diff --git a/src/upb.c b/src/upb.c
index e58d272301..2412be3065 100644
--- a/src/upb.c
+++ b/src/upb.c
@@ -32,8 +32,8 @@ struct upb_type_info upb_type_info[] = {
   TYPE_INFO(SFIXED64, UPB_WIRE_TYPE_64BIT,       int64_t)
   TYPE_INFO(SINT32,   UPB_WIRE_TYPE_VARINT,      int32_t)
   TYPE_INFO(SINT64,   UPB_WIRE_TYPE_VARINT,      int64_t)
-  TYPE_INFO(STRING,   UPB_WIRE_TYPE_DELIMITED,   struct upb_string*)
-  TYPE_INFO(BYTES,    UPB_WIRE_TYPE_DELIMITED,   struct upb_string*)
+  TYPE_INFO(STRING,   UPB_WIRE_TYPE_DELIMITED,   union upb_string*)
+  TYPE_INFO(BYTES,    UPB_WIRE_TYPE_DELIMITED,   union upb_string*)
 };
 
 void upb_seterr(struct upb_status *status, enum upb_status_code code,
diff --git a/src/upb.h b/src/upb.h
index 237281fc60..aeef3498c3 100644
--- a/src/upb.h
+++ b/src/upb.h
@@ -122,9 +122,9 @@ struct upb_tag {
 
 /* Polymorphic values of .proto types *****************************************/
 
-struct upb_string;
-struct upb_array;
-struct upb_msg;
+union upb_string;
+union upb_array;
+union upb_msg;
 
 // A single .proto value.  The owner must have an out-of-band way of knowing
 // the type, so that it knows which union member to use.
@@ -136,9 +136,9 @@ union upb_value {
   uint32_t uint32;
   uint64_t uint64;
   bool _bool;
-  struct upb_string *str;
-  struct upb_array *arr;
-  struct upb_msg *msg;
+  union upb_string *str;
+  union upb_array *arr;
+  union upb_msg *msg;
 };
 
 // A pointer to a .proto value.  The owner must have an out-of-band way of
@@ -151,9 +151,9 @@ union upb_value_ptr {
   uint32_t *uint32;
   uint64_t *uint64;
   bool *_bool;
-  struct upb_string **str;
-  struct upb_array **arr;
-  struct upb_msg **msg;
+  union upb_string **str;
+  union upb_array **arr;
+  union upb_msg **msg;
   void *_void;
 };
 
diff --git a/src/upb_data.h b/src/upb_data.h
index 48b5d9dfbb..ea59ac7923 100644
--- a/src/upb_data.h
+++ b/src/upb_data.h
@@ -8,7 +8,15 @@
  * protobufs).
  *
  * The members of all structs should be considered private.  Access should
- * only happen through the provided functions. */
+ * only happen through the provided functions.
+ *
+ * Unlike Google's protobuf, messages contain *pointers* to strings and arrays
+ * instead of including them by value.  This makes unused strings and arrays
+ * use less memory, and lets the strings and arrays have multiple possible
+ * representations (for example, a string could be a slice).  It also gives
+ * us more flexibility wrt refcounting.  The cost is that when a field *is*
+ * being used, the net memory usage is one pointer more than if we had
+ * included the thing directly. */
 
 #ifndef UPB_DATA_H
 #define UPB_DATA_H
@@ -189,7 +197,7 @@ typedef struct {
   uint32_t byte_size;
 } upb_refcounted_string;
 
-typedef union {
+typedef union upb_string {
   upb_norefcount_string norefcount;
   upb_string_common common;
   upb_refcounted_string refcounted;
@@ -197,12 +205,12 @@ typedef union {
 
 // Returns a newly constructed, refcounted string which starts out empty.
 // Caller owns one ref on it.  The returned string will not be frozen.
-upb_string *upb_string_new();
+upb_string *upb_string_new(void);
 
 // Creates a new string which is a duplicate of the given string.  If
 // refcounted is true, the new string is refcounted, otherwise the caller
 // has exlusive ownership of it.
-INLINE upb_string *upb_strdup(upb_string *s, bool refcounted);
+INLINE upb_string *upb_strdup(upb_string *s);
 
 // INTERNAL-ONLY:
 // Frees the given string, alone with any memory the string owned.
@@ -213,7 +221,7 @@ void _upb_string_free(upb_string *s);
 // were incompatible with src's.
 INLINE upb_string *upb_string_getref(upb_string *s, int ref_flags) {
   if(_upb_data_incref(&s->common.base, ref_flags)) return s;
-  return upb_strdup(s, true);
+  return upb_strdup(s);
 }
 
 // The caller releases a ref on src, which it must previously have owned a ref
@@ -227,6 +235,8 @@ INLINE void upb_string_unref(upb_string *s) {
 // not be frozen otherwise the program will assert-fail or abort().
 char *upb_string_getrwbuf(upb_string *s, upb_strlen_t byte_len);
 
+void upb_string_resize(upb_string *s, upb_strlen_t len);
+
 INLINE void upb_string_clear(upb_string *s) {
   upb_string_getrwbuf(s, 0);
 }
@@ -270,12 +280,20 @@ INLINE void upb_strcpy(upb_string *dest, upb_string *src) {
   memcpy(upb_string_getrwbuf(dest, src_len), upb_string_getrobuf(src), src_len);
 }
 
-INLINE upb_string *upb_strdup(upb_string *s, bool refcounted) {
-  upb_string *copy = upb_string_new(refcounted);
+INLINE upb_string *upb_strdup(upb_string *s) {
+  upb_string *copy = upb_string_new();
   upb_strcpy(copy, s);
   return copy;
 }
 
+INLINE upb_string *upb_strdupc(const char *src) {
+  upb_string *copy = upb_string_new();
+  upb_strlen_t len = strlen(src);
+  char *buf = upb_string_getrwbuf(copy, len);
+  memcpy(buf, src, len);
+  return copy;
+}
+
 // Appends 'append' to 's' in-place, resizing s if necessary.
 INLINE void upb_strcat(upb_string *s, upb_string *append) {
   upb_strlen_t s_len = upb_strlen(s);
@@ -290,7 +308,7 @@ INLINE void upb_strcat(upb_string *s, upb_string *append) {
 // the original string data instead of copying it.  Both now and in the future,
 // the caller owns a ref on whatever is returned.
 INLINE upb_string *upb_strslice(upb_string *s, int offset, int len) {
-  upb_string *slice = upb_string_new(true);
+  upb_string *slice = upb_string_new();
   len = UPB_MIN((upb_strlen_t)len, upb_strlen(s) - (upb_strlen_t)offset);
   memcpy(upb_string_getrwbuf(slice, len), upb_string_getrobuf(s) + offset, len);
   return slice;
@@ -304,7 +322,7 @@ upb_string *upb_strreadfile(const char *filename);
 // must not dynamically allocate this type.
 typedef upb_string upb_static_string;
 #define UPB_STRLIT_LEN(str, len) {0 | UPB_DATA_FROZEN, len, str}
-#define UPB_STRLIT(str) {{{0 | UPB_DATA_FROZEN}, sizeof(str), str}}
+#define UPB_STRLIT(str) {{0 | UPB_DATA_FROZEN, sizeof(str), str}}
 
 // Allows using upb_strings in printf, ie:
 //   upb_string str = UPB_STRLIT("Hello, World!\n");
@@ -316,33 +334,50 @@ typedef upb_string upb_static_string;
 
 typedef uint32_t upb_arraylen_t;
 
-// The members of this struct are private.  Access should only be through the
-// associated functions.
+// The comments attached to upb_string above also apply here.
+typedef struct {
+  upb_data base;
+  upb_arraylen_t len;
+  union upb_value_ptr elements;
+} upb_array_common;
+
+typedef struct {
+  uint32_t size_and_flags;
+  upb_arraylen_t len;
+  union upb_value_ptr elements;
+} upb_norefcount_array;
+
 typedef struct {
-  unsigned int size:29;  // How many bytes we own, 0 if we don't own.
-  bool is_heap_allocated:1;
-  bool is_frozen:1;
-  bool has_refcount:1;
+  upb_data base;
   upb_arraylen_t len;
-  union upb_value_ptr *elements;
+  union upb_value_ptr elements;
+  upb_arraylen_t size;
+} upb_refcounted_array;
+
+typedef union upb_array {
+  upb_norefcount_array norefcount;
+  upb_array_common common;
+  upb_refcounted_array refcounted;
 } upb_array;
 
+// This type can be used either to perform read-only access on an array,
+// or to statically define a non-reference-counted static array.
 #define UPB_DEFINE_MSG_ARRAY(type) \
-typedef struct type ## array { \
-  unsigned int size:29;  \
-  bool is_heap_allocated:1; \
-  bool is_frozen:1;\
-  bool has_refcount:1;\
+typedef struct type ## _array { \
+  upb_data base; \
   upb_arraylen_t len;\
   type **elements; \
-} type ## array; \
+} type ## _array; \
 
-#define UPB_MSG_ARRAY(type) struct type ## array
+#define UPB_MSG_ARRAY(type) struct type ## _array
 
-// Constructs a newly-allocated array, which starts out empty.  Caller owns one
-// ref on it.
+// Constructs a newly-allocated, reference-counted array which starts out
+// empty.  Caller owns one ref on it.
 upb_array *upb_array_new(void);
 
+union upb_value upb_array_get(upb_array *a, struct upb_fielddef *f, int elem);
+
+#if 0
 // Returns an array to which caller owns a ref, and contains the same contents
 // as src.  The returned value may be a copy of src, if the requested flags
 // were incompatible with src's.
@@ -358,12 +393,6 @@ INLINE void upb_array_unref(upb_array *a, struct upb_fielddef *f);
 INLINE void upb_array_set(upb_array *a, struct upb_fielddef *f, int elem,
                           union upb_value val);
 
-// Note that the caller does *not* own a ref on the returned value.
-INLINE union upb_value upb_array_get(upb_array *a, struct upb_fielddef *f,
-                                     int elem);
-INLINE union upb_value upb_array_getmutable(upb_array *a,
-                                            struct upb_fielddef *f, int elem,
-                                            union upb_value val);
 
 // Note that array_append will attempt to take a reference on the given value,
 // so to avoid a copy use append_default and get.
@@ -371,15 +400,16 @@ INLINE void upb_array_append(upb_array *a, struct upb_fielddef *f,
                              union upb_value val);
 INLINE void upb_array_append_default(upb_array *a, struct upb_fielddef *f,
                              union upb_value val);
+#endif
 
 // Returns the current number of elements in the array.
 INLINE size_t upb_array_len(upb_array *a) {
-  return a->len;
+  return a->common.len;
 }
 
 /* upb_msg ********************************************************************/
 
-typedef struct {
+typedef union upb_msg {
   uint8_t data[1];
 } upb_msg;
 
@@ -390,13 +420,12 @@ void upb_msg_unref(upb_msg *msg, struct upb_msgdef *md);
 
 // Tests whether the given field is explicitly set, or whether it will return
 // a default.
-bool upb_msg_isset(upb_msg *msg, struct upb_fielddef *f);
+bool upb_msg_has(upb_msg *msg, struct upb_fielddef *f);
 
 // Returns the current value if set, or the default value if not set, of the
 // specified field.  The mutable version will first replace the value with a
 // mutable copy if it is not already mutable.
 union upb_value upb_msg_get(upb_msg *msg, struct upb_fielddef *f);
-union upb_value upb_msg_getmutable(upb_msg *msg, struct upb_fielddef *f);
 
 // Sets the given field to the given value.  The msg will take a ref on val,
 // and will drop a ref on whatever was there before.
diff --git a/src/upb_def.c b/src/upb_def.c
index 5f52f3136f..be5c181586 100644
--- a/src/upb_def.c
+++ b/src/upb_def.c
@@ -437,7 +437,7 @@ static struct symtab_ent *resolve(struct upb_strtable *t,
     return e;
   } else {
     // Remove components from base until we find an entry or run out.
-    upb_string *sym_str = upb_string_new(true);
+    upb_string *sym_str = upb_string_new();
     int baselen = upb_strlen(base);
     while(1) {
       // sym_str = base[0...base_len] + UPB_SYMBOL_SEPARATOR + symbol
@@ -461,7 +461,7 @@ static struct symtab_ent *resolve(struct upb_strtable *t,
  *   join("", "Baz") -> "Baz"
  * Caller owns a ref on the returned string. */
 static upb_string *join(upb_string *base, upb_string *name) {
-  upb_string *joined = upb_strdup(base, true);
+  upb_string *joined = upb_strdup(base);
   upb_strlen_t len = upb_strlen(joined);
   if(len > 0) {
     upb_string_getrwbuf(joined, len + 1)[len] = UPB_SYMBOL_SEPARATOR;
diff --git a/src/upb_def.h b/src/upb_def.h
index e8c75487c5..b013c408a4 100644
--- a/src/upb_def.h
+++ b/src/upb_def.h
@@ -173,7 +173,7 @@ struct google_protobuf_DescriptorProto;
 struct upb_msgdef {
   struct upb_def base;
   upb_atomic_refcount_t cycle_refcount;
-  struct upb_msg *default_msg;   // Message with all default values set.
+  upb_msg *default_msg;   // Message with all default values set.
   size_t size;
   upb_field_count_t num_fields;
   uint32_t set_flags_bytes;
diff --git a/src/upb_parse.c b/src/upb_parse.c
index 2948022e8e..b9cad5a4cd 100644
--- a/src/upb_parse.c
+++ b/src/upb_parse.c
@@ -272,8 +272,8 @@ static uint8_t *skip_wire_value(uint8_t *buf, uint8_t *end, upb_wire_type_t wt,
   }
 }
 
-uint8_t *upb_parse_value(uint8_t *buf, uint8_t *end, upb_field_type_t ft,
-                         union upb_value_ptr v, struct upb_status *status)
+static uint8_t *upb_parse_value(uint8_t *buf, uint8_t *end, upb_field_type_t ft,
+                                union upb_value_ptr v, struct upb_status *status)
 {
 #define CASE(t, member_name) \
   case UPB_TYPE(t): return upb_get_ ## t(buf, end, v.member_name, status);
diff --git a/src/upb_table.h b/src/upb_table.h
index 9a49b8b3c5..31ff7d2092 100644
--- a/src/upb_table.h
+++ b/src/upb_table.h
@@ -39,7 +39,7 @@ struct upb_inttable_entry {
 // performance by letting us compare hashes before comparing lengths or the
 // strings themselves.
 struct upb_strtable_entry {
-  upb_string *key;  // We own a frozen ref.
+  upb_string *key;         // We own a frozen ref.
   uint32_t next;           // Internal chaining.
 };
 
diff --git a/src/upb_text.h b/src/upb_text.h
index 32d72784a7..6b2f4eb15f 100644
--- a/src/upb_text.h
+++ b/src/upb_text.h
@@ -23,10 +23,10 @@ INLINE void upb_text_printer_init(struct upb_text_printer *p, bool single_line)
   p->single_line = single_line;
 }
 void upb_text_printval(upb_field_type_t type, union upb_value p, FILE *file);
-void upb_text_printfield(struct upb_text_printer *p, struct upb_string *name,
+void upb_text_printfield(struct upb_text_printer *p, upb_string *name,
                          upb_field_type_t valtype, union upb_value val,
                          FILE *stream);
-void upb_text_push(struct upb_text_printer *p, struct upb_string *submsg_type,
+void upb_text_push(struct upb_text_printer *p, upb_string *submsg_type,
                    FILE *stream);
 void upb_text_pop(struct upb_text_printer *p, FILE *stream);
 
diff --git a/tools/upbc.c b/tools/upbc.c
index a6ab289691..8e89435544 100644
--- a/tools/upbc.c
+++ b/tools/upbc.c
@@ -11,33 +11,36 @@
 #include <ctype.h>
 #include <inttypes.h>
 #include <stdarg.h>
+#include <stdlib.h>
 #include "descriptor.h"
-#include "upb_array.h"
+#include "upb_data.h"
 #include "upb_def.h"
-#include "upb_mm.h"
-#include "upb_msg.h"
 #include "upb_text.h"
 
 /* These are in-place string transformations that do not change the length of
  * the string (and thus never need to re-allocate). */
 
-/* Convert to C identifier: foo.bar.Baz -> foo_bar_Baz. */
-static void to_cident(struct upb_string *str)
+// Convert to C identifier: foo.bar.Baz -> foo_bar_Baz.
+static void to_cident(upb_string *str)
 {
-  for(uint32_t i = 0; i < str->byte_len; i++)
-    if(str->ptr[i] == '.' || str->ptr[i] == '/')
-      str->ptr[i] = '_';
+  upb_strlen_t len = upb_strlen(str);
+  char *buf = upb_string_getrwbuf(str, len);
+  for(uint32_t i = 0; i < len; i++)
+    if(buf[i] == '.' || buf[i] == '/')
+      buf[i] = '_';
 }
 
-/* Convert to C proprocessor identifier: foo.bar.Baz -> FOO_BAR_BAZ. */
-static void to_preproc(struct upb_string *str)
+// Convert to C proprocessor identifier: foo.bar.Baz -> FOO_BAR_BAZ.
+static void to_preproc(upb_string *str)
 {
   to_cident(str);
-  for(uint32_t i = 0; i < str->byte_len; i++)
-    str->ptr[i] = toupper(str->ptr[i]);
+  upb_strlen_t len = upb_strlen(str);
+  char *buf = upb_string_getrwbuf(str, len);
+  for(uint32_t i = 0; i < len; i++)
+    buf[i] = toupper(buf[i]);
 }
 
-static int my_memrchr(char *data, char c, size_t len)
+static int my_memrchr(const char *data, char c, size_t len)
 {
   int off = len-1;
   while(off > 0 && data[off] != c) --off;
@@ -62,10 +65,13 @@ static void write_const_h(struct upb_def *defs[], int num_entries,
                           char *outfile_name, FILE *stream)
 {
   /* Header file prologue. */
-  struct upb_string *include_guard_name = upb_strdupc(outfile_name);
+  upb_string *include_guard_name = upb_strdupc(outfile_name);
   to_preproc(include_guard_name);
   /* A bit cheesy, but will do the job. */
-  include_guard_name->ptr[include_guard_name->byte_len-1] = 'C';
+  upb_strlen_t len = upb_strlen(include_guard_name);
+  char *buf = upb_string_getrwbuf(include_guard_name, len);
+  buf[len-1] = 'C';
+
   fputs("/* This file was generated by upbc (the upb compiler).  "
         "Do not edit. */\n\n", stream),
   fprintf(stream, "#ifndef " UPB_STRFMT "\n", UPB_STRARG(include_guard_name));
@@ -79,14 +85,14 @@ static void write_const_h(struct upb_def *defs[], int num_entries,
   for(int i = 0; i < num_entries; i++) {  /* Foreach enum */
     if(defs[i]->type != UPB_DEF_ENUM) continue;
     struct upb_enumdef *enumdef = upb_downcast_enumdef(defs[i]);
-    struct upb_string *enum_name = upb_strdup(UPB_UPCAST(enumdef)->fqname);
-    struct upb_string *enum_val_prefix = upb_strdup(enum_name);
+    upb_string *enum_name = upb_strdup(UPB_UPCAST(enumdef)->fqname);
+    upb_string *enum_val_prefix = upb_strdup(enum_name);
     to_cident(enum_name);
 
-    enum_val_prefix->byte_len = my_memrchr(enum_val_prefix->ptr,
-                                           UPB_SYMBOL_SEPARATOR,
-                                           enum_val_prefix->byte_len);
-    enum_val_prefix->byte_len++;
+    const char *data = upb_string_getrobuf(enum_val_prefix);
+    upb_strlen_t len = upb_strlen(enum_val_prefix);
+    upb_strlen_t lastsep = my_memrchr(data, UPB_SYMBOL_SEPARATOR, len);
+    upb_string_resize(enum_val_prefix, lastsep + 1);
     to_preproc(enum_val_prefix);
 
     fprintf(stream, "typedef enum " UPB_STRFMT " {\n", UPB_STRARG(enum_name));
@@ -94,7 +100,7 @@ static void write_const_h(struct upb_def *defs[], int num_entries,
     bool first = true;
     /* Foreach enum value. */
     for(upb_enum_begin(&iter, enumdef); !upb_enum_done(&iter); upb_enum_next(&iter)) {
-      struct upb_string *value_name = upb_strdup(iter.name);
+      upb_string *value_name = upb_strdup(iter.name);
       to_preproc(value_name);
       /* "  GOOGLE_PROTOBUF_FIELDDESCRIPTORPROTO_TYPE_UINT32 = 13," */
       if (!first) fputs(",\n", stream);
@@ -124,7 +130,7 @@ static void write_h(struct upb_def *defs[], int num_defs, char *outfile_name,
                     char *descriptor_cident, FILE *stream)
 {
   /* Header file prologue. */
-  struct upb_string *include_guard_name = upb_strdupc(outfile_name);
+  upb_string *include_guard_name = upb_strdupc(outfile_name);
   to_preproc(include_guard_name);
   fputs("/* This file was generated by upbc (the upb compiler).  "
         "Do not edit. */\n\n", stream),
@@ -149,7 +155,7 @@ static void write_h(struct upb_def *defs[], int num_defs, char *outfile_name,
   for(int i = 0; i < num_defs; i++) {  /* Foreach message */
     struct upb_msgdef *m = upb_dyncast_msgdef(defs[i]);
     if(!m) continue;
-    struct upb_string *msg_name = upb_strdup(UPB_UPCAST(m)->fqname);
+    upb_string *msg_name = upb_strdup(UPB_UPCAST(m)->fqname);
     to_cident(msg_name);
     fprintf(stream, "struct " UPB_STRFMT ";\n", UPB_STRARG(msg_name));
     fprintf(stream, "typedef struct " UPB_STRFMT "\n    " UPB_STRFMT ";\n\n",
@@ -162,7 +168,7 @@ static void write_h(struct upb_def *defs[], int num_defs, char *outfile_name,
   for(int i = 0; i < num_defs; i++) {  /* Foreach message */
     struct upb_msgdef *m = upb_dyncast_msgdef(defs[i]);
     if(!m) continue;
-    struct upb_string *msg_name = upb_strdup(UPB_UPCAST(m)->fqname);
+    upb_string *msg_name = upb_strdup(UPB_UPCAST(m)->fqname);
     to_cident(msg_name);
     fprintf(stream, "struct " UPB_STRFMT " {\n", UPB_STRARG(msg_name));
     fputs("  struct upb_mmhead mmhead;\n", stream);
@@ -181,7 +187,7 @@ static void write_h(struct upb_def *defs[], int num_defs, char *outfile_name,
     for(upb_field_count_t j = 0; j < m->num_fields; j++) {
       struct upb_fielddef *f = &m->fields[j];
       if(upb_issubmsg(f)) {
-        struct upb_string *type_name = upb_strdup(f->def->fqname);
+        upb_string *type_name = upb_strdup(f->def->fqname);
         to_cident(type_name);
         if(f->label == GOOGLE_PROTOBUF_FIELDDESCRIPTORPROTO_LABEL_REPEATED) {
           fprintf(stream, "  UPB_MSG_ARRAY(" UPB_STRFMT ")* " UPB_STRFMT ";\n",
@@ -241,14 +247,14 @@ struct strtable_entry {
 struct typetable_entry {
   struct upb_strtable_entry e;
   struct upb_fielddef *field;
-  struct upb_string *cident;  /* Type name converted with to_cident(). */
+  upb_string *cident;  /* Type name converted with to_cident(). */
   /* A list of all values of this type, in an established order. */
   union upb_value *values;
   int values_size, values_len;
   struct array {
     int offset;
     int len;
-    struct upb_array *ptr;  /* So we can find it later. */
+    upb_array *ptr;  /* So we can find it later. */
   } *arrays;
   int arrays_size, arrays_len;
 };
@@ -270,32 +276,33 @@ int compare_entries(const void *_e1, const void *_e2)
  *
  * TODO: make these use a generic msg visitor. */
 
-static void add_strings_from_msg(struct upb_msg *msg, struct upb_strtable *t);
+static void add_strings_from_msg(upb_msg *msg, struct upb_msgdef *md,
+                                 struct upb_strtable *t);
 
-static void add_strings_from_value(union upb_value_ptr p,
+static void add_strings_from_value(union upb_value p,
                                    struct upb_fielddef *f,
                                    struct upb_strtable *t)
 {
   if(upb_isstringtype(f->type)) {
-    struct strtable_entry e = {.e = {.key = *p.str}};
+    struct strtable_entry e = {.e = {.key = p.str}};
     if(upb_strtable_lookup(t, e.e.key) == NULL)
       upb_strtable_insert(t, &e.e);
   } else if(upb_issubmsg(f)) {
-    add_strings_from_msg(*p.msg, t);
+    add_strings_from_msg(p.msg, upb_downcast_msgdef(f->def), t);
   }
 }
 
-static void add_strings_from_msg(struct upb_msg *msg, struct upb_strtable *t)
+static void add_strings_from_msg(upb_msg *msg, struct upb_msgdef *md,
+                                 struct upb_strtable *t)
 {
-  struct upb_msgdef *m = msg->def;
-  for(upb_field_count_t i = 0; i < m->num_fields; i++) {
-    struct upb_fielddef *f = &m->fields[i];
-    if(!upb_msg_isset(msg, f)) continue;
-    union upb_value_ptr p = upb_msg_getptr(msg, f);
+  for(upb_field_count_t i = 0; i < md->num_fields; i++) {
+    struct upb_fielddef *f = &md->fields[i];
+    if(!upb_msg_has(msg, f)) continue;
+    union upb_value p = upb_msg_get(msg, f);
     if(upb_isarray(f)) {
-      struct upb_array *arr = *p.arr;
-      for(uint32_t j = 0; j < arr->len; j++)
-        add_strings_from_value(upb_array_getelementptr(arr, j), f, t);
+      upb_array *arr = p.arr;
+      for(uint32_t j = 0; j < upb_array_len(arr); j++)
+        add_strings_from_value(upb_array_get(arr, f, j), f, t);
     } else {
       add_strings_from_value(p, f, t);
     }
@@ -310,8 +317,8 @@ static void add_strings_from_msg(struct upb_msg *msg, struct upb_strtable *t)
 struct typetable_entry *get_or_insert_typeentry(struct upb_strtable *t,
                                                 struct upb_fielddef *f)
 {
-  struct upb_string *type_name = upb_issubmsg(f) ? upb_strdup(f->def->fqname) :
-                                                   upb_strdupc(upb_type_info[f->type].ctype);
+  upb_string *type_name = upb_issubmsg(f) ? upb_strdup(f->def->fqname) :
+                                            upb_strdupc(upb_type_info[f->type].ctype);
   struct typetable_entry *type_e = upb_strtable_lookup(t, type_name);
   if(type_e == NULL) {
     struct typetable_entry new_type_e = {
@@ -331,7 +338,7 @@ struct typetable_entry *get_or_insert_typeentry(struct upb_strtable *t,
   return type_e;
 }
 
-static void add_value(union upb_value_ptr p, struct upb_fielddef *f,
+static void add_value(union upb_value v, struct upb_fielddef *f,
                       struct upb_strtable *t)
 {
   struct typetable_entry *type_e = get_or_insert_typeentry(t, f);
@@ -339,19 +346,19 @@ static void add_value(union upb_value_ptr p, struct upb_fielddef *f,
     type_e->values_size = UPB_MAX(type_e->values_size * 2, 4);
     type_e->values = realloc(type_e->values, sizeof(*type_e->values) * type_e->values_size);
   }
-  type_e->values[type_e->values_len++] = upb_value_read(p, f->type);
+  type_e->values[type_e->values_len++] = v;
 }
 
-static void add_submsgs(struct upb_msg *msg, struct upb_strtable *t)
+static void add_submsgs(upb_msg *msg, struct upb_msgdef *md,
+                        struct upb_strtable *t)
 {
-  struct upb_msgdef *m = msg->def;
-  for(upb_field_count_t i = 0; i < m->num_fields; i++) {
-    struct upb_fielddef *f = &m->fields[i];
-    if(!upb_msg_isset(msg, f)) continue;
-    union upb_value_ptr p = upb_msg_getptr(msg, f);
+  for(upb_field_count_t i = 0; i < md->num_fields; i++) {
+    struct upb_fielddef *f = &md->fields[i];
+    if(!upb_msg_has(msg, f)) continue;
+    union upb_value v = upb_msg_get(msg, f);
     if(upb_isarray(f)) {
       if(upb_isstring(f)) continue;  /* Handled by a different code-path. */
-      struct upb_array *arr = *p.arr;
+      upb_array *arr = v.arr;
 
       /* Add to our list of arrays for this type. */
       struct typetable_entry *arr_type_e =
@@ -362,30 +369,31 @@ static void add_submsgs(struct upb_msg *msg, struct upb_strtable *t)
                                      sizeof(*arr_type_e->arrays)*arr_type_e->arrays_size);
       }
       arr_type_e->arrays[arr_type_e->arrays_len].offset = arr_type_e->values_len;
-      arr_type_e->arrays[arr_type_e->arrays_len].len = arr->len;
-      arr_type_e->arrays[arr_type_e->arrays_len].ptr = *p.arr;
+      arr_type_e->arrays[arr_type_e->arrays_len].len = upb_array_len(arr);
+      arr_type_e->arrays[arr_type_e->arrays_len].ptr = v.arr;
       arr_type_e->arrays_len++;
 
       /* Add the individual values in the array. */
-      for(uint32_t j = 0; j < arr->len; j++)
-        add_value(upb_array_getelementptr(arr, j), f, t);
+      for(uint32_t j = 0; j < upb_array_len(arr); j++)
+        add_value(upb_array_get(arr, f, j), f, t);
 
       /* Add submsgs.  We must do this separately so that the msgs in this
        * array are contiguous (and don't have submsgs of the same type
        * interleaved). */
-      for(uint32_t j = 0; j < arr->len; j++)
-        add_submsgs(*upb_array_getelementptr(arr, j).msg, t);
+      for(uint32_t j = 0; j < upb_array_len(arr); j++)
+        add_submsgs(upb_array_get(arr, f, j).msg, upb_downcast_msgdef(f->def), t);
     } else {
       if(!upb_issubmsg(f)) continue;
-      add_value(p, f, t);
-      add_submsgs(*p.msg, t);
+      add_value(v, f, t);
+      add_submsgs(v.msg, upb_downcast_msgdef(f->def), t);
     }
   }
 }
 
 /* write_messages_c emits a .c file that contains the data of a protobuf,
  * serialized as C structures. */
-static void write_message_c(struct upb_msg *msg, char *cident, char *hfile_name,
+static void write_message_c(upb_msg *msg, struct upb_msgdef *md,
+                            char *cident, char *hfile_name,
                             int argc, char *argv[], char *infile_name,
                             FILE *stream)
 {
@@ -415,7 +423,7 @@ static void write_message_c(struct upb_msg *msg, char *cident, char *hfile_name,
    * same string more than once. */
   struct upb_strtable strings;
   upb_strtable_init(&strings, 16, sizeof(struct strtable_entry));
-  add_strings_from_msg(msg, &strings);
+  add_strings_from_msg(msg, md, &strings);
 
   int size;
   struct strtable_entry **str_entries = strtable_to_array(&strings, &size);
@@ -427,7 +435,7 @@ static void write_message_c(struct upb_msg *msg, char *cident, char *hfile_name,
   int col = 2;
   int offset = 0;
   for(int i = 0; i < size; i++) {
-    struct upb_string *s = str_entries[i]->e.key;
+    upb_string *s = str_entries[i]->e.key;
     str_entries[i]->offset = offset;
     str_entries[i]->num = i;
     for(uint32_t j = 0; j < s->byte_len; j++) {