--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -867,67 +867,26 @@ GetNativePropertyHooks(JSContext *cx, JS
 
   MOZ_ASSERT(IsDOMIfaceAndProtoClass(js::GetObjectClass(obj)));
   const DOMIfaceAndProtoJSClass* ifaceAndProtoJSClass =
     DOMIfaceAndProtoJSClass::FromJSClass(js::GetObjectClass(obj));
   type = ifaceAndProtoJSClass->mType;
   return ifaceAndProtoJSClass->mNativeHooks;
 }
 
-// Try to resolve a property as an unforgeable property from the given
-// NativeProperties, if it's there.  nativeProperties is allowed to be null (in
-// which case we of course won't resolve anything).
-static bool
-XrayResolveUnforgeableProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
-                               JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
-                               JS::MutableHandle<JSPropertyDescriptor> desc,
-                               const NativeProperties* nativeProperties);
-
-static bool
-XrayResolveNativeProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
-                          const NativePropertyHooks* nativePropertyHooks,
-                          DOMObjectType type, JS::Handle<JSObject*> obj,
-                          JS::Handle<jsid> id,
-                          JS::MutableHandle<JSPropertyDescriptor> desc);
-
 bool
 XrayResolveOwnProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
                        JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
                        JS::MutableHandle<JSPropertyDescriptor> desc, unsigned flags)
 {
   DOMObjectType type;
   const NativePropertyHooks *nativePropertyHooks =
     GetNativePropertyHooks(cx, obj, type);
 
-  if (type != eInstance) {
-    // For prototype objects and interface objects, just return their
-    // normal set of properties.
-    return XrayResolveNativeProperty(cx, wrapper, nativePropertyHooks, type,
-                                     obj, id, desc);
-  }
-
-  // Check for unforgeable properties before doing mResolveOwnProperty weirdness
-  const NativePropertiesHolder& nativeProperties =
-    nativePropertyHooks->mNativeProperties;
-  if (!XrayResolveUnforgeableProperty(cx, wrapper, obj, id, desc,
-                                      nativeProperties.regular)) {
-    return false;
-  }
-  if (desc.object()) {
-    return true;
-  }
-  if (!XrayResolveUnforgeableProperty(cx, wrapper, obj, id, desc,
-                                      nativeProperties.chromeOnly)) {
-    return false;
-  }
-  if (desc.object()) {
-    return true;
-  }
-
-  return !nativePropertyHooks->mResolveOwnProperty ||
+  return type != eInstance || !nativePropertyHooks->mResolveOwnProperty ||
          nativePropertyHooks->mResolveOwnProperty(cx, wrapper, obj, id, desc, flags);
 }
 
 static bool
 XrayResolveAttribute(JSContext* cx, JS::Handle<JSObject*> wrapper,
                      JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
                      const Prefable<const JSPropertySpec>* attributes, jsid* attributeIds,
                      const JSPropertySpec* attributeSpecs, JS::MutableHandle<JSPropertyDescriptor> desc)
@@ -972,30 +931,16 @@ XrayResolveAttribute(JSContext* cx, JS::
           return true;
         }
       }
     }
   }
   return true;
 }
 
-/* static */ bool
-XrayResolveUnforgeableProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
-                               JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
-                               JS::MutableHandle<JSPropertyDescriptor> desc,
-                               const NativeProperties* nativeProperties)
-{
-  return !nativeProperties || !nativeProperties->unforgeableAttributes ||
-         XrayResolveAttribute(cx, wrapper, obj, id,
-                              nativeProperties->unforgeableAttributes,
-                              nativeProperties->unforgeableAttributeIds,
-                              nativeProperties->unforgeableAttributeSpecs,
-                              desc);
-}
-
 static bool
 XrayResolveProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
                     JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
                     JS::MutableHandle<JSPropertyDescriptor> desc, DOMObjectType type,
                     const NativeProperties* nativeProperties)
 {
   const Prefable<const JSFunctionSpec>* methods;
   jsid* methodIds;
@@ -1058,16 +1003,28 @@ XrayResolveProperty(JSContext* cx, JS::H
                                 nativeProperties->attributeIds,
                                 nativeProperties->attributeSpecs, desc)) {
         return false;
       }
       if (desc.object()) {
         return true;
       }
     }
+    if (nativeProperties->unforgeableAttributes) {
+      if (!XrayResolveAttribute(cx, wrapper, obj, id,
+                                nativeProperties->unforgeableAttributes,
+                                nativeProperties->unforgeableAttributeIds,
+                                nativeProperties->unforgeableAttributeSpecs,
+                                desc)) {
+        return false;
+      }
+      if (desc.object()) {
+        return true;
+      }
+    }
   }
 
   if (nativeProperties->constants) {
     const Prefable<const ConstantSpec>* constant;
     for (constant = nativeProperties->constants; constant->specs; ++constant) {
       if (constant->isEnabled(cx, obj)) {
         // Set i to be the index into our full list of ids/specs that we're
         // looking at now.
@@ -1106,17 +1063,17 @@ ResolvePrototypeOrConstructor(JSContext*
     desc.setAttributes(attrs);
     desc.setGetter(JS_PropertyStub);
     desc.setSetter(JS_StrictPropertyStub);
     desc.value().set(JS::ObjectValue(*protoOrIface));
   }
   return JS_WrapPropertyDescriptor(cx, desc);
 }
 
-/* static */ bool
+bool
 XrayResolveNativeProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
                           const NativePropertyHooks* nativePropertyHooks,
                           DOMObjectType type, JS::Handle<JSObject*> obj,
                           JS::Handle<jsid> id,
                           JS::MutableHandle<JSPropertyDescriptor> desc)
 {
   if (type == eInterface && IdEquals(id, "prototype")) {
     return nativePropertyHooks->mPrototypeID == prototypes::id::_ID_Count ||
@@ -1942,20 +1899,19 @@ InterfaceHasInstance(JSContext* cx, int 
              "Why do we have a hasInstance hook if we don't have a prototype "
              "ID?");
 
   *bp = (domClass && domClass->mInterfaceChain[depth] == prototypeID);
   return true;
 }
 
 bool
-ReportLenientThisUnwrappingFailure(JSContext* cx, JSObject* obj)
+ReportLenientThisUnwrappingFailure(JSContext* cx, JS::Handle<JSObject*> obj)
 {
-  JS::Rooted<JSObject*> rootedObj(cx, obj);
-  GlobalObject global(cx, rootedObj);
+  GlobalObject global(cx, obj);
   if (global.Failed()) {
     return false;
   }
   nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(global.GetAsSupports());
   if (window && window->GetDoc()) {
     window->GetDoc()->WarnOnceAbout(nsIDocument::eLenientThis);
   }
   return true;

--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -2057,17 +2057,17 @@ InterfaceHasInstance(JSContext* cx, JS::
 bool
 InterfaceHasInstance(JSContext* cx, int prototypeID, int depth,
                      JS::Handle<JSObject*> instance,
                      bool* bp);
 
 // Helper for lenient getters/setters to report to console.  If this
 // returns false, we couldn't even get a global.
 bool
-ReportLenientThisUnwrappingFailure(JSContext* cx, JSObject* obj);
+ReportLenientThisUnwrappingFailure(JSContext* cx, JS::Handle<JSObject*> obj);
 
 inline JSObject*
 GetUnforgeableHolder(JSObject* aGlobal, prototypes::ID aId)
 {
   JS::Heap<JSObject*>* protoAndIfaceArray = GetProtoAndIfaceArray(aGlobal);
   JSObject* interfaceProto = protoAndIfaceArray[aId];
   return &js::GetReservedSlot(interfaceProto,
                               DOM_INTERFACE_PROTO_SLOTS_BASE).toObject();

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -5316,65 +5316,40 @@ class CGSetterCall(CGPerSignatureCall):
 
 class CGAbstractBindingMethod(CGAbstractStaticMethod):
     """
     Common class to generate the JSNatives for all our methods, getters, and
     setters.  This will generate the function declaration and unwrap the
     |this| object.  Subclasses are expected to override the generate_code
     function to do the rest of the work.  This function should return a
     CGThing which is already properly indented.
-
-    getThisObj should be code for getting a JSObject* for the binding
-    object.  If this is None, we will auto-generate code based on
-    descriptor to do the right thing.  "" can be passed in if the
-    binding object is already stored in 'obj'.
-
-    callArgs should be code for getting a JS::CallArgs into a variable
-    called 'args'.  This can be "" if there is already such a variable
-    around.
     """
     def __init__(self, descriptor, name, args, unwrapFailureCode=None,
-                 getThisObj=None,
+                 getThisObj="args.computeThis(cx).toObjectOrNull()",
                  callArgs="JS::CallArgs args = JS::CallArgsFromVp(argc, vp);"):
         CGAbstractStaticMethod.__init__(self, descriptor, name, "bool", args)
 
         if unwrapFailureCode is None:
             self.unwrapFailureCode = 'return ThrowErrorMessage(cx, MSG_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "Value", "%s");' % descriptor.interface.identifier.name
         else:
             self.unwrapFailureCode = unwrapFailureCode
-
-        if getThisObj == "":
-            self.getThisObj = None
-        else:
-            if getThisObj is None:
-                if descriptor.interface.isOnGlobalProtoChain():
-                    ensureCondition = "!args.thisv().isNullOrUndefined() && !args.thisv().isObject()"
-                    getThisObj = "args.thisv().isObject() ? &args.thisv().toObject() : js::GetGlobalForObjectCrossCompartment(&args.callee())"
-                else:
-                    ensureCondition = "!args.thisv().isObject()"
-                    getThisObj = "&args.thisv().toObject()"
-                ensureThisObj = CGIfWrapper(CGGeneric(self.unwrapFailureCode),
-                                            ensureCondition)
-            else:
-                ensureThisObj = None
-            self.getThisObj = CGList(
-                [ensureThisObj,
-                 CGGeneric("JS::RootedObject obj(cx, %s);\n" %
-                           getThisObj)],
-                "\n")
+        self.getThisObj = getThisObj
         self.callArgs = callArgs
 
     def definition_body(self):
         # Our descriptor might claim that we're not castable, simply because
         # we're someone's consequential interface.  But for this-unwrapping, we
         # know that we're the real deal.  So fake a descriptor here for
         # consumption by CastableObjectUnwrapper.
         getThis = CGList([
                 CGGeneric(self.callArgs) if self.callArgs != "" else None,
-                self.getThisObj,
+                CGGeneric("JS::RootedObject obj(cx, %s);\n"
+                          "if (!obj) {\n"
+                          "  return false;\n"
+                          "}" % self.getThisObj) if self.getThisObj else None,
                 CGGeneric("%s* self;" % self.descriptor.nativeType)
                 ], "\n")
         unwrapThis = CGGeneric(
             str(CastableObjectUnwrapper(
                         self.descriptor,
                         "obj", "self", self.unwrapFailureCode)))
         return CGList([ CGIndenter(getThis), CGIndenter(unwrapThis),
                         self.generate_code() ], "\n").define()
@@ -5605,17 +5580,17 @@ class CGGenericGetter(CGAbstractBindingM
     """
     def __init__(self, descriptor, lenientThis=False):
         args = [Argument('JSContext*', 'cx'), Argument('unsigned', 'argc'),
                 Argument('JS::Value*', 'vp')]
         if lenientThis:
             name = "genericLenientGetter"
             unwrapFailureCode = (
                 "MOZ_ASSERT(!JS_IsExceptionPending(cx));\n"
-                "if (!ReportLenientThisUnwrappingFailure(cx, &args.callee())) {\n"
+                "if (!ReportLenientThisUnwrappingFailure(cx, obj)) {\n"
                 "  return false;\n"
                 "}\n"
                 "args.rval().set(JS::UndefinedValue());\n"
                 "return true;")
         else:
             name = "genericGetter"
             unwrapFailureCode = (
                 'return ThrowInvalidThis(cx, args, MSG_GETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
@@ -5685,17 +5660,17 @@ class CGGenericSetter(CGAbstractBindingM
     """
     def __init__(self, descriptor, lenientThis=False):
         args = [Argument('JSContext*', 'cx'), Argument('unsigned', 'argc'),
                 Argument('JS::Value*', 'vp')]
         if lenientThis:
             name = "genericLenientSetter"
             unwrapFailureCode = (
                 "MOZ_ASSERT(!JS_IsExceptionPending(cx));\n"
-                "if (!ReportLenientThisUnwrappingFailure(cx, &args.callee())) {\n"
+                "if (!ReportLenientThisUnwrappingFailure(cx, obj)) {\n"
                 "  return false;\n"
                 "}\n"
                 "args.rval().set(JS::UndefinedValue());\n"
                 "return true;")
         else:
             name = "genericSetter"
             unwrapFailureCode = (
                 'return ThrowInvalidThis(cx, args, MSG_SETTER_THIS_DOES_NOT_IMPLEMENT_INTERFACE, "%s");' %
@@ -7300,51 +7275,73 @@ class CGDOMJSProxyHandler_getOwnProperty
             readonly = toStringBool(indexedSetter is None)
             fillDescriptor = "FillPropertyDescriptor(desc, proxy, %s);\nreturn true;" % readonly
             templateValues = {'jsvalRef': 'desc.value()', 'jsvalHandle': 'desc.value()',
                               'obj': 'proxy', 'successCode': fillDescriptor}
             get = ("if (IsArrayIndex(index)) {\n" +
                    CGIndenter(CGProxyIndexedGetter(self.descriptor, templateValues)).define() + "\n" +
                    "}\n") % (self.descriptor.nativeType)
 
+        if UseHolderForUnforgeable(self.descriptor):
+            getUnforgeable = """if (!JS_GetPropertyDescriptorById(cx, ${holder}, id, flags, desc)) {
+  return false;
+}
+MOZ_ASSERT_IF(desc.object(), desc.object() == ${holder});"""
+            getUnforgeable = CallOnUnforgeableHolder(self.descriptor,
+                                                     getUnforgeable, "isXray")
+            getUnforgeable += """if (desc.object()) {
+  desc.object().set(proxy);
+  return !isXray || JS_WrapPropertyDescriptor(cx, desc);
+}
+
+"""
+        else:
+            getUnforgeable = ""
+
         if indexedSetter or self.descriptor.operations['NamedSetter']:
             setOrIndexedGet += "if (flags & JSRESOLVE_ASSIGNING) {\n"
             if indexedSetter:
                 setOrIndexedGet += ("  if (IsArrayIndex(index)) {\n")
                 if not 'IndexedCreator' in self.descriptor.operations:
                     # FIXME need to check that this is a 'supported property
                     # index'.  But if that happens, watch out for the assumption
                     # below that the name setter always returns for
                     # IsArrayIndex(index).
                     assert False
                 setOrIndexedGet += ("    FillPropertyDescriptor(desc, proxy, JSVAL_VOID, false);\n" +
                                     "    return true;\n" +
                                     "  }\n")
+            setOrIndexedGet += CGIndenter(CGGeneric(getUnforgeable)).define()
             if self.descriptor.operations['NamedSetter']:
                 if not 'NamedCreator' in self.descriptor.operations:
                     # FIXME need to check that this is a 'supported property name'
                     assert False
                 create = CGGeneric("FillPropertyDescriptor(desc, proxy, JSVAL_VOID, false);\n"
                                    "return true;")
                 # If we have an indexed setter we've already returned
                 if (self.descriptor.supportsIndexedProperties() and
                     not indexedSetter):
                     create = CGIfWrapper(create, "!IsArrayIndex(index)")
                 setOrIndexedGet += CGIndenter(create).define() + "\n"
             setOrIndexedGet += "}"
             if indexedGetter:
                 setOrIndexedGet += (" else {\n" +
-                                    CGIndenter(CGGeneric(get)).define() +
+                                    CGIndenter(CGGeneric(get + "\n" + getUnforgeable)).define() +
+                                    "}")
+            else:
+                setOrIndexedGet += (" else {\n" +
+                                    CGIndenter(CGGeneric(getUnforgeable)).define() +
                                     "}")
             setOrIndexedGet += "\n\n"
         else:
             if indexedGetter:
                 setOrIndexedGet += ("if (!(flags & JSRESOLVE_ASSIGNING)) {\n" +
                                     CGIndenter(CGGeneric(get)).define() +
                                     "}\n\n")
+            setOrIndexedGet += getUnforgeable
 
         if self.descriptor.supportsNamedProperties():
             readonly = toStringBool(self.descriptor.operations['NamedSetter'] is None)
             fillDescriptor = "FillPropertyDescriptor(desc, proxy, %s);\nreturn true;" % readonly
             templateValues = {'jsvalRef': 'desc.value()', 'jsvalHandle': 'desc.value()',
                               'obj': 'proxy', 'successCode': fillDescriptor}
             condition = "!HasPropertyOnPrototype(cx, proxy, id)"
             if self.descriptor.interface.getExtendedAttribute('OverrideBuiltins'):

--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -518,17 +518,16 @@ class IDLInterface(IDLObjectWithScope):
         # self.interfacesBasedOnSelf is the set of interfaces that inherit from
         # self or have self as a consequential interface, including self itself.
         # Used for distinguishability checking.
         self.interfacesBasedOnSelf = set([self])
         # self.interfacesImplementingSelf is the set of interfaces that directly
         # have self as a consequential interface
         self.interfacesImplementingSelf = set()
         self._hasChildInterfaces = False
-        self._isOnGlobalProtoChain = False
 
         IDLObjectWithScope.__init__(self, location, parentScope, name)
 
         if not isPartial:
             self.setNonPartial(location, parent, members)
         else:
             # Just remember our members for now
             self.members = members
@@ -582,25 +581,16 @@ class IDLInterface(IDLObjectWithScope):
 
         assert iter(self.members)
 
         if self.parent:
             self.parent.finish(scope)
 
             self.parent._hasChildInterfaces = True
 
-            # Interfaces with [Global] must not have anything inherit from them
-            if self.parent.getExtendedAttribute("Global"):
-                # Note: This is not a self.parent.isOnGlobalProtoChain() check
-                # because ancestors of a [Global] interface can have other
-                # descendants.
-                raise WebIDLError("[Global] interface has another interface "
-                                  "inheriting from it",
-                                  [self.location, self.parent.location])
-
             # Callbacks must not inherit from non-callbacks or inherit from
             # anything that has consequential interfaces.
             # XXXbz Can non-callbacks inherit from callbacks?  Spec issue pending.
             # XXXbz Can callbacks have consequential interfaces?  Spec issue pending
             if self.isCallback():
                 if not self.parent.isCallback():
                     raise WebIDLError("Callback interface %s inheriting from "
                                       "non-callback interface %s" %
@@ -746,41 +736,16 @@ class IDLInterface(IDLObjectWithScope):
             if memberType in specialMembersSeen:
                 raise WebIDLError("Multiple " + memberType + " on %s" % (self),
                                    [self.location,
                                     specialMembersSeen[memberType].location,
                                     member.location])
 
             specialMembersSeen[memberType] = member
 
-        if self._isOnGlobalProtoChain:
-            # Make sure we have no named setters, creators, or deleters
-            for memberType in ["setter", "creator", "deleter"]:
-                memberId = "named " + memberType + "s"
-                if memberId in specialMembersSeen:
-                    raise WebIDLError("Interface with [Global] has a named %s" %
-                                      memberType,
-                                      [self.location,
-                                       specialMembersSeen[memberId].location])
-            # Make sure we're not [OverrideBuiltins]
-            if self.getExtendedAttribute("OverrideBuiltins"):
-                raise WebIDLError("Interface with [Global] also has "
-                                  "[OverrideBuiltins]",
-                                  [self.location])
-            # Mark all of our ancestors as being on the global's proto chain too
-            parent = self.parent
-            while parent:
-                # Must not inherit from an interface with [OverrideBuiltins]
-                if parent.getExtendedAttribute("OverrideBuiltins"):
-                    raise WebIDLError("Interface with [Global] inherits from "
-                                      "interface with [OverrideBuiltins]",
-                                      [self.location, parent.location])
-                parent._isOnGlobalProtoChain = True
-                parent = parent.parent
-
     def validate(self):
         for member in self.members:
             member.validate()
 
             # Check that PutForwards refers to another attribute and that no
             # cycles exist in forwarded assignments.
             if member.isAttr():
                 iface = self
@@ -954,21 +919,16 @@ class IDLInterface(IDLObjectWithScope):
             elif (identifier == "ArrayClass"):
                 if not attr.noArguments():
                     raise WebIDLError("[ArrayClass] must take no arguments",
                                       [attr.location])
                 if self.parent:
                     raise WebIDLError("[ArrayClass] must not be specified on "
                                       "an interface with inherited interfaces",
                                       [attr.location, self.location])
-            elif identifier == "Global":
-                if not attr.noArguments():
-                    raise WebIDLError("[Global] must take no arguments",
-                                      [attr.location])
-                self._isOnGlobalProtoChain = True
             elif (identifier == "PrefControlled" or
                   identifier == "NeedNewResolve" or
                   identifier == "OverrideBuiltins" or
                   identifier == "ChromeOnly"):
                 # Known extended attributes that do not take values
                 if not attr.noArguments():
                     raise WebIDLError("[%s] must take no arguments" % identifier,
                                       [attr.location])
@@ -1077,19 +1037,16 @@ class IDLInterface(IDLObjectWithScope):
         assert len(naviProp) == 1
         assert isinstance(naviProp, list)
         assert len(naviProp[0]) != 0
         return naviProp[0]
 
     def hasChildInterfaces(self):
         return self._hasChildInterfaces
 
-    def isOnGlobalProtoChain(self):
-        return self._isOnGlobalProtoChain
-
     def _getDependentObjects(self):
         deps = set(self.members)
         deps.union(self.implementedInterfaces)
         if self.parent:
             deps.add(self.parent)
         return deps
 
 class IDLDictionary(IDLObjectWithScope):

deleted file mode 100644
--- a/dom/bindings/parser/tests/test_global_extended_attr.py
+++ /dev/null
@@ -1,122 +0,0 @@
-def WebIDLTest(parser, harness):
-    parser.parse("""
-      [Global]
-      interface Foo : Bar {
-        getter any(DOMString name);
-      };
-      interface Bar {};
-    """)
-
-    results = parser.finish()
-
-    harness.ok(results[0].isOnGlobalProtoChain(),
-               "[Global] interface should be on global's proto chain")
-    harness.ok(results[1].isOnGlobalProtoChain(),
-               "[Global] interface should be on global's proto chain")
-
-    parser = parser.reset()
-    threw = False
-    try:
-        parser.parse("""
-          [Global]
-          interface Foo {
-            getter any(DOMString name);
-            setter void(DOMString name, any arg);
-          };
-        """)
-        results = parser.finish()
-    except:
-        threw = True
-
-    harness.ok(threw,
-               "Should have thrown for [Global] used on an interface with a "
-               "named setter")
-
-    parser = parser.reset()
-    threw = False
-    try:
-        parser.parse("""
-          [Global]
-          interface Foo {
-            getter any(DOMString name);
-            creator void(DOMString name, any arg);
-          };
-        """)
-        results = parser.finish()
-    except:
-        threw = True
-
-    harness.ok(threw,
-               "Should have thrown for [Global] used on an interface with a "
-               "named creator")
-
-    parser = parser.reset()
-    threw = False
-    try:
-        parser.parse("""
-          [Global]
-          interface Foo {
-            getter any(DOMString name);
-            deleter void(DOMString name);
-          };
-        """)
-        results = parser.finish()
-    except:
-        threw = True
-
-    harness.ok(threw,
-               "Should have thrown for [Global] used on an interface with a "
-               "named deleter")
-
-    parser = parser.reset()
-    threw = False
-    try:
-        parser.parse("""
-          [Global, OverrideBuiltins]
-          interface Foo {
-          };
-        """)
-        results = parser.finish()
-    except:
-        threw = True
-
-    harness.ok(threw,
-               "Should have thrown for [Global] used on an interface with a "
-               "[OverrideBuiltins]")
-
-    parser = parser.reset()
-    threw = False
-    try:
-        parser.parse("""
-          [Global]
-          interface Foo : Bar {
-          };
-          [OverrideBuiltins]
-          interface Bar {
-          };
-        """)
-        results = parser.finish()
-    except:
-        threw = True
-
-    harness.ok(threw,
-               "Should have thrown for [Global] used on an interface with an "
-               "[OverrideBuiltins] ancestor")
-
-    parser = parser.reset()
-    threw = False
-    try:
-        parser.parse("""
-          [Global]
-          interface Foo {
-          };
-          interface Bar : Foo {
-          };
-        """)
-        results = parser.finish()
-    except:
-        threw = True
-
-    harness.ok(threw,
-               "Should have thrown for [Global] used on an interface with a "
-               "descendant")

--- a/dom/bindings/test/Makefile.in
+++ b/dom/bindings/test/Makefile.in
@@ -63,23 +63,21 @@ MOCHITEST_FILES := \
   test_bug852846.html \
   test_bug862092.html \
   test_bug560072.html \
   test_lenientThis.html \
   test_ByteString.html \
   test_exception_messages.html \
   test_bug707564.html \
   test_defineProperty.html \
-  file_document_location_set_via_xray.html \
   $(NULL)
 
 MOCHITEST_CHROME_FILES = \
   test_bug775543.html \
   test_bug707564-chrome.html \
-  test_document_location_set_via_xray.html \
   $(NULL)
 
 ifdef GNU_CC
 CXXFLAGS += -Wno-uninitialized
 endif
 
 # Include rules.mk before any of our targets so our first target is coming from
 # rules.mk and running make with no target in this dir does the right thing.

deleted file mode 100644
--- a/dom/bindings/test/file_document_location_set_via_xray.html
+++ /dev/null
@@ -1,5 +0,0 @@
-<body>
-<script>
-document.x = 5;
-</script>
-</body>

deleted file mode 100644
--- a/dom/bindings/test/test_document_location_set_via_xray.html
+++ /dev/null
@@ -1,49 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=905493
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Bug 905493</title>
-  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=905493">Mozilla Bug 905493</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-<iframe id="t" src="http://example.org/tests/dom/bindings/test/file_document_location_set_via_xray.html"></iframe>
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 905493 **/
-
-function test()
-{
-  var doc = document.getElementById("t").contentWindow.document;
-  ok(!("x" in doc), "Should have an Xray here");
-  is(doc.x, undefined, "Really should have an Xray here");
-  is(doc.wrappedJSObject.x, 5, "And wrapping the right thing");
-  document.getElementById("t").onload = function() {
-    ok(true, "Load happened");
-    SimpleTest.finish();
-  };
-  try {
-    // Test the forwarding location setter
-    doc.location = "chrome://mochikit/content/tests/SimpleTest/test.css";
-  } catch (e) {
-    // Load failed
-    ok(false, "Load failed");
-    SimpleTest.finish();
-  }
-}
-
-SimpleTest.waitForExplicitFinish();
-addLoadEvent(test);
-
-</script>
-</pre>
-</body>
-</html>

--- a/dom/tests/mochitest/chrome/test_sandbox_bindings.xul
+++ b/dom/tests/mochitest/chrome/test_sandbox_bindings.xul
@@ -44,24 +44,16 @@ https://bugzilla.mozilla.org/show_bug.cg
       } catch (e) {
         ok(false, "'EventTarget' shouldn't throw in a sandbox");
       }
       try {
         var xhr = Components.utils.evalInSandbox("XMLHttpRequest.prototype", sandbox);
         ok(xhr, "'XMLHttpRequest.prototype' in a sandbox should return the XMLHttpRequest interface prototype object");
         ok(isXrayWrapper(xhr), "Getting an interface prototype object on an Xray wrapper should return an Xray wrapper");
         ok(isXrayWrapper(xhr.constructor), "Getting the constructor property on an Xray wrapper of an interface prototype object should return an Xray wrapper");
-        isnot(Object.getOwnPropertyDescriptor(xhr, "send"), undefined,
-              "We should claim to have a send() method");
-        isnot(Object.keys(xhr).indexOf("responseType"), -1,
-              "We should claim to have a responseType property");
-        isnot(Object.getOwnPropertyNames(xhr).indexOf("open"), -1,
-              "We should claim to have an open() method");
-        isnot(Object.getOwnPropertyDescriptor(xhr, "constructor"), undefined,
-              "We should claim to have a 'constructor' property");
       } catch (e) {
         ok(false, "'XMLHttpRequest.prototype' shouldn't throw in a sandbox");
       }
       try {
         var img = Components.utils.evalInSandbox("Image.prototype", sandbox);
         ok(img, "'Image.prototype' in a sandbox should return the interface prototype object");
         ok(isXrayWrapper(img), "Getting an interface prototype object on an Xray wrapper should return an Xray wrapper");
       } catch (e) {
@@ -90,24 +82,16 @@ https://bugzilla.mozilla.org/show_bug.cg
         delete xhr.constructor;
       } catch (e) {
         is(xhr.constructor, undefined, "'XMLHttpRequest.prototype.constructor' should be permanent");
       }
       try {
         var xhr = Components.utils.evalInSandbox("XMLHttpRequest", sandbox);
         is(xhr, "[object XrayWrapper " + XMLHttpRequest + "]", "'XMLHttpRequest' in a sandbox should return the XMLHttpRequest interface object");
         ok(isXrayWrapper(xhr.prototype), "Getting the prototype property on an Xray wrapper of an interface object should return an Xray wrapper");
-        isnot(Object.getOwnPropertyDescriptor(xhr, "UNSENT"), undefined,
-              "We should claim to have an UNSENT constant");
-        isnot(Object.keys(xhr).indexOf("OPENED"), -1,
-              "We should claim to have an OPENED constant");
-        isnot(Object.getOwnPropertyNames(xhr).indexOf("DONE"), -1,
-              "We should claim to have a DONE constant");
-        isnot(Object.getOwnPropertyDescriptor(xhr, "prototype"), undefined,
-              "We should claim to have 'prototype' property");
       } catch (e) {
         ok(false, "'XMLHttpRequest' shouldn't throw in a sandbox");
       }
       try {
         var xhr = Components.utils.evalInSandbox("XMLHttpRequest()", sandbox);
         is("" + xhr, "[object XrayWrapper " + XMLHttpRequest() + "]", "'XMLHttpRequest()' in a sandbox should create an XMLHttpRequest object");
       } catch (e) {
         ok(false, "'XMLHttpRequest()' shouldn't throw in a sandbox");

--- a/dom/webidl/DummyBinding.webidl
+++ b/dom/webidl/DummyBinding.webidl
@@ -2,18 +2,17 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
 // Dummy bindings that we need to force generation of things that
 // aren't actually referenced anywhere in IDL yet but are used in C++.
 
-[Global]
-interface DummyInterface : EventTarget {
+interface DummyInterface {
   readonly attribute OnErrorEventHandlerNonNull onErrorEventHandler;
   FilePropertyBag fileBag();
   InspectorRGBTriple rgbTriple();
   Function getFunction();
   void funcSocketsDict(optional SocketsDict arg);
   void funcHttpConnDict(optional HttpConnDict arg);
   void funcWebSocketDict(optional WebSocketDict arg);
   void funcDNSCacheDict(optional DNSCacheDict arg);