diff --git a/mozilla/js/src/jsexn.c b/mozilla/js/src/jsexn.c
index cd916a26414..671c6ed2364 100644
--- a/mozilla/js/src/jsexn.c
+++ b/mozilla/js/src/jsexn.c
@@ -529,7 +529,6 @@ static JSBool
 Exception(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
 {
     JSBool ok;
-    jsval pval;
     uint32 lineno;
     JSString *message, *filename;
     JSStackFrame *fp;
@@ -549,10 +548,10 @@ Exception(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
         ok = OBJ_GET_PROPERTY(cx, JSVAL_TO_OBJECT(argv[-2]),
                               ATOM_TO_JSID(cx->runtime->atomState
                                            .classPrototypeAtom),
-                              &pval);
+                              rval);
         if (!ok)
             goto out;
-        obj = js_NewObject(cx, &js_ErrorClass, JSVAL_TO_OBJECT(pval), NULL);
+        obj = js_NewObject(cx, &js_ErrorClass, JSVAL_TO_OBJECT(*rval), NULL);
         if (!obj) {
             ok = JS_FALSE;
             goto out;
diff --git a/mozilla/js/src/jsfile.c b/mozilla/js/src/jsfile.c
index a3956f96a3a..3735e84a588 100644
--- a/mozilla/js/src/jsfile.c
+++ b/mozilla/js/src/jsfile.c
@@ -2172,6 +2172,7 @@ file_constructor(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
         obj = JS_NewObject(cx, &file_class, NULL, NULL);
         if (!obj)
             return JS_FALSE;
+        *rval = OBJECT_TO_JSVAL(obj);
     }
 
     str = (argc == 0) 
@@ -2191,7 +2192,6 @@ file_constructor(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
 
     SECURITY_CHECK(cx, NULL, "constructor", file);
 
-    *rval = OBJECT_TO_JSVAL(obj);
     return JS_TRUE;
 }
 
diff --git a/mozilla/js/src/jsregexp.c b/mozilla/js/src/jsregexp.c
index 47d5b246732..f2574e99a55 100644
--- a/mozilla/js/src/jsregexp.c
+++ b/mozilla/js/src/jsregexp.c
@@ -4059,6 +4059,12 @@ RegExp(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
         obj = js_NewObject(cx, &js_RegExpClass, NULL, NULL);
         if (!obj)
             return JS_FALSE;
+
+        /*
+         * regexp_compile does not use rval to root its temporaries
+         * so we can use it to root obj.
+         */
+        *rval = OBJECT_TO_JSVAL(obj);
     }
     return regexp_compile(cx, obj, argc, argv, rval);
 }
diff --git a/mozilla/js/src/jsscript.c b/mozilla/js/src/jsscript.c
index 9e0ba6ada66..3ecf460a077 100644
--- a/mozilla/js/src/jsscript.c
+++ b/mozilla/js/src/jsscript.c
@@ -878,6 +878,12 @@ Script(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
         obj = js_NewObject(cx, &js_ScriptClass, NULL, NULL);
         if (!obj)
             return JS_FALSE;
+
+        /*
+         * script_compile does not use rval to root its temporaries
+         * so we can use it to root obj.
+         */
+        *rval = OBJECT_TO_JSVAL(obj);
     }
     return script_compile(cx, obj, argc, argv, rval);
 }