diff --git a/source/simulation2/serialization/BinarySerializer.cpp b/source/simulation2/serialization/BinarySerializer.cpp
index 2f8616d13c..467b991bba 100644
--- a/source/simulation2/serialization/BinarySerializer.cpp
+++ b/source/simulation2/serialization/BinarySerializer.cpp
@@ -232,28 +232,28 @@ void CBinarySerializerScriptImpl::HandleScriptVal(JS::HandleValue val)
 			}
 			else if (protokey == JSProto_Map)
 			{
-				// TODO: There's no C++ API (yet) to work with maps. This code relies on the internal 
-				// structure of the Iterator object returned by Map.entries(). This is not ideal
-				// because the structure could change in the future (and actually does change with v31).
-				// Change this code if SpiderMonkey gets such an API.
-				u32 mapSize;
-				m_ScriptInterface.GetProperty(val, "size", mapSize);
-				
 				m_Serializer.NumberU8_Unbounded("type", SCRIPT_TYPE_OBJECT_MAP);
-				m_Serializer.NumberU32_Unbounded("map size", mapSize);
+				m_Serializer.NumberU32_Unbounded("map size", JS::MapSize(cx, obj));
 				
 				JS::RootedValue keyValueIterator(cx);
-				m_ScriptInterface.CallFunction(val, "entries", &keyValueIterator);
-				for (u32 i=0; i<mapSize; ++i)
-				{
-					JS::RootedValue currentIterator(cx);
-					JS::RootedValue keyValuePair(cx);
-					ENSURE(m_ScriptInterface.CallFunction(keyValueIterator, "next", &currentIterator));
+				if (!JS::MapEntries(cx, obj, &keyValueIterator))
+					throw PSERROR_Serialize_ScriptError("JS::MapEntries failed");
+
+				JS::ForOfIterator it(cx);
+				if (!it.init(keyValueIterator))
+					throw PSERROR_Serialize_ScriptError("JS::ForOfIterator::init failed");
+
+				JS::RootedValue keyValuePair(cx);
+				bool done;
+				while (true)
+				{
+					if (!it.next(&keyValuePair, &done))
+						throw PSERROR_Serialize_ScriptError("JS::ForOfIterator::next failed");
+
+					if (done)
+						break;
 
-					// the Iterator has a property called "value" that contains the key-value pair of the map
-					m_ScriptInterface.GetProperty(currentIterator, "value", &keyValuePair);
 					JS::RootedObject keyValuePairObj(cx, &keyValuePair.toObject());
-					
 					JS::RootedValue key(cx);
 					JS::RootedValue value(cx);
 					ENSURE(JS_GetElement(cx, keyValuePairObj, 0, &key));
@@ -262,15 +262,12 @@ void CBinarySerializerScriptImpl::HandleScriptVal(JS::HandleValue val)
 					HandleScriptVal(key);
 					HandleScriptVal(value);
 				}
-				
 				break;
 			}
 			else if (protokey == JSProto_Set)
 			{
-				// TODO: There's no C++ API (yet) to work with sets. This code relies on the internal 
-				// structure of the Iterator object returned by Set.values(). This is not ideal
-				// because the structure could change in the future.
-				// Change this code if SpiderMonkey gets such an API.
+				// TODO: When updating SpiderMonkey to a release after 38 use the C++ API for Sets.
+				// https://bugzilla.mozilla.org/show_bug.cgi?id=1159469
 				u32 setSize;
 				m_ScriptInterface.GetProperty(val, "size", setSize);
 
diff --git a/source/simulation2/serialization/StdDeserializer.cpp b/source/simulation2/serialization/StdDeserializer.cpp
index 2d2d38d2bb..9262442759 100644
--- a/source/simulation2/serialization/StdDeserializer.cpp
+++ b/source/simulation2/serialization/StdDeserializer.cpp
@@ -421,10 +421,9 @@ jsval CStdDeserializer::ReadScriptVal(const char* UNUSED(name), JS::HandleObject
 	}
 	case SCRIPT_TYPE_OBJECT_MAP:
 	{
+		JS::RootedObject obj(cx, JS::NewMapObject(cx));
 		u32 mapSize;
 		NumberU32_Unbounded("map size", mapSize);
-		JS::RootedValue mapVal(cx);
-		m_ScriptInterface.Eval("(new Map())", &mapVal);
 
 		// To match the serializer order, we reserve the map's backref tag here
 		u32 mapTag = ReserveScriptBackref();
@@ -433,11 +432,10 @@ jsval CStdDeserializer::ReadScriptVal(const char* UNUSED(name), JS::HandleObject
 		{
 			JS::RootedValue key(cx, ReadScriptVal("map key", JS::NullPtr()));
 			JS::RootedValue value(cx, ReadScriptVal("map value", JS::NullPtr()));
-			m_ScriptInterface.CallFunctionVoid(mapVal, "set", key, value);
+			JS::MapSet(cx, obj, key, value);
 		}
-		JS::RootedObject mapObj(cx, &mapVal.toObject());
-		SetReservedScriptBackref(mapTag, mapObj);
-		return mapVal;
+		SetReservedScriptBackref(mapTag, obj);
+		return JS::ObjectValue(*obj);
 	}
 	case SCRIPT_TYPE_OBJECT_SET:
 	{