diff -r 4de6137c510e js/src/jsapi.cpp
--- a/js/src/jsapi.cpp	Thu Aug 16 17:51:22 2012 +0100
+++ b/js/src/jsapi.cpp	Mon Aug 20 16:43:09 2012 +0200
@@ -837,17 +837,16 @@ JSRuntime::JSRuntime()
     telemetryCallback(NULL),
     propertyRemovals(0),
     thousandsSeparator(0),
     decimalSeparator(0),
     numGrouping(0),
     waiveGCQuota(false),
     mathCache_(NULL),
     dtoaState(NULL),
-    pendingProxyOperation(NULL),
     trustedPrincipals_(NULL),
     wrapObjectCallback(TransparentObjectWrapper),
     sameCompartmentWrapObjectCallback(NULL),
     preWrapObjectCallback(NULL),
     preserveWrapperCallback(NULL),
 #ifdef DEBUG
     noGCOrAllocationCheck(0),
 #endif
diff -r 4de6137c510e js/src/jscntxt.h
--- a/js/src/jscntxt.h	Thu Aug 16 17:51:22 2012 +0100
+++ b/js/src/jscntxt.h	Mon Aug 20 16:43:09 2012 +0200
@@ -91,22 +91,16 @@ struct GSNCache {
     GSNCache() : code(NULL) { }
 
     void purge();
 };
 
 inline GSNCache *
 GetGSNCache(JSContext *cx);
 
-struct PendingProxyOperation {
-    PendingProxyOperation   *next;
-    RootedObject            object;
-    PendingProxyOperation(JSContext *cx, JSObject *object) : next(NULL), object(cx, object) {}
-};
-
 typedef Vector<ScriptAndCounts, 0, SystemAllocPolicy> ScriptAndCountsVector;
 
 struct ConservativeGCData
 {
     /*
      * The GC scans conservatively between ThreadData::nativeStackBase and
      * nativeStackTop unless the latter is NULL.
      */
@@ -832,19 +826,16 @@ struct JSRuntime : js::RuntimeFriendFiel
     js::NewObjectCache  newObjectCache;
     js::NativeIterCache nativeIterCache;
     js::SourceDataCache sourceDataCache;
     js::EvalCache       evalCache;
 
     /* State used by jsdtoa.cpp. */
     DtoaState           *dtoaState;
 
-    /* List of currently pending operations on proxies. */
-    js::PendingProxyOperation *pendingProxyOperation;
-
     js::ConservativeGCData conservativeGC;
 
   private:
     JSPrincipals        *trustedPrincipals_;
   public:
     void setTrustedPrincipals(JSPrincipals *p) { trustedPrincipals_ = p; }
     JSPrincipals *trustedPrincipals() const { return trustedPrincipals_; }
 
diff -r 4de6137c510e js/src/jsproxy.cpp
--- a/js/src/jsproxy.cpp	Thu Aug 16 17:51:22 2012 +0100
+++ b/js/src/jsproxy.cpp	Mon Aug 20 16:43:09 2012 +0200
@@ -44,69 +44,52 @@ GetConstruct(JSObject *proxy)
 static inline HeapSlot &
 GetFunctionProxyConstruct(JSObject *proxy)
 {
     JS_ASSERT(IsFunctionProxy(proxy));
     JS_ASSERT(proxy->slotSpan() > JSSLOT_PROXY_CONSTRUCT);
     return proxy->getSlotRef(JSSLOT_PROXY_CONSTRUCT);
 }
 
-#ifdef DEBUG
-static bool
-OperationInProgress(JSContext *cx, JSObject *proxy)
-{
-    PendingProxyOperation *op = cx->runtime->pendingProxyOperation;
-    while (op) {
-        if (op->object == proxy)
-            return true;
-        op = op->next;
-    }
-    return false;
-}
-#endif
-
 BaseProxyHandler::BaseProxyHandler(void *family)
   : mFamily(family),
     mHasPrototype(false)
 {
 }
 
 BaseProxyHandler::~BaseProxyHandler()
 {
 }
 
 bool
 BaseProxyHandler::has(JSContext *cx, JSObject *proxy, jsid id, bool *bp)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     AutoPropertyDescriptorRooter desc(cx);
     if (!getPropertyDescriptor(cx, proxy, id, false, &desc))
         return false;
     *bp = !!desc.obj;
     return true;
 }
 
 bool
 BaseProxyHandler::hasOwn(JSContext *cx, JSObject *proxy, jsid id, bool *bp)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     AutoPropertyDescriptorRooter desc(cx);
     if (!getOwnPropertyDescriptor(cx, proxy, id, false, &desc))
         return false;
     *bp = !!desc.obj;
     return true;
 }
 
 bool
 BaseProxyHandler::get(JSContext *cx, JSObject *proxy, JSObject *receiver_, jsid id_, Value *vp)
 {
     RootedObject receiver(cx, receiver_);
     RootedId id(cx, id_);
 
-    JS_ASSERT(OperationInProgress(cx, proxy));
     AutoPropertyDescriptorRooter desc(cx);
     if (!getPropertyDescriptor(cx, proxy, id, false, &desc))
         return false;
     if (!desc.obj) {
         vp->setUndefined();
         return true;
     }
     if (!desc.getter ||
@@ -154,17 +137,16 @@ BaseProxyHandler::getElementIfPresent(JS
 
 bool
 BaseProxyHandler::set(JSContext *cx, JSObject *proxy_, JSObject *receiver_, jsid id_, bool strict,
                       Value *vp)
 {
     RootedObject proxy(cx, proxy_), receiver(cx, receiver_);
     RootedId id(cx, id_);
 
-    JS_ASSERT(OperationInProgress(cx, proxy));
     AutoPropertyDescriptorRooter desc(cx);
     if (!getOwnPropertyDescriptor(cx, proxy, id, true, &desc))
         return false;
     /* The control-flow here differs from ::get() because of the fall-through case below. */
     if (desc.obj) {
         // Check for read-only properties.
         if (desc.attrs & JSPROP_READONLY)
             return strict ? Throw(cx, id, JSMSG_CANT_REDEFINE_PROP) : true;
@@ -228,17 +210,16 @@ BaseProxyHandler::set(JSContext *cx, JSO
     desc.getter = NULL;
     desc.setter = NULL; // Pick up the class getter/setter.
     return defineProperty(cx, receiver, id, &desc);
 }
 
 bool
 BaseProxyHandler::keys(JSContext *cx, JSObject *proxy, AutoIdVector &props)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     JS_ASSERT(props.length() == 0);
 
     if (!getOwnPropertyNames(cx, proxy, props))
         return false;
 
     /* Select only the enumerable properties through in-place iteration. */
     AutoPropertyDescriptorRooter desc(cx);
     size_t i = 0;
@@ -257,17 +238,16 @@ BaseProxyHandler::keys(JSContext *cx, JS
     return true;
 }
 
 bool
 BaseProxyHandler::iterate(JSContext *cx, JSObject *proxy_, unsigned flags, Value *vp)
 {
     RootedObject proxy(cx, proxy_);
 
-    JS_ASSERT(OperationInProgress(cx, proxy));
     AutoIdVector props(cx);
     if ((flags & JSITER_OWNONLY)
         ? !keys(cx, proxy, props)
         : !enumerate(cx, proxy, props)) {
         return false;
     }
 
     RootedValue value(cx);
@@ -338,43 +318,38 @@ BaseProxyHandler::iteratorNext(JSContext
 {
     vp->setMagic(JS_NO_ITER_VALUE);
     return true;
 }
 
 bool
 BaseProxyHandler::nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl, CallArgs args)
 {
-    JS_ASSERT(OperationInProgress(cx, &args.thisv().toObject()));
     ReportIncompatible(cx, args);
     return false;
 }
 
 bool
 BaseProxyHandler::hasInstance(JSContext *cx, JSObject *proxy, const Value *vp, bool *bp)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
-
     RootedValue val(cx, ObjectValue(*proxy));
     js_ReportValueError(cx, JSMSG_BAD_INSTANCEOF_RHS,
                         JSDVG_SEARCH_STACK, val, NullPtr());
     return false;
 }
 
 JSType
 BaseProxyHandler::typeOf(JSContext *cx, JSObject *proxy)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     return IsFunctionProxy(proxy) ? JSTYPE_FUNCTION : JSTYPE_OBJECT;
 }
 
 bool
 BaseProxyHandler::objectClassIs(JSObject *proxy, ESClassValue classValue, JSContext *cx)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     return false;
 }
 
 void
 BaseProxyHandler::finalize(JSFreeOp *fop, JSObject *proxy)
 {
 }
 
@@ -467,29 +442,27 @@ IndirectProxyHandler::enumerate(JSContex
     RootedObject target(cx, GetProxyTargetObject(proxy));
     return GetPropertyNames(cx, target, 0, &props);
 }
 
 bool
 IndirectProxyHandler::call(JSContext *cx, JSObject *proxy, unsigned argc,
                    Value *vp)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     AutoValueRooter rval(cx);
     JSBool ok = Invoke(cx, vp[1], GetCall(proxy), argc, JS_ARGV(cx, vp), rval.addr());
     if (ok)
         JS_SET_RVAL(cx, vp, rval.value());
     return ok;
 }
 
 bool
 IndirectProxyHandler::construct(JSContext *cx, JSObject *proxy, unsigned argc,
                                 Value *argv, Value *rval)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     Value fval = GetConstruct(proxy);
     if (fval.isUndefined())
         fval = GetCall(proxy);
     return InvokeConstructor(cx, fval, argc, argv, rval);
 }
 
 bool
 IndirectProxyHandler::nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
@@ -780,38 +753,40 @@ ArrayToIdVector(JSContext *cx, const Val
 /* Derived class for all scripted proxy handlers. */
 class ScriptedProxyHandler : public IndirectProxyHandler {
   public:
     ScriptedProxyHandler();
     virtual ~ScriptedProxyHandler();
 
     /* ES5 Harmony fundamental proxy traps. */
     virtual bool getPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set,
-                                       PropertyDescriptor *desc);
+                                       PropertyDescriptor *desc) MOZ_OVERRIDE;
     virtual bool getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set,
-                                          PropertyDescriptor *desc);
+                                          PropertyDescriptor *desc) MOZ_OVERRIDE;
     virtual bool defineProperty(JSContext *cx, JSObject *proxy, jsid id,
-                                PropertyDescriptor *desc);
+                                PropertyDescriptor *desc) MOZ_OVERRIDE;
     virtual bool getOwnPropertyNames(JSContext *cx, JSObject *proxy, AutoIdVector &props);
-    virtual bool delete_(JSContext *cx, JSObject *proxy, jsid id, bool *bp);
-    virtual bool enumerate(JSContext *cx, JSObject *proxy, AutoIdVector &props);
+    virtual bool delete_(JSContext *cx, JSObject *proxy, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool enumerate(JSContext *cx, JSObject *proxy, AutoIdVector &props) MOZ_OVERRIDE;
 
     /* ES5 Harmony derived proxy traps. */
-    virtual bool has(JSContext *cx, JSObject *proxy, jsid id, bool *bp);
-    virtual bool hasOwn(JSContext *cx, JSObject *proxy, jsid id, bool *bp);
-    virtual bool get(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, Value *vp);
+    virtual bool has(JSContext *cx, JSObject *proxy, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool hasOwn(JSContext *cx, JSObject *proxy, jsid id, bool *bp) MOZ_OVERRIDE;
+    virtual bool get(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id,
+                     Value *vp) MOZ_OVERRIDE;
     virtual bool set(JSContext *cx, JSObject *proxy, JSObject *receiver, jsid id, bool strict,
-                     Value *vp);
-    virtual bool keys(JSContext *cx, JSObject *proxy, AutoIdVector &props);
-    virtual bool iterate(JSContext *cx, JSObject *proxy, unsigned flags, Value *vp);
+                     Value *vp) MOZ_OVERRIDE;
+    virtual bool keys(JSContext *cx, JSObject *proxy, AutoIdVector &props) MOZ_OVERRIDE;
+    virtual bool iterate(JSContext *cx, JSObject *proxy, unsigned flags, Value *vp) MOZ_OVERRIDE;
 
     /* Spidermonkey extensions. */
-    virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl, CallArgs args) MOZ_OVERRIDE;
+    virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
+                            CallArgs args) MOZ_OVERRIDE;
     virtual JSType typeOf(JSContext *cx, JSObject *proxy);
-    virtual bool defaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp);
+    virtual bool defaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp) MOZ_OVERRIDE;
 
     static ScriptedProxyHandler singleton;
 };
 
 static int sScriptedProxyHandlerFamily = 0;
 
 ScriptedProxyHandler::ScriptedProxyHandler() : IndirectProxyHandler(&sScriptedProxyHandlerFamily)
 {
@@ -834,17 +809,16 @@ ReturnedValueMustNotBePrimitive(JSContex
         return false;
     }
     return true;
 }
 
 static JSObject *
 GetProxyHandlerObject(JSContext *cx, JSObject *proxy)
 {
-    JS_ASSERT(OperationInProgress(cx, proxy));
     return GetProxyPrivate(proxy).toObjectOrNull();
 }
 
 bool
 ScriptedProxyHandler::getPropertyDescriptor(JSContext *cx, JSObject *proxy_, jsid id_, bool set,
                                             PropertyDescriptor *desc)
 {
     RootedId id(cx, id_);
@@ -1042,33 +1016,16 @@ ScriptedProxyHandler::defaultValue(JSCon
      * This function is only here to prevent bug 757063. It will be removed when
      * the direct proxy refactor is complete.
      */
     return BaseProxyHandler::defaultValue(cx, proxy, hint, vp);
 }
 
 ScriptedProxyHandler ScriptedProxyHandler::singleton;
 
-class AutoPendingProxyOperation {
-    JSRuntime               *rt;
-    PendingProxyOperation   op;
-  public:
-    AutoPendingProxyOperation(JSContext *cx, JSObject *proxy)
-        : rt(cx->runtime), op(cx, proxy)
-    {
-        op.next = rt->pendingProxyOperation;
-        rt->pendingProxyOperation = &op;
-    }
-
-    ~AutoPendingProxyOperation() {
-        JS_ASSERT(rt->pendingProxyOperation == &op);
-        rt->pendingProxyOperation = op.next;
-    }
-};
-
 #define INVOKE_ON_PROTOTYPE(cx, handler, proxy, protoCall)                   \
     JS_BEGIN_MACRO                                                           \
         JSObject *proto;                                                     \
         if (!handler->getPrototypeOf(cx, proxy, &proto))                     \
             return false;                                                    \
         if (!proto)                                                          \
             return true;                                                     \
         assertSameCompartment(cx, proxy, proto);                             \
@@ -1078,91 +1035,89 @@ class AutoPendingProxyOperation {
 
 bool
 Proxy::getPropertyDescriptor(JSContext *cx, JSObject *proxy_, jsid id_, bool set,
                              PropertyDescriptor *desc)
 {
     JS_CHECK_RECURSION(cx, return false);
     RootedObject proxy(cx, proxy_);
     RootedId id(cx, id_);
-    AutoPendingProxyOperation pending(cx, proxy);
     BaseProxyHandler *handler = GetProxyHandler(proxy);
     if (!handler->hasPrototype())
         return handler->getPropertyDescriptor(cx, proxy, id, set, desc);
     if (!handler->getOwnPropertyDescriptor(cx, proxy, id, set, desc))
         return false;
     if (desc->obj)
         return true;
     INVOKE_ON_PROTOTYPE(cx, handler, proxy,
                         JS_GetPropertyDescriptorById(cx, proto, id,
                                                      JSRESOLVE_QUALIFIED, desc));
 }
 
 bool
-Proxy::getPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set, Value *vp)
+Proxy::getPropertyDescriptor(JSContext *cx, JSObject *proxy_, jsid id, bool set, Value *vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     AutoPropertyDescriptorRooter desc(cx);
     return Proxy::getPropertyDescriptor(cx, proxy, id, set, &desc) &&
            NewPropertyDescriptorObject(cx, &desc, vp);
 }
 
 bool
-Proxy::getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set,
+Proxy::getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy_, jsid id, bool set,
                                 PropertyDescriptor *desc)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->getOwnPropertyDescriptor(cx, proxy, id, set, desc);
 }
 
 bool
-Proxy::getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy, jsid id, bool set, Value *vp)
+Proxy::getOwnPropertyDescriptor(JSContext *cx, JSObject *proxy_, jsid id, bool set, Value *vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     AutoPropertyDescriptorRooter desc(cx);
     return Proxy::getOwnPropertyDescriptor(cx, proxy, id, set, &desc) &&
            NewPropertyDescriptorObject(cx, &desc, vp);
 }
 
 bool
-Proxy::defineProperty(JSContext *cx, JSObject *proxy, jsid id, PropertyDescriptor *desc)
+Proxy::defineProperty(JSContext *cx, JSObject *proxy_, jsid id, PropertyDescriptor *desc)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->defineProperty(cx, proxy, id, desc);
 }
 
 bool
 Proxy::defineProperty(JSContext *cx, JSObject *proxy_, jsid id_, const Value &v)
 {
     JS_CHECK_RECURSION(cx, return false);
     RootedObject proxy(cx, proxy_);
     RootedId id(cx, id_);
-    AutoPendingProxyOperation pending(cx, proxy);
     AutoPropertyDescriptorRooter desc(cx);
     return ParsePropertyDescriptorObject(cx, proxy, v, &desc) &&
            Proxy::defineProperty(cx, proxy, id, &desc);
 }
 
 bool
-Proxy::getOwnPropertyNames(JSContext *cx, JSObject *proxy, AutoIdVector &props)
+Proxy::getOwnPropertyNames(JSContext *cx, JSObject *proxy_, AutoIdVector &props)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->getOwnPropertyNames(cx, proxy, props);
 }
 
 bool
-Proxy::delete_(JSContext *cx, JSObject *proxy, jsid id, bool *bp)
+Proxy::delete_(JSContext *cx, JSObject *proxy_, jsid id, bool *bp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->delete_(cx, proxy, id, bp);
 }
 
 static bool
 AppendUnique(JSContext *cx, AutoIdVector &base, AutoIdVector &others)
 {
     AutoIdVector uniqueOthers(cx);
     if (!uniqueOthers.reserve(others.length()))
@@ -1177,20 +1132,20 @@ AppendUnique(JSContext *cx, AutoIdVector
         }
         if (unique)
             uniqueOthers.append(others[i]);
     }
     return base.append(uniqueOthers);
 }
 
 bool
-Proxy::enumerate(JSContext *cx, JSObject *proxy, AutoIdVector &props)
+Proxy::enumerate(JSContext *cx, JSObject *proxy_, AutoIdVector &props)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     BaseProxyHandler *handler = GetProxyHandler(proxy);
     if (!handler->hasPrototype())
         return GetProxyHandler(proxy)->enumerate(cx, proxy, props);
     if (!handler->keys(cx, proxy, props))
         return false;
     AutoIdVector protoProps(cx);
     INVOKE_ON_PROTOTYPE(cx, handler, proxy,
                         GetPropertyNames(cx, proto, 0, &protoProps) &&
@@ -1198,77 +1153,76 @@ Proxy::enumerate(JSContext *cx, JSObject
 }
 
 bool
 Proxy::has(JSContext *cx, JSObject *proxy_, jsid id_, bool *bp)
 {
     JS_CHECK_RECURSION(cx, return false);
     RootedObject proxy(cx, proxy_);
     RootedId id(cx, id_);
-    AutoPendingProxyOperation pending(cx, proxy);
     BaseProxyHandler *handler = GetProxyHandler(proxy);
     if (!handler->hasPrototype())
         return handler->has(cx, proxy, id, bp);
     if (!handler->hasOwn(cx, proxy, id, bp))
         return false;
     if (*bp)
         return true;
     JSBool Bp;
     INVOKE_ON_PROTOTYPE(cx, handler, proxy,
                         JS_HasPropertyById(cx, proto, id, &Bp) &&
                         ((*bp = Bp) || true));
 }
 
 bool
-Proxy::hasOwn(JSContext *cx, JSObject *proxy, jsid id, bool *bp)
+Proxy::hasOwn(JSContext *cx, JSObject *proxy_, jsid id, bool *bp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->hasOwn(cx, proxy, id, bp);
 }
 
 bool
-Proxy::get(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
+Proxy::get(JSContext *cx, HandleObject proxy_, HandleObject receiver, HandleId id,
            MutableHandleValue vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     BaseProxyHandler *handler = GetProxyHandler(proxy);
     bool own = false;
     if (!handler->hasPrototype() || (handler->hasOwn(cx, proxy, id, &own) && own))
         return handler->get(cx, proxy, receiver, id, vp.address());
     INVOKE_ON_PROTOTYPE(cx, handler, proxy, proto->getGeneric(cx, receiver, id, vp));
 }
 
 bool
-Proxy::getElementIfPresent(JSContext *cx, HandleObject proxy, HandleObject receiver, uint32_t index,
+Proxy::getElementIfPresent(JSContext *cx, HandleObject proxy_, HandleObject receiver, uint32_t index,
                            MutableHandleValue vp, bool *present)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     BaseProxyHandler *handler = GetProxyHandler(proxy);
     bool hasOwn, status = true;
     if (!handler->hasPrototype() ||
         ((status = handler->hasOwn(cx, proxy, INT_TO_JSID(index), &hasOwn)) && hasOwn))
     {
         return GetProxyHandler(proxy)->getElementIfPresent(cx, proxy, receiver,
                                                            index, vp.address(), present);
     } else if (!status) {
         return false;
     }
     INVOKE_ON_PROTOTYPE(cx, handler, proxy,
                         proto->getElementIfPresent(cx, receiver, index, vp, present));
 }
 
 bool
-Proxy::set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id, bool strict,
+Proxy::set(JSContext *cx, HandleObject proxy_, HandleObject receiver, HandleId id, bool strict,
            MutableHandleValue vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     BaseProxyHandler *handler = GetProxyHandler(proxy);
     RootedObject proto(cx);
     if (handler->hasPrototype()) {
         // If we're using a prototype, we still want to use the proxy trap unless
         // we have a non-own property with a setter.
         bool hasOwn;
         AutoPropertyDescriptorRooter desc(cx);
         if (handler->hasOwn(cx, proxy, id, &hasOwn) && !hasOwn &&
@@ -1280,127 +1234,127 @@ Proxy::set(JSContext *cx, HandleObject p
         } else if (cx->isExceptionPending()) {
             return false;
         }
     }
     return handler->set(cx, proxy, receiver, id, strict, vp.address());
 }
 
 bool
-Proxy::keys(JSContext *cx, JSObject *proxy, AutoIdVector &props)
+Proxy::keys(JSContext *cx, JSObject *proxy_, AutoIdVector &props)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->keys(cx, proxy, props);
 }
 
 bool
-Proxy::iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleValue vp)
+Proxy::iterate(JSContext *cx, HandleObject proxy_, unsigned flags, MutableHandleValue vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     BaseProxyHandler *handler = GetProxyHandler(proxy);
     if (!handler->hasPrototype())
         return GetProxyHandler(proxy)->iterate(cx, proxy, flags, vp.address());
     AutoIdVector props(cx);
     // The other Proxy::foo methods do the prototype-aware work for us here.
     if ((flags & JSITER_OWNONLY)
         ? !Proxy::keys(cx, proxy, props)
         : !Proxy::enumerate(cx, proxy, props)) {
         return false;
     }
     return EnumeratedIdVectorToIterator(cx, proxy, flags, props, vp);
 }
 
 bool
-Proxy::call(JSContext *cx, JSObject *proxy, unsigned argc, Value *vp)
+Proxy::call(JSContext *cx, JSObject *proxy_, unsigned argc, Value *vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->call(cx, proxy, argc, vp);
 }
 
 bool
-Proxy::construct(JSContext *cx, JSObject *proxy, unsigned argc, Value *argv, Value *rval)
+Proxy::construct(JSContext *cx, JSObject *proxy_, unsigned argc, Value *argv, Value *rval)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->construct(cx, proxy, argc, argv, rval);
 }
 
 bool
 Proxy::nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl, CallArgs args)
 {
     JS_CHECK_RECURSION(cx, return false);
     Rooted<JSObject*> proxy(cx, &args.thisv().toObject());
-    AutoPendingProxyOperation pending(cx, proxy);
     return GetProxyHandler(proxy)->nativeCall(cx, test, impl, args);
 }
 
 bool
-Proxy::hasInstance(JSContext *cx, JSObject *proxy, const js::Value *vp, bool *bp)
+Proxy::hasInstance(JSContext *cx, JSObject *proxy_, const js::Value *vp, bool *bp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->hasInstance(cx, proxy, vp, bp);
 }
 
 JSType
-Proxy::typeOf(JSContext *cx, JSObject *proxy)
+Proxy::typeOf(JSContext *cx, JSObject *proxy_)
 {
     // FIXME: API doesn't allow us to report error (bug 618906).
     JS_CHECK_RECURSION(cx, return JSTYPE_OBJECT);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->typeOf(cx, proxy);
 }
 
 bool
-Proxy::objectClassIs(JSObject *proxy, ESClassValue classValue, JSContext *cx)
+Proxy::objectClassIs(JSObject *proxy_, ESClassValue classValue, JSContext *cx)
 {
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->objectClassIs(proxy, classValue, cx);
 }
 
 JSString *
-Proxy::obj_toString(JSContext *cx, JSObject *proxy)
+Proxy::obj_toString(JSContext *cx, JSObject *proxy_)
 {
     JS_CHECK_RECURSION(cx, return NULL);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->obj_toString(cx, proxy);
 }
 
 JSString *
-Proxy::fun_toString(JSContext *cx, JSObject *proxy, unsigned indent)
+Proxy::fun_toString(JSContext *cx, JSObject *proxy_, unsigned indent)
 {
     JS_CHECK_RECURSION(cx, return NULL);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
+    return GetProxyHandler(proxy)->obj_toString(cx, proxy);
     return GetProxyHandler(proxy)->fun_toString(cx, proxy, indent);
 }
 
 bool
-Proxy::regexp_toShared(JSContext *cx, JSObject *proxy, RegExpGuard *g)
+Proxy::regexp_toShared(JSContext *cx, JSObject *proxy_, RegExpGuard *g)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->regexp_toShared(cx, proxy, g);
 }
 
 bool
-Proxy::defaultValue(JSContext *cx, JSObject *proxy, JSType hint, Value *vp)
+Proxy::defaultValue(JSContext *cx, JSObject *proxy_, JSType hint, Value *vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->defaultValue(cx, proxy, hint, vp);
 }
 
 bool
-Proxy::iteratorNext(JSContext *cx, JSObject *proxy, Value *vp)
+Proxy::iteratorNext(JSContext *cx, JSObject *proxy_, Value *vp)
 {
     JS_CHECK_RECURSION(cx, return false);
-    AutoPendingProxyOperation pending(cx, proxy);
+    RootedObject proxy(cx, proxy_);
     return GetProxyHandler(proxy)->iteratorNext(cx, proxy, vp);
 }
 
 static JSObject *
 proxy_innerObject(JSContext *cx, HandleObject obj)
 {
     return GetProxyPrivate(obj).toObjectOrNull();
 }
@@ -1715,17 +1669,16 @@ proxy_Finalize(FreeOp *fop, JSObject *ob
     JS_ASSERT(obj->isProxy());
     if (!obj->getSlot(JSSLOT_PROXY_HANDLER).isUndefined())
         GetProxyHandler(obj)->finalize(fop, obj);
 }
 
 static JSBool
 proxy_HasInstance(JSContext *cx, HandleObject proxy, const Value *v, JSBool *bp)
 {
-    AutoPendingProxyOperation pending(cx, proxy);
     bool b;
     if (!Proxy::hasInstance(cx, proxy, v, &b))
         return false;
     *bp = !!b;
     return true;
 }
 
 static JSType
@@ -2032,32 +1985,16 @@ proxy_createFunction(JSContext *cx, unsi
 }
 
 static JSFunctionSpec static_methods[] = {
     JS_FN("create",         proxy_create,          2, 0),
     JS_FN("createFunction", proxy_createFunction,  3, 0),
     JS_FS_END
 };
 
-Class js::CallableObjectClass = {
-    "Function",
-    JSCLASS_HAS_RESERVED_SLOTS(2),
-    JS_PropertyStub,         /* addProperty */
-    JS_PropertyStub,         /* delProperty */
-    JS_PropertyStub,         /* getProperty */
-    JS_StrictPropertyStub,   /* setProperty */
-    JS_EnumerateStub,
-    JS_ResolveStub,
-    JS_ConvertStub,
-    NULL,                    /* finalize    */
-    NULL,                    /* checkAccess */
-    NULL,                    /* call        */
-    NULL                     /* construct   */
-};
-
 Class js::ProxyClass = {
     "Proxy",
     JSCLASS_HAS_CACHED_PROTO(JSProto_Proxy),
     JS_PropertyStub,         /* addProperty */
     JS_PropertyStub,         /* delProperty */
     JS_PropertyStub,         /* getProperty */
     JS_StrictPropertyStub,   /* setProperty */
     JS_EnumerateStub,