diff --git a/js/src/ion/CodeGenerator.cpp b/js/src/ion/CodeGenerator.cpp
index 7babd1d28eb..f41567afcfe 100644
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -1518,7 +1518,7 @@ CodeGenerator::visitInitProp(LInitProp *lir)
 {
     Register objReg = ToRegister(lir->getObject());
 
-    typedef bool(*pf)(JSContext *cx, HandleObject obj, HandlePropertyName name, const Value &value);
+    typedef bool(*pf)(JSContext *, HandleObject, HandlePropertyName, HandleValue);
     static const VMFunction InitPropInfo = FunctionInfo<pf>(InitProp);
 
     pushArg(ToValue(lir, LInitProp::ValueIndex));
@@ -1880,7 +1880,7 @@ CodeGenerator::visitCompareS(LCompareS *lir)
 bool
 CodeGenerator::visitCompareV(LCompareV *lir)
 {
-    typedef bool (*pf)(JSContext *, const Value &, const Value &, JSBool *);
+    typedef bool (*pf)(JSContext *, HandleValue, HandleValue, JSBool *);
     static const VMFunction EqInfo = FunctionInfo<pf>(ion::LooselyEqual<true>);
     static const VMFunction NeInfo = FunctionInfo<pf>(ion::LooselyEqual<false>);
     static const VMFunction StrictEqInfo = FunctionInfo<pf>(ion::StrictlyEqual<true>);
@@ -2498,7 +2498,7 @@ bool
 CodeGenerator::emitArrayPush(LInstruction *lir, const MArrayPush *mir, Register obj,
                              ConstantOrRegister value, Register elementsTemp, Register length)
 {
-    typedef bool (*pf)(JSContext *, JSObject *, const Value &, uint32_t *);
+    typedef bool (*pf)(JSContext *, JSObject *, HandleValue, uint32_t *);
     static const VMFunction Info = FunctionInfo<pf>(ion::ArrayPushDense);
     OutOfLineCode *ool = oolCallVM(Info, lir, (ArgList(), obj, value), StoreRegisterTo(length));
     if (!ool)
@@ -3389,7 +3389,7 @@ CodeGenerator::visitOutOfLineSetPropertyCache(OutOfLineCache *ool)
 bool
 CodeGenerator::visitThrow(LThrow *lir)
 {
-    typedef bool (*pf)(JSContext *, const Value &);
+    typedef bool (*pf)(JSContext *, HandleValue);
     static const VMFunction ThrowInfo = FunctionInfo<pf>(js::Throw);
 
     pushArg(ToValue(lir, LThrow::Value));
@@ -3399,7 +3399,7 @@ CodeGenerator::visitThrow(LThrow *lir)
 bool
 CodeGenerator::visitBitNotV(LBitNotV *lir)
 {
-    typedef bool (*pf)(JSContext *, const Value &, int *p);
+    typedef bool (*pf)(JSContext *, HandleValue, int *p);
     static const VMFunction info = FunctionInfo<pf>(BitNot);
 
     pushArg(ToValue(lir, LBitNotV::Input));
@@ -3409,7 +3409,7 @@ CodeGenerator::visitBitNotV(LBitNotV *lir)
 bool
 CodeGenerator::visitBitOpV(LBitOpV *lir)
 {
-    typedef bool (*pf)(JSContext *, const Value &, const Value &, int *p);
+    typedef bool (*pf)(JSContext *, HandleValue, HandleValue, int *p);
     static const VMFunction BitAndInfo = FunctionInfo<pf>(BitAnd);
     static const VMFunction BitOrInfo = FunctionInfo<pf>(BitOr);
     static const VMFunction BitXorInfo = FunctionInfo<pf>(BitXor);
@@ -3507,7 +3507,7 @@ CodeGenerator::visitTypeOfV(LTypeOfV *lir)
 bool
 CodeGenerator::visitOutOfLineTypeOfV(OutOfLineTypeOfV *ool)
 {
-    typedef JSString *(*pf)(JSContext *, const Value &);
+    typedef JSString *(*pf)(JSContext *, HandleValue);
     static const VMFunction Info = FunctionInfo<pf>(TypeOfOperation);
 
     LTypeOfV *ins = ool->ins();
diff --git a/js/src/ion/VMFunctions.cpp b/js/src/ion/VMFunctions.cpp
index 218728aab52..7ed860e436f 100644
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -125,7 +125,7 @@ DefVarOrConst(JSContext *cx, HandlePropertyName dn, unsigned attrs, HandleObject
 }
 
 bool
-InitProp(JSContext *cx, HandleObject obj, HandlePropertyName name, const Value &value)
+InitProp(JSContext *cx, HandleObject obj, HandlePropertyName name, HandleValue value)
 {
     // Copy the incoming value. This may be overwritten; the return value is discarded.
     RootedValue rval(cx, value);
@@ -138,7 +138,7 @@ InitProp(JSContext *cx, HandleObject obj, HandlePropertyName name, const Value &
 
 template<bool Equal>
 bool
-LooselyEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
+LooselyEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res)
 {
     bool equal;
     if (!js::LooselyEqual(cx, lhs, rhs, &equal))
@@ -147,12 +147,12 @@ LooselyEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
     return true;
 }
 
-template bool LooselyEqual<true>(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
-template bool LooselyEqual<false>(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
+template bool LooselyEqual<true>(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
+template bool LooselyEqual<false>(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
 
 template<bool Equal>
 bool
-StrictlyEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
+StrictlyEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res)
 {
     bool equal;
     if (!js::StrictlyEqual(cx, lhs, rhs, &equal))
@@ -161,11 +161,11 @@ StrictlyEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
     return true;
 }
 
-template bool StrictlyEqual<true>(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
-template bool StrictlyEqual<false>(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
+template bool StrictlyEqual<true>(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
+template bool StrictlyEqual<false>(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
 
 bool
-LessThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
+LessThan(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res)
 {
     bool cond;
     if (!LessThanOperation(cx, lhs, rhs, &cond))
@@ -175,7 +175,7 @@ LessThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
 }
 
 bool
-LessThanOrEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
+LessThanOrEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res)
 {
     bool cond;
     if (!LessThanOrEqualOperation(cx, lhs, rhs, &cond))
@@ -185,7 +185,7 @@ LessThanOrEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
 }
 
 bool
-GreaterThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
+GreaterThan(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res)
 {
     bool cond;
     if (!GreaterThanOperation(cx, lhs, rhs, &cond))
@@ -195,7 +195,7 @@ GreaterThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
 }
 
 bool
-GreaterThanOrEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res)
+GreaterThanOrEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res)
 {
     bool cond;
     if (!GreaterThanOrEqualOperation(cx, lhs, rhs, &cond))
@@ -293,7 +293,7 @@ ArrayPopDense(JSContext *cx, JSObject *obj, Value *rval)
 }
 
 bool
-ArrayPushDense(JSContext *cx, JSObject *obj, const Value &v, uint32_t *length)
+ArrayPushDense(JSContext *cx, JSObject *obj, HandleValue v, uint32_t *length)
 {
     JS_ASSERT(obj->isDenseArray());
 
diff --git a/js/src/ion/VMFunctions.h b/js/src/ion/VMFunctions.h
index 75e31b32eae..d3c46339cc7 100644
--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@@ -402,18 +402,18 @@ JSObject *NewGCThing(JSContext *cx, gc::AllocKind allocKind, size_t thingSize);
 bool CheckOverRecursed(JSContext *cx);
 
 bool DefVarOrConst(JSContext *cx, HandlePropertyName dn, unsigned attrs, HandleObject scopeChain);
-bool InitProp(JSContext *cx, HandleObject obj, HandlePropertyName name, const Value &value);
+bool InitProp(JSContext *cx, HandleObject obj, HandlePropertyName name, HandleValue value);
 
 template<bool Equal>
-bool LooselyEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
+bool LooselyEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
 
 template<bool Equal>
-bool StrictlyEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
+bool StrictlyEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
 
-bool LessThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
-bool LessThanOrEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
-bool GreaterThan(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
-bool GreaterThanOrEqual(JSContext *cx, const Value &lhs, const Value &rhs, JSBool *res);
+bool LessThan(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
+bool LessThanOrEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
+bool GreaterThan(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
+bool GreaterThanOrEqual(JSContext *cx, HandleValue lhs, HandleValue rhs, JSBool *res);
 
 template<bool Equal>
 bool StringsEqual(JSContext *cx, HandleString left, HandleString right, JSBool *res);
@@ -427,7 +427,7 @@ JSObject *NewInitArray(JSContext *cx, uint32_t count, types::TypeObject *type);
 JSObject *NewInitObject(JSContext *cx, HandleObject templateObject);
 
 bool ArrayPopDense(JSContext *cx, JSObject *obj, Value *rval);
-bool ArrayPushDense(JSContext *cx, JSObject *obj, const Value &v, uint32_t *length);
+bool ArrayPushDense(JSContext *cx, JSObject *obj, HandleValue v, uint32_t *length);
 bool ArrayShiftDense(JSContext *cx, JSObject *obj, Value *rval);
 
 bool SetProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, HandleValue value,
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index e363ab31cb5..db248a31db8 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -2053,8 +2053,8 @@ END_CASE(JSOP_RSH)
 
 BEGIN_CASE(JSOP_URSH)
 {
-    Value lval = regs.sp[-2];
-    Value rval = regs.sp[-1];
+    HandleValue lval = HandleValue::fromMarkedLocation(&regs.sp[-2]);
+    HandleValue rval = HandleValue::fromMarkedLocation(&regs.sp[-1]);
     if (!UrshOperation(cx, script, regs.pc, lval, rval, &regs.sp[-2]))
         goto error;
     regs.sp--;
@@ -2126,7 +2126,8 @@ END_CASE(JSOP_NOT)
 BEGIN_CASE(JSOP_BITNOT)
 {
     int32_t i;
-    if (!BitNot(cx, regs.sp[-1], &i))
+    HandleValue value = HandleValue::fromMarkedLocation(&regs.sp[-1]);
+    if (!BitNot(cx, value, &i))
         goto error;
     regs.sp[-1].setInt32(i);
 }
@@ -2241,7 +2242,7 @@ END_CASE(JSOP_TOID)
 BEGIN_CASE(JSOP_TYPEOFEXPR)
 BEGIN_CASE(JSOP_TYPEOF)
 {
-    const Value &ref = regs.sp[-1];
+    HandleValue ref = HandleValue::fromMarkedLocation(&regs.sp[-1]);
     regs.sp[-1].setString(TypeOfOperation(cx, ref));
 }
 END_CASE(JSOP_TYPEOF)
@@ -3308,7 +3309,7 @@ END_CASE(JSOP_THROWING)
 BEGIN_CASE(JSOP_THROW)
 {
     CHECK_BRANCH();
-    Value v;
+    RootedValue &v = rootValue0;
     POP_COPY_TO(v);
     JS_ALWAYS_FALSE(Throw(cx, v));
     /* let the code at error try to catch the exception. */
@@ -3975,7 +3976,7 @@ END_CASE(JSOP_ARRAYPUSH)
 }
 
 bool
-js::Throw(JSContext *cx, const Value &v)
+js::Throw(JSContext *cx, HandleValue v)
 {
     JS_ASSERT(!cx->isExceptionPending());
     cx->setPendingException(v);
diff --git a/js/src/jsinterp.h b/js/src/jsinterp.h
index f0735304957..197fb87a986 100644
--- a/js/src/jsinterp.h
+++ b/js/src/jsinterp.h
@@ -325,7 +325,7 @@ Debug_SetValueRangeToCrashOnTouch(HeapValue *vec, size_t len)
 }
 
 bool
-Throw(JSContext *cx, const Value &v);
+Throw(JSContext *cx, HandleValue v);
 
 bool
 GetProperty(JSContext *cx, HandleValue value, PropertyName *name, MutableHandleValue vp);
diff --git a/js/src/jsinterpinlines.h b/js/src/jsinterpinlines.h
index bd13c06e27b..edc726d07c9 100644
--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -824,7 +824,7 @@ SetObjectElementOperation(JSContext *cx, Handle<JSObject*> obj, HandleId id, con
 }
 
 static JS_ALWAYS_INLINE JSString *
-TypeOfOperation(JSContext *cx, const Value &v)
+TypeOfOperation(JSContext *cx, HandleValue v)
 {
     JSType type = JS_TypeOfValue(cx, v);
     return cx->runtime->atomState.typeAtoms[type];
@@ -880,7 +880,7 @@ GreaterThanOrEqualOperation(JSContext *cx, const Value &lhs, const Value &rhs, b
 }
 
 static JS_ALWAYS_INLINE bool
-BitNot(JSContext *cx, const Value &in, int *out)
+BitNot(JSContext *cx, HandleValue in, int *out)
 {
     int i;
     if (!ToInt32(cx, in, &i))
@@ -890,7 +890,7 @@ BitNot(JSContext *cx, const Value &in, int *out)
 }
 
 static JS_ALWAYS_INLINE bool
-BitXor(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
+BitXor(JSContext *cx, HandleValue lhs, HandleValue rhs, int *out)
 {
     int left, right;
     if (!ToInt32(cx, lhs, &left) || !ToInt32(cx, rhs, &right))
@@ -900,7 +900,7 @@ BitXor(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
 }
 
 static JS_ALWAYS_INLINE bool
-BitOr(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
+BitOr(JSContext *cx, HandleValue lhs, HandleValue rhs, int *out)
 {
     int left, right;
     if (!ToInt32(cx, lhs, &left) || !ToInt32(cx, rhs, &right))
@@ -910,7 +910,7 @@ BitOr(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
 }
 
 static JS_ALWAYS_INLINE bool
-BitAnd(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
+BitAnd(JSContext *cx, HandleValue lhs, HandleValue rhs, int *out)
 {
     int left, right;
     if (!ToInt32(cx, lhs, &left) || !ToInt32(cx, rhs, &right))
@@ -920,7 +920,7 @@ BitAnd(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
 }
 
 static JS_ALWAYS_INLINE bool
-BitLsh(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
+BitLsh(JSContext *cx, HandleValue lhs, HandleValue rhs, int *out)
 {
     int32_t left, right;
     if (!ToInt32(cx, lhs, &left) || !ToInt32(cx, rhs, &right))
@@ -930,7 +930,7 @@ BitLsh(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
 }
 
 static JS_ALWAYS_INLINE bool
-BitRsh(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
+BitRsh(JSContext *cx, HandleValue lhs, HandleValue rhs, int *out)
 {
     int32_t left, right;
     if (!ToInt32(cx, lhs, &left) || !ToInt32(cx, rhs, &right))
@@ -940,8 +940,8 @@ BitRsh(JSContext *cx, const Value &lhs, const Value &rhs, int *out)
 }
 
 static JS_ALWAYS_INLINE bool
-UrshOperation(JSContext *cx, HandleScript script, jsbytecode *pc, const Value &lhs, const Value &rhs,
-              Value *out)
+UrshOperation(JSContext *cx, HandleScript script, jsbytecode *pc,
+              HandleValue lhs, HandleValue rhs, Value *out)
 {
     uint32_t left;
     int32_t  right;