--- a/dom/xhr/XMLHttpRequestWorker.cpp
+++ b/dom/xhr/XMLHttpRequestWorker.cpp
@@ -98,17 +98,17 @@ public:
   const Maybe<ServiceWorkerDescriptor> mController;
 
   // XHR Params:
   bool mMozAnon;
   bool mMozSystem;
 
   // Only touched on the main thread.
   RefPtr<XMLHttpRequestMainThread> mXHR;
-  nsCOMPtr<nsIXMLHttpRequestUpload> mXHRUpload;
+  RefPtr<XMLHttpRequestUpload> mXHRUpload;
   nsCOMPtr<nsIEventTarget> mSyncLoopTarget;
   nsCOMPtr<nsIEventTarget> mSyncEventResponseTarget;
   uint32_t mInnerEventStreamId;
   uint32_t mInnerChannelId;
   uint32_t mOutstandingSendCount;
 
   // Only touched on the worker thread.
   uint32_t mOuterEventStreamId;
@@ -288,17 +288,17 @@ enum
   STRING_LAST_XHR = STRING_loadend,
   STRING_LAST_EVENTTARGET = STRING_timeout
 };
 
 static_assert(STRING_LAST_XHR >= STRING_LAST_EVENTTARGET, "Bad string setup!");
 static_assert(STRING_LAST_XHR == STRING_COUNT - 1, "Bad string setup!");
 
 const char* const sEventStrings[] = {
-  // nsIXMLHttpRequestEventTarget event types, supported by both XHR and Upload.
+  // XMLHttpRequestEventTarget event types, supported by both XHR and Upload.
   "abort",
   "error",
   "load",
   "loadstart",
   "progress",
   "timeout",
 
   // nsIXMLHttpRequest event types, supported only by XHR.
@@ -947,21 +947,22 @@ Proxy::AddRemoveEventListeners(bool aUpl
 {
   AssertIsOnMainThread();
 
   NS_ASSERTION(!aUpload ||
                (mUploadEventListenersAttached && !aAdd) ||
                (!mUploadEventListenersAttached && aAdd),
                "Messed up logic for upload listeners!");
 
-  nsCOMPtr<nsIDOMEventTarget> target =
+  DOMEventTargetHelper* targetHelper =
     aUpload ?
-    do_QueryInterface(mXHRUpload) :
-    do_QueryInterface(static_cast<nsIXMLHttpRequest*>(mXHR.get()));
-  NS_ASSERTION(target, "This should never fail!");
+    static_cast<XMLHttpRequestUpload*>(mXHRUpload.get()) :
+    static_cast<XMLHttpRequestEventTarget*>(mXHR.get());
+  MOZ_ASSERT(targetHelper, "This should never fail!");
+  nsCOMPtr<nsIDOMEventTarget> target = targetHelper;
 
   uint32_t lastEventType = aUpload ? STRING_LAST_EVENTTARGET : STRING_LAST_XHR;
 
   nsAutoString eventType;
   for (uint32_t index = 0; index <= lastEventType; index++) {
     eventType = NS_ConvertASCIItoUTF16(sEventStrings[index]);
     if (aAdd) {
       if (NS_FAILED(target->AddEventListener(eventType, this, false))) {
@@ -999,17 +1000,17 @@ Proxy::HandleEvent(nsIDOMEvent* aEvent)
   }
 
   nsCOMPtr<nsIDOMEventTarget> target;
   if (NS_FAILED(aEvent->GetTarget(getter_AddRefs(target)))) {
     NS_WARNING("Failed to get target!");
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIXMLHttpRequestUpload> uploadTarget = do_QueryInterface(target);
+  bool isUploadTarget = mXHR != target;
   ProgressEvent* progressEvent = aEvent->InternalDOMEvent()->AsProgressEvent();
 
   if (mInOpen && type.EqualsASCII(sEventStrings[STRING_readystatechange])) {
     uint16_t readyState = 0;
     if (NS_SUCCEEDED(mXHR->GetReadyState(&readyState)) &&
         readyState == nsIXMLHttpRequest::OPENED) {
       mInnerEventStreamId++;
     }
@@ -1023,30 +1024,30 @@ Proxy::HandleEvent(nsIDOMEvent* aEvent)
     if (!GetOrCreateDOMReflectorNoWrap(cx, mXHR, &value)) {
       return NS_ERROR_FAILURE;
     }
 
     JS::Rooted<JSObject*> scope(cx, &value.toObject());
 
     RefPtr<EventRunnable> runnable;
     if (progressEvent) {
-      runnable = new EventRunnable(this, !!uploadTarget, type,
+      runnable = new EventRunnable(this, isUploadTarget, type,
                                    progressEvent->LengthComputable(),
                                    progressEvent->Loaded(),
                                    progressEvent->Total(),
                                    scope);
     }
     else {
-      runnable = new EventRunnable(this, !!uploadTarget, type, scope);
+      runnable = new EventRunnable(this, isUploadTarget, type, scope);
     }
 
     runnable->Dispatch();
   }
 
-  if (!uploadTarget) {
+  if (!isUploadTarget) {
     if (type.EqualsASCII(sEventStrings[STRING_loadstart])) {
       mMainThreadSeenLoadStart = true;
     }
     else if (mMainThreadSeenLoadStart &&
              type.EqualsASCII(sEventStrings[STRING_loadend])) {
       mMainThreadSeenLoadStart = false;
 
       RefPtr<LoadStartDetectionRunnable> runnable =