diff --git a/js/src/gc/GC.h b/js/src/gc/GC.h
index 84faea8cb02b..21ccc121d272 100644
--- a/js/src/gc/GC.h
+++ b/js/src/gc/GC.h
@@ -77,8 +77,8 @@ typedef void (*IterateZoneCallback)(JSRuntime* rt, void* data, JS::Zone* zone);
 typedef void (*IterateArenaCallback)(JSRuntime* rt, void* data,
                                      gc::Arena* arena, JS::TraceKind traceKind,
                                      size_t thingSize);
-typedef void (*IterateCellCallback)(JSRuntime* rt, void* data, void* thing,
-                                    JS::TraceKind traceKind, size_t thingSize);
+typedef void (*IterateCellCallback)(JSRuntime* rt, void* data,
+                                    JS::GCCellPtr cellptr, size_t thingSize);
 
 /*
  * This function calls |zoneCallback| on every zone, |realmCallback| on
diff --git a/js/src/gc/PublicIterators.cpp b/js/src/gc/PublicIterators.cpp
index 073cbe6f2fed..7b2c86c221a6 100644
--- a/js/src/gc/PublicIterators.cpp
+++ b/js/src/gc/PublicIterators.cpp
@@ -38,8 +38,8 @@ static void IterateRealmsArenasCellsUnbarriered(
       Arena* arena = aiter.get();
       (*arenaCallback)(cx->runtime(), data, arena, traceKind, thingSize);
       for (ArenaCellIter iter(arena); !iter.done(); iter.next()) {
-        (*cellCallback)(cx->runtime(), data, iter.getCell(), traceKind,
-                        thingSize);
+        (*cellCallback)(cx->runtime(), data,
+                        JS::GCCellPtr(iter.getCell(), traceKind), thingSize);
       }
     }
   }
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index cf96a0ac35aa..dddd019cc2c2 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -1074,23 +1074,23 @@ static void DumpHeapVisitArena(JSRuntime* rt, void* data, gc::Arena* arena,
           unsigned(arena->getAllocKind()), unsigned(thingSize));
 }
 
-static void DumpHeapVisitCell(JSRuntime* rt, void* data, void* thing,
-                              JS::TraceKind traceKind, size_t thingSize) {
+static void DumpHeapVisitCell(JSRuntime* rt, void* data, JS::GCCellPtr cellptr,
+                              size_t thingSize) {
   DumpHeapTracer* dtrc = static_cast<DumpHeapTracer*>(data);
   char cellDesc[1024 * 32];
-  JS_GetTraceThingInfo(cellDesc, sizeof(cellDesc), dtrc, thing, traceKind,
-                       true);
+  JS_GetTraceThingInfo(cellDesc, sizeof(cellDesc), dtrc, cellptr.asCell(),
+                       cellptr.kind(), true);
 
-  fprintf(dtrc->output, "%p %c %s", thing, MarkDescriptor(thing), cellDesc);
+  fprintf(dtrc->output, "%p %c %s", cellptr.asCell(),
+          MarkDescriptor(cellptr.asCell()), cellDesc);
   if (dtrc->mallocSizeOf) {
-    auto size =
-        JS::ubi::Node(JS::GCCellPtr(thing, traceKind)).size(dtrc->mallocSizeOf);
+    auto size = JS::ubi::Node(cellptr).size(dtrc->mallocSizeOf);
     fprintf(dtrc->output, " SIZE:: %" PRIu64 "\n", size);
   } else {
     fprintf(dtrc->output, "\n");
   }
 
-  js::TraceChildren(dtrc, thing, traceKind);
+  js::TraceChildren(dtrc, cellptr.asCell(), cellptr.kind());
 }
 
 bool DumpHeapTracer::onChild(const JS::GCCellPtr& thing) {
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index d7690046e5e6..c523c5e5273f 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -332,14 +332,14 @@ static void CollectScriptSourceStats(StatsClosure* closure, ScriptSource* ss) {
 // doing coarse-grained measurements. Skipping them more than doubles the
 // profile speed for complex pages such as gmail.com.
 template <Granularity granularity>
-static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
-                              JS::TraceKind traceKind, size_t thingSize) {
+static void StatsCellCallback(JSRuntime* rt, void* data, JS::GCCellPtr cellptr,
+                              size_t thingSize) {
   StatsClosure* closure = static_cast<StatsClosure*>(data);
   RuntimeStats* rtStats = closure->rtStats;
   ZoneStats* zStats = rtStats->currZoneStats;
-  switch (traceKind) {
+  switch (cellptr.kind()) {
     case JS::TraceKind::Object: {
-      JSObject* obj = static_cast<JSObject*>(thing);
+      JSObject* obj = &cellptr.as<JSObject>();
       RealmStats& realmStats = obj->maybeCCWRealm()->realmStats();
       JS::ClassInfo info;  // This zeroes all the sizes.
       info.objectsGCHeap += thingSize;
@@ -384,7 +384,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
     }
 
     case JS::TraceKind::Script: {
-      JSScript* script = static_cast<JSScript*>(thing);
+      JSScript* script = &cellptr.as<JSScript>();
       RealmStats& realmStats = script->realm()->realmStats();
       realmStats.scriptsGCHeap += thingSize;
       realmStats.scriptsMallocHeapData +=
@@ -399,7 +399,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
     }
 
     case JS::TraceKind::String: {
-      JSString* str = static_cast<JSString*>(thing);
+      JSString* str = &cellptr.as<JSString>();
       size_t size = thingSize;
       if (!str->isTenured()) {
         size += Nursery::stringHeaderSize();
@@ -441,7 +441,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
       break;
 
     case JS::TraceKind::BigInt: {
-      JS::BigInt* bi = static_cast<BigInt*>(thing);
+      JS::BigInt* bi = &cellptr.as<BigInt>();
       zStats->bigIntsGCHeap += thingSize;
       zStats->bigIntsMallocHeap +=
           bi->sizeOfExcludingThis(rtStats->mallocSizeOf_);
@@ -464,7 +464,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
     }
 
     case JS::TraceKind::LazyScript: {
-      LazyScript* lazy = static_cast<LazyScript*>(thing);
+      LazyScript* lazy = &cellptr.as<LazyScript>();
       zStats->lazyScriptsGCHeap += thingSize;
       zStats->lazyScriptsMallocHeap +=
           lazy->sizeOfExcludingThis(rtStats->mallocSizeOf_);
@@ -472,7 +472,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
     }
 
     case JS::TraceKind::Shape: {
-      Shape* shape = static_cast<Shape*>(thing);
+      Shape* shape = &cellptr.as<Shape>();
 
       JS::ShapeInfo info;  // This zeroes all the sizes.
       if (shape->inDictionary()) {
@@ -486,7 +486,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
     }
 
     case JS::TraceKind::ObjectGroup: {
-      ObjectGroup* group = static_cast<ObjectGroup*>(thing);
+      ObjectGroup* group = &cellptr.as<ObjectGroup>();
       zStats->objectGroupsGCHeap += thingSize;
       zStats->objectGroupsMallocHeap +=
           group->sizeOfExcludingThis(rtStats->mallocSizeOf_);
@@ -494,7 +494,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
     }
 
     case JS::TraceKind::Scope: {
-      Scope* scope = static_cast<Scope*>(thing);
+      Scope* scope = &cellptr.as<Scope>();
       zStats->scopesGCHeap += thingSize;
       zStats->scopesMallocHeap +=
           scope->sizeOfExcludingThis(rtStats->mallocSizeOf_);
@@ -502,7 +502,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
     }
 
     case JS::TraceKind::RegExpShared: {
-      auto regexp = static_cast<RegExpShared*>(thing);
+      auto regexp = &cellptr.as<RegExpShared>();
       zStats->regExpSharedsGCHeap += thingSize;
       zStats->regExpSharedsMallocHeap +=
           regexp->sizeOfExcludingThis(rtStats->mallocSizeOf_);
@@ -514,7 +514,7 @@ static void StatsCellCallback(JSRuntime* rt, void* data, void* thing,
   }
 
   // Yes, this is a subtraction:  see StatsArenaCallback() for details.
-  zStats->unusedGCThings.addToKind(traceKind, -thingSize);
+  zStats->unusedGCThings.addToKind(cellptr.kind(), -thingSize);
 }
 
 void ZoneStats::initStrings() {