--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -1466,34 +1466,34 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWra
 pre_call_clean_up:
     // clean up any 'out' params handed in
     for (i = 0; i < paramCount; i++) {
         const nsXPTParamInfo& param = info->params[i];
         if (!param.IsOut())
             continue;
 
         const nsXPTType& type = param.GetType();
-        if (!type.IsPointer())
+        if (!type.deprecated_IsPointer())
             continue;
         void* p;
         if (!(p = nativeParams[i].val.p))
             continue;
 
         if (param.IsIn()) {
             if (type.IsArray()) {
                 void** pp;
                 if (nsnull != (pp = *((void***)p))) {
 
                     // we need to get the array length and iterate the items
                     JSUint32 array_count;
                     nsXPTType datum_type;
 
                     if (NS_SUCCEEDED(mInfo->GetTypeForParam(methodIndex, &param,
                                                             1, &datum_type)) &&
-                        datum_type.IsPointer() &&
+                        datum_type.deprecated_IsPointer() &&
                         GetArraySizeFromParam(cx, info, param, methodIndex,
                                               i, nativeParams, &array_count) &&
                         array_count) {
 
                         CleanupPointerArray(datum_type, array_count, pp);
                     }
 
                     // always release the array if it is inout
@@ -1695,32 +1695,32 @@ pre_call_clean_up:
         // We didn't manage all the result conversions!
         // We have to cleanup any junk that *did* get converted.
 
         for (uint8 k = 0; k < i; k++) {
             const nsXPTParamInfo& param = info->params[k];
             if (!param.IsOut())
                 continue;
             const nsXPTType& type = param.GetType();
-            if (!type.IsPointer())
+            if (!type.deprecated_IsPointer())
                 continue;
             void* p;
             if (!(p = nativeParams[k].val.p))
                 continue;
 
             if (type.IsArray()) {
                 void** pp;
                 if (nsnull != (pp = *((void***)p))) {
                     // we need to get the array length and iterate the items
                     JSUint32 array_count;
                     nsXPTType datum_type;
 
                     if (NS_SUCCEEDED(mInfo->GetTypeForParam(methodIndex, &param,
                                                             1, &datum_type)) &&
-                        datum_type.IsPointer() &&
+                        datum_type.deprecated_IsPointer() &&
                         GetArraySizeFromParam(cx, info, param, methodIndex,
                                               k, nativeParams, &array_count) &&
                         array_count) {
 
                         CleanupPointerArray(datum_type, array_count, pp);
                     }
                     nsMemory::Free(pp);
                 }

--- a/xpcom/reflect/xptinfo/public/xptinfo.h
+++ b/xpcom/reflect/xptinfo/public/xptinfo.h
@@ -72,19 +72,34 @@ public:
         {return flags;}
 
     bool IsPointer() const
         {return 0 != (XPT_TDP_IS_POINTER(flags));}
 
     bool IsReference() const
         {return 0 != (XPT_TDP_IS_REFERENCE(flags));}
 
-    bool IsArithmetic() const     // terminology from Harbison/Steele
+    // 'Arithmetic' here roughly means that the value is self-contained and
+    // doesn't depend on anything else in memory (ie: not a pointer, not an
+    // XPCOM object, not a jsval, etc).
+    //
+    // Supposedly this terminology comes from Harbison/Steele, but it's still
+    // a rather crappy name. We'd change it if it wasn't used all over the
+    // place in xptcall. :-(
+    bool IsArithmetic() const
         {return flags <= T_WCHAR;}
 
+    // We used to abuse 'pointer' flag bit in typelib format quite extensively.
+    // We've gotten rid of most of the cases, but there's still a fair amount
+    // of refactoring to be done in XPCWrappedJSClass before we can safely stop
+    // asking about this. In the mean time, we've got a temporary version of
+    // IsPointer() that should be equivalent to what's in the typelib.
+    bool deprecated_IsPointer() const
+        {return !IsArithmetic() && TagPart() != T_JSVAL;}
+
     bool IsInterfacePointer() const
         {  switch (TagPart()) {
              default:
                return false;
              case T_INTERFACE:
              case T_INTERFACE_IS:
                return true;
            }