgname(uint32_t i
             return false;
 
         /*
          * If we are accessing a defined global which is a normal data property
          * then bake its address into the jitcode and guard against future
          * reallocation of the global object's slots.
          */
         RootedId id(cx, NameToId(name));
-        RawShape shape = globalObj->nativeLookup(cx, id);
+        Shape *shape = globalObj->nativeLookup(cx, id);
         if (shape && shape->hasDefaultGetter() && shape->hasSlot()) {
             HeapSlot *value = &globalObj->getSlotRef(shape->slot());
             if (!value->isUndefined() && !propertyTypes->isOwnProperty(cx, globalType, true)) {
                 if (!watchGlobalReallocation())
                     return false;
                 RegisterID reg = frame.allocReg();
                 masm.move(ImmPtr(value), reg);
 
--- a/js/src/methodjit/FastOps.cpp
+++ b/js/src/methodjit/FastOps.cpp
@@ -1472,17 +1472,17 @@ mjit::Compiler::jsop_setelem(bool popGua
     ic.fastPathStart = masm.label();
 
     // Create the common out-of-line sync block, taking care to link previous
     // guards here after.
     RESERVE_OOL_SPACE(stubcc.masm);
     ic.slowPathStart = stubcc.syncExit(Uses(3));
 
     // Guard obj is a dense array.
-    RawShape shape = GetDenseArrayShape(cx, globalObj);
+    Shape *shape = GetDenseArrayShape(cx, globalObj);
     if (!shape)
         return false;
     ic.shapeGuard = masm.guardShape(ic.objReg, shape);
     stubcc.linkExitDirect(ic.shapeGuard, ic.slowPathStart);
 
     // Load the dynamic elements vector.
     masm.loadPtr(Address(ic.objReg, JSObject::offsetOfElements()), ic.objReg);
 
@@ -2056,17 +2056,17 @@ mjit::Compiler::jsop_getelem()
     if (id->mightBeType(JSVAL_TYPE_INT32)) {
         // Always test the type first (see comment in PolyIC.h).
         if (!id->isTypeKnown()) {
             ic.typeGuard = masm.testInt32(Assembler::NotEqual, ic.typeReg);
             stubcc.linkExitDirect(ic.typeGuard.get(), ic.slowPathStart);
         }
 
         // Guard obj is a dense array.
-        RawShape shape = GetDenseArrayShape(cx, globalObj);
+        Shape *shape = GetDenseArrayShape(cx, globalObj);
         if (!shape)
             return false;
         ic.shapeGuard = masm.guardShape(ic.objReg, shape);
         stubcc.linkExitDirect(ic.shapeGuard, ic.slowPathStart);
 
         Int32Key key = id->isConstant()
                        ? Int32Key::FromConstant(id->getValue().toInt32())
                        : Int32Key::FromRegister(ic.id.dataReg());
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1397,17 +1397,17 @@ GetPIC(JSContext *cx, JSScript *script, 
     for (uint32_t i = 0; i < chunk->nPICs; i++) {
         if (pics[i].pc == pc)
             return &pics[i];
     }
 
     return NULL;
 }
 
-RawShape
+Shape *
 mjit::GetPICSingleShape(JSContext *cx, JSScript *script, jsbytecode *pc, bool constructing)
 {
     ic::PICInfo *pic = GetPIC(cx, script, pc, constructing);
     if (!pic)
         return NULL;
     return pic->getSingleShape();
 }
 
--- a/js/src/methodjit/MethodJIT.h
+++ b/js/src/methodjit/MethodJIT.h
@@ -1031,17 +1031,17 @@ IsLowerableFunCallOrApply(jsbytecode *pc
 #ifdef JS_MONOIC
     return (*pc == JSOP_FUNCALL && GET_ARGC(pc) >= 1) ||
            (*pc == JSOP_FUNAPPLY && GET_ARGC(pc) == 2);
 #else
     return false;
 #endif
 }
 
-RawShape
+Shape *
 GetPICSingleShape(JSContext *cx, JSScript *script, jsbytecode *pc, bool constructing);
 
 static inline void
 PurgeCaches(JSScript *script)
 {
     for (int constructing = 0; constructing <= 1; constructing++) {
         for (int barriers = 0; barriers <= 1; barriers++) {
             mjit::JITScript *jit = script->getJIT((bool) constructing, (bool) barriers);
--- a/js/src/methodjit/MonoIC.cpp
+++ b/js/src/methodjit/MonoIC.cpp
@@ -110,24 +110,24 @@ PatchSetFallback(VMFrame &f, ic::SetGlob
 {
     Repatcher repatch(f.chunk());
     VoidStubSetGlobal stub = DisabledSetGlobal;
     JSC::FunctionPtr fptr(JS_FUNC_TO_DATA_PTR(void *, stub));
     repatch.relink(ic->slowPathCall, fptr);
 }
 
 void
-SetGlobalNameIC::patchInlineShapeGuard(Repatcher &repatcher, RawShape shape)
+SetGlobalNameIC::patchInlineShapeGuard(Repatcher &repatcher, Shape *shape)
 {
     JSC::CodeLocationDataLabelPtr label = fastPathStart.dataLabelPtrAtOffset(shapeOffset);
     repatcher.repatch(label, shape);
 }
 
 static LookupStatus
-UpdateSetGlobalName(VMFrame &f, ic::SetGlobalNameIC *ic, JSObject *obj, RawShape shape)
+UpdateSetGlobalName(VMFrame &f, ic::SetGlobalNameIC *ic, JSObject *obj, Shape *shape)
 {
     /* Give globals a chance to appear. */
     if (!shape)
         return Lookup_Uncacheable;
 
     if (!shape->hasDefaultSetter() ||
         !shape->writable() ||
         !shape->hasSlot() ||
@@ -155,17 +155,17 @@ ic::SetGlobalName(VMFrame &f, ic::SetGlo
 {
     RootedObject obj(f.cx, &f.fp()->global());
     RootedPropertyName name(f.cx, f.script()->getName(GET_UINT32_INDEX(f.pc())));
 
     RecompilationMonitor monitor(f.cx);
 
     {
         RootedId id(f.cx, NameToId(name));
-        RawShape shape = obj->nativeLookup(f.cx, id);
+        Shape *shape = obj->nativeLookup(f.cx, id);
 
         if (!monitor.recompiled()) {
             LookupStatus status = UpdateSetGlobalName(f, ic, obj, shape);
             if (status == Lookup_Error)
                 THROW();
         }
     }
 
--- a/js/src/methodjit/MonoIC.h
+++ b/js/src/methodjit/MonoIC.h
@@ -110,17 +110,17 @@ struct SetGlobalNameIC : public GlobalNa
     RegisterID objReg   : 5;    /* Register for object, if objConst is false. */
     RegisterID shapeReg : 5;    /* Register for shape; volatile. */
 
     int32_t fastRejoinOffset : 16;  /* Offset from fastPathStart to rejoin. */
 
     /* SET only. */
     ValueRemat vr;              /* RHS value. */
 
-    void patchInlineShapeGuard(Repatcher &repatcher, RawShape shape);
+    void patchInlineShapeGuard(Repatcher &repatcher, Shape *shape);
 };
 
 void JS_FASTCALL GetGlobalName(VMFrame &f, ic::GetGlobalNameIC *ic);
 void JS_FASTCALL SetGlobalName(VMFrame &f, ic::SetGlobalNameIC *ic);
 
 struct EqualityICInfo {
     typedef JSC::MacroAssembler::RegisterID RegisterID;
 
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@@ -186,17 +186,17 @@ class SetPropCompiler : public PICStubCo
                           NULL);
         repatcher.relink(labels.getInlineShapeJump(pic.fastPathStart.labelAtOffset(pic.shapeGuard)),
                          pic.slowPathStart);
 
         FunctionPtr target(JS_FUNC_TO_DATA_PTR(void *, ic::SetPropOrName));
         repatcher.relink(pic.slowPathCall, target);
     }
 
-    LookupStatus patchInline(RawShape shape)
+    LookupStatus patchInline(Shape *shape)
     {
         JS_ASSERT(!pic.inlinePathPatched);
         JaegerSpew(JSpew_PICs, "patch setprop inline at %p\n", pic.fastPathStart.executableAddress());
 
         Repatcher repatcher(f.chunk());
         SetPropLabels &labels = pic.setPropLabels();
 
         int32_t offset;
@@ -1005,17 +1005,17 @@ class GetPropCompiler : public PICStubCo
             repatcher.relink(pic.getPropLabels().getInlineTypeJump(pic.fastPathStart), start);
         }
 
         disable("generated string length stub");
 
         return Lookup_Cacheable;
     }
 
-    LookupStatus patchInline(JSObject *holder, RawShape shape)
+    LookupStatus patchInline(JSObject *holder, Shape *shape)
     {
         spew("patch", "inline");
         Repatcher repatcher(f.chunk());
         GetPropLabels &labels = pic.getPropLabels();
 
         int32_t offset;
         if (holder->isFixedSlot(shape->slot())) {
             CodeLocationInstruction istr = labels.getDslotsLoad(pic.fastPathRejoin);
@@ -1040,17 +1040,17 @@ class GetPropCompiler : public PICStubCo
         repatcher.patchAddressOffsetForValueLoad(labels.getValueLoad(pic.fastPathRejoin), offset);
 
         pic.inlinePathPatched = true;
 
         return Lookup_Cacheable;
     }
 
     /* For JSPropertyOp getters. */
-    void generateGetterStub(Assembler &masm, RawShape shape, jsid userid,
+    void generateGetterStub(Assembler &masm, Shape *shape, jsid userid,
                             Label start, Vector<Jump, 8> &shapeMismatches)
     {
         /*
          * Getter hook needs to be called from the stub. The state is fully
          * synced and no registers are live except the result registers.
          */
         JS_ASSERT(pic.canCallHook);
         PropertyOp getter = shape->getterOp();
@@ -1150,17 +1150,17 @@ class GetPropCompiler : public PICStubCo
         }
 
         linker.patchJump(pic.fastPathRejoin);
 
         linkerEpilogue(linker, start, shapeMismatches);
     }
 
     /* For getters backed by a JSNative. */
-    void generateNativeGetterStub(Assembler &masm, RawShape shape,
+    void generateNativeGetterStub(Assembler &masm, Shape *shape,
                                   Label start, Vector<Jump, 8> &shapeMismatches)
     {
        /*
          * Getter hook needs to be called from the stub. The state is fully
          * synced and no registers are live except the result registers.
          */
         JS_ASSERT(pic.canCallHook);
 
@@ -1652,17 +1652,17 @@ class ScopeNameCompiler : public PICStub
 
         /* For GETXPROP, the object is already in objReg. */
         if (pic.kind == ic::PICInfo::NAME)
             masm.loadPtr(Address(JSFrameReg, StackFrame::offsetOfScopeChain()), pic.objReg);
 
         JS_ASSERT(obj == getprop.holder);
         JS_ASSERT(getprop.holder != &scopeChain->global());
 
-        RawShape shape = getprop.shape;
+        Shape *shape = getprop.shape;
         if (!shape->hasDefaultGetter())
             return disable("unhandled callobj sprop getter");
 
         LookupStatus status = walkScopeChain(masm, fails);
         if (status != Lookup_Cacheable)
             return status;
 
         /* If a scope chain walk was required, the final object needs a NULL test. */
--- a/js/src/methodjit/PolyIC.h
+++ b/js/src/methodjit/PolyIC.h
@@ -482,22 +482,22 @@ struct PICInfo : public BasePolyIC {
     PropertyName *name;
 
   private:
     Shape *inlinePathShape_;
 
   public:
     void purge(Repatcher &repatcher);
 
-    void setInlinePathShape(RawShape shape) {
+    void setInlinePathShape(Shape *shape) {
         JS_ASSERT(!inlinePathShape_);
         inlinePathShape_ = shape;
     }
 
-    RawShape getSingleShape() {
+    Shape *getSingleShape() {
         if (disabled || hadUncacheable || stubsGenerated > 0)
             return NULL;
         return inlinePathShape_;
     }
 
   protected:
     // Reset the data members to the state of a fresh PIC before any patching
     // or stub generation was done.
--- a/js/src/vm/ObjectImpl-inl.h
+++ b/js/src/vm/ObjectImpl-inl.h
@@ -47,23 +47,23 @@ js::ObjectImpl::compartment() const
 }
 
 inline js::TaggedProto
 js::ObjectImpl::getTaggedProto() const
 {
     return TaggedProto(getProto());
 }
 
-inline js::RawShape
+inline js::Shape *
 js::ObjectImpl::nativeLookup(JSContext *cx, PropertyId pid)
 {
     return nativeLookup(cx, pid.asId());
 }
 
-inline js::RawShape
+inline js::Shape *
 js::ObjectImpl::nativeLookup(JSContext *cx, PropertyName *name)
 {
     return nativeLookup(cx, NameToId(name));
 }
 
 inline bool
 js::ObjectImpl::nativeContains(JSContext *cx, jsid id)
 {
--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -191,18 +191,18 @@ js::ObjectImpl::checkShapeConsistency()
         if (throttle < 0)
             throttle = 0;
     }
     if (throttle == 0)
         return;
 
     MOZ_ASSERT(isNative());
 
-    RawShape shape = lastProperty();
-    RawShape prev = NULL;
+    Shape *shape = lastProperty();
+    Shape *prev = NULL;
 
     if (inDictionaryMode()) {
         MOZ_ASSERT(shape->hasTable());
 
         ShapeTable &table = shape->table();
         for (uint32_t fslot = table.freelist; fslot != SHAPE_INVALID_SLOT;
              fslot = getSlot(fslot).toPrivateUint32()) {
             MOZ_ASSERT(fslot < slotSpan());
@@ -289,17 +289,17 @@ js::ObjectImpl::slotInRange(uint32_t slo
 #if defined(_MSC_VER) && _MSC_VER >= 1500
 /*
  * Work around a compiler bug in MSVC9 and above, where inlining this function
  * causes stack pointer offsets to go awry and spp to refer to something higher
  * up the stack.
  */
 MOZ_NEVER_INLINE
 #endif
-RawShape
+Shape *
 js::ObjectImpl::nativeLookup(JSContext *cx, jsid id)
 {
     MOZ_ASSERT(isNative());
     Shape **spp;
     return Shape::search(cx, lastProperty(), id, &spp);
 }
 
 #if defined(_MSC_VER)
--- a/js/src/vm/ObjectImpl.h
+++ b/js/src/vm/ObjectImpl.h
@@ -20,17 +20,17 @@
 #include "vm/NumericConversions.h"
 #include "vm/String.h"
 
 namespace js {
 
 class Debugger;
 class ObjectImpl;
 class Nursery;
-ForwardDeclare(Shape);
+class Shape;
 
 class AutoPropDescArrayRooter;
 
 static inline PropertyOp
 CastAsPropertyOp(JSObject *object)
 {
     return JS_DATA_TO_FUNC_PTR(PropertyOp, object);
 }
@@ -359,17 +359,17 @@ class ElementsHeader
     union {
         class {
             friend class DenseElementsHeader;
             uint32_t initializedLength;
             uint32_t capacity;
         } dense;
         class {
             friend class SparseElementsHeader;
-            RawShape shape;
+            Shape *shape;
         } sparse;
         class {
             friend class ArrayBufferElementsHeader;
             JSObject * views;
         } buffer;
     };
 
     void staticAsserts() {
@@ -450,17 +450,17 @@ class DenseElementsHeader : public Eleme
 
     DenseElementsHeader(const DenseElementsHeader &other) MOZ_DELETE;
     void operator=(const DenseElementsHeader &other) MOZ_DELETE;
 };
 
 class SparseElementsHeader : public ElementsHeader
 {
   public:
-    RawShape shape() {
+    Shape *shape() {
         MOZ_ASSERT(ElementsHeader::isSparseElements());
         return sparse.shape;
     }
 
     uint32_t length() const {
         MOZ_ASSERT(ElementsHeader::isSparseElements());
         return ElementsHeader::length;
     }
@@ -1312,19 +1312,19 @@ class ObjectImpl : public gc::Cell
      */
     bool hasLazyType() const { return type_->lazy(); }
 
     inline uint32_t slotSpan() const;
 
     /* Compute dynamicSlotsCount() for this object. */
     inline uint32_t numDynamicSlots() const;
 
-    RawShape nativeLookup(JSContext *cx, jsid id);
-    inline RawShape nativeLookup(JSContext *cx, PropertyId pid);
-    inline RawShape nativeLookup(JSContext *cx, PropertyName *name);
+    Shape *nativeLookup(JSContext *cx, jsid id);
+    inline Shape *nativeLookup(JSContext *cx, PropertyId pid);
+    inline Shape *nativeLookup(JSContext *cx, PropertyName *name);
 
     inline bool nativeContains(JSContext *cx, jsid id);
     inline bool nativeContains(JSContext *cx, PropertyName* name);
     inline bool nativeContains(JSContext *cx, Shape* shape);
 
     /*
      * Contextless; can be called from parallel code. Returns false if the
      * operation would have been effectful.
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -260,17 +260,17 @@ RegExpObject::createShared(JSContext *cx
     JS_ASSERT(!maybeShared());
     if (!cx->compartment->regExps.get(cx, getSource(), getFlags(), g))
         return false;
 
     self->setShared(cx, **g);
     return true;
 }
 
-RawShape
+Shape *
 RegExpObject::assignInitialShape(JSContext *cx)
 {
     JS_ASSERT(isRegExp());
     JS_ASSERT(nativeEmpty());
 
     JS_STATIC_ASSERT(LAST_INDEX_SLOT == 0);
     JS_STATIC_ASSERT(SOURCE_SLOT == LAST_INDEX_SLOT + 1);
     JS_STATIC_ASSERT(GLOBAL_FLAG_SLOT == SOURCE_SLOT + 1);
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -350,17 +350,17 @@ class RegExpObject : public JSObject
   private:
     friend class RegExpObjectBuilder;
 
     /*
      * Compute the initial shape to associate with fresh RegExp objects,
      * encoding their initial properties. Return the shape after
      * changing this regular expression object's last property to it.
      */
-    RawShape assignInitialShape(JSContext *cx);
+    Shape *assignInitialShape(JSContext *cx);
 
     bool init(JSContext *cx, HandleAtom source, RegExpFlag flags);
 
     /*
      * Precondition: the syntax for |source| has already been validated.
      * Side effect: sets the private field.
      */
     bool createShared(JSContext *cx, RegExpGuard *g);
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -58,17 +58,17 @@ StaticScopeIter::operator++(int)
 bool
 StaticScopeIter::hasDynamicScopeObject() const
 {
     return obj->isStaticBlock()
            ? obj->asStaticBlock().needsClone()
            : obj->toFunction()->isHeavyweight();
 }
 
-RawShape
+Shape *
 StaticScopeIter::scopeShape() const
 {
     JS_ASSERT(hasDynamicScopeObject());
     JS_ASSERT(type() != NAMED_LAMBDA);
     return type() == BLOCK
            ? block().lastProperty()
            : funScript()->bindings.callObjShape();
 }
@@ -92,17 +92,17 @@ RawScript
 StaticScopeIter::funScript() const
 {
     JS_ASSERT(type() == FUNCTION);
     return obj->toFunction()->nonLazyScript();
 }
 
 /*****************************************************************************/
 
-RawShape
+Shape *
 js::ScopeCoordinateToStaticScopeShape(JSContext *cx, JSScript *script, jsbytecode *pc)
 {
     JS_ASSERT(pc >= script->code && pc < script->code + script->length);
     JS_ASSERT(JOF_OPTYPE(*pc) == JOF_SCOPECOORD);
 
     uint32_t blockIndex = GET_UINT32_INDEX(pc + 2 * sizeof(uint16_t));
     RootedObject innermostStaticScope(cx, NULL);
     if (blockIndex == UINT32_MAX)
@@ -677,17 +677,17 @@ StaticBlockObject::create(JSContext *cx)
 
     JSObject *obj = JSObject::create(cx, FINALIZE_KIND, gc::TenuredHeap, emptyBlockShape, type);
     if (!obj)
         return NULL;
 
     return &obj->asStaticBlock();
 }
 
-/* static */ RawShape
+/* static */ Shape *
 StaticBlockObject::addVar(JSContext *cx, Handle<StaticBlockObject*> block, HandleId id,
                           int index, bool *redeclared)
 {
     JS_ASSERT(JSID_IS_ATOM(id) || (JSID_IS_INT(id) && JSID_TO_INT(id) == index));
 
     *redeclared = false;
 
     /* Inline JSObject::addProperty in order to trap the redefinition case. */
@@ -1218,17 +1218,17 @@ class DebugScopeProxy : public BaseProxy
             }
 
             return true;
         }
 
         /* Handle unaliased let and catch bindings at block scope. */
         if (scope->isClonedBlock()) {
             Rooted<ClonedBlockObject *> block(cx, &scope->asClonedBlock());
-            RawShape shape = block->lastProperty()->search(cx, id);
+            Shape *shape = block->lastProperty()->search(cx, id);
             if (!shape)
                 return false;
 
             unsigned i = shape->shortid();
             if (block->staticBlock().isAliased(i))
                 return false;
 
             if (maybeframe) {
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -61,17 +61,17 @@ class StaticScopeIter
   public:
     explicit StaticScopeIter(JSContext *cx, HandleObject obj);
 
     bool done() const;
     void operator++(int);
 
     /* Return whether this static scope will be on the dynamic scope chain. */
     bool hasDynamicScopeObject() const;
-    RawShape scopeShape() const;
+    Shape *scopeShape() const;
 
     enum Type { BLOCK, FUNCTION, NAMED_LAMBDA };
     Type type() const;
 
     StaticBlockObject &block() const;
     RawScript funScript() const;
 };
 
@@ -94,17 +94,17 @@ struct ScopeCoordinate
     inline ScopeCoordinate(jsbytecode *pc);
     inline ScopeCoordinate() {}
 };
 
 /*
  * Return a shape representing the static scope containing the variable
  * accessed by the ALIASEDVAR op at 'pc'.
  */
-extern RawShape
+extern Shape *
 ScopeCoordinateToStaticScopeShape(JSContext *cx, JSScript *script, jsbytecode *pc);
 
 /* Return the name being accessed by the given ALIASEDVAR op. */
 extern PropertyName *
 ScopeCoordinateName(JSContext *cx, JSScript *script, jsbytecode *pc);
 
 /*****************************************************************************/
 
@@ -342,17 +342,17 @@ class StaticBlockObject : public BlockOb
      * The parser uses 'enclosingBlock' as the prev-link in the pc->blockChain
      * stack. Note: in the case of hoisting, this prev-link will not ultimately
      * be the same as enclosingBlock, initEnclosingStaticScope must be called
      * separately in the emitter. 'reset' is just for asserting stackiness.
      */
     void initPrevBlockChainFromParser(StaticBlockObject *prev);
     void resetPrevBlockChainFromParser();
 
-    static RawShape addVar(JSContext *cx, Handle<StaticBlockObject*> block, HandleId id,
+    static Shape *addVar(JSContext *cx, Handle<StaticBlockObject*> block, HandleId id,
                            int index, bool *redeclared);
 };
 
 class ClonedBlockObject : public BlockObject
 {
   public:
     static ClonedBlockObject *create(JSContext *cx, Handle<StaticBlockObject *> block,
                                      AbstractFramePtr frame);
--- a/js/src/vm/Shape-inl.h
+++ b/js/src/vm/Shape-inl.h
@@ -126,17 +126,17 @@ BaseShape::operator=(const BaseShape &ot
 
 inline bool
 BaseShape::matchesGetterSetter(PropertyOp rawGetter, StrictPropertyOp rawSetter) const
 {
     return rawGetter == this->rawGetter && rawSetter == this->rawSetter;
 }
 
 inline
-StackBaseShape::StackBaseShape(RawShape shape)
+StackBaseShape::StackBaseShape(Shape *shape)
   : flags(shape->getObjectFlags()),
     clasp(shape->getObjectClass()),
     parent(shape->getObjectParent()),
     compartment(shape->compartment())
 {
     updateGetterSetter(shape->attrs, shape->getter(), shape->setter());
 }
 
@@ -239,17 +239,17 @@ StackShape::hash() const
     hash = JS_ROTATE_LEFT32(hash, 4) ^ attrs;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ shortid;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ slot_;
     hash = JS_ROTATE_LEFT32(hash, 4) ^ JSID_BITS(propid);
     return hash;
 }
 
 inline bool
-Shape::matches(const RawShape other) const
+Shape::matches(const Shape *other) const
 {
     return propid_.get() == other->propid_.get() &&
            matchesParamsAfterId(other->base(), other->maybeSlot(), other->attrs,
                                 other->flags, other->shortid_);
 }
 
 inline bool
 Shape::matches(const StackShape &other) const
@@ -334,17 +334,17 @@ Shape::set(JSContext* cx, HandleObject o
         RootedObject nobj(cx, &obj->asWith().object());
         return CallJSPropertyOpSetter(cx, self->setterOp(), nobj, id, strict, vp);
     }
 
     return CallJSPropertyOpSetter(cx, self->setterOp(), obj, id, strict, vp);
 }
 
 inline void
-Shape::setParent(RawShape p)
+Shape::setParent(Shape *p)
 {
     JS_ASSERT_IF(p && !p->hasMissingSlot() && !inDictionary(),
                  p->maybeSlot() <= maybeSlot());
     JS_ASSERT_IF(p && !inDictionary(),
                  hasSlot() == (p->maybeSlot() != maybeSlot()));
     parent = p;
 }
 
@@ -400,43 +400,43 @@ EmptyShape::EmptyShape(UnownedBaseShape 
   : js::Shape(base, nfixed)
 {
     /* Only empty shapes can be NON_NATIVE. */
     if (!getObjectClass()->isNative())
         flags |= NON_NATIVE;
 }
 
 inline void
-Shape::writeBarrierPre(RawShape shape)
+Shape::writeBarrierPre(Shape *shape)
 {
 #ifdef JSGC_INCREMENTAL
     if (!shape || !shape->runtime()->needsBarrier())
         return;
 
     JS::Zone *zone = shape->zone();
     if (zone->needsBarrier()) {
-        RawShape tmp = shape;
+        Shape *tmp = shape;
         MarkShapeUnbarriered(zone->barrierTracer(), &tmp, "write barrier");
         JS_ASSERT(tmp == shape);
     }
 #endif
 }
 
 inline void
-Shape::writeBarrierPost(RawShape shape, void *addr)
+Shape::writeBarrierPost(Shape *shape, void *addr)
 {
 }
 
 inline void
-Shape::readBarrier(RawShape shape)
+Shape::readBarrier(Shape *shape)
 {
 #ifdef JSGC_INCREMENTAL
     JS::Zone *zone = shape->zone();
     if (zone->needsBarrier()) {
-        RawShape tmp = shape;
+        Shape *tmp = shape;
         MarkShapeUnbarriered(zone->barrierTracer(), &tmp, "read barrier");
         JS_ASSERT(tmp == shape);
     }
 #endif
 }
 
 inline void
 Shape::markChildren(JSTracer *trc)
--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@@ -36,17 +36,17 @@
 
 using namespace js;
 using namespace js::gc;
 
 using mozilla::DebugOnly;
 using mozilla::PodZero;
 
 bool
-ShapeTable::init(JSRuntime *rt, RawShape lastProp)
+ShapeTable::init(JSRuntime *rt, Shape *lastProp)
 {
     /*
      * Either we're creating a table for a large scope that was populated
      * via property cache hit logic under JSOP_INITPROP, JSOP_SETNAME, or
      * JSOP_SETPROP; or else calloc failed at least once already. In any
      * event, let's try to grow, overallocating to hold at least twice the
      * current population.
      */
@@ -91,17 +91,17 @@ Shape::makeOwnBaseShape(JSContext *cx)
     nbase->setOwned(base()->toUnowned());
 
     this->base_ = nbase;
 
     return true;
 }
 
 void
-Shape::handoffTableTo(RawShape shape)
+Shape::handoffTableTo(Shape *shape)
 {
     JS_ASSERT(inDictionary() && shape->inDictionary());
 
     if (this == shape)
         return;
 
     JS_ASSERT(base()->isOwned() && !shape->base()->isOwned());
 
@@ -270,30 +270,30 @@ ShapeTable::grow(JSContext *cx)
 
     if (!change(delta, cx) && entryCount + removedCount == size - 1) {
         JS_ReportOutOfMemory(cx);
         return false;
     }
     return true;
 }
 
-RawShape
+Shape *
 Shape::getChildBinding(JSContext *cx, const StackShape &child)
 {
     JS_ASSERT(!inDictionary());
 
     /* Try to allocate all slots inline. */
     uint32_t slots = child.slotSpan();
     gc::AllocKind kind = gc::GetGCObjectKind(slots);
     uint32_t nfixed = gc::GetGCKindSlots(kind);
 
     return cx->propertyTree().getChild(cx, this, nfixed, child);
 }
 
-/* static */ RawShape
+/* static */ Shape *
 Shape::replaceLastProperty(JSContext *cx, const StackBaseShape &base,
                            TaggedProto proto, HandleShape shape)
 {
     JS_ASSERT(!shape->inDictionary());
 
     if (!shape->parent) {
         /* Treat as resetting the initial property of the shape hierarchy. */
         AllocKind kind = gc::GetGCObjectKind(shape->numFixedSlots());
@@ -315,17 +315,17 @@ Shape::replaceLastProperty(JSContext *cx
     return cx->propertyTree().getChild(cx, shape->parent, shape->numFixedSlots(), child);
 }
 
 /*
  * Get or create a property-tree or dictionary child property of |parent|,
  * which must be lastProperty() if inDictionaryMode(), else parent must be
  * one of lastProperty() or lastProperty()->parent.
  */
-/* static */ RawShape
+/* static */ Shape *
 JSObject::getChildProperty(JSContext *cx, HandleObject obj, HandleShape parent, StackShape &child)
 {
     /*
      * Shared properties have no slot, but slot_ will reflect that of parent.
      * Unshared properties allocate a slot here but may lose it due to a
      * JS_ClearScope call.
      */
     if (!child.hasSlot()) {
@@ -390,17 +390,17 @@ js::ObjectImpl::toDictionaryMode(JSConte
      */
     RootedShape root(cx);
     RootedShape dictionaryShape(cx);
 
     RootedShape shape(cx, lastProperty());
     while (shape) {
         JS_ASSERT(!shape->inDictionary());
 
-        RawShape dprop = js_NewGCShape(cx);
+        Shape *dprop = js_NewGCShape(cx);
         if (!dprop) {
             js_ReportOutOfMemory(cx);
             return false;
         }
 
         HeapPtrShape *listp = dictionaryShape
                               ? &dictionaryShape->parent
                               : (HeapPtrShape *) root.address();
@@ -445,17 +445,17 @@ NormalizeGetterAndSetter(JSObject *obj,
     if (getter == JS_PropertyStub) {
         JS_ASSERT(!(attrs & JSPROP_GETTER));
         getter = NULL;
     }
 
     return true;
 }
 
-/* static */ RawShape
+/* static */ Shape *
 JSObject::addProperty(JSContext *cx, HandleObject obj, HandleId id,
                       PropertyOp getter, StrictPropertyOp setter,
                       uint32_t slot, unsigned attrs,
                       unsigned flags, int shortid, bool allowDictionary)
 {
     JS_ASSERT(!JSID_IS_VOID(id));
 
     if (!obj->isExtensible()) {
@@ -468,17 +468,17 @@ JSObject::addProperty(JSContext *cx, Han
     Shape **spp = NULL;
     if (obj->inDictionaryMode())
         spp = obj->lastProperty()->table().search(id, true);
 
     return addPropertyInternal(cx, obj, id, getter, setter, slot, attrs, flags, shortid,
                                spp, allowDictionary);
 }
 
-/* static */ RawShape
+/* static */ Shape *
 JSObject::addPropertyInternal(JSContext *cx, HandleObject obj, HandleId id,
                               PropertyOp getter, StrictPropertyOp setter,
                               uint32_t slot, unsigned attrs,
                               unsigned flags, int shortid, Shape **spp,
                               bool allowDictionary)
 {
     JS_ASSERT_IF(!allowDictionary, !obj->inDictionaryMode());
 
@@ -535,17 +535,17 @@ JSObject::addPropertyInternal(JSContext 
         shape = getChildProperty(cx, obj, last, child);
     }
 
     if (shape) {
         JS_ASSERT(shape == obj->lastProperty());
 
         if (table) {
             /* Store the tree node pointer in the table entry for id. */
-            SHAPE_STORE_PRESERVING_COLLISION(spp, static_cast<RawShape>(shape));
+            SHAPE_STORE_PRESERVING_COLLISION(spp, static_cast<Shape *>(shape));
             ++table->entryCount;
 
             /* Pass the table along to the new last property, namely shape. */
             JS_ASSERT(&shape->parent->table() == table);
             shape->parent->handoffTableTo(shape);
         }
 
         obj->checkShapeConsistency();
@@ -575,17 +575,17 @@ CheckCanChangeAttrs(JSContext *cx, JSObj
         (*attrsp & (JSPROP_GETTER | JSPROP_SETTER | JSPROP_SHARED))) {
         obj->reportNotConfigurable(cx, shape->propid());
         return false;
     }
 
     return true;
 }
 
-/* static */ RawShape
+/* static */ Shape *
 JSObject::putProperty(JSContext *cx, HandleObject obj, HandleId id,
                       PropertyOp getter, StrictPropertyOp setter,
                       uint32_t slot, unsigned attrs,
                       unsigned flags, int shortid)
 {
     JS_ASSERT(!JSID_IS_VOID(id));
 
 #ifdef DEBUG
@@ -707,17 +707,17 @@ JSObject::putProperty(JSContext *cx, Han
         if (!nbase)
             return NULL;
 
         JS_ASSERT(shape == obj->lastProperty());
 
         /* Find or create a property tree node labeled by our arguments. */
         StackShape child(nbase, id, slot, obj->numFixedSlots(), attrs, flags, shortid);
         RootedShape parent(cx, shape->parent);
-        RawShape newShape = JSObject::getChildProperty(cx, obj, parent, child);
+        Shape *newShape = JSObject::getChildProperty(cx, obj, parent, child);
 
         if (!newShape) {
             obj->checkShapeConsistency();
             return NULL;
         }
 
         shape = newShape;
     }
@@ -734,17 +734,17 @@ JSObject::putProperty(JSContext *cx, Han
         ++cx->runtime->propertyRemovals;
     }
 
     obj->checkShapeConsistency();
 
     return shape;
 }
 
-/* static */ RawShape
+/* static */ Shape *
 JSObject::changeProperty(JSContext *cx, HandleObject obj, HandleShape shape, unsigned attrs,
                          unsigned mask, PropertyOp getter, StrictPropertyOp setter)
 {
     JS_ASSERT(obj->nativeContains(cx, shape));
 
     attrs |= shape->attrs & mask;
 
     /* Allow only shared (slotless) => unshared (slotful) transition. */
@@ -768,17 +768,17 @@ JSObject::changeProperty(JSContext *cx, 
 
     /*
      * Let JSObject::putProperty handle this |overwriting| case, including
      * the conservation of shape->slot (if it's valid). We must not call
      * removeProperty because it will free an allocated shape->slot, and
      * putProperty won't re-allocate it.
      */
     RootedId propid(cx, shape->propid());
-    RawShape newShape = putProperty(cx, obj, propid, getter, setter, shape->maybeSlot(),
+    Shape *newShape = putProperty(cx, obj, propid, getter, setter, shape->maybeSlot(),
                                     attrs, shape->flags, shape->maybeShortid());
 
     obj->checkShapeConsistency();
     return newShape;
 }
 
 bool
 JSObject::removeProperty(JSContext *cx, jsid id_)
@@ -855,25 +855,25 @@ JSObject::removeProperty(JSContext *cx, 
             --table.entryCount;
 
 #ifdef DEBUG
             /*
              * Check the consistency of the table but limit the number of
              * checks not to alter significantly the complexity of the
              * delete in debug builds, see bug 534493.
              */
-            RawShape aprop = self->lastProperty();
+            Shape *aprop = self->lastProperty();
             for (int n = 50; --n >= 0 && aprop->parent; aprop = aprop->parent)
                 JS_ASSERT_IF(aprop != shape, self->nativeContains(cx, aprop));
 #endif
         }
 
         {
             /* Remove shape from its non-circular doubly linked list. */
-            RawShape oldLastProp = self->lastProperty();
+            Shape *oldLastProp = self->lastProperty();
             shape->removeFromDictionary(self);
 
             /* Hand off table from the old to new last property. */
             oldLastProp->handoffTableTo(self->lastProperty());
         }
 
         /* Generate a new shape for the object, infallibly. */
         JS_ALWAYS_TRUE(self->generateOwnShape(cx, spare));
@@ -1011,25 +1011,25 @@ JSObject::setParent(JSContext *cx, Handl
         UnownedBaseShape *nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
             return false;
 
         obj->lastProperty()->base()->adoptUnowned(nbase);
         return true;
     }
 
-    RawShape newShape = Shape::setObjectParent(cx, parent, obj->getTaggedProto(), obj->shape_);
+    Shape *newShape = Shape::setObjectParent(cx, parent, obj->getTaggedProto(), obj->shape_);
     if (!newShape)
         return false;
 
     obj->shape_ = newShape;
     return true;
 }
 
-/* static */ RawShape
+/* static */ Shape *
 Shape::setObjectParent(JSContext *cx, JSObject *parent, TaggedProto proto, Shape *last)
 {
     if (last->getObjectParent() == parent)
         return last;
 
     StackBaseShape base(last);
     base.parent = parent;
 
@@ -1090,17 +1090,17 @@ js::ObjectImpl::setFlag(JSContext *cx, /
         UnownedBaseShape *nbase = BaseShape::getUnowned(cx, base);
         if (!nbase)
             return false;
 
         self->lastProperty()->base()->adoptUnowned(nbase);
         return true;
     }
 
-    RawShape newShape =
+    Shape *newShape =
         Shape::setObjectFlag(cx, flag, self->getTaggedProto(), self->lastProperty());
     if (!newShape)
         return false;
 
     self->shape_ = newShape;
     return true;
 }
 
@@ -1117,17 +1117,17 @@ js::ObjectImpl::clearFlag(JSContext *cx,
     UnownedBaseShape *nbase = BaseShape::getUnowned(cx, base);
     if (!nbase)
         return false;
 
     self->lastProperty()->base()->adoptUnowned(nbase);
     return true;
 }
 
-/* static */ RawShape
+/* static */ Shape *
 Shape::setObjectFlag(JSContext *cx, BaseShape::Flag flag, TaggedProto proto, Shape *last)
 {
     if (last->getObjectFlags() & flag)
         return last;
 
     StackBaseShape base(last);
     base.flags |= flag;
 
@@ -1268,17 +1268,17 @@ EmptyShape::getInitialShape(JSContext *c
     Rooted<TaggedProto> protoRoot(cx, lookup.proto);
     RootedObject parentRoot(cx, lookup.parent);
 
     StackBaseShape base(cx->compartment, clasp, parent, objectFlags);
     Rooted<UnownedBaseShape*> nbase(cx, BaseShape::getUnowned(cx, base));
     if (!nbase)
         return NULL;
 
-    RawShape shape = cx->propertyTree().newShape(cx);
+    Shape *shape = cx->propertyTree().newShape(cx);
     if (!shape)
         return NULL;
     new (shape) EmptyShape(nbase, nfixed);
 
     lookup.proto = protoRoot;
     lookup.parent = parentRoot;
 
     if (!table.relookupOrAdd(p, lookup, InitialShapeEntry(shape, lookup.proto)))
@@ -1325,17 +1325,17 @@ EmptyShape::insertInitialShape(JSContext
     InitialShapeSet::Ptr p = cx->compartment->initialShapes.lookup(lookup);
     JS_ASSERT(p);
 
     InitialShapeEntry &entry = const_cast<InitialShapeEntry &>(*p);
     JS_ASSERT(entry.shape->isEmptyShape());
 
     /* The new shape had better be rooted at the old one. */
 #ifdef DEBUG
-    RawShape nshape = shape;
+    Shape *nshape = shape;
     while (!nshape->isEmptyShape())
         nshape = nshape->previous();
     JS_ASSERT(nshape == entry.shape);
 #endif
 
     entry.shape = shape.get();
 
     /*
@@ -1376,17 +1376,17 @@ JSCompartment::markAllInitialShapeTableE
 void
 JSCompartment::sweepInitialShapeTable()
 {
     gcstats::AutoPhase ap(rt->gcStats, gcstats::PHASE_SWEEP_TABLES_INITIAL_SHAPE);
 
     if (initialShapes.initialized()) {
         for (InitialShapeSet::Enum e(initialShapes); !e.empty(); e.popFront()) {
             const InitialShapeEntry &entry = e.front();
-            RawShape shape = entry.shape;
+            Shape *shape = entry.shape;
             JSObject *proto = entry.proto.raw();
             if (IsShapeAboutToBeFinalized(&shape) || (entry.proto.isObject() && IsObjectAboutToBeFinalized(&proto))) {
                 e.removeFront();
             } else {
 #ifdef DEBUG
                 DebugOnly<JSObject *> parent = shape->getObjectParent();
                 JS_ASSERT(!parent || !IsObjectAboutToBeFinalized(&parent));
                 JS_ASSERT(parent == shape->getObjectParent());
--- a/js/src/vm/Shape.h
+++ b/js/src/vm/Shape.h
@@ -132,17 +132,17 @@ struct ShapeTable {
     ~ShapeTable() {
         js_free(entries);
     }
 
     /* By definition, hashShift = HASH_BITS - log2(capacity). */
     uint32_t capacity() const { return JS_BIT(HASH_BITS - hashShift); }
 
     /* Computes the size of the entries array for a given capacity. */
-    static size_t sizeOfEntries(size_t cap) { return cap * sizeof(RawShape); }
+    static size_t sizeOfEntries(size_t cap) { return cap * sizeof(Shape *); }
 
     /*
      * This counts the ShapeTable object itself (which must be
      * heap-allocated) and its |entries| array.
      */
     size_t sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf) const {
         return mallocSizeOf(this) + mallocSizeOf(entries);
     }
@@ -160,17 +160,17 @@ struct ShapeTable {
      */
     bool grow(JSContext *cx);
 
     /*
      * NB: init and change are fallible but do not report OOM, so callers can
      * cope or ignore. They do however use JSRuntime's calloc_ method in order
      * to update the malloc counter on success.
      */
-    bool            init(JSRuntime *rt, RawShape lastProp);
+    bool            init(JSRuntime *rt, Shape *lastProp);
     bool            change(int log2Delta, JSContext *cx);
     Shape           **search(jsid id, bool adding);
 };
 
 /*
  * Reuse the API-only JSPROP_INDEX attribute to mean shadowability.
  */
 #define JSPROP_SHADOWABLE       JSPROP_INDEX
@@ -218,18 +218,18 @@ struct ShapeTable {
  * may change when the object has an established property lineage. On such
  * changes the entire property lineage is not updated, but rather only the
  * last property (and its base shape). This works because only the object's
  * last property is used to query information about the object. Care must be
  * taken to call JSObject::canRemoveLastProperty when unwinding an object to
  * an earlier property, however.
  */
 
+class Shape;
 class UnownedBaseShape;
-ForwardDeclare(Shape);
 struct StackBaseShape;
 
 class BaseShape : public js::gc::Cell
 {
   public:
     friend class Shape;
     friend struct StackBaseShape;
     friend struct StackShape;
@@ -412,17 +412,17 @@ struct StackBaseShape
       : flags(objectFlags),
         clasp(clasp),
         parent(parent),
         rawGetter(NULL),
         rawSetter(NULL),
         compartment(comp)
     {}
 
-    inline StackBaseShape(RawShape shape);
+    inline StackBaseShape(Shape *shape);
 
     inline void updateGetterSetter(uint8_t attrs,
                                    PropertyOp rawGetter,
                                    StrictPropertyOp rawSetter);
 
     static inline HashNumber hash(const StackBaseShape *lookup);
     static inline bool match(UnownedBaseShape *key, const StackBaseShape *lookup);
 
@@ -509,36 +509,36 @@ class Shape : public js::gc::Cell
         KidsPointer kids;       /* null, single child, or a tagged ptr
                                    to many-kids data structure */
         HeapPtrShape *listp;    /* dictionary list starting at shape_
                                    has a double-indirect back pointer,
                                    either to the next shape's parent if not
                                    last, else to obj->shape_ */
     };
 
-    static inline RawShape search(JSContext *cx, Shape *start, jsid id,
+    static inline Shape *search(JSContext *cx, Shape *start, jsid id,
                                   Shape ***pspp, bool adding = false);
     static inline Shape *searchNoHashify(Shape *start, jsid id);
 
     inline void removeFromDictionary(ObjectImpl *obj);
     inline void insertIntoDictionary(HeapPtrShape *dictp);
 
     inline void initDictionaryShape(const StackShape &child, uint32_t nfixed,
                                     HeapPtrShape *dictp);
 
-    RawShape getChildBinding(JSContext *cx, const StackShape &child);
+    Shape *getChildBinding(JSContext *cx, const StackShape &child);
 
     /* Replace the base shape of the last shape in a non-dictionary lineage with base. */
-    static RawShape replaceLastProperty(JSContext *cx, const StackBaseShape &base,
+    static Shape *replaceLastProperty(JSContext *cx, const StackBaseShape &base,
                                         TaggedProto proto, HandleShape shape);
 
     static bool hashify(JSContext *cx, Shape *shape);
-    void handoffTableTo(RawShape newShape);
+    void handoffTableTo(Shape *newShape);
 
-    inline void setParent(RawShape p);
+    inline void setParent(Shape *p);
 
     bool ensureOwnBaseShape(JSContext *cx) {
         if (base()->isOwned())
             return true;
         return makeOwnBaseShape(cx);
     }
 
     bool makeOwnBaseShape(JSContext *cx);
@@ -592,18 +592,18 @@ class Shape : public js::gc::Cell
             JS_ASSERT(!empty());
             cursor = cursor->parent;
         }
     };
 
     Class *getObjectClass() const { return base()->clasp; }
     JSObject *getObjectParent() const { return base()->parent; }
 
-    static RawShape setObjectParent(JSContext *cx, JSObject *obj, TaggedProto proto, Shape *last);
-    static RawShape setObjectFlag(JSContext *cx, BaseShape::Flag flag, TaggedProto proto, Shape *last);
+    static Shape *setObjectParent(JSContext *cx, JSObject *obj, TaggedProto proto, Shape *last);
+    static Shape *setObjectFlag(JSContext *cx, BaseShape::Flag flag, TaggedProto proto, Shape *last);
 
     uint32_t getObjectFlags() const { return base()->getObjectFlags(); }
     bool hasObjectFlag(BaseShape::Flag flag) const {
         JS_ASSERT(!(flag & ~BaseShape::OBJECT_FLAG_MASK));
         return !!(base()->flags & flag);
     }
 
   protected:
@@ -681,17 +681,17 @@ class Shape : public js::gc::Cell
     Value setterOrUndefined() const {
         return (hasSetterValue() && base()->setterObj)
                ? ObjectValue(*base()->setterObj)
                : UndefinedValue();
     }
 
     void update(PropertyOp getter, StrictPropertyOp setter, uint8_t attrs);
 
-    inline bool matches(const RawShape other) const;
+    inline bool matches(const Shape *other) const;
     inline bool matches(const StackShape &other) const;
     inline bool matchesParamsAfterId(BaseShape *base,
                                      uint32_t aslot, unsigned aattrs, unsigned aflags,
                                      int ashortid) const;
 
     bool get(JSContext* cx, HandleObject receiver, JSObject *obj, JSObject *pobj, MutableHandleValue vp);
     bool set(JSContext* cx, HandleObject obj, HandleObject receiver, bool strict, MutableHandleValue vp);
 
@@ -792,61 +792,61 @@ class Shape : public js::gc::Cell
         JS_ASSERT_IF(isDataDescriptor(), writable());
         return hasSlot() || (attrs & JSPROP_SHADOWABLE);
     }
 
     uint32_t entryCount() {
         if (hasTable())
             return table().entryCount;
 
-        RawShape shape = this;
+        Shape *shape = this;
         uint32_t count = 0;
         for (Shape::Range<NoGC> r(shape); !r.empty(); r.popFront())
             ++count;
         return count;
     }
 
     bool isBigEnoughForAShapeTable() {
         JS_ASSERT(!hasTable());
-        RawShape shape = this;
+        Shape *shape = this;
         uint32_t count = 0;
         for (Shape::Range<NoGC> r(shape); !r.empty(); r.popFront()) {
             ++count;
             if (count >= ShapeTable::MIN_ENTRIES)
                 return true;
         }
         return false;
     }
 
 #ifdef DEBUG
     void dump(JSContext *cx, FILE *fp) const;
     void dumpSubtree(JSContext *cx, int level, FILE *fp) const;
 #endif
 
     void sweep();
     void finalize(FreeOp *fop);
-    void removeChild(RawShape child);
+    void removeChild(Shape *child);
 
     JS::Zone *zone() const { return tenuredZone(); }
 
-    static inline void writeBarrierPre(RawShape shape);
-    static inline void writeBarrierPost(RawShape shape, void *addr);
+    static inline void writeBarrierPre(Shape *shape);
+    static inline void writeBarrierPost(Shape *shape, void *addr);
 
     /*
      * All weak references need a read barrier for incremental GC. This getter
      * method implements the read barrier. It's used to obtain initial shapes
      * from the compartment.
      */
-    static inline void readBarrier(RawShape shape);
+    static inline void readBarrier(Shape *shape);
 
     static inline ThingRootKind rootKind() { return THING_ROOT_SHAPE; }
 
     inline void markChildren(JSTracer *trc);
 
-    inline RawShape search(JSContext *cx, jsid id) {
+    inline Shape *search(JSContext *cx, jsid id) {
         Shape **_;
         return search(cx, this, id, &_);
     }
 
     /* For JIT usage */
     static inline size_t offsetOfBase() { return offsetof(Shape, base_); }
 
   private:
@@ -985,17 +985,17 @@ struct StackShape
         flags(uint8_t(flags)),
         shortid(int16_t(shortid))
     {
         JS_ASSERT(base);
         JS_ASSERT(!JSID_IS_VOID(propid));
         JS_ASSERT(slot <= SHAPE_INVALID_SLOT);
     }
 
-    StackShape(const RawShape &shape)
+    StackShape(Shape *const &shape)
       : base(shape->base()->unowned()),
         propid(shape->propidRef()),
         slot_(shape->slotInfo & Shape::SLOT_MASK),
         attrs(shape->attrs),
         flags(shape->flags),
         shortid(shape->shortid_)
     {}
 
@@ -1035,36 +1035,36 @@ struct StackShape
         MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
     };
  };
 
 } /* namespace js */
 
 /* js::Shape pointer tag bit indicating a collision. */
 #define SHAPE_COLLISION                 (uintptr_t(1))
-#define SHAPE_REMOVED                   ((RawShape) SHAPE_COLLISION)
+#define SHAPE_REMOVED                   ((Shape *) SHAPE_COLLISION)
 
 /* Macros to get and set shape pointer values and collision flags. */
 #define SHAPE_IS_FREE(shape)            ((shape) == NULL)
 #define SHAPE_IS_REMOVED(shape)         ((shape) == SHAPE_REMOVED)
 #define SHAPE_IS_LIVE(shape)            ((shape) > SHAPE_REMOVED)
-#define SHAPE_FLAG_COLLISION(spp,shape) (*(spp) = (RawShape)                  \
+#define SHAPE_FLAG_COLLISION(spp,shape) (*(spp) = (Shape *)                  \
                                          (uintptr_t(shape) | SHAPE_COLLISION))
 #define SHAPE_HAD_COLLISION(shape)      (uintptr_t(shape) & SHAPE_COLLISION)
 #define SHAPE_FETCH(spp)                SHAPE_CLEAR_COLLISION(*(spp))
 
 #define SHAPE_CLEAR_COLLISION(shape)                                          \
-    ((RawShape) (uintptr_t(shape) & ~SHAPE_COLLISION))
+    ((Shape *) (uintptr_t(shape) & ~SHAPE_COLLISION))
 
 #define SHAPE_STORE_PRESERVING_COLLISION(spp, shape)                          \
-    (*(spp) = (RawShape) (uintptr_t(shape) | SHAPE_HAD_COLLISION(*(spp))))
+    (*(spp) = (Shape *) (uintptr_t(shape) | SHAPE_HAD_COLLISION(*(spp))))
 
 namespace js {
 
-inline RawShape
+inline Shape *
 Shape::search(JSContext *cx, Shape *start, jsid id, Shape ***pspp, bool adding)
 {
     if (start->inDictionary()) {
         *pspp = start->table().search(id, adding);
         return SHAPE_FETCH(*pspp);
     }
 
     *pspp = NULL;
@@ -1085,17 +1085,17 @@ Shape::search(JSContext *cx, Shape *star
          * No table built -- there weren't enough entries, or OOM occurred.
          * Don't increment numLinearSearches, to keep hasTable() false.
          */
         JS_ASSERT(!start->hasTable());
     } else {
         start->incrementNumLinearSearches();
     }
 
-    for (RawShape shape = start; shape; shape = shape->parent) {
+    for (Shape *shape = start; shape; shape = shape->parent) {
         if (shape->propidRef() == id)
             return shape;
     }
 
     return NULL;
 }
 
 /*
--- a/js/src/vm/StringObject.h
+++ b/js/src/vm/StringObject.h
@@ -54,14 +54,14 @@ class StringObject : public JSObject
     friend JSObject *
     ::js_InitStringClass(JSContext *cx, js::HandleObject global);
 
     /*
      * Compute the initial shape to associate with fresh String objects, which
      * encodes the initial length property. Return the shape after changing
      * this String object's last property to it.
      */
-    RawShape assignInitialShape(JSContext *cx);
+    Shape *assignInitialShape(JSContext *cx);
 };
 
 } // namespace js
 
 #endif /* StringObject_h__ */