--- a/content/xbl/src/nsXBLProtoImplField.cpp
+++ b/content/xbl/src/nsXBLProtoImplField.cpp
@@ -406,17 +406,17 @@ nsXBLProtoImplField::InstallAccessors(JS
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   return NS_OK;
 }
 
 nsresult
 nsXBLProtoImplField::InstallField(nsIScriptContext* aContext,
-                                  JSObject* aBoundNode,
+                                  JS::Handle<JSObject*> aBoundNode,
                                   nsIURI* aBindingDocURI,
                                   bool* aDidInstall) const
 {
   NS_PRECONDITION(aBoundNode,
                   "uh-oh, bound node should NOT be null or bad things will "
                   "happen");
 
   *aDidInstall = false;
@@ -429,55 +429,55 @@ nsXBLProtoImplField::InstallField(nsIScr
   nsAutoMicroTask mt;
 
   // EvaluateString and JS_DefineUCProperty can both trigger GC, so
   // protect |result| here.
   nsresult rv;
 
   nsAutoCString uriSpec;
   aBindingDocURI->GetSpec(uriSpec);
-  
+
   AutoPushJSContext cx(aContext->GetNativeContext());
   NS_ASSERTION(!::JS_IsExceptionPending(cx),
                "Shouldn't get here when an exception is pending!");
-  
+
   // compile the literal string
   nsCOMPtr<nsIScriptContext> context = aContext;
 
   JSAutoRequest ar(cx);
 
   // First, enter the xbl scope, wrap the node, and use that as the scope for
   // the evaluation.
-  JSObject* scopeObject = xpc::GetXBLScope(cx, aBoundNode);
+  JS::Rooted<JSObject*> scopeObject(cx, xpc::GetXBLScope(cx, aBoundNode));
   JSAutoCompartment ac(cx, scopeObject);
-  JS::Value result = JSVAL_NULL;
 
-  JSObject* wrappedNode = aBoundNode;
-  if (!JS_WrapObject(cx, &wrappedNode))
+  JS::Rooted<JSObject*> wrappedNode(cx, aBoundNode);
+  if (!JS_WrapObject(cx, wrappedNode.address()))
       return NS_ERROR_OUT_OF_MEMORY;
 
+  JS::Rooted<JS::Value> result(cx);
   JS::CompileOptions options(cx);
   options.setFileAndLine(uriSpec.get(), mLineNumber)
          .setVersion(JSVERSION_LATEST)
          .setUserBit(true); // Flag us as XBL
   rv = context->EvaluateString(nsDependentString(mFieldText,
                                                  mFieldTextLength),
                                *wrappedNode, options,
                                /* aCoerceToString = */ false,
-                               &result);
+                               result.address());
   if (NS_FAILED(rv)) {
     return rv;
   }
 
 
   // Now, enter the node's compartment, wrap the eval result, and define it on
   // the bound node.
   JSAutoCompartment ac2(cx, aBoundNode);
   nsDependentString name(mName);
-  if (!JS_WrapValue(cx, &result) ||
+  if (!JS_WrapValue(cx, result.address()) ||
       !::JS_DefineUCProperty(cx, aBoundNode,
                              reinterpret_cast<const jschar*>(mName), 
                              name.Length(), result, nullptr, nullptr,
                              mJSAttributes)) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   *aDidInstall = true;

--- a/content/xbl/src/nsXBLProtoImplField.h
+++ b/content/xbl/src/nsXBLProtoImplField.h
@@ -27,17 +27,17 @@ public:
   void SetLineNumber(uint32_t aLineNumber) {
     mLineNumber = aLineNumber;
   }
   
   nsXBLProtoImplField* GetNext() const { return mNext; }
   void SetNext(nsXBLProtoImplField* aNext) { mNext = aNext; }
 
   nsresult InstallField(nsIScriptContext* aContext,
-                        JSObject* aBoundNode,
+                        JS::Handle<JSObject*> aBoundNode,
                         nsIURI* aBindingDocURI,
                         bool* aDidInstall) const;
 
   nsresult InstallAccessors(JSContext* aCx,
                             JS::Handle<JSObject*> aTargetClassObject);
 
   nsresult Read(nsIScriptContext* aContext, nsIObjectInputStream* aStream);
   nsresult Write(nsIScriptContext* aContext, nsIObjectOutputStream* aStream);