--- a/content/xbl/src/nsXBLProtoImplField.cpp
+++ b/content/xbl/src/nsXBLProtoImplField.cpp
@@ -122,17 +122,17 @@ ValueHasISupportsPrivate(const JS::Value
 
 // Define a shadowing property on |this| for the XBL field defined by the
 // contents of the callee's reserved slots.  If the property was defined,
 // *installed will be true, and idp will be set to the property name that was
 // defined.
 static JSBool
 InstallXBLField(JSContext* cx,
                 JS::Handle<JSObject*> callee, JS::Handle<JSObject*> thisObj,
-                jsid* idp, bool* installed)
+                JS::MutableHandle<jsid> idp, bool* installed)
 {
   *installed = false;
 
   // First ensure |this| is a reasonable XBL bound node.
   //
   // FieldAccessorGuard already determined whether |thisObj| was acceptable as
   // |this| in terms of not throwing a TypeError.  Assert this for good measure.
   MOZ_ASSERT(ValueHasISupportsPrivate(JS::ObjectValue(*thisObj)));
@@ -170,21 +170,21 @@ InstallXBLField(JSContext* cx,
   nsXBLPrototypeBinding* protoBinding;
   nsDependentJSString fieldName;
   {
     JSAutoCompartment ac(cx, callee);
 
     JS::Rooted<JSObject*> xblProto(cx);
     xblProto = &js::GetFunctionNativeReserved(callee, XBLPROTO_SLOT).toObject();
 
-    JS::Value name = js::GetFunctionNativeReserved(callee, FIELD_SLOT);
+    JS::Rooted<JS::Value> name(cx, js::GetFunctionNativeReserved(callee, FIELD_SLOT));
     JSFlatString* fieldStr = JS_ASSERT_STRING_IS_FLAT(name.toString());
     fieldName.init(fieldStr);
 
-    MOZ_ALWAYS_TRUE(JS_ValueToId(cx, name, idp));
+    MOZ_ALWAYS_TRUE(JS_ValueToId(cx, name, idp.address()));
 
     // If a separate XBL scope is being used, the callee is not same-compartment
     // with the xbl prototype, and the object is a cross-compartment wrapper.
     xblProto = js::UnwrapObject(xblProto);
     JSAutoCompartment ac2(cx, xblProto);
     JS::Value slotVal = ::JS_GetReservedSlot(xblProto, 0);
     protoBinding = static_cast<nsXBLPrototypeBinding*>(slotVal.toPrivate());
     MOZ_ASSERT(protoBinding);
@@ -227,17 +227,17 @@ FieldGetterImpl(JSContext *cx, JS::CallA
   // We should be in the compartment of |this|. If we got here via nativeCall,
   // |this| is not same-compartment with |callee|, and it's possible via
   // asymmetric security semantics that |args.calleev()| is actually a security
   // wrapper. In this case, we know we want to do an unsafe unwrap, and
   // InstallXBLField knows how to handle cross-compartment pointers.
   bool installed = false;
   JS::Rooted<JSObject*> callee(cx, js::UnwrapObject(&args.calleev().toObject()));
   JS::Rooted<jsid> id(cx);
-  if (!InstallXBLField(cx, callee, thisObj, id.address(), &installed)) {
+  if (!InstallXBLField(cx, callee, thisObj, &id, &installed)) {
     return false;
   }
 
   if (!installed) {
     args.rval().setUndefined();
     return true;
   }
 
@@ -296,17 +296,17 @@ FieldSetterImpl(JSContext *cx, JS::CallA
   // We should be in the compartment of |this|. If we got here via nativeCall,
   // |this| is not same-compartment with |callee|, and it's possible via
   // asymmetric security semantics that |args.calleev()| is actually a security
   // wrapper. In this case, we know we want to do an unsafe unwrap, and
   // InstallXBLField knows how to handle cross-compartment pointers.
   bool installed = false;
   JS::Rooted<JSObject*> callee(cx, js::UnwrapObject(&args.calleev().toObject()));
   JS::Rooted<jsid> id(cx);
-  if (!InstallXBLField(cx, callee, thisObj, id.address(), &installed)) {
+  if (!InstallXBLField(cx, callee, thisObj, &id, &installed)) {
     return false;
   }
 
   if (installed) {
     JS::Rooted<JS::Value> v(cx,
                             args.length() > 0 ? args[0] : JS::UndefinedValue());
     if (!::JS_SetPropertyById(cx, thisObj, id, v.address())) {
       return false;