johnson 2.0.0.pre0 → 2.0.0.pre1

data/vendor/tracemonkey/jsscan.h

@@ -48,6 +48,7 @@
 #include "jsopcode.h"
 #include "jsprvtd.h"
 #include "jspubtd.h"
+#include "jsvector.h"
 
 JS_BEGIN_EXTERN_C
 
@@ -161,73 +162,6 @@ typedef enum JSTokenType {
 # define TOKEN_TYPE_IS_DECL(tt) ((tt) == TOK_VAR)
 #endif
 
-struct JSStringBuffer {
-    jschar      *base;
-    jschar      *limit;         /* length limit for quick bounds check */
-    jschar      *ptr;           /* slot for next non-NUL char to store */
-    void        *data;
-    JSBool      (*grow)(JSStringBuffer *sb, size_t newlength);
-    void        (*free)(JSStringBuffer *sb);
-};
-
-#define STRING_BUFFER_ERROR_BASE        ((jschar *) 1)
-#define STRING_BUFFER_OK(sb)            ((sb)->base != STRING_BUFFER_ERROR_BASE)
-#define STRING_BUFFER_OFFSET(sb)        ((sb)->ptr -(sb)->base)
-
-extern void
-js_InitStringBuffer(JSStringBuffer *sb);
-
-extern void
-js_FinishStringBuffer(JSStringBuffer *sb);
-
-static inline void
-js_RewindStringBuffer(JSStringBuffer *sb)
-{
-    JS_ASSERT(STRING_BUFFER_OK(sb));
-    sb->ptr = sb->base;
-}
-
-#define ENSURE_STRING_BUFFER(sb,n) \
-    ((sb)->ptr + (n) <= (sb)->limit || sb->grow(sb, n))
-
-/*
- * NB: callers are obligated to test STRING_BUFFER_OK(sb) after this returns,
- * before calling it again -- but not necessarily before calling other sb ops
- * declared in this header file.
- *
- * Thus multiple calls, to ops other than this one that check STRING_BUFFER_OK
- * and suppress updating sb if true, can consolidate the final STRING_BUFFER_OK
- * test that conditions a JS_ReportOutOfMemory (if necessary -- the grow hook
- * can report OOM early, obviating the need for the callers to report).
- *
- * This style of error checking is not obviously better, and it could be worse
- * in efficiency, than the propagated failure return code style used elsewhere
- * in the engine. I view it as a failed experiment. /be
- */
-static inline void
-js_FastAppendChar(JSStringBuffer *sb, jschar c)
-{
-    JS_ASSERT(STRING_BUFFER_OK(sb));
-    if (!ENSURE_STRING_BUFFER(sb, 1))
-        return;
-    *sb->ptr++ = c;
-}
-
-extern void
-js_AppendChar(JSStringBuffer *sb, jschar c);
-
-extern void
-js_RepeatChar(JSStringBuffer *sb, jschar c, uintN count);
-
-extern void
-js_AppendCString(JSStringBuffer *sb, const char *asciiz);
-
-extern void
-js_AppendUCString(JSStringBuffer *sb, const jschar *buf, uintN len);
-
-extern void
-js_AppendJSString(JSStringBuffer *sb, JSString *str);
-
 struct JSTokenPtr {
     uint32              index;          /* index of char in physical line */
     uint32              lineno;         /* physical line number */
@@ -320,7 +254,6 @@ struct JSTokenStream {
     uint32              linepos;        /* linebuf offset in physical line */
     JSTokenBuf          linebuf;        /* line buffer for diagnostics */
     JSTokenBuf          userbuf;        /* user input buffer if !file */
-    JSStringBuffer      tokenbuf;       /* current token string buffer */
     const char          *filename;      /* input filename or null */
     FILE                *file;          /* stdio stream if reading from file */
     JSSourceHandler     listener;       /* callback for source; eg debugger */
@@ -328,10 +261,33 @@ struct JSTokenStream {
     void                *listenerTSData;/* listener data for this TokenStream */
     jschar              *saveEOL;       /* save next end of line in userbuf, to
                                            optimize for very long lines */
+    JSCharBuffer        tokenbuf;       /* current token string buffer */
+
+    /*
+     * To construct a JSTokenStream, first call the constructor, which is
+     * infallible, then call |init|, which can fail. To destroy a JSTokenStream,
+     * first call |close| then call the destructor. If |init| fails, do not call
+     * |close|.
+     *
+     * This class uses JSContext.tempPool to allocate internal buffers. The
+     * caller should JS_ARENA_MARK before calling |init| and JS_ARENA_RELEASE
+     * after calling |close|.
+     */
+    JSTokenStream(JSContext *);
+
+    /*
+     * Create a new token stream, either from an input buffer or from a file.
+     * Return false on file-open or memory-allocation failure.
+     */
+    bool init(JSContext *, const jschar *base, size_t length,
+              FILE *fp, const char *filename, uintN lineno);
+
+    void close(JSContext *);
+    ~JSTokenStream() {}
 };
 
 #define CURRENT_TOKEN(ts)       ((ts)->tokens[(ts)->cursor])
-#define ON_CURRENT_LINE(ts,pos) ((uint16)(ts)->lineno == (pos).end.lineno)
+#define ON_CURRENT_LINE(ts,pos) ((ts)->lineno == (pos).end.lineno)
 
 /* JSTokenStream flags */
 #define TSF_ERROR       0x01            /* fatal error while compiling */
@@ -380,19 +336,6 @@ struct JSTokenStream {
 #define LINE_SEPARATOR  0x2028
 #define PARA_SEPARATOR  0x2029
 
-/*
- * Create a new token stream, either from an input buffer or from a file.
- * Return null on file-open or memory-allocation failure.
- *
- * The function uses JSContext.tempPool to allocate internal buffers. The
- * caller should release them using JS_ARENA_RELEASE after it has finished
- * with the token stream and has called js_CloseTokenStream.
- */
-extern JSBool
-js_InitTokenStream(JSContext *cx, JSTokenStream *ts,
-                   const jschar *base, size_t length,
-                   FILE *fp, const char *filename, uintN lineno);
-
 extern void
 js_CloseTokenStream(JSContext *cx, JSTokenStream *ts);
 

data/vendor/tracemonkey/jsscope.cpp

@@ -1,4 +1,4 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=8 sw=4 et tw=78:
  *
  * ***** BEGIN LICENSE BLOCK *****
@@ -41,10 +41,11 @@
 /*
  * JS symbol tables.
  */
-#include "jsstddef.h"
+#include <new>
 #include <stdlib.h>
 #include <string.h>
 #include "jstypes.h"
+#include "jsstdint.h"
 #include "jsarena.h"
 #include "jsbit.h"
 #include "jsclist.h"
@@ -58,7 +59,30 @@
 #include "jsnum.h"
 #include "jsscope.h"
 #include "jsstr.h"
-#include "jsarray.h"
+#include "jstracer.h"
+
+uint32
+js_GenerateShape(JSContext *cx, bool gcLocked)
+{
+    JSRuntime *rt;
+    uint32 shape;
+
+    rt = cx->runtime;
+    shape = JS_ATOMIC_INCREMENT(&rt->shapeGen);
+    JS_ASSERT(shape != 0);
+    if (shape >= SHAPE_OVERFLOW_BIT) {
+        /*
+         * FIXME bug 440834: The shape id space has overflowed. Currently we
+         * cope badly with this and schedule the GC on the every call. But
+         * first we make sure that increments from other threads would not
+         * have a chance to wrap around shapeGen to zero.
+         */
+        rt->shapeGen = SHAPE_OVERFLOW_BIT;
+        shape = SHAPE_OVERFLOW_BIT;
+        js_TriggerGC(cx, gcLocked);
+    }
+    return shape;
+}
 
 JSScope *
 js_GetMutableScope(JSContext *cx, JSObject *obj)
@@ -69,7 +93,7 @@ js_GetMutableScope(JSContext *cx, JSObject *obj)
 
     scope = OBJ_SCOPE(obj);
     JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, scope));
-    if (scope->object == obj)
+    if (scope->owned())
         return scope;
 
     /*
@@ -77,11 +101,11 @@ js_GetMutableScope(JSContext *cx, JSObject *obj)
      * birth, and runtime clone of a block objects are never mutated.
      */
     JS_ASSERT(STOBJ_GET_CLASS(obj) != &js_BlockClass);
-    newscope = js_NewScope(cx, scope->map.ops, LOCKED_OBJ_GET_CLASS(obj), obj);
+    newscope = JSScope::create(cx, scope->ops, obj->getClass(), obj, scope->shape);
     if (!newscope)
         return NULL;
     JS_LOCK_SCOPE(cx, newscope);
-    obj->map = &newscope->map;
+    obj->map = newscope;
 
     JS_ASSERT(newscope->freeslot == JSSLOT_FREE(STOBJ_GET_CLASS(obj)));
     clasp = STOBJ_GET_CLASS(obj);
@@ -93,7 +117,9 @@ js_GetMutableScope(JSContext *cx, JSObject *obj)
             newscope->freeslot = freeslot;
     }
     JS_TRANSFER_SCOPE_LOCK(cx, scope, newscope);
-    js_DropScope(cx, scope, obj);
+    JS_ATOMIC_DECREMENT(&scope->nrefs);
+    if (scope->nrefs == 0)
+        JSScope::destroy(cx, scope);
     return newscope;
 }
 
@@ -107,27 +133,27 @@ js_GetMutableScope(JSContext *cx, JSObject *obj)
 #define MIN_SCOPE_SIZE          JS_BIT(MIN_SCOPE_SIZE_LOG2)
 #define SCOPE_TABLE_NBYTES(n)   ((n) * sizeof(JSScopeProperty *))
 
-static void
-InitMinimalScope(JSContext *cx, JSScope *scope)
+void
+JSScope::initMinimal(JSContext *cx, uint32 newShape)
 {
-    js_LeaveTraceIfGlobalObject(cx, scope->object);
-    scope->shape = 0;
-    scope->hashShift = JS_DHASH_BITS - MIN_SCOPE_SIZE_LOG2;
-    scope->entryCount = scope->removedCount = 0;
-    scope->table = NULL;
-    scope->lastProp = NULL;
+    shape = newShape;
+    emptyScope = NULL;
+    hashShift = JS_DHASH_BITS - MIN_SCOPE_SIZE_LOG2;
+    entryCount = removedCount = 0;
+    table = NULL;
+    lastProp = NULL;
 }
 
-static JSBool
-CreateScopeTable(JSContext *cx, JSScope *scope, JSBool report)
+bool
+JSScope::createTable(JSContext *cx, bool report)
 {
     int sizeLog2;
     JSScopeProperty *sprop, **spp;
 
-    JS_ASSERT(!scope->table);
-    JS_ASSERT(scope->lastProp);
+    JS_ASSERT(!table);
+    JS_ASSERT(lastProp);
 
-    if (scope->entryCount > SCOPE_HASH_THRESHOLD) {
+    if (entryCount > SCOPE_HASH_THRESHOLD) {
         /*
          * Either we're creating a table for a large scope that was populated
          * via property cache hit logic under JSOP_INITPROP, JSOP_SETNAME, or
@@ -135,52 +161,78 @@ CreateScopeTable(JSContext *cx, JSScope *scope, JSBool report)
          * event, let's try to grow, overallocating to hold at least twice the
          * current population.
          */
-        sizeLog2 = JS_CeilingLog2(2 * scope->entryCount);
-        scope->hashShift = JS_DHASH_BITS - sizeLog2;
+        sizeLog2 = JS_CeilingLog2(2 * entryCount);
+        hashShift = JS_DHASH_BITS - sizeLog2;
     } else {
-        JS_ASSERT(scope->hashShift == JS_DHASH_BITS - MIN_SCOPE_SIZE_LOG2);
+        JS_ASSERT(hashShift == JS_DHASH_BITS - MIN_SCOPE_SIZE_LOG2);
         sizeLog2 = MIN_SCOPE_SIZE_LOG2;
     }
 
-    scope->table = (JSScopeProperty **)
-        calloc(JS_BIT(sizeLog2), sizeof(JSScopeProperty *));
-    if (!scope->table) {
+    table = (JSScopeProperty **) js_calloc(JS_BIT(sizeLog2) * sizeof(JSScopeProperty *));
+    if (!table) {
         if (report)
             JS_ReportOutOfMemory(cx);
-        return JS_FALSE;
+        return false;
     }
-    js_UpdateMallocCounter(cx, JS_BIT(sizeLog2) * sizeof(JSScopeProperty *));
+    cx->updateMallocCounter(JS_BIT(sizeLog2) * sizeof(JSScopeProperty *));
 
-    scope->hashShift = JS_DHASH_BITS - sizeLog2;
-    for (sprop = scope->lastProp; sprop; sprop = sprop->parent) {
-        spp = js_SearchScope(scope, sprop->id, JS_TRUE);
+    hashShift = JS_DHASH_BITS - sizeLog2;
+    for (sprop = lastProp; sprop; sprop = sprop->parent) {
+        spp = search(sprop->id, true);
         SPROP_STORE_PRESERVING_COLLISION(spp, sprop);
     }
-    return JS_TRUE;
+    return true;
 }
 
 JSScope *
-js_NewScope(JSContext *cx, JSObjectOps *ops, JSClass *clasp, JSObject *obj)
+JSScope::create(JSContext *cx, const JSObjectOps *ops, JSClass *clasp,
+                JSObject *obj, uint32 shape)
 {
     JS_ASSERT(OPS_IS_NATIVE(ops));
     JS_ASSERT(obj);
 
-    JSScope *scope = (JSScope *) JS_malloc(cx, sizeof(JSScope));
+    JSScope *scope = cx->create<JSScope>(ops, obj);
     if (!scope)
         return NULL;
 
-    scope->map.ops = ops;
-    scope->object = obj;
     scope->nrefs = 1;
     scope->freeslot = JSSLOT_FREE(clasp);
-    scope->flags = 0;
-    InitMinimalScope(cx, scope);
+    scope->flags = cx->runtime->gcRegenShapesScopeFlag;
+    js_LeaveTraceIfGlobalObject(cx, obj);
+    scope->initMinimal(cx, shape);
+
+#ifdef JS_THREADSAFE
+    js_InitTitle(cx, &scope->title);
+#endif
+    JS_RUNTIME_METER(cx->runtime, liveScopes);
+    JS_RUNTIME_METER(cx->runtime, totalScopes);
+    return scope;
+}
+
+JSEmptyScope *
+JSScope::createEmptyScope(JSContext *cx, JSClass *clasp)
+{
+    JS_ASSERT(!emptyScope);
+
+    JSEmptyScope *scope = cx->create<JSEmptyScope>(ops, clasp);
+    if (!scope)
+        return NULL;
+
+    /*
+     * This scope holds a reference to the new empty scope. Our only caller,
+     * getEmptyScope, also promises to incref on behalf of its caller.
+     */
+    scope->nrefs = 2;
+    scope->freeslot = JSSLOT_FREE(clasp);
+    scope->flags = OWN_SHAPE | cx->runtime->gcRegenShapesScopeFlag;
+    scope->initMinimal(cx, js_GenerateShape(cx, false));
 
 #ifdef JS_THREADSAFE
     js_InitTitle(cx, &scope->title);
 #endif
     JS_RUNTIME_METER(cx->runtime, liveScopes);
     JS_RUNTIME_METER(cx->runtime, totalScopes);
+    emptyScope = scope;
     return scope;
 }
 
@@ -192,39 +244,19 @@ js_NewScope(JSContext *cx, JSObjectOps *ops, JSClass *clasp, JSObject *obj)
 #endif
 
 void
-js_DestroyScope(JSContext *cx, JSScope *scope)
+JSScope::destroy(JSContext *cx, JSScope *scope)
 {
 #ifdef JS_THREADSAFE
     js_FinishTitle(cx, &scope->title);
 #endif
     if (scope->table)
-        JS_free(cx, scope->table);
+        cx->free(scope->table);
+    if (scope->emptyScope)
+        scope->emptyScope->drop(cx, NULL);
 
     LIVE_SCOPE_METER(cx, cx->runtime->liveScopeProps -= scope->entryCount);
     JS_RUNTIME_UNMETER(cx->runtime, liveScopes);
-    JS_free(cx, scope);
-}
-
-void
-js_HoldScope(JSScope *scope)
-{
-    JS_ASSERT(scope->nrefs >= 0);
-    JS_ATOMIC_INCREMENT(&scope->nrefs);
-}
-
-JSBool
-js_DropScope(JSContext *cx, JSScope *scope, JSObject *obj)
-{
-    JS_ASSERT(scope->nrefs > 0);
-    JS_ATOMIC_DECREMENT(&scope->nrefs);
-
-    if (scope->nrefs == 0) {
-        js_DestroyScope(cx, scope);
-        return false;
-    }
-    if (scope->object == obj)
-        scope->object = NULL;
-    return true;
+    cx->free(scope);
 }
 
 #ifdef JS_DUMP_PROPTREE_STATS
@@ -276,34 +308,21 @@ JS_STATIC_ASSERT(sizeof(jsid) == JS_BYTES_PER_WORD);
 #define SCOPE_HASH1(hash0,shift)        ((hash0) >> (shift))
 #define SCOPE_HASH2(hash0,log2,shift)   ((((hash0) << (log2)) >> (shift)) | 1)
 
-JS_FRIEND_API(JSScopeProperty **)
-js_SearchScope(JSScope *scope, jsid id, JSBool adding)
+JSScopeProperty **
+JSScope::searchTable(jsid id, bool adding)
 {
     JSHashNumber hash0, hash1, hash2;
-    int hashShift, sizeLog2;
+    int sizeLog2;
     JSScopeProperty *stored, *sprop, **spp, **firstRemoved;
     uint32 sizeMask;
 
-    METER(searches);
-    if (!scope->table) {
-        /* Not enough properties to justify hashing: search from lastProp. */
-        JS_ASSERT(!SCOPE_HAD_MIDDLE_DELETE(scope));
-        for (spp = &scope->lastProp; (sprop = *spp); spp = &sprop->parent) {
-            if (sprop->id == id) {
-                METER(hits);
-                return spp;
-            }
-        }
-        METER(misses);
-        return spp;
-    }
+    JS_ASSERT(table);
 
     /* Compute the primary hash address. */
     METER(hashes);
     hash0 = SCOPE_HASH0(id);
-    hashShift = scope->hashShift;
     hash1 = SCOPE_HASH1(hash0, hashShift);
-    spp = scope->table + hash1;
+    spp = table + hash1;
 
     /* Miss: return space for a new entry. */
     stored = *spp;
@@ -337,7 +356,7 @@ js_SearchScope(JSScope *scope, jsid id, JSBool adding)
         METER(steps);
         hash1 -= hash2;
         hash1 &= sizeMask;
-        spp = scope->table + hash1;
+        spp = table + hash1;
 
         stored = *spp;
         if (SPROP_IS_FREE(stored)) {
@@ -364,33 +383,31 @@ js_SearchScope(JSScope *scope, jsid id, JSBool adding)
     return NULL;
 }
 
-static JSBool
-ChangeScope(JSContext *cx, JSScope *scope, int change)
+bool
+JSScope::changeTable(JSContext *cx, int change)
 {
     int oldlog2, newlog2;
     uint32 oldsize, newsize, nbytes;
-    JSScopeProperty **table, **oldtable, **spp, **oldspp, *sprop;
+    JSScopeProperty **newtable, **oldtable, **spp, **oldspp, *sprop;
 
-    if (!scope->table)
-        return CreateScopeTable(cx, scope, JS_TRUE);
+    if (!table)
+        return createTable(cx, true);
 
-    /* Grow, shrink, or compress by changing scope->table. */
-    oldlog2 = JS_DHASH_BITS - scope->hashShift;
+    /* Grow, shrink, or compress by changing this->table. */
+    oldlog2 = JS_DHASH_BITS - hashShift;
     newlog2 = oldlog2 + change;
     oldsize = JS_BIT(oldlog2);
     newsize = JS_BIT(newlog2);
     nbytes = SCOPE_TABLE_NBYTES(newsize);
-    table = (JSScopeProperty **) calloc(nbytes, 1);
-    if (!table) {
-        JS_ReportOutOfMemory(cx);
-        return JS_FALSE;
-    }
+    newtable = (JSScopeProperty **) cx->calloc(nbytes);
+    if (!newtable)
+        return false;
 
-    /* Now that we have a new table allocated, update scope members. */
-    scope->hashShift = JS_DHASH_BITS - newlog2;
-    scope->removedCount = 0;
-    oldtable = scope->table;
-    scope->table = table;
+    /* Now that we have newtable allocated, update members. */
+    hashShift = JS_DHASH_BITS - newlog2;
+    removedCount = 0;
+    oldtable = table;
+    table = newtable;
 
     /* Treat the above calloc as a JS_malloc, to match CreateScopeTable. */
     cx->runtime->gcMallocBytes += nbytes;
@@ -399,7 +416,7 @@ ChangeScope(JSContext *cx, JSScope *scope, int change)
     for (oldspp = oldtable; oldsize != 0; oldspp++) {
         sprop = SPROP_FETCH(oldspp);
         if (sprop) {
-            spp = js_SearchScope(scope, sprop->id, JS_TRUE);
+            spp = search(sprop->id, true);
             JS_ASSERT(SPROP_IS_FREE(*spp));
             *spp = sprop;
         }
@@ -407,8 +424,8 @@ ChangeScope(JSContext *cx, JSScope *scope, int change)
     }
 
     /* Finally, free the old table storage. */
-    JS_free(cx, oldtable);
-    return JS_TRUE;
+    cx->free(oldtable);
+    return true;
 }
 
 /*
@@ -557,7 +574,7 @@ NewPropTreeKidsChunk(JSRuntime *rt)
 {
     PropTreeKidsChunk *chunk;
 
-    chunk = (PropTreeKidsChunk *) calloc(1, sizeof *chunk);
+    chunk = (PropTreeKidsChunk *) js_calloc(sizeof *chunk);
     if (!chunk)
         return NULL;
     JS_ASSERT(((jsuword)chunk & CHUNKY_KIDS_TAG) == 0);
@@ -571,11 +588,11 @@ DestroyPropTreeKidsChunk(JSRuntime *rt, PropTreeKidsChunk *chunk)
     JS_RUNTIME_UNMETER(rt, propTreeKidsChunks);
     if (chunk->table)
         JS_DHashTableDestroy(chunk->table);
-    free(chunk);
+    js_free(chunk);
 }
 
 /* NB: Called with rt->gcLock held. */
-static JSBool
+static bool
 InsertPropertyTreeChild(JSRuntime *rt, JSScopeProperty *parent,
                         JSScopeProperty *child, PropTreeKidsChunk *sweptChunk)
 {
@@ -592,7 +609,7 @@ InsertPropertyTreeChild(JSRuntime *rt, JSScopeProperty *parent,
         entry = (JSPropertyTreeEntry *)
                 JS_DHashTableOperate(table, child, JS_DHASH_ADD);
         if (!entry)
-            return JS_FALSE;
+            return false;
         childp = &entry->child;
         sprop = *childp;
         if (!sprop) {
@@ -629,7 +646,7 @@ InsertPropertyTreeChild(JSRuntime *rt, JSScopeProperty *parent,
                     entry = (JSPropertyTreeEntry *)
                             JS_DHashTableOperate(table, child, JS_DHASH_ADD);
                     if (!entry)
-                        return JS_FALSE;
+                        return false;
                     if (!entry->child) {
                         entry->child = child;
                         while (chunk->next)
@@ -673,7 +690,7 @@ InsertPropertyTreeChild(JSRuntime *rt, JSScopeProperty *parent,
                 } else {
                     chunk = NewPropTreeKidsChunk(rt);
                     if (!chunk)
-                        return JS_FALSE;
+                        return false;
                 }
                 *chunkp = chunk;
                 childp = &chunk->kids[0];
@@ -694,7 +711,7 @@ InsertPropertyTreeChild(JSRuntime *rt, JSScopeProperty *parent,
                 } else {
                     chunk = NewPropTreeKidsChunk(rt);
                     if (!chunk)
-                        return JS_FALSE;
+                        return false;
                 }
                 parent->kids = CHUNK_TO_KIDS(chunk);
                 chunk->kids[0] = sprop;
@@ -706,7 +723,7 @@ InsertPropertyTreeChild(JSRuntime *rt, JSScopeProperty *parent,
     }
 
     child->parent = parent;
-    return JS_TRUE;
+    return true;
 }
 
 /* NB: Called with rt->gcLock held. */
@@ -930,7 +947,7 @@ locked_not_found:
     sprop->flags = child->flags;
     sprop->shortid = child->shortid;
     sprop->parent = sprop->kids = NULL;
-    sprop->shape = js_GenerateShape(cx, JS_TRUE);
+    sprop->shape = js_GenerateShape(cx, true);
 
     if (!parent) {
         entry->child = sprop;
@@ -956,7 +973,7 @@ out_of_memory:
     JS_END_MACRO
 
 static void
-CheckAncestorLine(JSScope *scope, JSBool sparse)
+CheckAncestorLine(JSScope *scope, bool sparse)
 {
     uint32 size;
     JSScopeProperty **spp, **start, **end, *ancestorLine, *sprop, *aprop;
@@ -964,7 +981,7 @@ CheckAncestorLine(JSScope *scope, JSBool sparse)
 
     ancestorLine = SCOPE_LAST_PROP(scope);
     if (ancestorLine)
-        JS_ASSERT(SCOPE_HAS_PROPERTY(scope, ancestorLine));
+        JS_ASSERT(scope->has(ancestorLine));
 
     entryCount = 0;
     size = SCOPE_CAPACITY(scope);
@@ -984,8 +1001,7 @@ CheckAncestorLine(JSScope *scope, JSBool sparse)
 
     ancestorCount = 0;
     for (sprop = ancestorLine; sprop; sprop = sprop->parent) {
-        if (SCOPE_HAD_MIDDLE_DELETE(scope) &&
-            !SCOPE_HAS_PROPERTY(scope, sprop)) {
+        if (scope->hadMiddleDelete() && !scope->has(sprop)) {
             JS_ASSERT(sparse);
             continue;
         }
@@ -997,13 +1013,13 @@ CheckAncestorLine(JSScope *scope, JSBool sparse)
 #define CHECK_ANCESTOR_LINE(scope, sparse) /* nothing */
 #endif
 
-static void
-ReportReadOnlyScope(JSContext *cx, JSScope *scope)
+void
+JSScope::reportReadOnlyScope(JSContext *cx)
 {
     JSString *str;
     const char *bytes;
 
-    str = js_ValueToString(cx, OBJECT_TO_JSVAL(scope->object));
+    str = js_ValueToString(cx, OBJECT_TO_JSVAL(object));
     if (!str)
         return;
     bytes = js_GetStringBytes(cx, str);
@@ -1012,18 +1028,33 @@ ReportReadOnlyScope(JSContext *cx, JSScope *scope)
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_READ_ONLY, bytes);
 }
 
+void
+JSScope::generateOwnShape(JSContext *cx)
+{
+    if (object)
+        js_LeaveTraceIfGlobalObject(cx, object);
+
+    shape = js_GenerateShape(cx, false);
+    setOwnShape();
+}
+
 JSScopeProperty *
-js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
-                    JSPropertyOp getter, JSPropertyOp setter, uint32 slot,
-                    uintN attrs, uintN flags, intN shortid)
+JSScope::add(JSContext *cx, jsid id,
+             JSPropertyOp getter, JSPropertyOp setter,
+             uint32 slot, uintN attrs,
+             uintN flags, intN shortid)
 {
     JSScopeProperty **spp, *sprop, *overwriting, **spvec, **spp2, child;
     uint32 size, splen, i;
     int change;
     JSTempValueRooter tvr;
 
-    JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, scope));
-    CHECK_ANCESTOR_LINE(scope, JS_TRUE);
+    JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, this));
+    CHECK_ANCESTOR_LINE(this, true);
+
+    JS_ASSERT(!JSVAL_IS_NULL(id));
+    JS_ASSERT_IF(!cx->runtime->gcRegenShapes,
+                 hasRegenFlag(cx->runtime->gcRegenShapesScopeFlag));
 
     /*
      * You can't add properties to a sealed scope.  But note well that you can
@@ -1031,8 +1062,8 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
      * a JSScopeProperty * in the scope's hash table -- but no id is added, so
      * the scope remains sealed.
      */
-    if (SCOPE_IS_SEALED(scope)) {
-        ReportReadOnlyScope(cx, scope);
+    if (sealed()) {
+        reportReadOnlyScope(cx);
         return NULL;
     }
 
@@ -1049,29 +1080,29 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
      * Search for id in order to claim its entry, allocating a property tree
      * node if one doesn't already exist for our parameters.
      */
-    spp = js_SearchScope(scope, id, JS_TRUE);
+    spp = search(id, true);
     sprop = overwriting = SPROP_FETCH(spp);
     if (!sprop) {
         /* Check whether we need to grow, if the load factor is >= .75. */
-        size = SCOPE_CAPACITY(scope);
-        if (scope->entryCount + scope->removedCount >= size - (size >> 2)) {
-            if (scope->removedCount >= size >> 2) {
+        size = SCOPE_CAPACITY(this);
+        if (entryCount + removedCount >= size - (size >> 2)) {
+            if (removedCount >= size >> 2) {
                 METER(compresses);
                 change = 0;
             } else {
                 METER(grows);
                 change = 1;
             }
-            if (!ChangeScope(cx, scope, change) &&
-                scope->entryCount + scope->removedCount == size - 1) {
+            if (!changeTable(cx, change) &&
+                entryCount + removedCount == size - 1) {
                 METER(addFailures);
                 return NULL;
             }
-            spp = js_SearchScope(scope, id, JS_TRUE);
+            spp = search(id, true);
             JS_ASSERT(!SPROP_FETCH(spp));
         }
     } else {
-        /* Property exists: js_SearchScope must have returned a valid entry. */
+        /* Property exists: JSScope::search must have returned a valid *spp. */
         JS_ASSERT(!SPROP_IS_REMOVED(*spp));
 
         /*
@@ -1082,7 +1113,7 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
          */
         if (!(attrs & JSPROP_SHARED) &&
             slot == SPROP_INVALID_SLOT &&
-            SPROP_HAS_VALID_SLOT(sprop, scope)) {
+            SPROP_HAS_VALID_SLOT(sprop, this)) {
             slot = sprop->slot;
         }
         if (SPROP_MATCH_PARAMS_AFTER_ID(sprop, getter, setter, slot, attrs,
@@ -1094,9 +1125,9 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
         /*
          * If we are clearing sprop to force the existing property that it
          * describes to be overwritten, then we have to unlink sprop from the
-         * ancestor line at scope->lastProp, lazily if sprop is not lastProp.
+         * ancestor line at this->lastProp, lazily if sprop is not lastProp.
          * And we must remove the entry at *spp, precisely so the lazy "middle
-         * delete" fixup code further below won't find sprop in scope->table,
+         * delete" fixup code further below won't find sprop in this->table,
          * in spite of sprop being on the ancestor line.
          *
          * When we finally succeed in finding or creating a new sprop
@@ -1105,53 +1136,52 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
          * indeed creating a new entry, or merely overwriting an existing
          * property.
          */
-        if (sprop == SCOPE_LAST_PROP(scope)) {
+        if (sprop == SCOPE_LAST_PROP(this)) {
             do {
-                SCOPE_REMOVE_LAST_PROP(scope);
-                if (!SCOPE_HAD_MIDDLE_DELETE(scope))
+                SCOPE_REMOVE_LAST_PROP(this);
+                if (!hadMiddleDelete())
                     break;
-                sprop = SCOPE_LAST_PROP(scope);
-            } while (sprop && !SCOPE_HAS_PROPERTY(scope, sprop));
-        } else if (!SCOPE_HAD_MIDDLE_DELETE(scope)) {
+                sprop = SCOPE_LAST_PROP(this);
+            } while (sprop && !has(sprop));
+        } else if (!hadMiddleDelete()) {
             /*
              * If we have no hash table yet, we need one now.  The middle
              * delete code is simple-minded that way!
              */
-            if (!scope->table) {
-                if (!CreateScopeTable(cx, scope, JS_TRUE))
+            if (!table) {
+                if (!createTable(cx, true))
                     return NULL;
-                spp = js_SearchScope(scope, id, JS_TRUE);
+                spp = search(id, true);
                 sprop = overwriting = SPROP_FETCH(spp);
             }
-            SCOPE_SET_MIDDLE_DELETE(scope);
+            setMiddleDelete();
         }
-        js_MakeScopeShapeUnique(cx, scope);
 
         /*
          * If we fail later on trying to find or create a new sprop, we will
          * goto fail_overwrite and restore *spp from |overwriting|.  Note that
-         * we don't bother to keep scope->removedCount in sync, because we'll
-         * fix up *spp and scope->entryCount shortly, no matter how control
+         * we don't bother to keep this->removedCount in sync, because we'll
+         * fix up *spp and this->entryCount shortly, no matter how control
          * flow returns from this function.
          */
-        if (scope->table)
+        if (table)
             SPROP_STORE_PRESERVING_COLLISION(spp, NULL);
-        scope->entryCount--;
-        CHECK_ANCESTOR_LINE(scope, JS_TRUE);
+        entryCount--;
+        CHECK_ANCESTOR_LINE(this, true);
         sprop = NULL;
     }
 
     if (!sprop) {
         /*
          * If properties were deleted from the middle of the list starting at
-         * scope->lastProp, we may need to fork the property tree and squeeze
-         * all deleted properties out of scope's ancestor line.  Otherwise we
-         * risk adding a node with the same id as a "middle" node, violating
+         * this->lastProp, we may need to fork the property tree and squeeze
+         * all deleted properties out of this scope's ancestor line. Otherwise
+         * we risk adding a node with the same id as a "middle" node, violating
          * the rule that properties along an ancestor line have distinct ids.
          */
-        if (SCOPE_HAD_MIDDLE_DELETE(scope)) {
-            JS_ASSERT(scope->table);
-            CHECK_ANCESTOR_LINE(scope, JS_TRUE);
+        if (hadMiddleDelete()) {
+            JS_ASSERT(table);
+            CHECK_ANCESTOR_LINE(this, true);
 
             /*
              * Our forking heuristic tries to balance the desire to avoid
@@ -1167,8 +1197,8 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
 
             bool conflicts = false;
             uint32 count = 0;
-            uint32 threshold = JS_BIT(JS_CeilingLog2(scope->entryCount));
-            for (sprop = SCOPE_LAST_PROP(scope); sprop; sprop = sprop->parent) {
+            uint32 threshold = JS_BIT(JS_CeilingLog2(entryCount));
+            for (sprop = SCOPE_LAST_PROP(this); sprop; sprop = sprop->parent) {
                 ++count;
                 if (sprop->id == id) {
                     conflicts = true;
@@ -1178,27 +1208,27 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
 
             if (conflicts || count > threshold) {
                 /*
-                 * Enumerate live entries in scope->table using a temporary
+                 * Enumerate live entries in this->table using a temporary
                  * vector, by walking the (possibly sparse, due to deletions)
-                 * ancestor line from scope->lastProp.
+                 * ancestor line from this->lastProp.
                  */
-                splen = scope->entryCount;
+                splen = entryCount;
                 JS_ASSERT(splen != 0);
                 spvec = (JSScopeProperty **)
-                        JS_malloc(cx, SCOPE_TABLE_NBYTES(splen));
+                        cx->malloc(SCOPE_TABLE_NBYTES(splen));
                 if (!spvec)
                     goto fail_overwrite;
                 i = splen;
-                sprop = SCOPE_LAST_PROP(scope);
+                sprop = SCOPE_LAST_PROP(this);
                 JS_ASSERT(sprop);
                 do {
                     /*
-                     * NB: test SCOPE_GET_PROPERTY, not SCOPE_HAS_PROPERTY,
-                     * as the latter macro insists that sprop->id maps to
-                     * sprop, while the former simply tests whether sprop->id
-                     * is bound in scope.
+                     * NB: use JSScope::lookup, not JSScope::has, as the latter
+                     * macro insists that sprop->id maps to sprop, while the
+                     * former simply tests whether sprop->id is bound in this
+                     * scope.
                      */
-                    if (!SCOPE_GET_PROPERTY(scope, sprop->id))
+                    if (!lookup(sprop->id))
                         continue;
 
                     JS_ASSERT(sprop != overwriting);
@@ -1209,8 +1239,8 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
 
                 /*
                  * Now loop forward through spvec, forking the property tree
-                 * whenever we see a "parent gap" due to deletions from scope.
-                 * NB: sprop is null on first entry to the loop body.
+                 * whenever we see a "parent gap" due to deletions from this
+                 * scope. NB: sprop is null on first entry to the loop body.
                  */
                 do {
                     if (spvec[i]->parent == sprop) {
@@ -1218,26 +1248,26 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
                     } else {
                         sprop = GetPropertyTreeChild(cx, sprop, spvec[i]);
                         if (!sprop) {
-                            JS_free(cx, spvec);
+                            cx->free(spvec);
                             goto fail_overwrite;
                         }
 
-                        spp2 = js_SearchScope(scope, sprop->id, JS_FALSE);
+                        spp2 = search(sprop->id, false);
                         JS_ASSERT(SPROP_FETCH(spp2) == spvec[i]);
                         SPROP_STORE_PRESERVING_COLLISION(spp2, sprop);
                     }
                 } while (++i < splen);
-                JS_free(cx, spvec);
+                cx->free(spvec);
 
                 /*
-                 * Now sprop points to the last property in scope, where the
-                 * ancestor line from sprop to the root is dense w.r.t. scope:
-                 * it contains no nodes not mapped by scope->table.
+                 * Now sprop points to the last property in this scope, where
+                 * the ancestor line from sprop to the root is dense w.r.t.
+                 * this scope: it contains no nodes not mapped by this->table.
                  */
-                scope->lastProp = sprop;
-                CHECK_ANCESTOR_LINE(scope, JS_FALSE);
+                lastProp = sprop;
+                CHECK_ANCESTOR_LINE(this, false);
                 JS_RUNTIME_METER(cx->runtime, middleDeleteFixups);
-                SCOPE_CLR_MIDDLE_DELETE(scope);
+                clearMiddleDelete();
             }
         }
 
@@ -1258,7 +1288,7 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
                  * Similarly, we use a specific slot if provided by the caller.
                  */
                 if (slot == SPROP_INVALID_SLOT &&
-                    !js_AllocSlot(cx, scope->object, &slot)) {
+                    !js_AllocSlot(cx, object, &slot)) {
                     goto fail_overwrite;
                 }
             }
@@ -1270,7 +1300,7 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
          * XXXbe this could get expensive with lots of watchpoints...
          */
         if (!JS_CLIST_IS_EMPTY(&cx->runtime->watchPointList) &&
-            js_FindWatchPoint(cx->runtime, scope, id)) {
+            js_FindWatchPoint(cx->runtime, this, id)) {
             if (overwriting)
                 JS_PUSH_TEMP_ROOT_SPROP(cx, overwriting, &tvr);
             setter = js_WrapWatchedSetter(cx, id, attrs, setter);
@@ -1288,23 +1318,21 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
         child.attrs = attrs;
         child.flags = flags;
         child.shortid = shortid;
-        sprop = GetPropertyTreeChild(cx, scope->lastProp, &child);
+        sprop = GetPropertyTreeChild(cx, lastProp, &child);
         if (!sprop)
             goto fail_overwrite;
 
         /*
-         * The scope's shape defaults to its last property's shape, but may
-         * be regenerated later as the scope diverges (from the property cache
+         * This scope's shape defaults to its last property's shape, but may be
+         * regenerated later as this scope diverges (from the property cache
          * point of view) from the structural type associated with sprop.
          */
-        js_ExtendScopeShape(cx, scope, sprop);
+        extend(cx, sprop);
 
         /* Store the tree node pointer in the table entry for id. */
-        if (scope->table)
+        if (table)
             SPROP_STORE_PRESERVING_COLLISION(spp, sprop);
-        scope->entryCount++;
-        scope->lastProp = sprop;
-        CHECK_ANCESTOR_LINE(scope, JS_FALSE);
+        CHECK_ANCESTOR_LINE(this, false);
 #ifdef DEBUG
         if (!overwriting) {
             LIVE_SCOPE_METER(cx, ++cx->runtime->liveScopeProps);
@@ -1313,20 +1341,20 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
 #endif
 
         /*
-         * If we reach the hashing threshold, try to allocate scope->table.
+         * If we reach the hashing threshold, try to allocate this->table.
          * If we can't (a rare event, preceded by swapping to death on most
          * modern OSes), stick with linear search rather than whining about
-         * this little set-back.  Therefore we must test !scope->table and
-         * scope->entryCount >= SCOPE_HASH_THRESHOLD, not merely whether the
+         * this little set-back.  Therefore we must test !this->table and
+         * this->entryCount >= SCOPE_HASH_THRESHOLD, not merely whether the
          * entry count just reached the threshold.
          */
-        if (!scope->table && scope->entryCount >= SCOPE_HASH_THRESHOLD)
-            (void) CreateScopeTable(cx, scope, JS_FALSE);
+        if (!table && entryCount >= SCOPE_HASH_THRESHOLD)
+            (void) createTable(cx, false);
     }
 
     jsuint index;
     if (js_IdIsIndex(sprop->id, &index))
-        SCOPE_SET_INDEXED_PROPERTIES(scope);
+        setIndexedProperties();
 
     METER(adds);
     return sprop;
@@ -1334,23 +1362,23 @@ js_AddScopeProperty(JSContext *cx, JSScope *scope, jsid id,
 fail_overwrite:
     if (overwriting) {
         /*
-         * We may or may not have forked overwriting out of scope's ancestor
-         * line, so we must check (the alternative is to set a flag above, but
-         * that hurts the common, non-error case).  If we did fork overwriting
-         * out, we'll add it back at scope->lastProp.  This means enumeration
-         * order can change due to a failure to overwrite an id.
-         * XXXbe very minor incompatibility
+         * We may or may not have forked overwriting out of this scope's
+         * ancestor line, so we must check (the alternative is to set a flag
+         * above, but that hurts the common, non-error case). If we did fork
+         * overwriting out, we'll add it back at scope->lastProp. This means
+         * enumeration order can change due to a failure to overwrite an id.
+         * XXXbe minor(?) incompatibility
          */
-        for (sprop = SCOPE_LAST_PROP(scope); ; sprop = sprop->parent) {
+        for (sprop = SCOPE_LAST_PROP(this); ; sprop = sprop->parent) {
             if (!sprop) {
-                sprop = SCOPE_LAST_PROP(scope);
+                sprop = SCOPE_LAST_PROP(this);
                 if (overwriting->parent == sprop) {
-                    scope->lastProp = overwriting;
+                    lastProp = overwriting;
                 } else {
                     sprop = GetPropertyTreeChild(cx, sprop, overwriting);
                     if (sprop) {
                         JS_ASSERT(sprop != overwriting);
-                        scope->lastProp = sprop;
+                        lastProp = sprop;
                     }
                     overwriting = sprop;
                 }
@@ -1360,24 +1388,24 @@ fail_overwrite:
                 break;
         }
         if (overwriting) {
-            if (scope->table)
+            if (table)
                 SPROP_STORE_PRESERVING_COLLISION(spp, overwriting);
-            scope->entryCount++;
+            entryCount++;
         }
-        CHECK_ANCESTOR_LINE(scope, JS_TRUE);
+        CHECK_ANCESTOR_LINE(this, true);
     }
     METER(addFailures);
     return NULL;
 }
 
 JSScopeProperty *
-js_ChangeScopePropertyAttrs(JSContext *cx, JSScope *scope,
-                            JSScopeProperty *sprop, uintN attrs, uintN mask,
-                            JSPropertyOp getter, JSPropertyOp setter)
+JSScope::change(JSContext *cx, JSScopeProperty *sprop,
+                uintN attrs, uintN mask,
+                JSPropertyOp getter, JSPropertyOp setter)
 {
     JSScopeProperty child, *newsprop, **spp;
 
-    CHECK_ANCESTOR_LINE(scope, JS_TRUE);
+    CHECK_ANCESTOR_LINE(this, true);
 
     /* Allow only shared (slot-less) => unshared (slot-full) transition. */
     attrs |= sprop->attrs & mask;
@@ -1401,47 +1429,44 @@ js_ChangeScopePropertyAttrs(JSContext *cx, JSScope *scope,
     child.flags = sprop->flags;
     child.shortid = sprop->shortid;
 
-    if (SCOPE_LAST_PROP(scope) == sprop) {
+    if (SCOPE_LAST_PROP(this) == sprop) {
         /*
-         * Optimize the case where the last property added to scope is changed
-         * to have a different attrs, getter, or setter.  In the last property
-         * case, we need not fork the property tree.  But since we do not call
-         * js_AddScopeProperty, we may need to allocate a new slot directly.
+         * Optimize the case where the last property added to this scope is
+         * changed to have a different attrs, getter, or setter. In the last
+         * property case, we need not fork the property tree. But since we do
+         * not call JSScope::addProperty, we may need to allocate a new slot
+         * directly.
          */
         if ((sprop->attrs & JSPROP_SHARED) && !(attrs & JSPROP_SHARED)) {
             JS_ASSERT(child.slot == SPROP_INVALID_SLOT);
-            if (!js_AllocSlot(cx, scope->object, &child.slot))
+            if (!js_AllocSlot(cx, object, &child.slot))
                 return NULL;
         }
 
         newsprop = GetPropertyTreeChild(cx, sprop->parent, &child);
         if (newsprop) {
-            spp = js_SearchScope(scope, sprop->id, JS_FALSE);
+            spp = search(sprop->id, false);
             JS_ASSERT(SPROP_FETCH(spp) == sprop);
 
-            if (scope->table)
+            if (table)
                 SPROP_STORE_PRESERVING_COLLISION(spp, newsprop);
-            scope->lastProp = newsprop;
-            CHECK_ANCESTOR_LINE(scope, JS_TRUE);
+            lastProp = newsprop;
+            CHECK_ANCESTOR_LINE(this, true);
         }
     } else {
         /*
-         * Let js_AddScopeProperty handle this |overwriting| case, including
-         * the conservation of sprop->slot (if it's valid).  We must not call
-         * js_RemoveScopeProperty here, it will free a valid sprop->slot and
-         * js_AddScopeProperty won't re-allocate it.
+         * Let JSScope::addProperty handle this |overwriting| case, including
+         * the conservation of sprop->slot (if it's valid). We must not call
+         * JSScope::remove here, because it will free a valid sprop->slot and
+         * JSScope::add won't re-allocate it.
          */
-        newsprop = js_AddScopeProperty(cx, scope, child.id,
-                                       child.getter, child.setter, child.slot,
-                                       child.attrs, child.flags, child.shortid);
+        newsprop = add(cx, child.id, child.getter, child.setter, child.slot,
+                       child.attrs, child.flags, child.shortid);
     }
 
     if (newsprop) {
-        js_LeaveTraceIfGlobalObject(cx, scope->object);
-        if (scope->shape == sprop->shape)
-            scope->shape = newsprop->shape;
-        else
-            js_MakeScopeShapeUnique(cx, scope);
+        js_LeaveTraceIfGlobalObject(cx, object);
+        replacingShapeChange(cx, sprop, newsprop);
     }
 #ifdef JS_DUMP_PROPTREE_STATS
     else
@@ -1450,95 +1475,155 @@ js_ChangeScopePropertyAttrs(JSContext *cx, JSScope *scope,
     return newsprop;
 }
 
-JSBool
-js_RemoveScopeProperty(JSContext *cx, JSScope *scope, jsid id)
+bool
+JSScope::remove(JSContext *cx, jsid id)
 {
     JSScopeProperty **spp, *stored, *sprop;
     uint32 size;
 
-    JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, scope));
-    CHECK_ANCESTOR_LINE(scope, JS_TRUE);
-    if (SCOPE_IS_SEALED(scope)) {
-        ReportReadOnlyScope(cx, scope);
-        return JS_FALSE;
+    JS_ASSERT(JS_IS_SCOPE_LOCKED(cx, this));
+    CHECK_ANCESTOR_LINE(this, true);
+    if (sealed()) {
+        reportReadOnlyScope(cx);
+        return false;
     }
     METER(removes);
 
-    spp = js_SearchScope(scope, id, JS_FALSE);
+    spp = search(id, false);
     stored = *spp;
     sprop = SPROP_CLEAR_COLLISION(stored);
     if (!sprop) {
         METER(uselessRemoves);
-        return JS_TRUE;
+        return true;
     }
 
     /* Convert from a list to a hash so we can handle "middle deletes". */
-    if (!scope->table && sprop != scope->lastProp) {
-        if (!CreateScopeTable(cx, scope, JS_TRUE))
-            return JS_FALSE;
-        spp = js_SearchScope(scope, id, JS_FALSE);
+    if (!table && sprop != lastProp) {
+        if (!createTable(cx, true))
+            return false;
+        spp = search(id, false);
         stored = *spp;
         sprop = SPROP_CLEAR_COLLISION(stored);
     }
 
     /* First, if sprop is unshared and not cleared, free its slot number. */
-    if (SPROP_HAS_VALID_SLOT(sprop, scope)) {
-        js_FreeSlot(cx, scope->object, sprop->slot);
+    if (SPROP_HAS_VALID_SLOT(sprop, this)) {
+        js_FreeSlot(cx, object, sprop->slot);
         JS_ATOMIC_INCREMENT(&cx->runtime->propertyRemovals);
     }
 
     /* Next, remove id by setting its entry to a removed or free sentinel. */
     if (SPROP_HAD_COLLISION(stored)) {
-        JS_ASSERT(scope->table);
+        JS_ASSERT(table);
         *spp = SPROP_REMOVED;
-        scope->removedCount++;
+        removedCount++;
     } else {
         METER(removeFrees);
-        if (scope->table)
+        if (table)
             *spp = NULL;
     }
-    scope->entryCount--;
+    entryCount--;
     LIVE_SCOPE_METER(cx, --cx->runtime->liveScopeProps);
 
-    /* Update scope->lastProp directly, or set its deferred update flag. */
-    if (sprop == SCOPE_LAST_PROP(scope)) {
+    /* Update this->lastProp directly, or set its deferred update flag. */
+    if (sprop == SCOPE_LAST_PROP(this)) {
         do {
-            SCOPE_REMOVE_LAST_PROP(scope);
-            if (!SCOPE_HAD_MIDDLE_DELETE(scope))
+            SCOPE_REMOVE_LAST_PROP(this);
+            if (!hadMiddleDelete())
                 break;
-            sprop = SCOPE_LAST_PROP(scope);
-        } while (sprop && !SCOPE_HAS_PROPERTY(scope, sprop));
-        if (!SCOPE_LAST_PROP(scope))
-            SCOPE_CLR_MIDDLE_DELETE(scope);
-    } else if (!SCOPE_HAD_MIDDLE_DELETE(scope)) {
-        SCOPE_SET_MIDDLE_DELETE(scope);
+            sprop = SCOPE_LAST_PROP(this);
+        } while (sprop && !has(sprop));
+        if (!SCOPE_LAST_PROP(this))
+            clearMiddleDelete();
+    } else if (!hadMiddleDelete()) {
+        setMiddleDelete();
     }
-    js_MakeScopeShapeUnique(cx, scope);
-    CHECK_ANCESTOR_LINE(scope, JS_TRUE);
+    generateOwnShape(cx);
+    CHECK_ANCESTOR_LINE(this, true);
 
-    /* Last, consider shrinking scope's table if its load factor is <= .25. */
-    size = SCOPE_CAPACITY(scope);
-    if (size > MIN_SCOPE_SIZE && scope->entryCount <= size >> 2) {
+    /* Last, consider shrinking this->table if its load factor is <= .25. */
+    size = SCOPE_CAPACITY(this);
+    if (size > MIN_SCOPE_SIZE && entryCount <= size >> 2) {
         METER(shrinks);
-        (void) ChangeScope(cx, scope, -1);
+        (void) changeTable(cx, -1);
     }
 
-    return JS_TRUE;
+    return true;
 }
 
 void
-js_ClearScope(JSContext *cx, JSScope *scope)
+JSScope::clear(JSContext *cx)
 {
-    CHECK_ANCESTOR_LINE(scope, JS_TRUE);
-    LIVE_SCOPE_METER(cx, cx->runtime->liveScopeProps -= scope->entryCount);
+    CHECK_ANCESTOR_LINE(this, true);
+    LIVE_SCOPE_METER(cx, cx->runtime->liveScopeProps -= entryCount);
+
+    if (table)
+        js_free(table);
+    clearMiddleDelete();
+    js_LeaveTraceIfGlobalObject(cx, object);
+
+    JSClass *clasp = object->getClass();
+    JSObject *proto = object->getProto();
+    JSEmptyScope *emptyScope;
+    uint32 newShape;
+    if (proto &&
+        OBJ_IS_NATIVE(proto) &&
+        (emptyScope = OBJ_SCOPE(proto)->emptyScope) &&
+        emptyScope->clasp == clasp) {
+        newShape = emptyScope->shape;
+    } else {
+        newShape = js_GenerateShape(cx, false);
+    }
+    initMinimal(cx, newShape);
 
-    if (scope->table)
-        free(scope->table);
-    SCOPE_CLR_MIDDLE_DELETE(scope);
-    InitMinimalScope(cx, scope);
     JS_ATOMIC_INCREMENT(&cx->runtime->propertyRemovals);
 }
 
+void
+JSScope::brandingShapeChange(JSContext *cx, uint32 slot, jsval v)
+{
+    generateOwnShape(cx);
+}
+
+void
+JSScope::deletingShapeChange(JSContext *cx, JSScopeProperty *sprop)
+{
+    generateOwnShape(cx);
+}
+
+void
+JSScope::methodShapeChange(JSContext *cx, uint32 slot, jsval toval)
+{
+    generateOwnShape(cx);
+}
+
+void
+JSScope::protoShapeChange(JSContext *cx)
+{
+    generateOwnShape(cx);
+}
+
+void
+JSScope::replacingShapeChange(JSContext *cx, JSScopeProperty *sprop, JSScopeProperty *newsprop)
+{
+    if (shape == sprop->shape)
+        shape = newsprop->shape;
+    else
+        generateOwnShape(cx);
+}
+
+void
+JSScope::sealingShapeChange(JSContext *cx)
+{
+    generateOwnShape(cx);
+}
+
+void
+JSScope::shadowingShapeChange(JSContext *cx, JSScopeProperty *sprop)
+{
+    generateOwnShape(cx);
+}
+
 void
 js_TraceId(JSTracer *trc, jsid id)
 {
@@ -1575,23 +1660,22 @@ PrintPropertyGetterOrSetter(JSTracer *trc, char *buf, size_t bufsize)
 }
 #endif
 
-
 void
-js_TraceScopeProperty(JSTracer *trc, JSScopeProperty *sprop)
+JSScopeProperty::trace(JSTracer *trc)
 {
     if (IS_GC_MARKING_TRACER(trc))
-        sprop->flags |= SPROP_MARK;
-    TRACE_ID(trc, sprop->id);
+        flags |= SPROP_MARK;
+    js_TraceId(trc, id);
 
 #if JS_HAS_GETTER_SETTER
-    if (sprop->attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
-        if (sprop->attrs & JSPROP_GETTER) {
-            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, sprop, 0);
-            JS_CallTracer(trc, js_CastAsObject(sprop->getter), JSTRACE_OBJECT);
+    if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
+        if (attrs & JSPROP_GETTER) {
+            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, this, 0);
+            JS_CallTracer(trc, js_CastAsObject(getter), JSTRACE_OBJECT);
         }
-        if (sprop->attrs & JSPROP_SETTER) {
-            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, sprop, 1);
-            JS_CallTracer(trc, js_CastAsObject(sprop->setter), JSTRACE_OBJECT);
+        if (attrs & JSPROP_SETTER) {
+            JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, this, 1);
+            JS_CallTracer(trc, js_CastAsObject(setter), JSTRACE_OBJECT);
         }
     }
 #endif /* JS_HAS_GETTER_SETTER */
@@ -1757,10 +1841,12 @@ js_SweepScopeProperties(JSContext *cx)
              */
             if (sprop->flags & SPROP_MARK) {
                 sprop->flags &= ~SPROP_MARK;
-                if (sprop->flags & SPROP_FLAG_SHAPE_REGEN)
-                    sprop->flags &= ~SPROP_FLAG_SHAPE_REGEN;
-                else
-                    sprop->shape = js_RegenerateShapeForGC(cx);
+                if (rt->gcRegenShapes) {
+                    if (sprop->flags & SPROP_FLAG_SHAPE_REGEN)
+                        sprop->flags &= ~SPROP_FLAG_SHAPE_REGEN;
+                    else
+                        sprop->shape = js_RegenerateShapeForGC(cx);
+                }
                 liveCount++;
                 continue;
             }
@@ -1800,7 +1886,7 @@ js_SweepScopeProperties(JSContext *cx)
                 sprop->kids = NULL;
                 parent = sprop->parent;
 
-                /* Assert that grandparent has no kids or chunky kids. */
+                /* The grandparent must have either no kids or chunky kids. */
                 JS_ASSERT(!parent || !parent->kids ||
                           KIDS_IS_CHUNKY(parent->kids));
                 if (KIDS_IS_CHUNKY(kids)) {
@@ -1819,8 +1905,7 @@ js_SweepScopeProperties(JSContext *cx)
                              * re-use by InsertPropertyTreeChild.
                              */
                             chunk->kids[i] = NULL;
-                            if (!InsertPropertyTreeChild(rt, parent, kid,
-                                                         chunk)) {
+                            if (!InsertPropertyTreeChild(rt, parent, kid, chunk)) {
                                 /*
                                  * This can happen only if we failed to add an
                                  * entry to the root property hash table.
@@ -1942,17 +2027,17 @@ js_SweepScopeProperties(JSContext *cx)
 #endif
 }
 
-JSBool
+bool
 js_InitPropertyTree(JSRuntime *rt)
 {
     if (!JS_DHashTableInit(&rt->propertyTreeHash, &PropertyTreeHashOps, NULL,
                            sizeof(JSPropertyTreeEntry), JS_DHASH_MIN_SIZE)) {
         rt->propertyTreeHash.ops = NULL;
-        return JS_FALSE;
+        return false;
     }
     JS_INIT_ARENA_POOL(&rt->propertyArenaPool, "properties",
                        256 * sizeof(JSScopeProperty), sizeof(void *), NULL);
-    return JS_TRUE;
+    return true;
 }
 
 void