johnson 2.0.0.pre0 → 2.0.0.pre1

data/vendor/tracemonkey/jswince.asm

@@ -20,11 +20,25 @@ $FuncName
 $PrologName
     MEND
 
+    ;; -------- Functions to test processor features.
+    export  js_arm_try_thumb_op
     export  js_arm_try_armv6t2_op
+    export  js_arm_try_armv7_op
+    export  js_arm_try_armv6_op
+    export  js_arm_try_armv5_op
+    export  js_arm_try_vfp_op
+
+    ;; Test for Thumb support.
+    FUNC_HEADER js_arm_try_thumb_op
+    bx lr
+    mov pc, lr
+    ENTRY_END
+    endp
 
     ;; I'm not smart enough to figure out which flags to pass to armasm to get it
     ;; to understand movt and fmdrr/vmov; the disassembler figures them out just fine!
 
+    ;; Test for Thumb2 support.
     FUNC_HEADER js_arm_try_armv6t2_op
     ;; movt r0,#0xFFFF
     DCD 0xE34F0FFF
@@ -32,8 +46,7 @@ $PrologName
     ENTRY_END
     endp
 
-    export  js_arm_try_vfp_op
-
+    ;; Test for VFP support.
     FUNC_HEADER js_arm_try_vfp_op
     ;; fmdrr d0, r0, r1
     DCD 0xEC410B10
@@ -41,4 +54,29 @@ $PrologName
     ENTRY_END
     endp
 
+    ;; Tests for each architecture version.
+
+    FUNC_HEADER js_arm_try_armv7_op
+    ;; pli pc, #0
+    DCD 0xF45FF000
+    mov pc, lr
+    ENTRY_END
+    endp
+
+    FUNC_HEADER js_arm_try_armv6_op
+    ;; rev ip, ip
+    DCD 0xE6BFCF3C
+    mov pc, lr
+    ENTRY_END
+    endp
+
+    FUNC_HEADER js_arm_try_armv5_op
+    ;; clz ip, ip
+    DCD 0xE16FCF1C
+    mov pc, lr
+    ENTRY_END
+    endp
+
+    ;; --------
+
     end

data/vendor/tracemonkey/jsxdrapi.cpp

@@ -1,4 +1,4 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  *
  * ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
@@ -36,13 +36,13 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
-#include "jsstddef.h"
 #include "jsversion.h"
 
 #if JS_HAS_XDR
 
 #include <string.h>
 #include "jstypes.h"
+#include "jsstdint.h"
 #include "jsutil.h" /* Added by JSIFY */
 #include "jsdhash.h"
 #include "jsprf.h"
@@ -90,7 +90,7 @@ typedef struct JSXDRMemState {
             if (MEM_LIMIT(xdr) &&                                             \
                 MEM_COUNT(xdr) + bytes > MEM_LIMIT(xdr)) {                    \
                 uint32 limit_ = JS_ROUNDUP(MEM_COUNT(xdr) + bytes, MEM_BLOCK);\
-                void *data_ = JS_realloc((xdr)->cx, MEM_BASE(xdr), limit_);   \
+                void *data_ = (xdr)->cx->realloc(MEM_BASE(xdr), limit_);      \
                 if (!data_)                                                   \
                     return 0;                                                 \
                 MEM_BASE(xdr) = (char *) data_;                               \
@@ -216,7 +216,7 @@ mem_tell(JSXDRState *xdr)
 static void
 mem_finalize(JSXDRState *xdr)
 {
-    JS_free(xdr->cx, MEM_BASE(xdr));
+    xdr->cx->free(MEM_BASE(xdr));
 }
 
 static JSXDROps xdrmem_ops = {
@@ -239,13 +239,13 @@ JS_XDRInitBase(JSXDRState *xdr, JSXDRMode mode, JSContext *cx)
 JS_PUBLIC_API(JSXDRState *)
 JS_XDRNewMem(JSContext *cx, JSXDRMode mode)
 {
-    JSXDRState *xdr = (JSXDRState *) JS_malloc(cx, sizeof(JSXDRMemState));
+    JSXDRState *xdr = (JSXDRState *) cx->malloc(sizeof(JSXDRMemState));
     if (!xdr)
         return NULL;
     JS_XDRInitBase(xdr, mode, cx);
     if (mode == JSXDR_ENCODE) {
-        if (!(MEM_BASE(xdr) = (char *) JS_malloc(cx, MEM_BLOCK))) {
-            JS_free(cx, xdr);
+        if (!(MEM_BASE(xdr) = (char *) cx->malloc(MEM_BLOCK))) {
+            cx->free(xdr);
             return NULL;
         }
     } else {
@@ -299,11 +299,11 @@ JS_XDRDestroy(JSXDRState *xdr)
     JSContext *cx = xdr->cx;
     xdr->ops->finalize(xdr);
     if (xdr->registry) {
-        JS_free(cx, xdr->registry);
+        cx->free(xdr->registry);
         if (xdr->reghash)
             JS_DHashTableDestroy((JSDHashTable *) xdr->reghash);
     }
-    JS_free(cx, xdr);
+    cx->free(xdr);
 }
 
 JS_PUBLIC_API(JSBool)
@@ -381,18 +381,18 @@ JS_XDRCString(JSXDRState *xdr, char **sp)
         len = strlen(*sp);
     JS_XDRUint32(xdr, &len);
     if (xdr->mode == JSXDR_DECODE) {
-        if (!(*sp = (char *) JS_malloc(xdr->cx, len + 1)))
+        if (!(*sp = (char *) xdr->cx->malloc(len + 1)))
             return JS_FALSE;
     }
     if (!JS_XDRBytes(xdr, *sp, len)) {
         if (xdr->mode == JSXDR_DECODE)
-            JS_free(xdr->cx, *sp);
+            xdr->cx->free(*sp);
         return JS_FALSE;
     }
     if (xdr->mode == JSXDR_DECODE) {
         (*sp)[len] = '\0';
     } else if (xdr->mode == JSXDR_FREE) {
-        JS_free(xdr->cx, *sp);
+        xdr->cx->free(*sp);
         *sp = NULL;
     }
     return JS_TRUE;
@@ -447,16 +447,16 @@ JS_XDRString(JSXDRState *xdr, JSString **strp)
     jschar *chars;
 
     if (xdr->mode == JSXDR_ENCODE)
-        nchars = JSSTRING_LENGTH(*strp);
+        nchars = (*strp)->length();
     if (!JS_XDRUint32(xdr, &nchars))
         return JS_FALSE;
 
     if (xdr->mode == JSXDR_DECODE) {
-        chars = (jschar *) JS_malloc(xdr->cx, (nchars + 1) * sizeof(jschar));
+        chars = (jschar *) xdr->cx->malloc((nchars + 1) * sizeof(jschar));
         if (!chars)
             return JS_FALSE;
     } else {
-        chars = JSSTRING_CHARS(*strp);
+        chars = (*strp)->chars();
     }
 
     if (!XDRChars(xdr, chars, nchars))
@@ -471,7 +471,7 @@ JS_XDRString(JSXDRState *xdr, JSString **strp)
 
 bad:
     if (xdr->mode == JSXDR_DECODE)
-        JS_free(xdr->cx, chars);
+        xdr->cx->free(chars);
     return JS_FALSE;
 }
 
@@ -493,8 +493,7 @@ XDRDoubleValue(JSXDRState *xdr, jsdouble *dp)
 {
     jsdpun u;
 
-    if (xdr->mode == JSXDR_ENCODE)
-        u.d = *dp;
+    u.d = (xdr->mode == JSXDR_ENCODE) ? *dp : 0.0;
     if (!JS_XDRUint32(xdr, &u.s.lo) || !JS_XDRUint32(xdr, &u.s.hi))
         return JS_FALSE;
     if (xdr->mode == JSXDR_DECODE)
@@ -505,10 +504,7 @@ XDRDoubleValue(JSXDRState *xdr, jsdouble *dp)
 JS_PUBLIC_API(JSBool)
 JS_XDRDouble(JSXDRState *xdr, jsdouble **dpp)
 {
-    jsdouble d;
-
-    if (xdr->mode == JSXDR_ENCODE)
-        d = **dpp;
+    jsdouble d = (xdr->mode == JSXDR_ENCODE) ? **dpp : 0.0;
     if (!XDRDoubleValue(xdr, &d))
         return JS_FALSE;
     if (xdr->mode == JSXDR_DECODE) {
@@ -544,9 +540,7 @@ XDRValueBody(JSXDRState *xdr, uint32 type, jsval *vp)
         break;
       }
       case JSVAL_DOUBLE: {
-        jsdouble *dp;
-        if (xdr->mode == JSXDR_ENCODE)
-            dp = JSVAL_TO_DOUBLE(*vp);
+        jsdouble *dp = (xdr->mode == JSXDR_ENCODE) ? JSVAL_TO_DOUBLE(*vp) : NULL;
         if (!JS_XDRDouble(xdr, &dp))
             return JS_FALSE;
         if (xdr->mode == JSXDR_DECODE)
@@ -563,7 +557,7 @@ XDRValueBody(JSXDRState *xdr, uint32 type, jsval *vp)
             *vp = OBJECT_TO_JSVAL(obj);
         break;
       }
-      case JSVAL_BOOLEAN: {
+      case JSVAL_SPECIAL: {
         uint32 b;
         if (xdr->mode == JSXDR_ENCODE)
             b = (uint32) JSVAL_TO_BOOLEAN(*vp);
@@ -610,7 +604,6 @@ js_XDRAtom(JSXDRState *xdr, JSAtom **atomp)
 {
     jsval v;
     uint32 type;
-    jsdouble d;
 
     if (xdr->mode == JSXDR_ENCODE) {
         v = ATOM_KEY(*atomp);
@@ -627,6 +620,7 @@ js_XDRAtom(JSXDRState *xdr, JSAtom **atomp)
         return js_XDRStringAtom(xdr, atomp);
 
     if (type == JSVAL_DOUBLE) {
+        jsdouble d = 0;
         if (!XDRDoubleValue(xdr, &d))
             return JS_FALSE;
         *atomp = js_AtomizeDouble(xdr->cx, d);
@@ -668,7 +662,7 @@ js_XDRStringAtom(JSXDRState *xdr, JSAtom **atomp)
          * This is very uncommon. Don't use the tempPool arena for this as
          * most allocations here will be bigger than tempPool's arenasize.
          */
-        chars = (jschar *) JS_malloc(cx, nchars * sizeof(jschar));
+        chars = (jschar *) cx->malloc(nchars * sizeof(jschar));
         if (!chars)
             return JS_FALSE;
     }
@@ -676,7 +670,7 @@ js_XDRStringAtom(JSXDRState *xdr, JSAtom **atomp)
     if (XDRChars(xdr, chars, nchars))
         atom = js_AtomizeChars(cx, chars, nchars, 0);
     if (chars != stackChars)
-        JS_free(cx, chars);
+        cx->free(chars);
 
     if (!atom)
         return JS_FALSE;
@@ -715,7 +709,7 @@ JS_XDRRegisterClass(JSXDRState *xdr, JSClass *clasp, uint32 *idp)
     if (numclasses == maxclasses) {
         maxclasses = (maxclasses == 0) ? CLASS_REGISTRY_MIN : maxclasses << 1;
         registry = (JSClass **)
-            JS_realloc(xdr->cx, xdr->registry, maxclasses * sizeof(JSClass *));
+            xdr->cx->realloc(xdr->registry, maxclasses * sizeof(JSClass *));
         if (!registry)
             return JS_FALSE;
         xdr->registry = registry;

data/vendor/tracemonkey/jsxdrapi.h

@@ -204,7 +204,7 @@ JS_XDRFindClassById(JSXDRState *xdr, uint32 id);
  * before deserialization of bytecode.  If the saved version does not match
  * the current version, abort deserialization and invalidate the file.
  */
-#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 49)
+#define JSXDR_BYTECODE_VERSION      (0xb973c0de - 52)
 
 /*
  * Library-private functions.

data/vendor/tracemonkey/jsxml.cpp

@@ -1,4 +1,4 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
  * vim: set ts=4 sw=4 et tw=78:
  *
  * ***** BEGIN LICENSE BLOCK *****
@@ -37,7 +37,6 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "jsstddef.h"
 #include "jsversion.h"
 
 #if JS_HAS_XML_SUPPORT
@@ -46,6 +45,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include "jstypes.h"
+#include "jsstdint.h"
 #include "jsbit.h"
 #include "jsprf.h"
 #include "jsutil.h"
@@ -68,6 +68,7 @@
 #include "jsstr.h"
 #include "jsxml.h"
 #include "jsstaticcheck.h"
+#include "jsvector.h"
 
 #ifdef DEBUG
 #include <string.h>     /* for #ifdef DEBUG memset calls */
@@ -117,8 +118,8 @@ const char js_gt_entity_str[]     = "&gt;";
 const char js_lt_entity_str[]     = "&lt;";
 const char js_quot_entity_str[]   = "&quot;";
 
-#define IS_EMPTY(str) (JSSTRING_LENGTH(str) == 0)
-#define IS_STAR(str)  (JSSTRING_LENGTH(str) == 1 && *JSSTRING_CHARS(str) == '*')
+#define IS_STAR(str)  ((str)->length() == 1 && *(str)->chars() == '*')
+
 /* Slot indexes shared between Namespace and QName objects. */
 const uint32 JSSLOT_PREFIX      = JSSLOT_PRIVATE;
 const uint32 JSSLOT_URI         = JSSLOT_PRIVATE + 1;
@@ -200,6 +201,14 @@ xml_isXMLName(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
     return JS_TRUE;
 }
 
+static inline bool
+AppendString(JSCharBuffer &cb, JSString *str)
+{
+    const jschar *chars, *end;
+    str->getCharsAndEnd(chars, end);
+    return cb.append(chars, end);
+}
+
 /*
  * Namespace class and library functions.
  */
@@ -292,7 +301,7 @@ NewXMLNamespace(JSContext *cx, JSString *prefix, JSString *uri, JSBool declared)
 {
     JSObject *obj;
 
-    obj = js_NewObject(cx, &js_NamespaceClass.base, NULL, NULL, 0);
+    obj = js_NewObject(cx, &js_NamespaceClass.base, NULL, NULL);
     if (!obj)
         return JS_FALSE;
     JS_ASSERT(JSVAL_IS_VOID(obj->fslots[JSSLOT_PREFIX]));
@@ -378,7 +387,7 @@ JS_FRIEND_DATA(JSExtendedClass) js_QNameClass = {
     JSCLASS_HAS_RESERVED_SLOTS(QNAME_RESERVED_SLOTS) |
     JSCLASS_MARK_IS_TRACE | JSCLASS_HAS_CACHED_PROTO(JSProto_QName),
     JS_PropertyStub,   JS_PropertyStub,   qname_getProperty, NULL,
-    JS_EnumerateStub,  JS_ResolveStub,    JS_ConvertStub,    JS_FinalizeStub,
+    JS_EnumerateStub,  JS_ResolveStub,    JS_ConvertStub,    NULL,
     NULL,              NULL,              NULL,              NULL,
     NULL,              NULL,              NULL,              NULL },
     qname_equality,    NULL,              NULL,              NULL,
@@ -397,7 +406,7 @@ JS_FRIEND_DATA(JSClass) js_AttributeNameClass = {
     JSCLASS_HAS_RESERVED_SLOTS(QNAME_RESERVED_SLOTS) |
     JSCLASS_MARK_IS_TRACE | JSCLASS_HAS_CACHED_PROTO(JSProto_AttributeName),
     JS_PropertyStub,   JS_PropertyStub,   JS_PropertyStub,   JS_PropertyStub,
-    JS_EnumerateStub,  JS_ResolveStub,    JS_ConvertStub,    JS_FinalizeStub,
+    JS_EnumerateStub,  JS_ResolveStub,    JS_ConvertStub,    NULL,
     NULL,              NULL,              NULL,              NULL,
     NULL,              NULL,              NULL,              NULL
 };
@@ -445,7 +454,7 @@ qname_toString(JSContext *cx, uintN argc, jsval *vp)
     if (!uri) {
         /* No uri means wildcard qualifier. */
         str = ATOM_TO_STRING(cx->runtime->atomState.starQualifierAtom);
-    } else if (IS_EMPTY(uri)) {
+    } else if (uri->empty()) {
         /* Empty string for uri means localName is in no namespace. */
         str = cx->runtime->emptyString;
     } else {
@@ -459,16 +468,16 @@ qname_toString(JSContext *cx, uintN argc, jsval *vp)
         return JS_FALSE;
 
     if (str && clasp == &js_AttributeNameClass) {
-        length = JSSTRING_LENGTH(str);
-        chars = (jschar *) JS_malloc(cx, (length + 2) * sizeof(jschar));
+        length = str->length();
+        chars = (jschar *) cx->malloc((length + 2) * sizeof(jschar));
         if (!chars)
             return JS_FALSE;
         *chars = '@';
-        js_strncpy(chars + 1, JSSTRING_CHARS(str), length);
+        js_strncpy(chars + 1, str->chars(), length);
         chars[++length] = 0;
         str = js_NewString(cx, chars, length);
         if (!str) {
-            JS_free(cx, chars);
+            cx->free(chars);
             return JS_FALSE;
         }
     }
@@ -505,7 +514,7 @@ NewXMLQName(JSContext *cx, JSString *uri, JSString *prefix, JSString *localName,
     JSObject *obj;
 
     JS_ASSERT(IsQNameClass(clasp));
-    obj = js_NewObject(cx, clasp, NULL, NULL, 0);
+    obj = js_NewObject(cx, clasp, NULL, NULL);
     if (!obj)
         return NULL;
     InitXMLQName(obj, uri, prefix, localName);
@@ -576,7 +585,7 @@ js_IsXMLName(JSContext *cx, jsval v)
         }
     }
 
-    return IsXMLName(JSSTRING_CHARS(name), JSSTRING_LENGTH(name));
+    return IsXMLName(name->chars(), name->length());
 }
 
 /*
@@ -617,7 +626,7 @@ NamespaceHelper(JSContext *cx, JSObject *obj, intN argc, jsval *argv,
             return JS_TRUE;
         }
 
-        obj = js_NewObject(cx, &js_NamespaceClass.base, NULL, NULL, 0);
+        obj = js_NewObject(cx, &js_NamespaceClass.base, NULL, NULL);
         if (!obj)
             return JS_FALSE;
         *rval = OBJECT_TO_JSVAL(obj);
@@ -640,7 +649,7 @@ NamespaceHelper(JSContext *cx, JSObject *obj, intN argc, jsval *argv,
             if (!uri)
                 return JS_FALSE;
             obj->fslots[JSSLOT_URI] = STRING_TO_JSVAL(uri);
-            if (!IS_EMPTY(uri))
+            if (!uri->empty())
                 obj->fslots[JSSLOT_PREFIX] = JSVAL_VOID;
         }
     } else if (argc == 2) {
@@ -652,12 +661,12 @@ NamespaceHelper(JSContext *cx, JSObject *obj, intN argc, jsval *argv,
         obj->fslots[JSSLOT_URI] = STRING_TO_JSVAL(uri);
 
         prefixval = argv[0];
-        if (IS_EMPTY(uri)) {
+        if (uri->empty()) {
             if (!JSVAL_IS_VOID(prefixval)) {
                 prefix = js_ValueToString(cx, prefixval);
                 if (!prefix)
                     return JS_FALSE;
-                if (!IS_EMPTY(prefix)) {
+                if (!prefix->empty()) {
                     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
                                          JSMSG_BAD_XML_NAMESPACE,
                                          js_ValueToPrintableString(cx,
@@ -724,7 +733,7 @@ QNameHelper(JSContext *cx, JSObject *obj, JSClass *clasp, intN argc,
          * Create and return a new QName or AttributeName object exactly as if
          * constructed.
          */
-        obj = js_NewObject(cx, clasp, NULL, NULL, 0);
+        obj = js_NewObject(cx, clasp, NULL, NULL);
         if (!obj)
             return JS_FALSE;
         *rval = OBJECT_TO_JSVAL(obj);
@@ -804,7 +813,7 @@ QNameHelper(JSContext *cx, JSObject *obj, JSClass *clasp, intN argc,
             argv[0] = STRING_TO_JSVAL(uri);     /* local root */
 
             /* NULL here represents *undefined* in ECMA-357 13.2.2 3(c)iii. */
-            prefix = IS_EMPTY(uri) ? cx->runtime->emptyString : NULL;
+            prefix = uri->empty() ? cx->runtime->emptyString : NULL;
         }
     }
 
@@ -858,56 +867,46 @@ attr_identity(const void *a, const void *b)
     return qname_identity(xmla->name, xmlb->name);
 }
 
-static void
-XMLArrayCursorInit(JSXMLArrayCursor *cursor, JSXMLArray *array)
+struct JSXMLArrayCursor
 {
+    JSXMLArray       *array;
+    uint32           index;
     JSXMLArrayCursor *next;
+    JSXMLArrayCursor **prevp;
+    void             *root;
 
-    cursor->array = array;
-    cursor->index = 0;
-    next = cursor->next = array->cursors;
-    if (next)
-        next->prevp = &cursor->next;
-    cursor->prevp = &array->cursors;
-    array->cursors = cursor;
-    cursor->root = NULL;
-}
-
-static void
-XMLArrayCursorFinish(JSXMLArrayCursor *cursor)
-{
-    JSXMLArrayCursor *next;
+    JSXMLArrayCursor(JSXMLArray *array)
+      : array(array), index(0), next(array->cursors), prevp(&array->cursors),
+        root(NULL)
+    {
+        if (next)
+            next->prevp = &next;
+        array->cursors = this;
+    }
 
-    if (!cursor->array)
-        return;
-    next = cursor->next;
-    if (next)
-        next->prevp = cursor->prevp;
-    *cursor->prevp = next;
-    cursor->array = NULL;
-}
+    ~JSXMLArrayCursor() { disconnect(); }
 
-static void *
-XMLArrayCursorNext(JSXMLArrayCursor *cursor)
-{
-    JSXMLArray *array;
-
-    array = cursor->array;
-    if (!array || cursor->index >= array->length)
-        return NULL;
-    return cursor->root = array->vector[cursor->index++];
-}
+    void disconnect() {
+        if (!array)
+            return;
+        if (next)
+            next->prevp = prevp;
+        *prevp = next;
+        array = NULL;
+    }
 
-static void *
-XMLArrayCursorItem(JSXMLArrayCursor *cursor)
-{
-    JSXMLArray *array;
+    void *getNext() {
+        if (!array || index >= array->length)
+            return NULL;
+        return root = array->vector[index++];
+    }
 
-    array = cursor->array;
-    if (!array || cursor->index >= array->length)
-        return NULL;
-    return cursor->root = array->vector[cursor->index];
-}
+    void *getCurrent() {
+        if (!array || index >= array->length)
+            return NULL;
+        return root = array->vector[index];
+    }
+};
 
 static void
 XMLArrayCursorTrace(JSTracer *trc, JSXMLArrayCursor *cursor)
@@ -932,8 +931,12 @@ XMLArraySetCapacity(JSContext *cx, JSXMLArray *array, uint32 capacity)
 
     if (capacity == 0) {
         /* We could let realloc(p, 0) free this, but purify gets confused. */
-        if (array->vector)
-            free(array->vector);
+        if (array->vector) {
+            if (cx)
+                cx->free(array->vector);
+            else
+                js_free(array->vector);
+        }
         vector = NULL;
     } else {
         if (
@@ -941,7 +944,7 @@ XMLArraySetCapacity(JSContext *cx, JSXMLArray *array, uint32 capacity)
             (size_t)capacity > ~(size_t)0 / sizeof(void *) ||
 #endif
             !(vector = (void **)
-                       realloc(array->vector, capacity * sizeof(void *)))) {
+                       js_realloc(array->vector, capacity * sizeof(void *)))) {
             if (cx)
                 JS_ReportOutOfMemory(cx);
             return JS_FALSE;
@@ -973,12 +976,10 @@ XMLArrayInit(JSContext *cx, JSXMLArray *array, uint32 capacity)
 static void
 XMLArrayFinish(JSContext *cx, JSXMLArray *array)
 {
-    JSXMLArrayCursor *cursor;
-
-    JS_free(cx, array->vector);
+    cx->free(array->vector);
 
-    while ((cursor = array->cursors) != NULL)
-        XMLArrayCursorFinish(cursor);
+    while (JSXMLArrayCursor *cursor = array->cursors)
+        cursor->disconnect();
 
 #ifdef DEBUG
     memset(array, 0xd5, sizeof *array);
@@ -1039,7 +1040,7 @@ XMLArrayAddMember(JSContext *cx, JSXMLArray *array, uint32 index, void *elt)
                 (size_t)capacity > ~(size_t)0 / sizeof(void *) ||
 #endif
                 !(vector = (void **)
-                           realloc(array->vector, capacity * sizeof(void *)))) {
+                           js_realloc(array->vector, capacity * sizeof(void *)))) {
                 JS_ReportOutOfMemory(cx);
                 return JS_FALSE;
             }
@@ -1120,10 +1121,10 @@ XMLArrayTruncate(JSContext *cx, JSXMLArray *array, uint32 length)
 
     if (length == 0) {
         if (array->vector)
-            free(array->vector);
+            cx->free(array->vector);
         vector = NULL;
     } else {
-        vector = (void **) realloc(array->vector, length * sizeof(void *));
+        vector = (void **) js_realloc(array->vector, length * sizeof(void *));
         if (!vector)
             return;
     }
@@ -1237,10 +1238,10 @@ static JSPropertySpec xml_static_props[] = {
 
 /* Macros for special-casing xml:, xmlns= and xmlns:foo= in ParseNodeToQName. */
 #define IS_XML(str)                                                           \
-    (JSSTRING_LENGTH(str) == 3 && IS_XML_CHARS(JSSTRING_CHARS(str)))
+    (str->length() == 3 && IS_XML_CHARS(str->chars()))
 
 #define IS_XMLNS(str)                                                         \
-    (JSSTRING_LENGTH(str) == 5 && IS_XMLNS_CHARS(JSSTRING_CHARS(str)))
+    (str->length() == 5 && IS_XMLNS_CHARS(str->chars()))
 
 #define IS_XML_CHARS(chars)                                                   \
     (JS_TOLOWER((chars)[0]) == 'x' &&                                         \
@@ -1274,7 +1275,7 @@ ParseNodeToQName(JSCompiler *jsc, JSParseNode *pn,
 
     JS_ASSERT(pn->pn_arity == PN_NULLARY);
     str = ATOM_TO_STRING(pn->pn_atom);
-    JSSTRING_CHARS_AND_LENGTH(str, start, length);
+    str->getCharsAndLength(start, length);
     JS_ASSERT(length != 0 && *start != '@');
     JS_ASSERT(length != 1 || *start != '*');
 
@@ -1282,7 +1283,7 @@ ParseNodeToQName(JSCompiler *jsc, JSParseNode *pn,
     limit = start + length;
     colon = js_strchr_limit(start, ':', limit);
     if (colon) {
-        offset = PTRDIFF(colon, start, jschar);
+        offset = colon - start;
         prefix = js_NewDependentString(cx, str, 0, offset);
         if (!prefix)
             return NULL;
@@ -1342,12 +1343,12 @@ ParseNodeToQName(JSCompiler *jsc, JSParseNode *pn,
                 --n;
                 ns = XMLARRAY_MEMBER(inScopeNSes, n, JSObject);
                 nsprefix = GetPrefix(ns);
-                if (!nsprefix || IS_EMPTY(nsprefix)) {
+                if (!nsprefix || nsprefix->empty()) {
                     uri = GetURI(ns);
                     break;
                 }
             }
-            prefix = IS_EMPTY(uri) ? jsc->context->runtime->emptyString : NULL;
+            prefix = uri->empty() ? jsc->context->runtime->emptyString : NULL;
         }
         localName = str;
     }
@@ -1362,7 +1363,7 @@ ChompXMLWhitespace(JSContext *cx, JSString *str)
     const jschar *cp, *start, *end;
     jschar c;
 
-    JSSTRING_CHARS_AND_LENGTH(str, start, length);
+    str->getCharsAndLength(start, length);
     for (cp = start, end = cp + length; cp < end; cp++) {
         c = *cp;
         if (!JS_ISXMLSPACE(c))
@@ -1374,10 +1375,10 @@ ChompXMLWhitespace(JSContext *cx, JSString *str)
             break;
         --end;
     }
-    newlength = PTRDIFF(end, cp, jschar);
+    newlength = end - cp;
     if (newlength == length)
         return str;
-    offset = PTRDIFF(cp, start, jschar);
+    offset = cp - start;
     return js_NewDependentString(cx, str, offset, newlength);
 }
 
@@ -1550,7 +1551,7 @@ ParseNodeToXML(JSCompiler *jsc, JSParseNode *pn,
             if (pn2->pn_type != TOK_XMLATTR)
                 goto syntax;
 
-            JSSTRING_CHARS_AND_LENGTH(str, chars, length);
+            str->getCharsAndLength(chars, length);
             if (length >= 5 &&
                 IS_XMLNS_CHARS(chars) &&
                 (length == 5 || chars[5] == ':')) {
@@ -1849,25 +1850,25 @@ ParseXMLSource(JSContext *cx, JSString *src)
     uri = GetURI(JSVAL_TO_OBJECT(nsval));
     uri = js_EscapeAttributeValue(cx, uri, JS_FALSE);
 
-    urilen = JSSTRING_LENGTH(uri);
-    srclen = JSSTRING_LENGTH(src);
+    urilen = uri->length();
+    srclen = src->length();
     length = constrlen(prefix) + urilen + constrlen(middle) + srclen +
              constrlen(suffix);
 
-    chars = (jschar *) JS_malloc(cx, (length + 1) * sizeof(jschar));
+    chars = (jschar *) cx->malloc((length + 1) * sizeof(jschar));
     if (!chars)
         return NULL;
 
     dstlen = length;
     js_InflateStringToBuffer(cx, prefix, constrlen(prefix), chars, &dstlen);
     offset = dstlen;
-    js_strncpy(chars + offset, JSSTRING_CHARS(uri), urilen);
+    js_strncpy(chars + offset, uri->chars(), urilen);
     offset += urilen;
     dstlen = length - offset + 1;
     js_InflateStringToBuffer(cx, middle, constrlen(middle), chars + offset,
                              &dstlen);
     offset += dstlen;
-    srcp = JSSTRING_CHARS(src);
+    srcp = src->chars();
     js_strncpy(chars + offset, srcp, srclen);
     offset += srclen;
     dstlen = length - offset + 1;
@@ -1905,7 +1906,7 @@ ParseXMLSource(JSContext *cx, JSString *src)
         }
     }
 
-    JS_free(cx, chars);
+    cx->free(chars);
     return xml;
 
 #undef constrlen
@@ -1963,7 +1964,7 @@ ToXML(JSContext *cx, jsval v)
     } else {
         obj = JSVAL_TO_OBJECT(v);
         if (OBJECT_IS_XML(cx, obj)) {
-            xml = (JSXML *) JS_GetPrivate(cx, obj);
+            xml = (JSXML *) obj->getPrivate();
             if (xml->xml_class == JSXML_CLASS_LIST) {
                 if (xml->xml_kids.length != 1)
                     goto bad;
@@ -1991,7 +1992,7 @@ ToXML(JSContext *cx, jsval v)
     str = js_ValueToString(cx, v);
     if (!str)
         return NULL;
-    if (IS_EMPTY(str)) {
+    if (str->empty()) {
         length = 0;
 #ifdef __GNUC__         /* suppress bogus gcc warnings */
         xml = NULL;
@@ -2044,12 +2045,12 @@ ToXMLList(JSContext *cx, jsval v)
     } else {
         obj = JSVAL_TO_OBJECT(v);
         if (OBJECT_IS_XML(cx, obj)) {
-            xml = (JSXML *) JS_GetPrivate(cx, obj);
+            xml = (JSXML *) obj->getPrivate();
             if (xml->xml_class != JSXML_CLASS_LIST) {
                 listobj = js_NewXMLObject(cx, JSXML_CLASS_LIST);
                 if (!listobj)
                     return NULL;
-                list = (JSXML *) JS_GetPrivate(cx, listobj);
+                list = (JSXML *) listobj->getPrivate();
                 if (!Append(cx, list, xml))
                     return NULL;
                 return listobj;
@@ -2072,7 +2073,7 @@ ToXMLList(JSContext *cx, jsval v)
     str = js_ValueToString(cx, v);
     if (!str)
         return NULL;
-    if (IS_EMPTY(str)) {
+    if (str->empty()) {
         xml = NULL;
         length = 0;
     } else {
@@ -2088,7 +2089,7 @@ ToXMLList(JSContext *cx, jsval v)
 
     listobj = js_NewXMLObject(cx, JSXML_CLASS_LIST);
     if (listobj) {
-        list = (JSXML *) JS_GetPrivate(cx, listobj);
+        list = (JSXML *) listobj->getPrivate();
         for (i = 0; i < length; i++) {
             kid = OrphanXMLChild(cx, xml, i);
             if (!kid || !Append(cx, list, kid)) {
@@ -2114,87 +2115,58 @@ bad:
  * MakeXMLCommentString, and MakeXMLPIString are further factored into a common
  * MakeXMLSpecialString subroutine.
  *
- * These functions take ownership of sb->base, if sb is non-null, in all cases
- * of success or failure.
+ * These functions mutate cb, leaving it empty.
  */
 static JSString *
-MakeXMLSpecialString(JSContext *cx, JSStringBuffer *sb,
+MakeXMLSpecialString(JSContext *cx, JSCharBuffer &cb,
                      JSString *str, JSString *str2,
                      const jschar *prefix, size_t prefixlength,
                      const jschar *suffix, size_t suffixlength)
 {
-    JSStringBuffer localSB;
-    size_t length, length2, newlength;
-    jschar *bp, *base;
-
-    if (!sb) {
-        sb = &localSB;
-        js_InitStringBuffer(sb);
-    }
-
-    length = JSSTRING_LENGTH(str);
-    length2 = str2 ? JSSTRING_LENGTH(str2) : 0;
-    newlength = STRING_BUFFER_OFFSET(sb) +
-                prefixlength + length + ((length2 != 0) ? 1 + length2 : 0) +
-                suffixlength;
-    bp = base = (jschar *)
-                JS_realloc(cx, sb->base, (newlength + 1) * sizeof(jschar));
-    if (!bp) {
-        js_FinishStringBuffer(sb);
+    if (!cb.append(prefix, prefixlength) || !AppendString(cb, str))
         return NULL;
+    if (str2 && !str2->empty()) {
+        if (!cb.append(' ') || !AppendString(cb, str2))
+            return NULL;
     }
+    if (!cb.append(suffix, suffixlength))
+        return NULL;
 
-    bp += STRING_BUFFER_OFFSET(sb);
-    js_strncpy(bp, prefix, prefixlength);
-    bp += prefixlength;
-    js_strncpy(bp, JSSTRING_CHARS(str), length);
-    bp += length;
-    if (length2 != 0) {
-        *bp++ = (jschar) ' ';
-        js_strncpy(bp, JSSTRING_CHARS(str2), length2);
-        bp += length2;
-    }
-    js_strncpy(bp, suffix, suffixlength);
-    bp[suffixlength] = 0;
-
-    str = js_NewString(cx, base, newlength);
-    if (!str)
-        free(base);
-    return str;
+    return js_NewStringFromCharBuffer(cx, cb);
 }
 
 static JSString *
-MakeXMLCDATAString(JSContext *cx, JSStringBuffer *sb, JSString *str)
+MakeXMLCDATAString(JSContext *cx, JSCharBuffer &cb, JSString *str)
 {
     static const jschar cdata_prefix_ucNstr[] = {'<', '!', '[',
                                                  'C', 'D', 'A', 'T', 'A',
                                                  '['};
     static const jschar cdata_suffix_ucNstr[] = {']', ']', '>'};
 
-    return MakeXMLSpecialString(cx, sb, str, NULL,
+    return MakeXMLSpecialString(cx, cb, str, NULL,
                                 cdata_prefix_ucNstr, 9,
                                 cdata_suffix_ucNstr, 3);
 }
 
 static JSString *
-MakeXMLCommentString(JSContext *cx, JSStringBuffer *sb, JSString *str)
+MakeXMLCommentString(JSContext *cx, JSCharBuffer &cb, JSString *str)
 {
     static const jschar comment_prefix_ucNstr[] = {'<', '!', '-', '-'};
     static const jschar comment_suffix_ucNstr[] = {'-', '-', '>'};
 
-    return MakeXMLSpecialString(cx, sb, str, NULL,
+    return MakeXMLSpecialString(cx, cb, str, NULL,
                                 comment_prefix_ucNstr, 4,
                                 comment_suffix_ucNstr, 3);
 }
 
 static JSString *
-MakeXMLPIString(JSContext *cx, JSStringBuffer *sb, JSString *name,
+MakeXMLPIString(JSContext *cx, JSCharBuffer &cb, JSString *name,
                 JSString *value)
 {
     static const jschar pi_prefix_ucNstr[] = {'<', '?'};
     static const jschar pi_suffix_ucNstr[] = {'?', '>'};
 
-    return MakeXMLSpecialString(cx, sb, name, value,
+    return MakeXMLSpecialString(cx, cb, name, value,
                                 pi_prefix_ucNstr, 2,
                                 pi_suffix_ucNstr, 2);
 }
@@ -2203,142 +2175,103 @@ MakeXMLPIString(JSContext *cx, JSStringBuffer *sb, JSString *name,
  * ECMA-357 10.2.1 17(d-g) pulled out into a common subroutine that appends
  * equals, a double quote, an attribute value, and a closing double quote.
  */
-static void
-AppendAttributeValue(JSContext *cx, JSStringBuffer *sb, JSString *valstr)
+static bool
+AppendAttributeValue(JSContext *cx, JSCharBuffer &cb, JSString *valstr)
 {
-    js_AppendChar(sb, '=');
+    if (!cb.append('='))
+        return false;
     valstr = js_EscapeAttributeValue(cx, valstr, JS_TRUE);
-    if (!valstr) {
-        if (STRING_BUFFER_OK(sb)) {
-            free(sb->base);
-            sb->base = STRING_BUFFER_ERROR_BASE;
-        }
-        return;
-    }
-    js_AppendJSString(sb, valstr);
+    return valstr && AppendString(cb, valstr);
 }
 
 /*
  * ECMA-357 10.2.1.1 EscapeElementValue helper method.
- *
- * This function takes ownership of sb->base, if sb is non-null, in all cases
- * of success or failure.
+
+ * These functions mutate cb, leaving it empty.
  */
 static JSString *
-EscapeElementValue(JSContext *cx, JSStringBuffer *sb, JSString *str)
+EscapeElementValue(JSContext *cx, JSCharBuffer &cb, JSString *str)
 {
-    size_t length, newlength;
-    const jschar *cp, *start, *end;
-    jschar c;
-
-    JSSTRING_CHARS_AND_LENGTH(str, start, length);
-    newlength = length;
-    for (cp = start, end = cp + length; cp < end; cp++) {
-        c = *cp;
-        if (c == '<' || c == '>')
-            newlength += 3;
-        else if (c == '&')
-            newlength += 4;
-
-        if (newlength < length) {
-            js_ReportAllocationOverflow(cx);
-            return NULL;
-        }
-    }
-    if ((sb && STRING_BUFFER_OFFSET(sb) != 0) || newlength > length) {
-        JSStringBuffer localSB;
-        if (!sb) {
-            sb = &localSB;
-            js_InitStringBuffer(sb);
-        }
-        if (!sb->grow(sb, newlength)) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
-        for (cp = start; cp < end; cp++) {
-            c = *cp;
-            if (c == '<')
-                js_AppendCString(sb, js_lt_entity_str);
-            else if (c == '>')
-                js_AppendCString(sb, js_gt_entity_str);
-            else if (c == '&')
-                js_AppendCString(sb, js_amp_entity_str);
-            else
-                js_AppendChar(sb, c);
+    size_t length;
+    const jschar *start;
+    str->getCharsAndLength(start, length);
+
+    for (const jschar *cp = start, *end = start + length; cp != end; ++cp) {
+        jschar c = *cp;
+        switch (*cp) {
+          case '<':
+            if (!js_AppendLiteral(cb, js_lt_entity_str))
+                return NULL;
+            break;
+          case '>':
+            if (!js_AppendLiteral(cb, js_gt_entity_str))
+                return NULL;
+            break;
+          case '&':
+            if (!js_AppendLiteral(cb, js_amp_entity_str))
+                return NULL;
+            break;
+          default:
+            if (!cb.append(c))
+                return NULL;
         }
-        JS_ASSERT(STRING_BUFFER_OK(sb));
-        str = js_NewString(cx, sb->base, STRING_BUFFER_OFFSET(sb));
-        if (!str)
-            js_FinishStringBuffer(sb);
     }
-    return str;
+    return js_NewStringFromCharBuffer(cx, cb);
 }
 
 /*
  * ECMA-357 10.2.1.2 EscapeAttributeValue helper method.
- * This function takes ownership of sb->base, if sb is non-null, in all cases.
+ *
+ * These functions mutate cb, leaving it empty.
  */
 static JSString *
-EscapeAttributeValue(JSContext *cx, JSStringBuffer *sb, JSString *str,
+EscapeAttributeValue(JSContext *cx, JSCharBuffer &cb, JSString *str,
                      JSBool quote)
 {
-    size_t length, newlength;
-    const jschar *cp, *start, *end;
-    jschar c;
+    size_t length;
+    const jschar *start;
+    str->getCharsAndLength(start, length);
 
-    JSSTRING_CHARS_AND_LENGTH(str, start, length);
-    newlength = length + (quote ? 2 : 0);
-    for (cp = start, end = cp + length; cp < end; cp++) {
-        c = *cp;
-        if (c == '"')
-            newlength += 5;
-        else if (c == '<')
-            newlength += 3;
-        else if (c == '&' || c == '\n' || c == '\r' || c == '\t')
-            newlength += 4;
-
-        if (newlength < length) {
-            js_ReportAllocationOverflow(cx);
-            return NULL;
-        }
-    }
-    if ((sb && STRING_BUFFER_OFFSET(sb) != 0) || newlength > length) {
-        JSStringBuffer localSB;
-        if (!sb) {
-            sb = &localSB;
-            js_InitStringBuffer(sb);
-        }
-        if (!sb->grow(sb, newlength)) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
-        if (quote)
-            js_AppendChar(sb, '"');
-        for (cp = start; cp < end; cp++) {
-            c = *cp;
-            if (c == '"')
-                js_AppendCString(sb, js_quot_entity_str);
-            else if (c == '<')
-                js_AppendCString(sb, js_lt_entity_str);
-            else if (c == '&')
-                js_AppendCString(sb, js_amp_entity_str);
-            else if (c == '\n')
-                js_AppendCString(sb, "&#xA;");
-            else if (c == '\r')
-                js_AppendCString(sb, "&#xD;");
-            else if (c == '\t')
-                js_AppendCString(sb, "&#x9;");
-            else
-                js_AppendChar(sb, c);
+    if (quote && !cb.append('"'))
+        return NULL;
+
+    for (const jschar *cp = start, *end = start + length; cp != end; ++cp) {
+        jschar c = *cp;
+        switch (c) {
+          case '"':
+            if (!js_AppendLiteral(cb, js_quot_entity_str))
+                return NULL;
+            break;
+          case '<':
+            if (!js_AppendLiteral(cb, js_lt_entity_str))
+                return NULL;
+            break;
+          case '&':
+            if (!js_AppendLiteral(cb, js_amp_entity_str))
+                return NULL;
+            break;
+          case '\n':
+            if (!js_AppendLiteral(cb, "&#xA;"))
+                return NULL;
+            break;
+          case '\r':
+            if (!js_AppendLiteral(cb, "&#xD;"))
+                return NULL;
+            break;
+          case '\t':
+            if (!js_AppendLiteral(cb, "&#x9;"))
+                return NULL;
+            break;
+          default:
+            if (!cb.append(c))
+                return NULL;
         }
-        if (quote)
-            js_AppendChar(sb, '"');
-        JS_ASSERT(STRING_BUFFER_OK(sb));
-        str = js_NewString(cx, sb->base, STRING_BUFFER_OFFSET(sb));
-        if (!str)
-            js_FinishStringBuffer(sb);
     }
-    return str;
+
+    if (quote && !cb.append('"'))
+        return NULL;
+
+    return js_NewStringFromCharBuffer(cx, cb);
 }
 
 /* 13.3.5.4 [[GetNamespace]]([InScopeNamespaces]) */
@@ -2403,7 +2336,7 @@ GetNamespace(JSContext *cx, JSObject *qn, const JSXMLArray *inScopeNSes)
                 if (nsprefix == prefix ||
                     ((nsprefix && prefix)
                      ? js_EqualStrings(nsprefix, prefix)
-                     : IS_EMPTY(nsprefix ? nsprefix : prefix))) {
+                     : (nsprefix ? nsprefix : prefix)->empty())) {
                     match = ns;
                     break;
                 }
@@ -2435,7 +2368,7 @@ GeneratePrefix(JSContext *cx, JSString *uri, JSXMLArray *decls)
     JSObject *ns;
     JSString *nsprefix, *prefix;
 
-    JS_ASSERT(!IS_EMPTY(uri));
+    JS_ASSERT(!uri->empty());
 
     /*
      * If there are no *declared* namespaces, skip all collision detection and
@@ -2457,18 +2390,18 @@ GeneratePrefix(JSContext *cx, JSString *uri, JSXMLArray *decls)
      * ".../there.is.only.xul", "xbl" given ".../xbl", and "xbl2" given any
      * likely URI of the form ".../xbl2/2005".
      */
-    JSSTRING_CHARS_AND_END(uri, start, end);
+    uri->getCharsAndEnd(start, end);
     cp = end;
     while (--cp > start) {
         if (*cp == '.' || *cp == '/' || *cp == ':') {
             ++cp;
-            length = PTRDIFF(end, cp, jschar);
+            length = end - cp;
             if (IsXMLName(cp, length) && !STARTS_WITH_XML(cp, length))
                 break;
             end = --cp;
         }
     }
-    length = PTRDIFF(end, cp, jschar);
+    length = end - cp;
 
     /*
      * If the namespace consisted only of non-XML names or names that begin
@@ -2482,7 +2415,7 @@ GeneratePrefix(JSContext *cx, JSString *uri, JSXMLArray *decls)
     if (STARTS_WITH_XML(cp, length) || !IsXMLName(cp, length)) {
         newlength = length + 2 + (size_t) log10((double) decls->length);
         bp = (jschar *)
-             JS_malloc(cx, (newlength + 1) * sizeof(jschar));
+             cx->malloc((newlength + 1) * sizeof(jschar));
         if (!bp)
             return NULL;
 
@@ -2501,13 +2434,13 @@ GeneratePrefix(JSContext *cx, JSString *uri, JSXMLArray *decls)
         for (i = 0, n = decls->length; i < n; i++) {
             ns = XMLARRAY_MEMBER(decls, i, JSObject);
             if (ns && (nsprefix = GetPrefix(ns)) &&
-                JSSTRING_LENGTH(nsprefix) == newlength &&
-                !memcmp(JSSTRING_CHARS(nsprefix), bp,
+                nsprefix->length() == newlength &&
+                !memcmp(nsprefix->chars(), bp,
                         newlength * sizeof(jschar))) {
                 if (bp == cp) {
                     newlength = length + 2 + (size_t) log10((double) n);
                     bp = (jschar *)
-                         JS_malloc(cx, (newlength + 1) * sizeof(jschar));
+                         cx->malloc((newlength + 1) * sizeof(jschar));
                     if (!bp)
                         return NULL;
                     js_strncpy(bp, cp, length);
@@ -2529,12 +2462,12 @@ GeneratePrefix(JSContext *cx, JSString *uri, JSXMLArray *decls)
     } while (!done);
 
     if (bp == cp) {
-        offset = PTRDIFF(cp, start, jschar);
+        offset = cp - start;
         prefix = js_NewDependentString(cx, uri, offset, length);
     } else {
         prefix = js_NewString(cx, bp, newlength);
         if (!prefix)
-            JS_free(cx, bp);
+            cx->free(bp);
     }
     return prefix;
 }
@@ -2561,26 +2494,20 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
                uint32 indentLevel)
 {
     JSBool pretty, indentKids;
-    JSStringBuffer sb;
-    JSString *str, *prefix, *kidstr, *nsuri;
-    JSXMLArrayCursor cursor;
+    JSCharBuffer cb(cx);
+    JSString *str, *prefix, *nsuri;
     uint32 i, n, nextIndentLevel;
     JSXMLArray empty, decls, ancdecls;
     JSObject *ns, *ns2;
-    JSXML *attr, *kid;
 
     if (!GetBooleanXMLSetting(cx, js_prettyPrinting_str, &pretty))
         return NULL;
 
-    js_InitStringBuffer(&sb);
     if (pretty) {
-        js_RepeatChar(&sb, ' ', indentLevel & ~TO_SOURCE_FLAG);
-
-        if (!STRING_BUFFER_OK(&sb)) {
-            JS_ReportOutOfMemory(cx);
+        if (!cb.appendN(' ', indentLevel & ~TO_SOURCE_FLAG))
             return NULL;
-        }
     }
+
     str = NULL;
 
     switch (xml->xml_class) {
@@ -2593,54 +2520,43 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
         } else {
             str = xml->xml_value;
         }
-        return EscapeElementValue(cx, &sb, str);
+        return EscapeElementValue(cx, cb, str);
 
       case JSXML_CLASS_ATTRIBUTE:
         /* Step 5. */
-        return EscapeAttributeValue(cx, &sb, xml->xml_value,
+        return EscapeAttributeValue(cx, cb, xml->xml_value,
                                     (indentLevel & TO_SOURCE_FLAG) != 0);
 
       case JSXML_CLASS_COMMENT:
         /* Step 6. */
-        return MakeXMLCommentString(cx, &sb, xml->xml_value);
+        return MakeXMLCommentString(cx, cb, xml->xml_value);
 
       case JSXML_CLASS_PROCESSING_INSTRUCTION:
         /* Step 7. */
-        return MakeXMLPIString(cx, &sb, GetLocalName(xml->name),
+        return MakeXMLPIString(cx, cb, GetLocalName(xml->name),
                                xml->xml_value);
 
       case JSXML_CLASS_LIST:
         /* ECMA-357 10.2.2. */
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        i = 0;
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
-            if (pretty && i != 0)
-                js_AppendChar(&sb, '\n');
-
-            kidstr = XMLToXMLString(cx, kid, ancestorNSes, indentLevel);
-            if (!kidstr)
-                break;
+        {
+            JSXMLArrayCursor cursor(&xml->xml_kids);
+            i = 0;
+            while (JSXML *kid = (JSXML *) cursor.getNext()) {
+                if (pretty && i != 0) {
+                    if (!cb.append('\n'))
+                        return NULL;
+                }
 
-            js_AppendJSString(&sb, kidstr);
-            ++i;
+                JSString *kidstr = XMLToXMLString(cx, kid, ancestorNSes, indentLevel);
+                if (!kidstr || !AppendString(cb, kidstr))
+                    return NULL;
+                ++i;
+            }
         }
-        XMLArrayCursorFinish(&cursor);
-        if (kid)
-            goto list_out;
 
-        if (!sb.base)
+        if (cb.empty())
             return cx->runtime->emptyString;
-
-        if (!STRING_BUFFER_OK(&sb)) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
-
-        str = js_NewString(cx, sb.base, STRING_BUFFER_OFFSET(&sb));
-      list_out:
-        if (!str && STRING_BUFFER_OK(&sb))
-            js_FinishStringBuffer(&sb);
-        return str;
+        return js_NewStringFromCharBuffer(cx, cb);
 
       default:;
     }
@@ -2658,20 +2574,19 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
     ancdecls.capacity = 0;
 
     /* Clone in-scope namespaces not in ancestorNSes into decls. */
-    XMLArrayCursorInit(&cursor, &xml->xml_namespaces);
-    while ((ns = (JSObject *) XMLArrayCursorNext(&cursor)) != NULL) {
-        if (!IsDeclared(ns))
-            continue;
-        if (!XMLARRAY_HAS_MEMBER(ancestorNSes, ns, namespace_identity)) {
-            /* NOTE: may want to exclude unused namespaces here. */
-            ns2 = NewXMLNamespace(cx, GetPrefix(ns), GetURI(ns), JS_TRUE);
-            if (!ns2 || !XMLARRAY_APPEND(cx, &decls, ns2))
-                break;
+    {
+        JSXMLArrayCursor cursor(&xml->xml_namespaces);
+        while ((ns = (JSObject *) cursor.getNext()) != NULL) {
+            if (!IsDeclared(ns))
+                continue;
+            if (!XMLARRAY_HAS_MEMBER(ancestorNSes, ns, namespace_identity)) {
+                /* NOTE: may want to exclude unused namespaces here. */
+                ns2 = NewXMLNamespace(cx, GetPrefix(ns), GetURI(ns), JS_TRUE);
+                if (!ns2 || !XMLARRAY_APPEND(cx, &decls, ns2))
+                    goto out;
+            }
         }
     }
-    XMLArrayCursorFinish(&cursor);
-    if (ns)
-        goto out;
 
     /*
      * Union ancestorNSes and decls into ancdecls.  Note that ancdecls does
@@ -2744,7 +2659,7 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
          * erratum or not.  Note that changing setNamespace to update the list
          * of in-scope namespaces will change x.namespaceDeclarations().
          */
-        if (IS_EMPTY(prefix)) {
+        if (prefix->empty()) {
             i = XMLArrayFindMember(&decls, ns, namespace_match);
             if (i != XML_NOT_FOUND)
                 XMLArrayDelete(cx, &decls, i, JS_TRUE);
@@ -2763,14 +2678,16 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
         }
     }
 
-    /* Format the element or point-tag into sb. */
-    js_AppendChar(&sb, '<');
+    /* Format the element or point-tag into cb. */
+    if (!cb.append('<'))
+        goto out;
 
-    if (prefix && !IS_EMPTY(prefix)) {
-        js_AppendJSString(&sb, prefix);
-        js_AppendChar(&sb, ':');
+    if (prefix && !prefix->empty()) {
+        if (!AppendString(cb, prefix) || !cb.append(':'))
+            goto out;
     }
-    js_AppendJSString(&sb, GetLocalName(xml->name));
+    if (!AppendString(cb, GetLocalName(xml->name)))
+        goto out;
 
     /*
      * Step 16 makes a union to avoid writing two loops in step 17, to share
@@ -2779,94 +2696,102 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
      */
 
     /* Step 17(b): append attributes. */
-    XMLArrayCursorInit(&cursor, &xml->xml_attrs);
-    while ((attr = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
-        js_AppendChar(&sb, ' ');
-        ns2 = GetNamespace(cx, attr->name, &ancdecls);
-        if (!ns2)
-            break;
+    {
+        JSXMLArrayCursor cursor(&xml->xml_attrs);
+        while (JSXML *attr = (JSXML *) cursor.getNext()) {
+            if (!cb.append(' '))
+                goto out;
+            ns2 = GetNamespace(cx, attr->name, &ancdecls);
+            if (!ns2)
+                goto out;
 
-        /* 17(b)(ii): NULL means *undefined* here. */
-        prefix = GetPrefix(ns2);
-        if (!prefix) {
-            prefix = GeneratePrefix(cx, GetURI(ns2), &ancdecls);
-            if (!prefix)
-                break;
+            /* 17(b)(ii): NULL means *undefined* here. */
+            prefix = GetPrefix(ns2);
+            if (!prefix) {
+                prefix = GeneratePrefix(cx, GetURI(ns2), &ancdecls);
+                if (!prefix)
+                    goto out;
 
-            /* Again, we avoid copying ns2 until we know it's prefix-less. */
-            ns2 = NewXMLNamespace(cx, prefix, GetURI(ns2), JS_TRUE);
-            if (!ns2)
-                break;
+                /* Again, we avoid copying ns2 until we know it's prefix-less. */
+                ns2 = NewXMLNamespace(cx, prefix, GetURI(ns2), JS_TRUE);
+                if (!ns2)
+                    goto out;
 
-            /*
-             * In the spec, ancdecls has no name, but is always written out as
-             * (AncestorNamespaces U namespaceDeclarations).  Since we compute
-             * that union in ancdecls, any time we append a namespace strong
-             * ref to decls, we must also append a weak ref to ancdecls.  Order
-             * matters here: code at label out: releases strong refs in decls.
-             */
-            if (!XMLARRAY_APPEND(cx, &ancdecls, ns2) ||
-                !XMLARRAY_APPEND(cx, &decls, ns2)) {
-                break;
+                /*
+                 * In the spec, ancdecls has no name, but is always written out as
+                 * (AncestorNamespaces U namespaceDeclarations).  Since we compute
+                 * that union in ancdecls, any time we append a namespace strong
+                 * ref to decls, we must also append a weak ref to ancdecls.  Order
+                 * matters here: code at label out: releases strong refs in decls.
+                 */
+                if (!XMLARRAY_APPEND(cx, &ancdecls, ns2) ||
+                    !XMLARRAY_APPEND(cx, &decls, ns2)) {
+                    goto out;
+                }
             }
-        }
 
-        /* 17(b)(iii). */
-        if (!IS_EMPTY(prefix)) {
-            js_AppendJSString(&sb, prefix);
-            js_AppendChar(&sb, ':');
-        }
+            /* 17(b)(iii). */
+            if (!prefix->empty()) {
+                if (!AppendString(cb, prefix) || !cb.append(':'))
+                    goto out;
+            }
 
-        /* 17(b)(iv). */
-        js_AppendJSString(&sb, GetLocalName(attr->name));
+            /* 17(b)(iv). */
+            if (!AppendString(cb, GetLocalName(attr->name)))
+                goto out;
 
-        /* 17(d-g). */
-        AppendAttributeValue(cx, &sb, attr->xml_value);
+            /* 17(d-g). */
+            if (!AppendAttributeValue(cx, cb, attr->xml_value))
+                goto out;
+        }
     }
-    XMLArrayCursorFinish(&cursor);
-    if (attr)
-        goto out;
 
     /* Step 17(c): append XML namespace declarations. */
-    XMLArrayCursorInit(&cursor, &decls);
-    while ((ns2 = (JSObject *) XMLArrayCursorNext(&cursor)) != NULL) {
-        JS_ASSERT(IsDeclared(ns2));
+    {
+        JSXMLArrayCursor cursor(&decls);
+        while (JSObject *ns3 = (JSObject *) cursor.getNext()) {
+            JS_ASSERT(IsDeclared(ns3));
 
-        js_AppendCString(&sb, " xmlns");
+            if (!js_AppendLiteral(cb, " xmlns"))
+                goto out;
 
-        /* 17(c)(ii): NULL means *undefined* here. */
-        prefix = GetPrefix(ns2);
-        if (!prefix) {
-            prefix = GeneratePrefix(cx, GetURI(ns2), &ancdecls);
-            if (!prefix)
-                break;
-            ns2->fslots[JSSLOT_PREFIX] = STRING_TO_JSVAL(prefix);
-        }
+            /* 17(c)(ii): NULL means *undefined* here. */
+            prefix = GetPrefix(ns3);
+            if (!prefix) {
+                prefix = GeneratePrefix(cx, GetURI(ns3), &ancdecls);
+                if (!prefix)
+                    goto out;
+                ns3->fslots[JSSLOT_PREFIX] = STRING_TO_JSVAL(prefix);
+            }
 
-        /* 17(c)(iii). */
-        if (!IS_EMPTY(prefix)) {
-            js_AppendChar(&sb, ':');
-            js_AppendJSString(&sb, prefix);
-        }
+            /* 17(c)(iii). */
+            if (!prefix->empty()) {
+                if (!cb.append(':') || !AppendString(cb, prefix))
+                    goto out;
+            }
 
-        /* 17(d-g). */
-        AppendAttributeValue(cx, &sb, GetURI(ns2));
+            /* 17(d-g). */
+            if (!AppendAttributeValue(cx, cb, GetURI(ns3)))
+                goto out;
+        }
     }
-    XMLArrayCursorFinish(&cursor);
-    if (ns2)
-        goto out;
 
     /* Step 18: handle point tags. */
     n = xml->xml_kids.length;
     if (n == 0) {
-        js_AppendCString(&sb, "/>");
+        if (!js_AppendLiteral(cb, "/>"))
+            goto out;
     } else {
         /* Steps 19 through 25: handle element content, and open the end-tag. */
-        js_AppendChar(&sb, '>');
-        indentKids = n > 1 ||
-                     (n == 1 &&
-                      (kid = XMLARRAY_MEMBER(&xml->xml_kids, 0, JSXML)) &&
-                      kid->xml_class != JSXML_CLASS_TEXT);
+        if (!cb.append('>'))
+            goto out;
+        {
+            JSXML *kid;
+            indentKids = n > 1 ||
+                         (n == 1 &&
+                          (kid = XMLARRAY_MEMBER(&xml->xml_kids, 0, JSXML)) &&
+                          kid->xml_class != JSXML_CLASS_TEXT);
+        }
 
         if (pretty && indentKids) {
             if (!GetUint32XMLSetting(cx, js_prettyIndent_str, &i))
@@ -2876,49 +2801,46 @@ XMLToXMLString(JSContext *cx, JSXML *xml, const JSXMLArray *ancestorNSes,
             nextIndentLevel = indentLevel & TO_SOURCE_FLAG;
         }
 
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
-            if (pretty && indentKids)
-                js_AppendChar(&sb, '\n');
+        {
+            JSXMLArrayCursor cursor(&xml->xml_kids);
+            while (JSXML *kid = (JSXML *) cursor.getNext()) {
+                if (pretty && indentKids) {
+                    if (!cb.append('\n'))
+                        goto out;
+                }
 
-            kidstr = XMLToXMLString(cx, kid, &ancdecls, nextIndentLevel);
-            if (!kidstr)
-                break;
+                JSString *kidstr = XMLToXMLString(cx, kid, &ancdecls, nextIndentLevel);
+                if (!kidstr)
+                    goto out;
 
-            js_AppendJSString(&sb, kidstr);
+                if (!AppendString(cb, kidstr))
+                    goto out;
+            }
         }
-        XMLArrayCursorFinish(&cursor);
-        if (kid)
-            goto out;
 
         if (pretty && indentKids) {
-            js_AppendChar(&sb, '\n');
-            js_RepeatChar(&sb, ' ', indentLevel & ~TO_SOURCE_FLAG);
+            if (!cb.append('\n') ||
+                !cb.appendN(' ', indentLevel & ~TO_SOURCE_FLAG))
+                goto out;
         }
-        js_AppendCString(&sb, "</");
+        if (!js_AppendLiteral(cb, "</"))
+            goto out;
 
         /* Step 26. */
         prefix = GetPrefix(ns);
-        if (prefix && !IS_EMPTY(prefix)) {
-            js_AppendJSString(&sb, prefix);
-            js_AppendChar(&sb, ':');
+        if (prefix && !prefix->empty()) {
+            if (!AppendString(cb, prefix) || !cb.append(':'))
+                goto out;
         }
 
         /* Step 27. */
-        js_AppendJSString(&sb, GetLocalName(xml->name));
-        js_AppendChar(&sb, '>');
-    }
-
-    if (!STRING_BUFFER_OK(&sb)) {
-        JS_ReportOutOfMemory(cx);
-        goto out;
+        if (!AppendString(cb, GetLocalName(xml->name)) || !cb.append('>'))
+            goto out;
     }
 
-    str = js_NewString(cx, sb.base, STRING_BUFFER_OFFSET(&sb));
+    str = js_NewStringFromCharBuffer(cx, cb);
 out:
     js_LeaveLocalRootScopeWithResult(cx, STRING_TO_JSVAL(str));
-    if (!str && STRING_BUFFER_OK(&sb))
-        js_FinishStringBuffer(&sb);
     XMLArrayFinish(cx, &decls);
     if (ancdecls.capacity != 0)
         XMLArrayFinish(cx, &ancdecls);
@@ -2943,21 +2865,24 @@ ToXMLString(JSContext *cx, jsval v, uint32 toSourceFlag)
     if (JSVAL_IS_BOOLEAN(v) || JSVAL_IS_NUMBER(v))
         return js_ValueToString(cx, v);
 
-    if (JSVAL_IS_STRING(v))
-        return EscapeElementValue(cx, NULL, JSVAL_TO_STRING(v));
+    if (JSVAL_IS_STRING(v)) {
+        JSCharBuffer cb(cx);
+        return EscapeElementValue(cx, cb, JSVAL_TO_STRING(v));
+    }
 
     obj = JSVAL_TO_OBJECT(v);
     if (!OBJECT_IS_XML(cx, obj)) {
-        if (!OBJ_DEFAULT_VALUE(cx, obj, JSTYPE_STRING, &v))
+        if (!obj->defaultValue(cx, JSTYPE_STRING, &v))
             return NULL;
         str = js_ValueToString(cx, v);
         if (!str)
             return NULL;
-        return EscapeElementValue(cx, NULL, str);
+        JSCharBuffer cb(cx);
+        return EscapeElementValue(cx, cb, str);
     }
 
     /* Handle non-element cases in this switch, returning from each case. */
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     return XMLToXMLString(cx, xml, NULL, toSourceFlag | 0);
 }
 
@@ -3084,8 +3009,8 @@ ToXMLName(JSContext *cx, jsval v, jsid *funidp)
     if (js_IdIsIndex(STRING_TO_JSVAL(name), &index))
         goto bad;
 
-    if (*JSSTRING_CHARS(name) == '@') {
-        name = js_NewDependentString(cx, name, 1, JSSTRING_LENGTH(name) - 1);
+    if (*name->chars() == '@') {
+        name = js_NewDependentString(cx, name, 1, name->length() - 1);
         if (!name)
             return NULL;
         *funidp = 0;
@@ -3135,7 +3060,7 @@ AddInScopeNamespace(JSContext *cx, JSXML *xml, JSObject *ns)
         if (!match && !XMLARRAY_ADD_MEMBER(cx, &xml->xml_namespaces, n, ns))
             return JS_FALSE;
     } else {
-        if (IS_EMPTY(prefix) && IS_EMPTY(GetURI(xml->name)))
+        if (prefix->empty() && GetURI(xml->name)->empty())
             return JS_TRUE;
         match = NULL;
 #ifdef __GNUC__         /* suppress bogus gcc warnings */
@@ -3209,7 +3134,6 @@ static JSXML *
 DeepCopy(JSContext *cx, JSXML *xml, JSObject *obj, uintN flags)
 {
     JSXML *copy;
-    JSBool ok;
 
     /* Our caller may not be protecting newborns with a local root scope. */
     if (!js_EnterLocalRootScope(cx))
@@ -3218,14 +3142,11 @@ DeepCopy(JSContext *cx, JSXML *xml, JSObject *obj, uintN flags)
     if (copy) {
         if (obj) {
             /* Caller provided the object for this copy, hook 'em up. */
-            ok = JS_SetPrivate(cx, obj, copy);
-            if (ok)
-                copy->object = obj;
-        } else {
-            ok = js_GetXMLObject(cx, copy) != NULL;
-        }
-        if (!ok)
+            obj->setPrivate(copy);
+            copy->object = obj;
+        } else if (!js_GetXMLObject(cx, copy)) {
             copy = NULL;
+        }
     }
     js_LeaveLocalRootScopeWithResult(cx, (jsval) copy);
     return copy;
@@ -3241,9 +3162,7 @@ DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent,
                  uintN flags)
 {
     uint32 j, n;
-    JSXMLArrayCursor cursor;
-    JSBool ok;
-    JSXML *kid, *kid2;
+    JSXML *kid2;
     JSString *str;
 
     JS_ASSERT(cx->localRootStack);
@@ -3252,10 +3171,9 @@ DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent,
     if (!XMLArraySetCapacity(cx, to, n))
         return JS_FALSE;
 
-    XMLArrayCursorInit(&cursor, from);
+    JSXMLArrayCursor cursor(from);
     j = 0;
-    ok = JS_TRUE;
-    while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+    while (JSXML *kid = (JSXML *) cursor.getNext()) {
         if ((flags & XSF_IGNORE_COMMENTS) &&
             kid->xml_class == JSXML_CLASS_COMMENT) {
             continue;
@@ -3271,8 +3189,7 @@ DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent,
         kid2 = DeepCopyInLRS(cx, kid, flags);
         if (!kid2) {
             to->length = j;
-            ok = JS_FALSE;
-            break;
+            return JS_FALSE;
         }
 
         if ((flags & XSF_IGNORE_WHITESPACE) &&
@@ -3280,8 +3197,7 @@ DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent,
             str = ChompXMLWhitespace(cx, kid2->xml_value);
             if (!str) {
                 to->length = j;
-                ok = JS_FALSE;
-                break;
+                return JS_FALSE;
             }
             kid2->xml_value = str;
         }
@@ -3291,9 +3207,6 @@ DeepCopySetInLRS(JSContext *cx, JSXMLArray *from, JSXMLArray *to, JSXML *parent,
         if (parent->xml_class != JSXML_CLASS_LIST)
             kid2->parent = parent;
     }
-    XMLArrayCursorFinish(&cursor);
-    if (!ok)
-        return JS_FALSE;
 
     if (j < n)
         XMLArrayTrim(to);
@@ -3466,7 +3379,7 @@ Descendants(JSContext *cx, JSXML *xml, jsval id)
     listobj = js_NewXMLObject(cx, JSXML_CLASS_LIST);
     if (!listobj)
         return NULL;
-    list = (JSXML *) JS_GetPrivate(cx, listobj);
+    list = (JSXML *) listobj->getPrivate();
     if (funid)
         return list;
 
@@ -3505,9 +3418,7 @@ XMLEquals(JSContext *cx, JSXML *xml, JSXML *vxml, JSBool *bp)
 {
     JSObject *qn, *vqn;
     uint32 i, j, n;
-    JSXMLArrayCursor cursor, vcursor;
     JSXML *kid, *vkid, *attr, *vattr;
-    JSBool ok;
     JSObject *xobj, *vobj;
 
 retry:
@@ -3543,27 +3454,25 @@ retry:
     } else if (xml->xml_kids.length != vxml->xml_kids.length) {
         *bp = JS_FALSE;
     } else {
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        XMLArrayCursorInit(&vcursor, &vxml->xml_kids);
-        for (;;) {
-            kid = (JSXML *) XMLArrayCursorNext(&cursor);
-            vkid = (JSXML *) XMLArrayCursorNext(&vcursor);
-            if (!kid || !vkid) {
-                *bp = !kid && !vkid;
-                ok = JS_TRUE;
-                break;
+        {
+            JSXMLArrayCursor cursor(&xml->xml_kids);
+            JSXMLArrayCursor vcursor(&vxml->xml_kids);
+            for (;;) {
+                kid = (JSXML *) cursor.getNext();
+                vkid = (JSXML *) vcursor.getNext();
+                if (!kid || !vkid) {
+                    *bp = !kid && !vkid;
+                    break;
+                }
+                xobj = js_GetXMLObject(cx, kid);
+                vobj = js_GetXMLObject(cx, vkid);
+                if (!xobj || !vobj ||
+                    !js_TestXMLEquality(cx, xobj, OBJECT_TO_JSVAL(vobj), bp))
+                    return JS_FALSE;
+                if (!*bp)
+                    break;
             }
-            xobj = js_GetXMLObject(cx, kid);
-            vobj = js_GetXMLObject(cx, vkid);
-            ok = xobj && vobj &&
-                 js_TestXMLEquality(cx, xobj, OBJECT_TO_JSVAL(vobj), bp);
-            if (!ok || !*bp)
-                break;
         }
-        XMLArrayCursorFinish(&vcursor);
-        XMLArrayCursorFinish(&cursor);
-        if (!ok)
-            return JS_FALSE;
 
         if (*bp && xml->xml_class == JSXML_CLASS_ELEMENT) {
             n = xml->xml_attrs.length;
@@ -3616,7 +3525,7 @@ Equals(JSContext *cx, JSXML *xml, jsval v, JSBool *bp)
         if (!OBJECT_IS_XML(cx, vobj)) {
             *bp = JS_FALSE;
         } else {
-            vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+            vxml = (JSXML *) vobj->getPrivate();
             if (!XMLEquals(cx, xml, vxml, bp))
                 return JS_FALSE;
         }
@@ -3657,7 +3566,7 @@ Insert(JSContext *cx, JSXML *xml, uint32 i, jsval v)
     if (!JSVAL_IS_PRIMITIVE(v)) {
         vobj = JSVAL_TO_OBJECT(v);
         if (OBJECT_IS_XML(cx, vobj)) {
-            vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+            vxml = (JSXML *) vobj->getPrivate();
             if (vxml->xml_class == JSXML_CLASS_LIST) {
                 n = vxml->xml_kids.length;
                 if (n == 0)
@@ -3751,7 +3660,7 @@ Replace(JSContext *cx, JSXML *xml, uint32 i, jsval v)
     if (!JSVAL_IS_PRIMITIVE(v)) {
         vobj = JSVAL_TO_OBJECT(v);
         if (OBJECT_IS_XML(cx, vobj))
-            vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+            vxml = (JSXML *) vobj->getPrivate();
     }
 
     switch (vxml ? JSXMLClass(vxml->xml_class) : JSXML_CLASS_LIMIT) {
@@ -3894,21 +3803,16 @@ GetNamedProperty(JSContext *cx, JSXML *xml, JSObject* nameqn, JSXML *list)
 {
     JSXMLArray *array;
     JSXMLNameMatcher matcher;
-    JSXMLArrayCursor cursor;
-    JSXML *kid;
     JSBool attrs;
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+        JSXMLArrayCursor cursor(&xml->xml_kids);
+        while (JSXML *kid = (JSXML *) cursor.getNext()) {
             if (kid->xml_class == JSXML_CLASS_ELEMENT &&
                 !GetNamedProperty(cx, kid, nameqn, list)) {
-                break;
+                return JS_FALSE;
             }
         }
-        XMLArrayCursorFinish(&cursor);
-        if (kid)
-            return JS_FALSE;
     } else if (xml->xml_class == JSXML_CLASS_ELEMENT) {
         attrs = (OBJ_GET_CLASS(cx, nameqn) == &js_AttributeNameClass);
         if (attrs) {
@@ -3919,21 +3823,18 @@ GetNamedProperty(JSContext *cx, JSXML *xml, JSObject* nameqn, JSXML *list)
             matcher = MatchElemName;
         }
 
-        XMLArrayCursorInit(&cursor, array);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+        JSXMLArrayCursor cursor(array);
+        while (JSXML *kid = (JSXML *) cursor.getNext()) {
             if (matcher(nameqn, kid)) {
                 if (!attrs &&
                     kid->xml_class == JSXML_CLASS_ELEMENT &&
                     !SyncInScopeNamespaces(cx, kid)) {
-                    break;
+                    return JS_FALSE;
                 }
                 if (!Append(cx, list, kid))
-                    break;
+                    return JS_FALSE;
             }
         }
-        XMLArrayCursorFinish(&cursor);
-        if (kid)
-            return JS_FALSE;
     }
 
     return JS_TRUE;
@@ -4001,7 +3902,7 @@ GetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
         roots[1] = OBJECT_TO_JSVAL(listobj);
         tvr.count++;
 
-        list = (JSXML *) JS_GetPrivate(cx, listobj);
+        list = (JSXML *) listobj->getPrivate();
         if (!GetNamedProperty(cx, xml, nameqn, list)) {
             listobj = NULL;
         } else {
@@ -4087,7 +3988,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
     if (!JSVAL_IS_PRIMITIVE(*vp)) {
         vobj = JSVAL_TO_OBJECT(*vp);
         if (OBJECT_IS_XML(cx, vobj))
-            vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+            vxml = (JSXML *) vobj->getPrivate();
     }
 
     ok = js_EnterLocalRootScope(cx);
@@ -4166,8 +4067,6 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                     goto bad;
             } else {
                 nameobj = targetprop;
-                if (!nameobj)
-                    goto bad;
                 if (OBJ_GET_CLASS(cx, nameobj) == &js_AttributeNameClass) {
                     /*
                      * 2(c)(iii)(1-3).
@@ -4180,7 +4079,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                     if (JSVAL_IS_PRIMITIVE(attrval))    /* no such attribute */
                         goto out;
                     attrobj = JSVAL_TO_OBJECT(attrval);
-                    attr = (JSXML *) JS_GetPrivate(cx, attrobj);
+                    attr = (JSXML *) attrobj->getPrivate();
                     if (JSXML_LENGTH(attr) != 0)
                         goto out;
 
@@ -4286,7 +4185,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                 ok = GetProperty(cx, parentobj, id, vp);
                 if (!ok)
                     goto out;
-                attr = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(*vp));
+                attr = (JSXML *) JSVAL_TO_OBJECT(*vp)->getPrivate();
 
                 /* 2(e)(iii) - the length check comes from the bug 375406. */
                 if (attr->xml_kids.length != 0)
@@ -4379,7 +4278,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                 if (!vobj)
                     goto bad;
                 roots[VAL_ROOT] = *vp = OBJECT_TO_JSVAL(vobj);
-                vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+                vxml = (JSXML *) vobj->getPrivate();
             }
             XMLARRAY_SET_MEMBER(&xml->xml_kids, i, vxml);
         }
@@ -4642,7 +4541,7 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                 vobj = js_NewXMLObject(cx, JSXML_CLASS_ELEMENT);
                 if (!vobj)
                     goto bad;
-                vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+                vxml = (JSXML *) vobj->getPrivate();
                 vxml->parent = xml;
                 vxml->name = nameqn;
 
@@ -4661,11 +4560,9 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
 
         /* 14. */
         if (primitiveAssign) {
-            JSXMLArrayCursor cursor;
-
-            XMLArrayCursorInit(&cursor, &xml->xml_kids);
+            JSXMLArrayCursor cursor(&xml->xml_kids);
             cursor.index = matchIndex;
-            kid = (JSXML *) XMLArrayCursorItem(&cursor);
+            kid = (JSXML *) cursor.getCurrent();
             if (JSXML_HAS_KIDS(kid)) {
                 XMLArrayFinish(cx, &kid->xml_kids);
                 ok = XMLArrayInit(cx, &kid->xml_kids, 1);
@@ -4675,13 +4572,12 @@ PutProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
             /* XXXbe Erratum? redundant w.r.t. 7(b-c) else clause above */
             if (ok) {
                 ok = JS_ConvertValue(cx, *vp, JSTYPE_STRING, vp);
-                if (ok && !IS_EMPTY(JSVAL_TO_STRING(*vp))) {
+                if (ok && !JSVAL_TO_STRING(*vp)->empty()) {
                     roots[VAL_ROOT] = *vp;
-                    if ((JSXML *) XMLArrayCursorItem(&cursor) == kid)
+                    if ((JSXML *) cursor.getCurrent() == kid)
                         ok = Replace(cx, kid, 0, *vp);
                 }
             }
-            XMLArrayCursorFinish(&cursor);
         } else {
             /* 15(a). */
             ok = Replace(cx, xml, matchIndex, *vp);
@@ -4744,7 +4640,7 @@ ResolveValue(JSContext *cx, JSXML *list, JSXML **result)
     id = OBJECT_TO_JSVAL(targetprop);
     if (!GetProperty(cx, base->object, id, &tv))
         return JS_FALSE;
-    target = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(tv));
+    target = (JSXML *) JSVAL_TO_OBJECT(tv)->getPrivate();
 
     if (JSXML_LENGTH(target) == 0) {
         if (base->xml_class == JSXML_CLASS_LIST && JSXML_LENGTH(base) > 1) {
@@ -4756,7 +4652,7 @@ ResolveValue(JSContext *cx, JSXML *list, JSXML **result)
             return JS_FALSE;
         if (!GetProperty(cx, base->object, id, &tv))
             return JS_FALSE;
-        target = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(tv));
+        target = (JSXML *) JSVAL_TO_OBJECT(tv)->getPrivate();
     }
 
     *result = target;
@@ -4767,21 +4663,18 @@ static JSBool
 HasNamedProperty(JSXML *xml, JSObject *nameqn)
 {
     JSBool found;
-    JSXMLArrayCursor cursor;
-    JSXML *kid;
     JSXMLArray *array;
     JSXMLNameMatcher matcher;
     uint32 i, n;
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         found = JS_FALSE;
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+        JSXMLArrayCursor cursor(&xml->xml_kids);
+        while (JSXML *kid = (JSXML *) cursor.getNext()) {
             found = HasNamedProperty(kid, nameqn);
             if (found)
                 break;
         }
-        XMLArrayCursorFinish(&cursor);
         return found;
     }
 
@@ -4794,7 +4687,7 @@ HasNamedProperty(JSXML *xml, JSObject *nameqn)
             matcher = MatchElemName;
         }
         for (i = 0, n = array->length; i < n; i++) {
-            kid = XMLARRAY_MEMBER(array, i, JSXML);
+            JSXML *kid = XMLARRAY_MEMBER(array, i, JSXML);
             if (kid && matcher(nameqn, kid))
                 return JS_TRUE;
         }
@@ -4832,9 +4725,9 @@ HasFunctionProperty(JSContext *cx, JSObject *obj, jsid funid, JSBool *found)
     if (!js_LookupProperty(cx, obj, funid, &pobj, &prop))
         return JS_FALSE;
     if (prop) {
-        OBJ_DROP_PROPERTY(cx, pobj, prop);
+        pobj->dropProperty(cx, prop);
     } else {
-        xml = (JSXML *) JS_GetPrivate(cx, obj);
+        xml = (JSXML *) obj->getPrivate();
         if (HasSimpleContent(xml)) {
             /*
              * Search in String.prototype to set found whenever
@@ -4847,7 +4740,7 @@ HasFunctionProperty(JSContext *cx, JSObject *obj, jsid funid, JSBool *found)
             if (ok) {
                 ok = js_LookupProperty(cx, tvr.u.object, funid, &pobj, &prop);
                 if (ok && prop)
-                    OBJ_DROP_PROPERTY(cx, pobj, prop);
+                    pobj->dropProperty(cx, prop);
             }
             JS_POP_TEMP_ROOT(cx, &tvr);
             if (!ok)
@@ -4867,7 +4760,7 @@ HasProperty(JSContext *cx, JSObject *obj, jsval id, JSBool *found)
     JSObject *qn;
     jsid funid;
 
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     if (js_IdIsIndex(id, &i)) {
         *found = HasIndexedProperty(xml, i);
     } else {
@@ -4887,9 +4780,7 @@ HasProperty(JSContext *cx, JSObject *obj, jsval id, JSBool *found)
 static void
 xml_finalize(JSContext *cx, JSObject *obj)
 {
-    JSXML *xml;
-
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    JSXML *xml = (JSXML *) obj->getPrivate();
     if (!xml)
         return;
     if (xml->object == obj)
@@ -4915,7 +4806,7 @@ xml_trace_vector(JSTracer *trc, JSXML **vec, uint32 len)
  * js_XMLObjectOps.newObjectMap is null, so XML objects appear to be native.
  * Thus xml_lookupProperty must return a valid JSScopeProperty pointer
  * parameter via *propp to signify "property found".  Since the only call to
- * xml_lookupProperty is via OBJ_LOOKUP_PROPERTY, and then only from
+ * xml_lookupProperty is via JSObject::lookupProperty, and then only from
  * js_FindProperty (in jsobj.c, called from jsinterp.c) or from JSOP_IN case
  * in the interpreter, the only time we add a JSScopeProperty here is when an
  * unqualified name is being accessed or when "name in xml" is called.
@@ -4948,7 +4839,7 @@ xml_lookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
     JSScopeProperty *sprop;
 
     v = ID_TO_VALUE(id);
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     if (js_IdIsIndex(v, &i)) {
         found = HasIndexedProperty(xml, i);
     } else {
@@ -4978,21 +4869,15 @@ xml_lookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
 
 static JSBool
 xml_defineProperty(JSContext *cx, JSObject *obj, jsid id, jsval value,
-                   JSPropertyOp getter, JSPropertyOp setter, uintN attrs,
-                   JSProperty **propp)
+                   JSPropertyOp getter, JSPropertyOp setter, uintN attrs)
 {
     if (VALUE_IS_FUNCTION(cx, value) || getter || setter ||
         (attrs & JSPROP_ENUMERATE) == 0 ||
         (attrs & (JSPROP_READONLY | JSPROP_PERMANENT | JSPROP_SHARED))) {
-        return js_DefineProperty(cx, obj, id, value, getter, setter, attrs,
-                                 propp);
+        return js_DefineProperty(cx, obj, id, value, getter, setter, attrs);
     }
 
-    if (!PutProperty(cx, obj, ID_TO_VALUE(id), &value))
-        return JS_FALSE;
-    if (propp)
-        *propp = NULL;
-    return JS_TRUE;
+    return PutProperty(cx, obj, ID_TO_VALUE(id), &value);
 }
 
 static JSBool
@@ -5060,7 +4945,7 @@ xml_deleteProperty(JSContext *cx, JSObject *obj, jsid id, jsval *rval)
     jsid funid;
 
     idval = ID_TO_VALUE(id);
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     if (js_IdIsIndex(idval, &index)) {
         if (xml->xml_class != JSXML_CLASS_LIST) {
             /* See NOTE in spec: this variation is reserved for future use. */
@@ -5103,7 +4988,7 @@ xml_defaultValue(JSContext *cx, JSObject *obj, JSType hint, jsval *vp)
 
     if (hint == JSTYPE_OBJECT) {
         /* Called from for..in code in js_Interpret: return an XMLList. */
-        xml = (JSXML *) JS_GetPrivate(cx, obj);
+        xml = (JSXML *) obj->getPrivate();
         if (xml->xml_class != JSXML_CLASS_LIST) {
             obj = ToXMLList(cx, OBJECT_TO_JSVAL(obj));
             if (!obj)
@@ -5124,7 +5009,7 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
     uint32 length, index;
     JSXMLArrayCursor *cursor;
 
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *)obj->getPrivate();
     length = JSXML_LENGTH(xml);
 
     switch (enum_op) {
@@ -5132,10 +5017,9 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
         if (length == 0) {
             cursor = NULL;
         } else {
-            cursor = (JSXMLArrayCursor *) JS_malloc(cx, sizeof *cursor);
+            cursor = cx->create<JSXMLArrayCursor>(&xml->xml_kids);
             if (!cursor)
                 return JS_FALSE;
-            XMLArrayCursorInit(cursor, &xml->xml_kids);
         }
         *statep = PRIVATE_TO_JSVAL(cursor);
         if (idp)
@@ -5153,10 +5037,8 @@ xml_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
 
       case JSENUMERATE_DESTROY:
         cursor = (JSXMLArrayCursor *) JSVAL_TO_PRIVATE(*statep);
-        if (cursor) {
-            XMLArrayCursorFinish(cursor);
-            JS_free(cx, cursor);
-        }
+        if (cursor)
+            cx->destroy(cursor);
         *statep = JSVAL_NULL;
         break;
     }
@@ -5172,9 +5054,7 @@ xml_hasInstance(JSContext *cx, JSObject *obj, jsval v, JSBool *bp)
 static void
 xml_trace(JSTracer *trc, JSObject *obj)
 {
-    JSXML *xml;
-
-    xml = (JSXML *) JS_GetPrivate(trc->context, obj);
+    JSXML *xml = (JSXML *) obj->getPrivate();
     if (xml)
         JS_CALL_TRACER(trc, xml, JSTRACE_XML, "private");
 }
@@ -5257,7 +5137,7 @@ js_EnumerateXMLValues(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
     JSObject *kidobj;
 
     JS_ASSERT(JS_InstanceOf(cx, obj, &js_XMLClass, NULL));
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     length = JSXML_LENGTH(xml);
     JS_ASSERT(INT_FITS_IN_JSVAL(length));
 
@@ -5266,10 +5146,9 @@ js_EnumerateXMLValues(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
         if (length == 0) {
             cursor = NULL;
         } else {
-            cursor = (JSXMLArrayCursor *) JS_malloc(cx, sizeof *cursor);
+            cursor = cx->create<JSXMLArrayCursor>(&xml->xml_kids);
             if (!cursor)
                 return JS_FALSE;
-            XMLArrayCursorInit(cursor, &xml->xml_kids);
         }
         *statep = PRIVATE_TO_JSVAL(cursor);
         if (idp)
@@ -5300,8 +5179,7 @@ js_EnumerateXMLValues(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
         cursor = (JSXMLArrayCursor *) JSVAL_TO_PRIVATE(*statep);
         if (cursor) {
       destroy:
-            XMLArrayCursorFinish(cursor);
-            JS_free(cx, cursor);
+            cx->destroy(cursor);
         }
         *statep = JSVAL_NULL;
         break;
@@ -5319,12 +5197,12 @@ js_TestXMLEquality(JSContext *cx, JSObject *obj, jsval v, JSBool *bp)
     jsdouble d, d2;
 
     JS_ASSERT(JS_InstanceOf(cx, obj, &js_XMLClass, NULL));
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     vxml = NULL;
     if (!JSVAL_IS_PRIMITIVE(v)) {
         vobj = JSVAL_TO_OBJECT(v);
         if (OBJECT_IS_XML(cx, vobj))
-            vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+            vxml = (JSXML *) vobj->getPrivate();
     }
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
@@ -5402,21 +5280,21 @@ js_ConcatenateXML(JSContext *cx, JSObject *obj, jsval v, jsval *vp)
         goto out;
     }
 
-    list = (JSXML *) JS_GetPrivate(cx, listobj);
-    lxml = (JSXML *) JS_GetPrivate(cx, obj);
+    list = (JSXML *) listobj->getPrivate();
+    lxml = (JSXML *) obj->getPrivate();
     ok = Append(cx, list, lxml);
     if (!ok)
         goto out;
 
     if (VALUE_IS_XML(cx, v)) {
-        rxml = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(v));
+        rxml = (JSXML *) JSVAL_TO_OBJECT(v)->getPrivate();
     } else {
         robj = ToXML(cx, v);
         if (!robj) {
             ok = JS_FALSE;
             goto out;
         }
-        rxml = (JSXML *) JS_GetPrivate(cx, robj);
+        rxml = (JSXML *) robj->getPrivate();
     }
     ok = Append(cx, list, rxml);
     if (!ok)
@@ -5439,8 +5317,7 @@ JS_FRIEND_DATA(JSObjectOps) js_XMLObjectOps = {
     NULL,                       NULL,
     NULL,                       NULL,
     xml_hasInstance,            js_TraceObject,
-    xml_clear,                  NULL,
-    NULL
+    xml_clear
 };
 
 static JSObjectOps *
@@ -5553,7 +5430,7 @@ xml_appendChild(JSContext *cx, uintN argc, jsval *vp)
     JS_ASSERT(!JSVAL_IS_PRIMITIVE(v));
     vobj = JSVAL_TO_OBJECT(v);
     JS_ASSERT(OBJECT_IS_XML(cx, vobj));
-    vxml = (JSXML *) JS_GetPrivate(cx, vobj);
+    vxml = (JSXML *) vobj->getPrivate();
     JS_ASSERT(vxml->xml_class == JSXML_CLASS_LIST);
 
     if (!IndexToIdVal(cx, vxml->xml_kids.length, &name))
@@ -5589,20 +5466,14 @@ xml_attribute(JSContext *cx, uintN argc, jsval *vp)
 static JSBool
 xml_attributes(JSContext *cx, uintN argc, jsval *vp)
 {
-    jsval name;
-    JSObject *qn;
-    JSTempValueRooter tvr;
-    JSBool ok;
-
-    name = ATOM_KEY(cx->runtime->atomState.starAtom);
-    qn = ToAttributeName(cx, name);
+    jsval name = ATOM_KEY(cx->runtime->atomState.starAtom);
+    JSObject *qn = ToAttributeName(cx, name);
     if (!qn)
         return JS_FALSE;
     name = OBJECT_TO_JSVAL(qn);
-    JS_PUSH_SINGLE_TEMP_ROOT(cx, name, &tvr);
-    ok = GetProperty(cx, JS_THIS_OBJECT(cx, vp), name, vp);
-    JS_POP_TEMP_ROOT(cx, &tvr);
-    return ok;
+
+    JSAutoTempValueRooter tvr(cx, name);
+    return GetProperty(cx, JS_THIS_OBJECT(cx, vp), name, vp);
 }
 
 static JSXML *
@@ -5616,7 +5487,7 @@ xml_list_helper(JSContext *cx, JSXML *xml, jsval *rval)
         return NULL;
 
     *rval = OBJECT_TO_JSVAL(listobj);
-    list = (JSXML *) JS_GetPrivate(cx, listobj);
+    list = (JSXML *) listobj->getPrivate();
     list->xml_target = xml;
     return list;
 }
@@ -5657,8 +5528,7 @@ static JSBool
 xml_child(JSContext *cx, uintN argc, jsval *vp)
 {
     jsval name, v;
-    JSXML *list, *kid, *vxml;
-    JSXMLArrayCursor cursor;
+    JSXML *list, *vxml;
     JSObject *kidobj;
 
     XML_METHOD_PROLOG;
@@ -5669,27 +5539,26 @@ xml_child(JSContext *cx, uintN argc, jsval *vp)
         if (!list)
             return JS_FALSE;
 
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+        JSXMLArrayCursor cursor(&xml->xml_kids);
+        while (JSXML *kid = (JSXML *) cursor.getNext()) {
             kidobj = js_GetXMLObject(cx, kid);
             if (!kidobj)
-                break;
+                return JS_FALSE;
             if (!xml_child_helper(cx, kidobj, kid, name, &v))
-                break;
+                return JS_FALSE;
             if (JSVAL_IS_VOID(v)) {
                 /* The property didn't exist in this kid. */
                 continue;
             }
 
             JS_ASSERT(!JSVAL_IS_PRIMITIVE(v));
-            vxml = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(v));
+            vxml = (JSXML *) JSVAL_TO_OBJECT(v)->getPrivate();
             if ((!JSXML_HAS_KIDS(vxml) || vxml->xml_kids.length != 0) &&
                 !Append(cx, list, vxml)) {
-                break;
+                return JS_FALSE;
             }
         }
-        XMLArrayCursorFinish(&cursor);
-        return !kid;
+        return JS_TRUE;
     }
 
     /* ECMA-357 Edition 2 13.3.4.6 (note 13.3, not 13.4 as in Edition 1). */
@@ -5764,7 +5633,7 @@ xml_comments_helper(JSContext *cx, JSObject *obj, JSXML *xml, jsval *vp)
                 js_LeaveLocalRootScopeWithResult(cx, v);
                 if (!ok)
                     break;
-                vxml = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(v));
+                vxml = (JSXML *) JSVAL_TO_OBJECT(v)->getPrivate();
                 if (JSXML_LENGTH(vxml) != 0) {
                     ok = Append(cx, list, vxml);
                     if (!ok)
@@ -5800,25 +5669,20 @@ xml_contains(JSContext *cx, uintN argc, jsval *vp)
 {
     jsval value;
     JSBool eq;
-    JSXMLArrayCursor cursor;
-    JSXML *kid;
     JSObject *kidobj;
 
     XML_METHOD_PROLOG;
     value = argc != 0 ? vp[2] : JSVAL_VOID;
     if (xml->xml_class == JSXML_CLASS_LIST) {
         eq = JS_FALSE;
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+        JSXMLArrayCursor cursor(&xml->xml_kids);
+        while (JSXML *kid = (JSXML *) cursor.getNext()) {
             kidobj = js_GetXMLObject(cx, kid);
             if (!kidobj || !js_TestXMLEquality(cx, kidobj, value, &eq))
-                break;
+                return JS_FALSE;
             if (eq)
                 break;
         }
-        XMLArrayCursorFinish(&cursor);
-        if (kid && !eq)
-            return JS_FALSE;
     } else {
         if (!js_TestXMLEquality(cx, obj, value, &eq))
             return JS_FALSE;
@@ -5862,10 +5726,9 @@ static JSBool
 xml_elements_helper(JSContext *cx, JSObject *obj, JSXML *xml,
                     JSObject *nameqn, jsval *vp)
 {
-    JSXML *list, *kid, *vxml;
+    JSXML *list, *vxml;
     jsval v;
     JSBool ok;
-    JSXMLArrayCursor cursor;
     JSObject *kidobj;
     uint32 i, n;
 
@@ -5878,8 +5741,8 @@ xml_elements_helper(JSContext *cx, JSObject *obj, JSXML *xml,
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         /* 13.5.4.6 */
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+        JSXMLArrayCursor cursor(&xml->xml_kids);
+        while (JSXML *kid = (JSXML *) cursor.getNext()) {
             if (kid->xml_class == JSXML_CLASS_ELEMENT) {
                 ok = js_EnterLocalRootScope(cx);
                 if (!ok)
@@ -5894,7 +5757,7 @@ xml_elements_helper(JSContext *cx, JSObject *obj, JSXML *xml,
                 js_LeaveLocalRootScopeWithResult(cx, v);
                 if (!ok)
                     break;
-                vxml = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(v));
+                vxml = (JSXML *) JSVAL_TO_OBJECT(v)->getPrivate();
                 if (JSXML_LENGTH(vxml) != 0) {
                     ok = Append(cx, list, vxml);
                     if (!ok)
@@ -5902,10 +5765,9 @@ xml_elements_helper(JSContext *cx, JSObject *obj, JSXML *xml,
                 }
             }
         }
-        XMLArrayCursorFinish(&cursor);
     } else {
         for (i = 0, n = JSXML_LENGTH(xml); i < n; i++) {
-            kid = XMLARRAY_MEMBER(&xml->xml_kids, i, JSXML);
+            JSXML *kid = XMLARRAY_MEMBER(&xml->xml_kids, i, JSXML);
             if (kid && kid->xml_class == JSXML_CLASS_ELEMENT &&
                 MatchElemName(nameqn, kid)) {
                 ok = Append(cx, list, kid);
@@ -5988,7 +5850,7 @@ again:
                 if (!kidobj)
                     return JS_FALSE;
                 obj = kidobj;
-                xml = (JSXML *) JS_GetPrivate(cx, obj);
+                xml = (JSXML *) obj->getPrivate();
                 goto again;
             }
         }
@@ -6085,7 +5947,7 @@ TempNSArrayToJSArray(JSContext *cx, JSTempRootedNSArray *tmp, jsval *rval)
         if (!ns)
             continue;
         tmp->value = OBJECT_TO_JSVAL(ns);
-        if (!OBJ_SET_PROPERTY(cx, arrayobj, INT_TO_JSID(i), &tmp->value))
+        if (!arrayobj->setProperty(cx, INT_TO_JSID(i), &tmp->value))
             return JS_FALSE;
     }
     return JS_TRUE;
@@ -6166,7 +6028,7 @@ xml_insertChildAfter(JSContext *cx, uintN argc, jsval *vp)
     } else {
         if (!VALUE_IS_XML(cx, arg))
             return JS_TRUE;
-        kid = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(arg));
+        kid = (JSXML *) JSVAL_TO_OBJECT(arg)->getPrivate();
         i = XMLARRAY_FIND_MEMBER(&xml->xml_kids, kid, NULL);
         if (i == XML_NOT_FOUND)
             return JS_TRUE;
@@ -6198,7 +6060,7 @@ xml_insertChildBefore(JSContext *cx, uintN argc, jsval *vp)
     } else {
         if (!VALUE_IS_XML(cx, arg))
             return JS_TRUE;
-        kid = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(arg));
+        kid = (JSXML *) JSVAL_TO_OBJECT(arg)->getPrivate();
         i = XMLARRAY_FIND_MEMBER(&xml->xml_kids, kid, NULL);
         if (i == XML_NOT_FOUND)
             return JS_TRUE;
@@ -6420,7 +6282,7 @@ xml_normalize_helper(JSContext *cx, JSObject *obj, JSXML *xml)
                 n = xml->xml_kids.length;
                 kid->xml_value = str;
             }
-            if (IS_EMPTY(kid->xml_value)) {
+            if (kid->xml_value->empty()) {
                 NormalizingDelete(cx, xml, i);
                 n = xml->xml_kids.length;
                 --i;
@@ -6483,9 +6345,8 @@ static JSBool
 xml_processingInstructions_helper(JSContext *cx, JSObject *obj, JSXML *xml,
                                   JSObject *nameqn, jsval *vp)
 {
-    JSXML *list, *kid, *vxml;
+    JSXML *list, *vxml;
     JSBool ok;
-    JSXMLArrayCursor cursor;
     JSObject *kidobj;
     jsval v;
     uint32 i, n;
@@ -6500,8 +6361,8 @@ xml_processingInstructions_helper(JSContext *cx, JSObject *obj, JSXML *xml,
 
     if (xml->xml_class == JSXML_CLASS_LIST) {
         /* 13.5.4.17 Step 4 (misnumbered 9 -- Erratum?). */
-        XMLArrayCursorInit(&cursor, &xml->xml_kids);
-        while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+        JSXMLArrayCursor cursor(&xml->xml_kids);
+        while (JSXML *kid = (JSXML *) cursor.getNext()) {
             if (kid->xml_class == JSXML_CLASS_ELEMENT) {
                 ok = js_EnterLocalRootScope(cx);
                 if (!ok)
@@ -6517,7 +6378,7 @@ xml_processingInstructions_helper(JSContext *cx, JSObject *obj, JSXML *xml,
                 js_LeaveLocalRootScopeWithResult(cx, v);
                 if (!ok)
                     break;
-                vxml = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(v));
+                vxml = (JSXML *) JSVAL_TO_OBJECT(v)->getPrivate();
                 if (JSXML_LENGTH(vxml) != 0) {
                     ok = Append(cx, list, vxml);
                     if (!ok)
@@ -6525,11 +6386,10 @@ xml_processingInstructions_helper(JSContext *cx, JSObject *obj, JSXML *xml,
                 }
             }
         }
-        XMLArrayCursorFinish(&cursor);
     } else {
         /* 13.4.4.28 Step 4. */
         for (i = 0, n = JSXML_LENGTH(xml); i < n; i++) {
-            kid = XMLARRAY_MEMBER(&xml->xml_kids, i, JSXML);
+            JSXML *kid = XMLARRAY_MEMBER(&xml->xml_kids, i, JSXML);
             if (kid && kid->xml_class == JSXML_CLASS_PROCESSING_INSTRUCTION) {
                 localName = GetLocalName(nameqn);
                 if (IS_STAR(localName) ||
@@ -6692,7 +6552,7 @@ xml_replace(JSContext *cx, uintN argc, jsval *vp)
     } else {
         value = vp[3];
         vxml = VALUE_IS_XML(cx, value)
-               ? (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(value))
+               ? (JSXML *) JSVAL_TO_OBJECT(value)->getPrivate()
                : NULL;
         if (!vxml) {
             if (!JS_ConvertValue(cx, value, JSTYPE_STRING, &vp[3]))
@@ -6885,7 +6745,7 @@ xml_setName(JSContext *cx, uintN argc, jsval *vp)
          * the constructor, because we know uri of nameqn is non-empty (so
          * prefix does not need to be converted from null to empty by QName).
          */
-        JS_ASSERT(!IS_EMPTY(GetURI(nameqn)));
+        JS_ASSERT(!GetURI(nameqn)->empty());
 
         nsarray = &nsowner->xml_namespaces;
         for (i = 0, n = nsarray->length; i < n; i++) {
@@ -6987,7 +6847,7 @@ xml_text_helper(JSContext *cx, JSObject *obj, JSXML *xml, jsval *vp)
                 js_LeaveLocalRootScopeWithResult(cx, v);
                 if (!ok)
                     return JS_FALSE;
-                vxml = (JSXML *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(v));
+                vxml = (JSXML *) JSVAL_TO_OBJECT(v)->getPrivate();
                 if (JSXML_LENGTH(vxml) != 0 && !Append(cx, list, vxml))
                     return JS_FALSE;
             }
@@ -7016,8 +6876,6 @@ static JSString *
 xml_toString_helper(JSContext *cx, JSXML *xml)
 {
     JSString *str, *kidstr;
-    JSXML *kid;
-    JSXMLArrayCursor cursor;
 
     if (xml->xml_class == JSXML_CLASS_ATTRIBUTE ||
         xml->xml_class == JSXML_CLASS_TEXT) {
@@ -7030,8 +6888,8 @@ xml_toString_helper(JSContext *cx, JSXML *xml)
     str = cx->runtime->emptyString;
     if (!js_EnterLocalRootScope(cx))
         return NULL;
-    XMLArrayCursorInit(&cursor, &xml->xml_kids);
-    while ((kid = (JSXML *) XMLArrayCursorNext(&cursor)) != NULL) {
+    JSXMLArrayCursor cursor(&xml->xml_kids);
+    while (JSXML *kid = (JSXML *) cursor.getNext()) {
         if (kid->xml_class != JSXML_CLASS_COMMENT &&
             kid->xml_class != JSXML_CLASS_PROCESSING_INSTRUCTION) {
             kidstr = xml_toString_helper(cx, kid);
@@ -7044,7 +6902,6 @@ xml_toString_helper(JSContext *cx, JSXML *xml)
                 break;
         }
     }
-    XMLArrayCursorFinish(&cursor);
     js_LeaveLocalRootScopeWithResult(cx, STRING_TO_JSVAL(str));
     return str;
 }
@@ -7260,7 +7117,7 @@ XML(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
     if (!xobj)
         return JS_FALSE;
     *rval = OBJECT_TO_JSVAL(xobj);
-    xml = (JSXML *) JS_GetPrivate(cx, xobj);
+    xml = (JSXML *) xobj->getPrivate();
 
     if (JS_IsConstructing(cx) && !JSVAL_IS_PRIMITIVE(v)) {
         vobj = JSVAL_TO_OBJECT(v);
@@ -7293,14 +7150,14 @@ XMLList(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
     if (JS_IsConstructing(cx) && !JSVAL_IS_PRIMITIVE(v)) {
         vobj = JSVAL_TO_OBJECT(v);
         if (OBJECT_IS_XML(cx, vobj)) {
-            xml = (JSXML *) JS_GetPrivate(cx, vobj);
+            xml = (JSXML *) vobj->getPrivate();
             if (xml->xml_class == JSXML_CLASS_LIST) {
                 listobj = js_NewXMLObject(cx, JSXML_CLASS_LIST);
                 if (!listobj)
                     return JS_FALSE;
                 *rval = OBJECT_TO_JSVAL(listobj);
 
-                list = (JSXML *) JS_GetPrivate(cx, listobj);
+                list = (JSXML *) listobj->getPrivate();
                 if (!Append(cx, list, xml))
                     return JS_FALSE;
                 return JS_TRUE;
@@ -7317,19 +7174,6 @@ XMLList(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
     return JS_TRUE;
 }
 
-#define JSXML_LIST_SIZE     (offsetof(JSXML, u) + sizeof(struct JSXMLListVar))
-#define JSXML_ELEMENT_SIZE  (offsetof(JSXML, u) + sizeof(struct JSXMLElemVar))
-#define JSXML_LEAF_SIZE     (offsetof(JSXML, u) + sizeof(JSString *))
-
-static size_t sizeof_JSXML[JSXML_CLASS_LIMIT] = {
-    JSXML_LIST_SIZE,        /* JSXML_CLASS_LIST */
-    JSXML_ELEMENT_SIZE,     /* JSXML_CLASS_ELEMENT */
-    JSXML_LEAF_SIZE,        /* JSXML_CLASS_ATTRIBUTE */
-    JSXML_LEAF_SIZE,        /* JSXML_CLASS_PROCESSING_INSTRUCTION */
-    JSXML_LEAF_SIZE,        /* JSXML_CLASS_TEXT */
-    JSXML_LEAF_SIZE         /* JSXML_CLASS_COMMENT */
-};
-
 #ifdef DEBUG_notme
 JSCList xml_leaks = JS_INIT_STATIC_CLIST(&xml_leaks);
 uint32  xml_serial;
@@ -7340,7 +7184,7 @@ js_NewXML(JSContext *cx, JSXMLClass xml_class)
 {
     JSXML *xml;
 
-    xml = (JSXML *) js_NewGCThing(cx, GCX_XML, sizeof_JSXML[xml_class]);
+    xml = (JSXML *) js_NewGCXML(cx, GCX_XML);
     if (!xml)
         return NULL;
 
@@ -7478,11 +7322,10 @@ NewXMLObject(JSContext *cx, JSXML *xml)
 {
     JSObject *obj;
 
-    obj = js_NewObject(cx, &js_XMLClass, NULL, NULL, 0);
-    if (!obj || !JS_SetPrivate(cx, obj, xml)) {
-        cx->weakRoots.newborn[GCX_OBJECT] = NULL;
+    obj = js_NewObject(cx, &js_XMLClass, NULL, NULL);
+    if (!obj)
         return NULL;
-    }
+    obj->setPrivate(xml);
     METER(xml_stats.xmlobj);
     return obj;
 }
@@ -7494,7 +7337,7 @@ js_GetXMLObject(JSContext *cx, JSXML *xml)
 
     obj = xml->object;
     if (obj) {
-        JS_ASSERT(JS_GetPrivate(cx, obj) == xml);
+        JS_ASSERT(obj->getPrivate() == xml);
         return obj;
     }
 
@@ -7571,16 +7414,17 @@ js_InitXMLClass(JSContext *cx, JSObject *obj)
         return NULL;
 
     xml = js_NewXML(cx, JSXML_CLASS_TEXT);
-    if (!xml || !JS_SetPrivate(cx, proto, xml))
+    if (!xml)
         return NULL;
+    proto->setPrivate(xml);
     xml->object = proto;
     METER(xml_stats.xmlobj);
 
     /*
      * Prepare to set default settings on the XML constructor we just made.
-     * NB: We can't use JS_GetConstructor, because it calls OBJ_GET_PROPERTY,
-     * which is xml_getProperty, which creates a new XMLList every time!  We
-     * must instead call js_LookupProperty directly.
+     * NB: We can't use JS_GetConstructor, because it calls
+     * JSObject::getProperty, which is xml_getProperty, which creates a new
+     * XMLList every time!  We must instead call js_LookupProperty directly.
      */
     if (!js_LookupProperty(cx, proto,
                            ATOM_TO_JSID(cx->runtime->atomState.constructorAtom),
@@ -7591,7 +7435,7 @@ js_InitXMLClass(JSContext *cx, JSObject *obj)
     sprop = (JSScopeProperty *) prop;
     JS_ASSERT(SPROP_HAS_VALID_SLOT(sprop, OBJ_SCOPE(pobj)));
     cval = OBJ_GET_SLOT(cx, pobj, sprop->slot);
-    OBJ_DROP_PROPERTY(cx, pobj, prop);
+    pobj->dropProperty(cx, prop);
     JS_ASSERT(VALUE_IS_FUNCTION(cx, cval));
 
     /* Set default settings. */
@@ -7688,10 +7532,10 @@ js_GetFunctionNamespace(JSContext *cx, jsval *vp)
 /*
  * Note the asymmetry between js_GetDefaultXMLNamespace and js_SetDefaultXML-
  * Namespace.  Get searches fp->scopeChain for JS_DEFAULT_XML_NAMESPACE_ID,
- * while Set sets JS_DEFAULT_XML_NAMESPACE_ID in fp->varobj (unless fp is a
- * lightweight function activation).  There's no requirement that fp->varobj
- * lie directly on fp->scopeChain, although it should be reachable using the
- * prototype chain from a scope object (cf. JSOPTION_VAROBJFIX in jsapi.h).
+ * while Set sets JS_DEFAULT_XML_NAMESPACE_ID in fp->varobj. There's no
+ * requirement that fp->varobj lie directly on fp->scopeChain, although it
+ * should be reachable using the prototype chain from a scope object (cf.
+ * JSOPTION_VAROBJFIX in jsapi.h).
  *
  * If Get can't find JS_DEFAULT_XML_NAMESPACE_ID along the scope chain, it
  * creates a default namespace via 'new Namespace()'.  In contrast, Set uses
@@ -7708,21 +7552,15 @@ js_GetDefaultXMLNamespace(JSContext *cx, jsval *vp)
     jsval v;
 
     fp = js_GetTopStackFrame(cx);
-    ns = fp->xmlNamespace;
-    if (ns) {
-        *vp = OBJECT_TO_JSVAL(ns);
-        return JS_TRUE;
-    }
 
     obj = NULL;
     for (tmp = fp->scopeChain; tmp; tmp = OBJ_GET_PARENT(cx, tmp)) {
         JSClass *clasp = OBJ_GET_CLASS(cx, tmp);
         if (clasp == &js_BlockClass || clasp == &js_WithClass)
             continue;
-        if (!OBJ_GET_PROPERTY(cx, tmp, JS_DEFAULT_XML_NAMESPACE_ID, &v))
+        if (!tmp->getProperty(cx, JS_DEFAULT_XML_NAMESPACE_ID, &v))
             return JS_FALSE;
         if (!JSVAL_IS_PRIMITIVE(v)) {
-            fp->xmlNamespace = JSVAL_TO_OBJECT(v);
             *vp = v;
             return JS_TRUE;
         }
@@ -7733,13 +7571,10 @@ js_GetDefaultXMLNamespace(JSContext *cx, jsval *vp)
     if (!ns)
         return JS_FALSE;
     v = OBJECT_TO_JSVAL(ns);
-    if (obj &&
-        !OBJ_DEFINE_PROPERTY(cx, obj, JS_DEFAULT_XML_NAMESPACE_ID, v,
-                             JS_PropertyStub, JS_PropertyStub,
-                             JSPROP_PERMANENT, NULL)) {
+    if (!obj->defineProperty(cx, JS_DEFAULT_XML_NAMESPACE_ID, v, JS_PropertyStub, JS_PropertyStub,
+                             JSPROP_PERMANENT)) {
         return JS_FALSE;
     }
-    fp->xmlNamespace = ns;
     *vp = v;
     return JS_TRUE;
 }
@@ -7760,16 +7595,10 @@ js_SetDefaultXMLNamespace(JSContext *cx, jsval v)
 
     fp = js_GetTopStackFrame(cx);
     varobj = fp->varobj;
-    if (varobj) {
-        if (!OBJ_DEFINE_PROPERTY(cx, varobj, JS_DEFAULT_XML_NAMESPACE_ID, v,
-                                 JS_PropertyStub, JS_PropertyStub,
-                                 JSPROP_PERMANENT, NULL)) {
-            return JS_FALSE;
-        }
-    } else {
-        JS_ASSERT(fp->fun && !JSFUN_HEAVYWEIGHT_TEST(fp->fun->flags));
+    if (!varobj->defineProperty(cx, JS_DEFAULT_XML_NAMESPACE_ID, v,
+                                JS_PropertyStub, JS_PropertyStub, JSPROP_PERMANENT)) {
+        return JS_FALSE;
     }
-    fp->xmlNamespace = JSVAL_TO_OBJECT(v);
     return JS_TRUE;
 }
 
@@ -7788,21 +7617,23 @@ js_ToAttributeName(JSContext *cx, jsval *vp)
 JSString *
 js_EscapeAttributeValue(JSContext *cx, JSString *str, JSBool quote)
 {
-    return EscapeAttributeValue(cx, NULL, str, quote);
+    JSCharBuffer cb(cx);
+    return EscapeAttributeValue(cx, cb, str, quote);
 }
 
 JSString *
 js_AddAttributePart(JSContext *cx, JSBool isName, JSString *str, JSString *str2)
 {
     size_t len, len2, newlen;
-    jschar *chars, *chars2;
+    jschar *chars;
+    const jschar *chars2;
 
-    JSSTRING_CHARS_AND_LENGTH(str, chars, len);
-    if (!JSSTRING_IS_MUTABLE(str)) {
+    str->getCharsAndLength(const_cast<const jschar *&>(chars), len);
+    if (!str->isMutable()) {
         str = js_NewStringCopyN(cx, chars, len);
         if (!str)
             return NULL;
-        chars = JSFLATSTR_CHARS(str);
+        chars = str->flatChars();
     } else {
         /*
          * Reallocating str (because we know it has no other references)
@@ -7811,13 +7642,13 @@ js_AddAttributePart(JSContext *cx, JSBool isName, JSString *str, JSString *str2)
         js_PurgeDeflatedStringCache(cx->runtime, str);
     }
 
-    JSSTRING_CHARS_AND_LENGTH(str2, chars2, len2);
+    str2->getCharsAndLength(chars2, len2);
     newlen = (isName) ? len + 1 + len2 : len + 2 + len2 + 1;
-    chars = (jschar *) JS_realloc(cx, chars, (newlen+1) * sizeof(jschar));
+    chars = (jschar *) cx->realloc(chars, (newlen+1) * sizeof(jschar));
     if (!chars)
         return NULL;
 
-    JSFLATSTR_INIT(str, chars, newlen);
+    str->initFlat(chars, newlen);
     chars += len;
     if (isName) {
         *chars++ = ' ';
@@ -7837,7 +7668,8 @@ js_AddAttributePart(JSContext *cx, JSBool isName, JSString *str, JSString *str2)
 JSString *
 js_EscapeElementValue(JSContext *cx, JSString *str)
 {
-    return EscapeElementValue(cx, NULL, str);
+    JSCharBuffer cb(cx);
+    return EscapeElementValue(cx, cb, str);
 }
 
 JSString *
@@ -7880,7 +7712,7 @@ js_GetAnyName(JSContext *cx, jsval *vp)
 
             do {
                 obj = js_NewObjectWithGivenProto(cx, &js_AnyNameClass, NULL,
-                                                 NULL, 0);
+                                                 NULL);
                 if (!obj) {
                     ok = JS_FALSE;
                     break;
@@ -7963,7 +7795,7 @@ js_FindXMLProperty(JSContext *cx, jsval nameval, JSObject **objp, jsid *idp)
 
         if (OBJECT_IS_XML(cx, target)) {
             if (funid == 0) {
-                xml = (JSXML *) JS_GetPrivate(cx, target);
+                xml = (JSXML *) target->getPrivate();
                 found = HasNamedProperty(xml, qn);
             } else {
                 if (!HasFunctionProperty(cx, target, funid, &found))
@@ -7975,10 +7807,10 @@ js_FindXMLProperty(JSContext *cx, jsval nameval, JSObject **objp, jsid *idp)
                 return JS_TRUE;
             }
         } else if (funid != 0) {
-            if (!OBJ_LOOKUP_PROPERTY(cx, target, funid, &pobj, &prop))
+            if (!target->lookupProperty(cx, funid, &pobj, &prop))
                 return JS_FALSE;
             if (prop) {
-                OBJ_DROP_PROPERTY(cx, pobj, prop);
+                pobj->dropProperty(cx, prop);
                 *idp = funid;
                 *objp = target;
                 return JS_TRUE;
@@ -8027,7 +7859,7 @@ GetXMLFunction(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
         tvr.u.object = target;
     }
 
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     if (HasSimpleContent(xml)) {
         /* Search in String.prototype to implement 11.2.2.1 Step 3(f). */
         ok = js_GetClassPrototype(cx, NULL, INT_TO_JSID(JSProto_String),
@@ -8035,7 +7867,7 @@ GetXMLFunction(JSContext *cx, JSObject *obj, jsid id, jsval *vp)
         if (!ok)
             goto out;
         JS_ASSERT(tvr.u.object);
-        ok = OBJ_GET_PROPERTY(cx, tvr.u.object, id, vp);
+        ok = tvr.u.object->getProperty(cx, id, vp);
     }
 
   out:
@@ -8079,27 +7911,30 @@ js_DeleteXMLListElements(JSContext *cx, JSObject *listobj)
     JSXML *list;
     uint32 n;
 
-    list = (JSXML *) JS_GetPrivate(cx, listobj);
+    list = (JSXML *) listobj->getPrivate();
     for (n = list->xml_kids.length; n != 0; --n)
         DeleteListElement(cx, list, 0);
 
     return JS_TRUE;
 }
 
-typedef struct JSXMLFilter {
+struct JSXMLFilter
+{
     JSXML               *list;
     JSXML               *result;
     JSXML               *kid;
     JSXMLArrayCursor    cursor;
 
-} JSXMLFilter;
+    JSXMLFilter(JSXML *list, JSXMLArray *array)
+      : list(list), result(NULL), kid(NULL), cursor(array) {}
+
+    ~JSXMLFilter() {}
+};
 
 static void
 xmlfilter_trace(JSTracer *trc, JSObject *obj)
 {
-    JSXMLFilter *filter;
-
-    filter = (JSXMLFilter *) JS_GetPrivate(trc->context, obj);
+    JSXMLFilter *filter = (JSXMLFilter *) obj->getPrivate();
     if (!filter)
         return;
 
@@ -8119,14 +7954,11 @@ xmlfilter_trace(JSTracer *trc, JSObject *obj)
 static void
 xmlfilter_finalize(JSContext *cx, JSObject *obj)
 {
-    JSXMLFilter *filter;
-
-    filter = (JSXMLFilter *) JS_GetPrivate(cx, obj);
+    JSXMLFilter *filter = (JSXMLFilter *) obj->getPrivate();
     if (!filter)
         return;
 
-    XMLArrayCursorFinish(&filter->cursor);
-    JS_free(cx, filter);
+    cx->destroy(filter);
 }
 
 JSClass js_XMLFilterClass = {
@@ -8157,7 +7989,7 @@ js_StepXMLListFilter(JSContext *cx, JSBool initialized)
             return JS_FALSE;
         }
         obj = JSVAL_TO_OBJECT(sp[-2]);
-        xml = (JSXML *) JS_GetPrivate(cx, obj);
+        xml = (JSXML *) obj->getPrivate();
 
         if (xml->xml_class == JSXML_CLASS_LIST) {
             list = xml;
@@ -8171,29 +8003,24 @@ js_StepXMLListFilter(JSContext *cx, JSBool initialized)
              * as it may be the only root holding xml.
              */
             sp[-1] = OBJECT_TO_JSVAL(obj);
-            list = (JSXML *) JS_GetPrivate(cx, obj);
+            list = (JSXML *) obj->getPrivate();
             if (!Append(cx, list, xml))
                 return JS_FALSE;
         }
 
         filterobj = js_NewObjectWithGivenProto(cx, &js_XMLFilterClass,
-                                               NULL, NULL, 0);
+                                               NULL, NULL);
         if (!filterobj)
             return JS_FALSE;
 
-        filter = (JSXMLFilter *) JS_malloc(cx, sizeof *filter);
-        if (!filter)
-            return JS_FALSE;
-
         /*
-         * Init all filter fields before JS_SetPrivate exposes it to
+         * Init all filter fields before setPrivate exposes it to
          * xmlfilter_trace or xmlfilter_finalize.
          */
-        filter->list = list;
-        filter->result = NULL;
-        filter->kid = NULL;
-        XMLArrayCursorInit(&filter->cursor, &list->xml_kids);
-        JS_SetPrivate(cx, filterobj, filter);
+        filter = cx->create<JSXMLFilter>(list, &list->xml_kids);
+        if (!filter)
+            return JS_FALSE;
+        filterobj->setPrivate(filter);
 
         /* Store filterobj to use in the later iterations. */
         sp[-2] = OBJECT_TO_JSVAL(filterobj);
@@ -8203,13 +8030,13 @@ js_StepXMLListFilter(JSContext *cx, JSBool initialized)
             return JS_FALSE;
 
         /* This also roots resobj. */
-        filter->result = (JSXML *) JS_GetPrivate(cx, resobj);
+        filter->result = (JSXML *) resobj->getPrivate();
     } else {
         /* We have iterated at least once. */
         JS_ASSERT(!JSVAL_IS_PRIMITIVE(sp[-2]));
         JS_ASSERT(OBJ_GET_CLASS(cx, JSVAL_TO_OBJECT(sp[-2])) ==
                                 &js_XMLFilterClass);
-        filter = (JSXMLFilter *) JS_GetPrivate(cx, JSVAL_TO_OBJECT(sp[-2]));
+        filter = (JSXMLFilter *) JSVAL_TO_OBJECT(sp[-2])->getPrivate();
         JS_ASSERT(filter->kid);
 
         /* Check if the filter expression wants to append the element. */
@@ -8220,13 +8047,13 @@ js_StepXMLListFilter(JSContext *cx, JSBool initialized)
     }
 
     /* Do the iteration. */
-    filter->kid = (JSXML *) XMLArrayCursorNext(&filter->cursor);
+    filter->kid = (JSXML *) filter->cursor.getNext();
     if (!filter->kid) {
         /*
          * Do not defer finishing the cursor until the next GC cycle to avoid
          * accumulation of dead cursors associated with filter->list.
          */
-        XMLArrayCursorFinish(&filter->cursor);
+        filter->cursor.disconnect();
         JS_ASSERT(filter->result->object);
         sp[-2] = OBJECT_TO_JSVAL(filter->result->object);
         kidobj = NULL;
@@ -8261,7 +8088,7 @@ js_CloneXMLObject(JSContext *cx, JSObject *obj)
 
     if (!GetXMLSettingFlags(cx, &flags))
         return NULL;
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     if (flags & (XSF_IGNORE_COMMENTS |
                  XSF_IGNORE_PROCESSING_INSTRUCTIONS |
                  XSF_IGNORE_WHITESPACE)) {
@@ -8295,7 +8122,7 @@ js_NewXMLSpecialObject(JSContext *cx, JSXMLClass xml_class, JSString *name,
     obj = js_NewXMLObject(cx, xml_class);
     if (!obj)
         return NULL;
-    xml = (JSXML *) JS_GetPrivate(cx, obj);
+    xml = (JSXML *) obj->getPrivate();
     if (name) {
         qn = NewXMLQName(cx, cx->runtime->emptyString, NULL, name);
         if (!qn)
@@ -8309,19 +8136,22 @@ js_NewXMLSpecialObject(JSContext *cx, JSXMLClass xml_class, JSString *name,
 JSString *
 js_MakeXMLCDATAString(JSContext *cx, JSString *str)
 {
-    return MakeXMLCDATAString(cx, NULL, str);
+    JSCharBuffer cb(cx);
+    return MakeXMLCDATAString(cx, cb, str);
 }
 
 JSString *
 js_MakeXMLCommentString(JSContext *cx, JSString *str)
 {
-    return MakeXMLCommentString(cx, NULL, str);
+    JSCharBuffer cb(cx);
+    return MakeXMLCommentString(cx, cb, str);
 }
 
 JSString *
 js_MakeXMLPIString(JSContext *cx, JSString *name, JSString *str)
 {
-    return MakeXMLPIString(cx, NULL, name, str);
+    JSCharBuffer cb(cx);
+    return MakeXMLPIString(cx, cb, name, str);
 }
 
 #endif /* JS_HAS_XML_SUPPORT */