diff --git a/js/src/xpconnect/src/xpcconvert.cpp b/js/src/xpconnect/src/xpcconvert.cpp
index f4091e298784..038ededc0630 100644
--- a/js/src/xpconnect/src/xpcconvert.cpp
+++ b/js/src/xpconnect/src/xpcconvert.cpp
@@ -330,9 +330,12 @@ XPCConvert::NativeData2JS(XPCLazyCallContext& lccx, jsval* d, const void* s,
                     break;
 
                 if(!p->IsVoid()) {
-                    jsval str = XPCStringConvert::ReadableToJSVal(cx, *p);
+                    nsStringBuffer* buf;
+                    jsval str = XPCStringConvert::ReadableToJSVal(cx, *p, &buf);
                     if(JSVAL_IS_NULL(str))
                         return JS_FALSE;
+                    if(buf)
+                        buf->AddRef();
 
                     *d = str;
                 }
diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
index b08e77767b4d..b8bb9a16180e 100644
--- a/js/src/xpconnect/src/xpcprivate.h
+++ b/js/src/xpconnect/src/xpcprivate.h
@@ -113,6 +113,7 @@
 #include "nsBaseHashtable.h"
 #include "nsHashKeys.h"
 #include "nsWrapperCache.h"
+#include "nsStringBuffer.h"
 
 #include "nsIXPCScriptNotify.h"  // used to notify: ScriptEvaluated
 
@@ -3226,9 +3227,11 @@ class XPCStringConvert
 {
 public:
 
+    // If the string shares the readable's buffer, that buffer will
+    // get assigned to *sharedBuffer.  Otherwise null will be
+    // assigned.
     static jsval ReadableToJSVal(JSContext *cx, const nsAString &readable,
-                                 PRBool dontAddrefShared = PR_FALSE,
-                                 PRBool* sharedBuffer = nsnull);
+                                 nsStringBuffer** sharedBuffer);
 
     static XPCReadableJSStringWrapper *JSStringToReadable(XPCCallContext& ccx,
                                                           JSString *str);
diff --git a/js/src/xpconnect/src/xpcquickstubs.cpp b/js/src/xpconnect/src/xpcquickstubs.cpp
index da8f37639331..fe2e61445369 100644
--- a/js/src/xpconnect/src/xpcquickstubs.cpp
+++ b/js/src/xpconnect/src/xpcquickstubs.cpp
@@ -1071,13 +1071,12 @@ xpc_qsStringToJsval(JSContext *cx, nsString &str, jsval *rval)
         return JS_TRUE;
     }
 
-    PRBool isShared = PR_FALSE;
-    jsval jsstr =
-        XPCStringConvert::ReadableToJSVal(cx, str, PR_TRUE, &isShared);
+    nsStringBuffer* sharedBuffer;
+    jsval jsstr = XPCStringConvert::ReadableToJSVal(cx, str, &sharedBuffer);
     if (JSVAL_IS_NULL(jsstr))
         return JS_FALSE;
     *rval = jsstr;
-    if (isShared)
+    if (sharedBuffer)
     {
         // The string was shared but ReadableToJSVal didn't addref it.
         // Move the ownership from str to jsstr.
@@ -1096,13 +1095,12 @@ xpc_qsStringToJsstring(JSContext *cx, nsString &str, JSString **rval)
         return JS_TRUE;
     }
 
-    PRBool isShared = PR_FALSE;
-    jsval jsstr =
-        XPCStringConvert::ReadableToJSVal(cx, str, PR_TRUE, &isShared);
+    nsStringBuffer* sharedBuffer;
+    jsval jsstr = XPCStringConvert::ReadableToJSVal(cx, str, &sharedBuffer);
     if(JSVAL_IS_NULL(jsstr))
         return JS_FALSE;
     *rval = JSVAL_TO_STRING(jsstr);
-    if (isShared)
+    if (sharedBuffer)
     {
         // The string was shared but ReadableToJSVal didn't addref it.
         // Move the ownership from str to jsstr.
diff --git a/js/src/xpconnect/src/xpcstring.cpp b/js/src/xpconnect/src/xpcstring.cpp
index 0643a5658f43..12bd938afec5 100644
--- a/js/src/xpconnect/src/xpcstring.cpp
+++ b/js/src/xpconnect/src/xpcstring.cpp
@@ -78,14 +78,10 @@ XPCStringConvert::ShutdownDOMStringFinalizer()
 jsval
 XPCStringConvert::ReadableToJSVal(JSContext *cx,
                                   const nsAString &readable,
-                                  PRBool dontAddrefShared,
-                                  PRBool* sharedBuffer)
+                                  nsStringBuffer** sharedBuffer)
 {
     JSString *str;
-    if (sharedBuffer)
-    {
-        *sharedBuffer = PR_FALSE;
-    }
+    *sharedBuffer = nsnull;
 
     PRUint32 length = readable.Length();
 
@@ -114,14 +110,7 @@ XPCStringConvert::ReadableToJSVal(JSContext *cx,
 
         if (str)
         {
-            if (sharedBuffer)
-            {
-                *sharedBuffer = PR_TRUE;
-            }
-            if (!dontAddrefShared)
-            {
-                buf->AddRef();
-            }
+            *sharedBuffer = buf;
         }
     }
     else
diff --git a/js/src/xpconnect/src/xpcwrappedjs.cpp b/js/src/xpconnect/src/xpcwrappedjs.cpp
index c25ce29947f2..96b17cd4ab2a 100644
--- a/js/src/xpconnect/src/xpcwrappedjs.cpp
+++ b/js/src/xpconnect/src/xpcwrappedjs.cpp
@@ -620,9 +620,12 @@ nsXPCWrappedJS::GetProperty(const nsAString & name, nsIVariant **_retval)
     if(!ccx.IsValid())
         return NS_ERROR_UNEXPECTED;
 
-    jsval jsstr = XPCStringConvert::ReadableToJSVal(ccx, name);
+    nsStringBuffer* buf;
+    jsval jsstr = XPCStringConvert::ReadableToJSVal(ccx, name, &buf);
     if(JSVAL_IS_NULL(jsstr))
         return NS_ERROR_OUT_OF_MEMORY;
+    if(buf)
+        buf->AddRef();
 
     return nsXPCWrappedJSClass::
         GetNamedPropertyAsVariant(ccx, mJSObj, jsstr, _retval);