--- a/layout/style/ServoBindings.cpp
+++ b/layout/style/ServoBindings.cpp
@@ -1323,16 +1323,28 @@ Gecko_ClearPODTArray(void* aArray, size_
 
 void
 Gecko_CopyStyleGridTemplateValues(nsStyleGridTemplate* aGridTemplate,
                                   const nsStyleGridTemplate* aOther)
 {
   *aGridTemplate = *aOther;
 }
 
+mozilla::css::GridTemplateAreasValue*
+Gecko_NewGridTemplateAreasValue(uint32_t aAreas, uint32_t aTemplates, uint32_t aColumns)
+{
+  RefPtr<mozilla::css::GridTemplateAreasValue> value = new mozilla::css::GridTemplateAreasValue;
+  value->mNamedAreas.SetLength(aAreas);
+  value->mTemplates.SetLength(aTemplates);
+  value->mNColumns = aColumns;
+  return value.forget().take();
+}
+
+NS_IMPL_THREADSAFE_FFI_REFCOUNTING(mozilla::css::GridTemplateAreasValue, GridTemplateAreasValue);
+
 void
 Gecko_ClearAndResizeStyleContents(nsStyleContent* aContent, uint32_t aHowMany)
 {
   aContent->AllocateContents(aHowMany);
 }
 
 void
 Gecko_CopyStyleContentsFrom(nsStyleContent* aContent, const nsStyleContent* aOther)

--- a/layout/style/ServoBindings.h
+++ b/layout/style/ServoBindings.h
@@ -329,16 +329,21 @@ void Gecko_EnsureTArrayCapacity(void* ar
 //
 // Important note: Only valid for POD types, since destructors won't be run
 // otherwise. This is ensured with rust traits for the relevant structs.
 void Gecko_ClearPODTArray(void* array, size_t elem_size, size_t elem_align);
 
 void Gecko_CopyStyleGridTemplateValues(nsStyleGridTemplate* grid_template,
                                        const nsStyleGridTemplate* other);
 
+mozilla::css::GridTemplateAreasValue* Gecko_NewGridTemplateAreasValue(uint32_t areas,
+                                                                      uint32_t templates,
+                                                                      uint32_t columns);
+NS_DECL_THREADSAFE_FFI_REFCOUNTING(mozilla::css::GridTemplateAreasValue, GridTemplateAreasValue);
+
 // Clear the mContents, mCounterIncrements, or mCounterResets field in nsStyleContent. This is
 // needed to run the destructors, otherwise we'd leak the images, strings, and whatnot.
 void Gecko_ClearAndResizeStyleContents(nsStyleContent* content,
                                        uint32_t how_many);
 void Gecko_ClearAndResizeCounterIncrements(nsStyleContent* content,
                                            uint32_t how_many);
 void Gecko_ClearAndResizeCounterResets(nsStyleContent* content,
                                        uint32_t how_many);

--- a/layout/style/nsCSSValue.h
+++ b/layout/style/nsCSSValue.h
@@ -272,17 +272,17 @@ struct GridTemplateAreasValue final {
     return mTemplates == aOther.mTemplates;
   }
 
   bool operator!=(const GridTemplateAreasValue& aOther) const
   {
     return !(*this == aOther);
   }
 
-  NS_INLINE_DECL_REFCOUNTING(GridTemplateAreasValue)
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GridTemplateAreasValue)
 
   size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
 private:
   // Private destructor to make sure this isn't used as a stack variable
   // or member variable.
   ~GridTemplateAreasValue()
   {