--- a/dom/bindings/CallbackFunction.h
+++ b/dom/bindings/CallbackFunction.h
@@ -83,16 +83,26 @@ public:
 
   bool HasGrayCallable() const
   {
     // Play it safe in case this gets called after unlink.
     return mCallable && xpc_IsGrayGCThing(mCallable);
   }
 
 protected:
+  explicit CallbackFunction(CallbackFunction* aCallbackFunction)
+    : mCallable(aCallbackFunction->mCallable)
+  {
+    // Set mCallable before we hold, on the off chance that a GC could somehow
+    // happen in there... (which would be pretty odd, granted).
+    // Make sure we'll be able to drop as needed
+    nsLayoutStatics::AddRef();
+    NS_HOLD_JS_OBJECTS(this, CallbackFunction);
+  }
+
   void DropCallback()
   {
     if (mCallable) {
       mCallable = nullptr;
       NS_DROP_JS_OBJECTS(this, CallbackFunction);
       nsLayoutStatics::Release();
     }
   }

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -7373,17 +7373,17 @@ class CGCallbackFunction(CGClass):
             # same return type as what CallCallback generates.  So we want to
             # take advantage of all its CGNativeMember infrastructure, but that
             # infrastructure can't deal with templates and most especially
             # template arguments.  So just cheat and have CallCallback compute
             # all those things for us.
             callCallback = CallCallback(callback, descriptorProvider)
             CGClass.__init__(self, name,
                              bases=[ClassBase("CallbackFunction")],
-                             constructors=[self.getConstructor()],
+                             constructors=self.getConstructors(),
                              methods=self.getCallImpls(callCallback))
             self.generatable = True
         except NoSuchDescriptorError, err:
             if not descriptorProvider.workers:
                 raise err
             self.generatable = False
 
     def define(self):
@@ -7391,28 +7391,36 @@ class CGCallbackFunction(CGClass):
             return ""
         return CGClass.define(self)
 
     def declare(self):
         if not self.generatable:
             return ""
         return CGClass.declare(self)
 
-    def getConstructor(self):
-        return ClassConstructor(
+    def getConstructors(self):
+        return [ClassConstructor(
             [Argument("JSContext*", "cx"),
              Argument("JSObject*", "aOwner"),
              Argument("JSObject*", "aCallable"),
              Argument("bool*", "aInited")],
             bodyInHeader=True,
             visibility="public",
             baseConstructors=[
                 "CallbackFunction(cx, aOwner, aCallable, aInited)"
                 ],
-            body="")
+            body=""),
+            ClassConstructor(
+            [Argument("CallbackFunction*", "aOther")],
+            bodyInHeader=True,
+            visibility="public",
+            baseConstructors=[
+                "CallbackFunction(aOther)"
+                ],
+            body="")]
 
     def getCallImpls(self, callCallback):
         args = list(callCallback.args)
         # Strip out the JSContext*/JSObject* args
         # that got added.
         assert args[0].name == "cx" and args[0].argType == "JSContext*"
         assert args[1].name == "aThisObj" and args[1].argType == "JSObject*"
         args = args[2:]