Bug 1273220 - Rename RelocatablePtr to HeapPtr; r=sfink
authorTerrence Cole <terrence@mozilla.com>
Wed, 18 May 2016 12:18:05 -0700
changeset 337841 f18e46bce0a40e6b73435efb633c50a38fdb18e8
parent 337840 f95d305dc0f804dea500ea8910683668f8729c7e
child 337842 d98eab1b6a5ff57a2e47c9072cff8728295f2777
push id6249
push userjlund@mozilla.com
push dateMon, 01 Aug 2016 13:59:36 +0000
treeherdermozilla-beta@bad9d4f5bf7e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerssfink
bugs1273220
milestone49.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1273220 - Rename RelocatablePtr to HeapPtr; r=sfink
js/src/asmjs/WasmModule.h
js/src/builtin/MapObject.cpp
js/src/builtin/MapObject.h
js/src/builtin/ModuleObject.h
js/src/ctypes/CTypes.h
js/src/gc/Barrier.h
js/src/gc/Policy.h
js/src/gc/StoreBuffer.h
js/src/gc/Zone.h
js/src/gdb/tests/test-Root.cpp
js/src/jit/BaselineJIT.h
js/src/jit/JitFrameIterator.h
js/src/jit/JitFrames.cpp
js/src/jsapi-tests/testGCExactRooting.cpp
js/src/jsapi-tests/testGCStoreBufferRemoval.cpp
js/src/jsscript.h
js/src/jsweakmap.h
js/src/vm/Debugger.cpp
js/src/vm/Debugger.h
js/src/vm/DebuggerMemory.cpp
js/src/vm/RegExpObject.h
js/src/vm/RegExpStatics.h
js/src/vm/SavedStacks.h
js/src/vm/ScopeObject.h
js/src/vm/Stack.h
js/src/vm/TypeInference.h
js/src/vm/WeakMapPtr.cpp
--- a/js/src/asmjs/WasmModule.h
+++ b/js/src/asmjs/WasmModule.h
@@ -480,17 +480,17 @@ class Module : public mozilla::LinkedLis
         uint32_t numElems;
         explicit FuncPtrTable(const StaticLinkData::FuncPtrTable& table)
           : globalDataOffset(table.globalDataOffset),
             numElems(table.elemOffsets.length())
         {}
     };
     typedef Vector<FuncPtrTable, 0, SystemAllocPolicy> FuncPtrTableVector;
     typedef Vector<CacheableChars, 0, SystemAllocPolicy> FuncLabelVector;
-    typedef RelocatablePtrArrayBufferObjectMaybeShared BufferPtr;
+    typedef HeapPtr<ArrayBufferObjectMaybeShared*> BufferPtr;
     typedef GCPtr<WasmModuleObject*> ModuleObjectPtr;
 
     // Initialized when constructed:
     const UniqueConstModuleData  module_;
 
     // Initialized during staticallyLink:
     bool                         staticallyLinked_;
     uint8_t*                     interrupt_;
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@@ -433,17 +433,17 @@ MapObject::set(JSContext* cx, HandleObje
     ValueMap* map = obj->as<MapObject>().getData();
     if (!map)
         return false;
 
     Rooted<HashableValue> key(cx);
     if (!key.setValue(cx, k))
         return false;
 
-    RelocatableValue rval(v);
+    HeapPtr<Value> rval(v);
     if (!map->put(key, rval)) {
         ReportOutOfMemory(cx);
         return false;
     }
     WriteBarrierPost(cx->runtime(), map, key.value());
     return true;
 }
 
@@ -533,17 +533,17 @@ MapObject::construct(JSContext* cx, unsi
             RootedValue val(cx);
             if (!GetElement(cx, pairObj, pairObj, 1, &val))
                 return false;
 
             if (isOriginalAdder) {
                 if (!hkey.setValue(cx, key))
                     return false;
 
-                RelocatableValue rval(val);
+                HeapPtr<Value> rval(val);
                 if (!map->put(hkey, rval)) {
                     ReportOutOfMemory(cx);
                     return false;
                 }
                 WriteBarrierPost(cx->runtime(), map, key);
             } else {
                 if (!args2.init(2))
                     return false;
@@ -683,17 +683,17 @@ MapObject::has(JSContext* cx, unsigned a
 
 bool
 MapObject::set_impl(JSContext* cx, const CallArgs& args)
 {
     MOZ_ASSERT(MapObject::is(args.thisv()));
 
     ValueMap& map = extract(args);
     ARG0_KEY(cx, args, key);
-    RelocatableValue rval(args.get(1));
+    HeapPtr<Value> rval(args.get(1));
     if (!map.put(key, rval)) {
         ReportOutOfMemory(cx);
         return false;
     }
     WriteBarrierPost(cx->runtime(), &map, key.value());
     args.rval().set(args.thisv());
     return true;
 }
@@ -720,24 +720,24 @@ MapObject::delete_(JSContext *cx, Handle
     }
     return true;
 }
 
 bool
 MapObject::delete_impl(JSContext *cx, const CallArgs& args)
 {
     // MapObject::mark does not mark deleted entries. Incremental GC therefore
-    // requires that no RelocatableValue objects pointing to heap values be
-    // left alive in the ValueMap.
+    // requires that no HeapPtr<Value> objects pointing to heap values be left
+    // alive in the ValueMap.
     //
     // OrderedHashMap::remove() doesn't destroy the removed entry. It merely
     // calls OrderedHashMap::MapOps::makeEmpty. But that is sufficient, because
     // makeEmpty clears the value by doing e->value = Value(), and in the case
-    // of a ValueMap, Value() means RelocatableValue(), which is the same as
-    // RelocatableValue(UndefinedValue()).
+    // of a ValueMap, Value() means HeapPtr<Value>(), which is the same as
+    // HeapPtr<Value>(UndefinedValue()).
     MOZ_ASSERT(MapObject::is(args.thisv()));
 
     ValueMap& map = extract(args);
     ARG0_KEY(cx, args, key);
     bool found;
     if (!map.remove(key, &found)) {
         ReportOutOfMemory(cx);
         return false;
--- a/js/src/builtin/MapObject.h
+++ b/js/src/builtin/MapObject.h
@@ -61,17 +61,17 @@ class RootedBase<HashableValue> {
 
 template <class Key, class Value, class OrderedHashPolicy, class AllocPolicy>
 class OrderedHashMap;
 
 template <class T, class OrderedHashPolicy, class AllocPolicy>
 class OrderedHashSet;
 
 typedef OrderedHashMap<HashableValue,
-                       RelocatableValue,
+                       HeapPtr<Value>,
                        HashableValue::Hasher,
                        RuntimeAllocPolicy> ValueMap;
 
 typedef OrderedHashSet<HashableValue,
                        HashableValue::Hasher,
                        RuntimeAllocPolicy> ValueSet;
 
 class MapObject : public NativeObject {
--- a/js/src/builtin/ModuleObject.h
+++ b/js/src/builtin/ModuleObject.h
@@ -113,18 +113,18 @@ class IndirectBindingMap
         for (auto r = map_.all(); !r.empty(); r.popFront())
             func(r.front().key());
     }
 
   private:
     struct Binding
     {
         Binding(ModuleEnvironmentObject* environment, Shape* shape);
-        RelocatablePtr<ModuleEnvironmentObject*> environment;
-        RelocatablePtrShape shape;
+        HeapPtr<ModuleEnvironmentObject*> environment;
+        HeapPtr<Shape*> shape;
     };
 
     typedef HashMap<jsid, Binding, DefaultHasher<jsid>, ZoneAllocPolicy> Map;
 
     Map map_;
 };
 
 class ModuleNamespaceObject : public ProxyObject
@@ -189,18 +189,18 @@ class ModuleNamespaceObject : public Pro
 typedef Rooted<ModuleNamespaceObject*> RootedModuleNamespaceObject;
 typedef Handle<ModuleNamespaceObject*> HandleModuleNamespaceObject;
 
 struct FunctionDeclaration
 {
     FunctionDeclaration(HandleAtom name, HandleFunction fun);
     void trace(JSTracer* trc);
 
-    RelocatablePtrAtom name;
-    RelocatablePtrFunction fun;
+    HeapPtr<JSAtom*> name;
+    HeapPtr<JSFunction*> fun;
 };
 
 using FunctionDeclarationVector = GCVector<FunctionDeclaration, 0, ZoneAllocPolicy>;
 
 class ModuleObject : public NativeObject
 {
   public:
     enum
--- a/js/src/ctypes/CTypes.h
+++ b/js/src/ctypes/CTypes.h
@@ -276,18 +276,18 @@ struct FieldHashPolicy : DefaultHasher<J
 
     if (k->length() != l->length())
       return false;
 
     return EqualChars(k, l);
   }
 };
 
-using FieldInfoHash = GCHashMap<js::RelocatablePtr<JSFlatString*>,
-                                FieldInfo, FieldHashPolicy, SystemAllocPolicy>;
+using FieldInfoHash = GCHashMap<js::HeapPtr<JSFlatString*>, FieldInfo,
+                                FieldHashPolicy, SystemAllocPolicy>;
 
 // Descriptor of ABI, return type, argument types, and variadicity for a
 // FunctionType.
 struct FunctionInfo
 {
   // Initialized in NewFunctionInfo when !mIsVariadic, but only later, in
   // FunctionType::Call, when mIsVariadic. Not always consistent with
   // mFFITypes, due to lazy initialization when mIsVariadic.
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -136,17 +136,18 @@
  * BarrieredBase             base class of all barriers
  *  |  |
  *  | WriteBarrieredBase     base class which provides common write operations
  *  |  |  |  |  |
  *  |  |  |  | PreBarriered  provides pre-barriers only
  *  |  |  |  |
  *  |  |  | GCPtr            provides pre- and post-barriers
  *  |  |  |
- *  |  | RelocatablePtr      provides pre- and post-barriers and is relocatable
+ *  |  | HeapPtr             provides pre- and post-barriers; is relocatable
+ *  |  |                     and deletable for use inside C++ managed memory
  *  |  |
  *  | HeapSlot               similar to GCPtr, but tailored to slots storage
  *  |
  * ReadBarrieredBase         base class which provides common read operations
  *  |
  * ReadBarriered             provides read barriers only
  *
  *
@@ -156,17 +157,17 @@
  * WriteBarrieredBase<T>::pre
  *  -> InternalBarrierMethods<T*>::preBarrier
  *      -> T::writeBarrierPre
  *  -> InternalBarrierMethods<Value>::preBarrier
  *  -> InternalBarrierMethods<jsid>::preBarrier
  *      -> InternalBarrierMethods<T*>::preBarrier
  *          -> T::writeBarrierPre
  *
- * GCPtr<T>::post and RelocatablePtr<T>::post
+ * GCPtr<T>::post and HeapPtr<T>::post
  *  -> InternalBarrierMethods<T*>::postBarrier
  *      -> T::writeBarrierPost
  *  -> InternalBarrierMethods<Value>::postBarrier
  *      -> StoreBuffer::put
  *
  * These classes are designed to be used by the internals of the JS engine.
  * Barriers designed to be used externally are provided in js/RootingAPI.h.
  * These external barriers call into the same post-barrier implementations at
@@ -364,28 +365,29 @@ class WriteBarrieredBase : public Barrie
     static void writeBarrierPre(const T& v) { InternalBarrierMethods<T>::preBarrier(v); }
 
   protected:
     void pre() { InternalBarrierMethods<T>::preBarrier(this->value); }
     void post(T prev, T next) { InternalBarrierMethods<T>::postBarrier(&this->value, prev, next); }
 };
 
 /*
- * PreBarriered only automatically handles pre-barriers. Post-barriers must
- * be manually implemented when using this class. GCPtr and RelocatablePtr
- * should be used in all cases that do not require explicit low-level control
- * of moving behavior, e.g. for HashMap keys.
+ * PreBarriered only automatically handles pre-barriers. Post-barriers must be
+ * manually implemented when using this class. GCPtr and HeapPtr should be used
+ * in all cases that do not require explicit low-level control of moving
+ * behavior, e.g. for HashMap keys.
  */
 template <class T>
 class PreBarriered : public WriteBarrieredBase<T>
 {
   public:
     PreBarriered() : WriteBarrieredBase<T>(JS::GCPolicy<T>::initial()) {}
     /*
-     * Allow implicit construction for use in generic contexts, such as DebuggerWeakMap::markKeys.
+     * Allow implicit construction for use in generic contexts, such as
+     * DebuggerWeakMap::markKeys.
      */
     MOZ_IMPLICIT PreBarriered(T v) : WriteBarrieredBase<T>(v) {}
     explicit PreBarriered(const PreBarriered<T>& v) : WriteBarrieredBase<T>(v.value) {}
     ~PreBarriered() { this->pre(); }
 
     void init(T v) {
         this->value = v;
     }
@@ -408,17 +410,17 @@ class PreBarriered : public WriteBarrier
 /*
  * A pre- and post-barriered heap pointer, for use inside the JS engine.
  *
  * It must only be stored in memory that has GC lifetime. GCPtr must not be
  * used in contexts where it may be implicitly moved or deleted, e.g. most
  * containers.
  *
  * The post-barriers implemented by this class are faster than those
- * implemented by RelocatablePtr<T> or JS::Heap<T> at the cost of not
+ * implemented by js::HeapPtr<T> or JS::Heap<T> at the cost of not
  * automatically handling deletion or movement.
  */
 template <class T>
 class GCPtr : public WriteBarrieredBase<T>
 {
   public:
     GCPtr() : WriteBarrieredBase<T>(JS::GCPolicy<T>::initial()) {}
     explicit GCPtr(T v) : WriteBarrieredBase<T>(v) {
@@ -450,86 +452,86 @@ class GCPtr : public WriteBarrieredBase<
     void set(const T& v) {
         this->pre();
         T tmp = this->value;
         this->value = v;
         this->post(tmp, this->value);
     }
 
     /*
-     * Unlike RelocatablePtr<T>, GCPtr<T> must be managed with GC lifetimes.
+     * Unlike HeapPtr<T>, GCPtr<T> must be managed with GC lifetimes.
      * Specifically, the memory used by the pointer itself must be live until
      * at least the next minor GC. For that reason, move semantics are invalid
      * and are deleted here. Please note that not all containers support move
      * semantics, so this does not completely prevent invalid uses.
      */
     GCPtr(GCPtr<T>&&) = delete;
     GCPtr<T>& operator=(GCPtr<T>&&) = delete;
 };
 
 /*
  * A pre- and post-barriered heap pointer, for use inside the JS engine. These
  * heap pointers can be stored in C++ containers like GCVector and GCHashMap.
  *
  * The GC sometimes keeps pointers to pointers to GC things --- for example, to
  * track references into the nursery. However, C++ containers like GCVector and
  * GCHashMap usually reserve the right to relocate their elements any time
- * they're modified, invalidating all pointers to the elements. RelocatablePtr
+ * they're modified, invalidating all pointers to the elements. HeapPtr
  * has a move constructor which knows how to keep the GC up to date if it is
  * moved to a new location.
  *
- * However, because of this additional communication with the GC, RelocatablePtr
+ * However, because of this additional communication with the GC, HeapPtr
  * is somewhat slower, so it should only be used in contexts where this ability
  * is necessary.
  *
  * Obviously, JSObjects, JSStrings, and the like get tenured and compacted, so
  * whatever pointers they contain get relocated, in the sense used here.
  * However, since the GC itself is moving those values, it takes care of its
- * internal pointers to those pointers itself. RelocatablePtr is only necessary
+ * internal pointers to those pointers itself. HeapPtr is only necessary
  * when the relocation would otherwise occur without the GC's knowledge.
  */
 template <class T>
-class RelocatablePtr : public WriteBarrieredBase<T>
+class HeapPtr : public WriteBarrieredBase<T>
 {
   public:
-    RelocatablePtr() : WriteBarrieredBase<T>(JS::GCPolicy<T>::initial()) {}
+    HeapPtr() : WriteBarrieredBase<T>(JS::GCPolicy<T>::initial()) {}
 
     // Implicitly adding barriers is a reasonable default.
-    MOZ_IMPLICIT RelocatablePtr(const T& v) : WriteBarrieredBase<T>(v) {
+    MOZ_IMPLICIT HeapPtr(const T& v) : WriteBarrieredBase<T>(v) {
         this->post(JS::GCPolicy<T>::initial(), this->value);
     }
 
     /*
-     * For RelocatablePtr, move semantics are equivalent to copy semantics. In
+     * For HeapPtr, move semantics are equivalent to copy semantics. In
      * C++, a copy constructor taking const-ref is the way to get a single
      * function that will be used for both lvalue and rvalue copies, so we can
      * simply omit the rvalue variant.
      */
-    MOZ_IMPLICIT RelocatablePtr(const RelocatablePtr<T>& v) : WriteBarrieredBase<T>(v) {
+    MOZ_IMPLICIT HeapPtr(const HeapPtr<T>& v) : WriteBarrieredBase<T>(v) {
         this->post(JS::GCPolicy<T>::initial(), this->value);
     }
 
-    ~RelocatablePtr() {
+    ~HeapPtr() {
         this->pre();
         this->post(this->value, JS::GCPolicy<T>::initial());
     }
 
     void init(T v) {
         this->value = v;
         this->post(JS::GCPolicy<T>::initial(), this->value);
     }
 
-    DECLARE_POINTER_ASSIGN_OPS(RelocatablePtr, T);
+    DECLARE_POINTER_ASSIGN_OPS(HeapPtr, T);
 
     /* Make this friend so it can access pre() and post(). */
     template <class T1, class T2>
     friend inline void
     BarrieredSetPair(Zone* zone,
-                     RelocatablePtr<T1*>& v1, T1* val1,
-                     RelocatablePtr<T2*>& v2, T2* val2);
+                     HeapPtr<T1*>& v1, T1* val1,
+                     HeapPtr<T2*>& v2, T2* val2);
 
   protected:
     void set(const T& v) {
         this->pre();
         postBarrieredSet(v);
     }
 
     void postBarrieredSet(const T& v) {
@@ -638,17 +640,17 @@ using WeakRef = ReadBarriered<T>;
 // Add Value operations to all Barrier types. Note, this must be defined before
 // HeapSlot for HeapSlot's base to get these operations.
 template <>
 class BarrieredBaseMixins<JS::Value> : public ValueOperations<WriteBarrieredBase<JS::Value>>
 {};
 
 // A pre- and post-barriered Value that is specialized to be aware that it
 // resides in a slots or elements vector. This allows it to be relocated in
-// memory, but with substantially less overhead than a RelocatablePtr.
+// memory, but with substantially less overhead than a HeapPtr.
 class HeapSlot : public WriteBarrieredBase<Value>
 {
   public:
     enum Kind {
         Slot = 0,
         Element = 1
     };
 
@@ -743,18 +745,18 @@ class HeapSlotArray
 
 /*
  * This is a hack for RegExpStatics::updateFromMatch. It allows us to do two
  * barriers with only one branch to check if we're in an incremental GC.
  */
 template <class T1, class T2>
 static inline void
 BarrieredSetPair(Zone* zone,
-                 RelocatablePtr<T1*>& v1, T1* val1,
-                 RelocatablePtr<T2*>& v2, T2* val2)
+                 HeapPtr<T1*>& v1, T1* val1,
+                 HeapPtr<T2*>& v2, T2* val2)
 {
     if (T1::needWriteBarrierPre(zone)) {
         v1.pre();
         v2.pre();
     }
     v1.postBarrieredSet(val1);
     v2.postBarrieredSet(val2);
 }
@@ -800,19 +802,19 @@ struct MovableCellHasher<PreBarriered<T>
     using Lookup = T;
 
     static HashNumber hash(const Lookup& l) { return MovableCellHasher<T>::hash(l); }
     static bool match(const Key& k, const Lookup& l) { return MovableCellHasher<T>::match(k, l); }
     static void rekey(Key& k, const Key& newKey) { k.unsafeSet(newKey); }
 };
 
 template <typename T>
-struct MovableCellHasher<RelocatablePtr<T>>
+struct MovableCellHasher<HeapPtr<T>>
 {
-    using Key = RelocatablePtr<T>;
+    using Key = HeapPtr<T>;
     using Lookup = T;
 
     static HashNumber hash(const Lookup& l) { return MovableCellHasher<T>::hash(l); }
     static bool match(const Key& k, const Lookup& l) { return MovableCellHasher<T>::match(k, l); }
     static void rekey(Key& k, const Key& newKey) { k.unsafeSet(newKey); }
 };
 
 template <typename T>
@@ -888,30 +890,16 @@ class JitCode;
 } // namespace jit
 
 typedef PreBarriered<JSObject*> PreBarrieredObject;
 typedef PreBarriered<JSScript*> PreBarrieredScript;
 typedef PreBarriered<jit::JitCode*> PreBarrieredJitCode;
 typedef PreBarriered<JSString*> PreBarrieredString;
 typedef PreBarriered<JSAtom*> PreBarrieredAtom;
 
-typedef RelocatablePtr<JSObject*> RelocatablePtrObject;
-typedef RelocatablePtr<JSFunction*> RelocatablePtrFunction;
-typedef RelocatablePtr<PlainObject*> RelocatablePtrPlainObject;
-typedef RelocatablePtr<JSScript*> RelocatablePtrScript;
-typedef RelocatablePtr<NativeObject*> RelocatablePtrNativeObject;
-typedef RelocatablePtr<NestedScopeObject*> RelocatablePtrNestedScopeObject;
-typedef RelocatablePtr<Shape*> RelocatablePtrShape;
-typedef RelocatablePtr<ObjectGroup*> RelocatablePtrObjectGroup;
-typedef RelocatablePtr<jit::JitCode*> RelocatablePtrJitCode;
-typedef RelocatablePtr<JSLinearString*> RelocatablePtrLinearString;
-typedef RelocatablePtr<JSString*> RelocatablePtrString;
-typedef RelocatablePtr<JSAtom*> RelocatablePtrAtom;
-typedef RelocatablePtr<ArrayBufferObjectMaybeShared*> RelocatablePtrArrayBufferObjectMaybeShared;
-
 typedef GCPtr<NativeObject*> GCPtrNativeObject;
 typedef GCPtr<ArrayObject*> GCPtrArrayObject;
 typedef GCPtr<ArrayBufferObjectMaybeShared*> GCPtrArrayBufferObjectMaybeShared;
 typedef GCPtr<ArrayBufferObject*> GCPtrArrayBufferObject;
 typedef GCPtr<BaseShape*> GCPtrBaseShape;
 typedef GCPtr<JSAtom*> GCPtrAtom;
 typedef GCPtr<JSFlatString*> GCPtrFlatString;
 typedef GCPtr<JSFunction*> GCPtrFunction;
@@ -925,21 +913,19 @@ typedef GCPtr<ModuleNamespaceObject*> GC
 typedef GCPtr<PlainObject*> GCPtrPlainObject;
 typedef GCPtr<PropertyName*> GCPtrPropertyName;
 typedef GCPtr<Shape*> GCPtrShape;
 typedef GCPtr<UnownedBaseShape*> GCPtrUnownedBaseShape;
 typedef GCPtr<jit::JitCode*> GCPtrJitCode;
 typedef GCPtr<ObjectGroup*> GCPtrObjectGroup;
 
 typedef PreBarriered<Value> PreBarrieredValue;
-typedef RelocatablePtr<Value> RelocatableValue;
 typedef GCPtr<Value> GCPtrValue;
 
 typedef PreBarriered<jsid> PreBarrieredId;
-typedef RelocatablePtr<jsid> RelocatableId;
 typedef GCPtr<jsid> GCPtrId;
 
 typedef ImmutableTenuredPtr<PropertyName*> ImmutablePropertyNamePtr;
 typedef ImmutableTenuredPtr<JS::Symbol*> ImmutableSymbolPtr;
 
 typedef ReadBarriered<DebugScopeObject*> ReadBarrieredDebugScopeObject;
 typedef ReadBarriered<GlobalObject*> ReadBarrieredGlobalObject;
 typedef ReadBarriered<JSObject*> ReadBarrieredObject;
--- a/js/src/gc/Policy.h
+++ b/js/src/gc/Policy.h
@@ -140,22 +140,22 @@ struct InternalGCPointerPolicy {
 namespace JS {
 
 #define DEFINE_INTERNAL_GC_POLICY(type) \
     template <> struct GCPolicy<type> : public js::InternalGCPointerPolicy<type> {};
 FOR_EACH_INTERNAL_GC_POINTER_TYPE(DEFINE_INTERNAL_GC_POLICY)
 #undef DEFINE_INTERNAL_GC_POLICY
 
 template <typename T>
-struct GCPolicy<js::RelocatablePtr<T>>
+struct GCPolicy<js::HeapPtr<T>>
 {
-    static void trace(JSTracer* trc, js::RelocatablePtr<T>* thingp, const char* name) {
+    static void trace(JSTracer* trc, js::HeapPtr<T>* thingp, const char* name) {
         js::TraceEdge(trc, thingp, name);
     }
-    static bool needsSweep(js::RelocatablePtr<T>* thingp) {
+    static bool needsSweep(js::HeapPtr<T>* thingp) {
         return js::gc::IsAboutToBeFinalized(thingp);
     }
 };
 
 template <typename T>
 struct GCPolicy<js::ReadBarriered<T>>
 {
     static void trace(JSTracer* trc, js::ReadBarriered<T>* thingp, const char* name) {
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -59,17 +59,17 @@ class StoreBuffer
     struct MonoTypeBuffer
     {
         /* The canonical set of stores. */
         typedef HashSet<T, typename T::Hasher, SystemAllocPolicy> StoreSet;
         StoreSet stores_;
 
         /*
          * A one element cache in front of the canonical set to speed up
-         * temporary instances of RelocatablePtr.
+         * temporary instances of HeapPtr.
          */
         T last_;
 
         /* Maximum number of entries before we request a minor GC. */
         const static size_t MaxEntries = 48 * 1024 / sizeof(T);
 
         explicit MonoTypeBuffer() : last_(T()) {}
         ~MonoTypeBuffer() { stores_.finish(); }
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -334,18 +334,18 @@ struct Zone : public JS::shadow::Zone,
     //
     // This is used during GC while calculating zone groups to record edges that
     // can't be determined by examining this zone by itself.
     ZoneSet gcZoneGroupEdges;
 
     // Keep track of all TypeDescr and related objects in this compartment.
     // This is used by the GC to trace them all first when compacting, since the
     // TypedObject trace hook may access these objects.
-    using TypeDescrObjectSet = js::GCHashSet<js::RelocatablePtrObject,
-                                             js::MovableCellHasher<js::RelocatablePtrObject>,
+    using TypeDescrObjectSet = js::GCHashSet<js::HeapPtr<JSObject*>,
+                                             js::MovableCellHasher<js::HeapPtr<JSObject*>>,
                                              js::SystemAllocPolicy>;
     JS::WeakCache<TypeDescrObjectSet> typeDescrObjects;
 
 
     // Malloc counter to measure memory pressure for GC scheduling. It runs from
     // gcMaxMallocBytes down to zero. This counter should be used only when it's
     // not possible to know the size of a free.
     mozilla::Atomic<ptrdiff_t, mozilla::ReleaseAcquire> gcMallocBytes;
--- a/js/src/gdb/tests/test-Root.cpp
+++ b/js/src/gdb/tests/test-Root.cpp
@@ -35,23 +35,23 @@ FRAGMENT(Root, HeapSlot) {
 
   (void) plinth;
   (void) array;
 }
 
 FRAGMENT(Root, barriers) {
   JSObject* obj = JS_NewPlainObject(cx);
   js::PreBarriered<JSObject*> prebarriered(obj);
-  js::GCPtr<JSObject*> heapptr(obj);
-  js::RelocatablePtr<JSObject*> relocatable(obj);
+  js::GCPtrObject heapptr(obj);
+  js::HeapPtr<JSObject*> relocatable(obj);
 
   JS::Value val = JS::ObjectValue(*obj);
   js::PreBarrieredValue prebarrieredValue(JS::ObjectValue(*obj));
   js::GCPtrValue heapValue(JS::ObjectValue(*obj));
-  js::RelocatableValue relocatableValue(JS::ObjectValue(*obj));
+  js::HeapPtr<Value> relocatableValue(JS::ObjectValue(*obj));
 
   breakpoint();
 
   (void) prebarriered;
   (void) heapptr;
   (void) relocatable;
   (void) val;
   (void) prebarrieredValue;
--- a/js/src/jit/BaselineJIT.h
+++ b/js/src/jit/BaselineJIT.h
@@ -122,22 +122,22 @@ struct BaselineScript
 
     // Limit the locals on a given script so that stack check on baseline frames
     // doesn't overflow a uint32_t value.
     // (MAX_JSSCRIPT_SLOTS * sizeof(Value)) must fit within a uint32_t.
     static const uint32_t MAX_JSSCRIPT_SLOTS = 0xffffu;
 
   private:
     // Code pointer containing the actual method.
-    RelocatablePtrJitCode method_;
+    HeapPtr<JitCode*> method_;
 
     // For functions with a call object, template objects to use for the call
     // object and decl env object (linked via the call object's enclosing
     // scope).
-    RelocatablePtrObject templateScope_;
+    HeapPtr<JSObject*> templateScope_;
 
     // Allocated space for fallback stubs.
     FallbackICStubSpace fallbackStubSpace_;
 
     // If non-null, the list of wasm::Modules that contain an optimized call
     // directly to this script.
     Vector<DependentWasmModuleImport>* dependentWasmModules_;
 
--- a/js/src/jit/JitFrameIterator.h
+++ b/js/src/jit/JitFrameIterator.h
@@ -295,17 +295,17 @@ class JitProfilingFrameIterator
     void* stackAddress() const { return fp(); }
     FrameType frameType() const { MOZ_ASSERT(!done()); return type_; }
     void* returnAddressToFp() const { MOZ_ASSERT(!done()); return returnAddressToFp_; }
 };
 
 class RInstructionResults
 {
     // Vector of results of recover instructions.
-    typedef mozilla::Vector<RelocatableValue, 1, SystemAllocPolicy> Values;
+    typedef mozilla::Vector<HeapPtr<Value>, 1, SystemAllocPolicy> Values;
     UniquePtr<Values> results_;
 
     // The frame pointer is used as a key to check if the current frame already
     // bailed out.
     JitFrameLayout* fp_;
 
     // Record if we tried and succeed at allocating and filling the vector of
     // recover instruction results, if needed.  This flag is needed in order to
@@ -323,17 +323,17 @@ class RInstructionResults
     bool init(JSContext* cx, uint32_t numResults);
     bool isInitialized() const;
 #ifdef DEBUG
     size_t length() const;
 #endif
 
     JitFrameLayout* frame() const;
 
-    RelocatableValue& operator[](size_t index);
+    HeapPtr<Value>& operator[](size_t index);
 
     void trace(JSTracer* trc);
 };
 
 struct MaybeReadFallback
 {
     enum NoGCValue {
         NoGC_UndefinedValue,
--- a/js/src/jit/JitFrames.cpp
+++ b/js/src/jit/JitFrames.cpp
@@ -1623,17 +1623,17 @@ RInstructionResults::length() const
 
 JitFrameLayout*
 RInstructionResults::frame() const
 {
     MOZ_ASSERT(fp_);
     return fp_;
 }
 
-RelocatableValue&
+HeapPtr<Value>&
 RInstructionResults::operator [](size_t index)
 {
     return (*results_)[index];
 }
 
 void
 RInstructionResults::trace(JSTracer* trc)
 {
--- a/js/src/jsapi-tests/testGCExactRooting.cpp
+++ b/js/src/jsapi-tests/testGCExactRooting.cpp
@@ -41,38 +41,38 @@ BEGIN_TEST(testGCSuppressions)
     JS::AutoSuppressGCAnalysis noanalysisRt(cx->runtime());
 
     return true;
 }
 END_TEST(testGCSuppressions)
 
 struct MyContainer
 {
-    RelocatablePtrObject obj;
-    RelocatablePtrString str;
+    HeapPtr<JSObject*> obj;
+    HeapPtr<JSString*> str;
 
     MyContainer() : obj(nullptr), str(nullptr) {}
     void trace(JSTracer* trc) {
         js::TraceNullableEdge(trc, &obj, "test container");
         js::TraceNullableEdge(trc, &str, "test container");
     }
 };
 
 namespace js {
 template <>
 struct RootedBase<MyContainer> {
-    RelocatablePtrObject& obj() { return static_cast<Rooted<MyContainer>*>(this)->get().obj; }
-    RelocatablePtrString& str() { return static_cast<Rooted<MyContainer>*>(this)->get().str; }
+    HeapPtr<JSObject*>& obj() { return static_cast<Rooted<MyContainer>*>(this)->get().obj; }
+    HeapPtr<JSString*>& str() { return static_cast<Rooted<MyContainer>*>(this)->get().str; }
 };
 template <>
 struct PersistentRootedBase<MyContainer> {
-    RelocatablePtrObject& obj() {
+    HeapPtr<JSObject*>& obj() {
         return static_cast<PersistentRooted<MyContainer>*>(this)->get().obj;
     }
-    RelocatablePtrString& str() {
+    HeapPtr<JSString*>& str() {
         return static_cast<PersistentRooted<MyContainer>*>(this)->get().str;
     }
 };
 } // namespace js
 
 BEGIN_TEST(testGCRootedStaticStructInternalStackStorageAugmented)
 {
     JS::Rooted<MyContainer> container(cx);
--- a/js/src/jsapi-tests/testGCStoreBufferRemoval.cpp
+++ b/js/src/jsapi-tests/testGCStoreBufferRemoval.cpp
@@ -27,64 +27,64 @@ BEGIN_TEST(testGCStoreBufferRemoval)
     CHECK(js::gc::IsInsideNursery(obj.get()));
     JS_GC(cx->runtime());
     CHECK(!js::gc::IsInsideNursery(obj.get()));
     JS::RootedObject tenuredObject(cx, obj);
 
     // Hide the horrors herein from the static rooting analysis.
     AutoIgnoreRootingHazards ignore;
 
-    // Test removal of store buffer entries added by RelocatablePtr<T>.
+    // Test removal of store buffer entries added by HeapPtr<T>.
     {
         JSObject* badObject = reinterpret_cast<JSObject*>(1);
         JSObject* punnedPtr = nullptr;
-        RelocatablePtrObject* relocPtr =
-            reinterpret_cast<RelocatablePtrObject*>(&punnedPtr);
-        new (relocPtr) RelocatablePtrObject;
+        HeapPtr<JSObject*>* relocPtr =
+            reinterpret_cast<HeapPtr<JSObject*>*>(&punnedPtr);
+        new (relocPtr) HeapPtr<JSObject*>;
         *relocPtr = NurseryObject();
-        relocPtr->~RelocatablePtrObject();
+        relocPtr->~HeapPtr<JSObject*>();
         punnedPtr = badObject;
         JS_GC(cx->runtime());
 
-        new (relocPtr) RelocatablePtrObject;
+        new (relocPtr) HeapPtr<JSObject*>;
         *relocPtr = NurseryObject();
         *relocPtr = tenuredObject;
-        relocPtr->~RelocatablePtrObject();
+        relocPtr->~HeapPtr<JSObject*>();
         punnedPtr = badObject;
         JS_GC(cx->runtime());
 
-        new (relocPtr) RelocatablePtrObject;
+        new (relocPtr) HeapPtr<JSObject*>;
         *relocPtr = NurseryObject();
         *relocPtr = nullptr;
-        relocPtr->~RelocatablePtrObject();
+        relocPtr->~HeapPtr<JSObject*>();
         punnedPtr = badObject;
         JS_GC(cx->runtime());
     }
 
-    // Test removal of store buffer entries added by RelocatableValue.
+    // Test removal of store buffer entries added by HeapPtr<Value>.
     {
         Value punnedValue;
-        RelocatableValue* relocValue = reinterpret_cast<RelocatableValue*>(&punnedValue);
-        new (relocValue) RelocatableValue;
+        HeapPtr<Value>* relocValue = reinterpret_cast<HeapPtr<Value>*>(&punnedValue);
+        new (relocValue) HeapPtr<Value>;
         *relocValue = ObjectValue(*NurseryObject());
-        relocValue->~RelocatableValue();
+        relocValue->~HeapPtr<Value>();
         punnedValue = ObjectValueCrashOnTouch();
         JS_GC(cx->runtime());
 
-        new (relocValue) RelocatableValue;
+        new (relocValue) HeapPtr<Value>;
         *relocValue = ObjectValue(*NurseryObject());
         *relocValue = ObjectValue(*tenuredObject);
-        relocValue->~RelocatableValue();
+        relocValue->~HeapPtr<Value>();
         punnedValue = ObjectValueCrashOnTouch();
         JS_GC(cx->runtime());
 
-        new (relocValue) RelocatableValue;
+        new (relocValue) HeapPtr<Value>;
         *relocValue = ObjectValue(*NurseryObject());
         *relocValue = NullValue();
-        relocValue->~RelocatableValue();
+        relocValue->~HeapPtr<Value>();
         punnedValue = ObjectValueCrashOnTouch();
         JS_GC(cx->runtime());
     }
 
     // Test removal of store buffer entries added by Heap<T>.
     {
         JSObject* badObject = reinterpret_cast<JSObject*>(1);
         JSObject* punnedPtr = nullptr;
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -219,17 +219,17 @@ JS_STATIC_ASSERT(sizeof(Binding) == size
  */
 class Bindings
 {
     friend class BindingIter;
     friend class AliasedFormalIter;
     template <typename Outer> friend class BindingsOperations;
     template <typename Outer> friend class MutableBindingsOperations;
 
-    RelocatablePtrShape callObjShape_;
+    HeapPtr<Shape*> callObjShape_;
     uintptr_t bindingArrayAndFlag_;
     uint16_t numArgs_;
     uint16_t numBlockScoped_;
     uint16_t numBodyLevelLexicals_;
     uint16_t numUnaliasedBodyLevelLexicals_;
     uint32_t aliasedBodyLevelLexicalBegin_;
     uint32_t numVars_;
     uint32_t numUnaliasedVars_;
@@ -364,17 +364,17 @@ static_assert(sizeof(Bindings) % js::gc:
 
 template <class Outer>
 class BindingsOperations
 {
     const Bindings& bindings() const { return static_cast<const Outer*>(this)->get(); }
 
   public:
     // Direct data access to the underlying bindings.
-    const RelocatablePtrShape& callObjShape() const {
+    const HeapPtr<Shape*>& callObjShape() const {
         return bindings().callObjShape_;
     }
     uint16_t numArgs() const {
         return bindings().numArgs_;
     }
     uint16_t numBlockScoped() const {
         return bindings().numBlockScoped_;
     }
--- a/js/src/jsweakmap.h
+++ b/js/src/jsweakmap.h
@@ -367,23 +367,23 @@ WeakMap_set(JSContext* cx, unsigned argc
 
 extern bool
 WeakMap_delete(JSContext* cx, unsigned argc, Value* vp);
 
 extern JSObject*
 InitWeakMapClass(JSContext* cx, HandleObject obj);
 
 
-class ObjectValueMap : public WeakMap<RelocatablePtrObject, RelocatableValue,
-                                      MovableCellHasher<RelocatablePtrObject>>
+class ObjectValueMap : public WeakMap<HeapPtr<JSObject*>, HeapPtr<Value>,
+                                      MovableCellHasher<HeapPtr<JSObject*>>>
 {
   public:
     ObjectValueMap(JSContext* cx, JSObject* obj)
-      : WeakMap<RelocatablePtrObject, RelocatableValue,
-                MovableCellHasher<RelocatablePtrObject>>(cx, obj)
+      : WeakMap<HeapPtr<JSObject*>, HeapPtr<Value>,
+                MovableCellHasher<HeapPtr<JSObject*>>>(cx, obj)
     {}
 
     virtual bool findZoneEdges();
 };
 
 
 // Generic weak map for mapping objects to other objects.
 class ObjectWeakMap
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -2829,17 +2829,17 @@ Debugger::trace(JSTracer* trc)
      * Mark Debugger.Frame objects. These are all reachable from JS, because the
      * corresponding JS frames are still on the stack.
      *
      * (Once we support generator frames properly, we will need
      * weakly-referenced Debugger.Frame objects as well, for suspended generator
      * frames.)
      */
     for (FrameMap::Range r = frames.all(); !r.empty(); r.popFront()) {
-        RelocatablePtrNativeObject& frameobj = r.front().value();
+        HeapPtr<NativeObject*>& frameobj = r.front().value();
         MOZ_ASSERT(MaybeForwarded(frameobj.get())->getPrivate());
         TraceEdge(trc, &frameobj, "live Debugger.Frame");
     }
 
     allocationsLog.trace(trc);
 
     /* Trace the weak map from JSScript instances to Debugger.Script objects. */
     scripts.trace(trc);
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -64,22 +64,22 @@ typedef HashSet<ReadBarrieredGlobalObjec
  * created.
  *
  * Also note that keys in these weakmaps can be in any compartment, debuggee or
  * not, because they cannot be deleted when a compartment is no longer a
  * debuggee: the values need to maintain object identity across add/remove/add
  * transitions.
  */
 template <class UnbarrieredKey, bool InvisibleKeysOk=false>
-class DebuggerWeakMap : private WeakMap<RelocatablePtr<UnbarrieredKey>, RelocatablePtrObject,
-                                        MovableCellHasher<RelocatablePtr<UnbarrieredKey>>>
+class DebuggerWeakMap : private WeakMap<HeapPtr<UnbarrieredKey>, HeapPtr<JSObject*>,
+                                        MovableCellHasher<HeapPtr<UnbarrieredKey>>>
 {
   private:
-    typedef RelocatablePtr<UnbarrieredKey> Key;
-    typedef RelocatablePtrObject Value;
+    typedef HeapPtr<UnbarrieredKey> Key;
+    typedef HeapPtr<JSObject*> Value;
 
     typedef HashMap<JS::Zone*,
                     uintptr_t,
                     DefaultHasher<JS::Zone*>,
                     RuntimeAllocPolicy> CountMap;
 
     CountMap zoneCounts;
     JSCompartment* compartment;
@@ -325,20 +325,20 @@ class Debugger : private mozilla::Linked
               className(className),
               ctorName(ctorName),
               size(size),
               inNursery(inNursery)
         {
             MOZ_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>());
         };
 
-        RelocatablePtrObject frame;
+        HeapPtr<JSObject*> frame;
         double when;
         const char* className;
-        RelocatablePtrAtom ctorName;
+        HeapPtr<JSAtom*> ctorName;
         size_t size;
         bool inNursery;
 
         void trace(JSTracer* trc) {
             TraceNullableEdge(trc, &frame, "Debugger::AllocationsLogEntry::frame");
             TraceNullableEdge(trc, &ctorName, "Debugger::AllocationsLogEntry::ctorName");
         }
     };
@@ -435,17 +435,17 @@ class Debugger : private mozilla::Linked
      * removeDebuggee.
      *
      * We don't trace the keys of this map (the frames are on the stack and
      * thus necessarily live), but we do trace the values. It's like a WeakMap
      * that way, but since stack frames are not gc-things, the implementation
      * has to be different.
      */
     typedef HashMap<AbstractFramePtr,
-                    RelocatablePtrNativeObject,
+                    HeapPtr<NativeObject*>,
                     DefaultHasher<AbstractFramePtr>,
                     RuntimeAllocPolicy> FrameMap;
     FrameMap frames;
 
     /* An ephemeral map from JSScript* to Debugger.Script instances. */
     typedef DebuggerWeakMap<JSScript*> ScriptWeakMap;
     ScriptWeakMap scripts;
 
--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@@ -228,18 +228,18 @@ DebuggerMemory::drainAllocationsLog(JSCo
 
         RootedValue inNursery(cx, BooleanValue(entry.inNursery));
         if (!DefineProperty(cx, obj, cx->names().inNursery, inNursery))
             return false;
 
         result->setDenseElement(i, ObjectValue(*obj));
 
         // Pop the front queue entry, and delete it immediately, so that the GC
-        // sees the AllocationsLogEntry's RelocatablePtr barriers run atomically
-        // with the change to the graph (the queeue link).
+        // sees the AllocationsLogEntry's HeapPtr barriers run atomically with
+        // the change to the graph (the queue link).
         if (!dbg->allocationsLog.popFront()) {
             ReportOutOfMemory(cx);
             return false;
         }
     }
 
     dbg->allocationsLogOverflowed = false;
     args.rval().setObject(*result);
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -111,29 +111,29 @@ class RegExpShared
   private:
     friend class RegExpCompartment;
     friend class RegExpStatics;
 
     typedef frontend::TokenStream TokenStream;
 
     struct RegExpCompilation
     {
-        RelocatablePtrJitCode jitCode;
+        HeapPtr<jit::JitCode*> jitCode;
         uint8_t* byteCode;
 
         RegExpCompilation() : byteCode(nullptr) {}
         ~RegExpCompilation() { js_free(byteCode); }
 
         bool compiled(ForceByteCodeEnum force = DontForceByteCode) const {
             return byteCode || (force == DontForceByteCode && jitCode);
         }
     };
 
     /* Source to the RegExp, for lazy compilation. */
-    RelocatablePtrAtom source;
+    HeapPtr<JSAtom*>     source;
 
     RegExpFlag         flags;
     size_t             parenCount;
     bool               canStringMatch;
     bool               marked_;
 
     RegExpCompilation  compilationArray[4];
 
--- a/js/src/vm/RegExpStatics.h
+++ b/js/src/vm/RegExpStatics.h
@@ -16,29 +16,29 @@ namespace js {
 
 class GlobalObject;
 class RegExpStaticsObject;
 
 class RegExpStatics
 {
     /* The latest RegExp output, set after execution. */
     VectorMatchPairs        matches;
-    RelocatablePtrLinearString matchesInput;
+    HeapPtr<JSLinearString*>  matchesInput;
 
     /*
      * The previous RegExp input, used to resolve lazy state.
      * A raw RegExpShared cannot be stored because it may be in
      * a different compartment via evalcx().
      */
-    RelocatablePtrAtom      lazySource;
+    HeapPtr<JSAtom*>          lazySource;
     RegExpFlag              lazyFlags;
     size_t                  lazyIndex;
 
     /* The latest RegExp input, set before execution. */
-    RelocatablePtrString    pendingInput;
+    HeapPtr<JSString*>        pendingInput;
 
     /*
      * If non-zero, |matchesInput| and the |lazy*| fields may be used
      * to replay the last executed RegExp, and |matches| is invalid.
      */
     int32_t                 pendingLazyEvaluation;
 
   public:
--- a/js/src/vm/SavedStacks.h
+++ b/js/src/vm/SavedStacks.h
@@ -224,17 +224,17 @@ class SavedStacks {
     SavedFrame* getOrCreateSavedFrame(JSContext* cx, SavedFrame::HandleLookup lookup);
     SavedFrame* createFrameFromLookup(JSContext* cx, SavedFrame::HandleLookup lookup);
 
     // Cache for memoizing PCToLineNumber lookups.
 
     struct PCKey {
         PCKey(JSScript* script, jsbytecode* pc) : script(script), pc(pc) { }
 
-        RelocatablePtrScript script;
+        HeapPtr<JSScript*> script;
         jsbytecode* pc;
 
         void trace(JSTracer* trc) { /* PCKey is weak. */ }
         bool needsSweep() { return IsAboutToBeFinalized(&script); }
     };
 
   public:
     struct LocationValue {
@@ -251,17 +251,17 @@ class SavedStacks {
             // LocationValue is always held strongly, but in a weak map.
             // Assert that it has been marked already, but allow it to be
             // ejected from the map when the key dies.
             MOZ_ASSERT(source);
             MOZ_ASSERT(!IsAboutToBeFinalized(&source));
             return true;
         }
 
-        RelocatablePtrAtom source;
+        HeapPtr<JSAtom*> source;
         size_t line;
         uint32_t column;
     };
 
     template <typename Outer>
     struct LocationValueOperations {
         JSAtom* source() const { return loc().source; }
         size_t line() const { return loc().line; }
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -1208,17 +1208,17 @@ class MissingScopeKey
 
 // The value in LiveScopeMap, mapped from by live scope objects.
 class LiveScopeVal
 {
     friend class DebugScopes;
     friend class MissingScopeKey;
 
     AbstractFramePtr frame_;
-    RelocatablePtrObject staticScope_;
+    HeapPtr<JSObject*> staticScope_;
 
     static void staticAsserts();
 
   public:
     explicit LiveScopeVal(const ScopeIter& si)
       : frame_(si.initialFrame()),
         staticScope_(si.maybeStaticScope())
     { }
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@@ -1108,19 +1108,19 @@ struct DefaultHasher<AbstractFramePtr> {
 class LiveSavedFrameCache
 {
   public:
     using FramePtr = mozilla::Variant<AbstractFramePtr, jit::CommonFrameLayout*>;
 
   private:
     struct Entry
     {
-        FramePtr                    framePtr;
-        jsbytecode*                 pc;
-        RelocatablePtr<SavedFrame*> savedFrame;
+        FramePtr             framePtr;
+        jsbytecode*          pc;
+        HeapPtr<SavedFrame*> savedFrame;
 
         Entry(FramePtr& framePtr, jsbytecode* pc, SavedFrame* savedFrame)
           : framePtr(framePtr)
           , pc(pc)
           , savedFrame(savedFrame)
         { }
     };
 
--- a/js/src/vm/TypeInference.h
+++ b/js/src/vm/TypeInference.h
@@ -823,17 +823,17 @@ class PreliminaryObjectArray
 
     bool full() const;
     bool empty() const;
     void sweep();
 };
 
 class PreliminaryObjectArrayWithTemplate : public PreliminaryObjectArray
 {
-    RelocatablePtrShape shape_;
+    HeapPtr<Shape*> shape_;
 
   public:
     explicit PreliminaryObjectArrayWithTemplate(Shape* shape)
       : shape_(shape)
     {}
 
     void clear() {
         shape_.init(nullptr);
@@ -900,50 +900,50 @@ class TypeNewScript
         uint32_t offset;
         Initializer(Kind kind, uint32_t offset)
           : kind(kind), offset(offset)
         {}
     };
 
   private:
     // Scripted function which this information was computed for.
-    RelocatablePtrFunction function_;
+    HeapPtr<JSFunction*> function_;
 
     // Any preliminary objects with the type. The analyses are not performed
     // until this array is cleared.
     PreliminaryObjectArray* preliminaryObjects;
 
     // After the new script properties analyses have been performed, a template
     // object to use for newly constructed objects. The shape of this object
     // reflects all definite properties the object will have, and the
     // allocation kind to use. This is null if the new objects have an unboxed
     // layout, in which case the UnboxedLayout provides the initial structure
     // of the object.
-    RelocatablePtrPlainObject templateObject_;
+    HeapPtr<PlainObject*> templateObject_;
 
     // Order in which definite properties become initialized. We need this in
     // case the definite properties are invalidated (such as by adding a setter
     // to an object on the prototype chain) while an object is in the middle of
     // being initialized, so we can walk the stack and fixup any objects which
     // look for in-progress objects which were prematurely set with an incorrect
     // shape. Property assignments in inner frames are preceded by a series of
     // SETPROP_FRAME entries specifying the stack down to the frame containing
     // the write.
     Initializer* initializerList;
 
     // If there are additional properties found by the acquired properties
     // analysis which were not found by the definite properties analysis, this
     // shape contains all such additional properties (plus the definite
     // properties). When an object of this group acquires this shape, it is
     // fully initialized and its group can be changed to initializedGroup.
-    RelocatablePtrShape initializedShape_;
+    HeapPtr<Shape*> initializedShape_;
 
     // Group with definite properties set for all properties found by
     // both the definite and acquired properties analyses.
-    RelocatablePtrObjectGroup initializedGroup_;
+    HeapPtr<ObjectGroup*> initializedGroup_;
 
   public:
     TypeNewScript() { mozilla::PodZero(this); }
     ~TypeNewScript() {
         js_delete(preliminaryObjects);
         js_free(initializerList);
     }
 
--- a/js/src/vm/WeakMapPtr.cpp
+++ b/js/src/vm/WeakMapPtr.cpp
@@ -20,25 +20,25 @@ namespace {
 template<typename T>
 struct DataType
 {
 };
 
 template<>
 struct DataType<JSObject*>
 {
-    using BarrieredType = RelocatablePtrObject;
+    using BarrieredType = HeapPtr<JSObject*>;
     using HasherType = MovableCellHasher<BarrieredType>;
     static JSObject* NullValue() { return nullptr; }
 };
 
 template<>
 struct DataType<JS::Value>
 {
-    using BarrieredType = RelocatablePtr<Value>;
+    using BarrieredType = HeapPtr<Value>;
     static JS::Value NullValue() { return JS::UndefinedValue(); }
 };
 
 template <typename K, typename V>
 struct Utils
 {
     typedef typename DataType<K>::BarrieredType KeyType;
     typedef typename DataType<K>::HasherType HasherType;