Merge m-c to birch.
authorRyan VanderMeulen <ryanvm@gmail.com>
Mon, 29 Jul 2013 16:07:59 -0400
changeset 152650 5065fdc124082ebe40091abdf6648ce67c340656
parent 152649 f4f821610e3045160b1b486e1e9657546f04edab (current diff)
parent 152636 2e2955849611202c91068078ab114fd8d6d22a77 (diff)
child 152665 3d40d270c031f188eb2fdc6ee4b22cefb1f789f1
push id2859
push userakeybl@mozilla.com
push dateMon, 16 Sep 2013 19:14:59 +0000
treeherdermozilla-beta@87d3c51cd2bf [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone25.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge m-c to birch.
dom/network/src/TCPSocketParent.cpp
dom/tests/mochitest/general/test_interfaces.html
--- a/caps/src/nsSecurityManagerFactory.cpp
+++ b/caps/src/nsSecurityManagerFactory.cpp
@@ -80,27 +80,27 @@ nsSecurityNameSet::InitializeNameSet(nsI
         MOZ_ALWAYS_TRUE(JS_GetPrototype(cx, obj, proto.address()));
         if (!proto)
             break;
         obj = proto;
     }
     JSClass *objectClass = JS_GetClass(obj);
 
     JS::Rooted<JS::Value> v(cx);
-    if (!JS_GetProperty(cx, global, "netscape", v.address()))
+    if (!JS_GetProperty(cx, global, "netscape", &v))
         return NS_ERROR_FAILURE;
 
     JS::Rooted<JSObject*> securityObj(cx);
     if (v.isObject()) {
         /*
          * "netscape" property of window object exists; get the
          * "security" property.
          */
         obj = &v.toObject();
-        if (!JS_GetProperty(cx, obj, "security", v.address()) || !v.isObject())
+        if (!JS_GetProperty(cx, obj, "security", &v) || !v.isObject())
             return NS_ERROR_FAILURE;
         securityObj = &v.toObject();
     } else {
         /* define netscape.security object */
         obj = JS_DefineObject(cx, global, "netscape", objectClass, nullptr, 0);
         if (obj == nullptr)
             return NS_ERROR_FAILURE;
         securityObj = JS_DefineObject(cx, obj, "security", objectClass,
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -743,18 +743,17 @@ nsFrameMessageManager::ReceiveMessage(ns
           } else {
             defaultThisValue = aTarget;
           }
           JS::Rooted<JSObject*> global(ctx, JS_GetGlobalForObject(ctx, object));
           nsContentUtils::WrapNative(ctx, global, defaultThisValue,
                                      thisValue.address(), nullptr, true);
         } else {
           // If the listener is a JS object which has receiveMessage function:
-          if (!JS_GetProperty(ctx, object, "receiveMessage",
-                              funval.address()) ||
+          if (!JS_GetProperty(ctx, object, "receiveMessage", &funval) ||
               !funval.isObject())
             return NS_ERROR_UNEXPECTED;
 
           // Check if the object is even callable.
           NS_ENSURE_STATE(JS_ObjectIsCallable(ctx, &funval.toObject()));
           thisValue.setObject(*object);
         }
 
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -1158,17 +1158,17 @@ nsXBLBinding::LookupMemberInternal(JSCon
     }
     return mNextBinding->LookupMemberInternal(aCx, aName, aNameAsId,
                                               aDesc, aXBLScope);
   }
 
   // Find our class object. It's in a protected scope and permanent just in case,
   // so should be there no matter what.
   JS::RootedValue classObject(aCx);
-  if (!JS_GetProperty(aCx, aXBLScope, mJSClass->name, classObject.address())) {
+  if (!JS_GetProperty(aCx, aXBLScope, mJSClass->name, &classObject)) {
     return false;
   }
 
   // The bound element may have been adoped by a document and have a different
   // wrapper (and different xbl scope) than when the binding was applied, in
   // this case getting the class object will fail. Behave as if the class
   // object did not exist.
   if (classObject.isUndefined()) {
--- a/content/xbl/src/nsXBLProtoImplField.cpp
+++ b/content/xbl/src/nsXBLProtoImplField.cpp
@@ -239,17 +239,17 @@ FieldGetterImpl(JSContext *cx, JS::CallA
   }
 
   if (!installed) {
     args.rval().setUndefined();
     return true;
   }
 
   JS::Rooted<JS::Value> v(cx);
-  if (!JS_GetPropertyById(cx, thisObj, id, v.address())) {
+  if (!JS_GetPropertyById(cx, thisObj, id, &v)) {
     return false;
   }
   args.rval().set(v);
   return true;
 }
 
 static JSBool
 FieldGetter(JSContext *cx, unsigned argc, JS::Value *vp)
--- a/dom/audiochannel/AudioChannelService.cpp
+++ b/dom/audiochannel/AudioChannelService.cpp
@@ -536,32 +536,32 @@ AudioChannelService::Observe(nsISupports
     JS::Rooted<JS::Value> val(cx);
     if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
         !val.isObject()) {
       return NS_OK;
     }
 
     JS::Rooted<JSObject*> obj(cx, &val.toObject());
     JS::Rooted<JS::Value> key(cx);
-    if (!JS_GetProperty(cx, obj, "key", key.address()) ||
+    if (!JS_GetProperty(cx, obj, "key", &key) ||
         !key.isString()) {
       return NS_OK;
     }
 
     JS::RootedString jsKey(cx, JS_ValueToString(cx, key));
     if (!jsKey) {
       return NS_OK;
     }
     nsDependentJSString keyStr;
     if (!keyStr.init(cx, jsKey) || keyStr.Find("audio.volume.", 0, false)) {
       return NS_OK;
     }
 
     JS::Rooted<JS::Value> value(cx);
-    if (!JS_GetProperty(cx, obj, "value", value.address()) || !value.isInt32()) {
+    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isInt32()) {
       return NS_OK;
     }
 
     nsCOMPtr<nsIAudioManager> audioManager = do_GetService(NS_AUDIOMANAGER_CONTRACTID);
     NS_ENSURE_TRUE(audioManager, NS_OK);
 
     int32_t index = value.toInt32();
     if (keyStr.EqualsLiteral("audio.volume.content")) {
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -473,54 +473,54 @@ static nsDOMClassInfoData sClassInfoData
   NS_DEFINE_CLASSINFO_DATA(Selection, nsDOMGenericSH,
                            DEFAULT_SCRIPTABLE_FLAGS)
 
   // XUL classes
 #ifdef MOZ_XUL
   NS_DEFINE_CLASSINFO_DATA(XULCommandDispatcher, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 #endif
-  NS_DEFINE_CLASSINFO_DATA(XULControllers, nsNonDOMObjectSH,
-                           DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(BoxObject, nsDOMGenericSH,
-                           DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(XULControllers, nsNonDOMObjectSH,
+                                       DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(BoxObject, nsDOMGenericSH,
+                                       DEFAULT_SCRIPTABLE_FLAGS)
 #ifdef MOZ_XUL
-  NS_DEFINE_CLASSINFO_DATA(TreeSelection, nsDOMGenericSH,
-                           DEFAULT_SCRIPTABLE_FLAGS)
-  NS_DEFINE_CLASSINFO_DATA(TreeContentView, nsDOMGenericSH,
-                           DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(TreeSelection, nsDOMGenericSH,
+                                       DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(TreeContentView, nsDOMGenericSH,
+                                       DEFAULT_SCRIPTABLE_FLAGS)
 #endif
 
   // Crypto classes
 #ifndef MOZ_DISABLE_CRYPTOLEGACY
   NS_DEFINE_CLASSINFO_DATA(CRMFObject, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 #endif
   NS_DEFINE_CLASSINFO_DATA(Crypto, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   // DOM Chrome Window class.
   NS_DEFINE_CLASSINFO_DATA(ChromeWindow, nsWindowSH,
                            DEFAULT_SCRIPTABLE_FLAGS |
                            WINDOW_SCRIPTABLE_FLAGS)
 
 #ifdef MOZ_XUL
-  NS_DEFINE_CLASSINFO_DATA(XULTemplateBuilder, nsDOMGenericSH,
-                           DEFAULT_SCRIPTABLE_FLAGS)
-
-  NS_DEFINE_CLASSINFO_DATA(XULTreeBuilder, nsDOMGenericSH,
-                           DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(XULTemplateBuilder, nsDOMGenericSH,
+                                       DEFAULT_SCRIPTABLE_FLAGS)
+
+  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(XULTreeBuilder, nsDOMGenericSH,
+                                       DEFAULT_SCRIPTABLE_FLAGS)
 #endif
 
   NS_DEFINE_CLASSINFO_DATA(DOMStringList, nsStringListSH,
                            ARRAY_SCRIPTABLE_FLAGS)
 
 #ifdef MOZ_XUL
-  NS_DEFINE_CLASSINFO_DATA(TreeColumn, nsDOMGenericSH,
-                           DEFAULT_SCRIPTABLE_FLAGS)
+  NS_DEFINE_CHROME_ONLY_CLASSINFO_DATA(TreeColumn, nsDOMGenericSH,
+                                       DEFAULT_SCRIPTABLE_FLAGS)
 #endif
 
   NS_DEFINE_CLASSINFO_DATA(CSSMozDocumentRule, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
   NS_DEFINE_CLASSINFO_DATA(CSSSupportsRule, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
@@ -2708,17 +2708,17 @@ BaseStubConstructor(nsIWeakReference* aW
       }
 
       nsCxPusher pusher;
       pusher.Push(cx);
 
       JSAutoCompartment ac(cx, thisObject);
 
       JS::Rooted<JS::Value> funval(cx);
-      if (!JS_GetProperty(cx, thisObject, "constructor", funval.address()) ||
+      if (!JS_GetProperty(cx, thisObject, "constructor", &funval) ||
           !funval.isObject()) {
         return NS_ERROR_UNEXPECTED;
       }
 
       // Check if the object is even callable.
       NS_ENSURE_STATE(JS_ObjectIsCallable(cx, &funval.toObject()));
       {
         // wrap parameters in the target compartment
@@ -3213,17 +3213,17 @@ nsDOMConstructor::HasInstance(nsIXPConne
   if (NS_FAILED(rv)) {
     return rv;
   }
 
   if (!name_struct) {
     // This isn't a normal DOM object, see if this constructor lives on its
     // prototype chain.
     JS::Rooted<JS::Value> val(cx);
-    if (!JS_GetProperty(cx, obj, "prototype", val.address())) {
+    if (!JS_GetProperty(cx, obj, "prototype", &val)) {
       return NS_ERROR_UNEXPECTED;
     }
 
     if (JSVAL_IS_PRIMITIVE(val)) {
       return NS_OK;
     }
 
     JS::Rooted<JSObject*> dot_prototype(cx, val.toObjectOrNull());
@@ -3954,17 +3954,20 @@ nsWindowSH::GlobalResolve(nsGlobalWindow
 // window._content to window.content for backwards compatibility only.
 static JSBool
 ContentWindowGetter(JSContext *cx, unsigned argc, jsval *vp)
 {
   JSObject *obj = JS_THIS_OBJECT(cx, vp);
   if (!obj)
     return JS_FALSE;
 
-  return ::JS_GetProperty(cx, obj, "content", vp);
+  JS::Rooted<JS::Value> value(cx);
+  bool result = ::JS_GetProperty(cx, obj, "content", &value);
+  *vp = value;
+  return result;
 }
 
 template<class Interface>
 static nsresult
 LocationSetterGuts(JSContext *cx, JSObject *obj, jsval *vp)
 {
   // This function duplicates some of the logic in XPC_WN_HelperSetProperty
   obj = js::CheckedUnwrap(obj, /* stopAtOuter = */ false);
@@ -4101,17 +4104,17 @@ DefineComponentsShim(JSContext *cx, JS::
   for (uint32_t i = 0; i < ArrayLength(kInterfaceShimMap); ++i) {
 
     // Grab the names from the table.
     const char *geckoName = kInterfaceShimMap[i].geckoName;
     const char *domName = kInterfaceShimMap[i].domName;
 
     // Look up the appopriate interface object on the global.
     JS::Rooted<JS::Value> v(cx, JS::UndefinedValue());
-    ok = JS_GetProperty(cx, global, domName, v.address());
+    ok = JS_GetProperty(cx, global, domName, &v);
     NS_ENSURE_TRUE(ok, NS_ERROR_OUT_OF_MEMORY);
     if (!v.isObject()) {
       NS_WARNING("Unable to find interface object on global");
       continue;
     }
 
     // Define the shim on the interfaces object.
     ok = JS_DefineProperty(cx, interfaces, geckoName, v,
@@ -4632,17 +4635,17 @@ nsGenericArraySH::NewResolve(nsIXPConnec
 
 nsresult
 nsGenericArraySH::GetLength(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                              JSObject *obj, uint32_t *length)
 {
   *length = 0;
 
   JS::Rooted<JS::Value> lenval(cx);
-  if (!JS_GetProperty(cx, obj, "length", lenval.address())) {
+  if (!JS_GetProperty(cx, obj, "length", &lenval)) {
     return NS_ERROR_UNEXPECTED;
   }
 
   if (!JSVAL_IS_INT(lenval)) {
     // This can apparently happen with some sparse array impls falling back
     // onto this code.
     return NS_OK;
   }
@@ -4671,17 +4674,17 @@ nsGenericArraySH::Enumerate(nsIXPConnect
   if (sCurrentlyEnumerating) {
     // Don't recurse to death.
     return NS_OK;
   }
 
   sCurrentlyEnumerating = true;
 
   JS::Rooted<JS::Value> len_val(cx);
-  JSBool ok = ::JS_GetProperty(cx, obj, "length", len_val.address());
+  JSBool ok = ::JS_GetProperty(cx, obj, "length", &len_val);
 
   if (ok && JSVAL_IS_INT(len_val)) {
     int32_t length = JSVAL_TO_INT(len_val);
 
     for (int32_t i = 0; ok && i < length; ++i) {
       ok = ::JS_DefineElement(cx, obj, i, JSVAL_VOID, nullptr, nullptr,
                               JSPROP_ENUMERATE | JSPROP_SHARED);
     }
@@ -5019,17 +5022,23 @@ nsHTMLDocumentSH::CallToGetPropMapper(JS
 
   size_t length;
   JS::Anchor<JSString *> anchor(str);
   const jschar *chars = ::JS_GetStringCharsAndLength(cx, str, &length);
   if (!chars) {
     return JS_FALSE;
   }
 
-  return ::JS_GetUCProperty(cx, self, chars, length, vp);
+  JS::Rooted<JS::Value> value(cx);
+  if (!::JS_GetUCProperty(cx, self, chars, length, &value)) {
+    return false;
+  }
+
+  *vp = value;
+  return true;
 }
 
 // StringArray helper
 
 NS_IMETHODIMP
 nsStringArraySH::GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                              JSObject *aObj, jsid aId, jsval *vp,
                              bool *_retval)
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1317,17 +1317,23 @@ GetPropertyOnPrototype(JSContext* cx, JS
     return false;
   }
 
   *found = hasProp;
   if (!hasProp || !vp) {
     return true;
   }
 
-  return JS_ForwardGetPropertyTo(cx, proto, id, proxy, vp);
+  JS::Rooted<JS::Value> value(cx);
+  if (!JS_ForwardGetPropertyTo(cx, proto, id, proxy, &value)) {
+    return false;
+  }
+
+  *vp = value;
+  return true;
 }
 
 bool
 HasPropertyOnPrototype(JSContext* cx, JS::Handle<JSObject*> proxy,
                        DOMProxyHandler* handler,
                        JS::Handle<jsid> id)
 {
   JS::Rooted<JSObject*> obj(cx, proxy);
@@ -1736,17 +1742,17 @@ InterfaceHasInstance(JSContext* cx, JS::
 
   if (domClass &&
       domClass->mInterfaceChain[clasp->mDepth] == clasp->mPrototypeID) {
     *bp = true;
     return true;
   }
 
   JS::Rooted<JS::Value> protov(cx);
-  DebugOnly<bool> ok = JS_GetProperty(cx, obj, "prototype", protov.address());
+  DebugOnly<bool> ok = JS_GetProperty(cx, obj, "prototype", &protov);
   MOZ_ASSERT(ok, "Someone messed with our prototype property?");
 
   JS::Rooted<JSObject*> interfacePrototype(cx, &protov.toObject());
   MOZ_ASSERT(IsDOMIfaceAndProtoClass(js::GetObjectClass(interfacePrototype)),
              "Someone messed with our prototype property?");
 
   JS::Rooted<JSObject*> proto(cx);
   if (!JS_GetPrototype(cx, instance, proto.address())) {
@@ -1840,17 +1846,17 @@ GetWindowForJSImplementedObject(JSContex
   // Be very careful to not get tricked here.
   MOZ_ASSERT(NS_IsMainThread());
   if (!xpc::AccessCheck::isChrome(js::GetObjectCompartment(obj))) {
     NS_RUNTIMEABORT("Should have a chrome object here");
   }
 
   // Look up the content-side object.
   JS::Rooted<JS::Value> domImplVal(cx);
-  if (!JS_GetProperty(cx, obj, "__DOM_IMPL__", domImplVal.address())) {
+  if (!JS_GetProperty(cx, obj, "__DOM_IMPL__", &domImplVal)) {
     return false;
   }
 
   if (!domImplVal.isObject()) {
     ThrowErrorMessage(cx, MSG_NOT_OBJECT, "Value");
     return false;
   }
 
--- a/dom/bindings/CallbackInterface.cpp
+++ b/dom/bindings/CallbackInterface.cpp
@@ -11,17 +11,17 @@
 
 namespace mozilla {
 namespace dom {
 
 bool
 CallbackInterface::GetCallableProperty(JSContext* cx, const char* aPropName,
                                        JS::MutableHandle<JS::Value> aCallable)
 {
-  if (!JS_GetProperty(cx, mCallback, aPropName, aCallable.address())) {
+  if (!JS_GetProperty(cx, mCallback, aPropName, aCallable)) {
     return false;
   }
   if (!aCallable.isObject() ||
       !JS_ObjectIsCallable(cx, &aCallable.toObject())) {
     nsPrintfCString description("Property '%s'", aPropName);
     ThrowErrorMessage(cx, MSG_NOT_CALLABLE, description.get());
     return false;
   }
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -5522,17 +5522,17 @@ class CGSpecializedForwardingSetter(CGSp
 
     def definition_body(self):
         attrName = self.attr.identifier.name
         forwardToAttrName = self.attr.getExtendedAttribute("PutForwards")[0]
         # JS_GetProperty and JS_SetProperty can only deal with ASCII
         assert all(ord(c) < 128 for c in attrName)
         assert all(ord(c) < 128 for c in forwardToAttrName)
         return CGIndenter(CGGeneric("""JS::RootedValue v(cx);
-if (!JS_GetProperty(cx, obj, "%s", v.address())) {
+if (!JS_GetProperty(cx, obj, "%s", &v)) {
   return false;
 }
 
 if (!v.isObject()) {
   return ThrowErrorMessage(cx, MSG_NOT_OBJECT, "%s.%s");
 }
 
 return JS_SetProperty(cx, &v.toObject(), "%s", args[0]);""" % (attrName, self.descriptor.interface.identifier.name, attrName, forwardToAttrName))).define()
@@ -7536,31 +7536,31 @@ class CGDOMJSProxyHandler_get(ClassMetho
     def getBody(self):
         if UseHolderForUnforgeable(self.descriptor):
             hasUnforgeable = (
                 "JSBool hasUnforgeable;\n"
                  "if (!JS_AlreadyHasOwnPropertyById(cx, ${holder}, id, &hasUnforgeable)) {\n"
                  "  return false;\n"
                  "}\n"
                  "if (hasUnforgeable) {\n"
-                 "  return JS_ForwardGetPropertyTo(cx, ${holder}, id, proxy, vp.address());\n"
+                 "  return JS_ForwardGetPropertyTo(cx, ${holder}, id, proxy, vp);\n"
                  "}")
             getUnforgeableOrExpando = CallOnUnforgeableHolder(self.descriptor,
                                                               hasUnforgeable)
         else:
             getUnforgeableOrExpando = ""
         getUnforgeableOrExpando += """JS::Rooted<JSObject*> expando(cx, DOMProxyHandler::GetExpandoObject(proxy));
 if (expando) {
   JSBool hasProp;
   if (!JS_HasPropertyById(cx, expando, id, &hasProp)) {
     return false;
   }
 
   if (hasProp) {
-    return JS_GetPropertyById(cx, expando, id, vp.address());
+    return JS_GetPropertyById(cx, expando, id, vp);
   }
 }"""
 
         templateValues = {'jsvalRef': 'vp', 'jsvalHandle': 'vp', 'obj': 'proxy'}
 
         if self.descriptor.supportsIndexedProperties():
             getIndexedOrExpando = ("int32_t index = GetArrayIndexFromId(cx, id);\n" +
                                    "if (IsArrayIndex(index)) {\n" +
@@ -8211,21 +8211,21 @@ class CGDictionary(CGThing):
         if conversionInfo.dealWithOptional:
             replacements["declName"] = "(" + replacements["declName"] + ".Value())"
         if member.defaultValue:
             replacements["haveValue"] = "!isNull && !temp.ref().isUndefined()"
 
         # NOTE: jsids are per-runtime, so don't use them in workers
         if self.workers:
             propName = member.identifier.name
-            propGet = ('JS_GetProperty(cx, &val.toObject(), "%s", temp.ref().address())' %
+            propGet = ('JS_GetProperty(cx, &val.toObject(), "%s", &temp.ref())' %
                        propName)
         else:
             propId = self.makeIdName(member.identifier.name);
-            propGet = ("JS_GetPropertyById(cx, &val.toObject(), %s, temp.ref().address())" %
+            propGet = ("JS_GetPropertyById(cx, &val.toObject(), %s, &temp.ref())" %
                        propId)
 
         conversionReplacements = {
             "prop": self.makeMemberName(member.identifier.name),
             "convert": string.Template(conversionInfo.template).substitute(replacements),
             "propGet": propGet
             }
         conversion = ("if (!isNull && !${propGet}) {\n"
@@ -10115,17 +10115,17 @@ class CallbackGetter(CallbackMember):
         return "JS::Rooted<JS::Value> rval(cx, JS::UndefinedValue());\n"
 
     def getCall(self):
         replacements = {
             "errorReturn" : self.getDefaultRetval(),
             "attrName": self.attrName
             }
         return string.Template(
-            'if (!JS_GetProperty(cx, mCallback, "${attrName}", rval.address())) {\n'
+            'if (!JS_GetProperty(cx, mCallback, "${attrName}", &rval)) {\n'
             '  aRv.Throw(NS_ERROR_UNEXPECTED);\n'
             '  return${errorReturn};\n'
             '}\n').substitute(replacements);
 
 class CallbackSetter(CallbackMember):
     def __init__(self, attr, descriptor):
         self.ensureASCIIName(attr)
         self.attrName = attr.identifier.name
--- a/dom/bluetooth/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/BluetoothHfpManager.cpp
@@ -532,28 +532,28 @@ BluetoothHfpManager::HandleVolumeChanged
   NS_ENSURE_TRUE_VOID(cx);
 
   JS::Rooted<JS::Value> val(cx);
   NS_ENSURE_TRUE_VOID(JS_ParseJSON(cx, aData.BeginReading(), aData.Length(), &val));
   NS_ENSURE_TRUE_VOID(val.isObject());
 
   JS::Rooted<JSObject*> obj(cx, &val.toObject());
   JS::Rooted<JS::Value> key(cx);
-  if (!JS_GetProperty(cx, obj, "key", key.address()) || !key.isString()) {
+  if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
     return;
   }
 
   JSBool match;
   if (!JS_StringEqualsAscii(cx, key.toString(), AUDIO_VOLUME_BT_SCO_ID, &match) ||
       (match != JS_TRUE)) {
     return;
   }
 
   JS::Rooted<JS::Value> value(cx);
-  if (!JS_GetProperty(cx, obj, "value", value.address())||
+  if (!JS_GetProperty(cx, obj, "value", &value)||
       !value.isNumber()) {
     return;
   }
 
   mCurrentVgs = value.toNumber();
 
   // Adjust volume by headset and we don't have to send volume back to headset
   if (mReceiveVgsFlag) {
--- a/dom/bluetooth/BluetoothService.cpp
+++ b/dom/bluetooth/BluetoothService.cpp
@@ -561,17 +561,17 @@ BluetoothService::HandleSettingsChanged(
   }
 
   if (!val.isObject()) {
     return NS_OK;
   }
 
   JSObject& obj(val.toObject());
 
-  JS::Value key;
+  JS::Rooted<JS::Value> key(cx);
   if (!JS_GetProperty(cx, &obj, "key", &key)) {
     MOZ_ASSERT(!JS_IsExceptionPending(cx));
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   if (!key.isString()) {
     return NS_OK;
   }
@@ -579,17 +579,17 @@ BluetoothService::HandleSettingsChanged(
   // First, check if the string equals to BLUETOOTH_DEBUGGING_SETTING
   JSBool match;
   if (!JS_StringEqualsAscii(cx, key.toString(), BLUETOOTH_DEBUGGING_SETTING, &match)) {
     MOZ_ASSERT(!JS_IsExceptionPending(cx));
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   if (match) {
-    JS::Value value;
+    JS::Rooted<JS::Value> value(cx);
     if (!JS_GetProperty(cx, &obj, "value", &value)) {
       MOZ_ASSERT(!JS_IsExceptionPending(cx));
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
     if (!value.isBoolean()) {
       MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.debugging.enabled'!");
       return NS_ERROR_UNEXPECTED;
@@ -602,17 +602,17 @@ BluetoothService::HandleSettingsChanged(
 
   // Second, check if the string is BLUETOOTH_ENABLED_SETTING
   if (!JS_StringEqualsAscii(cx, key.toString(), BLUETOOTH_ENABLED_SETTING, &match)) {
     MOZ_ASSERT(!JS_IsExceptionPending(cx));
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   if (match) {
-    JS::Value value;
+    JS::Rooted<JS::Value> value(cx);
     if (!JS_GetProperty(cx, &obj, "value", &value)) {
       MOZ_ASSERT(!JS_IsExceptionPending(cx));
       return NS_ERROR_OUT_OF_MEMORY;
     }
 
     if (!value.isBoolean()) {
       MOZ_ASSERT(false, "Expecting a boolean for 'bluetooth.enabled'!");
       return NS_ERROR_UNEXPECTED;
--- a/dom/bluetooth/MediaMetaData.cpp
+++ b/dom/bluetooth/MediaMetaData.cpp
@@ -34,17 +34,17 @@ MediaMetaData::Init(JSContext* aCx, cons
     return aVal->isNullOrUndefined() ? NS_OK : NS_ERROR_TYPE_ERR;
   }
 
   JS::RootedObject obj(aCx, &aVal->toObject());
   nsCxPusher pusher;
   pusher.Push(aCx);
   JSAutoCompartment ac(aCx, obj);
 
-  JS::Value value;
+  JS::Rooted<JS::Value> value(aCx);
   NS_ENSURE_STATE(JS_GetProperty(aCx, obj, "mAlbum", &value));
   if (JSVAL_IS_STRING(value)) {
     nsDependentJSString jsString;
     NS_ENSURE_STATE(jsString.init(aCx, value.toString()));
     mAlbum = jsString;
   }
 
   NS_ENSURE_STATE(JS_GetProperty(aCx, obj, "mArtist", &value));
--- a/dom/bluetooth/MediaPlayStatus.cpp
+++ b/dom/bluetooth/MediaPlayStatus.cpp
@@ -33,17 +33,17 @@ MediaPlayStatus::Init(JSContext* aCx, co
     return aVal->isNullOrUndefined() ? NS_OK : NS_ERROR_TYPE_ERR;
   }
 
   JS::RootedObject obj(aCx, &aVal->toObject());
   nsCxPusher pusher;
   pusher.Push(aCx);
   JSAutoCompartment ac(aCx, obj);
 
-  JS::Value value;
+  JS::Rooted<JS::Value> value(aCx);
   NS_ENSURE_STATE(JS_GetProperty(aCx, obj, "mDuration", &value));
   if (JSVAL_IS_INT(value)) {
     NS_ENSURE_STATE(JS_ValueToInt64(aCx, value, &mDuration));
   }
 
   NS_ENSURE_STATE(JS_GetProperty(aCx, obj, "mPlayStatus", &value));
   if (JSVAL_IS_STRING(value)) {
     nsDependentJSString jsString;
--- a/dom/indexedDB/KeyPath.cpp
+++ b/dom/indexedDB/KeyPath.cpp
@@ -112,18 +112,17 @@ GetJSValFromKeyPathString(JSContext* aCx
 
       JSBool ok = JS_HasUCProperty(aCx, obj, keyPathChars, keyPathLen,
                                    &hasProp);
       NS_ENSURE_TRUE(ok, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
       if (hasProp) {
         // Get if the property exists...
         JS::Rooted<JS::Value> intermediate(aCx);
-        JSBool ok = JS_GetUCProperty(aCx, obj, keyPathChars, keyPathLen,
-                                     intermediate.address());
+        JSBool ok = JS_GetUCProperty(aCx, obj, keyPathChars, keyPathLen, &intermediate);
         NS_ENSURE_TRUE(ok, NS_ERROR_DOM_INDEXEDDB_UNKNOWN_ERR);
 
         // Treat explicitly undefined as an error.
         if (intermediate == JSVAL_VOID) {
           return NS_ERROR_DOM_INDEXEDDB_DATA_ERR;
         }
         if (tokenizer.hasMoreTokens()) {
           // ...and walk to it if there are more steps...
--- a/dom/network/src/TCPSocketParent.cpp
+++ b/dom/network/src/TCPSocketParent.cpp
@@ -208,17 +208,17 @@ TCPSocketParent::SendCallback(const nsAS
       InfallibleTArray<uint8_t> arr;
       arr.SwapElements(fallibleArr);
       data = SendableData(arr);
 
     } else {
       nsDependentJSString name;
 
       JS::Rooted<JS::Value> val(aCx);
-      if (!JS_GetProperty(aCx, obj, "name", val.address())) {
+      if (!JS_GetProperty(aCx, obj, "name", &val)) {
         NS_ERROR("No name property on supposed error object");
       } else if (JSVAL_IS_STRING(val)) {
         if (!name.init(aCx, JSVAL_TO_STRING(val))) {
           NS_WARNING("couldn't initialize string");
         }
       }
 
       data = TCPError(name);
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -535,17 +535,17 @@ nsJSObjWrapper::NP_Invalidate(NPObject *
     }
 
     // Forget our reference to the JSObject.
     jsnpobj->mJSObj = nullptr;
   }
 }
 
 static JSBool
-GetProperty(JSContext *cx, JSObject *obj, NPIdentifier id, JS::Value *rval)
+GetProperty(JSContext *cx, JSObject *obj, NPIdentifier id, JS::MutableHandle<JS::Value> rval)
 {
   NS_ASSERTION(NPIdentifierIsInt(id) || NPIdentifierIsString(id),
                "id must be either string or int!\n");
   return ::JS_GetPropertyById(cx, obj, NPIdentifierToJSId(id), rval);
 }
 
 // static
 bool
@@ -569,17 +569,17 @@ nsJSObjWrapper::NP_HasMethod(NPObject *n
 
   nsCxPusher pusher;
   pusher.Push(cx);
   JSAutoCompartment ac(cx, npjsobj->mJSObj);
 
   AutoJSExceptionReporter reporter(cx);
 
   JS::Rooted<JS::Value> v(cx);
-  JSBool ok = GetProperty(cx, npjsobj->mJSObj, id, v.address());
+  JSBool ok = GetProperty(cx, npjsobj->mJSObj, id, &v);
 
   return ok && !JSVAL_IS_PRIMITIVE(v) &&
     ::JS_ObjectIsFunction(cx, JSVAL_TO_OBJECT(v));
 }
 
 static bool
 doInvoke(NPObject *npobj, NPIdentifier method, const NPVariant *args,
          uint32_t argCount, bool ctorCall, NPVariant *result)
@@ -605,17 +605,17 @@ doInvoke(NPObject *npobj, NPIdentifier m
   nsCxPusher pusher;
   pusher.Push(cx);
   JSAutoCompartment ac(cx, npjsobj->mJSObj);
   JS::Rooted<JS::Value> fv(cx);
 
   AutoJSExceptionReporter reporter(cx);
 
   if (method != NPIdentifier_VOID) {
-    if (!GetProperty(cx, npjsobj->mJSObj, method, fv.address()) ||
+    if (!GetProperty(cx, npjsobj->mJSObj, method, &fv) ||
         ::JS_TypeOfValue(cx, fv) != JSTYPE_FUNCTION) {
       return false;
     }
   } else {
     fv = OBJECT_TO_JSVAL(npjsobj->mJSObj);
   }
 
   JS::Value jsargs_buf[8];
@@ -747,17 +747,17 @@ nsJSObjWrapper::NP_GetProperty(NPObject 
   nsJSObjWrapper *npjsobj = (nsJSObjWrapper *)npobj;
 
   nsCxPusher pusher;
   pusher.Push(cx);
   AutoJSExceptionReporter reporter(cx);
   JSAutoCompartment ac(cx, npjsobj->mJSObj);
 
   JS::Rooted<JS::Value> v(cx);
-  return (GetProperty(cx, npjsobj->mJSObj, id, v.address()) &&
+  return (GetProperty(cx, npjsobj->mJSObj, id, &v) &&
           JSValToNPVariant(npp, cx, v, result));
 }
 
 // static
 bool
 nsJSObjWrapper::NP_SetProperty(NPObject *npobj, NPIdentifier id,
                                const NPVariant *value)
 {
@@ -1616,17 +1616,17 @@ NPObjWrapper_Convert(JSContext *cx, JS::
   // either property with a value that isn't callable, will cause that property
   // to simply be ignored.  But there is a problem in one specific case: Java,
   // specifically java.lang.Integer.  The Integer class has static valueOf
   // methods, none of which are nullary, so the JS-reflected method will behave
   // poorly when called with no arguments.  We work around this problem by
   // giving plugins a [[DefaultValue]] which uses only toString and not valueOf.
 
   JS::Rooted<JS::Value> v(cx, JSVAL_VOID);
-  if (!JS_GetProperty(cx, obj, "toString", v.address()))
+  if (!JS_GetProperty(cx, obj, "toString", &v))
     return false;
   if (!JSVAL_IS_PRIMITIVE(v) && JS_ObjectIsCallable(cx, JSVAL_TO_OBJECT(v))) {
     if (!JS_CallFunctionValue(cx, obj, v, 0, NULL, vp.address()))
       return false;
     if (JSVAL_IS_PRIMITIVE(vp))
       return true;
   }
 
--- a/dom/src/geolocation/nsGeolocation.cpp
+++ b/dom/src/geolocation/nsGeolocation.cpp
@@ -713,27 +713,27 @@ nsGeolocationService::HandleMozsettingCh
     nsDependentString dataStr(aData);
     JS::Rooted<JS::Value> val(cx);
     if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) || !val.isObject()) {
       return;
     }
 
     JS::Rooted<JSObject*> obj(cx, &val.toObject());
     JS::Rooted<JS::Value> key(cx);
-    if (!JS_GetProperty(cx, obj, "key", key.address()) || !key.isString()) {
+    if (!JS_GetProperty(cx, obj, "key", &key) || !key.isString()) {
       return;
     }
 
     JSBool match;
     if (!JS_StringEqualsAscii(cx, key.toString(), GEO_SETINGS_ENABLED, &match) || (match != JS_TRUE)) {
       return;
     }
 
     JS::Rooted<JS::Value> value(cx);
-    if (!JS_GetProperty(cx, obj, "value", value.address()) || !value.isBoolean()) {
+    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isBoolean()) {
       return;
     }
 
     HandleMozsettingValue(value.toBoolean());
 }
 
 void
 nsGeolocationService::HandleMozsettingValue(const bool aValue)
--- a/dom/src/json/nsJSON.cpp
+++ b/dom/src/json/nsJSON.cpp
@@ -206,17 +206,17 @@ nsJSON::EncodeInternal(JSContext* cx, co
   /* Backward compatibility:
    * Manually call toJSON if implemented by the object and check that
    * the result is still an object
    * Note: It is perfectly fine to not implement toJSON, so it is
    * perfectly fine for GetMethod to fail
    */
   JS::Rooted<JS::Value> val(cx, aValue);
   JS::Rooted<JS::Value> toJSON(cx);
-  if (JS_GetProperty(cx, obj, "toJSON", toJSON.address()) &&
+  if (JS_GetProperty(cx, obj, "toJSON", &toJSON) &&
       toJSON.isObject() &&
       JS_ObjectIsCallable(cx, &toJSON.toObject())) {
     // If toJSON is implemented, it must not throw
     if (!JS_CallFunctionValue(cx, obj, toJSON, 0, NULL, val.address())) {
       if (JS_IsExceptionPending(cx))
         // passing NS_OK will throw the pending exception
         return NS_OK;
 
--- a/dom/system/OSFileConstants.cpp
+++ b/dom/system/OSFileConstants.cpp
@@ -600,17 +600,17 @@ static dom::ConstantSpec gWinProperties[
  *
  * If the field does not exist, create it. If it exists but is not an
  * object, throw a JS error.
  */
 JSObject *GetOrCreateObjectProperty(JSContext *cx, JS::Handle<JSObject*> aObject,
                                     const char *aProperty)
 {
   JS::Rooted<JS::Value> val(cx);
-  if (!JS_GetProperty(cx, aObject, aProperty, val.address())) {
+  if (!JS_GetProperty(cx, aObject, aProperty, &val)) {
     return NULL;
   }
   if (!val.isUndefined()) {
     if (val.isObject()) {
       return &val.toObject();
     }
 
     JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
--- a/dom/system/gonk/AudioManager.cpp
+++ b/dom/system/gonk/AudioManager.cpp
@@ -214,46 +214,46 @@ AudioManager::Observe(nsISupports* aSubj
                                             audioState, address.get());
       if (audioState == AUDIO_POLICY_DEVICE_STATE_AVAILABLE) {
         String8 cmd("bluetooth_enabled=true");
         AudioSystem::setParameters(0, cmd);
         cmd.setTo("A2dpSuspended=false");
         AudioSystem::setParameters(0, cmd);
       }
     }
-  } 
+  }
   // To process the volume control on each audio channel according to
   // change of settings
   else if (!strcmp(aTopic, "mozsettings-changed")) {
     AutoSafeJSContext cx;
     nsDependentString dataStr(aData);
     JS::Rooted<JS::Value> val(cx);
     if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
         !val.isObject()) {
       return NS_OK;
     }
 
     JS::Rooted<JSObject*> obj(cx, &val.toObject());
     JS::Rooted<JS::Value> key(cx);
-    if (!JS_GetProperty(cx, obj, "key", key.address()) ||
+    if (!JS_GetProperty(cx, obj, "key", &key) ||
         !key.isString()) {
       return NS_OK;
     }
 
     JS::RootedString jsKey(cx, JS_ValueToString(cx, key));
     if (!jsKey) {
       return NS_OK;
     }
     nsDependentJSString keyStr;
     if (!keyStr.init(cx, jsKey) || keyStr.EqualsLiteral("audio.volume.bt_sco")) {
       return NS_OK;
     }
 
     JS::Rooted<JS::Value> value(cx);
-    if (!JS_GetProperty(cx, obj, "value", value.address()) || !value.isInt32()) {
+    if (!JS_GetProperty(cx, obj, "value", &value) || !value.isInt32()) {
       return NS_OK;
     }
 
     int32_t index = value.toInt32();
     SetStreamVolumeIndex(AUDIO_STREAM_BLUETOOTH_SCO, index);
 
     return NS_OK;
   }
--- a/dom/system/gonk/AutoMounterSetting.cpp
+++ b/dom/system/gonk/AutoMounterSetting.cpp
@@ -181,29 +181,29 @@ AutoMounterSetting::Observe(nsISupports*
   mozilla::AutoSafeJSContext cx;
   nsDependentString dataStr(aData);
   JS::Rooted<JS::Value> val(cx);
   if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
       !val.isObject()) {
     return NS_OK;
   }
   JSObject& obj(val.toObject());
-  JS::Value key;
+  JS::Rooted<JS::Value> key(cx);
   if (!JS_GetProperty(cx, &obj, "key", &key) ||
       !key.isString()) {
     return NS_OK;
   }
 
   JSString *jsKey = JS_ValueToString(cx, key);
   nsDependentJSString keyStr;
   if (!keyStr.init(cx, jsKey)) {
     return NS_OK;
   }
 
-  JS::Value value;
+  JS::Rooted<JS::Value> value(cx);
   if (!JS_GetProperty(cx, &obj, "value", &value)) {
     return NS_OK;
   }
 
   // Check for ums.mode changes
   if (keyStr.EqualsLiteral(UMS_MODE)) {
     if (!value.isInt32()) {
       return NS_OK;
--- a/dom/system/gonk/TimeZoneSettingObserver.cpp
+++ b/dom/system/gonk/TimeZoneSettingObserver.cpp
@@ -175,29 +175,29 @@ TimeZoneSettingObserver::Observe(nsISupp
   JS::Rooted<JS::Value> val(cx);
   if (!JS_ParseJSON(cx, dataStr.get(), dataStr.Length(), &val) ||
       !val.isObject()) {
     return NS_OK;
   }
 
   // Get the key, which should be the JS string "time.timezone".
   JSObject &obj(val.toObject());
-  JS::Value key;
+  JS::Rooted<JS::Value> key(cx);
   if (!JS_GetProperty(cx, &obj, "key", &key) ||
       !key.isString()) {
     return NS_OK;
   }
   JSBool match;
   if (!JS_StringEqualsAscii(cx, key.toString(), TIME_TIMEZONE, &match) ||
       match != JS_TRUE) {
     return NS_OK;
   }
 
   // Get the value, which should be a JS string like "America/Chicago".
-  JS::Value value;
+  JS::Rooted<JS::Value> value(cx);
   if (!JS_GetProperty(cx, &obj, "value", &value) ||
       !value.isString()) {
     return NS_OK;
   }
 
   // Set the system timezone.
   return SetTimeZone(value, cx);
 }
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -30,17 +30,16 @@ var interfaceNamesInGlobalScope =
     "Array",
     "AsyncScrollEventDetail",
     "Attr",
     "BarProp",
     "BatteryManager",
     "BeforeUnloadEvent",
     "Blob",
     "BlobEvent",
-    "BoxObject",
     "CameraCapabilities",
     "CameraControl",
     "CameraManager",
     "CanvasGradient",
     "CanvasPattern",
     "CanvasRenderingContext2D",
     "CDATASection",
     "CharacterData",
@@ -478,20 +477,16 @@ var interfaceNamesInGlobalScope =
     "TextMetrics",
     "TimeEvent",
     "TimeRanges",
     "ToString",
     "Touch",
     "TouchEvent",
     "TouchList",
     "TransitionEvent",
-    "TreeColumn",
-    "TreeColumns",
-    "TreeContentView",
-    "TreeSelection",
     "TreeWalker",
     "UIEvent",
     "UndoManager",
     "URL",
     "UserDataHandler",
     "UserProximityEvent",
     "USSDReceivedEvent",
     "ValidityState",
@@ -527,19 +522,17 @@ var interfaceNamesInGlobalScope =
     "XULLabeledControlElement",
     "XULLabelElement",
     "XULMenuListElement",
     "XULMultiSelectControlElement",
     "XULPopupElement",
     "XULRelatedElement",
     "XULSelectControlElement",
     "XULSelectControlItemElement",
-    "XULTemplateBuilder",
     "XULTextBoxElement",
-    "XULTreeBuilder",
     "XULTreeElement",
   ]
 // IMPORTANT: Do not change this list without review from a DOM peer!
 
 // If your interface is named nsIDOMSomeInterface and you don't mean to expose
 // it to every webpage, simply change its name to nsISomeInterface to fix this problem.
 
 for (var i in SpecialPowers.Components.interfaces) {
--- a/dom/webidl/TreeColumns.webidl
+++ b/dom/webidl/TreeColumns.webidl
@@ -1,15 +1,16 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 interface MozTreeBoxObject;
 interface MozTreeColumn;
 
+[ChromeOnly]
 interface TreeColumns {
   /**
    * The tree widget for these columns.
    */
   readonly attribute MozTreeBoxObject? tree;
 
   /**
    * The number of columns.
--- a/dom/workers/ChromeWorkerScope.cpp
+++ b/dom/workers/ChromeWorkerScope.cpp
@@ -50,17 +50,17 @@ BEGIN_WORKERS_NAMESPACE
 bool
 DefineChromeWorkerFunctions(JSContext* aCx, JS::Handle<JSObject*> aGlobal)
 {
   // Currently ctypes is the only special property given to ChromeWorkers.
 #ifdef BUILD_CTYPES
   {
     JS::Rooted<JS::Value> ctypes(aCx);
     if (!JS_InitCTypesClass(aCx, aGlobal) ||
-        !JS_GetProperty(aCx, aGlobal, "ctypes", ctypes.address())) {
+        !JS_GetProperty(aCx, aGlobal, "ctypes", &ctypes)) {
       return false;
     }
 
     static JSCTypesCallbacks callbacks = {
       UnicodeToNative
     };
 
     JS_SetCTypesCallbacks(JSVAL_TO_OBJECT(ctypes), &callbacks);
--- a/dom/workers/EventListenerManager.cpp
+++ b/dom/workers/EventListenerManager.cpp
@@ -293,17 +293,17 @@ EventListenerManager::DispatchEvent(JSCo
   using namespace mozilla::dom::workers::events;
 
   if (!IsSupportedEventClass(aEvent)) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   JS::Rooted<JS::Value> val(aCx);
-  if (!JS_GetProperty(aCx, aEvent, "target", val.address())) {
+  if (!JS_GetProperty(aCx, aEvent, "target", &val)) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   if (!JSVAL_IS_NULL(val)) {
     // Already has a target, must be recursively dispatched. Throw.
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
@@ -311,26 +311,26 @@ EventListenerManager::DispatchEvent(JSCo
 
   if (mCollections.isEmpty()) {
     return false;
   }
 
   JS::Rooted<JSString*> eventType(aCx);
   JSBool eventIsTrusted;
 
-  if (!JS_GetProperty(aCx, aEvent, "type", val.address()) ||
+  if (!JS_GetProperty(aCx, aEvent, "type", &val) ||
       !(eventType = JS_ValueToString(aCx, val)) ||
       !(eventType = JS_InternJSString(aCx, eventType))) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   // We have already ensure that the event is one of our types of events so
   // there is no need to worry about this property being faked.
-  if (!JS_GetProperty(aCx, aEvent, "isTrusted", val.address()) ||
+  if (!JS_GetProperty(aCx, aEvent, "isTrusted", &val) ||
       !JS_ValueToBoolean(aCx, val, &eventIsTrusted)) {
     aRv.Throw(NS_ERROR_FAILURE);
     return false;
   }
 
   ListenerCollection* collection =
     GetCollectionForType(mCollections, INTERNED_STRING_TO_JSID(aCx, eventType));
   if (!collection) {
@@ -403,17 +403,17 @@ EventListenerManager::DispatchEvent(JSCo
       if (!JS_ReportPendingException(aCx)) {
         aRv.Throw(NS_ERROR_FAILURE);
         return false;
       }
       continue;
     }
 
     if (hasHandleEvent) {
-      if (!JS_GetProperty(aCx, listenerObj, sHandleEventChars, listenerVal.address())) {
+      if (!JS_GetProperty(aCx, listenerObj, sHandleEventChars, &listenerVal)) {
         if (!JS_ReportPendingException(aCx)) {
           aRv.Throw(NS_ERROR_FAILURE);
           return false;
         }
         continue;
       }
 
       thisObj = listenerObj;
--- a/dom/workers/Events.cpp
+++ b/dom/workers/Events.cpp
@@ -52,24 +52,24 @@ public:
 
   static JSObject*
   InitClass(JSContext* aCx, JS::Handle<JSObject*> aObj, bool aMainRuntime)
   {
     JS::Rooted<JSObject*> parentProto(aCx);
 
     if (aMainRuntime) {
       JS::Rooted<JS::Value> windowPropVal(aCx);
-      if (!JS_GetProperty(aCx, aObj, sClass.name, windowPropVal.address())) {
+      if (!JS_GetProperty(aCx, aObj, sClass.name, &windowPropVal)) {
         return NULL;
       }
 
       if (!JSVAL_IS_PRIMITIVE(windowPropVal)) {
         JS::Rooted<JS::Value> protoVal(aCx);
         if (!JS_GetProperty(aCx, JSVAL_TO_OBJECT(windowPropVal), "prototype",
-                            protoVal.address())) {
+                            &protoVal)) {
           return NULL;
         }
 
         if (!JSVAL_IS_PRIMITIVE(protoVal)) {
           parentProto = JSVAL_TO_OBJECT(protoVal);
         }
       }
     }
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -261,19 +261,20 @@ private:
     JS::Rooted<JS::Value> scope(aCx, js::GetFunctionNativeReserved(wrapper, SLOT_wrappedScope));
     JS::Rooted<JS::Value> listener(aCx, js::GetFunctionNativeReserved(wrapper, SLOT_wrappedFunction));
 
     JS_ASSERT(scope.isObject());
 
     JS::Rooted<JSObject*> event(aCx, &JS_ARGV(aCx, aVp)[0].toObject());
 
     jsval argv[3] = { JSVAL_VOID, JSVAL_VOID, JSVAL_VOID };
-    if (!JS_GetProperty(aCx, event, "message", &argv[0]) ||
-        !JS_GetProperty(aCx, event, "filename", &argv[1]) ||
-        !JS_GetProperty(aCx, event, "lineno", &argv[2])) {
+    JS::AutoArrayRooter rootedArgv(aCx, ArrayLength(argv), argv);
+    if (!JS_GetProperty(aCx, event, "message", rootedArgv.handleAt(0)) ||
+        !JS_GetProperty(aCx, event, "filename", rootedArgv.handleAt(1)) ||
+        !JS_GetProperty(aCx, event, "lineno", rootedArgv.handleAt(2))) {
       return false;
     }
 
     JS::Rooted<JS::Value> rval(aCx, JS::UndefinedValue());
     if (!JS_CallFunctionValue(aCx, JSVAL_TO_OBJECT(scope), listener,
                               ArrayLength(argv), argv, rval.address())) {
       JS_ReportPendingException(aCx);
       return false;
--- a/gfx/layers/d3d10/ContainerLayerD3D10.cpp
+++ b/gfx/layers/d3d10/ContainerLayerD3D10.cpp
@@ -236,35 +236,37 @@ ContainerLayerD3D10::RenderLayer()
     }
 
     hr = device()->CreateRenderTargetView(renderTexture, nullptr, getter_AddRefs(rtView));
     NS_ASSERTION(SUCCEEDED(hr), "Failed to create render target view for ContainerLayerD3D10!");
 
     effect()->GetVariableByName("vRenderTargetOffset")->
       GetRawValue(previousRenderTargetOffset, 0, 8);
 
+    previousViewportSize = mD3DManager->GetViewport();
+
     if (mVisibleRegion.GetNumRects() != 1 || !(GetContentFlags() & CONTENT_OPAQUE)) {
       const gfx3DMatrix& transform3D = GetEffectiveTransform();
       gfxMatrix transform;
       // If we have an opaque ancestor layer, then we can be sure that
       // all the pixels we draw into are either opaque already or will be
       // covered by something opaque. Otherwise copying up the background is
       // not safe.
       if (mSupportsComponentAlphaChildren) {
         bool is2d = transform3D.Is2D(&transform);
         NS_ASSERTION(is2d, "Transform should be 2d when mSupportsComponentAlphaChildren.");
 
         // Copy background up from below. This applies any 2D transform that is
         // applied to use relative to our parent, and compensates for the offset
         // that was applied on our parent's rendering.
         D3D10_BOX srcBox;
-        srcBox.left = visibleRect.x + int32_t(transform.x0) - int32_t(previousRenderTargetOffset[0]);
-        srcBox.top = visibleRect.y + int32_t(transform.y0) - int32_t(previousRenderTargetOffset[1]);
-        srcBox.right = srcBox.left + visibleRect.width;
-        srcBox.bottom = srcBox.top + visibleRect.height;
+        srcBox.left = std::max<int32_t>(visibleRect.x + int32_t(transform.x0) - int32_t(previousRenderTargetOffset[0]), 0);
+        srcBox.top = std::max<int32_t>(visibleRect.y + int32_t(transform.y0) - int32_t(previousRenderTargetOffset[1]), 0);
+        srcBox.right = std::min<int32_t>(srcBox.left + visibleRect.width, previousViewportSize.width);
+        srcBox.bottom = std::min<int32_t>(srcBox.top + visibleRect.height, previousViewportSize.height);
         srcBox.back = 1;
         srcBox.front = 0;
 
         nsRefPtr<ID3D10Resource> srcResource;
         previousRTView->GetResource(getter_AddRefs(srcResource));
 
         device()->CopySubresourceRegion(renderTexture, 0,
                                         0, 0, 0,
@@ -279,17 +281,16 @@ ContainerLayerD3D10::RenderLayer()
     ID3D10RenderTargetView *rtViewPtr = rtView;
     device()->OMSetRenderTargets(1, &rtViewPtr, nullptr);
 
     renderTargetOffset[0] = (float)visibleRect.x;
     renderTargetOffset[1] = (float)visibleRect.y;
     effect()->GetVariableByName("vRenderTargetOffset")->
       SetRawValue(renderTargetOffset, 0, 8);
 
-    previousViewportSize = mD3DManager->GetViewport();
     mD3DManager->SetViewport(nsIntSize(visibleRect.Size()));
   }
     
   D3D10_RECT oldD3D10Scissor;
   UINT numRects = 1;
   device()->RSGetScissorRects(&numRects, &oldD3D10Scissor);
   // Convert scissor to an nsIntRect. D3D10_RECT's are exclusive
   // on the bottom and right values.
--- a/hal/linux/udev.h
+++ b/hal/linux/udev.h
@@ -7,28 +7,39 @@
  * linking directly to it and use dlopen instead.
  */
 
 #ifndef HAL_LINUX_UDEV_H_
 #define HAL_LINUX_UDEV_H_
 
 #include <dlfcn.h>
 
+#include "mozilla/Util.h"
+
 namespace mozilla {
 
 struct udev;
 struct udev_device;
 struct udev_enumerate;
 struct udev_list_entry;
 struct udev_monitor;
 
 class udev_lib {
  public:
-  udev_lib() : lib(dlopen("libudev.so.0", RTLD_LAZY | RTLD_GLOBAL)),
-               udev(NULL) {
+  udev_lib() : lib(nullptr),
+               udev(nullptr) {
+    // Be careful about ABI compat! 0 -> 1 didn't change any
+    // symbols this code relies on, per:
+    // https://lists.fedoraproject.org/pipermail/devel/2012-June/168227.html
+    const char* lib_names[] = {"libudev.so.0", "libudev.so.1"};
+    for (unsigned i = 0; i < ArrayLength(lib_names); i++) {
+      lib = dlopen(lib_names[i], RTLD_LAZY | RTLD_GLOBAL);
+      if (lib)
+        break;
+    }
     if (lib && LoadSymbols())
       udev = udev_new();
   }
 
   ~udev_lib() {
     if (udev) {
       udev_unref(udev);
     }
--- a/ipc/glue/ProtocolUtils.cpp
+++ b/ipc/glue/ProtocolUtils.cpp
@@ -119,10 +119,19 @@ UnpackChannelOpened(const PrivateIPDLInt
                     const Message& aMsg,
                     TransportDescriptor* aTransport,
                     ProcessId* aOtherProcess,
                     ProtocolId* aProtocol)
 {
   return ChannelOpened::Read(aMsg, aTransport, aOtherProcess, aProtocol);
 }
 
+void
+ProtocolErrorBreakpoint(const char* aMsg)
+{
+    // Bugs that generate these error messages can be tough to
+    // reproduce.  Log always in the hope that someone finds the error
+    // message.
+    printf_stderr("IPDL protocol error: %s\n", aMsg);
+}
+
 } // namespace ipc
 } // namespace mozilla
--- a/ipc/glue/ProtocolUtils.h
+++ b/ipc/glue/ProtocolUtils.h
@@ -107,24 +107,18 @@ LoggingEnabled()
 {
 #if defined(DEBUG)
     return !!PR_GetEnv("MOZ_IPC_MESSAGE_LOG");
 #else
     return false;
 #endif
 }
 
-inline void
-ProtocolErrorBreakpoint(const char* aMsg)
-{
-    // Bugs that generate these error messages can be tough to
-    // reproduce.  Log always in the hope that someone finds the error
-    // message.
-    printf_stderr("IPDL protocol error: %s\n", aMsg);
-}
+void
+ProtocolErrorBreakpoint(const char* aMsg);
 
 typedef IPCMessageStart ProtocolId;
 
 struct PrivateIPDLInterface {};
 
 bool
 Bridge(const PrivateIPDLInterface&,
        AsyncChannel*, base::ProcessHandle, AsyncChannel*, base::ProcessHandle,
--- a/ipc/testshell/XPCShellEnvironment.cpp
+++ b/ipc/testshell/XPCShellEnvironment.cpp
@@ -73,17 +73,17 @@ private:
 };
 
 inline XPCShellEnvironment*
 Environment(JSObject* global)
 {
     AutoSafeJSContext cx;
     JSAutoCompartment ac(cx, global);
     Rooted<Value> v(cx);
-    if (!JS_GetProperty(cx, global, "__XPCShellEnvironment", v.address()) ||
+    if (!JS_GetProperty(cx, global, "__XPCShellEnvironment", &v) ||
         !v.get().isDouble())
     {
         return nullptr;
     }
     return static_cast<XPCShellEnvironment*>(v.get().toPrivate());
 }
 
 static JSBool
--- a/js/ipc/JavaScriptChild.cpp
+++ b/js/ipc/JavaScriptChild.cpp
@@ -367,17 +367,17 @@ JavaScriptChild::AnswerGet(const ObjectI
         return false;
 
     JSAutoCompartment comp(cx, obj);
 
     RootedId internedId(cx);
     if (!convertGeckoStringToId(cx, id, &internedId))
         return fail(cx, rs);
 
-    JS::Value val;
+    JS::Rooted<JS::Value> val(cx);
     if (!JS_ForwardGetPropertyTo(cx, obj, internedId, receiver, &val))
         return fail(cx, rs);
 
     if (!toVariant(cx, val, result))
         return fail(cx, rs);
 
     return ok(rs);
 }
@@ -511,17 +511,17 @@ JavaScriptChild::AnswerCall(const Object
 
     // Go through each argument that was an outparam, retrieve the "value"
     // field, and add it to a temporary list. We need to do this separately
     // because the outparams vector is not rooted.
     vals.clear();
     for (size_t i = 0; i < outobjects.length(); i++) {
         RootedObject obj(cx, &outobjects[i].toObject());
 
-        jsval v;
+        RootedValue v(cx);
         JSBool found;
         if (JS_HasProperty(cx, obj, "value", &found)) {
             if (!JS_GetProperty(cx, obj, "value", &v))
                 return fail(cx, rs);
         } else {
             v = UndefinedValue();
         }
         if (!vals.append(v))
--- a/js/ipc/JavaScriptShared.cpp
+++ b/js/ipc/JavaScriptShared.cpp
@@ -452,17 +452,17 @@ JavaScriptShared::Wrap(JSContext *cx, Ha
     RootedValue v(cx);
     for (size_t i = 0; i < ids.length(); i++) {
         id = ids[i];
 
         nsString str;
         if (!convertIdToGeckoString(cx, id, &str))
             return false;
 
-        if (!JS_GetPropertyById(cx, aObj, id, v.address()))
+        if (!JS_GetPropertyById(cx, aObj, id, &v))
             return false;
 
         JSVariant var;
         if (!toVariant(cx, v, &var))
             return false;
 
         outCpows->AppendElement(CpowEntry(str, var));
     }
--- a/js/jsd/jsd_val.cpp
+++ b/js/jsd/jsd_val.cpp
@@ -504,17 +504,17 @@ jsd_GetValueProperty(JSDContext* jsdc, J
         JS_GetUCPropertyAttributes(cx, obj, nameChars, nameLen, &attrs, &found);
         if (!found)
         {
             return NULL;
         }
 
         JS_ClearPendingException(cx);
 
-        if(!JS_GetUCProperty(cx, obj, nameChars, nameLen, val.address()))
+        if(!JS_GetUCProperty(cx, obj, nameChars, nameLen, &val))
         {
             if (JS_IsExceptionPending(cx))
             {
                 if (!JS_GetPendingException(cx, &pd.value))
                 {
                     return NULL;
                 }
                 pd.flags = JSPD_EXCEPTION;
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -1252,17 +1252,17 @@ GetCallbacks(JSObject* obj)
 
 // Utility function to access a property of an object as an object
 // returns false and sets the error if the property does not exist
 // or is not an object
 static bool GetObjectProperty(JSContext *cx, HandleObject obj,
                               const char *property, MutableHandleObject result)
 {
   RootedValue val(cx);
-  if (!JS_GetProperty(cx, obj, property, val.address())) {
+  if (!JS_GetProperty(cx, obj, property, &val)) {
     return false;
   }
 
   if (JSVAL_IS_PRIMITIVE(val)) {
     JS_ReportError(cx, "missing or non-object field");
     return false;
   }
 
@@ -2539,17 +2539,17 @@ ImplicitConvert(JSContext* cx,
         }
 
         JSFlatString *name = JSID_TO_FLAT_STRING(id);
         const FieldInfo* field = StructType::LookupField(cx, targetType, name);
         if (!field)
           return false;
 
         RootedValue prop(cx);
-        if (!JS_GetPropertyById(cx, valObj, id, prop.address()))
+        if (!JS_GetPropertyById(cx, valObj, id, &prop))
           return false;
 
         // Convert the field via ImplicitConvert().
         char* fieldData = intermediate.get() + field->mOffset;
         if (!ImplicitConvert(cx, prop, field->mType, fieldData, false, NULL))
           return false;
 
         ++i;
@@ -4287,17 +4287,17 @@ ArrayType::ConstructData(JSContext* cx,
       // Have a length, rather than an object to initialize from.
       convertObject = false;
 
     } else if (!JSVAL_IS_PRIMITIVE(args[0])) {
       // We were given an object with a .length property.
       // This could be a JS array, or a CData array.
       RootedObject arg(cx, &args[0].toObject());
       RootedValue lengthVal(cx);
-      if (!JS_GetProperty(cx, arg, "length", lengthVal.address()) ||
+      if (!JS_GetProperty(cx, arg, "length", &lengthVal) ||
           !jsvalToSize(cx, lengthVal, false, &length)) {
         JS_ReportError(cx, "argument must be an array object or length");
         return JS_FALSE;
       }
 
     } else if (args[0].isString()) {
       // We were given a string. Size the array to the appropriate length,
       // including space for the terminator.
@@ -4639,17 +4639,17 @@ ExtractStructField(JSContext* cx, jsval 
   if (!JS_NextProperty(cx, iter, &id))
     return NULL;
   if (!JSID_IS_VOID(id)) {
     JS_ReportError(cx, "struct field descriptors must contain one property");
     return NULL;
   }
 
   RootedValue propVal(cx);
-  if (!JS_GetPropertyById(cx, obj, nameid, propVal.address()))
+  if (!JS_GetPropertyById(cx, obj, nameid, &propVal))
     return NULL;
 
   if (propVal.isPrimitive() || !CType::IsCType(&propVal.toObject())) {
     JS_ReportError(cx, "struct field descriptors require a valid name and type");
     return NULL;
   }
 
   // Undefined size or zero size struct members are illegal.
@@ -7406,17 +7406,17 @@ Int64::Construct(JSContext* cx,
 
   int64_t i = 0;
   if (!jsvalToBigInteger(cx, args[0], true, &i))
     return TypeError(cx, "int64", args[0]);
 
   // Get ctypes.Int64.prototype from the 'prototype' property of the ctor.
   RootedValue slot(cx);
   RootedObject callee(cx, &args.callee());
-  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", slot.address()));
+  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", &slot));
   RootedObject proto(cx, JSVAL_TO_OBJECT(slot));
   JS_ASSERT(JS_GetClass(proto) == &sInt64ProtoClass);
 
   JSObject* result = Int64Base::Construct(cx, proto, i, false);
   if (!result)
     return JS_FALSE;
 
   args.rval().setObject(*result);
@@ -7576,17 +7576,17 @@ UInt64::Construct(JSContext* cx,
 
   uint64_t u = 0;
   if (!jsvalToBigInteger(cx, args[0], true, &u))
     return TypeError(cx, "uint64", args[0]);
 
   // Get ctypes.UInt64.prototype from the 'prototype' property of the ctor.
   RootedValue slot(cx);
   RootedObject callee(cx, &args.callee());
-  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", slot.address()));
+  ASSERT_OK(JS_GetProperty(cx, callee, "prototype", &slot));
   RootedObject proto(cx, &slot.toObject());
   JS_ASSERT(JS_GetClass(proto) == &sUInt64ProtoClass);
 
   JSObject* result = Int64Base::Construct(cx, proto, u, true);
   if (!result)
     return JS_FALSE;
 
   args.rval().setObject(*result);
--- a/js/src/ion/arm/Assembler-arm.cpp
+++ b/js/src/ion/arm/Assembler-arm.cpp
@@ -2803,13 +2803,13 @@ AutoFlushCache::flushAnyway()
         JSC::ExecutableAllocator::cacheFlush(NULL, 0xff000000);
     }
     used_ = false;
 }
 InstructionIterator::InstructionIterator(Instruction *i_) : i(i_) {
     const PoolHeader *ph;
     // If this is a guard, and the next instruction is a header, always work around the pool
     // If it isn't a guard, then start looking ahead.
-    if (InstIsGuard(i, &ph)) {
+    if (InstIsArtificialGuard(i, &ph)) {
         i = i->next();
     }
 }
 Assembler *Assembler::dummy = NULL;
--- a/js/src/ion/arm/MacroAssembler-arm.cpp
+++ b/js/src/ion/arm/MacroAssembler-arm.cpp
@@ -337,16 +337,24 @@ NextInst(Instruction *i)
     return i->next();
 }
 
 void
 MacroAssemblerARM::ma_movPatchable(Imm32 imm_, Register dest,
                                    Assembler::Condition c, RelocStyle rs, Instruction *i)
 {
     int32_t imm = imm_.value;
+    if (i) {
+        // Make sure the current instruction is not an artificial guard
+        // inserted by the assembler buffer.
+        // The InstructionIterator already does this and handles edge cases,
+        // so, just asking an iterator for its current instruction should be
+        // enough to make sure we don't accidentally inspect an artificial guard.
+        i = InstructionIterator(i).cur();
+    }
     switch(rs) {
       case L_MOVWT:
         as_movw(dest, Imm16(imm & 0xffff), c, i);
         // i can be NULL here.  that just means "insert in the next in sequence."
         // NextInst is special cased to not do anything when it is passed NULL, so two
         // consecutive instructions will be inserted.
         i = NextInst(i);
         as_movt(dest, Imm16(imm >> 16 & 0xffff), c, i);
--- a/js/src/jsapi-tests/testArrayBuffer.cpp
+++ b/js/src/jsapi-tests/testArrayBuffer.cpp
@@ -34,19 +34,19 @@ BEGIN_TEST(testArrayBuffer_bug720949_ste
         JS::HandleObject obj = testBuf[i];
         JS::HandleObject view = testArray[i];
         uint32_t size = sizes[i];
         JS::RootedValue v(cx);
 
         // Byte lengths should all agree
         CHECK(JS_IsArrayBufferObject(obj));
         CHECK_EQUAL(JS_GetArrayBufferByteLength(obj), size);
-        JS_GetProperty(cx, obj, "byteLength", v.address());
+        JS_GetProperty(cx, obj, "byteLength", &v);
         CHECK_SAME(v, INT_TO_JSVAL(size));
-        JS_GetProperty(cx, view, "byteLength", v.address());
+        JS_GetProperty(cx, view, "byteLength", &v);
         CHECK_SAME(v, INT_TO_JSVAL(size));
 
         // Modifying the underlying data should update the value returned through the view
         uint8_t *data = JS_GetArrayBufferData(obj);
         CHECK(data != NULL);
         *reinterpret_cast<uint32_t*>(data) = MAGIC_VALUE_2;
         CHECK(JS_GetElement(cx, view, 0, v.address()));
         CHECK_SAME(v, INT_TO_JSVAL(MAGIC_VALUE_2));
@@ -54,23 +54,23 @@ BEGIN_TEST(testArrayBuffer_bug720949_ste
         // Steal the contents
         void *contents;
         CHECK(JS_StealArrayBufferContents(cx, obj, &contents, &data));
         CHECK(contents != NULL);
         CHECK(data != NULL);
 
         // Check that the original ArrayBuffer is neutered
         CHECK_EQUAL(JS_GetArrayBufferByteLength(obj), 0);
-        CHECK(JS_GetProperty(cx, obj, "byteLength", v.address()));
+        CHECK(JS_GetProperty(cx, obj, "byteLength", &v));
         CHECK_SAME(v, INT_TO_JSVAL(0));
-        CHECK(JS_GetProperty(cx, view, "byteLength", v.address()));
+        CHECK(JS_GetProperty(cx, view, "byteLength", &v));
         CHECK_SAME(v, INT_TO_JSVAL(0));
-        CHECK(JS_GetProperty(cx, view, "byteOffset", v.address()));
+        CHECK(JS_GetProperty(cx, view, "byteOffset", &v));
         CHECK_SAME(v, INT_TO_JSVAL(0));
-        CHECK(JS_GetProperty(cx, view, "length", v.address()));
+        CHECK(JS_GetProperty(cx, view, "length", &v));
         CHECK_SAME(v, INT_TO_JSVAL(0));
         CHECK_EQUAL(JS_GetArrayBufferByteLength(obj), 0);
         v = JSVAL_VOID;
         JS_GetElement(cx, obj, 0, v.address());
         CHECK_SAME(v, JSVAL_VOID);
 
         // Transfer to a new ArrayBuffer
         JS::RootedObject dst(cx, JS_NewArrayBufferWithContents(cx, contents));
@@ -159,12 +159,12 @@ BEGIN_TEST(testArrayBuffer_bug720949_vie
         GC(cx);
     }
 
     return true;
 }
 
 bool isNeutered(JS::HandleObject obj) {
     JS::RootedValue v(cx);
-    return JS_GetProperty(cx, obj, "byteLength", v.address()) && v.toInt32() == 0;
+    return JS_GetProperty(cx, obj, "byteLength", &v) && v.toInt32() == 0;
 }
 
 END_TEST(testArrayBuffer_bug720949_viewList)
--- a/js/src/jsapi-tests/testException.cpp
+++ b/js/src/jsapi-tests/testException.cpp
@@ -13,13 +13,13 @@ BEGIN_TEST(testException_bug860435)
 
     EVAL("ReferenceError", fun.address());
     CHECK(fun.isObject());
 
     JS::RootedValue v(cx);
     JS_CallFunctionValue(cx, global, fun, 0, v.address(), v.address());
     CHECK(v.isObject());
 
-    JS_GetProperty(cx, &v.toObject(), "stack", v.address());
+    JS_GetProperty(cx, &v.toObject(), "stack", &v);
     CHECK(v.isString());
     return true;
 }
 END_TEST(testException_bug860435)
--- a/js/src/jsapi-tests/testFunctionProperties.cpp
+++ b/js/src/jsapi-tests/testFunctionProperties.cpp
@@ -10,17 +10,17 @@
 BEGIN_TEST(testFunctionProperties)
 {
     JS::RootedValue x(cx);
     EVAL("(function f() {})", x.address());
 
     JS::RootedObject obj(cx, JSVAL_TO_OBJECT(x));
 
     JS::RootedValue y(cx);
-    CHECK(JS_GetProperty(cx, obj, "arguments", y.address()));
+    CHECK(JS_GetProperty(cx, obj, "arguments", &y));
     CHECK_SAME(y, JSVAL_NULL);
 
-    CHECK(JS_GetProperty(cx, obj, "caller", y.address()));
+    CHECK(JS_GetProperty(cx, obj, "caller", &y));
     CHECK_SAME(y, JSVAL_NULL);
 
     return true;
 }
 END_TEST(testFunctionProperties)
--- a/js/src/jsapi-tests/testGetPropertyDefault.cpp
+++ b/js/src/jsapi-tests/testGetPropertyDefault.cpp
@@ -27,21 +27,21 @@ BEGIN_TEST(testGetPropertyDefault_bug594
 
         JS::RootedObject obj(cx, JS_NewObject(cx, NULL, NULL, NULL));
         CHECK(obj);
 
         JS::RootedValue v0(cx, JSVAL_TRUE);
         CHECK(JS_SetProperty(cx, obj, "here", v0));
 
         JS::RootedValue v1(cx);
-        CHECK(JS_GetPropertyDefault(cx, obj, "here", JSVAL_FALSE, v1.address()));
+        CHECK(JS_GetPropertyDefault(cx, obj, "here", JSVAL_FALSE, &v1));
         CHECK(JSVAL_IS_TRUE(v1));
 
         JS::RootedValue v2(cx);
-        CHECK(JS_GetPropertyDefault(cx, obj, "nothere", JSVAL_FALSE, v2.address()));
+        CHECK(JS_GetPropertyDefault(cx, obj, "nothere", JSVAL_FALSE, &v2));
         CHECK(JSVAL_IS_FALSE(v2));
     }
 
     {
         // Check JS_GetPropertyByIdDefault
 
         JS::RootedObject obj(cx, JS_NewObject(cx, NULL, NULL, NULL));
         CHECK(obj);
@@ -51,19 +51,19 @@ BEGIN_TEST(testGetPropertyDefault_bug594
 
         JS::RootedId nothereid(cx);
         CHECK(stringToId(cx, "nothere", nothereid.address()));
 
         JS::RootedValue v0(cx, JSVAL_TRUE);
         CHECK(JS_SetPropertyById(cx, obj, hereid, v0));
 
         JS::RootedValue v1(cx);
-        CHECK(JS_GetPropertyByIdDefault(cx, obj, hereid, JSVAL_FALSE, v1.address()));
+        CHECK(JS_GetPropertyByIdDefault(cx, obj, hereid, JSVAL_FALSE, &v1));
         CHECK(JSVAL_IS_TRUE(v1));
 
         JS::RootedValue v2(cx);
-        CHECK(JS_GetPropertyByIdDefault(cx, obj, nothereid, JSVAL_FALSE, v2.address()));
+        CHECK(JS_GetPropertyByIdDefault(cx, obj, nothereid, JSVAL_FALSE, &v2));
         CHECK(JSVAL_IS_FALSE(v2));
     }
 
     return true;
 }
 END_TEST(testGetPropertyDefault_bug594060)
--- a/js/src/jsapi-tests/testParseJSON.cpp
+++ b/js/src/jsapi-tests/testParseJSON.cpp
@@ -109,40 +109,40 @@ BEGIN_TEST(testParseJSON_success)
     // Arrays
     JS::RootedValue v(cx), v2(cx);
     JS::RootedObject obj(cx);
 
     CHECK(Parse(cx, "[]", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(JS_IsArrayObject(cx, obj));
-    CHECK(JS_GetProperty(cx, obj, "length", v2.address()));
+    CHECK(JS_GetProperty(cx, obj, "length", &v2));
     CHECK_SAME(v2, JSVAL_ZERO);
 
     CHECK(Parse(cx, "[1]", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(JS_IsArrayObject(cx, obj));
-    CHECK(JS_GetProperty(cx, obj, "0", v2.address()));
+    CHECK(JS_GetProperty(cx, obj, "0", &v2));
     CHECK_SAME(v2, JSVAL_ONE);
-    CHECK(JS_GetProperty(cx, obj, "length", v2.address()));
+    CHECK(JS_GetProperty(cx, obj, "length", &v2));
     CHECK_SAME(v2, JSVAL_ONE);
 
 
     // Objects
     CHECK(Parse(cx, "{}", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(!JS_IsArrayObject(cx, obj));
 
     CHECK(Parse(cx, "{ \"f\": 17 }", &v));
     CHECK(!JSVAL_IS_PRIMITIVE(v));
     obj = JSVAL_TO_OBJECT(v);
     CHECK(!JS_IsArrayObject(cx, obj));
-    CHECK(JS_GetProperty(cx, obj, "f", v2.address()));
+    CHECK(JS_GetProperty(cx, obj, "f", &v2));
     CHECK_SAME(v2, INT_TO_JSVAL(17));
 
     return true;
 }
 
 template<size_t N> inline bool
 Parse(JSContext *cx, const char (&input)[N], JS::MutableHandleValue vp)
 {
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3765,55 +3765,47 @@ JS_SetUCPropertyAttributes(JSContext *cx
 {
     RootedObject obj(cx, objArg);
     JSAtom *atom = AtomizeChars<CanGC>(cx, name, AUTO_NAMELEN(name, namelen));
     RootedId id(cx, AtomToId(atom));
     return atom && SetPropertyAttributesById(cx, obj, id, attrs, foundp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetPropertyById(JSContext *cx, JSObject *objArg, jsid idArg, jsval *vp)
+JS_GetPropertyById(JSContext *cx, JSObject *objArg, jsid idArg, MutableHandleValue vp)
 {
     return JS_ForwardGetPropertyTo(cx, objArg, idArg, objArg, vp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_ForwardGetPropertyTo(JSContext *cx, JSObject *objArg, jsid idArg, JSObject *onBehalfOfArg, jsval *vp)
+JS_ForwardGetPropertyTo(JSContext *cx, JSObject *objArg, jsid idArg, JSObject *onBehalfOfArg,
+                        MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
     RootedObject onBehalfOf(cx, onBehalfOfArg);
     RootedId id(cx, idArg);
 
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, obj, id);
     assertSameCompartment(cx, onBehalfOf);
     JSAutoResolveFlags rf(cx, 0);
 
-    RootedValue value(cx);
-    if (!JSObject::getGeneric(cx, obj, onBehalfOf, id, &value))
-        return false;
-
-    *vp = value;
-    return true;
-}
-
-JS_PUBLIC_API(JSBool)
-JS_GetPropertyByIdDefault(JSContext *cx, JSObject *objArg, jsid idArg, jsval defArg, jsval *vp)
+    return JSObject::getGeneric(cx, obj, onBehalfOf, id, vp);
+}
+
+JS_PUBLIC_API(JSBool)
+JS_GetPropertyByIdDefault(JSContext *cx, JSObject *objArg, jsid idArg, jsval defArg,
+                          MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
     RootedId id(cx, idArg);
     RootedValue def(cx, defArg);
 
-    RootedValue value(cx);
-    if (!baseops::GetPropertyDefault(cx, obj, id, def, &value))
-        return false;
-
-    *vp = value;
-    return true;
+    return baseops::GetPropertyDefault(cx, obj, id, def, vp);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_GetElement(JSContext *cx, JSObject *objArg, uint32_t index, jsval *vp)
 {
     return JS_ForwardGetElementTo(cx, objArg, index, objArg, vp);
 }
 
@@ -3851,34 +3843,36 @@ JS_GetElementIfPresent(JSContext *cx, JS
         return false;
 
     *vp = value;
     *present = isPresent;
     return true;
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetProperty(JSContext *cx, JSObject *objArg, const char *name, jsval *vp)
+JS_GetProperty(JSContext *cx, JSObject *objArg, const char *name, MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
     JSAtom *atom = Atomize(cx, name, strlen(name));
     return atom && JS_GetPropertyById(cx, obj, AtomToId(atom), vp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetPropertyDefault(JSContext *cx, JSObject *objArg, const char *name, jsval defArg, jsval *vp)
+JS_GetPropertyDefault(JSContext *cx, JSObject *objArg, const char *name, jsval defArg,
+                      MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
     RootedValue def(cx, defArg);
     JSAtom *atom = Atomize(cx, name, strlen(name));
     return atom && JS_GetPropertyByIdDefault(cx, obj, AtomToId(atom), def, vp);
 }
 
 JS_PUBLIC_API(JSBool)
-JS_GetUCProperty(JSContext *cx, JSObject *objArg, const jschar *name, size_t namelen, jsval *vp)
+JS_GetUCProperty(JSContext *cx, JSObject *objArg, const jschar *name, size_t namelen,
+                 MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
     JSAtom *atom = AtomizeChars<CanGC>(cx, name, AUTO_NAMELEN(name, namelen));
     return atom && JS_GetPropertyById(cx, obj, AtomToId(atom), vp);
 }
 
 JS_PUBLIC_API(JSBool)
 JS_SetPropertyById(JSContext *cx, JSObject *objArg, jsid idArg, HandleValue v)
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -3502,29 +3502,32 @@ class MutableHandleBase<JSPropertyDescri
 extern JS_PUBLIC_API(JSBool)
 JS_GetPropertyDescriptorById(JSContext *cx, JSObject *obj, jsid id, unsigned flags,
                              JSPropertyDescriptor *desc);
 
 extern JS_PUBLIC_API(JSBool)
 JS_GetOwnPropertyDescriptor(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetProperty(JSContext *cx, JSObject *obj, const char *name, jsval *vp);
+JS_GetProperty(JSContext *cx, JSObject *obj, const char *name, JS::MutableHandle<JS::Value> vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetPropertyDefault(JSContext *cx, JSObject *obj, const char *name, jsval def, jsval *vp);
+JS_GetPropertyDefault(JSContext *cx, JSObject *obj, const char *name, jsval def,
+                      JS::MutableHandle<JS::Value> vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetPropertyById(JSContext *cx, JSObject *obj, jsid id, jsval *vp);
+JS_GetPropertyById(JSContext *cx, JSObject *obj, jsid id, JS::MutableHandle<JS::Value> vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_GetPropertyByIdDefault(JSContext *cx, JSObject *obj, jsid id, jsval def, jsval *vp);
+JS_GetPropertyByIdDefault(JSContext *cx, JSObject *obj, jsid id, jsval def,
+                          JS::MutableHandle<JS::Value> vp);
 
 extern JS_PUBLIC_API(JSBool)
-JS_ForwardGetPropertyTo(JSContext *cx, JSObject *obj, jsid id, JSObject *onBehalfOf, jsval *vp);
+JS_ForwardGetPropertyTo(JSContext *cx, JSObject *obj, jsid id, JSObject *onBehalfOf,
+                        JS::MutableHandle<JS::Value> vp);
 
 extern JS_PUBLIC_API(JSBool)
 JS_SetProperty(JSContext *cx, JSObject *obj, const char *name, JS::Handle<JS::Value> v);
 
 extern JS_PUBLIC_API(JSBool)
 JS_SetPropertyById(JSContext *cx, JSObject *obj, jsid id, JS::Handle<JS::Value> v);
 
 extern JS_PUBLIC_API(JSBool)
@@ -3600,17 +3603,17 @@ JS_HasUCProperty(JSContext *cx, JSObject
 extern JS_PUBLIC_API(JSBool)
 JS_LookupUCProperty(JSContext *cx, JSObject *obj,
                     const jschar *name, size_t namelen,
                     jsval *vp);
 
 extern JS_PUBLIC_API(JSBool)
 JS_GetUCProperty(JSContext *cx, JSObject *obj,
                  const jschar *name, size_t namelen,
-                 jsval *vp);
+                 JS::MutableHandle<JS::Value> vp);
 
 extern JS_PUBLIC_API(JSBool)
 JS_SetUCProperty(JSContext *cx, JSObject *obj,
                  const jschar *name, size_t namelen,
                  JS::Handle<JS::Value> v);
 
 extern JS_PUBLIC_API(JSBool)
 JS_DeleteUCProperty2(JSContext *cx, JSObject *obj,
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -1100,28 +1100,28 @@ FormatFrame(JSContext *cx, const NonBuil
                                     desc->value.isString() ? "\"" : "");
             if (!buf)
                 return buf;
             namedArgCount++;
         }
 
         // print any unnamed trailing args (found in 'arguments' object)
         RootedValue val(cx);
-        if (JS_GetProperty(cx, callObj, "arguments", val.address()) && val.isObject()) {
+        if (JS_GetProperty(cx, callObj, "arguments", &val) && val.isObject()) {
             uint32_t argCount;
             RootedObject argsObj(cx, &val.toObject());
-            if (JS_GetProperty(cx, argsObj, "length", val.address()) &&
+            if (JS_GetProperty(cx, argsObj, "length", &val) &&
                 ToUint32(cx, val, &argCount) &&
                 argCount > namedArgCount)
             {
                 for (uint32_t k = namedArgCount; k < argCount; k++) {
                     char number[8];
                     JS_snprintf(number, 8, "%d", (int) k);
 
-                    if (JS_GetProperty(cx, argsObj, number, val.address())) {
+                    if (JS_GetProperty(cx, argsObj, number, &val)) {
                         JSAutoByteString valueBytes;
                         const char *value = FormatValue(cx, val, valueBytes);
                         buf = JS_sprintf_append(buf, "%s%s%s%s",
                                                 k ? ", " : "",
                                                 val.isString() ? "\"" : "",
                                                 value ? value : "?unknown?",
                                                 val.isString() ? "\"" : "");
                         if (!buf)
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -1043,24 +1043,24 @@ js_ReportUncaughtException(JSContext *cx
         roots[1] = StringValue(str);
 
     const char *filename_str = js_fileName_str;
     JSAutoByteString filename;
     if (!reportp && exnObject &&
         (exnObject->is<ErrorObject>() || IsDuckTypedErrorObject(cx, exnObject, &filename_str)))
     {
         RootedString name(cx);
-        if (JS_GetProperty(cx, exnObject, js_name_str, &roots[2]) &&
+        if (JS_GetProperty(cx, exnObject, js_name_str, tvr.handleAt(2)) &&
             JSVAL_IS_STRING(roots[2]))
         {
             name = JSVAL_TO_STRING(roots[2]);
         }
 
         RootedString msg(cx);
-        if (JS_GetProperty(cx, exnObject, js_message_str, &roots[3]) &&
+        if (JS_GetProperty(cx, exnObject, js_message_str, tvr.handleAt(3)) &&
             JSVAL_IS_STRING(roots[3]))
         {
             msg = JSVAL_TO_STRING(roots[3]);
         }
 
         if (name && msg) {
             RootedString colon(cx, JS_NewStringCopyZ(cx, ": "));
             if (!colon)
@@ -1072,31 +1072,31 @@ js_ReportUncaughtException(JSContext *cx
             if (!str)
                 return false;
         } else if (name) {
             str = name;
         } else if (msg) {
             str = msg;
         }
 
-        if (JS_GetProperty(cx, exnObject, filename_str, &roots[4])) {
+        if (JS_GetProperty(cx, exnObject, filename_str, tvr.handleAt(4))) {
             JSString *tmp = ToString<CanGC>(cx, HandleValue::fromMarkedLocation(&roots[4]));
             if (tmp)
                 filename.encodeLatin1(cx, tmp);
         }
 
         uint32_t lineno;
-        if (!JS_GetProperty(cx, exnObject, js_lineNumber_str, &roots[5]) ||
+        if (!JS_GetProperty(cx, exnObject, js_lineNumber_str, tvr.handleAt(5)) ||
             !ToUint32(cx, roots[5], &lineno))
         {
             lineno = 0;
         }
 
         uint32_t column;
-        if (!JS_GetProperty(cx, exnObject, js_columnNumber_str, &roots[5]) ||
+        if (!JS_GetProperty(cx, exnObject, js_columnNumber_str, tvr.handleAt(5)) ||
             !ToUint32(cx, roots[5], &column))
         {
             column = 0;
         }
 
         reportp = &report;
         PodZero(&report);
         report.filename = filename.ptr();
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -929,104 +929,104 @@ Evaluate(JSContext *cx, unsigned argc, j
     global = JS_GetGlobalForObject(cx, &args.callee());
     if (!global)
         return false;
 
     if (args.length() == 2) {
         RootedObject opts(cx, &args[1].toObject());
         RootedValue v(cx);
 
-        if (!JS_GetProperty(cx, opts, "newContext", v.address()))
+        if (!JS_GetProperty(cx, opts, "newContext", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             newContext = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "compileAndGo", v.address()))
+        if (!JS_GetProperty(cx, opts, "compileAndGo", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             compileAndGo = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "noScriptRval", v.address()))
+        if (!JS_GetProperty(cx, opts, "noScriptRval", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             noScriptRval = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "fileName", v.address()))
+        if (!JS_GetProperty(cx, opts, "fileName", &v))
             return false;
         if (JSVAL_IS_NULL(v)) {
             fileName = NULL;
         } else if (!JSVAL_IS_VOID(v)) {
             JSString *s = JS_ValueToString(cx, v);
             if (!s)
                 return false;
             fileName = fileNameBytes.encodeLatin1(cx, s);
             if (!fileName)
                 return false;
         }
 
-        if (!JS_GetProperty(cx, opts, "element", v.address()))
+        if (!JS_GetProperty(cx, opts, "element", &v))
             return false;
         if (!JSVAL_IS_PRIMITIVE(v))
             element = JSVAL_TO_OBJECT(v);
 
-        if (!JS_GetProperty(cx, opts, "sourceMapURL", v.address()))
+        if (!JS_GetProperty(cx, opts, "sourceMapURL", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             sourceMapURL = JS_ValueToString(cx, v);
             if (!sourceMapURL)
                 return false;
         }
 
-        if (!JS_GetProperty(cx, opts, "lineNumber", v.address()))
+        if (!JS_GetProperty(cx, opts, "lineNumber", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             uint32_t u;
             if (!JS_ValueToECMAUint32(cx, v, &u))
                 return false;
             lineNumber = u;
         }
 
-        if (!JS_GetProperty(cx, opts, "global", v.address()))
+        if (!JS_GetProperty(cx, opts, "global", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             global = JSVAL_IS_PRIMITIVE(v) ? NULL : JSVAL_TO_OBJECT(v);
             if (global) {
                 global = js::UncheckedUnwrap(global);
                 if (!global)
                     return false;
             }
             if (!global || !(JS_GetClass(global)->flags & JSCLASS_IS_GLOBAL)) {
                 JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNEXPECTED_TYPE,
                                      "\"global\" passed to evaluate()", "not a global object");
                 return false;
             }
         }
 
-        if (!JS_GetProperty(cx, opts, "catchTermination", v.address()))
+        if (!JS_GetProperty(cx, opts, "catchTermination", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             catchTermination = b;
         }
 
-        if (!JS_GetProperty(cx, opts, "saveFrameChain", v.address()))
+        if (!JS_GetProperty(cx, opts, "saveFrameChain", &v))
             return false;
         if (!JSVAL_IS_VOID(v)) {
             JSBool b;
             if (!JS_ValueToBoolean(cx, v, &b))
                 return false;
             saveFrameChain = b;
         }
     }
@@ -2460,31 +2460,31 @@ typedef struct ComplexObject {
 } ComplexObject;
 
 static JSBool
 sandbox_enumerate(JSContext *cx, HandleObject obj)
 {
     RootedValue v(cx);
     JSBool b;
 
-    if (!JS_GetProperty(cx, obj, "lazy", v.address()))
+    if (!JS_GetProperty(cx, obj, "lazy", &v))
         return false;
 
     JS_ValueToBoolean(cx, v, &b);
     return !b || JS_EnumerateStandardClasses(cx, obj);
 }
 
 static JSBool
 sandbox_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
                 MutableHandleObject objp)
 {
     RootedValue v(cx);
     JSBool b, resolved;
 
-    if (!JS_GetProperty(cx, obj, "lazy", v.address()))
+    if (!JS_GetProperty(cx, obj, "lazy", &v))
         return false;
 
     JS_ValueToBoolean(cx, v, &b);
     if (b) {
         if (!JS_ResolveStandardClass(cx, obj, id, &resolved))
             return false;
         if (resolved) {
             objp.set(obj);
--- a/js/src/shell/jsheaptools.cpp
+++ b/js/src/shell/jsheaptools.cpp
@@ -501,17 +501,17 @@ ReferenceFinder::addReferrer(jsval refer
 
     ScopedJSFreePtr<char> pathName(path->computeName(context));
     if (!pathName)
         return false;
 
     /* Find the property of the results object named |pathName|. */
     RootedValue v(context);
 
-    if (!JS_GetProperty(context, result, pathName, v.address()))
+    if (!JS_GetProperty(context, result, pathName, &v))
         return false;
     if (v.isUndefined()) {
         /* Create an array to accumulate referents under this path. */
         JSObject *array = JS_NewArrayObject(context, 1, referrer.address());
         if (!array)
             return false;
         v.setObject(*array);
         return !!JS_SetProperty(context, result, pathName, v);
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -4189,26 +4189,26 @@ DebuggerGenericEval(JSContext *cx, const
     /* Set options from object if provided. */
     char *url = NULL;
     unsigned lineNumber = 1;
 
     if (options.isObject()) {
         RootedObject opts(cx, &options.toObject());
         RootedValue v(cx);
 
-        if (!JS_GetProperty(cx, opts, "url", v.address()))
+        if (!JS_GetProperty(cx, opts, "url", &v))
             return false;
         if (!v.isUndefined()) {
             RootedString url_str(cx, JS_ValueToString(cx, v));
             if (!url_str)
                 return false;
             url = JS_EncodeString(cx, url_str);
         }
 
-        if (!JS_GetProperty(cx, opts, "lineNumber", v.address()))
+        if (!JS_GetProperty(cx, opts, "lineNumber", &v))
             return false;
         if (!v.isUndefined()) {
             uint32_t lineno;
             if (!JS_ValueToECMAUint32(cx, v, &lineno))
                 return false;
             lineNumber = lineno;
         }
     }
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -513,17 +513,17 @@ mozJSComponentLoader::LoadModule(FileLoc
     JSObject* file_jsobj = file_holder->GetJSObject();
     if (!file_jsobj) {
         return NULL;
     }
 
     JSCLAutoErrorReporterSetter aers(cx, xpc::SystemErrorReporter);
 
     RootedValue NSGetFactory_val(cx);
-    if (!JS_GetProperty(cx, entry->obj, "NSGetFactory", NSGetFactory_val.address()) ||
+    if (!JS_GetProperty(cx, entry->obj, "NSGetFactory", &NSGetFactory_val) ||
         JSVAL_IS_VOID(NSGetFactory_val)) {
         return NULL;
     }
 
     if (JS_TypeOfValue(cx, NSGetFactory_val) != JSTYPE_FUNCTION) {
         nsAutoCString spec;
         uri->GetSpec(spec);
         JS_ReportError(cx, "%s has NSGetFactory property that is not a function",
@@ -1276,17 +1276,17 @@ mozJSComponentLoader::ImportInto(const n
     vp.set(mod->obj);
 
     if (targetObj) {
         JSCLContextHelper cxhelper(mContext);
         JSAutoCompartment ac(mContext, mod->obj);
 
         RootedValue symbols(mContext);
         if (!JS_GetProperty(mContext, mod->obj,
-                            "EXPORTED_SYMBOLS", symbols.address())) {
+                            "EXPORTED_SYMBOLS", &symbols)) {
             return ReportOnCaller(cxhelper, ERROR_NOT_PRESENT,
                                   PromiseFlatCString(aLocation).get());
         }
 
         if (!symbols.isObject() ||
             !JS_IsArrayObject(mContext, &symbols.toObject())) {
             return ReportOnCaller(cxhelper, ERROR_NOT_AN_ARRAY,
                                   PromiseFlatCString(aLocation).get());
@@ -1311,17 +1311,17 @@ mozJSComponentLoader::ImportInto(const n
         for (uint32_t i = 0; i < symbolCount; ++i) {
             if (!JS_GetElement(mContext, symbolsObj, i, value.address()) ||
                 !value.isString() ||
                 !JS_ValueToId(mContext, value, symbolId.address())) {
                 return ReportOnCaller(cxhelper, ERROR_ARRAY_ELEMENT,
                                       PromiseFlatCString(aLocation).get(), i);
             }
 
-            if (!JS_GetPropertyById(mContext, mod->obj, symbolId, value.address())) {
+            if (!JS_GetPropertyById(mContext, mod->obj, symbolId, &value)) {
                 JSAutoByteString bytes(mContext, JSID_TO_STRING(symbolId));
                 if (!bytes)
                     return NS_ERROR_FAILURE;
                 return ReportOnCaller(cxhelper, ERROR_GETTING_SYMBOL,
                                       PromiseFlatCString(aLocation).get(),
                                       bytes.ptr());
             }
 
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -1911,17 +1911,17 @@ struct MOZ_STACK_CLASS ExceptionArgParse
 
         // If it wasn't found, indicate with undefined.
         if (!found) {
             rv.setUndefined();
             return true;
         }
 
         // Get the property.
-        return JS_GetProperty(cx, obj, name, rv.address());
+        return JS_GetProperty(cx, obj, name, rv);
     }
 
     /*
      * Internal data members.
      */
 
     // If there's a non-default exception string, hold onto the allocated bytes.
     JSAutoByteString messageBytes;
@@ -2238,17 +2238,17 @@ nsXPCConstructor::CallOrConstruct(nsIXPC
 
     args.rval().set(rval);
 
     // call initializer method if supplied
     if (mInitializer) {
         RootedObject newObj(cx, &rval.toObject());
         // first check existence of function property for better error reporting
         RootedValue fun(cx);
-        if (!JS_GetProperty(cx, newObj, mInitializer, fun.address()) ||
+        if (!JS_GetProperty(cx, newObj, mInitializer, &fun) ||
             fun.isPrimitive()) {
             return ThrowAndFail(NS_ERROR_XPC_BAD_INITIALIZER_NAME, cx, _retval);
         }
 
         RootedValue dummy(cx);
         if (!JS_CallFunctionValue(cx, newObj, fun, args.length(), args.array(), dummy.address())) {
             // function should have thrown an exception
             *_retval = false;
@@ -2487,17 +2487,17 @@ nsXPCComponents_Constructor::CallOrConst
         }
 
         RootedString str(cx, JS_ValueToString(cx, args[1]));
         RootedId id(cx);
         if (!str || !JS_ValueToId(cx, StringValue(str), id.address()))
             return ThrowAndFail(NS_ERROR_XPC_BAD_CONVERT_JS, cx, _retval);
 
         RootedValue val(cx);
-        if (!JS_GetPropertyById(cx, ifacesObj, id, val.address()) || val.isPrimitive())
+        if (!JS_GetPropertyById(cx, ifacesObj, id, &val) || val.isPrimitive())
             return ThrowAndFail(NS_ERROR_XPC_BAD_IID, cx, _retval);
 
         nsCOMPtr<nsIXPConnectWrappedNative> wn;
         if (NS_FAILED(xpc->GetWrappedNativeOfJSObject(cx, &val.toObject(),
                                                       getter_AddRefs(wn))) || !wn ||
             !(cInterfaceID = do_QueryWrappedNative(wn))) {
             return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
         }
@@ -2536,17 +2536,17 @@ nsXPCComponents_Constructor::CallOrConst
         }
 
         RootedString str(cx, JS_ValueToString(cx, args[0]));
         RootedId id(cx);
         if (!str || !JS_ValueToId(cx, StringValue(str), id.address()))
             return ThrowAndFail(NS_ERROR_XPC_BAD_CONVERT_JS, cx, _retval);
 
         RootedValue val(cx);
-        if (!JS_GetPropertyById(cx, classesObj, id, val.address()) || val.isPrimitive())
+        if (!JS_GetPropertyById(cx, classesObj, id, &val) || val.isPrimitive())
             return ThrowAndFail(NS_ERROR_XPC_BAD_CID, cx, _retval);
 
         nsCOMPtr<nsIXPConnectWrappedNative> wn;
         if (NS_FAILED(xpc->GetWrappedNativeOfJSObject(cx, JSVAL_TO_OBJECT(val),
                                                       getter_AddRefs(wn))) || !wn ||
             !(cClassID = do_QueryWrappedNative(wn))) {
             return ThrowAndFail(NS_ERROR_XPC_UNEXPECTED, cx, _retval);
         }
@@ -3521,17 +3521,17 @@ GetExpandedPrincipal(JSContext *cx, Hand
 // helper that tries to get a property form the options object
 nsresult
 GetPropFromOptions(JSContext *cx, HandleObject from, const char *name, MutableHandleValue prop,
                    JSBool *found)
 {
     if (!JS_HasProperty(cx, from, name, found))
         return NS_ERROR_INVALID_ARG;
 
-    if (found && !JS_GetProperty(cx, from, name, prop.address()))
+    if (found && !JS_GetProperty(cx, from, name, prop))
         return NS_ERROR_INVALID_ARG;
 
     return NS_OK;
 }
 
 // helper that tries to get a boolean property form the options object
 nsresult
 GetBoolPropFromOptions(JSContext *cx, HandleObject from, const char *name, bool *prop)
@@ -4270,17 +4270,17 @@ nsXPCComponents_Utils::MakeObjectPropsNo
     if (!ida)
         return NS_ERROR_FAILURE;
 
     RootedId id(cx);
     RootedValue v(cx);
     for (size_t i = 0; i < ida.length(); ++i) {
         id = ida[i];
 
-        if (!JS_GetPropertyById(cx, obj, id, v.address()))
+        if (!JS_GetPropertyById(cx, obj, id, &v))
             return NS_ERROR_FAILURE;
 
         if (v.isPrimitive())
             continue;
 
         RootedObject propobj(cx, &v.toObject());
         // TODO Deal with non-functions.
         if (!js::IsWrapper(propobj) || !JS_ObjectIsCallable(cx, propobj))
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -225,17 +225,17 @@ nsXPCWrappedJSClass::CallQueryInterfaceO
 
     // XXX we should install an error reporter that will send reports to
     // the JS error console service.
     if (!scriptEval.StartEvaluating(jsobj))
         return nullptr;
 
     // check upfront for the existence of the function property
     funid = mRuntime->GetStringID(XPCJSRuntime::IDX_QUERY_INTERFACE);
-    if (!JS_GetPropertyById(cx, jsobj, funid, fun.address()) || JSVAL_IS_PRIMITIVE(fun))
+    if (!JS_GetPropertyById(cx, jsobj, funid, &fun) || JSVAL_IS_PRIMITIVE(fun))
         return nullptr;
 
     // Ensure that we are asking for a scriptable interface.
     // NB:  It's important for security that this check is here rather
     // than later, since it prevents untrusted objects from implementing
     // some interfaces in JS and aggregating a trusted object to
     // implement intentionally (for security) unscriptable interfaces.
     // We so often ask for nsISupports that we can short-circuit the test...
@@ -325,17 +325,17 @@ GetNamedPropertyAsVariantRaw(XPCCallCont
                              JSObject* aJSObj,
                              jsid aName,
                              nsIVariant** aResult,
                              nsresult* pErr)
 {
     nsXPTType type = nsXPTType((uint8_t)TD_INTERFACE_TYPE);
     RootedValue val(ccx);
 
-    return JS_GetPropertyById(ccx, aJSObj, aName, val.address()) &&
+    return JS_GetPropertyById(ccx, aJSObj, aName, &val) &&
            // Note that this always takes the T_INTERFACE path through
            // JSData2Native, so the value passed for useAllocator
            // doesn't really matter. We pass true for consistency.
            XPCConvert::JSData2Native(aResult, val, type, true,
                                      &NS_GET_IID(nsIVariant), pErr);
 }
 
 // static
@@ -1259,17 +1259,17 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWra
                                 if (!JS_WrapObject(cx, thisObj.address()))
                                     goto pre_call_clean_up;
                             }
                         }
                     }
                 }
             }
         } else {
-            if (!JS_GetProperty(cx, obj, name, fval.address()))
+            if (!JS_GetProperty(cx, obj, name, &fval))
                 goto pre_call_clean_up;
             // XXX We really want to factor out the error reporting better and
             // specifically report the failure to find a function with this name.
             // This is what we do below if the property is found but is not a
             // function. We just need to factor better so we can get to that
             // reporting path from here.
 
             thisObj = obj;
@@ -1426,17 +1426,17 @@ pre_call_clean_up:
         return retval;
 
     // do the deed - note exceptions
 
     JS_ClearPendingException(cx);
 
     RootedValue rval(cx);
     if (XPT_MD_IS_GETTER(info->flags)) {
-        success = JS_GetProperty(cx, obj, name, rval.address());
+        success = JS_GetProperty(cx, obj, name, &rval);
     } else if (XPT_MD_IS_SETTER(info->flags)) {
         rval = *argv;
         success = JS_SetProperty(cx, obj, name, rval);
     } else {
         if (!JSVAL_IS_PRIMITIVE(fval)) {
             uint32_t oldOpts = JS_GetOptions(cx);
             JS_SetOptions(cx, oldOpts | JSOPTION_DONT_REPORT_UNCAUGHT);
 
@@ -1509,17 +1509,17 @@ pre_call_clean_up:
         else
             pv = (nsXPTCMiniVariant*) nativeParams[i].val.p;
 
         if (param.IsRetval())
             val = rval;
         else if (JSVAL_IS_PRIMITIVE(argv[i]) ||
                  !JS_GetPropertyById(cx, JSVAL_TO_OBJECT(argv[i]),
                                      mRuntime->GetStringID(XPCJSRuntime::IDX_VALUE),
-                                     val.address()))
+                                     &val))
             break;
 
         // setup allocator and/or iid
 
         if (type_tag == nsXPTType::T_INTERFACE) {
             if (NS_FAILED(GetInterfaceInfo()->
                           GetIIDForParamNoAlloc(methodIndex, &param,
                                                 &param_iid)))
@@ -1553,17 +1553,17 @@ pre_call_clean_up:
                     type.TagPart() == nsXPTType::T_PWSTRING_SIZE_IS;
 
             pv = (nsXPTCMiniVariant*) nativeParams[i].val.p;
 
             if (param.IsRetval())
                 val = rval;
             else if (!JS_GetPropertyById(cx, JSVAL_TO_OBJECT(argv[i]),
                                          mRuntime->GetStringID(XPCJSRuntime::IDX_VALUE),
-                                         val.address()))
+                                         &val))
                 break;
 
             // setup allocator and/or iid
 
             if (isArray) {
                 if (NS_FAILED(mInfo->GetTypeForParam(methodIndex, &param, 1,
                                                      &datum_type)))
                     break;
--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@@ -1988,17 +1988,17 @@ class CallMethodHelper
     GetArraySizeFromParam(uint8_t paramIndex, uint32_t* result) const;
 
     JS_ALWAYS_INLINE JSBool
     GetInterfaceTypeFromParam(uint8_t paramIndex,
                               const nsXPTType& datum_type,
                               nsID* result) const;
 
     JS_ALWAYS_INLINE JSBool
-    GetOutParamSource(uint8_t paramIndex, jsval* srcp) const;
+    GetOutParamSource(uint8_t paramIndex, MutableHandleValue srcp) const;
 
     JS_ALWAYS_INLINE JSBool
     GatherAndConvertResults();
 
     JS_ALWAYS_INLINE JSBool
     QueryInterfaceFastPath() const;
 
     nsXPTCVariant*
@@ -2244,17 +2244,17 @@ CallMethodHelper::GetInterfaceTypeFromPa
             return ThrowBadParam(NS_ERROR_XPC_CANT_GET_PARAM_IFACE_INFO,
                                  paramIndex, mCallContext);
         *result = *p;
     }
     return true;
 }
 
 JSBool
-CallMethodHelper::GetOutParamSource(uint8_t paramIndex, jsval* srcp) const
+CallMethodHelper::GetOutParamSource(uint8_t paramIndex, MutableHandleValue srcp) const
 {
     const nsXPTParamInfo& paramInfo = mMethodInfo->GetParam(paramIndex);
 
     if ((paramInfo.IsOut() || paramInfo.IsDipper()) &&
         !paramInfo.IsRetval()) {
         NS_ASSERTION(paramIndex < mArgc || paramInfo.IsOptional(),
                      "Expected either enough arguments or an optional argument");
         jsval arg = paramIndex < mArgc ? mArgv[paramIndex] : JSVAL_NULL;
@@ -2524,17 +2524,17 @@ CallMethodHelper::ConvertIndependentPara
         dp->SetValNeedsCleanup();
 
     // Even if there's nothing to convert, we still need to examine the
     // JSObject container for out-params. If it's null or otherwise invalid,
     // we want to know before the call, rather than after.
     //
     // This is a no-op for 'in' params.
     RootedValue src(mCallContext);
-    if (!GetOutParamSource(i, src.address()))
+    if (!GetOutParamSource(i, &src))
         return false;
 
     // All that's left to do is value conversion. Bail early if we don't need
     // to do that.
     if (!paramInfo.IsIn())
         return true;
 
     // We're definitely some variety of 'in' now, so there's something to
@@ -2629,17 +2629,17 @@ CallMethodHelper::ConvertDependentParam(
         dp->SetValNeedsCleanup();
 
     // Even if there's nothing to convert, we still need to examine the
     // JSObject container for out-params. If it's null or otherwise invalid,
     // we want to know before the call, rather than after.
     //
     // This is a no-op for 'in' params.
     RootedValue src(mCallContext);
-    if (!GetOutParamSource(i, src.address()))
+    if (!GetOutParamSource(i, &src))
         return false;
 
     // All that's left to do is value conversion. Bail early if we don't need
     // to do that.
     if (!paramInfo.IsIn())
         return true;
 
     // We're definitely some variety of 'in' now, so there's something to
--- a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
@@ -116,17 +116,17 @@ GetDoubleWrappedJSObject(XPCCallContext&
         RootedObject mainObj(ccx, underware->GetJSObject());
         if (mainObj) {
             RootedId id(ccx, ccx.GetRuntime()->
                             GetStringID(XPCJSRuntime::IDX_WRAPPED_JSOBJECT));
 
             JSAutoCompartment ac(ccx, mainObj);
 
             RootedValue val(ccx);
-            if (JS_GetPropertyById(ccx, mainObj, id, val.address()) &&
+            if (JS_GetPropertyById(ccx, mainObj, id, &val) &&
                 !JSVAL_IS_PRIMITIVE(val)) {
                 obj = JSVAL_TO_OBJECT(val);
             }
         }
     }
     return obj;
 }
 
--- a/js/xpconnect/src/dictionary_helper_gen.py
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@@ -274,23 +274,21 @@ def write_header(iface, fd):
 
     for member in attributes:
         fd.write("  %s;\n" % attributeVariableTypeAndName(member))
 
     fd.write("};\n\n")
 
 def write_getter(a, iface, fd):
     realtype = a.realtype.nativeType('in')
+    fd.write("    NS_ENSURE_STATE(JS_GetPropertyById(aCx, aObj, %s, &v));\n"
+             % get_jsid(a.name))
     if realtype.count("JS::Value"):
-        fd.write("    NS_ENSURE_STATE(JS_GetPropertyById(aCx, aObj, %s, &aDict.%s));\n"
-                 % (get_jsid(a.name), a.name))
-    else:
-        fd.write("    NS_ENSURE_STATE(JS_GetPropertyById(aCx, aObj, %s, v.address()));\n"
-                 % get_jsid(a.name))
-    if realtype.count("bool"):
+        fd.write("    aDict.%s = v;\n" % a.name)
+    elif realtype.count("bool"):
         fd.write("    JSBool b;\n")
         fd.write("    MOZ_ALWAYS_TRUE(JS_ValueToBoolean(aCx, v, &b));\n")
         fd.write("    aDict.%s = b;\n" % a.name)
     elif realtype.count("uint16_t"):
         fd.write("    uint32_t u;\n")
         fd.write("    NS_ENSURE_STATE(JS_ValueToECMAUint32(aCx, v, &u));\n")
         fd.write("    aDict.%s = u;\n" % a.name)
     elif realtype.count("int16_t"):
@@ -368,25 +366,21 @@ def write_cpp(iface, fd):
              (iface.name, iface.name))
     fd.write("{\n")
     if iface.base is not None:
         fd.write("  nsresult rv = %s_InitInternal(aDict, aCx, aObj);\n" %
                  iface.base)
         fd.write("  NS_ENSURE_SUCCESS(rv, rv);\n")
 
     fd.write("  JSBool found = JS_FALSE;\n")
-    needjsval = False
     needccx = False
     for a in attributes:
-        if not a.realtype.nativeType('in').count("JS::Value"):
-            needjsval = True
         if a.realtype.nativeType('in').count("nsIVariant"):
             needccx = True
-    if needjsval:
-        fd.write("  JS::RootedValue v(aCx, JSVAL_VOID);\n")
+    fd.write("  JS::RootedValue v(aCx, JSVAL_VOID);\n")
     if needccx:
         fd.write("  XPCCallContext ccx(NATIVE_CALLER, aCx);\n")
         fd.write("  NS_ENSURE_STATE(ccx.IsValid());\n")
     for a in attributes:
         fd.write("  NS_ENSURE_STATE(JS_HasPropertyById(aCx, aObj, %s, &found));\n"
                  % get_jsid(a.name))
         fd.write("  if (found) {\n")
         write_getter(a, iface, fd)
--- a/layout/inspector/src/inDOMUtils.cpp
+++ b/layout/inspector/src/inDOMUtils.cpp
@@ -493,16 +493,19 @@ static void GetKeywordsForProperty(const
     }
   }
 }
 
 static void GetColorsForProperty(const uint32_t aParserVariant,
                                  nsTArray<nsString>& aArray)
 {
   if (aParserVariant & VARIANT_COLOR) {
+    // GetKeywordsForProperty and GetOtherValuesForProperty assume aArray is sorted,
+    // and if aArray is not empty here, then it's not going to be sorted coming out.
+    MOZ_ASSERT(aArray.Length() == 0);
     size_t size;
     const char * const *allColorNames = NS_AllColorNames(&size);
     for (size_t i = 0; i < size; i++) {
       CopyASCIItoUTF16(allColorNames[i], *aArray.AppendElement());
     }
   }
   return;
 }
@@ -539,16 +542,19 @@ static void GetOtherValuesForProperty(co
   if (aParserVariant & VARIANT_TIMING_FUNCTION) {
     InsertNoDuplicates(aArray, NS_LITERAL_STRING("cubic-bezier"));
     InsertNoDuplicates(aArray, NS_LITERAL_STRING("steps"));
   }
   if (aParserVariant & VARIANT_CALC) {
     InsertNoDuplicates(aArray, NS_LITERAL_STRING("calc"));
     InsertNoDuplicates(aArray, NS_LITERAL_STRING("-moz-calc"));
   }
+  if (aParserVariant & VARIANT_URL) {
+    InsertNoDuplicates(aArray, NS_LITERAL_STRING("url"));
+  }
 }
 
 NS_IMETHODIMP
 inDOMUtils::GetCSSValuesForProperty(const nsAString& aProperty,
                                     uint32_t* aLength,
                                     PRUnichar*** aValues)
 {
   nsCSSProperty propertyID = nsCSSProps::LookupProperty(aProperty,
@@ -565,19 +571,25 @@ inDOMUtils::GetCSSValuesForProperty(cons
     uint32_t propertyParserVariant = nsCSSProps::ParserVariant(propertyID);
     // Get colors first.
     GetColorsForProperty(propertyParserVariant, array);
     GetKeywordsForProperty(propertyID, array);
     GetOtherValuesForProperty(propertyParserVariant, array);
   } else {
     // Property is shorthand.
     CSSPROPS_FOR_SHORTHAND_SUBPROPERTIES(subproperty, propertyID) {
+      // Get colors (once) first.
       uint32_t propertyParserVariant = nsCSSProps::ParserVariant(*subproperty);
-      // Get colors first.
-      GetColorsForProperty(propertyParserVariant, array);
+      if (propertyParserVariant & VARIANT_COLOR) {
+        GetColorsForProperty(propertyParserVariant, array);
+        break;
+      }
+    }
+    CSSPROPS_FOR_SHORTHAND_SUBPROPERTIES(subproperty, propertyID) {
+      uint32_t propertyParserVariant = nsCSSProps::ParserVariant(*subproperty);
       GetKeywordsForProperty(*subproperty, array);
       GetOtherValuesForProperty(propertyParserVariant, array);
     }
   }
   // All CSS properties take initial and inherit.
   InsertNoDuplicates(array, NS_LITERAL_STRING("-moz-initial"));
   InsertNoDuplicates(array, NS_LITERAL_STRING("inherit"));
 
--- a/layout/inspector/tests/test_bug877690.html
+++ b/layout/inspector/tests/test_bug877690.html
@@ -86,17 +86,42 @@ function do_test() {
       "navajowhite", "navy", "oldlace", "olive", "olivedrab", "orange", "orangered", "orchid", "palegoldenrod",
       "palegreen", "paleturquoise", "palevioletred", "papayawhip", "peachpuff", "peru", "pink", "plum",
       "powderblue", "purple", "red", "rosybrown", "royalblue", "saddlebrown", "salmon", "sandybrown",
       "seagreen", "seashell", "sienna", "silver", "skyblue", "slateblue", "slategray", "slategrey",
       "snow", "springgreen", "steelblue", "tan", "teal", "thistle", "tomato", "transparent", "turquoise",
       "violet", "wheat", "white", "whitesmoke", "yellow", "yellowgreen", "no-repeat", "repeat",
       "repeat-x", "repeat-y", "fixed", "scroll", "local", "center", "top", "bottom", "left", "right",
       "border-box", "padding-box", "content-box", "border-box", "padding-box", "content-box", "contain",
-      "cover", "rgb", "hsl", "-moz-rgba", "-moz-hsla", "rgba", "hsla", "none", "-moz-element", "-moz-image-rect" ];
+      "cover", "rgb", "hsl", "-moz-rgba", "-moz-hsla", "rgba", "hsla", "none", "-moz-element", "-moz-image-rect", "url" ];
+  ok(testValues(values, expected), "Shorthand property values.");
+
+  var prop = "border";
+  var values = utils.getCSSValuesForProperty(prop);
+  var expected = [ "-moz-calc", "-moz-hsla", "-moz-initial", "-moz-rgba", "-moz-use-text-color", "aliceblue",
+      "antiquewhite", "aqua", "aquamarine", "azure", "beige", "bisque", "black", "blanchedalmond", "blue", "blueviolet",
+      "brown", "burlywood", "cadetblue", "calc", "chartreuse", "chocolate", "coral", "cornflowerblue", "cornsilk",
+      "crimson", "cyan", "darkblue", "darkcyan", "darkgoldenrod", "darkgray", "darkgreen", "darkgrey", "darkkhaki",
+      "darkmagenta", "darkolivegreen", "darkorange", "darkorchid", "darkred", "darksalmon", "darkseagreen",
+      "darkslateblue", "darkslategray", "darkslategrey", "darkturquoise", "darkviolet", "dashed", "deeppink",
+      "deepskyblue", "dimgray", "dimgrey", "dodgerblue", "dotted", "double", "fill", "firebrick", "floralwhite",
+      "forestgreen", "fuchsia", "gainsboro", "ghostwhite", "gold", "goldenrod", "gray", "grey", "green", "greenyellow",
+      "groove", "hidden", "honeydew", "hotpink", "hsl", "hsla", "indianred", "indigo", "inherit", "inset", "ivory",
+      "khaki", "lavender", "lavenderblush", "lawngreen", "lemonchiffon", "lightblue", "lightcoral", "lightcyan",
+      "lightgoldenrodyellow", "lightgray", "lightgreen", "lightgrey", "lightpink", "lightsalmon", "lightseagreen",
+      "lightskyblue", "lightslategray", "lightslategrey", "lightsteelblue", "lightyellow", "lime", "limegreen",
+      "linen", "logical", "magenta", "maroon", "medium", "mediumaquamarine", "mediumblue", "mediumorchid",
+      "mediumpurple", "mediumseagreen", "mediumslateblue", "mediumspringgreen", "mediumturquoise",
+      "mediumvioletred", "midnightblue", "mintcream", "mistyrose", "moccasin", "navajowhite", "navy", "none",
+      "oldlace", "olive", "olivedrab", "orange", "orangered", "orchid", "outset", "palegoldenrod", "palegreen",
+      "paleturquoise", "palevioletred", "papayawhip", "peachpuff", "peru", "physical", "pink", "plum", "powderblue",
+      "purple", "red", "repeat", "rgb", "rgba", "ridge", "rosybrown", "round", "royalblue", "saddlebrown", "salmon",
+      "sandybrown", "seagreen", "seashell", "sienna", "silver", "skyblue", "slateblue", "slategray", "slategrey",
+      "snow", "solid", "springgreen", "steelblue", "stretch", "tan", "teal", "thick", "thin", "thistle", "tomato",
+      "transparent", "turquoise", "url", "violet", "wheat", "white", "whitesmoke", "yellow", "yellowgreen" ]
   ok(testValues(values, expected), "Shorthand property values.");
 
   // test keywords only
   var prop = "border-top";
   var values = utils.getCSSValuesForProperty(prop);
   var expected = [ "-moz-initial", "inherit", "thin", "medium", "thick", "none", "hidden", "dotted",
       "dashed", "solid", "double", "groove", "ridge", "inset", "outset", "-moz-use-text-color",
       "aliceblue", "antiquewhite", "aqua", "aquamarine", "azure", "beige", "bisque", "black",
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@@ -900,47 +900,47 @@ PeerConnectionImpl::NotifyDataChannel(al
 nsresult
 PeerConnectionImpl::ConvertConstraints(
   const JS::Value& aConstraints, MediaConstraints* aObj, JSContext* aCx)
 {
   JS::Rooted<JS::Value> mandatory(aCx), optional(aCx);
   JS::Rooted<JSObject*> constraints(aCx, &aConstraints.toObject());
 
   // Mandatory constraints.  Note that we only care if the constraint array exists
-  if (!JS_GetProperty(aCx, constraints, "mandatory", mandatory.address())) {
+  if (!JS_GetProperty(aCx, constraints, "mandatory", &mandatory)) {
     return NS_ERROR_FAILURE;
   }
   if (!mandatory.isNullOrUndefined()) {
     if (!mandatory.isObject()) {
       return NS_ERROR_FAILURE;
     }
 
     JS::Rooted<JSObject*> opts(aCx, &mandatory.toObject());
     JS::AutoIdArray mandatoryOpts(aCx, JS_Enumerate(aCx, opts));
 
     // Iterate over each property.
     for (size_t i = 0; i < mandatoryOpts.length(); i++) {
       JS::Rooted<JS::Value> option(aCx), optionName(aCx);
-      if (!JS_GetPropertyById(aCx, opts, mandatoryOpts[i], option.address()) ||
+      if (!JS_GetPropertyById(aCx, opts, mandatoryOpts[i], &option) ||
           !JS_IdToValue(aCx, mandatoryOpts[i], optionName.address()) ||
           // We only support boolean constraints for now.
           !option.isBoolean()) {
         return NS_ERROR_FAILURE;
       }
       JSString* optionNameString = JS_ValueToString(aCx, optionName);
       if (!optionNameString) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
       NS_ConvertUTF16toUTF8 stringVal(JS_GetStringCharsZ(aCx, optionNameString));
       aObj->setBooleanConstraint(stringVal.get(), JSVAL_TO_BOOLEAN(option), true);
     }
   }
 
   // Optional constraints.
-  if (!JS_GetProperty(aCx, constraints, "optional", optional.address())) {
+  if (!JS_GetProperty(aCx, constraints, "optional", &optional)) {
     return NS_ERROR_FAILURE;
   }
   if (!optional.isNullOrUndefined()) {
     if (!optional.isObject()) {
       return NS_ERROR_FAILURE;
     }
 
     JS::Rooted<JSObject*> array(aCx, &optional.toObject());
@@ -956,17 +956,17 @@ PeerConnectionImpl::ConvertConstraints(
       }
       JS::Rooted<JSObject*> opts(aCx, &element.toObject());
       JS::AutoIdArray optionalOpts(aCx, JS_Enumerate(aCx, opts));
       // Expect one property per entry.
       if (optionalOpts.length() != 1) {
         return NS_ERROR_FAILURE;
       }
       JS::Rooted<JS::Value> option(aCx), optionName(aCx);
-      if (!JS_GetPropertyById(aCx, opts, optionalOpts[0], option.address()) ||
+      if (!JS_GetPropertyById(aCx, opts, optionalOpts[0], &option) ||
           !JS_IdToValue(aCx, optionalOpts[0], optionName.address())) {
         return NS_ERROR_FAILURE;
       }
       // Ignore constraints other than boolean, as that's all we support.
       if (option.isBoolean()) {
         JSString* optionNameString = JS_ValueToString(aCx, optionName);
         if (!optionNameString) {
           return NS_ERROR_OUT_OF_MEMORY;
--- a/mozglue/build/Makefile.in
+++ b/mozglue/build/Makefile.in
@@ -36,16 +36,18 @@ else
 SDK_LIBRARY = $(REAL_LIBRARY)
 endif
 endif
 
 endif
  
 MOZ_GLUE_LDFLAGS = # Don't link against ourselves
 
+DEFINES += -DIMPL_MFBT
+
 ifeq (WINNT,$(OS_TARGET))
 DEFFILE = mozglue.def
 
 mozglue.def: mozglue.def.in
 	$(PYTHON) $(topsrcdir)/config/Preprocessor.py $(if $(MOZ_REPLACE_MALLOC),-DMOZ_REPLACE_MALLOC) $(ACDEFINES) $< > $@
 
 GARBAGE += mozglue.def
 
--- a/startupcache/test/TestStartupCache.cpp
+++ b/startupcache/test/TestStartupCache.cpp
@@ -411,21 +411,21 @@ GetHistogramCounts(const char *testmsg, 
     return false;
   }
   passed(testmsg);
 
   Rooted<Value> snapshot_val(cx);
   JSFunction *snapshot_fn = NULL;
   Rooted<Value> ss(cx);
   return (JS_GetProperty(cx, JSVAL_TO_OBJECT(h), "snapshot",
-                         snapshot_val.address())
+                         &snapshot_val)
           && (snapshot_fn = JS_ValueToFunction(cx, snapshot_val))
           && JS::Call(cx, JSVAL_TO_OBJECT(h),
                       snapshot_fn, 0, NULL, &ss)
-          && JS_GetProperty(cx, JSVAL_TO_OBJECT(ss), "counts", counts.address()));
+          && JS_GetProperty(cx, JSVAL_TO_OBJECT(ss), "counts", counts));
 }
 
 nsresult
 CompareCountArrays(JSContext *cx, JSObject *aBefore, JSObject *aAfter)
 {
   uint32_t before_size, after_size;
   JS::RootedObject before(cx, aBefore);
   JS::RootedObject after(cx, aAfter);
--- a/toolkit/components/ctypes/ctypes.cpp
+++ b/toolkit/components/ctypes/ctypes.cpp
@@ -62,42 +62,42 @@ Module::~Module()
 #define XPC_MAP_WANT_CALL
 #define XPC_MAP_FLAGS nsIXPCScriptable::WANT_CALL
 #include "xpc_map_end.h"
 
 static JSBool
 SealObjectAndPrototype(JSContext* cx, JSObject* parent, const char* name)
 {
   JS::Rooted<JS::Value> prop(cx);
-  if (!JS_GetProperty(cx, parent, name, prop.address()))
+  if (!JS_GetProperty(cx, parent, name, &prop))
     return false;
 
   if (prop.isUndefined()) {
     // Pretend we sealed the object.
     return true;
   }
 
   JS::Rooted<JSObject*> obj(cx, prop.toObjectOrNull());
-  if (!JS_GetProperty(cx, obj, "prototype", prop.address()))
+  if (!JS_GetProperty(cx, obj, "prototype", &prop))
     return false;
 
   JS::Rooted<JSObject*> prototype(cx, prop.toObjectOrNull());
   return JS_FreezeObject(cx, obj) && JS_FreezeObject(cx, prototype);
 }
 
 static JSBool
 InitAndSealCTypesClass(JSContext* cx, JS::Handle<JSObject*> global)
 {
   // Init the ctypes object.
   if (!JS_InitCTypesClass(cx, global))
     return false;
 
   // Set callbacks for charset conversion and such.
   JS::Rooted<JS::Value> ctypes(cx);
-  if (!JS_GetProperty(cx, global, "ctypes", ctypes.address()))
+  if (!JS_GetProperty(cx, global, "ctypes", &ctypes))
     return false;
 
   JS_SetCTypesCallbacks(JSVAL_TO_OBJECT(ctypes), &sCallbacks);
 
   // Seal up Object, Function, Array and Error and their prototypes.  (This
   // single object instance is shared amongst everyone who imports the ctypes
   // module.)
   if (!SealObjectAndPrototype(cx, global, "Object") ||
--- a/toolkit/components/perf/PerfMeasurement.cpp
+++ b/toolkit/components/perf/PerfMeasurement.cpp
@@ -37,26 +37,26 @@ Module::~Module()
 #define XPC_MAP_WANT_CALL
 #define XPC_MAP_FLAGS nsIXPCScriptable::WANT_CALL
 #include "xpc_map_end.h"
 
 static JSBool
 SealObjectAndPrototype(JSContext* cx, JSObject* parent, const char* name)
 {
   JS::Rooted<JS::Value> prop(cx);
-  if (!JS_GetProperty(cx, parent, name, prop.address()))
+  if (!JS_GetProperty(cx, parent, name, &prop))
     return false;
 
   if (prop.isUndefined()) {
     // Pretend we sealed the object.
     return true;
   }
 
   JS::Rooted<JSObject*> obj(cx, prop.toObjectOrNull());
-  if (!JS_GetProperty(cx, obj, "prototype", prop.address()))
+  if (!JS_GetProperty(cx, obj, "prototype", &prop))
     return false;
 
   JS::Rooted<JSObject*> prototype(cx, prop.toObjectOrNull());
   return JS_FreezeObject(cx, obj) && JS_FreezeObject(cx, prototype);
 }
 
 static JSBool
 InitAndSealPerfMeasurementClass(JSContext* cx, JS::Handle<JSObject*> global)
--- a/toolkit/components/places/History.cpp
+++ b/toolkit/components/places/History.cpp
@@ -292,17 +292,17 @@ GetJSValueAsURI(JSContext* aCtx,
  * @return the URI if it exists.
  */
 already_AddRefed<nsIURI>
 GetURIFromJSObject(JSContext* aCtx,
                    JSObject* aObject,
                    const char* aProperty)
 {
   JS::Rooted<JS::Value> uriVal(aCtx);
-  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, uriVal.address());
+  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, &uriVal);
   NS_ENSURE_TRUE(rc, nullptr);
   return GetJSValueAsURI(aCtx, uriVal);
 }
 
 /**
  * Attemps to convert a JS value to a string.
  * @param aCtx
  *        The JSContext for aObject.
@@ -350,17 +350,17 @@ GetJSValueAsString(JSContext* aCtx,
  */
 void
 GetStringFromJSObject(JSContext* aCtx,
                       JSObject* aObject,
                       const char* aProperty,
                       nsString& _string)
 {
   JS::Rooted<JS::Value> val(aCtx);
-  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, val.address());
+  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, &val);
   if (!rc) {
     _string.SetIsVoid(true);
     return;
   }
   else {
     GetJSValueAsString(aCtx, val, _string);
   }
 }
@@ -380,17 +380,17 @@ GetStringFromJSObject(JSContext* aCtx,
 template <typename IntType>
 nsresult
 GetIntFromJSObject(JSContext* aCtx,
                    JSObject* aObject,
                    const char* aProperty,
                    IntType* _int)
 {
   JS::Rooted<JS::Value> value(aCtx);
-  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, value.address());
+  JSBool rc = JS_GetProperty(aCtx, aObject, aProperty, &value);
   NS_ENSURE_TRUE(rc, NS_ERROR_UNEXPECTED);
   if (JSVAL_IS_VOID(value)) {
     return NS_ERROR_INVALID_ARG;
   }
   NS_ENSURE_ARG(JSVAL_IS_PRIMITIVE(value));
   NS_ENSURE_ARG(JSVAL_IS_NUMBER(value));
 
   double num;
@@ -2803,17 +2803,17 @@ History::UpdatePlaces(const JS::Value& a
     NS_ENSURE_ARG(guid.IsVoid() || isValidGUID);
 
     nsString title;
     GetStringFromJSObject(aCtx, info, "title", title);
 
     JS::Rooted<JSObject*> visits(aCtx, nullptr);
     {
       JS::Rooted<JS::Value> visitsVal(aCtx);
-      JSBool rc = JS_GetProperty(aCtx, info, "visits", visitsVal.address());
+      JSBool rc = JS_GetProperty(aCtx, info, "visits", &visitsVal);
       NS_ENSURE_TRUE(rc, NS_ERROR_UNEXPECTED);
       if (!JSVAL_IS_PRIMITIVE(visitsVal)) {
         visits = JSVAL_TO_OBJECT(visitsVal);
         NS_ENSURE_ARG(JS_IsArrayObject(aCtx, visits));
       }
     }
     NS_ENSURE_ARG(visits);