diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 3992c952ab1..4cb9d2c1202 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -3365,6 +3365,16 @@ class Value
 
     inline void setNumber(double d);
 
+    void setNumber(uint32 ui) {
+        if (ui > JSVAL_INT_MAX) {
+            mask = DoubleMask;
+            data.dbl = ui;
+        } else {
+            mask = Int32Mask;
+            data.i32 = ui;
+        }
+    }
+
     double &asDoubleRef() {
         JS_ASSERT(size_t(&data.dbl) % sizeof(double) == 0);
         JS_ASSERT(isDouble());
@@ -3557,8 +3567,12 @@ class Value
         return mask == BooleanMask;
     }
 
-    bool isBoolean(bool b) const {
-        return (mask == BooleanMask) & (data.boo == b);
+    bool isTrue() const {
+        return (mask == BooleanMask) & data.boo;
+    }
+
+    bool isFalse() const {
+        return (mask == BooleanMask) & !data.boo;
     }
 
     bool asBoolean() const {
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 2c4ce83555a..11148a4f9b9 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -2022,7 +2022,7 @@ IteratorMore(JSContext *cx, JSObject *iterobj, bool *cond, Value *rval)
     } else {
         if (!js_IteratorMore(cx, iterobj, rval))
             return false;
-        *cond = rval->isBoolean(true);
+        *cond = rval->isTrue();
     }
     return true;
 }
diff --git a/js/src/jsregexp.cpp b/js/src/jsregexp.cpp
index 312ff5223f5..c6caafc2e95 100644
--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@@ -5716,7 +5716,7 @@ regexp_test(JSContext *cx, uintN argc, Value *vp)
     if (!regexp_exec_sub(cx, ComputeThisObjectFromVp(cx, vp),
                          argc, vp + 2, JS_TRUE, vp))
         return JS_FALSE;
-    if (!vp->isBoolean(true))
+    if (!vp->isTrue())
         vp->setBoolean(false);
     return JS_TRUE;
 }
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 764e5566643..80358deff2b 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -722,6 +722,7 @@ js_str_toString(JSContext *cx, uintN argc, Value *vp)
     if (!js_GetPrimitiveThis(cx, vp, &js_StringClass, &primp))
         return false;
     vp->copy(*primp);
+    return true;
 }
 
 /*
@@ -1499,7 +1500,7 @@ class RegExpGuard
 static JS_ALWAYS_INLINE bool
 Matched(bool test, const Value &v)
 {
-    return test ? v.isBoolean(true) : !v.isNull();
+    return test ? v.isTrue() : !v.isNull();
 }
 
 typedef bool (*DoMatchCallback)(JSContext *cx, size_t count, void *data);
@@ -1652,7 +1653,7 @@ str_search(JSContext *cx, uintN argc, Value *vp)
     if (!js_ExecuteRegExp(cx, g.re(), str, &i, true, vp))
         return false;
 
-    if (vp->isBoolean(true))
+    if (vp->isTrue())
         vp->setInt32(cx->regExpStatics.leftContext.length);
     else
         vp->setInt32(-1);
@@ -1749,7 +1750,7 @@ PushRegExpSubstr(JSContext *cx, const JSSubString &sub, Value *&sp)
     JSString *str = js_NewDependentString(cx, whole, off, sub.length);
     if (!str)
         return false;
-    *sp++ = STRING_TO_JSVAL(str);
+    sp++->setString(str);
     return true;
 }
 
@@ -1798,8 +1799,8 @@ FindReplaceLength(JSContext *cx, ReplaceData &rdata, size_t *sizep)
 
         /* Push lambda and its 'this' parameter. */
         Value *sp = rdata.args.getvp();
-        *sp++ = OBJECT_TO_JSVAL(lambda);
-        *sp++ = OBJECT_TO_JSVAL(lambda->getParent());
+        sp++->setObject(*lambda);
+        sp++->setNonFunObjOrNull(lambda->getParent());
 
         /* Push $&, $1, $2, ... */
         if (!PushRegExpSubstr(cx, cx->regExpStatics.lastMatch, sp))
@@ -1813,13 +1814,13 @@ FindReplaceLength(JSContext *cx, ReplaceData &rdata, size_t *sizep)
 
         /* Make sure to push undefined for any unmatched parens. */
         for (; i < p; i++)
-            *sp++ = JSVAL_VOID;
+            sp++->setUndefined();
 
         /* Push match index and input string. */
-        *sp++ = INT_TO_JSVAL((jsint)cx->regExpStatics.leftContext.length);
-        *sp++ = STRING_TO_JSVAL(rdata.str);
+        sp++->setInt32(cx->regExpStatics.leftContext.length);
+        sp++->setString(rdata.str);
 
-        if (!js_Invoke(cx, rdata.args, 0))
+        if (!Invoke(cx, rdata.args, 0))
             return false;
 
         /*
@@ -1917,7 +1918,7 @@ BuildFlatReplacement(JSContext *cx, JSString *textstr, JSString *repstr,
                      const RegExpGuard &g, Value *vp)
 {
     if (g.match == -1) {
-        *vp = STRING_TO_JSVAL(textstr);
+        vp->setString(textstr);
         return true;
     }
 
@@ -1936,7 +1937,7 @@ BuildFlatReplacement(JSContext *cx, JSString *textstr, JSString *repstr,
     JSString *str = js_NewStringFromCharBuffer(cx, cb);
     if (!str)
         return false;
-    *vp = STRING_TO_JSVAL(str);
+    vp->setString(str);
     return true;
 }
 
@@ -1948,7 +1949,7 @@ str_replace(JSContext *cx, uintN argc, Value *vp)
 
     /* Extract replacement string/function. */
     if (argc >= 2 && js_IsCallable(vp[3])) {
-        rdata.lambda = JSVAL_TO_OBJECT(vp[3]);
+        rdata.lambda = &vp[3].asObject();
         rdata.repstr = NULL;
         rdata.dollar = rdata.dollarEnd = NULL;
     } else {
@@ -1983,7 +1984,7 @@ str_replace(JSContext *cx, uintN argc, Value *vp)
 
     if (!rdata.calledBack) {
         /* Didn't match, so the string is unmodified. */
-        *vp = STRING_TO_JSVAL(rdata.str);
+        vp->setString(rdata.str);
         return true;
     }
 
@@ -1995,7 +1996,7 @@ str_replace(JSContext *cx, uintN argc, Value *vp)
     if (!retstr)
         return false;
 
-    *vp = STRING_TO_JSVAL(retstr);
+    vp->setString(retstr);
     return true;
 }
 
@@ -2048,7 +2049,7 @@ find_split(JSContext *cx, JSString *str, JSRegExp *re, jsint *ip,
         index = (size_t)i;
         if (!js_ExecuteRegExp(cx, re, str, &index, JS_TRUE, &rval))
             return -2;
-        if (rval != JSVAL_TRUE) {
+        if (!rval.isTrue()) {
             /* Mismatch: ensure our caller advances i past end of string. */
             sep->length = 1;
             return length;
@@ -2109,18 +2110,18 @@ str_split(JSContext *cx, uintN argc, Value *vp)
     NORMALIZE_THIS(cx, vp, str);
 
     if (argc == 0) {
-        Value v = STRING_TO_JSVAL(str);
+        Value v(str);
         JSObject *aobj = js_NewArrayObject(cx, 1, &v);
         if (!aobj)
             return false;
-        *vp = OBJECT_TO_JSVAL(aobj);
+        vp->setNonFunObj(*aobj);
         return true;
     }
 
     JSRegExp *re;
     JSSubString *sep, tmp;
     if (VALUE_IS_REGEXP(cx, vp[2])) {
-        re = (JSRegExp *) JSVAL_TO_OBJECT(vp[2])->getPrivate();
+        re = (JSRegExp *) vp[2].asObject().getPrivate();
         sep = &tmp;
 
         /* Set a magic value so we can detect a successful re match. */
@@ -2130,7 +2131,7 @@ str_split(JSContext *cx, uintN argc, Value *vp)
         JSString *str2 = js_ValueToString(cx, vp[2]);
         if (!str2)
             return false;
-        vp[2] = STRING_TO_JSVAL(str2);
+        vp[2].setString(str2);
 
         /*
          * Point sep at a local copy of str2's header because find_split
@@ -2143,7 +2144,7 @@ str_split(JSContext *cx, uintN argc, Value *vp)
 
     /* Use the second argument as the split limit, if given. */
     uint32 limit = 0; /* Avoid warning. */
-    bool limited = (argc > 1) && !JSVAL_IS_VOID(vp[3]);
+    bool limited = (argc > 1) && !vp[3].isUndefined();
     if (limited) {
         jsdouble d;
         if (!ValueToNumber(cx, vp[3], &d))
@@ -2195,7 +2196,7 @@ str_split(JSContext *cx, uintN argc, Value *vp)
     JSObject *aobj = js_NewArrayObject(cx, splits.length(), splits.begin());
     if (!aobj)
         return false;
-    *vp = OBJECT_TO_JSVAL(aobj);
+    vp->setNonFunObj(*aobj);
     return true;
 }
 
@@ -2240,7 +2241,7 @@ str_substr(JSContext *cx, uintN argc, Value *vp)
         if (!str)
             return JS_FALSE;
     }
-    *vp = STRING_TO_JSVAL(str);
+    vp->setString(str);
     return JS_TRUE;
 }
 #endif /* JS_HAS_PERL_SUBSTR */
@@ -2258,18 +2259,18 @@ str_concat(JSContext *cx, uintN argc, Value *vp)
     NORMALIZE_THIS(cx, vp, str);
 
     /* Set vp (aka rval) early to handle the argc == 0 case. */
-    *vp = STRING_TO_JSVAL(str);
+    vp->setString(str);
 
     for (i = 0, argv = vp + 2; i < argc; i++) {
         str2 = js_ValueToString(cx, argv[i]);
         if (!str2)
             return JS_FALSE;
-        argv[i] = STRING_TO_JSVAL(str2);
+        argv[i].setString(str2);
 
         str = js_ConcatStrings(cx, str, str2);
         if (!str)
             return JS_FALSE;
-        *vp = STRING_TO_JSVAL(str);
+        vp->setString(str);
     }
 
     return JS_TRUE;
@@ -2278,16 +2279,11 @@ str_concat(JSContext *cx, uintN argc, Value *vp)
 static JSBool
 str_slice(JSContext *cx, uintN argc, Value *vp)
 {
-    Value t, v;
-    JSString *str;
-
-    t = vp[1];
-    v = vp[2];
-    if (argc == 1 && JSVAL_IS_STRING(t) && JSVAL_IS_INT(v)) {
+    if (argc == 1 && vp[1].isString() && vp[2].isInt32()) {
         size_t begin, end, length;
 
-        str = JSVAL_TO_STRING(t);
-        begin = JSVAL_TO_INT(v);
+        JSString *str = vp[1].asString();
+        begin = vp[2].asInt32();
         end = str->length();
         if (begin <= end) {
             length = end - begin;
@@ -2300,11 +2296,12 @@ str_slice(JSContext *cx, uintN argc, Value *vp)
                 if (!str)
                     return JS_FALSE;
             }
-            *vp = STRING_TO_JSVAL(str);
+            vp->setString(str);
             return JS_TRUE;
         }
     }
 
+    JSString *str;
     NORMALIZE_THIS(cx, vp, str);
 
     if (argc != 0) {
@@ -2345,7 +2342,7 @@ str_slice(JSContext *cx, uintN argc, Value *vp)
         if (!str)
             return JS_FALSE;
     }
-    *vp = STRING_TO_JSVAL(str);
+    vp->setString(str);
     return JS_TRUE;
 }
 
@@ -2413,7 +2410,7 @@ tagify(JSContext *cx, const char *begin, JSString *param, const char *end,
         js_free((char *)tagbuf);
         return JS_FALSE;
     }
-    *vp = STRING_TO_JSVAL(str);
+    vp->setString(str);
     return JS_TRUE;
 }
 
@@ -2913,15 +2910,15 @@ js_String(JSContext *cx, JSObject *obj, uintN argc, Value *argv, Value *rval)
         str = js_ValueToString(cx, argv[0]);
         if (!str)
             return JS_FALSE;
-        argv[0] = STRING_TO_JSVAL(str);
+        argv[0].setString(str);
     } else {
         str = cx->runtime->emptyString;
     }
     if (!JS_IsConstructing(cx)) {
-        *rval = STRING_TO_JSVAL(str);
+        rval->setString(str);
         return JS_TRUE;
     }
-    obj->setPrimitiveThis(STRING_TO_JSVAL(str));
+    obj->setPrimitiveThis(str);
     return JS_TRUE;
 }
 
@@ -2956,10 +2953,10 @@ str_fromCharCode(JSContext *cx, uintN argc, Value *vp)
             str = JSString::unitString(code);
             if (!str)
                 return JS_FALSE;
-            *vp = STRING_TO_JSVAL(str);
+            vp->setString(str);
             return JS_TRUE;
         }
-        argv[0] = INT_TO_JSVAL(code);
+        argv[0].setInt32(code);
     }
     chars = (jschar *) cx->malloc((argc + 1) * sizeof(jschar));
     if (!chars)
@@ -2978,7 +2975,7 @@ str_fromCharCode(JSContext *cx, uintN argc, Value *vp)
         cx->free(chars);
         return JS_FALSE;
     }
-    *vp = STRING_TO_JSVAL(str);
+    vp->setString(str);
     return JS_TRUE;
 }
 
@@ -3011,14 +3008,14 @@ js_InitStringClass(JSContext *cx, JSObject *obj)
     if (!JS_DefineFunctions(cx, obj, string_functions))
         return NULL;
 
-    proto = JS_InitClass(cx, obj, NULL, &js_StringClass, js_String, 1,
+    proto = js_InitClass(cx, obj, NULL, &js_StringClass, js_String, 1,
                          NULL, string_methods,
                          NULL, string_static_methods);
     if (!proto)
         return NULL;
-    proto->setPrimitiveThis(STRING_TO_JSVAL(cx->runtime->emptyString));
+    proto->setPrimitiveThis(cx->runtime->emptyString);
     if (!js_DefineNativeProperty(cx, proto, ATOM_TO_JSID(cx->runtime->atomState.lengthAtom),
-                                 JSVAL_VOID, NULL, NULL,
+                                 sUndefinedValue, NULL, NULL,
                                  JSPROP_READONLY | JSPROP_PERMANENT | JSPROP_SHARED, 0, 0,
                                  NULL)) {
         return JS_FALSE;
@@ -3192,7 +3189,7 @@ js_NewStringCopyZ(JSContext *cx, const jschar *s)
 }
 
 JS_FRIEND_API(const char *)
-js_ValueToPrintable(JSContext *cx, Value v, JSValueToStringFun v2sfun)
+js_ValueToPrintable(JSContext *cx, const Value &v, JSValueToStringFun v2sfun)
 {
     JSString *str;
 
@@ -3206,22 +3203,23 @@ js_ValueToPrintable(JSContext *cx, Value v, JSValueToStringFun v2sfun)
 }
 
 JSString *
-js_ValueToString(JSContext *cx, const Value &v)
+js_ValueToString(JSContext *cx, const Value &arg)
 {
-    JSString *str;
-
-    if (!JSVAL_IS_PRIMITIVE(v) && !JSVAL_TO_OBJECT(v)->defaultValue(cx, JSTYPE_STRING, &v))
+    Value v;
+    v.copy(arg);
+    if (v.isObject() && !v.asObject().defaultValue(cx, JSTYPE_STRING, &v))
         return NULL;
 
-    if (JSVAL_IS_STRING(v)) {
-        str = JSVAL_TO_STRING(v);
-    } else if (JSVAL_IS_INT(v)) {
-        str = js_NumberToString(cx, JSVAL_TO_INT(v));
-    } else if (JSVAL_IS_DOUBLE(v)) {
-        str = js_NumberToString(cx, *JSVAL_TO_DOUBLE(v));
-    } else if (JSVAL_IS_BOOLEAN(v)) {
-        str = js_BooleanToString(cx, JSVAL_TO_BOOLEAN(v));
-    } else if (JSVAL_IS_NULL(v)) {
+    JSString *str;
+    if (v.isString()) {
+        str = v.asString();
+    } else if (v.isInt32()) {
+        str = js_NumberToString(cx, v.asInt32());
+    } else if (v.isDouble()) {
+        str = js_NumberToString(cx, v.asDouble());
+    } else if (v.isBoolean()) {
+        str = js_BooleanToString(cx, v.asBoolean());
+    } else if (v.isNull()) {
         str = ATOM_TO_STRING(cx->runtime->atomState.nullAtom);
     } else {
         str = ATOM_TO_STRING(cx->runtime->atomState.typeAtoms[JSTYPE_VOID]);
@@ -3241,38 +3239,39 @@ AppendAtom(JSAtom *atom, JSCharBuffer &cb)
 
 /* This function implements E-262-3 section 9.8, toString. */
 JSBool
-js_ValueToCharBuffer(JSContext *cx, Value v, JSCharBuffer &cb)
+js_ValueToCharBuffer(JSContext *cx, const Value &arg, JSCharBuffer &cb)
 {
-    if (!JSVAL_IS_PRIMITIVE(v) && !JSVAL_TO_OBJECT(v)->defaultValue(cx, JSTYPE_STRING, &v))
+    Value v;
+    v.copy(arg);
+    if (v.isObject() && !v.asObject().defaultValue(cx, JSTYPE_STRING, &v))
         return JS_FALSE;
 
-    if (JSVAL_IS_STRING(v)) {
-        JSString *str = JSVAL_TO_STRING(v);
+    if (v.isString()) {
         const jschar *chars;
         size_t length;
-        str->getCharsAndLength(chars, length);
+        v.asString()->getCharsAndLength(chars, length);
         return cb.append(chars, length);
     }
-    if (JSVAL_IS_NUMBER(v))
+    if (v.isNumber())
         return js_NumberValueToCharBuffer(cx, v, cb);
-    if (JSVAL_IS_BOOLEAN(v))
-        return js_BooleanToCharBuffer(cx, JSVAL_TO_BOOLEAN(v), cb);
-    if (JSVAL_IS_NULL(v))
+    if (v.isBoolean())
+        return js_BooleanToCharBuffer(cx, v.asBoolean(), cb);
+    if (v.isNull())
         return AppendAtom(cx->runtime->atomState.nullAtom, cb);
-    JS_ASSERT(JSVAL_IS_VOID(v));
+    JS_ASSERT(v.isUndefined());
     return AppendAtom(cx->runtime->atomState.typeAtoms[JSTYPE_VOID], cb);
 }
 
 JS_FRIEND_API(JSString *)
-js_ValueToSource(JSContext *cx, Value v)
+js_ValueToSource(JSContext *cx, const Value &v)
 {
-    if (JSVAL_IS_VOID(v))
+    if (v.isUndefined())
         return ATOM_TO_STRING(cx->runtime->atomState.void0Atom);
-    if (JSVAL_IS_STRING(v))
-        return js_QuoteString(cx, JSVAL_TO_STRING(v), '"');
-    if (JSVAL_IS_PRIMITIVE(v)) {
+    if (v.isString())
+        return js_QuoteString(cx, v.asString(), '"');
+    if (v.isPrimitive()) {
         /* Special case to preserve negative zero, _contra_ toString. */
-        if (JSVAL_IS_DOUBLE(v) && JSDOUBLE_IS_NEGZERO(*JSVAL_TO_DOUBLE(v))) {
+        if (v.isDouble() && JSDOUBLE_IS_NEGZERO(v.asDouble())) {
             /* NB: _ucNstr rather than _ucstr to indicate non-terminated. */
             static const jschar js_negzero_ucNstr[] = {'-', '0'};
 
@@ -3282,8 +3281,8 @@ js_ValueToSource(JSContext *cx, Value v)
     }
 
     JSAtom *atom = cx->runtime->atomState.toSourceAtom;
-    AutoValueRooter tvr(cx, JSVAL_NULL);
-    if (!js_TryMethod(cx, JSVAL_TO_OBJECT(v), atom, 0, NULL, tvr.addr()))
+    AutoValueRooter tvr(cx);
+    if (!js_TryMethod(cx, &v.asObject(), atom, 0, NULL, tvr.addr()))
         return NULL;
     return js_ValueToString(cx, tvr.value());
 }
@@ -5240,7 +5239,7 @@ TransferBufferToString(JSContext *cx, JSCharBuffer &cb, Value *rval)
     JSString *str = js_NewStringFromCharBuffer(cx, cb);
     if (!str)
         return false;
-    *rval = STRING_TO_JSVAL(str);
+    rval->setString(str);
     return true;;
 }
 
@@ -5266,7 +5265,7 @@ Encode(JSContext *cx, JSString *str, const jschar *unescapedSet,
 
     str->getCharsAndLength(chars, length);
     if (length == 0) {
-        *rval = STRING_TO_JSVAL(cx->runtime->emptyString);
+        rval->setString(cx->runtime->emptyString);
         return JS_TRUE;
     }
 
@@ -5329,7 +5328,7 @@ Decode(JSContext *cx, JSString *str, const jschar *reservedSet, Value *rval)
 
     str->getCharsAndLength(chars, length);
     if (length == 0) {
-        *rval = STRING_TO_JSVAL(cx->runtime->emptyString);
+        rval->setString(cx->runtime->emptyString);
         return JS_TRUE;
     }
 
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index d9cf66e2bbc..a6ddb3a6270 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -82,11 +82,11 @@ ArrayBuffer::fromJSObject(JSObject *obj)
 }
 
 JSBool
-ArrayBuffer::prop_getByteLength(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+ArrayBuffer::prop_getByteLength(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     ArrayBuffer *abuf = ArrayBuffer::fromJSObject(obj);
     if (abuf)
-        *vp = INT_TO_JSVAL(jsint(abuf->byteLength));
+        vp->setInt32(jsint(abuf->byteLength));
     return true;
 }
 
@@ -104,13 +104,13 @@ ArrayBuffer::class_finalize(JSContext *cx, JSObject *obj)
  */
 JSBool
 ArrayBuffer::class_constructor(JSContext *cx, JSObject *obj,
-                               uintN argc, jsval *argv, jsval *rval)
+                               uintN argc, Value *argv, Value *rval)
 {
     if (!JS_IsConstructing(cx)) {
         obj = NewObject(cx, &ArrayBuffer::jsclass, NULL, NULL);
         if (!obj)
             return false;
-        *rval = OBJECT_TO_JSVAL(obj);
+        rval->setNonFunObj(*obj);
     }
 
     return create(cx, obj, argc, argv, rval);
@@ -118,13 +118,13 @@ ArrayBuffer::class_constructor(JSContext *cx, JSObject *obj,
 
 bool
 ArrayBuffer::create(JSContext *cx, JSObject *obj,
-                    uintN argc, jsval *argv, jsval *rval)
+                    uintN argc, Value *argv, Value *rval)
 {
     if (!obj) {
         obj = NewObject(cx, &ArrayBuffer::jsclass, NULL, NULL);
         if (!obj)
             return false;
-        *rval = OBJECT_TO_JSVAL(obj);
+        rval->setNonFunObj(*obj);
     }
 
     if (argc == 0) {
@@ -136,10 +136,10 @@ ArrayBuffer::create(JSContext *cx, JSObject *obj,
     int32_t nbytes;
     if (!ValueToECMAInt32(cx, argv[0], &nbytes))
         return false;
-    if (nbytes < 0 || !INT_FITS_IN_JSVAL(nbytes)) {
+    if (nbytes < 0) {
         /*
          * We're just not going to support arrays that are bigger than what will fit
-         * as an integer jsval; if someone actually ever complains (validly), then we
+         * as an integer value; if someone actually ever complains (validly), then we
          * can fix.
          */
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
@@ -224,38 +224,38 @@ TypedArray::isArrayIndex(JSContext *cx, jsid id, jsuint *ip)
 }
 
 JSBool
-TypedArray::prop_getBuffer(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+TypedArray::prop_getBuffer(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     TypedArray *tarray = fromJSObject(obj);
     if (tarray)
-        *vp = OBJECT_TO_JSVAL(tarray->bufferJS);
+        vp->setNonFunObj(*tarray->bufferJS);
     return true;
 }
 
 JSBool
-TypedArray::prop_getByteOffset(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+TypedArray::prop_getByteOffset(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     TypedArray *tarray = fromJSObject(obj);
     if (tarray)
-        *vp = INT_TO_JSVAL(tarray->byteOffset);
+        vp->setInt32(tarray->byteOffset);
     return true;
 }
 
 JSBool
-TypedArray::prop_getByteLength(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+TypedArray::prop_getByteLength(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     TypedArray *tarray = fromJSObject(obj);
     if (tarray)
-        *vp = INT_TO_JSVAL(tarray->byteLength);
+        vp->setInt32(tarray->byteLength);
     return true;
 }
 
 JSBool
-TypedArray::prop_getLength(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
+TypedArray::prop_getLength(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
     TypedArray *tarray = fromJSObject(obj);
     if (tarray)
-        *vp = INT_TO_JSVAL(tarray->length);
+        vp->setInt32(tarray->length);
     return true;
 }
 
@@ -477,29 +477,29 @@ class TypedArrayTemplate
 
     static JSFunctionSpec jsfuncs[];
 
-    static inline JSClass *slowClass()
+    static inline Class *slowClass()
     {
         return &TypedArray::slowClasses[ArrayTypeID()];
     }
 
-    static inline JSClass *fastClass()
+    static inline Class *fastClass()
     {
         return &TypedArray::fastClasses[ArrayTypeID()];
     }
 
-    static JSObjectOps *getObjectOps(JSContext *cx, JSClass *clasp)
+    static JSObjectOps *getObjectOps(JSContext *cx, Class *clasp)
     {
         return &fastObjectOps;
     }
 
     static JSBool
-    obj_getProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
+    obj_getProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
     {
         ThisTypeArray *tarray = ThisTypeArray::fromJSObject(obj);
         JS_ASSERT(tarray);
 
         if (id == ATOM_TO_JSID(cx->runtime->atomState.lengthAtom)) {
-            *vp = INT_TO_JSVAL(tarray->length);
+            vp->setNumber(tarray->length);
             return true;
         }
 
@@ -514,11 +514,11 @@ class TypedArrayTemplate
 
             JSObject *proto = obj->getProto();
             if (!proto) {
-                *vp = JSVAL_VOID;
+                vp->setUndefined();
                 return true;
             }
 
-            *vp = JSVAL_VOID;
+            vp->setUndefined();
             if (js_LookupPropertyWithFlags(cx, proto, id, cx->resolveFlags, &obj2, &prop) < 0)
                 return false;
 
@@ -536,13 +536,13 @@ class TypedArrayTemplate
     }
 
     static JSBool
-    obj_setProperty(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
+    obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
     {
         ThisTypeArray *tarray = ThisTypeArray::fromJSObject(obj);
         JS_ASSERT(tarray);
 
         if (id == ATOM_TO_JSID(cx->runtime->atomState.lengthAtom)) {
-            *vp = INT_TO_JSVAL(tarray->length);
+            vp->setNumber(tarray->length);
             return true;
         }
 
@@ -559,30 +559,30 @@ class TypedArrayTemplate
             // these objects.  This is especially true when these arrays
             // are used to implement HTML Canvas 2D's PixelArray objects,
             // which used to be plain old arrays.
-            *vp = JSVAL_VOID;
+            vp->setUndefined();
             return true;
         }
 
-        if (JSVAL_IS_INT(*vp)) {
-            tarray->setIndex(index, NativeType(JSVAL_TO_INT(*vp)));
+        if (vp->isInt32()) {
+            tarray->setIndex(index, NativeType(vp->asInt32()));
             return true;
         }
 
         jsdouble d;
 
-        if (JSVAL_IS_DOUBLE(*vp)) {
-            d = *JSVAL_TO_DOUBLE(*vp);
-        } else if (JSVAL_IS_NULL(*vp)) {
+        if (vp->isDouble()) {
+            d = vp->asDouble();
+        } else if (vp->isNull()) {
             d = 0.0f;
-        } else if (JSVAL_IS_PRIMITIVE(*vp)) {
-            JS_ASSERT(JSVAL_IS_STRING(*vp) || JSVAL_IS_SPECIAL(*vp));
-            if (JSVAL_IS_STRING(*vp)) {
+        } else if (vp->isPrimitive()) {
+            JS_ASSERT(vp->isString() || vp->isUndefined() || vp->isBoolean());
+            if (vp->isString()) {
                 // note that ValueToNumber will always succeed with a string arg
                 ValueToNumber(cx, *vp, &d);
-            } else if (*vp == JSVAL_VOID) {
+            } else if (vp->isUndefined()) {
                 d = js_NaN;
             } else {
-                d = (double) JSVAL_TO_BOOLEAN(*vp);
+                d = (double) vp->asBoolean();
             }
         } else {
             // non-primitive assignments become NaN or 0 (for float/int arrays)
@@ -614,20 +614,22 @@ class TypedArrayTemplate
     }
 
     static JSBool
-    obj_defineProperty(JSContext *cx, JSObject *obj, jsid id, jsval value,
-                       JSPropertyOp getter, JSPropertyOp setter, uintN attrs)
+    obj_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *vp,
+                       PropertyOp getter, PropertyOp setter, uintN attrs)
     {
         if (id == ATOM_TO_JSID(cx->runtime->atomState.lengthAtom))
             return true;
 
-        return obj_setProperty(cx, obj, id, &value);
+        Value v;
+        v.copy(*vp);
+        return obj_setProperty(cx, obj, id, &v);
     }
 
     static JSBool
-    obj_deleteProperty(JSContext *cx, JSObject *obj, jsval id, jsval *rval)
+    obj_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval)
     {
         if (id == ATOM_TO_JSID(cx->runtime->atomState.lengthAtom)) {
-            *rval = JSVAL_FALSE;
+            rval->setBoolean(false);
             return true;
         }
 
@@ -635,17 +637,17 @@ class TypedArrayTemplate
         JS_ASSERT(tarray);
 
         if (tarray->isArrayIndex(cx, id)) {
-            *rval = JSVAL_FALSE;
+            rval->setBoolean(false);
             return true;
         }
 
-        *rval = JSVAL_TRUE;
+        rval->setBoolean(true);
         return true;
     }
 
     static JSBool
     obj_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
-                  jsval *statep, jsid *idp)
+                  Value *statep, jsid *idp)
     {
         ThisTypeArray *tarray = ThisTypeArray::fromJSObject(obj);
         JS_ASSERT(tarray);
@@ -653,21 +655,22 @@ class TypedArrayTemplate
         jsint curVal;
         switch (enum_op) {
           case JSENUMERATE_INIT:
-            *statep = JSVAL_ZERO;
+            statep->setInt32(0);
             if (idp)
                 *idp = INT_TO_JSID(tarray->length);
             break;
 
           case JSENUMERATE_NEXT:
-            curVal = JSVAL_TO_INT(*statep);
+            curVal = statep->asInt32();
             *idp = INT_TO_JSID(curVal);
-            *statep = (curVal == int32(tarray->length))
-                      ? JSVAL_NULL
-                      : INT_TO_JSVAL(curVal+1);
+            if (curVal == int32(tarray->length))
+                statep->setNull();
+            else
+                statep->setInt32(curVal + 1);
             break;
 
           case JSENUMERATE_DESTROY:
-            *statep = JSVAL_NULL;
+            statep->setNull();
             break;
         }
 
@@ -688,7 +691,7 @@ class TypedArrayTemplate
      */
     static JSBool
     class_constructor(JSContext *cx, JSObject *obj,
-                      uintN argc, jsval *argv, jsval *rval)
+                      uintN argc, Value *argv, Value *rval)
     {
         //
         // Note: this is a constructor for slowClass, not fastClass!
@@ -698,20 +701,20 @@ class TypedArrayTemplate
             obj = NewObject(cx, slowClass(), NULL, NULL);
             if (!obj)
                 return false;
-            *rval = OBJECT_TO_JSVAL(obj);
+            rval->setNonFunObj(*obj);
         }
 
         return create(cx, obj, argc, argv, rval);
     }
 
     static bool
-    create(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
+    create(JSContext *cx, JSObject *obj, uintN argc, Value *argv, Value *rval)
     {
         if (!obj) {
             obj = NewObject(cx, slowClass(), NULL, NULL);
             if (!obj)
                 return false;
-            *rval = OBJECT_TO_JSVAL(obj);
+            rval->setNonFunObj(*obj);
         }
 
         ThisTypeArray *tarray = 0;
@@ -724,8 +727,8 @@ class TypedArrayTemplate
         }
 
         // figure out the type of the first argument
-        if (JSVAL_IS_INT(argv[0])) {
-            int32 len = JSVAL_TO_INT(argv[0]);
+        if (argv[0].isInt32()) {
+            int32 len = argv[0].asInt32();
             if (len < 0) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                      JSMSG_BAD_ARRAY_LENGTH);
@@ -743,7 +746,7 @@ class TypedArrayTemplate
                 delete tarray;
                 return false;
             }
-        } else if (JSVAL_IS_OBJECT(argv[0])) {
+        } else if (argv[0].isObject()) {
             int32_t byteOffset = -1;
             int32_t length = -1;
 
@@ -773,7 +776,7 @@ class TypedArrayTemplate
                 return false;
             }
 
-            if (!tarray->init(cx, JSVAL_TO_OBJECT(argv[0]), byteOffset, length)) {
+            if (!tarray->init(cx, &argv[0].asObject(), byteOffset, length)) {
                 delete tarray;
                 return false;
             }
@@ -796,13 +799,13 @@ class TypedArrayTemplate
 
     /* slice(start[, end]) */
     static JSBool
-    fun_slice(JSContext *cx, uintN argc, jsval *vp)
+    fun_slice(JSContext *cx, uintN argc, Value *vp)
     {
-        jsval *argv;
+        Value *argv;
         JSObject *obj;
 
         argv = JS_ARGV(cx, vp);
-        obj = JS_THIS_OBJECT(cx, vp);
+        obj = ComputeThisObjectFromVp(cx, vp);
 
         ThisTypeArray *tarray = ThisTypeArray::fromJSObject(obj);
         if (!tarray)
@@ -849,7 +852,7 @@ class TypedArrayTemplate
 
         // note the usage of JS_NewObject here -- we don't want the
         // constructor to be called!
-        JSObject *nobj = JS_NewObject(cx, slowClass(), NULL, NULL);
+        JSObject *nobj = NewObject(cx, slowClass(), NULL, NULL);
         if (!nobj) {
             delete ntarray;
             return false;
@@ -857,7 +860,7 @@ class TypedArrayTemplate
 
         makeFastWithPrivate(cx, nobj, ntarray);
 
-        *vp = OBJECT_TO_JSVAL(nobj);
+        vp->setNonFunObj(*nobj);
         return true;
     }
 
@@ -878,8 +881,7 @@ class TypedArrayTemplate
 
         // now munge the classword and make this into a fast typed
         // array class, since it's an instance
-        obj->classword ^= jsuword(slowClass());
-        obj->classword |= jsuword(fastClass());
+        obj->changeClassToFastArray();
 
         obj->map = &fastObjectMap;
     }
@@ -985,7 +987,7 @@ class TypedArrayTemplate
         *(static_cast<NativeType*>(data) + index) = val;
     }
 
-    inline void copyIndexToValue(JSContext *cx, uint32 index, jsval *vp);
+    inline void copyIndexToValue(JSContext *cx, uint32 index, Value *vp);
 
     ThisTypeArray *
     slice(uint32 begin, uint32 end)
@@ -1010,15 +1012,15 @@ class TypedArrayTemplate
 
   protected:
     static NativeType
-    nativeFromValue(JSContext *cx, jsval v)
+    nativeFromValue(JSContext *cx, const Value &v)
     {
-        if (JSVAL_IS_INT(v))
-            return NativeType(JSVAL_TO_INT(v));
+        if (v.isInt32())
+            return NativeType(v.asInt32());
 
-        if (JSVAL_IS_DOUBLE(v))
-            return NativeType(*JSVAL_TO_DOUBLE(v));
+        if (v.isDouble())
+            return NativeType(v.asDouble());
 
-        if (JSVAL_IS_PRIMITIVE(v) && v != JSVAL_HOLE) {
+        if (v.isPrimitive()) {
             jsdouble dval;
             ValueToNumber(cx, v, &dval);
             return NativeType(dval);
@@ -1038,15 +1040,13 @@ class TypedArrayTemplate
         if (ar->isDenseArray() && ar->getDenseArrayCapacity() >= len) {
             JS_ASSERT(ar->getArrayLength() == len);
 
-            jsval *src = ar->getDenseArrayElements();
+            Value *src = ar->getDenseArrayElements();
 
-            for (uintN i = 0; i < len; ++i) {
-                jsval v = *src++;
-                *dest++ = nativeFromValue(cx, v);
-            }
+            for (uintN i = 0; i < len; ++i)
+                *dest++ = nativeFromValue(cx, *src++);
         } else {
             // slow path
-            jsval v;
+            Value v;
 
             for (uintN i = 0; i < len; ++i) {
                 if (!ar->getProperty(cx, INT_TO_JSID(i), &v))
@@ -1148,15 +1148,10 @@ class TypedArrayTemplate
     bool
     createBufferWithByteLength(JSContext *cx, int32 bytes)
     {
-        if (!INT_FITS_IN_JSVAL(bytes)) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                                 JSMSG_NEED_DIET, "byte length");
-            return false;
-        }
-
-        jsval argv = INT_TO_JSVAL(bytes);
-        JSObject *obj = JS_ConstructObjectWithArguments(cx, &ArrayBuffer::jsclass, NULL, NULL,
-                                                        1, &argv);
+        Value argv;
+        argv.setInt32(bytes);
+        JSObject *obj = js_ConstructObject(cx, &ArrayBuffer::jsclass, NULL, NULL,
+                                           1, &argv);
         if (!obj)
             return false;
 
@@ -1175,56 +1170,50 @@ class TypedArrayTemplate
 // less than 32-bits in size.
 template<typename NativeType>
 void
-TypedArrayTemplate<NativeType>::copyIndexToValue(JSContext *cx, uint32 index, jsval *vp)
+TypedArrayTemplate<NativeType>::copyIndexToValue(JSContext *cx, uint32 index, Value *vp)
 {
     JS_STATIC_ASSERT(sizeof(NativeType) < 4);
 
-    *vp = INT_TO_JSVAL(getIndex(index));
+    vp->setInt32(getIndex(index));
 }
 
 // and we need to specialize for 32-bit integers and floats
 template<>
 void
-TypedArrayTemplate<int32>::copyIndexToValue(JSContext *cx, uint32 index, jsval *vp)
+TypedArrayTemplate<int32>::copyIndexToValue(JSContext *cx, uint32 index, Value *vp)
 {
     int32 val = getIndex(index);
-    if (INT_FITS_IN_JSVAL(val)) {
-        *vp = INT_TO_JSVAL(val);
-    } else {
-        jsdouble *dp = js_NewWeaklyRootedDouble(cx, jsdouble(val));
-        *vp = dp ? DOUBLE_TO_JSVAL(dp) : JSVAL_VOID;
-    }
+    if (val <= JSVAL_INT_MAX)
+        vp->setInt32(val);
+    else
+        vp->setDouble(val);
 }
 
 template<>
 void
-TypedArrayTemplate<uint32>::copyIndexToValue(JSContext *cx, uint32 index, jsval *vp)
+TypedArrayTemplate<uint32>::copyIndexToValue(JSContext *cx, uint32 index, Value *vp)
 {
     uint32 val = getIndex(index);
-    if (val < uint32(JSVAL_INT_MAX)) {
-        *vp = INT_TO_JSVAL(int32(val));
-    } else {
-        jsdouble *dp = js_NewWeaklyRootedDouble(cx, jsdouble(val));
-        *vp = dp ? DOUBLE_TO_JSVAL(dp) : JSVAL_VOID;
-    }
+    if (val <= JSVAL_INT_MAX)
+        vp->setInt32(val);
+    else
+        vp->setDouble(val);
 }
 
 template<>
 void
-TypedArrayTemplate<float>::copyIndexToValue(JSContext *cx, uint32 index, jsval *vp)
+TypedArrayTemplate<float>::copyIndexToValue(JSContext *cx, uint32 index, Value *vp)
 {
     float val = getIndex(index);
-    if (!js_NewWeaklyRootedNumber(cx, jsdouble(val), vp))
-        *vp = JSVAL_VOID;
+    vp->setDouble(val);
 }
 
 template<>
 void
-TypedArrayTemplate<double>::copyIndexToValue(JSContext *cx, uint32 index, jsval *vp)
+TypedArrayTemplate<double>::copyIndexToValue(JSContext *cx, uint32 index, Value *vp)
 {
     double val = getIndex(index);
-    if (!js_NewWeaklyRootedNumber(cx, jsdouble(val), vp))
-        *vp = JSVAL_VOID;
+    vp->setDouble(val);
 }
 
 /***
@@ -1235,18 +1224,18 @@ TypedArrayTemplate<double>::copyIndexToValue(JSContext *cx, uint32 index, jsval
  * ArrayBuffer (base)
  */
 
-JSClass ArrayBuffer::jsclass = {
+Class ArrayBuffer::jsclass = {
     "ArrayBuffer",
     JSCLASS_HAS_PRIVATE | JSCLASS_HAS_CACHED_PROTO(JSProto_ArrayBuffer),
-    JS_PropertyStub, JS_PropertyStub, JS_PropertyStub, JS_PropertyStub,
-    JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, ArrayBuffer::class_finalize,
+    PropertyStub,     PropertyStub,   PropertyStub,   PropertyStub,
+    EnumerateStub,    ResolveStub,    ConvertStub,    ArrayBuffer::class_finalize,
     JSCLASS_NO_OPTIONAL_MEMBERS
 };
 
 JSPropertySpec ArrayBuffer::jsprops[] = {
     { "byteLength",
       -1, JSPROP_SHARED | JSPROP_PERMANENT | JSPROP_READONLY,
-      ArrayBuffer::prop_getByteLength, ArrayBuffer::prop_getByteLength },
+      Jsvalify(ArrayBuffer::prop_getByteLength), Jsvalify(ArrayBuffer::prop_getByteLength) },
     {0,0,0,0,0}
 };
 
@@ -1257,20 +1246,19 @@ JSPropertySpec ArrayBuffer::jsprops[] = {
 JSPropertySpec TypedArray::jsprops[] = {
     { js_length_str,
       -1, JSPROP_SHARED | JSPROP_PERMANENT | JSPROP_READONLY,
-      TypedArray::prop_getLength, TypedArray::prop_getLength },
+      Jsvalify(TypedArray::prop_getLength), Jsvalify(TypedArray::prop_getLength) },
     { "byteLength",
       -1, JSPROP_SHARED | JSPROP_PERMANENT | JSPROP_READONLY,
-      TypedArray::prop_getByteLength, TypedArray::prop_getByteLength },
+      Jsvalify(TypedArray::prop_getByteLength), Jsvalify(TypedArray::prop_getByteLength) },
     { "byteOffset",
       -1, JSPROP_SHARED | JSPROP_PERMANENT | JSPROP_READONLY,
-      TypedArray::prop_getByteOffset, TypedArray::prop_getByteOffset },
+      Jsvalify(TypedArray::prop_getByteOffset), Jsvalify(TypedArray::prop_getByteOffset) },
     { "buffer",
       -1, JSPROP_SHARED | JSPROP_PERMANENT | JSPROP_READONLY,
-      TypedArray::prop_getBuffer, TypedArray::prop_getBuffer },
+      Jsvalify(TypedArray::prop_getBuffer), Jsvalify(TypedArray::prop_getBuffer) },
     {0,0,0,0,0}
 };
 
-
 /*
  * TypedArray boilerplate
  */
@@ -1306,8 +1294,8 @@ template<> JSFunctionSpec _typedArray::jsfuncs[] = {                           \
 {                                                                              \
     #_typedArray,                                                              \
     JSCLASS_HAS_PRIVATE | JSCLASS_HAS_CACHED_PROTO(JSProto_##_typedArray),     \
-    JS_PropertyStub, JS_PropertyStub, JS_PropertyStub, JS_PropertyStub,        \
-    JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, JS_FinalizeStub,         \
+    PropertyStub, PropertyStub, PropertyStub, PropertyStub,                    \
+    EnumerateStub, ResolveStub, ConvertStub, FinalizeStub,                     \
     JSCLASS_NO_OPTIONAL_MEMBERS                                                \
 }
 
@@ -1315,8 +1303,8 @@ template<> JSFunctionSpec _typedArray::jsfuncs[] = {                           \
 {                                                                              \
     #_typedArray,                                                              \
     JSCLASS_HAS_PRIVATE,                                                       \
-    JS_PropertyStub, JS_PropertyStub, JS_PropertyStub, JS_PropertyStub,        \
-    JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub,                          \
+    PropertyStub, PropertyStub, PropertyStub, PropertyStub,                    \
+    EnumerateStub, ResolveStub, ConvertStub,                                   \
     _typedArray::class_finalize,                                               \
     _typedArray::getObjectOps, NULL, NULL, NULL,                               \
     NULL, NULL, NULL, NULL                                                     \
@@ -1345,7 +1333,7 @@ IMPL_TYPED_ARRAY_STATICS(Float32Array);
 IMPL_TYPED_ARRAY_STATICS(Float64Array);
 IMPL_TYPED_ARRAY_STATICS(Uint8ClampedArray);
 
-JSClass TypedArray::fastClasses[TYPE_MAX] = {
+Class TypedArray::fastClasses[TYPE_MAX] = {
     IMPL_TYPED_ARRAY_FAST_CLASS(Int8Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Uint8Array),
     IMPL_TYPED_ARRAY_FAST_CLASS(Int16Array),
@@ -1357,7 +1345,7 @@ JSClass TypedArray::fastClasses[TYPE_MAX] = {
     IMPL_TYPED_ARRAY_FAST_CLASS(Uint8ClampedArray)
 };
 
-JSClass TypedArray::slowClasses[TYPE_MAX] = {
+Class TypedArray::slowClasses[TYPE_MAX] = {
     IMPL_TYPED_ARRAY_SLOW_CLASS(Int8Array),
     IMPL_TYPED_ARRAY_SLOW_CLASS(Uint8Array),
     IMPL_TYPED_ARRAY_SLOW_CLASS(Int16Array),
@@ -1418,19 +1406,19 @@ js_IsTypedArray(JSObject *obj)
 JS_FRIEND_API(JSObject *)
 js_CreateArrayBuffer(JSContext *cx, jsuint nbytes)
 {
-    AutoValueRooter tvr(cx);
-    if (!js_NewNumberInRootedValue(cx, jsdouble(nbytes), tvr.addr()))
+    Value vals[2];
+    vals[0].setNumber(nbytes);
+    vals[1].setUndefined();
+
+    AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
+    if (!ArrayBuffer::create(cx, NULL, 1, &vals[0], &vals[1]))
         return NULL;
 
-    AutoValueRooter rval(cx);
-    if (!ArrayBuffer::create(cx, NULL, 1, tvr.addr(), rval.addr()))
-        return NULL;
-
-    return JSVAL_TO_OBJECT(rval.value());
+    return &vals[1].asObject();
 }
 
 static inline JSBool
-TypedArrayConstruct(JSContext *cx, jsint atype, uintN argc, jsval *argv, jsval *rv)
+TypedArrayConstruct(JSContext *cx, jsint atype, uintN argc, Value *argv, Value *rv)
 {
     switch (atype) {
       case TypedArray::TYPE_INT8:
@@ -1471,16 +1459,15 @@ js_CreateTypedArray(JSContext *cx, jsint atype, jsuint nelements)
 {
     JS_ASSERT(atype >= 0 && atype < TypedArray::TYPE_MAX);
 
-    jsval vals[2] = { JSVAL_NULL, JSVAL_NULL };
+    Value vals[2];
+    vals[0].setInt32(nelements);
+    vals[1].setUndefined();
+
     AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
-
-    if (!js_NewNumberInRootedValue(cx, jsdouble(nelements), &vals[0]))
-        return NULL;
-
     if (!TypedArrayConstruct(cx, atype, 1, &vals[0], &vals[1]))
         return NULL;
 
-    return JSVAL_TO_OBJECT(vals[1]);
+    return &vals[1].asObject();
 }
 
 JS_FRIEND_API(JSObject *)
@@ -1488,15 +1475,15 @@ js_CreateTypedArrayWithArray(JSContext *cx, jsint atype, JSObject *arrayArg)
 {
     JS_ASSERT(atype >= 0 && atype < TypedArray::TYPE_MAX);
 
-    jsval vals[2] = { JSVAL_NULL, JSVAL_NULL };
+    Value vals[2];
+    vals[0].setObject(*arrayArg);
+    vals[1].setUndefined();
+
     AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
-
-    vals[0] = OBJECT_TO_JSVAL(arrayArg);
-
     if (!TypedArrayConstruct(cx, atype, 1, &vals[0], &vals[1]))
         return NULL;
 
-    return JSVAL_TO_OBJECT(vals[1]);
+    return &vals[1].asObject();
 }
 
 JS_FRIEND_API(JSObject *)
@@ -1507,30 +1494,27 @@ js_CreateTypedArrayWithBuffer(JSContext *cx, jsint atype, JSObject *bufArg,
     JS_ASSERT(bufArg && ArrayBuffer::fromJSObject(bufArg));
     JS_ASSERT_IF(byteoffset < 0, length < 0);
 
-    jsval vals[4] = { JSVAL_NULL, JSVAL_NULL, JSVAL_NULL, JSVAL_NULL };
-    AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
+    Value vals[4];
 
     int argc = 1;
-    vals[0] = OBJECT_TO_JSVAL(bufArg);
+    vals[0].setObject(*bufArg);
+    vals[3].setUndefined();
 
     if (byteoffset >= 0) {
-        if (!js_NewNumberInRootedValue(cx, jsdouble(byteoffset), &vals[argc]))
-            return NULL;
-
+        vals[argc].setInt32(byteoffset);
         argc++;
     }
 
     if (length >= 0) {
-        if (!js_NewNumberInRootedValue(cx, jsdouble(length), &vals[argc]))
-            return NULL;
-
+        vals[argc].setInt32(length);
         argc++;
     }
 
+    AutoArrayRooter tvr(cx, JS_ARRAY_LENGTH(vals), vals);
     if (!TypedArrayConstruct(cx, atype, argc, &vals[0], &vals[3]))
         return NULL;
 
-    return JSVAL_TO_OBJECT(vals[3]);
+    return &vals[3].asObject();
 }
 
 JS_FRIEND_API(JSBool)
@@ -1554,14 +1538,14 @@ js_ReparentTypedArrayToScope(JSContext *cx, JSObject *obj, JSObject *scope)
     if (!js_GetClassPrototype(cx, scope, key, &proto))
         return JS_FALSE;
 
-    obj->setProto(proto);
+    obj->setProto(NonFunObjTag(*proto));
     obj->setParent(scope);
 
     key = JSCLASS_CACHED_PROTO_KEY(&ArrayBuffer::jsclass);
     if (!js_GetClassPrototype(cx, scope, key, &proto))
         return JS_FALSE;
 
-    buffer->setProto(proto);
+    buffer->setProto(NonFunObjTag(*proto));
     buffer->setParent(scope);
 
     return JS_TRUE;
diff --git a/js/src/jstypedarray.h b/js/src/jstypedarray.h
index 47c1f9542c2..0834221fcc5 100644
--- a/js/src/jstypedarray.h
+++ b/js/src/jstypedarray.h
@@ -55,17 +55,17 @@ namespace js {
  * TypedArray with a size.
  */
 struct JS_FRIEND_API(ArrayBuffer) {
-    static js::Class jsclass;
+    static Class jsclass;
     static JSPropertySpec jsprops[];
 
-    static JSBool prop_getByteLength(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
+    static JSBool prop_getByteLength(JSContext *cx, JSObject *obj, jsid id, Value *vp);
     static void class_finalize(JSContext *cx, JSObject *obj);
 
-    static JSBool class_constructor(JSContext *cx, JSObject *obj,
-                                    uintN argc, jsval *argv, jsval *rval);
+    static JSBool class_constructor(JSContext *cx, JSObject *obj, uintN argc, Value *argv,
+                                    Value *rval);
 
     static bool create(JSContext *cx, JSObject *obj, uintN argc,
-                       jsval *argv, jsval *rval);
+                       Value *argv, Value *rval);
 
     static ArrayBuffer *fromJSObject(JSObject *obj);
 
@@ -116,20 +116,20 @@ struct JS_FRIEND_API(TypedArray) {
     };
 
     // and MUST NOT be used to construct new objects.
-    static js::Class fastClasses[TYPE_MAX];
+    static Class fastClasses[TYPE_MAX];
 
     // These are the slow/original classes, used
     // fo constructing new objects
-    static js::Class slowClasses[TYPE_MAX];
+    static Class slowClasses[TYPE_MAX];
 
     static JSPropertySpec jsprops[];
 
     static TypedArray *fromJSObject(JSObject *obj);
 
-    static JSBool prop_getBuffer(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
-    static JSBool prop_getByteOffset(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
-    static JSBool prop_getByteLength(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
-    static JSBool prop_getLength(JSContext *cx, JSObject *obj, jsval id, jsval *vp);
+    static JSBool prop_getBuffer(JSContext *cx, JSObject *obj, jsid id, Value *vp);
+    static JSBool prop_getByteOffset(JSContext *cx, JSObject *obj, jsid id, Value *vp);
+    static JSBool prop_getByteLength(JSContext *cx, JSObject *obj, jsid id, Value *vp);
+    static JSBool prop_getLength(JSContext *cx, JSObject *obj, jsid id, Value *vp);
 
     static JSBool obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
                                      JSObject **objp, JSProperty **propp);
diff --git a/js/src/jsxdrapi.cpp b/js/src/jsxdrapi.cpp
index 5f5707f5e81..a94ffe55610 100644
--- a/js/src/jsxdrapi.cpp
+++ b/js/src/jsxdrapi.cpp
@@ -36,6 +36,9 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
+
+#define __STDC_LIMIT_MACROS
+
 #include "jsversion.h"
 
 #if JS_HAS_XDR
@@ -54,6 +57,8 @@
 #include "jsstr.h"
 #include "jsxdrapi.h"
 
+using namespace js;
+
 #ifdef DEBUG
 #define DBG(x) x
 #else
@@ -502,22 +507,44 @@ XDRDoubleValue(JSXDRState *xdr, jsdouble *dp)
 }
 
 JS_PUBLIC_API(JSBool)
-JS_XDRDouble(JSXDRState *xdr, jsdouble **dpp)
+JS_XDRDouble(JSXDRState *xdr, jsdouble *dp)
 {
-    jsdouble d = (xdr->mode == JSXDR_ENCODE) ? **dpp : 0.0;
+    jsdouble d = (xdr->mode == JSXDR_ENCODE) ? *dp : 0.0;
     if (!XDRDoubleValue(xdr, &d))
         return JS_FALSE;
-    if (xdr->mode == JSXDR_DECODE) {
-        *dpp = JS_NewDouble(xdr->cx, d);
-        if (!*dpp)
-            return JS_FALSE;
-    }
+    if (xdr->mode == JSXDR_DECODE)
+        *dp = d;
     return JS_TRUE;
 }
 
-/* These are magic pseudo-tags: see jsapi.h, near the top, for real tags. */
-#define JSVAL_XDRNULL   0x8
-#define JSVAL_XDRVOID   0xA
+enum jsvaltag {
+    JSVAL_OBJECT  =             0x0,
+    JSVAL_INT     =             0x1,
+    JSVAL_DOUBLE  =             0x2,
+    JSVAL_STRING  =             0x4,
+    JSVAL_SPECIAL =             0x6,
+    JSVAL_XDRNULL =             0x8,
+    JSVAL_XDRVOID =             0xA
+};
+
+static jsvaltag
+JSVAL_TAG(jsval v)
+{
+    if (JSVAL_IS_NULL(v))
+        return JSVAL_XDRNULL;
+    if (JSVAL_IS_VOID(v))
+        return JSVAL_XDRVOID;
+    if (JSVAL_IS_OBJECT(v))
+        return JSVAL_OBJECT;
+    if (JSVAL_IS_INT(v))
+        return JSVAL_INT;
+    if (JSVAL_IS_DOUBLE(v))
+        return JSVAL_DOUBLE;
+    if (JSVAL_IS_STRING(v))
+        return JSVAL_STRING;
+    JS_ASSERT(JSVAL_IS_BOOLEAN(v));
+    return JSVAL_SPECIAL;
+}
 
 static JSBool
 XDRValueBody(JSXDRState *xdr, uint32 type, jsval *vp)
@@ -540,11 +567,11 @@ XDRValueBody(JSXDRState *xdr, uint32 type, jsval *vp)
         break;
       }
       case JSVAL_DOUBLE: {
-        jsdouble *dp = (xdr->mode == JSXDR_ENCODE) ? JSVAL_TO_DOUBLE(*vp) : NULL;
-        if (!JS_XDRDouble(xdr, &dp))
+        double d = xdr->mode == JSXDR_ENCODE ? JSVAL_TO_DOUBLE(*vp) : 0;
+        if (!JS_XDRDouble(xdr, &d))
             return JS_FALSE;
         if (xdr->mode == JSXDR_DECODE)
-            *vp = DOUBLE_TO_JSVAL(dp);
+            *vp = DOUBLE_TO_JSVAL(d);
         break;
       }
       case JSVAL_OBJECT: {
@@ -570,7 +597,7 @@ XDRValueBody(JSXDRState *xdr, uint32 type, jsval *vp)
       default: {
         uint32 i;
 
-        JS_ASSERT(type & JSVAL_INT);
+        JS_ASSERT(type == JSVAL_INT);
         if (xdr->mode == JSXDR_ENCODE)
             i = (uint32) JSVAL_TO_INT(*vp);
         if (!JS_XDRUint32(xdr, &i))
@@ -588,14 +615,8 @@ JS_XDRValue(JSXDRState *xdr, jsval *vp)
 {
     uint32 type;
 
-    if (xdr->mode == JSXDR_ENCODE) {
-        if (JSVAL_IS_NULL(*vp))
-            type = JSVAL_XDRNULL;
-        else if (JSVAL_IS_VOID(*vp))
-            type = JSVAL_XDRVOID;
-        else
-            type = JSVAL_TAG(*vp);
-    }
+    if (xdr->mode == JSXDR_ENCODE)
+        type = JSVAL_TAG(*vp);
     return JS_XDRUint32(xdr, &type) && XDRValueBody(xdr, type, vp);
 }
 
@@ -606,7 +627,7 @@ js_XDRAtom(JSXDRState *xdr, JSAtom **atomp)
     uint32 type;
 
     if (xdr->mode == JSXDR_ENCODE) {
-        v = ATOM_KEY(*atomp);
+        v = Jsvalify(BoxedWordToValue(ATOM_KEY(*atomp)));
         return JS_XDRValue(xdr, &v);
     }
 
@@ -627,8 +648,10 @@ js_XDRAtom(JSXDRState *xdr, JSAtom **atomp)
         return *atomp != NULL;
     }
 
+    jsboxedword w;
     return XDRValueBody(xdr, type, &v) &&
-           js_AtomizePrimitiveValue(xdr->cx, v, atomp);
+           ValueToBoxedWord(xdr->cx, Valueify(v), &w) &&
+           js_AtomizePrimitiveValue(xdr->cx, w, atomp);
 }
 
 extern JSBool
@@ -781,14 +804,14 @@ JS_XDRFindClassIdByName(JSXDRState *xdr, const char *name)
     return 0;
 }
 
-JS_PUBLIC_API(JSClass *)
+JS_PUBLIC_API(Class *)
 JS_XDRFindClassById(JSXDRState *xdr, uint32 id)
 {
     uintN i = CLASS_ID_TO_INDEX(id);
 
     if (i >= xdr->numclasses)
         return NULL;
-    return xdr->registry[i];
+    return Valueify(xdr->registry[i]);
 }
 
 #endif /* JS_HAS_XDR */
diff --git a/js/src/jsxdrapi.h b/js/src/jsxdrapi.h
index 9d93faf075b..15e250dc4b5 100644
--- a/js/src/jsxdrapi.h
+++ b/js/src/jsxdrapi.h
@@ -110,7 +110,7 @@ struct JSXDRState {
     JSXDRMode   mode;
     JSXDROps    *ops;
     JSContext   *cx;
-    js::Class   **registry;
+    JSClass     **registry;
     uintN       numclasses;
     uintN       maxclasses;
     void        *reghash;
@@ -164,7 +164,7 @@ extern JS_PUBLIC_API(JSBool)
 JS_XDRStringOrNull(JSXDRState *xdr, JSString **strp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_XDRDouble(JSXDRState *xdr, jsdouble **dp);
+JS_XDRDouble(JSXDRState *xdr, jsdouble *dp);
 
 extern JS_PUBLIC_API(JSBool)
 JS_XDRValue(JSXDRState *xdr, jsval *vp);
@@ -205,7 +205,7 @@ JS_XDRFindClassById(JSXDRState *xdr, uint32 id);
  * before deserialization of bytecode.  If the saved version does not match
  * the current version, abort deserialization and invalidate the file.
  */
-#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 62)
+#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 63)
 
 /*
  * Library-private functions.