--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -311,20 +311,16 @@ XPCConvert::NativeData2JS(XPCLazyCallCon
         {
             *d = *((jsval*)s);
             if (!JS_WrapValue(cx, d))
                 return JS_FALSE;
             break;
         }
 
     default:
-        if (!type.IsPointer()) {
-            XPC_LOG_ERROR(("XPCConvert::NativeData2JS : unsupported type"));
-            return JS_FALSE;
-        }
 
         // set the default result
         *d = JSVAL_NULL;
 
         switch (type.TagPart()) {
         case nsXPTType::T_VOID:
             XPC_LOG_ERROR(("XPCConvert::NativeData2JS : void* params not supported"));
             return JS_FALSE;
@@ -653,20 +649,16 @@ XPCConvert::JSData2Native(XPCCallContext
             }
             *((uint16*)d) = (uint16) chars[0];
             break;
         }
     case nsXPTType::T_JSVAL :
         *((jsval*)d) = s;
         break;
     default:
-        if (!type.IsPointer()) {
-            NS_ERROR("unsupported type");
-            return JS_FALSE;
-        }
 
         switch (type.TagPart()) {
         case nsXPTType::T_VOID:
             XPC_LOG_ERROR(("XPCConvert::JSData2Native : void* params not supported"));
             NS_ERROR("void* params not supported");
             return JS_FALSE;
         case nsXPTType::T_IID:
         {
@@ -1902,20 +1894,16 @@ XPCConvert::NativeStringWithSize2JS(JSCo
                                     nsresult* pErr)
 {
     NS_PRECONDITION(s, "bad param");
     NS_PRECONDITION(d, "bad param");
 
     if (pErr)
         *pErr = NS_ERROR_XPC_BAD_CONVERT_NATIVE;
 
-    if (!type.IsPointer()) {
-        XPC_LOG_ERROR(("XPCConvert::NativeStringWithSize2JS : unsupported type"));
-        return JS_FALSE;
-    }
     switch (type.TagPart()) {
         case nsXPTType::T_PSTRING_SIZE_IS:
         {
             char* p = *((char**)s);
             if (!p)
                 break;
             JSString* str;
             if (!(str = JS_NewStringCopyN(cx, p, count)))
@@ -1952,20 +1940,16 @@ XPCConvert::JSStringWithSize2Native(XPCC
 
     JSContext* cx = ccx.GetJSContext();
 
     JSUint32 len;
 
     if (pErr)
         *pErr = NS_ERROR_XPC_BAD_CONVERT_NATIVE;
 
-    if (!type.IsPointer()) {
-        XPC_LOG_ERROR(("XPCConvert::JSStringWithSize2Native : unsupported type"));
-        return JS_FALSE;
-    }
     switch (type.TagPart()) {
         case nsXPTType::T_PSTRING_SIZE_IS:
         {
             if (JSVAL_IS_VOID(s) || JSVAL_IS_NULL(s)) {
                 if (0 != count) {
                     if (pErr)
                         *pErr = NS_ERROR_XPC_NOT_ENOUGH_CHARS_IN_STRING;
                     return JS_FALSE;

--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -878,19 +878,20 @@ nsXPCWrappedJSClass::GetArraySizeFromPar
 
     rv = mInfo->GetSizeIsArgNumberForParam(methodIndex, &param, 0, &argnum);
     if (NS_FAILED(rv))
         return JS_FALSE;
 
     const nsXPTParamInfo& arg_param = method->params[argnum];
     const nsXPTType& arg_type = arg_param.GetType();
 
-    // The xpidl compiler ensures this. We reaffirm it for safety.
-    if (arg_type.IsPointer() || arg_type.TagPart() != nsXPTType::T_U32)
-        return JS_FALSE;
+    // This should be enforced by the xpidl compiler, but it's not.
+    // See bug 695235.
+    NS_ABORT_IF_FALSE(arg_type.TagPart() == nsXPTType::T_U32,
+                      "size_is references parameter of invalid type.");
 
     if (arg_param.IsIndirect())
         *result = *(JSUint32*)nativeParams[argnum].val.p;
     else
         *result = nativeParams[argnum].val.u32;
 
     return JS_TRUE;
 }
@@ -916,18 +917,18 @@ nsXPCWrappedJSClass::GetInterfaceTypeFro
         nsresult rv;
         rv = mInfo->GetInterfaceIsArgNumberForParam(methodIndex,
                                                     &param, &argnum);
         if (NS_FAILED(rv))
             return JS_FALSE;
 
         const nsXPTParamInfo& arg_param = method->params[argnum];
         const nsXPTType& arg_type = arg_param.GetType();
-        if (arg_type.IsPointer() &&
-            arg_type.TagPart() == nsXPTType::T_IID) {
+
+        if (arg_type.TagPart() == nsXPTType::T_IID) {
             if (arg_param.IsIndirect()) {
                 nsID** p = (nsID**) nativeParams[argnum].val.p;
                 if (!p || !*p)
                     return JS_FALSE;
                 *result = **p;
             } else {
                 nsID* p = (nsID*) nativeParams[argnum].val.p;
                 if (!p)
@@ -1294,17 +1295,18 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWra
             fval = OBJECT_TO_JSVAL(obj);
 
             // We may need to translate the 'this' for the function object.
 
             if (paramCount) {
                 const nsXPTParamInfo& firstParam = info->params[0];
                 if (firstParam.IsIn()) {
                     const nsXPTType& firstType = firstParam.GetType();
-                    if (firstType.IsPointer() && firstType.IsInterfacePointer()) {
+
+                    if (firstType.IsInterfacePointer()) {
                         nsIXPCFunctionThisTranslator* translator;
 
                         IID2ThisTranslatorMap* map =
                             mRuntime->GetThisTranslatorMap();
 
                         {
                             XPCAutoLock lock(mRuntime->GetMapLock()); // scoped lock
                             translator = map->Find(mIID);

--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -2320,19 +2320,16 @@ CallMethodHelper::GetArraySizeFromParam(
 
     // TODO fixup the various exceptions that are thrown
 
     rv = mIFaceInfo->GetSizeIsArgNumberForParam(mVTableIndex, &paramInfo, 0, &paramIndex);
     if (NS_FAILED(rv))
         return Throw(NS_ERROR_XPC_CANT_GET_ARRAY_INFO, mCallContext);
 
     const nsXPTType& type = mMethodInfo->GetParam(paramIndex).GetType();
-    // The xpidl compiler ensures this. We reaffirm it for safety.
-    if (type.IsPointer() || type.TagPart() != nsXPTType::T_U32)
-        return Throw(NS_ERROR_XPC_CANT_GET_ARRAY_INFO, mCallContext);
 
     *result = GetDispatchParam(paramIndex)->val.u32;
 
     return JS_TRUE;
 }
 
 JSBool
 CallMethodHelper::GetInterfaceTypeFromParam(uint8 paramIndex,
@@ -2352,20 +2349,16 @@ CallMethodHelper::GetInterfaceTypeFromPa
                                  paramIndex, mCallContext);
     } else if (tag == nsXPTType::T_INTERFACE_IS) {
         rv = mIFaceInfo->GetInterfaceIsArgNumberForParam(mVTableIndex, &paramInfo,
                                                          &paramIndex);
         if (NS_FAILED(rv))
             return Throw(NS_ERROR_XPC_CANT_GET_ARRAY_INFO, mCallContext);
 
         const nsXPTType& type = mMethodInfo->GetParam(paramIndex).GetType();
-        // The xpidl compiler ensures this. We reaffirm it for safety.
-        if (!type.IsPointer() || type.TagPart() != nsXPTType::T_IID)
-            return ThrowBadParam(NS_ERROR_XPC_CANT_GET_PARAM_IFACE_INFO,
-                                 paramIndex, mCallContext);
 
         nsID* p = (nsID*) GetDispatchParam(paramIndex)->val.p;
         if (!p)
             return ThrowBadParam(NS_ERROR_XPC_CANT_GET_PARAM_IFACE_INFO,
                                  paramIndex, mCallContext);
         *result = *p;
     }
     return JS_TRUE;
@@ -2666,38 +2659,36 @@ CallMethodHelper::ConvertIndependentPara
     if (paramInfo.IsOut()) {
         if (type.IsPointer() &&
             type_tag != nsXPTType::T_INTERFACE) {
             dp->SetValNeedsCleanup();
         }
 
         if (!paramInfo.IsIn())
             return JS_TRUE;
+
     } else {
-        if (type.IsPointer()) {
-            switch (type_tag) {
-            case nsXPTType::T_IID:
-                dp->SetValNeedsCleanup();
-                break;
-            case nsXPTType::T_CHAR_STR:
-                dp->SetValNeedsCleanup();
-                break;
-            case nsXPTType::T_ASTRING:
-                // Fall through to the T_DOMSTRING case
-
-            case nsXPTType::T_DOMSTRING:
-                dp->SetValNeedsCleanup();
-                break;
-
-            case nsXPTType::T_UTF8STRING:
-                // Fall through to the C string case for now...
-            case nsXPTType::T_CSTRING:
-                dp->SetValNeedsCleanup();
-                break;
-            }
+        switch (type_tag) {
+        case nsXPTType::T_IID:
+            dp->SetValNeedsCleanup();
+            break;
+        case nsXPTType::T_CHAR_STR:
+            dp->SetValNeedsCleanup();
+            break;
+        case nsXPTType::T_ASTRING:
+            // Fall through to the T_DOMSTRING case
+        case nsXPTType::T_DOMSTRING:
+            dp->SetValNeedsCleanup();
+            break;
+
+        case nsXPTType::T_UTF8STRING:
+            // Fall through to the C string case for now...
+        case nsXPTType::T_CSTRING:
+            dp->SetValNeedsCleanup();
+            break;
         }
 
         // Do this *after* the above because in the case where we have a
         // "T_DOMSTRING && IsDipper()" then arg might be null since this
         // is really an 'out' param masquerading as an 'in' param.
         NS_ASSERTION(i < mArgc || paramInfo.IsOptional(),
                      "Expected either enough arguments or an optional argument");
         if (i < mArgc)
@@ -2780,20 +2771,19 @@ CallMethodHelper::ConvertDependentParams
 
             if (!paramInfo.IsIn())
                 continue;
         } else {
             NS_ASSERTION(i < mArgc || paramInfo.IsOptional(),
                          "Expected either enough arguments or an optional argument");
             src = i < mArgc ? mArgv[i] : JSVAL_NULL;
 
-            if ((datum_type.IsPointer() &&
-                 (datum_type.TagPart() == nsXPTType::T_IID ||
-                  datum_type.TagPart() == nsXPTType::T_PSTRING_SIZE_IS ||
-                  datum_type.TagPart() == nsXPTType::T_PWSTRING_SIZE_IS)) ||
+            if (datum_type.TagPart() == nsXPTType::T_IID ||
+                datum_type.TagPart() == nsXPTType::T_PSTRING_SIZE_IS ||
+                datum_type.TagPart() == nsXPTType::T_PWSTRING_SIZE_IS ||
                 (isArray && datum_type.TagPart() == nsXPTType::T_CHAR_STR)) {
                 dp->SetValNeedsCleanup();
             }
         }
 
         nsID param_iid;
         if (datum_type.IsInterfacePointer() &&
             !GetInterfaceTypeFromParam(i, datum_type, &param_iid))