Do something remotely reasonable where designMode documents are concerned. Some fixes for evalInSandbox problems in recent nightlies.

common/modules/base.jsm

@@ -485,8 +485,11 @@ function isObject(obj) typeof obj === "object" && obj != null;
  * any window, frame, namespace, or execution context, which
  * is not the case when using (obj instanceof Array).
  */
-const isArray = Array.isArray ||
-    function isArray(val) objproto.toString.call(val) == "[object Array]";
+const isArray =
+    Array.isArray
+        // This is bloody stupid.
+        ? function isArray(val) Array.isArray(val) || val && val.constructor && val.constructor.name === "Array"
+        : function isArray(val) objproto.toString.call(val) == "[object Array]";
 
 /**
  * Returns true if and only if its sole argument is an

common/modules/util.jsm

@@ -262,7 +262,7 @@ const Util = Module("Util", XPCOM([Ci.nsIObserver, Ci.nsISupportsWeakReference])
     dequote: function dequote(pattern, chars)
         pattern.replace(/\\(.)/, function (m0, m1) chars.indexOf(m1) >= 0 ? m1 : m0),
 
-    domToString: function (node) {
+    domToString: function (node, html) {
         if (node instanceof Ci.nsISelection && node.isCollapsed)
             return "";
 
@@ -282,6 +282,8 @@ const Util = Module("Util", XPCOM([Ci.nsIObserver, Ci.nsISupportsWeakReference])
 
         let str = services.create("string");
         str.data = encoder.encodeToString();
+        if (html)
+            return str.data;
 
         let [result, length] = [{}, {}];
         services.create("htmlConverter").convert("text/html", str, str.data.length*2, "text/unicode", result, length);