diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 5fee6d728bb..11a2f32ba2f 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4588,7 +4588,7 @@ js_generic_fast_native_method_dispatcher(JSContext *cx, uintN argc, jsval *vp)
     native =
 #ifdef JS_TRACER
              (fs->flags & JSFUN_TRACEABLE)
-             ? ((JSTraceableNative *) fs->call)->native
+             ? JS_FUNC_TO_DATA_PTR(JSTraceableNative *, fs->call)->native
              :
 #endif
                (JSFastNative) fs->call;
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index c8dec64b2e1..e7b51587dcd 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -436,7 +436,7 @@ js_TraceWatchPoints(JSTracer *trc, JSObject *obj)
         if (wp->object == obj) {
             TRACE_SCOPE_PROPERTY(trc, wp->sprop);
             if ((wp->sprop->attrs & JSPROP_SETTER) && wp->setter) {
-                JS_CALL_OBJECT_TRACER(trc, (JSObject *)wp->setter,
+                JS_CALL_OBJECT_TRACER(trc, js_CastAsObject(wp->setter),
                                       "wp->setter");
             }
             JS_SET_TRACING_NAME(trc, "wp->closure");
@@ -652,7 +652,7 @@ js_watch_set(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
                 ok = !wp->setter ||
                      ((sprop->attrs & JSPROP_SETTER)
                       ? js_InternalCall(cx, obj,
-                                        OBJECT_TO_JSVAL((JSObject *)wp->setter),
+                                        js_CastAsObjectJSVal(wp->setter),
                                         1, vp, vp)
                       : wp->setter(cx, OBJ_THIS_OBJECT(cx, obj), userid, vp));
                 if (injectFrame) {
@@ -710,11 +710,11 @@ js_WrapWatchedSetter(JSContext *cx, jsid id, uintN attrs, JSPropertyOp setter)
         atom = NULL;
     }
     wrapper = js_NewFunction(cx, NULL, js_watch_set_wrapper, 1, 0,
-                             OBJ_GET_PARENT(cx, (JSObject *)setter),
+                             OBJ_GET_PARENT(cx, js_CastAsObject(setter)),
                              atom);
     if (!wrapper)
         return NULL;
-    return (JSPropertyOp) FUN_OBJECT(wrapper);
+    return js_CastAsPropertyOp(FUN_OBJECT(wrapper));
 }
 
 JS_PUBLIC_API(JSBool)
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 13b01dc0c0f..d168c9dfc22 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -2116,7 +2116,8 @@ js_NewFunction(JSContext *cx, JSObject *funobj, JSNative native, uintN nargs,
         fun->u.n.spare = 0;
         if (flags & JSFUN_TRACEABLE) {
 #ifdef JS_TRACER
-            JSTraceableNative *trcinfo = (JSTraceableNative *) native;
+            JSTraceableNative *trcinfo =
+                JS_FUNC_TO_DATA_PTR(JSTraceableNative *, native);
             fun->u.n.native = (JSNative) trcinfo->native;
             FUN_TRCINFO(fun) = trcinfo;
 #else
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 6cc4e7708c4..b5b9c5c4f3b 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -124,7 +124,7 @@ struct JSFunction {
 #ifdef JS_TRACER
 /* MSVC demands the intermediate (void *) cast here. */
 # define JS_TN(name,fastcall,nargs,flags,trcinfo)                             \
-    {name, (JSNative)(void *)(trcinfo), nargs,                                \
+    {name, JS_DATA_TO_FUNC_PTR(JSNative, trcinfo), nargs,                     \
      (flags) | JSFUN_FAST_NATIVE | JSFUN_STUB_GSOPS | JSFUN_TRACEABLE, 0}
 #else
 # define JS_TN(name,fastcall,nargs,flags,trcinfo)                             \
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 9a67efc269b..906c18f7bd2 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -5786,9 +5786,9 @@ js_Interpret(JSContext *cx)
                 attrs |= flags | JSPROP_SHARED;
                 rval = JSVAL_VOID;
                 if (flags == JSPROP_GETTER)
-                    getter = JS_EXTENSION (JSPropertyOp) obj;
+                    getter = js_CastAsPropertyOp(obj);
                 else
-                    setter = JS_EXTENSION (JSPropertyOp) obj;
+                    setter = js_CastAsPropertyOp(obj);
             }
 
             /*
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 714e98b13df..fb098aa1c4d 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -405,9 +405,10 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
             if (ok) {
                 if (OBJ_IS_NATIVE(obj2) &&
                     (attrs & (JSPROP_GETTER | JSPROP_SETTER))) {
+                    JSScopeProperty *sprop = (JSScopeProperty *) prop;
                     val = JSVAL_NULL;
                     if (attrs & JSPROP_GETTER)
-                        val = (jsval) ((JSScopeProperty*)prop)->getter;
+                        val = js_CastAsObjectJSVal(sprop->getter);
                     if (attrs & JSPROP_SETTER) {
                         if (val != JSVAL_NULL) {
                             /* Mark the getter, then set val to setter. */
@@ -415,7 +416,7 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
                                                    NULL)
                                   != NULL);
                         }
-                        val = (jsval) ((JSScopeProperty*)prop)->setter;
+                        val = js_CastAsObjectJSVal(sprop->setter);
                     }
                 } else {
                     ok = OBJ_GET_PROPERTY(cx, obj, id, &val);
@@ -770,8 +771,9 @@ obj_toSource(JSContext *cx, uintN argc, jsval *vp)
             }
             if (OBJ_IS_NATIVE(obj2) &&
                 (attrs & (JSPROP_GETTER | JSPROP_SETTER))) {
+                JSScopeProperty *sprop = (JSScopeProperty *) prop;
                 if (attrs & JSPROP_GETTER) {
-                    val[valcnt] = (jsval) ((JSScopeProperty *)prop)->getter;
+                    val[valcnt] = js_CastAsObjectJSVal(sprop->getter);
                     gsopold[valcnt] =
                         ATOM_TO_STRING(cx->runtime->atomState.getterAtom);
                     gsop[valcnt] =
@@ -780,7 +782,7 @@ obj_toSource(JSContext *cx, uintN argc, jsval *vp)
                     valcnt++;
                 }
                 if (attrs & JSPROP_SETTER) {
-                    val[valcnt] = (jsval) ((JSScopeProperty *)prop)->setter;
+                    val[valcnt] = js_CastAsObjectJSVal(sprop->setter);
                     gsopold[valcnt] =
                         ATOM_TO_STRING(cx->runtime->atomState.setterAtom);
                     gsop[valcnt] =
@@ -1821,7 +1823,7 @@ js_obj_defineGetter(JSContext *cx, uintN argc, jsval *vp)
         return JS_FALSE;
     *vp = JSVAL_VOID;
     return OBJ_DEFINE_PROPERTY(cx, obj, id, JSVAL_VOID,
-                               (JSPropertyOp) JSVAL_TO_OBJECT(fval),
+                               js_CastAsPropertyOp(JSVAL_TO_OBJECT(fval)),
                                JS_PropertyStub,
                                JSPROP_ENUMERATE | JSPROP_GETTER | JSPROP_SHARED,
                                NULL);
@@ -1857,7 +1859,7 @@ js_obj_defineSetter(JSContext *cx, uintN argc, jsval *vp)
     *vp = JSVAL_VOID;
     return OBJ_DEFINE_PROPERTY(cx, obj, id, JSVAL_VOID,
                                JS_PropertyStub,
-                               (JSPropertyOp) JSVAL_TO_OBJECT(fval),
+                               js_CastAsPropertyOp(JSVAL_TO_OBJECT(fval)),
                                JSPROP_ENUMERATE | JSPROP_SETTER | JSPROP_SHARED,
                                NULL);
 }
@@ -1880,7 +1882,7 @@ obj_lookupGetter(JSContext *cx, uintN argc, jsval *vp)
         if (OBJ_IS_NATIVE(pobj)) {
             sprop = (JSScopeProperty *) prop;
             if (sprop->attrs & JSPROP_GETTER)
-                *vp = OBJECT_TO_JSVAL((JSObject *) sprop->getter);
+                *vp = js_CastAsObjectJSVal(sprop->getter);
         }
         OBJ_DROP_PROPERTY(cx, pobj, prop);
     }
@@ -1905,7 +1907,7 @@ obj_lookupSetter(JSContext *cx, uintN argc, jsval *vp)
         if (OBJ_IS_NATIVE(pobj)) {
             sprop = (JSScopeProperty *) prop;
             if (sprop->attrs & JSPROP_SETTER)
-                *vp = OBJECT_TO_JSVAL((JSObject *) sprop->setter);
+                *vp = js_CastAsObjectJSVal(sprop->setter);
         }
         OBJ_DROP_PROPERTY(cx, pobj, prop);
     }
@@ -5663,7 +5665,7 @@ dumpValue(jsval val)
         fprintf(stderr, "<%s%s at %p>",
                 cls->name,
                 cls == &js_ObjectClass ? "" : " object",
-                obj);
+                (void *) obj);
     } else if (JSVAL_IS_INT(val)) {
         fprintf(stderr, "%d", JSVAL_TO_INT(val));
     } else if (JSVAL_IS_STRING(val)) {
@@ -5759,7 +5761,7 @@ js_DumpObject(JSObject *obj)
         if (sharesScope) {
             if (proto) {
                 fprintf(stderr, "no own properties - see proto (%s at %p)\n",
-                        STOBJ_GET_CLASS(proto)->name, proto);
+                        STOBJ_GET_CLASS(proto)->name, (void *) proto);
             } else {
                 fprintf(stderr, "no own properties - null proto\n");
             }
diff --git a/js/src/jsprvtd.h b/js/src/jsprvtd.h
index 710fa99a987..a3ee7d2af45 100644
--- a/js/src/jsprvtd.h
+++ b/js/src/jsprvtd.h
@@ -55,6 +55,7 @@
  */
 
 #include "jspubtd.h"
+#include "jsutil.h"
 
 /* Internal identifier (jsid) macros. */
 
@@ -260,4 +261,19 @@ struct JSTempValueRooter {
 extern JSBool js_CStringsAreUTF8;
 #endif
 
+/*
+ * Helper macros to convert between function and data pointers assuming that
+ * they have the same size.
+ */
+JS_STATIC_ASSERT(sizeof(void *) == sizeof(void (*)()));
+
+#ifdef __GNUC__
+# define JS_FUNC_TO_DATA_PTR(type, fun) (__extension__ (type) (fun))
+# define JS_DATA_TO_FUNC_PTR(type, ptr) (__extension__ (type) (ptr))
+#else
+/* Use an extra (void *) cast for MSVC. */
+# define JS_FUNC_TO_DATA_PTR(type, fun) ((type) (void *) (fun))
+# define JS_DATA_TO_FUNC_PTR(type, ptr) ((type) (void *) (ptr))
+#endif
+
 #endif /* jsprvtd_h___ */
diff --git a/js/src/jsregexp.cpp b/js/src/jsregexp.cpp
index 56409007700..7aed970f45e 100644
--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@@ -3904,7 +3904,7 @@ MatchRegExp(REGlobalData *gData, REMatchState *x)
                    caller ? caller->script->filename : "<unknown>",
                    caller ? js_FramePCToLineNumber(gData->cx, caller) : 0,
                    caller ? FramePCOffset(caller) : 0,
-                   (void *) native);
+                   JS_FUNC_TO_DATA_PTR(void *, native));
         })
 #endif
 
diff --git a/js/src/jsscope.cpp b/js/src/jsscope.cpp
index 891a23a9685..83fcc278857 100644
--- a/js/src/jsscope.cpp
+++ b/js/src/jsscope.cpp
@@ -1560,16 +1560,12 @@ js_TraceScopeProperty(JSTracer *trc, JSScopeProperty *sprop)
 #if JS_HAS_GETTER_SETTER
     if (sprop->attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
         if (sprop->attrs & JSPROP_GETTER) {
-            JS_ASSERT(JSVAL_IS_OBJECT((jsval) sprop->getter));
             JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, sprop, 0);
-            JS_CallTracer(trc, JSVAL_TO_OBJECT((jsval) sprop->getter),
-                          JSTRACE_OBJECT);
+            JS_CallTracer(trc, js_CastAsObject(sprop->getter), JSTRACE_OBJECT);
         }
         if (sprop->attrs & JSPROP_SETTER) {
-            JS_ASSERT(JSVAL_IS_OBJECT((jsval) sprop->setter));
             JS_SET_TRACING_DETAILS(trc, PrintPropertyGetterOrSetter, sprop, 1);
-            JS_CallTracer(trc, JSVAL_TO_OBJECT((jsval) sprop->setter),
-                          JSTRACE_OBJECT);
+            JS_CallTracer(trc, js_CastAsObject(sprop->setter), JSTRACE_OBJECT);
         }
     }
 #endif /* JS_HAS_GETTER_SETTER */
diff --git a/js/src/jsscope.h b/js/src/jsscope.h
index fac02ad35ec..1a8c112558d 100644
--- a/js/src/jsscope.h
+++ b/js/src/jsscope.h
@@ -271,6 +271,27 @@ JS_STATIC_ASSERT(offsetof(JSScope, title) == sizeof(JSObjectMap));
 #define SCOPE_LAST_PROP(scope)          ((scope)->lastProp)
 #define SCOPE_REMOVE_LAST_PROP(scope)   ((scope)->lastProp =                  \
                                          (scope)->lastProp->parent)
+/*
+ * Helpers for reinterpreting JSPropertyOp as JSObject* for scripted getters
+ * and setters.
+ */
+static inline JSObject *
+js_CastAsObject(JSPropertyOp op)
+{
+    return JS_FUNC_TO_DATA_PTR(JSObject *, op);
+}
+
+static inline jsval
+js_CastAsObjectJSVal(JSPropertyOp op)
+{
+    return OBJECT_TO_JSVAL(JS_FUNC_TO_DATA_PTR(JSObject *, op));
+}
+
+static inline JSPropertyOp
+js_CastAsPropertyOp(JSObject *object)
+{
+    return JS_DATA_TO_FUNC_PTR(JSPropertyOp, object);
+}
 
 struct JSScopeProperty {
     jsid            id;                 /* int-tagged jsval/untagged JSAtom* */
@@ -334,8 +355,8 @@ SPROP_GET(JSContext* cx, JSScopeProperty* sprop, JSObject* obj, JSObject* obj2,
     JS_ASSERT(!SPROP_HAS_STUB_GETTER(sprop));
 
     if (sprop->attrs & JSPROP_GETTER) {
-        return js_InternalGetOrSet(cx, obj, sprop->id,
-                                   OBJECT_TO_JSVAL((JSObject *) sprop->getter), JSACC_READ,
+        jsval fval = js_CastAsObjectJSVal(sprop->getter);
+        return js_InternalGetOrSet(cx, obj, sprop->id, fval, JSACC_READ,
                                    0, 0, vp);
     }
 
@@ -349,9 +370,9 @@ SPROP_SET(JSContext* cx, JSScopeProperty* sprop, JSObject* obj, JSObject* obj2,
                 !(sprop->attrs & JSPROP_GETTER)));
 
     if (sprop->attrs & JSPROP_SETTER) {
-        return js_InternalGetOrSet(cx, obj, (sprop)->id,
-                                   OBJECT_TO_JSVAL((JSObject *) sprop->setter),
-                                   JSACC_WRITE, 1, vp, vp);
+        jsval fval = js_CastAsObjectJSVal(sprop->setter);
+        return js_InternalGetOrSet(cx, obj, (sprop)->id, fval, JSACC_WRITE,
+                                   1, vp, vp);
     }
 
     if (sprop->attrs & JSPROP_GETTER) {
diff --git a/js/src/jstracer.cpp b/js/src/jstracer.cpp
index 8d243ead22d..44def6bb310 100644
--- a/js/src/jstracer.cpp
+++ b/js/src/jstracer.cpp
@@ -211,8 +211,9 @@ js_InitJITStatsClass(JSContext *cx, JSObject *glob)
 #define AUDIT(x) ((void)0)
 #endif /* JS_JIT_SPEW */
 
-#define INS_CONST(c)    addName(lir->insImm(c), #c)
-#define INS_CONSTPTR(p) addName(lir->insImmPtr((void*) (p)), #p)
+#define INS_CONST(c)        addName(lir->insImm(c), #c)
+#define INS_CONSTPTR(p)     addName(lir->insImmPtr((void*) (p)), #p)
+#define INS_CONSTFUNPTR(p)  addName(lir->insImmPtr(JS_FUNC_TO_DATA_PTR(void*, p)), #p)
 
 using namespace avmplus;
 using namespace nanojit;
@@ -5549,7 +5550,7 @@ TraceRecorder::map_is_native(JSObjectMap* map, LIns* map_ins, LIns*& ops_ins, si
 #define OP(ops) (*(JSObjectOp*) ((char*)(ops) + op_offset))
 
     if (OP(map->ops) == OP(&js_ObjectOps)) {
-        guard(true, addName(lir->ins2(LIR_eq, n, INS_CONSTPTR(OP(&js_ObjectOps))),
+        guard(true, addName(lir->ins2(LIR_eq, n, INS_CONSTFUNPTR(OP(&js_ObjectOps))),
                             "guard(native-map)"),
               MISMATCH_EXIT);
         return true;
@@ -9254,10 +9255,12 @@ js_GetBuiltinFunction(JSContext *cx, uintN index)
 
     if (!funobj) {
         /* Use NULL parent and atom. Builtin functions never escape to scripts. */
+        JS_ASSERT(index < JS_ARRAY_LENGTH(builtinFunctionInfo));
+        const BuiltinFunctionInfo *bfi = &builtinFunctionInfo[index];
         JSFunction *fun = js_NewFunction(cx,
                                          NULL,
-                                         (JSNative) builtinFunctionInfo[index].tn,
-                                         builtinFunctionInfo[index].nargs,
+                                         JS_DATA_TO_FUNC_PTR(JSNative, bfi->tn),
+                                         bfi->nargs,
                                          JSFUN_FAST_NATIVE | JSFUN_TRACEABLE,
                                          NULL,
                                          NULL);