diff --git a/js/src/builtin/Intl.cpp b/js/src/builtin/Intl.cpp
index 03f4c9e15c53..29dda165de05 100644
--- a/js/src/builtin/Intl.cpp
+++ b/js/src/builtin/Intl.cpp
@@ -563,7 +563,8 @@ static const Class CollatorClass = {
 static bool
 collator_toSource(JSContext *cx, unsigned argc, Value *vp)
 {
-    vp->setString(cx->names().Collator);
+    CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setString(cx->names().Collator);
     return true;
 }
 #endif
@@ -1049,7 +1050,8 @@ static const Class NumberFormatClass = {
 static bool
 numberFormat_toSource(JSContext *cx, unsigned argc, Value *vp)
 {
-    vp->setString(cx->names().NumberFormat);
+    CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setString(cx->names().NumberFormat);
     return true;
 }
 #endif
@@ -1507,7 +1509,8 @@ static const Class DateTimeFormatClass = {
 static bool
 dateTimeFormat_toSource(JSContext *cx, unsigned argc, Value *vp)
 {
-    vp->setString(cx->names().DateTimeFormat);
+    CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setString(cx->names().DateTimeFormat);
     return true;
 }
 #endif
@@ -1990,7 +1993,8 @@ const Class js::IntlClass = {
 static bool
 intl_toSource(JSContext *cx, unsigned argc, Value *vp)
 {
-    vp->setString(cx->names().Intl);
+    CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setString(cx->names().Intl);
     return true;
 }
 #endif
diff --git a/js/src/builtin/Object.cpp b/js/src/builtin/Object.cpp
index 09f9caab9d6a..5a5739a72579 100644
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -73,7 +73,7 @@ obj_propertyIsEnumerable(JSContext *cx, unsigned argc, Value *vp)
     }
 
     if (pobj != obj) {
-        vp->setBoolean(false);
+        args.rval().setBoolean(false);
         return true;
     }
 
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 3ef1b7a3d49c..d18f22e4f731 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -39,6 +39,7 @@ static bool fuzzingSafe = false;
 static bool
 GetBuildConfiguration(JSContext *cx, unsigned argc, jsval *vp)
 {
+    CallArgs args = CallArgsFromVp(argc, vp);
     RootedObject info(cx, JS_NewObject(cx, nullptr, JS::NullPtr(), JS::NullPtr()));
     if (!info)
         return false;
@@ -196,7 +197,7 @@ GetBuildConfiguration(JSContext *cx, unsigned argc, jsval *vp)
     if (!JS_SetProperty(cx, info, "binary-data", value))
         return false;
 
-    *vp = ObjectValue(*info);
+    args.rval().setObject(*info);
     return true;
 }
 
@@ -213,7 +214,7 @@ GC(JSContext *cx, unsigned argc, jsval *vp)
      */
     bool compartment = false;
     if (args.length() == 1) {
-        Value arg = vp[2];
+        Value arg = args[0];
         if (arg.isString()) {
             if (!JS_StringEqualsAscii(cx, arg.toString(), "compartment", &compartment))
                 return false;
@@ -241,7 +242,7 @@ GC(JSContext *cx, unsigned argc, jsval *vp)
     JSString *str = JS_NewStringCopyZ(cx, buf);
     if (!str)
         return false;
-    *vp = STRING_TO_JSVAL(str);
+    args.rval().setString(str);
     return true;
 }
 
@@ -412,7 +413,7 @@ InternalConst(JSContext *cx, unsigned argc, jsval *vp)
         return false;
 
     if (JS_FlatStringEqualsAscii(flat, "INCREMENTAL_MARK_STACK_BASE_CAPACITY")) {
-        vp[0] = UINT_TO_JSVAL(js::INCREMENTAL_MARK_STACK_BASE_CAPACITY);
+        args.rval().setNumber(uint32_t(js::INCREMENTAL_MARK_STACK_BASE_CAPACITY));
     } else {
         JS_ReportError(cx, "unknown const name");
         return false;
@@ -433,7 +434,7 @@ GCPreserveCode(JSContext *cx, unsigned argc, jsval *vp)
 
     cx->runtime()->alwaysPreserveCode = true;
 
-    *vp = JSVAL_VOID;
+    args.rval().setUndefined();
     return true;
 }
 
@@ -534,7 +535,7 @@ VerifyPostBarriers(JSContext *cx, unsigned argc, jsval *vp)
         return false;
     }
     gc::VerifyBarriers(cx->runtime(), gc::PostBarrierVerifier);
-    *vp = JSVAL_VOID;
+    args.rval().setUndefined();
     return true;
 }
 
@@ -563,7 +564,7 @@ GCState(JSContext *cx, unsigned argc, jsval *vp)
     JSString *str = JS_NewStringCopyZ(cx, state);
     if (!str)
         return false;
-    *vp = StringValue(str);
+    args.rval().setString(str);
     return true;
 }
 
@@ -830,7 +831,7 @@ CountHeap(JSContext *cx, unsigned argc, jsval *vp)
         return false;
     }
 
-    *vp = JS_NumberValue((double) counter);
+    args.rval().setNumber(double(counter));
     return true;
 }
 
@@ -876,6 +877,7 @@ static const JSClass FinalizeCounterClass = {
 static bool
 MakeFinalizeObserver(JSContext *cx, unsigned argc, jsval *vp)
 {
+    CallArgs args = CallArgsFromVp(argc, vp);
     RootedObject scope(cx, JS::CurrentGlobalOrNull(cx));
     if (!scope)
         return false;
@@ -884,14 +886,15 @@ MakeFinalizeObserver(JSContext *cx, unsigned argc, jsval *vp)
     if (!obj)
         return false;
 
-    *vp = OBJECT_TO_JSVAL(obj);
+    args.rval().setObject(*obj);
     return true;
 }
 
 static bool
 FinalizeCount(JSContext *cx, unsigned argc, jsval *vp)
 {
-    *vp = INT_TO_JSVAL(finalizeCount);
+    CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setInt32(finalizeCount);
     return true;
 }
 
@@ -1016,7 +1019,7 @@ DisplayName(JSContext *cx, unsigned argc, jsval *vp)
 
     JSFunction *fun = &args[0].toObject().as<JSFunction>();
     JSString *str = fun->displayAtom();
-    vp->setString(str == nullptr ? cx->runtime()->emptyString : str);
+    args.rval().setString(str ? str : cx->runtime()->emptyString);
     return true;
 }
 
@@ -1185,6 +1188,7 @@ SetJitCompilerOption(JSContext *cx, unsigned argc, jsval *vp)
 static bool
 GetJitCompilerOptions(JSContext *cx, unsigned argc, jsval *vp)
 {
+    CallArgs args = CallArgsFromVp(argc, vp);
     RootedObject info(cx, JS_NewObject(cx, nullptr, JS::NullPtr(), JS::NullPtr()));
     if (!info)
         return false;
@@ -1201,7 +1205,7 @@ GetJitCompilerOptions(JSContext *cx, unsigned argc, jsval *vp)
     JIT_COMPILER_OPTIONS(JIT_COMPILER_MATCH);
 #undef JIT_COMPILER_MATCH
 
-    *vp = ObjectValue(*info);
+    args.rval().setObject(*info);
 
     return true;
 }
diff --git a/js/src/jsapi-tests/testSlowScript.cpp b/js/src/jsapi-tests/testSlowScript.cpp
index 33d897db8134..403328206bb0 100644
--- a/js/src/jsapi-tests/testSlowScript.cpp
+++ b/js/src/jsapi-tests/testSlowScript.cpp
@@ -15,9 +15,10 @@ static unsigned sRemain;
 static bool
 RequestInterruptCallback(JSContext *cx, unsigned argc, jsval *vp)
 {
+    JS::CallArgs args = JS::CallArgsFromVp(argc, vp);
     if (!sRemain--)
         JS_RequestInterruptCallback(JS_GetRuntime(cx));
-    *vp = JSVAL_VOID;
+    args.rval().setUndefined();
     return true;
 }
 
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 4d55984e15e5..85b84d6eb4f5 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3977,7 +3977,7 @@ js_generic_native_method_dispatcher(JSContext *cx, unsigned argc, Value *vp)
     CallArgs args = CallArgsFromVp(argc, vp);
 
     const JSFunctionSpec *fs = (JSFunctionSpec *)
-        vp->toObject().as<JSFunction>().getExtendedSlot(0).toPrivate();
+        args.callee().as<JSFunction>().getExtendedSlot(0).toPrivate();
     JS_ASSERT((fs->flags & JSFUN_GENERIC_NATIVE) != 0);
 
     if (argc < 1) {
diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
index dcbc453cd26c..fbad2df1d9bf 100644
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -1185,7 +1185,7 @@ date_parse(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     if (args.length() == 0) {
-        vp->setNaN();
+        args.rval().setNaN();
         return true;
     }
 
@@ -1199,12 +1199,12 @@ date_parse(JSContext *cx, unsigned argc, Value *vp)
 
     double result;
     if (!date_parseString(linearStr, &result, &cx->runtime()->dateTimeInfo)) {
-        vp->setNaN();
+        args.rval().setNaN();
         return true;
     }
 
     result = TimeClip(result);
-    vp->setNumber(result);
+    args.rval().setNumber(result);
     return true;
 }
 
@@ -1217,7 +1217,8 @@ NowAsMillis()
 static bool
 date_now(JSContext *cx, unsigned argc, Value *vp)
 {
-    vp->setDouble(NowAsMillis());
+    CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setDouble(NowAsMillis());
     return true;
 }
 
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 883fc8a691c1..685242152b42 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -1282,7 +1282,7 @@ js::CallOrConstructBoundFunction(JSContext *cx, unsigned argc, Value *vp)
     if (constructing ? !InvokeConstructor(cx, invokeArgs) : !Invoke(cx, invokeArgs))
         return false;
 
-    *vp = invokeArgs.rval();
+    args.rval().set(invokeArgs.rval());
     return true;
 }
 
@@ -1291,7 +1291,7 @@ fun_isGenerator(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     JSFunction *fun;
-    if (!IsFunctionObject(vp[1], &fun)) {
+    if (!IsFunctionObject(args.thisv(), &fun)) {
         args.rval().setBoolean(false);
         return true;
     }
diff --git a/js/src/json.cpp b/js/src/json.cpp
index 075dc36b4407..1f8f1f9978b0 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -792,7 +792,8 @@ js::ParseJSONWithReviver(JSContext *cx, ConstTwoByteChars chars, size_t length,
 static bool
 json_toSource(JSContext *cx, unsigned argc, Value *vp)
 {
-    vp->setString(cx->names().JSON);
+    CallArgs args = CallArgsFromVp(argc, vp);
+    args.rval().setString(cx->names().JSON);
     return true;
 }
 #endif
@@ -828,11 +829,9 @@ bool
 json_stringify(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
-    RootedObject replacer(cx, (argc >= 2 && vp[3].isObject())
-                              ? &vp[3].toObject()
-                              : nullptr);
-    RootedValue value(cx, (argc >= 1) ? vp[2] : UndefinedValue());
-    RootedValue space(cx, (argc >= 3) ? vp[4] : UndefinedValue());
+    RootedObject replacer(cx, args.get(1).isObject() ? &args[1].toObject() : nullptr);
+    RootedValue value(cx, args.get(0));
+    RootedValue space(cx, args.get(2));
 
     StringBuffer sb(cx);
     if (!js_Stringify(cx, &value, replacer, space, sb))
@@ -845,9 +844,9 @@ json_stringify(JSContext *cx, unsigned argc, Value *vp)
         JSString *str = sb.finishString();
         if (!str)
             return false;
-        vp->setString(str);
+        args.rval().setString(str);
     } else {
-        vp->setUndefined();
+        args.rval().setUndefined();
     }
 
     return true;
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index 1440066732cd..62af5faffc10 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -3129,38 +3129,39 @@ proxy(JSContext *cx, unsigned argc, jsval *vp)
     if (!proxy)
         return false;
     proxy->setExtra(0, ObjectOrNullValue(handler));
-    vp->setObject(*proxy);
+    args.rval().setObject(*proxy);
     return true;
 }
 
 static bool
 proxy_create(JSContext *cx, unsigned argc, Value *vp)
 {
-    if (argc < 1) {
+    CallArgs args = CallArgsFromVp(argc, vp);
+    if (args.length() < 1) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_MORE_ARGS_NEEDED,
                              "create", "0", "s");
         return false;
     }
-    JSObject *handler = NonNullObject(cx, vp[2]);
+    JSObject *handler = NonNullObject(cx, args[0]);
     if (!handler)
         return false;
     JSObject *proto, *parent = nullptr;
-    if (argc > 1 && vp[3].isObject()) {
-        proto = &vp[3].toObject();
+    if (args.get(1).isObject()) {
+        proto = &args[1].toObject();
         parent = proto->getParent();
     } else {
-        JS_ASSERT(IsFunctionObject(vp[0]));
+        JS_ASSERT(IsFunctionObject(&args.callee()));
         proto = nullptr;
     }
     if (!parent)
-        parent = vp[0].toObject().getParent();
+        parent = args.callee().getParent();
     RootedValue priv(cx, ObjectValue(*handler));
     JSObject *proxy = NewProxyObject(cx, &ScriptedIndirectProxyHandler::singleton,
                                      priv, proto, parent);
     if (!proxy)
         return false;
 
-    vp->setObject(*proxy);
+    args.rval().setObject(*proxy);
     return true;
 }
 
@@ -3214,7 +3215,7 @@ proxy_createFunction(JSContext *cx, unsigned argc, Value *vp)
         return false;
     proxy->as<ProxyObject>().setExtra(0, ObjectValue(*ccHolder));
 
-    vp->setObject(*proxy);
+    args.rval().setObject(*proxy);
     return true;
 }
 
diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 5bae62d0a59b..4876b2dc8d7b 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -402,11 +402,12 @@ WeakMap_finalize(FreeOp *fop, JSObject *obj)
 static bool
 WeakMap_construct(JSContext *cx, unsigned argc, Value *vp)
 {
+    CallArgs args = CallArgsFromVp(argc, vp);
     JSObject *obj = NewBuiltinClassInstance(cx, &WeakMapObject::class_);
     if (!obj)
         return false;
 
-    vp->setObject(*obj);
+    args.rval().setObject(*obj);
     return true;
 }
 
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index b4bd290af429..74dafced4387 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -5478,7 +5478,7 @@ DebuggerObject_unwrap(JSContext *cx, unsigned argc, Value *vp)
     THIS_DEBUGOBJECT_OWNER_REFERENT(cx, argc, vp, "unwrap", args, dbg, referent);
     JSObject *unwrapped = UnwrapOneChecked(referent);
     if (!unwrapped) {
-        vp->setNull();
+        args.rval().setNull();
         return true;
     }