--- a/content/base/test/file_mixed_content_main.html
+++ b/content/base/test/file_mixed_content_main.html
@@ -52,17 +52,18 @@ https://bugzilla.mozilla.org/show_bug.cg
   object.width = "200";
   object.height = "200";
 
   testContent.appendChild(object);
 
   var objectCount = 0;
 
   function objectStatus(object) {
-    object instanceof SpecialPowers.Ci.nsIObjectLoadingContent;
+    // Expose our privileged bits on the object
+    object = SpecialPowers.wrap(object);
 
     if (object.displayedType != SpecialPowers.Ci.nsIObjectLoadingContent.TYPE_NULL) {
       //object loaded
       parent.postMessage({"test": "object", "msg": "insecure object loaded"}, "http://mochi.test:8888");
     }
     else {
       if(objectCount < MAX_COUNT) {
         objectCount++;

--- a/content/html/content/src/HTMLObjectElement.cpp
+++ b/content/html/content/src/HTMLObjectElement.cpp
@@ -2,16 +2,17 @@
 // vim:set et sw=2 sts=2 cin:
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/dom/HTMLObjectElement.h"
 #include "mozilla/Util.h"
 
+#include "mozilla/dom/HTMLObjectElementBinding.h"
 #include "nsAutoPtr.h"
 #include "nsAttrValueInlines.h"
 #include "nsGkAtoms.h"
 #include "nsError.h"
 #include "nsIDocument.h"
 #include "nsIPluginDocument.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMSVGDocument.h"
@@ -32,16 +33,18 @@ HTMLObjectElement::HTMLObjectElement(alr
   RegisterFreezableElement();
   SetIsNetworkCreated(aFromParser == FROM_PARSER_NETWORK);
 
   // <object> is always barred from constraint validation.
   SetBarredFromConstraintValidation(true);
 
   // By default we're in the loading state
   AddStatesSilently(NS_EVENT_STATE_LOADING);
+
+  SetIsDOMBinding();
 }
 
 HTMLObjectElement::~HTMLObjectElement()
 {
   UnregisterFreezableElement();
   DestroyImageLoadingContent();
 }
 
@@ -444,14 +447,32 @@ HTMLObjectElement::CopyInnerTo(Element* 
 
   if (aDest->OwnerDoc()->IsStaticDocument()) {
     CreateStaticClone(static_cast<HTMLObjectElement*>(aDest));
   }
 
   return rv;
 }
 
+JSObject*
+HTMLObjectElement::WrapNode(JSContext* aCx, JSObject* aScope,
+                            bool* aTriedToWrap)
+{
+  JSObject* obj = HTMLObjectElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+  if (!obj) {
+    return nullptr;
+  }
+  SetupProtoChain(aCx, obj);
+  return obj;
+}
+
+JSObject*
+HTMLObjectElement::GetCanonicalPrototype(JSContext* aCx, JSObject* aGlobal)
+{
+  return HTMLObjectElementBinding::GetProtoObject(aCx, aGlobal);
+}
+
 } // namespace dom
 } // namespace mozilla
 
 DOMCI_NODE_DATA(HTMLObjectElement, mozilla::dom::HTMLObjectElement)
 
 NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(Object)

--- a/content/html/content/src/HTMLObjectElement.h
+++ b/content/html/content/src/HTMLObjectElement.h
@@ -240,15 +240,20 @@ private:
    * Returns if the element is currently focusable regardless of it's tabindex
    * value. This is used to know the default tabindex value.
    */
   bool IsFocusableForTabIndex();
   
   virtual void GetItemValueText(nsAString& text);
   virtual void SetItemValueText(const nsAString& text);
 
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
+                             bool *aTriedToWrap) MOZ_OVERRIDE;
+  virtual JSObject* GetCanonicalPrototype(JSContext* aCx,
+                                          JSObject* aGlobal) MOZ_OVERRIDE;
+
   bool mIsDoneAddingChildren;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // mozilla_dom_HTMLObjectElement_h

--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -15,16 +15,19 @@
 #include "nsContentUtils.h"
 #include "nsIXPConnect.h"
 #include "WrapperFactory.h"
 #include "xpcprivate.h"
 #include "XPCQuickStubs.h"
 #include "XPCWrapper.h"
 #include "XrayWrapper.h"
 
+#include "mozilla/dom/HTMLObjectElement.h"
+#include "mozilla/dom/HTMLObjectElementBinding.h"
+
 namespace mozilla {
 namespace dom {
 
 JSErrorFormatString ErrorFormatString[] = {
 #define MSG_DEF(_name, _argc, _str) \
   { _str, _argc, JSEXN_TYPEERR },
 #include "mozilla/dom/Errors.msg"
 #undef MSG_DEF
@@ -1525,17 +1528,21 @@ ReparentWrapper(JSContext* aCx, JSObject
   bool preserving = cache->PreservingWrapper();
   cache->SetPreservingWrapper(false);
   cache->SetWrapper(aObj);
   cache->SetPreservingWrapper(preserving);
   if (!JS_CopyPropertiesFrom(aCx, aObj, propertyHolder)) {
     MOZ_CRASH();
   }
 
-  // We might need to call a hook here similar to PostTransplant.
+  HTMLObjectElement* htmlobject;
+  nsresult rv = UnwrapObject<HTMLObjectElement>(aCx, aObj, htmlobject);
+  if (NS_SUCCEEDED(rv)) {
+    htmlobject->SetupProtoChain(aCx, aObj);
+  }
 
   // Now we can just fix up the parent and return the wrapper
 
   if (newParent && !JS_SetParent(aCx, aObj, newParent)) {
     MOZ_CRASH();
   }
 
   return NS_OK;

--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@@ -84,16 +84,17 @@ webidl_files = \
   HTMLLIElement.webidl \
   HTMLLinkElement.webidl \
   HTMLMapElement.webidl \
   HTMLMenuElement.webidl \
   HTMLMenuItemElement.webidl \
   HTMLMetaElement.webidl \
   HTMLMeterElement.webidl \
   HTMLModElement.webidl \
+  HTMLObjectElement.webidl \
   HTMLOListElement.webidl \
   HTMLOptGroupElement.webidl \
   HTMLOptionElement.webidl \
   HTMLOptionsCollection.webidl \
   HTMLOutputElement.webidl \
   HTMLParagraphElement.webidl \
   HTMLParamElement.webidl \
   HTMLPreElement.webidl \