diff --git a/Makefile.in b/Makefile.in
index f00b97fded0..b3a4c6312bc 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -38,15 +38,29 @@ DIST_GARBAGE = config.cache config.log config.status* config-defs.h \
    $(topsrcdir)/.mozconfig.mk $(topsrcdir)/.mozconfig.out
 
 ifndef MOZ_PROFILE_USE
+# One of the first things we do in the build is purge "unknown" files
+# from the object directory. This serves two purposes:
+#
+#   1) Remove files from a previous build no longer accounted for in
+#      this build configuration.
+#
+#   2) Work around poor build system dependencies by forcing some
+#      rebuilds.
+#
+# Ideally #2 does not exist. Our reliance on this aspect should diminish
+# over time.
+#
+# moz.build backend generation simply installs a set of "manifests" into
+# a common directory. Each manifest is responsible for defining files in
+# a specific subdirectory of the object directory. The invoked Python
+# script simply iterates over all the manifests, purging files as
+# necessary. To manage new directories or add files to the manifests,
+# modify the backend generator.
+#
 # We need to explicitly put backend.RecursiveMakeBackend.built here
 # otherwise the rule in rules.mk doesn't run early enough.
 default alldep all:: CLOBBER $(topsrcdir)/configure config.status backend.RecursiveMakeBackend.built
-	$(RM) -r $(DIST)/sdk
-	$(RM) -r $(DIST)/include
-	$(RM) -r $(DIST)/private
-	$(RM) -r $(DIST)/public
-	$(RM) -r $(DIST)/bin
-	$(RM) -r _tests
+	$(PYTHON) $(topsrcdir)/config/purge_directories.py -d _build_manifests/purge .
 endif
 
 CLOBBER: $(topsrcdir)/CLOBBER
diff --git a/accessible/src/atk/AccessibleWrap.cpp b/accessible/src/atk/AccessibleWrap.cpp
index da124020e0e..8fed8d615d1 100644
--- a/accessible/src/atk/AccessibleWrap.cpp
+++ b/accessible/src/atk/AccessibleWrap.cpp
@@ -680,8 +680,7 @@ getRoleCB(AtkObject *aAtkObj)
   switch (accWrap->Role()) {
 #include "RoleMap.h"
     default:
-      MOZ_NOT_REACHED("Unknown role.");
-      aAtkObj->role = ATK_ROLE_UNKNOWN;
+      MOZ_CRASH("Unknown role.");
   };
 
 #undef ROLE
diff --git a/accessible/src/base/nsCoreUtils.cpp b/accessible/src/base/nsCoreUtils.cpp
index 2baaf14c2d9..b17e4021ad7 100644
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -197,7 +197,7 @@ nsCoreUtils::GetDOMElementFor(nsIContent *aContent)
     return aContent;
 
   if (aContent->IsNodeOfType(nsINode::eTEXT))
-    return aContent->GetParent();
+    return aContent->GetFlattenedTreeParent();
 
   return nullptr;
 }
@@ -540,7 +540,7 @@ nsCoreUtils::GetTreeBoxObject(nsIContent *aContent)
           return treeBox.forget();
       }
     }
-    currentContent = currentContent->GetParent();
+    currentContent = currentContent->GetFlattenedTreeParent();
   }
 
   return nullptr;
diff --git a/accessible/src/base/nsTextEquivUtils.cpp b/accessible/src/base/nsTextEquivUtils.cpp
index 9f0e366ac6f..f15c27d1999 100644
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -136,7 +136,7 @@ nsTextEquivUtils::AppendTextEquivFromTextContent(nsIContent *aContent,
   if (aContent->IsNodeOfType(nsINode::eTEXT)) {
     bool isHTMLBlock = false;
 
-    nsIContent *parentContent = aContent->GetParent();
+    nsIContent *parentContent = aContent->GetFlattenedTreeParent();
     if (parentContent) {
       nsIFrame *frame = parentContent->GetPrimaryFrame();
       if (frame) {
@@ -394,7 +394,7 @@ nsTextEquivUtils::GetRoleRule(role aRole)
   switch (aRole) {
 #include "RoleMap.h"
     default:
-      MOZ_NOT_REACHED("Unknown role.");
+      MOZ_CRASH("Unknown role.");
   }
 
 #undef ROLE
diff --git a/accessible/src/generic/DocAccessible.cpp b/accessible/src/generic/DocAccessible.cpp
index 4e653c4e791..6adc79927b0 100644
--- a/accessible/src/generic/DocAccessible.cpp
+++ b/accessible/src/generic/DocAccessible.cpp
@@ -1377,8 +1377,9 @@ DocAccessible::RecreateAccessible(nsIContent* aContent)
   // coalescence with normal hide and show events. Note, in this case they
   // should be coalesced with normal show/hide events.
 
-  ContentRemoved(aContent->GetParent(), aContent);
-  ContentInserted(aContent->GetParent(), aContent, aContent->GetNextSibling());
+  nsIContent* parent = aContent->GetFlattenedTreeParent();
+  ContentRemoved(parent, aContent);
+  ContentInserted(parent, aContent, aContent->GetNextSibling());
 }
 
 void
diff --git a/accessible/src/html/HTMLTableAccessible.cpp b/accessible/src/html/HTMLTableAccessible.cpp
index b8e6c8e1deb..207d1495277 100644
--- a/accessible/src/html/HTMLTableAccessible.cpp
+++ b/accessible/src/html/HTMLTableAccessible.cpp
@@ -314,6 +314,7 @@ HTMLTableHeaderCellAccessible::NativeRole()
 
   // Assume it's columnheader if there are headers in siblings, otherwise
   // rowheader.
+  // This should iterate the flattened tree
   nsIContent* parentContent = mContent->GetParent();
   if (!parentContent) {
     NS_ERROR("Deattached content on alive accessible?");
diff --git a/accessible/src/windows/msaa/AccessibleWrap.cpp b/accessible/src/windows/msaa/AccessibleWrap.cpp
index e220b030554..ac8a2d52530 100644
--- a/accessible/src/windows/msaa/AccessibleWrap.cpp
+++ b/accessible/src/windows/msaa/AccessibleWrap.cpp
@@ -378,7 +378,7 @@ AccessibleWrap::get_accRole(
   switch (geckoRole) {
 #include "RoleMap.h"
     default:
-      MOZ_NOT_REACHED("Unknown role.");
+      MOZ_CRASH("Unknown role.");
   };
 
 #undef ROLE
@@ -1181,7 +1181,7 @@ AccessibleWrap::role(long *aRole)
   switch (geckoRole) {
 #include "RoleMap.h"
     default:
-      MOZ_NOT_REACHED("Unknown role.");
+      MOZ_CRASH("Unknown role.");
   };
 
 #undef ROLE
diff --git a/accessible/src/xul/XULElementAccessibles.cpp b/accessible/src/xul/XULElementAccessibles.cpp
index d3f98d9f13b..99c1f0b7c1e 100644
--- a/accessible/src/xul/XULElementAccessibles.cpp
+++ b/accessible/src/xul/XULElementAccessibles.cpp
@@ -95,7 +95,7 @@ XULLabelAccessible::RelationByType(uint32_t aType)
   Relation rel = HyperTextAccessibleWrap::RelationByType(aType);
   if (aType == nsIAccessibleRelation::RELATION_LABEL_FOR) {
     // Caption is the label for groupbox
-    nsIContent *parent = mContent->GetParent();
+    nsIContent* parent = mContent->GetFlattenedTreeParent();
     if (parent && parent->Tag() == nsGkAtoms::caption) {
       Accessible* parent = Parent();
       if (parent && parent->Role() == roles::GROUPING)
diff --git a/accessible/src/xul/XULFormControlAccessible.cpp b/accessible/src/xul/XULFormControlAccessible.cpp
index 9a660b1723c..3fd32f1eb16 100644
--- a/accessible/src/xul/XULFormControlAccessible.cpp
+++ b/accessible/src/xul/XULFormControlAccessible.cpp
@@ -244,7 +244,7 @@ XULDropmarkerAccessible::DropmarkerOpen(bool aToggleOpen)
   bool isOpen = false;
 
   nsCOMPtr<nsIDOMXULButtonElement> parentButtonElement =
-    do_QueryInterface(mContent->GetParent());
+    do_QueryInterface(mContent->GetFlattenedTreeParent());
 
   if (parentButtonElement) {
     parentButtonElement->GetOpen(&isOpen);
diff --git a/accessible/src/xul/XULListboxAccessible.cpp b/accessible/src/xul/XULListboxAccessible.cpp
index 65b424287d3..977100efe3d 100644
--- a/accessible/src/xul/XULListboxAccessible.cpp
+++ b/accessible/src/xul/XULListboxAccessible.cpp
@@ -103,7 +103,7 @@ XULListboxAccessible::
   XULListboxAccessible(nsIContent* aContent, DocAccessible* aDoc) :
   XULSelectControlAccessible(aContent, aDoc), xpcAccessibleTable(this)
 {
-  nsIContent* parentContent = mContent->GetParent();
+  nsIContent* parentContent = mContent->GetFlattenedTreeParent();
   if (parentContent) {
     nsCOMPtr<nsIAutoCompletePopup> autoCompletePopupElm =
       do_QueryInterface(parentContent);
diff --git a/accessible/src/xul/XULMenuAccessible.cpp b/accessible/src/xul/XULMenuAccessible.cpp
index 5baca8ce5f0..68d551582db 100644
--- a/accessible/src/xul/XULMenuAccessible.cpp
+++ b/accessible/src/xul/XULMenuAccessible.cpp
@@ -439,7 +439,7 @@ XULMenupopupAccessible::
     mType = eMenuPopupType;
 
   // May be the anonymous <menupopup> inside <menulist> (a combobox)
-  mSelectControl = do_QueryInterface(mContent->GetParent());
+  mSelectControl = do_QueryInterface(mContent->GetFlattenedTreeParent());
   if (!mSelectControl)
     mGenericTypes &= ~eSelect;
 }
@@ -477,7 +477,7 @@ XULMenupopupAccessible::NativeName(nsString& aName)
   nsIContent* content = mContent;
   while (content && aName.IsEmpty()) {
     content->GetAttr(kNameSpaceID_None, nsGkAtoms::label, aName);
-    content = content->GetParent();
+    content = content->GetFlattenedTreeParent();
   }
 
   return eNameOK;
diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index b634dbd9fd2..0b0bda7509b 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -386,6 +386,11 @@ window[chromehidden~="toolbar"] toolbar:not(.toolbar-primary):not(.chromeclass-m
 }
 
 /* Identity UI */
+#identity-popup-content-box:not(.chromeUI) > #identity-popup-brandName,
+#identity-popup-content-box:not(.chromeUI) > #identity-popup-chromeLabel,
+#identity-popup-content-box.chromeUI > .identity-popup-label:not(#identity-popup-brandName):not(#identity-popup-chromeLabel),
+#identity-popup-content-box.chromeUI > .identity-popup-description,
+#identity-popup-content-box.chromeUI > #identity-popup-button-container,
 #identity-popup-content-box.unknownIdentity > #identity-popup-connectedToLabel ,
 #identity-popup-content-box.unknownIdentity > #identity-popup-runByLabel ,
 #identity-popup-content-box.unknownIdentity > #identity-popup-content-host ,
@@ -662,6 +667,12 @@ chatbar {
   max-height: 0;
 }
 
+/** See bug 872317 for why the following rule is necessary. */
+
+#downloads-indicator {
+  -moz-binding: url("chrome://browser/content/downloads/download.xml#download-toolbarbutton");
+}
+
 /* full screen chat window support */
 chatbar:-moz-full-screen-ancestor,
 chatbox:-moz-full-screen-ancestor  {
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 977a1be0bbb..30ee35765d8 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -143,6 +143,7 @@ let gInitialPages = [
   "about:newtab",
   "about:home",
   "about:privatebrowsing",
+  "about:welcomeback",
   "about:sessionrestore"
 ];
 
@@ -6403,6 +6404,11 @@ var gIdentityHandler = {
     return this._identityPopupContentBox =
       document.getElementById("identity-popup-content-box");
   },
+  get _identityPopupChromeLabel () {
+    delete this._identityPopupChromeLabel;
+    return this._identityPopupChromeLabel =
+      document.getElementById("identity-popup-chromeLabel");
+  },
   get _identityPopupContentHost () {
     delete this._identityPopupContentHost;
     return this._identityPopupContentHost =
@@ -6673,6 +6679,8 @@ var gIdentityHandler = {
                         "rtl" : "ltr";
       break; }
     case this.IDENTITY_MODE_CHROMEUI:
+      let brandBundle = document.getElementById("bundle_brand");
+      icon_label = brandBundle.getString("brandShortName");
       break;
     default:
       tooltip = gNavigatorBundle.getString("identity.unknown.tooltip");
@@ -6734,6 +6742,12 @@ var gIdentityHandler = {
       else if (iData.country) // Country only
         supplemental += iData.country;
       break; }
+    case this.IDENTITY_MODE_CHROMEUI: {
+      let brandBundle = document.getElementById("bundle_brand");
+      let brandShortName = brandBundle.getString("brandShortName");
+      this._identityPopupChromeLabel.textContent = gNavigatorBundle.getFormattedString("identity.chrome",
+                                                                                       [brandShortName]);
+      break; }
     }
 
     // Push the appropriate strings out to the UI
@@ -6761,10 +6775,8 @@ var gIdentityHandler = {
       return; // Left click, space or enter only
     }
 
-    // Don't allow left click, space or enter if the location
-    // is chrome UI or the location has been modified.
-    if (this._mode == this.IDENTITY_MODE_CHROMEUI ||
-        gURLBar.getAttribute("pageproxystate") != "valid") {
+    // Don't allow left click, space or enter if the location has been modified.
+    if (gURLBar.getAttribute("pageproxystate") != "valid") {
       TelemetryStopwatch.cancel("FX_IDENTITY_POPUP_OPEN_MS");
       return;
     }
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index a87e2edad5a..49eecf5946f 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -298,6 +298,11 @@
       <hbox id="identity-popup-container" align="top">
         <image id="identity-popup-icon"/>
         <vbox id="identity-popup-content-box">
+          <label id="identity-popup-brandName"
+                 class="identity-popup-label"
+                 value="&brandFullName;"/>
+          <label id="identity-popup-chromeLabel"
+                 class="identity-popup-label"/>
           <label id="identity-popup-connectedToLabel"
                  class="identity-popup-label"
                  value="&identity.connectedTo;"/>
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index ec7bf8a43dc..daa9060dddf 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -678,8 +678,13 @@ nsContextMenu.prototype = {
 
     // See if the user clicked in a frame.
     var docDefaultView = this.target.ownerDocument.defaultView;
-    if (docDefaultView != docDefaultView.top)
-      this.inFrame = true;
+    if (docDefaultView != docDefaultView.top) {
+      // srcdoc iframes are not considered frames for concerns about web
+      // content with about:srcdoc in location bar masqurading as trusted
+      // chrome/addon content.
+      if (!this.target.ownerDocument.isSrcdocDocument)
+        this.inFrame = true;
+    }
 
     // if the document is editable, show context menu like in text inputs
     if (!this.onEditableArea) {
diff --git a/browser/base/content/urlbarBindings.xml b/browser/base/content/urlbarBindings.xml
index 41a26da3a57..bd8318209ac 100644
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -1702,7 +1702,7 @@
               break;
 
             case Ci.nsIBlocklistService.STATE_VULNERABLE_UPDATE_AVAILABLE:
-              label = "pluginActivateOutdated.label";
+              label = "pluginActivateOutdated.message";
               linkLabel = "pluginActivate.updateLabel";
               button1.default = true;
               break;
diff --git a/browser/branding/aurora/content/identity-icons-brand.png b/browser/branding/aurora/content/identity-icons-brand.png
new file mode 100644
index 00000000000..afce613e2fd
Binary files /dev/null and b/browser/branding/aurora/content/identity-icons-brand.png differ
diff --git a/browser/branding/aurora/content/identity-icons-brand@2x.png b/browser/branding/aurora/content/identity-icons-brand@2x.png
new file mode 100644
index 00000000000..531ff5dec0c
Binary files /dev/null and b/browser/branding/aurora/content/identity-icons-brand@2x.png differ
diff --git a/browser/branding/aurora/content/jar.mn b/browser/branding/aurora/content/jar.mn
index 821aa03bc43..e22cb11c088 100644
--- a/browser/branding/aurora/content/jar.mn
+++ b/browser/branding/aurora/content/jar.mn
@@ -13,4 +13,7 @@ browser.jar:
   content/branding/icon64.png                    (icon64.png)
   content/branding/icon16.png                    (../default16.png)
   content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
diff --git a/browser/branding/nightly/content/identity-icons-brand.png b/browser/branding/nightly/content/identity-icons-brand.png
new file mode 100644
index 00000000000..afce613e2fd
Binary files /dev/null and b/browser/branding/nightly/content/identity-icons-brand.png differ
diff --git a/browser/branding/nightly/content/identity-icons-brand@2x.png b/browser/branding/nightly/content/identity-icons-brand@2x.png
new file mode 100644
index 00000000000..531ff5dec0c
Binary files /dev/null and b/browser/branding/nightly/content/identity-icons-brand@2x.png differ
diff --git a/browser/branding/nightly/content/jar.mn b/browser/branding/nightly/content/jar.mn
index 821aa03bc43..e22cb11c088 100644
--- a/browser/branding/nightly/content/jar.mn
+++ b/browser/branding/nightly/content/jar.mn
@@ -13,4 +13,7 @@ browser.jar:
   content/branding/icon64.png                    (icon64.png)
   content/branding/icon16.png                    (../default16.png)
   content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
diff --git a/browser/branding/official/content/identity-icons-brand.png b/browser/branding/official/content/identity-icons-brand.png
new file mode 100644
index 00000000000..afce613e2fd
Binary files /dev/null and b/browser/branding/official/content/identity-icons-brand.png differ
diff --git a/browser/branding/official/content/identity-icons-brand@2x.png b/browser/branding/official/content/identity-icons-brand@2x.png
new file mode 100644
index 00000000000..531ff5dec0c
Binary files /dev/null and b/browser/branding/official/content/identity-icons-brand@2x.png differ
diff --git a/browser/branding/official/content/jar.mn b/browser/branding/official/content/jar.mn
index a799da97c43..ae7a189dcd9 100644
--- a/browser/branding/official/content/jar.mn
+++ b/browser/branding/official/content/jar.mn
@@ -12,4 +12,7 @@ browser.jar:
   content/branding/icon64.png                    (icon64.png)
   content/branding/icon16.png                    (../default16.png)
   content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
diff --git a/browser/branding/unofficial/content/identity-icons-brand.png b/browser/branding/unofficial/content/identity-icons-brand.png
new file mode 100644
index 00000000000..a39e493c1eb
Binary files /dev/null and b/browser/branding/unofficial/content/identity-icons-brand.png differ
diff --git a/browser/branding/unofficial/content/identity-icons-brand@2x.png b/browser/branding/unofficial/content/identity-icons-brand@2x.png
new file mode 100644
index 00000000000..794d54ecae5
Binary files /dev/null and b/browser/branding/unofficial/content/identity-icons-brand@2x.png differ
diff --git a/browser/branding/unofficial/content/jar.mn b/browser/branding/unofficial/content/jar.mn
index 821aa03bc43..e22cb11c088 100644
--- a/browser/branding/unofficial/content/jar.mn
+++ b/browser/branding/unofficial/content/jar.mn
@@ -13,4 +13,7 @@ browser.jar:
   content/branding/icon64.png                    (icon64.png)
   content/branding/icon16.png                    (../default16.png)
   content/branding/icon32.png                    (../default32.png)
+  content/branding/icon128.png                   (../mozicon128.png)
+  content/branding/identity-icons-brand.png      (identity-icons-brand.png)
+  content/branding/identity-icons-brand@2x.png   (identity-icons-brand@2x.png)
   content/branding/aboutDialog.css               (aboutDialog.css)
diff --git a/browser/components/about/AboutRedirector.cpp b/browser/components/about/AboutRedirector.cpp
index 3e672a9bb09..9000e6ac30b 100644
--- a/browser/components/about/AboutRedirector.cpp
+++ b/browser/components/about/AboutRedirector.cpp
@@ -63,6 +63,8 @@ static RedirEntry kRedirMap[] = {
     nsIAboutModule::ALLOW_SCRIPT },
   { "sessionrestore", "chrome://browser/content/aboutSessionRestore.xhtml",
     nsIAboutModule::ALLOW_SCRIPT },
+  { "welcomeback", "chrome://browser/content/aboutWelcomeBack.xhtml",
+    nsIAboutModule::ALLOW_SCRIPT },
 #ifdef MOZ_SERVICES_SYNC
   { "sync-progress", "chrome://browser/content/sync/progress.xhtml",
     nsIAboutModule::ALLOW_SCRIPT },
diff --git a/browser/components/build/nsModule.cpp b/browser/components/build/nsModule.cpp
index fc5734cd255..193f323290e 100644
--- a/browser/components/build/nsModule.cpp
+++ b/browser/components/build/nsModule.cpp
@@ -95,6 +95,7 @@ static const mozilla::Module::ContractIDEntry kBrowserContracts[] = {
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "rights", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "robots", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "sessionrestore", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
+    { NS_ABOUT_MODULE_CONTRACTID_PREFIX "welcomeback", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
 #ifdef MOZ_SERVICES_SYNC
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "sync-tabs", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "sync-progress", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
diff --git a/browser/components/downloads/content/download.xml b/browser/components/downloads/content/download.xml
index ca73db7f54b..1e6c16bc946 100644
--- a/browser/components/downloads/content/download.xml
+++ b/browser/components/downloads/content/download.xml
@@ -106,4 +106,11 @@
 
     </content>
   </binding>
+
+  <binding id="download-toolbarbutton"
+           extends="chrome://global/content/bindings/toolbarbutton.xml#toolbarbutton">
+    <content>
+      <children />
+    </content>
+  </binding>
 </bindings>
diff --git a/browser/components/migration/content/aboutWelcomeBack.xhtml b/browser/components/migration/content/aboutWelcomeBack.xhtml
new file mode 100644
index 00000000000..7022682668b
--- /dev/null
+++ b/browser/components/migration/content/aboutWelcomeBack.xhtml
@@ -0,0 +1,90 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<!DOCTYPE html [
+  <!ENTITY % htmlDTD PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
+  %htmlDTD;
+  <!ENTITY % netErrorDTD SYSTEM "chrome://global/locale/netError.dtd">
+  %netErrorDTD;
+  <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd">
+  %globalDTD;
+  <!ENTITY % restorepageDTD SYSTEM "chrome://browser/locale/aboutSessionRestore.dtd">
+  %restorepageDTD;
+]>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>&restorepage.tabtitle;</title>
+    <link rel="stylesheet" href="chrome://global/skin/netError.css" type="text/css" media="all"/>
+    <link rel="stylesheet" href="chrome://browser/skin/aboutSessionRestore.css" type="text/css" media="all"/>
+    <link rel="stylesheet" href="chrome://browser/skin/aboutWelcomeBack.css" type="text/css" media="all"/>
+    <link rel="icon" type="image/png" href="chrome://global/skin/icons/information-16.png"/>
+
+    <script type="application/javascript;version=1.8" src="chrome://browser/content/aboutSessionRestore.js"/>
+  </head>
+
+  <body dir="&locale.dir;">
+
+    <!-- PAGE CONTAINER (for styling purposes only) -->
+    <div id="errorPageContainer">
+
+      <!-- Error Title -->
+      <div id="errorTitle">
+        <h1 id="errorTitleText">&welcomeback.pageTitle;</h1>
+      </div>
+
+      <!-- LONG CONTENT (the section most likely to require scrolling) -->
+      <div id="errorLongContent">
+
+        <!-- Short Description -->
+        <div id="errorShortDesc">
+          <p id="errorShortDescText">&welcomeback.pageInfo;</p>
+        </div>
+
+        <!-- Long Description (Note: See netError.dtd for used XHTML tags) -->
+        <div id="errorLongDesc">
+        </div>
+
+        <!-- Short Description -->
+        <div id="errorTrailerDesc">
+          <tree xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+                id="tabList" flex="1" seltype="single" hidecolumnpicker="true"
+                onclick="onListClick(event);" onkeydown="onListKeyDown(event);"
+                _window_label="&restorepage.windowLabel;">
+            <treecols>
+              <treecol cycler="true" id="restore" type="checkbox" label="&restorepage.restoreHeader;"/>
+              <splitter class="tree-splitter"/>
+              <treecol primary="true" id="title" label="&restorepage.listHeader;" flex="1"/>
+            </treecols>
+            <treechildren flex="1"/>
+          </tree>
+        </div>
+      </div>
+
+      <!-- Buttons -->
+      <hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="buttons">
+#ifdef XP_UNIX
+        <button id="errorCancel" label="&restorepage.closeButton;"
+                accesskey="&restorepage.close.access;"
+                oncommand="startNewSession();"/>
+        <button id="errorTryAgain" label="&restorepage.tryagainButton;"
+                accesskey="&restorepage.restore.access;"
+                oncommand="restoreSession();"/>
+#else
+        <button id="errorTryAgain" label="&restorepage.tryagainButton;"
+                accesskey="&restorepage.restore.access;"
+                oncommand="restoreSession();"/>
+        <button id="errorCancel" label="&restorepage.closeButton;"
+                accesskey="&restorepage.close.access;"
+                oncommand="startNewSession();"/>
+#endif
+      </hbox>
+      <!-- holds the session data for when the tab is closed -->
+      <input type="text" id="sessionData" style="display: none;"/>
+    </div>
+
+  </body>
+</html>
diff --git a/browser/components/migration/jar.mn b/browser/components/migration/jar.mn
index b369ee1dcdc..0e4d79837a5 100644
--- a/browser/components/migration/jar.mn
+++ b/browser/components/migration/jar.mn
@@ -5,3 +5,4 @@
 browser.jar:
 *  content/browser/migration/migration.xul                    (content/migration.xul)
    content/browser/migration/migration.js                     (content/migration.js)
+*  content/browser/aboutWelcomeBack.xhtml                     (content/aboutWelcomeBack.xhtml)
diff --git a/browser/components/migration/public/nsIBrowserProfileMigrator.idl b/browser/components/migration/public/nsIBrowserProfileMigrator.idl
index 20125bfb3e5..cc2cc84874c 100644
--- a/browser/components/migration/public/nsIBrowserProfileMigrator.idl
+++ b/browser/components/migration/public/nsIBrowserProfileMigrator.idl
@@ -9,7 +9,7 @@ interface nsIArray;
 interface nsIProfileStartup;
 
 [scriptable, uuid(44993E0E-74E8-4BEC-9D66-AD8156E0A274)]
-interface nsIBrowserProfileMigrator : nsISupports 
+interface nsIBrowserProfileMigrator : nsISupports
 {
   /**
    * profile items to migrate. use with migrate().
@@ -22,6 +22,7 @@ interface nsIBrowserProfileMigrator : nsISupports
   const unsigned short PASSWORDS   = 0x0010;
   const unsigned short BOOKMARKS   = 0x0020;
   const unsigned short OTHERDATA   = 0x0040;
+  const unsigned short SESSION     = 0x0080;
 
   /**
    * Copy user profile information to the current active profile.
diff --git a/browser/components/migration/src/FirefoxProfileMigrator.js b/browser/components/migration/src/FirefoxProfileMigrator.js
index 23e021d25bc..3db6720fe79 100644
--- a/browser/components/migration/src/FirefoxProfileMigrator.js
+++ b/browser/components/migration/src/FirefoxProfileMigrator.js
@@ -15,13 +15,26 @@
 
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 Components.utils.import("resource:///modules/MigrationUtils.jsm");
+Components.utils.import("resource://gre/modules/Services.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "PlacesBackups",
                                   "resource://gre/modules/PlacesBackups.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "SessionMigration",
+                                  "resource:///modules/sessionstore/SessionMigration.jsm");
 
 function FirefoxProfileMigrator() { }
 
 FirefoxProfileMigrator.prototype = Object.create(MigratorPrototype);
 
+FirefoxProfileMigrator.prototype._getFileObject = function(dir, fileName) {
+  let file = dir.clone();
+  file.append(fileName);
+
+  // File resources are monolithic.  We don't make partial copies since
+  // they are not expected to work alone. Return null to avoid trying to
+  // copy non-existing files.
+  return file.exists() ? file : null;
+}
+
 FirefoxProfileMigrator.prototype.getResources = function() {
   // Only allow migrating from the default (selected) profile since this will
   // be the only one returned by the toolkit profile service after bug 214675.
@@ -48,14 +61,9 @@ FirefoxProfileMigrator.prototype.getResources = function() {
   let getFileResource = function(aMigrationType, aFileNames) {
     let files = [];
     for (let fileName of aFileNames) {
-      let file = sourceProfileDir.clone();
-      file.append(fileName);
-
-      // File resources are monolithic.  We don't make partial copies since
-      // they are not expected to work alone.
-      if (!file.exists())
+      let file = this._getFileObject(sourceProfileDir, fileName);
+      if (!file)
         return null;
-
       files.push(file);
     }
     return {
@@ -67,7 +75,7 @@ FirefoxProfileMigrator.prototype.getResources = function() {
         aCallback(true);
       }
     };
-  };
+  }.bind(this);
 
   let types = MigrationUtils.resourceTypes;
   let places = getFileResource(types.HISTORY, ["places.sqlite"]);
@@ -79,8 +87,39 @@ FirefoxProfileMigrator.prototype.getResources = function() {
     [PlacesBackups.profileRelativeFolderPath]);
   let dictionary = getFileResource(types.OTHERDATA, ["persdict.dat"]);
 
+  let sessionFile = this._getFileObject(sourceProfileDir, "sessionstore.js");
+  let session;
+  if (sessionFile) {
+    session = {
+      type: types.SESSION,
+      migrate: function(aCallback) {
+        let newSessionFile = currentProfileDir.clone();
+        newSessionFile.append("sessionstore.js");
+        let migrationPromise = SessionMigration.migrate(sessionFile.path, newSessionFile.path);
+        migrationPromise.then(function() {
+          let buildID = Services.appinfo.platformBuildID;
+          let mstone = Services.appinfo.platformVersion;
+          // Force the browser to one-off resume the session that we give it:
+          Services.prefs.setBoolPref("browser.sessionstore.resume_session_once", true);
+          // Reset the homepage_override prefs so that the browser doesn't override our
+          // session with the "what's new" page:
+          Services.prefs.setCharPref("browser.startup.homepage_override.mstone", mstone);
+          Services.prefs.setCharPref("browser.startup.homepage_override.buildID", buildID);
+          // It's too early in startup for the pref service to have a profile directory,
+          // so we have to manually tell it where to save the prefs file.
+          let newPrefsFile = currentProfileDir.clone();
+          newPrefsFile.append("prefs.js");
+          Services.prefs.savePrefFile(newPrefsFile);
+          aCallback(true);
+        }, function() {
+          aCallback(false);
+        });
+      }
+    }
+  }
+
   return [r for each (r in [places, cookies, passwords, formData,
-                            dictionary, bookmarksBackups]) if (r)];
+                            dictionary, bookmarksBackups, session]) if (r)];
 }
 
 Object.defineProperty(FirefoxProfileMigrator.prototype, "startupOnlyMigrator", {
diff --git a/browser/components/migration/src/MigrationUtils.jsm b/browser/components/migration/src/MigrationUtils.jsm
index 3d23a98cea9..2c91e9a6fc2 100644
--- a/browser/components/migration/src/MigrationUtils.jsm
+++ b/browser/components/migration/src/MigrationUtils.jsm
@@ -332,7 +332,8 @@ this.MigrationUtils = Object.freeze({
     FORMDATA:   Ci.nsIBrowserProfileMigrator.FORMDATA,
     PASSWORDS:  Ci.nsIBrowserProfileMigrator.PASSWORDS,
     BOOKMARKS:  Ci.nsIBrowserProfileMigrator.BOOKMARKS,
-    OTHERDATA:  Ci.nsIBrowserProfileMigrator.OTHERDATA
+    OTHERDATA:  Ci.nsIBrowserProfileMigrator.OTHERDATA,
+    SESSION:    Ci.nsIBrowserProfileMigrator.SESSION,
   },
 
   /**
diff --git a/browser/components/sessionstore/src/Makefile.in b/browser/components/sessionstore/src/Makefile.in
index 62dcbd28d48..cfa035933d1 100644
--- a/browser/components/sessionstore/src/Makefile.in
+++ b/browser/components/sessionstore/src/Makefile.in
@@ -21,6 +21,7 @@ JS_MODULES_PATH := modules/sessionstore
 EXTRA_JS_MODULES := \
   DocumentUtils.jsm \
   SessionStorage.jsm \
+  SessionMigration.jsm \
   XPathGenerator.jsm \
   _SessionFile.jsm \
   $(NULL)
diff --git a/browser/components/sessionstore/src/SessionMigration.jsm b/browser/components/sessionstore/src/SessionMigration.jsm
new file mode 100644
index 00000000000..d8f7207aea3
--- /dev/null
+++ b/browser/components/sessionstore/src/SessionMigration.jsm
@@ -0,0 +1,117 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+this.EXPORTED_SYMBOLS = ["SessionMigration"];
+
+const Cu = Components.utils;
+Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
+Cu.import("resource://gre/modules/Task.jsm", this);
+Cu.import("resource://gre/modules/osfile.jsm", this);
+
+// An encoder to UTF-8.
+XPCOMUtils.defineLazyGetter(this, "gEncoder", function () {
+  return new TextEncoder();
+});
+
+// A decoder.
+XPCOMUtils.defineLazyGetter(this, "gDecoder", function () {
+  return new TextDecoder();
+});
+
+let SessionMigrationInternal = {
+  /**
+   * Convert the original session restore state into a minimal state. It will
+   * only contain:
+   * - open windows
+   *   - with tabs
+   *     - with history entries with only title, url
+   *     - with pinned state
+   *     - with tab group info (hidden + group id)
+   *     - with selected tab info
+   *   - with selected window info
+   *   - with tabgroups info
+   *
+   * The complete state is then wrapped into the "about:welcomeback" page as
+   * form field info to be restored when restoring the state.
+   */
+  convertState: function(aStateObj) {
+    let state = {
+      selectedWindow: aStateObj.selectedWindow,
+      _closedWindows: []
+    };
+    state.windows = aStateObj.windows.map(function(oldWin) {
+      var win = {extData: {}};
+      win.tabs = oldWin.tabs.map(function(oldTab) {
+        var tab = {};
+        // Keep only titles and urls for history entries
+        tab.entries = oldTab.entries.map(function(entry) {
+          return {url: entry.url, title: entry.title};
+        });
+        tab.index = oldTab.index;
+        tab.hidden = oldTab.hidden;
+        tab.pinned = oldTab.pinned;
+        // The tabgroup info is in the extData, so we need to get it out.
+        if (oldTab.extData && "tabview-tab" in oldTab.extData) {
+          tab.extData = {"tabview-tab": oldTab.extData["tabview-tab"]};
+        }
+        return tab;
+      });
+      // There are various tabgroup-related attributes that we need to get out
+      // of the session restore data for the window, too.
+      if (oldWin.extData) {
+        for (let k of Object.keys(oldWin.extData)) {
+          if (k.startsWith("tabview-")) {
+            win.extData[k] = oldWin.extData[k];
+          }
+        }
+      }
+      win.selected = oldWin.selected;
+      win._closedTabs = [];
+      return win;
+    });
+    let wrappedState = {
+      url: "about:welcomeback",
+      formdata: {
+        id: {"sessionData": state},
+        xpath: {}
+      }
+    };
+    return {windows: [{tabs: [{entries: [wrappedState]}]}]};
+  },
+  /**
+   * Asynchronously read session restore state (JSON) from a path
+   */
+  readState: function(aPath) {
+    return Task.spawn(function() {
+      let bytes = yield OS.File.read(aPath);
+      let text = gDecoder.decode(bytes);
+      let state = JSON.parse(text);
+      throw new Task.Result(state);
+    });
+  },
+  /**
+   * Asynchronously write session restore state as JSON to a path
+   */
+  writeState: function(aPath, aState) {
+    let bytes = gEncoder.encode(JSON.stringify(aState));
+    return OS.File.writeAtomic(aPath, bytes, {tmpPath: aPath + ".tmp"});
+  }
+}
+
+let SessionMigration = {
+  /**
+   * Migrate a limited set of session data from one path to another.
+   */
+  migrate: function(aFromPath, aToPath) {
+    return Task.spawn(function() {
+      let inState = yield SessionMigrationInternal.readState(aFromPath);
+      let outState = SessionMigrationInternal.convertState(inState);
+      // Unfortunately, we can't use SessionStore's own _SessionFile to
+      // write out the data because it has a dependency on the profile dir
+      // being known. When the migration runs, there is no guarantee that
+      // that's true.
+      yield SessionMigrationInternal.writeState(aToPath, outState);
+    });
+  }
+};
diff --git a/browser/components/sessionstore/src/SessionStore.jsm b/browser/components/sessionstore/src/SessionStore.jsm
index 6d173e17ad6..8fdf65f2a24 100644
--- a/browser/components/sessionstore/src/SessionStore.jsm
+++ b/browser/components/sessionstore/src/SessionStore.jsm
@@ -425,6 +425,11 @@ let SessionStoreInternal = {
                 }
               };
               this._initialState = { windows: [{ tabs: [{ entries: [pageData] }] }] };
+            } else if (this._hasSingleTabWithURL(this._initialState.windows,
+                                                 "about:welcomeback")) {
+              // On a single about:welcomeback URL that crashed, replace about:welcomeback
+              // with about:sessionrestore, to make clear to the user that we crashed.
+              this._initialState.windows[0].tabs[0].entries[0].url = "about:sessionrestore";
             }
           }
 
@@ -2072,6 +2077,12 @@ let SessionStoreInternal = {
     if (aEntry.referrerURI)
       entry.referrer = aEntry.referrerURI.spec;
 
+    if (aEntry.srcdocData)
+      entry.srcdocData = aEntry.srcdocData;
+
+    if (aEntry.isSrcdocEntry)
+      entry.isSrcdocEntry = aEntry.isSrcdocEntry;
+
     if (aEntry.contentType)
       entry.contentType = aEntry.contentType;
 
@@ -2251,7 +2262,8 @@ let SessionStoreInternal = {
     }
     var isHTTPS = this._getURIFromString((aContent.parent || aContent).
                                          document.location.href).schemeIs("https");
-    let isAboutSR = aContent.top.document.location.href == "about:sessionrestore";
+    let topURL = aContent.top.document.location.href;
+    let isAboutSR = topURL == "about:sessionrestore" || topURL == "about:welcomeback";
     if (aFullData || this.checkPrivacyLevel(isHTTPS, aIsPinned) || isAboutSR) {
       if (aFullData || aUpdateFormData) {
         let formData = DocumentUtils.getFormData(aContent.document);
@@ -3311,6 +3323,8 @@ let SessionStoreInternal = {
       shEntry.contentType = aEntry.contentType;
     if (aEntry.referrer)
       shEntry.referrerURI = this._getURIFromString(aEntry.referrer);
+    if (aEntry.isSrcdocEntry)
+      shEntry.srcdocData = aEntry.srcdocData;
 
     if (aEntry.cacheKey) {
       var cacheKey = Cc["@mozilla.org/supports-PRUint32;1"].
@@ -3452,7 +3466,7 @@ let SessionStoreInternal = {
         // for about:sessionrestore we saved the field as JSON to avoid
         // nested instances causing humongous sessionstore.js files.
         // cf. bug 467409
-        if (aData.url == "about:sessionrestore" &&
+        if ((aData.url == "about:sessionrestore" || aData.url == "about:welcomeback") &&
             "sessionData" in formdata.id &&
             typeof formdata.id["sessionData"] == "object") {
           formdata.id["sessionData"] =
@@ -4076,11 +4090,10 @@ let SessionStoreInternal = {
       return false;
 
     // don't wrap a single about:sessionrestore page
-    if (winData.length == 1 && winData[0].tabs &&
-        winData[0].tabs.length == 1 && winData[0].tabs[0].entries &&
-        winData[0].tabs[0].entries.length == 1 &&
-        winData[0].tabs[0].entries[0].url == "about:sessionrestore")
+    if (this._hasSingleTabWithURL(winData, "about:sessionrestore") ||
+        this._hasSingleTabWithURL(winData, "about:welcomeback")) {
       return false;
+    }
 
     // don't automatically restore in Safe Mode
     if (Services.appinfo.inSafeMode)
@@ -4096,6 +4109,23 @@ let SessionStoreInternal = {
             sessionAge && sessionAge >= SIX_HOURS_IN_MS);
   },
 
+  /**
+   * @param aWinData is the set of windows in session state
+   * @param aURL is the single URL we're looking for
+   * @returns whether the window data contains only the single URL passed
+   */
+  _hasSingleTabWithURL: function(aWinData, aURL) {
+    if (aWinData &&
+        aWinData.length == 1 &&
+        aWinData[0].tabs &&
+        aWinData[0].tabs.length == 1 &&
+        aWinData[0].tabs[0].entries &&
+        aWinData[0].tabs[0].entries.length == 1) {
+      return aURL == aWinData[0].tabs[0].entries[0].url;
+    }
+    return false;
+  },
+
   /**
    * Determine if the tab state we're passed is something we should save. This
    * is used when closing a tab or closing a window with a single tab
diff --git a/browser/components/sessionstore/test/Makefile.in b/browser/components/sessionstore/test/Makefile.in
index 34e7a9746a5..371c778ede0 100644
--- a/browser/components/sessionstore/test/Makefile.in
+++ b/browser/components/sessionstore/test/Makefile.in
@@ -14,11 +14,11 @@ include $(DEPTH)/config/autoconf.mk
 # browser_526613.js is disabled because of frequent failures (bug 534489)
 # browser_589246.js is disabled for leaking browser windows (bug 752467)
 # browser_580512.js is disabled for leaking browser windows (bug 752467)
-# browser_capabilities.js is disabled for using resources outside of the build network (bug 882575)
 
 MOCHITEST_BROWSER_FILES = \
 	head.js \
 	browser_attributes.js \
+	browser_capabilities.js \
 	browser_dying_cache.js \
 	browser_form_restore_events.js \
 	browser_form_restore_events_sample.html \
diff --git a/browser/devtools/framework/test/browser_new_activation_workflow.js b/browser/devtools/framework/test/browser_new_activation_workflow.js
index 85b73e7c783..16b426c3ac5 100644
--- a/browser/devtools/framework/test/browser_new_activation_workflow.js
+++ b/browser/devtools/framework/test/browser_new_activation_workflow.js
@@ -43,7 +43,7 @@ function selectAndCheckById(id) {
 
   return toolbox.selectTool(id).then(function() {
     let tab = doc.getElementById("toolbox-tab-" + id);
-    is(tab.selected, true, "The " + id + " tab is selected");
+    is(tab.hasAttribute("selected"), true, "The " + id + " tab is selected");
   });
 }
 
diff --git a/browser/devtools/framework/toolbox.css b/browser/devtools/framework/toolbox.css
index b1d68ec2659..25d5d872043 100644
--- a/browser/devtools/framework/toolbox.css
+++ b/browser/devtools/framework/toolbox.css
@@ -2,10 +2,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-.devtools-tab > .radio-check,
-.devtools-tab > .radio-check-box1,
-.devtools-tab > .radio-spacer-box {
-  display: none;
+.devtools-tab {
+  -moz-binding: url("chrome://global/content/bindings/general.xml#control-item");
+  -moz-box-align: center;
 }
 
 #toolbox-controls > toolbarbutton > .toolbarbutton-text,
diff --git a/browser/devtools/framework/toolbox.js b/browser/devtools/framework/toolbox.js
index 7288805a707..01fe87f5083 100644
--- a/browser/devtools/framework/toolbox.js
+++ b/browser/devtools/framework/toolbox.js
@@ -351,6 +351,9 @@ Toolbox.prototype = {
     let id = toolDefinition.id;
 
     let radio = this.doc.createElement("radio");
+    // The radio element is not being used in the conventional way, thus
+    // the devtools-tab class replaces the radio XBL binding with its base
+    // binding (the control-item binding).
     radio.className = "toolbox-tab devtools-tab";
     radio.id = "toolbox-tab-" + id;
     radio.setAttribute("toolid", id);
diff --git a/browser/locales/en-US/chrome/browser/aboutSessionRestore.dtd b/browser/locales/en-US/chrome/browser/aboutSessionRestore.dtd
index 50993be90c2..2e7fd39e98c 100644
--- a/browser/locales/en-US/chrome/browser/aboutSessionRestore.dtd
+++ b/browser/locales/en-US/chrome/browser/aboutSessionRestore.dtd
@@ -21,3 +21,14 @@
 <!ENTITY restorepage.listHeader     "Windows and Tabs">
 <!-- LOCALIZATION NOTE: &#37;S will be replaced with a number. -->
 <!ENTITY restorepage.windowLabel    "Window &#37;S">
+
+
+<!-- LOCALIZATION NOTE: The following 'welcomeback' strings are for about:welcomeback,
+     not for about:sessionstore -->
+<!ENTITY welcomeback.tabtitle       "Welcome Back!">
+
+<!-- LOCALIZATION NOTE: The title is intended to be welcoming and congratulatory,
+     expressing joy that the user has successfully migrated their stuff and hope
+     that now they have a better experience.  -->
+<!ENTITY welcomeback.pageTitle      "Welcome Back!">
+<!ENTITY welcomeback.pageInfo       "&brandShortName; successfully reset your profile. Below is a list of windows and tabs you had open; you can restore them or start with a clean slate.">
diff --git a/browser/locales/en-US/chrome/browser/browser.properties b/browser/locales/en-US/chrome/browser/browser.properties
index 374987e70b4..6c3d10b61a0 100644
--- a/browser/locales/en-US/chrome/browser/browser.properties
+++ b/browser/locales/en-US/chrome/browser/browser.properties
@@ -265,6 +265,9 @@ identity.unknown.tooltip=This website does not supply identity information.
 
 identity.ownerUnknown2=(unknown)
 
+# LOCALIZATION NOTE (identity.chrome): %S is replaced with the brandShortName.
+identity.chrome=This is a secure %S page.
+
 # Edit Bookmark UI
 editBookmarkPanel.pageBookmarkedTitle=Page Bookmarked
 editBookmarkPanel.pageBookmarkedDescription=%S will always remember this page for you.
diff --git a/browser/locales/en-US/chrome/browser/migration/migration.properties b/browser/locales/en-US/chrome/browser/migration/migration.properties
index b1cb03d0ac2..094a9dcf8a3 100644
--- a/browser/locales/en-US/chrome/browser/migration/migration.properties
+++ b/browser/locales/en-US/chrome/browser/migration/migration.properties
@@ -49,3 +49,5 @@ importedSafariReadingList=Reading List (From Safari)
 64_safari=Other Data
 64_chrome=Other Data
 64_firefox_other=Other Data
+
+128_firefox=Windows and Tabs
diff --git a/browser/metro/base/content/browser.xul b/browser/metro/base/content/browser.xul
index 173656f8a17..6b03fd1d7cf 100644
--- a/browser/metro/base/content/browser.xul
+++ b/browser/metro/base/content/browser.xul
@@ -258,6 +258,52 @@
       <button class="content-navigator-item close-button" command="cmd_findClose"/>
     </appbar>
 
+    <!-- Navbar -->
+    <appbar id="navbar" mousethrough="never" observes="bcast_windowState">
+      <hbox id="progress-container" layer="true">
+        <hbox id="progress-control" />
+      </hbox>
+
+      <!-- Main Toolbar -->
+      <toolbar id="toolbar" observes="bcast_windowState" flex="1">
+        <observes element="bcast_windowState" attribute="*"/>
+        <observes element="bcast_urlbarState" attribute="*"/>
+
+        <toolbarbutton id="back-button" class="appbar-primary" command="cmd_back"/>
+        <toolbarbutton id="forward-button" class="appbar-primary" command="cmd_forward"/>
+
+        <hbox id="urlbar-container" flex="1" observes="bcast_urlbarState">
+          <hbox id="urlbar" flex="1">
+            <box id="identity-box" role="button">
+              <hbox id="identity-box-inner" align="center" mousethrough="always">
+                <image id="identity-icon"/>
+              </hbox>
+            </box>
+
+            <textbox id="urlbar-edit"
+                     type="url"
+                     class="uri-element"
+                     autocompletesearch="history"
+                     autocompletepopup="start-autocomplete"
+                     completeselectedindex="true"
+                     placeholder="&urlbar.emptytext;"
+                     flex="1"
+                     ontextentered="BrowserUI.handleUrlbarEnter(param);"
+                     onkeydown="BrowserUI.navEditKeyPress();"
+                     onblur="BrowserUI._urlbarBlurred();"/>
+          </hbox>
+
+          <toolbarbutton id="reload-button" oncommand="CommandUpdater.doCommand(event.shiftKey ? 'cmd_forceReload' : 'cmd_reload');"/>
+          <toolbarbutton id="stop-button" command="cmd_stop"/>
+        </hbox>
+
+        <toolbarbutton id="download-button" oncommand="Appbar.onDownloadButton()"/>
+        <toolbarbutton id="star-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onStarButton()"/>
+        <toolbarbutton id="pin-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onPinButton()"/>
+        <toolbarbutton id="menu-button" class="appbar-primary" oncommand="Appbar.onMenuButton(event)"/>
+       </toolbar>
+    </appbar>
+
     <vbox id="panel-container" hidden="true" class="window-width window-height meta" observes="bcast_windowState">
       <hbox id="panel-header">
         <toolbarbutton id="panel-close-button" command="cmd_panel"/>
@@ -309,52 +355,6 @@
       </deck>
     </vbox>
 
-    <!-- Navbar -->
-    <appbar id="navbar" mousethrough="never" observes="bcast_windowState">
-      <hbox id="progress-container" layer="true">
-        <hbox id="progress-control" />
-      </hbox>
-
-      <!-- Main Toolbar -->
-      <toolbar id="toolbar" observes="bcast_windowState" flex="1">
-        <observes element="bcast_windowState" attribute="*"/>
-        <observes element="bcast_urlbarState" attribute="*"/>
-
-        <toolbarbutton id="back-button" class="appbar-primary" command="cmd_back"/>
-        <toolbarbutton id="forward-button" class="appbar-primary" command="cmd_forward"/>
-
-        <hbox id="urlbar-container" flex="1" observes="bcast_urlbarState">
-          <hbox id="urlbar" flex="1">
-            <box id="identity-box" role="button">
-              <hbox id="identity-box-inner" align="center" mousethrough="always">
-                <image id="identity-icon"/>
-              </hbox>
-            </box>
-
-            <textbox id="urlbar-edit"
-                     type="url"
-                     class="uri-element"
-                     autocompletesearch="history"
-                     autocompletepopup="start-autocomplete"
-                     completeselectedindex="true"
-                     placeholder="&urlbar.emptytext;"
-                     flex="1"
-                     ontextentered="BrowserUI.handleUrlbarEnter(param);"
-                     onkeydown="BrowserUI.navEditKeyPress();"
-                     onblur="BrowserUI._urlbarBlurred();"/>
-          </hbox>
-
-          <toolbarbutton id="reload-button" oncommand="CommandUpdater.doCommand(event.shiftKey ? 'cmd_forceReload' : 'cmd_reload');"/>
-          <toolbarbutton id="stop-button" command="cmd_stop"/>
-        </hbox>
-
-        <toolbarbutton id="download-button" oncommand="Appbar.onDownloadButton()"/>
-        <toolbarbutton id="star-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onStarButton()"/>
-        <toolbarbutton id="pin-button" class="appbar-primary" type="checkbox" oncommand="Appbar.onPinButton()"/>
-        <toolbarbutton id="menu-button" class="appbar-primary" oncommand="Appbar.onMenuButton(event)"/>
-       </toolbar>
-    </appbar>
-
     <!-- Context button bar -->
     <appbar id="contextappbar">
       <toolbar id="contextualactions-tray" flex="1">
diff --git a/browser/themes/linux/browser.css b/browser/themes/linux/browser.css
index 3ec5ab323da..1c5956880eb 100644
--- a/browser/themes/linux/browser.css
+++ b/browser/themes/linux/browser.css
@@ -1004,30 +1004,16 @@ toolbar[iconsize="small"] #webrtc-status-button {
   color: GrayText;
 }
 
-/* Favicon */
+%include ../shared/identity-block.inc.css
+
 #page-proxy-favicon {
-  width: 16px;
-  height: 16px;
   margin-top: 2px;
   margin-bottom: 2px;
   -moz-margin-start: 4px;
   -moz-margin-end: 3px;
-  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
   -moz-image-region: rect(0, 16px, 16px, 0);
 }
 
-.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
-}
-
-.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
-}
-
-.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
-}
-
 #identity-box:hover > #page-proxy-favicon {
   -moz-image-region: rect(0, 32px, 16px, 16px);
 }
@@ -1037,10 +1023,6 @@ toolbar[iconsize="small"] #webrtc-status-button {
   -moz-image-region: rect(0, 48px, 16px, 32px);
 }
 
-#page-proxy-favicon[pageproxystate="invalid"] {
-  opacity: 0.3;
-}
-
 /* Identity indicator */
 #identity-box {
   padding: 1px;
@@ -1069,21 +1051,10 @@ toolbar[iconsize="small"] #webrtc-status-button {
   -moz-padding-end: 5px;
 }
 
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
 #urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
   background-color: #fff;
-  color: hsl(92,100%,30%);
   -moz-margin-end: 4px;
-  background-image: linear-gradient(hsla(92,81%,16%,0),
-                                    hsla(92,81%,16%,.2) 25%,
-                                    hsla(92,81%,16%,.2) 75%,
-                                    hsla(92,81%,16%,0));
-  background-position: right;
-  background-size: 1px;
-  background-repeat: no-repeat;
-}
-
-#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
-  background-position: left;
 }
 
 /* Identity popup icons */
diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn
index 821a599f4c8..37dc96763a6 100644
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -9,6 +9,7 @@ browser.jar:
 * skin/classic/browser/aboutPrivateBrowsing.css
 * skin/classic/browser/aboutSessionRestore.css
   skin/classic/browser/aboutSessionRestore-window-icon.png
+  skin/classic/browser/aboutWelcomeBack.css                     (../shared/aboutWelcomeBack.css)
   skin/classic/browser/aboutCertError.css
   skin/classic/browser/aboutCertError_sectionCollapsed.png
   skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css
index 01adaced6f0..6a981ed030d 100644
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@@ -1291,20 +1291,9 @@ toolbar[mode="icons"] #zoom-in-button {
   padding-right: 10.01px;
 }
 
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
 #urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
-  color: hsl(92,100%,30%);
   -moz-padding-end: 4px;
-  background-image: linear-gradient(hsla(92,81%,16%,0),
-                                    hsla(92,81%,16%,.2) 25%,
-                                    hsla(92,81%,16%,.2) 75%,
-                                    hsla(92,81%,16%,0));
-  background-position: right;
-  background-size: 1px;
-  background-repeat: no-repeat;
-}
-
-#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
-  background-position: left;
 }
 
 #identity-box:-moz-focusring {
@@ -1374,38 +1363,36 @@ toolbar[mode="icons"] #zoom-in-button {
   height: 22px;
 }
 
+%include ../shared/identity-block.inc.css
+
 #page-proxy-favicon {
-  width: 16px;
-  height: 16px;
   margin: 0px;
   padding: 0px;
-  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
   -moz-image-region: rect(0, 16px, 16px, 0);
 }
 
-.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
-}
-
-.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
-}
-
-.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
-}
-
 #identity-box:hover:active > #page-proxy-favicon,
 #identity-box[open=true] > #page-proxy-favicon {
   -moz-image-region: rect(0, 32px, 16px, 16px);
 }
 
+/* The chromeUI identity-icon set includes three states,
+   but OS X only uses two of them. */
+#identity-box.chromeUI:hover:active > #page-proxy-favicon,
+#identity-box.chromeUI[open=true] > #page-proxy-favicon {
+  -moz-image-region: rect(0, 48px, 16px, 32px);
+}
+
 @media (min-resolution: 2dppx) {
   #page-proxy-favicon {
     list-style-image: url(chrome://browser/skin/identity-icons-generic@2x.png);
     -moz-image-region: rect(0, 32px, 32px, 0);
   }
 
+  .chromeUI > #page-proxy-favicon[pageproxystate="valid"] {
+    list-style-image: url(chrome://branding/content/identity-icons-brand@2x.png);
+  }
+
   .verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
     list-style-image: url(chrome://browser/skin/identity-icons-https@2x.png);
   }
@@ -1422,10 +1409,13 @@ toolbar[mode="icons"] #zoom-in-button {
   #identity-box[open=true] > #page-proxy-favicon {
     -moz-image-region: rect(0, 64px, 32px, 32px);
   }
-}
 
-#page-proxy-favicon[pageproxystate="invalid"] {
-  opacity: 0.3;
+  /* The chromeUI identity-icon set includes three states,
+     but OS X only uses two of them. */
+  #identity-box.chromeUI:hover:active > #page-proxy-favicon,
+  #identity-box.chromeUI[open=true] > #page-proxy-favicon {
+    -moz-image-region: rect(0, 96px, 32px, 64px);
+  }
 }
 
 #wrapper-urlbar-container[place="palette"] {
@@ -2964,6 +2954,10 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   #identity-popup.verifiedIdentity > #identity-popup-container > #identity-popup-icon {
     -moz-image-region: rect(256px, 128px, 384px, 0px);
   }
+
+  #identity-popup.chromeUI > #identity-popup-container > #identity-popup-icon {
+    list-style-image: url("chrome://branding/content/icon128.png");
+  }
 }
 
 /* Popup Body Text */
diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn
index 0874e564443..fbf8529d170 100644
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -8,6 +8,7 @@ browser.jar:
 * skin/classic/browser/aboutPrivateBrowsing.css             (aboutPrivateBrowsing.css)
 * skin/classic/browser/aboutSessionRestore.css              (aboutSessionRestore.css)
   skin/classic/browser/aboutSessionRestore-window-icon.png
+  skin/classic/browser/aboutWelcomeBack.css                 (../shared/aboutWelcomeBack.css)
   skin/classic/browser/aboutCertError.css
   skin/classic/browser/aboutCertError_sectionCollapsed.png
   skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
diff --git a/browser/themes/shared/aboutWelcomeBack.css b/browser/themes/shared/aboutWelcomeBack.css
new file mode 100644
index 00000000000..f38dda1881f
--- /dev/null
+++ b/browser/themes/shared/aboutWelcomeBack.css
@@ -0,0 +1,7 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#errorPageContainer {
+  background-image: url("chrome://global/skin/icons/information-64.png");
+}
diff --git a/browser/themes/shared/identity-block.inc.css b/browser/themes/shared/identity-block.inc.css
new file mode 100644
index 00000000000..5d60034c126
--- /dev/null
+++ b/browser/themes/shared/identity-block.inc.css
@@ -0,0 +1,93 @@
+%if 0
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+%endif
+
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
+#urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
+  background-position: right;
+  background-size: 1px;
+  background-repeat: no-repeat;
+}
+
+#urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
+  color: hsl(92,100%,30%);
+  background-image: linear-gradient(hsla(92,81%,16%,0),
+                                    hsla(92,81%,16%,.2) 35%,
+                                    hsla(92,81%,16%,.2) 65%,
+                                    hsla(92,81%,16%,0));
+}
+
+
+%ifdef MOZ_OFFICIAL_BRANDING
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI {
+  color: rgb(229,115,0);
+  background-image: linear-gradient(rgba(229,114,0,0),
+                                    rgba(229,114,0,.5) 35%,
+                                    rgba(229,114,0,.5) 65%,
+                                    rgba(229,114,0,0));
+}
+%else
+%if MOZ_UPDATE_CHANNEL == aurora
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI {
+  color: hsl(214,90%,23%);
+  background-image: linear-gradient(hsla(208,99%,37%,0),
+                                    hsla(214,90%,23%,.5) 35%,
+                                    hsla(214,90%,23%,.5) 65%,
+                                    hsla(214,90%,23%,0));
+}
+%else
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI {
+  color: hsl(211,33%,32%);
+  background-image: linear-gradient(hsla(211,33%,32%,0),
+                                    hsla(211,33%,32%,.5) 35%,
+                                    hsla(211,33%,32%,.5) 65%,
+                                    hsla(211,33%,32%,0));
+}
+%endif
+%endif
+
+#identity-box.chromeUI:-moz-locale-dir(rtl),
+#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
+  background-position: left;
+}
+
+/* page proxy icon */
+
+#page-proxy-favicon {
+  width: 16px;
+  height: 16px;
+  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
+}
+
+.chromeUI > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://branding/content/identity-icons-brand.png);
+}
+
+.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
+}
+
+.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
+}
+
+.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
+  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
+}
+
+#page-proxy-favicon[pageproxystate="invalid"] {
+  opacity: 0.3;
+}
+
+#identity-popup.chromeUI > #identity-popup-container > #identity-popup-icon {
+  list-style-image: url("chrome://branding/content/icon64.png");
+}
+
+#identity-popup-brandName {
+  font-weight: bold;
+  font-size: 1.25em;
+  margin-top: .5em;
+  margin-bottom: .5em;
+}
diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css
index 19ddb29805a..6bd1a852706 100644
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@@ -1457,20 +1457,9 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
   padding-right: 5.01px;
 }
 
+#urlbar[pageproxystate="valid"] > #identity-box.chromeUI,
 #urlbar[pageproxystate="valid"] > #identity-box.verifiedIdentity {
-  color: hsl(92,100%,30%);
   -moz-margin-end: 4px;
-  background-image: linear-gradient(hsla(92,81%,16%,0),
-                                    hsla(92,81%,16%,.2) 25%,
-                                    hsla(92,81%,16%,.2) 75%,
-                                    hsla(92,81%,16%,0));
-  background-position: right;
-  background-size: 1px;
-  background-repeat: no-repeat;
-}
-
-#identity-box.verifiedIdentity:-moz-locale-dir(rtl) {
-  background-position: left;
 }
 
 #identity-box.verifiedIdentity:not(:-moz-lwtheme) {
@@ -1512,14 +1501,13 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
 
 /* page proxy icon */
 
+%include ../shared/identity-block.inc.css
+
 #page-proxy-favicon {
-  width: 16px;
-  height: 16px;
   margin-top: 1px;
   margin-bottom: 1px;
   -moz-margin-start: 3px;
   -moz-margin-end: 2px;
-  list-style-image: url(chrome://browser/skin/identity-icons-generic.png);
   -moz-image-region: rect(0, 16px, 16px, 0);
 }
 
@@ -1527,18 +1515,6 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
   -moz-margin-end: 1px;
 }
 
-.verifiedDomain > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https.png);
-}
-
-.verifiedIdentity > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-ev.png);
-}
-
-.mixedActiveContent > #page-proxy-favicon[pageproxystate="valid"] {
-  list-style-image: url(chrome://browser/skin/identity-icons-https-mixed-active.png);
-}
-
 #identity-box:hover > #page-proxy-favicon {
   -moz-image-region: rect(0, 32px, 16px, 16px);
 }
@@ -1548,10 +1524,6 @@ html|*.urlbar-input:-moz-lwtheme::-moz-placeholder,
   -moz-image-region: rect(0, 48px, 16px, 32px);
 }
 
-#page-proxy-favicon[pageproxystate="invalid"] {
-  opacity: 0.3;
-}
-
 /* autocomplete */
 
 #treecolAutoCompleteImage {
diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn
index 640be2dd57a..ffaf3c4a2c5 100644
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -11,6 +11,7 @@ browser.jar:
 *       skin/classic/browser/aboutPrivateBrowsing.css
 *       skin/classic/browser/aboutSessionRestore.css
         skin/classic/browser/aboutSessionRestore-window-icon.png     (preferences/application.png)
+        skin/classic/browser/aboutWelcomeBack.css                    (../shared/aboutWelcomeBack.css)
         skin/classic/browser/aboutCertError.css
         skin/classic/browser/aboutCertError_sectionCollapsed.png
         skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
diff --git a/caps/src/nsPrincipal.cpp b/caps/src/nsPrincipal.cpp
index 19c0c3f1c77..70d95f74e77 100644
--- a/caps/src/nsPrincipal.cpp
+++ b/caps/src/nsPrincipal.cpp
@@ -840,8 +840,7 @@ nsExpandedPrincipal::CheckMayLoad(nsIURI* uri, bool aReport, bool aAllowIfInheri
 NS_IMETHODIMP
 nsExpandedPrincipal::GetHashValue(uint32_t* result)
 {
-  MOZ_NOT_REACHED("extended principal should never be used as key in a hash map");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("extended principal should never be used as key in a hash map");
 }
 
 NS_IMETHODIMP
diff --git a/config/purge_directories.py b/config/purge_directories.py
new file mode 100644
index 00000000000..899824b22d4
--- /dev/null
+++ b/config/purge_directories.py
@@ -0,0 +1,77 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This script is used to purge a directory of unwanted files as defined by
+# a manifest file.
+
+from __future__ import print_function, unicode_literals
+
+import argparse
+import os
+import sys
+import threading
+
+from mozpack.manifests import PurgeManifest
+
+def do_purge(purger, dest, state):
+    state['result'] = purger.purge(dest)
+
+def process_manifest(topdir, manifest_path):
+    manifest = PurgeManifest.from_path(manifest_path)
+    purger = manifest.get_purger()
+    full = os.path.join(topdir, manifest.relpath)
+
+    state = dict(
+        relpath=manifest.relpath,
+        result=None,
+    )
+
+    t = threading.Thread(target=do_purge, args=(purger, full, state))
+    state['thread'] = t
+    t.start()
+
+    return state
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(
+        description='Purge a directory of untracked files.')
+
+    parser.add_argument('--directory', '-d',
+        help='Directory containing manifest files. Will process every file '
+            'in directory.')
+    parser.add_argument('topdir',
+        help='Top directory all paths are evaluated from.')
+    parser.add_argument('manifests', nargs='*',
+        help='List of manifest files defining purge operations to perform.')
+
+    args = parser.parse_args()
+
+    states = []
+
+    print('Purging unaccounted files from object directory...')
+
+    # We perform purging using threads for performance reasons. Hopefully
+    # multiple I/O operations will be faster than just 1.
+    paths = []
+    if args.directory:
+        for path in sorted(os.listdir(args.directory)):
+            paths.append(os.path.join(args.directory, path))
+
+    paths.extend(args.manifests)
+
+    for path in paths:
+        states.append(process_manifest(args.topdir, path))
+
+    for state in states:
+        state['thread'].join()
+        print('Deleted %d files and %d directories from %s.' % (
+            state['result'].removed_files_count,
+            state['result'].removed_directories_count,
+            state['relpath']
+        ))
+
+    print('Finished purging.')
+
+    sys.exit(0)
diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index d4a52a960d9..63f192f8af5 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -611,7 +611,8 @@ public:
 
   /**
    * Returns the content node that is the parent of this node in the flattened
-   * tree.
+   * tree. For nodes that are not filtered into an insertion point, this
+   * simply returns their DOM parent in the original DOM tree.
    *
    * @return the flattened tree parent
    */
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index d84be96f710..a93c77f28ee 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -13,6 +13,7 @@
 #include "nsCompatibility.h"             // for member
 #include "nsCOMPtr.h"                    // for member
 #include "nsGkAtoms.h"                   // for static class members
+#include "nsIChannel.h"                  // for member
 #include "nsIDocumentEncoder.h"          // for member (in nsCOMPtr)
 #include "nsIDocumentObserver.h"         // for typedef (nsUpdateType)
 #include "nsIFrameRequestCallback.h"     // for member (in nsCOMPtr)
@@ -255,10 +256,14 @@ public:
   /**
    * Return the base URI for relative URIs in the document (the document uri
    * unless it's overridden by SetBaseURI, HTML <base> tags, etc.).  The
-   * returned URI could be null if there is no document URI.
+   * returned URI could be null if there is no document URI.  If the document
+   * is a srcdoc document, return the parent document's base URL.
    */
   nsIURI* GetDocBaseURI() const
   {
+    if (mIsSrcdocDocument && mParentDocument) {
+      return mParentDocument->GetDocBaseURI();
+    }
     return mDocumentBaseURI ? mDocumentBaseURI : mDocumentURI;
   }
   virtual already_AddRefed<nsIURI> GetBaseURI() const MOZ_OVERRIDE
@@ -628,6 +633,28 @@ public:
     return true;
   }
 
+  /**
+   * Return whether the document was created by a srcdoc iframe.
+   */
+  bool IsSrcdocDocument() const {
+    return mIsSrcdocDocument;
+  }
+
+  /**
+   * Sets whether the document was created by a srcdoc iframe.
+   */
+  void SetIsSrcdocDocument(bool aIsSrcdocDocument) {
+    mIsSrcdocDocument = aIsSrcdocDocument;
+  }
+
+  /*
+   * Gets the srcdoc string from within the channel (assuming both exist).
+   * Returns a void string if this isn't a srcdoc document or if
+   * the channel has not been set.
+   */
+  nsresult GetSrcdocData(nsAString& aSrcdocData);
+
+
 protected:
   virtual Element *GetRootElementInternal() const = 0;
 
@@ -1314,18 +1341,6 @@ public:
     return mHaveFiredTitleChange;
   }
 
-  /**
-   * See GetXBLChildNodesFor on nsBindingManager
-   */
-  virtual nsresult GetXBLChildNodesFor(nsIContent* aContent,
-                                       nsIDOMNodeList** aResult) = 0;
-
-  /**
-   * See GetContentListFor on nsBindingManager
-   */
-  virtual nsresult GetContentListFor(nsIContent* aContent,
-                                     nsIDOMNodeList** aResult) = 0;
-
   /**
    * See GetAnonymousElementByAttribute on nsIDOMDocumentXBL.
    */
@@ -2308,6 +2323,9 @@ protected:
   // Whether style sheet change events will be dispatched for this document
   bool mStyleSheetChangeEventsEnabled;
 
+  // Whether the document was created by a srcdoc iframe.
+  bool mIsSrcdocDocument;
+
   // The document's script global object, the object from which the
   // document can get its script context and scope. This is the
   // *inner* window object.
@@ -2327,6 +2345,9 @@ protected:
   uint32_t mSandboxFlags;
 
   nsCString mContentLanguage;
+
+  // The channel that got passed to nsDocument::StartDocumentLoad(), if any.
+  nsCOMPtr<nsIChannel> mChannel;
 private:
   nsCString mContentType;
 protected:
diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h
index 6c5f2873372..2637fe7200b 100644
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -114,8 +114,6 @@ enum {
   // node in fact has a class, but may be set even if it doesn't.
   NODE_MAY_HAVE_CLASS =                   NODE_FLAG_BIT(8),
 
-  NODE_IS_INSERTION_PARENT =              NODE_FLAG_BIT(9),
-
   // Node has an :empty or :-moz-only-whitespace selector
   NODE_HAS_EMPTY_SELECTOR =               NODE_FLAG_BIT(10),
 
diff --git a/content/base/src/ChildIterator.cpp b/content/base/src/ChildIterator.cpp
new file mode 100644
index 00000000000..9de77c40763
--- /dev/null
+++ b/content/base/src/ChildIterator.cpp
@@ -0,0 +1,158 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ChildIterator.h"
+#include "nsXBLChildrenElement.h"
+
+namespace mozilla {
+namespace dom {
+
+nsIContent*
+ExplicitChildIterator::GetNextChild()
+{
+  // If we're already in the inserted-children array, look there first
+  if (mIndexInInserted) {
+    MOZ_ASSERT(mChild);
+    MOZ_ASSERT(mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL));
+    MOZ_ASSERT(!mDefaultChild);
+
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (mIndexInInserted < point->mInsertedChildren.Length()) {
+      return point->mInsertedChildren[mIndexInInserted++];
+    }
+    mIndexInInserted = 0;
+    mChild = mChild->GetNextSibling();
+  } else if (mDefaultChild) {
+    // If we're already in default content, check if there are more nodes there
+    MOZ_ASSERT(mChild);
+    MOZ_ASSERT(mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL));
+
+    mDefaultChild = mDefaultChild->GetNextSibling();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetNextSibling();
+  } else if (mIsFirst) {  // at the beginning of the child list
+    mChild = mParent->GetFirstChild();
+    mIsFirst = false;
+  } else if (mChild) { // in the middle of the child list
+    mChild = mChild->GetNextSibling();
+  }
+
+  // Iterate until we find a non-<children>, or a <children> with content.
+  while (mChild &&
+         mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (!point->mInsertedChildren.IsEmpty()) {
+      mIndexInInserted = 1;
+      return point->mInsertedChildren[0];
+    }
+
+    mDefaultChild = mChild->GetFirstChild();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetNextSibling();
+  }
+
+  return mChild;
+}
+
+FlattenedChildIterator::FlattenedChildIterator(nsIContent* aParent)
+  : ExplicitChildIterator(aParent), mXBLInvolved(false)
+{
+  nsXBLBinding* binding =
+    aParent->OwnerDoc()->BindingManager()->GetBindingWithContent(aParent);
+
+  if (binding) {
+    nsIContent* anon = binding->GetAnonymousContent();
+    if (anon) {
+      mParent = anon;
+      mXBLInvolved = true;
+    }
+  }
+
+  // We set mXBLInvolved to true if either:
+  // - The node we're iterating has a binding with content attached to it.
+  // - The node is generated XBL content and has an <xbl:children> child.
+  if (!mXBLInvolved && aParent->GetBindingParent()) {
+    for (nsIContent* child = aParent->GetFirstChild();
+         child;
+         child = child->GetNextSibling()) {
+      if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+        mXBLInvolved = true;
+        break;
+      }
+    }
+  }
+}
+
+nsIContent* FlattenedChildIterator::Get()
+{
+  MOZ_ASSERT(!mIsFirst);
+
+  if (mIndexInInserted) {
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    return point->mInsertedChildren[mIndexInInserted - 1];
+  }
+  return mDefaultChild ? mDefaultChild : mChild;
+}
+
+nsIContent* FlattenedChildIterator::GetPreviousChild()
+{
+  // If we're already in the inserted-children array, look there first
+  if (mIndexInInserted) {
+    // NB: mIndexInInserted points one past the last returned child so we need
+    // to look *two* indices back in order to return the previous child.
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (--mIndexInInserted) {
+      return point->mInsertedChildren[mIndexInInserted - 1];
+    }
+    mChild = mChild->GetPreviousSibling();
+  } else if (mDefaultChild) {
+    // If we're already in default content, check if there are more nodes there
+    mDefaultChild = mDefaultChild->GetPreviousSibling();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetPreviousSibling();
+  } else if (mIsFirst) { // at the beginning of the child list
+    return nullptr;
+  } else if (mChild) { // in the middle of the child list
+    mChild = mChild->GetPreviousSibling();
+  } else { // at the end of the child list
+    mChild = mParent->GetLastChild();
+  }
+
+  // Iterate until we find a non-<children>, or a <children> with content.
+  while (mChild &&
+         mChild->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(mChild);
+    if (!point->mInsertedChildren.IsEmpty()) {
+      mIndexInInserted = point->InsertedChildrenLength();
+      return point->mInsertedChildren[mIndexInInserted - 1];
+    }
+
+    mDefaultChild = mChild->GetLastChild();
+    if (mDefaultChild) {
+      return mDefaultChild;
+    }
+
+    mChild = mChild->GetPreviousSibling();
+  }
+
+  if (!mChild) {
+    mIsFirst = true;
+  }
+
+  return mChild;
+}
+
+} // namespace dom
+} // namespace mozilla
diff --git a/content/base/src/ChildIterator.h b/content/base/src/ChildIterator.h
new file mode 100644
index 00000000000..170ecd0df86
--- /dev/null
+++ b/content/base/src/ChildIterator.h
@@ -0,0 +1,106 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Iterates over the children on a node. If a child is an insertion point,
+ * iterates over the children inserted there instead, or the default content
+ * if no children are inserted there.
+ *
+ * The FlattenedChildIterator expands any anonymous content bound from an XBL
+ * binding's <xbl:content> element.
+ */
+
+#include "nsIContent.h"
+
+namespace mozilla {
+namespace dom {
+
+// This class iterates normal DOM child nodes of a given DOM node with
+// <xbl:children> nodes replaced by the elements that have been filtered into that
+// insertion point. Any bindings on the given element are ignored for purposes
+// of determining which insertion point children are filtered into.
+class ExplicitChildIterator
+{
+public:
+  ExplicitChildIterator(nsIContent* aParent)
+    : mParent(aParent),
+      mChild(nullptr),
+      mDefaultChild(nullptr),
+      mIndexInInserted(0),
+      mIsFirst(true)
+  {
+  }
+
+  nsIContent* GetNextChild();
+
+protected:
+  // The parent of the children being iterated. For the FlattenedChildIterator,
+  // if there is a binding attached to the original parent, mParent points to
+  // the <xbl:content> element for the binding.
+  nsIContent* mParent;
+
+  // The current child. When we encounter an <xbl:children> insertion point,
+  // mChild remains as the insertion point whose content we're iterating (and
+  // our state is controled by mDefaultChild or mIndexInInserted depending on
+  // whether the insertion point expands to its default content or not).
+  nsIContent* mChild;
+
+  // If non-null, this points to the current default content for the current
+  // insertion point that we're iterating (i.e. mChild, which must be an
+  // nsXBLChildrenElement). Once this transitions back to null,
+  // we continue iterating at mChild's next sibling.
+  nsIContent* mDefaultChild;
+
+  // If not zero, we're iterating inserted children for an insertion point. This
+  // is an index into mChild's inserted children array (mChild must be an
+  // nsXBLChildrenElement). The index is one past the "current" child (as
+  // opposed to mChild which represents the "current" child).
+  uint32_t mIndexInInserted;
+
+  // A flag to let us know that we haven't started iterating yet.
+  bool mIsFirst;
+};
+
+// Iterates over the flattened children of a node, which accounts for anonymous
+// children and nodes moved by insertion points. If a node has anonymous
+// children, those are iterated over.
+class FlattenedChildIterator : public ExplicitChildIterator
+{
+public:
+  FlattenedChildIterator(nsIContent* aParent);
+
+  // Returns the current target of this iterator (which might be an explicit
+  // child of the node, default content for an <xbl:children> element or
+  // an inserted child for an <xbl:children> element.
+  nsIContent* Get();
+
+  // The inverse of GetNextChild. Properly steps in and out of <xbl:children>
+  // elements.
+  nsIContent* GetPreviousChild();
+
+  // Looks for aChildToFind respecting XBL insertion points.
+  void Seek(nsIContent* aChildToFind)
+  {
+    // It would be nice to assert that we find aChildToFind, but bz thinks that
+    // we might not find aChildToFind when called from ContentInserted
+    // if first-letter frames are about.
+
+    nsIContent* child;
+    do {
+      child = GetNextChild();
+    } while (child && child != aChildToFind);
+  }
+
+  bool XBLInvolved() { return mXBLInvolved; }
+
+private:
+  // For certain optimizations, nsCSSFrameConstructor needs to know if the
+  // child list of the element that we're iterating matches its .childNodes.
+  bool mXBLInvolved;
+};
+
+} // namespace dom
+} // namespace mozilla
diff --git a/content/base/src/Element.cpp b/content/base/src/Element.cpp
index 9521873ef8d..a6350f0cec8 100644
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -73,6 +73,7 @@
 #include "nsLayoutUtils.h"
 #include "nsGkAtoms.h"
 #include "nsContentUtils.h"
+#include "ChildIterator.h"
 
 #include "nsIDOMEventListener.h"
 #include "nsIWebNavigation.h"
@@ -94,7 +95,6 @@
 #include "nsView.h"
 #include "nsViewManager.h"
 #include "nsIScrollableFrame.h"
-#include "nsXBLInsertionPoint.h"
 #include "mozilla/css/StyleRule.h" /* For nsCSSSelectorList */
 #include "nsCSSRuleProcessor.h"
 #include "nsRuleProcessorData.h"
@@ -909,60 +909,6 @@ Element::HasAttributeNS(const nsAString& aNamespaceURI,
   return HasAttr(nsid, name);
 }
 
-static nsXBLBinding*
-GetFirstBindingWithContent(nsBindingManager* aBmgr, nsIContent* aBoundElem)
-{
-  nsXBLBinding* binding = aBmgr->GetBinding(aBoundElem);
-  while (binding) {
-    if (binding->GetAnonymousContent()) {
-      return binding;
-    }
-    binding = binding->GetBaseBinding();
-  }
-  
-  return nullptr;
-}
-
-static nsresult
-BindNodesInInsertPoints(nsXBLBinding* aBinding, nsIContent* aInsertParent,
-                        nsIDocument* aDocument)
-{
-  NS_PRECONDITION(aBinding && aInsertParent, "Missing arguments");
-
-  nsresult rv;
-  // These should be refcounted or otherwise protectable.
-  nsInsertionPointList* inserts =
-    aBinding->GetExistingInsertionPointsFor(aInsertParent);
-  if (inserts) {
-    bool allowScripts = aBinding->AllowScripts();
-#ifdef MOZ_XUL
-    nsCOMPtr<nsIXULDocument> xulDoc = do_QueryInterface(aDocument);
-#endif
-    uint32_t i;
-    for (i = 0; i < inserts->Length(); ++i) {
-      nsCOMPtr<nsIContent> insertRoot =
-        inserts->ElementAt(i)->GetDefaultContent();
-      if (insertRoot) {
-        for (nsCOMPtr<nsIContent> child = insertRoot->GetFirstChild();
-             child;
-             child = child->GetNextSibling()) {
-          rv = child->BindToTree(aDocument, aInsertParent,
-                                 aBinding->GetBoundElement(), allowScripts);
-          NS_ENSURE_SUCCESS(rv, rv);
-
-#ifdef MOZ_XUL
-          if (xulDoc) {
-            xulDoc->AddSubtreeToDocument(child);
-          }
-#endif
-        }
-      }
-    }
-  }
-
-  return NS_OK;
-}
-
 already_AddRefed<nsIHTMLCollection>
 Element::GetElementsByClassName(const nsAString& aClassNames)
 {
@@ -1104,9 +1050,8 @@ Element::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
   if (hadForceXBL) {
     nsBindingManager* bmgr = OwnerDoc()->BindingManager();
 
+    nsXBLBinding* contBinding = bmgr->GetBindingWithContent(this);
     // First check if we have a binding...
-    nsXBLBinding* contBinding =
-      GetFirstBindingWithContent(bmgr, this);
     if (contBinding) {
       nsCOMPtr<nsIContent> anonRoot = contBinding->GetAnonymousContent();
       bool allowScripts = contBinding->AllowScripts();
@@ -1116,21 +1061,6 @@ Element::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
         rv = child->BindToTree(aDocument, this, this, allowScripts);
         NS_ENSURE_SUCCESS(rv, rv);
       }
-
-      // ...then check if we have content in insertion points that are
-      // direct children of the <content>
-      rv = BindNodesInInsertPoints(contBinding, this, aDocument);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-
-    // ...and finally check if we're in a binding where we have content in
-    // insertion points.
-    if (aBindingParent) {
-      nsXBLBinding* binding = bmgr->GetBinding(aBindingParent);
-      if (binding) {
-        rv = BindNodesInInsertPoints(binding, this, aDocument);
-        NS_ENSURE_SUCCESS(rv, rv);
-      }
     }
   }
 
@@ -1183,15 +1113,13 @@ class RemoveFromBindingManagerRunnable : public nsRunnable {
 public:
   RemoveFromBindingManagerRunnable(nsBindingManager* aManager,
                                    Element* aElement,
-                                   nsIDocument* aDoc,
-                                   nsIContent* aBindingParent):
-    mManager(aManager), mElement(aElement), mDoc(aDoc),
-    mBindingParent(aBindingParent)
+                                   nsIDocument* aDoc):
+    mManager(aManager), mElement(aElement), mDoc(aDoc)
   {}
 
   NS_IMETHOD Run()
   {
-    mManager->RemovedFromDocumentInternal(mElement, mDoc, mBindingParent);
+    mManager->RemovedFromDocumentInternal(mElement, mDoc);
     return NS_OK;
   }
 
@@ -1199,7 +1127,6 @@ private:
   nsRefPtr<nsBindingManager> mManager;
   nsRefPtr<Element> mElement;
   nsCOMPtr<nsIDocument> mDoc;
-  nsCOMPtr<nsIContent> mBindingParent;
 };
 
 void
@@ -1247,7 +1174,7 @@ Element::UnbindFromTree(bool aDeep, bool aNullParent)
     if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
       nsContentUtils::AddScriptRunner(
         new RemoveFromBindingManagerRunnable(document->BindingManager(), this,
-                                             document, GetBindingParent()));
+                                             document));
     }
 
     document->ClearBoxObjectFor(this);
@@ -2106,44 +2033,36 @@ Element::List(FILE* out, int32_t aIndent,
                                        getter_AddRefs(anonymousChildren));
 
   if (anonymousChildren) {
-    uint32_t length;
+    uint32_t length = 0;
     anonymousChildren->GetLength(&length);
-    if (length > 0) {
-      for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
-      fputs("anonymous-children<\n", out);
 
-      for (uint32_t i = 0; i < length; ++i) {
-        nsCOMPtr<nsIDOMNode> node;
-        anonymousChildren->Item(i, getter_AddRefs(node));
-        nsCOMPtr<nsIContent> child = do_QueryInterface(node);
-        child->List(out, aIndent + 1);
-      }
+    for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
+    fputs("anonymous-children<\n", out);
 
-      for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
-      fputs(">\n", out);
+    for (uint32_t i = 0; i < length; ++i) {
+      nsCOMPtr<nsIDOMNode> node;
+      anonymousChildren->Item(i, getter_AddRefs(node));
+      nsCOMPtr<nsIContent> child = do_QueryInterface(node);
+      child->List(out, aIndent + 1);
     }
-  }
 
-  if (bindingManager->HasContentListFor(nonConstThis)) {
-    nsCOMPtr<nsIDOMNodeList> contentList;
-    bindingManager->GetContentListFor(nonConstThis,
-                                      getter_AddRefs(contentList));
+    for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
+    fputs(">\n", out);
 
-    NS_ASSERTION(contentList != nullptr, "oops, binding manager lied");
-    
-    uint32_t length;
-    contentList->GetLength(&length);
-    if (length > 0) {
-      for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
-      fputs("content-list<\n", out);
+    bool outHeader = false;
+    ExplicitChildIterator iter(nonConstThis);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+      if (!outHeader) {
+        outHeader = true;
 
-      for (uint32_t i = 0; i < length; ++i) {
-        nsCOMPtr<nsIDOMNode> node;
-        contentList->Item(i, getter_AddRefs(node));
-        nsCOMPtr<nsIContent> child = do_QueryInterface(node);
-        child->List(out, aIndent + 1);
+        for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
+        fputs("content-list<\n", out);
       }
 
+      child->List(out, aIndent + 1);
+    }
+
+    if (outHeader) {
       for (indent = aIndent; --indent >= 0; ) fputs("  ", out);
       fputs(">\n", out);
     }
@@ -2708,7 +2627,7 @@ public:
             EncodeTextFragment(u.mTextFragment, aOut);
             break;
           default:
-            MOZ_NOT_REACHED("Unknown unit type?");
+            MOZ_CRASH("Unknown unit type?");
         }
       }
     }
diff --git a/content/base/src/FragmentOrElement.cpp b/content/base/src/FragmentOrElement.cpp
index 293de9a30f8..b3873a3c466 100644
--- a/content/base/src/FragmentOrElement.cpp
+++ b/content/base/src/FragmentOrElement.cpp
@@ -94,7 +94,7 @@
 #include "nsView.h"
 #include "nsViewManager.h"
 #include "nsIScrollableFrame.h"
-#include "nsXBLInsertionPoint.h"
+#include "ChildIterator.h"
 #include "mozilla/css/StyleRule.h" /* For nsCSSSelectorList */
 #include "nsRuleProcessorData.h"
 #include "nsAsyncDOMEvent.h"
@@ -149,16 +149,15 @@ nsIContent::FindFirstNonChromeOnlyAccessContent() const
 nsIContent*
 nsIContent::GetFlattenedTreeParent() const
 {
-  nsIContent *parent = GetParent();
-  if (parent && parent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
-    nsIDocument *doc = parent->OwnerDoc();
-    nsIContent* insertionElement =
-      doc->BindingManager()->GetNestedInsertionPoint(parent, this);
-    if (insertionElement) {
-      parent = insertionElement;
+  if (HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
+    nsIContent* parent = OwnerDoc()->BindingManager()->
+      GetInsertionParent(const_cast<nsIContent*>(this));
+    if (parent) {
+      return parent;
     }
   }
-  return parent;
+
+  return GetParent();
 }
 
 nsIContent::IMEState
@@ -653,24 +652,14 @@ FragmentOrElement::GetChildren(uint32_t aFilter)
   // explict content altered by insertion point if we were requested for XBL
   // anonymous content, otherwise append explicit content with respect to
   // insertion point if any.
-  nsINodeList *childList = nullptr;
-
-  nsIDocument* document = OwnerDoc();
   if (!(aFilter & eAllButXBL)) {
-    childList = document->BindingManager()->GetXBLChildNodesFor(this);
-    if (!childList) {
-      childList = ChildNodes();
+    FlattenedChildIterator iter(this);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+      list->AppendElement(child);
     }
-
   } else {
-    childList = document->BindingManager()->GetContentListFor(this);
-  }
-
-  if (childList) {
-    uint32_t length = 0;
-    childList->GetLength(&length);
-    for (uint32_t idx = 0; idx < length; idx++) {
-      nsIContent* child = childList->Item(idx);
+    ExplicitChildIterator iter(this);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
       list->AppendElement(child);
     }
   }
diff --git a/content/base/src/moz.build b/content/base/src/moz.build
index 277a6e2203d..cb64a05ff41 100644
--- a/content/base/src/moz.build
+++ b/content/base/src/moz.build
@@ -87,6 +87,7 @@ CPP_SOURCES += [
     'nsCCUncollectableMarker.cpp',
     'nsCSPService.cpp',
     'nsChannelPolicy.cpp',
+    'ChildIterator.cpp',
     'nsContentAreaDragDrop.cpp',
     'nsContentIterator.cpp',
     'nsContentList.cpp',
diff --git a/content/base/src/nsAttrValue.cpp b/content/base/src/nsAttrValue.cpp
index 70fd5b78cc8..6917b855652 100644
--- a/content/base/src/nsAttrValue.cpp
+++ b/content/base/src/nsAttrValue.cpp
@@ -308,8 +308,7 @@ nsAttrValue::SetTo(const nsAttrValue& aOther)
     }
     case eCSSStyleRule:
     {
-      MOZ_NOT_REACHED("These should be refcounted!");
-      break;
+      MOZ_CRASH("These should be refcounted!");
     }
     case eURL:
     {
diff --git a/content/base/src/nsContentIterator.cpp b/content/base/src/nsContentIterator.cpp
index a046cf7c29e..bf4819aae03 100644
--- a/content/base/src/nsContentIterator.cpp
+++ b/content/base/src/nsContentIterator.cpp
@@ -1452,5 +1452,5 @@ nsContentSubtreeIterator::GetTopAncestorInRange(nsINode* aNode)
     content = parent;
   }
 
-  MOZ_NOT_REACHED("This should only be possible if aNode was null");
+  MOZ_CRASH("This should only be possible if aNode was null");
 }
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index df0251c0aef..40fd695b349 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -6100,11 +6100,17 @@ nsContentUtils::SetUpChannelOwner(nsIPrincipal* aLoadingPrincipal,
   if (aForceOwner || ((NS_SUCCEEDED(URIInheritsSecurityContext(aURI, &inherit)) &&
       (inherit || (aSetUpForAboutBlank && NS_IsAboutBlank(aURI)))))) {
 #ifdef DEBUG
-    // Assert that aForceOwner is only set for null principals
+    // Assert that aForceOwner is only set for null principals for non-srcdoc
+    // loads.  (Strictly speaking not all uses of about:srcdoc would be 
+    // srcdoc loads, but the URI is non-resolvable in cases where it is not).
     if (aForceOwner) {
-      nsCOMPtr<nsIURI> ownerURI;
-      nsresult rv = aLoadingPrincipal->GetURI(getter_AddRefs(ownerURI));
-      MOZ_ASSERT(NS_SUCCEEDED(rv) && SchemeIs(ownerURI, NS_NULLPRINCIPAL_SCHEME));
+      nsAutoCString uriStr;
+      aURI->GetSpec(uriStr);
+      if(!uriStr.EqualsLiteral("about:srcdoc")) {
+        nsCOMPtr<nsIURI> ownerURI;
+        nsresult rv = aLoadingPrincipal->GetURI(getter_AddRefs(ownerURI));
+        MOZ_ASSERT(NS_SUCCEEDED(rv) && SchemeIs(ownerURI, NS_NULLPRINCIPAL_SCHEME));
+      }
     }
 #endif
     aChannel->SetOwner(aLoadingPrincipal);
@@ -6287,9 +6293,6 @@ nsContentUtils::ReleaseWrapper(void* aScriptObjectHolder,
     JSObject* obj = aCache->GetWrapperPreserveColor();
     if (aCache->IsDOMBinding() && obj && js::IsProxy(obj)) {
         DOMProxyHandler::GetAndClearExpandoObject(obj);
-        if (!aCache->PreservingWrapper()) {
-          return;
-        }
     }
     aCache->SetPreservingWrapper(false);
     DropJSObjects(aScriptObjectHolder);
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index a47f13eacdf..6ab2ce69880 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -2420,6 +2420,14 @@ nsDocument::StartDocumentLoad(const char* aCommand, nsIChannel* aChannel,
   RetrieveRelevantHeaders(aChannel);
 
   mChannel = aChannel;
+  nsCOMPtr<nsIInputStreamChannel> inStrmChan = do_QueryInterface(mChannel);
+  if (inStrmChan) {
+    bool isSrcdocChannel;
+    inStrmChan->GetIsSrcdocChannel(&isSrcdocChannel);
+    if (isSrcdocChannel) {
+      mIsSrcdocDocument = true;
+    }
+  }
 
   // If this document is being loaded by a docshell, copy its sandbox flags
   // to the document. These are immutable after being set here.
@@ -3000,7 +3008,23 @@ nsDocument::GetReferrer(nsAString& aReferrer)
 void
 nsIDocument::GetReferrer(nsAString& aReferrer) const
 {
-  CopyUTF8toUTF16(mReferrer, aReferrer);
+  if (mIsSrcdocDocument && mParentDocument)
+      mParentDocument->GetReferrer(aReferrer);
+  else
+    CopyUTF8toUTF16(mReferrer, aReferrer);
+}
+
+nsresult
+nsIDocument::GetSrcdocData(nsAString &aSrcdocData)
+{
+  if (mIsSrcdocDocument) {
+    nsCOMPtr<nsIInputStreamChannel> inStrmChan = do_QueryInterface(mChannel);
+    if (inStrmChan) {
+      return inStrmChan->GetSrcdocData(aSrcdocData);
+    }
+  }
+  aSrcdocData = NullString();
+  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -6169,18 +6193,6 @@ nsDocument::ClearBoxObjectFor(nsIContent* aContent)
   }
 }
 
-nsresult
-nsDocument::GetXBLChildNodesFor(nsIContent* aContent, nsIDOMNodeList** aResult)
-{
-  return BindingManager()->GetXBLChildNodesFor(aContent, aResult);
-}
-
-nsresult
-nsDocument::GetContentListFor(nsIContent* aContent, nsIDOMNodeList** aResult)
-{
-  return BindingManager()->GetContentListFor(aContent, aResult);
-}
-
 void
 nsDocument::FlushSkinBindings()
 {
@@ -8474,8 +8486,7 @@ nsDocument::MaybePreLoadImage(nsIURI* uri, const nsAString &aCrossOriginAttr)
     loadFlags |= imgILoader::LOAD_CORS_USE_CREDENTIALS;
     break;
   default:
-    /* should never happen */
-    MOZ_NOT_REACHED("Unknown CORS mode!");
+    MOZ_CRASH("Unknown CORS mode!");
   }
 
   // Image not in cache - trigger preload
@@ -11148,8 +11159,7 @@ nsDocument::SizeOfExcludingThis(MallocSizeOf aMallocSizeOf) const
   // nsDocuments can only appear at the top of the DOM tree, and we use the
   // specialized DocSizeOfExcludingThis() in that case.  So this should never
   // be called.
-  MOZ_NOT_REACHED("nsDocument::SizeOfExcludingThis");
-  return 0;
+  MOZ_CRASH();
 }
 
 void
diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index 3895244bb23..0573e84f70b 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -818,10 +818,6 @@ public:
   already_AddRefed<nsIBoxObject> GetBoxObjectFor(mozilla::dom::Element* aElement,
                                                  mozilla::ErrorResult& aRv) MOZ_OVERRIDE;
 
-  virtual NS_HIDDEN_(nsresult) GetXBLChildNodesFor(nsIContent* aContent,
-                                                   nsIDOMNodeList** aResult);
-  virtual NS_HIDDEN_(nsresult) GetContentListFor(nsIContent* aContent,
-                                                 nsIDOMNodeList** aResult);
   virtual NS_HIDDEN_(Element*)
     GetAnonymousElementByAttribute(nsIContent* aElement,
                                    nsIAtom* aAttrName,
@@ -1294,9 +1290,6 @@ protected:
 
   nsInterfaceHashtable<nsPtrHashKey<nsIContent>, nsPIBoxObject> *mBoxObjectTable;
 
-  // The channel that got passed to StartDocumentLoad(), if any
-  nsCOMPtr<nsIChannel> mChannel;
-
   // A document "without a browsing context" that owns the content of
   // HTMLTemplateElement.
   nsCOMPtr<nsIDocument> mTemplateContentsOwner;
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 22eb14caa05..1cd1f965ccd 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -312,21 +312,28 @@ nsFrameLoader::LoadFrame()
   NS_ENSURE_TRUE(mOwnerContent, NS_ERROR_NOT_INITIALIZED);
 
   nsAutoString src;
-  GetURL(src);
 
-  src.Trim(" \t\n\r");
+  bool isSrcdoc = mOwnerContent->IsHTML(nsGkAtoms::iframe) &&
+                  mOwnerContent->HasAttr(kNameSpaceID_None, nsGkAtoms::srcdoc);
+  if (isSrcdoc) {
+    src.AssignLiteral("about:srcdoc");
+  }
+  else {
+    GetURL(src);
 
-  if (src.IsEmpty()) {
-    // If the frame is a XUL element and has the attribute 'nodefaultsrc=true'
-    // then we will not use 'about:blank' as fallback but return early without
-    // starting a load if no 'src' attribute is given (or it's empty).
-    if (mOwnerContent->IsXUL() &&
-        mOwnerContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::nodefaultsrc,
-                                   nsGkAtoms::_true, eCaseMatters)) {
-      return NS_OK;
+    src.Trim(" \t\n\r");
+
+    if (src.IsEmpty()) {
+      // If the frame is a XUL element and has the attribute 'nodefaultsrc=true'
+      // then we will not use 'about:blank' as fallback but return early without
+      // starting a load if no 'src' attribute is given (or it's empty).
+      if (mOwnerContent->IsXUL() &&
+          mOwnerContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::nodefaultsrc,
+                                     nsGkAtoms::_true, eCaseMatters)) {
+        return NS_OK;
+      }
+      src.AssignLiteral("about:blank");
     }
-
-    src.AssignLiteral("about:blank");
   }
 
   nsIDocument* doc = mOwnerContent->OwnerDoc();
@@ -472,8 +479,23 @@ nsFrameLoader::ReallyStartLoadingInternal()
   loadInfo->SetOwner(mOwnerContent->NodePrincipal());
 
   nsCOMPtr<nsIURI> referrer;
-  rv = mOwnerContent->NodePrincipal()->GetURI(getter_AddRefs(referrer));
-  NS_ENSURE_SUCCESS(rv, rv);
+  
+  nsAutoString srcdoc;
+  bool isSrcdoc = mOwnerContent->IsHTML(nsGkAtoms::iframe) &&
+                  mOwnerContent->GetAttr(kNameSpaceID_None, nsGkAtoms::srcdoc,
+                                         srcdoc);
+
+  if (isSrcdoc) {
+    nsAutoString referrerStr;
+    mOwnerContent->OwnerDoc()->GetReferrer(referrerStr);
+    rv = NS_NewURI(getter_AddRefs(referrer), referrerStr);
+
+    loadInfo->SetSrcdocData(srcdoc);
+  }
+  else {
+    rv = mOwnerContent->NodePrincipal()->GetURI(getter_AddRefs(referrer));
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
   loadInfo->SetReferrer(referrer);
 
diff --git a/content/base/src/nsGkAtomList.h b/content/base/src/nsGkAtomList.h
index fb77156a84b..89291728c81 100644
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -993,6 +993,7 @@ GK_ATOM(splitmenu, "splitmenu")
 GK_ATOM(splitter, "splitter")
 GK_ATOM(spring, "spring")
 GK_ATOM(src, "src")
+GK_ATOM(srcdoc, "srcdoc")
 GK_ATOM(srclang, "srclang")
 GK_ATOM(stack, "stack")
 GK_ATOM(standalone, "standalone")
diff --git a/content/base/src/nsINode.cpp b/content/base/src/nsINode.cpp
index c536ffa8d8c..71cbb5bf7ac 100644
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@@ -93,7 +93,6 @@
 #include "nsTextNode.h"
 #include "nsUnicharUtils.h"
 #include "nsXBLBinding.h"
-#include "nsXBLInsertionPoint.h"
 #include "nsXBLPrototypeBinding.h"
 #include "prprf.h"
 #include "xpcpublic.h"
@@ -1194,8 +1193,7 @@ nsINode::UnoptimizableCCNode() const
   const uintptr_t problematicFlags = (NODE_IS_ANONYMOUS |
                                       NODE_IS_IN_ANONYMOUS_SUBTREE |
                                       NODE_IS_NATIVE_ANONYMOUS_ROOT |
-                                      NODE_MAY_BE_IN_BINDING_MNGR |
-                                      NODE_IS_INSERTION_PARENT);
+                                      NODE_MAY_BE_IN_BINDING_MNGR);
   return HasFlag(problematicFlags) ||
          NodeType() == nsIDOMNode::ATTRIBUTE_NODE ||
          // For strange cases like xbl:content/xbl:children
diff --git a/content/base/src/nsNameSpaceManager.cpp b/content/base/src/nsNameSpaceManager.cpp
index cbbddd17b75..91b920ba231 100644
--- a/content/base/src/nsNameSpaceManager.cpp
+++ b/content/base/src/nsNameSpaceManager.cpp
@@ -17,6 +17,8 @@
 #include "nsContentCreatorFunctions.h"
 #include "nsDataHashtable.h"
 #include "nsString.h"
+#include "nsINodeInfo.h"
+#include "nsXBLChildrenElement.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -202,6 +204,10 @@ NS_NewElement(nsIContent** aResult,
   if (ns == kNameSpaceID_SVG) {
     return NS_NewSVGElement(aResult, aNodeInfo, aFromParser);
   }
+  if (ns == kNameSpaceID_XBL && aNodeInfo.get()->Equals(nsGkAtoms::children)) {
+    NS_ADDREF(*aResult = new nsXBLChildrenElement(aNodeInfo));
+    return NS_OK;
+  }
   return NS_NewXMLElement(aResult, aNodeInfo);
 }
 
diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
index 6ed3bc2c768..5e7d77de592 100644
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -2993,8 +2993,7 @@ nsObjectLoadingContent::ShouldPlay(FallbackType &aReason, bool aIgnoreCurrentTyp
   case nsIPluginTag::STATE_CLICKTOPLAY:
     return false;
   }
-  MOZ_NOT_REACHED("Unexpected enabledState");
-  return false;
+  MOZ_CRASH("Unexpected enabledState");
 }
 
 nsIDocument*
diff --git a/content/canvas/src/CanvasRenderingContext2D.cpp b/content/canvas/src/CanvasRenderingContext2D.cpp
index fd7683c45a7..5aebf7574c0 100644
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1318,7 +1318,7 @@ WrapStyle(JSContext* cx, JSObject* objArg,
       break;
     }
     default:
-      MOZ_NOT_REACHED("unexpected CanvasMultiGetterType");
+      MOZ_CRASH("unexpected CanvasMultiGetterType");
   }
   if (!ok) {
     error.Throw(NS_ERROR_FAILURE);
@@ -2079,6 +2079,9 @@ CanvasRenderingContext2D::SetFont(const nsAString& font,
     return;
   }
 
+  // add a rule to prevent text zoom from affecting the style
+  rules.AppendElement(new nsDisableTextZoomStyleRule);
+
   nsRefPtr<nsStyleContext> sc =
       styleSet->ResolveStyleForRules(parentContext, rules);
   if (!sc) {
@@ -2097,21 +2100,20 @@ CanvasRenderingContext2D::SetFont(const nsAString& font,
 
   // use CSS pixels instead of dev pixels to avoid being affected by page zoom
   const uint32_t aupcp = nsPresContext::AppUnitsPerCSSPixel();
-  // un-zoom the font size to avoid being affected by text-only zoom
-  //
-  // Purposely ignore the font size that respects the user's minimum
-  // font preference (fontStyle->mFont.size) in favor of the computed
-  // size (fontStyle->mSize).  See
-  // https://bugzilla.mozilla.org/show_bug.cgi?id=698652.
-  const nscoord fontSize = nsStyleFont::UnZoomText(parentContext->PresContext(), fontStyle->mSize);
 
   bool printerFont = (presShell->GetPresContext()->Type() == nsPresContext::eContext_PrintPreview ||
                       presShell->GetPresContext()->Type() == nsPresContext::eContext_Print);
 
+  // Purposely ignore the font size that respects the user's minimum
+  // font preference (fontStyle->mFont.size) in favor of the computed
+  // size (fontStyle->mSize).  See
+  // https://bugzilla.mozilla.org/show_bug.cgi?id=698652.
+  MOZ_ASSERT(!fontStyle->mAllowZoom,
+             "expected text zoom to be disabled on this nsStyleFont");
   gfxFontStyle style(fontStyle->mFont.style,
                      fontStyle->mFont.weight,
                      fontStyle->mFont.stretch,
-                     NSAppUnitsToFloatPixels(fontSize, float(aupcp)),
+                     NSAppUnitsToFloatPixels(fontStyle->mSize, float(aupcp)),
                      language,
                      fontStyle->mFont.sizeAdjust,
                      fontStyle->mFont.systemFont,
@@ -2638,7 +2640,7 @@ CanvasRenderingContext2D::DrawOrMeasureText(const nsAString& aRawText,
     anchorY = -fontMetrics.emDescent;
     break;
   default:
-      MOZ_NOT_REACHED("unexpected TextBaseline");
+    MOZ_CRASH("unexpected TextBaseline");
   }
 
   processor.mPt.y += anchorY;
diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index 7ad60c26ecf..384d2da0e10 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -5509,17 +5509,14 @@ WebGLTexelFormat mozilla::GetWebGLTexelFormat(GLenum format, GLenum type)
             case LOCAL_GL_UNSIGNED_INT:
                 return WebGLTexelConversions::D32;
             default:
-                MOZ_NOT_REACHED("Invalid WebGL texture format/type?");
-                return WebGLTexelConversions::BadFormat;
+                MOZ_CRASH("Invalid WebGL texture format/type?");
         }
     } else if (format == LOCAL_GL_DEPTH_STENCIL) {
         switch (type) {
             case LOCAL_GL_UNSIGNED_INT_24_8_EXT:
                 return WebGLTexelConversions::D24S8;
             default:
-                MOZ_NOT_REACHED("Invalid WebGL texture format/type?");
-                NS_ABORT_IF_FALSE(false, "Coding mistake?! Should never reach this point.");
-                return WebGLTexelConversions::BadFormat;
+                MOZ_CRASH("Invalid WebGL texture format/type?");
         }
     }
 
diff --git a/content/canvas/src/WebGLFramebuffer.cpp b/content/canvas/src/WebGLFramebuffer.cpp
index 4312038b4fa..66958ce74d4 100644
--- a/content/canvas/src/WebGLFramebuffer.cpp
+++ b/content/canvas/src/WebGLFramebuffer.cpp
@@ -118,7 +118,7 @@ WebGLFramebuffer::Attachment::IsComplete() const {
                     format == LOCAL_GL_RGB ||
                     format == LOCAL_GL_RGBA);
         }
-        MOZ_NOT_REACHED("Invalid WebGL attachment poin?");
+        MOZ_CRASH("Invalid WebGL attachment poin?");
     }
 
     if (mRenderbufferPtr) {
@@ -139,7 +139,7 @@ WebGLFramebuffer::Attachment::IsComplete() const {
                     format == LOCAL_GL_RGB5_A1 ||
                     format == LOCAL_GL_RGBA4);
         }
-        MOZ_NOT_REACHED("Invalid WebGL attachment poin?");
+        MOZ_CRASH("Invalid WebGL attachment poin?");
     }
 
     NS_ABORT(); // should never get there
diff --git a/content/events/src/TextComposition.cpp b/content/events/src/TextComposition.cpp
index c20578a1f3a..53edc76ab04 100644
--- a/content/events/src/TextComposition.cpp
+++ b/content/events/src/TextComposition.cpp
@@ -140,8 +140,7 @@ TextComposition::CompositionEventDispatcher::Run()
       break;
     }
     default:
-      MOZ_NOT_REACHED("Unsupported event");
-      break;
+      MOZ_CRASH("Unsupported event");
   }
   return NS_OK;
 }
diff --git a/content/events/src/nsDOMMouseEvent.cpp b/content/events/src/nsDOMMouseEvent.cpp
index a447351dfdc..deadce56e61 100644
--- a/content/events/src/nsDOMMouseEvent.cpp
+++ b/content/events/src/nsDOMMouseEvent.cpp
@@ -141,8 +141,7 @@ nsDOMMouseEvent::InitMouseEvent(const nsAString& aType,
       static_cast<nsInputEvent*>(mEvent)->modifiers = modifiers;
       return NS_OK;
     default:
-      MOZ_NOT_REACHED("There is no space to store the modifiers");
-      return NS_ERROR_FAILURE;
+      MOZ_CRASH("There is no space to store the modifiers");
   }
 }
 
@@ -242,8 +241,7 @@ nsDOMMouseEvent::Buttons()
     case NS_SIMPLE_GESTURE_EVENT:
       return static_cast<nsMouseEvent_base*>(mEvent)->buttons;
     default:
-      MOZ_NOT_REACHED("Tried to get mouse buttons for non-mouse event!");
-      return 0;
+      MOZ_CRASH("Tried to get mouse buttons for non-mouse event!");
   }
 }
 
diff --git a/content/events/src/nsDOMUIEvent.cpp b/content/events/src/nsDOMUIEvent.cpp
index 39c20ff7ab7..fc49c018294 100644
--- a/content/events/src/nsDOMUIEvent.cpp
+++ b/content/events/src/nsDOMUIEvent.cpp
@@ -362,7 +362,7 @@ nsDOMUIEvent::IsChar() const
     default:
       return false;
   }
-  MOZ_NOT_REACHED("Switch handles all cases.");
+  MOZ_CRASH("Switch handles all cases.");
 }
 
 NS_IMETHODIMP
diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
index 90f88f47849..7a23186405c 100644
--- a/content/events/src/nsEventStateManager.cpp
+++ b/content/events/src/nsEventStateManager.cpp
@@ -1495,8 +1495,7 @@ nsEventStateManager::DispatchCrossProcessEvent(nsEvent* aEvent,
     return remote->SendRealTouchEvent(*touchEvent);
   }
   default: {
-    MOZ_NOT_REACHED("Attempt to send non-whitelisted event?");
-    return false;
+    MOZ_CRASH("Attempt to send non-whitelisted event?");
   }
   }
 }
@@ -2520,8 +2519,7 @@ nsEventStateManager::DispatchLegacyMouseScrollEvents(nsIFrame* aTargetFrame,
       break;
 
     default:
-      MOZ_NOT_REACHED("Invalid deltaMode value comes");
-      return;
+      MOZ_CRASH("Invalid deltaMode value comes");
   }
 
   // Send the legacy events in following order:
@@ -2847,8 +2845,7 @@ nsEventStateManager::DoScrollText(nsIScrollableFrame* aScrollableFrame,
       origin = nsGkAtoms::pixels;
       break;
     default:
-      MOZ_NOT_REACHED("Invalid deltaMode value comes");
-      return;
+      MOZ_CRASH("Invalid deltaMode value comes");
   }
 
   // We shouldn't scroll more one page at once except when over one page scroll
@@ -2892,8 +2889,7 @@ nsEventStateManager::DoScrollText(nsIScrollableFrame* aScrollableFrame,
       mode = nsIScrollableFrame::SMOOTH;
       break;
     default:
-      MOZ_NOT_REACHED("Invalid scrollType value comes");
-      return;
+      MOZ_CRASH("Invalid scrollType value comes");
   }
 
   nsIntPoint overflow;
diff --git a/content/events/src/nsIMEStateManager.cpp b/content/events/src/nsIMEStateManager.cpp
index 5e95f10704a..b82e62cd699 100644
--- a/content/events/src/nsIMEStateManager.cpp
+++ b/content/events/src/nsIMEStateManager.cpp
@@ -587,10 +587,9 @@ nsIMEStateManager::NotifyIME(NotificationToIME aNotification,
       case REQUEST_TO_CANCEL_COMPOSITION:
         return composition ? aWidget->NotifyIME(aNotification) : NS_OK;
       default:
-        MOZ_NOT_REACHED("Unsupported notification");
-        return NS_ERROR_INVALID_ARG;
+        MOZ_CRASH("Unsupported notification");
     }
-    MOZ_NOT_REACHED(
+    MOZ_CRASH(
       "Failed to handle the notification for non-synthesized composition");
   }
 
@@ -1049,8 +1048,7 @@ nsIMEStateManager::IsEditableIMEState(nsIWidget* aWidget)
     case widget::IMEState::DISABLED:
       return false;
     default:
-      MOZ_NOT_REACHED("Unknown IME enable state");
-      return false;
+      MOZ_CRASH("Unknown IME enable state");
   }
 }
 
diff --git a/content/html/content/src/HTMLIFrameElement.cpp b/content/html/content/src/HTMLIFrameElement.cpp
index 346b19a8c2d..1e9301370da 100644
--- a/content/html/content/src/HTMLIFrameElement.cpp
+++ b/content/html/content/src/HTMLIFrameElement.cpp
@@ -55,6 +55,7 @@ NS_IMPL_URI_ATTR(HTMLIFrameElement, Src, src)
 NS_IMPL_STRING_ATTR(HTMLIFrameElement, Width, width)
 NS_IMPL_BOOL_ATTR(HTMLIFrameElement, AllowFullscreen, allowfullscreen)
 NS_IMPL_STRING_ATTR(HTMLIFrameElement, Sandbox, sandbox)
+NS_IMPL_STRING_ATTR(HTMLIFrameElement, Srcdoc, srcdoc)
 
 void
 HTMLIFrameElement::GetItemValueText(nsAString& aValue)
@@ -198,6 +199,24 @@ HTMLIFrameElement::GetAttributeMappingFunction() const
   return &MapAttributesIntoRule;
 }
 
+nsresult
+HTMLIFrameElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                           nsIAtom* aPrefix, const nsAString& aValue,
+                           bool aNotify)
+{
+  nsresult rv = nsGenericHTMLFrameElement::SetAttr(aNameSpaceID, aName,
+                                                   aPrefix, aValue, aNotify);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::srcdoc) {
+    // Don't propagate error here. The attribute was successfully set, that's
+    // what we should reflect.
+    LoadSrc();
+  }
+
+  return NS_OK;
+}
+
 nsresult
 HTMLIFrameElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                 const nsAttrValue* aValue,
@@ -227,6 +246,23 @@ HTMLIFrameElement::AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                             aNotify);
 }
 
+nsresult
+HTMLIFrameElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                             bool aNotify)
+{
+  // Invoke on the superclass.
+  nsresult rv = nsGenericHTMLFrameElement::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (aNameSpaceID == kNameSpaceID_None &&
+      aAttribute == nsGkAtoms::srcdoc) {
+    // Fall back to the src attribute, if any
+    LoadSrc();
+  }
+
+  return NS_OK;
+}
+
 uint32_t
 HTMLIFrameElement::GetSandboxFlags()
 {
diff --git a/content/html/content/src/HTMLIFrameElement.h b/content/html/content/src/HTMLIFrameElement.h
index df2aea4b16c..8300a9d7928 100644
--- a/content/html/content/src/HTMLIFrameElement.h
+++ b/content/html/content/src/HTMLIFrameElement.h
@@ -49,9 +49,19 @@ public:
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const MOZ_OVERRIDE;
   virtual nsIDOMNode* AsDOMNode() MOZ_OVERRIDE { return this; }
 
+  nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                   const nsAString& aValue, bool aNotify)
+  {
+    return SetAttr(aNameSpaceID, aName, nullptr, aValue, aNotify);
+  }
+  virtual nsresult SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
+                           nsIAtom* aPrefix, const nsAString& aValue,
+                           bool aNotify) MOZ_OVERRIDE;
   virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                 const nsAttrValue* aValue,
                                 bool aNotify) MOZ_OVERRIDE;
+  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                             bool aNotify) MOZ_OVERRIDE;
 
   uint32_t GetSandboxFlags();
 
@@ -61,6 +71,14 @@ public:
   {
     SetHTMLAttr(nsGkAtoms::src, aSrc, aError);
   }
+  void GetSrcdoc(DOMString& aSrcdoc)
+  {
+    GetHTMLAttr(nsGkAtoms::srcdoc, aSrcdoc);
+  }
+  void SetSrcdoc(const nsAString& aSrcdoc, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::srcdoc, aSrcdoc, aError);
+  }
   void GetName(DOMString& aName)
   {
     GetHTMLAttr(nsGkAtoms::name, aName);
diff --git a/content/html/content/src/nsGenericHTMLFrameElement.cpp b/content/html/content/src/nsGenericHTMLFrameElement.cpp
index 2c1aef4730d..37d2b10c134 100644
--- a/content/html/content/src/nsGenericHTMLFrameElement.cpp
+++ b/content/html/content/src/nsGenericHTMLFrameElement.cpp
@@ -229,7 +229,9 @@ nsGenericHTMLFrameElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
                                               aValue, aNotify);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
+  if (aNameSpaceID == kNameSpaceID_None && aName == nsGkAtoms::src &&
+      (Tag() != nsGkAtoms::iframe || 
+       !HasAttr(kNameSpaceID_None,nsGkAtoms::srcdoc))) {
     // Don't propagate error here. The attribute was successfully set, that's
     // what we should reflect.
     LoadSrc();
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index b4fcedc0abf..0348eb562d2 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -386,6 +386,10 @@ MOCHITEST_FILES = \
 		test_bug885024.html \
 		test_track.html \
 		test_track_disabled.html \
+		test_srcdoc.html \
+		file_srcdoc.html \
+		test_srcdoc-2.html \
+		file_srcdoc-2.html \
 		$(NULL)
 
 MOCHITEST_CHROME_FILES = \
diff --git a/content/html/content/test/file_srcdoc-2.html b/content/html/content/test/file_srcdoc-2.html
new file mode 100644
index 00000000000..bd75f5e059e
--- /dev/null
+++ b/content/html/content/test/file_srcdoc-2.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+<body>
+<iframe id="iframe" srcdoc="Hello World"></iframe>
+</body>
+
+</html>
diff --git a/content/html/content/test/file_srcdoc.html b/content/html/content/test/file_srcdoc.html
new file mode 100644
index 00000000000..70fbff42f70
--- /dev/null
+++ b/content/html/content/test/file_srcdoc.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+<body>
+<iframe id="iframe" srcdoc="Hello World"></iframe>
+    
+<iframe id="iframe1" src="about:mozilla" 
+    srcdoc="Goodbye World"></iframe>
+<iframe id="iframe2" srcdoc="Peeking test" sandbox=""></iframe>
+<iframe id="iframe3" src="data:text/html;charset=US-ASCII,Gone" 
+    srcdoc="Going"></iframe>
+</body>
+
+</html>
diff --git a/content/html/content/test/test_srcdoc-2.html b/content/html/content/test/test_srcdoc-2.html
new file mode 100644
index 00000000000..4e273473b95
--- /dev/null
+++ b/content/html/content/test/test_srcdoc-2.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+    <head>
+<title>Test session history for srcdoc iframes introduced in bug 802895</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+
+<link rel="stylesheet" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=802895">Mozilla Bug 802895</a>
+
+<iframe id="pframe" name="pframe" src="file_srcdoc-2.html"></iframe>
+<pre id="test">
+<script>
+
+  SimpleTest.waitForExplicitFinish();
+  var pframe = $("pframe");
+
+  //disable bfcache
+  pframe.contentWindow.addEventListener("unload", function () { }, false);
+
+  var loadState = 0;
+  pframe.onload = function () {
+    SimpleTest.executeSoon(function () {
+
+      var pDoc = pframe.contentDocument;
+
+      if (loadState == 0) {
+        var div = pDoc.createElement("div");
+        div.id = "modifyCheck";
+        div.innerHTML = "hello again";
+        pDoc.body.appendChild(div);
+        ok(pDoc.getElementById("modifyCheck"), "Child element not created");
+        pframe.src = "about:blank";
+        loadState = 1;
+      }
+      else if (loadState == 1) {
+        loadState = 2;
+        window.history.back();
+      }
+      else if (loadState == 2) {
+        ok(!pDoc.getElementById("modifyCheck"), "modifyCheck element shouldn't be present");
+        is(pDoc.getElementById("iframe").contentDocument.body.innerHTML,
+           "Hello World", "srcdoc iframe not present");
+        SimpleTest.finish();
+      }
+
+    })
+  };
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/content/test/test_srcdoc.html b/content/html/content/test/test_srcdoc.html
new file mode 100644
index 00000000000..6c8260d9e38
--- /dev/null
+++ b/content/html/content/test/test_srcdoc.html
@@ -0,0 +1,117 @@
+<!doctype html>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=802895
+-->
+    <head>
+<title>Tests for srcdoc iframes introduced in bug 802895</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=802895">Mozilla Bug 802895</a>
+
+<iframe id="pframe" src="file_srcdoc.html"></iframe>
+
+<pre id="test">
+<script>
+
+  SimpleTest.waitForExplicitFinish();
+  var pframe = $("pframe");
+
+  var loadState = 0;
+  pframe.contentWindow.addEventListener("load", function () {
+
+    var pframeDoc = pframe.contentDocument;
+
+    var iframe = pframeDoc.getElementById("iframe");
+    var innerDoc = iframe.contentDocument;
+    var iframe1 = pframeDoc.getElementById("iframe1");
+    var innerDoc1 = iframe1.contentDocument;
+
+    var finish = false;
+    var finish1 = false;
+    var finish3 = false;
+
+
+
+    is(iframe.srcdoc, "Hello World", "Bad srcdoc attribute contents")
+
+    is(innerDoc.domain, document.domain, "Wrong domain");
+    is(innerDoc.referrer, pframeDoc.referrer, "Wrong referrer");
+    is(innerDoc.body.innerHTML, "Hello World", "Wrong body");
+    is(innerDoc.compatMode, "CSS1Compat", "Not standards compliant");
+
+    is(innerDoc1.domain, document.domain, "Wrong domain with src attribute");
+    is(innerDoc1.referrer, pframeDoc.referrer, "Wrong referrer with src attribute");
+    is(innerDoc1.body.innerHTML, "Goodbye World", "Wrong body with src attribute")
+    is(innerDoc1.compatMode, "CSS1Compat", "Not standards compliant with src attribute");
+
+    var iframe2 = pframeDoc.getElementById("iframe2");
+    var innerDoc2 = iframe2.contentDocument;
+    try {
+      innerDoc2.domain;
+      foundError = false;
+    }
+    catch (error) {
+      foundError = true;
+    }
+    ok(foundError, "srcdoc iframe not sandboxed");
+
+    //Test changed srcdoc attribute
+    iframe.onload = function () {
+
+      iframe = pframeDoc.getElementById("iframe");
+      innerDoc = iframe.contentDocument;
+
+      is(iframe.srcdoc, "Hello again", "Bad srcdoc attribute contents with srcdoc attribute changed");
+      is(innerDoc.domain, document.domain, "Wrong domain with srcdoc attribute changed");
+      is(innerDoc.referrer, pframeDoc.referrer, "Wrong referrer with srcdoc attribute changed");
+      is(innerDoc.body.innerHTML, "Hello again", "Wrong body with srcdoc attribute changed");
+      is(innerDoc.compatMode, "CSS1Compat", "Not standards compliant with srcdoc attribute changed");
+
+      finish = true;
+      if (finish && finish1 && finish3) {
+        SimpleTest.finish();
+      }
+    };
+
+    iframe.srcdoc = "Hello again";
+
+    var iframe3 = pframeDoc.getElementById("iframe3");
+
+    // Test srcdoc attribute removal
+    iframe3.onload = function () {
+      var innerDoc3 = iframe3.contentDocument;
+      is(innerDoc3.body.innerHTML, "Gone", "Bad srcdoc attribute removal");
+      finish3 = true;
+      if (finish && finish1 && finish3) {
+        SimpleTest.finish();
+      }
+    }
+
+    iframe3.removeAttribute("srcdoc");
+
+
+    var iframe1load = false;
+    iframe1.onload = function () {
+      iframe1load = true;
+    }
+
+    iframe1.src = "data:text/plain;charset=US-ASCII,Goodbyeeee";
+
+    // Need to test that changing the src doesn't change the iframe.
+    setTimeout(function () {
+      ok(!iframe1load, "Changing src attribute shouldn't cause a load when srcdoc is set");
+      finish1 = true;
+      if (finish && finish1 && finish3) {
+        SimpleTest.finish();
+      }
+    }, 2000);
+
+  }, false);
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/document/src/nsHTMLContentSink.cpp b/content/html/document/src/nsHTMLContentSink.cpp
index 861d4aea932..4dba37ef246 100644
--- a/content/html/document/src/nsHTMLContentSink.cpp
+++ b/content/html/document/src/nsHTMLContentSink.cpp
@@ -662,22 +662,18 @@ SinkContext::OpenContainer(const nsIParserNode& aNode)
   // Special handling for certain tags
   switch (nodeType) {
     case eHTMLTag_form:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for forms.");
 
     case eHTMLTag_frameset:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for frames.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for frames.");
 
     case eHTMLTag_noembed:
     case eHTMLTag_noframes:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for noembed/noframes.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for noembed/noframes.");
 
     case eHTMLTag_script:
     case eHTMLTag_style:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for styles and scripts.");
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for styles and scripts.");
 
     case eHTMLTag_button:
     case eHTMLTag_audio:
@@ -783,12 +779,10 @@ SinkContext::CloseContainer(const nsHTMLTag aTag)
   switch (nodeType) {
   case eHTMLTag_noembed:
   case eHTMLTag_noframes:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for noembed/noframes.");
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink for noembed/noframes.");
 
   case eHTMLTag_form:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink for forms.");
 
   case eHTMLTag_video:
   case eHTMLTag_audio:
@@ -801,14 +795,10 @@ SinkContext::CloseContainer(const nsHTMLTag aTag)
     break;
 
   case eHTMLTag_script:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink to run scripts.");
-    result = NS_ERROR_NOT_IMPLEMENTED;
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink to run scripts.");
 
   case eHTMLTag_style:
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for styles.");
-    result = NS_ERROR_NOT_IMPLEMENTED;
-    break;
+    MOZ_CRASH("Must not use HTMLContentSink for styles.");
 
   default:
     break;
@@ -855,9 +845,7 @@ SinkContext::AddLeaf(const nsIParserNode& aNode)
       // Additional processing needed once the element is in the tree
       switch (nodeType) {
       case eHTMLTag_meta:
-        MOZ_NOT_REACHED("Must not use HTMLContentSink for metas.");
-        rv = NS_ERROR_NOT_IMPLEMENTED;
-        break;
+        MOZ_CRASH("Must not use HTMLContentSink for metas.");
 
       case eHTMLTag_input:
         content->DoneCreatingElement();
@@ -1751,9 +1739,8 @@ HTMLContentSink::OpenContainer(const nsIParserNode& aNode)
 
   switch (aNode.GetNodeType()) {
     case eHTMLTag_frameset:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for frames.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for frames.");
+
     case eHTMLTag_head:
       rv = OpenHeadContext();
       if (NS_SUCCEEDED(rv)) {
@@ -1776,9 +1763,8 @@ HTMLContentSink::OpenContainer(const nsIParserNode& aNode)
       }
       break;
     case eHTMLTag_form:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for forms.");
+
     default:
       rv = mCurrentContext->OpenContainer(aNode);
       break;
@@ -1794,9 +1780,8 @@ HTMLContentSink::CloseContainer(const eHTMLTags aTag)
 
   switch (aTag) {
     case eHTMLTag_frameset:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for frames.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for frames.");
+
     case eHTMLTag_head:
       CloseHeadContext();
       break;
@@ -1807,9 +1792,8 @@ HTMLContentSink::CloseContainer(const eHTMLTags aTag)
       rv = CloseHTML();
       break;
     case eHTMLTag_form:
-      MOZ_NOT_REACHED("Must not use HTMLContentSink for forms.");
-      rv = NS_ERROR_NOT_IMPLEMENTED;
-      break;
+      MOZ_CRASH("Must not use HTMLContentSink for forms.");
+
     default:
       rv = mCurrentContext->CloseContainer(aTag);
       break;
@@ -1832,10 +1816,8 @@ HTMLContentSink::AddLeaf(const nsIParserNode& aNode)
   nsHTMLTag nodeType = nsHTMLTag(aNode.GetNodeType());
   switch (nodeType) {
   case eHTMLTag_link:
-    rv = NS_ERROR_NOT_IMPLEMENTED;
-    MOZ_NOT_REACHED("Must not use HTMLContentSink for links.");
+    MOZ_CRASH("Must not use HTMLContentSink for links.");
 
-    break;
   default:
     rv = mCurrentContext->AddLeaf(aNode);
 
diff --git a/content/media/DOMMediaStream.cpp b/content/media/DOMMediaStream.cpp
index 8cd9a8a89e5..62aa70437cc 100644
--- a/content/media/DOMMediaStream.cpp
+++ b/content/media/DOMMediaStream.cpp
@@ -255,8 +255,7 @@ DOMMediaStream::CreateDOMTrack(TrackID aTrackID, MediaSegment::Type aType)
     mTrackTypesAvailable |= HINT_CONTENTS_VIDEO;
     break;
   default:
-    MOZ_NOT_REACHED("Unhandled track type");
-    return nullptr;
+    MOZ_CRASH("Unhandled track type");
   }
   mTracks.AppendElement(track);
 
diff --git a/content/media/MediaStreamGraph.cpp b/content/media/MediaStreamGraph.cpp
index 5c83909a90c..7512907df91 100644
--- a/content/media/MediaStreamGraph.cpp
+++ b/content/media/MediaStreamGraph.cpp
@@ -1837,8 +1837,7 @@ MediaStream::ApplyTrackDisabling(TrackID aTrackID, MediaSegment* aSegment)
     break;
   }
   default:
-    MOZ_NOT_REACHED("Unknown track type");
-    break;
+    MOZ_CRASH("Unknown track type");
   }
 }
 
diff --git a/content/media/encoder/MediaEncoder.cpp b/content/media/encoder/MediaEncoder.cpp
index 2f5b002a660..46296e95c1c 100644
--- a/content/media/encoder/MediaEncoder.cpp
+++ b/content/media/encoder/MediaEncoder.cpp
@@ -233,8 +233,7 @@ MediaEncoder::GetEncodedData(nsTArray<nsTArray<uint8_t> >* aOutputBufs,
       break;
 
     default:
-      MOZ_NOT_REACHED("Invalid encode state");
-      break;
+      MOZ_CRASH("Invalid encode state");
     }
   }
 }
diff --git a/content/media/encoder/OpusTrackEncoder.cpp b/content/media/encoder/OpusTrackEncoder.cpp
index b773bebf9b1..8d082563c0d 100644
--- a/content/media/encoder/OpusTrackEncoder.cpp
+++ b/content/media/encoder/OpusTrackEncoder.cpp
@@ -220,8 +220,7 @@ OpusTrackEncoder::GetHeader(nsTArray<uint8_t>* aOutput)
     // No more headers.
     break;
   default:
-    MOZ_NOT_REACHED("Invalid state");
-    break;
+    MOZ_CRASH("Invalid state");
   }
   return NS_OK;
 }
diff --git a/content/media/test/crashtests/crashtests.list b/content/media/test/crashtests/crashtests.list
index 2cf81f35f02..cbe701f107c 100644
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -1,4 +1,4 @@
-load 459439-1.html
+skip-if(B2G) load 459439-1.html # bug 888557
 load 466607-1.html
 load 466945-1.html
 load 468763-1.html
diff --git a/content/media/webaudio/AudioBuffer.cpp b/content/media/webaudio/AudioBuffer.cpp
index 545b24c37b3..cb5b9724b5f 100644
--- a/content/media/webaudio/AudioBuffer.cpp
+++ b/content/media/webaudio/AudioBuffer.cpp
@@ -164,7 +164,13 @@ ThreadSharedFloatArrayBufferList*
 AudioBuffer::GetThreadSharedChannelsForRate(JSContext* aJSContext)
 {
   if (!mSharedChannels) {
-    // Steal JS data
+    for (uint32_t i = 0; i < mJSChannels.Length(); ++i) {
+      if (mLength != JS_GetTypedArrayLength(mJSChannels[i])) {
+        // Probably one of the arrays was neutered
+        return nullptr;
+      }
+    }
+
     mSharedChannels =
       StealJSArrayDataIntoThreadSharedFloatArrayBufferList(aJSContext, mJSChannels);
   }
diff --git a/content/media/webaudio/AudioBuffer.h b/content/media/webaudio/AudioBuffer.h
index 16019a9a0f0..9ca0f6d8511 100644
--- a/content/media/webaudio/AudioBuffer.h
+++ b/content/media/webaudio/AudioBuffer.h
@@ -91,6 +91,7 @@ public:
 
   /**
    * Returns a ThreadSharedFloatArrayBufferList containing the sample data.
+   * Can return null if there is no data.
    */
   ThreadSharedFloatArrayBufferList* GetThreadSharedChannelsForRate(JSContext* aContext);
 
diff --git a/content/media/webaudio/MediaBufferDecoder.cpp b/content/media/webaudio/MediaBufferDecoder.cpp
index 9846804bb73..1d5fcddc5ab 100644
--- a/content/media/webaudio/MediaBufferDecoder.cpp
+++ b/content/media/webaudio/MediaBufferDecoder.cpp
@@ -439,8 +439,7 @@ MediaDecodeTask::RunNextPhase()
     break;
   case PhaseEnum::Decode:
   case PhaseEnum::Done:
-    MOZ_NOT_REACHED("Invalid phase Decode");
-    break;
+    MOZ_CRASH("Invalid phase Decode");
   }
 }
 
diff --git a/content/media/webspeech/recognition/SpeechRecognition.cpp b/content/media/webspeech/recognition/SpeechRecognition.cpp
index b4a8468d1c5..7fce6ffc60a 100644
--- a/content/media/webspeech/recognition/SpeechRecognition.cpp
+++ b/content/media/webspeech/recognition/SpeechRecognition.cpp
@@ -171,7 +171,7 @@ SpeechRecognition::Transition(SpeechEvent* aEvent)
           AbortError(aEvent);
           break;
         case EVENT_COUNT:
-          MOZ_NOT_REACHED("Invalid event EVENT_COUNT");
+          MOZ_CRASH("Invalid event EVENT_COUNT");
       }
       break;
     case STATE_STARTING:
@@ -195,9 +195,9 @@ SpeechRecognition::Transition(SpeechEvent* aEvent)
           break;
         case EVENT_START:
           SR_LOG("STATE_STARTING: Unhandled event %s", GetName(aEvent));
-          MOZ_NOT_REACHED("");
+          MOZ_CRASH();
         case EVENT_COUNT:
-          MOZ_NOT_REACHED("Invalid event EVENT_COUNT");
+          MOZ_CRASH("Invalid event EVENT_COUNT");
       }
       break;
     case STATE_ESTIMATING:
@@ -221,9 +221,9 @@ SpeechRecognition::Transition(SpeechEvent* aEvent)
           break;
         case EVENT_START:
           SR_LOG("STATE_ESTIMATING: Unhandled event %d", aEvent->mType);
-          MOZ_NOT_REACHED("");
+          MOZ_CRASH();
         case EVENT_COUNT:
-          MOZ_NOT_REACHED("Invalid event EVENT_COUNT");
+          MOZ_CRASH("Invalid event EVENT_COUNT");
       }
       break;
     case STATE_WAITING_FOR_SPEECH:
@@ -247,9 +247,9 @@ SpeechRecognition::Transition(SpeechEvent* aEvent)
           break;
         case EVENT_START:
           SR_LOG("STATE_STARTING: Unhandled event %s", GetName(aEvent));
-          MOZ_NOT_REACHED("");
+          MOZ_CRASH();
         case EVENT_COUNT:
-          MOZ_NOT_REACHED("Invalid event EVENT_COUNT");
+          MOZ_CRASH("Invalid event EVENT_COUNT");
       }
       break;
     case STATE_RECOGNIZING:
@@ -273,9 +273,9 @@ SpeechRecognition::Transition(SpeechEvent* aEvent)
           break;
         case EVENT_START:
           SR_LOG("STATE_RECOGNIZING: Unhandled aEvent %s", GetName(aEvent));
-          MOZ_NOT_REACHED("");
+          MOZ_CRASH();
         case EVENT_COUNT:
-          MOZ_NOT_REACHED("Invalid event EVENT_COUNT");
+          MOZ_CRASH("Invalid event EVENT_COUNT");
       }
       break;
     case STATE_WAITING_FOR_RESULT:
@@ -299,16 +299,16 @@ SpeechRecognition::Transition(SpeechEvent* aEvent)
         case EVENT_START:
         case EVENT_RECOGNITIONSERVICE_INTERMEDIATE_RESULT:
           SR_LOG("STATE_WAITING_FOR_RESULT: Unhandled aEvent %s", GetName(aEvent));
-          MOZ_NOT_REACHED("");
+          MOZ_CRASH();
         case EVENT_COUNT:
-          MOZ_NOT_REACHED("Invalid event EVENT_COUNT");
+          MOZ_CRASH("Invalid event EVENT_COUNT");
       }
       break;
     case STATE_ABORTING:
       DoNothing(aEvent);
       break;
     case STATE_COUNT:
-      MOZ_NOT_REACHED("Invalid state STATE_COUNT");
+      MOZ_CRASH("Invalid state STATE_COUNT");
   }
 
   return;
diff --git a/content/media/webspeech/recognition/moz.build b/content/media/webspeech/recognition/moz.build
index 87815e871ab..4952784aa59 100644
--- a/content/media/webspeech/recognition/moz.build
+++ b/content/media/webspeech/recognition/moz.build
@@ -15,7 +15,6 @@ XPIDL_SOURCES = [
 TEST_DIRS += ['test']
 
 EXPORTS.mozilla.dom += [
-    'FakeSpeechRecognitionService.h',
     'SpeechGrammar.h',
     'SpeechGrammarList.h',
     'SpeechRecognition.h',
@@ -23,6 +22,7 @@ EXPORTS.mozilla.dom += [
     'SpeechRecognitionResult.h',
     'SpeechRecognitionResultList.h',
     'SpeechStreamListener.h',
+    'test/FakeSpeechRecognitionService.h',
 ]
 
 CPP_SOURCES += [
diff --git a/content/media/webspeech/synth/ipc/SpeechSynthesisChild.cpp b/content/media/webspeech/synth/ipc/SpeechSynthesisChild.cpp
index fa9903b4a0f..56fd7498f6f 100644
--- a/content/media/webspeech/synth/ipc/SpeechSynthesisChild.cpp
+++ b/content/media/webspeech/synth/ipc/SpeechSynthesisChild.cpp
@@ -48,8 +48,7 @@ SpeechSynthesisChild::AllocPSpeechSynthesisRequest(const nsString& aText,
                                                    const float& aRate,
                                                    const float& aPitch)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a request!");
-  return nullptr;
+  MOZ_CRASH("Caller is supposed to manually construct a request!");
 }
 
 bool
@@ -149,16 +148,14 @@ NS_IMETHODIMP
 SpeechTaskChild::Setup(nsISpeechTaskCallback* aCallback,
                        uint32_t aChannels, uint32_t aRate, uint8_t argc)
 {
-  MOZ_NOT_REACHED("Should never be called from child");
-  return NS_ERROR_NOT_IMPLEMENTED;
+  MOZ_CRASH("Should never be called from child");
 }
 
 NS_IMETHODIMP
 SpeechTaskChild::SendAudio(const JS::Value& aData, const JS::Value& aLandmarks,
                            JSContext* aCx)
 {
-  MOZ_NOT_REACHED("Should never be called from child");
-  return NS_ERROR_NOT_IMPLEMENTED;
+  MOZ_CRASH("Should never be called from child");
 }
 
 void
diff --git a/content/media/webspeech/synth/moz.build b/content/media/webspeech/synth/moz.build
index 24722e75c7c..0fd05772632 100644
--- a/content/media/webspeech/synth/moz.build
+++ b/content/media/webspeech/synth/moz.build
@@ -18,10 +18,10 @@ XPIDL_SOURCES += [
 EXPORTS.mozilla.dom += [
     'EnableSpeechSynthesisCheck.h',
     'SpeechSynthesis.h',
-    'SpeechSynthesisChild.h',
-    'SpeechSynthesisParent.h',
     'SpeechSynthesisUtterance.h',
     'SpeechSynthesisVoice.h',
+    'ipc/SpeechSynthesisChild.h',
+    'ipc/SpeechSynthesisParent.h',
     'nsSpeechTask.h',
     'nsSynthVoiceRegistry.h',
 ]
diff --git a/content/smil/nsSMILTimedElement.cpp b/content/smil/nsSMILTimedElement.cpp
index d08acc61d54..cde4e9ca763 100644
--- a/content/smil/nsSMILTimedElement.cpp
+++ b/content/smil/nsSMILTimedElement.cpp
@@ -2220,7 +2220,7 @@ nsSMILTimedElement::GetNextMilestone(nsSMILMilestone& aNextMilestone) const
   case STATE_POSTACTIVE:
     return false;
   }
-  MOZ_NOT_REACHED("Invalid element state");
+  MOZ_CRASH("Invalid element state");
 }
 
 void
@@ -2292,7 +2292,7 @@ nsSMILTimedElement::GetEffectiveBeginInstance() const
       return prevInterval ? prevInterval->Begin() : nullptr;
     }
   }
-  MOZ_NOT_REACHED("Invalid element state");
+  MOZ_CRASH("Invalid element state");
 }
 
 const nsSMILInterval*
diff --git a/content/smil/test/test_smilTextZoom.xhtml b/content/smil/test/test_smilTextZoom.xhtml
index 3a901f3f16a..ec6d41f06a5 100644
--- a/content/smil/test/test_smilTextZoom.xhtml
+++ b/content/smil/test/test_smilTextZoom.xhtml
@@ -59,27 +59,26 @@ function main()
   try {
     // Verify computed style values at various points during animation.
     // * Correct behavior is for the computed values of 'font-size' to be
-    // exactly twice as large as their corresponding specified values.
-    // (Mozilla's SVG code divides out the textZoom factor from these computed
-    // values when rendering, to obtain the correct font-size.)
+    // the same as their corresponding specified values, since text zoom
+    // should not affect SVG text elements.
     // * I also include tests for an identical animation of the "stroke-width"
     // property, which should _not_ be affected by textZoom.
     var text = document.getElementsByTagName("text")[0];
     var rect = document.getElementsByTagName("rect")[0];
 
-    verifyStyle(text, "font-size",    "10px");
+    verifyStyle(text, "font-size",    "5px");
     verifyStyle(rect, "stroke-width", "5px");
     svg.setCurrentTime(1);
-    verifyStyle(text, "font-size",    "40px");
+    verifyStyle(text, "font-size",    "20px");
     verifyStyle(rect, "stroke-width", "20px");
     svg.setCurrentTime(1.5);
-    verifyStyle(text, "font-size",    "60px");
+    verifyStyle(text, "font-size",    "30px");
     verifyStyle(rect, "stroke-width", "30px");
     svg.setCurrentTime(2);
-    verifyStyle(text, "font-size",    "80px");
+    verifyStyle(text, "font-size",    "40px");
     verifyStyle(rect, "stroke-width", "40px");
     svg.setCurrentTime(3);
-    verifyStyle(text, "font-size",    "80px");
+    verifyStyle(text, "font-size",    "40px");
     verifyStyle(rect, "stroke-width", "40px");
   } catch (e) {
     // If anything goes wrong, make sure we restore textZoom before bubbling
diff --git a/content/xbl/src/moz.build b/content/xbl/src/moz.build
index 829b9ceb2c6..379e12ca4b9 100644
--- a/content/xbl/src/moz.build
+++ b/content/xbl/src/moz.build
@@ -18,7 +18,7 @@ CPP_SOURCES += [
     'nsXBLContentSink.cpp',
     'nsXBLDocumentInfo.cpp',
     'nsXBLEventHandler.cpp',
-    'nsXBLInsertionPoint.cpp',
+    'nsXBLChildrenElement.cpp',
     'nsXBLProtoImpl.cpp',
     'nsXBLProtoImplField.cpp',
     'nsXBLProtoImplMethod.cpp',
diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
index b62c5508d4f..5c234e6ffe8 100644
--- a/content/xbl/src/nsBindingManager.cpp
+++ b/content/xbl/src/nsBindingManager.cpp
@@ -22,11 +22,12 @@
 #include "nsContentCID.h"
 #include "mozilla/dom/XMLDocument.h"
 #include "nsIStreamListener.h"
+#include "ChildIterator.h"
 
 #include "nsXBLBinding.h"
 #include "nsXBLPrototypeBinding.h"
 #include "nsXBLDocumentInfo.h"
-#include "nsXBLInsertionPoint.h"
+#include "nsXBLChildrenElement.h"
 
 #include "nsIStyleRuleProcessor.h"
 #include "nsRuleProcessorData.h"
@@ -48,168 +49,6 @@
 
 using namespace mozilla;
 
-// ==================================================================
-// = nsAnonymousContentList 
-// ==================================================================
-
-#define NS_ANONYMOUS_CONTENT_LIST_IID \
-  { 0xbfb5d8e7, 0xf718, 0x4a46, \
-    { 0xb2, 0x2b, 0x22, 0x4a, 0x44, 0x4c, 0xb9, 0x77 } }
-
-class nsAnonymousContentList : public nsINodeList
-{
-public:
-  nsAnonymousContentList(nsIContent *aContent, nsInsertionPointList* aElements);
-  virtual ~nsAnonymousContentList();
-
-  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsAnonymousContentList)
-  // nsIDOMNodeList interface
-  NS_DECL_NSIDOMNODELIST
-
-  // nsINodeList interface
-  virtual int32_t IndexOf(nsIContent* aContent);
-  virtual nsINode *GetParentObject()
-  {
-    return mContent;
-  }
-  virtual nsIContent* Item(uint32_t aIndex);
-
-  int32_t GetInsertionPointCount() { return mElements->Length(); }
-
-  nsXBLInsertionPoint* GetInsertionPointAt(int32_t i) { return static_cast<nsXBLInsertionPoint*>(mElements->ElementAt(i)); }
-  void RemoveInsertionPointAt(int32_t i) { mElements->RemoveElementAt(i); }
-
-  virtual JSObject* WrapObject(JSContext *cx,
-                               JS::Handle<JSObject*> scope) MOZ_OVERRIDE
-  {
-    return mozilla::dom::NodeListBinding::Wrap(cx, scope, this);
-  }
-
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ANONYMOUS_CONTENT_LIST_IID)
-private:
-  nsCOMPtr<nsIContent> mContent;
-  nsInsertionPointList* mElements;
-};
-
-NS_DEFINE_STATIC_IID_ACCESSOR(nsAnonymousContentList,
-                              NS_ANONYMOUS_CONTENT_LIST_IID)
-
-nsAnonymousContentList::nsAnonymousContentList(nsIContent *aContent,
-                                               nsInsertionPointList* aElements)
-  : mContent(aContent),
-    mElements(aElements)
-{
-  MOZ_COUNT_CTOR(nsAnonymousContentList);
-
-  // We don't reference count our Anonymous reference (to avoid circular
-  // references). We'll be told when the Anonymous goes away.
-  SetIsDOMBinding();
-}
-
-nsAnonymousContentList::~nsAnonymousContentList()
-{
-  MOZ_COUNT_DTOR(nsAnonymousContentList);
-  delete mElements;
-}
-
-NS_IMPL_CYCLE_COLLECTING_ADDREF(nsAnonymousContentList)
-NS_IMPL_CYCLE_COLLECTING_RELEASE(nsAnonymousContentList)
-
-NS_INTERFACE_TABLE_HEAD(nsAnonymousContentList)
-  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
-  NS_INTERFACE_TABLE3(nsAnonymousContentList, nsINodeList, nsIDOMNodeList,
-                      nsAnonymousContentList)
-  NS_INTERFACE_TABLE_TO_MAP_SEGUE_CYCLE_COLLECTION(nsAnonymousContentList)
-NS_INTERFACE_MAP_END
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsAnonymousContentList)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mContent)
-  tmp->mElements->Clear();
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsAnonymousContentList)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mContent)
-  {
-    int32_t i, count = tmp->mElements->Length();
-    for (i = 0; i < count; ++i) {
-      NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mElements->ElementAt(i));
-    }
-  }
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsAnonymousContentList)
-  NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
-NS_IMPL_CYCLE_COLLECTION_TRACE_END
-
-NS_IMETHODIMP
-nsAnonymousContentList::GetLength(uint32_t* aLength)
-{
-  NS_ASSERTION(aLength != nullptr, "null ptr");
-  if (! aLength)
-      return NS_ERROR_NULL_POINTER;
-
-  int32_t cnt = mElements->Length();
-
-  *aLength = 0;
-  for (int32_t i = 0; i < cnt; i++)
-    *aLength += static_cast<nsXBLInsertionPoint*>(mElements->ElementAt(i))->ChildCount();
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP    
-nsAnonymousContentList::Item(uint32_t aIndex, nsIDOMNode** aReturn)
-{
-  nsINode* item = Item(aIndex);
-  if (!item)
-    return NS_ERROR_FAILURE;
-
-  return CallQueryInterface(item, aReturn);    
-}
-
-nsIContent*
-nsAnonymousContentList::Item(uint32_t aIndex)
-{
-  int32_t cnt = mElements->Length();
-  uint32_t pointCount = 0;
-
-  for (int32_t i = 0; i < cnt; i++) {
-    aIndex -= pointCount;
-    
-    nsXBLInsertionPoint* point = static_cast<nsXBLInsertionPoint*>(mElements->ElementAt(i));
-    pointCount = point->ChildCount();
-
-    if (aIndex < pointCount) {
-      return point->ChildAt(aIndex);
-    }
-  }
-
-  return nullptr;
-}
-
-int32_t
-nsAnonymousContentList::IndexOf(nsIContent* aContent)
-{
-  int32_t cnt = mElements->Length();
-  int32_t lengthSoFar = 0;
-
-  for (int32_t i = 0; i < cnt; ++i) {
-    nsXBLInsertionPoint* point =
-      static_cast<nsXBLInsertionPoint*>(mElements->ElementAt(i));
-    int32_t idx = point->IndexOf(aContent);
-    if (idx != -1) {
-      return idx + lengthSoFar;
-    }
-
-    lengthSoFar += point->ChildCount();
-  }
-
-  // Didn't find it anywhere
-  return -1;
-}
-
 //
 // Generic pldhash table stuff for mapping one nsISupports to another
 //
@@ -357,14 +196,6 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsBindingManager)
   if (tmp->mLoadingDocTable.IsInitialized())
     tmp->mLoadingDocTable.Clear();
 
-  if (tmp->mContentListTable.ops)
-    PL_DHashTableFinish(&(tmp->mContentListTable));
-  tmp->mContentListTable.ops = nullptr;
-
-  if (tmp->mAnonymousNodesTable.ops)
-    PL_DHashTableFinish(&(tmp->mAnonymousNodesTable));
-  tmp->mAnonymousNodesTable.ops = nullptr;
-
   if (tmp->mInsertionParentTable.ops)
     PL_DHashTableFinish(&(tmp->mInsertionParentTable));
   tmp->mInsertionParentTable.ops = nullptr;
@@ -431,8 +262,6 @@ nsBindingManager::nsBindingManager(nsIDocument* aDocument)
     mAttachedStackSizeOnOutermost(0),
     mDocument(aDocument)
 {
-  mContentListTable.ops = nullptr;
-  mAnonymousNodesTable.ops = nullptr;
   mInsertionParentTable.ops = nullptr;
   mWrapperTable.ops = nullptr;
 }
@@ -441,10 +270,6 @@ nsBindingManager::~nsBindingManager(void)
 {
   mDestroyed = true;
 
-  if (mContentListTable.ops)
-    PL_DHashTableFinish(&mContentListTable);
-  if (mAnonymousNodesTable.ops)
-    PL_DHashTableFinish(&mAnonymousNodesTable);
   NS_ASSERTION(!mInsertionParentTable.ops || !mInsertionParentTable.entryCount,
                "Insertion parent table isn't empty!");
   if (mInsertionParentTable.ops)
@@ -453,49 +278,6 @@ nsBindingManager::~nsBindingManager(void)
     PL_DHashTableFinish(&mWrapperTable);
 }
 
-PLDHashOperator
-RemoveInsertionParentCB(PLDHashTable* aTable, PLDHashEntryHdr* aEntry,
-                        uint32_t aNumber, void* aArg)
-{
-  return (static_cast<ObjectEntry*>(aEntry)->GetValue() ==
-          static_cast<nsISupports*>(aArg)) ? PL_DHASH_REMOVE : PL_DHASH_NEXT;
-}
-
-static void
-RemoveInsertionParentForNodeList(nsIDOMNodeList* aList, nsIContent* aParent)
-{
-  nsAnonymousContentList* list = nullptr;
-  if (aList) {
-    CallQueryInterface(aList, &list);
-  }
-  if (list) {
-    int32_t count = list->GetInsertionPointCount();
-    for (int32_t i = 0; i < count; ++i) {
-      nsRefPtr<nsXBLInsertionPoint> currPoint = list->GetInsertionPointAt(i);
-      currPoint->UnbindDefaultContent();
-#ifdef DEBUG
-      nsCOMPtr<nsIContent> parent = currPoint->GetInsertionParent();
-      NS_ASSERTION(!parent || parent == aParent, "Wrong insertion parent!");
-#endif
-      currPoint->ClearInsertionParent();
-    }
-    NS_RELEASE(list);
-  }
-}
-
-void
-nsBindingManager::RemoveInsertionParent(nsIContent* aParent)
-{
-  RemoveInsertionParentForNodeList(GetContentListFor(aParent), aParent);
-
-  RemoveInsertionParentForNodeList(GetAnonymousNodesFor(aParent), aParent);
-
-  if (mInsertionParentTable.ops) {
-    PL_DHashTableEnumerate(&mInsertionParentTable, RemoveInsertionParentCB,
-                           static_cast<nsISupports*>(aParent));
-  }
-}
-
 nsXBLBinding*
 nsBindingManager::GetBinding(nsIContent* aContent)
 {
@@ -507,6 +289,13 @@ nsBindingManager::GetBinding(nsIContent* aContent)
   return nullptr;
 }
 
+nsXBLBinding*
+nsBindingManager::GetBindingWithContent(nsIContent* aContent)
+{
+  nsXBLBinding* binding = GetBinding(aContent);
+  return binding ? binding->GetBindingWithContent() : nullptr;
+}
+
 nsresult
 nsBindingManager::SetBinding(nsIContent* aContent, nsXBLBinding* aBinding)
 {
@@ -522,16 +311,6 @@ nsBindingManager::SetBinding(nsIContent* aContent, nsXBLBinding* aBinding)
   // dies before we process mAttachedStack).
   nsRefPtr<nsXBLBinding> oldBinding = GetBinding(aContent);
   if (oldBinding) {
-    if (aContent->HasFlag(NODE_IS_INSERTION_PARENT)) {
-      nsRefPtr<nsXBLBinding> parentBinding =
-        GetBinding(aContent->GetBindingParent());
-      // Clear insertion parent only if we don't have a parent binding which
-      // marked content to be an insertion parent. See also ChangeDocumentFor().
-      if (!parentBinding || !parentBinding->HasInsertionParent(aContent)) {
-        RemoveInsertionParent(aContent);
-        aContent->UnsetFlags(NODE_IS_INSERTION_PARENT);
-      }
-    }
     // Don't remove items here as that could mess up an executing
     // ProcessAttachedQueue
     uint32_t index = mAttachedStack.IndexOf(oldBinding);
@@ -539,19 +318,15 @@ nsBindingManager::SetBinding(nsIContent* aContent, nsXBLBinding* aBinding)
       mAttachedStack[index] = nullptr;
     }
   }
-  
+
   if (aBinding) {
     aContent->SetFlags(NODE_MAY_BE_IN_BINDING_MNGR);
     mBindingTable.Put(aContent, aBinding);
   } else {
     mBindingTable.Remove(aContent);
 
-    // The death of the bindings means the death of the JS wrapper,
-    // and the flushing of our explicit and anonymous insertion point
-    // lists.
+    // The death of the bindings means the death of the JS wrapper.
     SetWrappedJS(aContent, nullptr);
-    SetContentListFor(aContent, nullptr);
-    SetAnonymousNodesFor(aContent, nullptr);
     if (oldBinding) {
       oldBinding->SetBoundElement(nullptr);
     }
@@ -574,9 +349,6 @@ nsBindingManager::GetInsertionParent(nsIContent* aContent)
 nsresult
 nsBindingManager::SetInsertionParent(nsIContent* aContent, nsIContent* aParent)
 {
-  NS_ASSERTION(!aParent || aParent->HasFlag(NODE_IS_INSERTION_PARENT),
-               "Insertion parent should have NODE_IS_INSERTION_PARENT flag!");
-
   if (mDestroyed) {
     return NS_OK;
   }
@@ -606,30 +378,14 @@ nsBindingManager::SetWrappedJS(nsIContent* aContent, nsIXPConnectWrappedJS* aWra
 
 void
 nsBindingManager::RemovedFromDocumentInternal(nsIContent* aContent,
-                                              nsIDocument* aOldDocument,
-                                              nsIContent* aContentBindingParent)
+                                              nsIDocument* aOldDocument)
 {
   NS_PRECONDITION(aOldDocument != nullptr, "no old document");
 
   if (mDestroyed)
     return;
 
-  // Hold a ref to the binding so it won't die when we remove it from our
-  // table.
   nsRefPtr<nsXBLBinding> binding = GetBinding(aContent);
-  if (aContent->HasFlag(NODE_IS_INSERTION_PARENT)) {
-    nsRefPtr<nsXBLBinding> parentBinding = GetBinding(aContentBindingParent);
-    if (parentBinding) {
-      parentBinding->RemoveInsertionParent(aContent);
-      // Clear insertion parent only if we don't have a binding which
-      // marked content to be an insertion parent. See also SetBinding().
-      if (!binding || !binding->HasInsertionParent(aContent)) {
-        RemoveInsertionParent(aContent);
-        aContent->UnsetFlags(NODE_IS_INSERTION_PARENT);
-      }
-    }
-  }
-
   if (binding) {
     binding->PrototypeBinding()->BindingDetached(binding->GetBoundElement());
     binding->ChangeDocument(aOldDocument, nullptr);
@@ -638,8 +394,6 @@ nsBindingManager::RemovedFromDocumentInternal(nsIContent* aContent,
 
   // Clear out insertion parents and content lists.
   SetInsertionParent(aContent, nullptr);
-  SetContentListFor(aContent, nullptr);
-  SetAnonymousNodesFor(aContent, nullptr);
 }
 
 nsIAtom*
@@ -659,177 +413,19 @@ nsBindingManager::ResolveTag(nsIContent* aContent, int32_t* aNameSpaceID)
   return aContent->Tag();
 }
 
-nsresult
-nsBindingManager::GetContentListFor(nsIContent* aContent, nsIDOMNodeList** aResult)
-{
-  NS_IF_ADDREF(*aResult = GetContentListFor(aContent));
-  return NS_OK;
-}
-
-nsINodeList*
-nsBindingManager::GetContentListFor(nsIContent* aContent)
-{ 
-  nsINodeList* result = nullptr;
-
-  if (mContentListTable.ops) {
-    result = static_cast<nsAnonymousContentList*>
-      (LookupObject(mContentListTable, aContent));
-  }
-
-  if (!result) {
-    result = aContent->ChildNodes();
-  }
-
-  return result;
-}
-
-nsresult
-nsBindingManager::SetContentListFor(nsIContent* aContent,
-                                    nsInsertionPointList* aList)
-{
-  if (mDestroyed) {
-    return NS_OK;
-  }
-
-  nsAnonymousContentList* contentList = nullptr;
-  if (aList) {
-    contentList = new nsAnonymousContentList(aContent, aList);
-    if (!contentList) {
-      delete aList;
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-
-  return SetOrRemoveObject(mContentListTable, aContent, contentList);
-}
-
-bool
-nsBindingManager::HasContentListFor(nsIContent* aContent)
-{
-  return mContentListTable.ops && LookupObject(mContentListTable, aContent);
-}
-
-nsINodeList*
-nsBindingManager::GetAnonymousNodesInternal(nsIContent* aContent,
-                                            bool* aIsAnonymousContentList)
-{ 
-  nsINodeList* result = nullptr;
-  if (mAnonymousNodesTable.ops) {
-    result = static_cast<nsAnonymousContentList*>
-                        (LookupObject(mAnonymousNodesTable, aContent));
-  }
-
-  if (!result) {
-    *aIsAnonymousContentList = false;
-    nsXBLBinding *binding = GetBinding(aContent);
-    if (binding) {
-      result = binding->GetAnonymousNodes();
-    }
-  } else
-    *aIsAnonymousContentList = true;
-
-  return result;
-}
-
 nsresult
 nsBindingManager::GetAnonymousNodesFor(nsIContent* aContent,
                                        nsIDOMNodeList** aResult)
 {
-  bool dummy;
-  NS_IF_ADDREF(*aResult = GetAnonymousNodesInternal(aContent, &dummy));
+  NS_IF_ADDREF(*aResult = GetAnonymousNodesFor(aContent));
   return NS_OK;
 }
 
 nsINodeList*
 nsBindingManager::GetAnonymousNodesFor(nsIContent* aContent)
 {
-  bool dummy;
-  return GetAnonymousNodesInternal(aContent, &dummy);
-}
-
-nsresult
-nsBindingManager::SetAnonymousNodesFor(nsIContent* aContent,
-                                       nsInsertionPointList* aList)
-{
-  if (mDestroyed) {
-    return NS_OK;
-  }
-
-  nsAnonymousContentList* contentList = nullptr;
-  if (aList) {
-    contentList = new nsAnonymousContentList(aContent, aList);
-    if (!contentList) {
-      delete aList;
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-  }
-
-  return SetOrRemoveObject(mAnonymousNodesTable, aContent, contentList);
-}
-
-nsINodeList*
-nsBindingManager::GetXBLChildNodesInternal(nsIContent* aContent,
-                                           bool* aIsAnonymousContentList)
-{
-  uint32_t length;
-
-  // Retrieve the anonymous content that we should build.
-  nsINodeList* result = GetAnonymousNodesInternal(aContent,
-                                                  aIsAnonymousContentList);
-  if (result) {
-    result->GetLength(&length);
-    if (length == 0)
-      result = nullptr;
-  }
-    
-  // We may have an altered list of children from XBL insertion points.
-  // If we don't have any anonymous kids, we next check to see if we have 
-  // insertion points.
-  if (!result) {
-    if (mContentListTable.ops) {
-      result = static_cast<nsAnonymousContentList*>
-                          (LookupObject(mContentListTable, aContent));
-      *aIsAnonymousContentList = true;
-    }
-  }
-
-  return result;
-}
-
-nsresult
-nsBindingManager::GetXBLChildNodesFor(nsIContent* aContent, nsIDOMNodeList** aResult)
-{
-  NS_IF_ADDREF(*aResult = GetXBLChildNodesFor(aContent));
-  return NS_OK;
-}
-
-nsINodeList*
-nsBindingManager::GetXBLChildNodesFor(nsIContent* aContent)
-{
-  bool dummy;
-  return GetXBLChildNodesInternal(aContent, &dummy);
-}
-
-nsIContent*
-nsBindingManager::GetInsertionPoint(nsIContent* aParent,
-                                    const nsIContent* aChild,
-                                    uint32_t* aIndex)
-{
-  nsXBLBinding *binding = GetBinding(aParent);
-  return binding ? binding->GetInsertionPoint(aChild, aIndex) : nullptr;
-}
-
-nsIContent*
-nsBindingManager::GetSingleInsertionPoint(nsIContent* aParent,
-                                          uint32_t* aIndex,
-                                          bool* aMultipleInsertionPoints)
-{
-  nsXBLBinding *binding = GetBinding(aParent);
-  if (binding)
-    return binding->GetSingleInsertionPoint(aIndex, aMultipleInsertionPoints);
-
-  *aMultipleInsertionPoints = false;
-  return nullptr;
+  nsXBLBinding* binding = GetBindingWithContent(aContent);
+  return binding ? binding->GetAnonymousNodeList() : nullptr;
 }
 
 nsresult
@@ -1372,115 +968,33 @@ nsBindingManager::AppendAllSheets(nsTArray<nsCSSStyleSheet*>& aArray)
   mBindingTable.EnumerateRead(EnumAppendAllSheets, &aArray);
 }
 
-nsIContent*
-nsBindingManager::GetNestedInsertionPoint(nsIContent* aParent,
-                                          const nsIContent* aChild)
+static void
+InsertAppendedContent(nsBindingManager* aManager,
+                      nsXBLChildrenElement* aPoint,
+                      nsIContent* aFirstNewContent)
 {
-  // Check to see if the content is anonymous.
-  if (aChild->GetBindingParent() == aParent)
-    return nullptr; // It is anonymous. Don't use the insertion point, since that's only
-                   // for the explicit kids.
+  uint32_t insertionIndex;
+  if (nsIContent* prevSibling = aFirstNewContent->GetPreviousSibling()) {
+    // If we have a previous sibling, then it must already be in aPoint. Find
+    // it and insert after it.
+    insertionIndex = aPoint->IndexOfInsertedChild(prevSibling);
+    MOZ_ASSERT(insertionIndex != aPoint->NoIndex);
 
-  uint32_t index;
-  nsIContent *insertionElement = GetInsertionPoint(aParent, aChild, &index);
-  if (insertionElement && insertionElement != aParent) {
-    // See if we nest even further in.
-    nsIContent* nestedPoint = GetNestedInsertionPoint(insertionElement, aChild);
-    if (nestedPoint)
-      insertionElement = nestedPoint;
+    // Our insertion index is one after our previous sibling's index.
+    ++insertionIndex;
+  } else {
+    // Otherwise, we append.
+    // TODO This is wrong for nested insertion points. In that case, we need to
+    // keep track of the right index to insert into.
+    insertionIndex = aPoint->mInsertedChildren.Length();
   }
 
-  return insertionElement;
-}
-
-nsIContent*
-nsBindingManager::GetNestedSingleInsertionPoint(nsIContent* aParent,
-                                                bool* aMultipleInsertionPoints)
-{
-  *aMultipleInsertionPoints = false;
-  
-  uint32_t index;
-  nsIContent *insertionElement =
-    GetSingleInsertionPoint(aParent, &index, aMultipleInsertionPoints);
-  if (*aMultipleInsertionPoints) {
-    return nullptr;
+  // Do the inserting.
+  for (nsIContent* currentChild = aFirstNewContent;
+       currentChild;
+       currentChild = currentChild->GetNextSibling()) {
+    aPoint->InsertInsertedChildAt(currentChild, insertionIndex++, aManager);
   }
-  if (insertionElement && insertionElement != aParent) {
-    // See if we nest even further in.
-    nsIContent* nestedPoint =
-      GetNestedSingleInsertionPoint(insertionElement,
-                                    aMultipleInsertionPoints);
-    if (nestedPoint)
-      insertionElement = nestedPoint;
-  }
-
-  return insertionElement;
-}
-
-nsXBLInsertionPoint*
-nsBindingManager::FindInsertionPointAndIndex(nsIContent* aContainer,
-                                             nsIContent* aInsertionParent,
-                                             uint32_t aIndexInContainer,
-                                             int32_t aAppend,
-                                             int32_t* aInsertionIndex)
-{
-  bool isAnonymousContentList;
-  nsINodeList* nodeList =
-    GetXBLChildNodesInternal(aInsertionParent, &isAnonymousContentList);
-  if (!nodeList || !isAnonymousContentList) {
-    return nullptr;
-  }
-
-  // Find a non-pseudo-insertion point and just jam ourselves in.  This is
-  // not 100% correct, since there might be multiple insertion points under
-  // this insertion parent, and we should really be using the one that
-  // matches our content...  Hack city, baby.
-  nsAnonymousContentList* contentList =
-    static_cast<nsAnonymousContentList*>(nodeList);
-
-  int32_t count = contentList->GetInsertionPointCount();
-  for (int32_t i = 0; i < count; i++) {
-    nsXBLInsertionPoint* point = contentList->GetInsertionPointAt(i);
-    if (point->GetInsertionIndex() != -1) {
-      // We're real. Jam the kid in.
-
-      // Find the right insertion spot.  Can't just insert in the insertion
-      // point at aIndexInContainer since the point may contain anonymous
-      // content, not all of aContainer's kids, etc.  So find the last
-      // child of aContainer that comes before aIndexInContainer and is in
-      // the insertion point and insert right after it.
-      int32_t pointSize = point->ChildCount();
-      for (int32_t parentIndex = aIndexInContainer - 1; parentIndex >= 0;
-           --parentIndex) {
-        nsIContent* currentSibling = aContainer->GetChildAt(parentIndex);
-        for (int32_t pointIndex = pointSize - 1; pointIndex >= 0;
-             --pointIndex) {
-          if (point->ChildAt(pointIndex) == currentSibling) {
-            *aInsertionIndex = pointIndex + 1;
-            return point;
-          }
-        }
-      }
-
-      // None of our previous siblings are in here... just stick
-      // ourselves in at the end of the insertion point if we're
-      // appending, and at the beginning otherwise.            
-      // XXXbz if we ever start doing the filter thing right, this may be no
-      // good, since we may _still_ have anonymous kids in there and may need
-      // to get the ordering with those right.  In fact, this is even wrong
-      // without the filter thing for nested insertion points, since they might
-      // contain anonymous content that needs to come after all explicit
-      // kids... but we have no way to know that here easily.
-      if (aAppend) {
-        *aInsertionIndex = pointSize;
-      } else {
-        *aInsertionIndex = 0;
-      }
-      return point;
-    }
-  }
-
-  return nullptr;  
 }
 
 void
@@ -1489,38 +1003,60 @@ nsBindingManager::ContentAppended(nsIDocument* aDocument,
                                   nsIContent* aFirstNewContent,
                                   int32_t     aNewIndexInContainer)
 {
-  if (aNewIndexInContainer != -1 &&
-      (mContentListTable.ops || mAnonymousNodesTable.ops)) {
-    // It's not anonymous.
-    NS_ASSERTION(aNewIndexInContainer >= 0, "Bogus index");
-
-    bool multiple;
-    nsIContent* ins = GetNestedSingleInsertionPoint(aContainer, &multiple);
-
-    if (multiple) {
-      // Do each kid individually
-      int32_t childCount = aContainer->GetChildCount();
-      for (int32_t idx = aNewIndexInContainer; idx < childCount; ++idx) {
-        HandleChildInsertion(aContainer, aContainer->GetChildAt(idx),
-                             idx, true);
-      }
-    }
-    else if (ins) {
-      int32_t insertionIndex;
-      nsXBLInsertionPoint* point =
-        FindInsertionPointAndIndex(aContainer, ins, aNewIndexInContainer,
-                                   true, &insertionIndex);
-      if (point) {
-        int32_t childCount = aContainer->GetChildCount();
-        for (int32_t j = aNewIndexInContainer; j < childCount;
-             j++, insertionIndex++) {
-          nsIContent* child = aContainer->GetChildAt(j);
-          point->InsertChildAt(insertionIndex, child);
-          SetInsertionParent(child, ins);
-        }
-      }
-    }
+  if (aNewIndexInContainer == -1) {
+    return;
   }
+
+  // Try to find insertion points for all the new kids.
+  nsXBLChildrenElement* point = nullptr;
+  nsIContent* parent = aContainer;
+  bool first = true;
+  do {
+    nsXBLBinding* binding = GetBindingWithContent(parent);
+    if (!binding) {
+      break;
+    }
+
+    if (binding->HasFilteredInsertionPoints()) {
+      // There are filtered insertion points involved, handle each child
+      // separately.
+      // We could optimize this in the case when we've nested a few levels
+      // deep already, without hitting bindings that have filtered insertion
+      // points.
+      int32_t currentIndex = aNewIndexInContainer;
+      for (nsIContent* currentChild = aFirstNewContent; currentChild;
+           currentChild = currentChild->GetNextSibling()) {
+        HandleChildInsertion(aContainer, currentChild,
+                             currentIndex++, true);
+      }
+
+      return;
+    }
+
+    point = binding->GetDefaultInsertionPoint();
+    if (!point) {
+      break;
+    }
+
+    // Even though we're in ContentAppended, nested insertion points force us
+    // to deal with this append as an insertion except in the outermost
+    // binding.
+    if (first) {
+      first = false;
+      for (nsIContent* child = aFirstNewContent; child;
+           child = child->GetNextSibling()) {
+        point->AppendInsertedChild(child, this);
+      }
+    } else {
+      InsertAppendedContent(this, point, aFirstNewContent);
+    }
+
+    nsIContent* newParent = point->GetParent();
+    if (newParent == parent) {
+      break;
+    }
+    parent = newParent;
+  } while (parent);
 }
 
 void
@@ -1529,37 +1065,11 @@ nsBindingManager::ContentInserted(nsIDocument* aDocument,
                                   nsIContent* aChild,
                                   int32_t aIndexInContainer)
 {
-  if (aIndexInContainer != -1 &&
-      (mContentListTable.ops || mAnonymousNodesTable.ops)) {
-    // It's not anonymous.
-    NS_ASSERTION(aIndexInContainer >= 0, "Bogus index");
-    HandleChildInsertion(aContainer, aChild, aIndexInContainer, false);
+  if (aIndexInContainer == -1) {
+    return;
   }
-}
 
-static void
-RemoveChildFromInsertionPoint(nsAnonymousContentList* aInsertionPointList,
-                              nsIContent* aChild,
-                              bool aRemoveFromPseudoPoints)
-{
-  // We need to find the insertion point that contains aChild and remove it
-  // from that insertion point.  Sadly, we don't know which point it is, or
-  // when we've hit it, but just trying to remove from all the pseudo or
-  // non-pseudo insertion points, depending on the value of
-  // aRemoveFromPseudoPoints, should work.
-
-  // XXXbz nsXBLInsertionPoint::RemoveChild could return whether it
-  // removed something.  Wouldn't that let us short-circuit the walk?
-  // Or can a child be in multiple insertion points?  I wouldn't think
-  // so...
-  int32_t count = aInsertionPointList->GetInsertionPointCount();
-  for (int32_t i = 0; i < count; i++) {
-    nsXBLInsertionPoint* point =
-      aInsertionPointList->GetInsertionPointAt(i);
-    if ((point->GetInsertionIndex() == -1) == aRemoveFromPseudoPoints) {
-      point->RemoveChild(aChild);
-    }
-  }
+  HandleChildInsertion(aContainer, aChild, aIndexInContainer, false);
 }
 
 void
@@ -1569,53 +1079,51 @@ nsBindingManager::ContentRemoved(nsIDocument* aDocument,
                                  int32_t aIndexInContainer,
                                  nsIContent* aPreviousSibling)
 {
-  if (aContainer && aIndexInContainer != -1 &&
-      (mContentListTable.ops || mAnonymousNodesTable.ops)) {
-    // It's not anonymous
-    nsCOMPtr<nsIContent> point = GetNestedInsertionPoint(aContainer, aChild);
+  SetInsertionParent(aChild, nullptr);
 
-    if (point) {
-      bool isAnonymousContentList;
-      nsCOMPtr<nsIDOMNodeList> nodeList =
-        GetXBLChildNodesInternal(point, &isAnonymousContentList);
-      
-      if (nodeList && isAnonymousContentList) {
-        // Find a non-pseudo-insertion point and remove ourselves.
-        RemoveChildFromInsertionPoint(static_cast<nsAnonymousContentList*>
-                                        (static_cast<nsIDOMNodeList*>
-                                                    (nodeList)),
-                                      aChild,
-                                      false);
-        SetInsertionParent(aChild, nullptr);
-      }
-
-      // Also remove from the list in mContentListTable, if any.
-      if (mContentListTable.ops) {
-        nsCOMPtr<nsIDOMNodeList> otherNodeList =
-          static_cast<nsAnonymousContentList*>
-                     (LookupObject(mContentListTable, point));
-        if (otherNodeList && otherNodeList != nodeList) {
-          // otherNodeList is always anonymous
-          RemoveChildFromInsertionPoint(static_cast<nsAnonymousContentList*>
-                                        (static_cast<nsIDOMNodeList*>
-                                                    (otherNodeList)),
-                                        aChild,
-                                        false);
-        }
+  nsXBLChildrenElement* point = nullptr;
+  nsIContent* parent = aContainer;
+  do {
+    nsXBLBinding* binding = GetBindingWithContent(parent);
+    if (!binding) {
+      // If aChild is XBL content, it might have <xbl:children> elements
+      // somewhere under it. We need to inform those elements that they're no
+      // longer in the tree so they can tell their distributed children that
+      // they're no longer distributed under them.
+      // XXX This is wrong. We need to do far more work to update the parent
+      // binding's list of insertion points and to get the new insertion parent
+      // for the newly-distributed children correct.
+      if (aChild->GetBindingParent()) {
+        ClearInsertionPointsRecursively(aChild);
       }
+      return;
     }
 
-    // Whether the child has a nested insertion point or not, aContainer might
-    // have insertion points under it.  If that's the case, we need to remove
-    // aChild from the pseudo insertion point it's in.
-    if (mContentListTable.ops) {
-      nsAnonymousContentList* insertionPointList =
-        static_cast<nsAnonymousContentList*>(LookupObject(mContentListTable,
-                                                          aContainer));
-      if (insertionPointList) {
-        RemoveChildFromInsertionPoint(insertionPointList, aChild, true);
-      }
+    point = binding->FindInsertionPointFor(aChild);
+    if (!point) {
+      break;
     }
+
+    point->RemoveInsertedChild(aChild);
+
+    nsIContent* newParent = point->GetParent();
+    if (newParent == parent) {
+      break;
+    }
+    parent = newParent;
+  } while (parent);
+}
+
+void
+nsBindingManager::ClearInsertionPointsRecursively(nsIContent* aContent)
+{
+  if (aContent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    static_cast<nsXBLChildrenElement*>(aContent)->ClearInsertedChildrenAndInsertionParents(this);
+  }
+
+  uint32_t childCount = aContent->GetChildCount();
+  for (uint32_t c = 0; c < childCount; c++) {
+    ClearInsertionPointsRecursively(aContent->GetChildAt(c));
   }
 }
 
@@ -1630,14 +1138,6 @@ nsBindingManager::DropDocumentReference()
     mProcessAttachedQueueEvent->Revoke();
   }
 
-  if (mContentListTable.ops)
-    PL_DHashTableFinish(&(mContentListTable));
-  mContentListTable.ops = nullptr;
-
-  if (mAnonymousNodesTable.ops)
-    PL_DHashTableFinish(&(mAnonymousNodesTable));
-  mAnonymousNodesTable.ops = nullptr;
-
   if (mInsertionParentTable.ops)
     PL_DHashTableFinish(&(mInsertionParentTable));
   mInsertionParentTable.ops = nullptr;
@@ -1676,20 +1176,6 @@ nsBindingManager::Traverse(nsIContent *aContent,
     cb.NoteXPCOMChild(aContent);
     CycleCollectionNoteChild(cb, binding, "[via binding manager] mBindingTable value");
   }
-  if (mContentListTable.ops &&
-      (value = LookupObject(mContentListTable, aContent))) {
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "[via binding manager] mContentListTable key");
-    cb.NoteXPCOMChild(aContent);
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "[via binding manager] mContentListTable value");
-    cb.NoteXPCOMChild(value);
-  }
-  if (mAnonymousNodesTable.ops &&
-      (value = LookupObject(mAnonymousNodesTable, aContent))) {
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "[via binding manager] mAnonymousNodesTable key");
-    cb.NoteXPCOMChild(aContent);
-    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "[via binding manager] mAnonymousNodesTable value");
-    cb.NoteXPCOMChild(value);
-  }
   if (mWrapperTable.ops &&
       (value = LookupObject(mWrapperTable, aContent))) {
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "[via binding manager] mWrapperTable key");
@@ -1725,16 +1211,123 @@ nsBindingManager::HandleChildInsertion(nsIContent* aContainer,
                   uint32_t(aContainer->IndexOf(aChild)) == aIndexInContainer,
                   "Child not at the right index?");
 
-  nsIContent* ins = GetNestedInsertionPoint(aContainer, aChild);
-
-  if (ins) {
-    int32_t insertionIndex;
-    nsXBLInsertionPoint* point =
-      FindInsertionPointAndIndex(aContainer, ins, aIndexInContainer, aAppend,
-                                 &insertionIndex);
-    if (point) {
-      point->InsertChildAt(insertionIndex, aChild);
-      SetInsertionParent(aChild, ins);
+  nsXBLChildrenElement* point = nullptr;
+  nsIContent* parent = aContainer;
+  while (parent) {
+    nsXBLBinding* binding = GetBindingWithContent(parent);
+    if (!binding) {
+      break;
     }
+
+    point = binding->FindInsertionPointFor(aChild);
+    if (!point) {
+      break;
+    }
+
+    // Insert the child into the proper insertion point.
+    // TODO If there were multiple insertion points, this approximation can be
+    // wrong. We need to re-run the distribution algorithm. In the meantime,
+    // this should work well enough.
+    uint32_t index = aAppend ? point->mInsertedChildren.Length() : 0;
+    for (nsIContent* currentSibling = aChild->GetPreviousSibling();
+         currentSibling;
+         currentSibling = currentSibling->GetPreviousSibling()) {
+      // If we find one of our previous siblings in the insertion point, the
+      // index following it is the correct insertion point. Otherwise, we guess
+      // based on whether we're appending or inserting.
+      uint32_t pointIndex = point->IndexOfInsertedChild(currentSibling);
+      if (pointIndex != point->NoIndex) {
+        index = pointIndex + 1;
+        break;
+      }
+    }
+
+    point->InsertInsertedChildAt(aChild, index, this);
+
+    nsIContent* newParent = point->GetParent();
+    if (newParent == parent) {
+      break;
+    }
+
+    parent = newParent;
   }
 }
+
+
+nsIContent*
+nsBindingManager::FindNestedInsertionPoint(nsIContent* aContainer,
+                                           nsIContent* aChild)
+{
+  NS_PRECONDITION(aChild->GetParent() == aContainer,
+                  "Wrong container");
+
+  nsIContent* parent = aContainer;
+  if (aContainer->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    if (static_cast<nsXBLChildrenElement*>(aContainer)->
+          HasInsertedChildren()) {
+      return nullptr;
+    }
+    parent = aContainer->GetParent();
+  }
+
+  while (parent) {
+    nsXBLBinding* binding = GetBindingWithContent(parent);
+    if (!binding) {
+      break;
+    }
+  
+    nsXBLChildrenElement* point = binding->FindInsertionPointFor(aChild);
+    if (!point) {
+      return nullptr;
+    }
+
+    nsIContent* newParent = point->GetParent();
+    if (newParent == parent) {
+      break;
+    }
+    parent = newParent;
+  }
+
+  return parent;
+}
+
+nsIContent*
+nsBindingManager::FindNestedSingleInsertionPoint(nsIContent* aContainer,
+                                                 bool* aMulti)
+{
+  *aMulti = false;
+
+  nsIContent* parent = aContainer;
+  if (aContainer->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    if (static_cast<nsXBLChildrenElement*>(aContainer)->
+          HasInsertedChildren()) {
+      return nullptr;
+    }
+    parent = aContainer->GetParent();
+  }
+
+  while(parent) {
+    nsXBLBinding* binding = GetBindingWithContent(parent);
+    if (!binding) {
+      break;
+    }
+
+    if (binding->HasFilteredInsertionPoints()) {
+      *aMulti = true;
+      return nullptr;
+    }
+
+    nsXBLChildrenElement* point = binding->GetDefaultInsertionPoint();
+    if (!point) {
+      return nullptr;
+    }
+
+    nsIContent* newParent = point->GetParent();
+    if (newParent == parent) {
+      break;
+    }
+    parent = newParent;
+  }
+
+  return parent;
+}
diff --git a/content/xbl/src/nsBindingManager.h b/content/xbl/src/nsBindingManager.h
index 7ea2d37975e..f4f4713333a 100644
--- a/content/xbl/src/nsBindingManager.h
+++ b/content/xbl/src/nsBindingManager.h
@@ -44,6 +44,7 @@ public:
   ~nsBindingManager();
 
   nsXBLBinding* GetBinding(nsIContent* aContent);
+  nsXBLBinding* GetBindingWithContent(nsIContent* aContent);
   nsresult SetBinding(nsIContent* aContent, nsXBLBinding* aBinding);
 
   nsIContent* GetInsertionParent(nsIContent* aContent);
@@ -62,40 +63,14 @@ public:
   void RemovedFromDocument(nsIContent* aContent, nsIDocument* aOldDocument)
   {
     if (aContent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
-      RemovedFromDocumentInternal(aContent, aOldDocument,
-                                  aContent->GetBindingParent());
+      RemovedFromDocumentInternal(aContent, aOldDocument);
     }
   }
   void RemovedFromDocumentInternal(nsIContent* aContent,
-                                   nsIDocument* aOldDocument,
-                                   nsIContent* aContentBindingParent);
+                                   nsIDocument* aOldDocument);
 
   nsIAtom* ResolveTag(nsIContent* aContent, int32_t* aNameSpaceID);
 
-  /**
-   * Return a list of all explicit children, including any children
-   * that may have been inserted via XBL insertion points.
-   */
-  nsresult GetContentListFor(nsIContent* aContent, nsIDOMNodeList** aResult);
-
-  /**
-   * Non-COMy version of GetContentListFor.
-   */
-  nsINodeList* GetContentListFor(nsIContent* aContent);
-
-  /**
-   * Set the insertion point children for the specified element.
-   * The binding manager assumes ownership of aList.
-   */
-  nsresult SetContentListFor(nsIContent* aContent,
-                             nsInsertionPointList* aList);
-
-  /**
-   * Determine whether or not the explicit child list has been altered
-   * by XBL insertion points.
-   */
-  bool HasContentListFor(nsIContent* aContent);
-
   /**
    * Return the nodelist of "anonymous" kids for this node.  This might
    * actually include some of the nodes actual DOM kids, if there are
@@ -103,60 +78,8 @@ public:
    * returning a non-null list for nodes which have a binding attached.
    */
   nsresult GetAnonymousNodesFor(nsIContent* aContent, nsIDOMNodeList** aResult);
-
-  /**
-   * Same as above, but without the XPCOM goop
-   */
   nsINodeList* GetAnonymousNodesFor(nsIContent* aContent);
 
-  /**
-   * Set the anonymous child content for the specified element.
-   * The binding manager assumes ownership of aList.
-   */
-  nsresult SetAnonymousNodesFor(nsIContent* aContent,
-                                nsInsertionPointList* aList);
-
-  /**
-   * Retrieves the anonymous list of children if the element has one;
-   * otherwise, retrieves the list of explicit children. N.B. that if
-   * the explicit child list has not been altered by XBL insertion
-   * points, then aResult will be null.
-   */
-  nsresult GetXBLChildNodesFor(nsIContent* aContent, nsIDOMNodeList** aResult);
-
-  /**
-   * Non-COMy version of GetXBLChildNodesFor
-   */
-  nsINodeList* GetXBLChildNodesFor(nsIContent* aContent);
-
-  /**
-   * Given a parent element and a child content, determine where the
-   * child content should be inserted in the parent element's
-   * anonymous content tree. Specifically, aChild should be inserted
-   * beneath aResult at the index specified by aIndex.
-   */
-  // XXXbz That's false.  The aIndex doesn't seem to accurately reflect
-  // anything resembling reality in terms of inserting content.  It's really
-  // only used to tell apart two different insertion points with the same
-  // insertion parent when managing our internal data structures.  We really
-  // shouldn't be handing it out in our public API, since it's not useful to
-  // anyone.
-  nsIContent* GetInsertionPoint(nsIContent* aParent,
-                                const nsIContent* aChild, uint32_t* aIndex);
-
-  /**
-   * Return the unfiltered insertion point for the specified parent
-   * element. If other filtered insertion points exist,
-   * aMultipleInsertionPoints will be set to true.
-   */
-  nsIContent* GetSingleInsertionPoint(nsIContent* aParent, uint32_t* aIndex,
-                                      bool* aMultipleInsertionPoints);
-
-  nsIContent* GetNestedInsertionPoint(nsIContent* aParent,
-                                      const nsIContent* aChild);
-  nsIContent* GetNestedSingleInsertionPoint(nsIContent* aParent,
-                                            bool* aMultipleInsertionPoints);
-
   nsresult ClearBinding(nsIContent* aContent);
   nsresult LoadBindingDocument(nsIDocument* aBoundDoc, nsIURI* aURL,
                                nsIPrincipal* aOriginPrincipal);
@@ -205,18 +128,22 @@ public:
   void BeginOutermostUpdate();
   void EndOutermostUpdate();
 
+  // When removing an insertion point or a parent of one, clear the insertion
+  // points and their insertion parents.
+  void ClearInsertionPointsRecursively(nsIContent* aContent);
+
   // Called when the document is going away
   void DropDocumentReference();
 
+  nsIContent* FindNestedInsertionPoint(nsIContent* aContainer,
+                                       nsIContent* aChild);
+
+  nsIContent* FindNestedSingleInsertionPoint(nsIContent* aContainer, bool* aMulti);
+
 protected:
   nsIXPConnectWrappedJS* GetWrappedJS(nsIContent* aContent);
   nsresult SetWrappedJS(nsIContent* aContent, nsIXPConnectWrappedJS* aResult);
 
-  nsINodeList* GetXBLChildNodesInternal(nsIContent* aContent,
-                                        bool* aIsAnonymousContentList);
-  nsINodeList* GetAnonymousNodesInternal(nsIContent* aContent,
-                                         bool* aIsAnonymousContentList);
-
   // Called by ContentAppended and ContentInserted to handle a single child
   // insertion.  aChild must not be null.  aContainer may be null.
   // aIndexInContainer is the index of the child in the parent.  aAppend is
@@ -224,19 +151,6 @@ protected:
   void HandleChildInsertion(nsIContent* aContainer, nsIContent* aChild,
                             uint32_t aIndexInContainer, bool aAppend);
 
-  // For the given container under which a child is being added, given
-  // insertion parent and given index of the child being inserted, find the
-  // right nsXBLInsertionPoint and the right index in that insertion point to
-  // insert it at.  If null is returned, aInsertionIndex might be garbage.
-  // aAppend controls what should be returned as the aInsertionIndex if the
-  // right index can't be found.  If true, the length of the insertion point
-  // will be returned; otherwise 0 will be returned.
-  nsXBLInsertionPoint* FindInsertionPointAndIndex(nsIContent* aContainer,
-                                                  nsIContent* aInsertionParent,
-                                                  uint32_t aIndexInContainer,
-                                                  int32_t aAppend,
-                                                  int32_t* aInsertionIndex);
-
   // Same as ProcessAttachedQueue, but also nulls out
   // mProcessAttachedQueueEvent
   void DoProcessAttachedQueue();
@@ -246,29 +160,10 @@ protected:
 
 // MEMBER VARIABLES
 protected: 
-  void RemoveInsertionParent(nsIContent* aParent);
   // A mapping from nsIContent* to the nsXBLBinding* that is
   // installed on that element.
   nsRefPtrHashtable<nsISupportsHashKey,nsXBLBinding> mBindingTable;
 
-  // A mapping from nsIContent* to an nsAnonymousContentList*.  This
-  // list contains an accurate reflection of our *explicit* children
-  // (once intermingled with insertion points) in the altered DOM.
-  // There is an entry for a content node in this table only if that
-  // content node has some <children> kids.
-  PLDHashTable mContentListTable;
-
-  // A mapping from nsIContent* to an nsAnonymousContentList*.  This
-  // list contains an accurate reflection of our *anonymous* children
-  // (if and only if they are intermingled with insertion points) in
-  // the altered DOM.  This table is not used if no insertion points
-  // were defined directly underneath a <content> tag in a binding.
-  // The NodeList from the <content> is used instead as a performance
-  // optimization.  There is an entry for a content node in this table
-  // only if that content node has a binding with a <content> attached
-  // and this <content> contains <children> elements directly.
-  PLDHashTable mAnonymousNodesTable;
-
   // A mapping from nsIContent* to nsIContent*.  The insertion parent
   // is our one true parent in the transformed DOM.  This gives us a
   // more-or-less O(1) way of obtaining our transformed parent.
diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
index 358c291ae26..6aaa6a96ca6 100644
--- a/content/xbl/src/nsXBLBinding.cpp
+++ b/content/xbl/src/nsXBLBinding.cpp
@@ -1,4 +1,5 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -19,6 +20,7 @@
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsContentUtils.h"
+#include "ChildIterator.h"
 #include "nsCxPusher.h"
 #ifdef MOZ_XUL
 #include "nsIXULDocument.h"
@@ -28,7 +30,6 @@
 #include "mozilla/dom/XMLDocument.h"
 #include "jsapi.h"
 #include "nsXBLService.h"
-#include "nsXBLInsertionPoint.h"
 #include "nsIXPConnect.h"
 #include "nsIScriptContext.h"
 #include "nsCRT.h"
@@ -47,6 +48,7 @@
 #include "nsIPrincipal.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsGUIEvent.h"
+#include "nsXBLChildrenElement.h"
 
 #include "prprf.h"
 #include "nsNodeUtils.h"
@@ -142,8 +144,7 @@ nsXBLJSClass::Destroy()
 nsXBLBinding::nsXBLBinding(nsXBLPrototypeBinding* aBinding)
   : mIsStyleBinding(true),
     mMarkedForDeath(false),
-    mPrototypeBinding(aBinding),
-    mInsertionPointTable(nullptr)
+    mPrototypeBinding(aBinding)
 {
   NS_ASSERTION(mPrototypeBinding, "Must have a prototype binding!");
   // Grab a ref to the document info so the prototype binding won't die
@@ -156,25 +157,10 @@ nsXBLBinding::~nsXBLBinding(void)
   if (mContent) {
     nsXBLBinding::UninstallAnonymousContent(mContent->OwnerDoc(), mContent);
   }
-  delete mInsertionPointTable;
   nsXBLDocumentInfo* info = mPrototypeBinding->XBLDocumentInfo();
   NS_RELEASE(info);
 }
 
-static PLDHashOperator
-TraverseKey(nsISupports* aKey, nsInsertionPointList* aData, void* aClosure)
-{
-  nsCycleCollectionTraversalCallback &cb = 
-    *static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
-
-  NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mInsertionPointTable key");
-  cb.NoteXPCOMChild(aKey);
-  if (aData) {
-    ImplCycleCollectionTraverse(cb, *aData, "mInsertionPointTable value");
-  }
-  return PL_DHASH_NEXT;
-}
-
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXBLBinding)
   // XXX Probably can't unlink mPrototypeBinding->XBLDocumentInfo(), because
   //     mPrototypeBinding is weak.
@@ -184,8 +170,9 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXBLBinding)
   }
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mContent)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mNextBinding)
-  delete tmp->mInsertionPointTable;
-  tmp->mInsertionPointTable = nullptr;
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDefaultInsertionPoint)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mInsertionPoints)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mAnonymousContentList)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXBLBinding)
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb,
@@ -194,8 +181,9 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXBLBinding)
                       tmp->mPrototypeBinding->XBLDocumentInfo()));
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mContent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mNextBinding)
-  if (tmp->mInsertionPointTable)
-    tmp->mInsertionPointTable->EnumerateRead(TraverseKey, &cb);
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDefaultInsertionPoint)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mInsertionPoints)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAnonymousContentList)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXBLBinding, AddRef)
 NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXBLBinding, Release)
@@ -211,6 +199,16 @@ nsXBLBinding::SetBaseBinding(nsXBLBinding* aBinding)
   mNextBinding = aBinding; // Comptr handles rel/add
 }
 
+nsXBLBinding*
+nsXBLBinding::GetBindingWithContent()
+{
+  if (mContent) {
+    return this;
+  }
+
+  return mNextBinding ? mNextBinding->GetBindingWithContent() : nullptr;
+}
+
 void
 nsXBLBinding::InstallAnonymousContent(nsIContent* aAnonParent, nsIContent* aElement,
                                       bool aChromeOnlyContent)
@@ -300,187 +298,6 @@ nsXBLBinding::HasStyleSheets() const
   return mNextBinding ? mNextBinding->HasStyleSheets() : false;
 }
 
-struct EnumData {
-  nsXBLBinding* mBinding;
- 
-  EnumData(nsXBLBinding* aBinding)
-    :mBinding(aBinding)
-  {}
-};
-
-struct ContentListData : public EnumData {
-  nsBindingManager* mBindingManager;
-  nsresult          mRv;
-
-  ContentListData(nsXBLBinding* aBinding, nsBindingManager* aManager)
-    :EnumData(aBinding), mBindingManager(aManager), mRv(NS_OK)
-  {}
-};
-
-static PLDHashOperator
-BuildContentLists(nsISupports* aKey,
-                  nsAutoPtr<nsInsertionPointList>& aData,
-                  void* aClosure)
-{
-  ContentListData* data = (ContentListData*)aClosure;
-  nsBindingManager* bm = data->mBindingManager;
-  nsXBLBinding* binding = data->mBinding;
-
-  nsIContent *boundElement = binding->GetBoundElement();
-
-  int32_t count = aData->Length();
-  
-  if (count == 0)
-    return PL_DHASH_NEXT;
-
-  // Figure out the relevant content node.
-  nsXBLInsertionPoint* currPoint = aData->ElementAt(0);
-  nsCOMPtr<nsIContent> parent = currPoint->GetInsertionParent();
-  if (!parent) {
-    data->mRv = NS_ERROR_FAILURE;
-    return PL_DHASH_STOP;
-  }
-  int32_t currIndex = currPoint->GetInsertionIndex();
-
-  // XXX Could this array just be altered in place and passed directly to
-  // SetContentListFor?  We'd save space if we could pull this off.
-  nsInsertionPointList* contentList = new nsInsertionPointList;
-  if (!contentList) {
-    data->mRv = NS_ERROR_OUT_OF_MEMORY;
-    return PL_DHASH_STOP;
-  }
-
-  nsCOMPtr<nsIDOMNodeList> nodeList;
-  if (parent == boundElement) {
-    // We are altering anonymous nodes to accommodate insertion points.
-    nodeList = binding->GetAnonymousNodes();
-  }
-  else {
-    // We are altering the explicit content list of a node to accommodate insertion points.
-    nsCOMPtr<nsIDOMNode> node(do_QueryInterface(parent));
-    node->GetChildNodes(getter_AddRefs(nodeList));
-  }
-
-  nsXBLInsertionPoint* pseudoPoint = nullptr;
-  uint32_t childCount;
-  nodeList->GetLength(&childCount);
-  int32_t j = 0;
-
-  for (uint32_t i = 0; i < childCount; i++) {
-    nsCOMPtr<nsIDOMNode> node;
-    nodeList->Item(i, getter_AddRefs(node));
-    nsCOMPtr<nsIContent> child(do_QueryInterface(node));
-    if (((int32_t)i) == currIndex) {
-      // Add the currPoint to the insertion point list.
-      contentList->AppendElement(currPoint);
-
-      // Get the next real insertion point and update our currIndex.
-      j++;
-      if (j < count) {
-        currPoint = aData->ElementAt(j);
-        currIndex = currPoint->GetInsertionIndex();
-      }
-
-      // Null out our current pseudo-point.
-      pseudoPoint = nullptr;
-    }
-    
-    if (!pseudoPoint) {
-      pseudoPoint = new nsXBLInsertionPoint(parent, (uint32_t) -1, nullptr);
-      if (pseudoPoint) {
-        contentList->AppendElement(pseudoPoint);
-      }
-    }
-    if (pseudoPoint) {
-      pseudoPoint->AddChild(child);
-    }
-  }
-
-  // Add in all the remaining insertion points.
-  contentList->AppendElements(aData->Elements() + j, count - j);
-  
-  // Now set the content list using the binding manager,
-  // If the bound element is the parent, then we alter the anonymous node list
-  // instead.  This allows us to always maintain two distinct lists should
-  // insertion points be nested into an inner binding.
-  if (parent == boundElement)
-    bm->SetAnonymousNodesFor(parent, contentList);
-  else 
-    bm->SetContentListFor(parent, contentList);
-  return PL_DHASH_NEXT;
-}
-
-static PLDHashOperator
-RealizeDefaultContent(nsISupports* aKey,
-                      nsAutoPtr<nsInsertionPointList>& aData,
-                      void* aClosure)
-{
-  ContentListData* data = (ContentListData*)aClosure;
-  nsBindingManager* bm = data->mBindingManager;
-  nsXBLBinding* binding = data->mBinding;
-
-  int32_t count = aData->Length();
- 
-  for (int32_t i = 0; i < count; i++) {
-    nsXBLInsertionPoint* currPoint = aData->ElementAt(i);
-    int32_t insCount = currPoint->ChildCount();
-    
-    if (insCount == 0) {
-      nsCOMPtr<nsIContent> defContent = currPoint->GetDefaultContentTemplate();
-      if (defContent) {
-        // We need to take this template and use it to realize the
-        // actual default content (through cloning).
-        // Clone this insertion point element.
-        nsCOMPtr<nsIContent> insParent = currPoint->GetInsertionParent();
-        if (!insParent) {
-          data->mRv = NS_ERROR_FAILURE;
-          return PL_DHASH_STOP;
-        }
-        nsIDocument *document = insParent->OwnerDoc();
-        nsCOMPtr<nsINode> clonedNode;
-        nsCOMArray<nsINode> nodesWithProperties;
-        nsNodeUtils::Clone(defContent, true, document->NodeInfoManager(),
-                           nodesWithProperties, getter_AddRefs(clonedNode));
-
-        // Now that we have the cloned content, install the default content as
-        // if it were additional anonymous content.
-        nsCOMPtr<nsIContent> clonedContent(do_QueryInterface(clonedNode));
-        binding->InstallAnonymousContent(clonedContent, insParent,
-                                         binding->PrototypeBinding()->
-                                           ChromeOnlyContent());
-
-        // Cache the clone so that it can be properly destroyed if/when our
-        // other anonymous content is destroyed.
-        currPoint->SetDefaultContent(clonedContent);
-
-        // Now make sure the kids of the clone are added to the insertion point as
-        // children.
-        for (nsIContent* child = clonedContent->GetFirstChild();
-             child;
-             child = child->GetNextSibling()) {
-          bm->SetInsertionParent(child, insParent);
-          currPoint->AddChild(child);
-        }
-      }
-    }
-  }
-
-  return PL_DHASH_NEXT;
-}
-
-static PLDHashOperator
-ChangeDocumentForDefaultContent(nsISupports* aKey,
-                                nsAutoPtr<nsInsertionPointList>& aData,
-                                void* aClosure)
-{
-  int32_t count = aData->Length();
-  for (int32_t i = 0; i < count; i++) {
-    aData->ElementAt(i)->UnbindDefaultContent();
-  }
-
-  return PL_DHASH_NEXT;
-}
-
 void
 nsXBLBinding::GenerateAnonymousContent()
 {
@@ -505,169 +322,60 @@ nsXBLBinding::GenerateAnonymousContent()
 
   // Plan to build the content by default.
   bool hasContent = (contentCount > 0);
-  bool hasInsertionPoints = mPrototypeBinding->HasInsertionPoints();
-
-#ifdef DEBUG
-  // See if there's an includes attribute.
-  if (nsContentUtils::HasNonEmptyAttr(content, kNameSpaceID_None,
-                                      nsGkAtoms::includes)) {
-    nsAutoCString message("An XBL Binding with URI ");
-    nsAutoCString uri;
-    mPrototypeBinding->BindingURI()->GetSpec(uri);
-    message += uri;
-    message += " is still using the deprecated\n<content includes=\"\"> syntax! Use <children> instead!\n"; 
-    NS_WARNING(message.get());
-  }
-#endif
-
-  if (hasContent || hasInsertionPoints) {
+  if (hasContent) {
     nsIDocument* doc = mBoundElement->OwnerDoc();
     
     nsBindingManager *bindingManager = doc->BindingManager();
 
-    nsCOMPtr<nsIDOMNodeList> children;
-    bindingManager->GetContentListFor(mBoundElement, getter_AddRefs(children));
- 
-    nsCOMPtr<nsIDOMNode> node;
-    nsCOMPtr<nsIContent> childContent;
-    uint32_t length;
-    children->GetLength(&length);
-    if (length > 0 && !hasInsertionPoints) {
-      // There are children being placed underneath us, but we have no specified
-      // insertion points, and therefore no place to put the kids.  Don't generate
-      // anonymous content.
-      // Special case template and observes.
-      for (uint32_t i = 0; i < length; i++) {
-        children->Item(i, getter_AddRefs(node));
-        childContent = do_QueryInterface(node);
+    nsCOMPtr<nsINode> clonedNode;
+    nsCOMArray<nsINode> nodesWithProperties;
+    nsNodeUtils::Clone(content, true, doc->NodeInfoManager(),
+                       nodesWithProperties, getter_AddRefs(clonedNode));
+    mContent = clonedNode->AsElement();
 
-        nsINodeInfo *ni = childContent->NodeInfo();
-        nsIAtom *localName = ni->NameAtom();
-        if (ni->NamespaceID() != kNameSpaceID_XUL ||
-            (localName != nsGkAtoms::observes &&
-             localName != nsGkAtoms::_template)) {
-          hasContent = false;
-          break;
+    // Search for <xbl:children> elements in the XBL content. In the presence
+    // of multiple default insertion points, we use the last one in document
+    // order.
+    for (nsIContent* child = mContent; child; child = child->GetNextNode(mContent)) {
+      if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+        nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(child);
+        if (point->IsDefaultInsertion()) {
+          mDefaultInsertionPoint = point;
+        } else {
+          mInsertionPoints.AppendElement(point);
         }
       }
     }
 
-    if (hasContent || hasInsertionPoints) {
-      nsCOMPtr<nsINode> clonedNode;
-      nsCOMArray<nsINode> nodesWithProperties;
-      nsNodeUtils::Clone(content, true, doc->NodeInfoManager(),
-                         nodesWithProperties, getter_AddRefs(clonedNode));
+    // Do this after looking for <children> as this messes up the parent
+    // pointer which would make the GetNextNode call above fail
+    InstallAnonymousContent(mContent, mBoundElement,
+                            mPrototypeBinding->ChromeOnlyContent());
 
-      mContent = do_QueryInterface(clonedNode);
-      InstallAnonymousContent(mContent, mBoundElement,
-                              mPrototypeBinding->ChromeOnlyContent());
-
-      if (hasInsertionPoints) {
-        // Now check and see if we have a single insertion point 
-        // or multiple insertion points.
-      
-        // Enumerate the prototype binding's insertion table to build
-        // our table of instantiated insertion points.
-        mPrototypeBinding->InstantiateInsertionPoints(this);
-
-        // We now have our insertion point table constructed.  We
-        // enumerate this table.  For each array of insertion points
-        // bundled under the same content node, we generate a content
-        // list.  In the case of the bound element, we generate a new
-        // anonymous node list that will be used in place of the binding's
-        // cached anonymous node list.
-        ContentListData data(this, bindingManager);
-        mInsertionPointTable->Enumerate(BuildContentLists, &data);
-        if (NS_FAILED(data.mRv)) {
-          return;
-        }
-
-        // We need to place the children
-        // at their respective insertion points.
-        uint32_t index = 0;
-        bool multiplePoints = false;
-        nsIContent *singlePoint = GetSingleInsertionPoint(&index,
-                                                          &multiplePoints);
-      
-        if (children) {
-          if (multiplePoints) {
-            // We must walk the entire content list in order to determine where
-            // each child belongs.
-            children->GetLength(&length);
-            for (uint32_t i = 0; i < length; i++) {
-              children->Item(i, getter_AddRefs(node));
-              childContent = do_QueryInterface(node);
-
-              // Now determine the insertion point in the prototype table.
-              uint32_t index;
-              nsIContent *point = GetInsertionPoint(childContent, &index);
-              bindingManager->SetInsertionParent(childContent, point);
-
-              // Find the correct nsIXBLInsertion point in our table.
-              nsInsertionPointList* arr = nullptr;
-              GetInsertionPointsFor(point, &arr);
-              nsXBLInsertionPoint* insertionPoint = nullptr;
-              int32_t arrCount = arr->Length();
-              for (int32_t j = 0; j < arrCount; j++) {
-                insertionPoint = arr->ElementAt(j);
-                if (insertionPoint->Matches(point, index))
-                  break;
-                insertionPoint = nullptr;
-              }
-
-              if (insertionPoint) 
-                insertionPoint->AddChild(childContent);
-              else {
-                // We were unable to place this child.  All anonymous content
-                // should be thrown out.  Special-case template and observes.
-
-                nsINodeInfo *ni = childContent->NodeInfo();
-                nsIAtom *localName = ni->NameAtom();
-                if (ni->NamespaceID() != kNameSpaceID_XUL ||
-                    (localName != nsGkAtoms::observes &&
-                     localName != nsGkAtoms::_template)) {
-                  // Undo InstallAnonymousContent
-                  UninstallAnonymousContent(doc, mContent);
-
-                  // Kill all anonymous content.
-                  mContent = nullptr;
-                  bindingManager->SetContentListFor(mBoundElement, nullptr);
-                  bindingManager->SetAnonymousNodesFor(mBoundElement, nullptr);
-                  return;
-                }
-              }
-            }
-          }
-          else {
-            // All of our children are shunted to this single insertion point.
-            nsInsertionPointList* arr = nullptr;
-            GetInsertionPointsFor(singlePoint, &arr);
-            nsXBLInsertionPoint* insertionPoint = arr->ElementAt(0);
-        
-            nsCOMPtr<nsIDOMNode> node;
-            nsCOMPtr<nsIContent> content;
-            uint32_t length;
-            children->GetLength(&length);
-          
-            for (uint32_t i = 0; i < length; i++) {
-              children->Item(i, getter_AddRefs(node));
-              content = do_QueryInterface(node);
-              bindingManager->SetInsertionParent(content, singlePoint);
-              insertionPoint->AddChild(content);
-            }
-          }
-        }
-
-        // Now that all of our children have been added, we need to walk all of our
-        // nsIXBLInsertion points to see if any of them have default content that
-        // needs to be built.
-        mInsertionPointTable->Enumerate(RealizeDefaultContent, &data);
-        if (NS_FAILED(data.mRv)) {
-          return;
+    // Insert explicit children into insertion points
+    if (mDefaultInsertionPoint && mInsertionPoints.IsEmpty()) {
+      ExplicitChildIterator iter(mBoundElement);
+      for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+        mDefaultInsertionPoint->AppendInsertedChild(child, bindingManager);
+      }
+    } else if (!mInsertionPoints.IsEmpty()) {
+      ExplicitChildIterator iter(mBoundElement);
+      for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+        nsXBLChildrenElement* point = FindInsertionPointForInternal(child);
+        if (point) {
+          point->AppendInsertedChild(child, bindingManager);
         }
       }
     }
 
+    // Set binding parent on default content if need
+    if (mDefaultInsertionPoint) {
+      mDefaultInsertionPoint->MaybeSetupDefaultContent(bindingManager);
+    }
+    for (uint32_t i = 0; i < mInsertionPoints.Length(); ++i) {
+      mInsertionPoints[i]->MaybeSetupDefaultContent(bindingManager);
+    }
+
     mPrototypeBinding->SetInitialAttributes(mBoundElement, mContent);
   }
 
@@ -696,6 +404,58 @@ nsXBLBinding::GenerateAnonymousContent()
   }
 }
 
+nsXBLChildrenElement*
+nsXBLBinding::FindInsertionPointFor(nsIContent* aChild)
+{
+  // XXX We should get rid of this function as it causes us to traverse the
+  // binding chain multiple times
+  if (mContent) {
+    return FindInsertionPointForInternal(aChild);
+  }
+  
+  return mNextBinding ? mNextBinding->FindInsertionPointFor(aChild)
+                      : nullptr;
+}
+
+nsXBLChildrenElement*
+nsXBLBinding::FindInsertionPointForInternal(nsIContent* aChild)
+{
+  for (uint32_t i = 0; i < mInsertionPoints.Length(); ++i) {
+    nsXBLChildrenElement* point = mInsertionPoints[i];
+    if (point->Includes(aChild)) {
+      return point;
+    }
+  }
+  
+  return mDefaultInsertionPoint;
+}
+
+void
+nsXBLBinding::ClearInsertionPoints()
+{
+  if (mDefaultInsertionPoint) {
+    mDefaultInsertionPoint->ClearInsertedChildren();
+  }
+
+  for (uint32_t i = 0; i < mInsertionPoints.Length(); ++i) {
+    mInsertionPoints[i]->ClearInsertedChildren();
+  }
+}
+
+nsAnonymousContentList*
+nsXBLBinding::GetAnonymousNodeList()
+{
+  if (!mContent) {
+    return mNextBinding ? mNextBinding->GetAnonymousNodeList() : nullptr;
+  }
+
+  if (!mAnonymousContentList) {
+    mAnonymousContentList = new nsAnonymousContentList(mContent);
+  }
+
+  return mAnonymousContentList;
+}
+
 void
 nsXBLBinding::InstallEventHandlers()
 {
@@ -919,6 +679,35 @@ nsXBLBinding::UnhookEventHandlers()
   }
 }
 
+static void
+UpdateInsertionParent(nsBindingManager* aBindingManager,
+                      nsXBLChildrenElement* aPoint,
+                      nsIContent* aOldBoundElement)
+{
+  if (aPoint->IsDefaultInsertion()) {
+    return;
+  }
+
+  for (size_t i = 0; i < aPoint->InsertedChildrenLength(); ++i) {
+    nsIContent* child = aPoint->mInsertedChildren[i];
+
+    MOZ_ASSERT(child->GetParentNode());
+
+    // Here, we're iterating children that we inserted. There are two cases:
+    // either |child| is an explicit child of |aOldBoundElement| and is no
+    // longer inserted anywhere or it's a child of a <children> element
+    // parented to |aOldBoundElement|. In the former case, the child is no
+    // longer inserted anywhere, so we set its insertion parent to null. In the
+    // latter case, the child is now inserted into |aOldBoundElement| from some
+    // binding above us, so we set its insertion parent to aOldBoundElement.
+    if (child->GetParentNode() == aOldBoundElement) {
+      aBindingManager->SetInsertionParent(child, nullptr);
+    } else {
+      aBindingManager->SetInsertionParent(child, aOldBoundElement);
+    }
+  }
+}
+
 void
 nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocument)
 {
@@ -1025,24 +814,28 @@ nsXBLBinding::ChangeDocument(nsIDocument* aOldDocument, nsIDocument* aNewDocumen
 
     // Update the anonymous content.
     // XXXbz why not only for style bindings?
-    nsIContent *anonymous = mContent;
-    if (anonymous) {
-      // Also kill the default content within all our insertion points.
-      if (mInsertionPointTable)
-        mInsertionPointTable->Enumerate(ChangeDocumentForDefaultContent,
-                                        nullptr);
-
-      nsXBLBinding::UninstallAnonymousContent(aOldDocument, anonymous);
+    if (mContent) {
+      nsXBLBinding::UninstallAnonymousContent(aOldDocument, mContent);
     }
 
-    // Make sure that henceforth we don't claim that mBoundElement's children
-    // have insertion parents in the old document.
     nsBindingManager* bindingManager = aOldDocument->BindingManager();
-    for (nsIContent* child = mBoundElement->GetLastChild();
-         child;
-         child = child->GetPreviousSibling()) {
-      bindingManager->SetInsertionParent(child, nullptr);
+
+    // Now that we've unbound our anonymous content from the tree and updated
+    // its binding parent, update the insertion parent for content inserted
+    // into our <children> elements.
+    if (mDefaultInsertionPoint) {
+      UpdateInsertionParent(bindingManager, mDefaultInsertionPoint,
+                            mBoundElement);
     }
+
+    for (size_t i = 0; i < mInsertionPoints.Length(); ++i) {
+      UpdateInsertionParent(bindingManager, mInsertionPoints[i],
+                            mBoundElement);
+    }
+
+    // Now that our inserted children no longer think they're inserted
+    // anywhere, make sure our internal state reflects that as well.
+    ClearInsertionPoints();
   }
 }
 
@@ -1274,109 +1067,6 @@ nsXBLBinding::AllowScripts()
   return NS_SUCCEEDED(rv) && canExecute;
 }
 
-void
-nsXBLBinding::RemoveInsertionParent(nsIContent* aParent)
-{
-  if (mNextBinding) {
-    mNextBinding->RemoveInsertionParent(aParent);
-  }
-  if (mInsertionPointTable) {
-    nsInsertionPointList* list = nullptr;
-    mInsertionPointTable->Get(aParent, &list);
-    if (list) {
-      int32_t count = list->Length();
-      for (int32_t i = 0; i < count; ++i) {
-        nsRefPtr<nsXBLInsertionPoint> currPoint = list->ElementAt(i);
-        currPoint->UnbindDefaultContent();
-#ifdef DEBUG
-        nsCOMPtr<nsIContent> parent = currPoint->GetInsertionParent();
-        NS_ASSERTION(!parent || parent == aParent, "Wrong insertion parent!");
-#endif
-        currPoint->ClearInsertionParent();
-      }
-      mInsertionPointTable->Remove(aParent);
-    }
-  }
-}
-
-bool
-nsXBLBinding::HasInsertionParent(nsIContent* aParent)
-{
-  if (mInsertionPointTable) {
-    nsInsertionPointList* list = nullptr;
-    mInsertionPointTable->Get(aParent, &list);
-    if (list) {
-      return true;
-    }
-  }
-  return mNextBinding ? mNextBinding->HasInsertionParent(aParent) : false;
-}
-
-void
-nsXBLBinding::GetInsertionPointsFor(nsIContent* aParent,
-                                    nsInsertionPointList** aResult)
-{
-  if (!mInsertionPointTable) {
-    mInsertionPointTable =
-      new nsClassHashtable<nsISupportsHashKey, nsInsertionPointList>;
-    mInsertionPointTable->Init(4);
-  }
-
-  mInsertionPointTable->Get(aParent, aResult);
-
-  if (!*aResult) {
-    *aResult = new nsInsertionPointList;
-    mInsertionPointTable->Put(aParent, *aResult);
-    if (aParent) {
-      aParent->SetFlags(NODE_IS_INSERTION_PARENT);
-    }
-  }
-}
-
-nsInsertionPointList*
-nsXBLBinding::GetExistingInsertionPointsFor(nsIContent* aParent)
-{
-  if (!mInsertionPointTable) {
-    return nullptr;
-  }
-
-  nsInsertionPointList* result = nullptr;
-  mInsertionPointTable->Get(aParent, &result);
-  return result;
-}
-
-nsIContent*
-nsXBLBinding::GetInsertionPoint(const nsIContent* aChild, uint32_t* aIndex)
-{
-  if (mContent) {
-    return mPrototypeBinding->GetInsertionPoint(mBoundElement, mContent,
-                                                aChild, aIndex);
-  }
-
-  if (mNextBinding)
-    return mNextBinding->GetInsertionPoint(aChild, aIndex);
-
-  return nullptr;
-}
-
-nsIContent*
-nsXBLBinding::GetSingleInsertionPoint(uint32_t* aIndex,
-                                      bool* aMultipleInsertionPoints)
-{
-  *aMultipleInsertionPoints = false;
-  if (mContent) {
-    return mPrototypeBinding->GetSingleInsertionPoint(mBoundElement, mContent, 
-                                                      aIndex, 
-                                                      aMultipleInsertionPoints);
-  }
-
-  if (mNextBinding)
-    return mNextBinding->GetSingleInsertionPoint(aIndex,
-                                                 aMultipleInsertionPoints);
-
-  return nullptr;
-}
-
 nsXBLBinding*
 nsXBLBinding::RootBinding()
 {
@@ -1512,16 +1202,3 @@ nsXBLBinding::ImplementsInterface(REFNSIID aIID) const
   return mPrototypeBinding->ImplementsInterface(aIID) ||
     (mNextBinding && mNextBinding->ImplementsInterface(aIID));
 }
-
-nsINodeList*
-nsXBLBinding::GetAnonymousNodes()
-{
-  if (mContent) {
-    return mContent->ChildNodes();
-  }
-
-  if (mNextBinding)
-    return mNextBinding->GetAnonymousNodes();
-
-  return nullptr;
-}
diff --git a/content/xbl/src/nsXBLBinding.h b/content/xbl/src/nsXBLBinding.h
index 6511b8cf0d8..a71dbd2b4aa 100644
--- a/content/xbl/src/nsXBLBinding.h
+++ b/content/xbl/src/nsXBLBinding.h
@@ -22,9 +22,8 @@ class nsIContent;
 class nsIAtom;
 class nsIDocument;
 class nsIScriptContext;
-class nsObjectHashtable;
-class nsXBLInsertionPoint;
-typedef nsTArray<nsRefPtr<nsXBLInsertionPoint> > nsInsertionPointList;
+class nsXBLChildrenElement;
+class nsAnonymousContentList;
 struct JSContext;
 class JSObject;
 
@@ -53,6 +52,7 @@ public:
 
   nsXBLPrototypeBinding* PrototypeBinding() { return mPrototypeBinding; }
   nsIContent* GetAnonymousContent() { return mContent.get(); }
+  nsXBLBinding* GetBindingWithContent();
 
   nsXBLBinding* GetBaseBinding() { return mNextBinding; }
   void SetBaseBinding(nsXBLBinding *aBinding);
@@ -120,20 +120,6 @@ public:
   // object |obj|.  False return means a JS exception was set.
   bool ResolveAllFields(JSContext *cx, JS::Handle<JSObject*> obj) const;
 
-  // Get the list of insertion points for aParent. The nsInsertionPointList
-  // is owned by the binding, you should not delete it.
-  void GetInsertionPointsFor(nsIContent* aParent,
-                             nsInsertionPointList** aResult);
-
-  nsInsertionPointList* GetExistingInsertionPointsFor(nsIContent* aParent);
-
-  // XXXbz this aIndex has nothing to do with an index into the child
-  // list of the insertion parent or anything.
-  nsIContent* GetInsertionPoint(const nsIContent* aChild, uint32_t* aIndex);
-
-  nsIContent* GetSingleInsertionPoint(uint32_t* aIndex,
-                                      bool* aMultipleInsertionPoints);
-
   void AttributeChanged(nsIAtom* aAttribute, int32_t aNameSpaceID,
                         bool aRemoveFlag, bool aNotify);
 
@@ -141,8 +127,6 @@ public:
 
   void WalkRules(nsIStyleRuleProcessor::EnumFunc aFunc, void* aData);
 
-  nsINodeList* GetAnonymousNodes();
-
   static nsresult DoInitJSClass(JSContext *cx, JS::Handle<JSObject*> global,
                                 JS::Handle<JSObject*> obj,
                                 const nsAFlatCString& aClassName,
@@ -152,8 +136,24 @@ public:
 
   bool AllowScripts();  // XXX make const
 
-  void RemoveInsertionParent(nsIContent* aParent);
-  bool HasInsertionParent(nsIContent* aParent);
+  nsXBLChildrenElement* FindInsertionPointFor(nsIContent* aChild);
+
+  bool HasFilteredInsertionPoints()
+  {
+    return !mInsertionPoints.IsEmpty();
+  }
+
+  nsXBLChildrenElement* GetDefaultInsertionPoint()
+  {
+    return mDefaultInsertionPoint;
+  }
+
+  // Removes all inserted node from <xbl:children> insertion points under us.
+  void ClearInsertionPoints();
+
+  // Returns a live node list that iterates over the anonymous nodes generated
+  // by this binding.
+  nsAnonymousContentList* GetAnonymousNodeList();
 
 // MEMBER VARIABLES
 protected:
@@ -167,11 +167,20 @@ protected:
   nsRefPtr<nsXBLJSClass> mJSClass; // Strong. The class object also holds a strong reference,
                                    // which might be somewhat redundant, but be safe to avoid
                                    // worrying about edge cases.
-  
+
   nsIContent* mBoundElement; // [WEAK] We have a reference, but we don't own it.
-  
-  // A hash from nsIContent* -> (a sorted array of nsXBLInsertionPoint)
-  nsClassHashtable<nsISupportsHashKey, nsInsertionPointList>* mInsertionPointTable;
+
+  // The <xbl:children> elements that we found in our <xbl:content> when we
+  // processed this binding. The default insertion point has no includes
+  // attribute and all other insertion points must have at least one includes
+  // attribute. These points must be up-to-date with respect to their parent's
+  // children, even if their parent has another binding attached to it,
+  // preventing us from rendering their contents directly.
+  nsRefPtr<nsXBLChildrenElement> mDefaultInsertionPoint;
+  nsTArray<nsRefPtr<nsXBLChildrenElement> > mInsertionPoints;
+  nsRefPtr<nsAnonymousContentList> mAnonymousContentList;
+
+  nsXBLChildrenElement* FindInsertionPointForInternal(nsIContent* aChild);
 };
 
 #endif // nsXBLBinding_h_
diff --git a/content/xbl/src/nsXBLChildrenElement.cpp b/content/xbl/src/nsXBLChildrenElement.cpp
new file mode 100644
index 00000000000..646ba87cec4
--- /dev/null
+++ b/content/xbl/src/nsXBLChildrenElement.cpp
@@ -0,0 +1,210 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsXBLChildrenElement.h"
+#include "nsCharSeparatedTokenizer.h"
+#include "mozilla/dom/NodeListBinding.h"
+
+nsXBLChildrenElement::~nsXBLChildrenElement()
+{
+}
+
+NS_IMPL_ADDREF_INHERITED(nsXBLChildrenElement, Element)
+NS_IMPL_RELEASE_INHERITED(nsXBLChildrenElement, Element)
+
+NS_INTERFACE_TABLE_HEAD(nsXBLChildrenElement)
+  NS_INTERFACE_TABLE_INHERITED2(nsXBLChildrenElement, nsIDOMNode,
+                                                      nsIDOMElement)
+  NS_ELEMENT_INTERFACE_TABLE_TO_MAP_SEGUE
+NS_INTERFACE_MAP_END_INHERITING(Element)
+
+NS_IMPL_ELEMENT_CLONE(nsXBLChildrenElement)
+
+nsIAtom*
+nsXBLChildrenElement::GetIDAttributeName() const
+{
+  return nullptr;
+}
+
+nsIAtom*
+nsXBLChildrenElement::DoGetID() const
+{
+  return nullptr;
+}
+
+nsresult
+nsXBLChildrenElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                                bool aNotify)
+{
+  if (aAttribute == nsGkAtoms::includes &&
+      aNameSpaceID == kNameSpaceID_None) {
+    mIncludes.Clear();
+  }
+
+  return Element::UnsetAttr(aNameSpaceID, aAttribute, aNotify);
+}
+
+bool
+nsXBLChildrenElement::ParseAttribute(int32_t aNamespaceID,
+                                     nsIAtom* aAttribute,
+                                     const nsAString& aValue,
+                                     nsAttrValue& aResult)
+{
+  if (aAttribute == nsGkAtoms::includes &&
+      aNamespaceID == kNameSpaceID_None) {
+    mIncludes.Clear();
+    nsCharSeparatedTokenizer tok(aValue, '|',
+                                 nsCharSeparatedTokenizer::SEPARATOR_OPTIONAL);
+    while (tok.hasMoreTokens()) {
+      mIncludes.AppendElement(do_GetAtom(tok.nextToken()));
+    }
+  }
+
+  return false;
+}
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_1(nsAnonymousContentList, mParent)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsAnonymousContentList)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsAnonymousContentList)
+
+NS_INTERFACE_TABLE_HEAD(nsAnonymousContentList)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_TABLE_INHERITED3(nsAnonymousContentList, nsINodeList,
+                                                        nsIDOMNodeList,
+                                                        nsAnonymousContentList)
+  NS_INTERFACE_TABLE_TO_MAP_SEGUE
+  NS_INTERFACE_MAP_ENTRIES_CYCLE_COLLECTION(nsAnonymousContentList)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+NS_IMETHODIMP
+nsAnonymousContentList::GetLength(uint32_t* aLength)
+{
+  if (!mParent) {
+    *aLength = 0;
+    return NS_OK;
+  }
+
+  uint32_t count = 0;
+  for (nsIContent* child = mParent->GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+      nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(child);
+      if (!point->mInsertedChildren.IsEmpty()) {
+        count += point->mInsertedChildren.Length();
+      }
+      else {
+        count += point->GetChildCount();
+      }
+    }
+    else {
+      ++count;
+    }
+  }
+
+  *aLength = count;
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAnonymousContentList::Item(uint32_t aIndex, nsIDOMNode** aReturn)
+{
+  nsIContent* item = Item(aIndex);
+  if (!item) {
+    return NS_ERROR_FAILURE;
+  }
+
+  return CallQueryInterface(item, aReturn);
+}
+
+nsIContent*
+nsAnonymousContentList::Item(uint32_t aIndex)
+{
+  if (!mParent) {
+    return nullptr;
+  }
+
+  uint32_t remIndex = aIndex;
+  for (nsIContent* child = mParent->GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+      nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(child);
+      if (!point->mInsertedChildren.IsEmpty()) {
+        if (remIndex < point->mInsertedChildren.Length()) {
+          return point->mInsertedChildren[remIndex];
+        }
+        remIndex -= point->mInsertedChildren.Length();
+      }
+      else {
+        if (remIndex < point->GetChildCount()) {
+          return point->GetChildAt(remIndex);
+        }
+        remIndex -= point->GetChildCount();
+      }
+    }
+    else {
+      if (remIndex == 0) {
+        return child;
+      }
+      --remIndex;
+    }
+  }
+
+  return nullptr;
+}
+
+int32_t
+nsAnonymousContentList::IndexOf(nsIContent* aContent)
+{
+  NS_ASSERTION(!aContent->NodeInfo()->Equals(nsGkAtoms::children,
+                                             kNameSpaceID_XBL),
+               "Looking for insertion point");
+
+  if (!mParent) {
+    return -1;
+  }
+
+  uint32_t index = 0;
+  for (nsIContent* child = mParent->GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    if (child->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+      nsXBLChildrenElement* point = static_cast<nsXBLChildrenElement*>(child);
+      if (!point->mInsertedChildren.IsEmpty()) {
+        uint32_t insIndex = point->mInsertedChildren.IndexOf(aContent);
+        if (insIndex != point->mInsertedChildren.NoIndex) {
+          return index + insIndex;
+        }
+        index += point->mInsertedChildren.Length();
+      }
+      else {
+        int32_t insIndex = point->IndexOf(aContent);
+        if (insIndex != -1) {
+          return index + (uint32_t)insIndex;
+        }
+        index += point->GetChildCount();
+      }
+    }
+    else {
+      if (child == aContent) {
+        return index;
+      }
+      ++index;
+    }
+  }
+
+  return -1;
+}
+
+JSObject*
+nsAnonymousContentList::WrapObject(JSContext *cx, JS::Handle<JSObject*> scope)
+{
+  return mozilla::dom::NodeListBinding::Wrap(cx, scope, this);
+}
diff --git a/content/xbl/src/nsXBLChildrenElement.h b/content/xbl/src/nsXBLChildrenElement.h
new file mode 100644
index 00000000000..7bfad5c5837
--- /dev/null
+++ b/content/xbl/src/nsXBLChildrenElement.h
@@ -0,0 +1,186 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 sw=2 et tw=79: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsXBLChildrenElement_h___
+#define nsXBLChildrenElement_h___
+
+#include "nsIDOMElement.h"
+#include "nsINodeList.h"
+#include "nsBindingManager.h"
+#include "mozilla/dom/nsXMLElement.h"
+
+namespace mozilla {
+namespace dom {
+
+class ExplicitChildIterator;
+
+}
+}
+
+class nsAnonymousContentList;
+
+class nsXBLChildrenElement : public nsXMLElement
+{
+public:
+  friend class mozilla::dom::ExplicitChildIterator;
+  friend class nsAnonymousContentList;
+  nsXBLChildrenElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : nsXMLElement(aNodeInfo)
+  {
+  }
+  ~nsXBLChildrenElement();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsINode interface methods
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
+
+  virtual nsXPCClassInfo* GetClassInfo() { return nullptr; }
+
+  virtual nsIDOMNode* AsDOMNode() { return this; }
+
+  // nsIContent interface methods
+  virtual nsIAtom *GetIDAttributeName() const;
+  virtual nsIAtom* DoGetID() const;
+  virtual nsresult UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
+                             bool aNotify);
+  virtual bool ParseAttribute(int32_t aNamespaceID,
+                              nsIAtom* aAttribute,
+                              const nsAString& aValue,
+                              nsAttrValue& aResult);
+
+  void AppendInsertedChild(nsIContent* aChild,
+                           nsBindingManager* aBindingManager)
+  {
+    mInsertedChildren.AppendElement(aChild);
+    aBindingManager->SetInsertionParent(aChild, GetParent());
+  }
+
+  void InsertInsertedChildAt(nsIContent* aChild,
+                             uint32_t aIndex,
+                             nsBindingManager* aBindingManager)
+  {
+    mInsertedChildren.InsertElementAt(aIndex, aChild);
+    aBindingManager->SetInsertionParent(aChild, GetParent());
+  }
+
+  void RemoveInsertedChild(nsIContent* aChild)
+  {
+    // Can't use this assertion as we cheat for dynamic insertions and
+    // only insert in the innermost insertion point.
+    //NS_ASSERTION(mInsertedChildren.Contains(aChild),
+    //             "Removing child that's not there");
+    mInsertedChildren.RemoveElement(aChild);
+  }
+
+  void ClearInsertedChildren()
+  {
+    mInsertedChildren.Clear();
+  }
+
+  void ClearInsertedChildrenAndInsertionParents(nsBindingManager* aBindingManager)
+  {
+    for (uint32_t c = 0; c < mInsertedChildren.Length(); ++c) {
+      aBindingManager->SetInsertionParent(mInsertedChildren[c], nullptr);
+    }
+    mInsertedChildren.Clear();
+  }
+
+  void MaybeSetupDefaultContent(nsBindingManager* aBindingManager)
+  {
+    if (!HasInsertedChildren()) {
+      for (nsIContent* child = static_cast<nsINode*>(this)->GetFirstChild();
+           child;
+           child = child->GetNextSibling()) {
+        aBindingManager->SetInsertionParent(child, GetParent());
+      }
+    }
+  }
+
+  void MaybeRemoveDefaultContent(nsBindingManager* aBindingManager)
+  {
+    if (!HasInsertedChildren()) {
+      for (nsIContent* child = static_cast<nsINode*>(this)->GetFirstChild();
+           child;
+           child = child->GetNextSibling()) {
+        aBindingManager->SetInsertionParent(child, nullptr);
+      }
+    }
+  }
+
+  uint32_t InsertedChildrenLength()
+  {
+    return mInsertedChildren.Length();
+  }
+
+  bool HasInsertedChildren()
+  {
+    return !mInsertedChildren.IsEmpty();
+  }
+
+  enum {
+    NoIndex = uint32_t(-1)
+  };
+  uint32_t IndexOfInsertedChild(nsIContent* aChild)
+  {
+    return mInsertedChildren.IndexOf(aChild);
+  }
+
+  bool Includes(nsIContent* aChild)
+  {
+    NS_ASSERTION(!mIncludes.IsEmpty(),
+                 "Shouldn't check for includes on default insertion point");
+    return mIncludes.Contains(aChild->Tag());
+  }
+
+  bool IsDefaultInsertion()
+  {
+    return mIncludes.IsEmpty();
+  }
+
+  nsTArray<nsIContent*> mInsertedChildren;
+
+private:
+  nsTArray<nsCOMPtr<nsIAtom> > mIncludes;
+};
+
+class nsAnonymousContentList : public nsINodeList
+{
+public:
+  nsAnonymousContentList(nsIContent* aParent)
+    : mParent(aParent)
+  {
+    MOZ_COUNT_CTOR(nsAnonymousContentList);
+    SetIsDOMBinding();
+  }
+
+  virtual ~nsAnonymousContentList()
+  {
+    MOZ_COUNT_DTOR(nsAnonymousContentList);
+  }
+
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsAnonymousContentList)
+  // nsIDOMNodeList interface
+  NS_DECL_NSIDOMNODELIST
+
+  // nsINodeList interface
+  virtual int32_t IndexOf(nsIContent* aContent);
+  virtual nsINode* GetParentObject() { return mParent; }
+  virtual nsIContent* Item(uint32_t aIndex);
+
+  virtual JSObject* WrapObject(JSContext *cx, JS::Handle<JSObject*> scope) MOZ_OVERRIDE;
+
+  bool IsListFor(nsIContent* aContent) {
+    return mParent == aContent;
+  }
+
+private:
+  nsCOMPtr<nsIContent> mParent;
+};
+
+#endif // nsXBLChildrenElement_h___
diff --git a/content/xbl/src/nsXBLInsertionPoint.cpp b/content/xbl/src/nsXBLInsertionPoint.cpp
deleted file mode 100644
index 43743b3e6a0..00000000000
--- a/content/xbl/src/nsXBLInsertionPoint.cpp
+++ /dev/null
@@ -1,83 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsXBLInsertionPoint.h"
-#include "nsXBLBinding.h"
-
-nsXBLInsertionPoint::nsXBLInsertionPoint(nsIContent* aParentElement,
-                                         uint32_t aIndex,
-                                         nsIContent* aDefaultContent)
-  : mParentElement(aParentElement),
-    mIndex(aIndex),
-    mDefaultContentTemplate(aDefaultContent)
-{
-}
-
-nsXBLInsertionPoint::~nsXBLInsertionPoint()
-{
-  if (mDefaultContent) {
-    nsXBLBinding::UninstallAnonymousContent(mDefaultContent->OwnerDoc(),
-                                            mDefaultContent);
-  }
-}
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXBLInsertionPoint)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mElements)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDefaultContentTemplate)
-  if (tmp->mDefaultContent) {
-    nsXBLBinding::UninstallAnonymousContent(tmp->mDefaultContent->OwnerDoc(),
-                                            tmp->mDefaultContent);
-  }
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDefaultContent)
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXBLInsertionPoint)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mElements)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDefaultContentTemplate)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDefaultContent)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXBLInsertionPoint, AddRef)
-NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXBLInsertionPoint, Release)
-
-nsIContent*
-nsXBLInsertionPoint::GetInsertionParent()
-{
-  return mParentElement;
-}
-
-nsIContent*
-nsXBLInsertionPoint::GetDefaultContent()
-{
-  return mDefaultContent;
-}
-
-nsIContent*
-nsXBLInsertionPoint::GetDefaultContentTemplate()
-{
-  return mDefaultContentTemplate;
-}
-
-nsIContent*
-nsXBLInsertionPoint::ChildAt(uint32_t aIndex)
-{
-  return mElements.ObjectAt(aIndex);
-}
-
-bool
-nsXBLInsertionPoint::Matches(nsIContent* aContent, uint32_t aIndex)
-{
-  return (aContent == mParentElement && mIndex != -1 && ((int32_t)aIndex) == mIndex);
-}
-
-void
-nsXBLInsertionPoint::UnbindDefaultContent()
-{
-  if (!mDefaultContent) {
-    return;
-  }
-
-  // Undo InstallAnonymousContent.
-  nsXBLBinding::UninstallAnonymousContent(mDefaultContent->OwnerDoc(),
-                                          mDefaultContent);
-}
diff --git a/content/xbl/src/nsXBLInsertionPoint.h b/content/xbl/src/nsXBLInsertionPoint.h
deleted file mode 100644
index 291d2871d79..00000000000
--- a/content/xbl/src/nsXBLInsertionPoint.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef nsXBLInsertionPoint_h__
-#define nsXBLInsertionPoint_h__
-
-#include "nsCOMArray.h"
-#include "nsIContent.h"
-#include "nsCOMPtr.h"
-#include "nsCycleCollectionParticipant.h"
-
-class nsXBLInsertionPoint
-{
-public:
-  nsXBLInsertionPoint(nsIContent* aParentElement, uint32_t aIndex, nsIContent* aDefContent);
-  ~nsXBLInsertionPoint();
-
-  NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(nsXBLInsertionPoint)
-
-  NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLInsertionPoint)
-
-  nsIContent* GetInsertionParent();
-  void ClearInsertionParent() { mParentElement = nullptr; }
-
-  int32_t GetInsertionIndex() { return mIndex; }
-
-  void SetDefaultContent(nsIContent* aDefaultContent) { mDefaultContent = aDefaultContent; }
-  nsIContent* GetDefaultContent();
-
-  void SetDefaultContentTemplate(nsIContent* aDefaultContent) { mDefaultContentTemplate = aDefaultContent; }
-  nsIContent* GetDefaultContentTemplate();
-
-  void AddChild(nsIContent* aChildElement) { mElements.AppendObject(aChildElement); }
-  void InsertChildAt(int32_t aIndex, nsIContent* aChildElement) { mElements.InsertObjectAt(aChildElement, aIndex); }
-  void RemoveChild(nsIContent* aChildElement) { mElements.RemoveObject(aChildElement); }
-  
-  int32_t ChildCount() { return mElements.Count(); }
-
-  nsIContent* ChildAt(uint32_t aIndex);
-
-  int32_t IndexOf(nsIContent* aContent) { return mElements.IndexOf(aContent); }
-
-  bool Matches(nsIContent* aContent, uint32_t aIndex);
-
-  // Unbind all the default content in this insertion point.  Used
-  // when the insertion parent is going away.
-  void UnbindDefaultContent();
-
-protected:
-  nsIContent* mParentElement;            // This ref is weak.  The parent of the <children> element.
-  int32_t mIndex;                        // The index of this insertion point. -1 is a pseudo-point.
-  nsCOMArray<nsIContent> mElements;      // An array of elements present at the insertion point.
-  nsCOMPtr<nsIContent> mDefaultContentTemplate ;           // The template default content that will be cloned if
-                                                           // the insertion point is empty.
-  nsCOMPtr<nsIContent> mDefaultContent;  // The cloned default content obtained by cloning mDefaultContentTemplate.
-};
-
-#endif
diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
index e5023c97b8b..8849b64321e 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.cpp
+++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
@@ -23,7 +23,6 @@
 #include "mozilla/dom/XMLDocument.h"
 #include "nsXBLService.h"
 #include "nsXBLBinding.h"
-#include "nsXBLInsertionPoint.h"
 #include "nsXBLPrototypeBinding.h"
 #include "nsXBLContentSink.h"
 #include "xptinfo.h"
@@ -112,63 +111,6 @@ protected:
   nsXBLAttributeEntry* mNext;
 };
 
-// nsXBLInsertionPointEntry and helpers.  This class stores all the necessary
-// info to figure out the position of an insertion point.
-// The same insertion point may be in the insertion point table for multiple
-// keys, so we refcount the entries.
-
-class nsXBLInsertionPointEntry {
-public:
-  nsXBLInsertionPointEntry(nsIContent* aParent)
-    : mInsertionParent(aParent),
-      mInsertionIndex(0)
-  {}
-
-  ~nsXBLInsertionPointEntry() {
-    if (mDefaultContent) {
-      nsAutoScriptBlocker scriptBlocker;
-      // mDefaultContent is a sort of anonymous content within the XBL
-      // document, and we own and manage it.  Unhook it here, since we're going
-      // away.
-      mDefaultContent->UnbindFromTree();
-    }
-  }
-
-  NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLInsertionPointEntry)
-
-  nsIContent* GetInsertionParent() { return mInsertionParent; }
-  uint32_t GetInsertionIndex() { return mInsertionIndex; }
-  void SetInsertionIndex(uint32_t aIndex) { mInsertionIndex = aIndex; }
-
-  nsIContent* GetDefaultContent() { return mDefaultContent; }
-  void SetDefaultContent(nsIContent* aChildren) { mDefaultContent = aChildren; }
-
-  NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(nsXBLInsertionPointEntry)
-
-protected:
-  nsCOMPtr<nsIContent> mInsertionParent;
-  nsCOMPtr<nsIContent> mDefaultContent;
-  uint32_t mInsertionIndex;
-};
-
-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXBLInsertionPointEntry)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mInsertionParent)
-  if (tmp->mDefaultContent) {
-    nsAutoScriptBlocker scriptBlocker;
-    // mDefaultContent is a sort of anonymous content within the XBL
-    // document, and we own and manage it.  Unhook it here, since we're going
-    // away.
-    tmp->mDefaultContent->UnbindFromTree();
-    tmp->mDefaultContent = nullptr;
-  }      
-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXBLInsertionPointEntry)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mInsertionParent)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDefaultContent)
-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
-NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXBLInsertionPointEntry, AddRef)
-NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXBLInsertionPointEntry, Release)
-
 // =============================================================================
 
 // Implementation /////////////////////////////////////////////////////////////////
@@ -183,7 +125,6 @@ nsXBLPrototypeBinding::nsXBLPrototypeBinding()
   mChromeOnlyContent(false),
   mResources(nullptr),
   mAttributeTable(nullptr),
-  mInsertionPointTable(nullptr),
   mInterfaceTable(nullptr),
   mBaseNameSpaceID(kNameSpaceID_None)
 {
@@ -227,17 +168,6 @@ bool nsXBLPrototypeBinding::CompareBindingURI(nsIURI* aURI) const
   return equal;
 }
 
-static bool
-TraverseInsertionPoint(nsHashKey* aKey, void* aData, void* aClosure)
-{
-  nsCycleCollectionTraversalCallback &cb = 
-    *static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
-  nsXBLInsertionPointEntry* entry =
-    static_cast<nsXBLInsertionPointEntry*>(aData);
-  CycleCollectionNoteChild(cb, entry, "[insertion point table] value");
-  return kHashEnumerateNext;
-}
-
 static bool
 TraverseBinding(nsHashKey *aKey, void *aData, void* aClosure)
 {
@@ -257,8 +187,6 @@ nsXBLPrototypeBinding::Traverse(nsCycleCollectionTraversalCallback &cb) const
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "proto mResources mLoader");
     cb.NoteXPCOMChild(mResources->mLoader);
   }
-  if (mInsertionPointTable)
-    mInsertionPointTable->Enumerate(TraverseInsertionPoint, &cb);
   if (mInterfaceTable)
     mInterfaceTable->Enumerate(TraverseBinding, &cb);
 }
@@ -282,11 +210,7 @@ nsXBLPrototypeBinding::Initialize()
 {
   nsIContent* content = GetImmediateChild(nsGkAtoms::content);
   if (content) {
-    // Make sure to construct the attribute table first, since constructing the
-    // insertion point table removes some of the subtrees, which makes them
-    // unreachable by walking our DOM.
     ConstructAttributeTable(content);
-    ConstructInsertionTable(content);
   }
 }
 
@@ -294,7 +218,6 @@ nsXBLPrototypeBinding::~nsXBLPrototypeBinding(void)
 {
   delete mResources;
   delete mAttributeTable;
-  delete mInsertionPointTable;
   delete mInterfaceTable;
   delete mImplementation;
   MOZ_COUNT_DTOR(nsXBLPrototypeBinding);
@@ -529,151 +452,6 @@ nsXBLPrototypeBinding::AttributeChanged(nsIAtom* aAttribute,
   }
 }
 
-struct InsertionData {
-  nsXBLBinding* mBinding;
-  nsXBLPrototypeBinding* mPrototype;
-
-  InsertionData(nsXBLBinding* aBinding,
-                nsXBLPrototypeBinding* aPrototype) 
-    :mBinding(aBinding), mPrototype(aPrototype) {}
-};
-
-bool InstantiateInsertionPoint(nsHashKey* aKey, void* aData, void* aClosure)
-{
-  nsXBLInsertionPointEntry* entry = static_cast<nsXBLInsertionPointEntry*>(aData);
-  InsertionData* data = static_cast<InsertionData*>(aClosure);
-  nsXBLBinding* binding = data->mBinding;
-  nsXBLPrototypeBinding* proto = data->mPrototype;
-
-  // Get the insertion parent.
-  nsIContent* content = entry->GetInsertionParent();
-  uint32_t index = entry->GetInsertionIndex();
-  nsIContent* defContent = entry->GetDefaultContent();
-
-  // Locate the real content.
-  nsIContent *instanceRoot = binding->GetAnonymousContent();
-  nsIContent *templRoot = proto->GetImmediateChild(nsGkAtoms::content);
-  nsIContent *realContent = proto->LocateInstance(nullptr, templRoot,
-                                                  instanceRoot, content);
-  if (!realContent)
-    realContent = binding->GetBoundElement();
-
-  // Now that we have the real content, look it up in our table.
-  nsInsertionPointList* points = nullptr;
-  binding->GetInsertionPointsFor(realContent, &points);
-  nsXBLInsertionPoint* insertionPoint = nullptr;
-  int32_t count = points->Length();
-  int32_t i = 0;
-  int32_t currIndex = 0;  
-  
-  for ( ; i < count; i++) {
-    nsXBLInsertionPoint* currPoint = points->ElementAt(i);
-    currIndex = currPoint->GetInsertionIndex();
-    if (currIndex == (int32_t)index) {
-      // This is a match. Break out of the loop and set our variable.
-      insertionPoint = currPoint;
-      break;
-    }
-    
-    if (currIndex > (int32_t)index)
-      // There was no match. Break.
-      break;
-  }
-
-  if (!insertionPoint) {
-    // We need to make a new insertion point.
-    insertionPoint = new nsXBLInsertionPoint(realContent, index, defContent);
-    if (insertionPoint) {
-      points->InsertElementAt(i, insertionPoint);
-    }
-  }
-
-  return true;
-}
-
-void
-nsXBLPrototypeBinding::InstantiateInsertionPoints(nsXBLBinding* aBinding)
-{
-  InsertionData data(aBinding, this);
-  if (mInsertionPointTable)
-    mInsertionPointTable->Enumerate(InstantiateInsertionPoint, &data);
-}
-
-nsIContent*
-nsXBLPrototypeBinding::GetInsertionPoint(nsIContent* aBoundElement,
-                                         nsIContent* aCopyRoot,
-                                         const nsIContent* aChild,
-                                         uint32_t* aIndex)
-{
-  if (!mInsertionPointTable)
-    return nullptr;
-
-  nsISupportsKey key(aChild->Tag());
-  nsXBLInsertionPointEntry* entry = static_cast<nsXBLInsertionPointEntry*>(mInsertionPointTable->Get(&key));
-  if (!entry) {
-    nsISupportsKey key2(nsGkAtoms::children);
-    entry = static_cast<nsXBLInsertionPointEntry*>(mInsertionPointTable->Get(&key2));
-  }
-
-  nsIContent *realContent = nullptr;
-  if (entry) {
-    nsIContent* content = entry->GetInsertionParent();
-    *aIndex = entry->GetInsertionIndex();
-    nsIContent* templContent = GetImmediateChild(nsGkAtoms::content);
-    realContent = LocateInstance(nullptr, templContent, aCopyRoot, content);
-  }
-  else {
-    // We got nothin'.  Bail.
-    return nullptr;
-  }
-
-  return realContent ? realContent : aBoundElement;
-}
-
-nsIContent*
-nsXBLPrototypeBinding::GetSingleInsertionPoint(nsIContent* aBoundElement,
-                                               nsIContent* aCopyRoot,
-                                               uint32_t* aIndex,
-                                               bool* aMultipleInsertionPoints)
-{ 
-  *aMultipleInsertionPoints = false;
-  *aIndex = 0;
-
-  if (!mInsertionPointTable)
-    return nullptr;
-
-  if (mInsertionPointTable->Count() != 1) {
-    *aMultipleInsertionPoints = true;
-    return nullptr;
-  }
-
-  nsISupportsKey key(nsGkAtoms::children);
-  nsXBLInsertionPointEntry* entry =
-    static_cast<nsXBLInsertionPointEntry*>(mInsertionPointTable->Get(&key));
-
-  if (!entry) {
-    // The only insertion point specified was actually a filtered insertion
-    // point. This means (strictly speaking) that we actually have multiple
-    // insertion points: the filtered one and a generic insertion point
-    // (content that doesn't match the filter will just go right underneath the
-    // bound element).
-
-    *aMultipleInsertionPoints = true;
-    *aIndex = 0;
-    return nullptr;
-  }
-
-  *aMultipleInsertionPoints = false;
-  *aIndex = entry->GetInsertionIndex();
-
-  nsIContent* templContent = GetImmediateChild(nsGkAtoms::content);
-  nsIContent* content = entry->GetInsertionParent();
-  nsIContent *realContent = LocateInstance(nullptr, templContent, aCopyRoot,
-                                           content);
-
-  return realContent ? realContent : aBoundElement;
-}
-
 void
 nsXBLPrototypeBinding::SetBaseTag(int32_t aNamespaceID, nsIAtom* aTag)
 {
@@ -744,86 +522,20 @@ nsXBLPrototypeBinding::LocateInstance(nsIContent* aBoundElement,
   if (aTemplChild == aTemplRoot || !aTemplChild)
     return nullptr;
 
-  nsCOMPtr<nsIContent> templParent = aTemplChild->GetParent();
-  nsCOMPtr<nsIContent> childPoint;
+  nsIContent* templParent = aTemplChild->GetParent();
 
   // We may be disconnected from our parent during cycle collection.
   if (!templParent)
     return nullptr;
-  
-  if (aBoundElement) {
-    if (templParent->NodeInfo()->Equals(nsGkAtoms::children,
-                                        kNameSpaceID_XBL)) {
-      childPoint = templParent;
-      templParent = childPoint->GetParent();
-    }
-  }
 
-  if (!templParent)
+  nsIContent *copyParent =
+    templParent == aTemplRoot ? aCopyRoot :
+                   LocateInstance(aBoundElement, aTemplRoot, aCopyRoot, templParent);
+
+  if (!copyParent)
     return nullptr;
 
-  nsIContent* result = nullptr;
-  nsIContent *copyParent;
-
-  if (templParent == aTemplRoot)
-    copyParent = aCopyRoot;
-  else
-    copyParent = LocateInstance(aBoundElement, aTemplRoot, aCopyRoot, templParent);
-  
-  if (childPoint && aBoundElement) {
-    // First we have to locate this insertion point and use its index and its
-    // count to detemine our precise position within the template.
-    nsIDocument* doc = aBoundElement->OwnerDoc();
-    nsXBLBinding *binding = doc->BindingManager()->GetBinding(aBoundElement);
-    nsIContent *anonContent = nullptr;
-
-    while (binding) {
-      anonContent = binding->GetAnonymousContent();
-      if (anonContent)
-        break;
-
-      binding = binding->GetBaseBinding();
-    }
-
-    NS_ABORT_IF_FALSE(binding, "Bug 620181 this is unexpected");
-    if (!binding)
-      return nullptr;
-
-    nsInsertionPointList* points = nullptr;
-    if (anonContent == copyParent)
-      binding->GetInsertionPointsFor(aBoundElement, &points);
-    else
-      binding->GetInsertionPointsFor(copyParent, &points);
-    int32_t count = points->Length();
-    for (int32_t i = 0; i < count; i++) {
-      // Next we have to find the real insertion point for this proto insertion
-      // point.  If it does not contain any default content, then we should 
-      // return null, since the content is not in the clone.
-      nsXBLInsertionPoint* currPoint = static_cast<nsXBLInsertionPoint*>(points->ElementAt(i));
-      nsCOMPtr<nsIContent> defContent = currPoint->GetDefaultContentTemplate();
-      if (defContent == childPoint) {
-        // Now check to see if we even built default content at this
-        // insertion point.
-        defContent = currPoint->GetDefaultContent();
-        if (defContent) {
-          // Find out the index of the template element within the <children> elt.
-          int32_t index = childPoint->IndexOf(aTemplChild);
-          
-          // Now we just have to find the corresponding elt underneath the cloned
-          // default content.
-          result = defContent->GetChildAt(index);
-        } 
-        break;
-      }
-    }
-  }
-  else if (copyParent)
-  {
-    int32_t index = templParent->IndexOf(aTemplChild);
-    result = copyParent->GetChildAt(index);
-  }
-
-  return result;
+  return copyParent->GetChildAt(templParent->IndexOf(aTemplChild));
 }
 
 struct nsXBLAttrChangeData
@@ -1080,111 +792,6 @@ nsXBLPrototypeBinding::ConstructAttributeTable(nsIContent* aElement)
   }
 }
 
-static bool
-DeleteInsertionPointEntry(nsHashKey* aKey, void* aData, void* aClosure)
-{
-  static_cast<nsXBLInsertionPointEntry*>(aData)->Release();
-  return true;
-}
-
-void 
-nsXBLPrototypeBinding::ConstructInsertionTable(nsIContent* aContent)
-{
-  nsCOMArray<nsIContent> childrenElements;
-  GetNestedChildren(nsGkAtoms::children, kNameSpaceID_XBL, aContent,
-                    childrenElements);
-
-  int32_t count = childrenElements.Count();
-  if (count == 0)
-    return;
-
-  mInsertionPointTable = new nsObjectHashtable(nullptr, nullptr,
-                                               DeleteInsertionPointEntry,
-                                               nullptr, 4);
-  if (!mInsertionPointTable)
-    return;
-
-  int32_t i;
-  for (i = 0; i < count; i++) {
-    nsIContent* child = childrenElements[i];
-    nsCOMPtr<nsIContent> parent = child->GetParent();
-
-    // Create an XBL insertion point entry.
-    nsXBLInsertionPointEntry* xblIns = new nsXBLInsertionPointEntry(parent);
-
-    nsAutoString includes;
-    child->GetAttr(kNameSpaceID_None, nsGkAtoms::includes, includes);
-    if (includes.IsEmpty()) {
-      nsISupportsKey key(nsGkAtoms::children);
-      xblIns->AddRef();
-      mInsertionPointTable->Put(&key, xblIns);
-    }
-    else {
-      // The user specified at least one attribute.
-      char* str = ToNewCString(includes);
-      char* newStr;
-      // XXX We should use a strtok function that tokenizes PRUnichar's
-      // so that we don't have to convert from Unicode to ASCII and then back
-
-      char* token = nsCRT::strtok( str, "| ", &newStr );
-      while( token != nullptr ) {
-        nsAutoString tok;
-        tok.AssignWithConversion(token);
-
-        // Build an atom out of this string.
-        nsCOMPtr<nsIAtom> atom = do_GetAtom(tok);
-
-        nsISupportsKey key(atom);
-        xblIns->AddRef();
-        mInsertionPointTable->Put(&key, xblIns);
-          
-        token = nsCRT::strtok( newStr, "| ", &newStr );
-      }
-
-      nsMemory::Free(str);
-    }
-
-    // Compute the index of the <children> element.  This index is
-    // equal to the index of the <children> in the template minus the #
-    // of previous insertion point siblings removed.  Because our childrenElements
-    // array was built in a DFS that went from left-to-right through siblings,
-    // if we dynamically obtain our index each time, then the removals of previous
-    // siblings will cause the index to adjust (and we won't have to take that into
-    // account explicitly).
-    int32_t index = parent->IndexOf(child);
-    xblIns->SetInsertionIndex((uint32_t)index);
-
-    // Now remove the <children> element from the template.  This ensures that the
-    // binding instantiation will not contain a clone of the <children> element when
-    // it clones the binding template.
-    parent->RemoveChildAt(index, false);
-
-    // See if the insertion point contains default content.  Default content must
-    // be cached in our insertion point entry, since it will need to be cloned
-    // in situations where no content ends up being placed at the insertion point.
-    uint32_t defaultCount = child->GetChildCount();
-    if (defaultCount > 0) {
-      nsAutoScriptBlocker scriptBlocker;
-      // Annotate the insertion point with our default content.
-      xblIns->SetDefaultContent(child);
-
-      // Reconnect back to our parent for access later.  This makes "inherits" easier
-      // to work with on default content.
-      // XXXbz this is somewhat screwed up, since it's sort of like anonymous
-      // content... but not.
-      nsresult rv =
-        child->BindToTree(parent->GetCurrentDoc(), parent,
-                          parent->GetBindingParent(), false);
-      if (NS_FAILED(rv)) {
-        // Well... now what?  Just unbind and bail out, I guess...
-        // XXXbz This really shouldn't be a void method!
-        child->UnbindFromTree();
-        return;
-      }
-    }
-  }
-}
-
 nsresult
 nsXBLPrototypeBinding::ConstructInterfaceTable(const nsAString& aImpls)
 {
@@ -1252,23 +859,6 @@ nsXBLPrototypeBinding::ConstructInterfaceTable(const nsAString& aImpls)
   return NS_OK;
 }
 
-void
-nsXBLPrototypeBinding::GetNestedChildren(nsIAtom* aTag, int32_t aNamespace,
-                                         nsIContent* aContent,
-                                         nsCOMArray<nsIContent> & aList)
-{
-  for (nsIContent* child = aContent->GetFirstChild();
-       child;
-       child = child->GetNextSibling()) {
-
-    if (child->NodeInfo()->Equals(aTag, aNamespace)) {
-      aList.AppendObject(child);
-    }
-    else
-      GetNestedChildren(aTag, aNamespace, child, aList);
-  }
-}
-
 nsresult
 nsXBLPrototypeBinding::AddResourceListener(nsIContent* aBoundElement)
 {
@@ -1502,31 +1092,6 @@ nsXBLPrototypeBinding::Read(nsIObjectInputStream* aStream,
   return NS_OK;
 }
 
-static
-bool
-GatherInsertionPoints(nsHashKey *aKey, void *aData, void* aClosure)
-{
-  ArrayOfInsertionPointsByContent* insertionPointsByContent =
-    static_cast<ArrayOfInsertionPointsByContent *>(aClosure);
-
-  nsXBLInsertionPointEntry* entry = static_cast<nsXBLInsertionPointEntry *>(aData);
-
-  // Add a new blank array if it isn't already there.
-  nsAutoTArray<InsertionItem, 1>* list;
-  if (!insertionPointsByContent->Get(entry->GetInsertionParent(), &list)) {
-    list = new nsAutoTArray<InsertionItem, 1>;
-    insertionPointsByContent->Put(entry->GetInsertionParent(), list);
-  }
-
-  // Add the item to the array and ensure it stays sorted by insertion index.
-  nsIAtom* atom = static_cast<nsIAtom *>(
-                    static_cast<nsISupportsKey *>(aKey)->GetValue());
-  InsertionItem newitem(entry->GetInsertionIndex(), atom, entry->GetDefaultContent());
-  list->InsertElementSorted(newitem);
-
-  return kHashEnumerateNext;
-}
-
 static
 bool
 WriteInterfaceID(nsHashKey *aKey, void *aData, void* aClosure)
@@ -1590,20 +1155,9 @@ nsXBLPrototypeBinding::Write(nsIObjectOutputStream* aStream)
   rv = aStream->WriteWStringZ(baseTag.get());
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // The binding holds insertions points keyed by the tag that is going to be
-  // inserted, however, the cache would prefer to know insertion points keyed
-  // by where they are in the content hierarchy. GatherInsertionPoints is used
-  // to iterate over the insertion points and store them temporarily in this
-  // latter hashtable.
-  ArrayOfInsertionPointsByContent insertionPointsByContent;
-  insertionPointsByContent.Init();
-  if (mInsertionPointTable) {
-    mInsertionPointTable->Enumerate(GatherInsertionPoints, &insertionPointsByContent);
-  }
-
   nsIContent* content = GetImmediateChild(nsGkAtoms::content);
   if (content) {
-    rv = WriteContentNode(aStream, content, insertionPointsByContent);
+    rv = WriteContentNode(aStream, content);
     NS_ENSURE_SUCCESS(rv, rv);
   }
   else {
@@ -1832,57 +1386,6 @@ nsXBLPrototypeBinding::ReadContentNode(nsIObjectInputStream* aStream,
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
-  // Next, read the insertion points.
-  uint32_t insertionPointIndex;
-  rv = aStream->Read32(&insertionPointIndex);
-  NS_ENSURE_SUCCESS(rv, rv);
-  while (insertionPointIndex != XBLBinding_Serialize_NoMoreInsertionPoints) {
-    nsRefPtr<nsXBLInsertionPointEntry> xblIns =
-      new nsXBLInsertionPointEntry(content);
-    xblIns->SetInsertionIndex(insertionPointIndex);
-
-    // If the insertion point has default content, read it.
-    nsCOMPtr<nsIContent> defaultContent;
-    rv = ReadContentNode(aStream, aDocument, aNim, getter_AddRefs(defaultContent));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (defaultContent) {
-      xblIns->SetDefaultContent(defaultContent);
-
-      rv = defaultContent->BindToTree(nullptr, content,
-                                      content->GetBindingParent(), false);
-      if (NS_FAILED(rv)) {
-        defaultContent->UnbindFromTree();
-        return rv;
-      }
-    }
-
-    if (!mInsertionPointTable) {
-      mInsertionPointTable = new nsObjectHashtable(nullptr, nullptr,
-                                                   DeleteInsertionPointEntry,
-                                                   nullptr, 4);
-    }
-
-    // Now read in the tags that can be inserted at this point, which is
-    // specified by the syntax includes="menupopup|panel", and add them to
-    // the hash.
-    uint32_t count;
-    rv = aStream->Read32(&count);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    for (; count > 0; count --) {
-      aStream->ReadString(tag);
-      nsCOMPtr<nsIAtom> tagAtom = do_GetAtom(tag);
-
-      nsISupportsKey key(tagAtom);
-      NS_ADDREF(xblIns.get());
-      mInsertionPointTable->Put(&key, xblIns);
-    }
-
-    rv = aStream->Read32(&insertionPointIndex);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
-
   // Finally, read in the child nodes.
   uint32_t childCount;
   rv = aStream->Read32(&childCount);
@@ -1961,8 +1464,7 @@ WriteAttributeNS(nsHashKey *aKey, void *aData, void* aClosure)
 
 nsresult
 nsXBLPrototypeBinding::WriteContentNode(nsIObjectOutputStream* aStream,
-                                        nsIContent* aNode,
-                                        ArrayOfInsertionPointsByContent& aInsertionPointsByContent)
+                                        nsIContent* aNode)
 {
   nsresult rv;
 
@@ -2046,62 +1548,13 @@ nsXBLPrototypeBinding::WriteContentNode(nsIObjectOutputStream* aStream,
   rv = aStream->Write8(XBLBinding_Serialize_NoMoreAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // Write out the insertion points.
-  nsAutoTArray<InsertionItem, 1>* list;
-  if (aInsertionPointsByContent.Get(aNode, &list)) {
-    uint32_t lastInsertionIndex = 0xFFFFFFFF;
-
-    // Iterate over the insertion points and see if they match this point
-    // in the content tree by comparing insertion indices.
-    for (uint32_t l = 0; l < list->Length(); l++) {
-      InsertionItem item = list->ElementAt(l);
-      // The list is sorted by insertionIndex so all items pertaining to
-      // this point will be in the list in order. We only need to write out the
-      // default content and the number of tags once for each index.
-      if (item.insertionIndex != lastInsertionIndex) {
-        lastInsertionIndex = item.insertionIndex;
-        aStream->Write32(item.insertionIndex);
-        // If the insertion point has default content, write that out, or
-        // write out XBLBinding_Serialize_NoContent if there isn't any.
-        if (item.defaultContent) {
-          rv = WriteContentNode(aStream, item.defaultContent,
-                                aInsertionPointsByContent);
-        }
-        else {
-          rv = aStream->Write8(XBLBinding_Serialize_NoContent);
-        }
-        NS_ENSURE_SUCCESS(rv, rv);
-
-        // Determine how many insertion points share the same index, so that
-        // the total count can be written out.
-        uint32_t icount = 1;
-        for (uint32_t i = l + 1; i < list->Length(); i++) {
-          if (list->ElementAt(i).insertionIndex != lastInsertionIndex)
-            break;
-          icount++;
-        }
-
-        rv = aStream->Write32(icount);
-        NS_ENSURE_SUCCESS(rv, rv);
-      }
-
-      rv = aStream->WriteWStringZ(nsDependentAtomString(list->ElementAt(l).tag).get());
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-  }
-
-  // Write out an end marker after the insertion points. If there weren't
-  // any, this will be all that is written out.
-  rv = aStream->Write32(XBLBinding_Serialize_NoMoreInsertionPoints);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   // Finally, write out the child nodes.
   count = aNode->GetChildCount();
   rv = aStream->Write32(count);
   NS_ENSURE_SUCCESS(rv, rv);
 
   for (i = 0; i < count; i++) {
-    rv = WriteContentNode(aStream, aNode->GetChildAt(i), aInsertionPointsByContent);
+    rv = WriteContentNode(aStream, aNode->GetChildAt(i));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
diff --git a/content/xbl/src/nsXBLPrototypeBinding.h b/content/xbl/src/nsXBLPrototypeBinding.h
index da6deeeee1d..dac6eae9491 100644
--- a/content/xbl/src/nsXBLPrototypeBinding.h
+++ b/content/xbl/src/nsXBLPrototypeBinding.h
@@ -27,34 +27,6 @@ class nsXBLProtoImplField;
 class nsXBLBinding;
 class nsCSSStyleSheet;
 
-// This structure represents an insertion point, and is used when writing out
-// insertion points. It contains comparison operators so that it can be stored
-// in an array sorted by index.
-struct InsertionItem {
-  uint32_t insertionIndex;
-  nsIAtom* tag;
-  nsIContent* defaultContent;
-
-  InsertionItem(uint32_t aInsertionIndex, nsIAtom* aTag, nsIContent* aDefaultContent)
-    : insertionIndex(aInsertionIndex), tag(aTag), defaultContent(aDefaultContent) { }
-
-  bool operator<(const InsertionItem& item) const
-  {
-    NS_ASSERTION(insertionIndex != item.insertionIndex || defaultContent == item.defaultContent,
-                 "default content is different for same index");
-    return insertionIndex < item.insertionIndex;
-  }
-
-  bool operator==(const InsertionItem& item) const
-  {
-    NS_ASSERTION(insertionIndex != item.insertionIndex || defaultContent == item.defaultContent,
-                 "default content is different for same index");
-    return insertionIndex == item.insertionIndex;
-  }
-};
-
-typedef nsClassHashtable<nsISupportsHashKey, nsAutoTArray<InsertionItem, 1> > ArrayOfInsertionPointsByContent;
-
 // *********************************************************************/
 // The XBLPrototypeBinding class
 
@@ -145,8 +117,6 @@ public:
 
   nsIStyleRuleProcessor* GetRuleProcessor();
   nsXBLPrototypeResources::sheet_array_type* GetStyleSheets();
-
-  bool HasInsertionPoints() { return mInsertionPointTable != nullptr; }
   
   bool HasStyleSheets() {
     return mResources && mResources->mStyleSheetList.Length() > 0;
@@ -154,19 +124,6 @@ public:
 
   nsresult FlushSkinSheets();
 
-  void InstantiateInsertionPoints(nsXBLBinding* aBinding);
-
-  // XXXbz this aIndex has nothing to do with an index into the child
-  // list of the insertion parent or anything.
-  nsIContent* GetInsertionPoint(nsIContent* aBoundElement,
-                                nsIContent* aCopyRoot,
-                                const nsIContent *aChild,
-                                uint32_t* aIndex);
-
-  nsIContent* GetSingleInsertionPoint(nsIContent* aBoundElement,
-                                      nsIContent* aCopyRoot,
-                                      uint32_t* aIndex, bool* aMultiple);
-
   nsIAtom* GetBaseTag(int32_t* aNamespaceID);
   void SetBaseTag(int32_t aNamespaceID, nsIAtom* aTag);
 
@@ -219,8 +176,6 @@ public:
 
   /**
    * Write the content node aNode to aStream.
-   * aInsertionPointsByContent is a hash of the insertion points in the binding,
-   * keyed by where there are in the content hierarchy.
    *
    * This method is called recursively for each child descendant. For the topmost
    * call, aNode must be an element.
@@ -245,19 +200,11 @@ public:
    *     destination namespace
    *     destination attribute
    *   the constant XBLBinding_Serialize_NoMoreAttributes
-   *   insertion points within this node:
-   *     child index to insert within node
-   *     default content serialized in the same manner or XBLBinding_Serialize_NoContent
-   *     count of insertion points at that index
-   *       that number of string tags (those in the <children>'s includes attribute)
-   *   the constant XBLBinding_Serialize_NoMoreInsertionPoints
    *   32-bit count of the number of child nodes
    *     each child node is serialized in the same manner in sequence
    *   the constant XBLBinding_Serialize_NoContent
    */
-  nsresult WriteContentNode(nsIObjectOutputStream* aStream,
-                            nsIContent* aNode,
-                            ArrayOfInsertionPointsByContent& aInsertionPointsByContent);
+  nsresult WriteContentNode(nsIObjectOutputStream* aStream, nsIContent* aNode);
 
   /**
    * Read or write a namespace id from or to aStream. If the namespace matches
@@ -286,9 +233,6 @@ public:
   void Trace(const TraceCallbacks& aCallbacks, void *aClosure) const;
 
 // Internal member functions.
-// XXXbz GetImmediateChild needs to be public to be called by SetAttrs,
-// InstantiateInsertionPoints, etc; those should probably be a class static
-// method instead of a global (non-static!) ones.
 public:
   /**
    * GetImmediateChild locates the immediate child of our binding element which
@@ -309,10 +253,6 @@ protected:
                            int32_t aDestNamespaceID, nsIAtom* aDestTag,
                            nsIContent* aContent);
   void ConstructAttributeTable(nsIContent* aElement);
-  void ConstructInsertionTable(nsIContent* aElement);
-  void GetNestedChildren(nsIAtom* aTag, int32_t aNamespace,
-                         nsIContent* aContent,
-                         nsCOMArray<nsIContent> & aList);
   void CreateKeyHandlers();
 
 // MEMBER VARIABLES
@@ -342,9 +282,6 @@ protected:
                                       // keys in the table. Containers are nsObjectHashtables.
                                       // This table is used to efficiently handle attribute changes.
 
-  nsObjectHashtable* mInsertionPointTable; // A table of insertion points for placing explicit content
-                                           // underneath anonymous content.
-
   nsSupportsHashtable* mInterfaceTable; // A table of cached interfaces that we support.
 
   int32_t mBaseNameSpaceID;    // If we extend a tagname/namespace, then that information will
diff --git a/content/xml/content/src/moz.build b/content/xml/content/src/moz.build
index 2b5a517ec90..1d3ce63b4ba 100644
--- a/content/xml/content/src/moz.build
+++ b/content/xml/content/src/moz.build
@@ -10,6 +10,7 @@ EXPORTS.mozilla.dom += [
     'CDATASection.h',
     'ProcessingInstruction.h',
     'XMLStylesheetProcessingInstruction.h',
+    'nsXMLElement.h',
 ]
 
 CPP_SOURCES += [
diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
index 2f7c8198851..3e6860ace57 100644
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -67,6 +67,7 @@
 #include "nsXULTemplateQueryProcessorXML.h"
 #include "nsXULTemplateQueryProcessorStorage.h"
 #include "nsContentUtils.h"
+#include "ChildIterator.h"
 #include "nsCxPusher.h"
 
 using namespace mozilla::dom;
@@ -1654,47 +1655,28 @@ nsXULTemplateBuilder::GetTemplateRoot(nsIContent** aResult)
         }
     }
 
-#if 1 // XXX hack to workaround bug with XBL insertion/removal?
-    {
-        // If root node has no template attribute, then look for a child
-        // node which is a template tag
-        for (nsIContent* child = mRoot->GetFirstChild();
-             child;
-             child = child->GetNextSibling()) {
+    // If root node has no template attribute, then look for a child
+    // node which is a template tag.
+    for (nsIContent* child = mRoot->GetFirstChild();
+         child;
+         child = child->GetNextSibling()) {
 
-            if (IsTemplateElement(child)) {
-                NS_ADDREF(*aResult = child);
-                return NS_OK;
-            }
+        if (IsTemplateElement(child)) {
+            NS_ADDREF(*aResult = child);
+            return NS_OK;
         }
     }
-#endif
 
-    // If we couldn't find a real child, look through the anonymous
-    // kids, too.
-    nsCOMPtr<nsIDocument> doc = mRoot->GetDocument();
-    if (! doc)
-        return NS_OK;
-
-    nsCOMPtr<nsIDOMNodeList> kids;
-    doc->BindingManager()->GetXBLChildNodesFor(mRoot, getter_AddRefs(kids));
-
-    if (kids) {
-        uint32_t length;
-        kids->GetLength(&length);
-
-        for (uint32_t i = 0; i < length; ++i) {
-            nsCOMPtr<nsIDOMNode> node;
-            kids->Item(i, getter_AddRefs(node));
-            if (! node)
-                continue;
-
-            nsCOMPtr<nsIContent> child = do_QueryInterface(node);
-
-            if (IsTemplateElement(child)) {
-                NS_ADDREF(*aResult = child.get());
-                return NS_OK;
-            }
+    // Look through the anonymous children as well. Although FlattenedChildIterator
+    // will find a template element that has been placed in an insertion point, many
+    // bindings do not have a specific insertion point for the template element, which
+    // would cause it to not be part of the flattened content tree. The check above to
+    // check the explicit children as well handles this case.
+    FlattenedChildIterator iter(mRoot);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+        if (IsTemplateElement(child)) {
+            NS_ADDREF(*aResult = child);
+            return NS_OK;
         }
     }
 
diff --git a/docshell/base/Makefile.in b/docshell/base/Makefile.in
index 6c2f1dd63c2..a957271c20b 100644
--- a/docshell/base/Makefile.in
+++ b/docshell/base/Makefile.in
@@ -35,4 +35,5 @@ LOCAL_INCLUDES += \
   -I$(topsrcdir)/layout/generic \
   -I$(topsrcdir)/layout/xul/base/src \
   -I$(topsrcdir)/content/base/src \
+  -I$(topsrcdir)/netwerk/protocol/viewsource \
   $(NULL)
diff --git a/docshell/base/nsAboutRedirector.cpp b/docshell/base/nsAboutRedirector.cpp
index f6fe52fcbb5..4ab1ccdd03d 100644
--- a/docshell/base/nsAboutRedirector.cpp
+++ b/docshell/base/nsAboutRedirector.cpp
@@ -64,7 +64,12 @@ static RedirEntry kRedirMap[] = {
     { "support", "chrome://global/content/aboutSupport.xhtml",
       nsIAboutModule::ALLOW_SCRIPT },
     { "telemetry", "chrome://global/content/aboutTelemetry.xhtml",
-      nsIAboutModule::ALLOW_SCRIPT }
+      nsIAboutModule::ALLOW_SCRIPT },
+    // about:srcdoc is unresolvable by specification.  It is included here
+    // because the security manager would disallow srcdoc iframes otherwise.
+    { "srcdoc", "about:blank",
+      nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
+      nsIAboutModule::HIDE_FROM_ABOUTABOUT }
 };
 static const int kRedirTotal = NS_ARRAY_LENGTH(kRedirMap);
 
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 62329fac8d8..a11f85a3847 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -89,6 +89,7 @@
 #include "nsIDocShellTreeItem.h"
 #include "nsIChannel.h"
 #include "IHistory.h"
+#include "nsViewSourceHandler.h"
 
 // we want to explore making the document own the load group
 // so we can associate the document URI with the load group.
@@ -1260,8 +1261,11 @@ nsDocShell::LoadURI(nsIURI * aURI,
     bool inheritOwner = false;
     bool ownerIsExplicit = false;
     bool sendReferrer = true;
+    bool isSrcdoc = false;
     nsCOMPtr<nsISHEntry> shEntry;
     nsXPIDLString target;
+    nsAutoString srcdoc;
+
     uint32_t loadType = MAKE_LOAD_TYPE(LOAD_NORMAL, aLoadFlags);    
 
     NS_ENSURE_ARG(aURI);
@@ -1288,6 +1292,8 @@ nsDocShell::LoadURI(nsIURI * aURI,
         aLoadInfo->GetPostDataStream(getter_AddRefs(postStream));
         aLoadInfo->GetHeadersStream(getter_AddRefs(headersStream));
         aLoadInfo->GetSendReferrer(&sendReferrer);
+        aLoadInfo->GetIsSrcdocLoad(&isSrcdoc);
+        aLoadInfo->GetSrcdocData(srcdoc);
     }
 
 #if defined(PR_LOGGING) && defined(DEBUG)
@@ -1508,6 +1514,9 @@ nsDocShell::LoadURI(nsIURI * aURI,
     if (aLoadFlags & LOAD_FLAGS_FORCE_ALLOW_COOKIES)
         flags |= INTERNAL_LOAD_FLAGS_FORCE_ALLOW_COOKIES;
 
+    if (isSrcdoc)
+        flags |= INTERNAL_LOAD_FLAGS_IS_SRCDOC;
+
     return InternalLoad(aURI,
                         referrer,
                         owner,
@@ -1520,6 +1529,7 @@ nsDocShell::LoadURI(nsIURI * aURI,
                         loadType,
                         nullptr,         // No SHEntry
                         aFirstParty,
+                        srcdoc,
                         nullptr,         // No nsIDocShell
                         nullptr);        // No nsIRequest
 }
@@ -4567,7 +4577,7 @@ nsDocShell::LoadErrorPage(nsIURI *aURI, const PRUnichar *aURL,
     return InternalLoad(errorPageURI, nullptr, nullptr,
                         INTERNAL_LOAD_FLAGS_INHERIT_OWNER, nullptr, nullptr,
                         NullString(), nullptr, nullptr, LOAD_ERROR_PAGE,
-                        nullptr, true, nullptr, nullptr);
+                        nullptr, true, NullString(), nullptr,nullptr);
 }
 
 
@@ -4608,17 +4618,24 @@ nsDocShell::Reload(uint32_t aReloadFlags)
     else {
         nsCOMPtr<nsIDocument> doc(do_GetInterface(GetAsSupports(this)));
 
+        // Do not inherit owner from document
+        uint32_t flags = INTERNAL_LOAD_FLAGS_NONE;
+        nsAutoString srcdoc;
         nsIPrincipal* principal = nullptr;
         nsAutoString contentTypeHint;
         if (doc) {
             principal = doc->NodePrincipal();
             doc->GetContentType(contentTypeHint);
-        }
 
+            if (doc->IsSrcdocDocument()) {
+                doc->GetSrcdocData(srcdoc);
+                flags |= INTERNAL_LOAD_FLAGS_IS_SRCDOC;
+            }
+        }
         rv = InternalLoad(mCurrentURI,
                           mReferrerURI,
                           principal,
-                          INTERNAL_LOAD_FLAGS_NONE, // Do not inherit owner from document
+                          flags,
                           nullptr,         // No window target
                           NS_LossyConvertUTF16toASCII(contentTypeHint).get(),
                           NullString(),    // No forced download
@@ -4627,6 +4644,7 @@ nsDocShell::Reload(uint32_t aReloadFlags)
                           loadType,        // Load type
                           nullptr,         // No SHEntry
                           true,
+                          srcdoc,          // srcdoc argument for iframe
                           nullptr,         // No nsIDocShell
                           nullptr);        // No nsIRequest
     }
@@ -8467,7 +8485,9 @@ public:
                       nsISupports * aOwner, uint32_t aFlags,
                       const char* aTypeHint, nsIInputStream * aPostData,
                       nsIInputStream * aHeadersData, uint32_t aLoadType,
-                      nsISHEntry * aSHEntry, bool aFirstParty) :
+                      nsISHEntry * aSHEntry, bool aFirstParty,
+                      const nsAString &aSrcdoc) :
+        mSrcdoc(aSrcdoc),
         mDocShell(aDocShell),
         mURI(aURI),
         mReferrer(aReferrer),
@@ -8490,7 +8510,7 @@ public:
                                        nullptr, mTypeHint.get(),
                                        NullString(), mPostData, mHeadersData,
                                        mLoadType, mSHEntry, mFirstParty,
-                                       nullptr, nullptr);
+                                       mSrcdoc, nullptr, nullptr);
     }
 
 private:
@@ -8498,6 +8518,7 @@ private:
     // Use IDL strings so .get() returns null by default
     nsXPIDLString mWindowTarget;
     nsXPIDLCString mTypeHint;
+    nsString mSrcdoc;
 
     nsRefPtr<nsDocShell> mDocShell;
     nsCOMPtr<nsIURI> mURI;
@@ -8541,6 +8562,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                          uint32_t aLoadType,
                          nsISHEntry * aSHEntry,
                          bool aFirstParty,
+                         const nsAString &aSrcdoc,
                          nsIDocShell** aDocShell,
                          nsIRequest** aRequest)
 {
@@ -8779,6 +8801,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                                               aLoadType,
                                               aSHEntry,
                                               aFirstParty,
+                                              aSrcdoc,
                                               aDocShell,
                                               aRequest);
             if (rv == NS_ERROR_NO_CONTENT) {
@@ -8860,7 +8883,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
             nsCOMPtr<nsIRunnable> ev =
                 new InternalLoadEvent(this, aURI, aReferrer, aOwner, aFlags,
                                       aTypeHint, aPostData, aHeadersData,
-                                      aLoadType, aSHEntry, aFirstParty);
+                                      aLoadType, aSHEntry, aFirstParty, aSrcdoc);
             return NS_DispatchToCurrentThread(ev);
         }
 
@@ -9267,6 +9290,12 @@ nsDocShell::InternalLoad(nsIURI * aURI,
         }
     }
 
+    nsAutoString srcdoc;
+    if (aFlags & INTERNAL_LOAD_FLAGS_IS_SRCDOC)
+      srcdoc = aSrcdoc;
+    else
+      srcdoc = NullString();
+
     nsCOMPtr<nsIRequest> req;
     rv = DoURILoad(aURI, aReferrer,
                    !(aFlags & INTERNAL_LOAD_FLAGS_DONT_SEND_REFERRER),
@@ -9274,7 +9303,8 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                    aFirstParty, aDocShell, getter_AddRefs(req),
                    (aFlags & INTERNAL_LOAD_FLAGS_FIRST_LOAD) != 0,
                    (aFlags & INTERNAL_LOAD_FLAGS_BYPASS_CLASSIFIER) != 0,
-                   (aFlags & INTERNAL_LOAD_FLAGS_FORCE_ALLOW_COOKIES) != 0);
+                   (aFlags & INTERNAL_LOAD_FLAGS_FORCE_ALLOW_COOKIES) != 0,
+                   srcdoc);
     if (req && aRequest)
         NS_ADDREF(*aRequest = req);
 
@@ -9352,7 +9382,8 @@ nsDocShell::DoURILoad(nsIURI * aURI,
                       nsIRequest ** aRequest,
                       bool aIsNewWindowTarget,
                       bool aBypassClassifier,
-                      bool aForceAllowCookies)
+                      bool aForceAllowCookies,
+                      const nsAString &aSrcdoc)
 {
 #ifdef MOZ_VISUAL_EVENT_TRACER
     nsAutoCString urlSpec;
@@ -9401,28 +9432,52 @@ nsDocShell::DoURILoad(nsIURI * aURI,
     // open a channel for the url
     nsCOMPtr<nsIChannel> channel;
 
-    rv = NS_NewChannel(getter_AddRefs(channel),
-                       aURI,
-                       nullptr,
-                       nullptr,
-                       static_cast<nsIInterfaceRequestor *>(this),
-                       loadFlags,
-                       channelPolicy);
-    if (NS_FAILED(rv)) {
-        if (rv == NS_ERROR_UNKNOWN_PROTOCOL) {
-            // This is a uri with a protocol scheme we don't know how
-            // to handle.  Embedders might still be interested in
-            // handling the load, though, so we fire a notification
-            // before throwing the load away.
-            bool abort = false;
-            nsresult rv2 = mContentListener->OnStartURIOpen(aURI, &abort);
-            if (NS_SUCCEEDED(rv2) && abort) {
-                // Hey, they're handling the load for us!  How convenient!
-                return NS_OK;
+    bool isSrcdoc = !aSrcdoc.IsVoid();
+    if (!isSrcdoc) {
+        rv = NS_NewChannel(getter_AddRefs(channel),
+                           aURI,
+                           nullptr,
+                           nullptr,
+                           static_cast<nsIInterfaceRequestor *>(this),
+                           loadFlags,
+                           channelPolicy);
+        if (NS_FAILED(rv)) {
+            if (rv == NS_ERROR_UNKNOWN_PROTOCOL) {
+                // This is a uri with a protocol scheme we don't know how
+                // to handle.  Embedders might still be interested in
+                // handling the load, though, so we fire a notification
+                // before throwing the load away.
+                bool abort = false;
+                nsresult rv2 = mContentListener->OnStartURIOpen(aURI, &abort);
+                if (NS_SUCCEEDED(rv2) && abort) {
+                    // Hey, they're handling the load for us!  How convenient!
+                    return NS_OK;
+                }
             }
+            return rv;
+        }
+    }
+    else {
+        nsAutoCString scheme;
+        rv = aURI->GetScheme(scheme);
+        NS_ENSURE_SUCCESS(rv,rv);
+        bool isViewSource;
+        aURI->SchemeIs("view-source",&isViewSource);
+
+        if (isViewSource) {
+            nsViewSourceHandler *vsh = nsViewSourceHandler::GetInstance();
+            NS_ENSURE_TRUE(vsh,NS_ERROR_FAILURE);
+
+            rv = vsh->NewSrcdocChannel(aURI, aSrcdoc,getter_AddRefs(channel));
+            NS_ENSURE_SUCCESS(rv, rv);
+        }
+        else {
+            rv = NS_NewInputStreamChannel(getter_AddRefs(channel),aURI,
+                                          aSrcdoc,
+                                          NS_LITERAL_CSTRING("text/html"),
+                                          true);
+            NS_ENSURE_SUCCESS(rv, rv);
         }
-            
-        return rv;
     }
 
     nsCOMPtr<nsIApplicationCacheChannel> appCacheChannel =
@@ -9580,7 +9635,8 @@ nsDocShell::DoURILoad(nsIURI * aURI,
     }
 
     nsContentUtils::SetUpChannelOwner(ownerPrincipal, channel, aURI, true,
-                                      (mSandboxFlags & SANDBOXED_ORIGIN));
+                                      (mSandboxFlags & SANDBOXED_ORIGIN) ||
+                                      isSrcdoc);
 
     nsCOMPtr<nsIScriptChannel> scriptChannel = do_QueryInterface(channel);
     if (scriptChannel) {
@@ -10638,6 +10694,16 @@ nsDocShell::AddToSessionHistory(nsIURI * aURI, nsIChannel * aChannel,
                   mHistoryID,
                   mDynamicallyCreated);
     entry->SetReferrerURI(referrerURI);
+    nsCOMPtr<nsIInputStreamChannel> inStrmChan = do_QueryInterface(aChannel);
+    if (inStrmChan) {
+        bool isSrcdocChannel;
+        inStrmChan->GetIsSrcdocChannel(&isSrcdocChannel);
+        if (isSrcdocChannel) {
+            nsAutoString srcdoc;
+            inStrmChan->GetSrcdocData(srcdoc);
+            entry->SetSrcdocData(srcdoc);
+        }
+    }
     /* If cache got a 'no-store', ask SH not to store
      * HistoryLayoutState. By default, SH will set this
      * flag to true and save HistoryLayoutState.
@@ -10784,10 +10850,24 @@ nsDocShell::LoadHistoryEntry(nsISHEntry * aEntry, uint32_t aLoadType)
         return NS_BINDING_ABORTED;
     }
 
+    // Do not inherit owner from document (security-critical!);
+    uint32_t flags = INTERNAL_LOAD_FLAGS_NONE;
+
+    nsAutoString srcdoc;
+    bool isSrcdoc;
+    aEntry->GetIsSrcdocEntry(&isSrcdoc);
+    if (isSrcdoc) {
+        aEntry->GetSrcdocData(srcdoc);
+        flags |= INTERNAL_LOAD_FLAGS_IS_SRCDOC;
+    }
+    else {
+        srcdoc = NullString();
+    }
+
     rv = InternalLoad(uri,
                       referrerURI,
                       owner,
-                      INTERNAL_LOAD_FLAGS_NONE, // Do not inherit owner from document (security-critical!)
+                      flags,
                       nullptr,            // No window target
                       contentType.get(),  // Type hint
                       NullString(),       // No forced file download
@@ -10796,6 +10876,7 @@ nsDocShell::LoadHistoryEntry(nsISHEntry * aEntry, uint32_t aLoadType)
                       aLoadType,          // Load type
                       aEntry,             // SHEntry
                       true,
+                      srcdoc,
                       nullptr,            // No nsIDocShell
                       nullptr);           // No nsIRequest
     return rv;
@@ -12235,6 +12316,7 @@ nsDocShell::OnLinkClickSync(nsIContent *aContent,
                              LOAD_LINK,                 // Load type
                              nullptr,                   // No SHEntry
                              true,                      // first party site
+                             NullString(),              // No srcdoc
                              aDocShell,                 // DocShell out-param
                              aRequest);                 // Request out-param
   if (NS_SUCCEEDED(rv)) {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 81007488c4f..764fe3b9463 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -289,6 +289,8 @@ protected:
     // Actually open a channel and perform a URI load.  Note: whatever owner is
     // passed to this function will be set on the channel.  Callers who wish to
     // not have an owner on the channel should just pass null.
+    // If aSrcdoc is not void, the load will be considered as a srcdoc load,
+    // and the contents of aSrcdoc will be loaded instead of aURI.
     virtual nsresult DoURILoad(nsIURI * aURI,
                                nsIURI * aReferrer,
                                bool aSendReferrer,
@@ -302,7 +304,8 @@ protected:
                                nsIRequest ** aRequest,
                                bool aIsNewWindowTarget,
                                bool aBypassClassifier,
-                               bool aForceAllowCookies);
+                               bool aForceAllowCookies,
+                               const nsAString &aSrcdoc);
     NS_IMETHOD AddHeadersToChannel(nsIInputStream * aHeadersData, 
                                   nsIChannel * aChannel);
     virtual nsresult DoChannelLoad(nsIChannel * aChannel,
diff --git a/docshell/base/nsDocShellLoadInfo.cpp b/docshell/base/nsDocShellLoadInfo.cpp
index e1943c30c02..0d29e797ff6 100644
--- a/docshell/base/nsDocShellLoadInfo.cpp
+++ b/docshell/base/nsDocShellLoadInfo.cpp
@@ -16,7 +16,8 @@ nsDocShellLoadInfo::nsDocShellLoadInfo()
   : mInheritOwner(false),
     mOwnerIsExplicit(false),
     mSendReferrer(true),
-    mLoadType(nsIDocShellLoadInfo::loadNormal)
+    mLoadType(nsIDocShellLoadInfo::loadNormal),
+    mIsSrcdocLoad(false)
 {
 }
 
@@ -188,6 +189,26 @@ NS_IMETHODIMP nsDocShellLoadInfo::SetSendReferrer(bool aSendReferrer)
    return NS_OK;
 }
 
+NS_IMETHODIMP nsDocShellLoadInfo::GetIsSrcdocLoad(bool* aIsSrcdocLoad)
+{
+   *aIsSrcdocLoad = mIsSrcdocLoad;
+   return NS_OK;
+}
+
+NS_IMETHODIMP nsDocShellLoadInfo::GetSrcdocData(nsAString &aSrcdocData)
+{
+   aSrcdocData = mSrcdocData;
+   return NS_OK;
+}
+
+NS_IMETHODIMP nsDocShellLoadInfo::SetSrcdocData(const nsAString &aSrcdocData)
+{
+   mSrcdocData = aSrcdocData;
+   mIsSrcdocLoad = true;
+   return NS_OK;
+}
+
+
 //*****************************************************************************
 // nsDocShellLoadInfo: Helpers
 //*****************************************************************************   
diff --git a/docshell/base/nsDocShellLoadInfo.h b/docshell/base/nsDocShellLoadInfo.h
index ff0661a1334..de906dd7980 100644
--- a/docshell/base/nsDocShellLoadInfo.h
+++ b/docshell/base/nsDocShellLoadInfo.h
@@ -40,6 +40,8 @@ protected:
   nsString                         mTarget;
   nsCOMPtr<nsIInputStream>         mPostDataStream;
   nsCOMPtr<nsIInputStream>         mHeadersStream;
+  bool                             mIsSrcdocLoad;
+  nsString                         mSrcdocData;
 };
 
 #endif /* nsDocShellLoadInfo_h__ */
diff --git a/docshell/base/nsIDocShell.idl b/docshell/base/nsIDocShell.idl
index 4a63bf98b7f..e527df05591 100644
--- a/docshell/base/nsIDocShell.idl
+++ b/docshell/base/nsIDocShell.idl
@@ -42,7 +42,7 @@ interface nsIVariant;
 interface nsIPrivacyTransitionObserver;
 interface nsIReflowObserver;
 
-[scriptable, builtinclass, uuid(f453d2ee-bac7-46f9-a553-df918f0cc0d0)]
+[scriptable, builtinclass, uuid(cdeb1ed0-7794-4e5f-964e-bb9d753d1686)]
 interface nsIDocShell : nsIDocShellTreeItem
 {
   /**
@@ -106,6 +106,9 @@ interface nsIDocShell : nsIDocShellTreeItem
   const long INTERNAL_LOAD_FLAGS_BYPASS_CLASSIFIER       = 0x10;
   const long INTERNAL_LOAD_FLAGS_FORCE_ALLOW_COOKIES     = 0x20;
 
+  // Whether the load should be treated as srcdoc load, rather than a URI one.
+  const long INTERNAL_LOAD_FLAGS_IS_SRCDOC               = 0x40;
+
   /**
    * Loads the given URI.  This method is identical to loadURI(...) except
    * that its parameter list is broken out instead of being packaged inside
@@ -128,6 +131,9 @@ interface nsIDocShell : nsIDocShellTreeItem
    * @param aLoadFlags      - Flags to modify load behaviour. Flags are defined
    *                          in nsIWebNavigation.
    * @param aSHEntry        - Active Session History entry (if loading from SH)
+   * @param aSrcdoc           When INTERNAL_LOAD_FLAGS_IS_SRCDOC is set, the
+   *                          contents of this parameter will be loaded instead
+   *                          of aURI.
    */
   [noscript]void internalLoad(in nsIURI aURI,
                               in nsIURI aReferrer,
@@ -141,6 +147,7 @@ interface nsIDocShell : nsIDocShellTreeItem
                               in unsigned long aLoadFlags,
                               in nsISHEntry aSHEntry,
                               in boolean firstParty,
+                              in AString aSrcdoc,
                               out nsIDocShell aDocShell,
                               out nsIRequest aRequest);
 
diff --git a/docshell/base/nsIDocShellLoadInfo.idl b/docshell/base/nsIDocShellLoadInfo.idl
index 27a00dfb9c0..77c0e2ee954 100644
--- a/docshell/base/nsIDocShellLoadInfo.idl
+++ b/docshell/base/nsIDocShellLoadInfo.idl
@@ -17,7 +17,7 @@ interface nsISHEntry;
 
 typedef long nsDocShellInfoLoadType;
 
-[scriptable, uuid(5b041ea4-6655-434c-b3d3-cbbc9441f86a)]
+[scriptable, uuid(5df91211-37db-47e9-8f83-2d5b0cb2eb9e)]
 interface nsIDocShellLoadInfo : nsISupports
 {
     /** This is the referrer for the load. */
@@ -82,4 +82,16 @@ interface nsIDocShellLoadInfo : nsISupports
      *  sent, even if it's available. This attribute defaults to true.
      */
     attribute boolean sendReferrer;
+
+    /** True if the docshell has been created to load an iframe where the
+     * srcdoc attribute has been set.  Set when srcdocData is specified.
+     */
+    readonly attribute boolean isSrcdocLoad;
+
+    /** When set, the load will be interpreted as a srcdoc load, where contents
+     * of this string will be loaded instead of the URI.  Setting srcdocData
+     * sets isSrcdocLoad to true
+     */
+    attribute AString srcdocData;
+
 };
diff --git a/docshell/build/nsDocShellModule.cpp b/docshell/build/nsDocShellModule.cpp
index d8e9fbed36e..0490f43c448 100644
--- a/docshell/build/nsDocShellModule.cpp
+++ b/docshell/build/nsDocShellModule.cpp
@@ -183,6 +183,7 @@ const mozilla::Module::ContractIDEntry kDocShellContracts[] = {
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "newaddon", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "support", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
   { NS_ABOUT_MODULE_CONTRACTID_PREFIX "telemetry", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
+  { NS_ABOUT_MODULE_CONTRACTID_PREFIX "srcdoc", &kNS_ABOUT_REDIRECTOR_MODULE_CID },
   { NS_URI_LOADER_CONTRACTID, &kNS_URI_LOADER_CID },
   { NS_DOCUMENTLOADER_SERVICE_CONTRACTID, &kNS_DOCUMENTLOADER_SERVICE_CID },
   { NS_EXTERNALHELPERAPPSERVICE_CONTRACTID, &kNS_EXTERNALHELPERAPPSERVICE_CID },
diff --git a/docshell/shistory/public/nsISHEntry.idl b/docshell/shistory/public/nsISHEntry.idl
index 6d1dca23f8b..395e694d90c 100644
--- a/docshell/shistory/public/nsISHEntry.idl
+++ b/docshell/shistory/public/nsISHEntry.idl
@@ -29,7 +29,7 @@ class nsSHEntryShared;
 [ptr] native nsDocShellEditorDataPtr(nsDocShellEditorData);
 [ptr] native nsSHEntryShared(nsSHEntryShared);
 
-[scriptable, uuid(6443FD72-A50F-4B8B-BB82-BB1FA04CB15D)]
+[scriptable, uuid(162EA0EB-E577-4B9A-AF9D-A94E8350B029)]
 interface nsISHEntry : nsIHistoryEntry
 {
     /** URI for the document */
@@ -237,6 +237,20 @@ interface nsISHEntry : nsIHistoryEntry
      * it's preceeded by a call to adoptBFCacheEntry(aEntry).
      */
     boolean sharesDocumentWith(in nsISHEntry aEntry);
+
+    /**
+     * True if this SHEntry corresponds to a document created by a srcdoc iframe.
+     * Set when a value is assigned to  srcdocData.
+     */
+    readonly attribute boolean isSrcdocEntry;
+
+    /**
+     * Contents of the srcdoc attribute in a srcdoc iframe to be loaded instead
+     * of the URI.  Similar to a Data URI, this information is needed to
+     * recreate the document at a later stage.
+     * Setting this sets isSrcdocEntry to true
+     */
+    attribute AString srcdocData;
 };
 
 [scriptable, uuid(bb66ac35-253b-471f-a317-3ece940f04c5)]
diff --git a/docshell/shistory/src/nsSHEntry.cpp b/docshell/shistory/src/nsSHEntry.cpp
index 14891a78595..3a811091268 100644
--- a/docshell/shistory/src/nsSHEntry.cpp
+++ b/docshell/shistory/src/nsSHEntry.cpp
@@ -35,6 +35,7 @@ nsSHEntry::nsSHEntry()
   , mScrollPositionY(0)
   , mParent(nullptr)
   , mURIWasModified(false)
+  , mIsSrcdocEntry(false)
 {
   mShared = new nsSHEntryShared();
 }
@@ -52,6 +53,8 @@ nsSHEntry::nsSHEntry(const nsSHEntry &other)
   , mParent(other.mParent)
   , mURIWasModified(other.mURIWasModified)
   , mStateData(other.mStateData)
+  , mIsSrcdocEntry(other.mIsSrcdocEntry)
+  , mSrcdocData(other.mSrcdocData)
 {
 }
 
@@ -491,6 +494,30 @@ nsSHEntry::AbandonBFCacheEntry()
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsSHEntry::GetIsSrcdocEntry(bool* aIsSrcdocEntry)
+{
+  *aIsSrcdocEntry = mIsSrcdocEntry;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsSHEntry::GetSrcdocData(nsAString &aSrcdocData)
+{
+  aSrcdocData = mSrcdocData;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsSHEntry::SetSrcdocData(const nsAString &aSrcdocData)
+{
+  mSrcdocData = aSrcdocData;
+  mIsSrcdocEntry = true;
+  return NS_OK;
+}
+
+
+
 //*****************************************************************************
 //    nsSHEntry: nsISHContainer
 //*****************************************************************************
diff --git a/docshell/shistory/src/nsSHEntry.h b/docshell/shistory/src/nsSHEntry.h
index b0e6ed945b9..495d8e81761 100644
--- a/docshell/shistory/src/nsSHEntry.h
+++ b/docshell/shistory/src/nsSHEntry.h
@@ -62,6 +62,8 @@ private:
   nsCOMArray<nsISHEntry>   mChildren;
   bool                     mURIWasModified;
   nsCOMPtr<nsIStructuredCloneContainer> mStateData;
+  bool                     mIsSrcdocEntry;
+  nsString                 mSrcdocData;
 };
 
 #endif /* nsSHEntry_h */
diff --git a/dom/audiochannel/AudioChannelService.cpp b/dom/audiochannel/AudioChannelService.cpp
index 5c5ab9394a9..3a956c53f95 100644
--- a/dom/audiochannel/AudioChannelService.cpp
+++ b/dom/audiochannel/AudioChannelService.cpp
@@ -568,6 +568,5 @@ AudioChannelService::GetInternalType(AudioChannelType aType,
       break;
   }
 
-  MOZ_NOT_REACHED("unexpected audio channel type");
-  return AUDIO_CHANNEL_INT_LAST;
+  MOZ_CRASH("unexpected audio channel type");
 }
diff --git a/dom/base/DOMRequest.cpp b/dom/base/DOMRequest.cpp
index 18e1d48e44c..8e43ef0d03e 100644
--- a/dom/base/DOMRequest.cpp
+++ b/dom/base/DOMRequest.cpp
@@ -95,7 +95,7 @@ DOMRequest::GetReadyState(nsAString& aReadyState)
       aReadyState.AssignLiteral("done");
       break;
     default:
-      MOZ_NOT_REACHED("Unrecognized readyState.");
+      MOZ_CRASH("Unrecognized readyState.");
   }
 
   return NS_OK;
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index f6833977aa8..ba4a07a9681 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -1816,19 +1816,16 @@ nsDOMClassInfo::Init()
   for (size_t i = 0; i < eDOMClassInfoIDCount; i++) {
     if (!sClassInfoData[i].u.mConstructorFptr ||
         sClassInfoData[i].mDebugID != i) {
-      MOZ_NOT_REACHED("Class info data out of sync, you forgot to update "
-                      "nsDOMClassInfo.h and nsDOMClassInfo.cpp! Fix this, "
-                      "mozilla will not work without this fixed!");
-      return NS_ERROR_NOT_INITIALIZED;
+      MOZ_CRASH("Class info data out of sync, you forgot to update "
+                "nsDOMClassInfo.h and nsDOMClassInfo.cpp! Fix this, "
+                "mozilla will not work without this fixed!");
     }
   }
 
   for (size_t i = 0; i < eDOMClassInfoIDCount; i++) {
     if (!sClassInfoData[i].mInterfaces) {
-      MOZ_NOT_REACHED("Class info data without an interface list! Fix this, "
-                      "mozilla will not work without this fixed!");
-
-      return NS_ERROR_NOT_INITIALIZED;
+      MOZ_CRASH("Class info data without an interface list! Fix this, "
+                "mozilla will not work without this fixed!");
      }
    }
 #endif
@@ -2027,8 +2024,7 @@ NS_IMETHODIMP
 nsDOMClassInfo::PostTransplant(nsIXPConnectWrappedNative *wrapper,
                                JSContext *cx, JSObject *obj)
 {
-  MOZ_NOT_REACHED("nsDOMClassInfo::PostTransplant Don't call me!");
-  return NS_OK;
+  MOZ_CRASH("nsDOMClassInfo::PostTransplant Don't call me!");
 }
 
 NS_IMETHODIMP
@@ -3147,7 +3143,7 @@ DefineIDBInterfaceConstants(JSContext *cx, JS::Handle<JSObject*> obj, const nsII
     interface = IDBConstant::IDBTransaction;
   }
   else {
-    MOZ_NOT_REACHED("unexpected IID");
+    MOZ_CRASH("unexpected IID");
   }
 
   for (int8_t i = 0; i < (int8_t)mozilla::ArrayLength(sIDBConstants); ++i) {
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index ea176945c75..05a49dfbf42 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -311,7 +311,7 @@ nsFocusManager::GetRedirectedFocus(nsIContent* aContent)
         if (!doc)
           return nullptr;
 
-        nsINodeList* children = doc->BindingManager()->GetXBLChildNodesFor(aContent);
+        nsINodeList* children = doc->BindingManager()->GetAnonymousNodesFor(aContent);
         if (children) {
           nsIContent* child = children->Item(0);
           if (child && child->Tag() == nsGkAtoms::slider)
diff --git a/dom/base/nsScreen.cpp b/dom/base/nsScreen.cpp
index 27350672648..17a240f7474 100644
--- a/dom/base/nsScreen.cpp
+++ b/dom/base/nsScreen.cpp
@@ -198,7 +198,7 @@ nsScreen::GetMozOrientation(nsString& aOrientation)
     break;
   case eScreenOrientation_None:
   default:
-    MOZ_NOT_REACHED("Unacceptable mOrientation value");
+    MOZ_CRASH("Unacceptable mOrientation value");
   }
 }
 
@@ -371,8 +371,7 @@ nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations,
 
   // This is only for compilers that don't understand that the previous switch
   // will always return.
-  MOZ_NOT_REACHED("unexpected lock orientation permission value");
-  return false;
+  MOZ_CRASH("unexpected lock orientation permission value");
 }
 
 void
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 3f716a55d06..643a931a108 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -5057,7 +5057,7 @@ class CGMethodCall(CGThing):
                      argCountCases,
                      CGGeneric('return ThrowErrorMessage(cx, MSG_MISSING_ARGUMENTS, "%s");\n' % methodName)))
         overloadCGThings.append(
-            CGGeneric('MOZ_NOT_REACHED("We have an always-returning default case");\n'
+            CGGeneric('MOZ_CRASH("We have an always-returning default case");\n'
                       'return false;'))
         self.cgRoot = CGWrapper(CGIndenter(CGList(overloadCGThings, "\n")),
                                 pre="\n")
diff --git a/dom/bindings/DOMJSProxyHandler.cpp b/dom/bindings/DOMJSProxyHandler.cpp
index b185e6cf915..79c9c32fd21 100644
--- a/dom/bindings/DOMJSProxyHandler.cpp
+++ b/dom/bindings/DOMJSProxyHandler.cpp
@@ -89,12 +89,6 @@ DOMProxyHandler::GetAndClearExpandoObject(JSObject* obj)
     if (v.isUndefined()) {
       return nullptr;
     }
-
-    nsISupports* native = UnwrapDOMObject<nsISupports>(obj);
-    nsWrapperCache* cache;
-    CallQueryInterface(native, &cache);
-    cache->SetPreservingWrapper(false);
-    nsContentUtils::DropJSObjects(native);
     expandoAndGeneration->expando = UndefinedValue();
   }
 
diff --git a/dom/bindings/DOMJSProxyHandler.h b/dom/bindings/DOMJSProxyHandler.h
index 269edf1e1b3..b25529d428e 100644
--- a/dom/bindings/DOMJSProxyHandler.h
+++ b/dom/bindings/DOMJSProxyHandler.h
@@ -70,6 +70,7 @@ public:
     v = expandoAndGeneration->expando;
     return v.isUndefined() ? nullptr : &v.toObject();
   }
+  /* GetAndClearExpandoObject does not DROP or clear the preserving wrapper flag. */
   static JSObject* GetAndClearExpandoObject(JSObject* obj);
   static JSObject* EnsureExpandoObject(JSContext* cx,
                                        JS::Handle<JSObject*> obj);
diff --git a/dom/bindings/PrimitiveConversions.h b/dom/bindings/PrimitiveConversions.h
index 9ce36d0d1da..fcbbba41f7a 100644
--- a/dom/bindings/PrimitiveConversions.h
+++ b/dom/bindings/PrimitiveConversions.h
@@ -93,8 +93,7 @@ struct DisallowedConversion {
 private:
   static inline bool converter(JSContext* cx, JS::Handle<JS::Value> v,
                                jstype* retval) {
-    MOZ_NOT_REACHED("This should never be instantiated!");
-    return false;
+    MOZ_CRASH("This should never be instantiated!");
   }
 };
 
diff --git a/dom/bluetooth/BluetoothService.cpp b/dom/bluetooth/BluetoothService.cpp
index d2c71d9ad47..5a60462ab10 100644
--- a/dom/bluetooth/BluetoothService.cpp
+++ b/dom/bluetooth/BluetoothService.cpp
@@ -681,7 +681,7 @@ BluetoothService::HandleShutdown()
         }
 
         if (NS_FAILED(timer->Cancel())) {
-          MOZ_NOT_REACHED("Failed to cancel shutdown timer, this will crash!");
+          MOZ_CRASH("Failed to cancel shutdown timer, this will crash!");
         }
       }
       else {
diff --git a/dom/bluetooth/BluetoothUnixSocketConnector.cpp b/dom/bluetooth/BluetoothUnixSocketConnector.cpp
index 55db5d7f70c..e094bfe96be 100644
--- a/dom/bluetooth/BluetoothUnixSocketConnector.cpp
+++ b/dom/bluetooth/BluetoothUnixSocketConnector.cpp
@@ -93,7 +93,7 @@ BluetoothUnixSocketConnector::SetUp(int aFd)
   case BluetoothSocketType::SCO:
     break;
   default:
-    MOZ_NOT_REACHED("Unknown socket type!");
+    MOZ_CRASH("Unknown socket type!");
   }
 
   if (lm) {
@@ -181,7 +181,7 @@ BluetoothUnixSocketConnector::Create()
     fd = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_L2CAP);
     break;
   default:
-    MOZ_NOT_REACHED();
+    MOZ_CRASH();
   }
 
   if (fd < 0) {
@@ -262,7 +262,7 @@ BluetoothUnixSocketConnector::GetSocketAddr(const sockaddr_any& aAddr,
     get_bdaddr_as_string((bdaddr_t*)(&aAddr.l2.l2_bdaddr), addr);
     break;
   default:
-    MOZ_NOT_REACHED("Socket should be either RFCOMM or SCO!");
+    MOZ_CRASH("Socket should be either RFCOMM or SCO!");
   }
   aAddrStr.AssignASCII(addr);
 }
diff --git a/dom/bluetooth/ipc/BluetoothChild.cpp b/dom/bluetooth/ipc/BluetoothChild.cpp
index e7b6ec9f75c..ce590212be9 100644
--- a/dom/bluetooth/ipc/BluetoothChild.cpp
+++ b/dom/bluetooth/ipc/BluetoothChild.cpp
@@ -117,8 +117,7 @@ BluetoothChild::RecvNotificationsStopped()
 PBluetoothRequestChild*
 BluetoothChild::AllocPBluetoothRequest(const Request& aRequest)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a request!");
-  return nullptr;
+  MOZ_CRASH("Caller is supposed to manually construct a request!");
 }
 
 bool
diff --git a/dom/bluetooth/ipc/BluetoothParent.cpp b/dom/bluetooth/ipc/BluetoothParent.cpp
index 11d85c84259..f4619a77d3d 100644
--- a/dom/bluetooth/ipc/BluetoothParent.cpp
+++ b/dom/bluetooth/ipc/BluetoothParent.cpp
@@ -67,8 +67,7 @@ public:
   virtual bool
   ParseSuccessfulReply(JS::Value* aValue) MOZ_OVERRIDE
   {
-    MOZ_NOT_REACHED("This should never be called!");
-    return false;
+    MOZ_CRASH("This should never be called!");
   }
 };
 
@@ -232,12 +231,10 @@ BluetoothParent::RecvPBluetoothRequestConstructor(
     case Request::TIsScoConnectedRequest:
       return actor->DoRequest(aRequest.get_IsScoConnectedRequest());
     default:
-      MOZ_NOT_REACHED("Unknown type!");
-      return false;
+      MOZ_CRASH("Unknown type!");
   }
 
-  MOZ_NOT_REACHED("Should never get here!");
-  return false;
+  MOZ_CRASH("Should never get here!");
 }
 
 PBluetoothRequestParent*
diff --git a/dom/bluetooth/ipc/BluetoothServiceChildProcess.cpp b/dom/bluetooth/ipc/BluetoothServiceChildProcess.cpp
index e2fdaa7206e..03a04a961b2 100644
--- a/dom/bluetooth/ipc/BluetoothServiceChildProcess.cpp
+++ b/dom/bluetooth/ipc/BluetoothServiceChildProcess.cpp
@@ -194,8 +194,7 @@ BluetoothServiceChildProcess::GetScoSocket(
                                     bool aEncrypt,
                                     mozilla::ipc::UnixSocketConsumer* aConsumer)
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("This should never be called!");
 }
 
 nsresult
@@ -203,16 +202,14 @@ BluetoothServiceChildProcess::GetServiceChannel(const nsAString& aDeviceAddress,
                                                 const nsAString& aServiceUuid,
                                                 BluetoothProfileManagerBase* aManager)
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("This should never be called!");
 }
 
 bool
 BluetoothServiceChildProcess::UpdateSdpRecords(const nsAString& aDeviceAddress,
                                                BluetoothProfileManagerBase* aManager)
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return false;
+  MOZ_CRASH("This should never be called!");
 }
 
 bool
@@ -364,35 +361,30 @@ BluetoothServiceChildProcess::HandleShutdown()
 nsresult
 BluetoothServiceChildProcess::StartInternal()
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("This should never be called!");
 }
 
 nsresult
 BluetoothServiceChildProcess::StopInternal()
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("This should never be called!");
 }
 
 bool
 BluetoothServiceChildProcess::IsEnabledInternal()
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return false;
+  MOZ_CRASH("This should never be called!");
 }
 
 bool
 BluetoothServiceChildProcess::IsConnected(uint16_t aProfileId)
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return false;
+  MOZ_CRASH("This should never be called!");
 }
 
 nsresult
 BluetoothServiceChildProcess::SendSinkMessage(const nsAString& aDeviceAddresses,
                                               const nsAString& aMessage)
 {
-  MOZ_NOT_REACHED("This should never be called!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("This should never be called!");
 }
diff --git a/dom/bluetooth/moz.build b/dom/bluetooth/moz.build
index 9d751ad0050..3e57c7736ca 100644
--- a/dom/bluetooth/moz.build
+++ b/dom/bluetooth/moz.build
@@ -62,7 +62,7 @@ if CONFIG['MOZ_B2G_BT']:
             ]
 
 EXPORTS.mozilla.dom.bluetooth.ipc += [
-    'BluetoothMessageUtils.h',
+    'ipc/BluetoothMessageUtils.h',
 ]
 
 EXPORTS.mozilla.dom.bluetooth += [
diff --git a/dom/fm/FMRadio.cpp b/dom/fm/FMRadio.cpp
index 49a61acae91..4e6c6977c8d 100644
--- a/dom/fm/FMRadio.cpp
+++ b/dom/fm/FMRadio.cpp
@@ -240,8 +240,7 @@ void FMRadio::Notify(const FMRadioOperationInformation& info)
       DispatchTrustedEvent(RADIO_SEEK_COMPLETE_EVENT_NAME);
       break;
     default:
-      MOZ_NOT_REACHED();
-      return;
+      MOZ_CRASH();
   }
 }
 
diff --git a/dom/indexedDB/AsyncConnectionHelper.cpp b/dom/indexedDB/AsyncConnectionHelper.cpp
index eda9ec7b8cd..5af48e16c13 100644
--- a/dom/indexedDB/AsyncConnectionHelper.cpp
+++ b/dom/indexedDB/AsyncConnectionHelper.cpp
@@ -254,7 +254,7 @@ AsyncConnectionHelper::Run()
       }
 
       default:
-        MOZ_NOT_REACHED("Unknown value for ChildProcessSendResult!");
+        MOZ_CRASH("Unknown value for ChildProcessSendResult!");
     }
 
     NS_ASSERTION(gCurrentTransaction == mTransaction, "Should be unchanged!");
diff --git a/dom/indexedDB/IDBDatabase.cpp b/dom/indexedDB/IDBDatabase.cpp
index 4a907783cb6..660977a74eb 100644
--- a/dom/indexedDB/IDBDatabase.cpp
+++ b/dom/indexedDB/IDBDatabase.cpp
@@ -136,8 +136,7 @@ public:
                                             const ResponseValue& aResponseValue)
                                             MOZ_OVERRIDE
   {
-    MOZ_NOT_REACHED("Should never get here!");
-    return NS_ERROR_UNEXPECTED;
+    MOZ_CRASH("Should never get here!");
   }
 
 private:
@@ -869,8 +868,7 @@ nsresult
 NoRequestDatabaseHelper::UnpackResponseFromParentProcess(
                                             const ResponseValue& aResponseValue)
 {
-  MOZ_NOT_REACHED("Should never get here!");
-  return NS_ERROR_UNEXPECTED;
+  MOZ_CRASH("Should never get here!");
 }
 
 nsresult
diff --git a/dom/indexedDB/OpenDatabaseHelper.cpp b/dom/indexedDB/OpenDatabaseHelper.cpp
index ac8569b5c24..eb20057ba61 100644
--- a/dom/indexedDB/OpenDatabaseHelper.cpp
+++ b/dom/indexedDB/OpenDatabaseHelper.cpp
@@ -1479,8 +1479,7 @@ protected:
                                             const ResponseValue& aResponseValue)
                                             MOZ_OVERRIDE
   {
-    MOZ_NOT_REACHED("Should never get here!");
-    return NS_ERROR_UNEXPECTED;
+    MOZ_CRASH("Should never get here!");
   }
 
   uint64_t RequestedVersion() const
@@ -1559,8 +1558,7 @@ protected:
                                             const ResponseValue& aResponseValue)
                                             MOZ_OVERRIDE
   {
-    MOZ_NOT_REACHED("Should never get here!");
-    return NS_ERROR_UNEXPECTED;
+    MOZ_CRASH("Should never get here!");
   }
 
 private:
diff --git a/dom/indexedDB/ProfilerHelpers.h b/dom/indexedDB/ProfilerHelpers.h
index 0f9fa677f5f..271a2f29e06 100644
--- a/dom/indexedDB/ProfilerHelpers.h
+++ b/dom/indexedDB/ProfilerHelpers.h
@@ -73,7 +73,7 @@ public:
         AppendLiteral("\"versionchange\"");
         break;
       default:
-        MOZ_NOT_REACHED("Unknown mode!");
+        MOZ_CRASH("Unknown mode!");
     };
   }
 
@@ -154,7 +154,7 @@ public:
         AppendLiteral("\"prevunique\"");
         break;
       default:
-        MOZ_NOT_REACHED("Unknown direction!");
+        MOZ_CRASH("Unknown direction!");
     };
   }
 };
diff --git a/dom/indexedDB/ipc/IndexedDBChild.cpp b/dom/indexedDB/ipc/IndexedDBChild.cpp
index 652b1dee494..db79e7f2f91 100644
--- a/dom/indexedDB/ipc/IndexedDBChild.cpp
+++ b/dom/indexedDB/ipc/IndexedDBChild.cpp
@@ -226,8 +226,7 @@ IndexedDBChild::DeallocPIndexedDBDatabase(PIndexedDBDatabaseChild* aActor)
 PIndexedDBDeleteDatabaseRequestChild*
 IndexedDBChild::AllocPIndexedDBDeleteDatabaseRequest(const nsString& aName)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a request!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct a request!");
 }
 
 bool
@@ -649,8 +648,7 @@ IndexedDBTransactionChild::RecvComplete(const CompleteParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown union type!");
-      return false;
+      MOZ_CRASH("Unknown union type!");
   }
 
   FireCompleteEvent(resultCode);
@@ -661,8 +659,7 @@ PIndexedDBObjectStoreChild*
 IndexedDBTransactionChild::AllocPIndexedDBObjectStore(
                                     const ObjectStoreConstructorParams& aParams)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct an object store!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct an object store!");
 }
 
 bool
@@ -760,8 +757,7 @@ PIndexedDBRequestChild*
 IndexedDBObjectStoreChild::AllocPIndexedDBRequest(
                                         const ObjectStoreRequestParams& aParams)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a request!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct a request!");
 }
 
 bool
@@ -776,8 +772,7 @@ PIndexedDBIndexChild*
 IndexedDBObjectStoreChild::AllocPIndexedDBIndex(
                                           const IndexConstructorParams& aParams)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct an index!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct an index!");
 }
 
 bool
@@ -892,8 +887,7 @@ IndexedDBIndexChild::RecvPIndexedDBCursorConstructor(
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown union type!");
-      return false;
+      MOZ_CRASH("Unknown union type!");
   }
 
   actor->SetCursor(cursor);
@@ -903,8 +897,7 @@ IndexedDBIndexChild::RecvPIndexedDBCursorConstructor(
 PIndexedDBRequestChild*
 IndexedDBIndexChild::AllocPIndexedDBRequest(const IndexRequestParams& aParams)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a request!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct a request!");
 }
 
 bool
@@ -981,8 +974,7 @@ IndexedDBCursorChild::ActorDestroy(ActorDestroyReason aWhy)
 PIndexedDBRequestChild*
 IndexedDBCursorChild::AllocPIndexedDBRequest(const CursorRequestParams& aParams)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a request!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct a request!");
 }
 
 bool
@@ -1034,8 +1026,7 @@ IndexedDBRequestChildBase::Disconnect()
 bool
 IndexedDBRequestChildBase::Recv__delete__(const ResponseValue& aResponse)
 {
-  MOZ_NOT_REACHED("This should be overridden!");
-  return false;
+  MOZ_CRASH("This should be overridden!");
 }
 
 /*******************************************************************************
@@ -1093,8 +1084,7 @@ IndexedDBObjectStoreRequestChild::Recv__delete__(const ResponseValue& aResponse)
       break;
 
     default:
-      MOZ_NOT_REACHED("Received invalid response parameters!");
-      return false;
+      MOZ_CRASH("Received invalid response parameters!");
   }
 
   nsresult rv = mHelper->OnParentProcessRequestComplete(aResponse);
@@ -1152,8 +1142,7 @@ IndexedDBIndexRequestChild::Recv__delete__(const ResponseValue& aResponse)
       break;
 
     default:
-      MOZ_NOT_REACHED("Received invalid response parameters!");
-      return false;
+      MOZ_CRASH("Received invalid response parameters!");
   }
 
   nsresult rv = mHelper->OnParentProcessRequestComplete(aResponse);
@@ -1196,8 +1185,7 @@ IndexedDBCursorRequestChild::Recv__delete__(const ResponseValue& aResponse)
       break;
 
     default:
-      MOZ_NOT_REACHED("Received invalid response parameters!");
-      return false;
+      MOZ_CRASH("Received invalid response parameters!");
   }
 
   nsresult rv = mHelper->OnParentProcessRequestComplete(aResponse);
@@ -1282,15 +1270,13 @@ IPCOpenDatabaseHelper::UnpackResponseFromParentProcess(
 AsyncConnectionHelper::ChildProcessSendResult
 IPCOpenDatabaseHelper::SendResponseToChildProcess(nsresult aResultCode)
 {
-  MOZ_NOT_REACHED("Don't call me!");
-  return Error;
+  MOZ_CRASH("Don't call me!");
 }
 
 nsresult
 IPCOpenDatabaseHelper::DoDatabaseWork(mozIStorageConnection* aConnection)
 {
-  MOZ_NOT_REACHED("Don't call me!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("Don't call me!");
 }
 
 nsresult
@@ -1311,15 +1297,13 @@ IPCSetVersionHelper::UnpackResponseFromParentProcess(
 AsyncConnectionHelper::ChildProcessSendResult
 IPCSetVersionHelper::SendResponseToChildProcess(nsresult aResultCode)
 {
-  MOZ_NOT_REACHED("Don't call me!");
-  return Error;
+  MOZ_CRASH("Don't call me!");
 }
 
 nsresult
 IPCSetVersionHelper::DoDatabaseWork(mozIStorageConnection* aConnection)
 {
-  MOZ_NOT_REACHED("Don't call me!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("Don't call me!");
 }
 
 already_AddRefed<nsIDOMEvent>
@@ -1343,15 +1327,13 @@ nsresult
 IPCDeleteDatabaseHelper::UnpackResponseFromParentProcess(
                                             const ResponseValue& aResponseValue)
 {
-  MOZ_NOT_REACHED("Don't call me!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("Don't call me!");
 }
 
 AsyncConnectionHelper::ChildProcessSendResult
 IPCDeleteDatabaseHelper::SendResponseToChildProcess(nsresult aResultCode)
 {
-  MOZ_NOT_REACHED("Don't call me!");
-  return Error;
+  MOZ_CRASH("Don't call me!");
 }
 
 nsresult
@@ -1364,6 +1346,5 @@ IPCDeleteDatabaseHelper::GetSuccessResult(JSContext* aCx, JS::MutableHandle<JS::
 nsresult
 IPCDeleteDatabaseHelper::DoDatabaseWork(mozIStorageConnection* aConnection)
 {
-  MOZ_NOT_REACHED("Don't call me!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("Don't call me!");
 }
diff --git a/dom/indexedDB/ipc/IndexedDBParent.cpp b/dom/indexedDB/ipc/IndexedDBParent.cpp
index 1b4942d1cb3..a551269b280 100644
--- a/dom/indexedDB/ipc/IndexedDBParent.cpp
+++ b/dom/indexedDB/ipc/IndexedDBParent.cpp
@@ -310,8 +310,7 @@ IndexedDBDatabaseParent::HandleEvent(nsIDOMEvent* aEvent)
     return NS_OK;
   }
 
-  MOZ_NOT_REACHED("Unexpected message!");
-  return NS_ERROR_UNEXPECTED;
+  MOZ_CRASH("Unexpected message!");
 }
 
 void
@@ -413,7 +412,7 @@ IndexedDBDatabaseParent::HandleRequestEvent(nsIDOMEvent* aEvent,
 
   nsAutoTArray<nsString, 20> objectStoreNames;
   if (!dbInfo->GetObjectStoreNames(objectStoreNames)) {
-    MOZ_NOT_REACHED("This should never fail!");
+    MOZ_CRASH("This should never fail!");
   }
 
   InfallibleTArray<ObjectStoreInfoGuts> objectStoreInfos;
@@ -510,8 +509,7 @@ IndexedDBDatabaseParent::HandleRequestEvent(nsIDOMEvent* aEvent,
     return NS_OK;
   }
 
-  MOZ_NOT_REACHED("Unexpected message type!");
-  return NS_ERROR_UNEXPECTED;
+  MOZ_CRASH("Unexpected message type!");
 }
 
 nsresult
@@ -556,8 +554,7 @@ IndexedDBDatabaseParent::HandleDatabaseEvent(nsIDOMEvent* aEvent,
     return NS_OK;
   }
 
-  MOZ_NOT_REACHED("Unexpected message type!");
-  return NS_ERROR_UNEXPECTED;
+  MOZ_CRASH("Unexpected message type!");
 }
 
 void
@@ -780,8 +777,7 @@ IndexedDBTransactionParent::RecvAllRequestsFinished()
 bool
 IndexedDBTransactionParent::RecvDeleteObjectStore(const nsString& aName)
 {
-  MOZ_NOT_REACHED("Should be overridden, don't call me!");
-  return false;
+  MOZ_CRASH("Should be overridden, don't call me!");
 }
 
 bool
@@ -824,12 +820,10 @@ IndexedDBTransactionParent::RecvPIndexedDBObjectStoreConstructor(
 
   if (aParams.type() ==
       ObjectStoreConstructorParams::TCreateObjectStoreParams) {
-    MOZ_NOT_REACHED("Should be overridden, don't call me!");
-    return false;
+    MOZ_CRASH("Should be overridden, don't call me!");
   }
 
-  MOZ_NOT_REACHED("Unknown param type!");
-  return false;
+  MOZ_CRASH("Unknown param type!");
 }
 
 PIndexedDBObjectStoreParent*
@@ -1029,12 +1023,10 @@ IndexedDBCursorParent::RecvPIndexedDBRequestConstructor(
       return actor->Continue(aParams.get_ContinueParams());
 
     default:
-      MOZ_NOT_REACHED("Unknown type!");
-      return false;
+      MOZ_CRASH("Unknown type!");
   }
 
-  MOZ_NOT_REACHED("Should never get here!");
-  return false;
+  MOZ_CRASH("Should never get here!");
 }
 
 PIndexedDBRequestParent*
@@ -1086,8 +1078,7 @@ IndexedDBObjectStoreParent::ActorDestroy(ActorDestroyReason aWhy)
 bool
 IndexedDBObjectStoreParent::RecvDeleteIndex(const nsString& aName)
 {
-  MOZ_NOT_REACHED("Should be overridden, don't call me!");
-  return false;
+  MOZ_CRASH("Should be overridden, don't call me!");
 }
 
 bool
@@ -1139,12 +1130,10 @@ IndexedDBObjectStoreParent::RecvPIndexedDBRequestConstructor(
       return actor->OpenCursor(aParams.get_OpenCursorParams());
 
     default:
-      MOZ_NOT_REACHED("Unknown type!");
-      return false;
+      MOZ_CRASH("Unknown type!");
   }
 
-  MOZ_NOT_REACHED("Should never get here!");
-  return false;
+  MOZ_CRASH("Should never get here!");
 }
 
 bool
@@ -1183,12 +1172,10 @@ IndexedDBObjectStoreParent::RecvPIndexedDBIndexConstructor(
   }
 
   if (aParams.type() == IndexConstructorParams::TCreateIndexParams) {
-    MOZ_NOT_REACHED("Should be overridden, don't call me!");
-    return false;
+    MOZ_CRASH("Should be overridden, don't call me!");
   }
 
-  MOZ_NOT_REACHED("Unknown param type!");
-  return false;
+  MOZ_CRASH("Unknown param type!");
 }
 
 PIndexedDBRequestParent*
@@ -1225,8 +1212,7 @@ PIndexedDBCursorParent*
 IndexedDBObjectStoreParent::AllocPIndexedDBCursor(
                               const ObjectStoreCursorConstructorParams& aParams)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a cursor!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct a cursor!");
 }
 
 bool
@@ -1415,12 +1401,10 @@ IndexedDBIndexParent::RecvPIndexedDBRequestConstructor(
       return actor->OpenKeyCursor(aParams.get_OpenKeyCursorParams());
 
     default:
-      MOZ_NOT_REACHED("Unknown type!");
-      return false;
+      MOZ_CRASH("Unknown type!");
   }
 
-  MOZ_NOT_REACHED("Should never get here!");
-  return false;
+  MOZ_CRASH("Should never get here!");
 }
 
 PIndexedDBRequestParent*
@@ -1440,8 +1424,7 @@ PIndexedDBCursorParent*
 IndexedDBIndexParent::AllocPIndexedDBCursor(
                                     const IndexCursorConstructorParams& aParams)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a cursor!");
-  return NULL;
+  MOZ_CRASH("Caller is supposed to manually construct a cursor!");
 }
 
 bool
@@ -1572,8 +1555,7 @@ IndexedDBObjectStoreRequestParent::GetAll(const GetAllParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   {
@@ -1712,8 +1694,7 @@ IndexedDBObjectStoreRequestParent::Count(const CountParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   nsRefPtr<IDBRequest> request;
@@ -1752,8 +1733,7 @@ IndexedDBObjectStoreRequestParent::OpenCursor(const OpenCursorParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   size_t direction = static_cast<size_t>(aParams.direction());
@@ -1875,8 +1855,7 @@ IndexedDBIndexRequestParent::GetAll(const GetAllParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   {
@@ -1915,8 +1894,7 @@ IndexedDBIndexRequestParent::GetAllKeys(const GetAllKeysParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   {
@@ -1953,8 +1931,7 @@ IndexedDBIndexRequestParent::Count(const CountParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   nsRefPtr<IDBRequest> request;
@@ -1993,8 +1970,7 @@ IndexedDBIndexRequestParent::OpenCursor(const OpenCursorParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   size_t direction = static_cast<size_t>(aParams.direction());
@@ -2035,8 +2011,7 @@ IndexedDBIndexRequestParent::OpenKeyCursor(const OpenKeyCursorParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown param type!");
-      return false;
+      MOZ_CRASH("Unknown param type!");
   }
 
   size_t direction = static_cast<size_t>(aParams.direction());
@@ -2202,6 +2177,5 @@ IndexedDBDeleteDatabaseRequestParent::SetOpenRequest(
  NS_IMETHODIMP
  WeakEventListenerBase::HandleEvent(nsIDOMEvent* aEvent)
 {
-  MOZ_NOT_REACHED("This must be overridden!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("This must be overridden!");
 }
diff --git a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
index 6def8c3b06c..57508a25fa9 100644
--- a/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLIFrameElement.idl
@@ -16,7 +16,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(21ffbe98-51f5-499e-8d6f-612ae798c1e1)]
+[scriptable, uuid(60D9BCF1-3B0C-4704-AE8C-5B6AC0180B2E)]
 interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
 {
            attribute DOMString        align;
@@ -28,6 +28,7 @@ interface nsIDOMHTMLIFrameElement : nsIDOMHTMLElement
            attribute DOMString        name;
            attribute DOMString        scrolling;
            attribute DOMString        src;
+           attribute DOMString        srcdoc;
            attribute DOMString        width;
   // Introduced in DOM Level 2:
   readonly attribute nsIDOMDocument   contentDocument;
diff --git a/dom/ipc/Blob.cpp b/dom/ipc/Blob.cpp
index 2500b5db127..b1107920999 100644
--- a/dom/ipc/Blob.cpp
+++ b/dom/ipc/Blob.cpp
@@ -90,8 +90,7 @@ public:
   {
     // See InputStreamUtils.cpp to see how deserialization of a
     // RemoteInputStream is special-cased.
-    MOZ_NOT_REACHED("RemoteInputStream should never be deserialized");
-    return false;
+    MOZ_CRASH("RemoteInputStream should never be deserialized");
   }
 
   void
@@ -626,7 +625,7 @@ BlobTraits<Parent>::BaseType::NoteRunnableCompleted(
     }
   }
 
-  MOZ_NOT_REACHED("Runnable not in our array!");
+  MOZ_CRASH("Runnable not in our array!");
 }
 
 template <ActorFlavorEnum ActorFlavor>
@@ -1079,7 +1078,7 @@ Blob<ActorFlavor>::Create(const ConstructorParamsType& aParams)
     }
 
     default:
-      MOZ_NOT_REACHED("Unknown params!");
+      MOZ_CRASH("Unknown params!");
   }
 
   return nullptr;
@@ -1185,13 +1184,13 @@ Blob<ActorFlavor>::CreateRemoteBlob(const ConstructorParamsType& aParams)
     }
 
     default:
-      MOZ_NOT_REACHED("Unknown params!");
+      MOZ_CRASH("Unknown params!");
   }
 
   MOZ_ASSERT(remoteBlob);
 
   if (NS_FAILED(remoteBlob->SetMutable(false))) {
-    MOZ_NOT_REACHED("Failed to make remote blob immutable!");
+    MOZ_CRASH("Failed to make remote blob immutable!");
   }
 
   return remoteBlob.forget();
@@ -1278,7 +1277,7 @@ Blob<ActorFlavor>::RecvResolveMystery(const ResolveMysteryParams& aParams)
     }
 
     default:
-      MOZ_NOT_REACHED("Unknown params!");
+      MOZ_CRASH("Unknown params!");
   }
 
   return true;
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 930c1833c9a..64c2eaa307a 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -846,11 +846,9 @@ PBluetoothChild*
 ContentChild::AllocPBluetooth()
 {
 #ifdef MOZ_B2G_BT
-    MOZ_NOT_REACHED("No one should be allocating PBluetoothChild actors");
-    return nullptr;
+    MOZ_CRASH("No one should be allocating PBluetoothChild actors");
 #else
-    MOZ_NOT_REACHED("No support for bluetooth on this platform!");
-    return nullptr;
+    MOZ_CRASH("No support for bluetooth on this platform!");
 #endif
 }
 
@@ -861,8 +859,7 @@ ContentChild::DeallocPBluetooth(PBluetoothChild* aActor)
     delete aActor;
     return true;
 #else
-    MOZ_NOT_REACHED("No support for bluetooth on this platform!");
-    return false;
+    MOZ_CRASH("No support for bluetooth on this platform!");
 #endif
 }
 
@@ -870,8 +867,7 @@ PSpeechSynthesisChild*
 ContentChild::AllocPSpeechSynthesis()
 {
 #ifdef MOZ_WEBSPEECH
-    MOZ_NOT_REACHED("No one should be allocating PSpeechSynthesisChild actors");
-    return nullptr;
+    MOZ_CRASH("No one should be allocating PSpeechSynthesisChild actors");
 #else
     return nullptr;
 #endif
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 32161ffcc2d..3ec2626eefd 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -1992,8 +1992,7 @@ ContentParent::AllocPBluetooth()
     }
     return new mozilla::dom::bluetooth::BluetoothParent();
 #else
-    MOZ_NOT_REACHED("No support for bluetooth on this platform!");
-    return nullptr;
+    MOZ_CRASH("No support for bluetooth on this platform!");
 #endif
 }
 
@@ -2004,8 +2003,7 @@ ContentParent::DeallocPBluetooth(PBluetoothParent* aActor)
     delete aActor;
     return true;
 #else
-    MOZ_NOT_REACHED("No support for bluetooth on this platform!");
-    return false;
+    MOZ_CRASH("No support for bluetooth on this platform!");
 #endif
 }
 
@@ -2018,8 +2016,7 @@ ContentParent::RecvPBluetoothConstructor(PBluetoothParent* aActor)
 
     return static_cast<BluetoothParent*>(aActor)->InitWithService(btService);
 #else
-    MOZ_NOT_REACHED("No support for bluetooth on this platform!");
-    return false;
+    MOZ_CRASH("No support for bluetooth on this platform!");
 #endif
 }
 
diff --git a/dom/ipc/StructuredCloneUtils.cpp b/dom/ipc/StructuredCloneUtils.cpp
index 3b5fb963a81..00871f4da56 100644
--- a/dom/ipc/StructuredCloneUtils.cpp
+++ b/dom/ipc/StructuredCloneUtils.cpp
@@ -48,12 +48,8 @@ Read(JSContext* aCx, JSStructuredCloneReader* aReader, uint32_t aTag,
       // File should not be mutable.
       nsCOMPtr<nsIMutable> mutableFile = do_QueryInterface(file);
       bool isMutable;
-      if (NS_FAILED(mutableFile->GetMutable(&isMutable))) {
-        MOZ_NOT_REACHED("GetMutable failed!");
-      }
-      else {
-        MOZ_ASSERT(!isMutable);
-      }
+      MOZ_ASSERT(NS_SUCCEEDED(mutableFile->GetMutable(&isMutable)));
+      MOZ_ASSERT(!isMutable);
     }
 #endif
 
@@ -81,12 +77,8 @@ Read(JSContext* aCx, JSStructuredCloneReader* aReader, uint32_t aTag,
       // Blob should not be mutable.
       nsCOMPtr<nsIMutable> mutableBlob = do_QueryInterface(blob);
       bool isMutable;
-      if (NS_FAILED(mutableBlob->GetMutable(&isMutable))) {
-        MOZ_NOT_REACHED("GetMutable failed!");
-      }
-      else {
-        MOZ_ASSERT(!isMutable);
-      }
+      MOZ_ASSERT(NS_SUCCEEDED(mutableBlob->GetMutable(&isMutable)));
+      MOZ_ASSERT(!isMutable);
     }
 #endif
 
diff --git a/dom/mobilemessage/src/MmsMessage.cpp b/dom/mobilemessage/src/MmsMessage.cpp
index 5d7df4e82b3..d76f21455ba 100644
--- a/dom/mobilemessage/src/MmsMessage.cpp
+++ b/dom/mobilemessage/src/MmsMessage.cpp
@@ -366,8 +366,7 @@ MmsMessage::GetDelivery(nsAString& aDelivery)
     case eDeliveryState_Unknown:
     case eDeliveryState_EndGuard:
     default:
-      MOZ_NOT_REACHED("We shouldn't get any other delivery state!");
-      return NS_ERROR_UNEXPECTED;
+      MOZ_CRASH("We shouldn't get any other delivery state!");
   }
 
   return NS_OK;
@@ -409,8 +408,7 @@ MmsMessage::GetDeliveryStatus(JSContext* aCx, JS::Value* aDeliveryStatus)
         break;
       case eDeliveryStatus_EndGuard:
       default:
-        MOZ_NOT_REACHED("We shouldn't get any other delivery status!");
-        return NS_ERROR_UNEXPECTED;
+        MOZ_CRASH("We shouldn't get any other delivery status!");
     }
     tempStrArray.AppendElement(statusStr);
   }
diff --git a/dom/mobilemessage/src/MobileMessageCallback.cpp b/dom/mobilemessage/src/MobileMessageCallback.cpp
index 3b5961d7517..8773d61c5bf 100644
--- a/dom/mobilemessage/src/MobileMessageCallback.cpp
+++ b/dom/mobilemessage/src/MobileMessageCallback.cpp
@@ -92,8 +92,7 @@ MobileMessageCallback::NotifyError(int32_t aError)
       mDOMRequest->FireError(NS_LITERAL_STRING("RadioDisabledError"));
       break;
     default: // SUCCESS_NO_ERROR is handled above.
-      MOZ_NOT_REACHED("Should never get here!");
-      return NS_ERROR_FAILURE;
+      MOZ_CRASH("Should never get here!");
   }
 
   return NS_OK;
diff --git a/dom/mobilemessage/src/MobileMessageCursorCallback.cpp b/dom/mobilemessage/src/MobileMessageCursorCallback.cpp
index 6e9c6842e7a..77af8722e44 100644
--- a/dom/mobilemessage/src/MobileMessageCursorCallback.cpp
+++ b/dom/mobilemessage/src/MobileMessageCursorCallback.cpp
@@ -48,8 +48,7 @@ MobileMessageCursorCallback::NotifyCursorError(int32_t aError)
       cursor->FireError(NS_LITERAL_STRING("InternalError"));
       break;
     default: // SUCCESS_NO_ERROR is handled above.
-      MOZ_NOT_REACHED("Should never get here!");
-      return NS_ERROR_FAILURE;
+      MOZ_CRASH("Should never get here!");
   }
 
   return NS_OK;
diff --git a/dom/mobilemessage/src/MobileMessageThread.cpp b/dom/mobilemessage/src/MobileMessageThread.cpp
index 613b82eb62f..28c9f00315d 100644
--- a/dom/mobilemessage/src/MobileMessageThread.cpp
+++ b/dom/mobilemessage/src/MobileMessageThread.cpp
@@ -186,8 +186,7 @@ MobileMessageThread::GetLastMessageType(nsAString& aLastMessageType)
       break;
     case eMessageType_EndGuard:
     default:
-      MOZ_NOT_REACHED("We shouldn't get any other message type!");
-      return NS_ERROR_UNEXPECTED;
+      MOZ_CRASH("We shouldn't get any other message type!");
   }
 
   return NS_OK;
diff --git a/dom/mobilemessage/src/SmsMessage.cpp b/dom/mobilemessage/src/SmsMessage.cpp
index 0015e57975f..f902c9076a9 100644
--- a/dom/mobilemessage/src/SmsMessage.cpp
+++ b/dom/mobilemessage/src/SmsMessage.cpp
@@ -178,8 +178,7 @@ SmsMessage::GetDelivery(nsAString& aDelivery)
     case eDeliveryState_Unknown:
     case eDeliveryState_EndGuard:
     default:
-      MOZ_NOT_REACHED("We shouldn't get any other delivery state!");
-      return NS_ERROR_UNEXPECTED;
+      MOZ_CRASH("We shouldn't get any other delivery state!");
   }
 
   return NS_OK;
@@ -203,8 +202,7 @@ SmsMessage::GetDeliveryStatus(nsAString& aDeliveryStatus)
       break;
     case eDeliveryStatus_EndGuard:
     default:
-      MOZ_NOT_REACHED("We shouldn't get any other delivery status!");
-      return NS_ERROR_UNEXPECTED;
+      MOZ_CRASH("We shouldn't get any other delivery status!");
   }
 
   return NS_OK;
@@ -251,8 +249,7 @@ SmsMessage::GetMessageClass(nsAString& aMessageClass)
       aMessageClass = MESSAGE_CLASS_CLASS_3;
       break;
     default:
-      MOZ_NOT_REACHED("We shouldn't get any other message class!");
-      return NS_ERROR_UNEXPECTED;
+      MOZ_CRASH("We shouldn't get any other message class!");
   }
 
   return NS_OK;
diff --git a/dom/mobilemessage/src/ipc/SmsChild.cpp b/dom/mobilemessage/src/ipc/SmsChild.cpp
index a34bb0602cf..006774c6508 100644
--- a/dom/mobilemessage/src/ipc/SmsChild.cpp
+++ b/dom/mobilemessage/src/ipc/SmsChild.cpp
@@ -30,8 +30,7 @@ CreateMessageFromMessageData(const MobileMessageData& aData)
       message = new SmsMessage(aData.get_SmsMessageData());
       break;
     default:
-      MOZ_NOT_REACHED("Unexpected type of MobileMessageData");
-      return nullptr;
+      MOZ_CRASH("Unexpected type of MobileMessageData");
   }
 
   return message.forget();
@@ -113,8 +112,7 @@ SmsChild::RecvNotifyDeliveryErrorMessage(const MobileMessageData& aData)
 PSmsRequestChild*
 SmsChild::AllocPSmsRequest(const IPCSmsRequest& aRequest)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a request!");
-  return nullptr;
+  MOZ_CRASH("Caller is supposed to manually construct a request!");
 }
 
 bool
@@ -127,8 +125,7 @@ SmsChild::DeallocPSmsRequest(PSmsRequestChild* aActor)
 PMobileMessageCursorChild*
 SmsChild::AllocPMobileMessageCursor(const IPCMobileMessageCursor& aCursor)
 {
-  MOZ_NOT_REACHED("Caller is supposed to manually construct a cursor!");
-  return nullptr;
+  MOZ_CRASH("Caller is supposed to manually construct a cursor!");
 }
 
 bool
@@ -200,8 +197,7 @@ SmsRequestChild::Recv__delete__(const MessageReply& aReply)
       mReplyRequest->NotifyMarkMessageReadFailed(aReply.get_ReplyMarkeMessageReadFail().error());
       break;
     default:
-      MOZ_NOT_REACHED("Received invalid response parameters!");
-      return false;
+      MOZ_CRASH("Received invalid response parameters!");
   }
 
   return true;
@@ -243,8 +239,7 @@ MobileMessageCursorChild::RecvNotifyResult(const MobileMessageCursorData& aData)
       result = new MobileMessageThread(aData.get_ThreadData());
       break;
     default:
-      MOZ_NOT_REACHED("Received invalid response parameters!");
-      return false;
+      MOZ_CRASH("Received invalid response parameters!");
   }
 
   mCursorCallback->NotifyCursorResult(result);
diff --git a/dom/mobilemessage/src/ipc/SmsParent.cpp b/dom/mobilemessage/src/ipc/SmsParent.cpp
index d2809db1109..d3507c33d4a 100644
--- a/dom/mobilemessage/src/ipc/SmsParent.cpp
+++ b/dom/mobilemessage/src/ipc/SmsParent.cpp
@@ -338,8 +338,7 @@ SmsParent::RecvPSmsRequestConstructor(PSmsRequestParent* aActor,
     case IPCSmsRequest::TMarkMessageReadRequest:
       return actor->DoRequest(aRequest.get_MarkMessageReadRequest());
     default:
-      MOZ_NOT_REACHED("Unknown type!");
-      break;
+      MOZ_CRASH("Unknown type!");
   }
 
   return false;
@@ -377,8 +376,7 @@ SmsParent::RecvPMobileMessageCursorConstructor(PMobileMessageCursorParent* aActo
     case IPCMobileMessageCursor::TCreateThreadCursorRequest:
       return actor->DoRequest(aRequest.get_CreateThreadCursorRequest());
     default:
-      MOZ_NOT_REACHED("Unknown type!");
-      break;
+      MOZ_CRASH("Unknown type!");
   }
 
   return false;
@@ -444,8 +442,7 @@ SmsRequestParent::DoRequest(const SendMessageRequest& aRequest)
     }
     break;
   default:
-    MOZ_NOT_REACHED("Unknown type of SendMessageRequest!");
-    return false;
+    MOZ_CRASH("Unknown type of SendMessageRequest!");
   }
   return true;
 }
@@ -740,8 +737,7 @@ MobileMessageCursorParent::NotifyCursorResult(nsISupports* aResult)
       ? NS_OK : NS_ERROR_FAILURE;
   }
 
-  MOZ_NOT_REACHED("Received invalid response parameters!");
-  return NS_ERROR_FAILURE;
+  MOZ_CRASH("Received invalid response parameters!");
 }
 
 NS_IMETHODIMP
diff --git a/dom/mobilemessage/src/moz.build b/dom/mobilemessage/src/moz.build
index 46824650f80..b00198f6f85 100644
--- a/dom/mobilemessage/src/moz.build
+++ b/dom/mobilemessage/src/moz.build
@@ -4,14 +4,21 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android':
+    mmsdir = 'android'
+elif CONFIG['MOZ_B2G_RIL']:
+    mmsdir = 'ril'
+else:
+    mmsdir = 'fallback'
+
 EXPORTS.mozilla.dom.mobilemessage += [
     'Constants.h',
     'MobileMessageCallback.h',
     'MobileMessageService.h',
-    'SmsChild.h',
-    'SmsParent.h',
     'SmsServicesFactory.h',
     'Types.h',
+    'ipc/SmsChild.h',
+    'ipc/SmsParent.h',
 ]
 
 if CONFIG['MOZ_B2G_RIL']:
@@ -23,8 +30,8 @@ if CONFIG['MOZ_B2G_RIL']:
     ]
 else:
     EXPORTS.mozilla.dom.mobilemessage += [
-        'MmsService.h',
-        'MobileMessageDatabaseService.h',
+        "%s/%s" % (mmsdir, 'MmsService.h'),
+        "%s/%s" % (mmsdir, 'MobileMessageDatabaseService.h'),
     ]
     CPP_SOURCES += [
         'MobileMessageDatabaseService.cpp',
diff --git a/dom/network/src/TCPSocketChild.cpp b/dom/network/src/TCPSocketChild.cpp
index 1e70561d587..157c0a7afa1 100644
--- a/dom/network/src/TCPSocketChild.cpp
+++ b/dom/network/src/TCPSocketChild.cpp
@@ -145,11 +145,11 @@ TCPSocketChild::RecvCallback(const nsString& aType,
       rv = mSocket->CallListenerData(aType, data.get_nsString());
 
     } else {
-      MOZ_NOT_REACHED("Invalid callback data type!");
+      MOZ_CRASH("Invalid callback data type!");
     }
 
   } else {
-    MOZ_NOT_REACHED("Invalid callback type!");
+    MOZ_CRASH("Invalid callback type!");
   }
   NS_ENSURE_SUCCESS(rv, true);
   return true;
diff --git a/dom/network/src/TCPSocketParent.cpp b/dom/network/src/TCPSocketParent.cpp
index 2fd00f0926f..1283e1147a8 100644
--- a/dom/network/src/TCPSocketParent.cpp
+++ b/dom/network/src/TCPSocketParent.cpp
@@ -112,8 +112,7 @@ TCPSocketParent::RecvData(const SendableData& aData)
       break;
 
     default:
-      MOZ_NOT_REACHED("unexpected SendableData type");
-      return false;
+      MOZ_CRASH("unexpected SendableData type");
   }
   return true;
 }
diff --git a/dom/power/PowerManagerService.cpp b/dom/power/PowerManagerService.cpp
index a9fac2d65bd..30e93c604da 100644
--- a/dom/power/PowerManagerService.cpp
+++ b/dom/power/PowerManagerService.cpp
@@ -119,8 +119,7 @@ PowerManagerService::Reboot()
   // To synchronize any unsaved user data before rebooting.
   SyncProfile();
   hal::Reboot();
-  MOZ_NOT_REACHED("hal::Reboot() shouldn't return");
-  return NS_OK;
+  MOZ_CRASH("hal::Reboot() shouldn't return");
 }
 
 NS_IMETHODIMP
@@ -130,8 +129,7 @@ PowerManagerService::PowerOff()
   // To synchronize any unsaved user data before powering off.
   SyncProfile();
   hal::PowerOff();
-  MOZ_NOT_REACHED("hal::PowerOff() shouldn't return");
-  return NS_OK;
+  MOZ_CRASH("hal::PowerOff() shouldn't return");
 }
 
 NS_IMETHODIMP
@@ -153,8 +151,7 @@ PowerManagerService::Restart()
   sync();
 #endif
   _exit(0);
-  MOZ_NOT_REACHED("_exit() shouldn't return");
-  return NS_OK;
+  MOZ_CRASH("_exit() shouldn't return");
 }
 
 NS_IMETHODIMP
diff --git a/dom/src/notification/Notification.cpp b/dom/src/notification/Notification.cpp
index 6ec479135ff..a03f209c074 100644
--- a/dom/src/notification/Notification.cpp
+++ b/dom/src/notification/Notification.cpp
@@ -254,7 +254,7 @@ NotificationTask::Run()
   case eClose:
     return mNotification->CloseInternal();
   default:
-    MOZ_NOT_REACHED("Unexpected action for NotificationTask.");
+    MOZ_CRASH("Unexpected action for NotificationTask.");
   }
 }
 
diff --git a/dom/webidl/Document.webidl b/dom/webidl/Document.webidl
index 2233af8d0ac..59f4902e338 100644
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -319,6 +319,12 @@ partial interface Document {
   attribute boolean styleSheetChangeEventsEnabled;
 };
 
+// Extension to give chrome JS the ability to determine when a document was
+// created to satisfy an iframe with srcdoc attribute.
+partial interface Document {
+  [ChromeOnly] readonly attribute boolean isSrcdocDocument;
+};
+
 Document implements XPathEvaluator;
 Document implements GlobalEventHandlers;
 Document implements NodeEventHandlers;
diff --git a/dom/webidl/HTMLIFrameElement.webidl b/dom/webidl/HTMLIFrameElement.webidl
index e919317edb4..1f68b0e4c25 100644
--- a/dom/webidl/HTMLIFrameElement.webidl
+++ b/dom/webidl/HTMLIFrameElement.webidl
@@ -14,7 +14,8 @@
 interface HTMLIFrameElement : HTMLElement {
   [SetterThrows, Pure]
            attribute DOMString src;
-           // attribute DOMString srcdoc;
+  [SetterThrows, Pure]
+           attribute DOMString srcdoc;
   [SetterThrows, Pure]
            attribute DOMString name;
   // [PutForwards=value] readonly attribute DOMSettableTokenList sandbox;
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index 110e213f0e2..49b81594d9f 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -749,7 +749,7 @@ CTypesActivityCallback(JSContext* aCx,
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown type flag!");
+      MOZ_CRASH("Unknown type flag!");
   }
 }
 
diff --git a/dom/workers/XMLHttpRequest.cpp b/dom/workers/XMLHttpRequest.cpp
index 9299cadad7e..52fdabe2083 100644
--- a/dom/workers/XMLHttpRequest.cpp
+++ b/dom/workers/XMLHttpRequest.cpp
@@ -263,8 +263,7 @@ ConvertStringToResponseType(const nsAString& aString)
     }
   }
 
-  MOZ_NOT_REACHED("Don't know anything about this response type!");
-  return XMLHttpRequestResponseType::_empty;
+  MOZ_CRASH("Don't know anything about this response type!");
 }
 
 enum
diff --git a/editor/libeditor/base/nsEditorCommands.cpp b/editor/libeditor/base/nsEditorCommands.cpp
index 389669c7b63..4f2890fce6f 100644
--- a/editor/libeditor/base/nsEditorCommands.cpp
+++ b/editor/libeditor/base/nsEditorCommands.cpp
@@ -590,7 +590,7 @@ nsDeleteCommand::DoCommand(const char* aCommandName,
   } else if (!nsCRT::strcmp("cmd_deleteToEndOfLine", aCommandName)) {
     deleteDir = nsIEditor::eToEndOfLine;
   } else {
-    MOZ_NOT_REACHED("Unrecognized nsDeleteCommand");
+    MOZ_CRASH("Unrecognized nsDeleteCommand");
   }
 
   return editor->DeleteSelection(deleteDir, nsIEditor::eStrip);
diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp
index 74a06ea2fd6..7a8e771186f 100644
--- a/extensions/cookie/nsPermissionManager.cpp
+++ b/extensions/cookie/nsPermissionManager.cpp
@@ -288,8 +288,7 @@ DeleteFromMozHostListener(nsPermissionManager* aManager)
 
 NS_IMETHODIMP DeleteFromMozHostListener::HandleResult(mozIStorageResultSet *)
 {
-  MOZ_NOT_REACHED("Should not get any results");
-  return NS_OK;
+  MOZ_CRASH("Should not get any results");
 }
 
 NS_IMETHODIMP DeleteFromMozHostListener::HandleError(mozIStorageError *)
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index ea7e17f0bbf..ce2ee75f349 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -1738,8 +1738,7 @@ GLContext::ReadPixelsIntoImageSurface(gfxImageSurface* dest)
             break;
 
         default:
-            MOZ_NOT_REACHED("Bad format.");
-            return;
+            MOZ_CRASH("Bad format.");
     }
     MOZ_ASSERT(dest->Stride() == dest->Width() * destPixelSize);
 
@@ -1772,8 +1771,7 @@ GLContext::ReadPixelsIntoImageSurface(gfxImageSurface* dest)
                 break;
             }
             default: {
-                MOZ_NOT_REACHED("Bad read format.");
-                return;
+                MOZ_CRASH("Bad read format.");
             }
         }
 
@@ -1794,8 +1792,7 @@ GLContext::ReadPixelsIntoImageSurface(gfxImageSurface* dest)
                 break;
             }
             default: {
-                MOZ_NOT_REACHED("Bad read type.");
-                return;
+                MOZ_CRASH("Bad read type.");
             }
         }
 
diff --git a/gfx/gl/GLContext.h b/gfx/gl/GLContext.h
index bdfe724dd56..df8190d0441 100644
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@@ -250,7 +250,7 @@ public:
     virtual GLLibraryEGL* GetLibraryEGL() { return nullptr; }
 
     virtual void MakeCurrent_EGLSurface(void* surf) {
-        MOZ_NOT_REACHED("Must be called against a GLContextEGL.");
+        MOZ_CRASH("Must be called against a GLContextEGL.");
     }
 
     /**
diff --git a/gfx/gl/GLContextProviderGLX.cpp b/gfx/gl/GLContextProviderGLX.cpp
index a36a3669168..9372484ee15 100644
--- a/gfx/gl/GLContextProviderGLX.cpp
+++ b/gfx/gl/GLContextProviderGLX.cpp
@@ -107,8 +107,7 @@ GLXLibrary::EnsureInitialized(LibType libType)
 #endif
             break;
         default:
-            MOZ_NOT_REACHED("Invalid GLX library type.");
-            return false;
+            MOZ_CRASH("Invalid GLX library type.");
         }
 
         ScopedGfxFeatureReporter reporter(libGLfilename, forceFeatureReport);
diff --git a/gfx/gl/GLScreenBuffer.cpp b/gfx/gl/GLScreenBuffer.cpp
index 584fc16b54d..8ce1b8ff7df 100644
--- a/gfx/gl/GLScreenBuffer.cpp
+++ b/gfx/gl/GLScreenBuffer.cpp
@@ -95,10 +95,7 @@ GLScreenBuffer::BindAsFramebuffer(GLContext* const gl, GLenum target) const
         break;
 
     default:
-        // In case we got a bad target.
-        MOZ_NOT_REACHED("Bad `target` for BindFramebuffer.");
-        gl->raw_fBindFramebuffer(target, 0);
-        break;
+        MOZ_CRASH("Bad `target` for BindFramebuffer.");
     }
 }
 
@@ -577,8 +574,7 @@ ReadBuffer::Create(GLContext* gl,
         colorRB = surf->Renderbuffer();
         break;
     default:
-        MOZ_NOT_REACHED("Unknown attachment type?");
-        return nullptr;
+        MOZ_CRASH("Unknown attachment type?");
     }
     MOZ_ASSERT(colorTex || colorRB);
 
@@ -627,8 +623,7 @@ ReadBuffer::Attach(SharedSurface_GL* surf)
             colorRB = surf->Renderbuffer();
             break;
         default:
-            MOZ_NOT_REACHED("Unknown attachment type?");
-            return;
+            MOZ_CRASH("Unknown attachment type?");
         }
 
         mGL->AttachBuffersToFB(colorTex, colorRB, 0, 0, mFB);
diff --git a/gfx/gl/SharedSurface.h b/gfx/gl/SharedSurface.h
index 91c0f5b68bd..8488b72e7dc 100644
--- a/gfx/gl/SharedSurface.h
+++ b/gfx/gl/SharedSurface.h
@@ -105,14 +105,12 @@ public:
     // For use when AttachType is correct.
     virtual GLuint Texture() const {
         MOZ_ASSERT(AttachType() == AttachmentType::GLTexture);
-        MOZ_NOT_REACHED("Did you forget to override this function?");
-        return 0;
+        MOZ_CRASH("Did you forget to override this function?");
     }
 
     virtual GLuint Renderbuffer() const {
         MOZ_ASSERT(AttachType() == AttachmentType::GLRenderbuffer);
-        MOZ_NOT_REACHED("Did you forget to override this function?");
-        return 0;
+        MOZ_CRASH("Did you forget to override this function?");
     }
 };
 
diff --git a/gfx/gl/SharedSurfaceGL.cpp b/gfx/gl/SharedSurfaceGL.cpp
index f1c27e34967..cf8069519b7 100644
--- a/gfx/gl/SharedSurfaceGL.cpp
+++ b/gfx/gl/SharedSurfaceGL.cpp
@@ -61,8 +61,7 @@ SharedSurface_GL::Copy(SharedSurface_GL* src, SharedSurface_GL* dest,
             gl->BlitFramebufferToFramebuffer(0, destWrapper.FB(),
                                              src->Size(), dest->Size());
         } else {
-            MOZ_NOT_REACHED("Unhandled dest->AttachType().");
-            return;
+            MOZ_CRASH("Unhandled dest->AttachType().");
         }
 
         if (srcNeedsUnlock)
@@ -99,8 +98,7 @@ SharedSurface_GL::Copy(SharedSurface_GL* src, SharedSurface_GL* dest,
             gl->BlitFramebufferToFramebuffer(srcWrapper.FB(), 0,
                                              src->Size(), dest->Size());
         } else {
-            MOZ_NOT_REACHED("Unhandled src->AttachType().");
-            return;
+            MOZ_CRASH("Unhandled src->AttachType().");
         }
 
         if (destNeedsUnlock)
@@ -137,8 +135,7 @@ SharedSurface_GL::Copy(SharedSurface_GL* src, SharedSurface_GL* dest,
             return;
         }
 
-        MOZ_NOT_REACHED("Unhandled dest->AttachType().");
-        return;
+        MOZ_CRASH("Unhandled dest->AttachType().");
     }
 
     if (src->AttachType() == AttachmentType::GLRenderbuffer) {
@@ -164,12 +161,10 @@ SharedSurface_GL::Copy(SharedSurface_GL* src, SharedSurface_GL* dest,
             return;
         }
 
-        MOZ_NOT_REACHED("Unhandled dest->AttachType().");
-        return;
+        MOZ_CRASH("Unhandled dest->AttachType().");
     }
 
-    MOZ_NOT_REACHED("Unhandled src->AttachType().");
-    return;
+    MOZ_CRASH("Unhandled src->AttachType().");
 }
 
 void
@@ -264,8 +259,7 @@ SharedSurface_Basic::Create(GLContext* gl,
         format = gfxASurface::ImageFormatARGB32;
         break;
     default:
-        MOZ_NOT_REACHED("Unhandled Tex format.");
-        return nullptr;
+        MOZ_CRASH("Unhandled Tex format.");
     }
     return new SharedSurface_Basic(gl, size, hasAlpha, format, tex);
 }
diff --git a/gfx/gl/SurfaceStream.cpp b/gfx/gl/SurfaceStream.cpp
index e65718b7051..ccbcdc3223e 100644
--- a/gfx/gl/SurfaceStream.cpp
+++ b/gfx/gl/SurfaceStream.cpp
@@ -43,8 +43,7 @@ SurfaceStream::CreateForType(SurfaceStreamType type, SurfaceStream* prevStream)
         case SurfaceStreamType::TripleBuffer:
             return new SurfaceStream_TripleBuffer(prevStream);
         default:
-            MOZ_NOT_REACHED("Invalid Type.");
-            return nullptr;
+            MOZ_CRASH("Invalid Type.");
     }
 }
 
diff --git a/gfx/layers/Effects.h b/gfx/layers/Effects.h
index b7c818f703e..1a8c0b5fa79 100644
--- a/gfx/layers/Effects.h
+++ b/gfx/layers/Effects.h
@@ -256,7 +256,7 @@ CreateTexturedEffect(TextureHost *aTextureHost,
     result = new EffectYCbCr(aTextureHost, aFilter);
     break;
   default:
-    MOZ_NOT_REACHED("unhandled program type");
+    MOZ_CRASH("unhandled program type");
   }
 
   return result;
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 71d2b95bb65..cc26391dd66 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -1778,13 +1778,13 @@ class RefLayer : public ContainerLayer {
 
 private:
   virtual void InsertAfter(Layer* aChild, Layer* aAfter)
-  { MOZ_NOT_REACHED("no"); }
+  { MOZ_CRASH(); }
 
   virtual void RemoveChild(Layer* aChild)
-  { MOZ_NOT_REACHED("no"); }
+  { MOZ_CRASH(); }
 
   virtual void RepositionChild(Layer* aChild, Layer* aAfter)
-  { MOZ_NOT_REACHED("no"); }
+  { MOZ_CRASH(); }
 
   using ContainerLayer::SetFrameMetrics;
 
diff --git a/gfx/layers/client/CompositableClient.h b/gfx/layers/client/CompositableClient.h
index 3577f96a2f4..d320bf7e091 100644
--- a/gfx/layers/client/CompositableClient.h
+++ b/gfx/layers/client/CompositableClient.h
@@ -73,8 +73,7 @@ public:
 
   virtual TextureInfo GetTextureInfo() const
   {
-    MOZ_NOT_REACHED("This method should be overridden");
-    return TextureInfo();
+    MOZ_CRASH("This method should be overridden");
   }
 
   LayersBackend GetCompositorBackendType() const;
@@ -85,7 +84,7 @@ public:
   virtual void SetDescriptorFromReply(TextureIdentifier aTextureId,
                                       const SurfaceDescriptor& aDescriptor)
   {
-    MOZ_NOT_REACHED("If you want to call this, you should have implemented it");
+    MOZ_CRASH("If you want to call this, you should have implemented it");
   }
 
   /**
diff --git a/gfx/layers/client/ContentClient.h b/gfx/layers/client/ContentClient.h
index e6c61dd8292..35133dfd113 100644
--- a/gfx/layers/client/ContentClient.h
+++ b/gfx/layers/client/ContentClient.h
@@ -141,8 +141,7 @@ public:
 
   virtual TextureInfo GetTextureInfo() const MOZ_OVERRIDE
   {
-    MOZ_NOT_REACHED("Should not be called on non-remote ContentClient");
-    return TextureInfo();
+    MOZ_CRASH("Should not be called on non-remote ContentClient");
   }
 
 private:
diff --git a/gfx/layers/client/ImageClient.cpp b/gfx/layers/client/ImageClient.cpp
index 7ec3dba062c..8bf0a5cdb92 100644
--- a/gfx/layers/client/ImageClient.cpp
+++ b/gfx/layers/client/ImageClient.cpp
@@ -40,7 +40,7 @@ ImageClient::CreateImageClient(CompositableType aCompositableHostType,
     result = nullptr;
     break;
   default:
-    MOZ_NOT_REACHED("unhandled program type");
+    MOZ_CRASH("unhandled program type");
   }
 
   NS_ASSERTION(result, "Failed to create ImageClient");
diff --git a/gfx/layers/composite/CompositableHost.cpp b/gfx/layers/composite/CompositableHost.cpp
index 654ed32c597..f1338e0e8ce 100644
--- a/gfx/layers/composite/CompositableHost.cpp
+++ b/gfx/layers/composite/CompositableHost.cpp
@@ -72,8 +72,7 @@ CompositableHost::Create(const TextureInfo& aTextureInfo)
     result = new ContentHostIncremental(aTextureInfo);
     return result;
   default:
-    MOZ_NOT_REACHED("Unknown CompositableType");
-    return nullptr;
+    MOZ_CRASH("Unknown CompositableType");
   }
 }
 
diff --git a/gfx/layers/composite/TextureHost.cpp b/gfx/layers/composite/TextureHost.cpp
index e6206766042..7ab7be56ca8 100644
--- a/gfx/layers/composite/TextureHost.cpp
+++ b/gfx/layers/composite/TextureHost.cpp
@@ -59,8 +59,7 @@ TextureHost::CreateTextureHost(SurfaceDescriptorType aDescriptorType,
                                     aTextureHostFlags,
                                     aTextureFlags);
     default:
-      MOZ_NOT_REACHED("Couldn't create texture host");
-      return nullptr;
+      MOZ_CRASH("Couldn't create texture host");
   }
 }
 
diff --git a/gfx/layers/composite/TiledContentHost.h b/gfx/layers/composite/TiledContentHost.h
index 221c868d93c..23a99215827 100644
--- a/gfx/layers/composite/TiledContentHost.h
+++ b/gfx/layers/composite/TiledContentHost.h
@@ -190,7 +190,7 @@ public:
                                  ISurfaceAllocator* aAllocator,
                                  const TextureInfo& aTextureInfo) MOZ_OVERRIDE
   {
-    MOZ_NOT_REACHED("Does nothing");
+    MOZ_CRASH("Does nothing");
   }
 
   virtual void SetCompositor(Compositor* aCompositor) MOZ_OVERRIDE
diff --git a/gfx/layers/d3d10/CanvasLayerD3D10.cpp b/gfx/layers/d3d10/CanvasLayerD3D10.cpp
index 2552cdb2234..84a54e47f4e 100644
--- a/gfx/layers/d3d10/CanvasLayerD3D10.cpp
+++ b/gfx/layers/d3d10/CanvasLayerD3D10.cpp
@@ -170,8 +170,7 @@ CanvasLayerD3D10::UpdateSurface()
       }
 
       default:
-        MOZ_NOT_REACHED("Unhandled SharedSurfaceType.");
-        return;
+        MOZ_CRASH("Unhandled SharedSurfaceType.");
     }
   } else if (mSurface) {
     RECT r;
diff --git a/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp b/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp
index 5880ad87f4a..39885b65cc1 100644
--- a/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp
+++ b/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp
@@ -125,7 +125,7 @@ ImageFormatForPixelFormat(android::PixelFormat aFormat)
   case PIXEL_FORMAT_A_8:
     return gfxASurface::ImageFormatA8;
   default:
-    MOZ_NOT_REACHED("Unknown gralloc pixel format");
+    MOZ_CRASH("Unknown gralloc pixel format");
   }
   return gfxASurface::ImageFormatARGB32;
 }
@@ -143,7 +143,7 @@ PixelFormatForImageFormat(gfxASurface::gfxImageFormat aFormat)
   case gfxASurface::ImageFormatA8:
     return android::PIXEL_FORMAT_A_8;
   default:
-    MOZ_NOT_REACHED("Unknown gralloc pixel format");
+    MOZ_CRASH("Unknown gralloc pixel format");
   }
   return gfxASurface::ImageFormatARGB32;
 }
diff --git a/gfx/layers/moz.build b/gfx/layers/moz.build
index 4d4d7e0100a..70e34c9ad3d 100644
--- a/gfx/layers/moz.build
+++ b/gfx/layers/moz.build
@@ -7,40 +7,40 @@
 MODULE = 'thebes'
 
 EXPORTS += [
-    'BasicCanvasLayer.h',
-    'BasicImplData.h',
-    'BasicLayers.h',
-    'BasicLayersImpl.h',
-    'BasicThebesLayer.h',
-    'ClientCanvasLayer.h',
-    'ClientContainerLayer.h',
-    'ClientLayerManager.h',
-    'ClientThebesLayer.h',
-    'ClientTiledThebesLayer.h',
-    'Composer2D.h',
-    'CompositableHost.h',
-    'CompositorChild.h',
-    'CompositorParent.h',
     'CopyableCanvasLayer.h',
     'D3D9SurfaceImage.h',
     'FrameMetrics.h',
     'GonkIOSurfaceImage.h',
     'ImageContainer.h',
-    'ImageHost.h',
-    'ImageLayerOGL.h',
     'ImageLayers.h',
     'ImageTypes.h',
-    'LayerManagerOGL.h',
-    'LayerManagerOGLProgram.h',
-    'LayerManagerOGLShaders.h',
     'LayerSorter.h',
     'LayerTreeInvalidation.h',
     'Layers.h',
     'LayersLogging.h',
     'ReadbackLayer.h',
-    'ShadowLayersManager.h',
     'SharedTextureImage.h',
-    'TexturePoolOGL.h',
+    'basic/BasicCanvasLayer.h',
+    'basic/BasicImplData.h',
+    'basic/BasicLayers.h',
+    'basic/BasicLayersImpl.h',
+    'basic/BasicThebesLayer.h',
+    'client/ClientCanvasLayer.h',
+    'client/ClientContainerLayer.h',
+    'client/ClientLayerManager.h',
+    'client/ClientThebesLayer.h',
+    'client/ClientTiledThebesLayer.h',
+    'composite/CompositableHost.h',
+    'composite/ImageHost.h',
+    'ipc/CompositorChild.h',
+    'ipc/CompositorParent.h',
+    'ipc/ShadowLayersManager.h',
+    'opengl/Composer2D.h',
+    'opengl/ImageLayerOGL.h',
+    'opengl/LayerManagerOGL.h',
+    'opengl/LayerManagerOGLProgram.h',
+    'opengl/LayerManagerOGLShaders.h',
+    'opengl/TexturePoolOGL.h',
 ]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
@@ -49,8 +49,8 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
     ]
     if CONFIG['MOZ_ENABLE_D3D9_LAYER']:
         EXPORTS += [
-            'DeviceManagerD3D9.h',
-            'LayerManagerD3D9.h',
+            'd3d9/DeviceManagerD3D9.h',
+            'd3d9/LayerManagerD3D9.h',
         ]
         CPP_SOURCES += [
             'LayerManagerD3D9.cpp',
@@ -64,13 +64,13 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
         ]
     if CONFIG['MOZ_ENABLE_D3D10_LAYER']:
         EXPORTS += [
-            'LayerManagerD3D10.h',
-            'ReadbackManagerD3D10.h',
+            'd3d10/LayerManagerD3D10.h',
+            'd3d10/ReadbackManagerD3D10.h',
         ]
         EXPORTS.mozilla.layers += [
-            'CompositorD3D11.h',
-            'ShadowLayerUtilsD3D10.h',
-            'TextureD3D11.h',
+            'd3d11/CompositorD3D11.h',
+            'd3d11/TextureD3D11.h',
+            'ipc/ShadowLayerUtilsD3D10.h',
         ]
         CPP_SOURCES += [
             'CanvasLayerD3D10.cpp',
@@ -86,62 +86,62 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':
         ]
 
 EXPORTS.gfxipc += [
-    'ShadowLayerUtils.h',
+    'ipc/ShadowLayerUtils.h',
 ]
 
 EXPORTS.mozilla.layers += [
-    'AsyncCompositionManager.h',
-    'AsyncPanZoomController.h',
-    'Axis.h',
-    'BasicCompositor.h',
-    'CanvasClient.h',
-    'CanvasLayerComposite.h',
-    'ColorLayerComposite.h',
-    'CompositableClient.h',
-    'CompositableForwarder.h',
-    'CompositableTransactionParent.h',
-    'CompositingRenderTargetOGL.h',
     'Compositor.h',
-    'CompositorChild.h',
-    'CompositorCocoaWidgetHelper.h',
-    'CompositorOGL.h',
-    'CompositorParent.h',
     'CompositorTypes.h',
-    'ContainerLayerComposite.h',
-    'ContentClient.h',
-    'ContentHost.h',
     'D3D9SurfaceImage.h',
     'Effects.h',
-    'GeckoContentController.h',
-    'GestureEventListener.h',
-    'ISurfaceAllocator.h',
-    'ImageBridgeChild.h',
-    'ImageBridgeParent.h',
-    'ImageClient.h',
-    'ImageHost.h',
-    'ImageLayerComposite.h',
-    'LayerManagerComposite.h',
-    'LayerTransactionChild.h',
-    'LayerTransactionParent.h',
     'LayersTypes.h',
     'RenderTrace.h',
-    'ShadowLayers.h',
-    'ShadowLayersManager.h',
-    'SharedPlanarYCbCrImage.h',
-    'SharedRGBImage.h',
-    'TaskThrottler.h',
-    'TextureClient.h',
-    'TextureClientOGL.h',
-    'TextureHost.h',
-    'TextureHostOGL.h',
-    'ThebesLayerComposite.h',
-    'TiledContentClient.h',
     'YCbCrImageDataSerializer.h',
+    'basic/BasicCompositor.h',
+    'client/CanvasClient.h',
+    'client/CompositableClient.h',
+    'client/ContentClient.h',
+    'client/ImageClient.h',
+    'client/TextureClient.h',
+    'client/TiledContentClient.h',
+    'composite/AsyncCompositionManager.h',
+    'composite/CanvasLayerComposite.h',
+    'composite/ColorLayerComposite.h',
+    'composite/ContainerLayerComposite.h',
+    'composite/ContentHost.h',
+    'composite/ImageHost.h',
+    'composite/ImageLayerComposite.h',
+    'composite/LayerManagerComposite.h',
+    'composite/TextureHost.h',
+    'composite/ThebesLayerComposite.h',
+    'ipc/AsyncPanZoomController.h',
+    'ipc/Axis.h',
+    'ipc/CompositableForwarder.h',
+    'ipc/CompositableTransactionParent.h',
+    'ipc/CompositorChild.h',
+    'ipc/CompositorCocoaWidgetHelper.h',
+    'ipc/CompositorParent.h',
+    'ipc/GeckoContentController.h',
+    'ipc/GestureEventListener.h',
+    'ipc/ISurfaceAllocator.h',
+    'ipc/ImageBridgeChild.h',
+    'ipc/ImageBridgeParent.h',
+    'ipc/LayerTransactionChild.h',
+    'ipc/LayerTransactionParent.h',
+    'ipc/ShadowLayers.h',
+    'ipc/ShadowLayersManager.h',
+    'ipc/SharedPlanarYCbCrImage.h',
+    'ipc/SharedRGBImage.h',
+    'ipc/TaskThrottler.h',
+    'opengl/CompositingRenderTargetOGL.h',
+    'opengl/CompositorOGL.h',
+    'opengl/TextureClientOGL.h',
+    'opengl/TextureHostOGL.h',
 ]
 
 if CONFIG['MOZ_X11']:
     EXPORTS.mozilla.layers += [
-        'ShadowLayerUtilsX11.h'
+        'ipc/ShadowLayerUtilsX11.h',
     ]
     CPP_SOURCES += [
         'ShadowLayerUtilsX11.cpp'
@@ -149,7 +149,7 @@ if CONFIG['MOZ_X11']:
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
     EXPORTS.mozilla.layers += [
-        'GLManager.h'
+        'opengl/GLManager.h',
     ]
     CPP_SOURCES += [
         'ShadowLayerUtilsMac.cpp',
@@ -161,7 +161,7 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
 # has full system permissions there.
 if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
     EXPORTS.mozilla.layers += [
-        'ShadowLayerUtilsGralloc.h'
+        'ipc/ShadowLayerUtilsGralloc.h',
     ]
     CPP_SOURCES += [
         'ShadowLayerUtilsGralloc.cpp',
diff --git a/gfx/layers/opengl/CanvasLayerOGL.cpp b/gfx/layers/opengl/CanvasLayerOGL.cpp
index ffef4884a32..e91abc00899 100644
--- a/gfx/layers/opengl/CanvasLayerOGL.cpp
+++ b/gfx/layers/opengl/CanvasLayerOGL.cpp
@@ -223,8 +223,7 @@ CanvasLayerOGL::UpdateSurface()
           break;
         }
         default:
-          MOZ_NOT_REACHED("Unacceptable SharedSurface type.");
-          return;
+          MOZ_CRASH("Unacceptable SharedSurface type.");
       }
     } else {
       nothingToShow = true;
@@ -245,8 +244,7 @@ CanvasLayerOGL::UpdateSurface()
 #endif
     updatedSurface = mCanvasSurface;
   } else {
-    MOZ_NOT_REACHED("Unhandled canvas layer type.");
-    return;
+    MOZ_CRASH("Unhandled canvas layer type.");
   }
 
   if (updatedSurface) {
diff --git a/gfx/layers/opengl/GLManager.cpp b/gfx/layers/opengl/GLManager.cpp
index f2b1430ebdb..8777ac15e63 100644
--- a/gfx/layers/opengl/GLManager.cpp
+++ b/gfx/layers/opengl/GLManager.cpp
@@ -78,8 +78,7 @@ GLManager::CreateGLManager(LayerManager* aManager)
     }
   }
 
-  MOZ_NOT_REACHED("Cannot create GLManager for non-GL layer manager");
-  return nullptr;
+  MOZ_CRASH("Cannot create GLManager for non-GL layer manager");
 }
 
 }
diff --git a/gfx/layers/opengl/TextureHostOGL.cpp b/gfx/layers/opengl/TextureHostOGL.cpp
index 67adb23c14a..7bd9a2f020d 100644
--- a/gfx/layers/opengl/TextureHostOGL.cpp
+++ b/gfx/layers/opengl/TextureHostOGL.cpp
@@ -115,8 +115,7 @@ FormatFromShaderType(ShaderProgramType aShaderType)
     case BGRXLayerProgramType:
       return FORMAT_B8G8R8X8;
     default:
-      MOZ_NOT_REACHED("Unsupported texture shader type");
-      return FORMAT_UNKNOWN;
+      MOZ_CRASH("Unsupported texture shader type");
   }
 }
 
@@ -435,8 +434,7 @@ SurfaceStreamHostOGL::Lock()
       break;
     }
     default:
-      MOZ_NOT_REACHED("Invalid SharedSurface type.");
-      return false;
+      MOZ_CRASH("Invalid SharedSurface type.");
   }
 
   if (toUpload) {
diff --git a/gfx/layers/opengl/TextureHostOGL.h b/gfx/layers/opengl/TextureHostOGL.h
index 2319a689aad..9da5a23ae40 100644
--- a/gfx/layers/opengl/TextureHostOGL.h
+++ b/gfx/layers/opengl/TextureHostOGL.h
@@ -50,7 +50,7 @@ public:
   virtual void ReleaseTexture() = 0;
   virtual gfx::IntSize GetSize() const = 0;
   virtual gl::ShaderProgramType GetShaderProgram() const {
-    MOZ_NOT_REACHED("unhandled shader type");
+    MOZ_CRASH("unhandled shader type");
   }
   // TODO: Noone's implementing this anymore, should see if we need this.
   virtual GLenum GetTextureTarget() const { return LOCAL_GL_TEXTURE_2D; }
@@ -73,7 +73,7 @@ GetProgramTypeForTexture(const TextureHost *aTextureHost)
   case gfx::FORMAT_R8G8B8A8:
     return gl::RGBALayerProgramType;;
   default:
-    MOZ_NOT_REACHED("unhandled program type");
+    MOZ_CRASH("unhandled program type");
   }
 }
 
diff --git a/gfx/thebes/gfx2DGlue.h b/gfx/thebes/gfx2DGlue.h
index c74007c7340..a5e83402731 100644
--- a/gfx/thebes/gfx2DGlue.h
+++ b/gfx/thebes/gfx2DGlue.h
@@ -133,7 +133,7 @@ inline gfxContext::GraphicsLineCap ThebesLineCap(CapStyle aStyle)
   case CAP_SQUARE:
     return gfxContext::LINE_CAP_SQUARE;
   }
-  MOZ_NOT_REACHED("Incomplete switch");
+  MOZ_CRASH("Incomplete switch");
 }
 
 inline CapStyle ToCapStyle(gfxContext::GraphicsLineCap aStyle)
@@ -146,7 +146,7 @@ inline CapStyle ToCapStyle(gfxContext::GraphicsLineCap aStyle)
   case gfxContext::LINE_CAP_SQUARE:
     return CAP_SQUARE;
   }
-  MOZ_NOT_REACHED("Incomplete switch");
+  MOZ_CRASH("Incomplete switch");
 }
 
 inline gfxContext::GraphicsLineJoin ThebesLineJoin(JoinStyle aStyle)
@@ -173,7 +173,7 @@ inline JoinStyle ToJoinStyle(gfxContext::GraphicsLineJoin aStyle)
   case gfxContext::LINE_JOIN_ROUND:
     return JOIN_ROUND;
   }
-  MOZ_NOT_REACHED("Incomplete switch");
+  MOZ_CRASH("Incomplete switch");
 }
 
 inline gfxMatrix ThebesMatrix(const Matrix &aMatrix)
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index f01e561ff76..9db76e177da 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -136,7 +136,7 @@ GetBackendName(mozilla::gfx::BackendType aBackend)
       case mozilla::gfx::BACKEND_NONE:
         return "none";
   }
-  MOZ_NOT_REACHED("Incomplete switch");
+  MOZ_CRASH("Incomplete switch");
 }
 
 class gfxPlatform {
diff --git a/gfx/thebes/gfxRect.h b/gfx/thebes/gfxRect.h
index 2363f61ff34..4fedd297b66 100644
--- a/gfx/thebes/gfxRect.h
+++ b/gfx/thebes/gfxRect.h
@@ -96,7 +96,7 @@ struct gfxRect :
             case NS_SIDE_BOTTOM: return BottomRight();
             case NS_SIDE_LEFT: return BottomLeft();
         }
-        MOZ_NOT_REACHED("Incomplet switch");
+        MOZ_CRASH("Incomplete switch");
     }
 
     gfxPoint CWCorner(mozilla::css::Side side) const {
@@ -106,7 +106,7 @@ struct gfxRect :
             case NS_SIDE_BOTTOM: return BottomLeft();
             case NS_SIDE_LEFT: return TopLeft();
         }
-        MOZ_NOT_REACHED("Incomplet switch");
+        MOZ_CRASH("Incomplete switch");
     }
 
     /* Conditions this border to Cairo's max coordinate space.
diff --git a/hal/gonk/GonkDiskSpaceWatcher.cpp b/hal/gonk/GonkDiskSpaceWatcher.cpp
index d72480363b0..ff796e60b55 100644
--- a/hal/gonk/GonkDiskSpaceWatcher.cpp
+++ b/hal/gonk/GonkDiskSpaceWatcher.cpp
@@ -74,8 +74,7 @@ public:
   // We should never write to the fanotify fd.
   virtual void OnFileCanWriteWithoutBlocking(int aFd)
   {
-    MOZ_NOT_REACHED("Must not write to fanotify fd");
-    MOZ_CRASH();
+    MOZ_CRASH("Must not write to fanotify fd");
   }
 
   void DoStart();
diff --git a/hal/gonk/UeventPoller.cpp b/hal/gonk/UeventPoller.cpp
index 96f006ff937..2c83cbd56f7 100644
--- a/hal/gonk/UeventPoller.cpp
+++ b/hal/gonk/UeventPoller.cpp
@@ -58,7 +58,7 @@ public:
   // no writing to the netlink socket
   virtual void OnFileCanWriteWithoutBlocking(int fd)
   {
-    MOZ_NOT_REACHED("Must not write to netlink socket");
+    MOZ_CRASH("Must not write to netlink socket");
   }
 
   MessageLoopForIO *GetIOLoop () const { return mIOLoop; }
diff --git a/hal/linux/LinuxPower.cpp b/hal/linux/LinuxPower.cpp
index cfa9711197e..1c30d0da6b4 100644
--- a/hal/linux/LinuxPower.cpp
+++ b/hal/linux/LinuxPower.cpp
@@ -66,10 +66,8 @@ QuitHard(hal::ShutdownMode aMode)
       _exit(1);
       break;
     default:
-      MOZ_NOT_REACHED();
-      break;
+      MOZ_CRASH();
   }
-  MOZ_NOT_REACHED();
 }
 
 // Function to complusively shut down the system with a given mode when timeout.
diff --git a/ipc/glue/FileDescriptor.cpp b/ipc/glue/FileDescriptor.cpp
index ba55e61859d..4b631c54040 100644
--- a/ipc/glue/FileDescriptor.cpp
+++ b/ipc/glue/FileDescriptor.cpp
@@ -110,8 +110,7 @@ FileDescriptor::ShareTo(const FileDescriptor::IPDLPrivate&,
   return base::FileDescriptor();
 #endif
 
-  MOZ_NOT_REACHED("Must not get here!");
-  return PickleType();
+  MOZ_CRASH("Must not get here!");
 }
 
 // static
diff --git a/ipc/glue/InputStreamUtils.cpp b/ipc/glue/InputStreamUtils.cpp
index 3f96ab7093a..bfe10a2dbe7 100644
--- a/ipc/glue/InputStreamUtils.cpp
+++ b/ipc/glue/InputStreamUtils.cpp
@@ -48,13 +48,13 @@ SerializeInputStream(nsIInputStream* aInputStream,
   nsCOMPtr<nsIIPCSerializableInputStream> serializable =
     do_QueryInterface(aInputStream);
   if (!serializable) {
-    MOZ_NOT_REACHED("Input stream is not serializable!");
+    MOZ_CRASH("Input stream is not serializable!");
   }
 
   serializable->Serialize(aParams);
 
   if (aParams.type() == InputStreamParams::T__None) {
-    MOZ_NOT_REACHED("Serialize failed!");
+    MOZ_CRASH("Serialize failed!");
   }
 }
 
diff --git a/ipc/glue/URIUtils.cpp b/ipc/glue/URIUtils.cpp
index 9a255d849be..1718821fca2 100644
--- a/ipc/glue/URIUtils.cpp
+++ b/ipc/glue/URIUtils.cpp
@@ -58,14 +58,14 @@ SerializeURI(nsIURI* aURI,
   if (serializable) {
     serializable->Serialize(aParams);
     if (aParams.type() == URIParams::T__None) {
-      MOZ_NOT_REACHED("Serialize failed!");
+      MOZ_CRASH("Serialize failed!");
     }
     return;
   }
 
   nsCString scheme;
   if (NS_FAILED(aURI->GetScheme(scheme))) {
-    MOZ_NOT_REACHED("This must never fail!");
+    MOZ_CRASH("This must never fail!");
   }
 
   bool allowed = false;
@@ -79,14 +79,14 @@ SerializeURI(nsIURI* aURI,
   }
 
   if (!allowed) {
-    MOZ_NOT_REACHED("All IPDL URIs must be serializable or an allowed "
-                    "scheme!");
+    MOZ_CRASH("All IPDL URIs must be serializable or an allowed "
+              "scheme!");
   }
 
   GenericURIParams params;
   if (NS_FAILED(aURI->GetSpec(params.spec())) ||
       NS_FAILED(aURI->GetOriginCharset(params.charset()))) {
-    MOZ_NOT_REACHED("This must never fail!");
+    MOZ_CRASH("This must never fail!");
   }
 
   aParams = params;
@@ -132,7 +132,7 @@ DeserializeURI(const URIParams& aParams)
         break;
 
       default:
-        MOZ_NOT_REACHED("Unknown params!");
+        MOZ_CRASH("Unknown params!");
     }
 
     MOZ_ASSERT(serializable);
@@ -160,7 +160,7 @@ DeserializeURI(const URIParams& aParams)
 
   nsCString scheme;
   if (NS_FAILED(uri->GetScheme(scheme))) {
-    MOZ_NOT_REACHED("This must never fail!");
+    MOZ_CRASH("This must never fail!");
   }
 
   bool allowed = false;
@@ -197,7 +197,7 @@ DeserializeURI(const OptionalURIParams& aParams)
       break;
 
     default:
-      MOZ_NOT_REACHED("Unknown params!");
+      MOZ_CRASH("Unknown params!");
   }
 
   return uri.forget();
diff --git a/ipc/nfc/Nfc.cpp b/ipc/nfc/Nfc.cpp
index d0c583c3f2f..cdb89f9cb8a 100644
--- a/ipc/nfc/Nfc.cpp
+++ b/ipc/nfc/Nfc.cpp
@@ -155,7 +155,7 @@ void
 NfcConnector::GetSocketAddr(const sockaddr_any& aAddr,
                             nsAString& aAddrStr)
 {
-    MOZ_NOT_REACHED("This should never be called!");
+    MOZ_CRASH("This should never be called!");
 }
 
 } // anonymous namespace
diff --git a/ipc/ril/Ril.cpp b/ipc/ril/Ril.cpp
index 79009b9f25b..4b0f8ae7092 100644
--- a/ipc/ril/Ril.cpp
+++ b/ipc/ril/Ril.cpp
@@ -156,8 +156,7 @@ void
 RilConnector::GetSocketAddr(const sockaddr_any& aAddr,
                             nsAString& aAddrStr)
 {
-    // Unused.
-    MOZ_NOT_REACHED("This should never be called!");
+    MOZ_CRASH("This should never be called!");
 }
 
 } // anonymous namespace
diff --git a/ipc/unixsocket/UnixSocket.cpp b/ipc/unixsocket/UnixSocket.cpp
index 4c83d56946e..9097991477c 100644
--- a/ipc/unixsocket/UnixSocket.cpp
+++ b/ipc/unixsocket/UnixSocket.cpp
@@ -753,7 +753,7 @@ UnixSocketImpl::OnFileCanReadWithoutBlocking(int aFd)
       }
     }
 
-    MOZ_NOT_REACHED("We returned early");
+    MOZ_CRASH("We returned early");
   }
 
   if (status == SOCKET_LISTENING) {
diff --git a/js/public/RootingAPI.h b/js/public/RootingAPI.h
index 21d718f9ed0..b33850e67bf 100644
--- a/js/public/RootingAPI.h
+++ b/js/public/RootingAPI.h
@@ -888,13 +888,11 @@ template <typename T> class MaybeRooted<T, NoGC>
     typedef FakeMutableHandle<T> MutableHandleType;
 
     static inline JS::Handle<T> toHandle(HandleType v) {
-        JS_NOT_REACHED("Bad conversion");
-        return JS::Handle<T>::fromMarkedLocation(NULL);
+        MOZ_ASSUME_UNREACHABLE("Bad conversion");
     }
 
     static inline JS::MutableHandle<T> toMutableHandle(MutableHandleType v) {
-        JS_NOT_REACHED("Bad conversion");
-        return JS::MutableHandle<T>::fromMarkedLocation(NULL);
+        MOZ_ASSUME_UNREACHABLE("Bad conversion");
     }
 };
 
diff --git a/js/public/Utility.h b/js/public/Utility.h
index ad29ff36614..16f00789cbe 100644
--- a/js/public/Utility.h
+++ b/js/public/Utility.h
@@ -41,7 +41,6 @@ namespace js {}
 
 #define JS_ASSERT(expr)           MOZ_ASSERT(expr)
 #define JS_ASSERT_IF(cond, expr)  MOZ_ASSERT_IF(cond, expr)
-#define JS_NOT_REACHED(reason)    MOZ_NOT_REACHED(reason)
 #define JS_ALWAYS_TRUE(expr)      MOZ_ALWAYS_TRUE(expr)
 #define JS_ALWAYS_FALSE(expr)     MOZ_ALWAYS_FALSE(expr)
 
diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index cda5e1fa979..4b88ddacb81 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -1549,7 +1549,7 @@ namespace JSC {
                             dblToFloat ? SD(dest) : DD(dest),
                             dblToFloat ? DM(src) : SM(src), 0);
             } else {
-                JS_NOT_REACHED("Other conversions did not seem useful on 2011/08/04");
+                MOZ_ASSUME_UNREACHABLE("Other conversions did not seem useful on 2011/08/04");
             }
         }
 
diff --git a/js/src/assembler/assembler/MacroAssemblerX86Common.h b/js/src/assembler/assembler/MacroAssemblerX86Common.h
index c2000910d56..39505bfcf87 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86Common.h
+++ b/js/src/assembler/assembler/MacroAssemblerX86Common.h
@@ -431,22 +431,22 @@ public:
 
     void load8SignExtend(BaseIndex address, RegisterID dest)
     {
-        m_assembler.movxbl_mr(address.offset, address.base, address.index, address.scale, dest);
+        m_assembler.movsbl_mr(address.offset, address.base, address.index, address.scale, dest);
     }
     
     void load8SignExtend(Address address, RegisterID dest)
     {
-        m_assembler.movxbl_mr(address.offset, address.base, dest);
+        m_assembler.movsbl_mr(address.offset, address.base, dest);
     }
 
     void load16SignExtend(BaseIndex address, RegisterID dest)
     {
-        m_assembler.movxwl_mr(address.offset, address.base, address.index, address.scale, dest);
+        m_assembler.movswl_mr(address.offset, address.base, address.index, address.scale, dest);
     }
     
     void load16SignExtend(Address address, RegisterID dest)
     {
-        m_assembler.movxwl_mr(address.offset, address.base, dest);
+        m_assembler.movswl_mr(address.offset, address.base, dest);
     }
 
     void load16(BaseIndex address, RegisterID dest)
diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index 1a7bab8cba1..db3e2645289 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -441,7 +441,7 @@ public:
 
     void pop_m(int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("pop        %s0x%x(%s)", PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_GROUP1A_Ev, GROUP1A_OP_POP, base, offset);
     }
 
@@ -483,7 +483,7 @@ public:
     void addl_mr(int offset, RegisterID base, RegisterID dst)
     {
         spew("addl       %s0x%x(%s), %s",
-             PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_ADD_GvEv, dst, base, offset);
     }
 
@@ -508,7 +508,7 @@ public:
     void addl_im(int imm, int offset, RegisterID base)
     {
         spew("addl       $%d, %s0x%x(%s)",
-             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(8,base));
+             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, offset);
             m_formatter.immediate8(imm);
@@ -581,7 +581,7 @@ public:
     void andl_mr(int offset, RegisterID base, RegisterID dst)
     {
         spew("andl       %s0x%x(%s), %s",
-             PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_AND_GvEv, dst, base, offset);
     }
 
@@ -800,7 +800,7 @@ public:
     void subl_mr(int offset, RegisterID base, RegisterID dst)
     {
         spew("subl       %s0x%x(%s), %s",
-             PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_SUB_GvEv, dst, base, offset);
     }
 
@@ -825,7 +825,7 @@ public:
     void subl_im(int imm, int offset, RegisterID base)
     {
         spew("subl       $0x%x, %s0x%x(%s)",
-             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(4, base));
+             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_SUB, base, offset);
             m_formatter.immediate8(imm);
@@ -896,7 +896,8 @@ public:
 
     void xorl_im(int imm, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("xorl       $0x%x, %s0x%x(%s)",
+             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_XOR, base, offset);
             m_formatter.immediate8(imm);
@@ -1042,7 +1043,7 @@ public:
     void imull_mr(int offset, RegisterID base, RegisterID dst)
     {
         spew("imull      %s0x%x(%s), %s",
-             PRETTY_PRINT_OFFSET(offset), nameIReg(4,base), nameIReg(4,dst));
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4,dst));
         m_formatter.twoByteOp(OP2_IMUL_GvEv, dst, base, offset);
     }
 
@@ -1087,7 +1088,7 @@ public:
     void cmpl_mr(int offset, RegisterID base, RegisterID src)
     {
         spew("cmpl       %s0x%x(%s), %s",
-             PRETTY_PRINT_OFFSET(offset), nameIReg(4, base), nameIReg(src));
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(src));
         m_formatter.oneByteOp(OP_CMP_GvEv, src, base, offset);
     }
 
@@ -1118,7 +1119,7 @@ public:
     void cmpl_im(int imm, int offset, RegisterID base)
     {
         spew("cmpl       $0x%x, %s0x%x(%s)",
-             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(4,base));
+             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, offset);
             m_formatter.immediate8(imm);
@@ -1143,7 +1144,7 @@ public:
     void cmpl_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
     {
         spew("cmpl       $%d, %d(%s,%s,%d)",
-             imm, offset, nameIReg(4,base), nameIReg(4,index), 1<<scale);
+             imm, offset, nameIReg(base), nameIReg(index), 1<<scale);
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, index, scale, offset);
             m_formatter.immediate8(imm);
@@ -1156,7 +1157,7 @@ public:
     void cmpl_im_force32(int imm, int offset, RegisterID base)
     {
         spew("cmpl       $0x%x, %s0x%x(%s)",
-             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(4,base));
+             imm, PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, offset);
         m_formatter.immediate32(imm);
     }
@@ -1228,13 +1229,14 @@ public:
 #else
     void cmpl_rm(RegisterID reg, const void* addr)
     {
-        FIXME_INSN_PRINTING;
+        spew("cmpl       %s, %p",
+             nameIReg(4, reg), addr);
         m_formatter.oneByteOp(OP_CMP_EvGv, reg, addr);
     }
 
     void cmpl_im(int imm, const void* addr)
     {
-        spew("cmpl       $0x%x, 0x%p", imm, addr);
+        spew("cmpl       $0x%x, %p", imm, addr);
         if (CAN_SIGN_EXTEND_8_32(imm)) {
             m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, addr);
             m_formatter.immediate8(imm);
@@ -1386,25 +1388,21 @@ public:
 
     void sete_r(RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp8(setccOpcode(ConditionE), (GroupOpcodeID)0, dst);
+        setCC_r(ConditionE, dst);
     }
 
     void setz_r(RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
         sete_r(dst);
     }
 
     void setne_r(RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp8(setccOpcode(ConditionNE), (GroupOpcodeID)0, dst);
+        setCC_r(ConditionNE, dst);
     }
 
     void setnz_r(RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
         setne_r(dst);
     }
 
@@ -1723,7 +1721,7 @@ public:
 #else
     void movl_rm(RegisterID src, const void* addr)
     {
-        spew("movl       %s, 0(%p)",
+        spew("movl       %s, %p",
              nameIReg(4, src), addr);
         if (src == X86Registers::eax)
             movl_EAXm(addr);
@@ -1733,7 +1731,7 @@ public:
 
     void movl_mr(const void* addr, RegisterID dst)
     {
-        spew("movl       0(%p), %s",
+        spew("movl       %p, %s",
              addr, nameIReg(4, dst));
         if (dst == X86Registers::eax)
             movl_mEAX(addr);
@@ -1791,23 +1789,23 @@ public:
         m_formatter.twoByteOp(OP2_MOVZX_GvEb, dst, base, index, scale, offset);
     }
 
-    void movxbl_mr(int offset, RegisterID base, RegisterID dst)
+    void movsbl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        spew("movxbl     %s0x%x(%s), %s",
+        spew("movsbl     %s0x%x(%s), %s",
              PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4, dst));
         m_formatter.twoByteOp(OP2_MOVSX_GvEb, dst, base, offset);
     }
 
-    void movxbl_mr_disp32(int offset, RegisterID base, RegisterID dst)
+    void movsbl_mr_disp32(int offset, RegisterID base, RegisterID dst)
     {
-        spew("movxbl     %s0x%x(%s), %s",
+        spew("movsbl     %s0x%x(%s), %s",
              PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4, dst));
         m_formatter.twoByteOp_disp32(OP2_MOVSX_GvEb, dst, base, offset);
     }
 
-    void movxbl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    void movsbl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
     {
-        spew("movxbl     %d(%s,%s,%d), %s",
+        spew("movsbl     %d(%s,%s,%d), %s",
              offset, nameIReg(base), nameIReg(index), 1<<scale, nameIReg(dst));
         m_formatter.twoByteOp(OP2_MOVSX_GvEb, dst, base, index, scale, offset);
     }
@@ -1833,23 +1831,23 @@ public:
         m_formatter.twoByteOp(OP2_MOVZX_GvEw, dst, base, index, scale, offset);
     }
 
-    void movxwl_mr(int offset, RegisterID base, RegisterID dst)
+    void movswl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        spew("movxwl     %s0x%x(%s), %s",
+        spew("movswl     %s0x%x(%s), %s",
              PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4, dst));
         m_formatter.twoByteOp(OP2_MOVSX_GvEw, dst, base, offset);
     }
 
-    void movxwl_mr_disp32(int offset, RegisterID base, RegisterID dst)
+    void movswl_mr_disp32(int offset, RegisterID base, RegisterID dst)
     {
-        spew("movxwl     %s0x%x(%s), %s",
+        spew("movswl     %s0x%x(%s), %s",
              PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4, dst));
         m_formatter.twoByteOp_disp32(OP2_MOVSX_GvEw, dst, base, offset);
     }
 
-    void movxwl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
+    void movswl_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
     {
-        spew("movxwl     %d(%s,%s,%d), %s",
+        spew("movswl     %d(%s,%s,%d), %s",
              offset, nameIReg(base), nameIReg(index), 1<<scale, nameIReg(dst));
         m_formatter.twoByteOp(OP2_MOVSX_GvEw, dst, base, index, scale, offset);
     }
@@ -1982,84 +1980,62 @@ public:
 
     JmpSrc jnz()
     {
-        // printing done by jne()
         return jne();
     }
 
     JmpSrc je()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionE));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionE);
     }
 
     JmpSrc jz()
     {
-        // printing done by je()
         return je();
     }
 
     JmpSrc jl()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionL));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionL);
     }
 
     JmpSrc jb()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionB));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionB);
     }
 
     JmpSrc jle()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionLE));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionLE);
     }
 
     JmpSrc jbe()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionBE));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionBE);
     }
 
     JmpSrc jge()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionGE));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionGE);
     }
 
     JmpSrc jg()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionG));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionG);
     }
 
     JmpSrc ja()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionA));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionA);
     }
 
     JmpSrc jae()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionAE));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionAE);
     }
 
     JmpSrc jo()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionO));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionO);
     }
 
     JmpSrc jp()
@@ -2069,9 +2045,7 @@ public:
 
     JmpSrc js()
     {
-        FIXME_INSN_PRINTING;
-        m_formatter.twoByteOp(jccRel32(ConditionS));
-        return m_formatter.immediateRel32();
+        return jCC(ConditionS);
     }
 
     JmpSrc jCC(Condition cond)
@@ -2182,7 +2156,7 @@ public:
     void cvttsd2si_rr(XMMRegisterID src, RegisterID dst)
     {
         spew("cvttsd2si  %s, %s",
-             nameFPReg(src), nameIReg(dst));
+             nameFPReg(src), nameIReg(4, dst));
         m_formatter.prefix(PRE_SSE_F2);
         m_formatter.twoByteOp(OP2_CVTTSD2SI_GdWsd, dst, (RegisterID)src);
     }
@@ -2654,16 +2628,19 @@ public:
 
     void jumpTablePointer(uintptr_t ptr)
     {
+        spew("#jumpTablePointer %llu", (unsigned long long)ptr);
         m_formatter.jumpTablePointer(ptr);
     }
 
     void doubleConstant(double d)
     {
+        spew(".double %.20f", d);
         m_formatter.doubleConstant(d);
     }
 
     void int64Constant(int64_t i)
     {
+        spew(".quad %lld", (long long)i);
         m_formatter.int64Constant(i);
     }
 
diff --git a/js/src/assembler/jit/ExecutableAllocator.h b/js/src/assembler/jit/ExecutableAllocator.h
index 16ad8359095..54b40fe112f 100644
--- a/js/src/assembler/jit/ExecutableAllocator.h
+++ b/js/src/assembler/jit/ExecutableAllocator.h
@@ -162,7 +162,7 @@ private:
           case ASMJS_CODE:    m_asmJSCodeBytes    += n;        break;
           case REGEXP_CODE:   m_regexpCodeBytes   += n;        break;
           case OTHER_CODE:    m_otherCodeBytes    += n;        break;
-          default:            JS_NOT_REACHED("bad code kind"); break;
+          default:            MOZ_ASSUME_UNREACHABLE("bad code kind");
         }
         return result;
     }
diff --git a/js/src/assembler/wtf/Assertions.h b/js/src/assembler/wtf/Assertions.h
index 2cb1c5ecfab..ddf52002443 100644
--- a/js/src/assembler/wtf/Assertions.h
+++ b/js/src/assembler/wtf/Assertions.h
@@ -44,7 +44,7 @@
     (void)variable; \
     ASSERT(assertion); \
 } while (0)
-#define ASSERT_NOT_REACHED() MOZ_NOT_REACHED("")
+#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE()
 #define CRASH() MOZ_CRASH()
 #define COMPILE_ASSERT(exp, name) MOZ_STATIC_ASSERT(exp, #name)
 
diff --git a/js/src/builtin/Intl.cpp b/js/src/builtin/Intl.cpp
index 488f7b5b3dc..bf9c5123ce9 100644
--- a/js/src/builtin/Intl.cpp
+++ b/js/src/builtin/Intl.cpp
@@ -76,8 +76,7 @@ using icu::NumberingSystem;
 static int32_t
 u_strlen(const UChar *s)
 {
-    MOZ_NOT_REACHED("u_strlen: Intl API disabled");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("u_strlen: Intl API disabled");
 }
 
 struct UEnumeration;
@@ -85,23 +84,19 @@ struct UEnumeration;
 static int32_t
 uenum_count(UEnumeration *en, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("uenum_count: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("uenum_count: Intl API disabled");
 }
 
 static const char *
 uenum_next(UEnumeration *en, int32_t *resultLength, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("uenum_next: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("uenum_next: Intl API disabled");
 }
 
 static void
 uenum_close(UEnumeration *en)
 {
-    MOZ_NOT_REACHED("uenum_close: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("uenum_close: Intl API disabled");
 }
 
 struct UCollator;
@@ -136,53 +131,45 @@ enum UCollationResult {
 static int32_t
 ucol_countAvailable(void)
 {
-    MOZ_NOT_REACHED("ucol_countAvailable: Intl API disabled");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("ucol_countAvailable: Intl API disabled");
 }
 
 static const char *
 ucol_getAvailable(int32_t localeIndex)
 {
-    MOZ_NOT_REACHED("ucol_getAvailable: Intl API disabled");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("ucol_getAvailable: Intl API disabled");
 }
 
 static UCollator *
 ucol_open(const char *loc, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("ucol_open: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("ucol_open: Intl API disabled");
 }
 
 static void
 ucol_setAttribute(UCollator *coll, UColAttribute attr, UColAttributeValue value, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("ucol_setAttribute: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
+    MOZ_ASSUME_UNREACHABLE("ucol_setAttribute: Intl API disabled");
 }
 
 static UCollationResult
 ucol_strcoll(const UCollator *coll, const UChar *source, int32_t sourceLength,
              const UChar *target, int32_t targetLength)
 {
-    MOZ_NOT_REACHED("ucol_strcoll: Intl API disabled");
-    return (UCollationResult) 0;
+    MOZ_ASSUME_UNREACHABLE("ucol_strcoll: Intl API disabled");
 }
 
 static void
 ucol_close(UCollator *coll)
 {
-    MOZ_NOT_REACHED("ucol_close: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("ucol_close: Intl API disabled");
 }
 
 static UEnumeration *
 ucol_getKeywordValuesForLocale(const char *key, const char *locale, UBool commonlyUsed,
                                UErrorCode *status)
 {
-    MOZ_NOT_REACHED("ucol_getKeywordValuesForLocale: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("ucol_getKeywordValuesForLocale: Intl API disabled");
 }
 
 struct UParseError;
@@ -219,53 +206,46 @@ enum UNumberFormatTextAttribute {
 static int32_t
 unum_countAvailable(void)
 {
-    MOZ_NOT_REACHED("unum_countAvailable: Intl API disabled");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("unum_countAvailable: Intl API disabled");
 }
 
 static const char *
 unum_getAvailable(int32_t localeIndex)
 {
-    MOZ_NOT_REACHED("unum_getAvailable: Intl API disabled");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("unum_getAvailable: Intl API disabled");
 }
 
 static UNumberFormat *
 unum_open(UNumberFormatStyle style, const UChar *pattern, int32_t patternLength,
           const char *locale, UParseError *parseErr, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("unum_open: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("unum_open: Intl API disabled");
 }
 
 static void
 unum_setAttribute(UNumberFormat *fmt, UNumberFormatAttribute  attr, int32_t newValue)
 {
-    MOZ_NOT_REACHED("unum_setAttribute: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("unum_setAttribute: Intl API disabled");
 }
 
 static int32_t
 unum_formatDouble(const UNumberFormat *fmt, double number, UChar *result,
                   int32_t resultLength, UFieldPosition *pos, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("unum_formatDouble: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("unum_formatDouble: Intl API disabled");
 }
 
 static void
 unum_close(UNumberFormat *fmt)
 {
-    MOZ_NOT_REACHED("unum_close: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("unum_close: Intl API disabled");
 }
 
 static void
 unum_setTextAttribute(UNumberFormat *fmt, UNumberFormatTextAttribute tag, const UChar *newValue,
                       int32_t newValueLength, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("unum_setTextAttribute: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
+    MOZ_ASSUME_UNREACHABLE("unum_setTextAttribute: Intl API disabled");
 }
 
 class Locale {
@@ -277,7 +257,7 @@ class Locale {
 Locale::Locale(const char *language, const char *country, const char *variant,
                const char *keywordsAndValues)
 {
-    MOZ_NOT_REACHED("Locale::Locale: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("Locale::Locale: Intl API disabled");
 }
 
 class NumberingSystem {
@@ -289,16 +269,13 @@ class NumberingSystem {
 NumberingSystem *
 NumberingSystem::createInstance(const Locale &inLocale, UErrorCode &status)
 {
-    MOZ_NOT_REACHED("NumberingSystem::createInstance: Intl API disabled");
-    status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("NumberingSystem::createInstance: Intl API disabled");
 }
 
 const char *
 NumberingSystem::getName()
 {
-    MOZ_NOT_REACHED("NumberingSystem::getName: Intl API disabled");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("NumberingSystem::getName: Intl API disabled");
 }
 
 typedef void *UCalendar;
@@ -313,32 +290,26 @@ static UCalendar *
 ucal_open(const UChar *zoneID, int32_t len, const char *locale,
           UCalendarType type, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("ucal_open: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("ucal_open: Intl API disabled");
 }
 
 static const char *
 ucal_getType(const UCalendar *cal, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("ucal_getType: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("ucal_getType: Intl API disabled");
 }
 
 static UEnumeration *
 ucal_getKeywordValuesForLocale(const char *key, const char *locale,
                                UBool commonlyUsed, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("ucal_getKeywordValuesForLocale: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("ucal_getKeywordValuesForLocale: Intl API disabled");
 }
 
 static void
 ucal_close(UCalendar *cal)
 {
-    MOZ_NOT_REACHED("ucal_close: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("ucal_close: Intl API disabled");
 }
 
 typedef void *UDateTimePatternGenerator;
@@ -346,9 +317,7 @@ typedef void *UDateTimePatternGenerator;
 static UDateTimePatternGenerator *
 udatpg_open(const char *locale, UErrorCode *pErrorCode)
 {
-    MOZ_NOT_REACHED("udatpg_open: Intl API disabled");
-    *pErrorCode = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("udatpg_open: Intl API disabled");
 }
 
 static int32_t
@@ -356,15 +325,13 @@ udatpg_getBestPattern(UDateTimePatternGenerator *dtpg, const UChar *skeleton,
                       int32_t length, UChar *bestPattern, int32_t capacity,
                       UErrorCode *pErrorCode)
 {
-    MOZ_NOT_REACHED("udatpg_getBestPattern: Intl API disabled");
-    *pErrorCode = U_UNSUPPORTED_ERROR;
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("udatpg_getBestPattern: Intl API disabled");
 }
 
 static void
 udatpg_close(UDateTimePatternGenerator *dtpg)
 {
-    MOZ_NOT_REACHED("udatpg_close: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("udatpg_close: Intl API disabled");
 }
 
 typedef void *UCalendar;
@@ -378,15 +345,13 @@ enum UDateFormatStyle {
 static int32_t
 udat_countAvailable(void)
 {
-    MOZ_NOT_REACHED("udat_countAvailable: Intl API disabled");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("udat_countAvailable: Intl API disabled");
 }
 
 static const char *
 udat_getAvailable(int32_t localeIndex)
 {
-    MOZ_NOT_REACHED("udat_getAvailable: Intl API disabled");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("udat_getAvailable: Intl API disabled");
 }
 
 static UDateFormat *
@@ -394,38 +359,32 @@ udat_open(UDateFormatStyle timeStyle, UDateFormatStyle dateStyle, const char *lo
           const UChar *tzID, int32_t tzIDLength, const UChar *pattern,
           int32_t patternLength, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("udat_open: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("udat_open: Intl API disabled");
 }
 
 static const UCalendar *
 udat_getCalendar(const UDateFormat *fmt)
 {
-    MOZ_NOT_REACHED("udat_getCalendar: Intl API disabled");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("udat_getCalendar: Intl API disabled");
 }
 
 static void
 ucal_setGregorianChange(UCalendar *cal, UDate date, UErrorCode *pErrorCode)
 {
-    MOZ_NOT_REACHED("ucal_setGregorianChange: Intl API disabled");
-    *pErrorCode = U_UNSUPPORTED_ERROR;
+    MOZ_ASSUME_UNREACHABLE("ucal_setGregorianChange: Intl API disabled");
 }
 
 static int32_t
 udat_format(const UDateFormat *format, UDate dateToFormat, UChar *result,
             int32_t resultLength, UFieldPosition *position, UErrorCode *status)
 {
-    MOZ_NOT_REACHED("udat_format: Intl API disabled");
-    *status = U_UNSUPPORTED_ERROR;
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("udat_format: Intl API disabled");
 }
 
 static void
 udat_close(UDateFormat *format)
 {
-    MOZ_NOT_REACHED("udat_close: Intl API disabled");
+    MOZ_ASSUME_UNREACHABLE("udat_close: Intl API disabled");
 }
 
 #endif
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 3f81a1ebf17..7f226fb8e1d 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -490,7 +490,7 @@ GCState(JSContext *cx, unsigned argc, jsval *vp)
     else if (globalState == gc::SWEEP)
         state = "sweep";
     else
-        JS_NOT_REACHED("Unobserveable global GC state");
+        MOZ_ASSUME_UNREACHABLE("Unobserveable global GC state");
 
     JSString *str = JS_NewStringCopyZ(cx, state);
     if (!str)
diff --git a/js/src/ctypes/CTypes.cpp b/js/src/ctypes/CTypes.cpp
index a45c123323e..bb99884db55 100644
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -2129,7 +2129,7 @@ ConvertToJS(JSContext* cx,
     break;
   }
   case TYPE_function:
-    JS_NOT_REACHED("cannot return a FunctionType");
+    MOZ_ASSUME_UNREACHABLE("cannot return a FunctionType");
   }
 
   return true;
@@ -2569,8 +2569,7 @@ ImplicitConvert(JSContext* cx,
   }
   case TYPE_void_t:
   case TYPE_function:
-    JS_NOT_REACHED("invalid type");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("invalid type");
   }
 
   return true;
@@ -2642,8 +2641,7 @@ ExplicitConvert(JSContext* cx, HandleValue val, HandleObject targetType, void* b
     return false;
   case TYPE_void_t:
   case TYPE_function:
-    JS_NOT_REACHED("invalid type");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("invalid type");
   }
   return true;
 }
@@ -2815,8 +2813,7 @@ BuildTypeSource(JSContext* cx,
       AppendString(result, "ctypes.winapi_abi, ");
       break;
     case INVALID_ABI:
-      JS_NOT_REACHED("invalid abi");
-      break;
+      MOZ_ASSUME_UNREACHABLE("invalid abi");
     }
 
     // Recursively build the source string describing the function return and
@@ -3060,8 +3057,7 @@ BuildDataSource(JSContext* cx,
     break;
   }
   case TYPE_void_t:
-    JS_NOT_REACHED("invalid type");
-    break;
+    MOZ_ASSUME_UNREACHABLE("invalid type");
   }
 
   return true;
@@ -3534,7 +3530,7 @@ CType::GetFFIType(JSContext* cx, JSObject* obj)
     break;
 
   default:
-    JS_NOT_REACHED("simple types must have an ffi_type");
+    MOZ_ASSUME_UNREACHABLE("simple types must have an ffi_type");
   }
 
   if (!result)
@@ -5463,8 +5459,7 @@ FunctionType::BuildSymbolName(JSString* name,
   }
 
   case INVALID_ABI:
-    JS_NOT_REACHED("invalid abi");
-    break;
+    MOZ_ASSUME_UNREACHABLE("invalid abi");
   }
 }
 
@@ -6800,7 +6795,7 @@ CDataFinalizer::Methods::ToString(JSContext *cx, unsigned argc, jsval *vp)
       return JS_FALSE;
     }
   } else if (!CDataFinalizer::GetValue(cx, objThis, value.address())) {
-    JS_NOT_REACHED("Could not convert an empty CDataFinalizer");
+    MOZ_ASSUME_UNREACHABLE("Could not convert an empty CDataFinalizer");
   } else {
     strMessage = JS_ValueToString(cx, value);
     if (!strMessage) {
@@ -7008,7 +7003,7 @@ CDataFinalizer::Construct(JSContext* cx, unsigned argc, jsval *vp)
       objBestArgType = CData::GetCType(objData);
       size_t sizeBestArg;
       if (!CType::GetSafeSize(objBestArgType, &sizeBestArg)) {
-        JS_NOT_REACHED("object with unknown size");
+        MOZ_ASSUME_UNREACHABLE("object with unknown size");
       }
       if (sizeBestArg != sizeArg) {
         return TypeError(cx, "(an object with the same size as that expected by the C finalization function)", valData);
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index fc95129f548..8927bd8728d 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -919,7 +919,7 @@ EmitVarOp(JSContext *cx, ParseNode *pn, JSOp op, BytecodeEmitter *bce)
       case JSOP_GETARG: case JSOP_GETLOCAL: op = JSOP_GETALIASEDVAR; break;
       case JSOP_SETARG: case JSOP_SETLOCAL: op = JSOP_SETALIASEDVAR; break;
       case JSOP_CALLARG: case JSOP_CALLLOCAL: op = JSOP_CALLALIASEDVAR; break;
-      default: JS_NOT_REACHED("unexpected var op");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected var op");
     }
 
     return EmitAliasedVarOp(cx, op, pn, bce);
@@ -1013,7 +1013,7 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
       case Definition::PLACEHOLDER:
       case Definition::NAMED_LAMBDA:
       case Definition::MISSING:
-        JS_NOT_REACHED("unexpected dn->kind");
+        MOZ_ASSUME_UNREACHABLE("unexpected dn->kind");
     }
     return false;
 }
@@ -1108,7 +1108,7 @@ TryConvertFreeName(BytecodeEmitter *bce, ParseNode *pn)
           case JSOP_NAME:     op = JSOP_GETINTRINSIC; break;
           case JSOP_SETNAME:  op = JSOP_SETINTRINSIC; break;
           /* Other *NAME ops aren't (yet) supported in self-hosted code. */
-          default: JS_NOT_REACHED("intrinsic");
+          default: MOZ_ASSUME_UNREACHABLE("intrinsic");
         }
         pn->setOp(op);
         return true;
@@ -1214,7 +1214,7 @@ TryConvertFreeName(BytecodeEmitter *bce, ParseNode *pn)
           case JSOP_SETCONST:
             /* Not supported. */
             return false;
-          default: JS_NOT_REACHED("gname");
+          default: MOZ_ASSUME_UNREACHABLE("gname");
         }
         pn->setOp(op);
         return true;
@@ -1363,7 +1363,7 @@ BindNameToSlotHelper(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         switch (op) {
           case JSOP_NAME:     op = JSOP_GETARG; break;
           case JSOP_SETNAME:  op = JSOP_SETARG; break;
-          default: JS_NOT_REACHED("arg");
+          default: MOZ_ASSUME_UNREACHABLE("arg");
         }
         JS_ASSERT(!pn->isConst());
         break;
@@ -1375,7 +1375,7 @@ BindNameToSlotHelper(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
           case JSOP_NAME:     op = JSOP_GETLOCAL; break;
           case JSOP_SETNAME:  op = JSOP_SETLOCAL; break;
           case JSOP_SETCONST: op = JSOP_SETLOCAL; break;
-          default: JS_NOT_REACHED("local");
+          default: MOZ_ASSUME_UNREACHABLE("local");
         }
         break;
 
@@ -1432,7 +1432,7 @@ BindNameToSlotHelper(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         return true;
 
       case Definition::MISSING:
-        JS_NOT_REACHED("missing");
+        MOZ_ASSUME_UNREACHABLE("missing");
     }
 
     /*
@@ -1624,8 +1624,7 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool *answe
               default:
                 return CheckSideEffects(cx, bce, pn2, answer);
             }
-            MOZ_NOT_REACHED("We have a returning default case");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("We have a returning default case");
           }
 
           case PNK_TYPEOF:
@@ -1648,8 +1647,7 @@ CheckSideEffects(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool *answe
             *answer = true;
             return true;
         }
-        MOZ_NOT_REACHED("We have a returning default case");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("We have a returning default case");
 
       case PN_NAME:
         /*
@@ -3365,7 +3363,7 @@ EmitAssignment(JSContext *cx, BytecodeEmitter *bce, ParseNode *lhs, JSOp op, Par
                   case JSOP_SETARG: op = JSOP_GETARG; break;
                   case JSOP_SETLOCAL: op = JSOP_GETLOCAL; break;
                   case JSOP_SETALIASEDVAR: op = JSOP_GETALIASEDVAR; break;
-                  default: JS_NOT_REACHED("Bad op");
+                  default: MOZ_ASSUME_UNREACHABLE("Bad op");
                 }
                 if (!EmitVarOp(cx, lhs, op, bce))
                     return false;
@@ -3589,7 +3587,7 @@ ParseNode::getConstantValue(JSContext *cx, bool strictChecks, MutableHandleValue
         return true;
       }
       default:
-        JS_NOT_REACHED("Unexpected node");
+        MOZ_ASSUME_UNREACHABLE("Unexpected node");
     }
     return false;
 }
@@ -5423,7 +5421,7 @@ EmitObject(JSContext *cx, BytecodeEmitter *bce, ParseNode *pn)
               case JSOP_INITPROP:        op = JSOP_INITELEM;        break;
               case JSOP_INITPROP_GETTER: op = JSOP_INITELEM_GETTER; break;
               case JSOP_INITPROP_SETTER: op = JSOP_INITELEM_SETTER; break;
-              default: JS_NOT_REACHED("Invalid op");
+              default: MOZ_ASSUME_UNREACHABLE("Invalid op");
             }
             if (Emit1(cx, bce, op) < 0)
                 return false;
diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index 1953caa5c0d..4a807d88ce6 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -381,16 +381,14 @@ Parser<FullParseHandler>::cloneParseTree(ParseNode *opn)
 
       case PN_CODE:
         if (pn->getKind() == PNK_MODULE) {
-            JS_NOT_REACHED("module nodes cannot be cloned");
-            return NULL;
-        } else {
-            NULLCHECK(pn->pn_funbox =
-                      newFunctionBox(opn->pn_funbox->function(), pc, opn->pn_funbox->strict));
-            NULLCHECK(pn->pn_body = cloneParseTree(opn->pn_body));
-            pn->pn_cookie = opn->pn_cookie;
-            pn->pn_dflags = opn->pn_dflags;
-            pn->pn_blockid = opn->pn_blockid;
+            MOZ_ASSUME_UNREACHABLE("module nodes cannot be cloned");
         }
+        NULLCHECK(pn->pn_funbox =
+                  newFunctionBox(opn->pn_funbox->function(), pc, opn->pn_funbox->strict));
+        NULLCHECK(pn->pn_body = cloneParseTree(opn->pn_body));
+        pn->pn_cookie = opn->pn_cookie;
+        pn->pn_dflags = opn->pn_dflags;
+        pn->pn_blockid = opn->pn_blockid;
         break;
 
       case PN_LIST:
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 883df04c953..77c347add71 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -188,8 +188,7 @@ ParseContext<FullParseHandler>::define(JSContext *cx, HandlePropertyName name,
         break;
 
       default:
-        JS_NOT_REACHED("unexpected kind");
-        break;
+        MOZ_ASSUME_UNREACHABLE("unexpected kind");
     }
 
     return true;
@@ -279,7 +278,7 @@ AppendPackedBindings(const ParseContext<ParseHandler> *pc, const DeclVector &vec
             kind = ARGUMENT;
             break;
           default:
-            JS_NOT_REACHED("unexpected dn->kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected dn->kind");
         }
 
         /*
@@ -3975,8 +3974,7 @@ Parser<FullParseHandler>::forStatement()
 
 #if JS_HAS_DESTRUCTURING
           case PNK_ASSIGN:
-            JS_NOT_REACHED("forStatement TOK_ASSIGN");
-            break;
+            MOZ_ASSUME_UNREACHABLE("forStatement TOK_ASSIGN");
 
           case PNK_ARRAY:
           case PNK_OBJECT:
@@ -6656,8 +6654,7 @@ Parser<ParseHandler>::primaryExpr(TokenKind tt)
             } else if (op == JSOP_INITPROP_SETTER) {
                 assignType = SET;
             } else {
-                JS_NOT_REACHED("bad opcode in object initializer");
-                assignType = VALUE; /* try to error early */
+                MOZ_ASSUME_UNREACHABLE("bad opcode in object initializer");
             }
 
             AtomIndexAddPtr p = seen.lookupForAdd(atom);
diff --git a/js/src/gc/RootMarking.cpp b/js/src/gc/RootMarking.cpp
index a4094e18531..1a41c09d1ce 100644
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@@ -66,7 +66,7 @@ MarkExactStackRoot(JSTracer *trc, Rooted<void*> *rooter, ThingRootKind kind)
       case THING_ROOT_PROPERTY_ID: MarkIdRoot(trc, &((js::PropertyId *)addr)->asId(), "exact-propertyid"); break;
       case THING_ROOT_BINDINGS:    ((Bindings *)addr)->trace(trc); break;
       case THING_ROOT_PROPERTY_DESCRIPTOR: ((JSPropertyDescriptor *)addr)->trace(trc); break;
-      default: JS_NOT_REACHED("Invalid THING_ROOT kind"); break;
+      default: MOZ_ASSUME_UNREACHABLE("Invalid THING_ROOT kind"); break;
     }
 }
 
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index c31732e0768..0e660238b44 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -251,8 +251,7 @@ ExplainReason(JS::gcreason::Reason reason)
         GCREASONS(SWITCH_REASON)
 
         default:
-          JS_NOT_REACHED("bad GC reason");
-          return "?";
+          MOZ_ASSUME_UNREACHABLE("bad GC reason");
 #undef SWITCH_REASON
     }
 }
diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index 385b599f77f..9f6fc87e24c 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -70,7 +70,7 @@ StoreBuffer::WholeCellEdges::mark(JSTracer *trc)
     JS_ASSERT(kind == JSTRACE_IONCODE);
     static_cast<ion::IonCode *>(tenured)->trace(trc);
 #else
-    MOZ_NOT_REACHED("Only objects can be in the wholeCellBuffer if IonMonkey is disabled.");
+    MOZ_ASSUME_UNREACHABLE("Only objects can be in the wholeCellBuffer if IonMonkey is disabled.");
 #endif
 }
 
diff --git a/js/src/ion/AsmJS.cpp b/js/src/ion/AsmJS.cpp
index 9b99a18fac2..553105ed73e 100644
--- a/js/src/ion/AsmJS.cpp
+++ b/js/src/ion/AsmJS.cpp
@@ -412,8 +412,7 @@ class Type
           case Unknown:
             return MIRType_None;
         }
-        JS_NOT_REACHED("Invalid Type");
-        return MIRType_None;
+        MOZ_ASSUME_UNREACHABLE("Invalid Type");
     }
 
     const char *toChars() const {
@@ -428,8 +427,7 @@ class Type
           case Void:      return "void";
           case Unknown:   return "unknown";
         }
-        JS_NOT_REACHED("Invalid Type");
-        return "";
+        MOZ_ASSUME_UNREACHABLE("Invalid Type");
     }
 };
 
@@ -468,8 +466,7 @@ class RetType
           case Signed: return AsmJSModule::Return_Int32;
           case Double: return AsmJSModule::Return_Double;
         }
-        JS_NOT_REACHED("Unexpected return type");
-        return AsmJSModule::Return_Void;
+        MOZ_ASSUME_UNREACHABLE("Unexpected return type");
     }
     MIRType toMIRType() const {
         switch (which_) {
@@ -477,8 +474,7 @@ class RetType
           case Signed: return MIRType_Int32;
           case Double: return MIRType_Double;
         }
-        JS_NOT_REACHED("Unexpected return type");
-        return MIRType_None;
+        MOZ_ASSUME_UNREACHABLE("Unexpected return type");
     }
     bool operator==(RetType rhs) const { return which_ == rhs.which_; }
     bool operator!=(RetType rhs) const { return which_ != rhs.which_; }
@@ -493,8 +489,7 @@ operator<=(Type lhs, RetType rhs)
       case RetType::Double: return lhs == Type::Double;
       case RetType::Void:   return lhs == Type::Void;
     }
-    JS_NOT_REACHED("Unexpected rhs type");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected rhs type");
 }
 
 // Represents the subset of Type that can be used as a variable or
@@ -567,8 +562,7 @@ operator<=(Type lhs, VarType rhs)
       case VarType::Int:    return lhs.isInt();
       case VarType::Double: return lhs.isDouble();
     }
-    JS_NOT_REACHED("Unexpected rhs type");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected rhs type");
 }
 
 // Passed from parent expressions to child expressions to indicate if and how
@@ -729,7 +723,7 @@ IsLiteralUint32(ParseNode *pn, uint32_t *u32)
         return false;
     }
 
-    JS_NOT_REACHED("Bad literal type");
+    MOZ_ASSUME_UNREACHABLE("Bad literal type");
 }
 
 static inline bool
@@ -749,7 +743,7 @@ IsBits32(ParseNode *pn, int32_t i)
         return false;
     }
 
-    JS_NOT_REACHED("Bad literal type");
+    MOZ_ASSUME_UNREACHABLE("Bad literal type");
 }
 
 /*****************************************************************************/
@@ -771,8 +765,7 @@ TypedArrayLoadType(ArrayBufferView::ViewType viewType)
         return Type::Doublish;
       default:;
     }
-    JS_NOT_REACHED("Unexpected array type");
-    return Type();
+    MOZ_ASSUME_UNREACHABLE("Unexpected array type");
 }
 
 enum ArrayStoreEnum {
@@ -796,8 +789,7 @@ TypedArrayStoreType(ArrayBufferView::ViewType viewType)
         return ArrayStore_Doublish;
       default:;
     }
-    JS_NOT_REACHED("Unexpected array type");
-    return ArrayStore_Doublish;
+    MOZ_ASSUME_UNREACHABLE("Unexpected array type");
 }
 
 /*****************************************************************************/
@@ -3863,8 +3855,7 @@ IsValidIntMultiplyConstant(ParseNode *expr)
         return false;
     }
 
-    JS_NOT_REACHED("Bad literal");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Bad literal");
 }
 
 static bool
@@ -4042,7 +4033,7 @@ CheckBitwise(FunctionCompiler &f, ParseNode *bitwise, MDefinition **def, Type *t
       case PNK_LSH:    identityElement = 0;  onlyOnRight = true;  *type = Type::Signed;   break;
       case PNK_RSH:    identityElement = 0;  onlyOnRight = true;  *type = Type::Signed;   break;
       case PNK_URSH:   identityElement = 0;  onlyOnRight = true;  *type = Type::Unsigned; break;
-      default: JS_NOT_REACHED("not a bitwise op");
+      default: MOZ_ASSUME_UNREACHABLE("not a bitwise op");
     }
 
     if (!onlyOnRight && IsBits32(lhs, identityElement)) {
@@ -4088,7 +4079,7 @@ CheckBitwise(FunctionCompiler &f, ParseNode *bitwise, MDefinition **def, Type *t
       case PNK_LSH:    *def = f.bitwise<MLsh>(lhsDef, rhsDef); break;
       case PNK_RSH:    *def = f.bitwise<MRsh>(lhsDef, rhsDef); break;
       case PNK_URSH:   *def = f.bitwise<MUrsh>(lhsDef, rhsDef); break;
-      default: JS_NOT_REACHED("not a bitwise op");
+      default: MOZ_ASSUME_UNREACHABLE("not a bitwise op");
     }
 
     return true;
@@ -5636,7 +5627,7 @@ GenerateOOLConvert(ModuleCompiler &m, RetType retType, Label *throwLabel)
 #endif
           break;
       default:
-          JS_NOT_REACHED("Unsupported convert type");
+          MOZ_ASSUME_UNREACHABLE("Unsupported convert type");
     }
 
     masm.freeStack(stackDec);
diff --git a/js/src/ion/BacktrackingAllocator.cpp b/js/src/ion/BacktrackingAllocator.cpp
index 83563fa87e5..17f95f3689c 100644
--- a/js/src/ion/BacktrackingAllocator.cpp
+++ b/js/src/ion/BacktrackingAllocator.cpp
@@ -1151,7 +1151,7 @@ BacktrackingAllocator::populateSafepoints()
                     break;
 #endif
                   default:
-                    JS_NOT_REACHED("Bad register type");
+                    MOZ_ASSUME_UNREACHABLE("Bad register type");
                 }
             }
         }
@@ -1439,7 +1439,7 @@ BacktrackingAllocator::computeSpillWeight(const LiveInterval *interval)
 
           default:
             // Note: RECOVERED_INPUT will not appear in UsePositionIterator.
-            JS_NOT_REACHED("Bad use");
+            MOZ_ASSUME_UNREACHABLE("Bad use");
         }
     }
 
diff --git a/js/src/ion/BaselineBailouts.cpp b/js/src/ion/BaselineBailouts.cpp
index f737c62e470..5fb068fd074 100644
--- a/js/src/ion/BaselineBailouts.cpp
+++ b/js/src/ion/BaselineBailouts.cpp
@@ -1328,7 +1328,7 @@ ion::FinishBailoutToBaseline(BaselineBailoutInfo *bailoutInfo)
             return false;
         break;
       default:
-        JS_NOT_REACHED("Unknown bailout kind!");
+        MOZ_ASSUME_UNREACHABLE("Unknown bailout kind!");
     }
 
     if (!CheckFrequentBailouts(cx, outerScript))
diff --git a/js/src/ion/BaselineCompiler.cpp b/js/src/ion/BaselineCompiler.cpp
index e9fd8f63215..2940551e1bf 100644
--- a/js/src/ion/BaselineCompiler.cpp
+++ b/js/src/ion/BaselineCompiler.cpp
@@ -1087,7 +1087,7 @@ BaselineCompiler::storeValue(const StackValue *source, const Address &dest,
         masm.storeValue(scratch, dest);
         break;
       default:
-        JS_NOT_REACHED("Invalid kind");
+        MOZ_ASSUME_UNREACHABLE("Invalid kind");
     }
 }
 
diff --git a/js/src/ion/BaselineFrameInfo.cpp b/js/src/ion/BaselineFrameInfo.cpp
index a0441160c79..8ad1f66759f 100644
--- a/js/src/ion/BaselineFrameInfo.cpp
+++ b/js/src/ion/BaselineFrameInfo.cpp
@@ -48,8 +48,7 @@ FrameInfo::sync(StackValue *val)
         masm.pushValue(val->constant());
         break;
       default:
-        JS_NOT_REACHED("Invalid kind");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Invalid kind");
     }
 
     val->setStack();
@@ -105,7 +104,7 @@ FrameInfo::popValue(ValueOperand dest)
         masm.moveValue(val->reg(), dest);
         break;
       default:
-        JS_NOT_REACHED("Invalid kind");
+        MOZ_ASSUME_UNREACHABLE("Invalid kind");
     }
 
     // masm.popValue already adjusted the stack pointer, don't do it twice.
@@ -141,7 +140,7 @@ FrameInfo::popRegsAndSync(uint32_t uses)
         break;
       }
       default:
-        JS_NOT_REACHED("Invalid uses");
+        MOZ_ASSUME_UNREACHABLE("Invalid uses");
     }
 }
 
@@ -178,7 +177,7 @@ FrameInfo::assertValidState(const BytecodeInfo &info)
                 JS_ASSERT(!usedR1);
                 usedR1 = true;
             } else {
-                JS_NOT_REACHED("Invalid register");
+                MOZ_ASSUME_UNREACHABLE("Invalid register");
             }
         }
     }
diff --git a/js/src/ion/BaselineIC.cpp b/js/src/ion/BaselineIC.cpp
index 3d4a3dcdbc7..06e0939d7c3 100644
--- a/js/src/ion/BaselineIC.cpp
+++ b/js/src/ion/BaselineIC.cpp
@@ -220,7 +220,7 @@ ICStub::trace(JSTracer *trc)
           case 2: setElemStub->toImpl<2>()->traceShapes(trc); break;
           case 3: setElemStub->toImpl<3>()->traceShapes(trc); break;
           case 4: setElemStub->toImpl<4>()->traceShapes(trc); break;
-          default: JS_NOT_REACHED("Invalid proto stub.");
+          default: MOZ_ASSUME_UNREACHABLE("Invalid proto stub.");
         }
         break;
       }
@@ -358,7 +358,7 @@ ICStub::trace(JSTracer *trc)
           case 2: propStub->toImpl<2>()->traceShapes(trc); break;
           case 3: propStub->toImpl<3>()->traceShapes(trc); break;
           case 4: propStub->toImpl<4>()->traceShapes(trc); break;
-          default: JS_NOT_REACHED("Invalid proto stub.");
+          default: MOZ_ASSUME_UNREACHABLE("Invalid proto stub.");
         }
         break;
       }
@@ -723,7 +723,7 @@ EnsureCanEnterIon(JSContext *cx, ICUseCount_Fallback *stub, BaselineFrame *frame
     else if (stat == Method_Compiled)
         IonSpew(IonSpew_BaselineOSR, "  Compiled with Ion!");
     else
-        JS_NOT_REACHED("Invalid MethodStatus!");
+        MOZ_ASSUME_UNREACHABLE("Invalid MethodStatus!");
 
     // Failed to compile.  Reset use count and return.
     if (stat != Method_Compiled) {
@@ -1436,8 +1436,7 @@ DoTypeUpdateFallback(JSContext *cx, BaselineFrame *frame, ICUpdatedStub *stub, H
         break;
       }
       default:
-        JS_NOT_REACHED("Invalid stub");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Invalid stub");
     }
 
     return stub->addUpdateStubForValue(cx, script, obj, id, value);
@@ -2464,8 +2463,7 @@ DoBinaryArithFallback(JSContext *cx, BaselineFrame *frame, ICBinaryArith_Fallbac
         break;
       }
       default:
-        JS_NOT_REACHED("Unhandled baseline arith op");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unhandled baseline arith op");
     }
 
     if (ret.isDouble())
@@ -2783,8 +2781,7 @@ ICBinaryArith_Double::Compiler::generateStubCode(MacroAssembler &masm)
         JS_ASSERT(ReturnFloatReg == FloatReg0);
         break;
       default:
-        JS_NOT_REACHED("Unexpected op");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     masm.boxDouble(FloatReg0, R0);
@@ -2864,8 +2861,7 @@ ICBinaryArith_BooleanWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         break;
       }
       default:
-       JS_NOT_REACHED("Unhandled op for BinaryArith_BooleanWithInt32.");
-       return false;
+       MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_BooleanWithInt32.");
     }
 
     // Failure case - jump to next stub
@@ -2927,8 +2923,7 @@ ICBinaryArith_DoubleWithInt32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.andPtr(intReg, intReg2);
         break;
       default:
-       JS_NOT_REACHED("Unhandled op for BinaryArith_DoubleWithInt32.");
-       return false;
+       MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_DoubleWithInt32.");
     }
     masm.tagValue(JSVAL_TYPE_INT32, intReg2, R0);
     EmitReturnFromIC(masm);
@@ -2969,8 +2964,7 @@ DoUnaryArithFallback(JSContext *cx, BaselineFrame *frame, ICUnaryArith_Fallback
             return false;
         break;
       default:
-        JS_NOT_REACHED("Unexpected op");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     if (res.isDouble())
@@ -4478,7 +4472,7 @@ ICSetElemDenseAddCompiler::getStub(ICStubSpace *space)
       case 2: stub = getStubSpecific<2>(space, &shapes); break;
       case 3: stub = getStubSpecific<3>(space, &shapes); break;
       case 4: stub = getStubSpecific<4>(space, &shapes); break;
-      default: JS_NOT_REACHED("ProtoChainDepth too high.");
+      default: MOZ_ASSUME_UNREACHABLE("ProtoChainDepth too high.");
     }
     if (!stub || !stub->initUpdatingChain(cx, space))
         return NULL;
@@ -6452,7 +6446,7 @@ ICSetPropNativeAddCompiler::getStub(ICStubSpace *space)
       case 2: stub = getStubSpecific<2>(space, &shapes); break;
       case 3: stub = getStubSpecific<3>(space, &shapes); break;
       case 4: stub = getStubSpecific<4>(space, &shapes); break;
-      default: JS_NOT_REACHED("ProtoChainDepth too high.");
+      default: MOZ_ASSUME_UNREACHABLE("ProtoChainDepth too high.");
     }
     if (!stub || !stub->initUpdatingChain(cx, space))
         return NULL;
@@ -8139,7 +8133,7 @@ ICTypeOf_Typed::Compiler::generateStubCode(MacroAssembler &masm)
         break;
 
       default:
-        JS_NOT_REACHED("Unexpected type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected type");
     }
 
     masm.movePtr(ImmGCPtr(typeString_), R0.scratchReg());
diff --git a/js/src/ion/BaselineIC.h b/js/src/ion/BaselineIC.h
index 6c0568da225..a7ad3c6f1eb 100644
--- a/js/src/ion/BaselineIC.h
+++ b/js/src/ion/BaselineIC.h
@@ -544,8 +544,7 @@ class ICStub
             IC_STUB_KIND_LIST(DEF_KIND_STR)
 #undef DEF_KIND_STR
           default:
-            JS_NOT_REACHED("Invalid kind.");
-            return "INVALID_KIND";
+            MOZ_ASSUME_UNREACHABLE("Invalid kind.");
         }
     }
 
@@ -1046,7 +1045,7 @@ class ICStubCompiler
             regs.take(R1);
             break;
           default:
-            JS_NOT_REACHED("Invalid numInputs");
+            MOZ_ASSUME_UNREACHABLE("Invalid numInputs");
         }
 
         return regs;
diff --git a/js/src/ion/BaselineJIT.cpp b/js/src/ion/BaselineJIT.cpp
index fd633dd7621..d17d41583fa 100644
--- a/js/src/ion/BaselineJIT.cpp
+++ b/js/src/ion/BaselineJIT.cpp
@@ -490,8 +490,7 @@ BaselineScript::icEntryFromPCOffset(uint32_t pcOffset)
         if (icEntry(i).isForOp())
             return icEntry(i);
     }
-    JS_NOT_REACHED("Invalid PC offset for IC entry.");
-    return icEntry(mid);
+    MOZ_ASSUME_UNREACHABLE("Invalid PC offset for IC entry.");
 }
 
 ICEntry &
@@ -636,8 +635,7 @@ BaselineScript::nativeCodeForPC(JSScript *script, jsbytecode *pc, PCMappingSlotI
         curPC += GetBytecodeLength(curPC);
     }
 
-    JS_NOT_REACHED("Invalid pc");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("Invalid pc");
 }
 
 jsbytecode *
@@ -681,8 +679,7 @@ BaselineScript::pcForReturnOffset(JSScript *script, uint32_t nativeOffset)
         curPC += GetBytecodeLength(curPC);
     }
 
-    JS_NOT_REACHED("Invalid pc");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("Invalid pc");
 }
 
 jsbytecode *
diff --git a/js/src/ion/CodeGenerator.cpp b/js/src/ion/CodeGenerator.cpp
index c7974fc6957..efb93018894 100644
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -596,7 +596,7 @@ CodeGenerator::visitIntToString(LIntToString *lir)
                         StoreRegisterTo(output));
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
     if (!ool)
         return false;
@@ -637,7 +637,7 @@ CodeGenerator::visitDoubleToString(LDoubleToString *lir)
                         StoreRegisterTo(output));
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
     if (!ool)
         return false;
@@ -3526,7 +3526,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
         funptr = JS_FUNC_TO_DATA_PTR(void *, js::math_acos_impl);
         break;
       default:
-        JS_NOT_REACHED("Unknown math function");
+        MOZ_ASSUME_UNREACHABLE("Unknown math function");
     }
 
     masm.callWithABI(funptr, MacroAssembler::DOUBLE);
@@ -3588,8 +3588,7 @@ CodeGenerator::visitBinaryV(LBinaryV *lir)
         return callVM(UrshInfo, lir);
 
       default:
-        JS_NOT_REACHED("Unexpected binary op");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unexpected binary op");
     }
 }
 
@@ -3736,8 +3735,7 @@ CodeGenerator::visitCompareVM(LCompareVM *lir)
             return callVM(GeInfo, lir);
 
           default:
-            JS_NOT_REACHED("Unexpected compare op");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unexpected compare op");
         }
 
       case ParallelExecution:
@@ -3767,12 +3765,11 @@ CodeGenerator::visitCompareVM(LCompareVM *lir)
             return callVM(ParGeInfo, lir);
 
           default:
-            JS_NOT_REACHED("Unexpected compare op");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unexpected compare op");
         }
     }
 
-    JS_NOT_REACHED("Unexpected exec mode");
+    MOZ_ASSUME_UNREACHABLE("Unexpected exec mode");
 }
 
 bool
@@ -4138,7 +4135,7 @@ IonCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
         masm.pop(temp1);
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     // Store lengthAndFlags.
@@ -4183,7 +4180,7 @@ IonCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
         masm.pop(temp1);
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     // Set lengthAndFlags.
@@ -5729,7 +5726,7 @@ CodeGenerator::addGetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Regi
         return addCache(ins, allocateCache(cache));
       }
       default:
-        JS_NOT_REACHED("Bad execution mode");
+        MOZ_ASSUME_UNREACHABLE("Bad execution mode");
     }
 }
 
@@ -6072,8 +6069,7 @@ CodeGenerator::visitBitOpV(LBitOpV *lir)
       default:
         break;
     }
-    JS_NOT_REACHED("unexpected bitop");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("unexpected bitop");
 }
 
 class OutOfLineTypeOfV : public OutOfLineCodeBase<CodeGenerator>
@@ -6917,7 +6913,7 @@ CodeGenerator::visitFunctionBoundary(LFunctionBoundary *lir)
             return true;
 
         default:
-            JS_NOT_REACHED("invalid LFunctionBoundary type");
+            MOZ_ASSUME_UNREACHABLE("invalid LFunctionBoundary type");
     }
 }
 
diff --git a/js/src/ion/CompactBuffer.h b/js/src/ion/CompactBuffer.h
index 599e0e530dc..04e124eb9fd 100644
--- a/js/src/ion/CompactBuffer.h
+++ b/js/src/ion/CompactBuffer.h
@@ -42,8 +42,7 @@ class CompactBufferReader
             if (!(byte & 1))
                 return val;
         }
-        JS_NOT_REACHED("unreachable");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("unreachable");
     }
 
   public:
diff --git a/js/src/ion/ExecutionModeInlines.h b/js/src/ion/ExecutionModeInlines.h
index 752473b957f..fa7ffbcae47 100644
--- a/js/src/ion/ExecutionModeInlines.h
+++ b/js/src/ion/ExecutionModeInlines.h
@@ -19,8 +19,7 @@ HasIonScript(JSScript *script, ExecutionMode cmode)
       case SequentialExecution: return script->hasIonScript();
       case ParallelExecution: return script->hasParallelIonScript();
     }
-    JS_NOT_REACHED("No such execution mode");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline IonScript *
@@ -30,8 +29,7 @@ GetIonScript(JSScript *script, ExecutionMode cmode)
       case SequentialExecution: return script->maybeIonScript();
       case ParallelExecution: return script->maybeParallelIonScript();
     }
-    JS_NOT_REACHED("No such execution mode");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline void
@@ -41,7 +39,7 @@ SetIonScript(JSScript *script, ExecutionMode cmode, IonScript *ionScript)
       case SequentialExecution: script->setIonScript(ionScript); return;
       case ParallelExecution: script->setParallelIonScript(ionScript); return;
     }
-    JS_NOT_REACHED("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline size_t
@@ -51,7 +49,7 @@ OffsetOfIonInJSScript(ExecutionMode cmode)
       case SequentialExecution: return JSScript::offsetOfIonScript();
       case ParallelExecution: return JSScript::offsetOfParallelIonScript();
     }
-    JS_NOT_REACHED("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline bool
@@ -61,7 +59,7 @@ CanIonCompile(JSScript *script, ExecutionMode cmode)
       case SequentialExecution: return script->canIonCompile();
       case ParallelExecution: return script->canParallelIonCompile();
     }
-    JS_NOT_REACHED("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
     return false;
 }
 
@@ -78,8 +76,7 @@ CompilingOffThread(JSScript *script, ExecutionMode cmode)
       case SequentialExecution: return script->isIonCompilingOffThread();
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
     }
-    JS_NOT_REACHED("No such execution mode");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline bool
@@ -89,8 +86,7 @@ CompilingOffThread(HandleScript script, ExecutionMode cmode)
       case SequentialExecution: return script->isIonCompilingOffThread();
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
     }
-    JS_NOT_REACHED("No such execution mode");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 static inline types::CompilerOutput::Kind
@@ -100,8 +96,7 @@ CompilerOutputKind(ExecutionMode cmode)
       case SequentialExecution: return types::CompilerOutput::Ion;
       case ParallelExecution: return types::CompilerOutput::ParallelIon;
     }
-    JS_NOT_REACHED("No such execution mode");
-    return types::CompilerOutput::Ion;
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 } // namespace ion
diff --git a/js/src/ion/FixedArityList.h b/js/src/ion/FixedArityList.h
index c595427e33d..06370b20e40 100644
--- a/js/src/ion/FixedArityList.h
+++ b/js/src/ion/FixedArityList.h
@@ -35,14 +35,10 @@ class FixedArityList<T, 0>
 {
   public:
     T &operator [](size_t index) {
-        JS_NOT_REACHED("no items");
-        static T *operand = NULL;
-        return *operand;
+        MOZ_ASSUME_UNREACHABLE("no items");
     }
     const T &operator [](size_t index) const {
-        JS_NOT_REACHED("no items");
-        static T *operand = NULL;
-        return *operand;
+        MOZ_ASSUME_UNREACHABLE("no items");
     }
 };
 
diff --git a/js/src/ion/Ion.cpp b/js/src/ion/Ion.cpp
index 40f7ce7da6c..770e8e77249 100644
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -819,8 +819,7 @@ IonScript::getSafepointIndex(uint32_t disp) const
         }
     }
 
-    JS_NOT_REACHED("displacement not found.");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("displacement not found.");
 }
 
 const OsiIndex *
@@ -834,8 +833,7 @@ IonScript::getOsiIndex(uint32_t disp) const
             return it;
     }
 
-    JS_NOT_REACHED("Failed to find OSI point return address");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("Failed to find OSI point return address");
 }
 
 const OsiIndex *
@@ -1218,7 +1216,7 @@ GenerateLIR(MIRGenerator *mir)
       }
 
       default:
-        JS_NOT_REACHED("Bad regalloc");
+        MOZ_ASSUME_UNREACHABLE("Bad regalloc");
     }
 
     if (mir->shouldCancel("Allocate Registers"))
@@ -2005,8 +2003,7 @@ InvalidateActivation(FreeOp *fop, uint8_t *ionTop, bool invalidateAll)
             break;
           case IonFrame_Unwound_OptimizedJS:
           case IonFrame_Unwound_BaselineStub:
-            JS_NOT_REACHED("invalid");
-            break;
+            MOZ_ASSUME_UNREACHABLE("invalid");
           case IonFrame_Unwound_Rectifier:
             IonSpew(IonSpew_Invalidate, "#%d unwound rectifier frame @ %p", frameno, it.fp());
             break;
@@ -2318,7 +2315,7 @@ ion::ForbidCompilation(JSContext *cx, JSScript *script, ExecutionMode mode)
         return;
     }
 
-    JS_NOT_REACHED("No such execution mode");
+    MOZ_ASSUME_UNREACHABLE("No such execution mode");
 }
 
 uint32_t
diff --git a/js/src/ion/IonAnalysis.cpp b/js/src/ion/IonAnalysis.cpp
index 646beeb9a2a..df475db357b 100644
--- a/js/src/ion/IonAnalysis.cpp
+++ b/js/src/ion/IonAnalysis.cpp
@@ -570,8 +570,7 @@ TypeAnalyzer::replaceRedundantPhi(MPhi *phi)
         v = MagicValue(JS_OPTIMIZED_ARGUMENTS);
         break;
       default:
-        JS_NOT_REACHED("unexpected type");
-        return;
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
     MConstant *c = MConstant::New(v);
     // The instruction pass will insert the box
diff --git a/js/src/ion/IonBuilder.cpp b/js/src/ion/IonBuilder.cpp
index 788c0243460..7647a99c5ab 100644
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -1104,8 +1104,7 @@ IonBuilder::snoopControlFlow(JSOp op)
 
           default:
             // Hard assert for now - make an error later.
-            JS_NOT_REACHED("unknown goto case");
-            break;
+            MOZ_ASSUME_UNREACHABLE("unknown goto case");
         }
         break;
       }
@@ -1116,8 +1115,7 @@ IonBuilder::snoopControlFlow(JSOp op)
       case JSOP_IFNE:
         // We should never reach an IFNE, it's a stopAt point, which will
         // trigger closing the loop.
-        JS_NOT_REACHED("we should never reach an ifne!");
-        return ControlStatus_Error;
+        MOZ_ASSUME_UNREACHABLE("we should never reach an ifne!");
 
       default:
         break;
@@ -1405,8 +1403,7 @@ IonBuilder::inspectOpcode(JSOp op)
 
       case JSOP_LOOPHEAD:
         // JSOP_LOOPHEAD is handled when processing the loop header.
-        JS_NOT_REACHED("JSOP_LOOPHEAD outside loop");
-        return true;
+        MOZ_ASSUME_UNREACHABLE("JSOP_LOOPHEAD outside loop");
 
       case JSOP_GETELEM:
       case JSOP_CALLELEM:
@@ -1606,9 +1603,8 @@ IonBuilder::processCfgEntry(CFGState &state)
         return processLabelEnd(state);
 
       default:
-        JS_NOT_REACHED("unknown cfgstate");
+        MOZ_ASSUME_UNREACHABLE("unknown cfgstate");
     }
-    return ControlStatus_Error;
 }
 
 IonBuilder::ControlStatus
@@ -2255,8 +2251,7 @@ IonBuilder::processSwitchBreak(JSOp op)
         breaks = &state.condswitch.breaks;
         break;
       default:
-        JS_NOT_REACHED("Unexpected switch state.");
-        return ControlStatus_Error;
+        MOZ_ASSUME_UNREACHABLE("Unexpected switch state.");
     }
 
     *breaks = new DeferredEdge(current, *breaks);
@@ -2332,8 +2327,7 @@ IonBuilder::maybeLoop(JSOp op, jssrcnote *sn)
         break;
 
       default:
-        JS_NOT_REACHED("unexpected opcode");
-        return ControlStatus_Error;
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
 
     return ControlStatus_None;
@@ -2363,8 +2357,7 @@ IonBuilder::assertValidLoopHeadOp(jsbytecode *pc)
             break;
 
           default:
-            JS_NOT_REACHED("JSOP_LOOPHEAD unexpected source note");
-            return;
+            MOZ_ASSUME_UNREACHABLE("JSOP_LOOPHEAD unexpected source note");
         }
 
         // Make sure this loop goes to the same ifne as the loop header's
@@ -3146,8 +3139,7 @@ IonBuilder::jsop_ifeq(JSOp op)
       }
 
       default:
-        JS_NOT_REACHED("unexpected source note type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("unexpected source note type");
     }
 
     // Switch to parsing the true branch. Note that no PC update is needed,
@@ -3176,8 +3168,7 @@ IonBuilder::processReturn(JSOp op)
 
       default:
         def = NULL;
-        JS_NOT_REACHED("unknown return op");
-        break;
+        MOZ_ASSUME_UNREACHABLE("unknown return op");
     }
 
     if (instrumentedProfiling())
@@ -3266,8 +3257,7 @@ IonBuilder::jsop_bitop(JSOp op)
         break;
 
       default:
-        JS_NOT_REACHED("unexpected bitop");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected bitop");
     }
 
     current->add(ins);
@@ -3324,8 +3314,7 @@ IonBuilder::jsop_binary(JSOp op, MDefinition *left, MDefinition *right)
         break;
 
       default:
-        JS_NOT_REACHED("unexpected binary opcode");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected binary opcode");
     }
 
     bool overflowed = types::HasOperationOverflowed(script(), pc);
@@ -6087,8 +6076,7 @@ ion::TypeSetIncludes(types::TypeSet *types, MIRType input, types::TypeSet *input
         return types->unknown() || (inputTypes && inputTypes->isSubset(types));
 
       default:
-        JS_NOT_REACHED("Bad input type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Bad input type");
     }
 }
 
@@ -6596,8 +6584,7 @@ IonBuilder::jsop_getelem_typed(int arrayType)
             knownType = MIRType_Double;
             break;
           default:
-            JS_NOT_REACHED("Unknown typed array type");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unknown typed array type");
         }
 
         // Get the length.
@@ -6643,8 +6630,7 @@ IonBuilder::jsop_getelem_typed(int arrayType)
                 needsBarrier = false;
             break;
           default:
-            JS_NOT_REACHED("Unknown typed array type");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unknown typed array type");
         }
 
         // Assume we will read out-of-bound values. In this case the
diff --git a/js/src/ion/IonCaches.cpp b/js/src/ion/IonCaches.cpp
index d9ab71d4942..5f0d63b59dc 100644
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -2834,8 +2834,7 @@ IsCacheableScopeChain(JSObject *scopeChain, JSObject *holder)
         }
     }
 
-    JS_NOT_REACHED("Shouldn't get here");
-    return false;
+    MOZ_ASSUME_UNREACHABLE();
 }
 
 JSObject *
diff --git a/js/src/ion/IonCaches.h b/js/src/ion/IonCaches.h
index 7d2525e6a59..4f8dc0462a5 100644
--- a/js/src/ion/IonCaches.h
+++ b/js/src/ion/IonCaches.h
@@ -38,8 +38,7 @@ class IonCacheVisitor
   public:
 #define VISIT_INS(op)                                               \
     virtual bool visit##op##IC(CodeGenerator *codegen, op##IC *) {  \
-        JS_NOT_REACHED("NYI: " #op "IC");                           \
-        return false;                                               \
+        MOZ_ASSUME_UNREACHABLE("NYI: " #op "IC");                   \
     }
 
     IONCACHE_KIND_LIST(VISIT_INS)
diff --git a/js/src/ion/IonCompartment.h b/js/src/ion/IonCompartment.h
index 7e55314d49e..b93de6b71c7 100644
--- a/js/src/ion/IonCompartment.h
+++ b/js/src/ion/IonCompartment.h
@@ -290,7 +290,7 @@ class IonCompartment
         switch (mode) {
           case SequentialExecution: return rt->argumentsRectifier_;
           case ParallelExecution:   return rt->parallelArgumentsRectifier_;
-          default:                  JS_NOT_REACHED("No such execution mode");
+          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
         }
     }
 
@@ -326,7 +326,7 @@ class IonCompartment
         switch (mode) {
           case SequentialExecution: return stringConcatStub_;
           case ParallelExecution:   return parallelStringConcatStub_;
-          default:                  JS_NOT_REACHED("No such execution mode");
+          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
         }
     }
 
diff --git a/js/src/ion/IonFrames-inl.h b/js/src/ion/IonFrames-inl.h
index 144cbf7e9fb..97970a501a4 100644
--- a/js/src/ion/IonFrames-inl.h
+++ b/js/src/ion/IonFrames-inl.h
@@ -47,9 +47,8 @@ SizeOfFramePrefix(FrameType type)
       case IonFrame_Osr:
         return IonOsrFrameLayout::Size();
       default:
-        JS_NOT_REACHED("unknown frame type");
+        MOZ_ASSUME_UNREACHABLE("unknown frame type");
     }
-    return 0;
 }
 
 inline IonCommonFrameLayout *
diff --git a/js/src/ion/IonFrames.cpp b/js/src/ion/IonFrames.cpp
index d2b13e36f7c..ffe55842531 100644
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -394,7 +394,7 @@ HandleException(JSContext *cx, const IonFrameIterator &frame, ResumeFromExceptio
             return;
 
           default:
-            JS_NOT_REACHED("Invalid trap status");
+            MOZ_ASSUME_UNREACHABLE("Invalid trap status");
         }
     }
 
@@ -456,7 +456,7 @@ HandleException(JSContext *cx, const IonFrameIterator &frame, ResumeFromExceptio
             break;
 
           default:
-            JS_NOT_REACHED("Invalid try note");
+            MOZ_ASSUME_UNREACHABLE("Invalid try note");
         }
     }
 
@@ -627,7 +627,7 @@ MarkCalleeToken(JSTracer *trc, CalleeToken token)
         return CalleeToToken(script);
       }
       default:
-        JS_NOT_REACHED("unknown callee token type");
+        MOZ_ASSUME_UNREACHABLE("unknown callee token type");
     }
 }
 
@@ -777,8 +777,7 @@ JitActivationIterator::jitStackRange(uintptr_t *&min, uintptr_t *&end)
         if (exitFrame->isWrapperExit() && f->outParam == Type_Handle) {
             switch (f->outParamRootType) {
               case VMFunction::RootNone:
-                JS_NOT_REACHED("Handle outparam must have root type");
-                break;
+                MOZ_ASSUME_UNREACHABLE("Handle outparam must have root type");
               case VMFunction::RootObject:
               case VMFunction::RootString:
               case VMFunction::RootPropertyName:
@@ -920,8 +919,7 @@ MarkIonExitFrame(JSTracer *trc, const IonFrameIterator &frame)
     if (f->outParam == Type_Handle) {
         switch (f->outParamRootType) {
           case VMFunction::RootNone:
-            JS_NOT_REACHED("Handle outparam must have root type");
-            break;
+            MOZ_ASSUME_UNREACHABLE("Handle outparam must have root type");
           case VMFunction::RootObject:
             gc::MarkObjectRoot(trc, footer->outParam<JSObject *>(), "ion-vm-out");
             break;
@@ -960,8 +958,7 @@ MarkJitActivation(JSTracer *trc, const JitActivationIterator &activations)
             MarkIonJSFrame(trc, frames);
             break;
           case IonFrame_Unwound_OptimizedJS:
-            JS_NOT_REACHED("invalid");
-            break;
+            MOZ_ASSUME_UNREACHABLE("invalid");
           case IonFrame_Rectifier:
           case IonFrame_Unwound_Rectifier:
             break;
@@ -971,8 +968,7 @@ MarkJitActivation(JSTracer *trc, const JitActivationIterator &activations)
             // dead.
             break;
           default:
-            JS_NOT_REACHED("unexpected frame type");
-            break;
+            MOZ_ASSUME_UNREACHABLE("unexpected frame type");
         }
     }
 }
@@ -1114,8 +1110,7 @@ SnapshotIterator::FromTypedPayload(JSValueType type, uintptr_t payload)
       case JSVAL_TYPE_OBJECT:
         return ObjectValue(*reinterpret_cast<JSObject *>(payload));
       default:
-        JS_NOT_REACHED("unexpected type - needs payload");
-        return UndefinedValue();
+        MOZ_ASSUME_UNREACHABLE("unexpected type - needs payload");
     }
 }
 
@@ -1184,8 +1179,7 @@ SnapshotIterator::slotValue(const Slot &slot)
         return ionScript_->getConstant(slot.constantIndex());
 
       default:
-        JS_NOT_REACHED("huh?");
-        return UndefinedValue();
+        MOZ_ASSUME_UNREACHABLE("huh?");
     }
 }
 
@@ -1204,7 +1198,7 @@ IonFrameIterator::ionScript() const
       case CalleeToken_ParallelFunction:
         return script()->parallelIonScript();
       default:
-        JS_NOT_REACHED("unknown callee token type");
+        MOZ_ASSUME_UNREACHABLE("unknown callee token type");
     }
 }
 
diff --git a/js/src/ion/IonFrames.h b/js/src/ion/IonFrames.h
index a0f243a85fb..8ac412c3932 100644
--- a/js/src/ion/IonFrames.h
+++ b/js/src/ion/IonFrames.h
@@ -90,8 +90,7 @@ ScriptFromCalleeToken(CalleeToken token)
       case CalleeToken_ParallelFunction:
         return CalleeTokenToParallelFunction(token)->nonLazyScript();
     }
-    JS_NOT_REACHED("invalid callee token tag");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("invalid callee token tag");
 }
 
 // In between every two frames lies a small header describing both frames. This
diff --git a/js/src/ion/IonMacroAssembler.cpp b/js/src/ion/IonMacroAssembler.cpp
index 8c2806f476a..22c13e87627 100644
--- a/js/src/ion/IonMacroAssembler.cpp
+++ b/js/src/ion/IonMacroAssembler.cpp
@@ -307,8 +307,7 @@ MacroAssembler::loadFromTypedArray(int arrayType, const T &src, AnyRegister dest
         canonicalizeDouble(dest.fpu());
         break;
       default:
-        JS_NOT_REACHED("Invalid typed array type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
     }
 }
 
@@ -363,8 +362,7 @@ MacroAssembler::loadFromTypedArray(int arrayType, const T &src, const ValueOpera
         boxDouble(ScratchFloatReg, dest);
         break;
       default:
-        JS_NOT_REACHED("Invalid typed array type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
     }
 }
 
@@ -1051,7 +1049,7 @@ MacroAssembler::enterExitFrameAndLoadContext(const VMFunction *f, Register cxReg
         enterParallelExitFrameAndLoadSlice(f, cxReg, scratch);
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 }
 
@@ -1073,7 +1071,7 @@ MacroAssembler::handleFailure(ExecutionMode executionMode)
         handler = JS_FUNC_TO_DATA_PTR(void *, ion::HandleParallelFailure);
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
     MacroAssemblerSpecific::handleFailureWithHandler(handler);
 
@@ -1093,7 +1091,7 @@ MacroAssembler::tagCallee(Register callee, ExecutionMode mode)
         orPtr(Imm32(CalleeToken_ParallelFunction), callee);
         return;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 }
 
@@ -1108,7 +1106,7 @@ MacroAssembler::clearCalleeTag(Register callee, ExecutionMode mode)
         andPtr(Imm32(~0x3), callee);
         return;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 }
 
@@ -1257,8 +1255,7 @@ MacroAssembler::PushEmptyRooted(VMFunction::RootType rootType)
 {
     switch (rootType) {
       case VMFunction::RootNone:
-        JS_NOT_REACHED("Handle must have root type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Handle must have root type");
       case VMFunction::RootObject:
       case VMFunction::RootString:
       case VMFunction::RootPropertyName:
@@ -1278,8 +1275,7 @@ MacroAssembler::popRooted(VMFunction::RootType rootType, Register cellReg,
 {
     switch (rootType) {
       case VMFunction::RootNone:
-        JS_NOT_REACHED("Handle must have root type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Handle must have root type");
       case VMFunction::RootObject:
       case VMFunction::RootString:
       case VMFunction::RootPropertyName:
diff --git a/js/src/ion/IonMacroAssembler.h b/js/src/ion/IonMacroAssembler.h
index 110de6d058f..fb47e017950 100644
--- a/js/src/ion/IonMacroAssembler.h
+++ b/js/src/ion/IonMacroAssembler.h
@@ -189,7 +189,7 @@ class MacroAssembler : public MacroAssemblerSpecific
           case MIRType_Object:      return testObject(cond, val);
           case MIRType_Double:      return testDouble(cond, val);
           default:
-            JS_NOT_REACHED("Bad MIRType");
+            MOZ_ASSUME_UNREACHABLE("Bad MIRType");
         }
     }
 
@@ -546,8 +546,7 @@ class MacroAssembler : public MacroAssemblerSpecific
             store32(value, dest);
             break;
           default:
-            JS_NOT_REACHED("Invalid typed array type");
-            break;
+            MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
         }
     }
 
@@ -562,8 +561,7 @@ class MacroAssembler : public MacroAssemblerSpecific
             storeDouble(value, dest);
             break;
           default:
-            JS_NOT_REACHED("Invalid typed array type");
-            break;
+            MOZ_ASSUME_UNREACHABLE("Invalid typed array type");
         }
     }
 
@@ -946,8 +944,7 @@ JSOpToDoubleCondition(JSOp op)
       case JSOP_GE:
         return Assembler::DoubleGreaterThanOrEqual;
       default:
-        JS_NOT_REACHED("Unexpected comparison operation");
-        return Assembler::DoubleEqual;
+        MOZ_ASSUME_UNREACHABLE("Unexpected comparison operation");
     }
 }
 
@@ -974,8 +971,7 @@ JSOpToCondition(JSOp op, bool isSigned)
           case JSOP_GE:
             return Assembler::GreaterThanOrEqual;
           default:
-            JS_NOT_REACHED("Unrecognized comparison operation");
-            return Assembler::Equal;
+            MOZ_ASSUME_UNREACHABLE("Unrecognized comparison operation");
         }
     } else {
         switch (op) {
@@ -994,8 +990,7 @@ JSOpToCondition(JSOp op, bool isSigned)
           case JSOP_GE:
             return Assembler::AboveOrEqual;
           default:
-            JS_NOT_REACHED("Unrecognized comparison operation");
-            return Assembler::Equal;
+            MOZ_ASSUME_UNREACHABLE("Unrecognized comparison operation");
         }
     }
 }
diff --git a/js/src/ion/IonTypes.h b/js/src/ion/IonTypes.h
index 21cd21ac991..1b0190bc776 100644
--- a/js/src/ion/IonTypes.h
+++ b/js/src/ion/IonTypes.h
@@ -67,9 +67,8 @@ BailoutKindString(BailoutKind kind)
       case Bailout_CachedShapeGuard:
         return "Bailout_CachedShapeGuard";
       default:
-        JS_NOT_REACHED("Invalid BailoutKind");
+        MOZ_ASSUME_UNREACHABLE("Invalid BailoutKind");
     }
-    return "INVALID_BAILOUT_KIND";
 }
 #endif
 
@@ -118,8 +117,7 @@ MIRTypeFromValueType(JSValueType type)
       case JSVAL_TYPE_UNKNOWN:
         return MIRType_Value;
       default:
-        JS_NOT_REACHED("unexpected jsval type");
-        return MIRType_None;
+        MOZ_ASSUME_UNREACHABLE("unexpected jsval type");
     }
 }
 
@@ -186,8 +184,7 @@ StringFromMIRType(MIRType type)
     case MIRType_ForkJoinSlice:
       return "ForkJoinSlice";
     default:
-      JS_NOT_REACHED("Unknown MIRType.");
-      return "";
+      MOZ_ASSUME_UNREACHABLE("Unknown MIRType.");
   }
 }
 
diff --git a/js/src/ion/LIR-Common.h b/js/src/ion/LIR-Common.h
index 5d83913ac1e..796210202f6 100644
--- a/js/src/ion/LIR-Common.h
+++ b/js/src/ion/LIR-Common.h
@@ -4480,21 +4480,19 @@ class LPhi : public LInstruction
         return 0;
     }
     LDefinition *getTemp(size_t index) {
-        JS_NOT_REACHED("no temps");
-        return NULL;
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     void setTemp(size_t index, const LDefinition &temp) {
-        JS_NOT_REACHED("no temps");
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     size_t numSuccessors() const {
         return 0;
     }
     MBasicBlock *getSuccessor(size_t i) const {
-        JS_NOT_REACHED("no successors");
-        return NULL;
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
     void setSuccessor(size_t i, MBasicBlock *) {
-        JS_NOT_REACHED("no successors");
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
 
     virtual void printInfo(FILE *fp) {
@@ -4793,20 +4791,19 @@ class LAsmJSCall : public LInstruction
         return 0;
     }
     LDefinition *getTemp(size_t index) {
-        JS_NOT_REACHED("no temps");
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     void setTemp(size_t index, const LDefinition &a) {
-        JS_NOT_REACHED("no temps");
+        MOZ_ASSUME_UNREACHABLE("no temps");
     }
     size_t numSuccessors() const {
         return 0;
     }
     MBasicBlock *getSuccessor(size_t i) const {
-        JS_NOT_REACHED("no successors");
-        return NULL;
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
     void setSuccessor(size_t i, MBasicBlock *) {
-        JS_NOT_REACHED("no successors");
+        MOZ_ASSUME_UNREACHABLE("no successors");
     }
 };
 
diff --git a/js/src/ion/LIR.cpp b/js/src/ion/LIR.cpp
index 9b710d2d40e..174831b899e 100644
--- a/js/src/ion/LIR.cpp
+++ b/js/src/ion/LIR.cpp
@@ -270,8 +270,7 @@ LAllocation::toString() const
         PrintUse(buf, sizeof(buf), toUse());
         return buf;
       default:
-        JS_NOT_REACHED("what?");
-        return "???";
+        MOZ_ASSUME_UNREACHABLE("what?");
     }
 }
 #endif // DEBUG
diff --git a/js/src/ion/LIR.h b/js/src/ion/LIR.h
index 3322de9b009..33ffd499a38 100644
--- a/js/src/ion/LIR.h
+++ b/js/src/ion/LIR.h
@@ -550,8 +550,7 @@ class LDefinition
           case MIRType_ForkJoinSlice:
             return LDefinition::GENERAL;
           default:
-            JS_NOT_REACHED("unexpected type");
-            return LDefinition::GENERAL;
+            MOZ_ASSUME_UNREACHABLE("unexpected type");
         }
     }
 };
@@ -717,7 +716,7 @@ class LInstructionVisitor
     {}
 
   public:
-#define VISIT_INS(op) virtual bool visit##op(L##op *) { JS_NOT_REACHED("NYI: " #op); return false; }
+#define VISIT_INS(op) virtual bool visit##op(L##op *) { MOZ_ASSUME_UNREACHABLE("NYI: " #op); }
     LIR_OPCODE_LIST(VISIT_INS)
 #undef VISIT_INS
 };
diff --git a/js/src/ion/LiveRangeAllocator.cpp b/js/src/ion/LiveRangeAllocator.cpp
index 09e5b14fec1..92ab68e0f7c 100644
--- a/js/src/ion/LiveRangeAllocator.cpp
+++ b/js/src/ion/LiveRangeAllocator.cpp
@@ -30,8 +30,7 @@ Requirement::priority() const
         return 2;
 
       default:
-        JS_NOT_REACHED("Unknown requirement kind.");
-        return -1;
+        MOZ_ASSUME_UNREACHABLE("Unknown requirement kind.");
     }
 }
 
diff --git a/js/src/ion/LiveRangeAllocator.h b/js/src/ion/LiveRangeAllocator.h
index 416a84e8749..9b8c98a57e7 100644
--- a/js/src/ion/LiveRangeAllocator.h
+++ b/js/src/ion/LiveRangeAllocator.h
@@ -117,9 +117,8 @@ UseCompatibleWith(const LUse *use, LAllocation alloc)
           // UsePosition is only used as hint.
         return alloc.isRegister();
       default:
-        JS_NOT_REACHED("Unknown use policy");
+        MOZ_ASSUME_UNREACHABLE("Unknown use policy");
     }
-    return false;
 }
 
 #ifdef DEBUG
@@ -147,9 +146,8 @@ DefinitionCompatibleWith(LInstruction *ins, const LDefinition *def, LAllocation
       case LDefinition::PASSTHROUGH:
         return true;
       default:
-        JS_NOT_REACHED("Unknown definition policy");
+        MOZ_ASSUME_UNREACHABLE("Unknown definition policy");
     }
-    return false;
 }
 
 #endif // DEBUG
diff --git a/js/src/ion/Lowering.cpp b/js/src/ion/Lowering.cpp
index 81f5532eb8b..31da6c40cde 100644
--- a/js/src/ion/Lowering.cpp
+++ b/js/src/ion/Lowering.cpp
@@ -843,8 +843,7 @@ LIRGenerator::visitCompare(MCompare *comp)
         return define(lir, comp);
     }
 
-    JS_NOT_REACHED("Unrecognized compare type.");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unrecognized compare type.");
 }
 
 static void
@@ -1452,8 +1451,7 @@ LIRGenerator::visitToDouble(MToDouble *convert)
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
-        JS_NOT_REACHED("unexpected type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1499,8 +1497,7 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
         return false;
 
       default:
-        JS_NOT_REACHED("unexpected type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1532,8 +1529,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
       default:
         // Objects might be effectful.
         // Strings are complicated - we don't handle them yet.
-        JS_NOT_REACHED("unexpected type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1546,8 +1542,7 @@ LIRGenerator::visitToString(MToString *ins)
       case MIRType_Null:
       case MIRType_Undefined:
       case MIRType_Boolean:
-        JS_NOT_REACHED("NYI: Lower MToString");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("NYI: Lower MToString");
 
       case MIRType_Double: {
         LDoubleToString *lir = new LDoubleToString(useRegister(opd), temp());
@@ -1567,8 +1562,7 @@ LIRGenerator::visitToString(MToString *ins)
 
       default:
         // Objects might be effectful. (see ToPrimitive)
-        JS_NOT_REACHED("unexpected type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1661,8 +1655,7 @@ LIRGenerator::visitLoadSlot(MLoadSlot *ins)
 
       case MIRType_Undefined:
       case MIRType_Null:
-        JS_NOT_REACHED("typed load must have a payload");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
         return define(new LLoadSlotT(useRegister(ins->slots())), ins);
@@ -1907,8 +1900,7 @@ LIRGenerator::visitNot(MNot *ins)
       }
 
       default:
-        JS_NOT_REACHED("Unexpected MIRType.");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unexpected MIRType.");
     }
 }
 
@@ -1976,8 +1968,7 @@ LIRGenerator::visitLoadElement(MLoadElement *ins)
       }
       case MIRType_Undefined:
       case MIRType_Null:
-        JS_NOT_REACHED("typed load must have a payload");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
       {
@@ -2083,8 +2074,7 @@ LIRGenerator::visitArrayPopShift(MArrayPopShift *ins)
       }
       case MIRType_Undefined:
       case MIRType_Null:
-        JS_NOT_REACHED("typed load must have a payload");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
 
       default:
       {
@@ -2179,8 +2169,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
       }
 
       default:
-        JS_NOT_REACHED("unexpected type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -2726,7 +2715,7 @@ LIRGenerator::visitAsmJSReturn(MAsmJSReturn *ins)
     else if (rval->type() == MIRType_Int32)
         lir->setOperand(0, useFixed(rval, ReturnReg));
     else
-        JS_NOT_REACHED("Unexpected asm.js return type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected asm.js return type");
     return add(lir);
 }
 
diff --git a/js/src/ion/MCallOptimize.cpp b/js/src/ion/MCallOptimize.cpp
index 2ec2a202bc4..43023524a22 100644
--- a/js/src/ion/MCallOptimize.cpp
+++ b/js/src/ion/MCallOptimize.cpp
@@ -1017,7 +1017,7 @@ IonBuilder::inlineUnsafeSetElement(CallInfo &callInfo)
             continue;
         }
 
-        JS_NOT_REACHED("Element access not dense array nor typed array");
+        MOZ_ASSUME_UNREACHABLE("Element access not dense array nor typed array");
     }
 
     return InliningStatus_Inlined;
@@ -1088,7 +1088,7 @@ IonBuilder::inlineForceSequentialOrInParallelSection(CallInfo &callInfo)
         return InliningStatus_Inlined;
     }
 
-    JS_NOT_REACHED("Invalid execution mode");
+    MOZ_ASSUME_UNREACHABLE("Invalid execution mode");
 }
 
 IonBuilder::InliningStatus
@@ -1262,7 +1262,7 @@ IonBuilder::inlineNewDenseArray(CallInfo &callInfo)
         return inlineNewDenseArrayForParallelExecution(callInfo);
     }
 
-    JS_NOT_REACHED("unknown ExecutionMode");
+    MOZ_ASSUME_UNREACHABLE("unknown ExecutionMode");
 }
 
 IonBuilder::InliningStatus
diff --git a/js/src/ion/MIR.cpp b/js/src/ion/MIR.cpp
index e264e967770..ab0e23e586c 100644
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -116,8 +116,7 @@ EvaluateConstantOperands(MBinaryInstruction *ins, bool *ptypeChange = NULL)
         ret.setNumber(NumberMod(lhs.toNumber(), rhs.toNumber()));
         break;
       default:
-        JS_NOT_REACHED("NYI");
-        return NULL;
+        MOZ_ASSUME_UNREACHABLE("NYI");
     }
 
     if (ins->type() != MIRTypeFromValue(ret)) {
@@ -437,8 +436,7 @@ MConstant::printOpcode(FILE *fp)
         fprintf(fp, "magic");
         break;
       default:
-        JS_NOT_REACHED("unexpected type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -1486,8 +1484,7 @@ MCompare::inputType()
       case Compare_Value:
         return MIRType_Value;
       default:
-        JS_NOT_REACHED("No known conversion");
-        return MIRType_None;
+        MOZ_ASSUME_UNREACHABLE("No known conversion");
     }
 }
 
@@ -1937,8 +1934,7 @@ MCompare::tryFold(bool *result)
             *result = (op == JSOP_NE || op == JSOP_STRICTNE);
             return true;
           default:
-            JS_NOT_REACHED("Unexpected type");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unexpected type");
         }
     }
 
@@ -1959,11 +1955,9 @@ MCompare::tryFold(bool *result)
             return true;
           case MIRType_Boolean:
             // Int32 specialization should handle this.
-            JS_NOT_REACHED("Wrong specialization");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Wrong specialization");
           default:
-            JS_NOT_REACHED("Unexpected type");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unexpected type");
         }
     }
 
@@ -1984,11 +1978,9 @@ MCompare::tryFold(bool *result)
             return true;
           case MIRType_String:
             // Compare_String specialization should handle this.
-            JS_NOT_REACHED("Wrong specialization");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Wrong specialization");
           default:
-            JS_NOT_REACHED("Unexpected type");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unexpected type");
         }
     }
 
@@ -2040,8 +2032,7 @@ MCompare::evaluateConstantOperands(bool *result)
             *result = (comp != 0);
             break;
           default:
-            JS_NOT_REACHED("Unexpected op.");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unexpected op.");
         }
 
         return true;
@@ -2073,8 +2064,7 @@ MCompare::evaluateConstantOperands(bool *result)
             *result = (lhsUint != rhsUint);
             break;
           default:
-            JS_NOT_REACHED("Unexpected op.");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unexpected op.");
         }
 
         return true;
diff --git a/js/src/ion/MIR.h b/js/src/ion/MIR.h
index 799b414f0e0..2c53de252f3 100644
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -3459,8 +3459,7 @@ class MDiv : public MBinaryArithInstruction
     void analyzeEdgeCasesBackward();
 
     double getIdentity() {
-        JS_NOT_REACHED("not used");
-        return 1;
+        MOZ_ASSUME_UNREACHABLE("not used");
     }
 
     bool canBeNegativeZero() {
@@ -3507,8 +3506,7 @@ class MMod : public MBinaryArithInstruction
     MDefinition *foldsTo(bool useValueNumbers);
 
     double getIdentity() {
-        JS_NOT_REACHED("not used");
-        return 1;
+        MOZ_ASSUME_UNREACHABLE("not used");
     }
 
     bool fallible();
@@ -5924,7 +5922,7 @@ class MPolyInlineDispatch : public MControlInstruction, public SingleObjectPolic
             if (getFunction(i) == func)
                 return getFunctionBlock(i);
         }
-        JS_NOT_REACHED("Bad function lookup!");
+        MOZ_ASSUME_UNREACHABLE("Bad function lookup!");
     }
 
     InlinePropertyTable *propTable() const {
diff --git a/js/src/ion/MIRGraph.cpp b/js/src/ion/MIRGraph.cpp
index 9143849e770..476d8d1ecdc 100644
--- a/js/src/ion/MIRGraph.cpp
+++ b/js/src/ion/MIRGraph.cpp
@@ -921,7 +921,7 @@ MBasicBlock::getSuccessorIndex(MBasicBlock *block) const
         if (getSuccessor(i) == block)
             return i;
     }
-    JS_NOT_REACHED("Invalid successor");
+    MOZ_ASSUME_UNREACHABLE("Invalid successor");
 }
 
 void
@@ -953,7 +953,7 @@ MBasicBlock::replacePredecessor(MBasicBlock *old, MBasicBlock *split)
         }
     }
 
-    JS_NOT_REACHED("predecessor was not found");
+    MOZ_ASSUME_UNREACHABLE("predecessor was not found");
 }
 
 void
@@ -990,7 +990,7 @@ MBasicBlock::removePredecessor(MBasicBlock *pred)
         return;
     }
 
-    JS_NOT_REACHED("predecessor was not found");
+    MOZ_ASSUME_UNREACHABLE("predecessor was not found");
 }
 
 void
diff --git a/js/src/ion/MOpcodes.h b/js/src/ion/MOpcodes.h
index eea1a3a4256..2cd8327a565 100644
--- a/js/src/ion/MOpcodes.h
+++ b/js/src/ion/MOpcodes.h
@@ -213,7 +213,7 @@ class MInstructionVisitor // interface i.e. pure abstract class
 class MInstructionVisitorWithDefaults : public MInstructionVisitor
 {
   public:
-#define VISIT_INS(op) virtual bool visit##op(M##op *) { JS_NOT_REACHED("NYI: " #op); return false; }
+#define VISIT_INS(op) virtual bool visit##op(M##op *) { MOZ_ASSUME_UNREACHABLE("NYI: " #op); }
     MIR_OPCODE_LIST(VISIT_INS)
 #undef VISIT_INS
 };
diff --git a/js/src/ion/Snapshots.cpp b/js/src/ion/Snapshots.cpp
index 0017ee2421e..d235f3efaf2 100644
--- a/js/src/ion/Snapshots.cpp
+++ b/js/src/ion/Snapshots.cpp
@@ -268,8 +268,7 @@ SnapshotReader::readSlot()
       }
     }
 
-    JS_NOT_REACHED("huh?");
-    return Slot(JS_UNDEFINED);
+    MOZ_ASSUME_UNREACHABLE("huh?");
 }
 
 SnapshotOffset
@@ -378,8 +377,7 @@ ValTypeToString(JSValueType type)
       case JSVAL_TYPE_MAGIC:
         return "magic";
       default:
-        JS_NOT_REACHED("no payload");
-        return "";
+        MOZ_ASSUME_UNREACHABLE("no payload");
     }
 }
 
diff --git a/js/src/ion/StupidAllocator.cpp b/js/src/ion/StupidAllocator.cpp
index d8f268fa23c..1a6b15c8902 100644
--- a/js/src/ion/StupidAllocator.cpp
+++ b/js/src/ion/StupidAllocator.cpp
@@ -36,8 +36,7 @@ StupidAllocator::registerIndex(AnyRegister reg)
         if (reg == registers[i].reg)
             return i;
     }
-    JS_NOT_REACHED("Bad register");
-    return UINT32_MAX;
+    MOZ_ASSUME_UNREACHABLE("Bad register");
 }
 
 bool
diff --git a/js/src/ion/TypePolicy.cpp b/js/src/ion/TypePolicy.cpp
index 5613f11c4df..3a8c1e7bdd1 100644
--- a/js/src/ion/TypePolicy.cpp
+++ b/js/src/ion/TypePolicy.cpp
@@ -209,8 +209,7 @@ ComparePolicy::adjustInputs(MInstruction *def)
             replace = MUnbox::New(in, MIRType_String, MUnbox::Infallible);
             break;
           default:
-            JS_NOT_REACHED("Unknown compare specialization");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Unknown compare specialization");
         }
 
         def->block()->insertBefore(def, replace);
@@ -491,8 +490,7 @@ StoreTypedArrayPolicy::adjustValueInput(MInstruction *ins, int arrayType,
         value = boxAt(ins, value);
         break;
       default:
-        JS_NOT_REACHED("Unexpected type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Unexpected type");
     }
 
     if (value != curValue) {
@@ -529,8 +527,7 @@ StoreTypedArrayPolicy::adjustValueInput(MInstruction *ins, int arrayType,
         }
         break;
       default:
-        JS_NOT_REACHED("Invalid array type");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Invalid array type");
     }
 
     if (value != curValue) {
diff --git a/js/src/ion/VMFunctions.cpp b/js/src/ion/VMFunctions.cpp
index c611bbe9459..362d3f56b5d 100644
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -633,7 +633,7 @@ DebugPrologue(JSContext *cx, BaselineFrame *frame, JSBool *mustReturn)
         return false;
 
       default:
-        JS_NOT_REACHED("Invalid trap status");
+        MOZ_ASSUME_UNREACHABLE("Invalid trap status");
     }
 }
 
@@ -767,7 +767,7 @@ HandleDebugTrap(JSContext *cx, BaselineFrame *frame, uint8_t *retAddr, JSBool *m
         return false;
 
       default:
-        JS_NOT_REACHED("Invalid trap status");
+        MOZ_ASSUME_UNREACHABLE("Invalid trap status");
     }
 
     return true;
@@ -805,7 +805,7 @@ OnDebuggerStatement(JSContext *cx, BaselineFrame *frame, jsbytecode *pc, JSBool
         return false;
 
       default:
-        JS_NOT_REACHED("Invalid trap status");
+        MOZ_ASSUME_UNREACHABLE("Invalid trap status");
     }
 }
 
diff --git a/js/src/ion/arm/Assembler-arm.cpp b/js/src/ion/arm/Assembler-arm.cpp
index 918fbd5abe8..54b18225baf 100644
--- a/js/src/ion/arm/Assembler-arm.cpp
+++ b/js/src/ion/arm/Assembler-arm.cpp
@@ -55,7 +55,7 @@ ABIArgGenerator::next(MIRType type)
         floatRegIndex_++;
         break;
       default:
-        JS_NOT_REACHED("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 #else
@@ -87,7 +87,7 @@ ABIArgGenerator::next(MIRType type)
       }
         break;
       default:
-        JS_NOT_REACHED("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 #endif
@@ -730,8 +730,7 @@ Assembler::getCF32Target(Iter *iter)
 
     }
 
-    JS_NOT_REACHED("unsupported branch relocation");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("unsupported branch relocation");
 }
 
 uintptr_t
@@ -794,8 +793,7 @@ Assembler::getPtr32Target(Iter *start, Register *dest, RelocStyle *style)
         uint32_t **ptr = (uint32_t **)&dataInst[offset + 8];
         return *ptr;
     }
-    JS_NOT_REACHED("unsupported relocation");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("unsupported relocation");
 }
 
 static IonCode *
@@ -1681,7 +1679,7 @@ Assembler::as_extdtr(LoadStore ls, int size, bool IsSigned, Index mode,
         extra_bits1 = 0;
         break;
       default:
-        JS_NOT_REACHED("SAY WHAT?");
+        MOZ_ASSUME_UNREACHABLE("SAY WHAT?");
     }
     return writeInst(extra_bits2 << 5 | extra_bits1 << 20 | 0x90 |
                      addr.encode() | RT(rt) | mode | c, dest);
@@ -1765,7 +1763,7 @@ Assembler::patchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
     int offset = (char *)constPoolAddr - (char *)loadAddr;
     switch(data.getLoadType()) {
       case PoolHintData::poolBOGUS:
-        JS_NOT_REACHED("bogus load type!");
+        MOZ_ASSUME_UNREACHABLE("bogus load type!");
       case PoolHintData::poolDTR:
         dummy->as_dtr(IsLoad, 32, Offset, data.getReg(),
                       DTRAddr(pc, DtrOffImm(offset+4*data.getIndex() - 8)), data.getCond(), instAddr);
@@ -1803,13 +1801,12 @@ Assembler::placeConstantPoolBarrier(int offset)
     // BUG: 700526
     // this is still an active path, however, we do not hit it in the test
     // suite at all.
-    JS_NOT_REACHED("ARMAssembler holdover");
+    MOZ_ASSUME_UNREACHABLE("ARMAssembler holdover");
 #if 0
     offset = (offset - sizeof(ARMWord)) >> 2;
     ASSERT((offset <= BOFFSET_MAX && offset >= BOFFSET_MIN));
     return AL | B | (offset & BRANCH_MASK);
 #endif
-    return -1;
 }
 
 // Control flow stuff:
@@ -2004,22 +2001,21 @@ Assembler::as_vnmul(VFPRegister vd, VFPRegister vn, VFPRegister vm,
                   Condition c)
 {
     return as_vfp_float(vd, vn, vm, opv_mul, c);
-    JS_NOT_REACHED("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 BufferOffset
 Assembler::as_vnmla(VFPRegister vd, VFPRegister vn, VFPRegister vm,
                   Condition c)
 {
-    JS_NOT_REACHED("Feature NYI");
-    return BufferOffset();
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 BufferOffset
 Assembler::as_vnmls(VFPRegister vd, VFPRegister vn, VFPRegister vm,
                   Condition c)
 {
-    JS_NOT_REACHED("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
     return BufferOffset();
 }
 
@@ -2207,7 +2203,7 @@ Assembler::as_vimm(VFPRegister vd, VFPImm imm, Condition c)
 
     // Don't know how to handle this right now.
     if (!vd.isDouble())
-        JS_NOT_REACHED("non-double immediate");
+        MOZ_ASSUME_UNREACHABLE("non-double immediate");
 
     return writeVFPInst(sz,  c | imm.encode() | VD(vd) | 0x02B00000);
 
@@ -2262,7 +2258,7 @@ Assembler::bind(Label *label, BufferOffset boff)
             else if (branch.is<InstBLImm>())
                 as_bl(dest.diffB<BOffImm>(b), c, b);
             else
-                JS_NOT_REACHED("crazy fixup!");
+                MOZ_ASSUME_UNREACHABLE("crazy fixup!");
             b = next;
         } while (more);
     }
@@ -2320,7 +2316,7 @@ Assembler::retarget(Label *label, Label *target)
             else if (branch.is<InstBLImm>())
                 as_bl(BOffImm(prev), c, labelBranchOffset);
             else
-                JS_NOT_REACHED("crazy fixup!");
+                MOZ_ASSUME_UNREACHABLE("crazy fixup!");
         } else {
             // The target is unbound and unused.  We can just take the head of
             // the list hanging off of label, and dump that into target.
diff --git a/js/src/ion/arm/BaselineIC-arm.cpp b/js/src/ion/arm/BaselineIC-arm.cpp
index ee370239c5b..35faa38cd29 100644
--- a/js/src/ion/arm/BaselineIC-arm.cpp
+++ b/js/src/ion/arm/BaselineIC-arm.cpp
@@ -196,8 +196,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-        JS_NOT_REACHED("Unhandled op for BinaryArith_Int32.");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_Int32.");
     }
 
     EmitReturnFromIC(masm);
@@ -248,8 +247,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.ma_rsb(R0.payloadReg(), Imm32(0), R0.payloadReg());
         break;
       default:
-        JS_NOT_REACHED("Unexpected op");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     EmitReturnFromIC(masm);
diff --git a/js/src/ion/arm/CodeGenerator-arm.cpp b/js/src/ion/arm/CodeGenerator-arm.cpp
index 9a56d220d2e..129a9faf8b9 100644
--- a/js/src/ion/arm/CodeGenerator-arm.cpp
+++ b/js/src/ion/arm/CodeGenerator-arm.cpp
@@ -215,7 +215,7 @@ CodeGeneratorARM::bailoutFrom(Label *label, LSnapshot *snapshot)
       case SequentialExecution:
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     if (!encode(snapshot))
@@ -803,7 +803,7 @@ CodeGeneratorARM::visitBitOpI(LBitOpI *ins)
             masm.ma_and(ToRegister(rhs), ToRegister(lhs), ToRegister(dest));
         break;
       default:
-        JS_NOT_REACHED("unexpected binary opcode");
+        MOZ_ASSUME_UNREACHABLE("unexpected binary opcode");
     }
 
     return true;
@@ -845,7 +845,7 @@ CodeGeneratorARM::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            JS_NOT_REACHED("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     } else {
         // The shift amounts should be AND'ed into the 0-31 range since arm
@@ -870,7 +870,7 @@ CodeGeneratorARM::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            JS_NOT_REACHED("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     }
 
@@ -1069,8 +1069,7 @@ CodeGeneratorARM::visitMathD(LMathD *math)
         masm.ma_vdiv(ToFloatRegister(src1), ToFloatRegister(src2), ToFloatRegister(output));
         break;
       default:
-        JS_NOT_REACHED("unexpected opcode");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
     return true;
 }
@@ -1703,15 +1702,13 @@ getBase(U *mir)
 bool
 CodeGeneratorARM::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic *ins)
 {
-    JS_NOT_REACHED("NYI");
-    return true;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 CodeGeneratorARM::visitStoreTypedArrayElementStatic(LStoreTypedArrayElementStatic *ins)
 {
-    JS_NOT_REACHED("NYI");
-    return true;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -1733,7 +1730,7 @@ CodeGeneratorARM::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
         isFloat = true;
         size = 32;
         break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
     Register index = ToRegister(ins->ptr());
     BufferOffset bo = masm.ma_BoundsCheck(index);
@@ -1773,7 +1770,7 @@ CodeGeneratorARM::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
         isFloat = true;
         size = 32;
         break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
     Register index = ToRegister(ins->ptr());
 
diff --git a/js/src/ion/arm/Lowering-arm.cpp b/js/src/ion/arm/Lowering-arm.cpp
index 211366a6361..27d7d3b5eb3 100644
--- a/js/src/ion/arm/Lowering-arm.cpp
+++ b/js/src/ion/arm/Lowering-arm.cpp
@@ -464,7 +464,7 @@ LIRGeneratorARM::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
         lir = new LAsmJSStoreHeap(useRegisterAtStart(ins->ptr()),
                                   useRegisterAtStart(ins->value()));
         break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
@@ -488,8 +488,7 @@ LIRGeneratorARM::lowerTruncateDToInt32(MTruncateToInt32 *ins)
 bool
 LIRGeneratorARM::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
-    JS_NOT_REACHED("NYI");
-    return true;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 //__aeabi_uidiv
diff --git a/js/src/ion/arm/MacroAssembler-arm.cpp b/js/src/ion/arm/MacroAssembler-arm.cpp
index 9f327e08997..d7084b3be53 100644
--- a/js/src/ion/arm/MacroAssembler-arm.cpp
+++ b/js/src/ion/arm/MacroAssembler-arm.cpp
@@ -695,7 +695,7 @@ MacroAssemblerARM::ma_cmn(Register src1, Register src2, Condition c)
 void
 MacroAssemblerARM::ma_cmn(Register src1, Operand op, Condition c)
 {
-    JS_NOT_REACHED("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 // Compare (src - src2).
@@ -729,8 +729,7 @@ MacroAssemblerARM::ma_cmp(Register src1, Operand op, Condition c)
         as_cmp(src1, O2Reg(ScratchRegister), c);
         break;
       default:
-        JS_NOT_REACHED("trying to compare FP and integer registers");
-        break;
+        MOZ_ASSUME_UNREACHABLE("trying to compare FP and integer registers");
     }
 }
 void
@@ -803,9 +802,7 @@ MacroAssemblerARM::ma_check_mul(Register src1, Register src2, Register dest, Con
         return NotEqual;
     }
 
-    JS_NOT_REACHED("Condition NYI");
-    return Always;
-
+    MOZ_ASSUME_UNREACHABLE("Condition NYI");
 }
 
 Assembler::Condition
@@ -823,8 +820,7 @@ MacroAssemblerARM::ma_check_mul(Register src1, Imm32 imm, Register dest, Conditi
         return NotEqual;
     }
 
-    JS_NOT_REACHED("Condition NYI");
-    return Always;
+    MOZ_ASSUME_UNREACHABLE("Condition NYI");
 }
 
 void
@@ -906,7 +902,7 @@ void
 MacroAssemblerARM::ma_dtr(LoadStore ls, Register rn, Register rm, Register rt,
                           Index mode, Assembler::Condition cc)
 {
-    JS_NOT_REACHED("Feature NYI");
+    MOZ_ASSUME_UNREACHABLE("Feature NYI");
 }
 
 void
@@ -1220,7 +1216,7 @@ MacroAssemblerARM::ma_b(void *target, Relocation::Kind reloc, Assembler::Conditi
             m_buffer.markGuard();
         break;
       default:
-        JS_NOT_REACHED("Other methods of generating tracable jumps NYI");
+        MOZ_ASSUME_UNREACHABLE("Other methods of generating tracable jumps NYI");
     }
 }
 
@@ -2770,7 +2766,7 @@ MacroAssemblerARMCompat::loadValue(Address src, ValueOperand val)
                 mode = IB;
                 break;
               default:
-                JS_NOT_REACHED("Bogus Offset for LoadValue as DTM");
+                MOZ_ASSUME_UNREACHABLE("Bogus Offset for LoadValue as DTM");
             }
             startDataTransferM(IsLoad, Register::FromCode(srcOp.base()), mode);
             transferReg(val.payloadReg());
@@ -2840,7 +2836,7 @@ MacroAssemblerARMCompat::storePayload(Register src, Operand dest)
         ma_str(src, ToPayload(dest));
         return;
     }
-    JS_NOT_REACHED("why do we do all of these things?");
+    MOZ_ASSUME_UNREACHABLE("why do we do all of these things?");
 
 }
 
@@ -2877,7 +2873,7 @@ MacroAssemblerARMCompat::storeTypeTag(ImmTag tag, Operand dest) {
         return;
     }
 
-    JS_NOT_REACHED("why do we do all of these things?");
+    MOZ_ASSUME_UNREACHABLE("why do we do all of these things?");
 
 }
 
diff --git a/js/src/ion/arm/MacroAssembler-arm.h b/js/src/ion/arm/MacroAssembler-arm.h
index a733d63bd71..7b8dcafca6e 100644
--- a/js/src/ion/arm/MacroAssembler-arm.h
+++ b/js/src/ion/arm/MacroAssembler-arm.h
@@ -362,7 +362,7 @@ class MacroAssemblerARM : public Assembler
             return transferMultipleByRunsImpl
                 <FloatRegisterBackwardIterator>(set, ls, rm, mode, -1);
         }
-        JS_NOT_REACHED("Invalid data transfer addressing mode");
+        MOZ_ASSUME_UNREACHABLE("Invalid data transfer addressing mode");
     }
 
 private:
@@ -483,10 +483,10 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         ma_mov(Imm32(imm.value), dest);
     }
     void mov(Register src, Address dest) {
-        JS_NOT_REACHED("NYI-IC");
+        MOZ_ASSUME_UNREACHABLE("NYI-IC");
     }
     void mov(Address src, Register dest) {
-        JS_NOT_REACHED("NYI-IC");
+        MOZ_ASSUME_UNREACHABLE("NYI-IC");
     }
 
     void call(const Register reg) {
diff --git a/js/src/ion/arm/MoveEmitter-arm.cpp b/js/src/ion/arm/MoveEmitter-arm.cpp
index 34297265d27..36eb3aaafba 100644
--- a/js/src/ion/arm/MoveEmitter-arm.cpp
+++ b/js/src/ion/arm/MoveEmitter-arm.cpp
@@ -190,7 +190,7 @@ MoveEmitterARM::emitMove(const MoveOperand &from, const MoveOperand &to)
             masm.ma_str(from.reg(), toOperand(to, false));
             break;
           default:
-            JS_NOT_REACHED("strange move!");
+            MOZ_ASSUME_UNREACHABLE("strange move!");
         }
     } else if (to.isGeneralReg()) {
         JS_ASSERT(from.isMemory() || from.isEffectiveAddress());
diff --git a/js/src/ion/arm/Trampoline-arm.cpp b/js/src/ion/arm/Trampoline-arm.cpp
index 7cfdaef5deb..c19ad732fa0 100644
--- a/js/src/ion/arm/Trampoline-arm.cpp
+++ b/js/src/ion/arm/Trampoline-arm.cpp
@@ -695,8 +695,7 @@ IonRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.branch32(Assembler::NotEqual, r0, Imm32(TP_SUCCESS), &failure);
         break;
       default:
-        JS_NOT_REACHED("unknown failure kind");
-        break;
+        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
     }
 
     // Load the outparam and free any allocated stack.
diff --git a/js/src/ion/shared/Assembler-shared.h b/js/src/ion/shared/Assembler-shared.h
index 1427c1fc8ef..bd7b5254faf 100644
--- a/js/src/ion/shared/Assembler-shared.h
+++ b/js/src/ion/shared/Assembler-shared.h
@@ -63,8 +63,7 @@ ScaleFromElemWidth(int shift)
         return TimesEight;
     }
 
-    JS_NOT_REACHED("Invalid scale");
-    return TimesOne;
+    MOZ_ASSUME_UNREACHABLE("Invalid scale");
 }
 
 // Used for 32-bit immediates which do not require relocation.
@@ -86,8 +85,7 @@ struct Imm32
           case TimesEight:
             return Imm32(3);
         };
-        JS_NOT_REACHED("Invalid scale");
-        return Imm32(-1);
+        MOZ_ASSUME_UNREACHABLE("Invalid scale");
     }
 
     static inline Imm32 FactorOf(enum Scale s) {
diff --git a/js/src/ion/shared/Assembler-x86-shared.cpp b/js/src/ion/shared/Assembler-x86-shared.cpp
index 09accd9c7bb..e7c4bee729a 100644
--- a/js/src/ion/shared/Assembler-x86-shared.cpp
+++ b/js/src/ion/shared/Assembler-x86-shared.cpp
@@ -123,8 +123,7 @@ AssemblerX86Shared::InvertCondition(Condition cond)
       case BelowOrEqual:
         return Above;
       default:
-        JS_NOT_REACHED("unexpected condition");
-        return Equal;
+        MOZ_ASSUME_UNREACHABLE("unexpected condition");
     }
 }
 
diff --git a/js/src/ion/shared/Assembler-x86-shared.h b/js/src/ion/shared/Assembler-x86-shared.h
index a0913abb1f4..9c897bd847f 100644
--- a/js/src/ion/shared/Assembler-x86-shared.h
+++ b/js/src/ion/shared/Assembler-x86-shared.h
@@ -134,8 +134,7 @@ class AssemblerX86Shared
             return NaN_IsTrue;
         }
 
-        JS_NOT_REACHED("Unknown double condition");
-        return NaN_HandledByCond;
+        MOZ_ASSUME_UNREACHABLE("Unknown double condition");
     }
 
     static void staticAsserts() {
@@ -248,7 +247,7 @@ class AssemblerX86Shared
             break;
 #endif
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movl(const Register &src, const Operand &dest) {
@@ -268,7 +267,7 @@ class AssemblerX86Shared
             break;
 #endif
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movl(const Imm32 &imm32, const Operand &dest) {
@@ -283,7 +282,7 @@ class AssemblerX86Shared
             masm.movl_i32m(imm32.value, dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -308,7 +307,7 @@ class AssemblerX86Shared
             masm.movsd_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movsd(const FloatRegister &src, const Operand &dest) {
@@ -324,7 +323,7 @@ class AssemblerX86Shared
             masm.movsd_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movss(const Operand &src, const FloatRegister &dest) {
@@ -337,7 +336,7 @@ class AssemblerX86Shared
             masm.movss_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movss(const FloatRegister &src, const Operand &dest) {
@@ -350,7 +349,7 @@ class AssemblerX86Shared
             masm.movss_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movdqa(const Operand &src, const FloatRegister &dest) {
@@ -363,7 +362,7 @@ class AssemblerX86Shared
             masm.movdqa_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movdqa(const FloatRegister &src, const Operand &dest) {
@@ -376,7 +375,7 @@ class AssemblerX86Shared
             masm.movdqa_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cvtss2sd(const FloatRegister &src, const FloatRegister &dest) {
@@ -396,19 +395,19 @@ class AssemblerX86Shared
             masm.movzbl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
-    void movxbl(const Operand &src, const Register &dest) {
+    void movsbl(const Operand &src, const Register &dest) {
         switch (src.kind()) {
           case Operand::REG_DISP:
-            masm.movxbl_mr(src.disp(), src.base(), dest.code());
+            masm.movsbl_mr(src.disp(), src.base(), dest.code());
             break;
           case Operand::SCALE:
-            masm.movxbl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
+            masm.movsbl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movb(const Register &src, const Operand &dest) {
@@ -420,7 +419,7 @@ class AssemblerX86Shared
             masm.movb_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movb(const Imm32 &src, const Operand &dest) {
@@ -432,7 +431,7 @@ class AssemblerX86Shared
             masm.movb_i8m(src.value, dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movzwl(const Operand &src, const Register &dest) {
@@ -444,7 +443,7 @@ class AssemblerX86Shared
             masm.movzwl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -457,7 +456,7 @@ class AssemblerX86Shared
             masm.movw_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movw(const Imm32 &src, const Operand &dest) {
@@ -469,19 +468,19 @@ class AssemblerX86Shared
             masm.movw_i16m(src.value, dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
-    void movxwl(const Operand &src, const Register &dest) {
+    void movswl(const Operand &src, const Register &dest) {
         switch (src.kind()) {
           case Operand::REG_DISP:
-            masm.movxwl_mr(src.disp(), src.base(), dest.code());
+            masm.movswl_mr(src.disp(), src.base(), dest.code());
             break;
           case Operand::SCALE:
-            masm.movxwl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
+            masm.movswl_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void leal(const Operand &src, const Register &dest) {
@@ -493,7 +492,7 @@ class AssemblerX86Shared
             masm.leal_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -578,7 +577,7 @@ class AssemblerX86Shared
             masm.jmp_r(op.reg());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpEAX(Label *label) { cmpSrc(label); }
@@ -675,7 +674,7 @@ class AssemblerX86Shared
             masm.call_m(op.disp(), op.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -708,7 +707,7 @@ class AssemblerX86Shared
             masm.cmpl_mr(rhs.disp(), rhs.base(), lhs.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(const Register &src, Imm32 imm) {
@@ -731,7 +730,7 @@ class AssemblerX86Shared
             break;
 #endif
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(const Operand &lhs, const Register &rhs) {
@@ -748,7 +747,7 @@ class AssemblerX86Shared
             break;
 #endif
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpl(const Operand &op, ImmWord imm) {
@@ -765,7 +764,7 @@ class AssemblerX86Shared
             break;
 #endif
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void setCC(Condition cond, const Register &r) {
@@ -791,7 +790,7 @@ class AssemblerX86Shared
             masm.testl_i32m(rhs.value, lhs.disp(), lhs.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
             break;
         }
     }
@@ -813,7 +812,7 @@ class AssemblerX86Shared
             break;
 #endif
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void subl(Imm32 imm, const Register &dest) {
@@ -828,7 +827,7 @@ class AssemblerX86Shared
             masm.subl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void addl(const Register &src, const Register &dest) {
@@ -846,7 +845,7 @@ class AssemblerX86Shared
             masm.subl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void orl(const Register &reg, const Register &dest) {
@@ -864,7 +863,7 @@ class AssemblerX86Shared
             masm.orl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorl(const Register &src, const Register &dest) {
@@ -882,7 +881,7 @@ class AssemblerX86Shared
             masm.xorl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void andl(const Register &src, const Register &dest) {
@@ -900,7 +899,7 @@ class AssemblerX86Shared
             masm.andl_im(imm.value, op.disp(), op.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void addl(const Operand &src, const Register &dest) {
@@ -912,7 +911,7 @@ class AssemblerX86Shared
             masm.addl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void orl(const Operand &src, const Register &dest) {
@@ -924,7 +923,7 @@ class AssemblerX86Shared
             masm.orl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorl(const Operand &src, const Register &dest) {
@@ -936,7 +935,7 @@ class AssemblerX86Shared
             masm.xorl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void andl(const Operand &src, const Register &dest) {
@@ -948,7 +947,7 @@ class AssemblerX86Shared
             masm.andl_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void imull(Imm32 imm, const Register &dest) {
@@ -966,7 +965,7 @@ class AssemblerX86Shared
             masm.imull_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void negl(const Operand &src) {
@@ -978,7 +977,7 @@ class AssemblerX86Shared
             masm.negl_m(src.disp(), src.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void negl(const Register &reg) {
@@ -993,7 +992,7 @@ class AssemblerX86Shared
             masm.notl_m(src.disp(), src.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void notl(const Register &reg) {
@@ -1031,7 +1030,7 @@ class AssemblerX86Shared
             masm.push_m(src.disp(), src.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void push(const Register &src) {
@@ -1047,7 +1046,7 @@ class AssemblerX86Shared
             masm.pop_m(src.disp(), src.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void pop(const Register &src) {
@@ -1103,7 +1102,7 @@ class AssemblerX86Shared
             masm.pinsrd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void psrldq(Imm32 shift, const FloatRegister &dest) {
@@ -1132,7 +1131,7 @@ class AssemblerX86Shared
             masm.cvtsi2sd_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cvttsd2si(const FloatRegister &src, const Register &dest) {
@@ -1186,7 +1185,7 @@ class AssemblerX86Shared
             break;
 #endif
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void subsd(const FloatRegister &src, const FloatRegister &dest) {
@@ -1203,7 +1202,7 @@ class AssemblerX86Shared
             masm.subsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void mulsd(const FloatRegister &src, const FloatRegister &dest) {
@@ -1220,7 +1219,7 @@ class AssemblerX86Shared
             masm.mulsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void divsd(const FloatRegister &src, const FloatRegister &dest) {
@@ -1237,7 +1236,7 @@ class AssemblerX86Shared
             masm.divsd_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorpd(const FloatRegister &src, const FloatRegister &dest) {
@@ -1269,7 +1268,7 @@ class AssemblerX86Shared
             masm.fisttp_m(dest.disp(), dest.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void fld(const Operand &dest) {
@@ -1278,7 +1277,7 @@ class AssemblerX86Shared
             masm.fld_m(dest.disp(), dest.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void fstp(const Operand &src) {
@@ -1287,7 +1286,7 @@ class AssemblerX86Shared
             masm.fstp_m(src.disp(), src.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -1337,7 +1336,7 @@ class AssemblerX86Shared
         return 1;
     }
     static uint8_t *nextInstruction(uint8_t *cur, uint32_t *count) {
-        JS_NOT_REACHED("nextInstruction NYI on x86");
+        MOZ_ASSUME_UNREACHABLE("nextInstruction NYI on x86");
     }
 
     // Toggle a jmp or cmp emitted by toggledJump().
diff --git a/js/src/ion/shared/CodeGenerator-shared-inl.h b/js/src/ion/shared/CodeGenerator-shared-inl.h
index 2a9a53d10c5..148f55449b1 100644
--- a/js/src/ion/shared/CodeGenerator-shared-inl.h
+++ b/js/src/ion/shared/CodeGenerator-shared-inl.h
@@ -17,8 +17,7 @@ ToInt32(const LAllocation *a)
         return a->toConstant()->toInt32();
     if (a->isConstantIndex())
         return a->toConstantIndex()->index();
-    JS_NOT_REACHED("this is not a constant!");
-    return -1;
+    MOZ_ASSUME_UNREACHABLE("this is not a constant!");
 }
 static inline double
 ToDouble(const LAllocation *a)
diff --git a/js/src/ion/shared/CodeGenerator-x86-shared.cpp b/js/src/ion/shared/CodeGenerator-x86-shared.cpp
index dc1786c8e71..d9904eb80e6 100644
--- a/js/src/ion/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/ion/shared/CodeGenerator-x86-shared.cpp
@@ -292,7 +292,7 @@ CodeGeneratorX86Shared::bailout(const T &binder, LSnapshot *snapshot)
       case SequentialExecution:
         break;
       default:
-        JS_NOT_REACHED("No such execution mode");
+        MOZ_ASSUME_UNREACHABLE("No such execution mode");
     }
 
     if (!encode(snapshot))
@@ -938,7 +938,7 @@ CodeGeneratorX86Shared::visitBitOpI(LBitOpI *ins)
                 masm.andl(ToOperand(rhs), ToRegister(lhs));
             break;
         default:
-            JS_NOT_REACHED("unexpected binary opcode");
+            MOZ_ASSUME_UNREACHABLE("unexpected binary opcode");
     }
 
     return true;
@@ -972,7 +972,7 @@ CodeGeneratorX86Shared::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            JS_NOT_REACHED("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     } else {
         JS_ASSERT(ToRegister(rhs) == ecx);
@@ -993,7 +993,7 @@ CodeGeneratorX86Shared::visitShiftI(LShiftI *ins)
             }
             break;
           default:
-            JS_NOT_REACHED("Unexpected shift op");
+            MOZ_ASSUME_UNREACHABLE("Unexpected shift op");
         }
     }
 
@@ -1138,8 +1138,7 @@ CodeGeneratorX86Shared::visitMathD(LMathD *math)
         masm.divsd(rhs, lhs);
         break;
       default:
-        JS_NOT_REACHED("unexpected opcode");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unexpected opcode");
     }
     return true;
 }
diff --git a/js/src/ion/shared/IonAssemblerBuffer.h b/js/src/ion/shared/IonAssemblerBuffer.h
index de88adb6ede..74fec89cb71 100644
--- a/js/src/ion/shared/IonAssemblerBuffer.h
+++ b/js/src/ion/shared/IonAssemblerBuffer.h
@@ -238,8 +238,7 @@ struct AssemblerBuffer
             return BufferOffset(bufferSize);
     }
     BufferOffset prevOffset() const {
-        JS_NOT_REACHED("Don't current record lastInstSize");
-        return BufferOffset(bufferSize + tail->nodeSize - lastInstSize);
+        MOZ_ASSUME_UNREACHABLE("Don't current record lastInstSize");
     }
 
     // Break the instruction stream so we can go back and edit it at this point
diff --git a/js/src/ion/shared/IonAssemblerBufferWithConstantPools.h b/js/src/ion/shared/IonAssemblerBufferWithConstantPools.h
index 5004b4d3d22..9e288d9298d 100644
--- a/js/src/ion/shared/IonAssemblerBufferWithConstantPools.h
+++ b/js/src/ion/shared/IonAssemblerBufferWithConstantPools.h
@@ -1130,8 +1130,7 @@ struct AssemblerBufferWithConstantPool : public AssemblerBuffer<SliceSize, Inst>
             }
             start = poolGroup[idx].other->addPoolSize(start);
         }
-        JS_NOT_REACHED("Entry is not in a pool");
-        return -1;
+        MOZ_ASSUME_UNREACHABLE("Entry is not in a pool");
     }
     void writePoolEntry(PoolEntry pe, uint8_t *buff) {
         size_t size = getPoolEntrySize(pe);
diff --git a/js/src/ion/shared/MacroAssembler-x86-shared.h b/js/src/ion/shared/MacroAssembler-x86-shared.h
index 90e65198b3f..36acefc6746 100644
--- a/js/src/ion/shared/MacroAssembler-x86-shared.h
+++ b/js/src/ion/shared/MacroAssembler-x86-shared.h
@@ -226,10 +226,10 @@ class MacroAssemblerX86Shared : public Assembler
         movzbl(Operand(src), dest);
     }
     void load8SignExtend(const Address &src, const Register &dest) {
-        movxbl(Operand(src), dest);
+        movsbl(Operand(src), dest);
     }
     void load8SignExtend(const BaseIndex &src, const Register &dest) {
-        movxbl(Operand(src), dest);
+        movsbl(Operand(src), dest);
     }
     template <typename S, typename T>
     void store8(const S &src, const T &dest) {
@@ -246,10 +246,10 @@ class MacroAssemblerX86Shared : public Assembler
         movw(src, Operand(dest));
     }
     void load16SignExtend(const Address &src, const Register &dest) {
-        movxwl(Operand(src), dest);
+        movswl(Operand(src), dest);
     }
     void load16SignExtend(const BaseIndex &src, const Register &dest) {
-        movxwl(Operand(src), dest);
+        movswl(Operand(src), dest);
     }
     void load32(const Address &address, Register dest) {
         movl(Operand(address), dest);
diff --git a/js/src/ion/x64/Assembler-x64.cpp b/js/src/ion/x64/Assembler-x64.cpp
index d897ee59a7b..77572a390e9 100644
--- a/js/src/ion/x64/Assembler-x64.cpp
+++ b/js/src/ion/x64/Assembler-x64.cpp
@@ -45,7 +45,7 @@ ABIArgGenerator::next(MIRType type)
         current_ = ABIArg(FloatArgRegs[regIndex_++]);
         break;
       default:
-        JS_NOT_REACHED("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 #else
@@ -68,7 +68,7 @@ ABIArgGenerator::next(MIRType type)
         current_ = ABIArg(FloatArgRegs[floatRegIndex_++]);
         break;
       default:
-        JS_NOT_REACHED("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 #endif
diff --git a/js/src/ion/x64/Assembler-x64.h b/js/src/ion/x64/Assembler-x64.h
index 5e6ff47886e..5058016acda 100644
--- a/js/src/ion/x64/Assembler-x64.h
+++ b/js/src/ion/x64/Assembler-x64.h
@@ -385,7 +385,7 @@ class Assembler : public AssemblerX86Shared
             masm.movq_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movq(const Register &src, const Operand &dest) {
@@ -400,7 +400,7 @@ class Assembler : public AssemblerX86Shared
             masm.movq_rm(src.code(), dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movq(Imm32 imm32, const Operand &dest) {
@@ -415,7 +415,7 @@ class Assembler : public AssemblerX86Shared
             masm.movq_i32m(imm32.value, dest.disp(), dest.base(), dest.index(), dest.scale());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movqsd(const Register &src, const FloatRegister &dest) {
@@ -451,7 +451,7 @@ class Assembler : public AssemblerX86Shared
             masm.addq_im(imm.value, dest.disp(), dest.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void addq(const Register &src, const Register &dest) {
@@ -466,7 +466,7 @@ class Assembler : public AssemblerX86Shared
             masm.addq_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
 
@@ -485,7 +485,7 @@ class Assembler : public AssemblerX86Shared
             masm.subq_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void shlq(Imm32 imm, const Register &dest) {
@@ -512,7 +512,7 @@ class Assembler : public AssemblerX86Shared
             masm.orq_mr(src.disp(), src.base(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void xorq(const Register &src, const Register &dest) {
@@ -568,7 +568,7 @@ class Assembler : public AssemblerX86Shared
             masm.leaq_mr(src.disp(), src.base(), src.index(), src.scale(), dest.code());
             break;
           default:
-            JS_NOT_REACHED("unexepcted operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexepcted operand kind");
         }
     }
 
@@ -603,7 +603,7 @@ class Assembler : public AssemblerX86Shared
             masm.cmpq_rm(rhs.code(), lhs.disp(), lhs.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpq(const Operand &lhs, Imm32 rhs) {
@@ -615,7 +615,7 @@ class Assembler : public AssemblerX86Shared
             masm.cmpq_im(rhs.value, lhs.disp(), lhs.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpq(const Register &lhs, const Operand &rhs) {
@@ -627,7 +627,7 @@ class Assembler : public AssemblerX86Shared
             masm.cmpq_mr(rhs.disp(), rhs.base(), lhs.code());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void cmpq(const Register &lhs, const Register &rhs) {
@@ -652,7 +652,7 @@ class Assembler : public AssemblerX86Shared
             masm.testq_i32m(rhs.value, lhs.disp(), lhs.base());
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
             break;
         }
     }
diff --git a/js/src/ion/x64/BaselineIC-x64.cpp b/js/src/ion/x64/BaselineIC-x64.cpp
index 7359d26eb66..7f90c92ed5f 100644
--- a/js/src/ion/x64/BaselineIC-x64.cpp
+++ b/js/src/ion/x64/BaselineIC-x64.cpp
@@ -180,8 +180,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-        JS_NOT_REACHED("Unhandled op in BinaryArith_Int32");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unhandled op in BinaryArith_Int32");
     }
 
     // Return from stub.
@@ -230,8 +229,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.negl(R0.valueReg());
         break;
       default:
-        JS_NOT_REACHED("Unexpected op");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     masm.tagValue(JSVAL_TYPE_INT32, R0.valueReg(), R0);
diff --git a/js/src/ion/x64/CodeGenerator-x64.cpp b/js/src/ion/x64/CodeGenerator-x64.cpp
index b53e346850e..256bde0218a 100644
--- a/js/src/ion/x64/CodeGenerator-x64.cpp
+++ b/js/src/ion/x64/CodeGenerator-x64.cpp
@@ -57,8 +57,7 @@ FrameSizeClass::ClassLimit()
 uint32_t
 FrameSizeClass::frameSize() const
 {
-    JS_NOT_REACHED("x64 does not use frame size classes");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("x64 does not use frame size classes");
 }
 
 bool
@@ -118,8 +117,7 @@ CodeGeneratorX64::visitUnbox(LUnbox *unbox)
             cond = masm.testString(Assembler::NotEqual, value);
             break;
           default:
-            JS_NOT_REACHED("Given MIRType cannot be unboxed.");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("Given MIRType cannot be unboxed.");
         }
         if (!bailoutIf(cond, unbox->snapshot()))
             return false;
@@ -139,8 +137,7 @@ CodeGeneratorX64::visitUnbox(LUnbox *unbox)
         masm.unboxString(value, ToRegister(result));
         break;
       default:
-        JS_NOT_REACHED("Given MIRType cannot be unboxed.");
-        break;
+        MOZ_ASSUME_UNREACHABLE("Given MIRType cannot be unboxed.");
     }
 
     return true;
@@ -176,7 +173,7 @@ CodeGeneratorX64::loadUnboxedValue(Operand source, MIRType type, const LDefiniti
         break;
 
       default:
-        JS_NOT_REACHED("unexpected type");
+        MOZ_ASSUME_UNREACHABLE("unexpected type");
     }
 }
 
@@ -389,15 +386,13 @@ CodeGeneratorX64::visitUInt32ToDouble(LUInt32ToDouble *lir)
 bool
 CodeGeneratorX64::visitLoadTypedArrayElementStatic(LLoadTypedArrayElementStatic *ins)
 {
-    JS_NOT_REACHED("NYI");
-    return true;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
 CodeGeneratorX64::visitStoreTypedArrayElementStatic(LStoreTypedArrayElementStatic *ins)
 {
-    JS_NOT_REACHED("NYI");
-    return true;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -419,14 +414,14 @@ CodeGeneratorX64::visitAsmJSLoadHeap(LAsmJSLoadHeap *ins)
 
     uint32_t before = masm.size();
     switch (vt) {
-      case ArrayBufferView::TYPE_INT8:    masm.movxbl(srcAddr, ToRegister(ins->output())); break;
+      case ArrayBufferView::TYPE_INT8:    masm.movsbl(srcAddr, ToRegister(ins->output())); break;
       case ArrayBufferView::TYPE_UINT8:   masm.movzbl(srcAddr, ToRegister(ins->output())); break;
-      case ArrayBufferView::TYPE_INT16:   masm.movxwl(srcAddr, ToRegister(ins->output())); break;
+      case ArrayBufferView::TYPE_INT16:   masm.movswl(srcAddr, ToRegister(ins->output())); break;
       case ArrayBufferView::TYPE_UINT16:  masm.movzwl(srcAddr, ToRegister(ins->output())); break;
       case ArrayBufferView::TYPE_INT32:   masm.movl(srcAddr, ToRegister(ins->output())); break;
       case ArrayBufferView::TYPE_UINT32:  masm.movl(srcAddr, ToRegister(ins->output())); break;
       case ArrayBufferView::TYPE_FLOAT64: masm.movsd(srcAddr, ToFloatRegister(ins->output())); break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
     uint32_t after = masm.size();
     return gen->noteHeapAccess(AsmJSHeapAccess(before, after, vt, ToAnyRegister(ins->output())));
@@ -457,7 +452,7 @@ CodeGeneratorX64::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
           case ArrayBufferView::TYPE_UINT16:  masm.movw(Imm32(ToInt32(ins->value())), dstAddr); break;
           case ArrayBufferView::TYPE_INT32:   masm.movl(Imm32(ToInt32(ins->value())), dstAddr); break;
           case ArrayBufferView::TYPE_UINT32:  masm.movl(Imm32(ToInt32(ins->value())), dstAddr); break;
-          default: JS_NOT_REACHED("unexpected array type");
+          default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
         }
     } else {
         switch (vt) {
@@ -468,7 +463,7 @@ CodeGeneratorX64::visitAsmJSStoreHeap(LAsmJSStoreHeap *ins)
           case ArrayBufferView::TYPE_INT32:   masm.movl(ToRegister(ins->value()), dstAddr); break;
           case ArrayBufferView::TYPE_UINT32:  masm.movl(ToRegister(ins->value()), dstAddr); break;
           case ArrayBufferView::TYPE_FLOAT64: masm.movsd(ToFloatRegister(ins->value()), dstAddr); break;
-          default: JS_NOT_REACHED("unexpected array type");
+          default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
         }
     }
     uint32_t after = masm.size();
diff --git a/js/src/ion/x64/Lowering-x64.cpp b/js/src/ion/x64/Lowering-x64.cpp
index 218142a750c..529db57a390 100644
--- a/js/src/ion/x64/Lowering-x64.cpp
+++ b/js/src/ion/x64/Lowering-x64.cpp
@@ -157,7 +157,7 @@ LIRGeneratorX64::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
         lir = new LAsmJSStoreHeap(useRegisterAtStart(ins->ptr()),
                                   useRegisterAtStart(ins->value()));
         break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
@@ -178,6 +178,5 @@ LIRGeneratorX64::newLGetPropertyCacheT(MGetPropertyCache *ins)
 bool
 LIRGeneratorX64::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins)
 {
-    JS_NOT_REACHED("NYI");
-    return true;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
diff --git a/js/src/ion/x64/MacroAssembler-x64.h b/js/src/ion/x64/MacroAssembler-x64.h
index 19c1e7dadea..585d9fd78ec 100644
--- a/js/src/ion/x64/MacroAssembler-x64.h
+++ b/js/src/ion/x64/MacroAssembler-x64.h
@@ -95,8 +95,7 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
                            base.scale(), base.disp() + 4);
 
           default:
-            JS_NOT_REACHED("unexpected operand kind");
-            return base; // Silence GCC warning.
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     static inline Operand ToUpper32(const Address &address) {
diff --git a/js/src/ion/x64/Trampoline-x64.cpp b/js/src/ion/x64/Trampoline-x64.cpp
index c72f6cf6c30..8660c20c326 100644
--- a/js/src/ion/x64/Trampoline-x64.cpp
+++ b/js/src/ion/x64/Trampoline-x64.cpp
@@ -450,8 +450,7 @@ GenerateBailoutThunk(JSContext *cx, MacroAssembler &masm, uint32_t frameClass)
 IonCode *
 IonRuntime::generateBailoutTable(JSContext *cx, uint32_t frameClass)
 {
-    JS_NOT_REACHED("x64 does not use bailout tables");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("x64 does not use bailout tables");
 }
 
 IonCode *
@@ -562,8 +561,7 @@ IonRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
                 break;
               case VMFunction::DoubleByValue:
               case VMFunction::DoubleByRef:
-                JS_NOT_REACHED("NYI: x64 callVM should not be used with 128bits values.");
-                break;
+                MOZ_ASSUME_UNREACHABLE("NYI: x64 callVM should not be used with 128bits values.");
             }
         }
     }
@@ -588,8 +586,7 @@ IonRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.branchPtr(Assembler::NotEqual, rax, Imm32(TP_SUCCESS), &failure);
         break;
       default:
-        JS_NOT_REACHED("unknown failure kind");
-        break;
+        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
     }
 
     // Load the outparam and free any allocated stack.
diff --git a/js/src/ion/x86/Assembler-x86.cpp b/js/src/ion/x86/Assembler-x86.cpp
index 02cc3feb35b..02e0af65bfe 100644
--- a/js/src/ion/x86/Assembler-x86.cpp
+++ b/js/src/ion/x86/Assembler-x86.cpp
@@ -28,7 +28,7 @@ ABIArgGenerator::next(MIRType type)
         stackOffset_ += sizeof(uint64_t);
         break;
       default:
-        JS_NOT_REACHED("Unexpected argument type");
+        MOZ_ASSUME_UNREACHABLE("Unexpected argument type");
     }
     return current_;
 }
diff --git a/js/src/ion/x86/Assembler-x86.h b/js/src/ion/x86/Assembler-x86.h
index 189b92f5f4c..c90e3f82340 100644
--- a/js/src/ion/x86/Assembler-x86.h
+++ b/js/src/ion/x86/Assembler-x86.h
@@ -312,7 +312,7 @@ class Assembler : public AssemblerX86Shared
             writeDataRelocation(ptr);
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void movl(ImmWord imm, Register dest) {
@@ -375,7 +375,7 @@ class Assembler : public AssemblerX86Shared
             writeDataRelocation(imm);
             break;
           default:
-            JS_NOT_REACHED("unexpected operand kind");
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     CodeOffsetLabel cmplWithPatch(const Register &lhs, Imm32 rhs) {
@@ -475,16 +475,16 @@ class Assembler : public AssemblerX86Shared
     }
 
     // Load from *(base + disp32) where disp32 can be patched.
-    CodeOffsetLabel movxblWithPatch(Address src, Register dest) {
-        masm.movxbl_mr_disp32(src.offset, src.base.code(), dest.code());
+    CodeOffsetLabel movsblWithPatch(Address src, Register dest) {
+        masm.movsbl_mr_disp32(src.offset, src.base.code(), dest.code());
         return masm.currentOffset();
     }
     CodeOffsetLabel movzblWithPatch(Address src, Register dest) {
         masm.movzbl_mr_disp32(src.offset, src.base.code(), dest.code());
         return masm.currentOffset();
     }
-    CodeOffsetLabel movxwlWithPatch(Address src, Register dest) {
-        masm.movxwl_mr_disp32(src.offset, src.base.code(), dest.code());
+    CodeOffsetLabel movswlWithPatch(Address src, Register dest) {
+        masm.movswl_mr_disp32(src.offset, src.base.code(), dest.code());
         return masm.currentOffset();
     }
     CodeOffsetLabel movzwlWithPatch(Address src, Register dest) {
diff --git a/js/src/ion/x86/BaselineIC-x86.cpp b/js/src/ion/x86/BaselineIC-x86.cpp
index 01a0b54bfc4..c8acff345b4 100644
--- a/js/src/ion/x86/BaselineIC-x86.cpp
+++ b/js/src/ion/x86/BaselineIC-x86.cpp
@@ -184,8 +184,7 @@ ICBinaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         }
         break;
       default:
-       JS_NOT_REACHED("Unhandled op for BinaryArith_Int32.  ");
-       return false;
+       MOZ_ASSUME_UNREACHABLE("Unhandled op for BinaryArith_Int32.  ");
     }
 
     // Return.
@@ -246,8 +245,7 @@ ICUnaryArith_Int32::Compiler::generateStubCode(MacroAssembler &masm)
         masm.negl(R0.payloadReg());
         break;
       default:
-        JS_NOT_REACHED("Unexpected op");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 
     EmitReturnFromIC(masm);
diff --git a/js/src/ion/x86/CodeGenerator-x86.cpp b/js/src/ion/x86/CodeGenerator-x86.cpp
index 3fc7945063d..dc138ab5264 100644
--- a/js/src/ion/x86/CodeGenerator-x86.cpp
+++ b/js/src/ion/x86/CodeGenerator-x86.cpp
@@ -415,15 +415,15 @@ CodeGeneratorX86::loadViewTypeElement(ArrayBufferView::ViewType vt, const Addres
                                       const LDefinition *out)
 {
     switch (vt) {
-      case ArrayBufferView::TYPE_INT8:    masm.movxblWithPatch(srcAddr, ToRegister(out)); break;
+      case ArrayBufferView::TYPE_INT8:    masm.movsblWithPatch(srcAddr, ToRegister(out)); break;
       case ArrayBufferView::TYPE_UINT8_CLAMPED:
       case ArrayBufferView::TYPE_UINT8:   masm.movzblWithPatch(srcAddr, ToRegister(out)); break;
-      case ArrayBufferView::TYPE_INT16:   masm.movxwlWithPatch(srcAddr, ToRegister(out)); break;
+      case ArrayBufferView::TYPE_INT16:   masm.movswlWithPatch(srcAddr, ToRegister(out)); break;
       case ArrayBufferView::TYPE_UINT16:  masm.movzwlWithPatch(srcAddr, ToRegister(out)); break;
       case ArrayBufferView::TYPE_INT32:   masm.movlWithPatch(srcAddr, ToRegister(out)); break;
       case ArrayBufferView::TYPE_UINT32:  masm.movlWithPatch(srcAddr, ToRegister(out)); break;
       case ArrayBufferView::TYPE_FLOAT64: masm.movsdWithPatch(srcAddr, ToFloatRegister(out)); break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 }
 
@@ -526,7 +526,7 @@ CodeGeneratorX86::storeViewTypeElement(ArrayBufferView::ViewType vt, const LAllo
       case ArrayBufferView::TYPE_INT32:   masm.movlWithPatch(ToRegister(value), dstAddr); break;
       case ArrayBufferView::TYPE_UINT32:  masm.movlWithPatch(ToRegister(value), dstAddr); break;
       case ArrayBufferView::TYPE_FLOAT64: masm.movsdWithPatch(ToFloatRegister(value), dstAddr); break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 }
 
diff --git a/js/src/ion/x86/Lowering-x86.cpp b/js/src/ion/x86/Lowering-x86.cpp
index abc1faf1a92..240ca2af101 100644
--- a/js/src/ion/x86/Lowering-x86.cpp
+++ b/js/src/ion/x86/Lowering-x86.cpp
@@ -237,7 +237,7 @@ LIRGeneratorX86::visitAsmJSStoreHeap(MAsmJSStoreHeap *ins)
         lir = new LAsmJSStoreHeap(useRegisterAtStart(ins->ptr()),
                                   useRegisterAtStart(ins->value()));
         break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
@@ -261,7 +261,7 @@ LIRGeneratorX86::visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic
         lir = new LStoreTypedArrayElementStatic(useRegisterAtStart(ins->ptr()),
                                                 useRegisterAtStart(ins->value()));
         break;
-      default: JS_NOT_REACHED("unexpected array type");
+      default: MOZ_ASSUME_UNREACHABLE("unexpected array type");
     }
 
     return add(lir, ins);
diff --git a/js/src/ion/x86/MacroAssembler-x86.h b/js/src/ion/x86/MacroAssembler-x86.h
index 73b1fa66eab..2f6756bf7c3 100644
--- a/js/src/ion/x86/MacroAssembler-x86.h
+++ b/js/src/ion/x86/MacroAssembler-x86.h
@@ -98,8 +98,7 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
                            base.scale(), base.disp() + sizeof(void *));
 
           default:
-            JS_NOT_REACHED("unexpected operand kind");
-            return base; // Silence GCC warning.
+            MOZ_ASSUME_UNREACHABLE("unexpected operand kind");
         }
     }
     void moveValue(const Value &val, Register type, Register data) {
diff --git a/js/src/ion/x86/Trampoline-x86.cpp b/js/src/ion/x86/Trampoline-x86.cpp
index 1e621de11dd..a98a5840bc9 100644
--- a/js/src/ion/x86/Trampoline-x86.cpp
+++ b/js/src/ion/x86/Trampoline-x86.cpp
@@ -609,8 +609,7 @@ IonRuntime::generateVMWrapper(JSContext *cx, const VMFunction &f)
         masm.branchPtr(Assembler::NotEqual, eax, Imm32(TP_SUCCESS), &failure);
         break;
       default:
-        JS_NOT_REACHED("unknown failure kind");
-        break;
+        MOZ_ASSUME_UNREACHABLE("unknown failure kind");
     }
 
     // Load the outparam and free any allocated stack.
diff --git a/js/src/jsanalyze.cpp b/js/src/jsanalyze.cpp
index b42dd4ba44b..8cec326204c 100644
--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@@ -2022,7 +2022,7 @@ SSAValue::print() const
         break;
 
       default:
-        JS_NOT_REACHED("Bad kind");
+        MOZ_ASSUME_UNREACHABLE("Bad kind");
     }
 }
 
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index fa6deb40232..cb9f970fd75 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -206,8 +206,7 @@ ReverseCompareOp(JSOp op)
       case JSOP_STRICTNE:
         return op;
       default:
-        JS_NOT_REACHED("unrecognized op");
-        return op;
+        MOZ_ASSUME_UNREACHABLE("unrecognized op");
     }
 }
 
@@ -232,8 +231,7 @@ NegateCompareOp(JSOp op)
       case JSOP_STRICTEQ:
         return JSOP_STRICTNE;
       default:
-        JS_NOT_REACHED("unrecognized op");
-        return op;
+        MOZ_ASSUME_UNREACHABLE("unrecognized op");
     }
 }
 
@@ -295,8 +293,7 @@ static inline uint32_t GetBytecodeSlot(JSScript *script, jsbytecode *pc)
         return ThisSlot();
 
       default:
-        JS_NOT_REACHED("Bad slot opcode");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("Bad slot opcode");
     }
 }
 
diff --git a/js/src/jsanalyzeinlines.h b/js/src/jsanalyzeinlines.h
index bda0739b185..9a5c3b10b9a 100644
--- a/js/src/jsanalyzeinlines.h
+++ b/js/src/jsanalyzeinlines.h
@@ -71,8 +71,7 @@ ScriptAnalysis::getValueTypes(const SSAValue &v)
         return &v.phiNode()->types;
       default:
         /* Cannot compute types for empty SSA values. */
-        JS_NOT_REACHED("Bad SSA value");
-        return NULL;
+        MOZ_ASSUME_UNREACHABLE("Bad SSA value");
     }
 }
 
diff --git a/js/src/jsclone.cpp b/js/src/jsclone.cpp
index cc93144431b..39d7588ce5c 100644
--- a/js/src/jsclone.cpp
+++ b/js/src/jsclone.cpp
@@ -927,8 +927,7 @@ JSStructuredCloneReader::readTypedArray(uint32_t arrayType, uint32_t nelems, Val
         obj = JS_NewUint8ClampedArrayWithBuffer(context(), buffer, byteOffset, nelems);
         break;
       default:
-        JS_NOT_REACHED("unknown TypedArray type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unknown TypedArray type");
     }
 
     if (!obj)
@@ -970,8 +969,7 @@ bytesPerTypedArrayElement(uint32_t arrayType)
       case TypedArray::TYPE_FLOAT64:
         return sizeof(uint64_t);
       default:
-        JS_NOT_REACHED("unknown TypedArray type");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("unknown TypedArray type");
     }
 }
 
@@ -1007,8 +1005,7 @@ JSStructuredCloneReader::readV1ArrayBuffer(uint32_t arrayType, uint32_t nelems,
       case TypedArray::TYPE_FLOAT64:
         return in.readArray((uint64_t*) buffer.dataPointer(), nelems);
       default:
-        JS_NOT_REACHED("unknown TypedArray type");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("unknown TypedArray type");
     }
 }
 
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 197aa7b4e59..240ac6f8714 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -103,8 +103,14 @@ void
 NewObjectCache::clearNurseryObjects(JSRuntime *rt)
 {
     for (unsigned i = 0; i < mozilla::ArrayLength(entries); ++i) {
-        if (IsInsideNursery(rt, entries[i].key))
-            mozilla::PodZero(&entries[i]);
+        Entry &e = entries[i];
+        JSObject *obj = reinterpret_cast<JSObject *>(&e.templateObject);
+        if (IsInsideNursery(rt, e.key) ||
+            IsInsideNursery(rt, obj->slots) ||
+            IsInsideNursery(rt, obj->elements))
+        {
+            mozilla::PodZero(&e);
+        }
     }
 }
 
diff --git a/js/src/jscntxtinlines.h b/js/src/jscntxtinlines.h
index 6899bb37920..f98ed3672af 100644
--- a/js/src/jscntxtinlines.h
+++ b/js/src/jscntxtinlines.h
@@ -616,8 +616,7 @@ js::ThreadSafeContext::allowGC() const
         return NoGC;
       default:
         /* Silence warnings. */
-        JS_NOT_REACHED("Bad context kind");
-        return NoGC;
+        MOZ_ASSUME_UNREACHABLE("Bad context kind");
     }
 }
 
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index 1e19a81637a..9cf45022bfb 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -105,7 +105,7 @@ js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame)
         frame.setReturnValue(rval);
         break;
       default:
-        JS_NOT_REACHED("bad Debugger::onEnterFrame JSTrapStatus value");
+        MOZ_ASSUME_UNREACHABLE("bad Debugger::onEnterFrame JSTrapStatus value");
     }
     return status;
 }
@@ -167,7 +167,7 @@ js::DebugExceptionUnwind(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
         break;
 
       default:
-        JS_NOT_REACHED("Invalid trap status");
+        MOZ_ASSUME_UNREACHABLE("Invalid trap status");
     }
 
     return status;
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index fedca8dbaf3..e21cb114308 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -948,7 +948,7 @@ JS::IncrementalReferenceBarrier(void *ptr, JSGCTraceKind kind)
     else if (kind == JSTRACE_TYPE_OBJECT)
         types::TypeObject::writeBarrierPre((types::TypeObject *) ptr);
     else
-        JS_NOT_REACHED("invalid trace kind");
+        MOZ_ASSUME_UNREACHABLE("invalid trace kind");
 }
 
 JS_FRIEND_API(void)
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 3d91be31818..2ddcca3a675 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -143,8 +143,7 @@ fun_getProperty(JSContext *cx, HandleObject obj_, HandleId id, MutableHandleValu
         return true;
     }
 
-    JS_NOT_REACHED("fun_getProperty");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("fun_getProperty");
 }
 
 
@@ -1751,7 +1750,6 @@ JSObject::hasIdempotentProtoChain() const
             return true;
     }
 
-    JS_NOT_REACHED("Should not get here");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Should not get here");
 }
 
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index d69f5af8a9c..270deacfced 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -459,8 +459,7 @@ FinalizeArenas(FreeOp *fop,
         return FinalizeTypedArenas<ion::IonCode>(fop, src, dest, thingKind, budget);
 #endif
       default:
-        JS_NOT_REACHED("Invalid alloc kind");
-        return true;
+        MOZ_ASSUME_UNREACHABLE("Invalid alloc kind");
     }
 }
 
@@ -725,8 +724,7 @@ Chunk::findDecommittedArenaOffset()
     for (unsigned i = 0; i < info.lastDecommittedArenaOffset; i++)
         if (decommittedArenas.get(i))
             return i;
-    JS_NOT_REACHED("No decommitted arenas found.");
-    return -1;
+    MOZ_ASSUME_UNREACHABLE("No decommitted arenas found.");
 }
 
 ArenaHeader *
@@ -2350,7 +2348,7 @@ GCHelperThread::startBackgroundShrink()
          */
         break;
       case SHUTDOWN:
-        JS_NOT_REACHED("No shrink on shutdown");
+        MOZ_ASSUME_UNREACHABLE("No shrink on shutdown");
     }
 #endif /* JS_THREADSAFE */
 }
@@ -3510,8 +3508,7 @@ RemoveFromGrayList(JSObject *wrapper)
         obj = next;
     }
 
-    JS_NOT_REACHED("object not found in gray link list");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("object not found in gray link list");
 }
 
 static void
@@ -4113,7 +4110,7 @@ ResetIncrementalGC(JSRuntime *rt, const char *reason)
         break;
 
       default:
-        JS_NOT_REACHED("Invalid incremental GC state");
+        MOZ_ASSUME_UNREACHABLE("Invalid incremental GC state");
     }
 
     rt->gcStats.reset(reason);
diff --git a/js/src/jsgcinlines.h b/js/src/jsgcinlines.h
index 7e9586290db..77c896fbd91 100644
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@@ -151,8 +151,7 @@ GetGCKindSlots(AllocKind thingKind)
       case FINALIZE_OBJECT16_BACKGROUND:
         return 16;
       default:
-        JS_NOT_REACHED("Bad object finalize kind");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("Bad object finalize kind");
     }
 }
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 64ec5c0b977..acdeaf4322a 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -190,8 +190,7 @@ types::TypeString(Type type)
           case JSVAL_TYPE_MAGIC:
             return "lazyargs";
           default:
-            JS_NOT_REACHED("Bad type");
-            return "";
+            MOZ_ASSUME_UNREACHABLE("Bad type");
         }
     }
     if (type.isUnknown())
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index 864ced49e19..dd6608003d0 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -113,8 +113,7 @@ CompilerOutput::ion() const
       case ParallelIon: return script->parallelIonScript();
     }
 #endif
-    JS_NOT_REACHED("Invalid kind of CompilerOutput");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("Invalid kind of CompilerOutput");
 }
 
 inline bool
@@ -223,8 +222,7 @@ PrimitiveTypeFlag(JSValueType type)
       case JSVAL_TYPE_MAGIC:
         return TYPE_FLAG_LAZYARGS;
       default:
-        JS_NOT_REACHED("Bad type");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("Bad type");
     }
 }
 
@@ -247,8 +245,7 @@ TypeFlagPrimitive(TypeFlags flags)
       case TYPE_FLAG_LAZYARGS:
         return JSVAL_TYPE_MAGIC;
       default:
-        JS_NOT_REACHED("Bad type");
-        return (JSValueType) 0;
+        MOZ_ASSUME_UNREACHABLE("Bad type");
     }
 }
 
@@ -498,8 +495,7 @@ GetClassForProtoKey(JSProtoKey key)
         return &ParallelArrayObject::class_;
 
       default:
-        JS_NOT_REACHED("Bad proto key");
-        return NULL;
+        MOZ_ASSUME_UNREACHABLE("Bad proto key");
     }
 }
 
@@ -1591,8 +1587,7 @@ TypeObject::getProperty(JSContext *cx, jsid id, bool own)
                     return &prop->types;
             }
 
-            JS_NOT_REACHED("Missing property");
-            return NULL;
+            MOZ_ASSUME_UNREACHABLE("Missing property");
         }
     }
 
diff --git a/js/src/jsobjinlines.h b/js/src/jsobjinlines.h
index cdf12dcd833..aef2d3b09e9 100644
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@@ -1266,8 +1266,7 @@ ObjectClassIs(HandleObject obj, ESClassValue classValue, JSContext *cx)
       case ESClass_ArrayBuffer: return obj->is<ArrayBufferObject>();
       case ESClass_Date: return obj->is<DateObject>();
     }
-    JS_NOT_REACHED("bad classValue");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("bad classValue");
 }
 
 inline bool
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 4a50c5ae9c8..6cb77040cbb 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -117,8 +117,7 @@ js_GetVariableBytecodeLength(jsbytecode *pc)
         return 1 + 3 * JUMP_OFFSET_LEN + ncases * JUMP_OFFSET_LEN;
       }
       default:
-        JS_NOT_REACHED("Unexpected op");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("Unexpected op");
     }
 }
 
@@ -250,15 +249,13 @@ PCCounts::countName(JSOp op, size_t which)
             return countElementNames[which - ACCESS_LIMIT];
         if (propertyOp(op))
             return countPropertyNames[which - ACCESS_LIMIT];
-        JS_NOT_REACHED("bad op");
-        return NULL;
+        MOZ_ASSUME_UNREACHABLE("bad op");
     }
 
     if (arithOp(op))
         return countArithNames[which - BASE_LIMIT];
 
-    JS_NOT_REACHED("bad op");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("bad op");
 }
 
 #ifdef DEBUG
@@ -2166,11 +2163,11 @@ js::GetPCCountScriptSummary(JSContext *cx, size_t index)
                 else if (PCCounts::propertyOp(op))
                     propertyTotals[j - PCCounts::ACCESS_LIMIT] += value;
                 else
-                    JS_NOT_REACHED("Bad opcode");
+                    MOZ_ASSUME_UNREACHABLE("Bad opcode");
             } else if (PCCounts::arithOp(op)) {
                 arithTotals[j - PCCounts::BASE_LIMIT] += value;
             } else {
-                JS_NOT_REACHED("Bad opcode");
+                MOZ_ASSUME_UNREACHABLE("Bad opcode");
             }
         }
     }
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 5853a3d9bf3..e2bef4f3912 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -515,8 +515,7 @@ GetBytecodeInteger(jsbytecode *pc)
       case JSOP_INT8:   return GET_INT8(pc);
       case JSOP_INT32:  return GET_INT32(pc);
       default:
-        JS_NOT_REACHED("Bad op");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("Bad op");
     }
 }
 
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index 134acbe7425..44b70b39389 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -309,15 +309,13 @@ BaseProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigned flags, Mut
 bool
 BaseProxyHandler::call(JSContext *cx, HandleObject proxy, const CallArgs &args)
 {
-    JS_NOT_REACHED("callable proxies should implement call trap");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("callable proxies should implement call trap");
 }
 
 bool
 BaseProxyHandler::construct(JSContext *cx, HandleObject proxy, const CallArgs &args)
 {
-    JS_NOT_REACHED("callable proxies should implement construct trap");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("callable proxies should implement construct trap");
 }
 
 const char *
@@ -329,16 +327,14 @@ BaseProxyHandler::className(JSContext *cx, HandleObject proxy)
 JSString *
 BaseProxyHandler::fun_toString(JSContext *cx, HandleObject proxy, unsigned indent)
 {
-    JS_NOT_REACHED("callable proxies should implement fun_toString trap");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("callable proxies should implement fun_toString trap");
 }
 
 bool
 BaseProxyHandler::regexp_toShared(JSContext *cx, HandleObject proxy,
                                   RegExpGuard *g)
 {
-    JS_NOT_REACHED("This should have been a wrapped regexp");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("This should have been a wrapped regexp");
 }
 
 bool
diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index 9a47bd36f6c..6346bb2c211 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -114,7 +114,7 @@ typedef AutoValueVector NodeVector;
 
 #define LOCAL_NOT_REACHED(expr)                                                        \
     JS_BEGIN_MACRO                                                                     \
-        JS_NOT_REACHED(expr);                                                          \
+        MOZ_ASSERT(false);                                                             \
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_PARSE_NODE);      \
         return false;                                                                  \
     JS_END_MACRO
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 31bd5e7860d..e7928db53cb 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -380,8 +380,7 @@ FindBlockIndex(JSScript *script, StaticBlockObject &block)
             return i;
     }
 
-    JS_NOT_REACHED("Block not found");
-    return UINT32_MAX;
+    MOZ_ASSUME_UNREACHABLE("Block not found");
 }
 
 template<XDRMode mode>
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index c21aec41294..8fd99b812f8 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -2452,8 +2452,7 @@ class TypedArrayTemplate
             break;
           }
           default:
-            JS_NOT_REACHED("copyFrom with a TypedArray of unknown type");
-            break;
+            MOZ_ASSUME_UNREACHABLE("copyFrom with a TypedArray of unknown type");
         }
 
         return true;
@@ -2530,8 +2529,7 @@ class TypedArrayTemplate
             break;
           }
           default:
-            JS_NOT_REACHED("copyFromWithOverlap with a TypedArray of unknown type");
-            break;
+            MOZ_ASSUME_UNREACHABLE("copyFromWithOverlap with a TypedArray of unknown type");
         }
 
         js_free(srcbuf);
@@ -3874,8 +3872,7 @@ js::IsTypedArrayConstructor(const Value &v, uint32_t type)
       case TypedArray::TYPE_UINT8_CLAMPED:
         return IsNativeFunction(v, Uint8ClampedArray::class_constructor);
     }
-    JS_NOT_REACHED("unexpected typed array type");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("unexpected typed array type");
 }
 
 bool
@@ -4032,8 +4029,7 @@ JS_GetArrayBufferViewType(JSObject *obj)
         return static_cast<JSArrayBufferViewType>(TypedArray::type(obj));
     else if (obj->is<DataViewObject>())
         return ArrayBufferView::TYPE_DATAVIEW;
-    JS_NOT_REACHED("invalid ArrayBufferView type");
-    return ArrayBufferView::TYPE_MAX;
+    MOZ_ASSUME_UNREACHABLE("invalid ArrayBufferView type");
 }
 
 JS_FRIEND_API(int8_t *)
diff --git a/js/src/jstypedarray.h b/js/src/jstypedarray.h
index f666e522043..18581362b01 100644
--- a/js/src/jstypedarray.h
+++ b/js/src/jstypedarray.h
@@ -337,8 +337,7 @@ TypedArrayShift(ArrayBufferView::ViewType viewType)
         return 3;
       default:;
     }
-    JS_NOT_REACHED("Unexpected array type");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("Unexpected array type");
 }
 
 class DataViewObject : public JSObject, public BufferView
diff --git a/js/src/jstypedarrayinlines.h b/js/src/jstypedarrayinlines.h
index 25a339823fe..1849e74cc12 100644
--- a/js/src/jstypedarrayinlines.h
+++ b/js/src/jstypedarrayinlines.h
@@ -156,8 +156,7 @@ TypedArray::slotWidth(int atype) {
     case js::TypedArray::TYPE_FLOAT64:
         return 8;
     default:
-        JS_NOT_REACHED("invalid typed array type");
-        return 0;
+        MOZ_ASSUME_UNREACHABLE("invalid typed array type");
     }
 }
 
diff --git a/js/src/jsversion.h b/js/src/jsversion.h
index efec331817e..1780616a32a 100644
--- a/js/src/jsversion.h
+++ b/js/src/jsversion.h
@@ -61,7 +61,7 @@
 #  define NEW_OBJECT_REPRESENTATION_ONLY() ((void)0)
 #else
 #  define NEW_OBJECT_REPRESENTATION_ONLY() \
-     MOZ_NOT_REACHED("don't call this!  to be used in the new object representation")
+     MOZ_ASSUME_UNREACHABLE("don't call this!  to be used in the new object representation")
 #endif
 
 #endif /* jsversion_h */
diff --git a/js/src/jsworkers.cpp b/js/src/jsworkers.cpp
index 7fc5cf4ca2f..56b6b505e7c 100644
--- a/js/src/jsworkers.cpp
+++ b/js/src/jsworkers.cpp
@@ -444,15 +444,13 @@ WorkerThread::threadLoop()
 bool
 js::StartOffThreadAsmJSCompile(JSContext *cx, AsmJSParallelTask *asmData)
 {
-    JS_NOT_REACHED("Off thread compilation not available in non-THREADSAFE builds");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Off thread compilation not available in non-THREADSAFE builds");
 }
 
 bool
 js::StartOffThreadIonCompile(JSContext *cx, ion::IonBuilder *builder)
 {
-    JS_NOT_REACHED("Off thread compilation not available in non-THREADSAFE builds");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Off thread compilation not available in non-THREADSAFE builds");
 }
 
 void
diff --git a/js/src/moz.build b/js/src/moz.build
index 193051b35f7..e831fd7a619 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -40,7 +40,6 @@ EXPORTS += [
     'jsdbgapi.h',
     'jsfriendapi.h',
     'jslock.h',
-    'jsperf.h',
     'jsprf.h',
     'jsprototypes.h',
     'jsproxy.h',
@@ -50,6 +49,7 @@ EXPORTS += [
     'jsutil.h',
     'jsversion.h',
     'jswrapper.h',
+    'perf/jsperf.h',
 ]
 
 if CONFIG['HAVE_DTRACE']:
@@ -61,22 +61,22 @@ if CONFIG['HAVE_DTRACE']:
 # that we ensure we don't over-expose our internal integer typedefs.  Note that
 # LegacyIntTypes.h below is deliberately exempted from this requirement.
 EXPORTS.js += [
-    'Anchor.h',
-    'CallArgs.h',
-    'CharacterEncoding.h',
-    'Date.h',
-    'GCAPI.h',
-    'HashTable.h',
-    'HeapAPI.h',
-    'LegacyIntTypes.h',
-    'MemoryMetrics.h',
-    'PropertyKey.h',
-    'RequiredDefines.h',
-    'RootingAPI.h',
-    'TemplateLib.h',
-    'Utility.h',
-    'Value.h',
-    'Vector.h',
+    '../public/Anchor.h',
+    '../public/CallArgs.h',
+    '../public/CharacterEncoding.h',
+    '../public/Date.h',
+    '../public/GCAPI.h',
+    '../public/HashTable.h',
+    '../public/HeapAPI.h',
+    '../public/LegacyIntTypes.h',
+    '../public/MemoryMetrics.h',
+    '../public/PropertyKey.h',
+    '../public/RequiredDefines.h',
+    '../public/RootingAPI.h',
+    '../public/TemplateLib.h',
+    '../public/Utility.h',
+    '../public/Value.h',
+    '../public/Vector.h',
 ]
 
 CPP_SOURCES += [
diff --git a/js/src/shell/jsoptparse.cpp b/js/src/shell/jsoptparse.cpp
index d3674eec2e3..6180189c890 100644
--- a/js/src/shell/jsoptparse.cpp
+++ b/js/src/shell/jsoptparse.cpp
@@ -135,7 +135,7 @@ PrintParagraph(const char *text, unsigned startColno, const unsigned limitColno,
             }
             break;
           default:
-            JS_NOT_REACHED("unhandled token splitting character in text");
+            MOZ_ASSUME_UNREACHABLE("unhandled token splitting character in text");
         }
     }
 }
@@ -309,8 +309,7 @@ OptionParser::handleOption(Option *opt, size_t argc, char **argv, size_t *i, boo
         return opt->asMultiStringOption()->strings.append(arg) ? Okay : Fail;
       }
       default:
-        JS_NOT_REACHED("unhandled option kind");
-        return Fail;
+        MOZ_ASSUME_UNREACHABLE("unhandled option kind");
     }
 }
 
@@ -337,8 +336,7 @@ OptionParser::handleArg(size_t argc, char **argv, size_t *i, bool *optionsAllowe
         return arg->asMultiStringOption()->strings.append(value) ? Okay : Fail;
       }
       default:
-        JS_NOT_REACHED("unhandled argument kind");
-        return Fail;
+        MOZ_ASSUME_UNREACHABLE("unhandled argument kind");
     }
 }
 
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-053.js b/js/src/tests/js1_8_1/regress/regress-452498-053.js
index ddd7d2a95b2..7b5f92c6f26 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-053.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-053.js
@@ -33,7 +33,7 @@ function test()
   let (a=0, b=1, c=2) {}
 
 // In RecycleTree at ../jsparse.cpp:315, we hit
-//     JS_NOT_REACHED("RecycleUseDefKids");
+//     MOZ_ASSUME_UNREACHABLE("RecycleUseDefKids");
 // pn->pn_type is TOK_UNARYOP
 // pn->pn_op   is JSOP_XMLNAME
 // pn->pn_defn is 1
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 07dba47e44a..00066f86e23 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -631,7 +631,7 @@ Debugger::slowPathOnLeaveFrame(JSContext *cx, AbstractFramePtr frame, bool frame
         return false;
 
       default:
-        JS_NOT_REACHED("bad final trap status");
+        MOZ_ASSUME_UNREACHABLE("bad final trap status");
     }
 }
 
@@ -829,7 +829,7 @@ Debugger::newCompletionValue(JSContext *cx, JSTrapStatus status, Value value_,
         return true;
 
       default:
-        JS_NOT_REACHED("bad status passed to Debugger::newCompletionValue");
+        MOZ_ASSUME_UNREACHABLE("bad status passed to Debugger::newCompletionValue");
     }
 
     /* Common tail for JSTRAP_RETURN and JSTRAP_THROW. */
@@ -1365,7 +1365,7 @@ Debugger::slowPathOnNewGlobalObject(JSContext *cx, Handle<GlobalObject *> global
         return false;
 
       default:
-        JS_NOT_REACHED("bad status from Debugger::fireNewGlobalObject");
+        MOZ_ASSUME_UNREACHABLE("bad status from Debugger::fireNewGlobalObject");
     }
 }
 
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index 66dac945a95..8abcc6a5720 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -82,26 +82,25 @@ ForkJoinSlice::InitializeTLS()
 JSRuntime *
 ForkJoinSlice::runtime()
 {
-    JS_NOT_REACHED("Not THREADSAFE build");
+    MOZ_ASSUME_UNREACHABLE("Not THREADSAFE build");
 }
 
 bool
 ForkJoinSlice::check()
 {
-    JS_NOT_REACHED("Not THREADSAFE build");
-    return true;
+    MOZ_ASSUME_UNREACHABLE("Not THREADSAFE build");
 }
 
 void
 ForkJoinSlice::requestGC(JS::gcreason::Reason reason)
 {
-    JS_NOT_REACHED("Not THREADSAFE build");
+    MOZ_ASSUME_UNREACHABLE("Not THREADSAFE build");
 }
 
 void
 ForkJoinSlice::requestZoneGC(JS::Zone *zone, JS::gcreason::Reason reason)
 {
-    JS_NOT_REACHED("Not THREADSAFE build");
+    MOZ_ASSUME_UNREACHABLE("Not THREADSAFE build");
 }
 
 void
@@ -110,14 +109,14 @@ ParallelBailoutRecord::setCause(ParallelBailoutCause cause,
                                 JSScript *currentScript,
                                 jsbytecode *currentPc)
 {
-    JS_NOT_REACHED("Not THREADSAFE build");
+    MOZ_ASSUME_UNREACHABLE("Not THREADSAFE build");
 }
 
 void
 ParallelBailoutRecord::addTrace(JSScript *script,
                                 jsbytecode *pc)
 {
-    JS_NOT_REACHED("Not THREADSAFE build");
+    MOZ_ASSUME_UNREACHABLE("Not THREADSAFE build");
 }
 
 bool
@@ -600,7 +599,7 @@ js::ParallelDo::apply()
         break;
 
       case NumForkJoinModes:
-        JS_NOT_REACHED("Invalid mode");
+        MOZ_ASSUME_UNREACHABLE("Invalid mode");
     }
 
     while (bailouts < MAX_BAILOUTS) {
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 800688f3853..de3868bef78 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -1228,7 +1228,7 @@ Interpret(JSContext *cx, RunState &state)
           case JSTRAP_ERROR:
             goto error;
           default:
-            JS_NOT_REACHED("bad ScriptDebugPrologue status");
+            MOZ_ASSUME_UNREACHABLE("bad ScriptDebugPrologue status");
         }
     }
 
@@ -2360,7 +2360,7 @@ BEGIN_CASE(JSOP_FUNCALL)
           case JSTRAP_ERROR:
             goto error;
           default:
-            JS_NOT_REACHED("bad ScriptDebugPrologue status");
+            MOZ_ASSUME_UNREACHABLE("bad ScriptDebugPrologue status");
         }
     }
 
@@ -3122,7 +3122,7 @@ END_CASE(JSOP_ARRAYPUSH)
                 goto forced_return;
 
               default:
-                JS_NOT_REACHED("Invalid trap status");
+                MOZ_ASSUME_UNREACHABLE("Invalid trap status");
             }
         }
 
diff --git a/js/src/vm/ObjectImpl.cpp b/js/src/vm/ObjectImpl.cpp
index 7441ad75ec7..a08f1f7b619 100644
--- a/js/src/vm/ObjectImpl.cpp
+++ b/js/src/vm/ObjectImpl.cpp
@@ -386,8 +386,7 @@ SparseElementsHeader::getOwnElement(JSContext *cx, Handle<ObjectImpl*> obj, uint
 {
     MOZ_ASSERT(this == &obj->elementsHeader());
 
-    MOZ_NOT_REACHED("NYI");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 template<typename T>
@@ -427,8 +426,7 @@ ArrayBufferElementsHeader::getOwnElement(JSContext *cx, Handle<ObjectImpl*> obj,
 {
     MOZ_ASSERT(this == &obj->elementsHeader());
 
-    MOZ_NOT_REACHED("NYI");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -438,8 +436,7 @@ SparseElementsHeader::defineElement(JSContext *cx, Handle<ObjectImpl*> obj, uint
 {
     MOZ_ASSERT(this == &obj->elementsHeader());
 
-    MOZ_NOT_REACHED("NYI");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -569,8 +566,7 @@ js::GetOwnProperty(JSContext *cx, Handle<ObjectImpl*> obj, PropertyId pid_, unsi
     Rooted<PropertyId> pid(cx, pid_);
 
     if (static_cast<JSObject *>(obj.get())->isProxy()) {
-        MOZ_NOT_REACHED("NYI: proxy [[GetOwnProperty]]");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("NYI: proxy [[GetOwnProperty]]");
     }
 
     RootedShape shape(cx, obj->nativeLookup(cx, pid));
@@ -612,8 +608,7 @@ js::GetOwnProperty(JSContext *cx, Handle<ObjectImpl*> obj, PropertyId pid_, unsi
         return true;
     }
 
-    MOZ_NOT_REACHED("NYI: PropertyOp-based properties");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("NYI: PropertyOp-based properties");
 }
 
 bool
@@ -648,8 +643,7 @@ js::GetOwnElement(JSContext *cx, Handle<ObjectImpl*> obj, uint32_t index, unsign
         return header.asArrayBufferElements().getOwnElement(cx, obj, index, resolveFlags, desc);
     }
 
-    MOZ_NOT_REACHED("bad elements kind!");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("bad elements kind!");
 }
 
 bool
@@ -666,8 +660,7 @@ js::GetProperty(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> rece
         MOZ_ASSERT(obj);
 
         if (Downcast(current)->isProxy()) {
-            MOZ_NOT_REACHED("NYI: proxy [[GetP]]");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("NYI: proxy [[GetP]]");
         }
 
         AutoPropDescRooter desc(cx);
@@ -711,12 +704,10 @@ js::GetProperty(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> rece
         }
 
         /* Otherwise it's a PropertyOp-based property.  XXX handle this! */
-        MOZ_NOT_REACHED("NYI: handle PropertyOp'd properties here");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("NYI: handle PropertyOp'd properties here");
     } while (false);
 
-    MOZ_NOT_REACHED("buggy control flow");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("buggy control flow");
 }
 
 bool
@@ -732,8 +723,7 @@ js::GetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
         MOZ_ASSERT(current);
 
         if (Downcast(current)->isProxy()) {
-            MOZ_NOT_REACHED("NYI: proxy [[GetP]]");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("NYI: proxy [[GetP]]");
         }
 
         PropDesc desc;
@@ -778,12 +768,10 @@ js::GetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
         }
 
         /* Otherwise it's a PropertyOp-based property.  XXX handle this! */
-        MOZ_NOT_REACHED("NYI: handle PropertyOp'd properties here");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("NYI: handle PropertyOp'd properties here");
     } while (false);
 
-    MOZ_NOT_REACHED("buggy control flow");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("buggy control flow");
 }
 
 bool
@@ -798,8 +786,7 @@ js::HasElement(JSContext *cx, Handle<ObjectImpl*> obj, uint32_t index, unsigned
         MOZ_ASSERT(current);
 
         if (Downcast(current)->isProxy()) {
-            MOZ_NOT_REACHED("NYI: proxy [[HasProperty]]");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("NYI: proxy [[HasProperty]]");
         }
 
         PropDesc prop;
@@ -819,8 +806,7 @@ js::HasElement(JSContext *cx, Handle<ObjectImpl*> obj, uint32_t index, unsigned
         return true;
     } while (false);
 
-    MOZ_NOT_REACHED("buggy control flow");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("buggy control flow");
 }
 
 bool
@@ -870,8 +856,7 @@ js::DefineElement(JSContext *cx, Handle<ObjectImpl*> obj, uint32_t index, const
                                                             resolveFlags, succeeded);
     }
 
-    MOZ_NOT_REACHED("bad elements kind!");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("bad elements kind!");
 }
 
 bool
@@ -881,8 +866,7 @@ SparseElementsHeader::setElement(JSContext *cx, Handle<ObjectImpl*> obj,
 {
     MOZ_ASSERT(this == &obj->elementsHeader());
 
-    MOZ_NOT_REACHED("NYI");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 bool
@@ -892,8 +876,7 @@ DenseElementsHeader::setElement(JSContext *cx, Handle<ObjectImpl*> obj,
 {
     MOZ_ASSERT(this == &obj->elementsHeader());
 
-    MOZ_NOT_REACHED("NYI");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("NYI");
 }
 
 template <typename T>
@@ -967,8 +950,7 @@ js::SetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
         MOZ_ASSERT(current);
 
         if (Downcast(current)->isProxy()) {
-            MOZ_NOT_REACHED("NYI: proxy [[SetP]]");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("NYI: proxy [[SetP]]");
         }
 
         PropDesc ownDesc;
@@ -1012,8 +994,7 @@ js::SetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
                 return Invoke(cx, args);
             }
 
-            MOZ_NOT_REACHED("NYI: setting PropertyOp-based property");
-            return false;
+            MOZ_ASSUME_UNREACHABLE("NYI: setting PropertyOp-based property");
         }
 
         current = current->getProto();
@@ -1024,8 +1005,7 @@ js::SetElement(JSContext *cx, Handle<ObjectImpl*> obj, Handle<ObjectImpl*> recei
         return DefineElement(cx, receiver, index, newDesc, false, resolveFlags, succeeded);
     } while (false);
 
-    MOZ_NOT_REACHED("buggy control flow");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("buggy control flow");
 }
 
 void
diff --git a/js/src/vm/ObjectImpl.h b/js/src/vm/ObjectImpl.h
index cf51c0f319f..f52a984e4a0 100644
--- a/js/src/vm/ObjectImpl.h
+++ b/js/src/vm/ObjectImpl.h
@@ -690,7 +690,7 @@ class TypedElementsHeader : public ElementsHeader
 template<typename T> inline void
 TypedElementsHeader<T>::assign(uint32_t index, double d)
 {
-    MOZ_NOT_REACHED("didn't specialize for this element type");
+    MOZ_ASSUME_UNREACHABLE("didn't specialize for this element type");
 }
 
 template<> inline void
@@ -1270,9 +1270,7 @@ class ObjectImpl : public gc::Cell
 
     bool makeElementsSparse(JSContext *cx) {
         NEW_OBJECT_REPRESENTATION_ONLY();
-
-        MOZ_NOT_REACHED("NYI");
-        return false;
+        MOZ_ASSUME_UNREACHABLE("NYI");
     }
 
     inline bool isProxy() const;
@@ -1399,9 +1397,7 @@ class ObjectImpl : public gc::Cell
                                                        uint32_t extra)
     {
         NEW_OBJECT_REPRESENTATION_ONLY();
-
-        MOZ_NOT_REACHED("NYI");
-        return Failure;
+        MOZ_ASSUME_UNREACHABLE("NYI");
     }
 
     /*
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index 86ca20abfac..0565a001353 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -404,8 +404,7 @@ RegExpShared::reportYarrError(JSContext *cx, TokenStream *ts, ErrorCode error)
 {
     switch (error) {
       case JSC::Yarr::NoError:
-        JS_NOT_REACHED("Called reportYarrError with value for no error");
-        return;
+        MOZ_ASSUME_UNREACHABLE("Called reportYarrError with value for no error");
 #define COMPILE_EMSG(__code, __msg)                                                              \
       case JSC::Yarr::__code:                                                                    \
         if (ts)                                                                                  \
@@ -426,7 +425,7 @@ RegExpShared::reportYarrError(JSContext *cx, TokenStream *ts, ErrorCode error)
       COMPILE_EMSG(EscapeUnterminated, JSMSG_TRAILING_SLASH);
 #undef COMPILE_EMSG
       default:
-        JS_NOT_REACHED("Unknown Yarr error code");
+        MOZ_ASSUME_UNREACHABLE("Unknown Yarr error code");
     }
 }
 
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index ee008a249d5..1005aebf21c 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -2114,7 +2114,7 @@ GetDebugScopeForMissing(JSContext *cx, const ScopeIter &si)
       }
       case ScopeIter::With:
       case ScopeIter::StrictEvalScope:
-        JS_NOT_REACHED("should already have a scope");
+        MOZ_ASSUME_UNREACHABLE("should already have a scope");
     }
     if (!debugScope)
         return NULL;
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 2d76e8f2a3e..c3337bfd746 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -341,7 +341,7 @@ AbstractFramePtr::maybeHookData() const
 #ifdef JS_ION
     return asBaselineFrame()->maybeHookData();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -355,7 +355,7 @@ AbstractFramePtr::setHookData(void *data) const
 #ifdef JS_ION
     asBaselineFrame()->setHookData(data);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -367,7 +367,7 @@ AbstractFramePtr::returnValue() const
 #ifdef JS_ION
     return *asBaselineFrame()->returnValue();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -381,7 +381,7 @@ AbstractFramePtr::setReturnValue(const Value &rval) const
 #ifdef JS_ION
     asBaselineFrame()->setReturnValue(rval);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -393,7 +393,7 @@ AbstractFramePtr::scopeChain() const
 #ifdef JS_ION
     return asBaselineFrame()->scopeChain();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -407,7 +407,7 @@ AbstractFramePtr::pushOnScopeChain(ScopeObject &scope)
 #ifdef JS_ION
     asBaselineFrame()->pushOnScopeChain(scope);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -419,7 +419,7 @@ AbstractFramePtr::callObj() const
 #ifdef JS_ION
     return asBaselineFrame()->callObj();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -431,7 +431,7 @@ AbstractFramePtr::initFunctionScopeObjects(JSContext *cx)
 #ifdef JS_ION
     return asBaselineFrame()->initFunctionScopeObjects(cx);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -449,7 +449,7 @@ AbstractFramePtr::numActualArgs() const
 #ifdef JS_ION
     return asBaselineFrame()->numActualArgs();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline unsigned
@@ -460,7 +460,7 @@ AbstractFramePtr::numFormalArgs() const
 #ifdef JS_ION
     return asBaselineFrame()->numFormalArgs();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -472,7 +472,7 @@ AbstractFramePtr::unaliasedVar(unsigned i, MaybeCheckAliasing checkAliasing)
 #ifdef JS_ION
     return asBaselineFrame()->unaliasedVar(i, checkAliasing);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -484,7 +484,7 @@ AbstractFramePtr::unaliasedLocal(unsigned i, MaybeCheckAliasing checkAliasing)
 #ifdef JS_ION
     return asBaselineFrame()->unaliasedLocal(i, checkAliasing);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -496,7 +496,7 @@ AbstractFramePtr::unaliasedFormal(unsigned i, MaybeCheckAliasing checkAliasing)
 #ifdef JS_ION
     return asBaselineFrame()->unaliasedFormal(i, checkAliasing);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -508,7 +508,7 @@ AbstractFramePtr::unaliasedActual(unsigned i, MaybeCheckAliasing checkAliasing)
 #ifdef JS_ION
     return asBaselineFrame()->unaliasedActual(i, checkAliasing);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -528,7 +528,7 @@ AbstractFramePtr::maybeBlockChain() const
 #ifdef JS_ION
     return asBaselineFrame()->maybeBlockChain();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -539,7 +539,7 @@ AbstractFramePtr::hasCallObj() const
 #ifdef JS_ION
     return asBaselineFrame()->hasCallObj();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -571,7 +571,7 @@ AbstractFramePtr::isFunctionFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->isFunctionFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -582,7 +582,7 @@ AbstractFramePtr::isGlobalFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->isGlobalFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -593,7 +593,7 @@ AbstractFramePtr::isEvalFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->isEvalFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -609,9 +609,8 @@ AbstractFramePtr::isDebuggerFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->isDebuggerFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
-    return false;
 }
 inline JSScript *
 AbstractFramePtr::script() const
@@ -621,7 +620,7 @@ AbstractFramePtr::script() const
 #ifdef JS_ION
     return asBaselineFrame()->script();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline JSFunction *
@@ -632,7 +631,7 @@ AbstractFramePtr::fun() const
 #ifdef JS_ION
     return asBaselineFrame()->fun();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline JSFunction *
@@ -643,7 +642,7 @@ AbstractFramePtr::maybeFun() const
 #ifdef JS_ION
     return asBaselineFrame()->maybeFun();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline JSFunction *
@@ -654,7 +653,7 @@ AbstractFramePtr::callee() const
 #ifdef JS_ION
     return asBaselineFrame()->callee();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline Value
@@ -665,7 +664,7 @@ AbstractFramePtr::calleev() const
 #ifdef JS_ION
     return asBaselineFrame()->calleev();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -676,7 +675,7 @@ AbstractFramePtr::isNonEvalFunctionFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->isNonEvalFunctionFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -687,7 +686,7 @@ AbstractFramePtr::isNonStrictDirectEvalFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->isNonStrictDirectEvalFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -698,7 +697,7 @@ AbstractFramePtr::isStrictEvalFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->isStrictEvalFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -710,7 +709,7 @@ AbstractFramePtr::argv() const
 #ifdef JS_ION
     return asBaselineFrame()->argv();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -722,7 +721,7 @@ AbstractFramePtr::hasArgsObj() const
 #ifdef JS_ION
     return asBaselineFrame()->hasArgsObj();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline ArgumentsObject &
@@ -733,7 +732,7 @@ AbstractFramePtr::argsObj() const
 #ifdef JS_ION
     return asBaselineFrame()->argsObj();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline void
@@ -746,7 +745,7 @@ AbstractFramePtr::initArgsObj(ArgumentsObject &argsobj) const
 #ifdef JS_ION
     asBaselineFrame()->initArgsObj(argsobj);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline bool
@@ -757,7 +756,7 @@ AbstractFramePtr::copyRawFrameSlots(AutoValueVector *vec) const
 #ifdef JS_ION
     return asBaselineFrame()->copyRawFrameSlots(vec);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -769,7 +768,7 @@ AbstractFramePtr::prevUpToDate() const
 #ifdef JS_ION
     return asBaselineFrame()->prevUpToDate();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 inline void
@@ -782,7 +781,7 @@ AbstractFramePtr::setPrevUpToDate() const
 #ifdef JS_ION
     asBaselineFrame()->setPrevUpToDate();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -794,7 +793,7 @@ AbstractFramePtr::thisValue() const
 #ifdef JS_ION
     return asBaselineFrame()->thisValue();
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -808,7 +807,7 @@ AbstractFramePtr::popBlock(JSContext *cx) const
 #ifdef JS_ION
     asBaselineFrame()->popBlock(cx);
 #else
-    JS_NOT_REACHED("Invalid frame");
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
@@ -818,7 +817,7 @@ AbstractFramePtr::popWith(JSContext *cx) const
     if (isStackFrame())
         asStackFrame()->popWith(cx);
     else
-        JS_NOT_REACHED("Invalid frame");
+        MOZ_ASSUME_UNREACHABLE("Invalid frame");
 }
 
 Activation::Activation(JSContext *cx, Kind kind, bool active)
diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
index 0d0993c92fb..30b0d71cab7 100644
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@@ -695,7 +695,7 @@ ScriptFrameIter::operator++()
 {
     switch (data_.state_) {
       case DONE:
-        JS_NOT_REACHED("Unexpected state");
+        MOZ_ASSUME_UNREACHABLE("Unexpected state");
       case SCRIPTED:
         if (interpFrame()->isDebuggerFrame() && interpFrame()->evalInFramePrev()) {
             AbstractFramePtr eifPrev = interpFrame()->evalInFramePrev();
@@ -714,7 +714,7 @@ ScriptFrameIter::operator++()
 #ifdef JS_ION
                     popJitFrame();
 #else
-                    JS_NOT_REACHED("Invalid state");
+                    MOZ_ASSUME_UNREACHABLE("Invalid state");
 #endif
                 } else {
                     popInterpreterFrame();
@@ -733,7 +733,7 @@ ScriptFrameIter::operator++()
         popJitFrame();
         break;
 #else
-        JS_NOT_REACHED("Unexpected state");
+        MOZ_ASSUME_UNREACHABLE("Unexpected state");
 #endif
     }
     return *this;
@@ -762,8 +762,7 @@ ScriptFrameIter::compartment() const
       case JIT:
         return data_.activations_.activation()->compartment();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 bool
@@ -784,8 +783,7 @@ ScriptFrameIter::isFunctionFrame() const
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 bool
@@ -806,8 +804,7 @@ ScriptFrameIter::isGlobalFrame() const
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 bool
@@ -828,8 +825,7 @@ ScriptFrameIter::isEvalFrame() const
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 bool
@@ -844,8 +840,7 @@ ScriptFrameIter::isNonEvalFunctionFrame() const
       case JIT:
         return !isEvalFrame() && isFunctionFrame();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 bool
@@ -859,8 +854,7 @@ ScriptFrameIter::isGeneratorFrame() const
       case JIT:
         return false;
     }
-    JS_NOT_REACHED("Unexpected state");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 bool
@@ -881,8 +875,7 @@ ScriptFrameIter::isConstructing() const
       case SCRIPTED:
         return interpFrame()->isConstructing();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 AbstractFramePtr
@@ -901,8 +894,7 @@ ScriptFrameIter::abstractFramePtr() const
         JS_ASSERT(interpFrame());
         return AbstractFramePtr(interpFrame());
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NullFramePtr();
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 void
@@ -950,7 +942,7 @@ ScriptFrameIter::updatePcQuadratic()
 #endif
         break;
     }
-    JS_NOT_REACHED("Unexpected state");
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 JSFunction *
@@ -972,8 +964,7 @@ ScriptFrameIter::callee() const
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 Value
@@ -992,8 +983,7 @@ ScriptFrameIter::calleev() const
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return Value();
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 unsigned
@@ -1016,8 +1006,7 @@ ScriptFrameIter::numActualArgs() const
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 Value
@@ -1036,8 +1025,7 @@ ScriptFrameIter::unaliasedActual(unsigned i, MaybeCheckAliasing checkAliasing) c
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NullValue();
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 JSObject *
@@ -1057,8 +1045,7 @@ ScriptFrameIter::scopeChain() const
       case SCRIPTED:
         return interpFrame()->scopeChain();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NULL;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 CallObject &
@@ -1088,8 +1075,7 @@ ScriptFrameIter::hasArgsObj() const
         break;
 #endif
     }
-    JS_NOT_REACHED("Unexpected state");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 ArgumentsObject &
@@ -1110,8 +1096,7 @@ ScriptFrameIter::argsObj() const
       case SCRIPTED:
         return interpFrame()->argsObj();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return interpFrame()->argsObj();
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 bool
@@ -1142,8 +1127,7 @@ ScriptFrameIter::thisv() const
       case SCRIPTED:
         return interpFrame()->thisValue();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NullValue();
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 Value
@@ -1161,8 +1145,7 @@ ScriptFrameIter::returnValue() const
       case SCRIPTED:
         return interpFrame()->returnValue();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NullValue();
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 void
@@ -1183,7 +1166,7 @@ ScriptFrameIter::setReturnValue(const Value &v)
         interpFrame()->setReturnValue(v);
         return;
     }
-    JS_NOT_REACHED("Unexpected state");
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 size_t
@@ -1206,8 +1189,7 @@ ScriptFrameIter::numFrameSlots() const
         JS_ASSERT(data_.interpFrames_.sp() >= interpFrame()->base());
         return data_.interpFrames_.sp() - interpFrame()->base();
     }
-    JS_NOT_REACHED("Unexpected state");
-    return 0;
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 Value
@@ -1232,8 +1214,7 @@ ScriptFrameIter::frameSlotValue(size_t index) const
       case SCRIPTED:
           return interpFrame()->base()[index];
     }
-    JS_NOT_REACHED("Unexpected state");
-    return NullValue();
+    MOZ_ASSUME_UNREACHABLE("Unexpected state");
 }
 
 #if defined(_MSC_VER)
@@ -1261,8 +1242,7 @@ AbstractFramePtr::hasPushedSPSFrame() const
 #ifdef JS_ION
     return asBaselineFrame()->hasPushedSPSFrame();
 #else
-    JS_NOT_REACHED("Invalid frame");
-    return false;
+    MOZ_ASSUME_UNREACHABLE("Invalid frame");
 #endif
 }
 
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 0fc1baacba9..3892538f707 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -293,7 +293,7 @@ bool CompartmentPrivate::TryParseLocationURI()
         // Strip current item and continue
         chain = Substring(chain, 0, idx);
     }
-    MOZ_NOT_REACHED("Chain parser loop does not terminate");
+    MOZ_ASSUME_UNREACHABLE("Chain parser loop does not terminate");
 }
 
 bool CompartmentPrivate::TryParseLocationURICandidate(const nsACString& uristr)
diff --git a/js/xpconnect/wrappers/WrapperFactory.cpp b/js/xpconnect/wrappers/WrapperFactory.cpp
index 48ff9f2a3a9..b75a8ad9826 100644
--- a/js/xpconnect/wrappers/WrapperFactory.cpp
+++ b/js/xpconnect/wrappers/WrapperFactory.cpp
@@ -623,7 +623,7 @@ WrapperFactory::WrapForSameCompartmentXray(JSContext *cx, JSObject *obj)
     else if (type == XrayForDOMObject)
         wrapper = &SCPermissiveXrayDOM::singleton;
     else
-        MOZ_NOT_REACHED("Bad Xray type");
+        MOZ_ASSUME_UNREACHABLE("Bad Xray type");
 
     // Make the Xray.
     JSObject *parent = JS_GetGlobalForObject(cx, obj);
diff --git a/js/xpconnect/wrappers/XrayWrapper.cpp b/js/xpconnect/wrappers/XrayWrapper.cpp
index 28ccf63dc6d..1803f442413 100644
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -148,12 +148,12 @@ public:
     static bool call(JSContext *cx, HandleObject wrapper,
                      const JS::CallArgs &args, js::Wrapper& baseInstance)
     {
-        MOZ_NOT_REACHED("Call trap currently implemented only for XPCWNs");
+        MOZ_ASSUME_UNREACHABLE("Call trap currently implemented only for XPCWNs");
     }
     static bool construct(JSContext *cx, HandleObject wrapper,
                           const JS::CallArgs &args, js::Wrapper& baseInstance)
     {
-        MOZ_NOT_REACHED("Call trap currently implemented only for XPCWNs");
+        MOZ_ASSUME_UNREACHABLE("Call trap currently implemented only for XPCWNs");
     }
 
     virtual void preserveWrapper(JSObject *target) = 0;
diff --git a/layout/base/moz.build b/layout/base/moz.build
index dc280c40428..635bb886887 100644
--- a/layout/base/moz.build
+++ b/layout/base/moz.build
@@ -91,7 +91,6 @@ CPP_SOURCES += [
     'nsCSSRendering.cpp',
     'nsCSSRenderingBorders.cpp',
     'nsCaret.cpp',
-    'nsChildIterator.cpp',
     'nsCounterManager.cpp',
     'nsDisplayList.cpp',
     'nsDisplayListInvalidation.cpp',
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 74caedafe50..81e1844a12f 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -69,7 +69,8 @@
 #include "nsObjectFrame.h"
 #include "nsRuleNode.h"
 #include "nsIDOMMutationEvent.h"
-#include "nsChildIterator.h"
+#include "ChildIterator.h"
+#include "nsXBLChildrenElement.h"
 #include "nsCSSRendering.h"
 #include "nsError.h"
 #include "nsLayoutUtils.h"
@@ -141,7 +142,6 @@ nsIFrame*
 NS_NewHTMLVideoFrame (nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 #include "nsSVGTextContainerFrame.h"
-#include "nsSVGTextFrame2.h"
 
 nsIFrame*
 NS_NewSVGOuterSVGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
@@ -3512,6 +3512,19 @@ nsCSSFrameConstructor::ConstructFrameFromItemInternal(FrameConstructionItem& aIt
   const nsStyleDisplay* display = styleContext->StyleDisplay();
   nsIContent* const content = aItem.mContent;
 
+  // Get the parent of the content and check if it is a XBL children element.
+  // Push the children element as an ancestor here because it does
+  // not have a frame and would not otherwise be pushed as an ancestor. It is
+  // necessary to do so in order to correctly handle style resolution on
+  // descendants.
+  nsIContent* parent = content->GetParent();
+  bool pushInsertionPoint = aState.mTreeMatchContext.mAncestorFilter.HasFilter() &&
+    parent && parent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL);
+  TreeMatchContext::AutoAncestorPusher
+    insertionPointPusher(pushInsertionPoint,
+                         aState.mTreeMatchContext,
+                         parent && parent->IsElement() ? parent->AsElement() : nullptr);
+
   // Push the content as a style ancestor now, so we don't have to do
   // it in our various full-constructor functions.  In particular,
   // since a number of full-constructor functions don't actually call
@@ -3772,9 +3785,8 @@ SetFlagsOnSubtree(nsIContent *aNode, uintptr_t aFlagsToSet)
 #ifdef DEBUG
   // Make sure that the node passed to us doesn't have any XBL children
   {
-    nsIDocument *doc = aNode->OwnerDoc();
-    NS_ASSERTION(doc, "The node must be in a document");
-    NS_ASSERTION(!doc->BindingManager()->GetXBLChildNodesFor(aNode),
+    FlattenedChildIterator iter(aNode);
+    NS_ASSERTION(!iter.XBLInvolved() || !iter.GetNextChild(),
                  "The node should not have any XBL children");
   }
 #endif
@@ -5941,18 +5953,16 @@ nsCSSFrameConstructor::FindFrameForContentSibling(nsIContent* aContent,
 }
 
 nsIFrame*
-nsCSSFrameConstructor::FindPreviousSibling(const ChildIterator& aFirst,
-                                           ChildIterator aIter,
+nsCSSFrameConstructor::FindPreviousSibling(FlattenedChildIterator aIter,
                                            uint8_t& aTargetContentDisplay)
 {
-  nsIContent* child = *aIter;
+  nsIContent* child = aIter.Get();
 
   // Note: not all content objects are associated with a frame (e.g., if it's
   // `display: none') so keep looking until we find a previous frame
-  while (aIter != aFirst) {
-    --aIter;
+  while (nsIContent* sibling = aIter.GetPreviousChild()) {
     nsIFrame* prevSibling =
-      FindFrameForContentSibling(*aIter, child, aTargetContentDisplay, true);
+      FindFrameForContentSibling(sibling, child, aTargetContentDisplay, true);
 
     if (prevSibling) {
       // Found a previous sibling, we're done!
@@ -5964,21 +5974,14 @@ nsCSSFrameConstructor::FindPreviousSibling(const ChildIterator& aFirst,
 }
 
 nsIFrame*
-nsCSSFrameConstructor::FindNextSibling(ChildIterator aIter,
-                                       const ChildIterator& aLast,
+nsCSSFrameConstructor::FindNextSibling(FlattenedChildIterator aIter,
                                        uint8_t& aTargetContentDisplay)
 {
-  if (aIter == aLast) {
-    // XXXbz Can happen when XBL lies to us about insertion points.  This check
-    // might be able to go away once bug 474324 is fixed.
-    return nullptr;
-  }
+  nsIContent* child = aIter.Get();
 
-  nsIContent* child = *aIter;
-
-  while (++aIter != aLast) {
+  while (nsIContent* sibling = aIter.GetNextChild()) {
     nsIFrame* nextSibling =
-      FindFrameForContentSibling(*aIter, child, aTargetContentDisplay, false);
+      FindFrameForContentSibling(sibling, child, aTargetContentDisplay, false);
 
     if (nextSibling) {
       // We found a next sibling, we're done!
@@ -6030,29 +6033,28 @@ nsCSSFrameConstructor::GetInsertionPrevSibling(nsIFrame*& aParentFrame,
   NS_PRECONDITION(aParentFrame, "Must have parent frame to start with");
   nsIContent* container = aParentFrame->GetContent();
 
-  ChildIterator first, last;
-  ChildIterator::Init(container, &first, &last);
-  ChildIterator iter(first);
+  FlattenedChildIterator iter(container);
   bool xblCase = iter.XBLInvolved() || container != aContainer;
   if (xblCase || !aChild->IsRootOfAnonymousSubtree()) {
     // The check for IsRootOfAnonymousSubtree() is because editor is
     // severely broken and calls us directly for native anonymous
     // nodes that it creates.
     if (aStartSkipChild) {
-      iter.seek(aStartSkipChild);
+      iter.Seek(aStartSkipChild);
     } else {
-      iter.seek(aChild);
+      iter.Seek(aChild);
     }
-  }
-#ifdef DEBUG
-  else {
+  } else {
+    // Prime the iterator for the call to FindPreviousSibling.
+    iter.GetNextChild();
     NS_WARNING("Someone passed native anonymous content directly into frame "
                "construction.  Stop doing that!");
   }
-#endif
 
+  // Note that FindPreviousSibling is passed the iterator by value, so that
+  // the later usage of the iterator starts from the same place.
   uint8_t childDisplay = UNSET_DISPLAY;
-  nsIFrame* prevSibling = FindPreviousSibling(first, iter, childDisplay);
+  nsIFrame* prevSibling = FindPreviousSibling(iter, childDisplay);
 
   // Now, find the geometric parent so that we can handle
   // continuations properly. Use the prev sibling if we have it;
@@ -6063,10 +6065,10 @@ nsCSSFrameConstructor::GetInsertionPrevSibling(nsIFrame*& aParentFrame,
   else {
     // If there is no previous sibling, then find the frame that follows
     if (aEndSkipChild) {
-      iter.seek(aEndSkipChild);
-      iter--;
+      iter.Seek(aEndSkipChild);
+      iter.GetPreviousChild();
     }
-    nsIFrame* nextSibling = FindNextSibling(iter, last, childDisplay);
+    nsIFrame* nextSibling = FindNextSibling(iter, childDisplay);
 
     if (nextSibling) {
       aParentFrame = nextSibling->GetParent()->GetContentInsertionFrame();
@@ -6325,11 +6327,8 @@ nsCSSFrameConstructor::CreateNeededFrames(nsIContent* aContent)
   }
 
   // Now descend.
-  ChildIterator iter, last;
-  for (ChildIterator::Init(aContent, &iter, &last);
-       iter != last;
-       ++iter) {
-    nsIContent* child = *iter;
+  FlattenedChildIterator iter(aContent);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
     if (child->HasFlag(NODE_DESCENDANTS_NEED_FRAMES)) {
       CreateNeededFrames(child);
     }
@@ -6381,7 +6380,6 @@ nsCSSFrameConstructor::IssueSingleInsertNofications(nsIContent* aContainer,
 
 nsIFrame*
 nsCSSFrameConstructor::GetRangeInsertionPoint(nsIContent* aContainer,
-                                              nsIFrame* aParentFrame,
                                               nsIContent* aStartChild,
                                               nsIContent* aEndChild,
                                               bool aAllowLazyConstruction)
@@ -6389,10 +6387,9 @@ nsCSSFrameConstructor::GetRangeInsertionPoint(nsIContent* aContainer,
   // See if we have an XBL insertion point. If so, then that's our
   // real parent frame; if not, then the frame hasn't been built yet
   // and we just bail.
-  nsIFrame* insertionPoint;
   bool multiple = false;
-  GetInsertionPoint(aParentFrame, nullptr, &insertionPoint, &multiple);
-  if (! insertionPoint)
+  nsIFrame* insertionPoint = GetInsertionPoint(aContainer, nullptr, &multiple);
+  if (!insertionPoint && !multiple)
     return nullptr; // Don't build the frames.
  
   bool hasInsertion = false;
@@ -6422,6 +6419,8 @@ nsCSSFrameConstructor::GetRangeInsertionPoint(nsIContent* aContainer,
       //
       // In the multiple insertion point case, we know we're going to need to do
       // multiple ContentInserted calls anyway.
+      // XXXndeakin This test doesn't work in the new world. Or rather, it works, but
+      // it's slow
       childCount = insertionPoint->GetContent()->GetChildCount();
     }
  
@@ -6511,8 +6510,11 @@ nsCSSFrameConstructor::ContentAppended(nsIContent*     aContainer,
 
   // Get the frame associated with the content
   nsIFrame* parentFrame = GetFrameFor(aContainer);
-  if (! parentFrame)
+
+  // See comment in ContentRangeInserted for why this is necessary.
+  if (!parentFrame && !aContainer->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
     return NS_OK;
+  }
 
   if (aAllowLazyConstruction &&
       MaybeConstructLazily(CONTENTAPPEND, aContainer, aFirstNewContent)) {
@@ -6520,7 +6522,7 @@ nsCSSFrameConstructor::ContentAppended(nsIContent*     aContainer,
   }
 
   LAYOUT_PHASE_TEMP_EXIT();
-  parentFrame = GetRangeInsertionPoint(aContainer, parentFrame,
+  parentFrame = GetRangeInsertionPoint(aContainer,
                                        aFirstNewContent, nullptr,
                                        aAllowLazyConstruction);
   LAYOUT_PHASE_TEMP_REENTER();
@@ -6608,8 +6610,9 @@ nsCSSFrameConstructor::ContentAppended(nsIContent*     aContainer,
   }
 
   nsIAtom* frameType = parentFrame->GetType();
-  bool haveNoXBLChildren =
-    mDocument->BindingManager()->GetXBLChildNodesFor(aContainer) == nullptr;
+
+  FlattenedChildIterator iter(aContainer);
+  bool haveNoXBLChildren = (!iter.XBLInvolved() || !iter.GetNextChild());
   FrameConstructionItemList items;
   if (aFirstNewContent->GetPreviousSibling() &&
       GetParentType(frameType) == eTypeBlock &&
@@ -6662,7 +6665,6 @@ nsCSSFrameConstructor::ContentAppended(nsIContent*     aContainer,
   }
   // To suppress whitespace-only text frames, we have to verify that
   // our container's DOM child list matches its flattened tree child list.
-  // This is guaranteed to be true if GetXBLChildNodesFor() returns null.
   items.SetParentHasNoXBLChildren(haveNoXBLChildren);
 
   nsFrameItems frameItems;
@@ -6929,10 +6931,16 @@ nsCSSFrameConstructor::ContentRangeInserted(nsIContent*            aContainer,
     return NS_OK;
   }
 
-  // Otherwise, we've got parent content. Find its frame.
   nsIFrame* parentFrame = GetFrameFor(aContainer);
-  if (! parentFrame)
+  // The xbl:children element won't have a frame, but default content can have the children as
+  // a parent. While its uncommon to change the structure of the default content itself, a label,
+  // for example, can be reframed by having its value attribute set or removed.
+  if (!parentFrame && !aContainer->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
     return NS_OK;
+  }
+
+  // Otherwise, we've got parent content. Find its frame.
+  NS_ASSERTION(!parentFrame || parentFrame->GetContent() == aContainer, "New XBL code is possibly wrong!");
 
   if (aAllowLazyConstruction &&
       MaybeConstructLazily(CONTENTINSERT, aContainer, aStartChild)) {
@@ -6943,23 +6951,18 @@ nsCSSFrameConstructor::ContentRangeInserted(nsIContent*            aContainer,
     // See if we have an XBL insertion point. If so, then that's our
     // real parent frame; if not, then the frame hasn't been built yet
     // and we just bail.
-    nsIFrame* insertionPoint;
-    GetInsertionPoint(parentFrame, aStartChild, &insertionPoint);
-    if (! insertionPoint)
-      return NS_OK; // Don't build the frames.
-
-    parentFrame = insertionPoint;
+    parentFrame = GetInsertionPoint(aContainer, aStartChild);
   } else {
     // Get our insertion point. If we need to issue single ContentInserted's
     // GetRangeInsertionPoint will take care of that for us.
     LAYOUT_PHASE_TEMP_EXIT();
-    parentFrame = GetRangeInsertionPoint(aContainer, parentFrame,
-                                         aStartChild, aEndChild,
+    parentFrame = GetRangeInsertionPoint(aContainer, aStartChild, aEndChild,
                                          aAllowLazyConstruction);
     LAYOUT_PHASE_TEMP_REENTER();
-    if (!parentFrame) {
-      return NS_OK;
-    }
+  }
+
+  if (!parentFrame) {
+    return NS_OK;
   }
 
   bool isAppend, isRangeInsertSafe;
@@ -7121,8 +7124,8 @@ nsCSSFrameConstructor::ContentRangeInserted(nsIContent*            aContainer,
 
   FrameConstructionItemList items;
   ParentType parentType = GetParentType(frameType);
-  bool haveNoXBLChildren =
-    mDocument->BindingManager()->GetXBLChildNodesFor(aContainer) == nullptr;
+  FlattenedChildIterator iter(aContainer);
+  bool haveNoXBLChildren = (!iter.XBLInvolved() || !iter.GetNextChild());
   if (aStartChild->GetPreviousSibling() &&
       parentType == eTypeBlock && haveNoXBLChildren) {
     // If there's a text node in the normal content list just before the
@@ -8936,71 +8939,50 @@ nsCSSFrameConstructor::ReplicateFixedFrames(nsPageContentFrame* aParentFrame)
   return NS_OK;
 }
 
-nsresult
-nsCSSFrameConstructor::GetInsertionPoint(nsIFrame*     aParentFrame,
+nsIFrame*
+nsCSSFrameConstructor::GetInsertionPoint(nsIContent*   aContainer,
                                          nsIContent*   aChildContent,
-                                         nsIFrame**    aInsertionPoint,
-                                         bool*       aMultiple)
+                                         bool*         aMultiple)
 {
-  // Make the insertion point be the parent frame by default, in case
-  // we have to bail early.
-  *aInsertionPoint = aParentFrame;
-
-  nsIContent* container = aParentFrame->GetContent();
-  if (!container)
-    return NS_OK;
-
   nsBindingManager *bindingManager = mDocument->BindingManager();
 
   nsIContent* insertionElement;
   if (aChildContent) {
     // We've got an explicit insertion child. Check to see if it's
     // anonymous.
-    if (aChildContent->GetBindingParent() == container) {
+    if (aChildContent->GetBindingParent() == aContainer) {
       // This child content is anonymous. Don't use the insertion
       // point, since that's only for the explicit kids.
-      return NS_OK;
+      return GetFrameFor(aContainer);
     }
 
-    uint32_t index;
-    insertionElement = bindingManager->GetInsertionPoint(container,
-                                                         aChildContent,
-                                                         &index);
+    insertionElement = bindingManager->FindNestedInsertionPoint(aContainer, aChildContent);
   }
   else {
     bool multiple;
-    uint32_t index;
-    insertionElement = bindingManager->GetSingleInsertionPoint(container,
-                                                               &index,
-                                                               &multiple);
-    if (multiple && aMultiple)
-      *aMultiple = multiple; // Record the fact that filters are in use.
+    insertionElement = bindingManager->FindNestedSingleInsertionPoint(aContainer, &multiple);
+
+    if (multiple) {
+      if (aMultiple) {
+        *aMultiple = true;
+      }
+      return nullptr;
+    }
   }
 
-  if (insertionElement) {
-    nsIFrame* insertionPoint = insertionElement->GetPrimaryFrame();
-    if (insertionPoint) {
-      // Use the content insertion frame of the insertion point.
-      insertionPoint = insertionPoint->GetContentInsertionFrame();
-      if (insertionPoint && insertionPoint != aParentFrame) 
-        GetInsertionPoint(insertionPoint, aChildContent, aInsertionPoint, aMultiple);
-    }
-    else {
-      // There was no frame created yet for the insertion point.
-      *aInsertionPoint = nullptr;
-    }
+  if (!insertionElement) {
+    insertionElement = aContainer;
   }
 
+  nsIFrame* insertionPoint = GetFrameFor(insertionElement);
+
   // fieldsets have multiple insertion points.  Note that we might
   // have to look at insertionElement here...
-  if (aMultiple && !*aMultiple) {
-    nsIContent* content = insertionElement ? insertionElement : container;
-    if (content->IsHTML(nsGkAtoms::fieldset)) {
-      *aMultiple = true;
-    }
+  if (aMultiple && insertionElement->IsHTML(nsGkAtoms::fieldset)) {
+    *aMultiple = true;
   }
 
-  return NS_OK;
+  return insertionPoint;
 }
 
 // Capture state for the frame tree rooted at the frame associated with the
@@ -9762,8 +9744,7 @@ nsCSSFrameConstructor::CreateNeededTablePseudos(nsFrameConstructorState& aState,
           eTypeColGroup : eTypeRowGroup;
         break;
       default:
-        MOZ_NOT_REACHED("Colgroups should be suppresing non-col child items");
-        break;
+        MOZ_CRASH("Colgroups should be suppresing non-col child items");
     }
 
     const PseudoParentData& pseudoData = sPseudoParentData[wrapperType];
@@ -9974,11 +9955,22 @@ nsCSSFrameConstructor::ProcessChildren(nsFrameConstructorState& aState,
       NS_WARNING("ProcessChildren max depth exceeded");
     }
 
-    ChildIterator iter, last;
-    for (ChildIterator::Init(aContent, &iter, &last);
-         iter != last;
-         ++iter) {
-      nsIContent* child = *iter;
+    FlattenedChildIterator iter(aContent);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+      // Get the parent of the content and check if it is a XBL children element
+      // (if the content is a children element then parent != aContent because the
+      // FlattenedChildIterator will transitively iterate through <xbl:children>
+      // for default content). Push the children element as an ancestor here because
+      // it does not have a frame and would not otherwise be pushed as an ancestor.
+      nsIContent* parent = child->GetParent();
+      MOZ_ASSERT(parent, "Parent must be non-null because we are iterating children.");
+      MOZ_ASSERT(parent->IsElement());
+      bool pushInsertionPoint = parent != aContent &&
+        aState.mTreeMatchContext.mAncestorFilter.HasFilter();
+      TreeMatchContext::AutoAncestorPusher
+        ancestorPusher(pushInsertionPoint, aState.mTreeMatchContext,
+                       parent->AsElement());
+
       // Frame construction item construction should not post
       // restyles, so removing restyle flags here is safe.
       if (child->IsElement()) {
@@ -11236,14 +11228,25 @@ nsCSSFrameConstructor::BuildInlineChildItems(nsFrameConstructorState& aState,
                                aParentItem.mChildItems);
   }
 
-  ChildIterator iter, last;
-  for (ChildIterator::Init(parentContent, &iter, &last);
-       iter != last;
-       ++iter) {
+  FlattenedChildIterator iter(parentContent);
+  for (nsIContent* content = iter.GetNextChild(); content; content = iter.GetNextChild()) {
+    // Get the parent of the content and check if it is a XBL children element
+    // (if the content is a children element then contentParent != parentContent because the
+    // FlattenedChildIterator will transitively iterate through <xbl:children>
+    // for default content). Push the children element as an ancestor here because
+    // it does not have a frame and would not otherwise be pushed as an ancestor.
+    nsIContent* contentParent = content->GetParent();
+    MOZ_ASSERT(contentParent, "Parent must be non-null because we are iterating children.");
+    MOZ_ASSERT(contentParent->IsElement());
+    bool pushInsertionPoint = contentParent != parentContent &&
+      aState.mTreeMatchContext.mAncestorFilter.HasFilter();
+    TreeMatchContext::AutoAncestorPusher
+      insertionPointPusher(pushInsertionPoint, aState.mTreeMatchContext,
+                           contentParent->AsElement());
+
     // Manually check for comments/PIs, since we don't have a frame to pass to
     // AddFrameConstructionItems.  We know our parent is a non-replaced inline,
     // so there is no need to do the NeedFrameFor check.
-    nsIContent* content = *iter;
     content->UnsetFlags(NODE_DESCENDANTS_NEED_FRAMES | NODE_NEEDS_FRAME);
     if (content->IsNodeOfType(nsINode::eCOMMENT) ||
         content->IsNodeOfType(nsINode::ePROCESSING_INSTRUCTION)) {
diff --git a/layout/base/nsCSSFrameConstructor.h b/layout/base/nsCSSFrameConstructor.h
index f093577052e..77b57489eff 100644
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -36,7 +36,7 @@ class nsPresContext;
 class nsStyleChangeList;
 class nsIFrame;
 struct nsGenConInitializer;
-class ChildIterator;
+
 class nsICSSAnonBoxPseudo;
 class nsPageContentFrame;
 struct PendingBinding;
@@ -45,6 +45,14 @@ class nsRefreshDriver;
 class nsFrameConstructorState;
 class nsFrameConstructorSaveState;
 
+namespace mozilla {
+namespace dom {
+
+class FlattenedChildIterator;
+
+}
+}
+
 class nsCSSFrameConstructor : public nsFrameManager
 {
   friend class nsRefreshDriver;
@@ -110,7 +118,6 @@ private:
   // ContentInserted calls for each child.  aEndChild = nullptr indicates that we
   // are dealing with an append.
   nsIFrame* GetRangeInsertionPoint(nsIContent* aContainer,
-                                   nsIFrame* aParentFrame,
                                    nsIContent* aStartChild,
                                    nsIContent* aEndChild,
                                    bool aAllowLazyConstruction);
@@ -355,10 +362,9 @@ public:
   nsresult ReplicateFixedFrames(nsPageContentFrame* aParentFrame);
 
   // Get the XBL insertion point for a child
-  nsresult GetInsertionPoint(nsIFrame*     aParentFrame,
-                             nsIContent*   aChildContent,
-                             nsIFrame**    aInsertionPoint,
-                             bool*       aMultiple = nullptr);
+  nsIFrame* GetInsertionPoint(nsIContent* aContainer,
+                              nsIContent* aChildContent,
+                              bool*       aMultiple = nullptr);
 
   nsresult CreateListBoxContent(nsPresContext* aPresContext,
                                 nsIFrame*       aParentFrame,
@@ -1405,7 +1411,7 @@ private:
 
   /**
    * Construct the frames for the children of aContent.  "children" is defined
-   * as "whatever ChildIterator returns for aContent".  This means we're
+   * as "whatever FlattenedChildIterator returns for aContent".  This means we're
    * basically operating on children in the "flattened tree" per sXBL/XBL2.
    * This method will also handle constructing ::before, ::after,
    * ::first-letter, and ::first-line frames, as needed and if allowed.
@@ -1784,15 +1790,13 @@ private:
   // Find the ``rightmost'' frame for the content immediately preceding the one
   // aIter points to, following continuations if necessary.  aIter is passed by
   // value on purpose, so as not to modify the caller's iterator.
-  nsIFrame* FindPreviousSibling(const ChildIterator& aFirst,
-                                ChildIterator aIter,
+  nsIFrame* FindPreviousSibling(mozilla::dom::FlattenedChildIterator aIter,
                                 uint8_t& aTargetContentDisplay);
 
   // Find the frame for the content node immediately following the one aIter
   // points to, following continuations if necessary.  aIter is passed by value
   // on purpose, so as not to modify the caller's iterator.
-  nsIFrame* FindNextSibling(ChildIterator aIter,
-                            const ChildIterator& aLast,
+  nsIFrame* FindNextSibling(mozilla::dom::FlattenedChildIterator aIter,
                             uint8_t& aTargetContentDisplay);
 
   // Find the right previous sibling for an insertion.  This also updates the
diff --git a/layout/base/nsChildIterator.cpp b/layout/base/nsChildIterator.cpp
deleted file mode 100644
index a96f60a4ca3..00000000000
--- a/layout/base/nsChildIterator.cpp
+++ /dev/null
@@ -1,51 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-// vim:cindent:ts=2:et:sw=2:
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/*
- * used by nsCSSFrameConstructor to determine and iterate the child list
- * used to construct frames (normal children or something from XBL)
- */
-
-#include "nsChildIterator.h"
-#include "nsIDocument.h"
-#include "nsBindingManager.h"
-
-nsresult
-ChildIterator::Init(nsIContent*    aContent,
-                    ChildIterator* aFirst,
-                    ChildIterator* aLast)
-{
-  // Initialize out parameters to be equal, in case of failure.
-  aFirst->mContent = aLast->mContent = nullptr;
-  aFirst->mChild   = aLast->mChild   = nullptr;
-  
-  NS_PRECONDITION(aContent != nullptr, "no content");
-  if (! aContent)
-    return NS_ERROR_NULL_POINTER;
-
-  nsIDocument* doc = aContent->OwnerDoc();
-
-  // If this node has XBL children, then use them. Otherwise, just use
-  // the vanilla content APIs.
-  nsINodeList* nodes = doc->BindingManager()->GetXBLChildNodesFor(aContent);
-
-  aFirst->mContent = aContent;
-  aLast->mContent  = aContent;
-  aFirst->mNodes   = nodes;
-  aLast->mNodes    = nodes;
-
-  if (nodes) {
-    uint32_t length;
-    nodes->GetLength(&length);
-    aFirst->mIndex = 0;
-    aLast->mIndex = length;
-  } else {
-    aFirst->mChild = aContent->GetFirstChild();
-    aLast->mChild = nullptr;
-  }
-
-  return NS_OK;
-}
diff --git a/layout/base/nsChildIterator.h b/layout/base/nsChildIterator.h
deleted file mode 100644
index 8b40dff4fe2..00000000000
--- a/layout/base/nsChildIterator.h
+++ /dev/null
@@ -1,161 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-// vim:cindent:ts=2:et:sw=2:
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-/*
- * used by nsCSSFrameConstructor to determine and iterate the child list
- * used to construct frames (normal children or something from XBL)
- */
-
-#include "nsCOMPtr.h"
-#include "nsIContent.h"
-#include "nsINodeList.h"
-
-/**
- * Helper class for iterating children during frame construction.
- * This class should always be used in lieu of the straight content
- * node APIs, since it handles XBL-generated anonymous content as
- * well.
- */
-class MOZ_STACK_CLASS ChildIterator
-{
-protected:
-  nsIContent* mContent;
-  // If mNodes is non-null (so XBLInvolved() is true), mIndex is the
-  // index into mNodes for our current position.  Otherwise, mChild is
-  // our current child (which might be null if we're done iterating).
-  union {
-    uint32_t mIndex;
-    nsIContent* mChild;
-  };
-  nsINodeList* mNodes;
-
-public:
-  ChildIterator()
-    : mContent(nullptr), mChild(0), mNodes(nullptr) {}
-
-  ChildIterator(const ChildIterator& aOther)
-    : mContent(aOther.mContent),
-      mNodes(aOther.mNodes) {
-    if (XBLInvolved()) {
-      mIndex = aOther.mIndex;
-    } else {
-      mChild = aOther.mChild;
-    }
-  }
-
-  ChildIterator& operator=(const ChildIterator& aOther) {
-    mContent = aOther.mContent;
-    mNodes = aOther.mNodes;
-    if (XBLInvolved()) {
-      mIndex = aOther.mIndex;
-    } else {
-      mChild = aOther.mChild;
-    }
-    return *this;
-  }
-
-  ChildIterator& operator++() {
-    if (XBLInvolved()) {
-      ++mIndex;
-    } else {
-      NS_ASSERTION(mChild, "Walking off end of list?");
-      mChild = mChild->GetNextSibling();
-    }
-
-    return *this;
-  }
-
-  ChildIterator operator++(int) {
-    ChildIterator result(*this);
-    ++(*this);
-    return result;
-  }
-
-  ChildIterator& operator--() {
-    if (XBLInvolved()) {
-      --mIndex;
-    } else if (mChild) {
-      mChild = mChild->GetPreviousSibling();
-      NS_ASSERTION(mChild, "Walking off beginning of list");
-    } else {
-      mChild = mContent->GetLastChild();
-    }
-    return *this;
-  }
-
-  ChildIterator operator--(int) {
-    ChildIterator result(*this);
-    --(*this);
-    return result;
-  }
-
-  nsIContent* get() const {
-    if (XBLInvolved()) {
-      return mNodes->Item(mIndex);
-    }
-
-    return mChild;
-  }
-
-  nsIContent* operator*() const { return get(); }
-
-  bool operator==(const ChildIterator& aOther) const {
-    if (XBLInvolved()) {
-      return mContent == aOther.mContent && mIndex == aOther.mIndex;
-    }
-
-    return mContent == aOther.mContent && mChild == aOther.mChild;
-  }
-
-  bool operator!=(const ChildIterator& aOther) const {
-    return !aOther.operator==(*this);
-  }
-
-  void seek(nsIContent* aContent) {
-    if (XBLInvolved()) {
-      int32_t index = mNodes->IndexOf(aContent);
-      // XXXbz I wish we could assert that index != -1, but it seems to not be
-      // the case in some XBL cases with filtered insertion points and no
-      // default insertion point.  I will now claim that XBL's management of
-      // its insertion points is broken in those cases, since it's returning an
-      // insertion parent for a node that doesn't actually have the node in its
-      // child list according to ChildIterator.  See bug 474324.
-      if (index != -1) {
-        mIndex = index;
-      } else {
-        // If aContent isn't going to get hit by this iterator, just seek to the
-        // end of the list for lack of anything better to do.
-        mIndex = length();
-      }
-    } else if (aContent->GetParent() == mContent) {
-      mChild = aContent;
-    } else {
-      // XXXbz I wish we could assert this doesn't happen, but I think that's
-      // not necessarily the case when called from ContentInserted if
-      // first-letter frames are about.
-      mChild = nullptr;
-    }
-  }
-
-  bool XBLInvolved() const { return mNodes != nullptr; }
-
-  /**
-   * Create a pair of ChildIterators for a content node. aFirst will
-   * point to the first child of aContent; aLast will point one past
-   * the last child of aContent.
-   */
-  static nsresult Init(nsIContent*    aContent,
-                       ChildIterator* aFirst,
-                       ChildIterator* aLast);
-
-private:
-  uint32_t length() {
-    NS_PRECONDITION(XBLInvolved(), "Don't call me");
-    uint32_t l;
-    mNodes->GetLength(&l);
-    return l;
-  }
-};
diff --git a/layout/base/nsFrameManager.cpp b/layout/base/nsFrameManager.cpp
index 0f0de4c9e64..6375bd4620d 100644
--- a/layout/base/nsFrameManager.cpp
+++ b/layout/base/nsFrameManager.cpp
@@ -60,6 +60,7 @@
 #include "nsTransitionManager.h"
 #include "RestyleTracker.h"
 #include "nsAbsoluteContainingBlock.h"
+#include "ChildIterator.h"
 
 #include "nsFrameManager.h"
 #include "nsRuleProcessorData.h"
@@ -173,7 +174,12 @@ public:
   NS_HIDDEN_(void)  Clear(void);
 
 protected:
-  NS_HIDDEN_(PLHashEntry**) GetEntryFor(nsIContent* aParentContent);
+  /**
+   * Gets the entry for the provided parent content. If the content
+   * is a <xbl:children> element, |**aParentContent| is set to
+   * the parent of the children element.
+   */
+  NS_HIDDEN_(PLHashEntry**) GetEntryFor(nsIContent** aParentContent);
   NS_HIDDEN_(void)          AppendNodeFor(UndisplayedNode* aNode,
                                           nsIContent* aParentContent);
 
@@ -398,19 +404,12 @@ nsFrameManager::ClearAllUndisplayedContentIn(nsIContent* aParentContent)
 
   // Need to look at aParentContent's content list due to XBL insertions.
   // Nodes in aParentContent's content list do not have aParentContent as a
-  // parent, but are treated as children of aParentContent. We get access to
-  // the content list via GetXBLChildNodesFor and just ignore any nodes we
-  // don't care about.
-  nsINodeList* list =
-    aParentContent->OwnerDoc()->BindingManager()->GetXBLChildNodesFor(aParentContent);
-  if (list) {
-    uint32_t length;
-    list->GetLength(&length);
-    for (uint32_t i = 0; i < length; ++i) {
-      nsIContent* child = list->Item(i);
-      if (child->GetParent() != aParentContent) {
-        ClearUndisplayedContentIn(child, child->GetParent());
-      }
+  // parent, but are treated as children of aParentContent. We iterate over
+  // the flattened content list and just ignore any nodes we don't care about.
+  FlattenedChildIterator iter(aParentContent);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+    if (child->GetParent() != aParentContent) {
+      ClearUndisplayedContentIn(child, child->GetParent());
     }
   }
 }
@@ -1375,6 +1374,18 @@ nsFrameManager::ReResolveStyleContext(nsPresContext     *aPresContext,
         NS_ASSERTION(!undisplayed->mStyle->GetPseudo(),
                      "Shouldn't have random pseudo style contexts in the "
                      "undisplayed map");
+
+        // Get the parent of the undisplayed content and check if it is a XBL
+        // children element. Push the children element as an ancestor here because it does
+        // not have a frame and would not otherwise be pushed as an ancestor.
+        nsIContent* parent = undisplayed->mContent->GetParent();
+        bool pushInsertionPoint = parent &&
+          parent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL);
+        TreeMatchContext::AutoAncestorPusher
+          insertionPointPusher(pushInsertionPoint,
+                               aTreeMatchContext,
+                               parent && parent->IsElement() ? parent->AsElement() : nullptr);
+
         nsRestyleHint thisChildHint = childRestyleHint;
         RestyleTracker::RestyleData undisplayedRestyleData;
         if (aRestyleTracker.GetRestyleData(undisplayed->mContent->AsElement(),
@@ -1530,6 +1541,19 @@ nsFrameManager::ReResolveStyleContext(nsPresContext     *aPresContext,
         for (; !childFrames.AtEnd(); childFrames.Next()) {
           nsIFrame* child = childFrames.get();
           if (!(child->GetStateBits() & NS_FRAME_OUT_OF_FLOW)) {
+            // Get the parent of the child frame's content and check if it is a XBL
+            // children element. Push the children element as an ancestor here because it does
+            // not have a frame and would not otherwise be pushed as an ancestor.
+
+            // Check if the frame has a content because |child| may be a nsPageFrame that does
+            // not have a content.
+            nsIContent* parent = child->GetContent() ? child->GetContent()->GetParent() : nullptr;
+            bool pushInsertionPoint = parent &&
+              parent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL);
+            TreeMatchContext::AutoAncestorPusher
+              insertionPointPusher(pushInsertionPoint, aTreeMatchContext,
+                                   parent && parent->IsElement() ? parent->AsElement() : nullptr);
+
             // only do frames that are in flow
             if (nsGkAtoms::placeholderFrame == child->GetType()) { // placeholder
               // get out of flow frame and recur there
@@ -1872,13 +1896,29 @@ nsFrameManagerBase::UndisplayedMap::~UndisplayedMap(void)
 }
 
 PLHashEntry**  
-nsFrameManagerBase::UndisplayedMap::GetEntryFor(nsIContent* aParentContent)
+nsFrameManagerBase::UndisplayedMap::GetEntryFor(nsIContent** aParentContent)
 {
-  if (mLastLookup && (aParentContent == (*mLastLookup)->key)) {
+  nsIContent* parentContent = *aParentContent;
+
+  if (mLastLookup && (parentContent == (*mLastLookup)->key)) {
     return mLastLookup;
   }
-  PLHashNumber hashCode = NS_PTR_TO_INT32(aParentContent);
-  PLHashEntry** entry = PL_HashTableRawLookup(mTable, hashCode, aParentContent);
+
+  // In the case of XBL default content, <xbl:children> elements do not get a
+  // frame causing a mismatch between the content tree and the frame tree.
+  // |GetEntryFor| is sometimes called with the content tree parent (which may
+  // be a <xbl:children> element) but the parent in the frame tree would be the
+  // insertion parent (parent of the <xbl:children> element). Here the children
+  // elements are normalized to the insertion parent to correct for the mismatch.
+  if (parentContent &&
+      parentContent->NodeInfo()->Equals(nsGkAtoms::children, kNameSpaceID_XBL)) {
+    parentContent = parentContent->GetParent();
+    // Change the caller's pointer for the parent content to be the insertion parent.
+    *aParentContent = parentContent;
+  }
+
+  PLHashNumber hashCode = NS_PTR_TO_INT32(parentContent);
+  PLHashEntry** entry = PL_HashTableRawLookup(mTable, hashCode, parentContent);
   if (*entry) {
     mLastLookup = entry;
   }
@@ -1888,7 +1928,7 @@ nsFrameManagerBase::UndisplayedMap::GetEntryFor(nsIContent* aParentContent)
 UndisplayedNode* 
 nsFrameManagerBase::UndisplayedMap::GetFirstNode(nsIContent* aParentContent)
 {
-  PLHashEntry** entry = GetEntryFor(aParentContent);
+  PLHashEntry** entry = GetEntryFor(&aParentContent);
   if (*entry) {
     return (UndisplayedNode*)((*entry)->value);
   }
@@ -1899,7 +1939,7 @@ void
 nsFrameManagerBase::UndisplayedMap::AppendNodeFor(UndisplayedNode* aNode,
                                                   nsIContent* aParentContent)
 {
-  PLHashEntry** entry = GetEntryFor(aParentContent);
+  PLHashEntry** entry = GetEntryFor(&aParentContent);
   if (*entry) {
     UndisplayedNode*  node = (UndisplayedNode*)((*entry)->value);
     while (node->mNext) {
@@ -1937,7 +1977,7 @@ void
 nsFrameManagerBase::UndisplayedMap::RemoveNodeFor(nsIContent* aParentContent,
                                                   UndisplayedNode* aNode)
 {
-  PLHashEntry** entry = GetEntryFor(aParentContent);
+  PLHashEntry** entry = GetEntryFor(&aParentContent);
   NS_ASSERTION(*entry, "content not in map");
   if (*entry) {
     if ((UndisplayedNode*)((*entry)->value) == aNode) {  // first node
@@ -1968,7 +2008,7 @@ nsFrameManagerBase::UndisplayedMap::RemoveNodeFor(nsIContent* aParentContent,
 void
 nsFrameManagerBase::UndisplayedMap::RemoveNodesFor(nsIContent* aParentContent)
 {
-  PLHashEntry** entry = GetEntryFor(aParentContent);
+  PLHashEntry** entry = GetEntryFor(&aParentContent);
   NS_ASSERTION(entry, "content not in map");
   if (*entry) {
     UndisplayedNode*  node = (UndisplayedNode*)((*entry)->value);
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 54891c81339..d3d0a5bc70a 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -109,7 +109,7 @@ load 382199-1.html
 load 382208-1.xhtml
 load 382262-1.html
 load 382396-1.xhtml
-load 382745-1.xhtml
+asserts(1) load 382745-1.xhtml
 load 383089-1.html
 load 385265-1.xhtml
 load 385295-1.xhtml
diff --git a/layout/generic/nsFlexContainerFrame.cpp b/layout/generic/nsFlexContainerFrame.cpp
index a00f975d536..d45b8e1f9c5 100644
--- a/layout/generic/nsFlexContainerFrame.cpp
+++ b/layout/generic/nsFlexContainerFrame.cpp
@@ -1570,7 +1570,7 @@ MainAxisPositionTracker::
         }
         break;
       default:
-        MOZ_NOT_REACHED("Unexpected justify-content value");
+        MOZ_CRASH("Unexpected justify-content value");
     }
   }
 
@@ -1900,9 +1900,7 @@ FlexboxAxisTracker::FlexboxAxisTracker(nsFlexContainerFrame* aFlexContainerFrame
       mMainAxis = GetReverseAxis(blockDimension);
       break;
     default:
-      MOZ_NOT_REACHED("Unexpected computed value for 'flex-flow' property");
-      mMainAxis = inlineDimension;
-      break;
+      MOZ_CRASH("Unexpected computed value for 'flex-flow' property");
   }
 
   // Determine cross axis:
diff --git a/layout/inspector/src/Makefile.in b/layout/inspector/src/Makefile.in
index 898ce9b9f85..6307f836ca1 100644
--- a/layout/inspector/src/Makefile.in
+++ b/layout/inspector/src/Makefile.in
@@ -17,6 +17,7 @@ FORCE_STATIC_LIB = 1
 
 LOCAL_INCLUDES	+= \
 		-I$(srcdir)/../../style \
+		-I$(topsrcdir)/content/base/src \
 		-I$(topsrcdir)/content/xbl/src \
 		$(NULL)
 
diff --git a/layout/inspector/src/inDOMUtils.cpp b/layout/inspector/src/inDOMUtils.cpp
index a57407a3a52..9e5dc000ddf 100644
--- a/layout/inspector/src/inDOMUtils.cpp
+++ b/layout/inspector/src/inDOMUtils.cpp
@@ -22,10 +22,12 @@
 #include "nsXBLPrototypeBinding.h"
 #include "nsIMutableArray.h"
 #include "nsBindingManager.h"
+#include "ChildIterator.h"
 #include "nsComputedDOMStyle.h"
 #include "nsEventStateManager.h"
 #include "nsIAtom.h"
 #include "nsRange.h"
+#include "nsContentList.h"
 #include "mozilla/dom/Element.h"
 #include "nsCSSStyleSheet.h"
 #include "nsRuleWalker.h"
diff --git a/layout/inspector/src/inDeepTreeWalker.cpp b/layout/inspector/src/inDeepTreeWalker.cpp
index 103056d26fa..a1265f27376 100644
--- a/layout/inspector/src/inDeepTreeWalker.cpp
+++ b/layout/inspector/src/inDeepTreeWalker.cpp
@@ -14,7 +14,9 @@
 #include "nsServiceManagerUtils.h"
 #include "inIDOMUtils.h"
 #include "nsIContent.h"
-#include "nsBindingManager.h"
+#include "nsContentList.h"
+#include "ChildIterator.h"
+#include "mozilla/dom/Element.h"
 
 /*****************************************************************************
  * This implementation does not currently operaate according to the W3C spec.
diff --git a/layout/reftests/dom/reftest.list b/layout/reftests/dom/reftest.list
index 6a8c8c2e5bb..859c2a8f879 100644
--- a/layout/reftests/dom/reftest.list
+++ b/layout/reftests/dom/reftest.list
@@ -48,3 +48,5 @@ skip-if(B2G) == multipleinsertionpoints-insertmultiple.xhtml multipleinsertionpo
 == multipleappendwithxul.xhtml multipleappendwithxul-ref.xhtml
 == multipleappendwithinput.xhtml multipleappendwithinput-ref.xhtml
 == multipleappendwitheditable.xhtml multipleappendwitheditable-ref.xhtml
+
+skip-if(B2G) == xbl-children-1.xhtml xbl-children-1-ref.xhtml
diff --git a/layout/reftests/dom/xbl-children-1-ref.xhtml b/layout/reftests/dom/xbl-children-1-ref.xhtml
new file mode 100644
index 00000000000..db526e90142
--- /dev/null
+++ b/layout/reftests/dom/xbl-children-1-ref.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <style>
+      #result {
+        color: green;
+        text-decoration: underline;
+        text-transform: lowercase;
+        background: yellow;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="result">text</div>
+  </body>
+</html>
+
diff --git a/layout/reftests/dom/xbl-children-1.xhtml b/layout/reftests/dom/xbl-children-1.xhtml
new file mode 100644
index 00000000000..6d065b61a77
--- /dev/null
+++ b/layout/reftests/dom/xbl-children-1.xhtml
@@ -0,0 +1,39 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"
+          xmlns:xhtml="http://www.w3.org/1999/xhtml">
+  <binding id="a">
+    <content>
+      <xhtml:div class="aparent">
+        <xhtml:div class="a">
+          <children>
+            <xhtml:div class="b">
+              TEXT
+            </xhtml:div>
+          </children>
+        </xhtml:div>
+      </xhtml:div>
+    </content>
+  </binding>
+</bindings>
+
+<style>
+
+  @namespace xbl "http://www.mozilla.org/xbl";
+  .a > .b { color: green; }
+  .a > xbl|children > .b { text-decoration: underline; }
+  .a .b { text-transform: lowercase; }
+  .aparent > * > .b { background: yellow; }
+
+  /* Inverse cases. */
+  .a > * > xbl|children > .b { color: red !important; }
+
+</style>
+
+</head>
+
+<body>
+<div style="-moz-binding: url(#a);" />
+</body>
+</html>
diff --git a/layout/style/nsCSSPropList.h b/layout/style/nsCSSPropList.h
index 4a89475a7c2..836f14fa5b9 100644
--- a/layout/style/nsCSSPropList.h
+++ b/layout/style/nsCSSPropList.h
@@ -3615,6 +3615,16 @@ CSS_PROP_TABLE(
     nullptr,
     CSS_PROP_NO_OFFSET,
     eStyleAnimType_None)
+CSS_PROP_FONT(
+    -x-text-zoom,
+    _x_text_zoom,
+    TextZoom,
+    CSS_PROPERTY_PARSE_INACCESSIBLE,
+    "",
+    0,
+    nullptr,
+    CSS_PROP_NO_OFFSET,
+    eStyleAnimType_None)
 #endif /* !defined(CSS_PROP_STUB_NOT_CSS) */
 #endif /* !defined(CSS_PROP_EXCLUDE_INTERNAL) */
 
diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index 000179668f1..85a6ca0156b 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -61,6 +61,7 @@
 #include "mozilla/LookAndFeel.h"
 #include "mozilla/Likely.h"
 #include "mozilla/Util.h"
+#include "nsXBLChildrenElement.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -2286,6 +2287,27 @@ static bool SelectorMatchesTree(Element* aPrevElement,
           // traverse further up the tree.
           aTreeMatchContext.PopStyleScopeForSelectorMatching(element);
         }
+
+        // Compatibility hack: First try matching this selector as though the
+        // <xbl:children> element wasn't in the tree to allow old selectors
+        // were written before <xbl:children> participated in CSS selector
+        // matching to work.
+        if (selector->mOperator == '>' &&
+            element->NodeInfo()->Equals(nsGkAtoms::children,
+                                        kNameSpaceID_XBL)) {
+          Element* styleScope = aTreeMatchContext.mCurrentStyleScope;
+          if (SelectorMatchesTree(element, selector, aTreeMatchContext,
+                                  aLookForRelevantLink)) {
+            // It matched, don't try matching on the <xbl:children> element at
+            // all.
+            return true;
+          }
+          // We want to reset mCurrentStyleScope on aTreeMatchContext
+          // back to its state before the SelectorMatchesTree call, in
+          // case that call happens to traverse past the style scope element
+          // and sets it to null.
+          aTreeMatchContext.mCurrentStyleScope = styleScope;
+        }
       }
     }
     if (!element) {
@@ -3393,6 +3415,7 @@ TreeMatchContext::InitAncestors(Element *aElement)
       if (!parent->IsElement()) {
         break;
       }
+
       cur = parent->AsElement();
     } while (true);
 
diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
index eb1dd0f19d1..f466d98aeed 100644
--- a/layout/style/nsComputedDOMStyle.cpp
+++ b/layout/style/nsComputedDOMStyle.cpp
@@ -3819,7 +3819,10 @@ nsComputedDOMStyle::GetLineHeightCoord(nscoord& aCoord)
   // font->mSize as the font size.  Adjust for that.  Also adjust for
   // the text zoom, if any.
   const nsStyleFont* font = StyleFont();
-  float fCoord = float(aCoord) / mPresShell->GetPresContext()->TextZoom();
+  float fCoord = float(aCoord);
+  if (font->mAllowZoom) {
+    fCoord /= mPresShell->GetPresContext()->TextZoom();
+  }
   if (font->mFont.size != font->mSize) {
     fCoord = fCoord * (float(font->mSize) / float(font->mFont.size));
   }
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index f01b6a2e486..36c176b1884 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -2547,8 +2547,10 @@ ComputeScriptLevelSize(const nsStyleFont* aFont, const nsStyleFont* aParentFont,
   }
 
   // Compute actual value of minScriptSize
-  nscoord minScriptSize =
-    nsStyleFont::ZoomText(aPresContext, aParentFont->mScriptMinSize);
+  nscoord minScriptSize = aParentFont->mScriptMinSize;
+  if (aFont->mAllowZoom) {
+    minScriptSize = nsStyleFont::ZoomText(aPresContext, minScriptSize);
+  }
 
   double scriptLevelScale =
     pow(aParentFont->mScriptSizeMultiplier, scriptLevelChange);
@@ -2874,7 +2876,7 @@ struct SetFontSizeCalcOps : public css::BasicCoordCalcOps,
                             mParentFont,
                             nullptr, mPresContext, mAtRoot,
                             true, mCanStoreInRuleTree);
-      if (!aValue.IsRelativeLengthUnit()) {
+      if (!aValue.IsRelativeLengthUnit() && mParentFont->mAllowZoom) {
         size = nsStyleFont::ZoomText(mPresContext, size);
       }
     }
@@ -2907,14 +2909,16 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
                         bool aAtRoot,
                         bool& aCanStoreInRuleTree)
 {
-  bool zoom = false;
+  // If false, means that *aSize has not been zoomed.  If true, means that
+  // *aSize has been zoomed iff aParentFont->mAllowZoom is true.
+  bool sizeIsZoomedAccordingToParent = false;
+
   int32_t baseSize = (int32_t) aPresContext->
     GetDefaultFont(aFont->mGenericID, aFont->mLanguage)->size;
   const nsCSSValue* sizeValue = aRuleData->ValueForFontSize();
   if (eCSSUnit_Enumerated == sizeValue->GetUnit()) {
     int32_t value = sizeValue->GetIntValue();
 
-    zoom = true;
     if ((NS_STYLE_FONT_SIZE_XXSMALL <= value) &&
         (value <= NS_STYLE_FONT_SIZE_XXLARGE)) {
       *aSize = CalcFontPointSize(value, baseSize,
@@ -2933,8 +2937,10 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
       // Note that relative units here use the parent's size unadjusted
       // for scriptlevel changes. A scriptlevel change between us and the parent
       // is simply ignored.
-      nscoord parentSize =
-        nsStyleFont::UnZoomText(aPresContext, aParentSize);
+      nscoord parentSize = aParentSize;
+      if (aParentFont->mAllowZoom) {
+        parentSize = nsStyleFont::UnZoomText(aPresContext, parentSize);
+      }
 
       if (NS_STYLE_FONT_SIZE_LARGER == value) {
         *aSize = FindNextLargerFontSize(parentSize,
@@ -2958,7 +2964,8 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
            sizeValue->GetUnit() == eCSSUnit_Percent ||
            sizeValue->IsCalcUnit()) {
     SetFontSizeCalcOps ops(aParentSize, aParentFont,
-                           aPresContext, aAtRoot, aCanStoreInRuleTree);
+                           aPresContext, aAtRoot,
+                           aCanStoreInRuleTree);
     *aSize = css::ComputeCalc(*sizeValue, ops);
     if (*aSize < 0) {
       NS_ABORT_IF_FALSE(sizeValue->IsCalcUnit(),
@@ -2966,13 +2973,13 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
                         "by parser");
       *aSize = 0;
     }
-    // Zoom is handled inside the calc ops when needed.
-    zoom = false;
+    // The calc ops will always zoom its result according to the value
+    // of aParentFont->mAllowZoom.
+    sizeIsZoomedAccordingToParent = true;
   }
   else if (eCSSUnit_System_Font == sizeValue->GetUnit()) {
     // this becomes our cascading size
     *aSize = aSystemFont.size;
-    zoom = true;
   }
   else if (eCSSUnit_Inherit == sizeValue->GetUnit()) {
     aCanStoreInRuleTree = false;
@@ -2980,13 +2987,12 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
     // to inherit and we don't want explicit "inherit" to differ from the
     // default.
     *aSize = aScriptLevelAdjustedParentSize;
-    zoom = false;
+    sizeIsZoomedAccordingToParent = true;
   }
   else if (eCSSUnit_Initial == sizeValue->GetUnit()) {
     // The initial value is 'medium', which has magical sizing based on
     // the generic font family, so do that here too.
     *aSize = baseSize;
-    zoom = true;
   } else {
     NS_ASSERTION(eCSSUnit_Null == sizeValue->GetUnit(),
                  "What kind of font-size value is this?");
@@ -3000,13 +3006,20 @@ nsRuleNode::SetFontSize(nsPresContext* aPresContext,
       // store the data in the rule tree.
       aCanStoreInRuleTree = false;
       *aSize = aScriptLevelAdjustedParentSize;
+      sizeIsZoomedAccordingToParent = true;
+    } else {
+      return;
     }
   }
 
   // We want to zoom the cascaded size so that em-based measurements,
   // line-heights, etc., work.
-  if (zoom) {
+  bool currentlyZoomed = sizeIsZoomedAccordingToParent &&
+                         aParentFont->mAllowZoom;
+  if (!currentlyZoomed && aFont->mAllowZoom) {
     *aSize = nsStyleFont::ZoomText(aPresContext, *aSize);
+  } else if (currentlyZoomed && !aFont->mAllowZoom) {
+    *aSize = nsStyleFont::UnZoomText(aPresContext, *aSize);
   }
 }
 
@@ -3027,6 +3040,21 @@ nsRuleNode::SetFont(nsPresContext* aPresContext, nsStyleContext* aContext,
 {
   bool atRoot = !aContext->GetParent();
 
+  // -x-text-zoom: none, inherit, initial
+  bool allowZoom;
+  const nsCSSValue* textZoomValue = aRuleData->ValueForTextZoom();
+  if (eCSSUnit_Inherit == textZoomValue->GetUnit()) {
+    allowZoom = aParentFont->mAllowZoom;
+  } else if (eCSSUnit_None == textZoomValue->GetUnit()) {
+    allowZoom = false;
+  } else {
+    MOZ_ASSERT(eCSSUnit_Initial == textZoomValue->GetUnit() ||
+               eCSSUnit_Null == textZoomValue->GetUnit(),
+               "unexpected unit");
+    allowZoom = true;
+  }
+  aFont->EnableZoom(aPresContext, allowZoom);
+
   // mLanguage must be set before before any of the CalcLengthWith calls
   // (direct calls or calls via SetFontSize) for the cases where |aParentFont|
   // is the same as |aFont|.
diff --git a/layout/style/nsStyleSet.cpp b/layout/style/nsStyleSet.cpp
index 1bc8da76bab..c4a124cebc6 100644
--- a/layout/style/nsStyleSet.cpp
+++ b/layout/style/nsStyleSet.cpp
@@ -99,6 +99,28 @@ nsInitialStyleRule::List(FILE* out, int32_t aIndent) const
 }
 #endif
 
+NS_IMPL_ISUPPORTS1(nsDisableTextZoomStyleRule, nsIStyleRule)
+
+/* virtual */ void
+nsDisableTextZoomStyleRule::MapRuleInfoInto(nsRuleData* aRuleData)
+{
+  if (!(aRuleData->mSIDs & NS_STYLE_INHERIT_BIT(Font)))
+    return;
+
+  nsCSSValue* value = aRuleData->ValueForTextZoom();
+  if (value->GetUnit() == eCSSUnit_Null)
+    value->SetNoneValue();
+}
+
+#ifdef DEBUG
+/* virtual */ void
+nsDisableTextZoomStyleRule::List(FILE* out, int32_t aIndent) const
+{
+  for (int32_t index = aIndent; --index >= 0; ) fputs("  ", out);
+  fputs("[disable text zoom style rule] {}\n", out);
+}
+#endif
+
 static const nsStyleSet::sheetType gCSSSheetTypes[] = {
   nsStyleSet::eAgentSheet,
   nsStyleSet::eUserSheet,
@@ -148,6 +170,7 @@ nsStyleSet::Init(nsPresContext *aPresContext)
   mFirstLineRule = new nsEmptyStyleRule;
   mFirstLetterRule = new nsEmptyStyleRule;
   mPlaceholderRule = new nsEmptyStyleRule;
+  mDisableTextZoomStyleRule = new nsDisableTextZoomStyleRule;
 
   mRuleTree = nsRuleNode::CreateRootNode(aPresContext);
 
@@ -1152,6 +1175,7 @@ nsStyleSet::ResolveStyleFor(Element* aElement,
   aTreeMatchContext.ResetForUnvisitedMatching();
   ElementRuleProcessorData data(PresContext(), aElement, &ruleWalker,
                                 aTreeMatchContext);
+  WalkDisableTextZoomRule(aElement, &ruleWalker);
   FileRules(EnumRulesMatching<ElementRuleProcessorData>, &data, aElement,
             &ruleWalker);
 
@@ -1288,6 +1312,14 @@ nsStyleSet::WalkRestrictionRule(nsCSSPseudoElements::Type aPseudoType,
     aRuleWalker->Forward(mPlaceholderRule);
 }
 
+void
+nsStyleSet::WalkDisableTextZoomRule(Element* aElement, nsRuleWalker* aRuleWalker)
+{
+  aRuleWalker->SetLevel(eAgentSheet, false, false);
+  if (aElement->IsSVG(nsGkAtoms::text))
+    aRuleWalker->Forward(mDisableTextZoomStyleRule);
+}
+
 already_AddRefed<nsStyleContext>
 nsStyleSet::ResolvePseudoElementStyle(Element* aParentElement,
                                       nsCSSPseudoElements::Type aType,
diff --git a/layout/style/nsStyleSet.h b/layout/style/nsStyleSet.h
index e7df877ebf0..441bc6ca252 100644
--- a/layout/style/nsStyleSet.h
+++ b/layout/style/nsStyleSet.h
@@ -53,6 +53,15 @@ class nsInitialStyleRule MOZ_FINAL : public nsIStyleRule
 #endif
 };
 
+class nsDisableTextZoomStyleRule MOZ_FINAL : public nsIStyleRule
+{
+  NS_DECL_ISUPPORTS
+  virtual void MapRuleInfoInto(nsRuleData* aRuleData) MOZ_OVERRIDE;
+#ifdef DEBUG
+  virtual void List(FILE* out = stdout, int32_t aIndent = 0) const MOZ_OVERRIDE;
+#endif
+};
+
 // The style set object is created by the document viewer and ownership is
 // then handed off to the PresShell.  Only the PresShell should delete a
 // style set.
@@ -336,6 +345,9 @@ class nsStyleSet
   void WalkRestrictionRule(nsCSSPseudoElements::Type aPseudoType,
                            nsRuleWalker* aRuleWalker);
 
+  void WalkDisableTextZoomRule(mozilla::dom::Element* aElement,
+                               nsRuleWalker* aRuleWalker);
+
 #ifdef DEBUG
   // Just like AddImportantRules except it doesn't actually add anything; it
   // just asserts that there are no important rules between aCurrLevelNode and
@@ -435,6 +447,10 @@ class nsStyleSet
   // determining when context-sensitive values are in use.
   nsRefPtr<nsInitialStyleRule> mInitialStyleRule;
 
+  // Style rule that sets the internal -x-text-zoom property on
+  // <svg:text> elements to disable the effect of text zooming.
+  nsRefPtr<nsDisableTextZoomStyleRule> mDisableTextZoomStyleRule;
+
   // Old rule trees, which should only be non-empty between
   // BeginReconstruct and EndReconstruct, but in case of bugs that cause
   // style contexts to exist too long, may last longer.
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 7ee64724055..e24ad7edb6b 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -100,6 +100,7 @@ nsStyleFont::nsStyleFont(const nsStyleFont& aSrc)
   , mGenericID(aSrc.mGenericID)
   , mScriptLevel(aSrc.mScriptLevel)
   , mExplicitLanguage(aSrc.mExplicitLanguage)
+  , mAllowZoom(aSrc.mAllowZoom)
   , mScriptUnconstrainedSize(aSrc.mScriptUnconstrainedSize)
   , mScriptMinSize(aSrc.mScriptMinSize)
   , mScriptSizeMultiplier(aSrc.mScriptSizeMultiplier)
@@ -128,6 +129,7 @@ nsStyleFont::Init(nsPresContext* aPresContext)
       NS_POINTS_TO_TWIPS(NS_MATHML_DEFAULT_SCRIPT_MIN_SIZE_PT));
   mScriptLevel = 0;
   mScriptSizeMultiplier = NS_MATHML_DEFAULT_SCRIPT_SIZE_MULTIPLIER;
+  mAllowZoom = true;
 
   nsAutoString language;
   aPresContext->Document()->GetContentLanguage(language);
@@ -161,8 +163,30 @@ nsStyleFont::Destroy(nsPresContext* aContext) {
   aContext->FreeToShell(sizeof(nsStyleFont), this);
 }
 
+void
+nsStyleFont::EnableZoom(nsPresContext* aContext, bool aEnable)
+{
+  if (mAllowZoom == aEnable) {
+    return;
+  }
+  mAllowZoom = aEnable;
+  if (mAllowZoom) {
+    mSize = nsStyleFont::ZoomText(aContext, mSize);
+    mFont.size = nsStyleFont::ZoomText(aContext, mFont.size);
+    mScriptUnconstrainedSize =
+      nsStyleFont::ZoomText(aContext, mScriptUnconstrainedSize);
+  } else {
+    mSize = nsStyleFont::UnZoomText(aContext, mSize);
+    mFont.size = nsStyleFont::UnZoomText(aContext, mFont.size);
+    mScriptUnconstrainedSize =
+      nsStyleFont::UnZoomText(aContext, mScriptUnconstrainedSize);
+  }
+}
+
 nsChangeHint nsStyleFont::CalcDifference(const nsStyleFont& aOther) const
 {
+  MOZ_ASSERT(mAllowZoom == aOther.mAllowZoom,
+             "expected mAllowZoom to be the same on both nsStyleFonts");
   if (mSize != aOther.mSize ||
       mLanguage != aOther.mLanguage ||
       mExplicitLanguage != aOther.mExplicitLanguage) {
diff --git a/layout/style/nsStyleStruct.h b/layout/style/nsStyleStruct.h
index d3d1fe349fc..353f5646a48 100644
--- a/layout/style/nsStyleStruct.h
+++ b/layout/style/nsStyleStruct.h
@@ -86,6 +86,8 @@ public:
   void* operator new(size_t sz, nsPresContext* aContext) CPP_THROW_NEW;
   void Destroy(nsPresContext* aContext);
 
+  void EnableZoom(nsPresContext* aContext, bool aEnable);
+
   nsFont  mFont;        // [inherited]
   nscoord mSize;        // [inherited] Our "computed size". Can be different
                         // from mFont.size which is our "actual size" and is
@@ -102,6 +104,10 @@ public:
   // was mLanguage set based on a lang attribute in the document?
   bool mExplicitLanguage;        // [inherited]
 
+  // should calls to ZoomText() and UnZoomText() be made to the font
+  // size on this nsStyleFont?
+  bool mAllowZoom;               // [inherited]
+
   // The value mSize would have had if scriptminsize had never been applied
   nscoord mScriptUnconstrainedSize;
   nscoord mScriptMinSize;        // [inherited] length
diff --git a/layout/style/test/ListCSSProperties.cpp b/layout/style/test/ListCSSProperties.cpp
index 94aefea3b49..d0b3c130b6f 100644
--- a/layout/style/test/ListCSSProperties.cpp
+++ b/layout/style/test/ListCSSProperties.cpp
@@ -103,6 +103,7 @@ const char *gInaccessibleProperties[] = {
     "-x-lang",
     "-x-span",
     "-x-system-font",
+    "-x-text-zoom",
     "border-end-color-value",
     "border-end-style-value",
     "border-end-width-value",
diff --git a/layout/svg/nsSVGGlyphFrame.cpp b/layout/svg/nsSVGGlyphFrame.cpp
index bf93cf86557..b9094cf1d89 100644
--- a/layout/svg/nsSVGGlyphFrame.cpp
+++ b/layout/svg/nsSVGGlyphFrame.cpp
@@ -1626,9 +1626,7 @@ nsSVGGlyphFrame::EnsureTextRun(float *aDrawScale, float *aMetricsScale,
   // fonts in SVG to respond to the browser's "TextZoom"
   // (Ctrl++,Ctrl+-)
   nsPresContext *presContext = PresContext();
-  float textZoom = presContext->TextZoom();
-  double size =
-    presContext->AppUnitsToFloatCSSPixels(fontData->mSize) / textZoom;
+  double size = presContext->AppUnitsToFloatCSSPixels(fontData->mSize);
 
   double textRunSize;
   if (mTextRun) {
diff --git a/layout/svg/nsSVGTextFrame2.cpp b/layout/svg/nsSVGTextFrame2.cpp
index c1ca2702c71..4bd25539383 100644
--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@@ -4980,8 +4980,7 @@ nsSVGTextFrame2::UpdateFontSizeScaleFactor()
     }
   }
 
-  float textZoom = presContext->TextZoom();
-  double minSize = presContext->AppUnitsToFloatCSSPixels(min) / textZoom;
+  double minSize = presContext->AppUnitsToFloatCSSPixels(min);
 
   if (geometricPrecision) {
     // We want to ensure minSize is scaled to PRECISE_SIZE.
@@ -4989,7 +4988,7 @@ nsSVGTextFrame2::UpdateFontSizeScaleFactor()
     return;
   }
 
-  double maxSize = presContext->AppUnitsToFloatCSSPixels(max) / textZoom;
+  double maxSize = presContext->AppUnitsToFloatCSSPixels(max);
 
   // The context scale is the ratio of the length of the transformed
   // diagonal vector (1,1) to the length of the untransformed diagonal
diff --git a/layout/tools/reftest/remotereftest.py b/layout/tools/reftest/remotereftest.py
index 1671a91a256..85afbbf7f71 100644
--- a/layout/tools/reftest/remotereftest.py
+++ b/layout/tools/reftest/remotereftest.py
@@ -182,7 +182,7 @@ class ReftestServer:
         self.httpPort = options.httpPort
         self.scriptDir = scriptDir
         self.pidFile = options.pidFile
-        self._httpdPath = options.httpdPath
+        self._httpdPath = os.path.abspath(options.httpdPath)
         self.shutdownURL = "http://%(server)s:%(port)s/server/shutdown" % { "server" : self.webServer, "port" : self.httpPort }
 
     def start(self):
diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
index bb1452de1ad..8c4bf2e05da 100644
--- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -32,7 +32,7 @@
 #include "nsLayoutUtils.h"
 #include "nsPIListBoxObject.h"
 #include "nsContentUtils.h"
-#include "nsChildIterator.h"
+#include "ChildIterator.h"
 #include "nsRenderingContext.h"
 #include <algorithm>
 
@@ -40,6 +40,8 @@
 #include "nsAccessibilityService.h"
 #endif
 
+using namespace mozilla::dom;
+
 /////////////// nsListScrollSmoother //////////////////
 
 /* A mediator used to smooth out scrolling. It works by seeing if 
@@ -535,11 +537,8 @@ nsListBoxBodyFrame::GetIndexOfItem(nsIDOMElement* aItem, int32_t* _retval)
     *_retval = 0;
     nsCOMPtr<nsIContent> itemContent(do_QueryInterface(aItem));
 
-    ChildIterator iter, last;
-    for (ChildIterator::Init(mContent, &iter, &last);
-         iter != last;
-         ++iter) {
-      nsIContent *child = (*iter);
+    FlattenedChildIterator iter(mContent);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
       // we hit a list row, count it
       if (child->Tag() == nsGkAtoms::listitem) {
         // is this it?
@@ -562,13 +561,10 @@ nsListBoxBodyFrame::GetItemAtIndex(int32_t aIndex, nsIDOMElement** aItem)
   *aItem = nullptr;
   if (aIndex < 0)
     return NS_OK;
-  
-  int32_t itemCount = 0;
-  ChildIterator iter, last;
-  for (ChildIterator::Init(mContent, &iter, &last);
-       iter != last;
-       ++iter) {
-    nsIContent *child = (*iter);
+
+  PRInt32 itemCount = 0;
+  FlattenedChildIterator iter(mContent);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
     // we hit a list row, check if it is the one we are looking for
     if (child->Tag() == nsGkAtoms::listitem) {
       // is this it?
@@ -670,14 +666,8 @@ nsListBoxBodyFrame::ComputeIntrinsicWidth(nsBoxLayoutState& aBoxLayoutState)
     if (styleContext->StyleMargin()->GetMargin(margin))
       width += margin.LeftRight();
 
-
-    ChildIterator iter, last;
-    uint32_t i = 0;
-    for (ChildIterator::Init(mContent, &iter, &last);
-         iter != last && i < 100;
-         ++iter, ++i) {
-      nsIContent *child = (*iter);
-
+    FlattenedChildIterator iter(mContent);
+    for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
       if (child->Tag() == nsGkAtoms::listitem) {
         nsRenderingContext* rendContext = aBoxLayoutState.GetRenderingContext();
         if (rendContext) {
@@ -714,13 +704,11 @@ void
 nsListBoxBodyFrame::ComputeTotalRowCount()
 {
   mRowCount = 0;
-
-  ChildIterator iter, last;
-  for (ChildIterator::Init(mContent, &iter, &last);
-       iter != last;
-       ++iter) {
-    if ((*iter)->Tag() == nsGkAtoms::listitem)
+  FlattenedChildIterator iter(mContent);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+    if (child->Tag() == nsGkAtoms::listitem) {
       ++mRowCount;
+    }
   }
 }
 
@@ -1377,16 +1365,17 @@ nsListBoxBodyFrame::OnContentRemoved(nsPresContext* aPresContext,
       // of the scrollbar is to stay locked to the bottom.  Since we are
       // removing visible content, the first visible row will have to move
       // down by one, and we will have to insert a new frame at the top.
-      
+
       // if the last content node has a frame, we are scrolled to the bottom
-      ChildIterator iter, last;
-      ChildIterator::Init(mContent, &iter, &last);
-      if (iter != last) {
-        iter = last;
-        --iter;
-        nsIContent *lastChild = *iter;
+      nsIContent* lastChild = nullptr;
+      FlattenedChildIterator iter(mContent);
+      for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+        lastChild = child;
+      }
+
+      if (lastChild) {
         nsIFrame* lastChildFrame = lastChild->GetPrimaryFrame();
-      
+
         if (lastChildFrame) {
           mTopFrame = nullptr;
           mRowsToPrepend = 1;
@@ -1419,15 +1408,12 @@ nsListBoxBodyFrame::GetListItemContentAt(int32_t aIndex, nsIContent** aContent)
   *aContent = nullptr;
 
   int32_t itemsFound = 0;
-  ChildIterator iter, last;
-  for (ChildIterator::Init(mContent, &iter, &last);
-       iter != last;
-       ++iter) {
-    nsIContent *kid = (*iter);
-    if (kid->Tag() == nsGkAtoms::listitem) {
+  FlattenedChildIterator iter(mContent);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+    if (child->Tag() == nsGkAtoms::listitem) {
       ++itemsFound;
       if (itemsFound-1 == aIndex) {
-        *aContent = kid;
+        *aContent = child;
         NS_IF_ADDREF(*aContent);
         return;
       }
@@ -1441,21 +1427,17 @@ nsListBoxBodyFrame::GetListItemNextSibling(nsIContent* aListItem, nsIContent** a
   *aContent = nullptr;
   aSiblingIndex = -1;
   nsIContent *prevKid = nullptr;
-  ChildIterator iter, last;
-  for (ChildIterator::Init(mContent, &iter, &last);
-       iter != last;
-       ++iter) {
-    nsIContent *kid = (*iter);
-
-    if (kid->Tag() == nsGkAtoms::listitem) {
+  FlattenedChildIterator iter(mContent);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+    if (child->Tag() == nsGkAtoms::listitem) {
       ++aSiblingIndex;
       if (prevKid == aListItem) {
-        *aContent = kid;
+        *aContent = child;
         NS_IF_ADDREF(*aContent);
         return;
       }
     }
-    prevKid = kid;
+    prevKid = child;
   }
 
   aSiblingIndex = -1; // no match, so there is no next sibling
diff --git a/layout/xul/base/src/nsListBoxObject.cpp b/layout/xul/base/src/nsListBoxObject.cpp
index da6616afdfa..3460f9485e0 100644
--- a/layout/xul/base/src/nsListBoxObject.cpp
+++ b/layout/xul/base/src/nsListBoxObject.cpp
@@ -13,6 +13,7 @@
 #include "nsGkAtoms.h"
 #include "nsIScrollableFrame.h"
 #include "nsListBoxBodyFrame.h"
+#include "ChildIterator.h"
 
 class nsListBoxObject : public nsPIListBoxObject, public nsBoxObject
 {
@@ -119,30 +120,22 @@ nsListBoxObject::GetIndexOfItem(nsIDOMElement* aElement, int32_t *aResult)
 
 //////////////////////
 
-static void
-FindBodyContent(nsIContent* aParent, nsIContent** aResult)
+static nsIContent*
+FindBodyContent(nsIContent* aParent)
 {
   if (aParent->Tag() == nsGkAtoms::listboxbody) {
-    *aResult = aParent;
-    NS_IF_ADDREF(*aResult);
+    return aParent;
   }
-  else {
-    nsCOMPtr<nsIDOMNodeList> kids;
-    aParent->OwnerDoc()->BindingManager()->GetXBLChildNodesFor(aParent, getter_AddRefs(kids));
-    if (!kids) return;
 
-    uint32_t i;
-    kids->GetLength(&i);
-    // start from the end, cuz we're smart and we know the listboxbody is probably at the end
-    while (i > 0) {
-      nsCOMPtr<nsIDOMNode> childNode;
-      kids->Item(--i, getter_AddRefs(childNode));
-      nsCOMPtr<nsIContent> childContent(do_QueryInterface(childNode));
-      FindBodyContent(childContent, aResult);
-      if (*aResult)
-        break;
+  mozilla::dom::FlattenedChildIterator iter(aParent);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
+    nsIContent* result = FindBodyContent(child);
+    if (result) {
+      return result;
     }
   }
+
+  return nullptr;
 }
 
 nsListBoxBodyFrame*
@@ -164,8 +157,7 @@ nsListBoxObject::GetListBoxBody(bool aFlush)
     return nullptr;
 
   // Iterate over our content model children looking for the body.
-  nsCOMPtr<nsIContent> content;
-  FindBodyContent(frame->GetContent(), getter_AddRefs(content));
+  nsCOMPtr<nsIContent> content = FindBodyContent(frame->GetContent());
 
   if (!content)
     return nullptr;
diff --git a/layout/xul/base/src/nsMenuBarFrame.cpp b/layout/xul/base/src/nsMenuBarFrame.cpp
index f57ed5dc4ab..dfad8ccbb4d 100644
--- a/layout/xul/base/src/nsMenuBarFrame.cpp
+++ b/layout/xul/base/src/nsMenuBarFrame.cpp
@@ -170,7 +170,8 @@ GetInsertionPoint(nsIPresShell* aShell, nsIFrame* aFrame, nsIFrame* aChild,
   nsIContent* child = nullptr;
   if (aChild)
     child = aChild->GetContent();
-  aShell->FrameConstructor()->GetInsertionPoint(aFrame, child, aResult);
+  *aResult = aShell->FrameConstructor()->
+    GetInsertionPoint(aFrame->GetContent(), child);
 }
 
 nsMenuFrame*
diff --git a/layout/xul/base/src/nsMenuPopupFrame.cpp b/layout/xul/base/src/nsMenuPopupFrame.cpp
index 43a10df5b20..da1d27d05b1 100644
--- a/layout/xul/base/src/nsMenuPopupFrame.cpp
+++ b/layout/xul/base/src/nsMenuPopupFrame.cpp
@@ -1622,9 +1622,8 @@ nsMenuPopupFrame::FindMenuWithShortcut(nsIDOMKeyEvent* aKeyEvent, bool& doAction
   doAction = false;
 
   // Enumerate over our list of frames.
-  nsIFrame* immediateParent = nullptr;
-  PresContext()->PresShell()->
-    FrameConstructor()->GetInsertionPoint(this, nullptr, &immediateParent);
+  nsIFrame* immediateParent = PresContext()->PresShell()->
+    FrameConstructor()->GetInsertionPoint(GetContent(), nullptr);
   if (!immediateParent)
     immediateParent = this;
 
diff --git a/layout/xul/base/src/nsXULPopupManager.cpp b/layout/xul/base/src/nsXULPopupManager.cpp
index 9ff89fababa..7d0ca6a4dfd 100644
--- a/layout/xul/base/src/nsXULPopupManager.cpp
+++ b/layout/xul/base/src/nsXULPopupManager.cpp
@@ -1954,10 +1954,9 @@ nsXULPopupManager::GetNextMenuItem(nsIFrame* aParent,
                                    nsMenuFrame* aStart,
                                    bool aIsPopup)
 {
-  nsIFrame* immediateParent = nullptr;
   nsPresContext* presContext = aParent->PresContext();
-  presContext->PresShell()->
-    FrameConstructor()->GetInsertionPoint(aParent, nullptr, &immediateParent);
+  nsIFrame* immediateParent = presContext->PresShell()->
+    FrameConstructor()->GetInsertionPoint(aParent->GetContent(), nullptr);
   if (!immediateParent)
     immediateParent = aParent;
 
@@ -1996,10 +1995,9 @@ nsXULPopupManager::GetPreviousMenuItem(nsIFrame* aParent,
                                        nsMenuFrame* aStart,
                                        bool aIsPopup)
 {
-  nsIFrame* immediateParent = nullptr;
   nsPresContext* presContext = aParent->PresContext();
-  presContext->PresShell()->
-    FrameConstructor()->GetInsertionPoint(aParent, nullptr, &immediateParent);
+  nsIFrame* immediateParent = presContext->PresShell()->
+    FrameConstructor()->GetInsertionPoint(aParent->GetContent(), nullptr);
   if (!immediateParent)
     immediateParent = aParent;
 
diff --git a/layout/xul/tree/Makefile.in b/layout/xul/tree/Makefile.in
index 5033f0cd0de..629c90245c0 100644
--- a/layout/xul/tree/Makefile.in
+++ b/layout/xul/tree/Makefile.in
@@ -16,6 +16,7 @@ FAIL_ON_WARNINGS = 1
 LOCAL_INCLUDES	= \
 		-I$(srcdir) \
 		-I$(topsrcdir)/content/events/src \
+		-I$(topsrcdir)/content/base/src \
 		-I$(srcdir)/../base/src \
 		-I$(srcdir)/../../base \
 		-I$(srcdir)/../../generic \
diff --git a/layout/xul/tree/nsTreeBodyFrame.cpp b/layout/xul/tree/nsTreeBodyFrame.cpp
index 34dd5400f54..2dffcaafcec 100644
--- a/layout/xul/tree/nsTreeBodyFrame.cpp
+++ b/layout/xul/tree/nsTreeBodyFrame.cpp
@@ -45,7 +45,6 @@
 #include "nsBoxLayoutState.h"
 #include "nsTreeContentView.h"
 #include "nsTreeUtils.h"
-#include "nsChildIterator.h"
 #include "nsITheme.h"
 #include "imgIRequest.h"
 #include "imgIContainer.h"
diff --git a/layout/xul/tree/nsTreeBoxObject.cpp b/layout/xul/tree/nsTreeBoxObject.cpp
index e00c8a3e25f..fc452944510 100644
--- a/layout/xul/tree/nsTreeBoxObject.cpp
+++ b/layout/xul/tree/nsTreeBoxObject.cpp
@@ -9,7 +9,7 @@
 #include "nsIXULTemplateBuilder.h"
 #include "nsTreeContentView.h"
 #include "nsITreeSelection.h"
-#include "nsChildIterator.h"
+#include "ChildIterator.h"
 #include "nsContentUtils.h"
 #include "nsError.h"
 #include "nsTreeBodyFrame.h"
@@ -52,30 +52,26 @@ nsTreeBoxObject::~nsTreeBoxObject()
   /* destructor code */
 }
 
-
-static void FindBodyElement(nsIContent* aParent, nsIContent** aResult)
+static nsIContent* FindBodyElement(nsIContent* aParent)
 {
-  *aResult = nullptr;
-  ChildIterator iter, last;
-  for (ChildIterator::Init(aParent, &iter, &last); iter != last; ++iter) {
-    nsCOMPtr<nsIContent> content = *iter;
-
+  mozilla::dom::FlattenedChildIterator iter(aParent);
+  for (nsIContent* content = iter.GetNextChild(); content; content = iter.GetNextChild()) {
     nsINodeInfo *ni = content->NodeInfo();
     if (ni->Equals(nsGkAtoms::treechildren, kNameSpaceID_XUL)) {
-      *aResult = content;
-      NS_ADDREF(*aResult);
-      break;
+      return content;
     } else if (ni->Equals(nsGkAtoms::tree, kNameSpaceID_XUL)) {
       // There are nesting tree elements. Only the innermost should
       // find the treechilren.
-      break;
+      return nullptr;
     } else if (content->IsElement() &&
                !ni->Equals(nsGkAtoms::_template, kNameSpaceID_XUL)) {
-      FindBodyElement(content, aResult);
-      if (*aResult)
-        break;
+      nsIContent* result = FindBodyElement(content);
+      if (result)
+        return result;
     }
   }
+
+  return nullptr;
 }
 
 nsTreeBodyFrame*
@@ -106,8 +102,7 @@ nsTreeBoxObject::GetTreeBody(bool aFlushLayout)
   }
 
   // Iterate over our content model children looking for the body.
-  nsCOMPtr<nsIContent> content;
-  FindBodyElement(frame->GetContent(), getter_AddRefs(content));
+  nsCOMPtr<nsIContent> content = FindBodyElement(frame->GetContent());
   if (!content)
     return nullptr;
 
diff --git a/layout/xul/tree/nsTreeContentView.cpp b/layout/xul/tree/nsTreeContentView.cpp
index 6071bb2e74f..f3d6459e7cb 100644
--- a/layout/xul/tree/nsTreeContentView.cpp
+++ b/layout/xul/tree/nsTreeContentView.cpp
@@ -8,7 +8,7 @@
 #include "nsIBoxObject.h"
 #include "nsTreeUtils.h"
 #include "nsTreeContentView.h"
-#include "nsChildIterator.h"
+#include "ChildIterator.h"
 #include "nsDOMClassInfoID.h"
 #include "nsError.h"
 #include "nsEventStates.h"
@@ -1046,9 +1046,8 @@ nsTreeContentView::Serialize(nsIContent* aContent, int32_t aParentIndex,
   if (!aContent->IsXUL())
     return;
 
-  ChildIterator iter, last;
-  for (ChildIterator::Init(aContent, &iter, &last); iter != last; ++iter) {
-    nsIContent* content = *iter;
+  dom::FlattenedChildIterator iter(aContent);
+  for (nsIContent* content = iter.GetNextChild(); content; content = iter.GetNextChild()) {
     nsIAtom *tag = content->Tag();
     int32_t count = aRows.Length();
 
@@ -1367,10 +1366,8 @@ nsTreeContentView::GetCell(nsIContent* aContainer, nsITreeColumn* aCol)
   // index in a row. "ref" attribute has higher priority.
   nsIContent* result = nullptr;
   int32_t j = 0;
-  ChildIterator iter, last;
-  for (ChildIterator::Init(aContainer, &iter, &last); iter != last; ++iter) {
-    nsIContent* cell = *iter;
-
+  dom::FlattenedChildIterator iter(aContainer);
+  for (nsIContent* cell = iter.GetNextChild(); cell; cell = iter.GetNextChild()) {
     if (cell->Tag() == nsGkAtoms::treecell) {
       if (colAtom && cell->AttrValueIs(kNameSpaceID_None, nsGkAtoms::ref,
                                        colAtom, eCaseMatters)) {
diff --git a/layout/xul/tree/nsTreeUtils.cpp b/layout/xul/tree/nsTreeUtils.cpp
index f14b3c9734b..63936dc2803 100644
--- a/layout/xul/tree/nsTreeUtils.cpp
+++ b/layout/xul/tree/nsTreeUtils.cpp
@@ -5,13 +5,15 @@
 
 #include "nsReadableUtils.h"
 #include "nsTreeUtils.h"
-#include "nsChildIterator.h"
+#include "ChildIterator.h"
 #include "nsCRT.h"
 #include "nsIAtom.h"
 #include "nsINameSpaceManager.h"
 #include "nsGkAtoms.h"
 #include "nsINodeInfo.h"
 
+namespace dom = mozilla::dom;
+
 nsresult
 nsTreeUtils::TokenizeProperties(const nsAString& aProperties, AtomArray & aPropertiesArray)
 {
@@ -52,10 +54,8 @@ nsTreeUtils::TokenizeProperties(const nsAString& aProperties, AtomArray & aPrope
 nsIContent*
 nsTreeUtils::GetImmediateChild(nsIContent* aContainer, nsIAtom* aTag)
 {
-  ChildIterator iter, last;
-  for (ChildIterator::Init(aContainer, &iter, &last); iter != last; ++iter) {
-    nsIContent* child = *iter;
-
+  dom::FlattenedChildIterator iter(aContainer);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
     if (child->Tag() == aTag) {
       return child;
     }
@@ -67,9 +67,8 @@ nsTreeUtils::GetImmediateChild(nsIContent* aContainer, nsIAtom* aTag)
 nsIContent*
 nsTreeUtils::GetDescendantChild(nsIContent* aContainer, nsIAtom* aTag)
 {
-  ChildIterator iter, last;
-  for (ChildIterator::Init(aContainer, &iter, &last); iter != last; ++iter) {
-    nsIContent* child = *iter;
+  dom::FlattenedChildIterator iter(aContainer);
+  for (nsIContent* child = iter.GetNextChild(); child; child = iter.GetNextChild()) {
     if (child->Tag() == aTag) {
       return child;
     }
diff --git a/media/libvpx/moz.build b/media/libvpx/moz.build
index 96222817d06..3384c26d874 100644
--- a/media/libvpx/moz.build
+++ b/media/libvpx/moz.build
@@ -7,28 +7,28 @@
 MODULE = 'vpx'
 
 EXPORTS.vpx += [
-    'arm.h',
-    'mem.h',
-    'scale_mode.h',
-    'vp8.h',
-    'vp8cx.h',
-    'vp8dx.h',
-    'vp8e.h',
-    'vpx_codec.h',
-    'vpx_codec_impl_bottom.h',
-    'vpx_codec_impl_top.h',
-    'vpx_decoder.h',
-    'vpx_decoder_compat.h',
-    'vpx_encoder.h',
-    'vpx_image.h',
-    'vpx_integer.h',
-    'vpx_mem.h',
-    'vpx_mem_intrnl.h',
-    'vpx_timer.h',
-    'vpxscale.h',
-    'x86.h',
-    'yv12config.h',
-    'yv12extend.h',
+    'vpx/vp8.h',
+    'vpx/vp8cx.h',
+    'vpx/vp8dx.h',
+    'vpx/vp8e.h',
+    'vpx/vpx_codec.h',
+    'vpx/vpx_codec_impl_bottom.h',
+    'vpx/vpx_codec_impl_top.h',
+    'vpx/vpx_decoder.h',
+    'vpx/vpx_decoder_compat.h',
+    'vpx/vpx_encoder.h',
+    'vpx/vpx_image.h',
+    'vpx/vpx_integer.h',
+    'vpx_mem/include/vpx_mem_intrnl.h',
+    'vpx_mem/vpx_mem.h',
+    'vpx_ports/arm.h',
+    'vpx_ports/mem.h',
+    'vpx_ports/vpx_timer.h',
+    'vpx_ports/x86.h',
+    'vpx_scale/scale_mode.h',
+    'vpx_scale/vpxscale.h',
+    'vpx_scale/yv12config.h',
+    'vpx_scale/yv12extend.h',
 ]
 
 if CONFIG['VPX_NEED_OBJ_INT_EXTRACT']:
diff --git a/mfbt/Assertions.h b/mfbt/Assertions.h
index 5ead7f493ec..6b3bd9f3a6e 100644
--- a/mfbt/Assertions.h
+++ b/mfbt/Assertions.h
@@ -132,70 +132,13 @@
 extern "C" {
 #endif
 
-/*
- * MOZ_CRASH crashes the program, plain and simple, in a Breakpad-compatible
- * way, in both debug and release builds.
- *
- * MOZ_CRASH is a good solution for "handling" failure cases when you're
- * unwilling or unable to handle them more cleanly -- for OOM, for likely memory
- * corruption, and so on.  It's also a good solution if you need safe behavior
- * in release builds as well as debug builds.  But if the failure is one that
- * should be debugged and fixed, MOZ_ASSERT is generally preferable.
- */
-#if defined(_MSC_VER)
-   /*
-    * On MSVC use the __debugbreak compiler intrinsic, which produces an inline
-    * (not nested in a system function) breakpoint.  This distinctively invokes
-    * Breakpad without requiring system library symbols on all stack-processing
-    * machines, as a nested breakpoint would require.  We use TerminateProcess
-    * with the exit code aborting would generate because we don't want to invoke
-    * atexit handlers, destructors, library unload handlers, and so on when our
-    * process might be in a compromised state.  We don't use abort() because
-    * it'd cause Windows to annoyingly pop up the process error dialog multiple
-    * times.  See bug 345118 and bug 426163.
-    *
-    * (Technically these are Windows requirements, not MSVC requirements.  But
-    * practically you need MSVC for debugging, and we only ship builds created
-    * by MSVC, so doing it this way reduces complexity.)
-    */
-#  ifdef __cplusplus
-#    define MOZ_CRASH() \
-       do { \
-         __debugbreak(); \
-         *((volatile int*) NULL) = 123; \
-         ::TerminateProcess(::GetCurrentProcess(), 3); \
-       } while (0)
-#  else
-#    define MOZ_CRASH() \
-       do { \
-         __debugbreak(); \
-         *((volatile int*) NULL) = 123; \
-         TerminateProcess(GetCurrentProcess(), 3); \
-       } while (0)
-#  endif
-#else
-#  ifdef __cplusplus
-#    define MOZ_CRASH() \
-       do { \
-         *((volatile int*) NULL) = 123; \
-         ::abort(); \
-       } while (0)
-#  else
-#    define MOZ_CRASH() \
-       do { \
-         *((volatile int*) NULL) = 123; \
-         abort(); \
-       } while (0)
-#  endif
-#endif
-
 /*
  * Prints |s| as an assertion failure (using file and ln as the location of the
  * assertion) to the standard debug-output channel.
  *
- * Usually you should use MOZ_ASSERT instead of this method.  This method is
- * primarily for internal use in this header, and only secondarily for use in
- * implementing release-build assertions.
+ * Usually you should use MOZ_ASSERT or MOZ_CRASH instead of this method.  This
+ * method is primarily for internal use in this header, and only secondarily
+ * for use in implementing release-build assertions.
  */
 static MOZ_ALWAYS_INLINE void
 MOZ_ReportAssertionFailure(const char* s, const char* file, int ln)
@@ -209,6 +152,112 @@ MOZ_ReportAssertionFailure(const char* s, const char* file, int ln)
 #endif
 }
 
+static MOZ_ALWAYS_INLINE void
+MOZ_ReportCrash(const char* s, const char* file, int ln)
+{
+#ifdef ANDROID
+    __android_log_print(ANDROID_LOG_FATAL, "MOZ_CRASH",
+                        "Hit MOZ_CRASH(%s) at %s:%d\n", s, file, ln);
+#else
+  fprintf(stderr, "Hit MOZ_CRASH(%s) at %s:%d\n", s, file, ln);
+  fflush(stderr);
+#endif
+}
+
+/**
+ * MOZ_REALLY_CRASH is used in the implementation of MOZ_CRASH().  You should
+ * call MOZ_CRASH instead.
+ */
+#if defined(_MSC_VER)
+   /*
+    * On MSVC use the __debugbreak compiler intrinsic, which produces an inline
+    * (not nested in a system function) breakpoint.  This distinctively invokes
+    * Breakpad without requiring system library symbols on all stack-processing
+    * machines, as a nested breakpoint would require.
+    *
+    * We use TerminateProcess with the exit code aborting would generate
+    * because we don't want to invoke atexit handlers, destructors, library
+    * unload handlers, and so on when our process might be in a compromised
+    * state.
+    *
+    * We don't use abort() because it'd cause Windows to annoyingly pop up the
+    * process error dialog multiple times.  See bug 345118 and bug 426163.
+    *
+    * We follow TerminateProcess() with a call to MOZ_NoReturn() so that the
+    * compiler doesn't hassle us to provide a return statement after a
+    * MOZ_REALLY_CRASH() call.
+    *
+    * (Technically these are Windows requirements, not MSVC requirements.  But
+    * practically you need MSVC for debugging, and we only ship builds created
+    * by MSVC, so doing it this way reduces complexity.)
+    */
+
+__declspec(noreturn) __inline void MOZ_NoReturn() {}
+
+#  ifdef __cplusplus
+#    define MOZ_REALLY_CRASH() \
+       do { \
+         __debugbreak(); \
+         *((volatile int*) NULL) = 123; \
+         ::TerminateProcess(::GetCurrentProcess(), 3); \
+         ::MOZ_NoReturn(); \
+       } while (0)
+#  else
+#    define MOZ_REALLY_CRASH() \
+       do { \
+         __debugbreak(); \
+         *((volatile int*) NULL) = 123; \
+         TerminateProcess(GetCurrentProcess(), 3); \
+         MOZ_NoReturn(); \
+       } while (0)
+#  endif
+#else
+#  ifdef __cplusplus
+#    define MOZ_REALLY_CRASH() \
+       do { \
+         *((volatile int*) NULL) = 123; \
+         ::abort(); \
+       } while (0)
+#  else
+#    define MOZ_REALLY_CRASH() \
+       do { \
+         *((volatile int*) NULL) = 123; \
+         abort(); \
+       } while (0)
+#  endif
+#endif
+
+/*
+ * MOZ_CRASH([explanation-string]) crashes the program, plain and simple, in a
+ * Breakpad-compatible way, in both debug and release builds.
+ *
+ * MOZ_CRASH is a good solution for "handling" failure cases when you're
+ * unwilling or unable to handle them more cleanly -- for OOM, for likely memory
+ * corruption, and so on.  It's also a good solution if you need safe behavior
+ * in release builds as well as debug builds.  But if the failure is one that
+ * should be debugged and fixed, MOZ_ASSERT is generally preferable.
+ *
+ * The optional explanation-string, if provided, must be a string literal
+ * explaining why we're crashing.  This argument is intended for use with
+ * MOZ_CRASH() calls whose rationale is non-obvious; don't use it if it's
+ * obvious why we're crashing.
+ *
+ * If we're a DEBUG build and we crash at a MOZ_CRASH which provides an
+ * explanation-string, we print the string to stderr.  Otherwise, we don't
+ * print anything; this is because we want MOZ_CRASH to be 100% safe in release
+ * builds, and it's hard to print to stderr safely when memory might have been
+ * corrupted.
+ */
+#ifndef DEBUG
+#  define MOZ_CRASH(...) MOZ_REALLY_CRASH()
+#else
+#  define MOZ_CRASH(...) \
+     do { \
+       MOZ_ReportCrash("" __VA_ARGS__, __FILE__, __LINE__); \
+       MOZ_REALLY_CRASH(); \
+     } while(0)
+#endif
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif
@@ -251,7 +300,7 @@ MOZ_ReportAssertionFailure(const char* s, const char* file, int ln)
      do { \
        if (MOZ_UNLIKELY(!(expr))) { \
          MOZ_ReportAssertionFailure(#expr, __FILE__, __LINE__); \
-         MOZ_CRASH(); \
+         MOZ_REALLY_CRASH(); \
        } \
      } while (0)
    /* Now the two-argument form. */
@@ -259,7 +308,7 @@ MOZ_ReportAssertionFailure(const char* s, const char* file, int ln)
      do { \
        if (MOZ_UNLIKELY(!(expr))) { \
          MOZ_ReportAssertionFailure(#expr " (" explain ")", __FILE__, __LINE__); \
-         MOZ_CRASH(); \
+         MOZ_REALLY_CRASH(); \
        } \
      } while (0)
    /* And now, helper macrology up the wazoo. */
@@ -310,14 +359,14 @@ MOZ_ReportAssertionFailure(const char* s, const char* file, int ln)
 #endif
 
 /*
- * MOZ_NOT_REACHED_MARKER() expands to an expression which states that it is
+ * MOZ_ASSUME_UNREACHABLE_MARKER() expands to an expression which states that it is
  * undefined behavior for execution to reach this point.  No guarantees are made
  * about what will happen if this is reached at runtime.  Most code should
- * probably use the higher level MOZ_NOT_REACHED, which uses this when
+ * probably use the higher level MOZ_ASSUME_UNREACHABLE, which uses this when
  * appropriate.
  */
 #if defined(__clang__)
-#  define MOZ_NOT_REACHED_MARKER() __builtin_unreachable()
+#  define MOZ_ASSUME_UNREACHABLE_MARKER() __builtin_unreachable()
 #elif defined(__GNUC__)
    /*
     * __builtin_unreachable() was implemented in gcc 4.5.  If we don't have
@@ -325,49 +374,71 @@ MOZ_ReportAssertionFailure(const char* s, const char* file, int ln)
     * in C++ in case there's another abort() visible in local scope.
     */
 #  if MOZ_GCC_VERSION_AT_LEAST(4, 5, 0)
-#    define MOZ_NOT_REACHED_MARKER() __builtin_unreachable()
+#    define MOZ_ASSUME_UNREACHABLE_MARKER() __builtin_unreachable()
 #  else
 #    ifdef __cplusplus
-#      define MOZ_NOT_REACHED_MARKER() ::abort()
+#      define MOZ_ASSUME_UNREACHABLE_MARKER() ::abort()
 #    else
-#      define MOZ_NOT_REACHED_MARKER() abort()
+#      define MOZ_ASSUME_UNREACHABLE_MARKER() abort()
 #    endif
 #  endif
 #elif defined(_MSC_VER)
-#  define MOZ_NOT_REACHED_MARKER() __assume(0)
+#  define MOZ_ASSUME_UNREACHABLE_MARKER() __assume(0)
 #else
 #  ifdef __cplusplus
-#    define MOZ_NOT_REACHED_MARKER() ::abort()
+#    define MOZ_ASSUME_UNREACHABLE_MARKER() ::abort()
 #  else
-#    define MOZ_NOT_REACHED_MARKER() abort()
+#    define MOZ_ASSUME_UNREACHABLE_MARKER() abort()
 #  endif
 #endif
 
 /*
- * MOZ_NOT_REACHED(reason) indicates that the given point can't be reached
- * during execution: simply reaching that point in execution is a bug.  It takes
- * as an argument an error message indicating the reason why that point should
- * not have been reachable.
+ * MOZ_ASSUME_UNREACHABLE([reason]) tells the compiler that it can assume that
+ * the macro call cannot be reached during execution.  This lets the compiler
+ * generate better-optimized code under some circumstances, at the expense of
+ * the program's behavior being undefined if control reaches the
+ * MOZ_ASSUME_UNREACHABLE.
  *
- *   // ...in a language parser...
- *   void handle(BooleanLiteralNode node)
+ * In Gecko, you probably should not use this macro outside of performance- or
+ * size-critical code, because it's unsafe.  If you don't care about code size
+ * or performance, you should probably use MOZ_ASSERT or MOZ_CRASH.
+ *
+ * SpiderMonkey is a different beast, and there it's acceptable to use
+ * MOZ_ASSUME_UNREACHABLE more widely.
+ *
+ * Note that MOZ_ASSUME_UNREACHABLE is noreturn, so it's valid not to return a
+ * value following a MOZ_ASSUME_UNREACHABLE call.
+ *
+ * Example usage:
+ *
+ *   enum ValueType {
+ *     VALUE_STRING,
+ *     VALUE_INT,
+ *     VALUE_FLOAT
+ *   };
+ *
+ *   int ptrToInt(ValueType type, void* value) {
  *   {
- *     if (node.isTrue())
- *       handleTrueLiteral();
- *     else if (node.isFalse())
- *       handleFalseLiteral();
- *     else
- *       MOZ_NOT_REACHED("boolean literal that's not true or false?");
+ *     // We know for sure that type is either INT or FLOAT, and we want this
+ *     // code to run as quickly as possible.
+ *     switch (type) {
+ *     case VALUE_INT:
+ *       return *(int*) value;
+ *     case VALUE_FLOAT:
+ *       return (int) *(float*) value;
+ *     default:
+ *       MOZ_ASSUME_UNREACHABLE("can only handle VALUE_INT and VALUE_FLOAT");
+ *     }
  *   }
  */
 #if defined(DEBUG)
-#  define MOZ_NOT_REACHED(reason) \
+#  define MOZ_ASSUME_UNREACHABLE(...) \
      do { \
-       MOZ_ASSERT(false, reason); \
-       MOZ_NOT_REACHED_MARKER(); \
+       MOZ_ASSERT(false, "MOZ_ASSUME_UNREACHABLE(" __VA_ARGS__ ")"); \
+       MOZ_ASSUME_UNREACHABLE_MARKER(); \
      } while (0)
 #else
-#  define MOZ_NOT_REACHED(reason)  MOZ_NOT_REACHED_MARKER()
+#  define MOZ_ASSUME_UNREACHABLE(reason)  MOZ_ASSUME_UNREACHABLE_MARKER()
 #endif
 
 /*
diff --git a/mfbt/LinkedList.h b/mfbt/LinkedList.h
index a958996d45b..58176e4472c 100644
--- a/mfbt/LinkedList.h
+++ b/mfbt/LinkedList.h
@@ -413,7 +413,7 @@ class LinkedList
         if (elem == t)
           return;
       }
-      MOZ_NOT_REACHED("element wasn't found in this list!");
+      MOZ_CRASH("element wasn't found in this list!");
 #endif
     }
 
diff --git a/mfbt/decimal/moz-decimal-utils.h b/mfbt/decimal/moz-decimal-utils.h
index 7f96d30b9f5..ff8ab74945d 100644
--- a/mfbt/decimal/moz-decimal-utils.h
+++ b/mfbt/decimal/moz-decimal-utils.h
@@ -32,7 +32,7 @@
 #endif
 #define ASSERT MOZ_ASSERT
 
-#define ASSERT_NOT_REACHED() MOZ_NOT_REACHED("")
+#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE()
 
 #define WTF_MAKE_NONCOPYABLE(ClassName) \
   private: \
diff --git a/mfbt/decimal/to-moz-dependencies.patch b/mfbt/decimal/to-moz-dependencies.patch
index 824f65c1a29..11e2429c8f5 100644
--- a/mfbt/decimal/to-moz-dependencies.patch
+++ b/mfbt/decimal/to-moz-dependencies.patch
@@ -256,7 +256,7 @@ new file mode 100644
 +#endif
 +#define ASSERT MOZ_ASSERT
 +
-+#define ASSERT_NOT_REACHED() MOZ_NOT_REACHED("")
++#define ASSERT_NOT_REACHED() MOZ_ASSUME_UNREACHABLE()
 +
 +#define WTF_MAKE_NONCOPYABLE(ClassName) \
 +  private: \
diff --git a/mobile/android/base/BrowserToolbar.java b/mobile/android/base/BrowserToolbar.java
index d2941672d86..223b4775ec9 100644
--- a/mobile/android/base/BrowserToolbar.java
+++ b/mobile/android/base/BrowserToolbar.java
@@ -1192,7 +1192,7 @@ public class BrowserToolbar extends GeckoRelativeLayout
         if (!mHasSoftMenuButton)
             return false;
 
-        if (mMenuPopup.isShowing())
+        if (mMenuPopup != null && mMenuPopup.isShowing())
             mMenuPopup.dismiss();
 
         return true;
diff --git a/mobile/android/base/GeckoPreferenceFragment.java b/mobile/android/base/GeckoPreferenceFragment.java
index 8545618ec68..eab1232074b 100644
--- a/mobile/android/base/GeckoPreferenceFragment.java
+++ b/mobile/android/base/GeckoPreferenceFragment.java
@@ -6,6 +6,7 @@
 package org.mozilla.gecko;
 
 import android.preference.Preference;
+import android.preference.PreferenceActivity;
 import android.preference.PreferenceCategory;
 import android.preference.PreferenceFragment;
 import android.preference.PreferenceScreen;
@@ -24,10 +25,23 @@ public class GeckoPreferenceFragment extends PreferenceFragment {
     @Override
     public void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
-        String resource = getArguments().getString("resource");
-        int res = getActivity().getResources().getIdentifier(resource,
+        String resourceName = getArguments().getString("resource");
+
+        int res = 0;
+        if (resourceName != null) {
+            // Fetch resource id by resource name.
+            res = getActivity().getResources().getIdentifier(resourceName,
                                                              "xml",
                                                              getActivity().getPackageName());
+        }
+
+        if (res == 0) {
+            // The resource was invalid. Use the default resource.
+            Log.e(LOGTAG, "Failed to find resource: " + resourceName + ". Displaying default settings.");
+
+            boolean isMultiPane = ((PreferenceActivity) getActivity()).onIsMultiPane();
+            res = isMultiPane ? R.xml.preferences_customize_tablet : R.xml.preferences;
+        }
         addPreferencesFromResource(res);
 
         PreferenceScreen screen = getPreferenceScreen();
diff --git a/mobile/android/base/GeckoPreferences.java b/mobile/android/base/GeckoPreferences.java
index 25aafc52113..6a310b64821 100644
--- a/mobile/android/base/GeckoPreferences.java
+++ b/mobile/android/base/GeckoPreferences.java
@@ -92,13 +92,23 @@ public class GeckoPreferences
         // Use setResourceToOpen to specify these extras.
         Bundle intentExtras = getIntent().getExtras();
         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.HONEYCOMB) {
+            int res = 0;
             if (intentExtras != null && intentExtras.containsKey(INTENT_EXTRA_RESOURCES)) {
+                // Fetch resource id from intent.
                 String resourceName = intentExtras.getString(INTENT_EXTRA_RESOURCES);
-                int resource = getResources().getIdentifier(resourceName, "xml", getPackageName());
-                addPreferencesFromResource(resource);
-            } else {
-                addPreferencesFromResource(R.xml.preferences);
+                if (resourceName != null) {
+                    res = getResources().getIdentifier(resourceName, "xml", getPackageName());
+                    if (res == 0) {
+                        Log.e(LOGTAG, "No resource found named " + resourceName);
+                    }
+                }
             }
+            if (res == 0) {
+                // No resource specified, or the resource was invalid; use the default preferences screen.
+                Log.e(LOGTAG, "Displaying default settings.");
+                res = R.xml.preferences;
+            }
+            addPreferencesFromResource(res);
         }
 
         registerEventListener("Sanitize:Finished");
@@ -123,8 +133,8 @@ public class GeckoPreferences
         Bundle fragmentArgs = new Bundle();
         // Add resource argument to fragment if it exists.
         if (intentExtras != null && intentExtras.containsKey(INTENT_EXTRA_RESOURCES)) {
-            String resource = intentExtras.getString(INTENT_EXTRA_RESOURCES);
-            fragmentArgs.putString(INTENT_EXTRA_RESOURCES, resource);
+            String resourceName = intentExtras.getString(INTENT_EXTRA_RESOURCES);
+            fragmentArgs.putString(INTENT_EXTRA_RESOURCES, resourceName);
         } else {
             // Use top-level settings screen.
             if (!onIsMultiPane()) {
diff --git a/mobile/android/base/resources/layout-large-v11/awesomebar_search.xml b/mobile/android/base/resources/layout-large-v11/awesomebar_search.xml
index 152ff4465e5..c7e7f39118a 100644
--- a/mobile/android/base/resources/layout-large-v11/awesomebar_search.xml
+++ b/mobile/android/base/resources/layout-large-v11/awesomebar_search.xml
@@ -41,16 +41,13 @@
               <requestFocus/>
     </view>
 
-    <LinearLayout android:layout_width="4dp"
-                  android:layout_height="fill_parent"
-                  android:orientation="vertical"
-                  android:layout_alignParentRight="true"/>
-
     <ImageButton android:id="@+id/awesomebar_button"
                  style="@style/AddressBar.ImageButton.Icon"
                  android:padding="14dip"
+                 android:background="@drawable/action_bar_button"
                  android:layout_centerVertical="true"
                  android:layout_alignRight="@id/awesomebar_text"
+                 android:nextFocusLeft="@id/awesomebar_text"
                  android:visibility="gone"
                  android:src="@drawable/ic_awesomebar_go"/>
 
diff --git a/mobile/android/base/resources/layout/awesomebar_search.xml b/mobile/android/base/resources/layout/awesomebar_search.xml
index c80208a44b8..98875ca4d19 100644
--- a/mobile/android/base/resources/layout/awesomebar_search.xml
+++ b/mobile/android/base/resources/layout/awesomebar_search.xml
@@ -43,16 +43,13 @@
           gecko:autoUpdateTheme="false">
     </view>
 
-    <LinearLayout android:layout_width="4dp"
-                  android:layout_height="fill_parent"
-                  android:orientation="vertical"
-                  android:layout_alignParentRight="true"/>
-
     <ImageButton android:id="@+id/awesomebar_button"
                  style="@style/AddressBar.ImageButton.Icon"
+                 android:background="@drawable/action_bar_button"
                  android:padding="12dip"
                  android:layout_centerVertical="true"
                  android:layout_alignRight="@id/awesomebar_text"
+                 android:nextFocusLeft="@id/awesomebar_text"
                  android:visibility="gone"
                  android:src="@drawable/ic_awesomebar_go"/>
 
diff --git a/mobile/android/chrome/content/aboutHealthReport.js b/mobile/android/chrome/content/aboutHealthReport.js
index 54915832d89..6acf024ffad 100644
--- a/mobile/android/chrome/content/aboutHealthReport.js
+++ b/mobile/android/chrome/content/aboutHealthReport.js
@@ -127,7 +127,7 @@ let healthReportWrapper = {
     console.log("AboutHealthReport: showing settings.");
     sendMessageToJava({
       type: "Settings:Show",
-      resource: "preferences_datareporting",
+      resource: "preferences_vendor",
     });
   },
 
diff --git a/modules/libjar/nsJARProtocolHandler.cpp b/modules/libjar/nsJARProtocolHandler.cpp
index c7649998b53..2bc7145daf3 100644
--- a/modules/libjar/nsJARProtocolHandler.cpp
+++ b/modules/libjar/nsJARProtocolHandler.cpp
@@ -75,8 +75,7 @@ nsJARProtocolHandler::RemoteOpenFileInProgress(
     MOZ_ASSERT(aListener);
 
     if (IsMainProcess()) {
-        MOZ_NOT_REACHED("Shouldn't be called in the main process!");
-        return false;
+        MOZ_CRASH("Shouldn't be called in the main process!");
     }
 
     RemoteFileListenerArray *listeners;
@@ -99,8 +98,7 @@ nsJARProtocolHandler::RemoteOpenFileComplete(nsIHashable *aRemoteFile,
     MOZ_ASSERT(aRemoteFile);
 
     if (IsMainProcess()) {
-        MOZ_NOT_REACHED("Shouldn't be called in the main process!");
-        return;
+        MOZ_CRASH("Shouldn't be called in the main process!");
     }
 
     RemoteFileListenerArray *tempListeners;
diff --git a/modules/libpref/src/prefapi.cpp b/modules/libpref/src/prefapi.cpp
index 59ad7c6d554..5069ca41fe8 100644
--- a/modules/libpref/src/prefapi.cpp
+++ b/modules/libpref/src/prefapi.cpp
@@ -293,8 +293,7 @@ SetPrefValue(const char* aPrefName, const dom::PrefValue& aValue,
         return PREF_SetBoolPref(aPrefName, aValue.get_bool(),
                                 setDefault);
     default:
-        MOZ_NOT_REACHED();
-        return NS_ERROR_FAILURE;
+        MOZ_CRASH();
     }
 }
 
@@ -426,7 +425,7 @@ GetPrefValueFromEntry(PrefHashEntry *aHashEntry, dom::PrefSetting* aPref,
         *settingValue = !!value->boolVal;
         return;
     default:
-        MOZ_NOT_REACHED();
+        MOZ_CRASH();
     }
 }
 
diff --git a/mozglue/linker/ElfLoader.h b/mozglue/linker/ElfLoader.h
index effe198ab67..cdcd3998a55 100644
--- a/mozglue/linker/ElfLoader.h
+++ b/mozglue/linker/ElfLoader.h
@@ -547,7 +547,7 @@ private:
       {
         if (other.item == NULL)
           return item ? true : false;
-        MOZ_NOT_REACHED("DebuggerHelper::iterator::operator< called with something else than DebuggerHelper::end()");
+        MOZ_CRASH("DebuggerHelper::iterator::operator< called with something else than DebuggerHelper::end()");
       }
     protected:
       friend class DebuggerHelper;
diff --git a/mozglue/linker/Mappable.cpp b/mozglue/linker/Mappable.cpp
index 2cd796070b4..874e953e4e0 100644
--- a/mozglue/linker/Mappable.cpp
+++ b/mozglue/linker/Mappable.cpp
@@ -411,7 +411,7 @@ MappableSeekableZStream::munmap(void *addr, size_t length)
       ::munmap(addr, length);
       return;
     }
-  MOZ_NOT_REACHED("munmap called with unknown mapping");
+  MOZ_CRASH("munmap called with unknown mapping");
 }
 
 void
@@ -422,12 +422,12 @@ public:
   AutoLock(pthread_mutex_t *mutex): mutex(mutex)
   {
     if (pthread_mutex_lock(mutex))
-      MOZ_NOT_REACHED("pthread_mutex_lock failed");
+      MOZ_CRASH("pthread_mutex_lock failed");
   }
   ~AutoLock()
   {
     if (pthread_mutex_unlock(mutex))
-      MOZ_NOT_REACHED("pthread_mutex_unlock failed");
+      MOZ_CRASH("pthread_mutex_unlock failed");
   }
 private:
   pthread_mutex_t *mutex;
diff --git a/netwerk/base/public/nsIInputStreamChannel.idl b/netwerk/base/public/nsIInputStreamChannel.idl
index 913ee68b62f..938b70e41ad 100644
--- a/netwerk/base/public/nsIInputStreamChannel.idl
+++ b/netwerk/base/public/nsIInputStreamChannel.idl
@@ -12,7 +12,7 @@ interface nsIInputStream;
  * This interface provides methods to initialize an input stream channel.
  * The input stream channel serves as a data pump for an input stream.
  */
-[scriptable, uuid(274c4d7a-2447-4ceb-a6de-80db1b83f5d2)]
+[scriptable, uuid(A30E916F-B1DE-452A-BDD0-C59BB516D427)]
 interface nsIInputStreamChannel : nsISupports
 {
     /**
@@ -36,4 +36,23 @@ interface nsIInputStreamChannel : nsISupports
      * has been opened.
      */
     attribute nsIInputStream contentStream;
+
+    /**
+     * Get/set the srcdoc data string.  When the input stream channel is 
+     * created to load a srcdoc iframe, this is set to hold the value of the
+     * srcdoc attribute.
+     *
+     * This should be the same value used to create contentStream, but this is
+     * not checked.
+     *
+     * Changing the value of this attribute will not otherwise affect the 
+     * functionality of the channel or input stream.
+     */
+    attribute AString srcdocData;
+
+    /**
+     * Returns true if srcdocData has been set within the channel.
+     */
+    readonly attribute boolean isSrcdocChannel;
+
 };
diff --git a/netwerk/base/public/nsNetUtil.h b/netwerk/base/public/nsNetUtil.h
index b51fda15986..60a84d478f8 100644
--- a/netwerk/base/public/nsNetUtil.h
+++ b/netwerk/base/public/nsNetUtil.h
@@ -81,11 +81,14 @@
 #include "nsIOfflineCacheUpdate.h"
 #include "nsIContentSniffer.h"
 #include "nsCategoryCache.h"
+#include "nsStringStream.h"
 
 #include <limits>
 
 #ifdef MOZILLA_INTERNAL_API
 
+#include "nsReadableUtils.h"
+
 inline already_AddRefed<nsIIOService>
 do_GetIOService(nsresult* error = 0)
 {
@@ -462,6 +465,47 @@ NS_NewInputStreamChannel(nsIChannel      **result,
                                     &contentCharset);
 }
 
+inline nsresult
+NS_NewInputStreamChannel(nsIChannel      **result,
+                         nsIURI           *uri,
+                         const nsAString  &data,
+                         const nsACString &contentType,
+                         bool              isSrcdocChannel = false)
+{
+
+    nsresult rv;
+
+    nsCOMPtr<nsIStringInputStream> stream;
+    stream = do_CreateInstance(NS_STRINGINPUTSTREAM_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+#ifdef MOZILLA_INTERNAL_API
+    uint32_t len;
+    char* utf8Bytes = ToNewUTF8String(data, &len);
+    rv = stream->AdoptData(utf8Bytes, len);
+#else
+    char* utf8Bytes = ToNewUTF8String(data);
+    rv = stream->AdoptData(utf8Bytes, strlen(utf8Bytes));
+#endif
+
+    nsCOMPtr<nsIChannel> chan;
+
+    rv = NS_NewInputStreamChannel(getter_AddRefs(chan), uri, stream,
+                                  contentType, NS_LITERAL_CSTRING("UTF-8"));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    if (isSrcdocChannel) {
+        nsCOMPtr<nsIInputStreamChannel> inStrmChan = do_QueryInterface(chan);
+        NS_ENSURE_TRUE(inStrmChan, NS_ERROR_FAILURE);
+        inStrmChan->SetSrcdocData(data);
+    }
+
+    *result = nullptr;
+    chan.swap(*result);
+
+    return NS_OK;
+}
+
 inline nsresult
 NS_NewInputStreamPump(nsIInputStreamPump **result,
                       nsIInputStream      *stream,
diff --git a/netwerk/base/src/BackgroundFileSaver.cpp b/netwerk/base/src/BackgroundFileSaver.cpp
index 9cd69361343..3ebfdd054b5 100644
--- a/netwerk/base/src/BackgroundFileSaver.cpp
+++ b/netwerk/base/src/BackgroundFileSaver.cpp
@@ -968,7 +968,7 @@ DigestOutputStream::WriteFrom(nsIInputStream* aFromStream,
   // Not supported. We could read the stream to a buf, call DigestOp on the
   // result, seek back and pass the stream on, but it's not worth it since our
   // application (NS_AsyncCopy) doesn't invoke this on the sink.
-  MOZ_NOT_REACHED("DigestOutputStream::WriteFrom not implemented");
+  MOZ_CRASH("DigestOutputStream::WriteFrom not implemented");
 }
 
 NS_IMETHODIMP
@@ -976,7 +976,7 @@ DigestOutputStream::WriteSegments(nsReadSegmentFun aReader,
                                   void *aClosure, uint32_t aCount,
                                   uint32_t *retval)
 {
-  MOZ_NOT_REACHED("DigestOutputStream::WriteSegments not implemented");
+  MOZ_CRASH("DigestOutputStream::WriteSegments not implemented");
 }
 
 NS_IMETHODIMP
diff --git a/netwerk/base/src/nsInputStreamChannel.cpp b/netwerk/base/src/nsInputStreamChannel.cpp
index 06a0a691e27..74b5d1a873b 100644
--- a/netwerk/base/src/nsInputStreamChannel.cpp
+++ b/netwerk/base/src/nsInputStreamChannel.cpp
@@ -67,3 +67,26 @@ nsInputStreamChannel::SetContentStream(nsIInputStream *stream)
   mContentStream = stream;
   return NS_OK;
 }
+
+NS_IMETHODIMP
+nsInputStreamChannel::GetSrcdocData(nsAString& aSrcdocData)
+{
+  aSrcdocData = mSrcdocData;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsInputStreamChannel::SetSrcdocData(const nsAString& aSrcdocData)
+{
+  mSrcdocData = aSrcdocData;
+  mIsSrcdocChannel = true;
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsInputStreamChannel::GetIsSrcdocChannel(bool *aIsSrcdocChannel)
+{
+  *aIsSrcdocChannel = mIsSrcdocChannel;
+  return NS_OK;
+}
+
diff --git a/netwerk/base/src/nsInputStreamChannel.h b/netwerk/base/src/nsInputStreamChannel.h
index 87cf0a1bc45..ab87fcaad02 100644
--- a/netwerk/base/src/nsInputStreamChannel.h
+++ b/netwerk/base/src/nsInputStreamChannel.h
@@ -18,7 +18,8 @@ public:
     NS_DECL_ISUPPORTS_INHERITED
     NS_DECL_NSIINPUTSTREAMCHANNEL
 
-    nsInputStreamChannel() {}
+    nsInputStreamChannel() :
+      mIsSrcdocChannel(false) {}
 
 protected:
     virtual ~nsInputStreamChannel() {}
@@ -28,6 +29,8 @@ protected:
 
 private:
     nsCOMPtr<nsIInputStream> mContentStream;
+    nsString mSrcdocData;
+    bool mIsSrcdocChannel;
 };
 
 #endif // !nsInputStreamChannel_h__
diff --git a/netwerk/ipc/RemoteOpenFileChild.cpp b/netwerk/ipc/RemoteOpenFileChild.cpp
index f185dc326ee..f8135269210 100644
--- a/netwerk/ipc/RemoteOpenFileChild.cpp
+++ b/netwerk/ipc/RemoteOpenFileChild.cpp
@@ -170,7 +170,7 @@ RemoteOpenFileChild::AsyncRemoteFileOpen(int32_t aFlags,
 #else
   nsString path;
   if (NS_FAILED(mFile->GetPath(path))) {
-    MOZ_NOT_REACHED("Couldn't get path from file!");
+    MOZ_CRASH("Couldn't get path from file!");
   }
 
   if (mTabChild) {
@@ -204,10 +204,7 @@ RemoteOpenFileChild::OnCachedFileDescriptor(const nsAString& aPath,
     MOZ_ASSERT(mFile);
 
     nsString path;
-    if (NS_FAILED(mFile->GetPath(path))) {
-      MOZ_NOT_REACHED("Couldn't get path from file!");
-    }
-
+    MOZ_ASSERT(NS_SUCCEEDED(mFile->GetPath(path)));
     MOZ_ASSERT(path == aPath, "Paths don't match!");
   }
 #endif
@@ -221,7 +218,7 @@ RemoteOpenFileChild::HandleFileDescriptorAndNotifyListener(
                                                       bool aFromRecvDelete)
 {
 #if defined(XP_WIN) || defined(MOZ_WIDGET_COCOA)
-  MOZ_NOT_REACHED("OS X and Windows shouldn't be doing IPDL here");
+  MOZ_CRASH("OS X and Windows shouldn't be doing IPDL here");
 #else
   if (!mListener) {
     // We already notified our listener (either in response to a cached file
@@ -246,7 +243,7 @@ RemoteOpenFileChild::HandleFileDescriptorAndNotifyListener(
   if (tabChild && aFromRecvDelete) {
     nsString path;
     if (NS_FAILED(mFile->GetPath(path))) {
-      MOZ_NOT_REACHED("Couldn't get path from file!");
+      MOZ_CRASH("Couldn't get path from file!");
     }
 
     tabChild->CancelCachedFileDescriptorCallback(path, this);
diff --git a/netwerk/ipc/RemoteOpenFileParent.cpp b/netwerk/ipc/RemoteOpenFileParent.cpp
index 174186e7a05..022f7ac5679 100644
--- a/netwerk/ipc/RemoteOpenFileParent.cpp
+++ b/netwerk/ipc/RemoteOpenFileParent.cpp
@@ -21,7 +21,7 @@ bool
 RemoteOpenFileParent::OpenSendCloseDelete()
 {
 #if defined(XP_WIN) || defined(MOZ_WIDGET_COCOA)
-  MOZ_NOT_REACHED("OS X and Windows shouldn't be doing IPDL here");
+  MOZ_CRASH("OS X and Windows shouldn't be doing IPDL here");
 #else
 
   // TODO: make this async!
diff --git a/netwerk/protocol/about/nsAboutProtocolHandler.cpp b/netwerk/protocol/about/nsAboutProtocolHandler.cpp
index 7ca71548c18..ffc166eb0ba 100644
--- a/netwerk/protocol/about/nsAboutProtocolHandler.cpp
+++ b/netwerk/protocol/about/nsAboutProtocolHandler.cpp
@@ -130,6 +130,17 @@ nsAboutProtocolHandler::NewChannel(nsIURI* uri, nsIChannel* *result)
     // about:what you ask?
     nsCOMPtr<nsIAboutModule> aboutMod;
     nsresult rv = NS_GetAboutModule(uri, getter_AddRefs(aboutMod));
+
+    nsAutoCString path;
+    nsresult rv2 = NS_GetAboutModuleName(uri, path);
+    if (NS_SUCCEEDED(rv2) && path.EqualsLiteral("srcdoc")) {
+        // about:srcdoc is meant to be unresolvable, yet is included in the 
+        // about lookup tables so that it can pass security checks when used in
+        // a srcdoc iframe.  To ensure that it stays unresolvable, we pretend
+        // that it doesn't exist.
+      rv = NS_ERROR_FACTORY_NOT_REGISTERED;
+    }
+
     if (NS_SUCCEEDED(rv)) {
         // The standard return case:
         rv = aboutMod->NewChannel(uri, result);
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 8b874362582..e77aff5813f 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -2916,7 +2916,7 @@ HttpCacheQuery::OnCacheEntryAvailable(nsICacheEntryDescriptor *entry,
                 mCacheEntryDeviceTelemetryID
                     = Telemetry::HTTP_OFFLINE_CACHE_DISPOSITION_2;
             } else {
-                MOZ_NOT_REACHED("unknown cache device ID");
+                MOZ_CRASH("unknown cache device ID");
             }
 
             delete cacheDeviceID;
diff --git a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
index bcc4a96c4cf..5aa075dee21 100644
--- a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
+++ b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
@@ -14,6 +14,7 @@
 #include "nsMimeTypes.h"
 #include "nsNetUtil.h"
 #include "nsIHttpHeaderVisitor.h"
+#include "nsStringStream.h"
 
 NS_IMPL_ADDREF(nsViewSourceChannel)
 NS_IMPL_RELEASE(nsViewSourceChannel)
@@ -73,6 +74,36 @@ nsViewSourceChannel::Init(nsIURI* uri)
     return NS_OK;
 }
 
+nsresult
+nsViewSourceChannel::InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc)
+{
+
+    nsresult rv;
+
+    nsCOMPtr<nsIURI> inStreamURI;
+    // Need to strip view-source: from the URI.  Hardcoded to
+    // about:srcdoc as this is the only permissible URI for srcdoc 
+    // loads
+    rv = NS_NewURI(getter_AddRefs(inStreamURI),
+                   NS_LITERAL_STRING("about:srcdoc"));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = NS_NewInputStreamChannel(getter_AddRefs(mChannel), inStreamURI,
+                                  aSrcdoc, NS_LITERAL_CSTRING("text/html"),
+                                  true);
+
+    NS_ENSURE_SUCCESS(rv, rv);
+    mOriginalURI = aURI;
+    
+    mChannel->SetOriginalURI(mOriginalURI);
+    mHttpChannel = do_QueryInterface(mChannel);
+    mHttpChannelInternal = do_QueryInterface(mChannel);
+    mCachingChannel = do_QueryInterface(mChannel);
+    mApplicationCacheChannel = do_QueryInterface(mChannel);
+    mUploadChannel = do_QueryInterface(mChannel);
+    return NS_OK;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsIRequest methods:
 
diff --git a/netwerk/protocol/viewsource/nsViewSourceChannel.h b/netwerk/protocol/viewsource/nsViewSourceChannel.h
index 5aabe280e1b..3db05151669 100644
--- a/netwerk/protocol/viewsource/nsViewSourceChannel.h
+++ b/netwerk/protocol/viewsource/nsViewSourceChannel.h
@@ -52,6 +52,8 @@ public:
 
     NS_HIDDEN_(nsresult) Init(nsIURI* uri);
 
+    NS_HIDDEN_(nsresult) InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc);
+
 protected:
     nsCOMPtr<nsIChannel>        mChannel;
     nsCOMPtr<nsIHttpChannel>    mHttpChannel;
diff --git a/netwerk/protocol/viewsource/nsViewSourceHandler.cpp b/netwerk/protocol/viewsource/nsViewSourceHandler.cpp
index bccf3ab3d56..3203aeab59e 100644
--- a/netwerk/protocol/viewsource/nsViewSourceHandler.cpp
+++ b/netwerk/protocol/viewsource/nsViewSourceHandler.cpp
@@ -108,6 +108,26 @@ nsViewSourceHandler::NewChannel(nsIURI* uri, nsIChannel* *result)
     return NS_OK;
 }
 
+nsresult
+nsViewSourceHandler::NewSrcdocChannel(nsIURI* uri, const nsAString &srcdoc,
+                                      nsIChannel* *result)
+{
+    NS_ENSURE_ARG_POINTER(uri);
+    nsViewSourceChannel *channel = new nsViewSourceChannel();
+    if (!channel)
+        return NS_ERROR_OUT_OF_MEMORY;
+    NS_ADDREF(channel);
+
+    nsresult rv = channel->InitSrcdoc(uri, srcdoc);
+    if (NS_FAILED(rv)) {
+        NS_RELEASE(channel);
+        return rv;
+    }
+
+    *result = static_cast<nsIViewSourceChannel*>(channel);
+    return NS_OK;
+}
+
 NS_IMETHODIMP 
 nsViewSourceHandler::AllowPort(int32_t port, const char *scheme, bool *_retval)
 {
@@ -115,3 +135,21 @@ nsViewSourceHandler::AllowPort(int32_t port, const char *scheme, bool *_retval)
     *_retval = false;
     return NS_OK;
 }
+
+nsViewSourceHandler::nsViewSourceHandler()
+{
+    gInstance = this;
+}
+
+nsViewSourceHandler::~nsViewSourceHandler()
+{
+    gInstance = nullptr;
+}
+
+nsViewSourceHandler* nsViewSourceHandler::gInstance = nullptr;
+
+nsViewSourceHandler*
+nsViewSourceHandler::GetInstance()
+{
+    return gInstance;
+}
diff --git a/netwerk/protocol/viewsource/nsViewSourceHandler.h b/netwerk/protocol/viewsource/nsViewSourceHandler.h
index a648d5a04c5..46ad55caae1 100644
--- a/netwerk/protocol/viewsource/nsViewSourceHandler.h
+++ b/netwerk/protocol/viewsource/nsViewSourceHandler.h
@@ -14,6 +14,21 @@ class nsViewSourceHandler MOZ_FINAL : public nsIProtocolHandler
 public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIPROTOCOLHANDLER
+
+    nsViewSourceHandler();
+
+    ~nsViewSourceHandler();
+
+    // Creates a new nsViewSourceChannel to view the source of an about:srcdoc
+    // URI with contents specified by srcdoc.
+    nsresult NewSrcdocChannel(nsIURI* uri, const nsAString &srcdoc, 
+                              nsIChannel** result);
+
+    static nsViewSourceHandler* GetInstance();
+
+private:
+    static nsViewSourceHandler* gInstance;
+
 };
 
 #endif /* !defined( nsViewSourceHandler_h___ ) */
diff --git a/netwerk/sctp/datachannel/DataChannel.h b/netwerk/sctp/datachannel/DataChannel.h
index 209f6e6edb3..a2d4e53804f 100644
--- a/netwerk/sctp/datachannel/DataChannel.h
+++ b/netwerk/sctp/datachannel/DataChannel.h
@@ -405,13 +405,15 @@ public:
   // Find out state
   uint16_t GetReadyState()
     {
-      if (mState == WAITING_TO_OPEN)
-        return CONNECTING;
-      return mState;
+      if (mConnection) {
+        MutexAutoLock lock(mConnection->mLock);
+        if (mState == WAITING_TO_OPEN)
+          return CONNECTING;
+        return mState;
+      }
+      return CLOSED;
     }
 
-  void SetReadyState(uint16_t aState) { mState = aState; }
-
   void GetLabel(nsAString& aLabel) { CopyUTF8toUTF16(mLabel, aLabel); }
   void GetProtocol(nsAString& aProtocol) { CopyUTF8toUTF16(mProtocol, aProtocol); }
   uint16_t GetStream() { return mStream; }
diff --git a/other-licenses/snappy/moz.build b/other-licenses/snappy/moz.build
index 424bf138e26..d75e8612505 100644
--- a/other-licenses/snappy/moz.build
+++ b/other-licenses/snappy/moz.build
@@ -5,9 +5,9 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 EXPORTS.snappy += [
-    'snappy-c.h',
     'snappy-stubs-public.h',
-    'snappy.h',
+    'src/snappy-c.h',
+    'src/snappy.h',
 ]
 
 CPP_SOURCES += [
diff --git a/parser/html/javasrc/AttributeName.java b/parser/html/javasrc/AttributeName.java
index e852fb9b439..8e759f277f1 100644
--- a/parser/html/javasrc/AttributeName.java
+++ b/parser/html/javasrc/AttributeName.java
@@ -882,6 +882,7 @@ public final class AttributeName
     public static final AttributeName POSTER = new AttributeName(ALL_NO_NS, SAME_LOCAL("poster"), ALL_NO_PREFIX, NCNAME_HTML | NCNAME_FOREIGN | NCNAME_LANG);
     public static final AttributeName POINTS = new AttributeName(ALL_NO_NS, SAME_LOCAL("points"), ALL_NO_PREFIX, NCNAME_HTML | NCNAME_FOREIGN | NCNAME_LANG);
     public static final AttributeName PROMPT = new AttributeName(ALL_NO_NS, SAME_LOCAL("prompt"), ALL_NO_PREFIX, NCNAME_HTML | NCNAME_FOREIGN | NCNAME_LANG);
+    public static final AttributeName SRCDOC = new AttributeName(ALL_NO_NS, SAME_LOCAL("srcdoc"), ALL_NO_PREFIX, NCNAME_HTML | NCNAME_FOREIGN | NCNAME_LANG);
     public static final AttributeName SCOPED = new AttributeName(ALL_NO_NS, SAME_LOCAL("scoped"), ALL_NO_PREFIX, NCNAME_HTML | NCNAME_FOREIGN | NCNAME_LANG);
     public static final AttributeName STRING = new AttributeName(ALL_NO_NS, SAME_LOCAL("string"), ALL_NO_PREFIX, NCNAME_HTML | NCNAME_FOREIGN | NCNAME_LANG);
     public static final AttributeName SCHEME = new AttributeName(ALL_NO_NS, SAME_LOCAL("scheme"), ALL_NO_PREFIX, NCNAME_HTML | NCNAME_FOREIGN | NCNAME_LANG);
@@ -1463,6 +1464,7 @@ public final class AttributeName
     POSTER,
     POINTS,
     PROMPT,
+    SRCDOC,
     SCOPED,
     STRING,
     SCHEME,
@@ -2045,6 +2047,7 @@ public final class AttributeName
     223089542,
     223138630,
     223311265,
+    224431494,
     224547358,
     224587256,
     224589550,
diff --git a/parser/html/javasrc/TreeBuilder.java b/parser/html/javasrc/TreeBuilder.java
index 9589dc8b11c..e6c3468c559 100644
--- a/parser/html/javasrc/TreeBuilder.java
+++ b/parser/html/javasrc/TreeBuilder.java
@@ -448,6 +448,8 @@ public abstract class TreeBuilder<T> implements TokenHandler,
 
     private boolean quirks = false;
 
+    private boolean isSrcdocDocument = false;
+
     // [NOCPP[
 
     private boolean reportingDoctype = true;
@@ -4158,6 +4160,21 @@ public abstract class TreeBuilder<T> implements TokenHandler,
     private void documentModeInternal(DocumentMode m, String publicIdentifier,
             String systemIdentifier, boolean html4SpecificAdditionalErrorChecks)
             throws SAXException {
+
+        if (isSrcdocDocument) {
+            // Srcdoc documents are always rendered in standards mode.
+            quirks = false;
+            if (documentModeHandler != null) {
+                documentModeHandler.documentMode(
+                        DocumentMode.STANDARDS_MODE
+                        // [NOCPP[
+                        , null, null, false
+                // ]NOCPP]
+                );
+            }
+            return;
+        }
+
         quirks = (m == DocumentMode.QUIRKS_MODE);
         if (documentModeHandler != null) {
             documentModeHandler.documentMode(
@@ -5531,6 +5548,10 @@ public abstract class TreeBuilder<T> implements TokenHandler,
         this.scriptingEnabled = scriptingEnabled;
     }
 
+    public void setIsSrcdocDocument(boolean isSrcdocDocument) {
+        this.isSrcdocDocument = isSrcdocDocument;
+    }
+
     // [NOCPP[
 
     /**
@@ -5951,11 +5972,15 @@ public abstract class TreeBuilder<T> implements TokenHandler,
     }
 
     private void errAlmostStandardsDoctype() throws SAXException {
-        err("Almost standards mode doctype. Expected \u201C<!DOCTYPE html>\u201D.");
+        if (!isSrcdocDocument) {
+            err("Almost standards mode doctype. Expected \u201C<!DOCTYPE html>\u201D.");
+        }
     }
 
     private void errQuirkyDoctype() throws SAXException {
-        err("Quirky doctype. Expected \u201C<!DOCTYPE html>\u201D.");
+        if (!isSrcdocDocument) {
+            err("Quirky doctype. Expected \u201C<!DOCTYPE html>\u201D.");
+        }
     }
 
     private void errNonSpaceInTrailer() throws SAXException {
@@ -5990,7 +6015,9 @@ public abstract class TreeBuilder<T> implements TokenHandler,
     }
 
     private void errStartTagWithoutDoctype() throws SAXException {
-        err("Start tag seen without seeing a doctype first. Expected \u201C<!DOCTYPE html>\u201D.");
+        if (!isSrcdocDocument) {
+            err("Start tag seen without seeing a doctype first. Expected \u201C<!DOCTYPE html>\u201D.");
+        }
     }
 
     private void errNoSelectInTableScope() throws SAXException {
@@ -6069,7 +6096,9 @@ public abstract class TreeBuilder<T> implements TokenHandler,
     }
 
     private void errEndTagSeenWithoutDoctype() throws SAXException {
-        err("End tag seen without seeing a doctype first. Expected \u201C<!DOCTYPE html>\u201D.");
+        if (!isSrcdocDocument) {
+            err("End tag seen without seeing a doctype first. Expected \u201C<!DOCTYPE html>\u201D.");
+        }
     }
 
     private void errEndTagAfterBody() throws SAXException {
diff --git a/parser/html/nsHtml5AtomList.h b/parser/html/nsHtml5AtomList.h
index e3eda0bbae2..3e778010df8 100644
--- a/parser/html/nsHtml5AtomList.h
+++ b/parser/html/nsHtml5AtomList.h
@@ -226,6 +226,7 @@ HTML5_ATOM(vspace, "vspace")
 HTML5_ATOM(poster, "poster")
 HTML5_ATOM(points, "points")
 HTML5_ATOM(prompt, "prompt")
+HTML5_ATOM(srcdoc, "srcdoc")
 HTML5_ATOM(scoped, "scoped")
 HTML5_ATOM(string, "string")
 HTML5_ATOM(scheme, "scheme")
diff --git a/parser/html/nsHtml5AttributeName.cpp b/parser/html/nsHtml5AttributeName.cpp
index 778c794f039..6416e503ed0 100644
--- a/parser/html/nsHtml5AttributeName.cpp
+++ b/parser/html/nsHtml5AttributeName.cpp
@@ -359,6 +359,7 @@ nsHtml5AttributeName* nsHtml5AttributeName::ATTR_VSPACE = nullptr;
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_POSTER = nullptr;
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_POINTS = nullptr;
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_PROMPT = nullptr;
+nsHtml5AttributeName* nsHtml5AttributeName::ATTR_SRCDOC = nullptr;
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_SCOPED = nullptr;
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_STRING = nullptr;
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_SCHEME = nullptr;
@@ -775,7 +776,7 @@ nsHtml5AttributeName* nsHtml5AttributeName::ATTR_GLYPH_ORIENTATION_VERTICAL = nu
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_COLOR_INTERPOLATION_FILTERS = nullptr;
 nsHtml5AttributeName* nsHtml5AttributeName::ATTR_GLYPH_ORIENTATION_HORIZONTAL = nullptr;
 nsHtml5AttributeName** nsHtml5AttributeName::ATTRIBUTE_NAMES = 0;
-static int32_t const ATTRIBUTE_HASHES_DATA[] = { 1153, 1383, 1601, 1793, 1827, 1857, 68600, 69146, 69177, 70237, 70270, 71572, 71669, 72415, 72444, 74846, 74904, 74943, 75001, 75276, 75590, 84742, 84839, 85575, 85963, 85992, 87204, 88074, 88171, 89130, 89163, 3207892, 3283895, 3284791, 3338752, 3358197, 3369562, 3539124, 3562402, 3574260, 3670335, 3696933, 3721879, 135280021, 135346322, 136317019, 136475749, 136548517, 136652214, 136884919, 136902418, 136942992, 137292068, 139120259, 139785574, 142250603, 142314056, 142331176, 142519584, 144752417, 145106895, 146147200, 146765926, 148805544, 149655723, 149809441, 150018784, 150445028, 150813181, 150923321, 152528754, 152536216, 152647366, 152962785, 155219321, 155654904, 157317483, 157350248, 157437941, 157447478, 157604838, 157685404, 157894402, 158315188, 166078431, 169409980, 169700259, 169856932, 170007032, 170409695, 170466488, 170513710, 170608367, 173028944, 173896963, 176090625, 176129212, 179390001, 179489057, 179627464, 179840468, 179849042, 180004216, 181779081, 183027151, 183645319, 183698797, 185922012, 185997252, 188312483, 188675799, 190977533, 190992569, 191006194, 191033518, 191038774, 191096249, 191166163, 191194426, 191522106, 191568039, 200104642, 202506661, 202537381, 202602917, 203070590, 203120766, 203389054, 203690071, 203971238, 203986524, 209040857, 209125756, 212055489, 212322418, 212746849, 213002877, 213055164, 213088023, 213259873, 213273386, 213435118, 213437318, 213438231, 213493071, 213532268, 213542834, 213584431, 213659891, 215285828, 215880731, 216112976, 216684637, 217369699, 217565298, 217576549, 218186795, 219743185, 220082234, 221623802, 221986406, 222283890, 223089542, 223138630, 223311265, 224547358, 224587256, 224589550, 224655650, 224785518, 224810917, 224813302, 225429618, 225432950, 225440869, 236107233, 236709921, 236838947, 237117095, 237143271, 237172455, 237209953, 237354143, 237372743, 237668065, 237703073, 237714273, 239743521, 240512803, 240522627, 240560417, 240656513, 241015715, 241062755, 241065383, 243523041, 245865199, 246261793, 246556195, 246774817, 246923491, 246928419, 246981667, 247014847, 247058369, 247112833, 247118177, 247119137, 247128739, 247316903, 249533729, 250235623, 250269543, 251402351, 252339047, 253260911, 253293679, 254844367, 255547879, 256077281, 256345377, 258124199, 258354465, 258605063, 258744193, 258845603, 258856961, 258926689, 269869248, 270174334, 270709417, 270778994, 270781796, 271102503, 271478858, 271490090, 272870654, 273335275, 273369140, 273924313, 274108530, 274116736, 276818662, 277476156, 279156579, 279349675, 280108533, 280128712, 280132869, 280162403, 280280292, 280413430, 280506130, 280677397, 280678580, 280686710, 280689066, 282736758, 283110901, 283275116, 283823226, 283890012, 284479340, 284606461, 286700477, 286798916, 291557706, 291665349, 291804100, 292138018, 292166446, 292418738, 292451039, 300298041, 300374839, 300597935, 303073389, 303083839, 303266673, 303354997, 303430688, 303576261, 303724281, 303819694, 304242723, 304382625, 306247792, 307227811, 307468786, 307724489, 309671175, 310252031, 310358241, 310373094, 311015256, 313357609, 313683893, 313701861, 313706996, 313707317, 313710350, 314027746, 314038181, 314091299, 314205627, 314233813, 316741830, 316797986, 317486755, 317794164, 320076137, 322657125, 322887778, 323506876, 323572412, 323605180, 325060058, 325320188, 325398738, 325541490, 325671619, 333868843, 336806130, 337212108, 337282686, 337285434, 337585223, 338036037, 338298087, 338566051, 340943551, 341190970, 342995704, 343352124, 343912673, 344585053, 346977248, 347218098, 347262163, 347278576, 347438191, 347655959, 347684788, 347726430, 347727772, 347776035, 347776629, 349500753, 350880161, 350887073, 353384123, 355496998, 355906922, 355979793, 356545959, 358637867, 358905016, 359164318, 359247286, 359350571, 359579447, 365560330, 367399355, 367420285, 367510727, 368013212, 370234760, 370353345, 370710317, 371074566, 371122285, 371194213, 371448425, 371448430, 371545055, 371593469, 371596922, 371758751, 371964792, 372151328, 376550136, 376710172, 376795771, 376826271, 376906556, 380514830, 380774774, 380775037, 381030322, 381136500, 381281631, 381282269, 381285504, 381330595, 381331422, 381335911, 381336484, 383907298, 383917408, 384595009, 384595013, 387799894, 387823201, 392581647, 392584937, 392742684, 392906485, 393003349, 400644707, 400973830, 404428547, 404432113, 404432865, 404469244, 404478897, 404694860, 406887479, 408294949, 408789955, 410022510, 410467324, 410586448, 410945965, 411845275, 414327152, 414327932, 414329781, 414346257, 414346439, 414639928, 414835998, 414894517, 414986533, 417465377, 417465381, 417492216, 418259232, 419310946, 420103495, 420242342, 420380455, 420658662, 420717432, 423183880, 424539259, 425929170, 425972964, 426050649, 426126450, 426142833, 426607922, 437289840, 437347469, 437412335, 437423943, 437455540, 437462252, 437597991, 437617485, 437986305, 437986507, 437986828, 437987072, 438015591, 438034813, 438038966, 438179623, 438347971, 438483573, 438547062, 438895551, 441592676, 442032555, 443548979, 447881379, 447881655, 447881895, 447887844, 448416189, 448445746, 448449012, 450942191, 452816744, 453668677, 454434495, 456610076, 456642844, 456738709, 457544600, 459451897, 459680944, 468058810, 468083581, 470964084, 471470955, 471567278, 472267822, 481177859, 481210627, 481435874, 481455115, 481485378, 481490218, 485105638, 486005878, 486383494, 487988916, 488103783, 490661867, 491574090, 491578272, 493041952, 493441205, 493582844, 493716979, 504577572, 504740359, 505091638, 505592418, 505656212, 509516275, 514998531, 515571132, 515594682, 518712698, 521362273, 526592419, 526807354, 527348842, 538294791, 539214049, 544689535, 545535009, 548544752, 548563346, 548595116, 551679010, 558034099, 560329411, 560356209, 560671018, 560671152, 560692590, 560845442, 569212097, 569474241, 572252718, 572768481, 575326764, 576174758, 576190819, 582099184, 582099438, 582372519, 582558889, 586552164, 591325418, 594231990, 594243961, 605711268, 615672071, 616086845, 621792370, 624879850, 627432831, 640040548, 654392808, 658675477, 659420283, 672891587, 694768102, 705890982, 725543146, 759097578, 761686526, 795383908, 843809551, 878105336, 908643300, 945213471 };
+static int32_t const ATTRIBUTE_HASHES_DATA[] = { 1153, 1383, 1601, 1793, 1827, 1857, 68600, 69146, 69177, 70237, 70270, 71572, 71669, 72415, 72444, 74846, 74904, 74943, 75001, 75276, 75590, 84742, 84839, 85575, 85963, 85992, 87204, 88074, 88171, 89130, 89163, 3207892, 3283895, 3284791, 3338752, 3358197, 3369562, 3539124, 3562402, 3574260, 3670335, 3696933, 3721879, 135280021, 135346322, 136317019, 136475749, 136548517, 136652214, 136884919, 136902418, 136942992, 137292068, 139120259, 139785574, 142250603, 142314056, 142331176, 142519584, 144752417, 145106895, 146147200, 146765926, 148805544, 149655723, 149809441, 150018784, 150445028, 150813181, 150923321, 152528754, 152536216, 152647366, 152962785, 155219321, 155654904, 157317483, 157350248, 157437941, 157447478, 157604838, 157685404, 157894402, 158315188, 166078431, 169409980, 169700259, 169856932, 170007032, 170409695, 170466488, 170513710, 170608367, 173028944, 173896963, 176090625, 176129212, 179390001, 179489057, 179627464, 179840468, 179849042, 180004216, 181779081, 183027151, 183645319, 183698797, 185922012, 185997252, 188312483, 188675799, 190977533, 190992569, 191006194, 191033518, 191038774, 191096249, 191166163, 191194426, 191522106, 191568039, 200104642, 202506661, 202537381, 202602917, 203070590, 203120766, 203389054, 203690071, 203971238, 203986524, 209040857, 209125756, 212055489, 212322418, 212746849, 213002877, 213055164, 213088023, 213259873, 213273386, 213435118, 213437318, 213438231, 213493071, 213532268, 213542834, 213584431, 213659891, 215285828, 215880731, 216112976, 216684637, 217369699, 217565298, 217576549, 218186795, 219743185, 220082234, 221623802, 221986406, 222283890, 223089542, 223138630, 223311265, 224431494, 224547358, 224587256, 224589550, 224655650, 224785518, 224810917, 224813302, 225429618, 225432950, 225440869, 236107233, 236709921, 236838947, 237117095, 237143271, 237172455, 237209953, 237354143, 237372743, 237668065, 237703073, 237714273, 239743521, 240512803, 240522627, 240560417, 240656513, 241015715, 241062755, 241065383, 243523041, 245865199, 246261793, 246556195, 246774817, 246923491, 246928419, 246981667, 247014847, 247058369, 247112833, 247118177, 247119137, 247128739, 247316903, 249533729, 250235623, 250269543, 251402351, 252339047, 253260911, 253293679, 254844367, 255547879, 256077281, 256345377, 258124199, 258354465, 258605063, 258744193, 258845603, 258856961, 258926689, 269869248, 270174334, 270709417, 270778994, 270781796, 271102503, 271478858, 271490090, 272870654, 273335275, 273369140, 273924313, 274108530, 274116736, 276818662, 277476156, 279156579, 279349675, 280108533, 280128712, 280132869, 280162403, 280280292, 280413430, 280506130, 280677397, 280678580, 280686710, 280689066, 282736758, 283110901, 283275116, 283823226, 283890012, 284479340, 284606461, 286700477, 286798916, 291557706, 291665349, 291804100, 292138018, 292166446, 292418738, 292451039, 300298041, 300374839, 300597935, 303073389, 303083839, 303266673, 303354997, 303430688, 303576261, 303724281, 303819694, 304242723, 304382625, 306247792, 307227811, 307468786, 307724489, 309671175, 310252031, 310358241, 310373094, 311015256, 313357609, 313683893, 313701861, 313706996, 313707317, 313710350, 314027746, 314038181, 314091299, 314205627, 314233813, 316741830, 316797986, 317486755, 317794164, 320076137, 322657125, 322887778, 323506876, 323572412, 323605180, 325060058, 325320188, 325398738, 325541490, 325671619, 333868843, 336806130, 337212108, 337282686, 337285434, 337585223, 338036037, 338298087, 338566051, 340943551, 341190970, 342995704, 343352124, 343912673, 344585053, 346977248, 347218098, 347262163, 347278576, 347438191, 347655959, 347684788, 347726430, 347727772, 347776035, 347776629, 349500753, 350880161, 350887073, 353384123, 355496998, 355906922, 355979793, 356545959, 358637867, 358905016, 359164318, 359247286, 359350571, 359579447, 365560330, 367399355, 367420285, 367510727, 368013212, 370234760, 370353345, 370710317, 371074566, 371122285, 371194213, 371448425, 371448430, 371545055, 371593469, 371596922, 371758751, 371964792, 372151328, 376550136, 376710172, 376795771, 376826271, 376906556, 380514830, 380774774, 380775037, 381030322, 381136500, 381281631, 381282269, 381285504, 381330595, 381331422, 381335911, 381336484, 383907298, 383917408, 384595009, 384595013, 387799894, 387823201, 392581647, 392584937, 392742684, 392906485, 393003349, 400644707, 400973830, 404428547, 404432113, 404432865, 404469244, 404478897, 404694860, 406887479, 408294949, 408789955, 410022510, 410467324, 410586448, 410945965, 411845275, 414327152, 414327932, 414329781, 414346257, 414346439, 414639928, 414835998, 414894517, 414986533, 417465377, 417465381, 417492216, 418259232, 419310946, 420103495, 420242342, 420380455, 420658662, 420717432, 423183880, 424539259, 425929170, 425972964, 426050649, 426126450, 426142833, 426607922, 437289840, 437347469, 437412335, 437423943, 437455540, 437462252, 437597991, 437617485, 437986305, 437986507, 437986828, 437987072, 438015591, 438034813, 438038966, 438179623, 438347971, 438483573, 438547062, 438895551, 441592676, 442032555, 443548979, 447881379, 447881655, 447881895, 447887844, 448416189, 448445746, 448449012, 450942191, 452816744, 453668677, 454434495, 456610076, 456642844, 456738709, 457544600, 459451897, 459680944, 468058810, 468083581, 470964084, 471470955, 471567278, 472267822, 481177859, 481210627, 481435874, 481455115, 481485378, 481490218, 485105638, 486005878, 486383494, 487988916, 488103783, 490661867, 491574090, 491578272, 493041952, 493441205, 493582844, 493716979, 504577572, 504740359, 505091638, 505592418, 505656212, 509516275, 514998531, 515571132, 515594682, 518712698, 521362273, 526592419, 526807354, 527348842, 538294791, 539214049, 544689535, 545535009, 548544752, 548563346, 548595116, 551679010, 558034099, 560329411, 560356209, 560671018, 560671152, 560692590, 560845442, 569212097, 569474241, 572252718, 572768481, 575326764, 576174758, 576190819, 582099184, 582099438, 582372519, 582558889, 586552164, 591325418, 594231990, 594243961, 605711268, 615672071, 616086845, 621792370, 624879850, 627432831, 640040548, 654392808, 658675477, 659420283, 672891587, 694768102, 705890982, 725543146, 759097578, 761686526, 795383908, 843809551, 878105336, 908643300, 945213471 };
 staticJArray<int32_t,int32_t> nsHtml5AttributeName::ATTRIBUTE_HASHES = { ATTRIBUTE_HASHES_DATA, MOZ_ARRAY_LENGTH(ATTRIBUTE_HASHES_DATA) };
 void
 nsHtml5AttributeName::initializeStatics()
@@ -977,6 +978,7 @@ nsHtml5AttributeName::initializeStatics()
   ATTR_POSTER = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::poster), ALL_NO_PREFIX);
   ATTR_POINTS = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::points), ALL_NO_PREFIX);
   ATTR_PROMPT = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::prompt), ALL_NO_PREFIX);
+  ATTR_SRCDOC = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::srcdoc), ALL_NO_PREFIX);
   ATTR_SCOPED = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::scoped), ALL_NO_PREFIX);
   ATTR_STRING = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::string), ALL_NO_PREFIX);
   ATTR_SCHEME = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::scheme), ALL_NO_PREFIX);
@@ -1392,7 +1394,7 @@ nsHtml5AttributeName::initializeStatics()
   ATTR_GLYPH_ORIENTATION_VERTICAL = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::glyph_orientation_vertical), ALL_NO_PREFIX);
   ATTR_COLOR_INTERPOLATION_FILTERS = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::color_interpolation_filters), ALL_NO_PREFIX);
   ATTR_GLYPH_ORIENTATION_HORIZONTAL = new nsHtml5AttributeName(ALL_NO_NS, SAME_LOCAL(nsHtml5Atoms::glyph_orientation_horizontal), ALL_NO_PREFIX);
-  ATTRIBUTE_NAMES = new nsHtml5AttributeName*[580];
+  ATTRIBUTE_NAMES = new nsHtml5AttributeName*[581];
   ATTRIBUTE_NAMES[0] = ATTR_D;
   ATTRIBUTE_NAMES[1] = ATTR_K;
   ATTRIBUTE_NAMES[2] = ATTR_R;
@@ -1558,421 +1560,422 @@ nsHtml5AttributeName::initializeStatics()
   ATTRIBUTE_NAMES[162] = ATTR_POSTER;
   ATTRIBUTE_NAMES[163] = ATTR_POINTS;
   ATTRIBUTE_NAMES[164] = ATTR_PROMPT;
-  ATTRIBUTE_NAMES[165] = ATTR_SCOPED;
-  ATTRIBUTE_NAMES[166] = ATTR_STRING;
-  ATTRIBUTE_NAMES[167] = ATTR_SCHEME;
-  ATTRIBUTE_NAMES[168] = ATTR_STROKE;
-  ATTRIBUTE_NAMES[169] = ATTR_RADIUS;
-  ATTRIBUTE_NAMES[170] = ATTR_RESULT;
-  ATTRIBUTE_NAMES[171] = ATTR_REPEAT;
-  ATTRIBUTE_NAMES[172] = ATTR_RSPACE;
-  ATTRIBUTE_NAMES[173] = ATTR_ROTATE;
-  ATTRIBUTE_NAMES[174] = ATTR_RQUOTE;
-  ATTRIBUTE_NAMES[175] = ATTR_ALTTEXT;
-  ATTRIBUTE_NAMES[176] = ATTR_ARCHIVE;
-  ATTRIBUTE_NAMES[177] = ATTR_AZIMUTH;
-  ATTRIBUTE_NAMES[178] = ATTR_CLOSURE;
-  ATTRIBUTE_NAMES[179] = ATTR_CHECKED;
-  ATTRIBUTE_NAMES[180] = ATTR_CLASSID;
-  ATTRIBUTE_NAMES[181] = ATTR_CHAROFF;
-  ATTRIBUTE_NAMES[182] = ATTR_BGCOLOR;
-  ATTRIBUTE_NAMES[183] = ATTR_COLSPAN;
-  ATTRIBUTE_NAMES[184] = ATTR_CHARSET;
-  ATTRIBUTE_NAMES[185] = ATTR_COMPACT;
-  ATTRIBUTE_NAMES[186] = ATTR_CONTENT;
-  ATTRIBUTE_NAMES[187] = ATTR_ENCTYPE;
-  ATTRIBUTE_NAMES[188] = ATTR_DATASRC;
-  ATTRIBUTE_NAMES[189] = ATTR_DATAFLD;
-  ATTRIBUTE_NAMES[190] = ATTR_DECLARE;
-  ATTRIBUTE_NAMES[191] = ATTR_DISPLAY;
-  ATTRIBUTE_NAMES[192] = ATTR_DIVISOR;
-  ATTRIBUTE_NAMES[193] = ATTR_DEFAULT;
-  ATTRIBUTE_NAMES[194] = ATTR_DESCENT;
-  ATTRIBUTE_NAMES[195] = ATTR_KERNING;
-  ATTRIBUTE_NAMES[196] = ATTR_HANGING;
-  ATTRIBUTE_NAMES[197] = ATTR_HEADERS;
-  ATTRIBUTE_NAMES[198] = ATTR_ONPASTE;
-  ATTRIBUTE_NAMES[199] = ATTR_ONCLICK;
-  ATTRIBUTE_NAMES[200] = ATTR_OPTIMUM;
-  ATTRIBUTE_NAMES[201] = ATTR_ONBEGIN;
-  ATTRIBUTE_NAMES[202] = ATTR_ONKEYUP;
-  ATTRIBUTE_NAMES[203] = ATTR_ONFOCUS;
-  ATTRIBUTE_NAMES[204] = ATTR_ONERROR;
-  ATTRIBUTE_NAMES[205] = ATTR_ONINPUT;
-  ATTRIBUTE_NAMES[206] = ATTR_ONABORT;
-  ATTRIBUTE_NAMES[207] = ATTR_ONSTART;
-  ATTRIBUTE_NAMES[208] = ATTR_ONRESET;
-  ATTRIBUTE_NAMES[209] = ATTR_OPACITY;
-  ATTRIBUTE_NAMES[210] = ATTR_NOSHADE;
-  ATTRIBUTE_NAMES[211] = ATTR_MINSIZE;
-  ATTRIBUTE_NAMES[212] = ATTR_MAXSIZE;
-  ATTRIBUTE_NAMES[213] = ATTR_LARGEOP;
-  ATTRIBUTE_NAMES[214] = ATTR_UNICODE;
-  ATTRIBUTE_NAMES[215] = ATTR_TARGETX;
-  ATTRIBUTE_NAMES[216] = ATTR_TARGETY;
-  ATTRIBUTE_NAMES[217] = ATTR_VIEWBOX;
-  ATTRIBUTE_NAMES[218] = ATTR_VERSION;
-  ATTRIBUTE_NAMES[219] = ATTR_PATTERN;
-  ATTRIBUTE_NAMES[220] = ATTR_PROFILE;
-  ATTRIBUTE_NAMES[221] = ATTR_SPACING;
-  ATTRIBUTE_NAMES[222] = ATTR_RESTART;
-  ATTRIBUTE_NAMES[223] = ATTR_ROWSPAN;
-  ATTRIBUTE_NAMES[224] = ATTR_SANDBOX;
-  ATTRIBUTE_NAMES[225] = ATTR_SUMMARY;
-  ATTRIBUTE_NAMES[226] = ATTR_STANDBY;
-  ATTRIBUTE_NAMES[227] = ATTR_REPLACE;
-  ATTRIBUTE_NAMES[228] = ATTR_AUTOPLAY;
-  ATTRIBUTE_NAMES[229] = ATTR_ADDITIVE;
-  ATTRIBUTE_NAMES[230] = ATTR_CALCMODE;
-  ATTRIBUTE_NAMES[231] = ATTR_CODETYPE;
-  ATTRIBUTE_NAMES[232] = ATTR_CODEBASE;
-  ATTRIBUTE_NAMES[233] = ATTR_CONTROLS;
-  ATTRIBUTE_NAMES[234] = ATTR_BEVELLED;
-  ATTRIBUTE_NAMES[235] = ATTR_BASELINE;
-  ATTRIBUTE_NAMES[236] = ATTR_EXPONENT;
-  ATTRIBUTE_NAMES[237] = ATTR_EDGEMODE;
-  ATTRIBUTE_NAMES[238] = ATTR_ENCODING;
-  ATTRIBUTE_NAMES[239] = ATTR_GLYPHREF;
-  ATTRIBUTE_NAMES[240] = ATTR_DATETIME;
-  ATTRIBUTE_NAMES[241] = ATTR_DISABLED;
-  ATTRIBUTE_NAMES[242] = ATTR_FONTSIZE;
-  ATTRIBUTE_NAMES[243] = ATTR_KEYTIMES;
-  ATTRIBUTE_NAMES[244] = ATTR_PANOSE_1;
-  ATTRIBUTE_NAMES[245] = ATTR_HREFLANG;
-  ATTRIBUTE_NAMES[246] = ATTR_ONRESIZE;
-  ATTRIBUTE_NAMES[247] = ATTR_ONCHANGE;
-  ATTRIBUTE_NAMES[248] = ATTR_ONBOUNCE;
-  ATTRIBUTE_NAMES[249] = ATTR_ONUNLOAD;
-  ATTRIBUTE_NAMES[250] = ATTR_ONFINISH;
-  ATTRIBUTE_NAMES[251] = ATTR_ONSCROLL;
-  ATTRIBUTE_NAMES[252] = ATTR_OPERATOR;
-  ATTRIBUTE_NAMES[253] = ATTR_OVERFLOW;
-  ATTRIBUTE_NAMES[254] = ATTR_ONSUBMIT;
-  ATTRIBUTE_NAMES[255] = ATTR_ONREPEAT;
-  ATTRIBUTE_NAMES[256] = ATTR_ONSELECT;
-  ATTRIBUTE_NAMES[257] = ATTR_NOTATION;
-  ATTRIBUTE_NAMES[258] = ATTR_NORESIZE;
-  ATTRIBUTE_NAMES[259] = ATTR_MANIFEST;
-  ATTRIBUTE_NAMES[260] = ATTR_MATHSIZE;
-  ATTRIBUTE_NAMES[261] = ATTR_MULTIPLE;
-  ATTRIBUTE_NAMES[262] = ATTR_LONGDESC;
-  ATTRIBUTE_NAMES[263] = ATTR_LANGUAGE;
-  ATTRIBUTE_NAMES[264] = ATTR_TEMPLATE;
-  ATTRIBUTE_NAMES[265] = ATTR_TABINDEX;
-  ATTRIBUTE_NAMES[266] = ATTR_READONLY;
-  ATTRIBUTE_NAMES[267] = ATTR_SELECTED;
-  ATTRIBUTE_NAMES[268] = ATTR_ROWLINES;
-  ATTRIBUTE_NAMES[269] = ATTR_SEAMLESS;
-  ATTRIBUTE_NAMES[270] = ATTR_ROWALIGN;
-  ATTRIBUTE_NAMES[271] = ATTR_STRETCHY;
-  ATTRIBUTE_NAMES[272] = ATTR_REQUIRED;
-  ATTRIBUTE_NAMES[273] = ATTR_XML_BASE;
-  ATTRIBUTE_NAMES[274] = ATTR_XML_LANG;
-  ATTRIBUTE_NAMES[275] = ATTR_X_HEIGHT;
-  ATTRIBUTE_NAMES[276] = ATTR_ARIA_OWNS;
-  ATTRIBUTE_NAMES[277] = ATTR_AUTOFOCUS;
-  ATTRIBUTE_NAMES[278] = ATTR_ARIA_SORT;
-  ATTRIBUTE_NAMES[279] = ATTR_ACCESSKEY;
-  ATTRIBUTE_NAMES[280] = ATTR_ARIA_BUSY;
-  ATTRIBUTE_NAMES[281] = ATTR_ARIA_GRAB;
-  ATTRIBUTE_NAMES[282] = ATTR_AMPLITUDE;
-  ATTRIBUTE_NAMES[283] = ATTR_ARIA_LIVE;
-  ATTRIBUTE_NAMES[284] = ATTR_CLIP_RULE;
-  ATTRIBUTE_NAMES[285] = ATTR_CLIP_PATH;
-  ATTRIBUTE_NAMES[286] = ATTR_EQUALROWS;
-  ATTRIBUTE_NAMES[287] = ATTR_ELEVATION;
-  ATTRIBUTE_NAMES[288] = ATTR_DIRECTION;
-  ATTRIBUTE_NAMES[289] = ATTR_DRAGGABLE;
-  ATTRIBUTE_NAMES[290] = ATTR_FILTERRES;
-  ATTRIBUTE_NAMES[291] = ATTR_FILL_RULE;
-  ATTRIBUTE_NAMES[292] = ATTR_FONTSTYLE;
-  ATTRIBUTE_NAMES[293] = ATTR_FONT_SIZE;
-  ATTRIBUTE_NAMES[294] = ATTR_KEYPOINTS;
-  ATTRIBUTE_NAMES[295] = ATTR_HIDEFOCUS;
-  ATTRIBUTE_NAMES[296] = ATTR_ONMESSAGE;
-  ATTRIBUTE_NAMES[297] = ATTR_INTERCEPT;
-  ATTRIBUTE_NAMES[298] = ATTR_ONDRAGEND;
-  ATTRIBUTE_NAMES[299] = ATTR_ONMOVEEND;
-  ATTRIBUTE_NAMES[300] = ATTR_ONINVALID;
-  ATTRIBUTE_NAMES[301] = ATTR_ONKEYDOWN;
-  ATTRIBUTE_NAMES[302] = ATTR_ONFOCUSIN;
-  ATTRIBUTE_NAMES[303] = ATTR_ONMOUSEUP;
-  ATTRIBUTE_NAMES[304] = ATTR_INPUTMODE;
-  ATTRIBUTE_NAMES[305] = ATTR_ONROWEXIT;
-  ATTRIBUTE_NAMES[306] = ATTR_MATHCOLOR;
-  ATTRIBUTE_NAMES[307] = ATTR_MASKUNITS;
-  ATTRIBUTE_NAMES[308] = ATTR_MAXLENGTH;
-  ATTRIBUTE_NAMES[309] = ATTR_LINEBREAK;
-  ATTRIBUTE_NAMES[310] = ATTR_TRANSFORM;
-  ATTRIBUTE_NAMES[311] = ATTR_V_HANGING;
-  ATTRIBUTE_NAMES[312] = ATTR_VALUETYPE;
-  ATTRIBUTE_NAMES[313] = ATTR_POINTSATZ;
-  ATTRIBUTE_NAMES[314] = ATTR_POINTSATX;
-  ATTRIBUTE_NAMES[315] = ATTR_POINTSATY;
-  ATTRIBUTE_NAMES[316] = ATTR_SYMMETRIC;
-  ATTRIBUTE_NAMES[317] = ATTR_SCROLLING;
-  ATTRIBUTE_NAMES[318] = ATTR_REPEATDUR;
-  ATTRIBUTE_NAMES[319] = ATTR_SELECTION;
-  ATTRIBUTE_NAMES[320] = ATTR_SEPARATOR;
-  ATTRIBUTE_NAMES[321] = ATTR_XML_SPACE;
-  ATTRIBUTE_NAMES[322] = ATTR_AUTOSUBMIT;
-  ATTRIBUTE_NAMES[323] = ATTR_ALPHABETIC;
-  ATTRIBUTE_NAMES[324] = ATTR_ACTIONTYPE;
-  ATTRIBUTE_NAMES[325] = ATTR_ACCUMULATE;
-  ATTRIBUTE_NAMES[326] = ATTR_ARIA_LEVEL;
-  ATTRIBUTE_NAMES[327] = ATTR_COLUMNSPAN;
-  ATTRIBUTE_NAMES[328] = ATTR_CAP_HEIGHT;
-  ATTRIBUTE_NAMES[329] = ATTR_BACKGROUND;
-  ATTRIBUTE_NAMES[330] = ATTR_GLYPH_NAME;
-  ATTRIBUTE_NAMES[331] = ATTR_GROUPALIGN;
-  ATTRIBUTE_NAMES[332] = ATTR_FONTFAMILY;
-  ATTRIBUTE_NAMES[333] = ATTR_FONTWEIGHT;
-  ATTRIBUTE_NAMES[334] = ATTR_FONT_STYLE;
-  ATTRIBUTE_NAMES[335] = ATTR_KEYSPLINES;
-  ATTRIBUTE_NAMES[336] = ATTR_HTTP_EQUIV;
-  ATTRIBUTE_NAMES[337] = ATTR_ONACTIVATE;
-  ATTRIBUTE_NAMES[338] = ATTR_OCCURRENCE;
-  ATTRIBUTE_NAMES[339] = ATTR_IRRELEVANT;
-  ATTRIBUTE_NAMES[340] = ATTR_ONDBLCLICK;
-  ATTRIBUTE_NAMES[341] = ATTR_ONDRAGDROP;
-  ATTRIBUTE_NAMES[342] = ATTR_ONKEYPRESS;
-  ATTRIBUTE_NAMES[343] = ATTR_ONROWENTER;
-  ATTRIBUTE_NAMES[344] = ATTR_ONDRAGOVER;
-  ATTRIBUTE_NAMES[345] = ATTR_ONFOCUSOUT;
-  ATTRIBUTE_NAMES[346] = ATTR_ONMOUSEOUT;
-  ATTRIBUTE_NAMES[347] = ATTR_NUMOCTAVES;
-  ATTRIBUTE_NAMES[348] = ATTR_MARKER_MID;
-  ATTRIBUTE_NAMES[349] = ATTR_MARKER_END;
-  ATTRIBUTE_NAMES[350] = ATTR_TEXTLENGTH;
-  ATTRIBUTE_NAMES[351] = ATTR_VISIBILITY;
-  ATTRIBUTE_NAMES[352] = ATTR_VIEWTARGET;
-  ATTRIBUTE_NAMES[353] = ATTR_VERT_ADV_Y;
-  ATTRIBUTE_NAMES[354] = ATTR_PATHLENGTH;
-  ATTRIBUTE_NAMES[355] = ATTR_REPEAT_MAX;
-  ATTRIBUTE_NAMES[356] = ATTR_RADIOGROUP;
-  ATTRIBUTE_NAMES[357] = ATTR_STOP_COLOR;
-  ATTRIBUTE_NAMES[358] = ATTR_SEPARATORS;
-  ATTRIBUTE_NAMES[359] = ATTR_REPEAT_MIN;
-  ATTRIBUTE_NAMES[360] = ATTR_ROWSPACING;
-  ATTRIBUTE_NAMES[361] = ATTR_ZOOMANDPAN;
-  ATTRIBUTE_NAMES[362] = ATTR_XLINK_TYPE;
-  ATTRIBUTE_NAMES[363] = ATTR_XLINK_ROLE;
-  ATTRIBUTE_NAMES[364] = ATTR_XLINK_HREF;
-  ATTRIBUTE_NAMES[365] = ATTR_XLINK_SHOW;
-  ATTRIBUTE_NAMES[366] = ATTR_ACCENTUNDER;
-  ATTRIBUTE_NAMES[367] = ATTR_ARIA_SECRET;
-  ATTRIBUTE_NAMES[368] = ATTR_ARIA_ATOMIC;
-  ATTRIBUTE_NAMES[369] = ATTR_ARIA_HIDDEN;
-  ATTRIBUTE_NAMES[370] = ATTR_ARIA_FLOWTO;
-  ATTRIBUTE_NAMES[371] = ATTR_ARABIC_FORM;
-  ATTRIBUTE_NAMES[372] = ATTR_CELLPADDING;
-  ATTRIBUTE_NAMES[373] = ATTR_CELLSPACING;
-  ATTRIBUTE_NAMES[374] = ATTR_COLUMNWIDTH;
-  ATTRIBUTE_NAMES[375] = ATTR_CROSSORIGIN;
-  ATTRIBUTE_NAMES[376] = ATTR_COLUMNALIGN;
-  ATTRIBUTE_NAMES[377] = ATTR_COLUMNLINES;
-  ATTRIBUTE_NAMES[378] = ATTR_CONTEXTMENU;
-  ATTRIBUTE_NAMES[379] = ATTR_BASEPROFILE;
-  ATTRIBUTE_NAMES[380] = ATTR_FONT_FAMILY;
-  ATTRIBUTE_NAMES[381] = ATTR_FRAMEBORDER;
-  ATTRIBUTE_NAMES[382] = ATTR_FILTERUNITS;
-  ATTRIBUTE_NAMES[383] = ATTR_FLOOD_COLOR;
-  ATTRIBUTE_NAMES[384] = ATTR_FONT_WEIGHT;
-  ATTRIBUTE_NAMES[385] = ATTR_HORIZ_ADV_X;
-  ATTRIBUTE_NAMES[386] = ATTR_ONDRAGLEAVE;
-  ATTRIBUTE_NAMES[387] = ATTR_ONMOUSEMOVE;
-  ATTRIBUTE_NAMES[388] = ATTR_ORIENTATION;
-  ATTRIBUTE_NAMES[389] = ATTR_ONMOUSEDOWN;
-  ATTRIBUTE_NAMES[390] = ATTR_ONMOUSEOVER;
-  ATTRIBUTE_NAMES[391] = ATTR_ONDRAGENTER;
-  ATTRIBUTE_NAMES[392] = ATTR_IDEOGRAPHIC;
-  ATTRIBUTE_NAMES[393] = ATTR_ONBEFORECUT;
-  ATTRIBUTE_NAMES[394] = ATTR_ONFORMINPUT;
-  ATTRIBUTE_NAMES[395] = ATTR_ONDRAGSTART;
-  ATTRIBUTE_NAMES[396] = ATTR_ONMOVESTART;
-  ATTRIBUTE_NAMES[397] = ATTR_MARKERUNITS;
-  ATTRIBUTE_NAMES[398] = ATTR_MATHVARIANT;
-  ATTRIBUTE_NAMES[399] = ATTR_MARGINWIDTH;
-  ATTRIBUTE_NAMES[400] = ATTR_MARKERWIDTH;
-  ATTRIBUTE_NAMES[401] = ATTR_TEXT_ANCHOR;
-  ATTRIBUTE_NAMES[402] = ATTR_TABLEVALUES;
-  ATTRIBUTE_NAMES[403] = ATTR_SCRIPTLEVEL;
-  ATTRIBUTE_NAMES[404] = ATTR_REPEATCOUNT;
-  ATTRIBUTE_NAMES[405] = ATTR_STITCHTILES;
-  ATTRIBUTE_NAMES[406] = ATTR_STARTOFFSET;
-  ATTRIBUTE_NAMES[407] = ATTR_SCROLLDELAY;
-  ATTRIBUTE_NAMES[408] = ATTR_XMLNS_XLINK;
-  ATTRIBUTE_NAMES[409] = ATTR_XLINK_TITLE;
-  ATTRIBUTE_NAMES[410] = ATTR_ARIA_INVALID;
-  ATTRIBUTE_NAMES[411] = ATTR_ARIA_PRESSED;
-  ATTRIBUTE_NAMES[412] = ATTR_ARIA_CHECKED;
-  ATTRIBUTE_NAMES[413] = ATTR_AUTOCOMPLETE;
-  ATTRIBUTE_NAMES[414] = ATTR_ARIA_SETSIZE;
-  ATTRIBUTE_NAMES[415] = ATTR_ARIA_CHANNEL;
-  ATTRIBUTE_NAMES[416] = ATTR_EQUALCOLUMNS;
-  ATTRIBUTE_NAMES[417] = ATTR_DISPLAYSTYLE;
-  ATTRIBUTE_NAMES[418] = ATTR_DATAFORMATAS;
-  ATTRIBUTE_NAMES[419] = ATTR_FILL_OPACITY;
-  ATTRIBUTE_NAMES[420] = ATTR_FONT_VARIANT;
-  ATTRIBUTE_NAMES[421] = ATTR_FONT_STRETCH;
-  ATTRIBUTE_NAMES[422] = ATTR_FRAMESPACING;
-  ATTRIBUTE_NAMES[423] = ATTR_KERNELMATRIX;
-  ATTRIBUTE_NAMES[424] = ATTR_ONDEACTIVATE;
-  ATTRIBUTE_NAMES[425] = ATTR_ONROWSDELETE;
-  ATTRIBUTE_NAMES[426] = ATTR_ONMOUSELEAVE;
-  ATTRIBUTE_NAMES[427] = ATTR_ONFORMCHANGE;
-  ATTRIBUTE_NAMES[428] = ATTR_ONCELLCHANGE;
-  ATTRIBUTE_NAMES[429] = ATTR_ONMOUSEWHEEL;
-  ATTRIBUTE_NAMES[430] = ATTR_ONMOUSEENTER;
-  ATTRIBUTE_NAMES[431] = ATTR_ONAFTERPRINT;
-  ATTRIBUTE_NAMES[432] = ATTR_ONBEFORECOPY;
-  ATTRIBUTE_NAMES[433] = ATTR_MARGINHEIGHT;
-  ATTRIBUTE_NAMES[434] = ATTR_MARKERHEIGHT;
-  ATTRIBUTE_NAMES[435] = ATTR_MARKER_START;
-  ATTRIBUTE_NAMES[436] = ATTR_MATHEMATICAL;
-  ATTRIBUTE_NAMES[437] = ATTR_LENGTHADJUST;
-  ATTRIBUTE_NAMES[438] = ATTR_UNSELECTABLE;
-  ATTRIBUTE_NAMES[439] = ATTR_UNICODE_BIDI;
-  ATTRIBUTE_NAMES[440] = ATTR_UNITS_PER_EM;
-  ATTRIBUTE_NAMES[441] = ATTR_WORD_SPACING;
-  ATTRIBUTE_NAMES[442] = ATTR_WRITING_MODE;
-  ATTRIBUTE_NAMES[443] = ATTR_V_ALPHABETIC;
-  ATTRIBUTE_NAMES[444] = ATTR_PATTERNUNITS;
-  ATTRIBUTE_NAMES[445] = ATTR_SPREADMETHOD;
-  ATTRIBUTE_NAMES[446] = ATTR_SURFACESCALE;
-  ATTRIBUTE_NAMES[447] = ATTR_STROKE_WIDTH;
-  ATTRIBUTE_NAMES[448] = ATTR_REPEAT_START;
-  ATTRIBUTE_NAMES[449] = ATTR_STDDEVIATION;
-  ATTRIBUTE_NAMES[450] = ATTR_STOP_OPACITY;
-  ATTRIBUTE_NAMES[451] = ATTR_ARIA_CONTROLS;
-  ATTRIBUTE_NAMES[452] = ATTR_ARIA_HASPOPUP;
-  ATTRIBUTE_NAMES[453] = ATTR_ACCENT_HEIGHT;
-  ATTRIBUTE_NAMES[454] = ATTR_ARIA_VALUENOW;
-  ATTRIBUTE_NAMES[455] = ATTR_ARIA_RELEVANT;
-  ATTRIBUTE_NAMES[456] = ATTR_ARIA_POSINSET;
-  ATTRIBUTE_NAMES[457] = ATTR_ARIA_VALUEMAX;
-  ATTRIBUTE_NAMES[458] = ATTR_ARIA_READONLY;
-  ATTRIBUTE_NAMES[459] = ATTR_ARIA_SELECTED;
-  ATTRIBUTE_NAMES[460] = ATTR_ARIA_REQUIRED;
-  ATTRIBUTE_NAMES[461] = ATTR_ARIA_EXPANDED;
-  ATTRIBUTE_NAMES[462] = ATTR_ARIA_DISABLED;
-  ATTRIBUTE_NAMES[463] = ATTR_ATTRIBUTETYPE;
-  ATTRIBUTE_NAMES[464] = ATTR_ATTRIBUTENAME;
-  ATTRIBUTE_NAMES[465] = ATTR_ARIA_DATATYPE;
-  ATTRIBUTE_NAMES[466] = ATTR_ARIA_VALUEMIN;
-  ATTRIBUTE_NAMES[467] = ATTR_BASEFREQUENCY;
-  ATTRIBUTE_NAMES[468] = ATTR_COLUMNSPACING;
-  ATTRIBUTE_NAMES[469] = ATTR_COLOR_PROFILE;
-  ATTRIBUTE_NAMES[470] = ATTR_CLIPPATHUNITS;
-  ATTRIBUTE_NAMES[471] = ATTR_DEFINITIONURL;
-  ATTRIBUTE_NAMES[472] = ATTR_GRADIENTUNITS;
-  ATTRIBUTE_NAMES[473] = ATTR_FLOOD_OPACITY;
-  ATTRIBUTE_NAMES[474] = ATTR_ONAFTERUPDATE;
-  ATTRIBUTE_NAMES[475] = ATTR_ONERRORUPDATE;
-  ATTRIBUTE_NAMES[476] = ATTR_ONBEFOREPASTE;
-  ATTRIBUTE_NAMES[477] = ATTR_ONLOSECAPTURE;
-  ATTRIBUTE_NAMES[478] = ATTR_ONCONTEXTMENU;
-  ATTRIBUTE_NAMES[479] = ATTR_ONSELECTSTART;
-  ATTRIBUTE_NAMES[480] = ATTR_ONBEFOREPRINT;
-  ATTRIBUTE_NAMES[481] = ATTR_MOVABLELIMITS;
-  ATTRIBUTE_NAMES[482] = ATTR_LINETHICKNESS;
-  ATTRIBUTE_NAMES[483] = ATTR_UNICODE_RANGE;
-  ATTRIBUTE_NAMES[484] = ATTR_THINMATHSPACE;
-  ATTRIBUTE_NAMES[485] = ATTR_VERT_ORIGIN_X;
-  ATTRIBUTE_NAMES[486] = ATTR_VERT_ORIGIN_Y;
-  ATTRIBUTE_NAMES[487] = ATTR_V_IDEOGRAPHIC;
-  ATTRIBUTE_NAMES[488] = ATTR_PRESERVEALPHA;
-  ATTRIBUTE_NAMES[489] = ATTR_SCRIPTMINSIZE;
-  ATTRIBUTE_NAMES[490] = ATTR_SPECIFICATION;
-  ATTRIBUTE_NAMES[491] = ATTR_XLINK_ACTUATE;
-  ATTRIBUTE_NAMES[492] = ATTR_XLINK_ARCROLE;
-  ATTRIBUTE_NAMES[493] = ATTR_ACCEPT_CHARSET;
-  ATTRIBUTE_NAMES[494] = ATTR_ALIGNMENTSCOPE;
-  ATTRIBUTE_NAMES[495] = ATTR_ARIA_MULTILINE;
-  ATTRIBUTE_NAMES[496] = ATTR_BASELINE_SHIFT;
-  ATTRIBUTE_NAMES[497] = ATTR_HORIZ_ORIGIN_X;
-  ATTRIBUTE_NAMES[498] = ATTR_HORIZ_ORIGIN_Y;
-  ATTRIBUTE_NAMES[499] = ATTR_ONBEFOREUPDATE;
-  ATTRIBUTE_NAMES[500] = ATTR_ONFILTERCHANGE;
-  ATTRIBUTE_NAMES[501] = ATTR_ONROWSINSERTED;
-  ATTRIBUTE_NAMES[502] = ATTR_ONBEFOREUNLOAD;
-  ATTRIBUTE_NAMES[503] = ATTR_MATHBACKGROUND;
-  ATTRIBUTE_NAMES[504] = ATTR_LETTER_SPACING;
-  ATTRIBUTE_NAMES[505] = ATTR_LIGHTING_COLOR;
-  ATTRIBUTE_NAMES[506] = ATTR_THICKMATHSPACE;
-  ATTRIBUTE_NAMES[507] = ATTR_TEXT_RENDERING;
-  ATTRIBUTE_NAMES[508] = ATTR_V_MATHEMATICAL;
-  ATTRIBUTE_NAMES[509] = ATTR_POINTER_EVENTS;
-  ATTRIBUTE_NAMES[510] = ATTR_PRIMITIVEUNITS;
-  ATTRIBUTE_NAMES[511] = ATTR_SYSTEMLANGUAGE;
-  ATTRIBUTE_NAMES[512] = ATTR_STROKE_LINECAP;
-  ATTRIBUTE_NAMES[513] = ATTR_SUBSCRIPTSHIFT;
-  ATTRIBUTE_NAMES[514] = ATTR_STROKE_OPACITY;
-  ATTRIBUTE_NAMES[515] = ATTR_ARIA_DROPEFFECT;
-  ATTRIBUTE_NAMES[516] = ATTR_ARIA_LABELLEDBY;
-  ATTRIBUTE_NAMES[517] = ATTR_ARIA_TEMPLATEID;
-  ATTRIBUTE_NAMES[518] = ATTR_COLOR_RENDERING;
-  ATTRIBUTE_NAMES[519] = ATTR_CONTENTEDITABLE;
-  ATTRIBUTE_NAMES[520] = ATTR_DIFFUSECONSTANT;
-  ATTRIBUTE_NAMES[521] = ATTR_ONDATAAVAILABLE;
-  ATTRIBUTE_NAMES[522] = ATTR_ONCONTROLSELECT;
-  ATTRIBUTE_NAMES[523] = ATTR_IMAGE_RENDERING;
-  ATTRIBUTE_NAMES[524] = ATTR_MEDIUMMATHSPACE;
-  ATTRIBUTE_NAMES[525] = ATTR_TEXT_DECORATION;
-  ATTRIBUTE_NAMES[526] = ATTR_SHAPE_RENDERING;
-  ATTRIBUTE_NAMES[527] = ATTR_STROKE_LINEJOIN;
-  ATTRIBUTE_NAMES[528] = ATTR_REPEAT_TEMPLATE;
-  ATTRIBUTE_NAMES[529] = ATTR_ARIA_DESCRIBEDBY;
-  ATTRIBUTE_NAMES[530] = ATTR_CONTENTSTYLETYPE;
-  ATTRIBUTE_NAMES[531] = ATTR_FONT_SIZE_ADJUST;
-  ATTRIBUTE_NAMES[532] = ATTR_KERNELUNITLENGTH;
-  ATTRIBUTE_NAMES[533] = ATTR_ONBEFOREACTIVATE;
-  ATTRIBUTE_NAMES[534] = ATTR_ONPROPERTYCHANGE;
-  ATTRIBUTE_NAMES[535] = ATTR_ONDATASETCHANGED;
-  ATTRIBUTE_NAMES[536] = ATTR_MASKCONTENTUNITS;
-  ATTRIBUTE_NAMES[537] = ATTR_PATTERNTRANSFORM;
-  ATTRIBUTE_NAMES[538] = ATTR_REQUIREDFEATURES;
-  ATTRIBUTE_NAMES[539] = ATTR_RENDERING_INTENT;
-  ATTRIBUTE_NAMES[540] = ATTR_SPECULAREXPONENT;
-  ATTRIBUTE_NAMES[541] = ATTR_SPECULARCONSTANT;
-  ATTRIBUTE_NAMES[542] = ATTR_SUPERSCRIPTSHIFT;
-  ATTRIBUTE_NAMES[543] = ATTR_STROKE_DASHARRAY;
-  ATTRIBUTE_NAMES[544] = ATTR_XCHANNELSELECTOR;
-  ATTRIBUTE_NAMES[545] = ATTR_YCHANNELSELECTOR;
-  ATTRIBUTE_NAMES[546] = ATTR_ARIA_AUTOCOMPLETE;
-  ATTRIBUTE_NAMES[547] = ATTR_CONTENTSCRIPTTYPE;
-  ATTRIBUTE_NAMES[548] = ATTR_ENABLE_BACKGROUND;
-  ATTRIBUTE_NAMES[549] = ATTR_DOMINANT_BASELINE;
-  ATTRIBUTE_NAMES[550] = ATTR_GRADIENTTRANSFORM;
-  ATTRIBUTE_NAMES[551] = ATTR_ONBEFORDEACTIVATE;
-  ATTRIBUTE_NAMES[552] = ATTR_ONDATASETCOMPLETE;
-  ATTRIBUTE_NAMES[553] = ATTR_OVERLINE_POSITION;
-  ATTRIBUTE_NAMES[554] = ATTR_ONBEFOREEDITFOCUS;
-  ATTRIBUTE_NAMES[555] = ATTR_LIMITINGCONEANGLE;
-  ATTRIBUTE_NAMES[556] = ATTR_VERYTHINMATHSPACE;
-  ATTRIBUTE_NAMES[557] = ATTR_STROKE_DASHOFFSET;
-  ATTRIBUTE_NAMES[558] = ATTR_STROKE_MITERLIMIT;
-  ATTRIBUTE_NAMES[559] = ATTR_ALIGNMENT_BASELINE;
-  ATTRIBUTE_NAMES[560] = ATTR_ONREADYSTATECHANGE;
-  ATTRIBUTE_NAMES[561] = ATTR_OVERLINE_THICKNESS;
-  ATTRIBUTE_NAMES[562] = ATTR_UNDERLINE_POSITION;
-  ATTRIBUTE_NAMES[563] = ATTR_VERYTHICKMATHSPACE;
-  ATTRIBUTE_NAMES[564] = ATTR_REQUIREDEXTENSIONS;
-  ATTRIBUTE_NAMES[565] = ATTR_COLOR_INTERPOLATION;
-  ATTRIBUTE_NAMES[566] = ATTR_UNDERLINE_THICKNESS;
-  ATTRIBUTE_NAMES[567] = ATTR_PRESERVEASPECTRATIO;
-  ATTRIBUTE_NAMES[568] = ATTR_PATTERNCONTENTUNITS;
-  ATTRIBUTE_NAMES[569] = ATTR_ARIA_MULTISELECTABLE;
-  ATTRIBUTE_NAMES[570] = ATTR_SCRIPTSIZEMULTIPLIER;
-  ATTRIBUTE_NAMES[571] = ATTR_ARIA_ACTIVEDESCENDANT;
-  ATTRIBUTE_NAMES[572] = ATTR_VERYVERYTHINMATHSPACE;
-  ATTRIBUTE_NAMES[573] = ATTR_VERYVERYTHICKMATHSPACE;
-  ATTRIBUTE_NAMES[574] = ATTR_STRIKETHROUGH_POSITION;
-  ATTRIBUTE_NAMES[575] = ATTR_STRIKETHROUGH_THICKNESS;
-  ATTRIBUTE_NAMES[576] = ATTR_EXTERNALRESOURCESREQUIRED;
-  ATTRIBUTE_NAMES[577] = ATTR_GLYPH_ORIENTATION_VERTICAL;
-  ATTRIBUTE_NAMES[578] = ATTR_COLOR_INTERPOLATION_FILTERS;
-  ATTRIBUTE_NAMES[579] = ATTR_GLYPH_ORIENTATION_HORIZONTAL;
+  ATTRIBUTE_NAMES[165] = ATTR_SRCDOC;
+  ATTRIBUTE_NAMES[166] = ATTR_SCOPED;
+  ATTRIBUTE_NAMES[167] = ATTR_STRING;
+  ATTRIBUTE_NAMES[168] = ATTR_SCHEME;
+  ATTRIBUTE_NAMES[169] = ATTR_STROKE;
+  ATTRIBUTE_NAMES[170] = ATTR_RADIUS;
+  ATTRIBUTE_NAMES[171] = ATTR_RESULT;
+  ATTRIBUTE_NAMES[172] = ATTR_REPEAT;
+  ATTRIBUTE_NAMES[173] = ATTR_RSPACE;
+  ATTRIBUTE_NAMES[174] = ATTR_ROTATE;
+  ATTRIBUTE_NAMES[175] = ATTR_RQUOTE;
+  ATTRIBUTE_NAMES[176] = ATTR_ALTTEXT;
+  ATTRIBUTE_NAMES[177] = ATTR_ARCHIVE;
+  ATTRIBUTE_NAMES[178] = ATTR_AZIMUTH;
+  ATTRIBUTE_NAMES[179] = ATTR_CLOSURE;
+  ATTRIBUTE_NAMES[180] = ATTR_CHECKED;
+  ATTRIBUTE_NAMES[181] = ATTR_CLASSID;
+  ATTRIBUTE_NAMES[182] = ATTR_CHAROFF;
+  ATTRIBUTE_NAMES[183] = ATTR_BGCOLOR;
+  ATTRIBUTE_NAMES[184] = ATTR_COLSPAN;
+  ATTRIBUTE_NAMES[185] = ATTR_CHARSET;
+  ATTRIBUTE_NAMES[186] = ATTR_COMPACT;
+  ATTRIBUTE_NAMES[187] = ATTR_CONTENT;
+  ATTRIBUTE_NAMES[188] = ATTR_ENCTYPE;
+  ATTRIBUTE_NAMES[189] = ATTR_DATASRC;
+  ATTRIBUTE_NAMES[190] = ATTR_DATAFLD;
+  ATTRIBUTE_NAMES[191] = ATTR_DECLARE;
+  ATTRIBUTE_NAMES[192] = ATTR_DISPLAY;
+  ATTRIBUTE_NAMES[193] = ATTR_DIVISOR;
+  ATTRIBUTE_NAMES[194] = ATTR_DEFAULT;
+  ATTRIBUTE_NAMES[195] = ATTR_DESCENT;
+  ATTRIBUTE_NAMES[196] = ATTR_KERNING;
+  ATTRIBUTE_NAMES[197] = ATTR_HANGING;
+  ATTRIBUTE_NAMES[198] = ATTR_HEADERS;
+  ATTRIBUTE_NAMES[199] = ATTR_ONPASTE;
+  ATTRIBUTE_NAMES[200] = ATTR_ONCLICK;
+  ATTRIBUTE_NAMES[201] = ATTR_OPTIMUM;
+  ATTRIBUTE_NAMES[202] = ATTR_ONBEGIN;
+  ATTRIBUTE_NAMES[203] = ATTR_ONKEYUP;
+  ATTRIBUTE_NAMES[204] = ATTR_ONFOCUS;
+  ATTRIBUTE_NAMES[205] = ATTR_ONERROR;
+  ATTRIBUTE_NAMES[206] = ATTR_ONINPUT;
+  ATTRIBUTE_NAMES[207] = ATTR_ONABORT;
+  ATTRIBUTE_NAMES[208] = ATTR_ONSTART;
+  ATTRIBUTE_NAMES[209] = ATTR_ONRESET;
+  ATTRIBUTE_NAMES[210] = ATTR_OPACITY;
+  ATTRIBUTE_NAMES[211] = ATTR_NOSHADE;
+  ATTRIBUTE_NAMES[212] = ATTR_MINSIZE;
+  ATTRIBUTE_NAMES[213] = ATTR_MAXSIZE;
+  ATTRIBUTE_NAMES[214] = ATTR_LARGEOP;
+  ATTRIBUTE_NAMES[215] = ATTR_UNICODE;
+  ATTRIBUTE_NAMES[216] = ATTR_TARGETX;
+  ATTRIBUTE_NAMES[217] = ATTR_TARGETY;
+  ATTRIBUTE_NAMES[218] = ATTR_VIEWBOX;
+  ATTRIBUTE_NAMES[219] = ATTR_VERSION;
+  ATTRIBUTE_NAMES[220] = ATTR_PATTERN;
+  ATTRIBUTE_NAMES[221] = ATTR_PROFILE;
+  ATTRIBUTE_NAMES[222] = ATTR_SPACING;
+  ATTRIBUTE_NAMES[223] = ATTR_RESTART;
+  ATTRIBUTE_NAMES[224] = ATTR_ROWSPAN;
+  ATTRIBUTE_NAMES[225] = ATTR_SANDBOX;
+  ATTRIBUTE_NAMES[226] = ATTR_SUMMARY;
+  ATTRIBUTE_NAMES[227] = ATTR_STANDBY;
+  ATTRIBUTE_NAMES[228] = ATTR_REPLACE;
+  ATTRIBUTE_NAMES[229] = ATTR_AUTOPLAY;
+  ATTRIBUTE_NAMES[230] = ATTR_ADDITIVE;
+  ATTRIBUTE_NAMES[231] = ATTR_CALCMODE;
+  ATTRIBUTE_NAMES[232] = ATTR_CODETYPE;
+  ATTRIBUTE_NAMES[233] = ATTR_CODEBASE;
+  ATTRIBUTE_NAMES[234] = ATTR_CONTROLS;
+  ATTRIBUTE_NAMES[235] = ATTR_BEVELLED;
+  ATTRIBUTE_NAMES[236] = ATTR_BASELINE;
+  ATTRIBUTE_NAMES[237] = ATTR_EXPONENT;
+  ATTRIBUTE_NAMES[238] = ATTR_EDGEMODE;
+  ATTRIBUTE_NAMES[239] = ATTR_ENCODING;
+  ATTRIBUTE_NAMES[240] = ATTR_GLYPHREF;
+  ATTRIBUTE_NAMES[241] = ATTR_DATETIME;
+  ATTRIBUTE_NAMES[242] = ATTR_DISABLED;
+  ATTRIBUTE_NAMES[243] = ATTR_FONTSIZE;
+  ATTRIBUTE_NAMES[244] = ATTR_KEYTIMES;
+  ATTRIBUTE_NAMES[245] = ATTR_PANOSE_1;
+  ATTRIBUTE_NAMES[246] = ATTR_HREFLANG;
+  ATTRIBUTE_NAMES[247] = ATTR_ONRESIZE;
+  ATTRIBUTE_NAMES[248] = ATTR_ONCHANGE;
+  ATTRIBUTE_NAMES[249] = ATTR_ONBOUNCE;
+  ATTRIBUTE_NAMES[250] = ATTR_ONUNLOAD;
+  ATTRIBUTE_NAMES[251] = ATTR_ONFINISH;
+  ATTRIBUTE_NAMES[252] = ATTR_ONSCROLL;
+  ATTRIBUTE_NAMES[253] = ATTR_OPERATOR;
+  ATTRIBUTE_NAMES[254] = ATTR_OVERFLOW;
+  ATTRIBUTE_NAMES[255] = ATTR_ONSUBMIT;
+  ATTRIBUTE_NAMES[256] = ATTR_ONREPEAT;
+  ATTRIBUTE_NAMES[257] = ATTR_ONSELECT;
+  ATTRIBUTE_NAMES[258] = ATTR_NOTATION;
+  ATTRIBUTE_NAMES[259] = ATTR_NORESIZE;
+  ATTRIBUTE_NAMES[260] = ATTR_MANIFEST;
+  ATTRIBUTE_NAMES[261] = ATTR_MATHSIZE;
+  ATTRIBUTE_NAMES[262] = ATTR_MULTIPLE;
+  ATTRIBUTE_NAMES[263] = ATTR_LONGDESC;
+  ATTRIBUTE_NAMES[264] = ATTR_LANGUAGE;
+  ATTRIBUTE_NAMES[265] = ATTR_TEMPLATE;
+  ATTRIBUTE_NAMES[266] = ATTR_TABINDEX;
+  ATTRIBUTE_NAMES[267] = ATTR_READONLY;
+  ATTRIBUTE_NAMES[268] = ATTR_SELECTED;
+  ATTRIBUTE_NAMES[269] = ATTR_ROWLINES;
+  ATTRIBUTE_NAMES[270] = ATTR_SEAMLESS;
+  ATTRIBUTE_NAMES[271] = ATTR_ROWALIGN;
+  ATTRIBUTE_NAMES[272] = ATTR_STRETCHY;
+  ATTRIBUTE_NAMES[273] = ATTR_REQUIRED;
+  ATTRIBUTE_NAMES[274] = ATTR_XML_BASE;
+  ATTRIBUTE_NAMES[275] = ATTR_XML_LANG;
+  ATTRIBUTE_NAMES[276] = ATTR_X_HEIGHT;
+  ATTRIBUTE_NAMES[277] = ATTR_ARIA_OWNS;
+  ATTRIBUTE_NAMES[278] = ATTR_AUTOFOCUS;
+  ATTRIBUTE_NAMES[279] = ATTR_ARIA_SORT;
+  ATTRIBUTE_NAMES[280] = ATTR_ACCESSKEY;
+  ATTRIBUTE_NAMES[281] = ATTR_ARIA_BUSY;
+  ATTRIBUTE_NAMES[282] = ATTR_ARIA_GRAB;
+  ATTRIBUTE_NAMES[283] = ATTR_AMPLITUDE;
+  ATTRIBUTE_NAMES[284] = ATTR_ARIA_LIVE;
+  ATTRIBUTE_NAMES[285] = ATTR_CLIP_RULE;
+  ATTRIBUTE_NAMES[286] = ATTR_CLIP_PATH;
+  ATTRIBUTE_NAMES[287] = ATTR_EQUALROWS;
+  ATTRIBUTE_NAMES[288] = ATTR_ELEVATION;
+  ATTRIBUTE_NAMES[289] = ATTR_DIRECTION;
+  ATTRIBUTE_NAMES[290] = ATTR_DRAGGABLE;
+  ATTRIBUTE_NAMES[291] = ATTR_FILTERRES;
+  ATTRIBUTE_NAMES[292] = ATTR_FILL_RULE;
+  ATTRIBUTE_NAMES[293] = ATTR_FONTSTYLE;
+  ATTRIBUTE_NAMES[294] = ATTR_FONT_SIZE;
+  ATTRIBUTE_NAMES[295] = ATTR_KEYPOINTS;
+  ATTRIBUTE_NAMES[296] = ATTR_HIDEFOCUS;
+  ATTRIBUTE_NAMES[297] = ATTR_ONMESSAGE;
+  ATTRIBUTE_NAMES[298] = ATTR_INTERCEPT;
+  ATTRIBUTE_NAMES[299] = ATTR_ONDRAGEND;
+  ATTRIBUTE_NAMES[300] = ATTR_ONMOVEEND;
+  ATTRIBUTE_NAMES[301] = ATTR_ONINVALID;
+  ATTRIBUTE_NAMES[302] = ATTR_ONKEYDOWN;
+  ATTRIBUTE_NAMES[303] = ATTR_ONFOCUSIN;
+  ATTRIBUTE_NAMES[304] = ATTR_ONMOUSEUP;
+  ATTRIBUTE_NAMES[305] = ATTR_INPUTMODE;
+  ATTRIBUTE_NAMES[306] = ATTR_ONROWEXIT;
+  ATTRIBUTE_NAMES[307] = ATTR_MATHCOLOR;
+  ATTRIBUTE_NAMES[308] = ATTR_MASKUNITS;
+  ATTRIBUTE_NAMES[309] = ATTR_MAXLENGTH;
+  ATTRIBUTE_NAMES[310] = ATTR_LINEBREAK;
+  ATTRIBUTE_NAMES[311] = ATTR_TRANSFORM;
+  ATTRIBUTE_NAMES[312] = ATTR_V_HANGING;
+  ATTRIBUTE_NAMES[313] = ATTR_VALUETYPE;
+  ATTRIBUTE_NAMES[314] = ATTR_POINTSATZ;
+  ATTRIBUTE_NAMES[315] = ATTR_POINTSATX;
+  ATTRIBUTE_NAMES[316] = ATTR_POINTSATY;
+  ATTRIBUTE_NAMES[317] = ATTR_SYMMETRIC;
+  ATTRIBUTE_NAMES[318] = ATTR_SCROLLING;
+  ATTRIBUTE_NAMES[319] = ATTR_REPEATDUR;
+  ATTRIBUTE_NAMES[320] = ATTR_SELECTION;
+  ATTRIBUTE_NAMES[321] = ATTR_SEPARATOR;
+  ATTRIBUTE_NAMES[322] = ATTR_XML_SPACE;
+  ATTRIBUTE_NAMES[323] = ATTR_AUTOSUBMIT;
+  ATTRIBUTE_NAMES[324] = ATTR_ALPHABETIC;
+  ATTRIBUTE_NAMES[325] = ATTR_ACTIONTYPE;
+  ATTRIBUTE_NAMES[326] = ATTR_ACCUMULATE;
+  ATTRIBUTE_NAMES[327] = ATTR_ARIA_LEVEL;
+  ATTRIBUTE_NAMES[328] = ATTR_COLUMNSPAN;
+  ATTRIBUTE_NAMES[329] = ATTR_CAP_HEIGHT;
+  ATTRIBUTE_NAMES[330] = ATTR_BACKGROUND;
+  ATTRIBUTE_NAMES[331] = ATTR_GLYPH_NAME;
+  ATTRIBUTE_NAMES[332] = ATTR_GROUPALIGN;
+  ATTRIBUTE_NAMES[333] = ATTR_FONTFAMILY;
+  ATTRIBUTE_NAMES[334] = ATTR_FONTWEIGHT;
+  ATTRIBUTE_NAMES[335] = ATTR_FONT_STYLE;
+  ATTRIBUTE_NAMES[336] = ATTR_KEYSPLINES;
+  ATTRIBUTE_NAMES[337] = ATTR_HTTP_EQUIV;
+  ATTRIBUTE_NAMES[338] = ATTR_ONACTIVATE;
+  ATTRIBUTE_NAMES[339] = ATTR_OCCURRENCE;
+  ATTRIBUTE_NAMES[340] = ATTR_IRRELEVANT;
+  ATTRIBUTE_NAMES[341] = ATTR_ONDBLCLICK;
+  ATTRIBUTE_NAMES[342] = ATTR_ONDRAGDROP;
+  ATTRIBUTE_NAMES[343] = ATTR_ONKEYPRESS;
+  ATTRIBUTE_NAMES[344] = ATTR_ONROWENTER;
+  ATTRIBUTE_NAMES[345] = ATTR_ONDRAGOVER;
+  ATTRIBUTE_NAMES[346] = ATTR_ONFOCUSOUT;
+  ATTRIBUTE_NAMES[347] = ATTR_ONMOUSEOUT;
+  ATTRIBUTE_NAMES[348] = ATTR_NUMOCTAVES;
+  ATTRIBUTE_NAMES[349] = ATTR_MARKER_MID;
+  ATTRIBUTE_NAMES[350] = ATTR_MARKER_END;
+  ATTRIBUTE_NAMES[351] = ATTR_TEXTLENGTH;
+  ATTRIBUTE_NAMES[352] = ATTR_VISIBILITY;
+  ATTRIBUTE_NAMES[353] = ATTR_VIEWTARGET;
+  ATTRIBUTE_NAMES[354] = ATTR_VERT_ADV_Y;
+  ATTRIBUTE_NAMES[355] = ATTR_PATHLENGTH;
+  ATTRIBUTE_NAMES[356] = ATTR_REPEAT_MAX;
+  ATTRIBUTE_NAMES[357] = ATTR_RADIOGROUP;
+  ATTRIBUTE_NAMES[358] = ATTR_STOP_COLOR;
+  ATTRIBUTE_NAMES[359] = ATTR_SEPARATORS;
+  ATTRIBUTE_NAMES[360] = ATTR_REPEAT_MIN;
+  ATTRIBUTE_NAMES[361] = ATTR_ROWSPACING;
+  ATTRIBUTE_NAMES[362] = ATTR_ZOOMANDPAN;
+  ATTRIBUTE_NAMES[363] = ATTR_XLINK_TYPE;
+  ATTRIBUTE_NAMES[364] = ATTR_XLINK_ROLE;
+  ATTRIBUTE_NAMES[365] = ATTR_XLINK_HREF;
+  ATTRIBUTE_NAMES[366] = ATTR_XLINK_SHOW;
+  ATTRIBUTE_NAMES[367] = ATTR_ACCENTUNDER;
+  ATTRIBUTE_NAMES[368] = ATTR_ARIA_SECRET;
+  ATTRIBUTE_NAMES[369] = ATTR_ARIA_ATOMIC;
+  ATTRIBUTE_NAMES[370] = ATTR_ARIA_HIDDEN;
+  ATTRIBUTE_NAMES[371] = ATTR_ARIA_FLOWTO;
+  ATTRIBUTE_NAMES[372] = ATTR_ARABIC_FORM;
+  ATTRIBUTE_NAMES[373] = ATTR_CELLPADDING;
+  ATTRIBUTE_NAMES[374] = ATTR_CELLSPACING;
+  ATTRIBUTE_NAMES[375] = ATTR_COLUMNWIDTH;
+  ATTRIBUTE_NAMES[376] = ATTR_CROSSORIGIN;
+  ATTRIBUTE_NAMES[377] = ATTR_COLUMNALIGN;
+  ATTRIBUTE_NAMES[378] = ATTR_COLUMNLINES;
+  ATTRIBUTE_NAMES[379] = ATTR_CONTEXTMENU;
+  ATTRIBUTE_NAMES[380] = ATTR_BASEPROFILE;
+  ATTRIBUTE_NAMES[381] = ATTR_FONT_FAMILY;
+  ATTRIBUTE_NAMES[382] = ATTR_FRAMEBORDER;
+  ATTRIBUTE_NAMES[383] = ATTR_FILTERUNITS;
+  ATTRIBUTE_NAMES[384] = ATTR_FLOOD_COLOR;
+  ATTRIBUTE_NAMES[385] = ATTR_FONT_WEIGHT;
+  ATTRIBUTE_NAMES[386] = ATTR_HORIZ_ADV_X;
+  ATTRIBUTE_NAMES[387] = ATTR_ONDRAGLEAVE;
+  ATTRIBUTE_NAMES[388] = ATTR_ONMOUSEMOVE;
+  ATTRIBUTE_NAMES[389] = ATTR_ORIENTATION;
+  ATTRIBUTE_NAMES[390] = ATTR_ONMOUSEDOWN;
+  ATTRIBUTE_NAMES[391] = ATTR_ONMOUSEOVER;
+  ATTRIBUTE_NAMES[392] = ATTR_ONDRAGENTER;
+  ATTRIBUTE_NAMES[393] = ATTR_IDEOGRAPHIC;
+  ATTRIBUTE_NAMES[394] = ATTR_ONBEFORECUT;
+  ATTRIBUTE_NAMES[395] = ATTR_ONFORMINPUT;
+  ATTRIBUTE_NAMES[396] = ATTR_ONDRAGSTART;
+  ATTRIBUTE_NAMES[397] = ATTR_ONMOVESTART;
+  ATTRIBUTE_NAMES[398] = ATTR_MARKERUNITS;
+  ATTRIBUTE_NAMES[399] = ATTR_MATHVARIANT;
+  ATTRIBUTE_NAMES[400] = ATTR_MARGINWIDTH;
+  ATTRIBUTE_NAMES[401] = ATTR_MARKERWIDTH;
+  ATTRIBUTE_NAMES[402] = ATTR_TEXT_ANCHOR;
+  ATTRIBUTE_NAMES[403] = ATTR_TABLEVALUES;
+  ATTRIBUTE_NAMES[404] = ATTR_SCRIPTLEVEL;
+  ATTRIBUTE_NAMES[405] = ATTR_REPEATCOUNT;
+  ATTRIBUTE_NAMES[406] = ATTR_STITCHTILES;
+  ATTRIBUTE_NAMES[407] = ATTR_STARTOFFSET;
+  ATTRIBUTE_NAMES[408] = ATTR_SCROLLDELAY;
+  ATTRIBUTE_NAMES[409] = ATTR_XMLNS_XLINK;
+  ATTRIBUTE_NAMES[410] = ATTR_XLINK_TITLE;
+  ATTRIBUTE_NAMES[411] = ATTR_ARIA_INVALID;
+  ATTRIBUTE_NAMES[412] = ATTR_ARIA_PRESSED;
+  ATTRIBUTE_NAMES[413] = ATTR_ARIA_CHECKED;
+  ATTRIBUTE_NAMES[414] = ATTR_AUTOCOMPLETE;
+  ATTRIBUTE_NAMES[415] = ATTR_ARIA_SETSIZE;
+  ATTRIBUTE_NAMES[416] = ATTR_ARIA_CHANNEL;
+  ATTRIBUTE_NAMES[417] = ATTR_EQUALCOLUMNS;
+  ATTRIBUTE_NAMES[418] = ATTR_DISPLAYSTYLE;
+  ATTRIBUTE_NAMES[419] = ATTR_DATAFORMATAS;
+  ATTRIBUTE_NAMES[420] = ATTR_FILL_OPACITY;
+  ATTRIBUTE_NAMES[421] = ATTR_FONT_VARIANT;
+  ATTRIBUTE_NAMES[422] = ATTR_FONT_STRETCH;
+  ATTRIBUTE_NAMES[423] = ATTR_FRAMESPACING;
+  ATTRIBUTE_NAMES[424] = ATTR_KERNELMATRIX;
+  ATTRIBUTE_NAMES[425] = ATTR_ONDEACTIVATE;
+  ATTRIBUTE_NAMES[426] = ATTR_ONROWSDELETE;
+  ATTRIBUTE_NAMES[427] = ATTR_ONMOUSELEAVE;
+  ATTRIBUTE_NAMES[428] = ATTR_ONFORMCHANGE;
+  ATTRIBUTE_NAMES[429] = ATTR_ONCELLCHANGE;
+  ATTRIBUTE_NAMES[430] = ATTR_ONMOUSEWHEEL;
+  ATTRIBUTE_NAMES[431] = ATTR_ONMOUSEENTER;
+  ATTRIBUTE_NAMES[432] = ATTR_ONAFTERPRINT;
+  ATTRIBUTE_NAMES[433] = ATTR_ONBEFORECOPY;
+  ATTRIBUTE_NAMES[434] = ATTR_MARGINHEIGHT;
+  ATTRIBUTE_NAMES[435] = ATTR_MARKERHEIGHT;
+  ATTRIBUTE_NAMES[436] = ATTR_MARKER_START;
+  ATTRIBUTE_NAMES[437] = ATTR_MATHEMATICAL;
+  ATTRIBUTE_NAMES[438] = ATTR_LENGTHADJUST;
+  ATTRIBUTE_NAMES[439] = ATTR_UNSELECTABLE;
+  ATTRIBUTE_NAMES[440] = ATTR_UNICODE_BIDI;
+  ATTRIBUTE_NAMES[441] = ATTR_UNITS_PER_EM;
+  ATTRIBUTE_NAMES[442] = ATTR_WORD_SPACING;
+  ATTRIBUTE_NAMES[443] = ATTR_WRITING_MODE;
+  ATTRIBUTE_NAMES[444] = ATTR_V_ALPHABETIC;
+  ATTRIBUTE_NAMES[445] = ATTR_PATTERNUNITS;
+  ATTRIBUTE_NAMES[446] = ATTR_SPREADMETHOD;
+  ATTRIBUTE_NAMES[447] = ATTR_SURFACESCALE;
+  ATTRIBUTE_NAMES[448] = ATTR_STROKE_WIDTH;
+  ATTRIBUTE_NAMES[449] = ATTR_REPEAT_START;
+  ATTRIBUTE_NAMES[450] = ATTR_STDDEVIATION;
+  ATTRIBUTE_NAMES[451] = ATTR_STOP_OPACITY;
+  ATTRIBUTE_NAMES[452] = ATTR_ARIA_CONTROLS;
+  ATTRIBUTE_NAMES[453] = ATTR_ARIA_HASPOPUP;
+  ATTRIBUTE_NAMES[454] = ATTR_ACCENT_HEIGHT;
+  ATTRIBUTE_NAMES[455] = ATTR_ARIA_VALUENOW;
+  ATTRIBUTE_NAMES[456] = ATTR_ARIA_RELEVANT;
+  ATTRIBUTE_NAMES[457] = ATTR_ARIA_POSINSET;
+  ATTRIBUTE_NAMES[458] = ATTR_ARIA_VALUEMAX;
+  ATTRIBUTE_NAMES[459] = ATTR_ARIA_READONLY;
+  ATTRIBUTE_NAMES[460] = ATTR_ARIA_SELECTED;
+  ATTRIBUTE_NAMES[461] = ATTR_ARIA_REQUIRED;
+  ATTRIBUTE_NAMES[462] = ATTR_ARIA_EXPANDED;
+  ATTRIBUTE_NAMES[463] = ATTR_ARIA_DISABLED;
+  ATTRIBUTE_NAMES[464] = ATTR_ATTRIBUTETYPE;
+  ATTRIBUTE_NAMES[465] = ATTR_ATTRIBUTENAME;
+  ATTRIBUTE_NAMES[466] = ATTR_ARIA_DATATYPE;
+  ATTRIBUTE_NAMES[467] = ATTR_ARIA_VALUEMIN;
+  ATTRIBUTE_NAMES[468] = ATTR_BASEFREQUENCY;
+  ATTRIBUTE_NAMES[469] = ATTR_COLUMNSPACING;
+  ATTRIBUTE_NAMES[470] = ATTR_COLOR_PROFILE;
+  ATTRIBUTE_NAMES[471] = ATTR_CLIPPATHUNITS;
+  ATTRIBUTE_NAMES[472] = ATTR_DEFINITIONURL;
+  ATTRIBUTE_NAMES[473] = ATTR_GRADIENTUNITS;
+  ATTRIBUTE_NAMES[474] = ATTR_FLOOD_OPACITY;
+  ATTRIBUTE_NAMES[475] = ATTR_ONAFTERUPDATE;
+  ATTRIBUTE_NAMES[476] = ATTR_ONERRORUPDATE;
+  ATTRIBUTE_NAMES[477] = ATTR_ONBEFOREPASTE;
+  ATTRIBUTE_NAMES[478] = ATTR_ONLOSECAPTURE;
+  ATTRIBUTE_NAMES[479] = ATTR_ONCONTEXTMENU;
+  ATTRIBUTE_NAMES[480] = ATTR_ONSELECTSTART;
+  ATTRIBUTE_NAMES[481] = ATTR_ONBEFOREPRINT;
+  ATTRIBUTE_NAMES[482] = ATTR_MOVABLELIMITS;
+  ATTRIBUTE_NAMES[483] = ATTR_LINETHICKNESS;
+  ATTRIBUTE_NAMES[484] = ATTR_UNICODE_RANGE;
+  ATTRIBUTE_NAMES[485] = ATTR_THINMATHSPACE;
+  ATTRIBUTE_NAMES[486] = ATTR_VERT_ORIGIN_X;
+  ATTRIBUTE_NAMES[487] = ATTR_VERT_ORIGIN_Y;
+  ATTRIBUTE_NAMES[488] = ATTR_V_IDEOGRAPHIC;
+  ATTRIBUTE_NAMES[489] = ATTR_PRESERVEALPHA;
+  ATTRIBUTE_NAMES[490] = ATTR_SCRIPTMINSIZE;
+  ATTRIBUTE_NAMES[491] = ATTR_SPECIFICATION;
+  ATTRIBUTE_NAMES[492] = ATTR_XLINK_ACTUATE;
+  ATTRIBUTE_NAMES[493] = ATTR_XLINK_ARCROLE;
+  ATTRIBUTE_NAMES[494] = ATTR_ACCEPT_CHARSET;
+  ATTRIBUTE_NAMES[495] = ATTR_ALIGNMENTSCOPE;
+  ATTRIBUTE_NAMES[496] = ATTR_ARIA_MULTILINE;
+  ATTRIBUTE_NAMES[497] = ATTR_BASELINE_SHIFT;
+  ATTRIBUTE_NAMES[498] = ATTR_HORIZ_ORIGIN_X;
+  ATTRIBUTE_NAMES[499] = ATTR_HORIZ_ORIGIN_Y;
+  ATTRIBUTE_NAMES[500] = ATTR_ONBEFOREUPDATE;
+  ATTRIBUTE_NAMES[501] = ATTR_ONFILTERCHANGE;
+  ATTRIBUTE_NAMES[502] = ATTR_ONROWSINSERTED;
+  ATTRIBUTE_NAMES[503] = ATTR_ONBEFOREUNLOAD;
+  ATTRIBUTE_NAMES[504] = ATTR_MATHBACKGROUND;
+  ATTRIBUTE_NAMES[505] = ATTR_LETTER_SPACING;
+  ATTRIBUTE_NAMES[506] = ATTR_LIGHTING_COLOR;
+  ATTRIBUTE_NAMES[507] = ATTR_THICKMATHSPACE;
+  ATTRIBUTE_NAMES[508] = ATTR_TEXT_RENDERING;
+  ATTRIBUTE_NAMES[509] = ATTR_V_MATHEMATICAL;
+  ATTRIBUTE_NAMES[510] = ATTR_POINTER_EVENTS;
+  ATTRIBUTE_NAMES[511] = ATTR_PRIMITIVEUNITS;
+  ATTRIBUTE_NAMES[512] = ATTR_SYSTEMLANGUAGE;
+  ATTRIBUTE_NAMES[513] = ATTR_STROKE_LINECAP;
+  ATTRIBUTE_NAMES[514] = ATTR_SUBSCRIPTSHIFT;
+  ATTRIBUTE_NAMES[515] = ATTR_STROKE_OPACITY;
+  ATTRIBUTE_NAMES[516] = ATTR_ARIA_DROPEFFECT;
+  ATTRIBUTE_NAMES[517] = ATTR_ARIA_LABELLEDBY;
+  ATTRIBUTE_NAMES[518] = ATTR_ARIA_TEMPLATEID;
+  ATTRIBUTE_NAMES[519] = ATTR_COLOR_RENDERING;
+  ATTRIBUTE_NAMES[520] = ATTR_CONTENTEDITABLE;
+  ATTRIBUTE_NAMES[521] = ATTR_DIFFUSECONSTANT;
+  ATTRIBUTE_NAMES[522] = ATTR_ONDATAAVAILABLE;
+  ATTRIBUTE_NAMES[523] = ATTR_ONCONTROLSELECT;
+  ATTRIBUTE_NAMES[524] = ATTR_IMAGE_RENDERING;
+  ATTRIBUTE_NAMES[525] = ATTR_MEDIUMMATHSPACE;
+  ATTRIBUTE_NAMES[526] = ATTR_TEXT_DECORATION;
+  ATTRIBUTE_NAMES[527] = ATTR_SHAPE_RENDERING;
+  ATTRIBUTE_NAMES[528] = ATTR_STROKE_LINEJOIN;
+  ATTRIBUTE_NAMES[529] = ATTR_REPEAT_TEMPLATE;
+  ATTRIBUTE_NAMES[530] = ATTR_ARIA_DESCRIBEDBY;
+  ATTRIBUTE_NAMES[531] = ATTR_CONTENTSTYLETYPE;
+  ATTRIBUTE_NAMES[532] = ATTR_FONT_SIZE_ADJUST;
+  ATTRIBUTE_NAMES[533] = ATTR_KERNELUNITLENGTH;
+  ATTRIBUTE_NAMES[534] = ATTR_ONBEFOREACTIVATE;
+  ATTRIBUTE_NAMES[535] = ATTR_ONPROPERTYCHANGE;
+  ATTRIBUTE_NAMES[536] = ATTR_ONDATASETCHANGED;
+  ATTRIBUTE_NAMES[537] = ATTR_MASKCONTENTUNITS;
+  ATTRIBUTE_NAMES[538] = ATTR_PATTERNTRANSFORM;
+  ATTRIBUTE_NAMES[539] = ATTR_REQUIREDFEATURES;
+  ATTRIBUTE_NAMES[540] = ATTR_RENDERING_INTENT;
+  ATTRIBUTE_NAMES[541] = ATTR_SPECULAREXPONENT;
+  ATTRIBUTE_NAMES[542] = ATTR_SPECULARCONSTANT;
+  ATTRIBUTE_NAMES[543] = ATTR_SUPERSCRIPTSHIFT;
+  ATTRIBUTE_NAMES[544] = ATTR_STROKE_DASHARRAY;
+  ATTRIBUTE_NAMES[545] = ATTR_XCHANNELSELECTOR;
+  ATTRIBUTE_NAMES[546] = ATTR_YCHANNELSELECTOR;
+  ATTRIBUTE_NAMES[547] = ATTR_ARIA_AUTOCOMPLETE;
+  ATTRIBUTE_NAMES[548] = ATTR_CONTENTSCRIPTTYPE;
+  ATTRIBUTE_NAMES[549] = ATTR_ENABLE_BACKGROUND;
+  ATTRIBUTE_NAMES[550] = ATTR_DOMINANT_BASELINE;
+  ATTRIBUTE_NAMES[551] = ATTR_GRADIENTTRANSFORM;
+  ATTRIBUTE_NAMES[552] = ATTR_ONBEFORDEACTIVATE;
+  ATTRIBUTE_NAMES[553] = ATTR_ONDATASETCOMPLETE;
+  ATTRIBUTE_NAMES[554] = ATTR_OVERLINE_POSITION;
+  ATTRIBUTE_NAMES[555] = ATTR_ONBEFOREEDITFOCUS;
+  ATTRIBUTE_NAMES[556] = ATTR_LIMITINGCONEANGLE;
+  ATTRIBUTE_NAMES[557] = ATTR_VERYTHINMATHSPACE;
+  ATTRIBUTE_NAMES[558] = ATTR_STROKE_DASHOFFSET;
+  ATTRIBUTE_NAMES[559] = ATTR_STROKE_MITERLIMIT;
+  ATTRIBUTE_NAMES[560] = ATTR_ALIGNMENT_BASELINE;
+  ATTRIBUTE_NAMES[561] = ATTR_ONREADYSTATECHANGE;
+  ATTRIBUTE_NAMES[562] = ATTR_OVERLINE_THICKNESS;
+  ATTRIBUTE_NAMES[563] = ATTR_UNDERLINE_POSITION;
+  ATTRIBUTE_NAMES[564] = ATTR_VERYTHICKMATHSPACE;
+  ATTRIBUTE_NAMES[565] = ATTR_REQUIREDEXTENSIONS;
+  ATTRIBUTE_NAMES[566] = ATTR_COLOR_INTERPOLATION;
+  ATTRIBUTE_NAMES[567] = ATTR_UNDERLINE_THICKNESS;
+  ATTRIBUTE_NAMES[568] = ATTR_PRESERVEASPECTRATIO;
+  ATTRIBUTE_NAMES[569] = ATTR_PATTERNCONTENTUNITS;
+  ATTRIBUTE_NAMES[570] = ATTR_ARIA_MULTISELECTABLE;
+  ATTRIBUTE_NAMES[571] = ATTR_SCRIPTSIZEMULTIPLIER;
+  ATTRIBUTE_NAMES[572] = ATTR_ARIA_ACTIVEDESCENDANT;
+  ATTRIBUTE_NAMES[573] = ATTR_VERYVERYTHINMATHSPACE;
+  ATTRIBUTE_NAMES[574] = ATTR_VERYVERYTHICKMATHSPACE;
+  ATTRIBUTE_NAMES[575] = ATTR_STRIKETHROUGH_POSITION;
+  ATTRIBUTE_NAMES[576] = ATTR_STRIKETHROUGH_THICKNESS;
+  ATTRIBUTE_NAMES[577] = ATTR_EXTERNALRESOURCESREQUIRED;
+  ATTRIBUTE_NAMES[578] = ATTR_GLYPH_ORIENTATION_VERTICAL;
+  ATTRIBUTE_NAMES[579] = ATTR_COLOR_INTERPOLATION_FILTERS;
+  ATTRIBUTE_NAMES[580] = ATTR_GLYPH_ORIENTATION_HORIZONTAL;
 }
 
 void
@@ -2151,6 +2154,7 @@ nsHtml5AttributeName::releaseStatics()
   delete ATTR_POSTER;
   delete ATTR_POINTS;
   delete ATTR_PROMPT;
+  delete ATTR_SRCDOC;
   delete ATTR_SCOPED;
   delete ATTR_STRING;
   delete ATTR_SCHEME;
diff --git a/parser/html/nsHtml5AttributeName.h b/parser/html/nsHtml5AttributeName.h
index c3a7e391a5e..3a10c1669a4 100644
--- a/parser/html/nsHtml5AttributeName.h
+++ b/parser/html/nsHtml5AttributeName.h
@@ -256,6 +256,7 @@ class nsHtml5AttributeName
     static nsHtml5AttributeName* ATTR_POSTER;
     static nsHtml5AttributeName* ATTR_POINTS;
     static nsHtml5AttributeName* ATTR_PROMPT;
+    static nsHtml5AttributeName* ATTR_SRCDOC;
     static nsHtml5AttributeName* ATTR_SCOPED;
     static nsHtml5AttributeName* ATTR_STRING;
     static nsHtml5AttributeName* ATTR_SCHEME;
diff --git a/parser/html/nsHtml5Parser.cpp b/parser/html/nsHtml5Parser.cpp
index 7b4772bdf7c..83383931e01 100644
--- a/parser/html/nsHtml5Parser.cpp
+++ b/parser/html/nsHtml5Parser.cpp
@@ -10,6 +10,7 @@
 #include "nsHtml5Parser.h"
 #include "nsHtml5AtomTable.h"
 #include "nsHtml5DependentUTF16Buffer.h"
+#include "nsIInputStreamChannel.h"
 
 NS_INTERFACE_TABLE_HEAD(nsHtml5Parser)
   NS_INTERFACE_TABLE2(nsHtml5Parser, nsIParser, nsISupportsWeakReference)
@@ -213,6 +214,9 @@ nsHtml5Parser::Parse(const nsAString& aSourceBuffer,
     // This is the first document.write() on a document.open()ed document
     mExecutor->SetParser(this);
     mTreeBuilder->setScriptingEnabled(mExecutor->IsScriptEnabled());
+
+    mTreeBuilder->setIsSrcdocDocument(IsSrcdocDocument());
+
     mTokenizer->start();
     mExecutor->Start();
     if (!aContentType.EqualsLiteral("text/html")) {
@@ -674,6 +678,9 @@ nsHtml5Parser::Initialize(nsIDocument* aDoc,
 
 void
 nsHtml5Parser::StartTokenizer(bool aScriptingEnabled) {
+
+  mTreeBuilder->setIsSrcdocDocument(IsSrcdocDocument());
+
   mTreeBuilder->SetPreventScriptExecution(!aScriptingEnabled);
   mTreeBuilder->setScriptingEnabled(aScriptingEnabled);
   mTokenizer->start();
@@ -697,3 +704,21 @@ nsHtml5Parser::ContinueAfterFailedCharsetSwitch()
     "Tried to continue after failed charset switch without a stream parser");
   mStreamParser->ContinueAfterFailedCharsetSwitch();
 }
+
+bool
+nsHtml5Parser::IsSrcdocDocument()
+{
+  nsresult rv;
+
+  bool isSrcdoc = false;
+  nsCOMPtr<nsIChannel> channel;
+  rv = GetChannel(getter_AddRefs(channel));
+  if (NS_SUCCEEDED(rv)) {
+    nsCOMPtr<nsIInputStreamChannel> isr = do_QueryInterface(channel);
+    if (isr) {
+      isr->GetIsSrcdocChannel(&isSrcdoc);
+    }
+  }
+  return isSrcdoc;
+}
+
diff --git a/parser/html/nsHtml5Parser.h b/parser/html/nsHtml5Parser.h
index a3aa2ddf8ef..59f68fcf539 100644
--- a/parser/html/nsHtml5Parser.h
+++ b/parser/html/nsHtml5Parser.h
@@ -258,6 +258,8 @@ class nsHtml5Parser : public nsIParser,
      */
     void ParseUntilBlocked();
 
+    bool IsSrcdocDocument();
+
   private:
 
     // State variables
diff --git a/parser/html/nsHtml5StreamParser.cpp b/parser/html/nsHtml5StreamParser.cpp
index 13400c66a68..2a2713b8e77 100644
--- a/parser/html/nsHtml5StreamParser.cpp
+++ b/parser/html/nsHtml5StreamParser.cpp
@@ -26,6 +26,7 @@
 #include "nsINestedURI.h"
 #include "nsCharsetSource.h"
 #include "nsIWyciwygChannel.h"
+#include "nsIInputStreamChannel.h"
 
 #include "mozilla/dom/EncodingUtils.h"
 
@@ -872,6 +873,7 @@ nsHtml5StreamParser::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
   bool scriptingEnabled = mMode == LOAD_AS_DATA ?
                                    false : mExecutor->IsScriptEnabled();
   mOwner->StartTokenizer(scriptingEnabled);
+  mTreeBuilder->setIsSrcdocDocument(IsSrcdocDocument());
   mTreeBuilder->setScriptingEnabled(scriptingEnabled);
   mTreeBuilder->SetPreventScriptExecution(!((mMode == NORMAL) &&
                                             scriptingEnabled));
@@ -1609,3 +1611,20 @@ nsHtml5StreamParser::MarkAsBroken()
     NS_WARNING("failed to dispatch executor flush event");
   }
 }
+
+bool
+nsHtml5StreamParser::IsSrcdocDocument()
+{
+  nsresult rv;
+
+  bool isSrcdoc = false;
+  nsCOMPtr<nsIChannel> channel;
+  rv = GetChannel(getter_AddRefs(channel));
+  if (NS_SUCCEEDED(rv)) {
+    nsCOMPtr<nsIInputStreamChannel> isr = do_QueryInterface(channel);
+    if (isr) {
+      isr->GetIsSrcdocChannel(&isSrcdoc);
+    }
+  }
+  return isSrcdoc;
+}
diff --git a/parser/html/nsHtml5StreamParser.h b/parser/html/nsHtml5StreamParser.h
index a0776de5c62..281a3db8966 100644
--- a/parser/html/nsHtml5StreamParser.h
+++ b/parser/html/nsHtml5StreamParser.h
@@ -198,6 +198,8 @@ class nsHtml5StreamParser : public nsIStreamListener,
      */
     void SetViewSourceTitle(nsIURI* aURL);
 
+    bool IsSrcdocDocument();
+
   private:
 
 #ifdef DEBUG
diff --git a/parser/html/nsHtml5StringParser.cpp b/parser/html/nsHtml5StringParser.cpp
index b7a010be26e..b733c111eaa 100644
--- a/parser/html/nsHtml5StringParser.cpp
+++ b/parser/html/nsHtml5StringParser.cpp
@@ -102,6 +102,7 @@ nsHtml5StringParser::Tokenize(const nsAString& aSourceBuffer,
   NS_PRECONDITION(!mExecutor->HasStarted(),
                   "Tried to start parse without initializing the parser.");
   mTreeBuilder->setScriptingEnabled(aScriptingEnabledForNoscriptParsing);
+  mTreeBuilder->setIsSrcdocDocument(aDocument->IsSrcdocDocument()); 
   mTokenizer->start();
   mExecutor->Start(); // Don't call WillBuildModel in fragment case
   if (!aSourceBuffer.IsEmpty()) {
diff --git a/parser/html/nsHtml5TreeBuilder.cpp b/parser/html/nsHtml5TreeBuilder.cpp
index 6b8f0fa8ea9..bac5dc7448b 100644
--- a/parser/html/nsHtml5TreeBuilder.cpp
+++ b/parser/html/nsHtml5TreeBuilder.cpp
@@ -3119,6 +3119,13 @@ nsHtml5TreeBuilder::isSecondOnStackBody()
 void 
 nsHtml5TreeBuilder::documentModeInternal(nsHtml5DocumentMode m, nsString* publicIdentifier, nsString* systemIdentifier, bool html4SpecificAdditionalErrorChecks)
 {
+  if (isSrcdocDocument) {
+    quirks = false;
+    if (this) {
+      this->documentMode(STANDARDS_MODE);
+    }
+    return;
+  }
   quirks = (m == QUIRKS_MODE);
   if (this) {
     this->documentMode(m);
@@ -4064,6 +4071,12 @@ nsHtml5TreeBuilder::setScriptingEnabled(bool scriptingEnabled)
   this->scriptingEnabled = scriptingEnabled;
 }
 
+void 
+nsHtml5TreeBuilder::setIsSrcdocDocument(bool isSrcdocDocument)
+{
+  this->isSrcdocDocument = isSrcdocDocument;
+}
+
 void 
 nsHtml5TreeBuilder::flushCharacters()
 {
diff --git a/parser/html/nsHtml5TreeBuilder.h b/parser/html/nsHtml5TreeBuilder.h
index ba915771a90..77fd3e718c3 100644
--- a/parser/html/nsHtml5TreeBuilder.h
+++ b/parser/html/nsHtml5TreeBuilder.h
@@ -98,6 +98,7 @@ class nsHtml5TreeBuilder : public nsAHtml5TreeBuilderState
     int32_t charBufferLen;
   private:
     bool quirks;
+    bool isSrcdocDocument;
   public:
     void startTokenization(nsHtml5Tokenizer* self);
     void doctype(nsIAtom* name, nsString* publicIdentifier, nsString* systemIdentifier, bool forceQuirks);
@@ -235,6 +236,7 @@ class nsHtml5TreeBuilder : public nsAHtml5TreeBuilderState
   public:
     bool isScriptingEnabled();
     void setScriptingEnabled(bool scriptingEnabled);
+    void setIsSrcdocDocument(bool isSrcdocDocument);
     void flushCharacters();
   private:
     bool charBufferContainsNonWhitespace();
diff --git a/parser/html/nsHtml5TreeBuilderCppSupplement.h b/parser/html/nsHtml5TreeBuilderCppSupplement.h
index 2f61d02e05a..45fc3e07c91 100644
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -823,7 +823,7 @@ nsHtml5TreeBuilder::errStrayDoctype()
 void
 nsHtml5TreeBuilder::errAlmostStandardsDoctype()
 {
-  if (MOZ_UNLIKELY(mViewSource)) {
+  if (MOZ_UNLIKELY(mViewSource) && !isSrcdocDocument) {
     mViewSource->AddErrorToCurrentRun("errAlmostStandardsDoctype");
   }
 }
@@ -831,7 +831,7 @@ nsHtml5TreeBuilder::errAlmostStandardsDoctype()
 void
 nsHtml5TreeBuilder::errQuirkyDoctype()
 {
-  if (MOZ_UNLIKELY(mViewSource)) {
+  if (MOZ_UNLIKELY(mViewSource) && !isSrcdocDocument) {
     mViewSource->AddErrorToCurrentRun("errQuirkyDoctype");
   }
 }
@@ -895,7 +895,7 @@ nsHtml5TreeBuilder::errFooBetweenHeadAndBody(nsIAtom* aName)
 void
 nsHtml5TreeBuilder::errStartTagWithoutDoctype()
 {
-  if (MOZ_UNLIKELY(mViewSource)) {
+  if (MOZ_UNLIKELY(mViewSource) && !isSrcdocDocument) {
     mViewSource->AddErrorToCurrentRun("errStartTagWithoutDoctype");
   }
 }
@@ -1016,7 +1016,7 @@ nsHtml5TreeBuilder::errStartTagInTableBody(nsIAtom* aName)
 void
 nsHtml5TreeBuilder::errEndTagSeenWithoutDoctype()
 {
-  if (MOZ_UNLIKELY(mViewSource)) {
+  if (MOZ_UNLIKELY(mViewSource) && !isSrcdocDocument) {
     mViewSource->AddErrorToCurrentRun("errEndTagSeenWithoutDoctype");
   }
 }
diff --git a/python/mozboot/mozboot/osx.py b/python/mozboot/mozboot/osx.py
index 8aa2d26b70b..a4c917d32da 100644
--- a/python/mozboot/mozboot/osx.py
+++ b/python/mozboot/mozboot/osx.py
@@ -240,7 +240,7 @@ class OSXBootstrapper(BaseBootstrapper):
             self.run_as_root([self.port, '-v', 'install', MACPORTS_CLANG_PACKAGE])
 
         self.run_as_root([self.port, 'select', '--set', 'python', 'python27'])
-        self.run_as_root([self.port, 'select', '--set', 'clang', 'mp-' + MACPORTS_CLANG_PACKAGE])
+        self.run_as_root([self.port, 'select', '--set', 'clang', MACPORTS_CLANG_PACKAGE])
 
     def ensure_package_manager(self):
         '''
diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index 839b5f22f03..42cdd7551ef 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -9,6 +9,9 @@ import logging
 import os
 import types
 
+from mozpack.copier import FilePurger
+from mozpack.manifests import PurgeManifest
+
 from .base import BuildBackend
 from ..frontend.data import (
     ConfigFileSubstitution,
@@ -127,6 +130,15 @@ class RecursiveMakeBackend(BuildBackend):
         self.backend_input_files.add(os.path.join(self.environment.topobjdir,
             'config', 'autoconf.mk'))
 
+        self._purge_manifests = dict(
+            dist_bin=PurgeManifest(relpath='dist/bin'),
+            dist_include=PurgeManifest(relpath='dist/include'),
+            dist_private=PurgeManifest(relpath='dist/private'),
+            dist_public=PurgeManifest(relpath='dist/public'),
+            dist_sdk=PurgeManifest(relpath='dist/sdk'),
+            tests=PurgeManifest(relpath='_tests'),
+        )
+
     def _update_from_avoid_write(self, result):
         existed, updated = result
 
@@ -252,6 +264,8 @@ class RecursiveMakeBackend(BuildBackend):
             self._update_from_avoid_write(mastermanifest.close())
             self.summary.managed_count += 1
 
+        self._write_purge_manifests()
+
     def _process_directory_traversal(self, obj, backend_file):
         """Process a data.DirectoryTraversal instance."""
         fh = backend_file.fh
@@ -309,6 +323,10 @@ class RecursiveMakeBackend(BuildBackend):
         if strings:
             backend_file.write('%s += %s\n' % (export_name, ' '.join(strings)))
 
+            for s in strings:
+                p = '%s%s' % (namespace, s)
+                self._purge_manifests['dist_include'].add(p)
+
         children = exports.get_children()
         for subdir in sorted(children):
             self._process_exports(children[subdir], backend_file,
@@ -323,3 +341,27 @@ class RecursiveMakeBackend(BuildBackend):
         if obj.relativedir != '':
             manifest = '%s/%s' % (obj.relativedir, manifest)
         self.xpcshell_manifests.append(manifest)
+
+    def _write_purge_manifests(self):
+        # We write out a "manifest" file for each directory that is to be
+        # purged.
+        #
+        # Ideally we have as few manifests as possible - ideally only 1. This
+        # will likely require all build metadata to be in emitted objects.
+        # We're not quite there yet, so we maintain multiple manifests.
+        man_dir = os.path.join(self.environment.topobjdir, '_build_manifests',
+            'purge')
+
+        # We have a purger for the manifests themselves to ensure we don't over
+        # purge if we delete a purge manifest.
+        purger = FilePurger()
+
+        for k, manifest in self._purge_manifests.items():
+            purger.add(k)
+            full = os.path.join(man_dir, k)
+
+            fh = FileAvoidWrite(os.path.join(man_dir, k))
+            manifest.write_fileobj(fh)
+            self._update_from_avoid_write(fh.close())
+
+        purger.purge(man_dir)
diff --git a/python/mozbuild/mozbuild/test/backend/common.py b/python/mozbuild/mozbuild/test/backend/common.py
index ec46d8661ba..b9169c2d480 100644
--- a/python/mozbuild/mozbuild/test/backend/common.py
+++ b/python/mozbuild/mozbuild/test/backend/common.py
@@ -89,15 +89,17 @@ class BackendTester(unittest.TestCase):
         config['substs'].append(('top_srcdir', srcdir))
         return ConfigEnvironment(srcdir, objdir, **config)
 
-    def _emit(self, name):
-        env = self._get_environment(name)
+    def _emit(self, name, env=None):
+        if not env:
+            env = self._get_environment(name)
+
         reader = BuildReader(env)
         emitter = TreeMetadataEmitter(env)
 
         return env, emitter.emit(reader.read_topsrcdir())
 
-    def _consume(self, name, cls):
-        env, objs = self._emit(name)
+    def _consume(self, name, cls, env=None):
+        env, objs = self._emit(name, env=env)
         backend = cls(env)
         backend.consume(objs)
 
diff --git a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
index d4fe128cbe6..31f237c9ef7 100644
--- a/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
+++ b/python/mozbuild/mozbuild/test/backend/test_recursivemake.py
@@ -7,6 +7,7 @@ from __future__ import unicode_literals
 import os
 import time
 
+from mozpack.manifests import PurgeManifest
 from mozunit import main
 
 from mozbuild.backend.configenvironment import ConfigEnvironment
@@ -242,6 +243,13 @@ class TestRecursiveMakeBackend(BackendTester):
             'EXPORTS_nspr/private += pprio.h',
         ])
 
+        # EXPORTS files should appear in the dist_include purge manifest.
+        m = PurgeManifest.from_path(os.path.join(env.topobjdir,
+            '_build_manifests', 'purge', 'dist_include'))
+        self.assertIn('foo.h', m.entries)
+        self.assertIn('mozilla/mozilla1.h', m.entries)
+        self.assertIn('mozilla/dom/dom2.h', m.entries)
+
     def test_xpcshell_manifests(self):
         """Ensure XPCSHELL_TESTS_MANIFESTS is written out correctly."""
         env = self._consume('xpcshell_manifests', RecursiveMakeBackend)
@@ -269,5 +277,42 @@ class TestRecursiveMakeBackend(BackendTester):
             '; THIS FILE WAS AUTOMATICALLY GENERATED. DO NOT MODIFY BY HAND.',
             ''] + ['[include:%s/xpcshell.ini]' % x for x in expected])
 
+    def test_purge_manifests_written(self):
+        env = self._consume('stub0', RecursiveMakeBackend)
+
+        purge_dir = os.path.join(env.topobjdir, '_build_manifests', 'purge')
+        self.assertTrue(os.path.exists(purge_dir))
+
+        expected = [
+            'dist_bin',
+            'dist_include',
+            'dist_private',
+            'dist_public',
+            'dist_sdk',
+            'tests',
+        ]
+
+        for e in expected:
+            full = os.path.join(purge_dir, e)
+            self.assertTrue(os.path.exists(full))
+
+        m = PurgeManifest.from_path(os.path.join(purge_dir, 'dist_bin'))
+        self.assertEqual(m.relpath, 'dist/bin')
+
+    def test_old_purge_manifest_deleted(self):
+        # Simulate a purge manifest from a previous backend version. Ensure it
+        # is deleted.
+        env = self._get_environment('stub0')
+        purge_dir = os.path.join(env.topobjdir, '_build_manifests', 'purge')
+        manifest_path = os.path.join(purge_dir, 'old_manifest')
+        os.makedirs(purge_dir)
+        m = PurgeManifest()
+        m.write_file(manifest_path)
+
+        self.assertTrue(os.path.exists(manifest_path))
+        self._consume('stub0', RecursiveMakeBackend, env)
+        self.assertFalse(os.path.exists(manifest_path))
+
+
 if __name__ == '__main__':
     main()
diff --git a/python/mozbuild/mozpack/copier.py b/python/mozbuild/mozpack/copier.py
index 08b6f1f7648..8f1efab00b5 100644
--- a/python/mozbuild/mozpack/copier.py
+++ b/python/mozbuild/mozpack/copier.py
@@ -19,14 +19,20 @@ from collections import (
 def ensure_parent_dir(file):
     '''Ensures the directory parent to the given file exists'''
     dir = os.path.dirname(file)
-    if not dir or os.path.exists(dir):
+    if not dir:
         return
+
     try:
         os.makedirs(dir)
     except OSError as error:
         if error.errno != errno.EEXIST:
             raise
 
+    if not os.access(dir, os.W_OK):
+        umask = os.umask(0077)
+        os.umask(umask)
+        os.chmod(dir, 0777 & ~umask)
+
 
 class FileRegistry(object):
     '''
@@ -168,12 +174,24 @@ class FileCopier(FileRegistry):
         directory_remove_count = 0
 
         for f in actual_dest_files - dest_files:
+            # Windows requires write access to remove files.
+            if os.name == 'nt' and not os.access(f, os.W_OK):
+                # It doesn't matter what we set the permissions to since we
+                # will remove this file shortly.
+                os.chmod(f, 0600)
+
             os.remove(f)
             file_remove_count += 1
+
         for root, dirs, files in os.walk(destination):
-            if not files and not dirs:
-                os.removedirs(root)
-                directory_remove_count += 1
+            if files or dirs:
+                continue
+
+            # Like files, permissions may not allow deletion. So, ensure write
+            # access is in place before attempting delete.
+            os.chmod(root, 0700)
+            os.removedirs(root)
+            directory_remove_count += 1
 
         return FileCopyResult(removed_files_count=file_remove_count,
             removed_directories_count=directory_remove_count)
diff --git a/python/mozbuild/mozpack/manifests.py b/python/mozbuild/mozpack/manifests.py
new file mode 100644
index 00000000000..352ea7a3bc2
--- /dev/null
+++ b/python/mozbuild/mozpack/manifests.py
@@ -0,0 +1,89 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import unicode_literals
+
+from .copier import FilePurger
+import mozpack.path as mozpath
+
+
+class UnreadablePurgeManifest(Exception):
+    """Error for failure when reading content of a serialized PurgeManifest."""
+
+
+class PurgeManifest(object):
+    """Describes actions to be used with a copier.FilePurger instance.
+
+    This class facilitates serialization and deserialization of data used
+    to construct a copier.FilePurger and to perform a purge operation.
+
+    The manifest contains a set of entries (paths that are accounted for and
+    shouldn't be purged) and a relative path. The relative path is optional and
+    can be used to e.g. have several manifest files in a directory be
+    dynamically applied to subdirectories under a common base directory.
+
+    Don't be confused by the name of this class: entries are files that are
+    *not* purged.
+    """
+    def __init__(self, relpath=''):
+        self.relpath = relpath
+        self.entries = set()
+
+    def __eq__(self, other):
+        if not isinstance(other, PurgeManifest):
+            return False
+
+        return other.relpath == self.relpath and other.entries == self.entries
+
+    @staticmethod
+    def from_path(path):
+        with open(path, 'rt') as fh:
+            return PurgeManifest.from_fileobj(fh)
+
+    @staticmethod
+    def from_fileobj(fh):
+        m = PurgeManifest()
+
+        version = fh.readline().rstrip()
+        if version != '1':
+            raise UnreadablePurgeManifest('Unknown manifest version: ' %
+                version)
+
+        m.relpath = fh.readline().rstrip()
+
+        for entry in fh:
+            m.entries.add(entry.rstrip())
+
+        return m
+
+    def add(self, path):
+        return self.entries.add(path)
+
+    def write_file(self, path):
+        with open(path, 'wt') as fh:
+            return self.write_fileobj(fh)
+
+    def write_fileobj(self, fh):
+        fh.write('1\n')
+        fh.write('%s\n' % self.relpath)
+
+        # We write sorted so written output is consistent.
+        for entry in sorted(self.entries):
+            fh.write('%s\n' % entry)
+
+    def get_purger(self, prepend_relpath=False):
+        """Obtain a FilePurger instance from this manifest.
+
+        If :prepend_relpath is truish, the relative path in the manifest will
+        be prepended to paths added to the FilePurger. Otherwise, the raw paths
+        will be used.
+        """
+        p = FilePurger()
+        for entry in self.entries:
+            if prepend_relpath:
+                entry = mozpath.join(self.relpath, entry)
+
+            p.add(entry)
+
+        return p
diff --git a/python/mozbuild/mozpack/test/test_copier.py b/python/mozbuild/mozpack/test/test_copier.py
index 6ab29f2c47b..9b145815a00 100644
--- a/python/mozbuild/mozpack/test/test_copier.py
+++ b/python/mozbuild/mozpack/test/test_copier.py
@@ -90,13 +90,7 @@ class TestFileRegistry(MatchTestTemplate, unittest.TestCase):
         self.assertTrue(self.registry.contains('foo/.foo'))
 
 
-class TestFileCopier(unittest.TestCase):
-    def setUp(self):
-        self.tmpdir = mkdtemp()
-
-    def tearDown(self):
-        shutil.rmtree(self.tmpdir)
-
+class TestFileCopier(TestWithTmpDir):
     def all_dirs(self, base):
         all_dirs = set()
         for root, dirs, files in os.walk(base):
@@ -132,6 +126,27 @@ class TestFileCopier(unittest.TestCase):
         self.assertEqual(self.all_files(self.tmpdir), set(copier.paths()))
         self.assertEqual(self.all_dirs(self.tmpdir), set(['qux']))
 
+    def test_permissions(self):
+        """Ensure files without write permission can be deleted."""
+        with open(self.tmppath('dummy'), 'a'):
+            pass
+
+        p = self.tmppath('no_perms')
+        with open(p, 'a'):
+            pass
+
+        # Make file and directory unwritable. Reminder: making a directory
+        # unwritable prevents modifications (including deletes) from the list
+        # of files in that directory.
+        os.chmod(p, 0400)
+        os.chmod(self.tmpdir, 0400)
+
+        copier = FileCopier()
+        copier.add('dummy', GeneratedFile('content'))
+        result = copier.copy(self.tmpdir)
+        self.assertEqual(result.removed_files_count, 1)
+        self.assertFalse(os.path.exists(p))
+
 
 class TestFilePurger(TestWithTmpDir):
     def test_file_purger(self):
diff --git a/python/mozbuild/mozpack/test/test_files.py b/python/mozbuild/mozpack/test/test_files.py
index 6e8326bfedd..ad6d9e8722b 100644
--- a/python/mozbuild/mozpack/test/test_files.py
+++ b/python/mozbuild/mozpack/test/test_files.py
@@ -24,6 +24,7 @@ from mozpack.chrome.manifest import (
     ManifestOverride,
 )
 import unittest
+import mozfile
 import mozunit
 import os
 import shutil
@@ -41,7 +42,7 @@ class TestWithTmpDir(unittest.TestCase):
         self.tmpdir = mkdtemp()
 
     def tearDown(self):
-        shutil.rmtree(self.tmpdir)
+        mozfile.rmtree(self.tmpdir)
 
     def tmppath(self, relpath):
         return os.path.normpath(os.path.join(self.tmpdir, relpath))
diff --git a/python/mozbuild/mozpack/test/test_manifests.py b/python/mozbuild/mozpack/test/test_manifests.py
new file mode 100644
index 00000000000..9d956c82ed8
--- /dev/null
+++ b/python/mozbuild/mozpack/test/test_manifests.py
@@ -0,0 +1,48 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import unicode_literals
+
+import os
+import unittest
+
+import mozunit
+
+from mozpack.manifests import (
+    PurgeManifest,
+    UnreadablePurgeManifest,
+)
+from mozpack.test.test_files import TestWithTmpDir
+
+
+class TestPurgeManifest(TestWithTmpDir):
+    def test_construct(self):
+        m = PurgeManifest()
+        self.assertEqual(m.relpath, '')
+        self.assertEqual(len(m.entries), 0)
+
+    def test_serialization(self):
+        m = PurgeManifest(relpath='rel')
+        m.add('foo')
+        m.add('bar')
+        p = self.tmppath('m')
+        m.write_file(p)
+
+        self.assertTrue(os.path.exists(p))
+
+        m2 = PurgeManifest.from_path(p)
+        self.assertEqual(m.relpath, m2.relpath)
+        self.assertEqual(m.entries, m2.entries)
+        self.assertEqual(m, m2)
+
+    def test_unknown_version(self):
+        p = self.tmppath('bad')
+
+        with open(p, 'wt') as fh:
+            fh.write('2\n')
+            fh.write('not relevant')
+
+        with self.assertRaises(UnreadablePurgeManifest):
+            PurgeManifest.from_path(p)
+
diff --git a/security/manager/ssl/src/ScopedNSSTypes.h b/security/manager/ssl/src/ScopedNSSTypes.h
index d177dbbc139..f0c5c7f8b6e 100644
--- a/security/manager/ssl/src/ScopedNSSTypes.h
+++ b/security/manager/ssl/src/ScopedNSSTypes.h
@@ -52,8 +52,7 @@ inline nsresult
 PRErrorCode_to_nsresult(PRErrorCode error)
 {
   if (!error) {
-    MOZ_NOT_REACHED("Function failed without calling PR_GetError");
-    return NS_ERROR_UNEXPECTED;
+    MOZ_CRASH("Function failed without calling PR_GetError");
   }
 
   // From NSSErrorsService::GetXPCOMFromNSSError
diff --git a/security/manager/ssl/src/nsUsageArrayHelper.cpp b/security/manager/ssl/src/nsUsageArrayHelper.cpp
index 384f755114e..1ce1fa33cd2 100644
--- a/security/manager/ssl/src/nsUsageArrayHelper.cpp
+++ b/security/manager/ssl/src/nsUsageArrayHelper.cpp
@@ -68,8 +68,7 @@ nsUsageArrayHelper::check(uint32_t previousCheckResult,
                           PRUnichar **outUsages)
 {
   if (!aCertUsage) {
-    MOZ_NOT_REACHED("caller should have supplied non-zero aCertUsage");
-    return nsIX509Cert::NOT_VERIFIED_UNKNOWN;
+    MOZ_CRASH("caller should have supplied non-zero aCertUsage");
   }
 
   if (isFatalError(previousCheckResult)) {
@@ -115,8 +114,7 @@ nsUsageArrayHelper::check(uint32_t previousCheckResult,
     typestr = "VerifyAnyCA";
     break;
   default:
-    MOZ_NOT_REACHED("unknown cert usage passed to check()");
-    return nsIX509Cert::NOT_VERIFIED_UNKNOWN;
+    MOZ_CRASH("unknown cert usage passed to check()");
   }
 
   SECStatus rv = certVerifier->VerifyCert(mCert, aCertUsage,
diff --git a/testing/marionette/client/setup.py b/testing/marionette/client/setup.py
index cd453fa5d27..ab503b9dcf0 100644
--- a/testing/marionette/client/setup.py
+++ b/testing/marionette/client/setup.py
@@ -1,7 +1,7 @@
 import os
 from setuptools import setup, find_packages
 
-version = '0.5.32'
+version = '0.5.33'
 
 # get documentation from the README
 try:
diff --git a/testing/marionette/jar.mn b/testing/marionette/jar.mn
index e364c31012d..3bc49bc0eb3 100644
--- a/testing/marionette/jar.mn
+++ b/testing/marionette/jar.mn
@@ -8,7 +8,7 @@ marionette.jar:
   content/marionette-listener.js    (marionette-listener.js)
   content/marionette-elements.js    (marionette-elements.js)
   content/marionette-sendkeys.js    (marionette-sendkeys.js)
-  content/marionette-log-obj.js     (marionette-log-obj.js)
+  content/marionette-common.js      (marionette-common.js)
   content/marionette-simpletest.js  (marionette-simpletest.js)
   content/EventUtils.js  (EventUtils.js)
   content/ChromeUtils.js  (ChromeUtils.js)
diff --git a/testing/marionette/marionette-common.js b/testing/marionette/marionette-common.js
new file mode 100644
index 00000000000..3b05560ea70
--- /dev/null
+++ b/testing/marionette/marionette-common.js
@@ -0,0 +1,85 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ *
+ * This file contains common code that is shared between marionette-server.js
+ * and marionette-listener.js.
+ *
+ */
+
+/**
+ * Creates an error message for a JavaScript exception thrown during
+ * execute_(async_)script.
+ *
+ * This will generate a [msg, trace] pair like:
+ *
+ * ['ReferenceError: foo is not defined',
+ *  'execute_script @test_foo.py, line 10
+ *   inline javascript, line 2
+ *   src: "return foo;"']
+ *
+ * @param error An Error object passed to a catch() clause.
+          fnName The name of the function to use in the stack trace message
+                 (e.g., 'execute_script').
+          pythonFile The filename of the test file containing the Marionette
+                  command that caused this exception to occur.
+          pythonLine The line number of the above test file.
+          script The JS script being executed in text form.
+ */
+this.createStackMessage = function createStackMessage(error, fnName, pythonFile,
+  pythonLine, script) {
+  let python_stack = fnName + " @" + pythonFile + ", line " + pythonLine;
+  let stack = error.stack.split("\n");
+  let line = stack[0].substr(stack[0].lastIndexOf(':') + 1);
+  let msg = error.name + ": " + error.message;
+  let trace = python_stack +
+    "\ninline javascript, line " + line +
+    "\nsrc: \"" + script.split("\n")[line] + "\"";
+  return [msg, trace];
+}
+
+this.MarionetteLogObj = function MarionetteLogObj() {
+  this.logs = [];
+}
+MarionetteLogObj.prototype = {
+  /**
+   * Log message. Accepts user defined log-level.
+   * @param msg String
+   *        The message to be logged
+   * @param level String
+   *        The logging level to be used
+   */
+  log: function ML_log(msg, level) {
+    let lev = level ? level : "INFO";
+    this.logs.push( [lev, msg, (new Date()).toString()]);
+  },
+
+  /**
+   * Add a list of logs to its list
+   * @param msgs Object
+   *        Takes a list of strings
+   */
+  addLogs: function ML_addLogs(msgs) {
+    for (let i = 0; i < msgs.length; i++) {
+      this.logs.push(msgs[i]);
+    }
+  },
+  
+  /**
+   * Return all logged messages.
+   */
+  getLogs: function ML_getLogs() {
+    let logs = this.logs;
+    this.clearLogs();
+    return logs;
+  },
+
+  /**
+   * Clears the logs
+   */
+  clearLogs: function ML_clearLogs() {
+    this.logs = [];
+  },
+}
diff --git a/testing/marionette/marionette-listener.js b/testing/marionette/marionette-listener.js
index 61c5639f9d1..c7a77d81d39 100644
--- a/testing/marionette/marionette-listener.js
+++ b/testing/marionette/marionette-listener.js
@@ -12,7 +12,7 @@ let loader = Cc["@mozilla.org/moz/jssubscript-loader;1"]
                .getService(Ci.mozIJSSubScriptLoader);
 
 loader.loadSubScript("chrome://marionette/content/marionette-simpletest.js");
-loader.loadSubScript("chrome://marionette/content/marionette-log-obj.js");
+loader.loadSubScript("chrome://marionette/content/marionette-common.js");
 Cu.import("chrome://marionette/content/marionette-elements.js");
 Cu.import("resource://gre/modules/FileUtils.jsm");
 Cu.import("resource://gre/modules/NetUtil.jsm");
@@ -279,35 +279,6 @@ function resetValues() {
   mouseEventsOnly = false;
 }
 
-/**
- * Creates an error message for a JavaScript exception thrown during
- * execute_(async_)script.
- *
- * This will generate a [msg, trace] pair like:
- *
- * ['ReferenceError: foo is not defined',
- *  'execute_script @test_foo.py, line 10
- *   inline javascript, line 2
- *   src: "return foo;"']
- *
- * @param error An Error object passed to a catch() clause.
-          fnName The name of the function to use in the stack trace message
-                 (e.g., 'execute_script').
-          pythonFile The filename of the test file containing the Marionette
-                  command that caused this exception to occur.
-          pythonLine The line number of the above test file.
-          script The JS script being executed in text form.
- */
-function createStackMessage(error, fnName, pythonFile, pythonLine, script) {
-  let python_stack = fnName + " @" + pythonFile + ", line " + pythonLine;
-  let stack = error.stack.split("\n");
-  let line = stack[0].substr(stack[0].lastIndexOf(':') + 1);
-  let msg = error.name + ": " + error.message;
-  let trace = python_stack +
-              "\ninline javascript, line " + line +
-              "\nsrc: \"" + script.split("\n")[line] + "\"";
-  return [msg, trace];
-}
 
 /*
  * Marionette Methods
diff --git a/testing/marionette/marionette-log-obj.js b/testing/marionette/marionette-log-obj.js
deleted file mode 100644
index 442e4e08153..00000000000
--- a/testing/marionette/marionette-log-obj.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-this.MarionetteLogObj = function MarionetteLogObj() {
-  this.logs = [];
-}
-MarionetteLogObj.prototype = {
-  /**
-   * Log message. Accepts user defined log-level.
-   * @param msg String
-   *        The message to be logged
-   * @param level String
-   *        The logging level to be used
-   */
-  log: function ML_log(msg, level) {
-    let lev = level ? level : "INFO";
-    this.logs.push( [lev, msg, (new Date()).toString()]);
-  },
-
-  /**
-   * Add a list of logs to its list
-   * @param msgs Object
-   *        Takes a list of strings
-   */
-  addLogs: function ML_addLogs(msgs) {
-    for (let i = 0; i < msgs.length; i++) {
-      this.logs.push(msgs[i]);
-    }
-  },
-  
-  /**
-   * Return all logged messages.
-   */
-  getLogs: function ML_getLogs() {
-    let logs = this.logs;
-    this.clearLogs();
-    return logs;
-  },
-
-  /**
-   * Clears the logs
-   */
-  clearLogs: function ML_clearLogs() {
-    this.logs = [];
-  },
-}
diff --git a/testing/marionette/marionette-server.js b/testing/marionette/marionette-server.js
index c94ce9eb9a7..2a5ccc22a6d 100644
--- a/testing/marionette/marionette-server.js
+++ b/testing/marionette/marionette-server.js
@@ -14,7 +14,7 @@ logger.info('marionette-server.js loaded');
 let loader = Cc["@mozilla.org/moz/jssubscript-loader;1"]
                .getService(Ci.mozIJSSubScriptLoader);
 loader.loadSubScript("chrome://marionette/content/marionette-simpletest.js");
-loader.loadSubScript("chrome://marionette/content/marionette-log-obj.js");
+loader.loadSubScript("chrome://marionette/content/marionette-common.js");
 Cu.import("chrome://marionette/content/marionette-elements.js");
 let utils = {};
 loader.loadSubScript("chrome://marionette/content/EventUtils.js", utils);
@@ -380,37 +380,6 @@ MarionetteServerConnection.prototype = {
     this.sendToClient({from:this.actorID, error: error_msg}, command_id);
   },
 
-  /**
-   * Creates an error message for a JavaScript exception thrown during
-   * execute_(async_)script.
-   *
-   * This will generate a [msg, trace] pair like:
-   *
-   * ['ReferenceError: foo is not defined',
-   *  'execute_script @test_foo.py, line 10
-   *   inline javascript, line 2
-   *   src: "return foo;"']
-   *
-   * @param error An Error object passed to a catch() clause.
-            fnName The name of the function to use in the stack trace message
-                   (e.g., 'execute_script').
-            pythonFile The filename of the test file containing the Marionette
-                    command that caused this exception to occur.
-            pythonLine The line number of the above test file.
-            script The JS script being executed in text form.
-   */
-  createStackMessage: function MDA_createStackMessage(error, fnName, pythonFile,
-      pythonLine, script) {
-    let python_stack = fnName + " @" + pythonFile + ", line " + pythonLine;
-    let stack = error.stack.split("\n");
-    let line = stack[0].substr(stack[0].lastIndexOf(':') + 1);
-    let msg = error.name + ": " + error.message;
-    let trace = python_stack +
-                "\ninline javascript, line " + line +
-                "\nsrc: \"" + script.split("\n")[line] + "\"";
-    return [msg, trace];
-  },
-
   /**
    * Gets the current active window
    * 
@@ -848,11 +817,11 @@ MarionetteServerConnection.prototype = {
                                   false, command_id, timeout);
     }
     catch (e) {
-      let error = this.createStackMessage(e,
-                                          "execute_script",
-                                          aRequest.filename,
-                                          aRequest.line,
-                                          script);
+      let error = createStackMessage(e,
+                                     "execute_script",
+                                     aRequest.filename,
+                                     aRequest.line,
+                                     script);
       this.sendError(error[0], 17, error[1], command_id);
     }
   },
@@ -1036,11 +1005,11 @@ MarionetteServerConnection.prototype = {
       this.executeScriptInSandbox(_chromeSandbox, script, directInject,
                                   true, command_id, timeout);
     } catch (e) {
-      let error = this.createStackMessage(e,
-                                          "execute_async_script",
-                                          aRequest.filename,
-                                          aRequest.line,
-                                          script);
+      let error = createStackMessage(e,
+                                     "execute_async_script",
+                                     aRequest.filename,
+                                     aRequest.line,
+                                     script);
       chromeAsyncReturnFunc(error[0], 17, error[1]);
     }
   },
diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index 876a2e8e001..a26c3ade513 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -263,6 +263,11 @@ class MochitestOptions(optparse.OptionParser):
                     help = "launches tests in immersive browser")
     defaults["immersiveMode"] = False
 
+    self.add_option("--httpd-path", action = "store",
+                    type = "string", dest = "httpdPath",
+                    help = "path to the httpd.js file")
+    defaults["httpdPath"] = None
+
     # -h, --help are automatically handled by OptionParser
 
     self.set_defaults(**defaults)
@@ -316,7 +321,6 @@ See <http://mochikit.com/doc/html/MochiKit/Logging.html> for details on the logg
     options.httpPort = self._automation.DEFAULT_HTTP_PORT
     options.sslPort = self._automation.DEFAULT_SSL_PORT
     options.webSocketPort = self._automation.DEFAULT_WEBSOCKET_PORT
-    options.httpdPath = '.' 
 
     if options.vmwareRecording:
       if not self._automation.IS_WIN32:
@@ -411,7 +415,11 @@ class MochitestServer:
     self.httpPort = options.httpPort
     self.shutdownURL = "http://%(server)s:%(port)s/server/shutdown" % { "server" : self.webServer, "port" : self.httpPort }
     self.testPrefix = "'webapprt_'" if options.webapprtContent else "undefined"
-    self._httpdPath = options.httpdPath
+    if options.httpdPath:
+        self._httpdPath = options.httpdPath
+    else:
+        self._httpdPath = '.'
+    self._httpdPath = os.path.abspath(self._httpdPath)
 
   def start(self):
     "Run the Mochitest server, returning the process ID of the server."
diff --git a/testing/mochitest/runtestsb2g.py b/testing/mochitest/runtestsb2g.py
index 64f3383b96d..22ff0235799 100644
--- a/testing/mochitest/runtestsb2g.py
+++ b/testing/mochitest/runtestsb2g.py
@@ -475,6 +475,11 @@ class B2GDeviceMochitest(B2GMochitest):
         if options.utilityPath == None:
             print "ERROR: unable to find utility path for %s, please specify with --utility-path" % (os.name)
             sys.exit(1)
+        # httpd-path is specified by standard makefile targets and may be specified
+        # on the command line to select a particular version of httpd.js. If not
+        # specified, try to select the one from xre.zip, as required in bug 882932.
+        if not options.httpdPath:
+            options.httpdPath = os.path.join(options.utilityPath, "components")
 
         options.profilePath = tempfile.mkdtemp()
         self.server = MochitestServer(localAutomation, options)
diff --git a/testing/mochitest/runtestsremote.py b/testing/mochitest/runtestsremote.py
index 1d2e9021450..364cd553cf4 100644
--- a/testing/mochitest/runtestsremote.py
+++ b/testing/mochitest/runtestsremote.py
@@ -70,11 +70,6 @@ class RemoteOptions(MochitestOptions):
                     help = "http port of the remote web server")
         defaults["httpPort"] = automation.DEFAULT_HTTP_PORT
 
-        self.add_option("--httpd-path", action = "store",
-                    type = "string", dest = "httpdPath",
-                    help = "path to the httpd.js file")
-        defaults["httpdPath"] = None
-
         self.add_option("--ssl-port", action = "store",
                     type = "string", dest = "sslPort",
                     help = "ssl port of the remote web server")
@@ -218,11 +213,6 @@ class RemoteOptions(MochitestOptions):
         tempPort = options.httpPort
         tempSSL = options.sslPort
         tempIP = options.webServer
-        # httpd-path is specified by standard makefile targets and may be specified
-        # on the command line to select a particular version of httpd.js. If not
-        # specified, try to select the one from hostutils.zip, as required in bug 882932.
-        if not options.httpdPath:
-            options.httpdPath = options.utilityPath + "/components"
         options = MochitestOptions.verifyOptions(self, options, mochitest)
         options.webServer = tempIP
         options.app = temp
@@ -312,6 +302,11 @@ class MochiRemote(Mochitest):
         if options.utilityPath == None:
             print "ERROR: unable to find utility path for %s, please specify with --utility-path" % (os.name)
             sys.exit(1)
+        # httpd-path is specified by standard makefile targets and may be specified
+        # on the command line to select a particular version of httpd.js. If not
+        # specified, try to select the one from hostutils.zip, as required in bug 882932.
+        if not options.httpdPath:
+            options.httpdPath = os.path.join(options.utilityPath, "components")
 
         xpcshell_path = os.path.join(options.utilityPath, xpcshell)
         if localAutomation.elf_arm(xpcshell_path):
diff --git a/toolkit/components/ctypes/tests/jsctypes-test-finalizer.cpp b/toolkit/components/ctypes/tests/jsctypes-test-finalizer.cpp
index f3d5a678d37..f2b2cb0d662 100644
--- a/toolkit/components/ctypes/tests/jsctypes-test-finalizer.cpp
+++ b/toolkit/components/ctypes/tests/jsctypes-test-finalizer.cpp
@@ -64,7 +64,7 @@ void
 test_finalizer_rel_size_t(size_t i)
 {
   if (--gFinalizerTestResources[i] < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
 }
 
@@ -72,7 +72,7 @@ size_t
 test_finalizer_rel_size_t_return_size_t(size_t i)
 {
   if (-- gFinalizerTestResources[i] < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
   return i;
 }
@@ -81,7 +81,7 @@ RECT
 test_finalizer_rel_size_t_return_struct_t(size_t i)
 {
   if (-- gFinalizerTestResources[i] < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
   const int32_t narrowed = (int32_t)i;
   RECT result = { narrowed, narrowed, narrowed, narrowed };
@@ -109,7 +109,7 @@ void
 test_finalizer_rel_int32_t(int32_t i)
 {
   if (--gFinalizerTestResources[i] < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
 }
 
@@ -134,7 +134,7 @@ void
 test_finalizer_rel_int64_t(int64_t i)
 {
   if (-- gFinalizerTestResources[i] < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
 }
 
@@ -161,7 +161,7 @@ test_finalizer_rel_ptr_t(void *i)
   int *as_int = (int*)i;
   -- (*as_int);
   if (*as_int < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
 }
 
@@ -187,7 +187,7 @@ test_finalizer_rel_int32_ptr_t(int32_t *i)
 {
   -- (*i);
   if (*i < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
 }
 
@@ -212,7 +212,7 @@ void
 test_finalizer_rel_null_t(void *i)
 {
   if (i != NULL) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
   gFinalizerTestResources[0] --;
 }
@@ -251,7 +251,7 @@ test_finalizer_rel_string_t(char *i)
 {
   int index = atoi(i);
   if (index < 0 || index >= (int)gFinalizerTestSize) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
   gFinalizerTestResources[index] --;
 }
@@ -285,7 +285,7 @@ test_finalizer_rel_struct_t(RECT i)
 {
   int index = i.top;
   if (index < 0 || index >= (int)gFinalizerTestSize) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
   gFinalizerTestResources[index] --;
 }
@@ -295,7 +295,7 @@ test_finalizer_struct_resource_is_acquired(RECT i)
 {
   int index = i.top;
   if (index < 0 || index >= (int)gFinalizerTestSize) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
   return gFinalizerTestResources[index] == 1;
 }
@@ -316,7 +316,7 @@ void
 test_finalizer_rel_size_t_set_errno(size_t i)
 {
   if (-- gFinalizerTestResources[i] < 0) {
-    MOZ_NOT_REACHED("Assertion failed");
+    MOZ_CRASH("Assertion failed");
   }
   errno = 10;
 }
diff --git a/toolkit/components/osfile/_PromiseWorker.jsm b/toolkit/components/osfile/_PromiseWorker.jsm
index 6945768f03e..08a467d307a 100644
--- a/toolkit/components/osfile/_PromiseWorker.jsm
+++ b/toolkit/components/osfile/_PromiseWorker.jsm
@@ -10,7 +10,7 @@
 this.EXPORTED_SYMBOLS = ["PromiseWorker"];
 
 // The library of promises.
-Components.utils.import("resource://gre/modules/commonjs/sdk/core/promise.js", this);
+Components.utils.import("resource://gre/modules/Promise.jsm", this);
 
 /**
  * An implementation of queues (FIFO).
diff --git a/toolkit/components/osfile/osfile_async_front.jsm b/toolkit/components/osfile/osfile_async_front.jsm
index 81263077fa7..2bd02d6abd5 100644
--- a/toolkit/components/osfile/osfile_async_front.jsm
+++ b/toolkit/components/osfile/osfile_async_front.jsm
@@ -45,7 +45,7 @@ if (OS.Constants.Win) {
 let Type = OS.Shared.Type;
 
 // The library of promises.
-Components.utils.import("resource://gre/modules/commonjs/sdk/core/promise.js", this);
+Components.utils.import("resource://gre/modules/Promise.jsm", this);
 
 // The implementation of communications
 Components.utils.import("resource://gre/modules/osfile/_PromiseWorker.jsm", this);
diff --git a/toolkit/components/osfile/tests/mochi/main_test_osfile_async.js b/toolkit/components/osfile/tests/mochi/main_test_osfile_async.js
index e68f9d10098..dbec46232f7 100644
--- a/toolkit/components/osfile/tests/mochi/main_test_osfile_async.js
+++ b/toolkit/components/osfile/tests/mochi/main_test_osfile_async.js
@@ -1,7 +1,7 @@
 "use strict";
 
 Components.utils.import("resource://gre/modules/osfile.jsm");
-Components.utils.import("resource://gre/modules/commonjs/sdk/core/promise.js");
+Components.utils.import("resource://gre/modules/Promise.jsm");
 Components.utils.import("resource://gre/modules/Task.jsm");
 
 // The following are used to compare against a well-tested reference
diff --git a/toolkit/components/protobuf/moz.build b/toolkit/components/protobuf/moz.build
index 2768b721ef4..0200de6e091 100644
--- a/toolkit/components/protobuf/moz.build
+++ b/toolkit/components/protobuf/moz.build
@@ -7,29 +7,29 @@
 MODULE = 'protobuf'
 
 EXPORTS.protobuf.google.protobuf += [
-    'extension_set.h',
-    'generated_message_util.h',
-    'message_lite.h',
-    'repeated_field.h',
-    'wire_format_lite.h',
-    'wire_format_lite_inl.h',
+    'google/protobuf/extension_set.h',
+    'google/protobuf/generated_message_util.h',
+    'google/protobuf/message_lite.h',
+    'google/protobuf/repeated_field.h',
+    'google/protobuf/wire_format_lite.h',
+    'google/protobuf/wire_format_lite_inl.h',
 ]
 
 EXPORTS.protobuf.google.protobuf.stubs += [
-    'common.h',
-    'hash.h',
-    'map-util.h',
-    'once.h',
-    'stl_util-inl.h',
+    'google/protobuf/stubs/common.h',
+    'google/protobuf/stubs/hash.h',
+    'google/protobuf/stubs/map-util.h',
+    'google/protobuf/stubs/once.h',
+    'google/protobuf/stubs/stl_util-inl.h',
 ]
 
 EXPORTS.protobuf.google.protobuf.io += [
-    'coded_stream.h',
-    'coded_stream_inl.h',
-    'package_info.h',
-    'zero_copy_stream.h',
-    'zero_copy_stream_impl.h',
-    'zero_copy_stream_impl_lite.h',
+    'google/protobuf/io/coded_stream.h',
+    'google/protobuf/io/coded_stream_inl.h',
+    'google/protobuf/io/zero_copy_stream.h',
+    'google/protobuf/io/zero_copy_stream_impl.h',
+    'google/protobuf/io/zero_copy_stream_impl_lite.h',
+    'google/protobuf/package_info.h',
 ]
 
 CPP_SOURCES += [
diff --git a/toolkit/components/telemetry/Telemetry.cpp b/toolkit/components/telemetry/Telemetry.cpp
index 71a585ff5a6..1e53e3ffbac 100644
--- a/toolkit/components/telemetry/Telemetry.cpp
+++ b/toolkit/components/telemetry/Telemetry.cpp
@@ -671,8 +671,7 @@ JSHistogram_Snapshot(JSContext *cx, unsigned argc, JS::Value *vp)
     JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(snapshot));
     return JS_TRUE;
   default:
-    MOZ_NOT_REACHED("unhandled reflection status");
-    return JS_FALSE;
+    MOZ_CRASH("unhandled reflection status");
   }
 }
 
diff --git a/toolkit/content/aboutSupport.xhtml b/toolkit/content/aboutSupport.xhtml
index 934e0a51cfc..e3973e66e10 100644
--- a/toolkit/content/aboutSupport.xhtml
+++ b/toolkit/content/aboutSupport.xhtml
@@ -81,6 +81,7 @@
             </td>
           </tr>
 
+#ifndef ANDROID
           <tr class="no-copy">
             <th class="column">
               &aboutSupport.appBasicsUpdateHistory;
@@ -92,6 +93,7 @@
               </button>
             </td>
           </tr>
+#endif
 
           <tr>
             <th class="column">
diff --git a/toolkit/content/resetProfile.js b/toolkit/content/resetProfile.js
index dcb4065d68f..a908f7de8bf 100644
--- a/toolkit/content/resetProfile.js
+++ b/toolkit/content/resetProfile.js
@@ -58,6 +58,7 @@ function getMigratedData() {
 
   // From migration.properties
   const MIGRATED_TYPES = [
+    128,// Windows/Tabs
     4,  // History and Bookmarks
     16, // Passwords
     8,  // Form History
diff --git a/toolkit/content/tests/chrome/test_bug562554.xul b/toolkit/content/tests/chrome/test_bug562554.xul
index 24a3dc0337a..3eb18b0d07d 100644
--- a/toolkit/content/tests/chrome/test_bug562554.xul
+++ b/toolkit/content/tests/chrome/test_bug562554.xul
@@ -4,20 +4,29 @@
 <!--
   XUL Widget Test for bug 562554
   -->
-<window title="Bug 557987" width="400" height="400"
-        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<window title="Bug 562554" width="400" height="400"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>  
   <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
 
-  <toolbarbutton type="menu" id="toolbarmenu" height="200px">
-    <menupopup id="menupopup" onpopupshowing="eventReceived('popupshowing'); return false;"/>
-    <stack>
-       <button width="100px" left="0px" height="30px" id="button1"
-        allowevents="true" onclick="eventReceived('clickbutton1'); return false;"/>
+<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl">
+  <xbl:binding id="menu" display="xul:menu"
+               extends="chrome://global/content/bindings/button.xml#button-base">
+    <xbl:content>
+      <xbl:children includes="menupopup"/>
+      <xul:stack>
+         <xul:button width="100" left="0" top="0" height="30" allowevents="true"
+                     onclick="eventReceived('clickbutton1'); return false;"/>
+         <xul:button width="100" left="70" top="0" height="30" 
+                     onclick="eventReceived('clickbutton2'); return false;"/>
+      </xul:stack>
+    </xbl:content>
+  </xbl:binding>
+</xbl:bindings>
 
-       <button width="100px" left="70px" id="button2"
-        onclick="eventReceived('clickbutton2'); return false;"/>
-    </stack>
+  <toolbarbutton type="menu" id="toolbarmenu" height="200" style="-moz-binding: url(#menu);">
+    <menupopup id="menupopup" onpopupshowing="eventReceived('popupshowing'); return false;"/>
   </toolbarbutton>
 
   <!-- test results are displayed in the html:body -->
@@ -40,13 +49,13 @@ let tests = [
   function() synthesizeMouse($("toolbarmenu"), 10, 50, {}, window),
 
   // Click on button1 which has allowevents="true" - should call clickbutton1
-  function() synthesizeMouse($("button1"), 10, 15, {}, window),
+  function() synthesizeMouse($("toolbarmenu"), 10, 15, {}, window),
 
   // Click on button2 where it intersects with button1 - should call popupshowing
-  function() synthesizeMouse($("button2"), 5, 15, {}, window),
+  function() synthesizeMouse($("toolbarmenu"), 85, 15, {}, window),
 
   // Click on button2 outside of intersection - should call popupshowing
-  function() synthesizeMouse($("button2"), 50, 15, {}, window)
+  function() synthesizeMouse($("toolbarmenu"), 150, 15, {}, window)
 ];
 
 function nextTest() {
diff --git a/toolkit/identity/IdentityCryptoService.cpp b/toolkit/identity/IdentityCryptoService.cpp
index a87439a1cf4..efa1e6c5615 100644
--- a/toolkit/identity/IdentityCryptoService.cpp
+++ b/toolkit/identity/IdentityCryptoService.cpp
@@ -357,11 +357,9 @@ GenerateKeyPair(PK11SlotInfo * slot,
     return PRErrorCode_to_nsresult(PR_GetError());
   }
   if (!*publicKey) {
-	SECKEY_DestroyPrivateKey(*privateKey);
-	*privateKey = NULL;
-    MOZ_NOT_REACHED("PK11_GnerateKeyPair returned private key without public "
-                    "key");
-    return NS_ERROR_UNEXPECTED;
+	  SECKEY_DestroyPrivateKey(*privateKey);
+	  *privateKey = NULL;
+    MOZ_CRASH("PK11_GnerateKeyPair returned private key without public key");
   }
 
   return NS_OK;
@@ -468,8 +466,7 @@ KeyGenRunnable::Run()
           mRv = GenerateDSAKeyPair(slot, &privk, &pubk);
           break;
         default:
-          MOZ_NOT_REACHED("unknown key type");
-          mRv = NS_ERROR_UNEXPECTED;
+          MOZ_CRASH("unknown key type");
         }
 
         PK11_FreeSlot(slot);
diff --git a/toolkit/themes/osx/global/button.css b/toolkit/themes/osx/global/button.css
index f908c6bfce9..d66740fbef7 100644
--- a/toolkit/themes/osx/global/button.css
+++ b/toolkit/themes/osx/global/button.css
@@ -3,6 +3,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 @namespace url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
+@namespace xbl "http://www.mozilla.org/xbl";
 
 button {
   -moz-appearance: button;
@@ -83,17 +84,28 @@ button[dlgtype="help"]:-moz-focusring {
   -moz-outline-radius: 10000px;
 }
 
-button[dlgtype="help"] > .button-box > .button-icon {
+button[dlgtype="help"] > .button-box > .button-icon,
+/* Due to XBL refactoring changes, default content in a binding is
+   contained in a <xbl:children> element and thus the selector above
+   will not match the help button icon. When the XBL refactoring is
+   shipped (bug 653881), the selector above may be removed. */
+button[dlgtype="help"] > .button-box > xbl|children > .button-icon {
   list-style-image: url("chrome://global/skin/icons/question-mark.png");
   -moz-image-region: rect(0 24px 24px 0);
   padding: 0;
   margin: 0;
 }
 
-button[dlgtype="help"]:active > .button-box > .button-icon {
+button[dlgtype="help"]:active > .button-box > .button-icon,
+/* When the XBL refactoring is shipped (bug 653881),
+   the selector above may be removed. */
+button[dlgtype="help"]:active > .button-box > xbl|children > .button-icon {
   -moz-image-region: rect(0 48px 24px 24px);
 }
 
-button[dlgtype="help"] > .button-box > .button-text {
+button[dlgtype="help"] > .button-box > .button-text,
+/* When the XBL refactoring is shipped (bug 653881),
+   the selector above may be removed. */
+button[dlgtype="help"] > .button-box > xbl|children > .button-text {
   display: none;
 }
diff --git a/toolkit/themes/osx/global/global.css b/toolkit/themes/osx/global/global.css
index 013ca0f95cc..e0831d317cc 100644
--- a/toolkit/themes/osx/global/global.css
+++ b/toolkit/themes/osx/global/global.css
@@ -10,6 +10,8 @@
 
 /* ::::: XBL bindings ::::: */
 
+@namespace xbl "http://www.mozilla.org/xbl";
+
 menulist > menupopup,
 .menulist-menupopup {
   -moz-binding: url("chrome://global/content/bindings/popup.xml#popup-scrollbars");
@@ -281,7 +283,7 @@ notification > button:active:hover:-moz-focusring {
   box-shadow: @focusRingShadow@, @roundButtonPressedShadow@;
 }
 
-notification > button > .button-box > .button-text {
+notification > button > .button-box > xbl|children > .button-text {
   margin: 0 !important;
 }
 
diff --git a/widget/cocoa/nsChildView.h b/widget/cocoa/nsChildView.h
index 2861ca38ab4..db19a1fa57b 100644
--- a/widget/cocoa/nsChildView.h
+++ b/widget/cocoa/nsChildView.h
@@ -105,6 +105,18 @@ class GLManager;
 
 @interface NSView (Undocumented)
 
+// Draws the title string of a window.
+// Present on NSThemeFrame since at least 10.6.
+// _drawTitleBar is somewhat complex, and has changed over the years
+// since OS X 10.6.  But in that time it's never done anything that
+// would break when called outside of -[NSView drawRect:] (which we
+// sometimes do), or whose output can't be redirected to a
+// CGContextRef object (which we also sometimes do).  This is likely
+// to remain true for the indefinite future.  However we should
+// check _drawTitleBar in each new major version of OS X.  For more
+// information see bug 877767.
+- (void)_drawTitleBar:(NSRect)aRect;
+
 // Returns an NSRect that is the bounding box for all an NSView's dirty
 // rectangles (ones that need to be redrawn).  The full list of dirty
 // rectangles can be obtained by calling -[NSView _dirtyRegion] and then
diff --git a/widget/cocoa/nsChildView.mm b/widget/cocoa/nsChildView.mm
index f5ccad556cc..fce7541b79b 100644
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@@ -151,6 +151,7 @@ uint32_t nsChildView::sLastInputEventCount = 0;
 - (void)clearCorners;
 
 // Overlay drawing functions for traditional CGContext drawing
+- (void)drawTitleString;
 - (void)drawTitlebarHighlight;
 - (void)maskTopCornersInContext:(CGContextRef)aContext;
 
@@ -2084,7 +2085,6 @@ nsChildView::UpdateTitlebarImageBuffer()
   double scale = BackingScaleFactor();
   CGContextScaleCTM(ctx, scale, scale);
   NSGraphicsContext* oldContext = [NSGraphicsContext currentContext];
-  [NSGraphicsContext setCurrentContext:[NSGraphicsContext graphicsContextWithGraphicsPort:ctx flipped:YES]];
 
   CGContextSaveGState(ctx);
 
@@ -2094,6 +2094,13 @@ nsChildView::UpdateTitlebarImageBuffer()
     CGContextTranslateCTM(ctx, 0, [frameView bounds].size.height);
     CGContextScaleCTM(ctx, 1, -1);
   }
+  NSGraphicsContext* context = [NSGraphicsContext graphicsContextWithGraphicsPort:ctx flipped:[frameView isFlipped]];
+  [NSGraphicsContext setCurrentContext:context];
+
+  // Draw the title string.
+  if ([frameView respondsToSelector:@selector(_drawTitleBar:)]) {
+    [frameView _drawTitleBar:[frameView bounds]];
+  }
 
   // Draw the titlebar controls into the titlebar image.
   for (id view in [window titlebarControls]) {
@@ -2119,14 +2126,17 @@ nsChildView::UpdateTitlebarImageBuffer()
     CGContextSaveGState(ctx);
     CGContextTranslateCTM(ctx, viewFrame.origin.x, viewFrame.origin.y);
 
-    if ([view isFlipped]) {
+    if ([context isFlipped] != [view isFlipped]) {
       CGContextTranslateCTM(ctx, 0, viewFrame.size.height);
       CGContextScaleCTM(ctx, 1, -1);
     }
 
+    [NSGraphicsContext setCurrentContext:[NSGraphicsContext graphicsContextWithGraphicsPort:ctx flipped:[view isFlipped]]];
+
     NSRect intersectRect = DevPixelsToCocoaPoints(intersection.GetBounds());
     [cell drawWithFrame:[view convertRect:intersectRect fromView:mView] inView:button];
 
+    [NSGraphicsContext setCurrentContext:context];
     CGContextRestoreGState(ctx);
   }
 
@@ -2952,7 +2962,7 @@ NSEvent* gLastDragMouseDownEvent = nil;
   nsIntRect boundingRect = mGeckoChild->CocoaPointsToDevPixels(aRect);
   const NSRect *rects;
   NSInteger count;
-  [[NSView focusView] getRectsBeingDrawn:&rects count:&count];
+  [self getRectsBeingDrawn:&rects count:&count];
 
   if (count > MAX_RECTS_IN_REGION) {
     return boundingRect;
@@ -2960,9 +2970,7 @@ NSEvent* gLastDragMouseDownEvent = nil;
 
   nsIntRegion region;
   for (NSInteger i = 0; i < count; ++i) {
-    // Add the rect to the region.
-    NSRect r = [self convertRect:rects[i] fromView:[NSView focusView]];
-    region.Or(region, mGeckoChild->CocoaPointsToDevPixels(r));
+    region.Or(region, mGeckoChild->CocoaPointsToDevPixels(rects[i]));
   }
   region.And(region, boundingRect);
   return region;
@@ -3026,12 +3034,6 @@ NSEvent* gLastDragMouseDownEvent = nil;
 
   PROFILER_LABEL("widget", "ChildView::drawRect");
 
-  // Clip to the dirty region.
-  const NSRect *rects;
-  NSInteger count;
-  [[NSView focusView] getRectsBeingDrawn:&rects count:&count];
-  CGContextClipToRects(aContext, (CGRect*)rects, count);
-
   // The CGContext that drawRect supplies us with comes with a transform that
   // scales one user space unit to one Cocoa point, which can consist of
   // multiple dev pixels. But Gecko expects its supplied context to be scaled
@@ -3097,6 +3099,7 @@ NSEvent* gLastDragMouseDownEvent = nil;
   }
 
   if ([self isCoveringTitlebar]) {
+    [self drawTitleString];
     [self drawTitlebarHighlight];
     [self maskTopCornersInContext:aContext];
   }
@@ -3266,6 +3269,26 @@ NSEvent* gLastDragMouseDownEvent = nil;
   CGContextRestoreGState(aContext);
 }
 
+- (void)drawTitleString
+{
+  NSView* frameView = [[[self window] contentView] superview];
+  if (![frameView respondsToSelector:@selector(_drawTitleBar:)]) {
+    return;
+  }
+
+  NSGraphicsContext* oldContext = [NSGraphicsContext currentContext];
+  CGContextRef ctx = (CGContextRef)[oldContext graphicsPort];
+  CGContextSaveGState(ctx);
+  if ([oldContext isFlipped] != [frameView isFlipped]) {
+    CGContextTranslateCTM(ctx, 0, [self bounds].size.height);
+    CGContextScaleCTM(ctx, 1, -1);
+  }
+  [NSGraphicsContext setCurrentContext:[NSGraphicsContext graphicsContextWithGraphicsPort:ctx flipped:[frameView isFlipped]]];
+  [frameView _drawTitleBar:[frameView bounds]];
+  CGContextRestoreGState(ctx);
+  [NSGraphicsContext setCurrentContext:oldContext];
+}
+
 - (void)drawTitlebarHighlight
 {
   DrawTitlebarHighlight([self bounds].size, [self cornerRadius],
@@ -3330,13 +3353,6 @@ NSEvent* gLastDragMouseDownEvent = nil;
   [super viewWillDraw];
 }
 
-// Allows us to turn off setting up the clip region
-// before each drawRect. We already clip within gecko.
-- (BOOL)wantsDefaultClipping
-{
-  return NO;
-}
-
 #if USE_CLICK_HOLD_CONTEXTMENU
 //
 // -clickHoldCallback:
@@ -4828,7 +4844,7 @@ static int32_t RoundUp(double aDouble)
   if (mGeckoChild &&
       mGeckoChild->GetInputContext().IsPasswordEditor() !=
         TextInputHandler::IsSecureEventInputEnabled()) {
-    MOZ_NOT_REACHED("in wrong secure input mode");
+    MOZ_CRASH("in wrong secure input mode");
   }
 #endif // #if !defined(RELEASE_BUILD) || defined(DEBUG)
 
diff --git a/widget/gonk/nsWindow.cpp b/widget/gonk/nsWindow.cpp
index 1359a5934a2..0971dc739d4 100644
--- a/widget/gonk/nsWindow.cpp
+++ b/widget/gonk/nsWindow.cpp
@@ -174,8 +174,7 @@ nsWindow::nsWindow()
             sRotationMatrix.Rotate(M_PI);
             break;
         default:
-            MOZ_NOT_REACHED("Unknown rotation");
-            break;
+            MOZ_CRASH("Unknown rotation");
         }
         sVirtualBounds = gScreenBounds;
 
@@ -847,8 +846,7 @@ ComputeOrientation(uint32_t aRotation, const nsIntSize& aScreenSize)
         return (naturallyPortrait ? eScreenOrientation_LandscapeSecondary : 
                 eScreenOrientation_PortraitSecondary);
     default:
-        MOZ_NOT_REACHED("Gonk screen must always have a known rotation");
-        return eScreenOrientation_None;
+        MOZ_CRASH("Gonk screen must always have a known rotation");
     }
 }
 
diff --git a/widget/gtk2/nsGtkKeyUtils.cpp b/widget/gtk2/nsGtkKeyUtils.cpp
index c188c8c8ddf..02bd311dbe9 100644
--- a/widget/gtk2/nsGtkKeyUtils.cpp
+++ b/widget/gtk2/nsGtkKeyUtils.cpp
@@ -496,8 +496,7 @@ KeymapWrapper::InitBySystemSettings()
                 modifier = LEVEL5;
                 break;
             default:
-                MOZ_NOT_REACHED("All indexes must be handled here");
-                break;
+                MOZ_CRASH("All indexes must be handled here");
         }
         for (uint32_t j = 0; j < ArrayLength(mod); j++) {
             if (modifier == mod[j]) {
diff --git a/widget/os2/nsWindow.cpp b/widget/os2/nsWindow.cpp
index 016edb5ded2..77c36da5e5e 100644
--- a/widget/os2/nsWindow.cpp
+++ b/widget/os2/nsWindow.cpp
@@ -2526,8 +2526,7 @@ PlatformToNSAttr(uint8_t aAttr)
       return NS_TEXTRANGE_SELECTEDCONVERTEDTEXT;
 
     default:
-      MOZ_NOT_REACHED("unknown attribute");
-      return NS_TEXTRANGE_RAWINPUT;
+      MOZ_CRASH("unknown attribute");
   }
 }
 
diff --git a/widget/windows/KeyboardLayout.cpp b/widget/windows/KeyboardLayout.cpp
index 639624bfaac..884556f5b33 100644
--- a/widget/windows/KeyboardLayout.cpp
+++ b/widget/windows/KeyboardLayout.cpp
@@ -497,8 +497,7 @@ NativeKey::NativeKey(nsWindowBase* aWidget,
             mVirtualKeyCode = VK_LSHIFT;
             break;
           default:
-            MOZ_NOT_REACHED("Unsupported mOriginalVirtualKeyCode");
-            break;
+            MOZ_CRASH("Unsupported mOriginalVirtualKeyCode");
         }
         break;
       }
@@ -534,8 +533,7 @@ NativeKey::NativeKey(nsWindowBase* aWidget,
           }
           break;
         default:
-          MOZ_NOT_REACHED("Unsupported mOriginalVirtualKeyCode");
-          break;
+          MOZ_CRASH("Unsupported mOriginalVirtualKeyCode");
       }
       break;
     }
@@ -551,8 +549,7 @@ NativeKey::NativeKey(nsWindowBase* aWidget,
         ComputeVirtualKeyCodeFromScanCodeEx();
       break;
     default:
-      MOZ_NOT_REACHED("Unsupported message");
-      break;
+      MOZ_CRASH("Unsupported message");
   }
 
   if (!mVirtualKeyCode) {
@@ -737,8 +734,7 @@ NativeKey::InitKeyEvent(nsKeyEvent& aKeyEvent,
     case NS_KEY_PRESS:
       break;
     default:
-      MOZ_NOT_REACHED("Invalid event message");
-      break;
+      MOZ_CRASH("Invalid event message");
   }
 
   aKeyEvent.mKeyNameIndex = mKeyNameIndex;
@@ -1069,8 +1065,7 @@ NativeKey::RemoveFollowingCharMessage() const
   MSG msg;
   if (!WinUtils::GetMessage(&msg, mMsg.hwnd,
                             mCharMsg.message, mCharMsg.message)) {
-    MOZ_NOT_REACHED("We lost the following char message");
-    return mCharMsg;
+    MOZ_CRASH("We lost the following char message");
   }
 
   MOZ_ASSERT(mCharMsg.message == msg.message &&
diff --git a/widget/windows/KeyboardLayout.h b/widget/windows/KeyboardLayout.h
index 07472bd638b..7ed19cfbdc2 100644
--- a/widget/windows/KeyboardLayout.h
+++ b/widget/windows/KeyboardLayout.h
@@ -377,7 +377,7 @@ private:
 
   NativeKey()
   {
-    MOZ_NOT_REACHED("The default constructor of NativeKey isn't available");
+    MOZ_CRASH("The default constructor of NativeKey isn't available");
   }
 
   UINT GetScanCodeWithExtendedFlag() const;
diff --git a/widget/windows/nsTextStore.cpp b/widget/windows/nsTextStore.cpp
index 6e631760b38..1cb75c31d13 100644
--- a/widget/windows/nsTextStore.cpp
+++ b/widget/windows/nsTextStore.cpp
@@ -1024,8 +1024,7 @@ nsTextStore::FlushPendingActions()
         break;
       }
       default:
-        MOZ_NOT_REACHED("unexpected action type");
-        break;
+        MOZ_CRASH("unexpected action type");
     }
 
     if (mWidget && !mWidget->Destroyed()) {
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index 8508962afae..a7c87af1e2b 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -1246,9 +1246,11 @@ void nsWindow::SetThemeRegion()
  **************************************************************/
 
 NS_METHOD nsWindow::RegisterTouchWindow() {
-  mTouchWindow = true;
-  mGesture.RegisterTouchWindow(mWnd);
-  ::EnumChildWindows(mWnd, nsWindow::RegisterTouchForDescendants, 0);
+  if (Preferences::GetInt("dom.w3c_touch_events.enabled", 0)) {
+    mTouchWindow = true;
+    mGesture.RegisterTouchWindow(mWnd);
+    ::EnumChildWindows(mWnd, nsWindow::RegisterTouchForDescendants, 0);
+  }
   return NS_OK;
 }
 
diff --git a/widget/xpwidgets/WidgetUtils.cpp b/widget/xpwidgets/WidgetUtils.cpp
index b64c74457ed..538ebc9e136 100644
--- a/widget/xpwidgets/WidgetUtils.cpp
+++ b/widget/xpwidgets/WidgetUtils.cpp
@@ -30,8 +30,7 @@ ComputeTransformForRotation(const nsIntRect& aBounds,
         transform.Rotate(M_PI * 3 / 2);
         break;
     default:
-        MOZ_NOT_REACHED("Unknown rotation");
-        break;
+        MOZ_CRASH("Unknown rotation");
     }
     return transform;
 }
diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
index babf7452307..6ff4d384863 100644
--- a/xpcom/ds/nsAtomTable.cpp
+++ b/xpcom/ds/nsAtomTable.cpp
@@ -484,7 +484,6 @@ static void HandleOOM()
 {
   fputs("Out of memory allocating atom hashtable.\n", stderr);
   MOZ_CRASH();
-  MOZ_NOT_REACHED();
 }
 
 static inline void
diff --git a/xpcom/glue/nsISupportsImpl.h b/xpcom/glue/nsISupportsImpl.h
index c28623a775e..0504a77fe0a 100644
--- a/xpcom/glue/nsISupportsImpl.h
+++ b/xpcom/glue/nsISupportsImpl.h
@@ -66,8 +66,8 @@ private:
 #define NS_ASSERT_OWNINGTHREAD_AND_NOT_CCTHREAD(_class) \
   do { \
     if (NS_IsCycleCollectorThread()) { \
-      MOZ_NOT_REACHED("Changing refcount of " #_class " object during Traverse is " \
-                      "not permitted!"); \
+      MOZ_CRASH("Changing refcount of " #_class " object during Traverse is " \
+                "not permitted!"); \
     } \
     else { \
       NS_ASSERT_OWNINGTHREAD(_class); \
diff --git a/xpcom/glue/nsTArray.h b/xpcom/glue/nsTArray.h
index f272b02ff7c..56a47b9a5fd 100644
--- a/xpcom/glue/nsTArray.h
+++ b/xpcom/glue/nsTArray.h
@@ -265,7 +265,6 @@ private:
   static void HandleOOM() {
     fputs("Out of memory allocating nsTArray buffer.\n", stderr);
     MOZ_CRASH();
-    MOZ_NOT_REACHED();
   }
 };