diff --git a/content/test/unit/test_range.js b/content/test/unit/test_range.js
index 4ea380c46ef..24f3b4cfffa 100644
--- a/content/test/unit/test_range.js
+++ b/content/test/unit/test_range.js
@@ -360,7 +360,7 @@ function run_miscellaneous_tests() {
       baseRange.setStart(null, 0);
       do_throw("Should have thrown NOT_OBJECT_ERR!");
     } catch (e) {
-      do_check_eq(e instanceof TypeError, true);
+      do_check_eq(e.constructor.name, "TypeError");
     }
 
     // Invalid start node
@@ -368,7 +368,7 @@ function run_miscellaneous_tests() {
       baseRange.setStart({}, 0);
       do_throw("Should have thrown SecurityError!");
     } catch (e) {
-      do_check_true(e instanceof TypeError);
+      do_check_eq(e.constructor.name, "TypeError");
     }
 
     // Invalid index
diff --git a/js/xpconnect/public/SandboxPrivate.h b/js/xpconnect/public/SandboxPrivate.h
index 88f6623de8b..2e270ecfbed 100644
--- a/js/xpconnect/public/SandboxPrivate.h
+++ b/js/xpconnect/public/SandboxPrivate.h
@@ -9,6 +9,7 @@
 #include "nsIScriptObjectPrincipal.h"
 #include "nsIPrincipal.h"
 #include "nsWeakReference.h"
+#include "nsWrapperCache.h"
 
 #include "js/RootingAPI.h"
 
@@ -17,17 +18,20 @@
 
 class SandboxPrivate : public nsIGlobalObject,
                        public nsIScriptObjectPrincipal,
-                       public nsSupportsWeakReference
+                       public nsSupportsWeakReference,
+                       public nsWrapperCache
 {
 public:
     SandboxPrivate(nsIPrincipal *principal, JSObject *global)
         : mPrincipal(principal)
-        , mGlobalJSObject(global)
     {
+        SetWrapper(global);
     }
     virtual ~SandboxPrivate() { }
 
-    NS_DECL_ISUPPORTS
+    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+    NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(SandboxPrivate,
+                                                           nsIGlobalObject)
 
     nsIPrincipal *GetPrincipal()
     {
@@ -36,16 +40,15 @@ public:
 
     JSObject *GetGlobalJSObject()
     {
-        return mGlobalJSObject;
+        return GetWrapper();
     }
 
     void ForgetGlobalObject()
     {
-        mGlobalJSObject = nullptr;
+        ClearWrapper();
     }
 private:
     nsCOMPtr<nsIPrincipal> mPrincipal;
-    JS::TenuredHeap<JSObject*> mGlobalJSObject;
 };
 
 #endif // __SANDBOXPRIVATE_H__
diff --git a/js/xpconnect/src/Sandbox.cpp b/js/xpconnect/src/Sandbox.cpp
index de6b220d237..0e57f62ec68 100644
--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -43,10 +43,16 @@ using namespace xpc;
 using mozilla::dom::DestroyProtoAndIfaceCache;
 using mozilla::dom::indexedDB::IndexedDatabaseManager;
 
-NS_IMPL_ISUPPORTS3(SandboxPrivate,
-                   nsIScriptObjectPrincipal,
-                   nsIGlobalObject,
-                   nsISupportsWeakReference)
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_0(SandboxPrivate)
+NS_IMPL_CYCLE_COLLECTING_ADDREF(SandboxPrivate)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(SandboxPrivate)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SandboxPrivate)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIScriptObjectPrincipal)
+  NS_INTERFACE_MAP_ENTRY(nsIScriptObjectPrincipal)
+  NS_INTERFACE_MAP_ENTRY(nsIGlobalObject)
+  NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
+NS_INTERFACE_MAP_END
 
 const char kScriptSecurityManagerContractID[] = NS_SCRIPTSECURITYMANAGER_CONTRACTID;
 
diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
index a6267098f47..e4210c5ec14 100644
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -819,24 +819,17 @@ XPCConvert::NativeInterface2JSObject(MutableHandleValue d,
     // object will create (and fill the cache) from its WrapObject call.
     nsWrapperCache *cache = aHelper.GetWrapperCache();
 
-    RootedObject flat(cx);
-    if (cache) {
-        flat = cache->GetWrapper();
-        if (cache->IsDOMBinding()) {
-            if (!flat) {
-                RootedObject global(cx, xpcscope->GetGlobalJSObject());
-                flat = cache->WrapObject(cx, global);
-                if (!flat)
-                    return false;
-            }
-
-            if (allowNativeWrapper && !JS_WrapObject(cx, &flat))
-                return false;
-
-            return CreateHolderIfNeeded(flat, d, dest);
-        }
-    } else {
-        flat = nullptr;
+    RootedObject flat(cx, cache ? cache->GetWrapper() : nullptr);
+    if (!flat && cache && cache->IsDOMBinding()) {
+        RootedObject global(cx, xpcscope->GetGlobalJSObject());
+        flat = cache->WrapObject(cx, global);
+        if (!flat)
+            return false;
+    }
+    if (flat) {
+        if (allowNativeWrapper && !JS_WrapObject(cx, &flat))
+            return false;
+        return CreateHolderIfNeeded(flat, d, dest);
     }
 
     // Don't double wrap CPOWs. This is a temporary measure for compatibility
diff --git a/js/xpconnect/tests/unit/test_allowedDomainsXHR.js b/js/xpconnect/tests/unit/test_allowedDomainsXHR.js
index 387a34c1e9c..dab2dd1c431 100644
--- a/js/xpconnect/tests/unit/test_allowedDomainsXHR.js
+++ b/js/xpconnect/tests/unit/test_allowedDomainsXHR.js
@@ -70,9 +70,13 @@ function run_test()
     httpserver.stop(finishIfDone);
   }
 
-  sb.checkResults = checkResults;
-  
+  // We want to execute checkResults from the scope of the sandbox as well to
+  // make sure that there are no permission errors related to nsEP. For that
+  // we need to clone the function into the sandbox and make a few things
+  // available for it.
+  cu.evalInSandbox('var checkResults = ' + checkResults.toSource(), sb);
   sb.do_check_eq = do_check_eq;
+  sb.httpbody = httpbody;
 
   function changeListener(event) {
     if (checkResults(async))