diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index ef6e663f55fc..1503bcf93067 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -426,6 +426,7 @@ class ReadBarriered
     T *value;
 
   public:
+    ReadBarriered() : value(NULL) {}
     ReadBarriered(T *value) : value(value) {}
 
     T *get() const {
@@ -437,6 +438,9 @@ class ReadBarriered
 
     operator T*() const { return get(); }
 
+    T &operator*() const { return *get(); }
+    T *operator->() const { return get(); }
+
     T *unsafeGet() { return value; }
 
     void set(T *v) { value = v; }
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 083bc6530ced..4e3e52b3b310 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -2617,7 +2617,7 @@ struct types::ObjectTableKey
 
 struct types::ObjectTableEntry
 {
-    TypeObject *object;
+    ReadBarriered<TypeObject> object;
     Type *types;
 };
 
@@ -5837,9 +5837,6 @@ JSObject::getNewType(JSContext *cx, JSFunction *fun)
         if (type->newScript && type->newScript->fun != fun)
             type->clearNewScript(cx);
 
-        if (cx->compartment->needsBarrier())
-            TypeObject::readBarrier(type);
-
         return type;
     }
 
@@ -5905,9 +5902,6 @@ JSCompartment::getLazyType(JSContext *cx, JSObject *proto)
         TypeObject *type = *p;
         JS_ASSERT(type->lazy());
 
-        if (cx->compartment->needsBarrier())
-            TypeObject::readBarrier(type);
-
         return type;
     }
 
diff --git a/js/src/jsinfer.h b/js/src/jsinfer.h
index d03e04e46256..bc685b84a439 100644
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@@ -898,7 +898,7 @@ struct TypeObjectEntry
     static inline HashNumber hash(JSObject *base);
     static inline bool match(TypeObject *key, JSObject *lookup);
 };
-typedef HashSet<TypeObject *, TypeObjectEntry, SystemAllocPolicy> TypeObjectSet;
+typedef HashSet<ReadBarriered<TypeObject>, TypeObjectEntry, SystemAllocPolicy> TypeObjectSet;
 
 /*
  * Call to mark a script's arguments as having been created, recompile any
@@ -1120,14 +1120,14 @@ class TypeScript
 };
 
 struct ArrayTableKey;
-typedef HashMap<ArrayTableKey,TypeObject*,ArrayTableKey,SystemAllocPolicy> ArrayTypeTable;
+typedef HashMap<ArrayTableKey,ReadBarriered<TypeObject>,ArrayTableKey,SystemAllocPolicy> ArrayTypeTable;
 
 struct ObjectTableKey;
 struct ObjectTableEntry;
 typedef HashMap<ObjectTableKey,ObjectTableEntry,ObjectTableKey,SystemAllocPolicy> ObjectTypeTable;
 
 struct AllocationSiteKey;
-typedef HashMap<AllocationSiteKey,TypeObject*,AllocationSiteKey,SystemAllocPolicy> AllocationSiteTable;
+typedef HashMap<AllocationSiteKey,ReadBarriered<TypeObject>,AllocationSiteKey,SystemAllocPolicy> AllocationSiteTable;
 
 /* Type information for a compartment. */
 struct TypeCompartment
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index e76bfc31895b..16574dacdbc4 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -1279,9 +1279,8 @@ TypeObject::readBarrier(TypeObject *type)
 {
 #ifdef JSGC_INCREMENTAL
     JSCompartment *comp = type->compartment();
-    JS_ASSERT(comp->needsBarrier());
-
-    MarkTypeObjectUnbarriered(comp->barrierTracer(), type, "read barrier");
+    if (comp->needsBarrier())
+        MarkTypeObjectUnbarriered(comp->barrierTracer(), type, "read barrier");
 #endif
 }
 
diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index c5d32ae07d62..77bc003a26d6 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -1275,14 +1275,8 @@ BaseShape::getUnowned(JSContext *cx, const BaseShape &base)
 
     BaseShapeSet::AddPtr p = table.lookupForAdd(&base);
 
-    if (p) {
-        UnownedBaseShape *base = *p;
-
-        if (cx->compartment->needsBarrier())
-            BaseShape::readBarrier(base);
-
-        return base;
-    }
+    if (p)
+        return *p;
 
     BaseShape *nbase_ = js_NewGCBaseShape(cx);
     if (!nbase_)
@@ -1382,14 +1376,8 @@ EmptyShape::getInitialShape(JSContext *cx, Class *clasp, JSObject *proto, JSObje
 
     InitialShapeSet::AddPtr p = table.lookupForAdd(lookup);
 
-    if (p) {
-        Shape *shape = p->shape;
-
-        if (cx->compartment->needsBarrier())
-            Shape::readBarrier(shape);
-
-        return shape;
-    }
+    if (p)
+        return p->shape;
 
     BaseShape base(clasp, parent, objectFlags);
     UnownedBaseShape *nbase = BaseShape::getUnowned(cx, base);
diff --git a/js/src/jsscope.h b/js/src/jsscope.h
index 14a53cd723a7..63239c8c9ad7 100644
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -493,7 +493,7 @@ struct BaseShapeEntry
     static inline HashNumber hash(const BaseShape *base);
     static inline bool match(UnownedBaseShape *key, const BaseShape *lookup);
 };
-typedef HashSet<UnownedBaseShape *, BaseShapeEntry, SystemAllocPolicy> BaseShapeSet;
+typedef HashSet<ReadBarriered<UnownedBaseShape>, BaseShapeEntry, SystemAllocPolicy> BaseShapeSet;
 
 struct Shape : public js::gc::Cell
 {
@@ -975,7 +975,7 @@ struct InitialShapeEntry
      * certain classes (e.g. String, RegExp) which may add certain baked-in
      * properties.
      */
-    js::Shape *shape;
+    ReadBarriered<Shape> shape;
 
     /*
      * Matching prototype for the entry. The shape of an object determines its
diff --git a/js/src/jsscopeinlines.h b/js/src/jsscopeinlines.h
index c6ffc2136d07..fe8e3a6b774a 100644
--- a/js/src/jsscopeinlines.h
+++ b/js/src/jsscopeinlines.h
@@ -362,9 +362,8 @@ Shape::readBarrier(const Shape *shape)
 {
 #ifdef JSGC_INCREMENTAL
     JSCompartment *comp = shape->compartment();
-    JS_ASSERT(comp->needsBarrier());
-
-    MarkShapeUnbarriered(comp->barrierTracer(), shape, "read barrier");
+    if (comp->needsBarrier())
+        MarkShapeUnbarriered(comp->barrierTracer(), shape, "read barrier");
 #endif
 }
 
@@ -391,9 +390,8 @@ BaseShape::readBarrier(BaseShape *base)
 {
 #ifdef JSGC_INCREMENTAL
     JSCompartment *comp = base->compartment();
-    JS_ASSERT(comp->needsBarrier());
-
-    MarkBaseShapeUnbarriered(comp->barrierTracer(), base, "read barrier");
+    if (comp->needsBarrier())
+        MarkBaseShapeUnbarriered(comp->barrierTracer(), base, "read barrier");
 #endif
 }