--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -1461,45 +1461,54 @@ NS_IMETHOD GetAttributeNode(const nsAStr
   return NS_OK;                                                               \
 }                                                                             \
 NS_IMETHOD SetAttributeNode(nsIDOMAttr* newAttr,                              \
                             nsIDOMAttr** _retval) MOZ_FINAL                   \
 {                                                                             \
   if (!newAttr) {                                                             \
     return NS_ERROR_INVALID_POINTER;                                          \
   }                                                                           \
+  mozilla::dom::Attr* attr = mozilla::dom::Attr::FromDOMAttr(newAttr);        \
+  if (!attr) {                                                                \
+    return NS_ERROR_INVALID_POINTER;                                          \
+  }                                                                           \
   mozilla::ErrorResult rv;                                                    \
-  mozilla::dom::Attr* attr = static_cast<mozilla::dom::Attr*>(newAttr);       \
   *_retval = Element::SetAttributeNode(*attr, rv).take();                     \
   return rv.ErrorCode();                                                      \
 }                                                                             \
 NS_IMETHOD RemoveAttributeNode(nsIDOMAttr* oldAttr,                           \
                                nsIDOMAttr** _retval) MOZ_FINAL                \
 {                                                                             \
   if (!oldAttr) {                                                             \
     return NS_ERROR_INVALID_POINTER;                                          \
   }                                                                           \
+  mozilla::dom::Attr* attr = mozilla::dom::Attr::FromDOMAttr(oldAttr);        \
+  if (!attr) {                                                                \
+    return NS_ERROR_INVALID_POINTER;                                          \
+  }                                                                           \
   mozilla::ErrorResult rv;                                                    \
-  mozilla::dom::Attr* attr = static_cast<mozilla::dom::Attr*>(oldAttr);       \
   *_retval = Element::RemoveAttributeNode(*attr, rv).take();                  \
   return rv.ErrorCode();                                                      \
 }                                                                             \
 NS_IMETHOD GetAttributeNodeNS(const nsAString& namespaceURI,                  \
                               const nsAString& localName,                     \
                               nsIDOMAttr** _retval) MOZ_FINAL                 \
 {                                                                             \
   NS_IF_ADDREF(*_retval = Element::GetAttributeNodeNS(namespaceURI,           \
                                                       localName));            \
   return NS_OK;                                                               \
 }                                                                             \
 NS_IMETHOD SetAttributeNodeNS(nsIDOMAttr* newAttr,                            \
                               nsIDOMAttr** _retval) MOZ_FINAL                 \
 {                                                                             \
+  mozilla::dom::Attr* attr = mozilla::dom::Attr::FromDOMAttr(newAttr);        \
+  if (!attr) {                                                                \
+    return NS_ERROR_INVALID_POINTER;                                          \
+  }                                                                           \
   mozilla::ErrorResult rv;                                                    \
-  mozilla::dom::Attr* attr = static_cast<mozilla::dom::Attr*>(newAttr);       \
   *_retval = Element::SetAttributeNodeNS(*attr, rv).take();                   \
   return rv.ErrorCode();                                                      \
 }                                                                             \
 NS_IMETHOD GetElementsByTagName(const nsAString& name,                        \
                                 nsIDOMHTMLCollection** _retval) MOZ_FINAL     \
 {                                                                             \
   Element::GetElementsByTagName(name, _retval);                               \
   return NS_OK;                                                               \

--- a/content/base/src/Attr.h
+++ b/content/base/src/Attr.h
@@ -74,16 +74,24 @@ public:
   static void Initialize();
   static void Shutdown();
 
   NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS_AMBIGUOUS(Attr,
                                                                    nsIAttribute)
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
+  // This method should not do anything interesting, except possibly in the case of
+  // external binary components.
+  static Attr* FromDOMAttr(nsIDOMAttr* aDOMAttr)
+  {
+    nsCOMPtr<nsIAttribute> iattr = do_QueryInterface(aDOMAttr);
+    return static_cast<mozilla::dom::Attr*>(iattr.get());
+  }
+
   // WebIDL
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
   // XPCOM GetName() is OK
   // XPCOM GetValue() is OK
 
   void SetValue(const nsAString& aValue, ErrorResult& aRv);
 

--- a/content/base/src/nsDOMAttributeMap.cpp
+++ b/content/base/src/nsDOMAttributeMap.cpp
@@ -237,30 +237,30 @@ nsDOMAttributeMap::GetNamedItem(const ns
   NS_ENSURE_ARG_POINTER(aAttribute);
 
   NS_IF_ADDREF(*aAttribute = GetNamedItem(aAttrName));
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsDOMAttributeMap::SetNamedItem(nsIDOMAttr* aAttr, nsIDOMAttr** aReturn)
+nsDOMAttributeMap::SetNamedItem(nsIDOMAttr* aDOMAttr, nsIDOMAttr** aReturn)
 {
-  Attr* attribute = static_cast<Attr*>(aAttr);
+  Attr* attribute = Attr::FromDOMAttr(aDOMAttr);
   NS_ENSURE_ARG(attribute);
 
   ErrorResult rv;
   *aReturn = SetNamedItem(*attribute, rv).take();
   return rv.ErrorCode();
 }
 
 NS_IMETHODIMP
-nsDOMAttributeMap::SetNamedItemNS(nsIDOMAttr* aAttr, nsIDOMAttr** aReturn)
+nsDOMAttributeMap::SetNamedItemNS(nsIDOMAttr* aDOMAttr, nsIDOMAttr** aReturn)
 {
-  Attr* attribute = static_cast<Attr*>(aAttr);
+  Attr* attribute = Attr::FromDOMAttr(aDOMAttr);
   NS_ENSURE_ARG(attribute);
 
   ErrorResult rv;
   *aReturn = SetNamedItemNS(*attribute, rv).take();
   return rv.ErrorCode();
 }
 
 already_AddRefed<Attr>