--- a/dom/bluetooth/tests/marionette/head.js
+++ b/dom/bluetooth/tests/marionette/head.js
@@ -38,25 +38,18 @@ const REMOTE_DEVICE_NAME = "Remote_BT_De
 
 // A system message signature of pairing request event
 const BT_PAIRING_REQ = "bluetooth-pairing-request";
 
 // Passkey and pincode used to reply pairing requst
 const BT_PAIRING_PASSKEY = 123456;
 const BT_PAIRING_PINCODE = "ABCDEFG";
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
+let Promise =
+  SpecialPowers.Cu.import("resource://gre/modules/Promise.jsm").Promise;
 
 let bluetoothManager;
 
 let pendingEmulatorCmdCount = 0;
 
 /**
  * Send emulator command with safe guard.
  *

--- a/dom/bluetooth2/tests/marionette/head.js
+++ b/dom/bluetooth2/tests/marionette/head.js
@@ -31,25 +31,18 @@ const EMULATOR_CLASS = 0x58020c;
 // which were defined at external/qemu/hw/bt.h:
 const BDADDR_ANY   = "00:00:00:00:00:00";
 const BDADDR_ALL   = "ff:ff:ff:ff:ff:ff";
 const BDADDR_LOCAL = "ff:ff:ff:00:00:00";
 
 // A user friendly name for remote BT device.
 const REMOTE_DEVICE_NAME = "Remote_BT_Device";
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
+let Promise =
+  SpecialPowers.Cu.import("resource://gre/modules/Promise.jsm").Promise;
 
 let bluetoothManager;
 
 let pendingEmulatorCmdCount = 0;
 
 /**
  * Push required permissions and test if |navigator.mozBluetooth| exists.
  * Resolve if it does, reject otherwise.

--- a/dom/cellbroadcast/tests/marionette/head.js
+++ b/dom/cellbroadcast/tests/marionette/head.js
@@ -1,22 +1,14 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Cc: Cc, Ci: Ci, Cr: Cr, Cu: Cu} = SpecialPowers;
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
+let Promise = Cu.import("resource://gre/modules/Promise.jsm").Promise;
 
 const PDU_DCS_CODING_GROUP_BITS          = 0xF0;
 const PDU_DCS_MSG_CODING_7BITS_ALPHABET  = 0x00;
 const PDU_DCS_MSG_CODING_8BITS_ALPHABET  = 0x04;
 const PDU_DCS_MSG_CODING_16BITS_ALPHABET = 0x08;
 
 const PDU_DCS_MSG_CLASS_BITS             = 0x03;
 const PDU_DCS_MSG_CLASS_NORMAL           = 0xFF;

--- a/dom/ipc/tests/test_CrashService_crash.html
+++ b/dom/ipc/tests/test_CrashService_crash.html
@@ -50,37 +50,37 @@ SpecialPowers.pushPrefEnv({'set':[
       };
       privateNoteIntentionalCrash();
       crash();
     }, false);
 
     // Finally, poll for the new crash record.
     function tryGetCrash() {
       info("Waiting for getCrashes");
-      crashMan.getCrashes().then(SpecialPowers.wrapCallback(function (crashes) {
+      crashMan.getCrashes().then(function (crashes) {
         if (crashes.length) {
           is(crashes.length, 1, "There should be only one record");
-          var crash = crashes[0];
+          var crash = SpecialPowers.wrap(crashes[0]);
           ok(crash.isOfType(crashMan.PROCESS_TYPE_CONTENT,
                             crashMan.CRASH_TYPE_CRASH),
              "Record should be a content crash");
           ok(!!crash.id, "Record should have an ID");
           ok(!!crash.crashDate, "Record should have a crash date");
           var dateMS = crash.crashDate.valueOf();
           var twoMin = 1000 * 60 * 2;
           ok(crashDateMS - twoMin <= dateMS &&
              dateMS <= crashDateMS + twoMin,
              "Record's crash date should be nowish: " +
              "now=" + crashDateMS + " recordDate=" + dateMS);
           SimpleTest.finish();
         }
         else {
           setTimeout(tryGetCrash, 1000);
         }
-      }), function (err) {
+      }, function (err) {
         ok(false, "Error getting crashes: " + err);
         SimpleTest.finish();
       });
     }
     setTimeout(tryGetCrash, 1000);
 
   }, function () {
     ok(false, "pruneOldCrashes error");

--- a/dom/mobilemessage/tests/marionette/head.js
+++ b/dom/mobilemessage/tests/marionette/head.js
@@ -1,22 +1,14 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Cc: Cc, Ci: Ci, Cr: Cr, Cu: Cu} = SpecialPowers;
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
+let Promise = Cu.import("resource://gre/modules/Promise.jsm").Promise;
 
 /**
  * Push a list of preference settings. Never reject.
  *
  * Fulfill params: (none)
  *
  * @param aPrefs
  *        An JS object.  For example:

--- a/dom/permission/tests/file_framework.js
+++ b/dom/permission/tests/file_framework.js
@@ -163,19 +163,21 @@ function addPermissions(aPerms, aDoc, aC
   });
   SpecialPowers.pushPermissions(permList, aCallback);
 }
 
 function expandPermissions(aPerms) {
   var perms = [];
   aPerms.forEach(function(el) {
     var access = permTable[el].access ? "readwrite" : null;
-    var expanded = expand(el, access);
+    var expanded = SpecialPowers.unwrap(expand(el, access));
+    // COW arrays don't behave array-like enough, to allow
+    // using expanded.slice(0) here.
     for (let i = 0; i < expanded.length; i++) {
-      perms.push(SpecialPowers.unwrap(expanded[i]));
+      perms.push(expanded[i]);
     }
   });
 
   return perms;
 }
 
 function msgHandler(evt) {
   var data = evt.data;

--- a/dom/plugins/test/mochitest/utils.js
+++ b/dom/plugins/test/mochitest/utils.js
@@ -64,34 +64,34 @@ function crashAndGetCrashServiceRecord(c
     catch (e) {
       ok(true, "p." + crashMethodName + "() should throw an exception");
     }
 
     // The crash record store is written and read back asyncly, so poll for
     // the new record.
     function tryGetCrash() {
       info("Waiting for getCrashes");
-      crashMan.getCrashes().then(SpecialPowers.wrapCallback(function (crashes) {
+      crashMan.getCrashes().then(function (crashes) {
         if (crashes.length) {
           is(crashes.length, 1, "There should be only one record");
           var crash = SpecialPowers.wrap(crashes[0]);
           ok(!!crash.id, "Record should have an ID");
           ok(!!crash.crashDate, "Record should have a crash date");
           var dateMS = crash.crashDate.valueOf();
           var twoMin = 1000 * 60 * 2;
           ok(crashDateMS - twoMin <= dateMS &&
              dateMS <= crashDateMS + twoMin,
              "Record's crash date should be nowish: " +
              "now=" + crashDateMS + " recordDate=" + dateMS);
           callback(crashMan, crash);
         }
         else {
           setTimeout(tryGetCrash, 1000);
         }
-      }), function (err) {
+      }, function (err) {
         ok(false, "Error getting crashes: " + err);
         SimpleTest.finish();
       });
     }
     setTimeout(tryGetCrash, 1000);
 
   }, function () {
     ok(false, "pruneOldCrashes error");

--- a/dom/system/gonk/RILContentHelper.js
+++ b/dom/system/gonk/RILContentHelper.js
@@ -794,33 +794,32 @@ RILContentHelper.prototype = {
     if (message.errorMsg) {
       this.fireRequestError(message.requestId, message.errorMsg);
       return;
     }
 
     let window = this._windowsMap[message.requestId];
     delete this._windowsMap[message.requestId];
     let contacts = message.contacts;
-    let result = new window.Array();
-    contacts.forEach(function(c) {
+    let result = contacts.map(function(c) {
       let prop = {name: [c.alphaId], tel: [{value: c.number}]};
 
       if (c.email) {
         prop.email = [{value: c.email}];
       }
 
       // ANR - Additional Number
       let anrLen = c.anr ? c.anr.length : 0;
       for (let i = 0; i < anrLen; i++) {
         prop.tel.push({value: c.anr[i]});
       }
 
       let contact = new window.mozContact(prop);
       contact.id = c.contactId;
-      result.push(contact);
+      return contact;
     });
 
     this.fireRequestSuccess(message.requestId, result);
   },
 
   handleUpdateIccContact: function(message) {
     if (message.errorMsg) {
       this.fireRequestError(message.requestId, message.errorMsg);

--- a/dom/telephony/test/marionette/head.js
+++ b/dom/telephony/test/marionette/head.js
@@ -1,21 +1,12 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
-
+let Promise = SpecialPowers.Cu.import("resource://gre/modules/Promise.jsm").Promise;
 let telephony;
 let conference;
 
 const kPrefRilDebuggingEnabled = "ril.debugging.enabled";
 
 /**
  * Emulator helper.
  */

--- a/dom/tethering/tests/marionette/head.js
+++ b/dom/tethering/tests/marionette/head.js
@@ -20,25 +20,18 @@ const TETHERING_SETTING_DNS2 = "8.8.4.4"
  * Wifi tethering setting.
  */
 const TETHERING_SETTING_SSID = "FirefoxHotSpot";
 const TETHERING_SETTING_SECURITY = "open";
 const TETHERING_SETTING_KEY = "1234567890";
 
 const SETTINGS_RIL_DATA_ENABLED = 'ril.data.enabled';
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
+let Promise =
+  SpecialPowers.Cu.import("resource://gre/modules/Promise.jsm").Promise;
 
 let gTestSuite = (function() {
   let suite = {};
 
   let tetheringManager;
   let pendingEmulatorShellCount = 0;
 
   /**

--- a/dom/voicemail/test/marionette/head.js
+++ b/dom/voicemail/test/marionette/head.js
@@ -1,27 +1,19 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 "use strict";
 
 const {Cc: Cc, Ci: Ci, Cr: Cr, Cu: Cu} = SpecialPowers;
 
-let RIL = SpecialPowers.wrap(SpecialPowers.createBlankObject());
-SpecialPowers.Cu.import("resource://gre/modules/ril_consts.js", RIL);
+let RIL = {};
+Cu.import("resource://gre/modules/ril_consts.js", RIL);
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
+let Promise = Cu.import("resource://gre/modules/Promise.jsm").Promise;
 
 const MWI_PDU_PREFIX = "0000";
 const MWI_PDU_UDH_PREFIX = "0040";
 const MWI_PID_DEFAULT = "00";
 const MWI_DCS_DISCARD_INACTIVE = "C0";
 const MWI_DCS_DISCARD_ACTIVE = "C8";
 const MWI_TIMESTAMP = "00000000000000";
 

--- a/dom/wifi/DOMWifiManager.js
+++ b/dom/wifi/DOMWifiManager.js
@@ -155,17 +155,17 @@ DOMWifiManager.prototype = {
   },
 
   _convertWifiNetwork: function(aNetwork) {
     let network = aNetwork ? new this._window.MozWifiNetwork(aNetwork) : null;
     return network;
   },
 
   _convertWifiNetworks: function(aNetworks) {
-    let networks = new this._window.Array();
+    let networks = [];
     for (let i in aNetworks) {
       networks.push(this._convertWifiNetwork(aNetworks[i]));
     }
     return networks;
   },
 
   _convertConnection: function(aConn) {
     let conn = aConn ? new MozWifiConnection(aConn) : null;

--- a/dom/wifi/test/marionette/head.js
+++ b/dom/wifi/test/marionette/head.js
@@ -1,20 +1,12 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
-// Emulate Promise.jsm semantics.
-Promise.defer = function() { return new Deferred(); }
-function Deferred()  {
-  this.promise = new Promise(function(resolve, reject) {
-    this.resolve = resolve;
-    this.reject = reject;
-  }.bind(this));
-  Object.freeze(this);
-}
+let Promise = SpecialPowers.Cu.import('resource://gre/modules/Promise.jsm').Promise;
 
 const STOCK_HOSTAPD_NAME = 'goldfish-hostapd';
 const HOSTAPD_CONFIG_PATH = '/data/misc/wifi/remote-hostapd/';
 
 const SETTINGS_RIL_DATA_ENABLED = 'ril.data.enabled';
 const SETTINGS_TETHERING_WIFI_ENABLED = 'tethering.wifi.enabled';
 const SETTINGS_TETHERING_WIFI_IP = 'tethering.wifi.ip';
 const SETTINGS_TETHERING_WIFI_SECURITY = 'tethering.wifi.security.type';

--- a/js/xpconnect/tests/chrome/test_bug760109.xul
+++ b/js/xpconnect/tests/chrome/test_bug760109.xul
@@ -75,21 +75,17 @@ https://bugzilla.mozilla.org/show_bug.cg
     this.baz = 4;
     this.__exposedProps__ = {foo: 'r', baz: 'rw'};
   }
   SomeConstructor.prototype.__exposedProps__ = {};
 
   const Cu = Components.utils;
   var sb = new Cu.Sandbox('http://www.example.org');
   sb.chromeArray = ['a', 'b', 'z'];
-  sb.chromeArray.__exposedProps__ = { length: 'rw' };
-  for (var i = 0; i < 10; ++i) {
-    sb.chromeArray.__exposedProps__[i] = 'rw';
-  }
-
+  sb.chromeArray.__exposedProps__ = {};
   sb.chromeObject = new SomeConstructor();
   sb.ok = ok;
   sb.is = is;
   Cu.evalInSandbox('(' + sandboxCode.toSource() + ')();', sb);
 
   ]]>
   </script>
 </window>

--- a/js/xpconnect/tests/unit/test_bug853709.js
+++ b/js/xpconnect/tests/unit/test_bug853709.js
@@ -2,17 +2,16 @@ const Cu = Components.utils;
 
 function setupChromeSandbox() {
   this.chromeObj = {a: 2, __exposedProps__: {a: "rw", b: "rw"} };
   this._b = 3;
   Object.defineProperty(chromeObj, 'b', { configurable: true,
                                           get: function() { return _b; },
                                           set: function(val) { _b = val; } });
   this.chromeArr = [4, 2, 1];
-  this.chromeArr["__exposedProps__"] = { "1": "rw" };
 }
 
 function checkDefineThrows(sb, obj, prop, desc) {
   var result = Cu.evalInSandbox('(function() { try { Object.defineProperty(' + obj + ', "' + prop + '", ' + desc.toSource() + '); return "nothrow"; } catch (e) { return e.toString(); }})();', sb);
   do_check_neq(result, 'nothrow');
   do_check_true(!!/denied/.exec(result));
   do_check_true(result.indexOf(prop) != -1); // Make sure the prop name is in the error message.
 }

--- a/js/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/xpconnect/wrappers/AccessCheck.cpp
@@ -243,16 +243,24 @@ ExposedPropertiesOnly::check(JSContext *
     //
     // Unfortunately, |cx| can be in either compartment when we call ::check. :-(
     JSAutoCompartment ac(cx, wrappedObject);
 
     bool found = false;
     if (!JS_HasPropertyById(cx, wrappedObject, exposedPropsId, &found))
         return false;
 
+    // Always permit access to "length" and indexed properties of arrays.
+    if ((JS_IsArrayObject(cx, wrappedObject) ||
+         JS_IsTypedArrayObject(wrappedObject)) &&
+        ((JSID_IS_INT(id) && JSID_TO_INT(id) >= 0) ||
+         (JSID_IS_STRING(id) && JS_FlatStringEqualsAscii(JSID_TO_FLAT_STRING(id), "length")))) {
+        return true; // Allow
+    }
+
     // If no __exposedProps__ existed, deny access.
     if (!found) {
         return false;
     }
 
     if (id == JSID_VOID)
         return true;
 

--- a/toolkit/devtools/server/actors/call-watcher.js
+++ b/toolkit/devtools/server/actors/call-watcher.js
@@ -407,23 +407,21 @@ let CallWatcherActor = exports.CallWatch
         return;
       }
     }
 
     /**
      * Instruments a function on the specified target object.
      */
     function overrideFunction(global, target, name, descriptor, callback) {
-      // Invoking .apply on an unxrayed content function doesn't work, because
-      // the arguments array is inaccessible to it. Get Xrays back.
-      let originalFunc = Cu.unwaiveXrays(target[name]);
+      let originalFunc = target[name];
 
       Object.defineProperty(target, name, {
         value: function(...args) {
-          let result = Cu.waiveXrays(originalFunc.apply(this, args));
+          let result = originalFunc.apply(this, args);
 
           if (self._recording) {
             let stack = getStack(name);
             let type = CallWatcherFront.METHOD_FUNCTION;
             callback(unwrappedWindow, global, this, type, name, stack, args, result);
           }
           return result;
         },
@@ -432,25 +430,23 @@ let CallWatcherActor = exports.CallWatch
         writable: true
       });
     }
 
     /**
      * Instruments a getter or setter on the specified target object.
      */
     function overrideAccessor(global, target, name, descriptor, callback) {
-      // Invoking .apply on an unxrayed content function doesn't work, because
-      // the arguments array is inaccessible to it. Get Xrays back.
-      let originalGetter = Cu.unwaiveXrays(target.__lookupGetter__(name));
-      let originalSetter = Cu.unwaiveXrays(target.__lookupSetter__(name));
+      let originalGetter = target.__lookupGetter__(name);
+      let originalSetter = target.__lookupSetter__(name);
 
       Object.defineProperty(target, name, {
         get: function(...args) {
           if (!originalGetter) return undefined;
-          let result = Cu.waiveXrays(originalGetter.apply(this, args));
+          let result = originalGetter.apply(this, args);
 
           if (self._recording) {
             let stack = getStack(name);
             let type = CallWatcherFront.GETTER_FUNCTION;
             callback(unwrappedWindow, global, this, type, name, stack, args, result);
           }
           return result;
         },

--- a/toolkit/devtools/server/actors/webgl.js
+++ b/toolkit/devtools/server/actors/webgl.js
@@ -487,19 +487,17 @@ let WebGLInstrumenter = {
     let afterFuncName = callbackName[1] || callbackName[0] || funcName;
 
     context[funcName] = function(...glArgs) {
       if (timing <= 0 && !observer.suppressHandlers) {
         let glBreak = observer[beforeFuncName](glArgs, cache, proxy);
         if (glBreak) return undefined;
       }
 
-      // Invoking .apply on an unxrayed content function doesn't work, because
-      // the arguments array is inaccessible to it. Get Xrays back.
-      let glResult = Cu.waiveXrays(Cu.unwaiveXrays(originalFunc).apply(this, glArgs));
+      let glResult = originalFunc.apply(this, glArgs);
 
       if (timing >= 0 && !observer.suppressHandlers) {
         let glBreak = observer[afterFuncName](glArgs, glResult, cache, proxy);
         if (glBreak) return undefined;
       }
 
       return glResult;
     };

--- a/toolkit/mozapps/extensions/test/mochitest/test_bug687194.html
+++ b/toolkit/mozapps/extensions/test/mochitest/test_bug687194.html
@@ -55,39 +55,39 @@
       lastResult = yield;
       is(lastResult.threw, true, "URI shouldn't resolve to begin with");
 
       let { AddonManager } = SpecialPowers.Cu.import("resource://gre/modules/AddonManager.jsm", {});
       const INSTALL_URI =
         "http://mochi.test:8888/tests/toolkit/mozapps/extensions/test/mochitest/file_bug687194.xpi"
       AddonManager.getInstallForURL(INSTALL_URI, (install) => {
         install = SpecialPowers.wrap(install);
-        install.addListener(SpecialPowers.wrapCallbackObject({
+        install.addListener({
           onInstallEnded: function(install, addon) {
             SimpleTest.executeSoon(() => test.next(addon));
           }
-        }));
+        });
         install.install();
       }, "application/x-xpinstall");
 
       let addon = SpecialPowers.wrap(yield);
 
       mm.sendAsyncMessage("test687194:resolveChromeURI",
                           { URI: "chrome://bug687194/content/e10sbug.js" });
       lastResult = yield;
       is(lastResult.threw, false, "able to resolve after the installation");
 
-      let listener = SpecialPowers.wrapCallbackObject({
+      let listener = {
         onUninstalled: function(removedAddon) {
-          if (removedAddon.id === addon.id) {
+          if (SpecialPowers.wrap(removedAddon).id === addon.id) {
             AddonManager.removeAddonListener(listener);
             SimpleTest.executeSoon(() => test.next());
           }
         }
-      });
+      };
       AddonManager.addAddonListener(listener);
       addon.uninstall();
 
       yield;
 
       mm.sendAsyncMessage("test687194:resolveChromeURI",
                           { URI: "chrome://bug687194/content/e10sbug.js" });
       lastResult = yield;