--- a/image/RasterImage.h
+++ b/image/RasterImage.h
@@ -449,9 +449,18 @@ protected:
 inline NS_IMETHODIMP
 RasterImage::GetAnimationMode(uint16_t* aAnimationMode) {
   return GetAnimationModeInternal(aAnimationMode);
 }
 
 } // namespace image
 } // namespace mozilla
 
+/**
+ * Casting RasterImage to nsISupports is ambiguous. This method handles that.
+ */
+inline nsISupports*
+ToSupports(mozilla::image::RasterImage* p)
+{
+  return NS_ISUPPORTS_CAST(mozilla::image::ImageResource*, p);
+}
+
 #endif /* mozilla_image_RasterImage_h */

--- a/netwerk/protocol/websocket/WebSocketEventService.h
+++ b/netwerk/protocol/websocket/WebSocketEventService.h
@@ -106,9 +106,19 @@ private:
   nsClassHashtable<nsUint64HashKey, WindowListener> mWindows;
 
   Atomic<uint64_t> mCountListeners;
 };
 
 } // net namespace
 } // mozilla namespace
 
+/**
+ * Casting WebSocketEventService to nsISupports is ambiguous.
+ * This method handles that.
+ */
+inline nsISupports*
+ToSupports(mozilla::net::WebSocketEventService* p)
+{
+  return NS_ISUPPORTS_CAST(nsIWebSocketEventService*, p);
+}
+
 #endif // mozilla_net_WebSocketEventService_h

--- a/netwerk/protocol/wyciwyg/nsWyciwygChannel.h
+++ b/netwerk/protocol/wyciwyg/nsWyciwygChannel.h
@@ -105,9 +105,19 @@ protected:
     nsCOMPtr<nsICacheEntry>             mCacheEntry;
     nsCOMPtr<nsIOutputStream>           mCacheOutputStream;
     nsCOMPtr<nsIInputStream>            mCacheInputStream;
     nsCOMPtr<nsIEventTarget>            mCacheIOTarget;
 
     nsCOMPtr<nsISupports>               mSecurityInfo;
 };
 
+/**
+ * Casting nsWyciwygChannel to nsISupports is ambiguous.
+ * This method handles that.
+ */
+inline nsISupports*
+ToSupports(nsWyciwygChannel* p)
+{
+  return NS_ISUPPORTS_CAST(nsIStreamListener*, p);
+}
+
 #endif /* nsWyciwygChannel_h___ */

--- a/storage/mozStorageConnection.h
+++ b/storage/mozStorageConnection.h
@@ -406,9 +406,20 @@ private:
   // nsCOMP<T> would cause an off-main thread QI, which
   // is not a good idea (and crashes XPConnect).
   RefPtr<mozIStorageCompletionCallback> mCallback;
 };
 
 } // namespace storage
 } // namespace mozilla
 
+
+/**
+ * Casting Connection to nsISupports is ambiguous.
+ * This method handles that.
+ */
+inline nsISupports*
+ToSupports(mozilla::storage::Connection* p)
+{
+  return NS_ISUPPORTS_CAST(mozIStorageConnection*, p);
+}
+
 #endif // mozilla_storage_Connection_h

new file mode 100644
--- /dev/null
+++ b/xpcom/glue/nsProxyRelease.cpp
@@ -0,0 +1,56 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsProxyRelease.h"
+#include "nsThreadUtils.h"
+
+
+class nsProxyReleaseEvent : public nsRunnable
+{
+public:
+  explicit nsProxyReleaseEvent(already_AddRefed<nsISupports> aDoomed)
+  : mDoomed(aDoomed.take()) {}
+
+  NS_IMETHOD Run()
+  {
+    NS_IF_RELEASE(mDoomed);
+    return NS_OK;
+  }
+
+private:
+  nsISupports* MOZ_OWNING_REF mDoomed;
+};
+
+
+void
+mozilla::detail::NS_ProxyRelease(nsIEventTarget* aTarget, nsISupports* aDoomed,
+                bool aAlwaysProxy)
+{
+  // Auto-managing release of the pointer.
+  RefPtr<nsISupports> doomed = aDoomed;
+  nsresult rv;
+
+  if (!doomed || !aTarget) {
+    return;
+  }
+
+  if (!aAlwaysProxy) {
+    bool onCurrentThread = false;
+    rv = aTarget->IsOnCurrentThread(&onCurrentThread);
+    if (NS_SUCCEEDED(rv) && onCurrentThread) {
+      return;
+    }
+  }
+
+  nsCOMPtr<nsIRunnable> ev = new nsProxyReleaseEvent(doomed.forget());
+
+  rv = aTarget->Dispatch(ev, NS_DISPATCH_NORMAL);
+  if (NS_FAILED(rv)) {
+    NS_WARNING("failed to post proxy release event, leaking!");
+    // It is better to leak the aDoomed object than risk crashing as
+    // a result of deleting it on the wrong thread.
+  }
+}

--- a/xpcom/glue/nsProxyRelease.h
+++ b/xpcom/glue/nsProxyRelease.h
@@ -7,41 +7,36 @@
 #ifndef nsProxyRelease_h__
 #define nsProxyRelease_h__
 
 #include "nsIEventTarget.h"
 #include "nsIThread.h"
 #include "nsCOMPtr.h"
 #include "nsAutoPtr.h"
 #include "MainThreadUtils.h"
-#include "nsThreadUtils.h"
 #include "mozilla/Likely.h"
 #include "mozilla/Move.h"
 
 #ifdef XPCOM_GLUE_AVOID_NSPR
 #error NS_ProxyRelease implementation depends on NSPR.
 #endif
 
 
-template<class T>
-class nsProxyReleaseEvent : public nsRunnable
-{
-public:
-  explicit nsProxyReleaseEvent(already_AddRefed<T> aDoomed)
-  : mDoomed(aDoomed.take()) {}
+namespace mozilla {
+namespace detail {
 
-  NS_IMETHOD Run()
-  {
-    NS_IF_RELEASE(mDoomed);
-    return NS_OK;
-  }
+/**
+ * Never use this method directly. Use NS_ProxyRelease instead.
+ */
+void
+NS_ProxyRelease(nsIEventTarget* aTarget, nsISupports* aDoomed,
+                bool aAlwaysProxy);
 
-private:
-  T* MOZ_OWNING_REF mDoomed;
-};
+}
+}
 
 /**
  * Ensures that the delete of a smart pointer occurs on the target thread.
  *
  * @param aTarget
  *        the target thread where the doomed object should be released.
  * @param aDoomed
  *        the doomed object; the object to be released on the target thread.
@@ -51,40 +46,18 @@ private:
  *        true, then an event will always be posted to the target thread for
  *        asynchronous release.
  */
 template<class T>
 inline NS_HIDDEN_(void)
 NS_ProxyRelease(nsIEventTarget* aTarget, already_AddRefed<T> aDoomed,
                 bool aAlwaysProxy = false)
 {
-  // Auto-managing release of the pointer.
-  RefPtr<T> doomed = aDoomed;
-  nsresult rv;
-
-  if (!doomed || !aTarget) {
-    return;
-  }
-
-  if (!aAlwaysProxy) {
-    bool onCurrentThread = false;
-    rv = aTarget->IsOnCurrentThread(&onCurrentThread);
-    if (NS_SUCCEEDED(rv) && onCurrentThread) {
-      return;
-    }
-  }
-
-  nsCOMPtr<nsIRunnable> ev = new nsProxyReleaseEvent<T>(doomed.forget());
-
-  rv = aTarget->Dispatch(ev, NS_DISPATCH_NORMAL);
-  if (NS_FAILED(rv)) {
-    NS_WARNING("failed to post proxy release event, leaking!");
-    // It is better to leak the aDoomed object than risk crashing as
-    // a result of deleting it on the wrong thread.
-  }
+  mozilla::detail::NS_ProxyRelease(
+      aTarget, ToSupports(aDoomed.take()), aAlwaysProxy);
 }
 
 /**
  * Ensures that the delete of a smart pointer occurs on the main thread.
  *
  * @param aDoomed
  *        the doomed object; the object to be released on the main thread.
  * @param aAlwaysProxy

--- a/xpcom/glue/objs.mozbuild
+++ b/xpcom/glue/objs.mozbuild
@@ -34,14 +34,15 @@ xpcom_glue_src_lcppsrcs = [
 
 xpcom_glue_src_cppsrcs = [
     '/xpcom/glue/%s' % s for s in xpcom_glue_src_lcppsrcs
 ]
 
 xpcom_gluens_src_lcppsrcs = [
     'BlockingResourceBase.cpp',
     'GenericFactory.cpp',
+    'nsProxyRelease.cpp',
     'nsTextFormatter.cpp',
 ]
 
 xpcom_gluens_src_cppsrcs = [
     '/xpcom/glue/%s' % s for s in xpcom_gluens_src_lcppsrcs
 ]

--- a/xpcom/libxpcomrt/moz.build
+++ b/xpcom/libxpcomrt/moz.build
@@ -56,16 +56,17 @@ xpcom_glue_src = [
     'nsCOMPtr.cpp',
     'nsCRTGlue.cpp',
     'nsComponentManagerUtils.cpp',
     'nsEnumeratorUtils.cpp',
     'GenericFactory.cpp',
     'nsID.cpp',
     'nsISupportsImpl.cpp',
     'nsMemory.cpp',
+    'nsProxyRelease.cpp',
     'nsQuickSort.cpp',
     'nsTArray.cpp',
     'nsTObserverArray.cpp',
     'nsThreadUtils.cpp',
     'nsWeakReference.cpp',
     'PLDHashTable.cpp',
 ]
 src_list += [