--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -2080,17 +2080,17 @@ NonVoidByteStringToJsval(JSContext *cx, 
     return true;
 }
 
 bool
 ConvertJSValueToByteString(JSContext* cx, JS::Handle<JS::Value> v,
                            JS::MutableHandle<JS::Value> pval, bool nullable,
                            nsACString& result)
 {
-  JSString *s;
+  JS::Rooted<JSString*> s(cx);
   if (v.isString()) {
     s = v.toString();
   } else {
 
     if (nullable && v.isNullOrUndefined()) {
       result.SetIsVoid(true);
       return true;
     }

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -6146,28 +6146,34 @@ def getUnionTypeTemplateVars(unionType, 
                     "mUnion.mType = mUnion.eObject;")
         setter = ClassMethod("SetToObject", "void",
                              [Argument("JSContext*", "cx"),
                               Argument("JSObject*", "obj")],
                              inline=True, bodyInHeader=True,
                              body=body)
 
     else:
+        # Important: we need to not have our declName involve
+        # maybe-GCing operations.
         jsConversion = string.Template(conversionInfo.template).substitute(
             {
                 "val": "value",
                 "mutableVal": "pvalue",
-                "declName": "SetAs" + name + "(%s)" % ctorArgs,
+                "declName": "memberSlot",
                 "holderName": "m" + name + "Holder",
                 }
             )
-        jsConversion = CGWrapper(CGGeneric(jsConversion),
-                                 pre="tryNext = false;\n",
-                                 post="\n"
-                                      "return true;")
+        jsConversion = CGWrapper(CGIndenter(CGGeneric(jsConversion)),
+                                 pre=("tryNext = false;\n"
+                                      "{ // scope for memberSlot\n"
+                                      "  %s& memberSlot = SetAs%s(%s);\n"
+                                      % (structType, name, ctorArgs)),
+                                 post=("\n"
+                                       "}\n"
+                                      "return true;"))
         setter = ClassMethod("TrySetTo" + name, "bool",
                               [Argument("JSContext*", "cx"),
                                Argument("JS::Handle<JS::Value>", "value"),
                                Argument("JS::MutableHandle<JS::Value>", "pvalue"),
                                Argument("bool&", "tryNext")],
                               inline=not ownsMembers,
                               bodyInHeader=not ownsMembers,
                               body=jsConversion.define())