Index: trunk/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp
===================================================================
--- trunk/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp	(revision 21147)
+++ trunk/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.cpp	(revision 21169)
@@ -196,4 +196,12 @@
 //-----------------------------------------------------------------------------
 
+struct DConAddrPlusPtr
+{
+  DConAddr addr;
+  void *p;
+};
+
+//-----------------------------------------------------------------------------
+
 ipcDConnectService *ipcDConnectService::mInstance = nsnull;
 
@@ -533,7 +541,7 @@
     case nsXPTType::T_INTERFACE_IS:
       {
-        reader.GetBytes(&v.val.p, sizeof(void *));
+        reader.GetBytes(&v.val.u64, sizeof(DConAddr));
         // stub creation will be handled outside this routine.  we only
-        // deserialize the DConAddr into v.val.p temporarily.
+        // deserialize the DConAddr into v.val.u64 temporarily.
       }
       break;
@@ -768,8 +776,10 @@
       {
         // stub creation will be handled outside this routine.  we only
-        // deserialize the DConAddr into v.val.p temporarily.
-        void *ptr;
-        reader.GetBytes(&ptr, sizeof(void *));
-        *((void **) v.val.p) = ptr;
+        // deserialize the DConAddr and the original value of v.val.p
+        // into v.val.p temporarily.  needs temporary memory alloc.
+        DConAddrPlusPtr *buf = (DConAddrPlusPtr *) nsMemory::Alloc(sizeof(DConAddrPlusPtr));
+        reader.GetBytes(&buf->addr, sizeof(DConAddr));
+        buf->p = v.val.p;
+        v.val.p = buf;
       }
       break;
@@ -939,6 +949,4 @@
     case nsXPTType::T_CHAR_STR:       /* fall through */
     case nsXPTType::T_WCHAR_STR:      /* fall through */
-    case nsXPTType::T_INTERFACE:      /* fall through */
-    case nsXPTType::T_INTERFACE_IS:   /* fall through */
     case nsXPTType::T_ASTRING:        /* fall through */
     case nsXPTType::T_DOMSTRING:      /* fall through */
@@ -946,4 +954,9 @@
     case nsXPTType::T_CSTRING:        /* fall through */
       size = sizeof(void *);
+      isSimple = PR_FALSE;
+      break;
+    case nsXPTType::T_INTERFACE:      /* fall through */
+    case nsXPTType::T_INTERFACE_IS:   /* fall through */
+      size = sizeof(DConAddr);
       isSimple = PR_FALSE;
       break;
@@ -1097,5 +1110,5 @@
     {
       // grab the DConAddr value temporarily stored in the param
-      PtrBits bits = (PtrBits) v.val.p;
+      PtrBits bits = v.val.u64;
 
       // DeserializeInterfaceParamBits needs IID only if it's a remote object
@@ -1525,5 +1538,6 @@
   {
     // write null address
-    writer.PutBytes(&obj, sizeof(obj));
+    DConAddr nullobj = 0;
+    writer.PutBytes(&nullobj, sizeof(nullobj));
   }
   else
@@ -1582,5 +1596,5 @@
       // send address of the instance wrapper, and set the low bit to indicate
       // to the remote party that this is a remote instance wrapper.
-      PtrBits bits = ((PtrBits) wrapper) | PTRBITS_REMOTE_BIT;
+      PtrBits bits = ((PtrBits)(uintptr_t) wrapper) | PTRBITS_REMOTE_BIT;
       writer.PutBytes(&bits, sizeof(bits));
     }
@@ -1900,5 +1914,5 @@
         // send address of the instance wrapper, and set the low bit to indicate
         // to the remote party that this is a remote instance wrapper.
-        PtrBits bits = ((PtrBits) wrapper) | PTRBITS_REMOTE_BIT;
+        PtrBits bits = ((PtrBits)(uintptr_t) wrapper) | PTRBITS_REMOTE_BIT;
         writer.PutBytes(&bits, sizeof(bits));
 
@@ -1987,10 +2001,8 @@
   PRUint32 len;
 
-  void *instance = 0;
-  reader.GetBytes(&instance, sizeof(void *));
+  PtrBits bits = 0;
+  reader.GetBytes(&bits, sizeof(DConAddr));
   if (reader.HasError())
     return NS_ERROR_INVALID_ARG;
-
-  PtrBits bits = (PtrBits) (instance);
 
   if (bits & PTRBITS_REMOTE_BIT)
@@ -2514,11 +2526,13 @@
       if (aParams[i].val.p && (paramInfo.IsOut() || paramInfo.IsRetval()))
       {
-        void **pptr = (void **) aParams[i].val.p;
         const nsXPTType &type = paramInfo.GetType();
         if (type.IsInterfacePointer())
         {
-          // grab the DConAddr value temporarily stored in the param
-          PtrBits bits = (PtrBits) *pptr;
-          *pptr = nsnull;
+          // grab the DConAddr value temporarily stored in the param, restore
+          // the pointer and free the temporarily allocated memory.
+          DConAddrPlusPtr *dptr = (DConAddrPlusPtr *)aParams[i].val.p;
+          PtrBits bits = dptr->addr;
+          aParams[i].val.p = dptr->p;
+          nsMemory::Free((void *)dptr);
 
           // DeserializeInterfaceParamBits needs IID only if it's a remote object
@@ -2533,5 +2547,5 @@
             rv = dConnect->DeserializeInterfaceParamBits(bits, mPeerID, iid, obj);
             if (NS_SUCCEEDED(rv))
-              *pptr = obj;
+              *(void **)aParams[i].val.p = obj;
           }
         }
@@ -2543,5 +2557,5 @@
                                      paramInfo, PR_TRUE, array);
           if (NS_SUCCEEDED(rv))
-            *pptr = array;
+            *(void **)aParams[i].val.p = array;
         }
       }
@@ -3589,5 +3603,5 @@
   msg.flags = 0;
   msg.request_index = setup->request_index;
-  msg.instance = (DConAddr)wrapper;
+  msg.instance = (DConAddr)(uintptr_t)wrapper;
   msg.status = rv;
 
@@ -3732,5 +3746,5 @@
       {
         // grab the DConAddr value temporarily stored in the param
-        PtrBits bits = (PtrBits) params[i].val.p;
+        PtrBits bits = (PtrBits)(uintptr_t) params[i].val.p;
 
         // DeserializeInterfaceParamBits needs IID only if it's a remote object
Index: trunk/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.h
===================================================================
--- trunk/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.h	(revision 21147)
+++ trunk/src/libs/xpcom18a4/ipc/ipcd/extensions/dconnect/src/ipcDConnectService.h	(revision 21169)
@@ -188,5 +188,5 @@
 // used elsewhere like nsAtomTable to safely represent the integral value
 // of an address.
-typedef unsigned long PtrBits;
+typedef PRUint64 PtrBits;
 
 // bit flag that defines if a PtrBits value represents a remote object
