--- a/content/xbl/test/file_bug821850.xhtml
+++ b/content/xbl/test/file_bug821850.xhtml
@@ -38,22 +38,16 @@ https://bugzilla.mozilla.org/show_bug.cg
 
           var bound = document.getElementById('bound');
           ok(bound, "bound is non-null");
           is(bound.method('baz'), "method:baz", "Xray methods work");
           is(bound.prop, "propVal", "Property Xrays work");
           is(bound.primitiveField, undefined, "Xrays don't show fields");
           is(bound.wrappedJSObject.primitiveField, 2, "Waiving Xrays show fields");
 
-          // Check that here document.QueryInterface works
-          ok("QueryInterface" in document,
-             "Should have a document.QueryInterface here");
-          is(document.QueryInterface(Components.interfaces.nsIDOMDocument),
-             document, "Should be able to QI the document");
-
           // This gets invoked by an event handler.
           window.finish = function() {
             // Content messed with stuff. Make sure we still see the right thing.
             is(bound.method('bay'), "method:bay", "Xray methods work");
             is(bound.wrappedJSObject.method('bay'), "hah", "Xray waived methods work");
             is(bound.prop, "set:someOtherVal", "Xray props work");
             is(bound.wrappedJSObject.prop, "redefined", "Xray waived props work");
             is(bound.wrappedJSObject.primitiveField, 321, "Can't do anything about redefined fields");
@@ -104,20 +98,16 @@ https://bugzilla.mozilla.org/show_bug.cg
   SpecialPowers = parent.SpecialPowers;
 
   // Test the Xray waiving behavior when accessing fields. We should be able to
   // see sequential JS-implemented properties, but should regain Xrays when we
   // hit a native property.
   window.contentVal = { foo: 10, rabbit: { hole: { bar: 100, win: window} } };
   ok(true, "Set contentVal");
 
-  // Check that we're not exposing QueryInterface to non-XBL code
-  ok(!("QueryInterface" in document),
-     "Should not have a document.QueryInterface here");
-
   function go() {
     "use strict";
 
     // Test what we can and cannot access in the XBL scope.
     is(typeof window.xrayExpando, "undefined", "Xray expandos are private to the caller");
     is(window.primitiveExpando, 11, "Can see waived expandos");
     is(window.stringExpando, "stringExpando", "Can see waived expandos");
     is(typeof window.objectExpando, "object", "object expando exists");

--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1455,34 +1455,24 @@ class MethodDefiner(PropertyDefiner):
         if any(m.isGetter() and m.isIndexed() for m in methods):
             self.regular.append({"name": 'iterator',
                                  "methodInfo": False,
                                  "nativeName": "JS_ArrayIterator",
                                  "length": 0,
                                  "flags": "JSPROP_ENUMERATE",
                                  "condition": MemberCondition(None, None) })
 
-        # Make sure to not stick QueryInterface on anything that
-        # hasXPConnectImpls: just put it on the rootmost things without that
-        # flag.
-        if (not descriptor.hasXPConnectImpls and
-            (not descriptor.interface.parent or
-             descriptor.getDescriptor(
-                    descriptor.interface.parent.identifier.name
-                    ).hasXPConnectImpls)
-            and not static and
+        if (not descriptor.interface.parent and not static and
             descriptor.nativeOwnership == 'nsisupports' and
             descriptor.interface.hasInterfacePrototypeObject()):
-            self.regular.append({"name": 'QueryInterface',
-                                 "methodInfo": False,
-                                 "length": 1,
-                                 "flags": "0",
-                                 "condition":
-                                     MemberCondition(None,
-                                                     "nsINode::IsChromeOrXBL") })
+            self.chrome.append({"name": 'QueryInterface',
+                                "methodInfo": False,
+                                "length": 1,
+                                "flags": "0",
+                                "condition": MemberCondition(None, None) })
 
         if not static:
             stringifier = descriptor.operations['Stringifier']
             if stringifier:
                 toStringDesc = { "name": "toString",
                                  "nativeName": stringifier.identifier.name,
                                  "length": 0,
                                  "flags": "JSPROP_ENUMERATE",

--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -2238,24 +2238,16 @@ JS_PUBLIC_API(JSObject *)
 JS_GetFunctionPrototype(JSContext *cx, JSObject *forObj)
 {
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, forObj);
     return forObj->global().getOrCreateFunctionPrototype(cx);
 }
 
 JS_PUBLIC_API(JSObject *)
-JS_GetArrayPrototype(JSContext *cx, JSObject *forObj)
-{
-    CHECK_REQUEST(cx);
-    assertSameCompartment(cx, forObj);
-    return forObj->global().getOrCreateArrayPrototype(cx);
-}
-
-JS_PUBLIC_API(JSObject *)
 JS_GetGlobalForObject(JSContext *cx, JSObject *obj)
 {
     AssertHeapIsIdle(cx);
     assertSameCompartment(cx, obj);
     return &obj->global();
 }
 
 extern JS_PUBLIC_API(JSBool)

--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2154,23 +2154,16 @@ JS_GetFunctionPrototype(JSContext *cx, J
 
 /*
  * Returns the original value of |Object.prototype| from the global object in
  * which |forObj| was created.
  */
 extern JS_PUBLIC_API(JSObject *)
 JS_GetObjectPrototype(JSContext *cx, JSObject *forObj);
 
-/*
- * Returns the original value of |Array.prototype| from the global object in
- * which |forObj| was created.
- */
-extern JS_PUBLIC_API(JSObject *)
-JS_GetArrayPrototype(JSContext *cx, JSObject *forObj);
-
 extern JS_PUBLIC_API(JSObject *)
 JS_GetGlobalForObject(JSContext *cx, JSObject *obj);
 
 extern JS_PUBLIC_API(JSBool)
 JS_IsGlobalObject(JSObject *obj);
 
 /*
  * May return NULL, if |c| never had a global (e.g. the atoms compartment), or

--- a/layout/inspector/src/inDOMUtils.cpp
+++ b/layout/inspector/src/inDOMUtils.cpp
@@ -384,18 +384,18 @@ inDOMUtils::GetCSSPropertyNames(uint32_t
       ++propCount;                                                      \
     }                                                                   \
   PR_END_MACRO
 
   // prop is the property id we're considering; propCount is how many properties
   // we've put into props so far.
   uint32_t prop = 0, propCount = 0;
   for ( ; prop < eCSSProperty_COUNT_no_shorthands; ++prop) {
-    if (nsCSSProps::PropertyParseType(nsCSSProperty(prop)) !=
-        CSS_PROPERTY_PARSE_INACCESSIBLE) {
+    if (!nsCSSProps::PropHasFlags(nsCSSProperty(prop),
+                                  CSS_PROPERTY_PARSE_INACCESSIBLE)) {
       DO_PROP(prop);
     }
   }
 
   if (!(aFlags & EXCLUDE_SHORTHANDS)) {
     for ( ; prop < eCSSProperty_COUNT; ++prop) {
       // Some shorthands are also aliases
       if ((aFlags & INCLUDE_ALIASES) ||

--- a/layout/style/nsCSSProps.h
+++ b/layout/style/nsCSSProps.h
@@ -223,20 +223,16 @@ public:
 private:
   static const uint32_t        kFlagsTable[eCSSProperty_COUNT];
 
 public:
   static inline bool PropHasFlags(nsCSSProperty aProperty, uint32_t aFlags)
   {
     NS_ABORT_IF_FALSE(0 <= aProperty && aProperty < eCSSProperty_COUNT,
                       "out of range");
-    MOZ_ASSERT(!(aFlags & CSS_PROPERTY_PARSE_PROPERTY_MASK),
-               "The CSS_PROPERTY_PARSE_* values are not bitflags; don't pass "
-               "them to PropHasFlags.  You probably want PropertyParseType "
-               "instead.");
     return (nsCSSProps::kFlagsTable[aProperty] & aFlags) == aFlags;
   }
 
   static inline uint32_t PropertyParseType(nsCSSProperty aProperty)
   {
     NS_ABORT_IF_FALSE(0 <= aProperty && aProperty < eCSSProperty_COUNT,
                       "out of range");
     return nsCSSProps::kFlagsTable[aProperty] &

--- a/layout/tools/reftest/reftest-content.js
+++ b/layout/tools/reftest/reftest-content.js
@@ -37,18 +37,16 @@ var gFailureTimeout = null;
 var gFailureReason;
 var gAssertionCount = 0;
 
 var gDebug;
 
 var gCurrentTestStartTime;
 var gClearingForAssertionCheck = false;
 
-const TYPE_LOAD = 'load';  // test without a reference (just test that it does
-                           // not assert, crash, hang, or leak)
 const TYPE_SCRIPT = 'script'; // test contains individual test results
 
 function markupDocumentViewer() {
     return docShell.contentViewer.QueryInterface(CI.nsIMarkupDocumentViewer);
 }
 
 function webNavigation() {
     return docShell.QueryInterface(CI.nsIWebNavigation);
@@ -635,22 +633,16 @@ function LogInfo(str)
 {
     sendAsyncMessage("reftest:Log", { type: "info", msg: str });
 }
 
 const SYNC_DEFAULT = 0x0;
 const SYNC_ALLOW_DISABLE = 0x1;
 function SynchronizeForSnapshot(flags)
 {
-    if (gCurrentTestType == TYPE_SCRIPT ||
-        gCurrentTestType == TYPE_LOAD) {
-        // Script tests or load-only tests do not need any snapshotting
-        return;
-    }
-
     if (flags & SYNC_ALLOW_DISABLE) {
         var docElt = content.document.documentElement;
         if (docElt && docElt.hasAttribute("reftest-no-sync-layers")) {
             LogInfo("Test file chose to skip SynchronizeForSnapshot");
             return;
         }
     }