--- a/dom/src/base/nsJSEnvironment.cpp
+++ b/dom/src/base/nsJSEnvironment.cpp
@@ -402,17 +402,17 @@ NS_HandleScriptError(nsIScriptGlobalObje
   nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(aScriptGlobal));
   nsIDocShell *docShell = win ? win->GetDocShell() : nsnull;
   if (docShell) {
     nsCOMPtr<nsPresContext> presContext;
     docShell->GetPresContext(getter_AddRefs(presContext));
 
     static PRInt32 errorDepth; // Recursion prevention
     ++errorDepth;
-    
+
     if (presContext && errorDepth < 2) {
       // Dispatch() must be synchronous for the recursion block
       // (errorDepth) to work.
       nsEventDispatcher::Dispatch(win, presContext, aErrorEvent, nsnull,
                                   aStatus);
       called = PR_TRUE;
     }
     --errorDepth;
@@ -614,17 +614,17 @@ NS_ScriptErrorReporter(JSContext *cx,
 
 JS_STATIC_DLL_CALLBACK(JSBool)
 LocaleToUnicode(JSContext *cx, char *src, jsval *rval)
 {
   nsresult rv;
 
   if (!gDecoder) {
     // use app default locale
-    nsCOMPtr<nsILocaleService> localeService = 
+    nsCOMPtr<nsILocaleService> localeService =
       do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
     if (NS_SUCCEEDED(rv)) {
       nsCOMPtr<nsILocale> appLocale;
       rv = localeService->GetApplicationLocale(getter_AddRefs(appLocale));
       if (NS_SUCCEEDED(rv)) {
         nsAutoString localeStr;
         rv = appLocale->
           GetCategory(NS_LITERAL_STRING(NSILOCALE_TIME), localeStr);
@@ -924,19 +924,19 @@ nsJSContext::DOMOperationCallback(JSCont
   JSStackFrame* fp = ::JS_GetScriptedCaller(cx, NULL);
   PRBool debugPossible = (fp != nsnull &&
                           cx->debugHooks->debuggerHandler != nsnull);
 #ifdef MOZ_JSDEBUGGER
   // Get the debugger service if necessary.
   if (debugPossible) {
     PRBool jsds_IsOn = PR_FALSE;
     const char jsdServiceCtrID[] = "@mozilla.org/js/jsd/debugger-service;1";
-    nsCOMPtr<jsdIExecutionHook> jsdHook;  
+    nsCOMPtr<jsdIExecutionHook> jsdHook;
     nsCOMPtr<jsdIDebuggerService> jsds = do_GetService(jsdServiceCtrID, &rv);
-  
+
     // Check if there's a user for the debugger service that's 'on' for us
     if (NS_SUCCEEDED(rv)) {
       jsds->GetDebuggerHook(getter_AddRefs(jsdHook));
       jsds->GetIsOn(&jsds_IsOn);
       if (jsds_IsOn) { // If this is not true, the next call would start jsd...
         rv = jsds->OnForRuntime(cx->runtime);
         jsds_IsOn = NS_SUCCEEDED(rv);
       }
@@ -954,17 +954,17 @@ nsJSContext::DOMOperationCallback(JSCont
     stringService(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
   if (!stringService)
     return JS_TRUE;
 
   nsCOMPtr<nsIStringBundle> bundle;
   stringService->CreateBundle(kDOMStringBundleURL, getter_AddRefs(bundle));
   if (!bundle)
     return JS_TRUE;
-  
+
   nsXPIDLString title, msg, stopButton, waitButton, debugButton, neverShowDlg;
 
   rv = bundle->GetStringFromName(NS_LITERAL_STRING("KillScriptTitle").get(),
                                   getter_Copies(title));
   rv |= bundle->GetStringFromName(NS_LITERAL_STRING("StopScriptButton").get(),
                                   getter_Copies(stopButton));
   rv |= bundle->GetStringFromName(NS_LITERAL_STRING("WaitForScriptButton").get(),
                                   getter_Copies(waitButton));
@@ -1510,20 +1510,18 @@ nsJSContext::EvaluateString(const nsAStr
   if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
     JSPRINCIPALS_DROP(mContext, jsprin);
     return NS_ERROR_FAILURE;
   }
 
   // The result of evaluation, used only if there were no errors.  This need
   // not be a GC root currently, provided we run the GC only from the
   // operation callback or from ScriptEvaluated.
-  //
-  // TODO: use JS_Begin/EndRequest to keep the GC from racing with JS
-  // execution on any thread.
-  jsval val;
+  jsval val = JSVAL_VOID;
+  jsval* vp = aRetValue ? &val : NULL;
 
   nsJSContext::TerminationFuncHolder holder(this);
 
   // SecurityManager said "ok", but don't compile if aVersion is unknown.
   // Since the caller is responsible for parsing the version strings, we just
   // check it isn't JSVERSION_UNKNOWN.
   if (ok && ((JSVersion)aVersion) != JSVERSION_UNKNOWN) {
     JSAutoRequest ar(mContext);
@@ -1531,31 +1529,31 @@ nsJSContext::EvaluateString(const nsAStr
 
     ok = ::JS_EvaluateUCScriptForPrincipals(mContext,
                                               (JSObject *)aScopeObject,
                                               jsprin,
                                               (jschar*)PromiseFlatString(aScript).get(),
                                               aScript.Length(),
                                               aURL,
                                               aLineNo,
-                                              &val);
+                                              vp);
 
     if (!ok) {
       // Tell XPConnect about any pending exceptions. This is needed
       // to avoid dropping JS exceptions in case we got here through
       // nested calls through XPConnect.
 
       JS_ReportPendingException(mContext);
     }
   }
 
   // Whew!  Finally done with these manually ref-counted things.
   JSPRINCIPALS_DROP(mContext, jsprin);
 
-  // If all went well, convert val to a string (XXXbe unless undefined?).
+  // If all went well, convert val to a string if one is wanted.
   if (ok) {
     JSAutoRequest ar(mContext);
     rv = JSValueToAString(mContext, val, aRetValue, aIsUndefined);
   }
   else {
     if (aIsUndefined) {
       *aIsUndefined = PR_TRUE;
     }
@@ -1957,17 +1955,17 @@ nsJSContext::CallEventHandler(nsISupport
     // right scope anyway, and we want to make sure that the arguments end up
     // in the same scope as aTarget.
     rv = ConvertSupportsTojsvals(aargv, target, &argc,
                                  reinterpret_cast<void **>(&argv), &mark);
     if (NS_FAILED(rv)) {
       stack->Pop(nsnull);
       return rv;
     }
-  
+
     AutoFreeJSStack stackGuard(mContext, mark); // ensure always freed.
 
     jsval funval = OBJECT_TO_JSVAL(aHandler);
     JSAutoRequest ar(mContext);
     PRBool ok = ::JS_CallFunctionValue(mContext, target,
                                        funval, argc, argv, &rval);
 
     if (!ok) {
@@ -2020,17 +2018,17 @@ nsJSContext::BindCompiledEventHandler(ns
   // Get the jsobject associated with this target
   JSObject *target = nsnull;
   nsAutoGCRoot root(&target, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
   rv = JSObjectFromInterface(aTarget, aScope, &target);
   NS_ENSURE_SUCCESS(rv, rv);
 
   JSObject *funobj = (JSObject*) aHandler;
-  
+
   JSAutoRequest ar(mContext);
 
   NS_ASSERTION(JS_TypeOfValue(mContext, OBJECT_TO_JSVAL(funobj)) == JSTYPE_FUNCTION,
                "Event handler object not a function");
 
   // Push our JSContext on our thread's context stack, in case native code
   // called from JS calls back into JS via XPConnect.
   nsCOMPtr<nsIJSContextStack> stack =
@@ -2075,20 +2073,20 @@ nsJSContext::GetBoundEventHandler(nsISup
     NS_ENSURE_SUCCESS(rv, rv);
     JSAutoRequest ar(mContext);
     rv = JSObjectFromInterface(aTarget, aScope, &obj);
     NS_ENSURE_SUCCESS(rv, rv);
 
     const char *charName = AtomToEventHandlerName(aName);
 
     jsval funval;
-    if (!JS_LookupProperty(mContext, obj, 
+    if (!JS_LookupProperty(mContext, obj,
                            charName, &funval))
         return NS_ERROR_FAILURE;
-    
+
     if (JS_TypeOfValue(mContext, funval) != JSTYPE_FUNCTION) {
         NS_WARNING("Event handler object not a function");
         aHandler.drop();
         return NS_OK;
     }
     NS_ASSERTION(aHandler.getScriptTypeID()==JAVASCRIPT,
                  "Expecting JS script object holder");
     return aHandler.set(JSVAL_TO_OBJECT(funval));
@@ -2216,17 +2214,17 @@ nsJSContext::Deserialize(nsIObjectInputS
     if (data)
         nsMemory::Free(data);
     NS_ASSERTION(aResult.getScriptTypeID()==JAVASCRIPT,
                  "Expecting JS script object holder");
 
     // Now that we've cleaned up, handle the case when rv is a failure
     // code, which could happen for all sorts of reasons above.
     NS_ENSURE_SUCCESS(rv, rv);
-    
+
     return aResult.set(result);
 }
 
 void
 nsJSContext::SetDefaultLanguageVersion(PRUint32 aVersion)
 {
   ::JS_SetVersion(mContext, (JSVersion)aVersion);
 }
@@ -2373,17 +2371,17 @@ nsJSContext::InitContext(nsIScriptGlobal
   // If there's already a global object in mContext we won't tell
   // XPConnect to wrap aGlobalObject since it's already wrapped.
 
   nsresult rv;
 
   if (!global) {
     nsCOMPtr<nsIDOMChromeWindow> chromeWindow(do_QueryInterface(aGlobalObject));
     PRUint32 flags = 0;
-    
+
     if (chromeWindow) {
       // Flag this window's global object and objects under it as "system",
       // for optional automated XPCNativeWrapper construction when chrome JS
       // views a content DOM.
       flags = nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT;
 
       // Always enable E4X for XUL and other chrome content -- there is no
       // need to preserve the <!-- script hiding hack from JS-in-HTML daze
@@ -2540,17 +2538,17 @@ nsJSContext::ConvertSupportsTojsvals(nsI
       argsArray->QueryElementAt(argCtr, NS_GET_IID(nsISupports),
                                 getter_AddRefs(arg));
       if (!arg) {
         *thisval = JSVAL_NULL;
         continue;
       }
       nsCOMPtr<nsIVariant> variant(do_QueryInterface(arg));
       if (variant != nsnull) {
-        rv = xpc->VariantToJS(mContext, (JSObject *)aScope, variant, 
+        rv = xpc->VariantToJS(mContext, (JSObject *)aScope, variant,
                               thisval);
       } else {
         // And finally, support the nsISupportsPrimitives supplied
         // by the AppShell.  It generally will pass only strings, but
         // as we have code for handling all, we may as well use it.
         rv = AddSupportsPrimitiveTojsvals(arg, thisval);
         if (rv == NS_ERROR_NO_INTERFACE) {
           // something else - probably an event object or similar -
@@ -2612,17 +2610,17 @@ nsJSContext::AddSupportsPrimitiveTojsval
     case nsISupportsPrimitive::TYPE_CSTRING : {
       nsCOMPtr<nsISupportsCString> p(do_QueryInterface(argPrimitive));
       NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
 
       nsCAutoString data;
 
       p->GetData(data);
 
-      
+
       JSString *str = ::JS_NewStringCopyN(cx, data.get(), data.Length());
       NS_ENSURE_TRUE(str, NS_ERROR_OUT_OF_MEMORY);
 
       *aArgv = STRING_TO_JSVAL(str);
 
       break;
     }
     case nsISupportsPrimitive::TYPE_STRING : {
@@ -2809,17 +2807,17 @@ nsresult
 nsJSContext::FindXPCNativeWrapperClass(nsIXPConnectJSObjectHolder *aHolder)
 {
   NS_ASSERTION(!NS_DOMClassInfo_GetXPCNativeWrapperClass(),
                "Why was this called?");
 
   JSObject *globalObj;
   aHolder->GetJSObject(&globalObj);
   NS_ASSERTION(globalObj, "Must have global by now!");
-      
+
   const char* arg = "arg";
   NS_NAMED_LITERAL_STRING(body, "return new XPCNativeWrapper(arg);");
 
   // Can't use CompileFunction() here because our principal isn't
   // inited yet and a null principal makes it fail.
   JSFunction *fun =
     ::JS_CompileUCFunction(mContext,
                            globalObj,
@@ -2829,17 +2827,17 @@ nsJSContext::FindXPCNativeWrapperClass(n
                            body.Length(),
                            "javascript:return new XPCNativeWrapper(arg);",
                            1 // lineno
                            );
   NS_ENSURE_TRUE(fun, NS_ERROR_FAILURE);
 
   jsval globalVal = OBJECT_TO_JSVAL(globalObj);
   jsval wrapper;
-      
+
   JSBool ok = ::JS_CallFunction(mContext, globalObj, fun,
                                 1, &globalVal, &wrapper);
   if (!ok) {
     // No need to notify about pending exceptions here; we don't
     // expect any other than out of memory, really.
     return NS_ERROR_FAILURE;
   }
 
@@ -3161,17 +3159,17 @@ nsJSContext::InitClasses(void *aGlobalOb
 #endif
 
 #ifdef MOZ_CALLGRIND
   // Attempt to initialize Callgrind functions
   ::JS_DefineFunctions(mContext, globalObj, CallgrindFunctions);
 #endif
 
   JSOptionChangedCallback(js_options_dot_str, this);
-    
+
   return rv;
 }
 
 void
 nsJSContext::ClearScope(void *aGlobalObj, PRBool aClearFromProtoChain)
 {
   // Push our JSContext on our thread's context stack.
   nsCOMPtr<nsIJSContextStack> stack =
@@ -3251,17 +3249,17 @@ nsJSContext::GC()
 void
 nsJSContext::ScriptEvaluated(PRBool aTerminated)
 {
   if (aTerminated && mTerminations) {
     // Make sure to null out mTerminations before doing anything that
     // might cause new termination funcs to be added!
     nsJSContext::TerminationFuncClosure* start = mTerminations;
     mTerminations = nsnull;
-    
+
     for (nsJSContext::TerminationFuncClosure* cur = start;
          cur;
          cur = cur->mNext) {
       (*(cur->mTerminationFunc))(cur->mTerminationFuncArg);
     }
     delete start;
   }