diff --git a/content/xbl/src/nsXBLProtoImplMethod.cpp b/content/xbl/src/nsXBLProtoImplMethod.cpp
index f26a6ec38080..5c7b9222e136 100644
--- a/content/xbl/src/nsXBLProtoImplMethod.cpp
+++ b/content/xbl/src/nsXBLProtoImplMethod.cpp
@@ -151,7 +151,7 @@ nsXBLProtoImplMethod::InstallMember(nsIScriptContext* aContext,
     JSAutoRequest ar(cx);
     JSAutoEnterCompartment ac;
 
-    if (!ac.enter(cx, mJSMethodObject)) {
+    if (!ac.enter(cx, globalObject)) {
       return NS_ERROR_UNEXPECTED;
     }
 
@@ -312,6 +312,10 @@ nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement)
   JSObject* thisObject = JSVAL_TO_OBJECT(v);
 
   JSAutoRequest ar(cx);
+  JSAutoEnterCompartment ac;
+
+  if (!ac.enter(cx, thisObject))
+    return NS_ERROR_UNEXPECTED;
 
   // Clone the function object, using thisObject as the parent so "this" is in
   // the scope chain of the resulting function (for backwards compat to the
diff --git a/content/xbl/src/nsXBLProtoImplProperty.cpp b/content/xbl/src/nsXBLProtoImplProperty.cpp
index 25d9593392f5..c941e879fd28 100644
--- a/content/xbl/src/nsXBLProtoImplProperty.cpp
+++ b/content/xbl/src/nsXBLProtoImplProperty.cpp
@@ -176,6 +176,11 @@ nsXBLProtoImplProperty::InstallMember(nsIScriptContext* aContext,
   if ((mJSGetterObject || mJSSetterObject) && targetClassObject) {
     JSObject * getter = nsnull;
     JSAutoRequest ar(cx);
+    JSAutoEnterCompartment ac;
+
+    if (!ac.enter(cx, globalObject))
+      return NS_ERROR_UNEXPECTED;
+
     if (mJSGetterObject)
       if (!(getter = ::JS_CloneFunctionObject(cx, mJSGetterObject, globalObject)))
         return NS_ERROR_OUT_OF_MEMORY;
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index f35666fdde5c..cefdab43b5fd 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1187,8 +1187,10 @@ bool
 JSAutoEnterCompartment::enter(JSContext *cx, JSObject *target)
 {
     JS_ASSERT(!call);
-    if (cx->compartment == target->getCompartment())
+    if (cx->compartment == target->getCompartment()) {
+        call = reinterpret_cast<JSCrossCompartmentCall*>(1);
         return true;
+    }
     call = JS_EnterCrossCompartmentCall(cx, target);
     return call != NULL;
 }
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 14379c86d293..0ba0c614c49b 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -979,12 +979,14 @@ class JS_PUBLIC_API(JSAutoEnterCompartment)
     bool entered() const { return call != NULL; }
 
     ~JSAutoEnterCompartment() {
-        if (call)
+        if (call && call != reinterpret_cast<JSCrossCompartmentCall*>(1))
             JS_LeaveCrossCompartmentCall(call);
     }
 
     void swap(JSAutoEnterCompartment &other) {
         JSCrossCompartmentCall *tmp = call;
+        if (tmp == reinterpret_cast<JSCrossCompartmentCall*>(1))
+            tmp = NULL;
         call = other.call;
         other.call = tmp;
     }
diff --git a/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp b/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp
index 2c5bd3fb1400..38897b0bd9eb 100644
--- a/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp
+++ b/js/src/xpconnect/loader/mozJSSubScriptLoader.cpp
@@ -217,6 +217,14 @@ mozJSSubScriptLoader::LoadSubScript (const PRUnichar * aURL
         fprintf (stderr, "Final global: %p\n", target_obj);
 #endif
     }
+    else if (target_obj->isWrapper())
+    {
+        target_obj = target_obj->unwrap();
+    }
+
+    JSAutoEnterCompartment ac;
+    if (!ac.enter(cx, target_obj))
+        return NS_ERROR_UNEXPECTED;
 
     /* load up the url.  From here on, failures are reflected as ``custom''
      * js exceptions */