Remove more direct QV4::Value usage

Remove Value::fromString(String *), and make
Encode safe against encoding raw Managed * pointers.

Change-Id: Ibca4668e1cbeaf85c78169d14386281659d33ef6
Reviewed-by: Simon Hausmann <[email protected]>

40 files changed, 162 insertions, 145 deletions

diff --git a/src/qml/jsapi/qjsvalue.cpp b/src/qml/jsapi/qjsvalue.cpp
index 2afeff0a07..5805b6a78f 100644
--- a/src/qml/jsapi/qjsvalue.cpp
+++ b/src/qml/jsapi/qjsvalue.cpp
@@ -508,7 +508,7 @@ QJSValue QJSValue::call(const QJSValueList &args)
 
     Scope scope(engine);
     ScopedCallData callData(scope, args.length());
-    callData->thisObject = Encode(engine->globalObject);
+    callData->thisObject = engine->globalObject->asReturnedValue();
     for (int i = 0; i < args.size(); ++i) {
         if (!args.at(i).d->checkEngine(engine)) {
             qWarning("QJSValue::call() failed: cannot call function with argument created in a different engine");
diff --git a/src/qml/jsapi/qjsvalue_p.h b/src/qml/jsapi/qjsvalue_p.h
index ec3f61ef20..bf839a6f1f 100644
--- a/src/qml/jsapi/qjsvalue_p.h
+++ b/src/qml/jsapi/qjsvalue_p.h
@@ -83,7 +83,7 @@ public:
         : PersistentValuePrivate(QV4::Encode::undefined())
         , string(0, s)
     {
-        value = QV4::Value::fromString(&string);
+        value.val = QV4::Encode(string.asReturned<QV4::String>());
     }
 
     QV4::ReturnedValue getValue(QV4::ExecutionEngine *e);
diff --git a/src/qml/jsruntime/qv4argumentsobject.cpp b/src/qml/jsruntime/qv4argumentsobject.cpp
index 06e75d8085..9f3675e817 100644
--- a/src/qml/jsruntime/qv4argumentsobject.cpp
+++ b/src/qml/jsruntime/qv4argumentsobject.cpp
@@ -71,7 +71,7 @@ ArgumentsObject::ArgumentsObject(CallContext *context)
     } else {
         internalClass = engine()->argumentsObjectClass;
         Q_ASSERT(CalleePropertyIndex == internalClass->find(context->engine->id_callee));
-        memberData[CalleePropertyIndex].value = Encode(context->function);
+        memberData[CalleePropertyIndex].value = context->function->asReturnedValue();
         isNonStrictArgumentsObject = true;
 
         uint numAccessors = qMin((int)context->function->formalParameterCount, context->realArgumentCount);
@@ -128,7 +128,7 @@ bool ArgumentsObject::defineOwnProperty(ExecutionContext *ctx, uint index, const
     if (isMapped && attrs.isData()) {
         if (!attrs.isGeneric()) {
             ScopedCallData callData(scope, 1);
-            callData->thisObject = Value::fromObject(this);
+            callData->thisObject = this->asReturnedValue();
             callData->args[0] = desc.value;
             map.setter()->call(callData);
         }
diff --git a/src/qml/jsruntime/qv4argumentsobject_p.h b/src/qml/jsruntime/qv4argumentsobject_p.h
index 7862a602bd..33245ca2fd 100644
--- a/src/qml/jsruntime/qv4argumentsobject_p.h
+++ b/src/qml/jsruntime/qv4argumentsobject_p.h
@@ -74,7 +74,7 @@ struct ArgumentsSetterFunction: FunctionObject
 struct ArgumentsObject: Object {
     Q_MANAGED
     CallContext *context;
-    QVector<Value> mappedArguments;
+    QVector<SafeValue> mappedArguments;
     ArgumentsObject(CallContext *context);
     ~ArgumentsObject() {}
 
diff --git a/src/qml/jsruntime/qv4arrayobject.cpp b/src/qml/jsruntime/qv4arrayobject.cpp
index 0aa7e93804..02b83428fa 100644
--- a/src/qml/jsruntime/qv4arrayobject.cpp
+++ b/src/qml/jsruntime/qv4arrayobject.cpp
@@ -349,7 +349,7 @@ ReturnedValue ArrayPrototype::method_shift(SimpleCallContext *ctx)
     if (pidx < UINT_MAX && (!instance->arrayAttributes || !instance->arrayAttributes[0].isGeneric()))
             front = instance->arrayData + pidx;
 
-    Value result = front ? Value::fromReturnedValue(instance->getValue(front, instance->arrayAttributes ? instance->arrayAttributes[pidx] : Attr_Data)) : Primitive::undefinedValue();
+    ScopedValue result(scope, front ? instance->getValue(front, instance->arrayAttributes ? instance->arrayAttributes[pidx] : Attr_Data) : Encode::undefined());
 
     if (!instance->protoHasArray() && instance->arrayDataLen <= len) {
         if (!instance->sparseArray) {
@@ -456,7 +456,7 @@ ReturnedValue ArrayPrototype::method_splice(SimpleCallContext *ctx)
 
     newArray->arrayReserve(deleteCount);
     for (uint i = 0; i < deleteCount; ++i) {
-        newArray->arrayData[i].value = Value::fromReturnedValue(instance->getIndexed(start + i));
+        newArray->arrayData[i].value = instance->getIndexed(start + i);
         newArray->arrayDataLen = i + 1;
     }
     newArray->setArrayLengthUnchecked(deleteCount);
@@ -675,6 +675,7 @@ ReturnedValue ArrayPrototype::method_some(SimpleCallContext *ctx)
     callData->args[2] = instance;
     ScopedValue v(scope);
 
+    ScopedValue r(scope);
     for (uint k = 0; k < len; ++k) {
         bool exists;
         v = instance->getIndexed(k, &exists);
@@ -683,8 +684,8 @@ ReturnedValue ArrayPrototype::method_some(SimpleCallContext *ctx)
 
         callData->args[0] = v;
         callData->args[1] = Primitive::fromDouble(k);
-        Value r = Value::fromReturnedValue(callback->call(callData));
-        if (r.toBoolean())
+        r = callback->call(callData);
+        if (r->toBoolean())
             return Encode(true);
     }
     return Encode(false);
diff --git a/src/qml/jsruntime/qv4booleanobject.cpp b/src/qml/jsruntime/qv4booleanobject.cpp
index 0a1e5449b7..e4274b2ed9 100644
--- a/src/qml/jsruntime/qv4booleanobject.cpp
+++ b/src/qml/jsruntime/qv4booleanobject.cpp
@@ -86,7 +86,7 @@ ReturnedValue BooleanPrototype::method_toString(SimpleCallContext *ctx)
         result = thisObject->value.booleanValue();
     }
 
-    return Value::fromString(ctx, QLatin1String(result ? "true" : "false")).asReturnedValue();
+    return Encode(ctx->engine->newString(QLatin1String(result ? "true" : "false")));
 }
 
 ReturnedValue BooleanPrototype::method_valueOf(SimpleCallContext *ctx)
diff --git a/src/qml/jsruntime/qv4context.cpp b/src/qml/jsruntime/qv4context.cpp
index e7ac8967a4..75f7f9eb9a 100644
--- a/src/qml/jsruntime/qv4context.cpp
+++ b/src/qml/jsruntime/qv4context.cpp
@@ -429,7 +429,7 @@ ReturnedValue ExecutionContext::getProperty(const StringRef name)
 
         else if (ctx->type >= Type_CallContext) {
             QV4::CallContext *c = static_cast<CallContext *>(ctx);
-            FunctionObject *f = c->function;
+            ScopedFunctionObject f(scope, c->function);
             if (f->needsActivation || hasWith || hasCatchScope) {
                 for (unsigned int i = 0; i < f->varCount; ++i)
                     if (f->varList[i]->isEqualTo(name))
@@ -446,7 +446,7 @@ ReturnedValue ExecutionContext::getProperty(const StringRef name)
             }
             if (f->function && f->function->isNamedExpression()
                 && name->isEqualTo(f->function->name))
-                return Value::fromObject(c->function).asReturnedValue();
+                return f.asReturnedValue();
         }
 
         else if (ctx->type == Type_GlobalContext) {
@@ -494,7 +494,7 @@ ReturnedValue ExecutionContext::getPropertyNoThrow(const StringRef name)
 
         else if (ctx->type >= Type_CallContext) {
             QV4::CallContext *c = static_cast<CallContext *>(ctx);
-            FunctionObject *f = c->function;
+            ScopedFunctionObject f(scope, c->function);
             if (f->needsActivation || hasWith || hasCatchScope) {
                 for (unsigned int i = 0; i < f->varCount; ++i)
                     if (f->varList[i]->isEqualTo(name))
@@ -511,7 +511,7 @@ ReturnedValue ExecutionContext::getPropertyNoThrow(const StringRef name)
             }
             if (f->function && f->function->isNamedExpression()
                 && name->isEqualTo(f->function->name))
-                return Value::fromObject(c->function).asReturnedValue();
+                return f.asReturnedValue();
         }
 
         else if (ctx->type == Type_GlobalContext) {
diff --git a/src/qml/jsruntime/qv4engine.cpp b/src/qml/jsruntime/qv4engine.cpp
index 2f297c34f5..e2f5ed4515 100644
--- a/src/qml/jsruntime/qv4engine.cpp
+++ b/src/qml/jsruntime/qv4engine.cpp
@@ -385,9 +385,9 @@ Returned<Object> *ExecutionEngine::newObject(InternalClass *internalClass)
     return object->asReturned<Object>();
 }
 
-String *ExecutionEngine::newString(const QString &s)
+Returned<String> *ExecutionEngine::newString(const QString &s)
 {
-    return new (memoryManager) String(this, s);
+    return (new (memoryManager) String(this, s))->asReturned<String>();
 }
 
 String *ExecutionEngine::newIdentifier(const QString &text)
@@ -395,7 +395,7 @@ String *ExecutionEngine::newIdentifier(const QString &text)
     return identifierTable->insertString(text);
 }
 
-Returned<Object> *ExecutionEngine::newStringObject(const Value &value)
+Returned<Object> *ExecutionEngine::newStringObject(const ValueRef value)
 {
     StringObject *object = new (memoryManager) StringObject(this, value);
     return object->asReturned<Object>();
diff --git a/src/qml/jsruntime/qv4engine_p.h b/src/qml/jsruntime/qv4engine_p.h
index fdfbfc38e1..ecc29e7427 100644
--- a/src/qml/jsruntime/qv4engine_p.h
+++ b/src/qml/jsruntime/qv4engine_p.h
@@ -272,10 +272,10 @@ struct Q_QML_EXPORT ExecutionEngine
     Returned<Object> *newObject();
     Returned<Object> *newObject(InternalClass *internalClass);
 
-    String *newString(const QString &s);
+    Returned<String> *newString(const QString &s);
     String *newIdentifier(const QString &text);
 
-    Returned<Object> *newStringObject(const Value &value);
+    Returned<Object> *newStringObject(const ValueRef value);
     Returned<Object> *newNumberObject(const ValueRef value);
     Returned<Object> *newBooleanObject(const ValueRef value);
 
diff --git a/src/qml/jsruntime/qv4errorobject.cpp b/src/qml/jsruntime/qv4errorobject.cpp
index d8400cd6d5..024068eed0 100644
--- a/src/qml/jsruntime/qv4errorobject.cpp
+++ b/src/qml/jsruntime/qv4errorobject.cpp
@@ -135,7 +135,8 @@ ErrorObject::ErrorObject(InternalClass *ic, const QString &message, const QStrin
         defineDefaultProperty(QStringLiteral("lineNumber"), Primitive::fromInt32(stackTrace.at(0).line));
     }
 
-    defineDefaultProperty(QStringLiteral("message"), Value::fromString(ic->engine->newString(message)));
+    ScopedValue v(scope, ic->engine->newString(message));
+    defineDefaultProperty(QStringLiteral("message"), v);
 }
 
 ReturnedValue ErrorObject::method_get_stack(SimpleCallContext *ctx)
@@ -157,9 +158,9 @@ ReturnedValue ErrorObject::method_get_stack(SimpleCallContext *ctx)
                 trace += QString::number(frame.line);
             }
         }
-        This->stack = ctx->engine->newString(trace);
+        This->stack = ctx->engine->newString(trace)->getPointer();
     }
-    return Value::fromString(This->stack).asReturnedValue();
+    return This->stack->asReturnedValue();
 }
 
 void ErrorObject::markObjects(Managed *that)
@@ -281,7 +282,9 @@ RangeErrorCtor::RangeErrorCtor(ExecutionContext *scope)
 
 ReturnedValue RangeErrorCtor::construct(Managed *m, CallData *callData)
 {
-    return Value::fromObject(new (m->engine()->memoryManager) RangeErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue())).asReturnedValue();
+    Scope scope(m->engine());
+    ScopedValue v(scope, new (m->engine()->memoryManager) RangeErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue()));
+    return v.asReturnedValue();
 }
 
 ReferenceErrorCtor::ReferenceErrorCtor(ExecutionContext *scope)
@@ -292,7 +295,9 @@ ReferenceErrorCtor::ReferenceErrorCtor(ExecutionContext *scope)
 
 ReturnedValue ReferenceErrorCtor::construct(Managed *m, CallData *callData)
 {
-    return Value::fromObject(new (m->engine()->memoryManager) ReferenceErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue())).asReturnedValue();
+    Scope scope(m->engine());
+    ScopedValue v(scope, new (m->engine()->memoryManager) ReferenceErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue()));
+    return v.asReturnedValue();
 }
 
 SyntaxErrorCtor::SyntaxErrorCtor(ExecutionContext *scope)
@@ -303,7 +308,9 @@ SyntaxErrorCtor::SyntaxErrorCtor(ExecutionContext *scope)
 
 ReturnedValue SyntaxErrorCtor::construct(Managed *m, CallData *callData)
 {
-    return Value::fromObject(new (m->engine()->memoryManager) SyntaxErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue())).asReturnedValue();
+    Scope scope(m->engine());
+    ScopedValue v(scope, new (m->engine()->memoryManager) SyntaxErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue()));
+    return v.asReturnedValue();
 }
 
 TypeErrorCtor::TypeErrorCtor(ExecutionContext *scope)
@@ -314,7 +321,9 @@ TypeErrorCtor::TypeErrorCtor(ExecutionContext *scope)
 
 ReturnedValue TypeErrorCtor::construct(Managed *m, CallData *callData)
 {
-    return Value::fromObject(new (m->engine()->memoryManager) TypeErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue())).asReturnedValue();
+    Scope scope(m->engine());
+    ScopedValue v(scope, new (m->engine()->memoryManager) TypeErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue()));
+    return v.asReturnedValue();
 }
 
 URIErrorCtor::URIErrorCtor(ExecutionContext *scope)
@@ -325,7 +334,9 @@ URIErrorCtor::URIErrorCtor(ExecutionContext *scope)
 
 ReturnedValue URIErrorCtor::construct(Managed *m, CallData *callData)
 {
-    return Value::fromObject(new (m->engine()->memoryManager) URIErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue())).asReturnedValue();
+    Scope scope(m->engine());
+    ScopedValue v(scope, new (m->engine()->memoryManager) URIErrorObject(m->engine(), callData->argc ? callData->args[0] : Primitive::undefinedValue()));
+    return v.asReturnedValue();
 }
 
 void ErrorPrototype::init(ExecutionEngine *engine, const Value &ctor, Object *obj)
diff --git a/src/qml/jsruntime/qv4function.cpp b/src/qml/jsruntime/qv4function.cpp
index 89eb5baba2..dc2643b60a 100644
--- a/src/qml/jsruntime/qv4function.cpp
+++ b/src/qml/jsruntime/qv4function.cpp
@@ -65,14 +65,14 @@ Function::Function(ExecutionEngine *engine, CompiledData::CompilationUnit *unit,
     formals.fill(0);
     const quint32 *formalsIndices = compiledFunction->formalsTable();
     for (int i = 0; i < compiledFunction->nFormals; ++i)
-        formals[i] = engine->newString(unit->data->stringAt(formalsIndices[i]));
+        formals[i] = engine->newString(unit->data->stringAt(formalsIndices[i]))->getPointer();
 
 
     locals.resize(compiledFunction->nLocals);
     locals.fill(0);
     const quint32 *localsIndices = compiledFunction->localsTable();
     for (int i = 0; i < compiledFunction->nLocals; ++i)
-        locals[i] = engine->newString(unit->data->stringAt(localsIndices[i]));
+        locals[i] = engine->newString(unit->data->stringAt(localsIndices[i]))->getPointer();
 }
 
 Function::~Function()
diff --git a/src/qml/jsruntime/qv4functionobject.cpp b/src/qml/jsruntime/qv4functionobject.cpp
index b4c39504f0..fbc5c10e3c 100644
--- a/src/qml/jsruntime/qv4functionobject.cpp
+++ b/src/qml/jsruntime/qv4functionobject.cpp
@@ -279,7 +279,7 @@ ReturnedValue FunctionCtor::construct(Managed *that, CallData *callData)
     QV4::CompiledData::CompilationUnit *compilationUnit = isel->compile();
     QV4::Function *vmf = compilationUnit->linkToEngine(v4);
 
-    return Value::fromObject(FunctionObject::creatScriptFunction(v4->rootContext, vmf)).asReturnedValue();
+    return FunctionObject::creatScriptFunction(v4->rootContext, vmf)->asReturnedValue();
 }
 
 // 15.3.1: This is equivalent to new Function(...)
diff --git a/src/qml/jsruntime/qv4identifiertable.cpp b/src/qml/jsruntime/qv4identifiertable.cpp
index 6553e78b22..04c31828cc 100644
--- a/src/qml/jsruntime/qv4identifiertable.cpp
+++ b/src/qml/jsruntime/qv4identifiertable.cpp
@@ -129,7 +129,7 @@ String *IdentifierTable::insertString(const QString &s)
         idx %= alloc;
     }
 
-    String *str = engine->newString(s);
+    String *str = engine->newString(s)->getPointer();
     addEntry(str);
     return str;
 }
@@ -177,7 +177,7 @@ Identifier *IdentifierTable::identifier(const char *s, int len)
         idx %= alloc;
     }
 
-    String *str = engine->newString(QString::fromLatin1(s, len));
+    String *str = engine->newString(QString::fromLatin1(s, len))->getPointer();
     addEntry(str);
     return str->identifier;
 }
diff --git a/src/qml/jsruntime/qv4numberobject.cpp b/src/qml/jsruntime/qv4numberobject.cpp
index c641d2c9e0..396dc33fd5 100644
--- a/src/qml/jsruntime/qv4numberobject.cpp
+++ b/src/qml/jsruntime/qv4numberobject.cpp
@@ -157,16 +157,16 @@ ReturnedValue NumberPrototype::method_toString(SimpleCallContext *ctx)
         }
     }
 
-    String *str = Primitive::fromDouble(num).toString(ctx);
-    return Value::fromString(str).asReturnedValue();
+    return Primitive::fromDouble(num).toString(ctx)->asReturnedValue();
 }
 
 ReturnedValue NumberPrototype::method_toLocaleString(SimpleCallContext *ctx)
 {
+    Scope scope(ctx);
     Value v = thisNumberValue(ctx);
 
-    String *str = v.toString(ctx);
-    return Value::fromString(str).asReturnedValue();
+    ScopedString str(scope, v.toString(ctx));
+    return str.asReturnedValue();
 }
 
 ReturnedValue NumberPrototype::method_valueOf(SimpleCallContext *ctx)
@@ -203,6 +203,7 @@ ReturnedValue NumberPrototype::method_toFixed(SimpleCallContext *ctx)
 
 ReturnedValue NumberPrototype::method_toExponential(SimpleCallContext *ctx)
 {
+    Scope scope(ctx);
     double d = thisNumberValue(ctx).asDouble();
 
     int fdigits = -1;
@@ -210,8 +211,8 @@ ReturnedValue NumberPrototype::method_toExponential(SimpleCallContext *ctx)
     if (ctx->callData->argc && !ctx->callData->args[0].isUndefined()) {
         int fdigits = ctx->callData->args[0].toInt32();
         if (fdigits < 0 || fdigits > 20) {
-            String *error = ctx->engine->newString(QStringLiteral("Number.prototype.toExponential: fractionDigits out of range"));
-            ctx->throwRangeError(Value::fromString(error));
+            ScopedString error(scope, ctx->engine->newString(QStringLiteral("Number.prototype.toExponential: fractionDigits out of range")));
+            ctx->throwRangeError(error.asValue());
         }
     }
 
@@ -234,8 +235,8 @@ ReturnedValue NumberPrototype::method_toPrecision(SimpleCallContext *ctx)
 
     double precision = ctx->callData->args[0].toInt32();
     if (precision < 1 || precision > 21) {
-        String *error = ctx->engine->newString(QStringLiteral("Number.prototype.toPrecision: precision out of range"));
-        ctx->throwRangeError(Value::fromString(error));
+        ScopedString error(scope, ctx->engine->newString(QStringLiteral("Number.prototype.toPrecision: precision out of range")));
+        ctx->throwRangeError(error.asValue());
     }
 
     char str[100];
diff --git a/src/qml/jsruntime/qv4object.cpp b/src/qml/jsruntime/qv4object.cpp
index e0c8974440..a785e5b13b 100644
--- a/src/qml/jsruntime/qv4object.cpp
+++ b/src/qml/jsruntime/qv4object.cpp
@@ -1451,7 +1451,7 @@ ArrayObject::ArrayObject(ExecutionEngine *engine, const QStringList &list)
     int len = list.count();
     arrayReserve(len);
     for (int ii = 0; ii < len; ++ii) {
-        arrayData[ii].value = Value::fromString(engine->newString(list.at(ii)));
+        arrayData[ii].value = Encode(engine->newString(list.at(ii)));
         arrayDataLen = ii + 1;
     }
     setArrayLengthUnchecked(len);
diff --git a/src/qml/jsruntime/qv4objectiterator.cpp b/src/qml/jsruntime/qv4objectiterator.cpp
index 1c12704545..fc85a3f04c 100644
--- a/src/qml/jsruntime/qv4objectiterator.cpp
+++ b/src/qml/jsruntime/qv4objectiterator.cpp
@@ -107,7 +107,7 @@ ReturnedValue ObjectIterator::nextPropertyName(Value *value)
         *value = Value::fromReturnedValue(object->getValue(p, attrs));
 
     if (name)
-        return Value::fromString(name).asReturnedValue();
+        return name->asReturnedValue();
     assert(index < UINT_MAX);
     return Encode(index);
 }
@@ -125,7 +125,7 @@ ReturnedValue ObjectIterator::nextPropertyNameAsString(Value *value)
         *value = Value::fromReturnedValue(object->getValue(p, attrs));
 
     if (name)
-        return Value::fromString(name).asReturnedValue();
+        return name->asReturnedValue();
     assert(index < UINT_MAX);
-    return Value::fromString(object->engine()->newString(QString::number(index))).asReturnedValue();
+    return Encode(object->engine()->newString(QString::number(index)));
 }
diff --git a/src/qml/jsruntime/qv4objectproto.cpp b/src/qml/jsruntime/qv4objectproto.cpp
index bf16073f61..fb47c4a15e 100644
--- a/src/qml/jsruntime/qv4objectproto.cpp
+++ b/src/qml/jsruntime/qv4objectproto.cpp
@@ -412,7 +412,9 @@ ReturnedValue ObjectPrototype::method_toLocaleString(SimpleCallContext *ctx)
 
 ReturnedValue ObjectPrototype::method_valueOf(SimpleCallContext *ctx)
 {
-    return Value::fromObject(ctx->callData->thisObject.toObject(ctx)).asReturnedValue();
+    Scope scope(ctx);
+    ScopedValue v(scope, ctx->callData->thisObject.toObject(ctx));
+    return v.asReturnedValue();
 }
 
 ReturnedValue ObjectPrototype::method_hasOwnProperty(SimpleCallContext *ctx)
@@ -509,7 +511,7 @@ ReturnedValue ObjectPrototype::method_get_proto(SimpleCallContext *ctx)
     if (!o)
         ctx->throwTypeError();
 
-    return Value::fromObject(o->prototype()).asReturnedValue();
+    return o->prototype()->asReturnedValue();
 }
 
 ReturnedValue ObjectPrototype::method_set_proto(SimpleCallContext *ctx)
diff --git a/src/qml/jsruntime/qv4qobjectwrapper.cpp b/src/qml/jsruntime/qv4qobjectwrapper.cpp
index 0f866a1331..6870cd693c 100644
--- a/src/qml/jsruntime/qv4qobjectwrapper.cpp
+++ b/src/qml/jsruntime/qv4qobjectwrapper.cpp
@@ -328,14 +328,14 @@ ReturnedValue QObjectWrapper::getQmlProperty(ExecutionContext *ctx, QQmlContextD
             return QV4::QObjectMethod::create(ctx->engine->rootContext, m_object, result->coreIndex,
                                               qmlcontextobject.asValue()).asReturnedValue();
         } else if (result->isSignalHandler()) {
-            QV4::QmlSignalHandler *handler = new (ctx->engine->memoryManager) QV4::QmlSignalHandler(ctx->engine, m_object, result->coreIndex);
+            QV4::Scoped<QV4::QmlSignalHandler> handler(scope, new (ctx->engine->memoryManager) QV4::QmlSignalHandler(ctx->engine, m_object, result->coreIndex));
 
             QV4::ScopedString connect(scope, ctx->engine->newIdentifier(QStringLiteral("connect")));
             QV4::ScopedString disconnect(scope, ctx->engine->newIdentifier(QStringLiteral("disconnect")));
             handler->put(connect, QV4::ScopedValue(scope, ctx->engine->functionClass->prototype->get(connect)));
             handler->put(disconnect, QV4::ScopedValue(scope, ctx->engine->functionClass->prototype->get(disconnect)));
 
-            return QV4::Value::fromObject(handler).asReturnedValue();
+            return handler.asReturnedValue();
         } else {
             return QV4::QObjectMethod::create(ctx->engine->rootContext, m_object, result->coreIndex).asReturnedValue();
         }
@@ -598,7 +598,7 @@ ReturnedValue QObjectWrapper::create(ExecutionEngine *engine, QQmlData *ddata, Q
         if (ddata->propertyCache) ddata->propertyCache->addref();
     }
 
-    return Value::fromObject(new (engine->memoryManager) QV4::QObjectWrapper(engine, object)).asReturnedValue();
+    return (new (engine->memoryManager) QV4::QObjectWrapper(engine, object))->asReturnedValue();
 }
 
 QV4::ReturnedValue QObjectWrapper::get(Managed *m, const StringRef name, bool *hasProperty)
diff --git a/src/qml/jsruntime/qv4regexpobject.cpp b/src/qml/jsruntime/qv4regexpobject.cpp
index d9e8b2419b..b3dec63d53 100644
--- a/src/qml/jsruntime/qv4regexpobject.cpp
+++ b/src/qml/jsruntime/qv4regexpobject.cpp
@@ -159,7 +159,8 @@ void RegExpObject::init(ExecutionEngine *engine)
         p.replace('/', QLatin1String("\\/"));
     }
 
-    defineReadonlyProperty(QStringLiteral("source"), Value::fromString(engine->newString(p)));
+    ScopedValue v(scope);
+    defineReadonlyProperty(QStringLiteral("source"), (v = engine->newString(p)));
     defineReadonlyProperty(QStringLiteral("global"), Primitive::fromBoolean(global));
     defineReadonlyProperty(QStringLiteral("ignoreCase"), Primitive::fromBoolean(this->value->ignoreCase()));
     defineReadonlyProperty(QStringLiteral("multiline"), Primitive::fromBoolean(this->value->multiLine()));
diff --git a/src/qml/jsruntime/qv4runtime.cpp b/src/qml/jsruntime/qv4runtime.cpp
index d18eeed240..0d7be34e74 100644
--- a/src/qml/jsruntime/qv4runtime.cpp
+++ b/src/qml/jsruntime/qv4runtime.cpp
@@ -549,8 +549,7 @@ Returned<String> *__qmljs_string_from_number(ExecutionContext *ctx, double numbe
 {
     QString qstr;
     __qmljs_numberToString(&qstr, number, 10);
-    String *string = ctx->engine->newString(qstr);
-    return string->asReturned<String>();
+    return ctx->engine->newString(qstr);
 }
 
 Returned<String> *__qmljs_string_concat(ExecutionContext *ctx, String *first, String *second)
@@ -563,7 +562,7 @@ Returned<String> *__qmljs_string_concat(ExecutionContext *ctx, String *first, St
     data += a.length();
     memcpy(data, b.constData(), b.length()*sizeof(QChar));
 
-    return ctx->engine->newString(newStr)->asReturned<String>();
+    return ctx->engine->newString(newStr);
 }
 
 ReturnedValue __qmljs_object_default_value(Object *object, int typeHint)
@@ -622,7 +621,7 @@ Returned<Object> *__qmljs_convert_to_object(ExecutionContext *ctx, const ValueRe
         return ctx->engine->newBooleanObject(value);
     case Value::Managed_Type:
         Q_ASSERT(value->isString());
-        return ctx->engine->newStringObject(*value);
+        return ctx->engine->newStringObject(value);
     case Value::Integer_Type:
     default: // double
         return ctx->engine->newNumberObject(value);
@@ -1096,7 +1095,8 @@ void __qmljs_throw(ExecutionContext *context, const ValueRef value)
 
 ReturnedValue __qmljs_builtin_typeof(ExecutionContext *ctx, const ValueRef value)
 {
-    String *res = 0;
+    Scope scope(ctx);
+    ScopedString res(scope);
     switch (value->type()) {
     case Value::Undefined_Type:
         res = ctx->engine->id_undefined;
@@ -1119,7 +1119,7 @@ ReturnedValue __qmljs_builtin_typeof(ExecutionContext *ctx, const ValueRef value
         res = ctx->engine->id_number;
         break;
     }
-    return Value::fromString(res).asReturnedValue();
+    return res.asReturnedValue();
 }
 
 QV4::ReturnedValue __qmljs_builtin_typeof_name(ExecutionContext *context, const StringRef name)
@@ -1240,8 +1240,7 @@ QV4::ReturnedValue __qmljs_builtin_setup_arguments_object(ExecutionContext *ctx)
 {
     assert(ctx->type >= ExecutionContext::Type_CallContext);
     CallContext *c = static_cast<CallContext *>(ctx);
-    ArgumentsObject *args = new (c->engine->memoryManager) ArgumentsObject(c);
-    return Value::fromObject(args).asReturnedValue();
+    return (new (c->engine->memoryManager) ArgumentsObject(c))->asReturnedValue();
 }
 
 QV4::ReturnedValue __qmljs_increment(const QV4::ValueRef value)
@@ -1309,7 +1308,7 @@ unsigned __qmljs_double_to_uint32(const double &d)
 
 ReturnedValue __qmljs_value_from_string(String *string)
 {
-    return Value::fromString(string).asReturnedValue();
+    return string->asReturnedValue();
 }
 
 ReturnedValue __qmljs_lookup_runtime_regexp(ExecutionContext *ctx, int id)
diff --git a/src/qml/jsruntime/qv4scopedvalue_p.h b/src/qml/jsruntime/qv4scopedvalue_p.h
index 4f250cd03e..775225a83b 100644
--- a/src/qml/jsruntime/qv4scopedvalue_p.h
+++ b/src/qml/jsruntime/qv4scopedvalue_p.h
@@ -555,7 +555,7 @@ struct Encode {
         val = v.val;
     }
     Encode(int i) {
-        val = (quint64(Value::_Integer_Type) << Value::Tag_Shift) | i;
+        val = (quint64(Value::_Integer_Type) << Value::Tag_Shift) | (uint)i;
     }
     Encode(uint i) {
         if (i <= INT_MAX) {
@@ -579,6 +579,8 @@ struct Encode {
         return val;
     }
     quint64 val;
+private:
+    Encode(void *);
 };
 
 inline SafeValue &SafeValue::operator =(const ScopedValue &v)
diff --git a/src/qml/jsruntime/qv4script.cpp b/src/qml/jsruntime/qv4script.cpp
index d358c8948c..432e3b4b47 100644
--- a/src/qml/jsruntime/qv4script.cpp
+++ b/src/qml/jsruntime/qv4script.cpp
@@ -271,7 +271,8 @@ ReturnedValue Script::qmlBinding()
     ExecutionEngine *v4 = scope->engine;
     Scope valueScope(v4);
     ScopedObject qmlObj(valueScope, qml.value());
-    return Value::fromObject(new (v4->memoryManager) QmlBindingWrapper(scope, vmFunction, qmlObj.getPointer())).asReturnedValue();
+    ScopedObject v(valueScope, new (v4->memoryManager) QmlBindingWrapper(scope, vmFunction, qmlObj.getPointer()));
+    return v.asReturnedValue();
 }
 
 QV4::ReturnedValue Script::evaluate(ExecutionEngine *engine,  const QString &script, ObjectRef scopeObject)
diff --git a/src/qml/jsruntime/qv4sequenceobject_p.h b/src/qml/jsruntime/qv4sequenceobject_p.h
index a743bac247..5399d2abc5 100644
--- a/src/qml/jsruntime/qv4sequenceobject_p.h
+++ b/src/qml/jsruntime/qv4sequenceobject_p.h
@@ -71,7 +71,7 @@ struct SequencePrototype : public QV4::Object
 
     static ReturnedValue method_valueOf(QV4::SimpleCallContext *ctx)
     {
-        return QV4::Value::fromString(ctx->callData->thisObject.toString(ctx)).asReturnedValue();
+        return ctx->callData->thisObject.toString(ctx)->asReturnedValue();
     }
 
     static ReturnedValue method_sort(QV4::SimpleCallContext *ctx);
diff --git a/src/qml/jsruntime/qv4serialize.cpp b/src/qml/jsruntime/qv4serialize.cpp
index a8dd865840..86e60e3c76 100644
--- a/src/qml/jsruntime/qv4serialize.cpp
+++ b/src/qml/jsruntime/qv4serialize.cpp
@@ -312,7 +312,7 @@ ReturnedValue Serialize::deserialize(const char *&data, QV8Engine *engine)
         quint32 size = headersize(header);
         QString qstr((QChar *)data, size);
         data += ALIGN(size * sizeof(uint16_t));
-        return QV4::Value::fromString(v4->newString(qstr)).asReturnedValue();
+        return QV4::Encode(v4->newString(qstr));
     }
     case WorkerFunction:
         Q_ASSERT(!"Unreachable");
diff --git a/src/qml/jsruntime/qv4string.cpp b/src/qml/jsruntime/qv4string.cpp
index eadb523532..af573fb471 100644
--- a/src/qml/jsruntime/qv4string.cpp
+++ b/src/qml/jsruntime/qv4string.cpp
@@ -161,7 +161,7 @@ ReturnedValue String::getIndexed(Managed *m, uint index, bool *hasProperty)
     if (index < that->_text.length()) {
         if (hasProperty)
             *hasProperty = true;
-        return Value::fromString(engine->newString(that->toQString().mid(index, 1))).asReturnedValue();
+        return Encode(engine->newString(that->toQString().mid(index, 1)));
     }
     PropertyAttributes attrs;
     Property *pd = engine->stringClass->prototype->__getPropertyDescriptor__(index, &attrs);
@@ -178,16 +178,16 @@ ReturnedValue String::getIndexed(Managed *m, uint index, bool *hasProperty)
 void String::put(Managed *m, const StringRef name, const ValueRef value)
 {
     Scope scope(m->engine());
-    String *that = static_cast<String *>(m);
-    Scoped<Object> o(scope, that->engine()->newStringObject(Value::fromString(that)));
+    ScopedString that(scope, static_cast<String *>(m));
+    Scoped<Object> o(scope, that->engine()->newStringObject(that));
     o->put(name, value);
 }
 
 void String::putIndexed(Managed *m, uint index, const ValueRef value)
 {
     Scope scope(m->engine());
-    String *that = static_cast<String *>(m);
-    Scoped<Object> o(scope, that->engine()->newStringObject(Value::fromString(that)));
+    ScopedString that(scope, static_cast<String *>(m));
+    Scoped<Object> o(scope, that->engine()->newStringObject(that));
     o->putIndexed(index, value);
 }
 
diff --git a/src/qml/jsruntime/qv4stringobject.cpp b/src/qml/jsruntime/qv4stringobject.cpp
index 402798f5ba..af6e92105f 100644
--- a/src/qml/jsruntime/qv4stringobject.cpp
+++ b/src/qml/jsruntime/qv4stringobject.cpp
@@ -88,11 +88,12 @@ StringObject::StringObject(InternalClass *ic)
     defineReadonlyProperty(ic->engine->id_length, Primitive::fromInt32(0));
 }
 
-StringObject::StringObject(ExecutionEngine *engine, const Value &value)
-    : Object(engine->stringClass), value(value)
+StringObject::StringObject(ExecutionEngine *engine, const ValueRef val)
+    : Object(engine->stringClass)
 {
     vtbl = &static_vtbl;
     type = Type_StringObject;
+    value = *val;
 
     tmpProperty.value = Primitive::undefinedValue();
 
@@ -105,7 +106,7 @@ Property *StringObject::getIndex(uint index) const
     QString str = value.stringValue()->toQString();
     if (index >= (uint)str.length())
         return 0;
-    tmpProperty.value = Value::fromString(internalClass->engine->newString(str.mid(index, 1)));
+    tmpProperty.value = Encode(internalClass->engine->newString(str.mid(index, 1)));
     return &tmpProperty;
 }
 
@@ -168,7 +169,7 @@ ReturnedValue StringCtor::construct(Managed *m, CallData *callData)
     Scope scope(v4);
     ScopedValue value(scope);
     if (callData->argc)
-        value = Value::fromString(callData->args[0].toString(v4->current));
+        value = callData->args[0].toString(v4->current);
     else
         value = Value::fromString(v4->current, QString());
     return Encode(v4->newStringObject(value));
@@ -180,7 +181,7 @@ ReturnedValue StringCtor::call(Managed *m, CallData *callData)
     Scope scope(v4);
     ScopedValue value(scope);
     if (callData->argc)
-        value = Value::fromString(callData->args[0].toString(v4->current));
+        value = callData->args[0].toString(v4->current);
     else
         value = Value::fromString(v4->current, QString());
     return value.asReturnedValue();
diff --git a/src/qml/jsruntime/qv4stringobject_p.h b/src/qml/jsruntime/qv4stringobject_p.h
index 0932379843..2e1e461ecc 100644
--- a/src/qml/jsruntime/qv4stringobject_p.h
+++ b/src/qml/jsruntime/qv4stringobject_p.h
@@ -54,7 +54,7 @@ struct StringObject: Object {
 
     Value value;
     mutable Property tmpProperty;
-    StringObject(ExecutionEngine *engine, const Value &value);
+    StringObject(ExecutionEngine *engine, const ValueRef value);
 
     Property *getIndex(uint index) const;
 
diff --git a/src/qml/jsruntime/qv4value.cpp b/src/qml/jsruntime/qv4value.cpp
index b256b04da0..66e80cfa01 100644
--- a/src/qml/jsruntime/qv4value.cpp
+++ b/src/qml/jsruntime/qv4value.cpp
@@ -204,12 +204,12 @@ bool Value::sameValue(Value other) const {
 
 Value Value::fromString(ExecutionContext *ctx, const QString &s)
 {
-    return fromString(ctx->engine->newString(s));
+    return fromManaged(ctx->engine->newString(s)->getPointer());
 }
 
 Value Value::fromString(ExecutionEngine *engine, const QString &s)
 {
-    return fromString(engine->newString(s));
+    return fromManaged(engine->newString(s)->getPointer());
 }
 
 
diff --git a/src/qml/jsruntime/qv4value_def_p.h b/src/qml/jsruntime/qv4value_def_p.h
index 2f2a754864..b10a412555 100644
--- a/src/qml/jsruntime/qv4value_def_p.h
+++ b/src/qml/jsruntime/qv4value_def_p.h
@@ -274,7 +274,6 @@ struct Q_QML_EXPORT Value
     }
 
     static Value emptyValue();
-    static Value fromString(String *s);
     static Value fromObject(Object *o);
     static Value fromManaged(Managed *o);
 
diff --git a/src/qml/jsruntime/qv4value_p.h b/src/qml/jsruntime/qv4value_p.h
index 7934682a03..7ad4e94044 100644
--- a/src/qml/jsruntime/qv4value_p.h
+++ b/src/qml/jsruntime/qv4value_p.h
@@ -165,18 +165,6 @@ inline Primitive Primitive::fromUInt32(uint i)
     return v;
 }
 
-inline Value Value::fromString(String *s)
-{
-    Value v;
-#if QT_POINTER_SIZE == 8
-    v.s = s;
-#else
-    v.tag = Managed_Type;
-    v.s = s;
-#endif
-    return v;
-}
-
 inline Value Value::fromObject(Object *o)
 {
     Value v;
diff --git a/src/qml/jsruntime/qv4variantobject.cpp b/src/qml/jsruntime/qv4variantobject.cpp
index 720e4fa3a6..2fe9c717bd 100644
--- a/src/qml/jsruntime/qv4variantobject.cpp
+++ b/src/qml/jsruntime/qv4variantobject.cpp
@@ -183,7 +183,7 @@ QV4::ReturnedValue VariantPrototype::method_toString(SimpleCallContext *ctx)
     QString result = o->data.toString();
     if (result.isEmpty() && !o->data.canConvert(QVariant::String))
         result = QString::fromLatin1("QVariant(%0)").arg(QString::fromLatin1(o->data.typeName()));
-    return Value::fromString(ctx->engine->newString(result)).asReturnedValue();
+    return Encode(ctx->engine->newString(result));
 }
 
 QV4::ReturnedValue VariantPrototype::method_valueOf(SimpleCallContext *ctx)
@@ -196,7 +196,7 @@ QV4::ReturnedValue VariantPrototype::method_valueOf(SimpleCallContext *ctx)
         case QVariant::Invalid:
             return Encode::undefined();
         case QVariant::String:
-            return Value::fromString(ctx->engine->newString(v.toString())).asReturnedValue();
+            return Encode(ctx->engine->newString(v.toString()));
         case QVariant::Int:
             return Encode(v.toInt());
         case QVariant::Double:
diff --git a/src/qml/jsruntime/qv4vme_moth.cpp b/src/qml/jsruntime/qv4vme_moth.cpp
index ccde91c86a..d388622f86 100644
--- a/src/qml/jsruntime/qv4vme_moth.cpp
+++ b/src/qml/jsruntime/qv4vme_moth.cpp
@@ -269,7 +269,7 @@ QV4::ReturnedValue VME::run(QV4::ExecutionContext *context, const uchar *&code,
 
     MOTH_BEGIN_INSTR(LoadRuntimeString)
 //        TRACE(value, "%s", instr.value.toString(context)->toQString().toUtf8().constData());
-        VALUE(instr.result) = QV4::Value::fromString(runtimeStrings[instr.stringId]);
+        VALUE(instr.result) = runtimeStrings[instr.stringId].asReturnedValue();
     MOTH_END_INSTR(LoadRuntimeString)
 
     MOTH_BEGIN_INSTR(LoadRegExp)
diff --git a/src/qml/qml/qqmlcontextwrapper.cpp b/src/qml/qml/qqmlcontextwrapper.cpp
index b7bb91f279..15974b07fa 100644
--- a/src/qml/qml/qqmlcontextwrapper.cpp
+++ b/src/qml/qml/qqmlcontextwrapper.cpp
@@ -76,23 +76,25 @@ QmlContextWrapper::~QmlContextWrapper()
 ReturnedValue QmlContextWrapper::qmlScope(QV8Engine *v8, QQmlContextData *ctxt, QObject *scope)
 {
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope valueScope(v4);
 
-    QmlContextWrapper *w = new (v4->memoryManager) QmlContextWrapper(v8, ctxt, scope);
-    return Value::fromObject(w).asReturnedValue();
+    Scoped<QmlContextWrapper> w(valueScope, new (v4->memoryManager) QmlContextWrapper(v8, ctxt, scope));
+    return w.asReturnedValue();
 }
 
 ReturnedValue QmlContextWrapper::urlScope(QV8Engine *v8, const QUrl &url)
 {
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope scope(v4);
 
     QQmlContextData *context = new QQmlContextData;
     context->url = url;
     context->isInternal = true;
     context->isJSContext = true;
 
-    QmlContextWrapper *w = new (v4->memoryManager) QmlContextWrapper(v8, context, 0);
+    Scoped<QmlContextWrapper> w(scope, new (v4->memoryManager) QmlContextWrapper(v8, context, 0));
     w->isNullWrapper = true;
-    return Value::fromObject(w).asReturnedValue();
+    return w.asReturnedValue();
 }
 
 QQmlContextData *QmlContextWrapper::callingContext(ExecutionEngine *v4)
diff --git a/src/qml/qml/qqmllistwrapper.cpp b/src/qml/qml/qqmllistwrapper.cpp
index 5f4e92fa4e..3746d58d77 100644
--- a/src/qml/qml/qqmllistwrapper.cpp
+++ b/src/qml/qml/qqmllistwrapper.cpp
@@ -69,24 +69,26 @@ ReturnedValue QmlListWrapper::create(QV8Engine *v8, QObject *object, int propId,
         return Encode::null();
 
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope scope(v4);
 
-    QmlListWrapper *r = new (v4->memoryManager) QmlListWrapper(v8);
+    Scoped<QmlListWrapper> r(scope, new (v4->memoryManager) QmlListWrapper(v8));
     r->object = object;
     r->propertyType = propType;
     void *args[] = { &r->property, 0 };
     QMetaObject::metacall(object, QMetaObject::ReadProperty, propId, args);
-    return Value::fromObject(r).asReturnedValue();
+    return r.asReturnedValue();
 }
 
 ReturnedValue QmlListWrapper::create(QV8Engine *v8, const QQmlListProperty<QObject> &prop, int propType)
 {
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope scope(v4);
 
-    QmlListWrapper *r = new (v4->memoryManager) QmlListWrapper(v8);
+    Scoped<QmlListWrapper> r(scope, new (v4->memoryManager) QmlListWrapper(v8));
     r->object = prop.object;
     r->property = prop;
     r->propertyType = propType;
-    return Value::fromObject(r).asReturnedValue();
+    return r.asReturnedValue();
 }
 
 QVariant QmlListWrapper::toVariant() const
diff --git a/src/qml/qml/qqmltypewrapper.cpp b/src/qml/qml/qqmltypewrapper.cpp
index 62f757f8c0..de2386daf1 100644
--- a/src/qml/qml/qqmltypewrapper.cpp
+++ b/src/qml/qml/qqmltypewrapper.cpp
@@ -91,10 +91,11 @@ ReturnedValue QmlTypeWrapper::create(QV8Engine *v8, QObject *o, QQmlType *t, Typ
 {
     Q_ASSERT(t);
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope scope(v4);
 
-    QmlTypeWrapper *w = new (v4->memoryManager) QmlTypeWrapper(v8);
+    Scoped<QmlTypeWrapper> w(scope, new (v4->memoryManager) QmlTypeWrapper(v8));
     w->mode = mode; w->object = o; w->type = t;
-    return Value::fromObject(w).asReturnedValue();
+    return w.asReturnedValue();
 }
 
 // Returns a type wrapper for importNamespace (of t) on o.  This allows nested resolution of a type in a
@@ -104,11 +105,12 @@ ReturnedValue QmlTypeWrapper::create(QV8Engine *v8, QObject *o, QQmlTypeNameCach
     Q_ASSERT(t);
     Q_ASSERT(importNamespace);
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope scope(v4);
 
-    QmlTypeWrapper *w = new (v4->memoryManager) QmlTypeWrapper(v8);
+    Scoped<QmlTypeWrapper> w(scope, new (v4->memoryManager) QmlTypeWrapper(v8));
     w->mode = mode; w->object = o; w->typeNamespace = t; w->importNamespace = importNamespace;
     t->addref();
-    return Value::fromObject(w).asReturnedValue();
+    return w.asReturnedValue();
 }
 
 
@@ -117,7 +119,7 @@ ReturnedValue QmlTypeWrapper::get(Managed *m, const StringRef name, bool *hasPro
     QV4::ExecutionEngine *v4 = m->engine();
     QV4::Scope scope(v4);
 
-    QmlTypeWrapper *w = m->as<QmlTypeWrapper>();
+    Scoped<QmlTypeWrapper> w(scope,  m->as<QmlTypeWrapper>());
     if (!w)
         v4->current->throwTypeError();
 
diff --git a/src/qml/qml/qqmlvaluetypewrapper.cpp b/src/qml/qml/qqmlvaluetypewrapper.cpp
index 5eb0e6bc6e..656e9dfe3a 100644
--- a/src/qml/qml/qqmlvaluetypewrapper.cpp
+++ b/src/qml/qml/qqmlvaluetypewrapper.cpp
@@ -143,23 +143,25 @@ void QmlValueTypeWrapper::initProto(ExecutionEngine *v4)
 ReturnedValue QmlValueTypeWrapper::create(QV8Engine *v8, QObject *object, int property, QQmlValueType *type)
 {
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope scope(v4);
     initProto(v4);
 
-    QmlValueTypeReference *r = new (v4->memoryManager) QmlValueTypeReference(v8);
+    Scoped<QmlValueTypeReference> r(scope, new (v4->memoryManager) QmlValueTypeReference(v8));
     r->setPrototype(v4->qmlExtensions()->valueTypeWrapperPrototype);
     r->type = type; r->object = object; r->property = property;
-    return Value::fromObject(r).asReturnedValue();
+    return r.asReturnedValue();
 }
 
 ReturnedValue QmlValueTypeWrapper::create(QV8Engine *v8, const QVariant &value, QQmlValueType *type)
 {
     ExecutionEngine *v4 = QV8Engine::getV4(v8);
+    Scope scope(v4);
     initProto(v4);
 
-    QmlValueTypeCopy *r = new (v4->memoryManager) QmlValueTypeCopy(v8);
+    Scoped<QmlValueTypeCopy> r(scope, new (v4->memoryManager) QmlValueTypeCopy(v8));
     r->setPrototype(v4->qmlExtensions()->valueTypeWrapperPrototype);
     r->type = type; r->value = value;
-    return Value::fromObject(r).asReturnedValue();
+    return r.asReturnedValue();
 }
 
 QVariant QmlValueTypeWrapper::toVariant() const
diff --git a/src/qml/qml/qqmlxmlhttprequest.cpp b/src/qml/qml/qqmlxmlhttprequest.cpp
index 39ba13a653..01a373b9ee 100644
--- a/src/qml/qml/qqmlxmlhttprequest.cpp
+++ b/src/qml/qml/qqmlxmlhttprequest.cpp
@@ -435,7 +435,7 @@ ReturnedValue NodePrototype::method_get_nodeName(SimpleCallContext *ctx)
         name = r->d->name;
         break;
     }
-    return Value::fromString(ctx->engine->newString(name)).asReturnedValue();
+    return Encode(ctx->engine->newString(name));
 }
 
 ReturnedValue NodePrototype::method_get_nodeValue(SimpleCallContext *ctx)
@@ -454,7 +454,7 @@ ReturnedValue NodePrototype::method_get_nodeValue(SimpleCallContext *ctx)
         r->d->type == NodeImpl::Notation)
         return Encode::null();
 
-    return Value::fromString(ctx->engine->newString(r->d->data)).asReturnedValue();
+    return Encode(ctx->engine->newString(r->d->data));
 }
 
 ReturnedValue NodePrototype::method_get_nodeType(SimpleCallContext *ctx)
@@ -792,6 +792,7 @@ ReturnedValue Document::load(QV8Engine *engine, const QByteArray &data)
 {
     Q_ASSERT(engine);
     ExecutionEngine *v4 = QV8Engine::getV4(engine);
+    Scope scope(v4);
 
     DocumentImpl *document = 0;
     QStack<NodeImpl *> nodeStack;
@@ -871,9 +872,9 @@ ReturnedValue Document::load(QV8Engine *engine, const QByteArray &data)
         return Encode::null();
     }
 
-    Object *instance = new (v4->memoryManager) Node(v4, document);
+    ScopedObject instance(scope, new (v4->memoryManager) Node(v4, document));
     instance->setPrototype(Document::prototype(v4).asObject());
-    return Value::fromObject(instance).asReturnedValue();
+    return instance.asReturnedValue();
 }
 
 Node::Node(const Node &o)
@@ -1635,15 +1636,16 @@ struct QQmlXMLHttpRequestCtor : public FunctionObject
     }
     static ReturnedValue construct(Managed *that, QV4::CallData *)
     {
-        QQmlXMLHttpRequestCtor *ctor = that->as<QQmlXMLHttpRequestCtor>();
+        Scope scope(that->engine());
+        Scoped<QQmlXMLHttpRequestCtor> ctor(scope, that->as<QQmlXMLHttpRequestCtor>());
         if (!ctor)
             that->engine()->current->throwTypeError();
 
         QV8Engine *engine = that->engine()->v8Engine;
         QQmlXMLHttpRequest *r = new QQmlXMLHttpRequest(engine, engine->networkAccessManager());
-        QQmlXMLHttpRequestWrapper *w = new (that->engine()->memoryManager) QQmlXMLHttpRequestWrapper(that->engine(), r);
+        Scoped<QQmlXMLHttpRequestWrapper> w(scope, new (that->engine()->memoryManager) QQmlXMLHttpRequestWrapper(that->engine(), r));
         w->setPrototype(ctor->proto);
-        return Value::fromObject(w).asReturnedValue();
+        return w.asReturnedValue();
     }
 
     static ReturnedValue call(Managed *, QV4::CallData *) {
diff --git a/src/qml/qml/v8/qqmlbuiltinfunctions.cpp b/src/qml/qml/v8/qqmlbuiltinfunctions.cpp
index 9240834cf4..121b0fbb78 100644
--- a/src/qml/qml/v8/qqmlbuiltinfunctions.cpp
+++ b/src/qml/qml/v8/qqmlbuiltinfunctions.cpp
@@ -957,12 +957,13 @@ ReturnedValue QtObject::method_createQmlObject(SimpleCallContext *ctx)
                 qmlerror = v4->newObject();
                 qmlerror->put((s = v4->newString("lineNumber")), (v = QV4::Primitive::fromInt32(error.line())));
                 qmlerror->put((s = v4->newString("columnNumber")), (v = QV4::Primitive::fromInt32(error.column())));
-                qmlerror->put((s = v4->newString("fileName")), (v = Value::fromString(v4->newString(error.url().toString()))));
-                qmlerror->put((s = v4->newString("message")), (v = Value::fromString(v4->newString(error.description()))));
+                qmlerror->put((s = v4->newString("fileName")), (v = v4->newString(error.url().toString())));
+                qmlerror->put((s = v4->newString("message")), (v = v4->newString(error.description())));
                 qmlerrors->putIndexed(ii, qmlerror);
             }
 
-            Scoped<Object> errorObject(scope, v4->newErrorObject(Value::fromString(v4->newString(errorstr))));
+            v = v4->newString(errorstr);
+            Scoped<Object> errorObject(scope, v4->newErrorObject(v));
             errorObject->put((s = v4->newString("qmlErrors")), qmlerrors);
             return errorObject.asReturnedValue();
         }
@@ -1254,7 +1255,7 @@ ReturnedValue QtObject::method_binding(SimpleCallContext *ctx)
     if (!f)
         V4THROW_TYPE("binding(): argument (binding expression) must be a function");
 
-    return QV4::Value::fromObject(new (ctx->engine->memoryManager) BindingFunction(f)).asReturnedValue();
+    return (new (ctx->engine->memoryManager) BindingFunction(f))->asReturnedValue();
 }
 
 
diff --git a/src/qml/qml/v8/qv8engine.cpp b/src/qml/qml/v8/qv8engine.cpp
index c6bce579a2..97cfb50212 100644
--- a/src/qml/qml/v8/qv8engine.cpp
+++ b/src/qml/qml/v8/qv8engine.cpp
@@ -190,7 +190,7 @@ static QV4::ReturnedValue arrayFromStringList(QV8Engine *engine, const QStringLi
     int len = list.count();
     a->arrayReserve(len);
     for (int ii = 0; ii < len; ++ii) {
-        a->arrayData[ii].value = QV4::Value::fromString(e->newString(list.at(ii)));
+        a->arrayData[ii].value = QV4::Encode(e->newString(list.at(ii)));
         a->arrayDataLen = ii + 1;
     }
     a->setArrayLengthUnchecked(len);
@@ -1013,7 +1013,7 @@ int QV8Engine::consoleCountHelper(const QString &file, quint16 line, quint16 col
 
 QV4::ReturnedValue QV8Engine::toString(const QString &string)
 {
-    return QV4::Value::fromString(m_v4Engine->newString(string)).asReturnedValue();
+    return QV4::Encode(m_v4Engine->newString(string));
 }
 
 QT_END_NAMESPACE
diff --git a/src/quick/items/context2d/qquickcontext2d.cpp b/src/quick/items/context2d/qquickcontext2d.cpp
index 263ee67398..7be8d0927a 100644
--- a/src/quick/items/context2d/qquickcontext2d.cpp
+++ b/src/quick/items/context2d/qquickcontext2d.cpp
@@ -1299,7 +1299,7 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_globalCompositeOperation(QV4::S
     QV4::Scoped<QQuickJSContext2D> r(scope, ctx->callData->thisObject.as<QQuickJSContext2D>());
     CHECK_CONTEXT(r)
 
-    return QV4::Value::fromString(ctx->engine->newString(qt_composite_mode_to_string(r->context->state.globalCompositeOperation))).asReturnedValue();
+    return QV4::Encode(ctx->engine->newString(qt_composite_mode_to_string(r->context->state.globalCompositeOperation)));
 }
 
 QV4::ReturnedValue QQuickJSContext2D::method_set_globalCompositeOperation(QV4::SimpleCallContext *ctx)
@@ -1357,14 +1357,14 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_fillStyle(QV4::SimpleCallContex
     QColor color = r->context->state.fillStyle.color();
     if (color.isValid()) {
         if (color.alpha() == 255)
-            return QV4::Value::fromString(ctx->engine->newString(color.name())).asReturnedValue();
+            return QV4::Encode(ctx->engine->newString(color.name()));
         QString alphaString = QString::number(color.alphaF(), 'f');
         while (alphaString.endsWith(QLatin1Char('0')))
             alphaString.chop(1);
         if (alphaString.endsWith(QLatin1Char('.')))
             alphaString += QLatin1Char('0');
         QString str = QString::fromLatin1("rgba(%1, %2, %3, %4)").arg(color.red()).arg(color.green()).arg(color.blue()).arg(alphaString);
-        return QV4::Value::fromString(ctx->engine->newString(str)).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(str));
     }
     return r->context->m_fillStyle.value();
 }
@@ -1472,14 +1472,14 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_strokeStyle(QV4::SimpleCallCont
     QColor color = r->context->state.strokeStyle.color();
     if (color.isValid()) {
         if (color.alpha() == 255)
-            return QV4::Value::fromString(ctx->engine->newString(color.name())).asReturnedValue();
+            return QV4::Encode(ctx->engine->newString(color.name()));
         QString alphaString = QString::number(color.alphaF(), 'f');
         while (alphaString.endsWith(QLatin1Char('0')))
             alphaString.chop(1);
         if (alphaString.endsWith(QLatin1Char('.')))
             alphaString += QLatin1Char('0');
         QString str = QString::fromLatin1("rgba(%1, %2, %3, %4)").arg(color.red()).arg(color.green()).arg(color.blue()).arg(alphaString);
-        return QV4::Value::fromString(ctx->engine->newString(str)).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(str));
     }
     return r->context->m_strokeStyle.value();
 }
@@ -1798,14 +1798,14 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_lineCap(QV4::SimpleCallContext
 
     switch (r->context->state.lineCap) {
     case Qt::RoundCap:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("round"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("round")));
     case Qt::SquareCap:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("square"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("square")));
     case Qt::FlatCap:
     default:
         break;
     }
-    return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("butt"))).asReturnedValue();
+    return QV4::Encode(ctx->engine->newString(QStringLiteral("butt")));
 }
 
 QV4::ReturnedValue QQuickJSContext2D::method_set_lineCap(QV4::SimpleCallContext *ctx)
@@ -1856,14 +1856,14 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_lineJoin(QV4::SimpleCallContext
 
     switch (r->context->state.lineJoin) {
     case Qt::RoundJoin:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("round"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("round")));
     case Qt::BevelJoin:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("bevel"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("bevel")));
     case Qt::MiterJoin:
     default:
         break;
     }
-    return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("miter"))).asReturnedValue();
+    return QV4::Encode(ctx->engine->newString(QStringLiteral("miter")));
 }
 
 QV4::ReturnedValue QQuickJSContext2D::method_set_lineJoin(QV4::SimpleCallContext *ctx)
@@ -1997,7 +1997,7 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_shadowColor(QV4::SimpleCallCont
     QV4::Scoped<QQuickJSContext2D> r(scope, ctx->callData->thisObject);
     CHECK_CONTEXT(r)
 
-    return QV4::Value::fromString(ctx->engine->newString(r->context->state.shadowColor.name())).asReturnedValue();
+    return QV4::Encode(ctx->engine->newString(r->context->state.shadowColor.name()));
 }
 
 QV4::ReturnedValue QQuickJSContext2D::method_set_shadowColor(QV4::SimpleCallContext *ctx)
@@ -2649,7 +2649,7 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_font(QV4::SimpleCallContext *ct
     QV4::Scoped<QQuickJSContext2D> r(scope, ctx->callData->thisObject);
     CHECK_CONTEXT(r)
 
-    return QV4::Value::fromString(ctx->engine->newString(r->context->state.font.toString())).asReturnedValue();
+    return QV4::Encode(ctx->engine->newString(r->context->state.font.toString()));
 }
 
 QV4::ReturnedValue QQuickJSContext2D::method_set_font(QV4::SimpleCallContext *ctx)
@@ -2688,18 +2688,18 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_textAlign(QV4::SimpleCallContex
 
     switch (r->context->state.textAlign) {
     case QQuickContext2D::End:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("end"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("end")));
     case QQuickContext2D::Left:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("left"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("left")));
     case QQuickContext2D::Right:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("right"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("right")));
     case QQuickContext2D::Center:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("center"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("center")));
     case QQuickContext2D::Start:
     default:
         break;
     }
-    return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("start"))).asReturnedValue();
+    return QV4::Encode(ctx->engine->newString(QStringLiteral("start")));
 }
 
 QV4::ReturnedValue QQuickJSContext2D::method_set_textAlign(QV4::SimpleCallContext *ctx)
@@ -2754,18 +2754,18 @@ QV4::ReturnedValue QQuickJSContext2D::method_get_textBaseline(QV4::SimpleCallCon
 
     switch (r->context->state.textBaseline) {
     case QQuickContext2D::Hanging:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("hanging"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("hanging")));
     case QQuickContext2D::Top:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("top"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("top")));
     case QQuickContext2D::Bottom:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("bottom"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("bottom")));
     case QQuickContext2D::Middle:
-        return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("middle"))).asReturnedValue();
+        return QV4::Encode(ctx->engine->newString(QStringLiteral("middle")));
     case QQuickContext2D::Alphabetic:
     default:
         break;
     }
-    return QV4::Value::fromString(ctx->engine->newString(QStringLiteral("alphabetic"))).asReturnedValue();
+    return QV4::Encode(ctx->engine->newString(QStringLiteral("alphabetic")));
 }
 
 QV4::ReturnedValue QQuickJSContext2D::method_set_textBaseline(QV4::SimpleCallContext *ctx)