Merge m-i to m-c

2024-09-13 09:24:08 -07:00 · 2013-06-29 06:54:12 -07:00 · 2013-06-29 06:54:12 -07:00 · 0d1e3423a9
commit 0d1e3423a9
parent aff009ccd0 92695d22a2
458 changed files with 5483 additions and 5358 deletions
--- a/Makefile.in
+++ b/Makefile.in
@ -38,15 +38,29 @@ DIST_GARBAGE = config.cache config.log config.status* config-defs.h \
   $(topsrcdir)/.mozconfig.mk $(topsrcdir)/.mozconfig.out

 ifndef MOZ_PROFILE_USE
+# One of the first things we do in the build is purge "unknown" files
+# from the object directory. This serves two purposes:
+#
+#   1) Remove files from a previous build no longer accounted for in
+#      this build configuration.
+#
+#   2) Work around poor build system dependencies by forcing some
+#      rebuilds.
+#
+# Ideally #2 does not exist. Our reliance on this aspect should diminish
+# over time.
+#
+# moz.build backend generation simply installs a set of "manifests" into
+# a common directory. Each manifest is responsible for defining files in
+# a specific subdirectory of the object directory. The invoked Python
+# script simply iterates over all the manifests, purging files as
+# necessary. To manage new directories or add files to the manifests,
+# modify the backend generator.
+#
 # We need to explicitly put backend.RecursiveMakeBackend.built here
 # otherwise the rule in rules.mk doesn't run early enough.
 default alldep all:: CLOBBER $(topsrcdir)/configure config.status backend.RecursiveMakeBackend.built
-	$(RM) -r $(DIST)/sdk
-	$(RM) -r $(DIST)/include
-	$(RM) -r $(DIST)/private
-	$(RM) -r $(DIST)/public
-	$(RM) -r $(DIST)/bin
-	$(RM) -r _tests
+	$(PYTHON) $(topsrcdir)/config/purge_directories.py -d _build_manifests/purge .
 endif

 CLOBBER: $(topsrcdir)/CLOBBER
--- a/accessible/src/atk/AccessibleWrap.cpp
+++ b/accessible/src/atk/AccessibleWrap.cpp
@ -680,8 +680,7 @@ getRoleCB(AtkObject *aAtkObj)
  switch (accWrap->Role()) {
 #include "RoleMap.h"
    default:
-      MOZ_NOT_REACHED("Unknown role.");
-      aAtkObj->role = ATK_ROLE_UNKNOWN;
+      MOZ_CRASH("Unknown role.");
  };

 #undef ROLE
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@ -197,7 +197,7 @@ nsCoreUtils::GetDOMElementFor(nsIContent *aContent)
    return aContent;

  if (aContent->IsNodeOfType(nsINode::eTEXT))
-    return aContent->GetParent();
+    return aContent->GetFlattenedTreeParent();

  return nullptr;
 }
@ -540,7 +540,7 @@ nsCoreUtils::GetTreeBoxObject(nsIContent *aContent)
          return treeBox.forget();
      }
    }
-    currentContent = currentContent->GetParent();
+    currentContent = currentContent->GetFlattenedTreeParent();
  }

  return nullptr;
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@ -136,7 +136,7 @@ nsTextEquivUtils::AppendTextEquivFromTextContent(nsIContent *aContent,
  if (aContent->IsNodeOfType(nsINode::eTEXT)) {
    bool isHTMLBlock = false;

-    nsIContent *parentContent = aContent->GetParent();
+    nsIContent *parentContent = aContent->GetFlattenedTreeParent();
    if (parentContent) {
      nsIFrame *frame = parentContent->GetPrimaryFrame();
      if (frame) {
@ -394,7 +394,7 @@ nsTextEquivUtils::GetRoleRule(role aRole)
  switch (aRole) {
 #include "RoleMap.h"
    default:
-      MOZ_NOT_REACHED("Unknown role.");
+      MOZ_CRASH("Unknown role.");
  }

 #undef ROLE
--- a/accessible/src/generic/DocAccessible.cpp
+++ b/accessible/src/generic/DocAccessible.cpp
@ -1377,8 +1377,9 @@ DocAccessible::RecreateAccessible(nsIContent* aContent)
  // coalescence with normal hide and show events. Note, in this case they
  // should be coalesced with normal show/hide events.

-  ContentRemoved(aContent->GetParent(), aContent);
-  ContentInserted(aContent->GetParent(), aContent, aContent->GetNextSibling());
+  nsIContent* parent = aContent->GetFlattenedTreeParent();
+  ContentRemoved(parent, aContent);
+  ContentInserted(parent, aContent, aContent->GetNextSibling());
 }

 void
--- a/accessible/src/html/HTMLTableAccessible.cpp
+++ b/accessible/src/html/HTMLTableAccessible.cpp
@ -314,6 +314,7 @@ HTMLTableHeaderCellAccessible::NativeRole()

  // Assume it's columnheader if there are headers in siblings, otherwise
  // rowheader.
+  // This should iterate the flattened tree
  nsIContent* parentContent = mContent->GetParent();
  if (!parentContent) {
    NS_ERROR("Deattached content on alive accessible?");
--- a/accessible/src/windows/msaa/AccessibleWrap.cpp
+++ b/accessible/src/windows/msaa/AccessibleWrap.cpp
@ -378,7 +378,7 @@ AccessibleWrap::get_accRole(
  switch (geckoRole) {
 #include "RoleMap.h"
    default:
-      MOZ_NOT_REACHED("Unknown role.");
+      MOZ_CRASH("Unknown role.");
  };

 #undef ROLE
@ -1181,7 +1181,7 @@ AccessibleWrap::role(long *aRole)
  switch (geckoRole) {
 #include "RoleMap.h"
    default:
-      MOZ_NOT_REACHED("Unknown role.");
+      MOZ_CRASH("Unknown role.");
  };

 #undef ROLE
--- a/accessible/src/xul/XULElementAccessibles.cpp
+++ b/accessible/src/xul/XULElementAccessibles.cpp
@ -95,7 +95,7 @@ XULLabelAccessible::RelationByType(uint32_t aType)
  Relation rel = HyperTextAccessibleWrap::RelationByType(aType);
  if (aType == nsIAccessibleRelation::RELATION_LABEL_FOR) {
    // Caption is the label for groupbox
-    nsIContent *parent = mContent->GetParent();
+    nsIContent* parent = mContent->GetFlattenedTreeParent();
    if (parent && parent->Tag() == nsGkAtoms::caption) {
      Accessible* parent = Parent();
      if (parent && parent->Role() == roles::GROUPING)
--- a/accessible/src/xul/XULFormControlAccessible.cpp
+++ b/accessible/src/xul/XULFormControlAccessible.cpp
@ -244,7 +244,7 @@ XULDropmarkerAccessible::DropmarkerOpen(bool aToggleOpen)
  bool isOpen = false;

  nsCOMPtr<nsIDOMXULButtonElement> parentButtonElement =
-    do_QueryInterface(mContent->GetParent());
+    do_QueryInterface(mContent->GetFlattenedTreeParent());

  if (parentButtonElement) {
    parentButtonElement->GetOpen(&isOpen);
--- a/accessible/src/xul/XULListboxAccessible.cpp
+++ b/accessible/src/xul/XULListboxAccessible.cpp
@ -103,7 +103,7 @@ XULListboxAccessible::
  XULListboxAccessible(nsIContent* aContent, DocAccessible* aDoc) :
  XULSelectControlAccessible(aContent, aDoc), xpcAccessibleTable(this)
 {
-  nsIContent* parentContent = mContent->GetParent();
+  nsIContent* parentContent = mContent->GetFlattenedTreeParent();
  if (parentContent) {
    nsCOMPtr<nsIAutoCompletePopup> autoCompletePopupElm =
      do_QueryInterface(parentContent);
--- a/accessible/src/xul/XULMenuAccessible.cpp
+++ b/accessible/src/xul/XULMenuAccessible.cpp
@ -439,7 +439,7 @@ XULMenupopupAccessible::
    mType = eMenuPopupType;

  // May be the anonymous <menupopup> inside <menulist> (a combobox)
-  mSelectControl = do_QueryInterface(mContent->GetParent());
+  mSelectControl = do_QueryInterface(mContent->GetFlattenedTreeParent());
  if (!mSelectControl)
    mGenericTypes &= ~eSelect;
 }
@ -477,7 +477,7 @@ XULMenupopupAccessible::NativeName(nsString& aName)
  nsIContent* content = mContent;
  while (content && aName.IsEmpty()) {
    content->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
-    content = content->GetParent();
+    content = content->GetFlattenedTreeParent();
  }

  return eNameOK;
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@ -386,6 +386,11 @@ window[chromehidden~="toolbar"] toolbar:not(.toolbar-primary):not(.chromeclass-m
 }

 /* Identity UI */
+#identity-popup-content-box:not(.chromeUI) > #identity-popup-brandName,
+#identity-popup-content-box:not(.chromeUI) > #identity-popup-chromeLabel,
+#identity-popup-content-box.chromeUI > .identity-popup-label:not(#identity-popup-brandName):not(#identity-popup-chromeLabel),
+#identity-popup-content-box.chromeUI > .identity-popup-description,
+#identity-popup-content-box.chromeUI > #identity-popup-button-container,
 #identity-popup-content-box.unknownIdentity > #identity-popup-connectedToLabel ,
 #identity-popup-content-box.unknownIdentity > #identity-popup-runByLabel ,
 #identity-popup-content-box.unknownIdentity > #identity-popup-content-host ,
@ -662,6 +667,12 @@ chatbar {
  max-height: 0;
 }

+/** See bug 872317 for why the following rule is necessary. */
+
+#downloads-indicator {
+  -moz-binding: url("chrome://browser/content/downloads/download.xml#download-toolbarbutton");
+}
+
 /* full screen chat window support */
 chatbar:-moz-full-screen-ancestor,
 chatbox:-moz-full-screen-ancestor  {
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@ -143,6 +143,7 @@ let gInitialPages = [
  "about:newtab",
  "about:home",
  "about:privatebrowsing",
+  "about:welcomeback",
  "about:sessionrestore"
 ];

@ -6403,6 +6404,11 @@ var gIdentityHandler = {
    return this._identityPopupContentBox =
      document.getElementById("identity-popup-content-box");
  },
+  get _identityPopupChromeLabel () {
+    delete this._identityPopupChromeLabel;
+    return this._identityPopupChromeLabel =
+      document.getElementById("identity-popup-chromeLabel");
+  },
  get _identityPopupContentHost () {
    delete this._identityPopupContentHost;
    return this._identityPopupContentHost =
@ -6673,6 +6679,8 @@ var gIdentityHandler = {
                        "rtl" : "ltr";
      break; }
    case this.IDENTITY_MODE_CHROMEUI:
+      let brandBundle = document.getElementById("bundle_brand");
+      icon_label = brandBundle.getString("brandShortName");
      break;
    default:
      tooltip = gNavigatorBundle.getString("identity.unknown.tooltip");
@ -6734,6 +6742,12 @@ var gIdentityHandler = {
      else if (iData.country) // Country only
        supplemental += iData.country;
      break; }
+    case this.IDENTITY_MODE_CHROMEUI: {
+      let brandBundle = document.getElementById("bundle_brand");
+      let brandShortName = brandBundle.getString("brandShortName");
+      this._identityPopupChromeLabel.textContent = gNavigatorBundle.getFormattedString("identity.chrome",
+                                                                                       [brandShortName]);
+      break; }
    }

    // Push the appropriate strings out to the UI
@ -6761,10 +6775,8 @@ var gIdentityHandler = {
      return; // Left click, space or enter only
    }

-    // Don't allow left click, space or enter if the location
-    // is chrome UI or the location has been modified.
-    if (this._mode == this.IDENTITY_MODE_CHROMEUI ||
-        gURLBar.getAttribute("pageproxystate") != "valid") {
+    // Don't allow left click, space or enter if the location has been modified.
+    if (gURLBar.getAttribute("pageproxystate") != "valid") {
      TelemetryStopwatch.cancel("FX_IDENTITY_POPUP_OPEN_MS");
      return;
    }
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@ -298,6 +298,11 @@
      <hbox id="identity-popup-container" align="top">
        <image id="identity-popup-icon"/>
        <vbox id="identity-popup-content-box">
+          <label id="identity-popup-brandName"
+                 class="identity-popup-label"
+                 value="&brandFullName;"/>
+          <label id="identity-popup-chromeLabel"
+                 class="identity-popup-label"/>
          <label id="identity-popup-connectedToLabel"
                 class="identity-popup-label"
                 value="&identity.connectedTo;"/>
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@ -678,8 +678,13 @@ nsContextMenu.prototype = {

    // See if the user clicked in a frame.
    var docDefaultView = this.target.ownerDocument.defaultView;
-    if (docDefaultView != docDefaultView.top)
-      this.inFrame = true;
+    if (docDefaultView != docDefaultView.top) {
+      // srcdoc iframes are not considered frames for concerns about web
+      // content with about:srcdoc in location bar masqurading as trusted
+      // chrome/addon content.
+      if (!this.target.ownerDocument.isSrcdocDocument)
+        this.inFrame = true;
+    }

    // if the document is editable, show context menu like in text inputs
    if (!this.onEditableArea) {
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@ -1702,7 +1702,7 @@
              break;

            case Ci.nsIBlocklistService.STATE_VULNERABLE_UPDATE_AVAILABLE:
-              label = "pluginActivateOutdated.label";
+              label = "pluginActivateOutdated.message";
              linkLabel = "pluginActivate.updateLabel";
              button1.default = true;
              break;
--- a/browser/branding/aurora/content/identity-icons-brand.png
+++ b/browser/branding/aurora/content/identity-icons-brand.png
--- a/browser/branding/aurora/content/identity-icons-brand@2x.png
+++ b/browser/branding/aurora/content/identity-icons-brand@2x.png
--- a/browser/branding/aurora/content/jar.mn
+++ b/browser/branding/aurora/content/jar.mn
@ -13,4 +13,7 @@ browser.jar:
  content/branding/icon64.png                    (icon64.png)
  content/branding/icon16.png                    (../default16.png)
  content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
  content/branding/aboutDialog.css               (aboutDialog.css)
--- a/browser/branding/nightly/content/identity-icons-brand.png
+++ b/browser/branding/nightly/content/identity-icons-brand.png
--- a/browser/branding/nightly/content/identity-icons-brand@2x.png
+++ b/browser/branding/nightly/content/identity-icons-brand@2x.png
--- a/browser/branding/nightly/content/jar.mn
+++ b/browser/branding/nightly/content/jar.mn
@ -13,4 +13,7 @@ browser.jar:
  content/branding/icon64.png                    (icon64.png)
  content/branding/icon16.png                    (../default16.png)
  content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
  content/branding/aboutDialog.css               (aboutDialog.css)
--- a/browser/branding/official/content/identity-icons-brand.png
+++ b/browser/branding/official/content/identity-icons-brand.png
--- a/browser/branding/official/content/identity-icons-brand@2x.png
+++ b/browser/branding/official/content/identity-icons-brand@2x.png
--- a/browser/branding/official/content/jar.mn
+++ b/browser/branding/official/content/jar.mn
@ -12,4 +12,7 @@ browser.jar:
  content/branding/icon64.png                    (icon64.png)
  content/branding/icon16.png                    (../default16.png)
  content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
  content/branding/aboutDialog.css               (aboutDialog.css)
--- a/browser/branding/unofficial/content/identity-icons-brand.png
+++ b/browser/branding/unofficial/content/identity-icons-brand.png
--- a/browser/branding/unofficial/content/identity-icons-brand@2x.png
+++ b/browser/branding/unofficial/content/identity-icons-brand@2x.png
--- a/browser/branding/unofficial/content/jar.mn
+++ b/browser/branding/unofficial/content/jar.mn
@ -13,4 +13,7 @@ browser.jar:
  content/branding/icon64.png                    (icon64.png)
  content/branding/icon16.png                    (../default16.png)
  content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
  content/branding/aboutDialog.css               (aboutDialog.css)
--- a/browser/components/about/AboutRedirector.cpp
+++ b/browser/components/about/AboutRedirector.cpp
@ -63,6 +63,8 @@ static RedirEntry kRedirMap[] = {
    nsIAboutModule::ALLOW_SCRIPT },
  { "sessionrestore", "chrome://browser/content/aboutSessionRestore.xhtml",
    nsIAboutModule::ALLOW_SCRIPT },
+  { "welcomeback", "chrome://browser/content/aboutWelcomeBack.xhtml",
+    nsIAboutModule::ALLOW_SCRIPT },
 #ifdef MOZ_SERVICES_SYNC
  { "sync-progress", "chrome://browser/content/sync/progress.xhtml",
    nsIAboutModule::ALLOW_SCRIPT },
--- a/browser/components/build/nsModule.cpp
+++ b/browser/components/build/nsModule.cpp
@ -95,6 +95,7 @@ static const mozilla::Module::ContractIDEntry kBrowserContracts[] = {
    { NS_ABOUT_MODULE_CONTRACTID_PREFIX "rights", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
    { NS_ABOUT_MODULE_CONTRACTID_PREFIX "robots", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
    { NS_ABOUT_MODULE_CONTRACTID_PREFIX "sessionrestore", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
+    { NS_ABOUT_MODULE_CONTRACTID_PREFIX "welcomeback", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
 #ifdef MOZ_SERVICES_SYNC
    { NS_ABOUT_MODULE_CONTRACTID_PREFIX "sync-tabs", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
    { NS_ABOUT_MODULE_CONTRACTID_PREFIX "sync-progress", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
--- a/browser/components/downloads/content/download.xml
+++ b/browser/components/downloads/content/download.xml
@ -106,4 +106,11 @@

    </content>
  </binding>
+
+  <binding id="download-toolbarbutton"
+           extends="chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton">
+    <content>
+      <children />
+    </content>
+  </binding>
 </bindings>
--- a/browser/components/migration/content/aboutWelcomeBack.xhtml
+++ b/browser/components/migration/content/aboutWelcomeBack.xhtml
@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<!DOCTYPE html [
+  <!ENTITY % htmlDTD PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
+  %htmlDTD;
+  <!ENTITY % netErrorDTD SYSTEM "chrome://global/locale/netError.dtd">
+  %netErrorDTD;
+  <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd">
+  %globalDTD;
+  <!ENTITY % restorepageDTD SYSTEM "chrome://browser/locale/aboutSessionRestore.dtd">
+  %restorepageDTD;
+]>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>&restorepage.tabtitle;</title>
+    <link rel="stylesheet" href="chrome://global/skin/netError.css" type="text/css" media="all"/>
+    <link rel="stylesheet" href="chrome://browser/skin/aboutSessionRestore.css" type="text/css" media="all"/>
+    <link rel="stylesheet" href="chrome://browser/skin/aboutWelcomeBack.css" type="text/css" media="all"/>
+    <link rel="icon" type="image/png" href="chrome://global/skin/icons/information-16.png"/>
+
+    <script type="application/javascript;version=1.8" src="chrome://browser/content/aboutSessionRestore.js"/>
+  </head>
+
+  <body dir="&locale.dir;">
+
+    <!-- PAGE CONTAINER (for styling purposes only) -->
+    <div id="errorPageContainer">
+
+      <!-- Error Title -->
+      <div id="errorTitle">
+        <h1 id="errorTitleText">&welcomeback.pageTitle;</h1>
+      </div>
+
+      <!-- LONG CONTENT (the section most likely to require scrolling) -->
+      <div id="errorLongContent">
+
+        <!-- Short Description -->
+        <div id="errorShortDesc">
+          <p id="errorShortDescText">&welcomeback.pageInfo;</p>
+        </div>
+
+        <!-- Long Description (Note: See netError.dtd for used XHTML tags) -->
+        <div id="errorLongDesc">
+        </div>
+
+        <!-- Short Description -->
+        <div id="errorTrailerDesc">
+          <tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+                id="tabList" flex="1" seltype="single" hidecolumnpicker="true"
+                onclick="onListClick(event);" onkeydown="onListKeyDown(event);"
+                _window_label="&restorepage.windowLabel;">
+            <treecols>
+              <treecol cycler="true" id="restore" type="checkbox" label="&restorepage.restoreHeader;"/>
+              <splitter class="tree-splitter"/>
+              <treecol primary="true" id="title" label="&restorepage.listHeader;" flex="1"/>
+            </treecols>
+            <treechildren flex="1"/>
+          </tree>
+        </div>
+      </div>
+
+      <!-- Buttons -->
+      <hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="buttons">
+#ifdef XP_UNIX
+        <button id="errorCancel" label="&restorepage.closeButton;"
+                accesskey="&restorepage.close.access;"
+                oncommand="startNewSession();"/>
+        <button id="errorTryAgain" label="&restorepage.tryagainButton;"
+                accesskey="&restorepage.restore.access;"
+                oncommand="restoreSession();"/>
+#else
+        <button id="errorTryAgain" label="&restorepage.tryagainButton;"
+                accesskey="&restorepage.restore.access;"
+                oncommand="restoreSession();"/>
+        <button id="errorCancel" label="&restorepage.closeButton;"
+                accesskey="&restorepage.close.access;"
+                oncommand="startNewSession();"/>
+#endif
+      </hbox>
+      <!-- holds the session data for when the tab is closed -->
+      <input type="text" id="sessionData" style="display: none;"/>
+    </div>
+
+  </body>
+</html>
--- a/browser/components/migration/jar.mn
+++ b/browser/components/migration/jar.mn
@ -5,3 +5,4 @@
 browser.jar:
 *  content/browser/migration/migration.xul                    (content/migration.xul)
   content/browser/migration/migration.js                     (content/migration.js)
+*  content/browser/aboutWelcomeBack.xhtml                     (content/aboutWelcomeBack.xhtml)
--- a/browser/components/migration/public/nsIBrowserProfileMigrator.idl
+++ b/browser/components/migration/public/nsIBrowserProfileMigrator.idl
@ -9,7 +9,7 @@ interface nsIArray;
 interface nsIProfileStartup;

 [scriptable, uuid(44993E0E-74E8-4BEC-9D66-AD8156E0A274)]
-interface nsIBrowserProfileMigrator : nsISupports 
+interface nsIBrowserProfileMigrator : nsISupports
 {
  /**
   * profile items to migrate. use with migrate().
@ -22,6 +22,7 @@ interface nsIBrowserProfileMigrator : nsISupports
  const unsigned short PASSWORDS   = 0x0010;
  const unsigned short BOOKMARKS   = 0x0020;
  const unsigned short OTHERDATA   = 0x0040;
+  const unsigned short SESSION     = 0x0080;

  /**
   * Copy user profile information to the current active profile.
--- a/browser/components/migration/src/FirefoxProfileMigrator.js
+++ b/browser/components/migration/src/FirefoxProfileMigrator.js
@ -15,13 +15,26 @@

 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 Components.utils.import("resource:///modules/MigrationUtils.jsm");
+Components.utils.import("resource://gre/modules/Services.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "PlacesBackups",
                                  "resource://gre/modules/PlacesBackups.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "SessionMigration",
+                                  "resource:///modules/sessionstore/SessionMigration.jsm");

 function FirefoxProfileMigrator() { }

 FirefoxProfileMigrator.prototype = Object.create(MigratorPrototype);

+FirefoxProfileMigrator.prototype._getFileObject = function(dir, fileName) {
+  let file = dir.clone();
+  file.append(fileName);
+
+  // File resources are monolithic.  We don't make partial copies since
+  // they are not expected to work alone. Return null to avoid trying to
+  // copy non-existing files.
+  return file.exists() ? file : null;
+}
+
 FirefoxProfileMigrator.prototype.getResources = function() {
  // Only allow migrating from the default (selected) profile since this will
  // be the only one returned by the toolkit profile service after bug 214675.
@ -48,14 +61,9 @@ FirefoxProfileMigrator.prototype.getResources = function() {
  let getFileResource = function(aMigrationType, aFileNames) {
    let files = [];
    for (let fileName of aFileNames) {
-      let file = sourceProfileDir.clone();
-      file.append(fileName);
-
-      // File resources are monolithic.  We don't make partial copies since
-      // they are not expected to work alone.
-      if (!file.exists())
+      let file = this._getFileObject(sourceProfileDir, fileName);
+      if (!file)
        return null;
-
      files.push(file);
    }
    return {
@ -67,7 +75,7 @@ FirefoxProfileMigrator.prototype.getResources = function() {
        aCallback(true);
      }
    };
-  };
+  }.bind(this);

  let types = MigrationUtils.resourceTypes;
  let places = getFileResource(types.HISTORY, ["places.sqlite"]);
@ -79,8 +87,39 @@ FirefoxProfileMigrator.prototype.getResources = function() {
    [PlacesBackups.profileRelativeFolderPath]);
  let dictionary = getFileResource(types.OTHERDATA, ["persdict.dat"]);

+  let sessionFile = this._getFileObject(sourceProfileDir, "sessionstore.js");
+  let session;
+  if (sessionFile) {
+    session = {
+      type: types.SESSION,
+      migrate: function(aCallback) {
+        let newSessionFile = currentProfileDir.clone();
+        newSessionFile.append("sessionstore.js");
+        let migrationPromise = SessionMigration.migrate(sessionFile.path, newSessionFile.path);
+        migrationPromise.then(function() {
+          let buildID = Services.appinfo.platformBuildID;
+          let mstone = Services.appinfo.platformVersion;
+          // Force the browser to one-off resume the session that we give it:
+          Services.prefs.setBoolPref("browser.sessionstore.resume_session_once", true);
+          // Reset the homepage_override prefs so that the browser doesn't override our
+          // session with the "what's new" page:
+          Services.prefs.setCharPref("browser.startup.homepage_override.mstone", mstone);
+          Services.prefs.setCharPref("browser.startup.homepage_override.buildID", buildID);
+          // It's too early in startup for the pref service to have a profile directory,
+          // so we have to manually tell it where to save the prefs file.
+          let newPrefsFile = currentProfileDir.clone();
+          newPrefsFile.append("prefs.js");
+          Services.prefs.savePrefFile(newPrefsFile);
+          aCallback(true);
+        }, function() {
+          aCallback(false);
+        });
+      }
+    }
+  }
+
  return [r for each (r in [places, cookies, passwords, formData,
-                            dictionary, bookmarksBackups]) if (r)];
+                            dictionary, bookmarksBackups, session]) if (r)];
 }

 Object.defineProperty(FirefoxProfileMigrator.prototype, "startupOnlyMigrator", {
--- a/browser/components/migration/src/MigrationUtils.jsm
+++ b/browser/components/migration/src/MigrationUtils.jsm
@ -332,7 +332,8 @@ this.MigrationUtils = Object.freeze({
    FORMDATA:   Ci.nsIBrowserProfileMigrator.FORMDATA,
    PASSWORDS:  Ci.nsIBrowserProfileMigrator.PASSWORDS,
    BOOKMARKS:  Ci.nsIBrowserProfileMigrator.BOOKMARKS,
-    OTHERDATA:  Ci.nsIBrowserProfileMigrator.OTHERDATA
+    OTHERDATA:  Ci.nsIBrowserProfileMigrator.OTHERDATA,
+    SESSION:    Ci.nsIBrowserProfileMigrator.SESSION,
  },

  /**
--- a/browser/components/sessionstore/src/Makefile.in
+++ b/browser/components/sessionstore/src/Makefile.in
@ -21,6 +21,7 @@ JS_MODULES_PATH := modules/sessionstore
 EXTRA_JS_MODULES := \
  DocumentUtils.jsm \
  SessionStorage.jsm \
+  SessionMigration.jsm \
  XPathGenerator.jsm \
  _SessionFile.jsm \
  $(NULL)
--- a/browser/components/sessionstore/src/SessionMigration.jsm
+++ b/browser/components/sessionstore/src/SessionMigration.jsm
@ -0,0 +1,117 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+this.EXPORTED_SYMBOLS = ["SessionMigration"];
+
+const Cu = Components.utils;
+Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
+Cu.import("resource://gre/modules/Task.jsm", this);
+Cu.import("resource://gre/modules/osfile.jsm", this);
+
+// An encoder to UTF-8.
+XPCOMUtils.defineLazyGetter(this, "gEncoder", function () {
+  return new TextEncoder();
+});
+
+// A decoder.
+XPCOMUtils.defineLazyGetter(this, "gDecoder", function () {
+  return new TextDecoder();
+});
+
+let SessionMigrationInternal = {
+  /**
+   * Convert the original session restore state into a minimal state. It will
+   * only contain:
+   * - open windows
+   *   - with tabs
+   *     - with history entries with only title, url
+   *     - with pinned state
+   *     - with tab group info (hidden + group id)
+   *     - with selected tab info
+   *   - with selected window info
+   *   - with tabgroups info
+   *
+   * The complete state is then wrapped into the "about:welcomeback" page as
+   * form field info to be restored when restoring the state.
+   */
+  convertState: function(aStateObj) {
+    let state = {
+      selectedWindow: aStateObj.selectedWindow,
+      _closedWindows: []
+    };
+    state.windows = aStateObj.windows.map(function(oldWin) {
+      var win = {extData: {}};
+      win.tabs = oldWin.tabs.map(function(oldTab) {
+        var tab = {};
+        // Keep only titles and urls for history entries
+        tab.entries = oldTab.entries.map(function(entry) {
+          return {url: entry.url, title: entry.title};
+        });
+        tab.index = oldTab.index;
+        tab.hidden = oldTab.hidden;
+        tab.pinned = oldTab.pinned;
+        // The tabgroup info is in the extData, so we need to get it out.
+        if (oldTab.extData && "tabview-tab" in oldTab.extData) {
+          tab.extData = {"tabview-tab": oldTab.extData["tabview-tab"]};
+        }
+        return tab;
+      });
+      // There are various tabgroup-related attributes that we need to get out
+      // of the session restore data for the window, too.
+      if (oldWin.extData) {
+        for (let k of Object.keys(oldWin.extData)) {
+          if (k.startsWith("tabview-")) {
+            win.extData[k] = oldWin.extData[k];
+          }
+        }
+      }
+      win.selected = oldWin.selected;
+      win._closedTabs = [];
+      return win;
+    });
+    let wrappedState = {
+      url: "about:welcomeback",
+      formdata: {
+        id: {"sessionData": state},
+        xpath: {}
+      }
+    };
+    return {windows: [{tabs: [{entries: [wrappedState]}]}]};
+  },
+  /**
+   * Asynchronously read session restore state (JSON) from a path
+   */
+  readState: function(aPath) {
+    return Task.spawn(function() {
+      let bytes = yield OS.File.read(aPath);
+      let text = gDecoder.decode(bytes);
+      let state = JSON.parse(text);
+      throw new Task.Result(state);
+    });
+  },
+  /**
+   * Asynchronously write session restore state as JSON to a path
+   */
+  writeState: function(aPath, aState) {
+    let bytes = gEncoder.encode(JSON.stringify(aState));
+    return OS.File.writeAtomic(aPath, bytes, {tmpPath: aPath + ".tmp"});
+  }
+}
+
+let SessionMigration = {
+  /**
+   * Migrate a limited set of session data from one path to another.
+   */
+  migrate: function(aFromPath, aToPath) {
+    return Task.spawn(function() {
+      let inState = yield SessionMigrationInternal.readState(aFromPath);
+      let outState = SessionMigrationInternal.convertState(inState);
+      // Unfortunately, we can't use SessionStore's own _SessionFile to
+      // write out the data because it has a dependency on the profile dir
+      // being known. When the migration runs, there is no guarantee that
+      // that's true.
+      yield SessionMigrationInternal.writeState(aToPath, outState);
+    });
+  }
+};
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@ -425,6 +425,11 @@ let SessionStoreInternal = {
                }
              };
              this._initialState = { windows: [{ tabs: [{ entries: [pageData] }] }] };
+            } else if (this._hasSingleTabWithURL(this._initialState.windows,
+                                                 "about:welcomeback")) {
+              // On a single about:welcomeback URL that crashed, replace about:welcomeback
+              // with about:sessionrestore, to make clear to the user that we crashed.
+              this._initialState.windows[0].tabs[0].entries[0].url = "about:sessionrestore";
            }
          }

@ -2072,6 +2077,12 @@ let SessionStoreInternal = {
    if (aEntry.referrerURI)
      entry.referrer = aEntry.referrerURI.spec;

+    if (aEntry.srcdocData)
+      entry.srcdocData = aEntry.srcdocData;
+
+    if (aEntry.isSrcdocEntry)
+      entry.isSrcdocEntry = aEntry.isSrcdocEntry;
+
    if (aEntry.contentType)
      entry.contentType = aEntry.contentType;

@ -2251,7 +2262,8 @@ let SessionStoreInternal = {
    }
    var isHTTPS = this._getURIFromString((aContent.parent || aContent).
                                         document.location.href).schemeIs("https");
-    let isAboutSR = aContent.top.document.location.href == "about:sessionrestore";
+    let topURL = aContent.top.document.location.href;
+    let isAboutSR = topURL == "about:sessionrestore" || topURL == "about:welcomeback";
    if (aFullData || this.checkPrivacyLevel(isHTTPS, aIsPinned) || isAboutSR) {
      if (aFullData || aUpdateFormData) {
        let formData = DocumentUtils.getFormData(aContent.document);
@ -3311,6 +3323,8 @@ let SessionStoreInternal = {
      shEntry.contentType = aEntry.contentType;
    if (aEntry.referrer)
      shEntry.referrerURI = this._getURIFromString(aEntry.referrer);
+    if (aEntry.isSrcdocEntry)
+      shEntry.srcdocData = aEntry.srcdocData;

    if (aEntry.cacheKey) {
      var cacheKey = Cc["@mozilla.org/supports-PRUint32;1"].
@ -3452,7 +3466,7 @@ let SessionStoreInternal = {
        // for about:sessionrestore we saved the field as JSON to avoid
        // nested instances causing humongous sessionstore.js files.
        // cf. bug 467409
-        if (aData.url == "about:sessionrestore" &&
+        if ((aData.url == "about:sessionrestore" || aData.url == "about:welcomeback") &&
            "sessionData" in formdata.id &&
            typeof formdata.id["sessionData"] == "object") {
          formdata.id["sessionData"] =
@ -4076,11 +4090,10 @@ let SessionStoreInternal = {
      return false;

    // don't wrap a single about:sessionrestore page
-    if (winData.length == 1 && winData[0].tabs &&
-        winData[0].tabs.length == 1 && winData[0].tabs[0].entries &&
-        winData[0].tabs[0].entries.length == 1 &&
-        winData[0].tabs[0].entries[0].url == "about:sessionrestore")
+    if (this._hasSingleTabWithURL(winData, "about:sessionrestore") ||
+        this._hasSingleTabWithURL(winData, "about:welcomeback")) {
      return false;
+    }

    // don't automatically restore in Safe Mode
    if (Services.appinfo.inSafeMode)
@ -4096,6 +4109,23 @@ let SessionStoreInternal = {
            sessionAge && sessionAge >= SIX_HOURS_IN_MS);
  },

+  /**
+   * @param aWinData is the set of windows in session state
+   * @param aURL is the single URL we're looking for
+   * @returns whether the window data contains only the single URL passed
+   */
+  _hasSingleTabWithURL: function(aWinData, aURL) {
+    if (aWinData &&
+        aWinData.length == 1 &&
+        aWinData[0].tabs &&
+        aWinData[0].tabs.length == 1 &&
+        aWinData[0].tabs[0].entries &&
+        aWinData[0].tabs[0].entries.length == 1) {
+      return aURL == aWinData[0].tabs[0].entries[0].url;
+    }
+    return false;
+  },
+
  /**
   * Determine if the tab state we're passed is something we should save. This
   * is used when closing a tab or closing a window with a single tab
--- a/browser/components/sessionstore/test/Makefile.in
+++ b/browser/components/sessionstore/test/Makefile.in
@ -14,11 +14,11 @@ include $(DEPTH)/config/autoconf.mk
 # browser_526613.js is disabled because of frequent failures (bug 534489)
 # browser_589246.js is disabled for leaking browser windows (bug 752467)
 # browser_580512.js is disabled for leaking browser windows (bug 752467)
-# browser_capabilities.js is disabled for using resources outside of the build network (bug 882575)

 MOCHITEST_BROWSER_FILES = \
 	head.js \
 	browser_attributes.js \
+	browser_capabilities.js \
 	browser_dying_cache.js \
 	browser_form_restore_events.js \
 	browser_form_restore_events_sample.html \
--- a/browser/devtools/framework/test/browser_new_activation_workflow.js
+++ b/browser/devtools/framework/test/browser_new_activation_workflow.js
@ -43,7 +43,7 @@ function selectAndCheckById(id) {

  return toolbox.selectTool(id).then(function() {
    let tab = doc.getElementById("toolbox-tab-" + id);
-    is(tab.selected, true, "The " + id + " tab is selected");
+    is(tab.hasAttribute("selected"), true, "The " + id + " tab is selected");
  });
 }

--- a/browser/devtools/framework/toolbox.css
+++ b/browser/devtools/framework/toolbox.css
@ -2,10 +2,9 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

-.devtools-tab > .radio-check,
-.devtools-tab > .radio-check-box1,
-.devtools-tab > .radio-spacer-box {
-  display: none;
+.devtools-tab {
+  -moz-binding: url("chrome://global/content/bindings/general.xml#control-item");
+  -moz-box-align: center;
 }

 #toolbox-controls > toolbarbutton > .toolbarbutton-text,
--- a/browser/devtools/framework/toolbox.js
+++ b/browser/devtools/framework/toolbox.js
@ -351,6 +351,9 @@ Toolbox.prototype = {
    let id = toolDefinition.id;

    let radio = this.doc.createElement("radio");
+    // The radio element is not being used in the conventional way, thus
+    // the devtools-tab class replaces the radio XBL binding with its base
+    // binding (the control-item binding).
    radio.className = "toolbox-tab devtools-tab";
    radio.id = "toolbox-tab-" + id;
    radio.setAttribute("toolid", id);
--- a/browser/locales/en-US/chrome/browser/aboutSessionRestore.dtd
+++ b/browser/locales/en-US/chrome/browser/aboutSessionRestore.dtd
@ -21,3 +21,14 @@
 <!ENTITY restorepage.listHeader     "Windows and Tabs">
 <!-- LOCALIZATION NOTE: &#37;S will be replaced with a number. -->
 <!ENTITY restorepage.windowLabel    "Window &#37;S">
+
+
+<!-- LOCALIZATION NOTE: The following 'welcomeback' strings are for about:welcomeback,
+     not for about:sessionstore -->
+<!ENTITY welcomeback.tabtitle       "Welcome Back!">
+
+<!-- LOCALIZATION NOTE: The title is intended to be welcoming and congratulatory,
+     expressing joy that the user has successfully migrated their stuff and hope
+     that now they have a better experience.  -->
+<!ENTITY welcomeback.pageTitle      "Welcome Back!">
+<!ENTITY welcomeback.pageInfo       "&brandShortName; successfully reset your profile. Below is a list of windows and tabs you had open; you can restore them or start with a clean slate.">
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@ -265,6 +265,9 @@ identity.unknown.tooltip=This website does not supply identity information.

 identity.ownerUnknown2=(unknown)

+# LOCALIZATION NOTE (identity.chrome): %S is replaced with the brandShortName.
+identity.chrome=This is a secure %S page.
+
 # Edit Bookmark UI
 editBookmarkPanel.pageBookmarkedTitle=Page Bookmarked
 editBookmarkPanel.pageBookmarkedDescription=%S will always remember this page for you.
--- a/browser/locales/en-US/chrome/browser/migration/migration.properties
+++ b/browser/locales/en-US/chrome/browser/migration/migration.properties
@ -49,3 +49,5 @@ importedSafariReadingList=Reading List (From Safari)
 64_safari=Other Data
 64_chrome=Other Data
 64_firefox_other=Other Data
+
+128_firefox=Windows and Tabs
--- a/browser/metro/base/content/browser.xul
+++ b/browser/metro/base/content/browser.xul
@ -258,6 +258,52 @@
      <button class="content-navigator-item close-button" command="cmd_findClose"/>
    </appbar>

+    <!-- Navbar -->
+    <appbar id="navbar" mousethrough="never" observes="bcast_windowState">
+      <hbox id="progress-container" layer="true">
+        <hbox id="progress-control" />
+      </hbox>
+
+      <!-- Main Toolbar -->
+      <toolbar id="toolbar" observes="bcast_windowState" flex="1">
+        <observes element="bcast_windowState" attribute="*"/>
+        <observes element="bcast_urlbarState" attribute="*"/>
+
+        <toolbarbutton id="back-button" class="appbar-primary" command="cmd_back"/>
+        <toolbarbutton id="forward-button" class="appbar-primary" command="cmd_forward"/>
+
+        <hbox id="urlbar-container" flex="1" observes="bcast_urlbarState">
+          <hbox id="urlbar" flex="1">
+            <box id="identity-box" role="button">
+              <hbox id="identity-box-inner" align="center" mousethrough="always">
+                <image id="identity-icon"/>
+              </hbox>
+            </box>
+
+            <textbox id="urlbar-edit"
+                     type="url"
+                     class="uri-element"
+                     autocompletesearch="history"
+                     autocompletepopup="start-autocomplete"
+                     completeselectedindex="true"
+                     placeholder="&urlbar.emptytext;"
+                     flex="1"
+                     ontextentered="BrowserUI.handleUrlbarEnter(param);"
+                     onkeydown="BrowserUI.navEditKeyPress();"
+                     onblur="BrowserUI._urlbarBlurred();"/>
+          </hbox>
+
+          <toolbarbutton id="reload-button" oncommand="CommandUpdater.doCommand(event.shiftKey ? 'cmd_forceReload' : 'cmd_reload');"/>
+          <toolbarbutton id="stop-button" command="cmd_stop"/>
+        </hbox>
+
+        <toolbarbutton id="download-button" oncommand="Appbar.onDownloadButton()"/>
+        <toolbarbutton id="star-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onStarButton()"/>
+        <toolbarbutton id="pin-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onPinButton()"/>
+        <toolbarbutton id="menu-button" class="appbar-primary" oncommand="Appbar.onMenuButton(event)"/>
+       </toolbar>
+    </appbar>
+
    <vbox id="panel-container" hidden="true" class="window-width window-height meta" observes="bcast_windowState">
      <hbox id="panel-header">
        <toolbarbutton id="panel-close-button" command="cmd_panel"/>
@ -309,52 +355,6 @@
      </deck>
    </vbox>

-    <!-- Navbar -->
-    <appbar id="navbar" mousethrough="never" observes="bcast_windowState">
-      <hbox id="progress-container" layer="true">
-        <hbox id="progress-control" />
-      </hbox>
-
-      <!-- Main Toolbar -->
-      <toolbar id="toolbar" observes="bcast_windowState" flex="1">
-        <observes element="bcast_windowState" attribute="*"/>
-        <observes element="bcast_urlbarState" attribute="*"/>
-
-        <toolbarbutton id="back-button" class="appbar-primary" command="cmd_back"/>
-        <toolbarbutton id="forward-button" class="appbar-primary" command="cmd_forward"/>
-
-        <hbox id="urlbar-container" flex="1" observes="bcast_urlbarState">
-          <hbox id="urlbar" flex="1">
-            <box id="identity-box" role="button">
-              <hbox id="identity-box-inner" align="center" mousethrough="always">
-                <image id="identity-icon"/>
-              </hbox>
-            </box>
-
-            <textbox id="urlbar-edit"
-                     type="url"
-                     class="uri-element"
-                     autocompletesearch="history"
-                     autocompletepopup="start-autocomplete"
-                     completeselectedindex="true"
-                     placeholder="&urlbar.emptytext;"
-                     flex="1"
-                     ontextentered="BrowserUI.handleUrlbarEnter(param);"
-                     onkeydown="BrowserUI.navEditKeyPress();"
-                     onblur="BrowserUI._urlbarBlurred();"/>
-          </hbox>
-
-          <toolbarbutton id="reload-button" oncommand="CommandUpdater.doCommand(event.shiftKey ? 'cmd_forceReload' : 'cmd_reload');"/>
-          <toolbarbutton id="stop-button" command="cmd_stop"/>
-        </hbox>
-
-        <toolbarbutton id="download-button" oncommand="Appbar.onDownloadButton()"/>
-        <toolbarbutton id="star-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onStarButton()"/>
-        <toolbarbutton id="pin-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onPinButton()"/>
-        <toolbarbutton id="menu-button" class="appbar-primary" oncommand="Appbar.onMenuButton(event)"/>
-       </toolbar>
-    </appbar>
-
    <!-- Context button bar -->
    <appbar id="contextappbar">
      <toolbar id="contextualactions-tray" flex="1">
--- a/browser/themes/linux/browser.css
+++ b/browser/themes/linux/browser.css
@ -1004,30 +1004,16 @@ toolbar[iconsize="small"] #webrtc-status-button {
  color: GrayText;
 }

-/* Favicon */
+%include ../shared/identity-block.inc.css
+
 #page-proxy-favicon {
-  width: 16px;
-  height: 16px;
  margin-top: 2px;
  margin-bottom: 2px;
  -moz-margin-start: 4px;
  -moz-margin-end: 3px;
-  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
  -moz-image-region: rect(0, 16px, 16px, 0);
 }

-.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
-}
-
-.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
-}
-
-.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
-}
-
 #identity-box:hover > #page-proxy-favicon {
  -moz-image-region: rect(0, 32px, 16px, 16px);
 }
@ -1037,10 +1023,6 @@ toolbar[iconsize="small"] #webrtc-status-button {
  -moz-image-region: rect(0, 48px, 16px, 32px);
 }

-#page-proxy-favicon[pageproxystate="invalid"] {
-  opacity: 0.3;
-}
-
 /* Identity indicator */
 #identity-box {
  padding: 1px;
@ -1069,21 +1051,10 @@ toolbar[iconsize="small"] #webrtc-status-button {
  -moz-padding-end: 5px;
 }

+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
 #urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
  background-color: #fff;
-  color: hsl(92,100%,30%);
  -moz-margin-end: 4px;
-  background-image: linear-gradient(hsla(92,81%,16%,0),
-                                    hsla(92,81%,16%,.2) 25%,
-                                    hsla(92,81%,16%,.2) 75%,
-                                    hsla(92,81%,16%,0));
-  background-position: right;
-  background-size: 1px;
-  background-repeat: no-repeat;
-}
-
-#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
-  background-position: left;
 }

 /* Identity popup icons */
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@ -9,6 +9,7 @@ browser.jar:
 * skin/classic/browser/aboutPrivateBrowsing.css
 * skin/classic/browser/aboutSessionRestore.css
  skin/classic/browser/aboutSessionRestore-window-icon.png
+  skin/classic/browser/aboutWelcomeBack.css                     (../shared/aboutWelcomeBack.css)
  skin/classic/browser/aboutCertError.css
  skin/classic/browser/aboutCertError_sectionCollapsed.png
  skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@ -1291,20 +1291,9 @@ toolbar[mode="icons"] #zoom-in-button {
  padding-right: 10.01px;
 }

+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
 #urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
-  color: hsl(92,100%,30%);
  -moz-padding-end: 4px;
-  background-image: linear-gradient(hsla(92,81%,16%,0),
-                                    hsla(92,81%,16%,.2) 25%,
-                                    hsla(92,81%,16%,.2) 75%,
-                                    hsla(92,81%,16%,0));
-  background-position: right;
-  background-size: 1px;
-  background-repeat: no-repeat;
-}
-
-#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
-  background-position: left;
 }

 #identity-box:-moz-focusring {
@ -1374,38 +1363,36 @@ toolbar[mode="icons"] #zoom-in-button {
  height: 22px;
 }

+%include ../shared/identity-block.inc.css
+
 #page-proxy-favicon {
-  width: 16px;
-  height: 16px;
  margin: 0px;
  padding: 0px;
-  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
  -moz-image-region: rect(0, 16px, 16px, 0);
 }

-.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
-}
-
-.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
-}
-
-.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
-}
-
 #identity-box:hover:active > #page-proxy-favicon,
 #identity-box[open=true] > #page-proxy-favicon {
  -moz-image-region: rect(0, 32px, 16px, 16px);
 }

+/* The chromeUI identity-icon set includes three states,
+   but OS X only uses two of them. */
+#identity-box.chromeUI:hover:active > #page-proxy-favicon,
+#identity-box.chromeUI[open=true] > #page-proxy-favicon {
+  -moz-image-region: rect(0, 48px, 16px, 32px);
+}
+
@media (min-resolution: 2dppx) {
  #page-proxy-favicon {
    list-style-image: url(chrome://browser/skin/identity-icons-generic@2x.png);
    -moz-image-region: rect(0, 32px, 32px, 0);
  }

+  .chromeUI > #page-proxy-favicon[pageproxystate="valid"] {
+    list-style-image: url(chrome://branding/content/identity-icons-brand@2x.png);
+  }
+
  .verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
    list-style-image: url(chrome://browser/skin/identity-icons-https@2x.png);
  }
@ -1422,10 +1409,13 @@ toolbar[mode="icons"] #zoom-in-button {
  #identity-box[open=true] > #page-proxy-favicon {
    -moz-image-region: rect(0, 64px, 32px, 32px);
  }
-}

-#page-proxy-favicon[pageproxystate="invalid"] {
-  opacity: 0.3;
+  /* The chromeUI identity-icon set includes three states,
+     but OS X only uses two of them. */
+  #identity-box.chromeUI:hover:active > #page-proxy-favicon,
+  #identity-box.chromeUI[open=true] > #page-proxy-favicon {
+    -moz-image-region: rect(0, 96px, 32px, 64px);
+  }
 }

 #wrapper-urlbar-container[place="palette"] {
@ -2964,6 +2954,10 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
  #identity-popup.verifiedIdentity > #identity-popup-container > #identity-popup-icon {
    -moz-image-region: rect(256px, 128px, 384px, 0px);
  }
+
+  #identity-popup.chromeUI > #identity-popup-container > #identity-popup-icon {
+    list-style-image: url("chrome://branding/content/icon128.png");
+  }
 }

 /* Popup Body Text */
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@ -8,6 +8,7 @@ browser.jar:
 * skin/classic/browser/aboutPrivateBrowsing.css             (aboutPrivateBrowsing.css)
 * skin/classic/browser/aboutSessionRestore.css              (aboutSessionRestore.css)
  skin/classic/browser/aboutSessionRestore-window-icon.png
+  skin/classic/browser/aboutWelcomeBack.css                 (../shared/aboutWelcomeBack.css)
  skin/classic/browser/aboutCertError.css
  skin/classic/browser/aboutCertError_sectionCollapsed.png
  skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
--- a/browser/themes/shared/aboutWelcomeBack.css
+++ b/browser/themes/shared/aboutWelcomeBack.css
@ -0,0 +1,7 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#errorPageContainer {
+  background-image: url("chrome://global/skin/icons/information-64.png");
+}
--- a/browser/themes/shared/identity-block.inc.css
+++ b/browser/themes/shared/identity-block.inc.css
@ -0,0 +1,93 @@
+%if 0
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+%endif
+
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
+#urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
+  background-position: right;
+  background-size: 1px;
+  background-repeat: no-repeat;
+}
+
+#urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
+  color: hsl(92,100%,30%);
+  background-image: linear-gradient(hsla(92,81%,16%,0),
+                                    hsla(92,81%,16%,.2) 35%,
+                                    hsla(92,81%,16%,.2) 65%,
+                                    hsla(92,81%,16%,0));
+}
+
+
+%ifdef MOZ_OFFICIAL_BRANDING
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI {
+  color: rgb(229,115,0);
+  background-image: linear-gradient(rgba(229,114,0,0),
+                                    rgba(229,114,0,.5) 35%,
+                                    rgba(229,114,0,.5) 65%,
+                                    rgba(229,114,0,0));
+}
+%else
+%if MOZ_UPDATE_CHANNEL == aurora
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI {
+  color: hsl(214,90%,23%);
+  background-image: linear-gradient(hsla(208,99%,37%,0),
+                                    hsla(214,90%,23%,.5) 35%,
+                                    hsla(214,90%,23%,.5) 65%,
+                                    hsla(214,90%,23%,0));
+}
+%else
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI {
+  color: hsl(211,33%,32%);
+  background-image: linear-gradient(hsla(211,33%,32%,0),
+                                    hsla(211,33%,32%,.5) 35%,
+                                    hsla(211,33%,32%,.5) 65%,
+                                    hsla(211,33%,32%,0));
+}
+%endif
+%endif
+
+#identity-box.chromeUI:-moz-locale-dir(rtl),
+#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
+  background-position: left;
+}
+
+/* page proxy icon */
+
+#page-proxy-favicon {
+  width: 16px;
+  height: 16px;
+  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
+}
+
+.chromeUI > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://branding/content/identity-icons-brand.png);
+}
+
+.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
+}
+
+.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
+}
+
+.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
+}
+
+#page-proxy-favicon[pageproxystate="invalid"] {
+  opacity: 0.3;
+}
+
+#identity-popup.chromeUI > #identity-popup-container > #identity-popup-icon {
+  list-style-image: url("chrome://branding/content/icon64.png");
+}
+
+#identity-popup-brandName {
+  font-weight: bold;
+  font-size: 1.25em;
+  margin-top: .5em;
+  margin-bottom: .5em;
+}
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@ -1457,20 +1457,9 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
  padding-right: 5.01px;
 }

+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
 #urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
-  color: hsl(92,100%,30%);
  -moz-margin-end: 4px;
-  background-image: linear-gradient(hsla(92,81%,16%,0),
-                                    hsla(92,81%,16%,.2) 25%,
-                                    hsla(92,81%,16%,.2) 75%,
-                                    hsla(92,81%,16%,0));
-  background-position: right;
-  background-size: 1px;
-  background-repeat: no-repeat;
-}
-
-#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
-  background-position: left;
 }

 #identity-box.verifiedIdentity:not(:-moz-lwtheme) {
@ -1512,14 +1501,13 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,

 /* page proxy icon */

+%include ../shared/identity-block.inc.css
+
 #page-proxy-favicon {
-  width: 16px;
-  height: 16px;
  margin-top: 1px;
  margin-bottom: 1px;
  -moz-margin-start: 3px;
  -moz-margin-end: 2px;
-  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
  -moz-image-region: rect(0, 16px, 16px, 0);
 }

@ -1527,18 +1515,6 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
  -moz-margin-end: 1px;
 }

-.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
-}
-
-.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
-}
-
-.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
-}
-
 #identity-box:hover > #page-proxy-favicon {
  -moz-image-region: rect(0, 32px, 16px, 16px);
 }
@ -1548,10 +1524,6 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
  -moz-image-region: rect(0, 48px, 16px, 32px);
 }

-#page-proxy-favicon[pageproxystate="invalid"] {
-  opacity: 0.3;
-}
-
 /* autocomplete */

 #treecolAutoCompleteImage {
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@ -11,6 +11,7 @@ browser.jar:
 *       skin/classic/browser/aboutPrivateBrowsing.css
 *       skin/classic/browser/aboutSessionRestore.css
        skin/classic/browser/aboutSessionRestore-window-icon.png     (preferences/application.png)
+        skin/classic/browser/aboutWelcomeBack.css                    (../shared/aboutWelcomeBack.css)
        skin/classic/browser/aboutCertError.css
        skin/classic/browser/aboutCertError_sectionCollapsed.png
        skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
--- a/caps/src/nsPrincipal.cpp
+++ b/caps/src/nsPrincipal.cpp
@ -840,8 +840,7 @@ nsExpandedPrincipal::CheckMayLoad(nsIURI* uri, bool aReport, bool aAllowIfInheri
 NS_IMETHODIMP
 nsExpandedPrincipal::GetHashValue(uint32_t* result)
 {
-  MOZ_NOT_REACHED("extended principal should never be used as key in a hash map");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("extended principal should never be used as key in a hash map");
 }

 NS_IMETHODIMP
--- a/config/purge_directories.py
+++ b/config/purge_directories.py
@ -0,0 +1,77 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This script is used to purge a directory of unwanted files as defined by
+# a manifest file.
+
+from __future__ import print_function, unicode_literals
+
+import argparse
+import os
+import sys
+import threading
+
+from mozpack.manifests import PurgeManifest
+
+def do_purge(purger, dest, state):
+    state['result'] = purger.purge(dest)
+
+def process_manifest(topdir, manifest_path):
+    manifest = PurgeManifest.from_path(manifest_path)
+    purger = manifest.get_purger()
+    full = os.path.join(topdir, manifest.relpath)
+
+    state = dict(
+        relpath=manifest.relpath,
+        result=None,
+    )
+
+    t = threading.Thread(target=do_purge, args=(purger, full, state))
+    state['thread'] = t
+    t.start()
+
+    return state
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(
+        description='Purge a directory of untracked files.')
+
+    parser.add_argument('--directory', '-d',
+        help='Directory containing manifest files. Will process every file '
+            'in directory.')
+    parser.add_argument('topdir',
+        help='Top directory all paths are evaluated from.')
+    parser.add_argument('manifests', nargs='*',
+        help='List of manifest files defining purge operations to perform.')
+
+    args = parser.parse_args()
+
+    states = []
+
+    print('Purging unaccounted files from object directory...')
+
+    # We perform purging using threads for performance reasons. Hopefully
+    # multiple I/O operations will be faster than just 1.
+    paths = []
+    if args.directory:
+        for path in sorted(os.listdir(args.directory)):
+            paths.append(os.path.join(args.directory, path))
+
+    paths.extend(args.manifests)
+
+    for path in paths:
+        states.append(process_manifest(args.topdir, path))
+
+    for state in states:
+        state['thread'].join()
+        print('Deleted %d files and %d directories from %s.' % (
+            state['result'].removed_files_count,
+            state['result'].removed_directories_count,
+            state['relpath']
+        ))
+
+    print('Finished purging.')
+
+    sys.exit(0)
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@ -611,7 +611,8 @@ public:

  /**
   * Returns the content node that is the parent of this node in the flattened
-   * tree.
+   * tree. For nodes that are not filtered into an insertion point, this
+   * simply returns their DOM parent in the original DOM tree.
   *
   * @return the flattened tree parent
   */
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@ -13,6 +13,7 @@
 #include "nsCompatibility.h"             // for member
 #include "nsCOMPtr.h"                    // for member
 #include "nsGkAtoms.h"                   // for static class members
+#include "nsIChannel.h"                  // for member
 #include "nsIDocumentEncoder.h"          // for member (in nsCOMPtr)
 #include "nsIDocumentObserver.h"         // for typedef (nsUpdateType)
 #include "nsIFrameRequestCallback.h"     // for member (in nsCOMPtr)
@ -255,10 +256,14 @@ public:
  /**
   * Return the base URI for relative URIs in the document (the document uri
   * unless it's overridden by SetBaseURI, HTML <base> tags, etc.).  The
-   * returned URI could be null if there is no document URI.
+   * returned URI could be null if there is no document URI.  If the document
+   * is a srcdoc document, return the parent document's base URL.
   */
  nsIURI* GetDocBaseURI() const
  {
+    if (mIsSrcdocDocument && mParentDocument) {
+      return mParentDocument->GetDocBaseURI();
+    }
    return mDocumentBaseURI ? mDocumentBaseURI : mDocumentURI;
  }
  virtual already_AddRefed<nsIURI> GetBaseURI() const MOZ_OVERRIDE
@ -628,6 +633,28 @@ public:
    return true;
  }

+  /**
+   * Return whether the document was created by a srcdoc iframe.
+   */
+  bool IsSrcdocDocument() const {
+    return mIsSrcdocDocument;
+  }
+
+  /**
+   * Sets whether the document was created by a srcdoc iframe.
+   */
+  void SetIsSrcdocDocument(bool aIsSrcdocDocument) {
+    mIsSrcdocDocument = aIsSrcdocDocument;
+  }
+
+  /*
+   * Gets the srcdoc string from within the channel (assuming both exist).
+   * Returns a void string if this isn't a srcdoc document or if
+   * the channel has not been set.
+   */
+  nsresult GetSrcdocData(nsAString& aSrcdocData);
+
+
 protected:
  virtual Element *GetRootElementInternal() const = 0;

@ -1314,18 +1341,6 @@ public:
    return mHaveFiredTitleChange;
  }

-  /**
-   * See GetXBLChildNodesFor on nsBindingManager
-   */
-  virtual nsresult GetXBLChildNodesFor(nsIContent* aContent,
-                                       nsIDOMNodeList** aResult) = 0;
-
-  /**
-   * See GetContentListFor on nsBindingManager
-   */
-  virtual nsresult GetContentListFor(nsIContent* aContent,
-                                     nsIDOMNodeList** aResult) = 0;
-
  /**
   * See GetAnonymousElementByAttribute on nsIDOMDocumentXBL.
   */
@ -2308,6 +2323,9 @@ protected:
  // Whether style sheet change events will be dispatched for this document
  bool mStyleSheetChangeEventsEnabled;

+  // Whether the document was created by a srcdoc iframe.
+  bool mIsSrcdocDocument;
+
  // The document's script global object, the object from which the
  // document can get its script context and scope. This is the
  // *inner* window object.
@ -2327,6 +2345,9 @@ protected:
  uint32_t mSandboxFlags;

  nsCString mContentLanguage;
+
+  // The channel that got passed to nsDocument::StartDocumentLoad(), if any.
+  nsCOMPtr<nsIChannel> mChannel;
 private:
  nsCString mContentType;
 protected:
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@ -114,8 +114,6 @@ enum {
  // node in fact has a class, but may be set even if it doesn't.
  NODE_MAY_HAVE_CLASS =                   NODE_FLAG_BIT(8),

-  NODE_IS_INSERTION_PARENT =              NODE_FLAG_BIT(9),
-
  // Node has an :empty or :-moz-only-whitespace selector
  NODE_HAS_EMPTY_SELECTOR =               NODE_FLAG_BIT(10),

--- a/content/base/src/ChildIterator.cpp
+++ b/content/base/src/ChildIterator.cpp
@ -0,0 +1,158 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ChildIterator.h"
+#include "nsXBLChildrenElement.h"
+
+namespace mozilla {
+namespace dom {
+
+nsIContent*
+ExplicitChildIterator::GetNextChild()
+{
+  // If we're already in the inserted-children array, look there first
+  if (mIndexInInserted) {
+    MOZ_ASSERT(mChild);
+    MOZ_ASSERT(mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL));
+    MOZ_ASSERT(!mDefaultChild);
+
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (mIndexInInserted < point->mInsertedChildren.Length()) {
+      return point->mInsertedChildren[mIndexInInserted++];
+    }
+    mIndexInInserted = 0;
+    mChild = mChild->GetNextSibling();
+  } else if (mDefaultChild) {
+    // If we're already in default content, check if there are more nodes there
+    MOZ_ASSERT(mChild);
+    MOZ_ASSERT(mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL));
+
+    mDefaultChild = mDefaultChild->GetNextSibling();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetNextSibling();
+  } else if (mIsFirst) {  // at the beginning of the child list
+    mChild = mParent->GetFirstChild();
+    mIsFirst = false;
+  } else if (mChild) { // in the middle of the child list
+    mChild = mChild->GetNextSibling();
+  }
+
+  // Iterate until we find a non-<children>, or a <children> with content.
+  while (mChild &&
+         mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (!point->mInsertedChildren.IsEmpty()) {
+      mIndexInInserted = 1;
+      return point->mInsertedChildren[0];
+    }
+
+    mDefaultChild = mChild->GetFirstChild();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetNextSibling();
+  }
+
+  return mChild;
+}
+
+FlattenedChildIterator::FlattenedChildIterator(nsIContent* aParent)
+  : ExplicitChildIterator(aParent), mXBLInvolved(false)
+{
+  nsXBLBinding* binding =
+    aParent->OwnerDoc()->BindingManager()->GetBindingWithContent(aParent);
+
+  if (binding) {
+    nsIContent* anon = binding->GetAnonymousContent();
+    if (anon) {
+      mParent = anon;
+      mXBLInvolved = true;
+    }
+  }
+
+  // We set mXBLInvolved to true if either:
+  // - The node we're iterating has a binding with content attached to it.
+  // - The node is generated XBL content and has an <xbl:children> child.
+  if (!mXBLInvolved && aParent->GetBindingParent()) {
+    for (nsIContent* child = aParent->GetFirstChild();
+         child;
+         child = child->GetNextSibling()) {
+      if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+        mXBLInvolved = true;
+        break;
+      }
+    }
+  }
+}
+
+nsIContent* FlattenedChildIterator::Get()
+{
+  MOZ_ASSERT(!mIsFirst);
+
+  if (mIndexInInserted) {
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    return point->mInsertedChildren[mIndexInInserted - 1];
+  }
+  return mDefaultChild ? mDefaultChild : mChild;
+}
+
+nsIContent* FlattenedChildIterator::GetPreviousChild()
+{
+  // If we're already in the inserted-children array, look there first
+  if (mIndexInInserted) {
+    // NB: mIndexInInserted points one past the last returned child so we need
+    // to look *two* indices back in order to return the previous child.
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (--mIndexInInserted) {
+      return point->mInsertedChildren[mIndexInInserted - 1];
+    }
+    mChild = mChild->GetPreviousSibling();
+  } else if (mDefaultChild) {
+    // If we're already in default content, check if there are more nodes there
+    mDefaultChild = mDefaultChild->GetPreviousSibling();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetPreviousSibling();
+  } else if (mIsFirst) { // at the beginning of the child list
+    return nullptr;
+  } else if (mChild) { // in the middle of the child list
+    mChild = mChild->GetPreviousSibling();
+  } else { // at the end of the child list
+    mChild = mParent->GetLastChild();
+  }
+
+  // Iterate until we find a non-<children>, or a <children> with content.
+  while (mChild &&
+         mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (!point->mInsertedChildren.IsEmpty()) {
+      mIndexInInserted = point->InsertedChildrenLength();
+      return point->mInsertedChildren[mIndexInInserted - 1];
+    }
+
+    mDefaultChild = mChild->GetLastChild();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetPreviousSibling();
+  }
+
+  if (!mChild) {
+    mIsFirst = true;
+  }
+
+  return mChild;
+}
+
+} // namespace dom
+} // namespace mozilla
--- a/content/base/src/ChildIterator.h
+++ b/content/base/src/ChildIterator.h
@ -0,0 +1,106 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Iterates over the children on a node. If a child is an insertion point,
+ * iterates over the children inserted there instead, or the default content
+ * if no children are inserted there.
+ *
+ * The FlattenedChildIterator expands any anonymous content bound from an XBL
+ * binding's <xbl:content> element.
+ */
+
+#include "nsIContent.h"
+
+namespace mozilla {
+namespace dom {
+
+// This class iterates normal DOM child nodes of a given DOM node with
+// <xbl:children> nodes replaced by the elements that have been filtered into that
+// insertion point. Any bindings on the given element are ignored for purposes
+// of determining which insertion point children are filtered into.
+class ExplicitChildIterator
+{
+public:
+  ExplicitChildIterator(nsIContent* aParent)
+    : mParent(aParent),
+      mChild(nullptr),
+      mDefaultChild(nullptr),
+      mIndexInInserted(0),
+      mIsFirst(true)
+  {
+  }
+
+  nsIContent* GetNextChild();
+
+protected:
+  // The parent of the children being iterated. For the FlattenedChildIterator,
+  // if there is a binding attached to the original parent, mParent points to
+  // the <xbl:content> element for the binding.
+  nsIContent* mParent;
+
+  // The current child. When we encounter an <xbl:children> insertion point,
+  // mChild remains as the insertion point whose content we're iterating (and
+  // our state is controled by mDefaultChild or mIndexInInserted depending on
+  // whether the insertion point expands to its default content or not).
+  nsIContent* mChild;
+
+  // If non-null, this points to the current default content for the current
+  // insertion point that we're iterating (i.e. mChild, which must be an
+  // nsXBLChildrenElement). Once this transitions back to null,
+  // we continue iterating at mChild's next sibling.
+  nsIContent* mDefaultChild;
+
+  // If not zero, we're iterating inserted children for an insertion point. This
+  // is an index into mChild's inserted children array (mChild must be an
+  // nsXBLChildrenElement). The index is one past the "current" child (as
+  // opposed to mChild which represents the "current" child).
+  uint32_t mIndexInInserted;
+
+  // A flag to let us know that we haven't started iterating yet.
+  bool mIsFirst;
+};
+
+// Iterates over the flattened children of a node, which accounts for anonymous
+// children and nodes moved by insertion points. If a node has anonymous
+// children, those are iterated over.
+class FlattenedChildIterator : public ExplicitChildIterator
+{
+public:
+  FlattenedChildIterator(nsIContent* aParent);
+
+  // Returns the current target of this iterator (which might be an explicit
+  // child of the node, default content for an <xbl:children> element or
+  // an inserted child for an <xbl:children> element.
+  nsIContent* Get();
+
+  // The inverse of GetNextChild. Properly steps in and out of <xbl:children>
+  // elements.
+  nsIContent* GetPreviousChild();
+
+  // Looks for aChildToFind respecting XBL insertion points.
+  void Seek(nsIContent* aChildToFind)
+  {
+    // It would be nice to assert that we find aChildToFind, but bz thinks that
+    // we might not find aChildToFind when called from ContentInserted
+    // if first-letter frames are about.
+
+    nsIContent* child;
+    do {
+      child = GetNextChild();
+    } while (child && child != aChildToFind);
+  }
+
+  bool XBLInvolved() { return mXBLInvolved; }
+
+private:
+  // For certain optimizations, nsCSSFrameConstructor needs to know if the
+  // child list of the element that we're iterating matches its .childNodes.
+  bool mXBLInvolved;
+};
+
+} // namespace dom
+} // namespace mozilla
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@ -73,6 +73,7 @@
 #include "nsLayoutUtils.h"
 #include "nsGkAtoms.h"
 #include "nsContentUtils.h"
+#include "ChildIterator.h"

 #include "nsIDOMEventListener.h"
 #include "nsIWebNavigation.h"
@ -94,7 +95,6 @@
 #include "nsView.h"
 #include "nsViewManager.h"
 #include "nsIScrollableFrame.h"
-#include "nsXBLInsertionPoint.h"
 #include "mozilla/css/StyleRule.h" /* For nsCSSSelectorList */
 #include "nsCSSRuleProcessor.h"
 #include "nsRuleProcessorData.h"
@ -909,60 +909,6 @@ Element::HasAttributeNS(const nsAString& aNamespaceURI,
  return HasAttr(nsid, name);
 }

-static nsXBLBinding*
-GetFirstBindingWithContent(nsBindingManager* aBmgr, nsIContent* aBoundElem)
-{
-  nsXBLBinding* binding = aBmgr->GetBinding(aBoundElem);
-  while (binding) {
-    if (binding->GetAnonymousContent()) {
-      return binding;
-    }
-    binding = binding->GetBaseBinding();
-  }
-  
-  return nullptr;
-}
-
-static nsresult
-BindNodesInInsertPoints(nsXBLBinding* aBinding, nsIContent* aInsertParent,
-                        nsIDocument* aDocument)
-{
-  NS_PRECONDITION(aBinding && aInsertParent, "Missing arguments");
-
-  nsresult rv;
-  // These should be refcounted or otherwise protectable.
-  nsInsertionPointList* inserts =
-    aBinding->GetExistingInsertionPointsFor(aInsertParent);
-  if (inserts) {
-    bool allowScripts = aBinding->AllowScripts();
-#ifdef MOZ_XUL
-    nsCOMPtr<nsIXULDocument> xulDoc = do_QueryInterface(aDocument);
-#endif
-    uint32_t i;
-    for (i = 0; i < inserts->Length(); ++i) {
-      nsCOMPtr<nsIContent> insertRoot =
-        inserts->ElementAt(i)->GetDefaultContent();
-      if (insertRoot) {
-        for (nsCOMPtr<nsIContent> child = insertRoot->GetFirstChild();
-             child;
-             child = child->GetNextSibling()) {
-          rv = child->BindToTree(aDocument, aInsertParent,
-                                 aBinding->GetBoundElement(), allowScripts);
-          NS_ENSURE_SUCCESS(rv, rv);
-
-#ifdef MOZ_XUL
-          if (xulDoc) {
-            xulDoc->AddSubtreeToDocument(child);
-          }
-#endif
-        }
-      }
-    }
-  }
-
-  return NS_OK;
-}
-
 already_AddRefed<nsIHTMLCollection>
 Element::GetElementsByClassName(const nsAString& aClassNames)
 {
@ -1104,9 +1050,8 @@ Element::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
  if (hadForceXBL) {
    nsBindingManager* bmgr = OwnerDoc()->BindingManager();

+    nsXBLBinding* contBinding = bmgr->GetBindingWithContent(this);
    // First check if we have a binding...
-    nsXBLBinding* contBinding =
-      GetFirstBindingWithContent(bmgr, this);
    if (contBinding) {
      nsCOMPtr<nsIContent> anonRoot = contBinding->GetAnonymousContent();
      bool allowScripts = contBinding->AllowScripts();
@ -1116,21 +1061,6 @@ Element::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
        rv = child->BindToTree(aDocument, this, this, allowScripts);
        NS_ENSURE_SUCCESS(rv, rv);
      }
-
-      // ...then check if we have content in insertion points that are
-      // direct children of the <content>
-      rv = BindNodesInInsertPoints(contBinding, this, aDocument);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-
-    // ...and finally check if we're in a binding where we have content in
-    // insertion points.
-    if (aBindingParent) {
-      nsXBLBinding* binding = bmgr->GetBinding(aBindingParent);
-      if (binding) {
-        rv = BindNodesInInsertPoints(binding, this, aDocument);
-        NS_ENSURE_SUCCESS(rv, rv);
-      }
    }
  }

@ -1183,15 +1113,13 @@ class RemoveFromBindingManagerRunnable : public nsRunnable {
 public:
  RemoveFromBindingManagerRunnable(nsBindingManager* aManager,
                                   Element* aElement,
-                                   nsIDocument* aDoc,
-                                   nsIContent* aBindingParent):
-    mManager(aManager), mElement(aElement), mDoc(aDoc),
-    mBindingParent(aBindingParent)
+                                   nsIDocument* aDoc):
+    mManager(aManager), mElement(aElement), mDoc(aDoc)
  {}

  NS_IMETHOD Run()
  {
-    mManager->RemovedFromDocumentInternal(mElement, mDoc, mBindingParent);
+    mManager->RemovedFromDocumentInternal(mElement, mDoc);
    return NS_OK;
  }

@ -1199,7 +1127,6 @@ private:
  nsRefPtr<nsBindingManager> mManager;
  nsRefPtr<Element> mElement;
  nsCOMPtr<nsIDocument> mDoc;
-  nsCOMPtr<nsIContent> mBindingParent;
 };

 void
@ -1247,7 +1174,7 @@ Element::UnbindFromTree(bool aDeep, bool aNullParent)
    if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
      nsContentUtils::AddScriptRunner(
        new RemoveFromBindingManagerRunnable(document->BindingManager(), this,
-                                             document, GetBindingParent()));
+                                             document));
    }

    document->ClearBoxObjectFor(this);
@ -2106,44 +2033,36 @@ Element::List(FILE* out, int32_t aIndent,
                                       getter_AddRefs(anonymousChildren));

  if (anonymousChildren) {
-    uint32_t length;
+    uint32_t length = 0;
    anonymousChildren->GetLength(&length);
-    if (length > 0) {
-      for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
-      fputs("anonymous-children<\n", out);

-      for (uint32_t i = 0; i < length; ++i) {
-        nsCOMPtr<nsIDOMNode> node;
-        anonymousChildren->Item(i, getter_AddRefs(node));
-        nsCOMPtr<nsIContent> child = do_QueryInterface(node);
-        child->List(out, aIndent + 1);
-      }
+    for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
+    fputs("anonymous-children<\n", out);

-      for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
-      fputs(">\n", out);
+    for (uint32_t i = 0; i < length; ++i) {
+      nsCOMPtr<nsIDOMNode> node;
+      anonymousChildren->Item(i, getter_AddRefs(node));
+      nsCOMPtr<nsIContent> child = do_QueryInterface(node);
+      child->List(out, aIndent + 1);
    }
-  }

-  if (bindingManager->HasContentListFor(nonConstThis)) {
-    nsCOMPtr<nsIDOMNodeList> contentList;
-    bindingManager->GetContentListFor(nonConstThis,
-                                      getter_AddRefs(contentList));
+    for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
+    fputs(">\n", out);

-    NS_ASSERTION(contentList != nullptr, "oops, binding manager lied");
-    
-    uint32_t length;
-    contentList->GetLength(&length);
-    if (length > 0) {
-      for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
-      fputs("content-list<\n", out);
+    bool outHeader = false;
+    ExplicitChildIterator iter(nonConstThis);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+      if (!outHeader) {
+        outHeader = true;

-      for (uint32_t i = 0; i < length; ++i) {
-        nsCOMPtr<nsIDOMNode> node;
-        contentList->Item(i, getter_AddRefs(node));
-        nsCOMPtr<nsIContent> child = do_QueryInterface(node);
-        child->List(out, aIndent + 1);
+        for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
+        fputs("content-list<\n", out);
      }

+      child->List(out, aIndent + 1);
+    }
+
+    if (outHeader) {
      for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
      fputs(">\n", out);
    }
@ -2708,7 +2627,7 @@ public:
            EncodeTextFragment(u.mTextFragment, aOut);
            break;
          default:
-            MOZ_NOT_REACHED("Unknown unit type?");
+            MOZ_CRASH("Unknown unit type?");
        }
      }
    }
--- a/content/base/src/FragmentOrElement.cpp
+++ b/content/base/src/FragmentOrElement.cpp
@ -94,7 +94,7 @@
 #include "nsView.h"
 #include "nsViewManager.h"
 #include "nsIScrollableFrame.h"
-#include "nsXBLInsertionPoint.h"
+#include "ChildIterator.h"
 #include "mozilla/css/StyleRule.h" /* For nsCSSSelectorList */
 #include "nsRuleProcessorData.h"
 #include "nsAsyncDOMEvent.h"
@ -149,16 +149,15 @@ nsIContent::FindFirstNonChromeOnlyAccessContent() const
 nsIContent*
 nsIContent::GetFlattenedTreeParent() const
 {
-  nsIContent *parent = GetParent();
-  if (parent && parent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
-    nsIDocument *doc = parent->OwnerDoc();
-    nsIContent* insertionElement =
-      doc->BindingManager()->GetNestedInsertionPoint(parent, this);
-    if (insertionElement) {
-      parent = insertionElement;
+  if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
+    nsIContent* parent = OwnerDoc()->BindingManager()->
+      GetInsertionParent(const_cast<nsIContent*>(this));
+    if (parent) {
+      return parent;
    }
  }
-  return parent;
+
+  return GetParent();
 }

 nsIContent::IMEState
@ -653,24 +652,14 @@ FragmentOrElement::GetChildren(uint32_t aFilter)
  // explict content altered by insertion point if we were requested for XBL
  // anonymous content, otherwise append explicit content with respect to
  // insertion point if any.
-  nsINodeList *childList = nullptr;
-
-  nsIDocument* document = OwnerDoc();
  if (!(aFilter & eAllButXBL)) {
-    childList = document->BindingManager()->GetXBLChildNodesFor(this);
-    if (!childList) {
-      childList = ChildNodes();
+    FlattenedChildIterator iter(this);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+      list->AppendElement(child);
    }
-
  } else {
-    childList = document->BindingManager()->GetContentListFor(this);
-  }
-
-  if (childList) {
-    uint32_t length = 0;
-    childList->GetLength(&length);
-    for (uint32_t idx = 0; idx < length; idx++) {
-      nsIContent* child = childList->Item(idx);
+    ExplicitChildIterator iter(this);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
      list->AppendElement(child);
    }
  }
--- a/content/base/src/moz.build
+++ b/content/base/src/moz.build
@ -87,6 +87,7 @@ CPP_SOURCES += [
    'nsCCUncollectableMarker.cpp',
    'nsCSPService.cpp',
    'nsChannelPolicy.cpp',
+    'ChildIterator.cpp',
    'nsContentAreaDragDrop.cpp',
    'nsContentIterator.cpp',
    'nsContentList.cpp',
--- a/content/base/src/nsAttrValue.cpp
+++ b/content/base/src/nsAttrValue.cpp
@ -308,8 +308,7 @@ nsAttrValue::SetTo(const nsAttrValue& aOther)
    }
    case eCSSStyleRule:
    {
-      MOZ_NOT_REACHED("These should be refcounted!");
-      break;
+      MOZ_CRASH("These should be refcounted!");
    }
    case eURL:
    {
--- a/content/base/src/nsContentIterator.cpp
+++ b/content/base/src/nsContentIterator.cpp
@ -1452,5 +1452,5 @@ nsContentSubtreeIterator::GetTopAncestorInRange(nsINode* aNode)
    content = parent;
  }

-  MOZ_NOT_REACHED("This should only be possible if aNode was null");
+  MOZ_CRASH("This should only be possible if aNode was null");
 }
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@ -6100,11 +6100,17 @@ nsContentUtils::SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
  if (aForceOwner || ((NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherit)) &&
      (inherit || (aSetUpForAboutBlank && NS_IsAboutBlank(aURI)))))) {
 #ifdef DEBUG
-    // Assert that aForceOwner is only set for null principals
+    // Assert that aForceOwner is only set for null principals for non-srcdoc
+    // loads.  (Strictly speaking not all uses of about:srcdoc would be 
+    // srcdoc loads, but the URI is non-resolvable in cases where it is not).
    if (aForceOwner) {
-      nsCOMPtr<nsIURI> ownerURI;
-      nsresult rv = aLoadingPrincipal->GetURI(getter_AddRefs(ownerURI));
-      MOZ_ASSERT(NS_SUCCEEDED(rv) && SchemeIs(ownerURI, NS_NULLPRINCIPAL_SCHEME));
+      nsAutoCString uriStr;
+      aURI->GetSpec(uriStr);
+      if(!uriStr.EqualsLiteral("about:srcdoc")) {
+        nsCOMPtr<nsIURI> ownerURI;
+        nsresult rv = aLoadingPrincipal->GetURI(getter_AddRefs(ownerURI));
+        MOZ_ASSERT(NS_SUCCEEDED(rv) && SchemeIs(ownerURI, NS_NULLPRINCIPAL_SCHEME));
+      }
    }
 #endif
    aChannel->SetOwner(aLoadingPrincipal);
@ -6287,9 +6293,6 @@ nsContentUtils::ReleaseWrapper(void* aScriptObjectHolder,
    JSObject* obj = aCache->GetWrapperPreserveColor();
    if (aCache->IsDOMBinding() && obj && js::IsProxy(obj)) {
        DOMProxyHandler::GetAndClearExpandoObject(obj);
-        if (!aCache->PreservingWrapper()) {
-          return;
-        }
    }
    aCache->SetPreservingWrapper(false);
    DropJSObjects(aScriptObjectHolder);
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@ -2420,6 +2420,14 @@ nsDocument::StartDocumentLoad(const char* aCommand, nsIChannel* aChannel,
  RetrieveRelevantHeaders(aChannel);

  mChannel = aChannel;
+  nsCOMPtr<nsIInputStreamChannel> inStrmChan = do_QueryInterface(mChannel);
+  if (inStrmChan) {
+    bool isSrcdocChannel;
+    inStrmChan->GetIsSrcdocChannel(&isSrcdocChannel);
+    if (isSrcdocChannel) {
+      mIsSrcdocDocument = true;
+    }
+  }

  // If this document is being loaded by a docshell, copy its sandbox flags
  // to the document. These are immutable after being set here.
@ -3000,7 +3008,23 @@ nsDocument::GetReferrer(nsAString& aReferrer)
 void
 nsIDocument::GetReferrer(nsAString& aReferrer) const
 {
-  CopyUTF8toUTF16(mReferrer, aReferrer);
+  if (mIsSrcdocDocument && mParentDocument)
+      mParentDocument->GetReferrer(aReferrer);
+  else
+    CopyUTF8toUTF16(mReferrer, aReferrer);
+}
+
+nsresult
+nsIDocument::GetSrcdocData(nsAString &aSrcdocData)
+{
+  if (mIsSrcdocDocument) {
+    nsCOMPtr<nsIInputStreamChannel> inStrmChan = do_QueryInterface(mChannel);
+    if (inStrmChan) {
+      return inStrmChan->GetSrcdocData(aSrcdocData);
+    }
+  }
+  aSrcdocData = NullString();
+  return NS_OK;
 }

 NS_IMETHODIMP
@ -6169,18 +6193,6 @@ nsDocument::ClearBoxObjectFor(nsIContent* aContent)
  }
 }

-nsresult
-nsDocument::GetXBLChildNodesFor(nsIContent* aContent, nsIDOMNodeList** aResult)
-{
-  return BindingManager()->GetXBLChildNodesFor(aContent, aResult);
-}
-
-nsresult
-nsDocument::GetContentListFor(nsIContent* aContent, nsIDOMNodeList** aResult)
-{
-  return BindingManager()->GetContentListFor(aContent, aResult);
-}
-
 void
 nsDocument::FlushSkinBindings()
 {
@ -8474,8 +8486,7 @@ nsDocument::MaybePreLoadImage(nsIURI* uri, const nsAString &aCrossOriginAttr)
    loadFlags |= imgILoader::LOAD_CORS_USE_CREDENTIALS;
    break;
  default:
-    /* should never happen */
-    MOZ_NOT_REACHED("Unknown CORS mode!");
+    MOZ_CRASH("Unknown CORS mode!");
  }

  // Image not in cache - trigger preload
@ -11148,8 +11159,7 @@ nsDocument::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
  // nsDocuments can only appear at the top of the DOM tree, and we use the
  // specialized DocSizeOfExcludingThis() in that case.  So this should never
  // be called.
-  MOZ_NOT_REACHED("nsDocument::SizeOfExcludingThis");
-  return 0;
+  MOZ_CRASH();
 }

 void
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@ -818,10 +818,6 @@ public:
  already_AddRefed<nsIBoxObject> GetBoxObjectFor(mozilla::dom::Element* aElement,
                                                 mozilla::ErrorResult& aRv) MOZ_OVERRIDE;

-  virtual NS_HIDDEN_(nsresult) GetXBLChildNodesFor(nsIContent* aContent,
-                                                   nsIDOMNodeList** aResult);
-  virtual NS_HIDDEN_(nsresult) GetContentListFor(nsIContent* aContent,
-                                                 nsIDOMNodeList** aResult);
  virtual NS_HIDDEN_(Element*)
    GetAnonymousElementByAttribute(nsIContent* aElement,
                                   nsIAtom* aAttrName,
@ -1294,9 +1290,6 @@ protected:

  nsInterfaceHashtable<nsPtrHashKey<nsIContent>, nsPIBoxObject> *mBoxObjectTable;

-  // The channel that got passed to StartDocumentLoad(), if any
-  nsCOMPtr<nsIChannel> mChannel;
-
  // A document "without a browsing context" that owns the content of
  // HTMLTemplateElement.
  nsCOMPtr<nsIDocument> mTemplateContentsOwner;
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@ -312,21 +312,28 @@ nsFrameLoader::LoadFrame()
  NS_ENSURE_TRUE(mOwnerContent, NS_ERROR_NOT_INITIALIZED);

  nsAutoString src;
-  GetURL(src);

-  src.Trim(" \t\n\r");
+  bool isSrcdoc = mOwnerContent->IsHTML(nsGkAtoms::iframe) &&
+                  mOwnerContent->HasAttr(kNameSpaceID_None, nsGkAtoms::srcdoc);
+  if (isSrcdoc) {
+    src.AssignLiteral("about:srcdoc");
+  }
+  else {
+    GetURL(src);

-  if (src.IsEmpty()) {
-    // If the frame is a XUL element and has the attribute 'nodefaultsrc=true'
-    // then we will not use 'about:blank' as fallback but return early without
-    // starting a load if no 'src' attribute is given (or it's empty).
-    if (mOwnerContent->IsXUL() &&
-        mOwnerContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::nodefaultsrc,
-                                   nsGkAtoms::_true, eCaseMatters)) {
-      return NS_OK;
+    src.Trim(" \t\n\r");
+
+    if (src.IsEmpty()) {
+      // If the frame is a XUL element and has the attribute 'nodefaultsrc=true'
+      // then we will not use 'about:blank' as fallback but return early without
+      // starting a load if no 'src' attribute is given (or it's empty).
+      if (mOwnerContent->IsXUL() &&
+          mOwnerContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::nodefaultsrc,
+                                     nsGkAtoms::_true, eCaseMatters)) {
+        return NS_OK;
+      }
+      src.AssignLiteral("about:blank");
    }
-
-    src.AssignLiteral("about:blank");
  }

  nsIDocument* doc = mOwnerContent->OwnerDoc();
@ -472,8 +479,23 @@ nsFrameLoader::ReallyStartLoadingInternal()
  loadInfo->SetOwner(mOwnerContent->NodePrincipal());

  nsCOMPtr<nsIURI> referrer;
-  rv = mOwnerContent->NodePrincipal()->GetURI(getter_AddRefs(referrer));
-  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsAutoString srcdoc;
+  bool isSrcdoc = mOwnerContent->IsHTML(nsGkAtoms::iframe) &&
+                  mOwnerContent->GetAttr(kNameSpaceID_None, nsGkAtoms::srcdoc,
+                                         srcdoc);
+
+  if (isSrcdoc) {
+    nsAutoString referrerStr;
+    mOwnerContent->OwnerDoc()->GetReferrer(referrerStr);
+    rv = NS_NewURI(getter_AddRefs(referrer), referrerStr);
+
+    loadInfo->SetSrcdocData(srcdoc);
+  }
+  else {
+    rv = mOwnerContent->NodePrincipal()->GetURI(getter_AddRefs(referrer));
+    NS_ENSURE_SUCCESS(rv, rv);
+  }

  loadInfo->SetReferrer(referrer);

--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@ -993,6 +993,7 @@ GK_ATOM(splitmenu, "splitmenu")
 GK_ATOM(splitter, "splitter")
 GK_ATOM(spring, "spring")
 GK_ATOM(src, "src")
+GK_ATOM(srcdoc, "srcdoc")
 GK_ATOM(srclang, "srclang")
 GK_ATOM(stack, "stack")
 GK_ATOM(standalone, "standalone")
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@ -93,7 +93,6 @@
 #include "nsTextNode.h"
 #include "nsUnicharUtils.h"
 #include "nsXBLBinding.h"
-#include "nsXBLInsertionPoint.h"
 #include "nsXBLPrototypeBinding.h"
 #include "prprf.h"
 #include "xpcpublic.h"
@ -1194,8 +1193,7 @@ nsINode::UnoptimizableCCNode() const
  const uintptr_t problematicFlags = (NODE_IS_ANONYMOUS |
                                      NODE_IS_IN_ANONYMOUS_SUBTREE |
                                      NODE_IS_NATIVE_ANONYMOUS_ROOT |
-                                      NODE_MAY_BE_IN_BINDING_MNGR |
-                                      NODE_IS_INSERTION_PARENT);
+                                      NODE_MAY_BE_IN_BINDING_MNGR);
  return HasFlag(problematicFlags) ||
         NodeType() == nsIDOMNode::ATTRIBUTE_NODE ||
         // For strange cases like xbl:content/xbl:children
--- a/content/base/src/nsNameSpaceManager.cpp
+++ b/content/base/src/nsNameSpaceManager.cpp
@ -17,6 +17,8 @@
 #include "nsContentCreatorFunctions.h"
 #include "nsDataHashtable.h"
 #include "nsString.h"
+#include "nsINodeInfo.h"
+#include "nsXBLChildrenElement.h"

 using namespace mozilla;
 using namespace mozilla::dom;
@ -202,6 +204,10 @@ NS_NewElement(nsIContent** aResult,
  if (ns == kNameSpaceID_SVG) {
    return NS_NewSVGElement(aResult, aNodeInfo, aFromParser);
  }
+  if (ns == kNameSpaceID_XBL && aNodeInfo.get()->Equals(nsGkAtoms::children)) {
+    NS_ADDREF(*aResult = new nsXBLChildrenElement(aNodeInfo));
+    return NS_OK;
+  }
  return NS_NewXMLElement(aResult, aNodeInfo);
 }

--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@ -2993,8 +2993,7 @@ nsObjectLoadingContent::ShouldPlay(FallbackType &aReason, bool aIgnoreCurrentTyp
  case nsIPluginTag::STATE_CLICKTOPLAY:
    return false;
  }
-  MOZ_NOT_REACHED("Unexpected enabledState");
-  return false;
+  MOZ_CRASH("Unexpected enabledState");
 }

 nsIDocument*
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@ -1318,7 +1318,7 @@ WrapStyle(JSContext* cx, JSObject* objArg,
      break;
    }
    default:
-      MOZ_NOT_REACHED("unexpected CanvasMultiGetterType");
+      MOZ_CRASH("unexpected CanvasMultiGetterType");
  }
  if (!ok) {
    error.Throw(NS_ERROR_FAILURE);
@ -2079,6 +2079,9 @@ CanvasRenderingContext2D::SetFont(const nsAString& font,
    return;
  }

+  // add a rule to prevent text zoom from affecting the style
+  rules.AppendElement(new nsDisableTextZoomStyleRule);
+
  nsRefPtr<nsStyleContext> sc =
      styleSet->ResolveStyleForRules(parentContext, rules);
  if (!sc) {
@ -2097,21 +2100,20 @@ CanvasRenderingContext2D::SetFont(const nsAString& font,

  // use CSS pixels instead of dev pixels to avoid being affected by page zoom
  const uint32_t aupcp = nsPresContext::AppUnitsPerCSSPixel();
-  // un-zoom the font size to avoid being affected by text-only zoom
-  //
-  // Purposely ignore the font size that respects the user's minimum
-  // font preference (fontStyle->mFont.size) in favor of the computed
-  // size (fontStyle->mSize).  See
-  // https://bugzilla.mozilla.org/show_bug.cgi?id=698652.
-  const nscoord fontSize = nsStyleFont::UnZoomText(parentContext->PresContext(), fontStyle->mSize);

  bool printerFont = (presShell->GetPresContext()->Type() == nsPresContext::eContext_PrintPreview ||
                      presShell->GetPresContext()->Type() == nsPresContext::eContext_Print);

+  // Purposely ignore the font size that respects the user's minimum
+  // font preference (fontStyle->mFont.size) in favor of the computed
+  // size (fontStyle->mSize).  See
+  // https://bugzilla.mozilla.org/show_bug.cgi?id=698652.
+  MOZ_ASSERT(!fontStyle->mAllowZoom,
+             "expected text zoom to be disabled on this nsStyleFont");
  gfxFontStyle style(fontStyle->mFont.style,
                     fontStyle->mFont.weight,
                     fontStyle->mFont.stretch,
-                     NSAppUnitsToFloatPixels(fontSize, float(aupcp)),
+                     NSAppUnitsToFloatPixels(fontStyle->mSize, float(aupcp)),
                     language,
                     fontStyle->mFont.sizeAdjust,
                     fontStyle->mFont.systemFont,
@ -2638,7 +2640,7 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
    anchorY = -fontMetrics.emDescent;
    break;
  default:
-      MOZ_NOT_REACHED("unexpected TextBaseline");
+    MOZ_CRASH("unexpected TextBaseline");
  }

  processor.mPt.y += anchorY;
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@ -5509,17 +5509,14 @@ WebGLTexelFormat mozilla::GetWebGLTexelFormat(GLenum format, GLenum type)
            case LOCAL_GL_UNSIGNED_INT:
                return WebGLTexelConversions::D32;
            default:
-                MOZ_NOT_REACHED("Invalid WebGL texture format/type?");
-                return WebGLTexelConversions::BadFormat;
+                MOZ_CRASH("Invalid WebGL texture format/type?");
        }
    } else if (format == LOCAL_GL_DEPTH_STENCIL) {
        switch (type) {
            case LOCAL_GL_UNSIGNED_INT_24_8_EXT:
                return WebGLTexelConversions::D24S8;
            default:
-                MOZ_NOT_REACHED("Invalid WebGL texture format/type?");
-                NS_ABORT_IF_FALSE(false, "Coding mistake?! Should never reach this point.");
-                return WebGLTexelConversions::BadFormat;
+                MOZ_CRASH("Invalid WebGL texture format/type?");
        }
    }

--- a/content/canvas/src/WebGLFramebuffer.cpp
+++ b/content/canvas/src/WebGLFramebuffer.cpp
@ -118,7 +118,7 @@ WebGLFramebuffer::Attachment::IsComplete() const {
                    format == LOCAL_GL_RGB ||
                    format == LOCAL_GL_RGBA);
        }
-        MOZ_NOT_REACHED("Invalid WebGL attachment poin?");
+        MOZ_CRASH("Invalid WebGL attachment poin?");
    }

    if (mRenderbufferPtr) {
@ -139,7 +139,7 @@ WebGLFramebuffer::Attachment::IsComplete() const {
                    format == LOCAL_GL_RGB5_A1 ||
                    format == LOCAL_GL_RGBA4);
        }
-        MOZ_NOT_REACHED("Invalid WebGL attachment poin?");
+        MOZ_CRASH("Invalid WebGL attachment poin?");
    }

    NS_ABORT(); // should never get there
--- a/content/events/src/TextComposition.cpp
+++ b/content/events/src/TextComposition.cpp
@ -140,8 +140,7 @@ TextComposition::CompositionEventDispatcher::Run()
      break;
    }
    default:
-      MOZ_NOT_REACHED("Unsupported event");
-      break;
+      MOZ_CRASH("Unsupported event");
  }
  return NS_OK;
 }
--- a/content/events/src/nsDOMMouseEvent.cpp
+++ b/content/events/src/nsDOMMouseEvent.cpp
@ -141,8 +141,7 @@ nsDOMMouseEvent::InitMouseEvent(const nsAString& aType,
      static_cast<nsInputEvent*>(mEvent)->modifiers = modifiers;
      return NS_OK;
    default:
-      MOZ_NOT_REACHED("There is no space to store the modifiers");
-      return NS_ERROR_FAILURE;
+      MOZ_CRASH("There is no space to store the modifiers");
  }
 }

@ -242,8 +241,7 @@ nsDOMMouseEvent::Buttons()
    case NS_SIMPLE_GESTURE_EVENT:
      return static_cast<nsMouseEvent_base*>(mEvent)->buttons;
    default:
-      MOZ_NOT_REACHED("Tried to get mouse buttons for non-mouse event!");
-      return 0;
+      MOZ_CRASH("Tried to get mouse buttons for non-mouse event!");
  }
 }

--- a/content/events/src/nsDOMUIEvent.cpp
+++ b/content/events/src/nsDOMUIEvent.cpp
@ -362,7 +362,7 @@ nsDOMUIEvent::IsChar() const
    default:
      return false;
  }
-  MOZ_NOT_REACHED("Switch handles all cases.");
+  MOZ_CRASH("Switch handles all cases.");
 }

 NS_IMETHODIMP
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@ -1495,8 +1495,7 @@ nsEventStateManager::DispatchCrossProcessEvent(nsEvent* aEvent,
    return remote->SendRealTouchEvent(*touchEvent);
  }
  default: {
-    MOZ_NOT_REACHED("Attempt to send non-whitelisted event?");
-    return false;
+    MOZ_CRASH("Attempt to send non-whitelisted event?");
  }
  }
 }
@ -2520,8 +2519,7 @@ nsEventStateManager::DispatchLegacyMouseScrollEvents(nsIFrame* aTargetFrame,
      break;

    default:
-      MOZ_NOT_REACHED("Invalid deltaMode value comes");
-      return;
+      MOZ_CRASH("Invalid deltaMode value comes");
  }

  // Send the legacy events in following order:
@ -2847,8 +2845,7 @@ nsEventStateManager::DoScrollText(nsIScrollableFrame* aScrollableFrame,
      origin = nsGkAtoms::pixels;
      break;
    default:
-      MOZ_NOT_REACHED("Invalid deltaMode value comes");
-      return;
+      MOZ_CRASH("Invalid deltaMode value comes");
  }

  // We shouldn't scroll more one page at once except when over one page scroll
@ -2892,8 +2889,7 @@ nsEventStateManager::DoScrollText(nsIScrollableFrame* aScrollableFrame,
      mode = nsIScrollableFrame::SMOOTH;
      break;
    default:
-      MOZ_NOT_REACHED("Invalid scrollType value comes");
-      return;
+      MOZ_CRASH("Invalid scrollType value comes");
  }

  nsIntPoint overflow;
--- a/content/events/src/nsIMEStateManager.cpp
+++ b/content/events/src/nsIMEStateManager.cpp
@ -587,10 +587,9 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
      case REQUEST_TO_CANCEL_COMPOSITION:
        return composition ? aWidget->NotifyIME(aNotification) : NS_OK;
      default:
-        MOZ_NOT_REACHED("Unsupported notification");
-        return NS_ERROR_INVALID_ARG;
+        MOZ_CRASH("Unsupported notification");
    }
-    MOZ_NOT_REACHED(
+    MOZ_CRASH(
      "Failed to handle the notification for non-synthesized composition");
  }

@ -1049,8 +1048,7 @@ nsIMEStateManager::IsEditableIMEState(nsIWidget* aWidget)
    case widget::IMEState::DISABLED:
      return false;
    default:
-      MOZ_NOT_REACHED("Unknown IME enable state");
-      return false;
+      MOZ_CRASH("Unknown IME enable state");
  }
 }

--- a/content/html/content/src/HTMLIFrameElement.cpp
+++ b/content/html/content/src/HTMLIFrameElement.cpp
@ -55,6 +55,7 @@ NS_IMPL_URI_ATTR(HTMLIFrameElement, Src, src)
 NS_IMPL_STRING_ATTR(HTMLIFrameElement, Width, width)
 NS_IMPL_BOOL_ATTR(HTMLIFrameElement, AllowFullscreen, allowfullscreen)
 NS_IMPL_STRING_ATTR(HTMLIFrameElement, Sandbox, sandbox)
+NS_IMPL_STRING_ATTR(HTMLIFrameElement, Srcdoc, srcdoc)

 void
 HTMLIFrameElement::GetItemValueText(nsAString& aValue)
@ -198,6 +199,24 @@ HTMLIFrameElement::GetAttributeMappingFunction() const
  return &MapAttributesIntoRule;
 }

+nsresult
+HTMLIFrameElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                           nsIAtom* aPrefix, const nsAString& aValue,
+                           bool aNotify)
+{
+  nsresult rv = nsGenericHTMLFrameElement::SetAttr(aNameSpaceID, aName,
+                                                   aPrefix, aValue, aNotify);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::srcdoc) {
+    // Don't propagate error here. The attribute was successfully set, that's
+    // what we should reflect.
+    LoadSrc();
+  }
+
+  return NS_OK;
+}
+
 nsresult
 HTMLIFrameElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                const nsAttrValue* aValue,
@ -227,6 +246,23 @@ HTMLIFrameElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                            aNotify);
 }

+nsresult
+HTMLIFrameElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                             bool aNotify)
+{
+  // Invoke on the superclass.
+  nsresult rv = nsGenericHTMLFrameElement::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (aNameSpaceID == kNameSpaceID_None &&
+      aAttribute == nsGkAtoms::srcdoc) {
+    // Fall back to the src attribute, if any
+    LoadSrc();
+  }
+
+  return NS_OK;
+}
+
 uint32_t
 HTMLIFrameElement::GetSandboxFlags()
 {
--- a/content/html/content/src/HTMLIFrameElement.h
+++ b/content/html/content/src/HTMLIFrameElement.h
@ -49,9 +49,19 @@ public:
  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const MOZ_OVERRIDE;
  virtual nsIDOMNode* AsDOMNode() MOZ_OVERRIDE { return this; }

+  nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                   const nsAString& aValue, bool aNotify)
+  {
+    return SetAttr(aNameSpaceID, aName, nullptr, aValue, aNotify);
+  }
+  virtual nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                           nsIAtom* aPrefix, const nsAString& aValue,
+                           bool aNotify) MOZ_OVERRIDE;
  virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                const nsAttrValue* aValue,
                                bool aNotify) MOZ_OVERRIDE;
+  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                             bool aNotify) MOZ_OVERRIDE;

  uint32_t GetSandboxFlags();

@ -61,6 +71,14 @@ public:
  {
    SetHTMLAttr(nsGkAtoms::src, aSrc, aError);
  }
+  void GetSrcdoc(DOMString& aSrcdoc)
+  {
+    GetHTMLAttr(nsGkAtoms::srcdoc, aSrcdoc);
+  }
+  void SetSrcdoc(const nsAString& aSrcdoc, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::srcdoc, aSrcdoc, aError);
+  }
  void GetName(DOMString& aName)
  {
    GetHTMLAttr(nsGkAtoms::name, aName);
--- a/content/html/content/src/nsGenericHTMLFrameElement.cpp
+++ b/content/html/content/src/nsGenericHTMLFrameElement.cpp
@ -229,7 +229,9 @@ nsGenericHTMLFrameElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                              aValue, aNotify);
  NS_ENSURE_SUCCESS(rv, rv);

-  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
+  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src &&
+      (Tag() != nsGkAtoms::iframe || 
+       !HasAttr(kNameSpaceID_None,nsGkAtoms::srcdoc))) {
    // Don't propagate error here. The attribute was successfully set, that's
    // what we should reflect.
    LoadSrc();
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@ -386,6 +386,10 @@ MOCHITEST_FILES = \
 		test_bug885024.html \
 		test_track.html \
 		test_track_disabled.html \
+		test_srcdoc.html \
+		file_srcdoc.html \
+		test_srcdoc-2.html \
+		file_srcdoc-2.html \
 		$(NULL)

 MOCHITEST_CHROME_FILES = \
--- a/content/html/content/test/file_srcdoc-2.html
+++ b/content/html/content/test/file_srcdoc-2.html
@ -0,0 +1,10 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+<body>
+<iframe id="iframe" srcdoc="Hello World"></iframe>
+</body>
+
+</html>
--- a/content/html/content/test/file_srcdoc.html
+++ b/content/html/content/test/file_srcdoc.html
@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+<body>
+<iframe id="iframe" srcdoc="Hello World"></iframe>
+    
+<iframe id="iframe1" src="about:mozilla" 
+    srcdoc="Goodbye World"></iframe>
+<iframe id="iframe2" srcdoc="Peeking test" sandbox=""></iframe>
+<iframe id="iframe3" src="data:text/html;charset=US-ASCII,Gone" 
+    srcdoc="Going"></iframe>
+</body>
+
+</html>
--- a/content/html/content/test/test_srcdoc-2.html
+++ b/content/html/content/test/test_srcdoc-2.html
@ -0,0 +1,57 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+    <head>
+<title>Test session history for srcdoc iframes introduced in bug 802895</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+
+<link rel="stylesheet" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=802895">Mozilla Bug 802895</a>
+
+<iframe id="pframe" name="pframe" src="file_srcdoc-2.html"></iframe>
+<pre id="test">
+<script>
+
+  SimpleTest.waitForExplicitFinish();
+  var pframe = $("pframe");
+
+  //disable bfcache
+  pframe.contentWindow.addEventListener("unload", function () { }, false);
+
+  var loadState = 0;
+  pframe.onload = function () {
+    SimpleTest.executeSoon(function () {
+
+      var pDoc = pframe.contentDocument;
+
+      if (loadState == 0) {
+        var div = pDoc.createElement("div");
+        div.id = "modifyCheck";
+        div.innerHTML = "hello again";
+        pDoc.body.appendChild(div);
+        ok(pDoc.getElementById("modifyCheck"), "Child element not created");
+        pframe.src = "about:blank";
+        loadState = 1;
+      }
+      else if (loadState == 1) {
+        loadState = 2;
+        window.history.back();
+      }
+      else if (loadState == 2) {
+        ok(!pDoc.getElementById("modifyCheck"), "modifyCheck element shouldn't be present");
+        is(pDoc.getElementById("iframe").contentDocument.body.innerHTML,
+           "Hello World", "srcdoc iframe not present");
+        SimpleTest.finish();
+      }
+
+    })
+  };
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/html/content/test/test_srcdoc.html
+++ b/content/html/content/test/test_srcdoc.html
@ -0,0 +1,117 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+    <head>
+<title>Tests for srcdoc iframes introduced in bug 802895</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=802895">Mozilla Bug 802895</a>
+
+<iframe id="pframe" src="file_srcdoc.html"></iframe>
+
+<pre id="test">
+<script>
+
+  SimpleTest.waitForExplicitFinish();
+  var pframe = $("pframe");
+
+  var loadState = 0;
+  pframe.contentWindow.addEventListener("load", function () {
+
+    var pframeDoc = pframe.contentDocument;
+
+    var iframe = pframeDoc.getElementById("iframe");
+    var innerDoc = iframe.contentDocument;
+    var iframe1 = pframeDoc.getElementById("iframe1");
+    var innerDoc1 = iframe1.contentDocument;
+
+    var finish = false;
+    var finish1 = false;
+    var finish3 = false;
+
+
+
+    is(iframe.srcdoc, "Hello World", "Bad srcdoc attribute contents")
+
+    is(innerDoc.domain, document.domain, "Wrong domain");
+    is(innerDoc.referrer, pframeDoc.referrer, "Wrong referrer");
+    is(innerDoc.body.innerHTML, "Hello World", "Wrong body");
+    is(innerDoc.compatMode, "CSS1Compat", "Not standards compliant");
+
+    is(innerDoc1.domain, document.domain, "Wrong domain with src attribute");
+    is(innerDoc1.referrer, pframeDoc.referrer, "Wrong referrer with src attribute");
+    is(innerDoc1.body.innerHTML, "Goodbye World", "Wrong body with src attribute")
+    is(innerDoc1.compatMode, "CSS1Compat", "Not standards compliant with src attribute");
+
+    var iframe2 = pframeDoc.getElementById("iframe2");
+    var innerDoc2 = iframe2.contentDocument;
+    try {
+      innerDoc2.domain;
+      foundError = false;
+    }
+    catch (error) {
+      foundError = true;
+    }
+    ok(foundError, "srcdoc iframe not sandboxed");
+
+    //Test changed srcdoc attribute
+    iframe.onload = function () {
+
+      iframe = pframeDoc.getElementById("iframe");
+      innerDoc = iframe.contentDocument;
+
+      is(iframe.srcdoc, "Hello again", "Bad srcdoc attribute contents with srcdoc attribute changed");
+      is(innerDoc.domain, document.domain, "Wrong domain with srcdoc attribute changed");
+      is(innerDoc.referrer, pframeDoc.referrer, "Wrong referrer with srcdoc attribute changed");
+      is(innerDoc.body.innerHTML, "Hello again", "Wrong body with srcdoc attribute changed");
+      is(innerDoc.compatMode, "CSS1Compat", "Not standards compliant with srcdoc attribute changed");
+
+      finish = true;
+      if (finish && finish1 && finish3) {
+        SimpleTest.finish();
+      }
+    };
+
+    iframe.srcdoc = "Hello again";
+
+    var iframe3 = pframeDoc.getElementById("iframe3");
+
+    // Test srcdoc attribute removal
+    iframe3.onload = function () {
+      var innerDoc3 = iframe3.contentDocument;
+      is(innerDoc3.body.innerHTML, "Gone", "Bad srcdoc attribute removal");
+      finish3 = true;
+      if (finish && finish1 && finish3) {
+        SimpleTest.finish();
+      }
+    }
+
+    iframe3.removeAttribute("srcdoc");
+
+
+    var iframe1load = false;
+    iframe1.onload = function () {
+      iframe1load = true;
+    }
+
+    iframe1.src = "data:text/plain;charset=US-ASCII,Goodbyeeee";
+
+    // Need to test that changing the src doesn't change the iframe.
+    setTimeout(function () {
+      ok(!iframe1load, "Changing src attribute shouldn't cause a load when srcdoc is set");
+      finish1 = true;
+      if (finish && finish1 && finish3) {
+        SimpleTest.finish();
+      }
+    }, 2000);
+
+  }, false);
+
+</script>
+</pre>
+</body>
+</html>
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@ -662,22 +662,18 @@ SinkContext::OpenContainer(const nsIParserNode& aNode)
  // Special handling for certain tags
  switch (nodeType) {
    case eHTMLTag_form:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for forms.");

    case eHTMLTag_frameset:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for frames.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for frames.");

    case eHTMLTag_noembed:
    case eHTMLTag_noframes:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for noembed/noframes.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for noembed/noframes.");

    case eHTMLTag_script:
    case eHTMLTag_style:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for styles and scripts.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for styles and scripts.");

    case eHTMLTag_button:
    case eHTMLTag_audio:
@ -783,12 +779,10 @@ SinkContext::CloseContainer(const nsHTMLTag aTag)
  switch (nodeType) {
  case eHTMLTag_noembed:
  case eHTMLTag_noframes:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for noembed/noframes.");
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink for noembed/noframes.");

  case eHTMLTag_form:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink for forms.");

  case eHTMLTag_video:
  case eHTMLTag_audio:
@ -801,14 +795,10 @@ SinkContext::CloseContainer(const nsHTMLTag aTag)
    break;

  case eHTMLTag_script:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink to run scripts.");
-    result = NS_ERROR_NOT_IMPLEMENTED;
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink to run scripts.");

  case eHTMLTag_style:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for styles.");
-    result = NS_ERROR_NOT_IMPLEMENTED;
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink for styles.");

  default:
    break;
@ -855,9 +845,7 @@ SinkContext::AddLeaf(const nsIParserNode& aNode)
      // Additional processing needed once the element is in the tree
      switch (nodeType) {
      case eHTMLTag_meta:
-        MOZ_NOT_REACHED("Must not use HTMLContentSink for metas.");
-        rv = NS_ERROR_NOT_IMPLEMENTED;
-        break;
+        MOZ_CRASH("Must not use HTMLContentSink for metas.");

      case eHTMLTag_input:
        content->DoneCreatingElement();
@ -1751,9 +1739,8 @@ HTMLContentSink::OpenContainer(const nsIParserNode& aNode)

  switch (aNode.GetNodeType()) {
    case eHTMLTag_frameset:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for frames.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for frames.");
+
    case eHTMLTag_head:
      rv = OpenHeadContext();
      if (NS_SUCCEEDED(rv)) {
@ -1776,9 +1763,8 @@ HTMLContentSink::OpenContainer(const nsIParserNode& aNode)
      }
      break;
    case eHTMLTag_form:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for forms.");
+
    default:
      rv = mCurrentContext->OpenContainer(aNode);
      break;
@ -1794,9 +1780,8 @@ HTMLContentSink::CloseContainer(const eHTMLTags aTag)

  switch (aTag) {
    case eHTMLTag_frameset:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for frames.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for frames.");
+
    case eHTMLTag_head:
      CloseHeadContext();
      break;
@ -1807,9 +1792,8 @@ HTMLContentSink::CloseContainer(const eHTMLTags aTag)
      rv = CloseHTML();
      break;
    case eHTMLTag_form:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for forms.");
+
    default:
      rv = mCurrentContext->CloseContainer(aTag);
      break;
@ -1832,10 +1816,8 @@ HTMLContentSink::AddLeaf(const nsIParserNode& aNode)
  nsHTMLTag nodeType = nsHTMLTag(aNode.GetNodeType());
  switch (nodeType) {
  case eHTMLTag_link:
-    rv = NS_ERROR_NOT_IMPLEMENTED;
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for links.");
+    MOZ_CRASH("Must not use HTMLContentSink for links.");

-    break;
  default:
    rv = mCurrentContext->AddLeaf(aNode);

--- a/content/media/DOMMediaStream.cpp
+++ b/content/media/DOMMediaStream.cpp
@ -255,8 +255,7 @@ DOMMediaStream::CreateDOMTrack(TrackID aTrackID, MediaSegment::Type aType)
    mTrackTypesAvailable |= HINT_CONTENTS_VIDEO;
    break;
  default:
-    MOZ_NOT_REACHED("Unhandled track type");
-    return nullptr;
+    MOZ_CRASH("Unhandled track type");
  }
  mTracks.AppendElement(track);

--- a/content/media/MediaStreamGraph.cpp
+++ b/content/media/MediaStreamGraph.cpp
@ -1837,8 +1837,7 @@ MediaStream::ApplyTrackDisabling(TrackID aTrackID, MediaSegment* aSegment)
    break;
  }
  default:
-    MOZ_NOT_REACHED("Unknown track type");
-    break;
+    MOZ_CRASH("Unknown track type");
  }
 }

--- a/content/media/encoder/MediaEncoder.cpp
+++ b/content/media/encoder/MediaEncoder.cpp
@ -233,8 +233,7 @@ MediaEncoder::GetEncodedData(nsTArray<nsTArray<uint8_t> >* aOutputBufs,
      break;

    default:
-      MOZ_NOT_REACHED("Invalid encode state");
-      break;
+      MOZ_CRASH("Invalid encode state");
    }
  }
 }
--- a/content/media/encoder/OpusTrackEncoder.cpp
+++ b/content/media/encoder/OpusTrackEncoder.cpp
@ -220,8 +220,7 @@ OpusTrackEncoder::GetHeader(nsTArray<uint8_t>* aOutput)
    // No more headers.
    break;
  default:
-    MOZ_NOT_REACHED("Invalid state");
-    break;
+    MOZ_CRASH("Invalid state");
  }
  return NS_OK;
 }
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@ -1,4 +1,4 @@
-load 459439-1.html
+skip-if(B2G) load 459439-1.html # bug 888557
 load 466607-1.html
 load 466945-1.html
 load 468763-1.html
--- a/content/media/webaudio/AudioBuffer.cpp
+++ b/content/media/webaudio/AudioBuffer.cpp
@ -164,7 +164,13 @@ ThreadSharedFloatArrayBufferList*
 AudioBuffer::GetThreadSharedChannelsForRate(JSContext* aJSContext)
 {
  if (!mSharedChannels) {
-    // Steal JS data
+    for (uint32_t i = 0; i < mJSChannels.Length(); ++i) {
+      if (mLength != JS_GetTypedArrayLength(mJSChannels[i])) {
+        // Probably one of the arrays was neutered
+        return nullptr;
+      }
+    }
+
    mSharedChannels =
      StealJSArrayDataIntoThreadSharedFloatArrayBufferList(aJSContext, mJSChannels);
  }
--- a/content/media/webaudio/AudioBuffer.h
+++ b/content/media/webaudio/AudioBuffer.h
@ -91,6 +91,7 @@ public:

  /**
   * Returns a ThreadSharedFloatArrayBufferList containing the sample data.
+   * Can return null if there is no data.
   */
  ThreadSharedFloatArrayBufferList* GetThreadSharedChannelsForRate(JSContext* aContext);

--- a/content/media/webaudio/MediaBufferDecoder.cpp
+++ b/content/media/webaudio/MediaBufferDecoder.cpp
@ -439,8 +439,7 @@ MediaDecodeTask::RunNextPhase()
    break;
  case PhaseEnum::Decode:
  case PhaseEnum::Done:
-    MOZ_NOT_REACHED("Invalid phase Decode");
-    break;
+    MOZ_CRASH("Invalid phase Decode");
  }
 }

--- a/Show More
+++ b/Show More