--- a/dom/canvas/WebGLContextGL.cpp
+++ b/dom/canvas/WebGLContextGL.cpp
@@ -682,30 +682,16 @@ WebGLContext::GetBufferParameter(GLenum 
 
         default:
             ErrorInvalidEnumInfo("getBufferParameter: parameter", pname);
     }
 
     return JS::NullValue();
 }
 
-static JS::Value
-MissingAttachmentCausesInvalidOp(WebGLContext* webgl)
-{
-    webgl->ErrorInvalidOperation("getFramebufferAttachmentParameter: Valid pname, but"
-                                 " missing attachment.");
-    return JS::NullValue();
-}
-
-static JS::Value
-JSUint32Value(uint32_t val)
-{
-    return JS::NumberValue(val);
-}
-
 JS::Value
 WebGLContext::GetFramebufferAttachmentParameter(JSContext* cx,
                                                 GLenum target,
                                                 GLenum attachment,
                                                 GLenum pname,
                                                 ErrorResult& rv)
 {
     const char funcName[] = "getFramebufferAttachmentParameter";
@@ -764,42 +750,42 @@ WebGLContext::GetFramebufferAttachmentPa
         return JS::NullValue();
 
     ////////////////
 
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_RED_SIZE:
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_GREEN_SIZE:
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_BLUE_SIZE:
         if (attachment == LOCAL_GL_COLOR)
-            return JS::Int32Value(8);
-        return JS::Int32Value(0);
+            return JS::NumberValue(8);
+        return JS::NumberValue(0);
 
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_ALPHA_SIZE:
         if (attachment == LOCAL_GL_COLOR)
-            return JS::Int32Value(mOptions.alpha ? 8 : 0);
-        return JS::Int32Value(0);
+            return JS::NumberValue(mOptions.alpha ? 8 : 0);
+        return JS::NumberValue(0);
 
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_DEPTH_SIZE:
         if (attachment == LOCAL_GL_DEPTH)
-            return JS::Int32Value(mOptions.depth ? 24 : 0);
-        return JS::Int32Value(0);
+            return JS::NumberValue(mOptions.depth ? 24 : 0);
+        return JS::NumberValue(0);
 
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_STENCIL_SIZE:
         if (attachment == LOCAL_GL_STENCIL)
-            return JS::Int32Value(mOptions.stencil ? 8 : 0);
-        return JS::Int32Value(0);
+            return JS::NumberValue(mOptions.stencil ? 8 : 0);
+        return JS::NumberValue(0);
 
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_COMPONENT_TYPE:
         if (attachment == LOCAL_GL_STENCIL)
-            return JS::Int32Value(LOCAL_GL_UNSIGNED_INT);
+            return JS::NumberValue(LOCAL_GL_UNSIGNED_INT);
         else
-            return JS::Int32Value(LOCAL_GL_UNSIGNED_NORMALIZED);
+            return JS::NumberValue(LOCAL_GL_UNSIGNED_NORMALIZED);
 
     case LOCAL_GL_FRAMEBUFFER_ATTACHMENT_COLOR_ENCODING:
-        return JS::Int32Value(LOCAL_GL_LINEAR);
+        return JS::NumberValue(LOCAL_GL_LINEAR);
     }
 
     ErrorInvalidEnum("%s: Invalid pname: 0x%04x", funcName, pname);
     return JS::NullValue();
 }
 
 JS::Value
 WebGLContext::GetRenderbufferParameter(GLenum target, GLenum pname)

--- a/dom/canvas/WebGLFramebuffer.cpp
+++ b/dom/canvas/WebGLFramebuffer.cpp
@@ -431,16 +431,17 @@ WebGLFramebuffer::WebGLFramebuffer(WebGL
     : WebGLContextBoundObject(webgl)
     , mGLName(fbo)
     , mIsKnownFBComplete(false)
     , mReadBufferMode(LOCAL_GL_COLOR_ATTACHMENT0)
     , mColorAttachment0(this, LOCAL_GL_COLOR_ATTACHMENT0)
     , mDepthAttachment(this, LOCAL_GL_DEPTH_ATTACHMENT)
     , mStencilAttachment(this, LOCAL_GL_STENCIL_ATTACHMENT)
     , mDepthStencilAttachment(this, LOCAL_GL_DEPTH_STENCIL_ATTACHMENT)
+    , mMoreColorAttachments(webgl->mGLMaxColorAttachments)
     , mDrawBuffers(1, LOCAL_GL_COLOR_ATTACHMENT0)
 #ifdef ANDROID
     , mIsFB(false)
 #endif
 {
     mContext->mFramebuffers.insertBack(this);
 }
 
@@ -581,25 +582,25 @@ WebGLFramebuffer::GetAttachPoint(GLenum 
 
     const auto lastCAEnum = mContext->LastColorAttachmentEnum();
     if (attachPoint < LOCAL_GL_COLOR_ATTACHMENT1 ||
         attachPoint > lastCAEnum)
     {
         return nullptr;
     }
 
-    if (!mMoreColorAttachments.size()) {
+    if (!mMoreColorAttachments.Size()) {
         for (GLenum cur = LOCAL_GL_COLOR_ATTACHMENT1; cur <= lastCAEnum; cur++) {
-            mMoreColorAttachments.push_back(WebGLFBAttachPoint(this, cur));
+            mMoreColorAttachments.AppendNew(this, cur);
         }
     }
-    MOZ_ASSERT(LOCAL_GL_COLOR_ATTACHMENT0 + mMoreColorAttachments.size() == lastCAEnum);
+    MOZ_ASSERT(LOCAL_GL_COLOR_ATTACHMENT0 + mMoreColorAttachments.Size() == lastCAEnum);
 
     const size_t offset = attachPoint - LOCAL_GL_COLOR_ATTACHMENT1;
-    MOZ_ASSERT(offset <= mMoreColorAttachments.size());
+    MOZ_ASSERT(offset <= mMoreColorAttachments.Size());
     return &mMoreColorAttachments[offset];
 }
 
 void
 WebGLFramebuffer::DetachTexture(const WebGLTexture* tex)
 {
     if (mColorAttachment0.Texture() == tex)
         mColorAttachment0.Clear();
@@ -655,17 +656,17 @@ WebGLFramebuffer::HasDefinedAttachments(
     }
 
     return hasAttachments;
 }
 
 bool
 WebGLFramebuffer::HasIncompleteAttachments() const
 {
-    const auto fnIsIncomplete = [](const auto& cur) {
+    const auto fnIsIncomplete = [](const WebGLFBAttachPoint& cur) {
         if (!cur.IsDefined())
             return false; // Not defined, so can't count as incomplete.
 
         return !cur.IsComplete();
     };
 
     bool hasIncomplete = false;
 
@@ -832,17 +833,17 @@ WebGLFramebuffer::CheckAndInitializeAtta
             hasUninitializedAttachments |= mDepthStencilAttachment.HasUninitializedImageData();
 
         if (!hasUninitializedAttachments)
             return true;
     }
 
     // Get buffer-bit-mask and color-attachment-mask-list
     uint32_t clearBits = 0;
-    std::vector<GLenum> tempDrawBuffers(1 + mMoreColorAttachments.size(), LOCAL_GL_NONE);
+    std::vector<GLenum> tempDrawBuffers(1 + mMoreColorAttachments.Size(), LOCAL_GL_NONE);
 
     if (mColorAttachment0.HasUninitializedImageData() && IsDrawBuffer(0)) {
         clearBits |= LOCAL_GL_COLOR_BUFFER_BIT;
         tempDrawBuffers[0] = LOCAL_GL_COLOR_ATTACHMENT0;
     }
 
     size_t i = 1;
     for (const auto& cur : mMoreColorAttachments) {
@@ -863,22 +864,22 @@ WebGLFramebuffer::CheckAndInitializeAtta
     if (mStencilAttachment.HasUninitializedImageData() ||
         mDepthStencilAttachment.HasUninitializedImageData())
     {
         clearBits |= LOCAL_GL_STENCIL_BUFFER_BIT;
     }
 
     mContext->MakeContextCurrent();
 
-    mContext->gl->fDrawBuffers(tempDrawBuffers.size(), tempDrawBuffers.data());
+    mContext->gl->fDrawBuffers(tempDrawBuffers.size(), &(tempDrawBuffers[0]));
 
     // Clear!
     mContext->ForceClearFramebufferWithDefaultValues(clearBits, false);
 
-    mContext->gl->fDrawBuffers(mDrawBuffers.size(), mDrawBuffers.data());
+    mContext->gl->fDrawBuffers(mDrawBuffers.size(), &(mDrawBuffers[0]));
 
     // Mark all the uninitialized images as initialized.
     if (mDepthAttachment.HasUninitializedImageData())
         mDepthAttachment.SetImageDataStatus(WebGLImageDataStatus::InitializedImageData);
     if (mStencilAttachment.HasUninitializedImageData())
         mStencilAttachment.SetImageDataStatus(WebGLImageDataStatus::InitializedImageData);
     if (mDepthStencilAttachment.HasUninitializedImageData())
         mDepthStencilAttachment.SetImageDataStatus(WebGLImageDataStatus::InitializedImageData);
@@ -942,17 +943,17 @@ WebGLFramebuffer::FinalizeAttachments() 
                                  LOCAL_GL_RENDERBUFFER, 0);
 
     // Call finalize.
     mColorAttachment0.FinalizeAttachment(gl, LOCAL_GL_COLOR_ATTACHMENT0);
     mDepthAttachment.FinalizeAttachment(gl, LOCAL_GL_DEPTH_ATTACHMENT);
     mStencilAttachment.FinalizeAttachment(gl, LOCAL_GL_STENCIL_ATTACHMENT);
     mDepthStencilAttachment.FinalizeAttachment(gl, LOCAL_GL_DEPTH_STENCIL_ATTACHMENT);
 
-    for (size_t i = 0; i < mMoreColorAttachments.size(); i++) {
+    for (size_t i = 0; i < mMoreColorAttachments.Size(); i++) {
         GLenum attachPoint = LOCAL_GL_COLOR_ATTACHMENT1 + i;
         mMoreColorAttachments[i].FinalizeAttachment(gl, attachPoint);
     }
 
     FinalizeDrawAndReadBuffers(gl, mColorAttachment0.IsDefined());
 }
 
 bool
@@ -1058,29 +1059,29 @@ ImplCycleCollectionTraverse(nsCycleColle
                             mozilla::WebGLFBAttachPoint& field,
                             const char* name,
                             uint32_t flags = 0)
 {
     CycleCollectionNoteChild(callback, field.Texture(), name, flags);
     CycleCollectionNoteChild(callback, field.Renderbuffer(), name, flags);
 }
 
-template<typename T>
+template<typename C>
 inline void
-ImplCycleCollectionUnlink(std::vector<T>& field)
+ImplCycleCollectionUnlink(C& field)
 {
     for (auto& cur : field) {
         cur.Unlink();
     }
 }
 
-template<typename T>
+template<typename C>
 inline void
 ImplCycleCollectionTraverse(nsCycleCollectionTraversalCallback& callback,
-                            std::vector<T>& field,
+                            C& field,
                             const char* name,
                             uint32_t flags = 0)
 {
     for (auto& cur : field) {
         ImplCycleCollectionTraverse(callback, cur, name, flags);
     }
 }
 

--- a/dom/canvas/WebGLFramebuffer.h
+++ b/dom/canvas/WebGLFramebuffer.h
@@ -16,32 +16,45 @@
 #include "WebGLTexture.h"
 
 namespace mozilla {
 
 class WebGLFramebuffer;
 class WebGLRenderbuffer;
 class WebGLTexture;
 
+template<typename T>
+class PlacementArray;
+
 namespace gl {
     class GLContext;
 } // namespace gl
 
 class WebGLFBAttachPoint
 {
 public:
     WebGLFramebuffer* const mFB;
     const GLenum mAttachmentPoint;
 private:
     WebGLRefPtr<WebGLTexture> mTexturePtr;
     WebGLRefPtr<WebGLRenderbuffer> mRenderbufferPtr;
     TexImageTarget mTexImageTarget;
     GLint mTexImageLayer;
     GLint mTexImageLevel;
 
+    // PlacementArray needs a default constructor.
+    template<typename T>
+    friend class PlacementArray;
+
+    WebGLFBAttachPoint()
+        : mFB(nullptr)
+        , mAttachmentPoint(0)
+    { }
+
+
 public:
     WebGLFBAttachPoint(WebGLFramebuffer* fb, GLenum attachmentPoint);
     ~WebGLFBAttachPoint();
 
     void Unlink();
 
     bool IsDefined() const;
     bool IsDeleteRequested() const;
@@ -93,16 +106,65 @@ public:
 
     JS::Value GetParameter(const char* funcName, WebGLContext* webgl, JSContext* cx,
                            GLenum target, GLenum attachment, GLenum pname,
                            ErrorResult* const out_error);
 
     void OnBackingStoreRespecified() const;
 };
 
+template<typename T>
+class PlacementArray
+{
+public:
+    const size_t mCapacity;
+protected:
+    size_t mSize;
+    T* const mArray;
+
+public:
+    PlacementArray(size_t capacity)
+        : mCapacity(capacity)
+        , mSize(0)
+        , mArray((T*)moz_xmalloc(sizeof(T) * capacity))
+    { }
+
+    ~PlacementArray() {
+        for (auto& cur : *this) {
+            cur.~T();
+        }
+        free(mArray);
+    }
+
+    T* begin() const {
+        return mArray;
+    }
+
+    T* end() const {
+        return mArray + mSize;
+    }
+
+    T& operator [](size_t offset) const {
+        MOZ_ASSERT(offset < mSize);
+        return mArray[offset];
+    }
+
+    const size_t& Size() const { return mSize; }
+
+    template<typename A, typename B>
+    void AppendNew(A a, B b) {
+        if (mSize == mCapacity)
+            MOZ_CRASH("Bad EmplaceAppend.");
+
+        // Placement `new`:
+        new (&(mArray[mSize])) T(a, b);
+        ++mSize;
+    }
+};
+
 class WebGLFramebuffer final
     : public nsWrapperCache
     , public WebGLRefCountedObject<WebGLFramebuffer>
     , public LinkedListElement<WebGLFramebuffer>
     , public WebGLContextBoundObject
     , public SupportsWeakPtr<WebGLFramebuffer>
 {
     friend class WebGLContext;
@@ -117,17 +179,18 @@ private:
 
     GLenum mReadBufferMode;
 
     // No need to chase pointers for the oft-used color0.
     WebGLFBAttachPoint mColorAttachment0;
     WebGLFBAttachPoint mDepthAttachment;
     WebGLFBAttachPoint mStencilAttachment;
     WebGLFBAttachPoint mDepthStencilAttachment;
-    std::vector<WebGLFBAttachPoint> mMoreColorAttachments;
+
+    PlacementArray<WebGLFBAttachPoint> mMoreColorAttachments;
 
     std::vector<GLenum> mDrawBuffers;
 
     bool IsDrawBuffer(size_t n) const {
         if (n < mDrawBuffers.size())
             return bool(mDrawBuffers[n]);
 
         return false;
@@ -173,17 +236,17 @@ public:
 
     bool HasDepthStencilConflict() const {
         return int(mDepthAttachment.IsDefined()) +
                int(mStencilAttachment.IsDefined()) +
                int(mDepthStencilAttachment.IsDefined()) >= 2;
     }
 
     const WebGLFBAttachPoint& ColorAttachment(size_t colorAttachmentId) const {
-        MOZ_ASSERT(colorAttachmentId < 1 + mMoreColorAttachments.size());
+        MOZ_ASSERT(colorAttachmentId < 1 + mMoreColorAttachments.Size());
         return colorAttachmentId ? mMoreColorAttachments[colorAttachmentId - 1]
                                  : mColorAttachment0;
     }
 
     const WebGLFBAttachPoint& DepthAttachment() const {
         return mDepthAttachment;
     }