diff --git a/accessible/mac/mozHTMLAccessible.mm b/accessible/mac/mozHTMLAccessible.mm
index c17231f45c5..ca80cc1088c 100644
--- a/accessible/mac/mozHTMLAccessible.mm
+++ b/accessible/mac/mozHTMLAccessible.mm
@@ -17,9 +17,10 @@
 - (NSString*)title
 {
   nsAutoString title;
+  ErrorResult rv;
   // XXX use the flattening API when there are available
   // see bug 768298
-  mGeckoAccessible->GetContent()->GetTextContent(title);
+  mGeckoAccessible->GetContent()->GetTextContent(title, rv);
 
   return nsCocoaUtils::ToNSString(title);
 }
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 9e46b6dcc3e..0080a4bf21d 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -886,6 +886,10 @@ pref("network.sntp.timeout", 30); // In seconds.
 
 // Enable dataStore
 pref("dom.datastore.enabled", true);
+// When an entry is changed, use two timers to fire system messages in a more
+// moderate pattern.
+pref("dom.datastore.sysMsgOnChangeShortTimeoutSec", 10);
+pref("dom.datastore.sysMsgOnChangeLongTimeoutSec", 60);
 
 // DOM Inter-App Communication API.
 pref("dom.inter-app-communication-api.enabled", true);
diff --git a/browser/base/content/aboutaccounts/aboutaccounts.js b/browser/base/content/aboutaccounts/aboutaccounts.js
index 5cceae154ac..af31be92e5b 100644
--- a/browser/base/content/aboutaccounts/aboutaccounts.js
+++ b/browser/base/content/aboutaccounts/aboutaccounts.js
@@ -12,6 +12,9 @@ Cu.import("resource://gre/modules/FxAccounts.jsm");
 let fxAccountsCommon = {};
 Cu.import("resource://gre/modules/FxAccountsCommon.js", fxAccountsCommon);
 
+// for master-password utilities
+Cu.import("resource://services-sync/util.js");
+
 const PREF_LAST_FXA_USER = "identity.fxaccounts.lastSignedInUserHash";
 const PREF_SYNC_SHOW_CUSTOMIZATION = "services.sync.ui.showCustomizationDialog";
 
@@ -104,6 +107,12 @@ let wrapper = {
       return;
     }
 
+    // If a master-password is enabled, we want to encourage the user to
+    // unlock it.  Things still work if not, but the user will probably need
+    // to re-auth next startup (in which case we will get here again and
+    // re-prompt)
+    Utils.ensureMPUnlocked();
+
     let iframe = document.getElementById("remote");
     this.iframe = iframe;
     iframe.addEventListener("load", this);
diff --git a/browser/base/content/aboutneterror/netError.css b/browser/base/content/aboutneterror/netError.css
index 69fbd10f3bd..bf83610ec3d 100644
--- a/browser/base/content/aboutneterror/netError.css
+++ b/browser/base/content/aboutneterror/netError.css
@@ -52,7 +52,7 @@ ul {
 }
 
 @media (max-width: 675px) {
-  #errorTitle {
+  #errorTitleText {
     padding-top: 0;
     background-image: none;
     -moz-padding-start: 0;
diff --git a/browser/base/content/sync/customize.js b/browser/base/content/sync/customize.js
index 8da91db7c8a..b3178036d3c 100644
--- a/browser/base/content/sync/customize.js
+++ b/browser/base/content/sync/customize.js
@@ -4,20 +4,6 @@
 
 "use strict";
 
-const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
-
-Cu.import("resource://gre/modules/Services.jsm");
-
-let service = Cc["@mozilla.org/weave/service;1"]
-                .getService(Ci.nsISupports)
-                .wrappedJSObject;
-
-if (!service.allowPasswordsEngine) {
-  let checkbox = document.getElementById("fxa-pweng-chk");
-  checkbox.checked = false;
-  checkbox.disabled = true;
-}
-
 addEventListener("dialogaccept", function () {
   let pane = document.getElementById("sync-customize-pane");
   pane.writePreferences(true);
diff --git a/browser/base/content/sync/customize.xul b/browser/base/content/sync/customize.xul
index e1fd95107b1..d95536d9ac9 100644
--- a/browser/base/content/sync/customize.xul
+++ b/browser/base/content/sync/customize.xul
@@ -45,8 +45,7 @@
       <checkbox label="&engine.bookmarks.label;"
                 accesskey="&engine.bookmarks.accesskey;"
                 preference="engine.bookmarks"/>
-      <checkbox id="fxa-pweng-chk"
-                label="&engine.passwords.label;"
+      <checkbox label="&engine.passwords.label;"
                 accesskey="&engine.passwords.accesskey;"
                 preference="engine.passwords"/>
       <checkbox label="&engine.history.label;"
diff --git a/browser/base/content/sync/utils.js b/browser/base/content/sync/utils.js
index 7268af4b520..f5dc14c17be 100644
--- a/browser/base/content/sync/utils.js
+++ b/browser/base/content/sync/utils.js
@@ -87,12 +87,6 @@ let gSyncUtils = {
     this._openLink(Weave.Svc.Prefs.get(root + "privacyURL"));
   },
 
-  openMPInfoPage: function (event) {
-    event.stopPropagation();
-    let baseURL = Services.urlFormatter.formatURLPref("app.support.baseURL");
-    this._openLink(baseURL + "sync-master-password");
-  },
-
   openFirstSyncProgressPage: function () {
     this._openLink("about:sync-progress");
   },
diff --git a/browser/components/nsBrowserContentHandler.js b/browser/components/nsBrowserContentHandler.js
index d4ebd603f78..d504e2e4ad1 100644
--- a/browser/components/nsBrowserContentHandler.js
+++ b/browser/components/nsBrowserContentHandler.js
@@ -782,9 +782,7 @@ nsDefaultCommandLineHandler.prototype = {
       Components.utils.reportError(e);
     }
 
-    count = cmdLine.length;
-
-    for (i = 0; i < count; ++i) {
+    for (let i = 0; i < cmdLine.length; ++i) {
       var curarg = cmdLine.getArgument(i);
       if (curarg.match(/^-/)) {
         Components.utils.reportError("Warning: unrecognized command line flag " + curarg + "\n");
diff --git a/browser/components/preferences/in-content/sync.js b/browser/components/preferences/in-content/sync.js
index b6366ecf6f6..eafae12f853 100644
--- a/browser/components/preferences/in-content/sync.js
+++ b/browser/components/preferences/in-content/sync.js
@@ -154,17 +154,6 @@ let gSyncPane = {
         for (let checkbox of engines.querySelectorAll("checkbox")) {
           checkbox.disabled = enginesListDisabled;
         }
-
-        let checkbox = document.getElementById("fxa-pweng-chk");
-        let help = document.getElementById("fxa-pweng-help");
-        let allowPasswordsEngine = service.allowPasswordsEngine;
-
-        if (!allowPasswordsEngine) {
-          checkbox.checked = false;
-        }
-
-        checkbox.disabled = !allowPasswordsEngine || enginesListDisabled;
-        help.hidden = allowPasswordsEngine || enginesListDisabled;
       });
     // If fxAccountEnabled is false and we are in a "not configured" state,
     // then fxAccounts is probably fully disabled rather than just unconfigured,
diff --git a/browser/components/preferences/in-content/sync.xul b/browser/components/preferences/in-content/sync.xul
index 5d9ac0a17bc..5f3585c83db 100644
--- a/browser/components/preferences/in-content/sync.xul
+++ b/browser/components/preferences/in-content/sync.xul
@@ -276,20 +276,9 @@
           <checkbox label="&engine.bookmarks.label;"
                     accesskey="&engine.bookmarks.accesskey;"
                     preference="engine.bookmarks"/>
-          <hbox>
-            <checkbox id="fxa-pweng-chk"
-                      label="&engine.passwords.label;"
-                      accesskey="&engine.passwords.accesskey;"
-                      preference="engine.passwords"/>
-
-            <vbox id="fxa-pweng-help">
-              <spacer flex="1"/>
-              <hbox id="fxa-pweng-help-link">
-                <image onclick="gSyncUtils.openMPInfoPage(event);" />
-              </hbox>
-              <spacer flex="1"/>
-            </vbox>
-          </hbox>
+          <checkbox label="&engine.passwords.label;"
+                    accesskey="&engine.passwords.accesskey;"
+                    preference="engine.passwords"/>
           <checkbox label="&engine.history.label;"
                     accesskey="&engine.history.accesskey;"
                     preference="engine.history"/>
diff --git a/browser/components/preferences/sync.js b/browser/components/preferences/sync.js
index 8c627ccb0b8..ea861ed671b 100644
--- a/browser/components/preferences/sync.js
+++ b/browser/components/preferences/sync.js
@@ -154,17 +154,6 @@ let gSyncPane = {
         for (let checkbox of engines.querySelectorAll("checkbox")) {
           checkbox.disabled = enginesListDisabled;
         }
-
-        let checkbox = document.getElementById("fxa-pweng-chk");
-        let help = document.getElementById("fxa-pweng-help");
-        let allowPasswordsEngine = service.allowPasswordsEngine;
-
-        if (!allowPasswordsEngine) {
-          checkbox.checked = false;
-        }
-
-        checkbox.disabled = !allowPasswordsEngine || enginesListDisabled;
-        help.hidden = allowPasswordsEngine || enginesListDisabled;
       });
     // If fxAccountEnabled is false and we are in a "not configured" state,
     // then fxAccounts is probably fully disabled rather than just unconfigured,
diff --git a/browser/components/preferences/sync.xul b/browser/components/preferences/sync.xul
index a88618794d4..aef18dedc86 100644
--- a/browser/components/preferences/sync.xul
+++ b/browser/components/preferences/sync.xul
@@ -265,20 +265,9 @@
                 <checkbox label="&engine.bookmarks.label;"
                           accesskey="&engine.bookmarks.accesskey;"
                           preference="engine.bookmarks"/>
-                <hbox>
-                  <checkbox id="fxa-pweng-chk"
-                            label="&engine.passwords.label;"
-                            accesskey="&engine.passwords.accesskey;"
-                            preference="engine.passwords"/>
-
-                  <vbox id="fxa-pweng-help">
-                    <spacer flex="1"/>
-                    <hbox id="fxa-pweng-help-link">
-                      <image onclick="gSyncUtils.openMPInfoPage(event);" />
-                    </hbox>
-                    <spacer flex="1"/>
-                  </vbox>
-                </hbox>
+                <checkbox label="&engine.passwords.label;"
+                          accesskey="&engine.passwords.accesskey;"
+                          preference="engine.passwords"/>
                 <checkbox label="&engine.history.label;"
                           accesskey="&engine.history.accesskey;"
                           preference="engine.history"/>
diff --git a/browser/themes/linux/preferences/preferences.css b/browser/themes/linux/preferences/preferences.css
index 20d8a312b01..2d2dffb3303 100644
--- a/browser/themes/linux/preferences/preferences.css
+++ b/browser/themes/linux/preferences/preferences.css
@@ -171,12 +171,4 @@ label.small {
   margin-bottom: 0.6em;
 }
 
-#fxa-pweng-help-link > label {
-  margin: 0;
-}
-
-#fxa-pweng-help-link > image {
-  list-style-image: url("chrome://global/skin/icons/question-16.png");
-}
-
 %endif
diff --git a/browser/themes/osx/preferences/preferences.css b/browser/themes/osx/preferences/preferences.css
index 50371d853a8..52ae7110bfa 100644
--- a/browser/themes/osx/preferences/preferences.css
+++ b/browser/themes/osx/preferences/preferences.css
@@ -233,20 +233,4 @@ html|a.inline-link:-moz-focusring {
   margin-bottom: 0.6em;
 }
 
-#fxa-pweng-help-link > label {
-  margin: 0;
-}
-
-#fxa-pweng-help-link > image {
-  width: 16px;
-  height: 16px;
-  list-style-image: url("chrome://global/skin/icons/question-16.png");
-}
-
-@media (min-resolution: 2dppx) {
-  #fxa-pweng-help-link > image {
-    list-style-image: url("chrome://global/skin/icons/question-32.png");
-  }
-}
-
 %endif
diff --git a/browser/themes/windows/preferences/preferences.css b/browser/themes/windows/preferences/preferences.css
index 63537da6992..13d5281f90b 100644
--- a/browser/themes/windows/preferences/preferences.css
+++ b/browser/themes/windows/preferences/preferences.css
@@ -161,12 +161,4 @@ label.small {
   margin-bottom: 0.6em;
 }
 
-#fxa-pweng-help-link > label {
-  margin: 0;
-}
-
-#fxa-pweng-help-link > image {
-  list-style-image: url("chrome://global/skin/icons/question-16.png");
-}
-
 %endif
diff --git a/content/base/public/Element.h b/content/base/public/Element.h
index bd8c19ddab3..1718232193d 100644
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -139,7 +139,7 @@ class Element : public FragmentOrElement
 {
 public:
 #ifdef MOZILLA_INTERNAL_API
-  Element(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo) :
+  explicit Element(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo) :
     FragmentOrElement(aNodeInfo),
     mState(NS_EVENT_STATE_MOZ_READONLY)
   {
@@ -1213,7 +1213,7 @@ private:
 class DestinationInsertionPointList : public nsINodeList
 {
 public:
-  DestinationInsertionPointList(Element* aElement);
+  explicit DestinationInsertionPointList(Element* aElement);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_CLASS(DestinationInsertionPointList)
diff --git a/content/base/public/FragmentOrElement.h b/content/base/public/FragmentOrElement.h
index 5353ea1e521..17fc512a7fc 100644
--- a/content/base/public/FragmentOrElement.h
+++ b/content/base/public/FragmentOrElement.h
@@ -48,7 +48,7 @@ class Element;
 class nsChildContentList MOZ_FINAL : public nsINodeList
 {
 public:
-  nsChildContentList(nsINode* aNode)
+  explicit nsChildContentList(nsINode* aNode)
     : mNode(aNode)
   {
     SetIsDOMBinding();
@@ -96,7 +96,7 @@ public:
 
   NS_DECL_NSIDOMXPATHNSRESOLVER
 
-  nsNode3Tearoff(nsINode *aNode) : mNode(aNode)
+  explicit nsNode3Tearoff(nsINode *aNode) : mNode(aNode)
   {
   }
 
@@ -114,7 +114,7 @@ private:
 class nsNodeWeakReference MOZ_FINAL : public nsIWeakReference
 {
 public:
-  nsNodeWeakReference(nsINode* aNode)
+  explicit nsNodeWeakReference(nsINode* aNode)
     : mNode(aNode)
   {
   }
@@ -143,7 +143,7 @@ private:
 class nsNodeSupportsWeakRefTearoff MOZ_FINAL : public nsISupportsWeakReference
 {
 public:
-  nsNodeSupportsWeakRefTearoff(nsINode* aNode)
+  explicit nsNodeSupportsWeakRefTearoff(nsINode* aNode)
     : mNode(aNode)
   {
   }
@@ -175,8 +175,8 @@ class UndoManager;
 class FragmentOrElement : public nsIContent
 {
 public:
-  FragmentOrElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
-  FragmentOrElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
+  explicit FragmentOrElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit FragmentOrElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
 
@@ -190,7 +190,8 @@ public:
   virtual nsresult InsertChildAt(nsIContent* aKid, uint32_t aIndex,
                                  bool aNotify) MOZ_OVERRIDE;
   virtual void RemoveChildAt(uint32_t aIndex, bool aNotify) MOZ_OVERRIDE;
-  virtual void GetTextContentInternal(nsAString& aTextContent) MOZ_OVERRIDE;
+  virtual void GetTextContentInternal(nsAString& aTextContent,
+                                      mozilla::ErrorResult& aError) MOZ_OVERRIDE;
   virtual void SetTextContentInternal(const nsAString& aTextContent,
                                       mozilla::ErrorResult& aError) MOZ_OVERRIDE;
 
diff --git a/content/base/public/nsDOMFile.h b/content/base/public/nsDOMFile.h
index f73bc1cee65..1cbcb78e347 100644
--- a/content/base/public/nsDOMFile.h
+++ b/content/base/public/nsDOMFile.h
@@ -754,7 +754,7 @@ class nsDOMFileList MOZ_FINAL : public nsIDOMFileList,
   ~nsDOMFileList() {}
 
 public:
-  nsDOMFileList(nsISupports *aParent) : mParent(aParent)
+  explicit nsDOMFileList(nsISupports *aParent) : mParent(aParent)
   {
     SetIsDOMBinding();
   }
diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
index 7ba6a654dad..fa4b2003356 100644
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@@ -54,7 +54,7 @@ public:
   // If you're using the external API, the only thing you can know about
   // nsIContent is that it exists with an IID
 
-  nsIContent(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  explicit nsIContent(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
     : nsINode(aNodeInfo)
   {
     MOZ_ASSERT(mNodeInfo);
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index 7875ffc5ef9..610b47f7910 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -688,7 +688,7 @@ private:
   class SelectorCacheKey
   {
     public:
-      SelectorCacheKey(const nsAString& aString) : mKey(aString)
+      explicit SelectorCacheKey(const nsAString& aString) : mKey(aString)
       {
         MOZ_COUNT_CTOR(SelectorCacheKey);
       }
@@ -2728,7 +2728,7 @@ private:
 class MOZ_STACK_CLASS nsAutoSyncOperation
 {
 public:
-  nsAutoSyncOperation(nsIDocument* aDocument);
+  explicit nsAutoSyncOperation(nsIDocument* aDocument);
   ~nsAutoSyncOperation();
 private:
   nsCOMArray<nsIDocument> mDocuments;
diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h
index 86e29ed18cc..c2558ab43e4 100644
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -337,7 +337,7 @@ public:
   friend class nsAttrAndChildArray;
 
 #ifdef MOZILLA_INTERNAL_API
-  nsINode(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  explicit nsINode(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
   : mNodeInfo(aNodeInfo),
     mParent(nullptr),
     mBoolFlags(0),
@@ -1136,9 +1136,10 @@ protected:
   }
   
 public:
-  void GetTextContent(nsAString& aTextContent)
+  void GetTextContent(nsAString& aTextContent,
+                      mozilla::ErrorResult& aError)
   {
-    GetTextContentInternal(aTextContent);
+    GetTextContentInternal(aTextContent, aError);
   }
   void SetTextContent(const nsAString& aTextContent,
                       mozilla::ErrorResult& aError)
@@ -1749,7 +1750,8 @@ protected:
     return IsEditableInternal();
   }
 
-  virtual void GetTextContentInternal(nsAString& aTextContent);
+  virtual void GetTextContentInternal(nsAString& aTextContent,
+                                      mozilla::ErrorResult& aError);
   virtual void SetTextContentInternal(const nsAString& aTextContent,
                                       mozilla::ErrorResult& aError)
   {
@@ -2032,8 +2034,9 @@ ToCanonicalSupports(nsINode* aPointer)
   } \
   NS_IMETHOD GetTextContent(nsAString& aTextContent) __VA_ARGS__ \
   { \
-    nsINode::GetTextContent(aTextContent); \
-    return NS_OK; \
+    mozilla::ErrorResult rv; \
+    nsINode::GetTextContent(aTextContent, rv); \
+    return rv.ErrorCode(); \
   } \
   NS_IMETHOD SetTextContent(const nsAString& aTextContent) __VA_ARGS__ \
   { \
diff --git a/content/base/public/nsNameSpaceManager.h b/content/base/public/nsNameSpaceManager.h
index 8b9f63738bc..889943e97ec 100644
--- a/content/base/public/nsNameSpaceManager.h
+++ b/content/base/public/nsNameSpaceManager.h
@@ -20,7 +20,7 @@ public:
   typedef const nsAString* KeyType;
   typedef const nsAString* KeyTypePointer;
 
-  nsNameSpaceKey(KeyTypePointer aKey) : mKey(aKey)
+  explicit nsNameSpaceKey(KeyTypePointer aKey) : mKey(aKey)
   {
   }
   nsNameSpaceKey(const nsNameSpaceKey& toCopy) : mKey(toCopy.mKey)
diff --git a/content/base/src/Attr.cpp b/content/base/src/Attr.cpp
index 48baf7c9d74..3059c9e2846 100644
--- a/content/base/src/Attr.cpp
+++ b/content/base/src/Attr.cpp
@@ -302,7 +302,8 @@ Attr::GetBaseURI(bool aTryUseXHRDocBaseURI) const
 }
 
 void
-Attr::GetTextContentInternal(nsAString& aTextContent)
+Attr::GetTextContentInternal(nsAString& aTextContent,
+                             ErrorResult& aError)
 {
   OwnerDoc()->WarnOnceAbout(nsIDocument::eTextContent);
 
diff --git a/content/base/src/Attr.h b/content/base/src/Attr.h
index 16a118c8ed7..42e02b26bc1 100644
--- a/content/base/src/Attr.h
+++ b/content/base/src/Attr.h
@@ -42,7 +42,8 @@ public:
 
   // nsIDOMNode interface
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
-  virtual void GetTextContentInternal(nsAString& aTextContent) MOZ_OVERRIDE;
+  virtual void GetTextContentInternal(nsAString& aTextContent,
+                                      ErrorResult& aError) MOZ_OVERRIDE;
   virtual void SetTextContentInternal(const nsAString& aTextContent,
                                       ErrorResult& aError) MOZ_OVERRIDE;
   virtual void GetNodeValueInternal(nsAString& aNodeValue) MOZ_OVERRIDE;
diff --git a/content/base/src/DOMRect.h b/content/base/src/DOMRect.h
index f4c2d3d4470..ce36815395b 100644
--- a/content/base/src/DOMRect.h
+++ b/content/base/src/DOMRect.h
@@ -33,7 +33,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(DOMRectReadOnly)
 
-  DOMRectReadOnly(nsISupports* aParent)
+  explicit DOMRectReadOnly(nsISupports* aParent)
     : mParent(aParent)
   {
     SetIsDOMBinding();
@@ -80,8 +80,8 @@ class DOMRect MOZ_FINAL : public DOMRectReadOnly
                         , public nsIDOMClientRect
 {
 public:
-  DOMRect(nsISupports* aParent, double aX = 0, double aY = 0,
-          double aWidth = 0, double aHeight = 0)
+  explicit DOMRect(nsISupports* aParent, double aX = 0, double aY = 0,
+                   double aWidth = 0, double aHeight = 0)
     : DOMRectReadOnly(aParent)
     , mX(aX)
     , mY(aY)
@@ -150,7 +150,7 @@ class DOMRectList MOZ_FINAL : public nsIDOMClientRectList,
   ~DOMRectList() {}
 
 public:
-  DOMRectList(nsISupports *aParent) : mParent(aParent)
+  explicit DOMRectList(nsISupports *aParent) : mParent(aParent)
   {
     SetIsDOMBinding();
   }
diff --git a/content/base/src/FragmentOrElement.cpp b/content/base/src/FragmentOrElement.cpp
index e2be514e15b..b41caeed96a 100644
--- a/content/base/src/FragmentOrElement.cpp
+++ b/content/base/src/FragmentOrElement.cpp
@@ -1102,10 +1102,12 @@ FragmentOrElement::RemoveChildAt(uint32_t aIndex, bool aNotify)
 }
 
 void
-FragmentOrElement::GetTextContentInternal(nsAString& aTextContent)
+FragmentOrElement::GetTextContentInternal(nsAString& aTextContent,
+                                          ErrorResult& aError)
 {
-  if(!nsContentUtils::GetNodeTextContent(this, true, aTextContent))
-    NS_RUNTIMEABORT("OOM");
+  if(!nsContentUtils::GetNodeTextContent(this, true, aTextContent)) {
+    aError.Throw(NS_ERROR_OUT_OF_MEMORY);
+  }
 }
 
 void
diff --git a/content/base/src/nsAttrValue.h b/content/base/src/nsAttrValue.h
index d4c19ab71a8..3bf1151bafd 100644
--- a/content/base/src/nsAttrValue.h
+++ b/content/base/src/nsAttrValue.h
@@ -67,7 +67,7 @@ struct ImageValue;
  */
 class nsCheapString : public nsString {
 public:
-  nsCheapString(nsStringBuffer* aBuf)
+  explicit nsCheapString(nsStringBuffer* aBuf)
   {
     if (aBuf)
       aBuf->ToString(aBuf->StorageSize()/sizeof(char16_t) - 1, *this);
diff --git a/content/base/src/nsDOMAttributeMap.h b/content/base/src/nsDOMAttributeMap.h
index e9d853d2639..477dc858acc 100644
--- a/content/base/src/nsDOMAttributeMap.h
+++ b/content/base/src/nsDOMAttributeMap.h
@@ -55,7 +55,7 @@ public:
   typedef const nsAttrKey& KeyType;
   typedef const nsAttrKey* KeyTypePointer;
 
-  nsAttrHashKey(KeyTypePointer aKey) : mKey(*aKey) {}
+  explicit nsAttrHashKey(KeyTypePointer aKey) : mKey(*aKey) {}
   nsAttrHashKey(const nsAttrHashKey& aCopy) : mKey(aCopy.mKey) {}
   ~nsAttrHashKey() {}
 
@@ -89,7 +89,7 @@ public:
   typedef mozilla::dom::Element Element;
   typedef mozilla::ErrorResult ErrorResult;
 
-  nsDOMAttributeMap(Element *aContent);
+  explicit nsDOMAttributeMap(Element *aContent);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS(nsDOMAttributeMap)
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index f93c00dfbd1..1f358025eec 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -2326,7 +2326,7 @@ nsFrameLoader::DoSendAsyncMessage(JSContext* aCx,
       return false;
     }
     return tabParent->SendAsyncMessage(nsString(aMessage), data, cpows,
-                                       aPrincipal);
+                                       IPC::Principal(aPrincipal));
   }
 
   if (mChildMessageManager) {
diff --git a/content/base/src/nsFrameMessageManager.cpp b/content/base/src/nsFrameMessageManager.cpp
index f9990ffb6d1..31ec577f780 100644
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -1729,10 +1729,10 @@ public:
     }
     if (aIsSync) {
       return cc->SendSyncMessage(PromiseFlatString(aMessage), data, cpows,
-                                 aPrincipal, aJSONRetVal);
+                                 IPC::Principal(aPrincipal), aJSONRetVal);
     }
     return cc->CallRpcMessage(PromiseFlatString(aMessage), data, cpows,
-                              aPrincipal, aJSONRetVal);
+                              IPC::Principal(aPrincipal), aJSONRetVal);
   }
 
   virtual bool DoSendAsyncMessage(JSContext* aCx,
@@ -1755,7 +1755,7 @@ public:
       return false;
     }
     return cc->SendAsyncMessage(PromiseFlatString(aMessage), data, cpows,
-                                aPrincipal);
+                                IPC::Principal(aPrincipal));
   }
 
 };
diff --git a/content/base/src/nsGenericDOMDataNode.h b/content/base/src/nsGenericDOMDataNode.h
index 19e1977cb54..b66bdd5f0bb 100644
--- a/content/base/src/nsGenericDOMDataNode.h
+++ b/content/base/src/nsGenericDOMDataNode.h
@@ -93,7 +93,8 @@ public:
   virtual nsresult InsertChildAt(nsIContent* aKid, uint32_t aIndex,
                                  bool aNotify) MOZ_OVERRIDE;
   virtual void RemoveChildAt(uint32_t aIndex, bool aNotify) MOZ_OVERRIDE;
-  virtual void GetTextContentInternal(nsAString& aTextContent) MOZ_OVERRIDE
+  virtual void GetTextContentInternal(nsAString& aTextContent,
+                                      mozilla::ErrorResult& aError) MOZ_OVERRIDE
   {
     GetNodeValue(aTextContent);
   }
diff --git a/content/base/src/nsINode.cpp b/content/base/src/nsINode.cpp
index 10d3514b8b0..ed89554af6b 100644
--- a/content/base/src/nsINode.cpp
+++ b/content/base/src/nsINode.cpp
@@ -380,7 +380,7 @@ nsINode::ChildNodes()
 }
 
 void
-nsINode::GetTextContentInternal(nsAString& aTextContent)
+nsINode::GetTextContentInternal(nsAString& aTextContent, ErrorResult& aError)
 {
   SetDOMStringToNull(aTextContent);
 }
diff --git a/content/base/src/nsMappedAttributeElement.h b/content/base/src/nsMappedAttributeElement.h
index 61460e15742..301b0682d13 100644
--- a/content/base/src/nsMappedAttributeElement.h
+++ b/content/base/src/nsMappedAttributeElement.h
@@ -28,7 +28,7 @@ class nsMappedAttributeElement : public nsMappedAttributeElementBase
 
 protected:
 
-  nsMappedAttributeElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  explicit nsMappedAttributeElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
     : nsMappedAttributeElementBase(aNodeInfo)
   {}
 
diff --git a/content/base/src/nsPropertyTable.h b/content/base/src/nsPropertyTable.h
index 510fd1bc796..ec5d26de2e8 100644
--- a/content/base/src/nsPropertyTable.h
+++ b/content/base/src/nsPropertyTable.h
@@ -52,8 +52,8 @@ public:
   // These are the types of objects that can own properties. No object should
   // inherit more then one of these classes.
   // To add support for more types just add to this list.
-  nsPropertyOwner(const nsINode* aObject) : mObject(aObject) {}
-  nsPropertyOwner(const nsIFrame* aObject) : mObject(aObject) {}
+  MOZ_IMPLICIT nsPropertyOwner(const nsINode* aObject) : mObject(aObject) {}
+  MOZ_IMPLICIT nsPropertyOwner(const nsIFrame* aObject) : mObject(aObject) {}
 
   operator const void*() { return mObject; }
   const void* get() { return mObject; }
diff --git a/content/base/src/nsRange.h b/content/base/src/nsRange.h
index a7bab97ef66..5e4c9f92f1e 100644
--- a/content/base/src/nsRange.h
+++ b/content/base/src/nsRange.h
@@ -41,7 +41,7 @@ class nsRange MOZ_FINAL : public nsIDOMRange,
   virtual ~nsRange();
 
 public:
-  nsRange(nsINode* aNode)
+  explicit nsRange(nsINode* aNode)
     : mRoot(nullptr)
     , mStartOffset(0)
     , mEndOffset(0)
@@ -290,7 +290,7 @@ protected:
 
   struct MOZ_STACK_CLASS AutoInvalidateSelection
   {
-    AutoInvalidateSelection(nsRange* aRange) : mRange(aRange)
+    explicit AutoInvalidateSelection(nsRange* aRange) : mRange(aRange)
     {
 #ifdef DEBUG
       mWasInSelection = mRange->IsInSelection();
diff --git a/content/base/src/nsStyledElement.h b/content/base/src/nsStyledElement.h
index 469d3b1707c..8e746d2bba6 100644
--- a/content/base/src/nsStyledElement.h
+++ b/content/base/src/nsStyledElement.h
@@ -30,7 +30,7 @@ class nsStyledElementNotElementCSSInlineStyle : public nsStyledElementBase
 
 protected:
 
-  inline nsStyledElementNotElementCSSInlineStyle(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  inline explicit nsStyledElementNotElementCSSInlineStyle(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
     : nsStyledElementBase(aNodeInfo)
   {}
 
@@ -72,7 +72,7 @@ protected:
 
 class nsStyledElement : public nsStyledElementNotElementCSSInlineStyle {
 protected:
-  inline nsStyledElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  inline explicit nsStyledElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
     : nsStyledElementNotElementCSSInlineStyle(aNodeInfo)
   {}
 };
diff --git a/content/base/src/nsXMLHttpRequest.h b/content/base/src/nsXMLHttpRequest.h
index 595044c12e8..0d53a3a97c4 100644
--- a/content/base/src/nsXMLHttpRequest.h
+++ b/content/base/src/nsXMLHttpRequest.h
@@ -113,7 +113,7 @@ class nsXHREventTarget : public mozilla::DOMEventTargetHelper,
                          public nsIXMLHttpRequestEventTarget
 {
 protected:
-  nsXHREventTarget(mozilla::DOMEventTargetHelper* aOwner)
+  explicit nsXHREventTarget(mozilla::DOMEventTargetHelper* aOwner)
     : mozilla::DOMEventTargetHelper(aOwner)
   {
   }
@@ -151,7 +151,7 @@ class nsXMLHttpRequestUpload MOZ_FINAL : public nsXHREventTarget,
                                          public nsIXMLHttpRequestUpload
 {
 public:
-  nsXMLHttpRequestUpload(mozilla::DOMEventTargetHelper* aOwner)
+  explicit nsXMLHttpRequestUpload(mozilla::DOMEventTargetHelper* aOwner)
     : nsXHREventTarget(aOwner)
   {
   }
@@ -343,31 +343,31 @@ private:
     RequestBody() : mType(Uninitialized)
     {
     }
-    RequestBody(const mozilla::dom::ArrayBuffer* aArrayBuffer) : mType(ArrayBuffer)
+    explicit RequestBody(const mozilla::dom::ArrayBuffer* aArrayBuffer) : mType(ArrayBuffer)
     {
       mValue.mArrayBuffer = aArrayBuffer;
     }
-    RequestBody(const mozilla::dom::ArrayBufferView* aArrayBufferView) : mType(ArrayBufferView)
+    explicit RequestBody(const mozilla::dom::ArrayBufferView* aArrayBufferView) : mType(ArrayBufferView)
     {
       mValue.mArrayBufferView = aArrayBufferView;
     }
-    RequestBody(nsIDOMBlob* aBlob) : mType(Blob)
+    explicit RequestBody(nsIDOMBlob* aBlob) : mType(Blob)
     {
       mValue.mBlob = aBlob;
     }
-    RequestBody(nsIDocument* aDocument) : mType(Document)
+    explicit RequestBody(nsIDocument* aDocument) : mType(Document)
     {
       mValue.mDocument = aDocument;
     }
-    RequestBody(const nsAString& aString) : mType(DOMString)
+    explicit RequestBody(const nsAString& aString) : mType(DOMString)
     {
       mValue.mString = &aString;
     }
-    RequestBody(nsFormData& aFormData) : mType(FormData)
+    explicit RequestBody(nsFormData& aFormData) : mType(FormData)
     {
       mValue.mFormData = &aFormData;
     }
-    RequestBody(nsIInputStream* aStream) : mType(InputStream)
+    explicit RequestBody(nsIInputStream* aStream) : mType(InputStream)
     {
       mValue.mStream = aStream;
     }
@@ -809,7 +809,7 @@ class nsXMLHttpRequestXPCOMifier MOZ_FINAL : public nsIStreamListener,
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsXMLHttpRequestXPCOMifier,
                                            nsIStreamListener)
 
-  nsXMLHttpRequestXPCOMifier(nsXMLHttpRequest* aXHR) :
+  explicit nsXMLHttpRequestXPCOMifier(nsXMLHttpRequest* aXHR) :
     mXHR(aXHR)
   {
   }
@@ -847,7 +847,7 @@ public:
     mXHR = nullptr;
     return NS_OK;
   }
-  nsXHRParseEndListener(nsIXMLHttpRequest* aXHR)
+  explicit nsXHRParseEndListener(nsIXMLHttpRequest* aXHR)
     : mXHR(do_GetWeakReference(aXHR)) {}
 private:
   virtual ~nsXHRParseEndListener() {}
diff --git a/content/html/content/public/HTMLCanvasElement.h b/content/html/content/public/HTMLCanvasElement.h
index ac4c6c8bcd7..575a41ff60c 100644
--- a/content/html/content/public/HTMLCanvasElement.h
+++ b/content/html/content/public/HTMLCanvasElement.h
@@ -47,7 +47,7 @@ class HTMLCanvasElement MOZ_FINAL : public nsGenericHTMLElement,
   typedef layers::LayerManager LayerManager;
 
 public:
-  HTMLCanvasElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit HTMLCanvasElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
   NS_IMPL_FROMCONTENT_HTML_WITH_TAG(HTMLCanvasElement, canvas)
 
diff --git a/content/html/content/src/HTMLMediaElement.cpp b/content/html/content/src/HTMLMediaElement.cpp
index 466d1c0d1ee..230e0c6431f 100644
--- a/content/html/content/src/HTMLMediaElement.cpp
+++ b/content/html/content/src/HTMLMediaElement.cpp
@@ -3895,6 +3895,11 @@ void HTMLMediaElement::UpdateAudioChannelPlayingState()
   if (playingThroughTheAudioChannel != mPlayingThroughTheAudioChannel) {
     mPlayingThroughTheAudioChannel = playingThroughTheAudioChannel;
 
+    // If we are not playing, we don't need to create a new audioChannelAgent.
+    if (!mAudioChannelAgent && !mPlayingThroughTheAudioChannel) {
+       return;
+    }
+
     if (!mAudioChannelAgent) {
       nsresult rv;
       mAudioChannelAgent = do_CreateInstance("@mozilla.org/audiochannelagent;1", &rv);
diff --git a/content/html/content/src/HTMLTimeElement.cpp b/content/html/content/src/HTMLTimeElement.cpp
index f7ea0d1b51c..bb9367047c3 100644
--- a/content/html/content/src/HTMLTimeElement.cpp
+++ b/content/html/content/src/HTMLTimeElement.cpp
@@ -37,7 +37,8 @@ HTMLTimeElement::GetItemValueText(nsAString& text)
   if (HasAttr(kNameSpaceID_None, nsGkAtoms::datetime)) {
     GetDateTime(text);
   } else {
-    GetTextContentInternal(text);
+    ErrorResult rv;
+    GetTextContentInternal(text, rv);
   }
 }
 
diff --git a/content/html/content/src/ValidityState.h b/content/html/content/src/ValidityState.h
index a74e8fb04e4..33fb447a1c5 100644
--- a/content/html/content/src/ValidityState.h
+++ b/content/html/content/src/ValidityState.h
@@ -75,7 +75,7 @@ public:
   }
 
 protected:
-  ValidityState(nsIConstraintValidation* aConstraintValidation);
+  explicit ValidityState(nsIConstraintValidation* aConstraintValidation);
 
   /**
    * Helper function to get a validity state from constraint validation instance.
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index b6af4398434..67b521eb713 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -3126,7 +3126,8 @@ nsGenericHTMLElement::SetItemValue(nsIVariant* aValue)
 void
 nsGenericHTMLElement::GetItemValueText(nsAString& text)
 {
-  GetTextContentInternal(text);
+  ErrorResult rv;
+  GetTextContentInternal(text, rv);
 }
 
 void
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index 630dcaa6bee..038b167a47f 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -51,7 +51,7 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase,
                              public nsIDOMHTMLElement
 {
 public:
-  nsGenericHTMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  explicit nsGenericHTMLElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
     : nsGenericHTMLElementBase(aNodeInfo),
       mScrollgrab(false)
   {
@@ -1263,7 +1263,7 @@ class nsGenericHTMLFormElement : public nsGenericHTMLElement,
                                  public nsIFormControl
 {
 public:
-  nsGenericHTMLFormElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit nsGenericHTMLFormElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
   NS_DECL_ISUPPORTS_INHERITED
 
@@ -1421,7 +1421,7 @@ protected:
 class nsGenericHTMLFormElementWithState : public nsGenericHTMLFormElement
 {
 public:
-  nsGenericHTMLFormElementWithState(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit nsGenericHTMLFormElementWithState(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
   /**
    * Get the presentation state for a piece of content, or create it if it does
diff --git a/content/html/content/test/file_fullscreen-plugins.html b/content/html/content/test/file_fullscreen-plugins.html
index 9d3c0dd3bf7..b1a99df2be3 100644
--- a/content/html/content/test/file_fullscreen-plugins.html
+++ b/content/html/content/test/file_fullscreen-plugins.html
@@ -15,6 +15,8 @@ Test plugins with DOM full-screen API:
 <head>
   <title>Test for Bug 545812</title>
   <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="enableTestPlugin.js"></script>
   <script type="application/javascript" src="file_fullscreen-utils.js"></script>
   <style>
   body:-moz-full-screen, div:-moz-full-screen {
diff --git a/content/html/content/test/mochitest.ini b/content/html/content/test/mochitest.ini
index 80dfa7941d0..9a1720d00d6 100644
--- a/content/html/content/test/mochitest.ini
+++ b/content/html/content/test/mochitest.ini
@@ -17,6 +17,7 @@ support-files =
   bug392567.jar^headers^
   bug441930_iframe.html
   bug514856_iframe.html
+  enableTestPlugin.js
   file_bug209275_1.html
   file_bug209275_2.html
   file_bug209275_3.html
diff --git a/content/html/content/test/test_iframe_sandbox_plugins.html b/content/html/content/test/test_iframe_sandbox_plugins.html
index 23c67d0d2e3..ab38a725c42 100644
--- a/content/html/content/test/test_iframe_sandbox_plugins.html
+++ b/content/html/content/test/test_iframe_sandbox_plugins.html
@@ -8,6 +8,7 @@ Implement HTML5 sandbox attribute for IFRAMEs
   <meta charset="utf-8">
   <title>Test for Bug 341604 - plugins</title>
   <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="enableTestPlugin.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
 </head>
 <script type="application/javascript">
diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index 2e3f5f8245c..e7dcab3c887 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -560,23 +560,29 @@ nsresult MediaDecoder::InitializeStateMachine(MediaDecoder* aCloneDonor)
     DECODER_LOG(PR_LOG_WARNING, "Failed to init state machine!");
     return NS_ERROR_FAILURE;
   }
-  {
-    ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
-    mDecoderStateMachine->SetDuration(mDuration);
-    mDecoderStateMachine->SetVolume(mInitialVolume);
-    mDecoderStateMachine->SetAudioCaptured(mInitialAudioCaptured);
-    SetPlaybackRate(mInitialPlaybackRate);
-    mDecoderStateMachine->SetPreservesPitch(mInitialPreservesPitch);
-    if (mMinimizePreroll) {
-      mDecoderStateMachine->SetMinimizePrerollUntilPlaybackStarts();
-    }
-  }
+
+  // If some parameters got set before the state machine got created,
+  // set them now
+  SetStateMachineParameters();
 
   ChangeState(PLAY_STATE_LOADING);
 
   return ScheduleStateMachineThread();
 }
 
+void MediaDecoder::SetStateMachineParameters()
+{
+  ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
+  mDecoderStateMachine->SetDuration(mDuration);
+  mDecoderStateMachine->SetVolume(mInitialVolume);
+  mDecoderStateMachine->SetAudioCaptured(mInitialAudioCaptured);
+  SetPlaybackRate(mInitialPlaybackRate);
+  mDecoderStateMachine->SetPreservesPitch(mInitialPreservesPitch);
+  if (mMinimizePreroll) {
+    mDecoderStateMachine->SetMinimizePrerollUntilPlaybackStarts();
+  }
+}
+
 void MediaDecoder::SetMinimizePrerollUntilPlaybackStarts()
 {
   MOZ_ASSERT(NS_IsMainThread());
diff --git a/content/media/MediaDecoder.h b/content/media/MediaDecoder.h
index 7db49e92789..cb37d3f1671 100644
--- a/content/media/MediaDecoder.h
+++ b/content/media/MediaDecoder.h
@@ -1011,6 +1011,7 @@ public:
 
 protected:
   virtual ~MediaDecoder();
+  void SetStateMachineParameters();
 
   /******
    * The following members should be accessed with the decoder lock held.
diff --git a/content/media/mediasource/MediaSourceDecoder.cpp b/content/media/mediasource/MediaSourceDecoder.cpp
index 280b304faa3..56370d27d55 100644
--- a/content/media/mediasource/MediaSourceDecoder.cpp
+++ b/content/media/mediasource/MediaSourceDecoder.cpp
@@ -310,7 +310,14 @@ MediaSourceDecoder::Load(nsIStreamListener**, MediaDecoder*)
     return NS_ERROR_FAILURE;
   }
 
-  return mDecoderStateMachine->Init(nullptr);
+
+  nsresult rv = mDecoderStateMachine->Init(nullptr);
+
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  SetStateMachineParameters();
+
+  return rv;
 }
 
 nsresult
diff --git a/content/media/omx/MediaCodecReader.cpp b/content/media/omx/MediaCodecReader.cpp
index 03fc7ee9d28..4ed087e1e86 100644
--- a/content/media/omx/MediaCodecReader.cpp
+++ b/content/media/omx/MediaCodecReader.cpp
@@ -123,7 +123,7 @@ bool MediaCodecReader::TrackInputCopier::Copy(MediaBuffer* aSourceBuffer, sp<ABu
 MediaCodecReader::Track::Track()
   : mDurationUs(INT64_C(0))
   , mInputIndex(sInvalidInputIndex)
-  , mEndOfStream(false)
+  , mInputEndOfStream(false)
   , mSeekTimeUs(sInvalidTimestampUs)
   , mFlushed(false)
 {
@@ -229,13 +229,14 @@ MediaCodecReader::DecodeAudioData()
 
   // Get one audio output data from MediaCodec
   CodecBufferInfo bufferInfo;
+  status_t status;
   TimeStamp timeout = TimeStamp::Now() + TimeDuration::FromSeconds(sMaxAudioDecodeDurationS);
   while (true) {
     if (timeout < TimeStamp::Now()) {
       return true; // Try it again later.
     }
-    status_t status = GetCodecOutputData(mAudioTrack, bufferInfo, sInvalidTimestampUs, timeout);
-    if (status == OK) {
+    status = GetCodecOutputData(mAudioTrack, bufferInfo, sInvalidTimestampUs, timeout);
+    if (status == OK || status == ERROR_END_OF_STREAM) {
       break;
     } else if (status == -EAGAIN) {
       return true; // Try it again later.
@@ -272,6 +273,10 @@ MediaCodecReader::DecodeAudioData()
 
   mAudioTrack.mCodec->releaseOutputBuffer(bufferInfo.mIndex);
 
+  if (status == ERROR_END_OF_STREAM) {
+    return false;
+  }
+
   return result;
 }
 
@@ -291,13 +296,14 @@ MediaCodecReader::DecodeVideoFrame(bool &aKeyframeSkip, int64_t aTimeThreshold)
 
   // Get one video output data from MediaCodec
   CodecBufferInfo bufferInfo;
+  status_t status;
   TimeStamp timeout = TimeStamp::Now() + TimeDuration::FromSeconds(sMaxVideoDecodeDurationS);
   while (true) {
     if (timeout < TimeStamp::Now()) {
       return true; // Try it again later.
     }
-    status_t status = GetCodecOutputData(mVideoTrack, bufferInfo, threshold, timeout);
-    if (status == OK) {
+    status = GetCodecOutputData(mVideoTrack, bufferInfo, threshold, timeout);
+    if (status == OK || status == ERROR_END_OF_STREAM) {
       break;
     } else if (status == -EAGAIN) {
       return true; // Try it again later.
@@ -392,6 +398,10 @@ MediaCodecReader::DecodeVideoFrame(bool &aKeyframeSkip, int64_t aTimeThreshold)
 
   mVideoTrack.mCodec->releaseOutputBuffer(bufferInfo.mIndex);
 
+  if (status == ERROR_END_OF_STREAM) {
+    return false;
+  }
+
   return result;
 }
 
@@ -475,8 +485,8 @@ MediaCodecReader::Seek(int64_t aTime,
     }
   }
 
-  mAudioTrack.mEndOfStream = false;
-  mVideoTrack.mEndOfStream = false;
+  mAudioTrack.mInputEndOfStream = false;
+  mVideoTrack.mInputEndOfStream = false;
 
   mAudioTrack.mSeekTimeUs = aTime;
   mVideoTrack.mSeekTimeUs = aTime;
@@ -995,7 +1005,7 @@ MediaCodecReader::FillCodecInputData(Track &aTrack)
     return UNKNOWN_ERROR;
   }
 
-  if (aTrack.mEndOfStream) {
+  if (aTrack.mInputEndOfStream) {
     return ERROR_END_OF_STREAM;
   }
 
@@ -1024,8 +1034,10 @@ MediaCodecReader::FillCodecInputData(Track &aTrack)
     if (status == INFO_FORMAT_CHANGED) {
       return INFO_FORMAT_CHANGED;
     } else if (status == ERROR_END_OF_STREAM) {
-      aTrack.mEndOfStream = true;
-      aTrack.mCodec->signalEndOfInputStream();
+      aTrack.mInputEndOfStream = true;
+      status = aTrack.mCodec->queueInputBuffer(aTrack.mInputIndex.value(),
+                                               0, 0, 0,
+                                               MediaCodec::BUFFER_FLAG_EOS);
       return ERROR_END_OF_STREAM;
     } else if (status == -ETIMEDOUT) {
       return OK; // try it later
@@ -1036,7 +1048,7 @@ MediaCodecReader::FillCodecInputData(Track &aTrack)
     }
 
     // read() successes
-    aTrack.mEndOfStream = false;
+    aTrack.mInputEndOfStream = false;
     aTrack.mSeekTimeUs = sInvalidTimestampUs;
 
     sp<ABuffer> input_buffer = nullptr;
@@ -1079,17 +1091,28 @@ MediaCodecReader::GetCodecOutputData(Track &aTrack,
 
   // Try to fill more input buffers and then get one output buffer.
   // FIXME: use callback from MediaCodec
-  status_t status = FillCodecInputData(aTrack);
-  int64_t duration = (int64_t)(aTimeout - TimeStamp::Now()).ToMicroseconds();
-  if (!IsValidDurationUs(duration)) {
-    return -EAGAIN;
-  }
-  if (status == OK) {
-    status = aTrack.mCodec->dequeueOutputBuffer(
-        &info.mIndex, &info.mOffset, &info.mSize, &info.mTimeUs, &info.mFlags, duration);
-  }
+  status_t status = OK;
+
+  while (status == OK || status == INFO_OUTPUT_BUFFERS_CHANGED ||
+         status == -EAGAIN || status == ERROR_END_OF_STREAM) {
+    // Try to fill more input buffers and then get one output buffer.
+    // FIXME: use callback from MediaCodec
+    status = FillCodecInputData(aTrack);
+    int64_t duration = (int64_t)(aTimeout - TimeStamp::Now()).ToMicroseconds();
+    if (!IsValidDurationUs(duration)) {
+      return -EAGAIN;
+    }
+
+    if (status == OK || status == ERROR_END_OF_STREAM) {
+      status = aTrack.mCodec->dequeueOutputBuffer(
+          &info.mIndex, &info.mOffset, &info.mSize, &info.mTimeUs, &info.mFlags, duration);
+      if (info.mFlags & MediaCodec::BUFFER_FLAG_EOS) {
+        aBuffer = info;
+        aBuffer.mBuffer = aTrack.mOutputBuffers[info.mIndex];
+        return ERROR_END_OF_STREAM;
+      }
+    }
 
-  while (status == OK || status == INFO_OUTPUT_BUFFERS_CHANGED || status == -EAGAIN) {
     if (status == OK) {
       if (!IsValidTimestampUs(aThreshold) || info.mTimeUs >= aThreshold) {
         // Get a valid output buffer.
@@ -1110,21 +1133,6 @@ MediaCodecReader::GetCodecOutputData(Track &aTrack,
       // Don't let this loop run for too long. Try it again later.
       return -EAGAIN;
     }
-
-    // FIXME: use callback from MediaCodec
-    status = FillCodecInputData(aTrack);
-    if (status == INFO_OUTPUT_BUFFERS_CHANGED) {
-      continue;
-    } else if (status != OK) {
-      return status;
-    }
-
-    duration = (int64_t)(aTimeout - TimeStamp::Now()).ToMicroseconds();
-    if (!IsValidDurationUs(duration)) {
-      return -EAGAIN;
-    }
-    status = aTrack.mCodec->dequeueOutputBuffer(
-        &info.mIndex, &info.mOffset, &info.mSize, &info.mTimeUs, &info.mFlags, duration);
   }
 
   if (status != OK) {
diff --git a/content/media/omx/MediaCodecReader.h b/content/media/omx/MediaCodecReader.h
index 2e9494ddb9c..6ad8987f2aa 100644
--- a/content/media/omx/MediaCodecReader.h
+++ b/content/media/omx/MediaCodecReader.h
@@ -109,7 +109,7 @@ protected:
 
     // playback parameters
     CheckedUint32 mInputIndex;
-    bool mEndOfStream;
+    bool mInputEndOfStream;
     int64_t mSeekTimeUs;
     bool mFlushed; // meaningless when mSeekTimeUs is invalid.
   };
diff --git a/content/media/test/crashtests/crashtests.list b/content/media/test/crashtests/crashtests.list
index ce0cc5ee952..d0790012124 100644
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -1,18 +1,18 @@
-skip-if(B2G) load 0-timescale.html
-skip-if(B2G) load 459439-1.html # bug 888557
+skip-if(Android||B2G) load 0-timescale.html # bug 1048628 for Android
+skip-if(Android||B2G) load 459439-1.html # bug 888557
 load 466607-1.html
 load 466945-1.html
 load 468763-1.html
 load 474744-1.html
 HTTP load 481136-1.html # needs to be HTTP to recognize the ogg as an audio file?
 load 493915-1.html
-skip-if(Android) load 495794-1.html
 load 492286-1.xhtml
+skip-if(Android) load 495794-1.html
 load 576612-1.html
 skip-if(Android||B2G) load 691096-1.html # Android sound API can't handle playing large number of sounds at once, bug 852821 for B2G
 load 752784-1.html
-skip-if(Android||B2G) HTTP load 795892-1.html # load failed, bug 833371 for B2G
 skip-if(Android||B2G) load 789075-1.html # load failed, bug 833371 for B2G
+skip-if(Android||B2G) HTTP load 795892-1.html # load failed, bug 833371 for B2G
 load 844563.html
 load 846612.html
 load 852838.html
@@ -33,12 +33,12 @@ load 876215.html
 load 876249.html
 load 876252.html
 load 876834.html
+load 877527.html
 load 877820.html
 load 878014.html
 load 878328.html
 load 878407.html
 load 878478.html
-load 877527.html
 load 880129.html
 skip-if(B2G) load 880202.html # load failed, bug 908306 for B2G
 load 880342-1.html
@@ -47,8 +47,8 @@ load 880384.html
 load 880404.html
 load 880724.html
 load 881775.html
-load 882956.html
 test-pref(media.webvtt.enabled,true) load 882549.html
+load 882956.html
 load 884459.html
 load 889042.html
 test-pref(media.webvtt.enabled,true) load 894104.html
@@ -68,11 +68,11 @@ load 952756.html
 load 966636.html
 load 986901.html
 load 990794.html
+load 1015662.html
+skip-if(Android||B2G) test-pref(media.navigator.permission.disabled,true) load 1028458.html
 load buffer-source-ended-1.html
-load offline-buffer-source-ended-1.html
 HTTP load media-element-source-seek-1.html
 skip-if(B2G) load oscillator-ended-1.html # intermittent B2G timeouts, bug 920338
 skip-if(B2G) load oscillator-ended-2.html # intermittent B2G timeouts, bug 920338
-load 1015662.html
+load offline-buffer-source-ended-1.html
 include ../../mediasource/test/crashtests/crashtests.list
-test-pref(media.navigator.permission.disabled,true) load 1028458.html
diff --git a/docshell/base/nsDSURIContentListener.h b/docshell/base/nsDSURIContentListener.h
index d84176bf691..038f153cfd7 100644
--- a/docshell/base/nsDSURIContentListener.h
+++ b/docshell/base/nsDSURIContentListener.h
@@ -29,7 +29,7 @@ public:
     nsresult Init();
 
 protected:
-    nsDSURIContentListener(nsDocShell* aDocShell);
+    explicit nsDSURIContentListener(nsDocShell* aDocShell);
     virtual ~nsDSURIContentListener();
 
     void DropDocShellreference() {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 342c1f44065..9b697bff8a7 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -665,7 +665,7 @@ protected:
     class RestorePresentationEvent : public nsRunnable {
     public:
         NS_DECL_NSIRUNNABLE
-        RestorePresentationEvent(nsDocShell *ds) : mDocShell(ds) {}
+        explicit RestorePresentationEvent(nsDocShell *ds) : mDocShell(ds) {}
         void Revoke() { mDocShell = nullptr; }
     private:
         nsRefPtr<nsDocShell> mDocShell;
@@ -928,7 +928,7 @@ private:
 public:
     class InterfaceRequestorProxy : public nsIInterfaceRequestor {
     public:
-        InterfaceRequestorProxy(nsIInterfaceRequestor* p);
+        explicit InterfaceRequestorProxy(nsIInterfaceRequestor* p);
         NS_DECL_THREADSAFE_ISUPPORTS
         NS_DECL_NSIINTERFACEREQUESTOR
  
diff --git a/docshell/base/nsDocShellEditorData.h b/docshell/base/nsDocShellEditorData.h
index b1614836b34..7dc2b4b38e0 100644
--- a/docshell/base/nsDocShellEditorData.h
+++ b/docshell/base/nsDocShellEditorData.h
@@ -20,7 +20,7 @@ class nsDocShellEditorData
 {
 public:
 
-  nsDocShellEditorData(nsIDocShell* inOwningDocShell);
+  explicit nsDocShellEditorData(nsIDocShell* inOwningDocShell);
   ~nsDocShellEditorData();
 
   nsresult MakeEditable(bool inWaitForUriLoad);
diff --git a/docshell/base/nsDocShellEnumerator.h b/docshell/base/nsDocShellEnumerator.h
index 32256fff4d6..b885e47ac26 100644
--- a/docshell/base/nsDocShellEnumerator.h
+++ b/docshell/base/nsDocShellEnumerator.h
@@ -42,7 +42,7 @@ protected:
 
 public:
 
-                              nsDocShellEnumerator(int32_t inEnumerationDirection);
+                              explicit nsDocShellEnumerator(int32_t inEnumerationDirection);
 
   // nsISupports
   NS_DECL_ISUPPORTS
diff --git a/docshell/shistory/src/nsSHistory.h b/docshell/shistory/src/nsSHistory.h
index 546b2f7cf66..101dcac1df3 100644
--- a/docshell/shistory/src/nsSHistory.h
+++ b/docshell/shistory/src/nsSHistory.h
@@ -108,7 +108,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSISIMPLEENUMERATOR
 
-  nsSHEnumerator(nsSHistory *  aHistory);
+  explicit nsSHEnumerator(nsSHistory *  aHistory);
   
 protected:
   friend class nsSHistory;
diff --git a/dom/audiochannel/AudioChannelAgent.cpp b/dom/audiochannel/AudioChannelAgent.cpp
index d8df5a4ea4a..cf8ee78280d 100644
--- a/dom/audiochannel/AudioChannelAgent.cpp
+++ b/dom/audiochannel/AudioChannelAgent.cpp
@@ -80,9 +80,6 @@ AudioChannelAgent::InitInternal(nsIDOMWindow* aWindow, int32_t aChannelType,
                                 nsIAudioChannelAgentCallback *aCallback,
                                 bool aUseWeakRef, bool aWithVideo)
 {
-  // We need the window only for IPC.
-  MOZ_ASSERT(aWindow || XRE_GetProcessType() == GeckoProcessType_Default);
-
   // We syncd the enum of channel type between nsIAudioChannelAgent.idl and
   // AudioChannelBinding.h the same.
   MOZ_ASSERT(int(AUDIO_AGENT_CHANNEL_NORMAL) == int(AudioChannel::Normal) &&
diff --git a/dom/base/DOMError.h b/dom/base/DOMError.h
index 1bd0bfc09b0..ca02d06ba03 100644
--- a/dom/base/DOMError.h
+++ b/dom/base/DOMError.h
@@ -44,7 +44,7 @@ public:
   // aWindow can be null if this DOMError is not associated with a particular
   // window.
 
-  DOMError(nsPIDOMWindow* aWindow);
+  explicit DOMError(nsPIDOMWindow* aWindow);
 
   DOMError(nsPIDOMWindow* aWindow, nsresult aValue);
 
diff --git a/dom/base/MessageChannel.h b/dom/base/MessageChannel.h
index 7818d0183db..c7411eae9fe 100644
--- a/dom/base/MessageChannel.h
+++ b/dom/base/MessageChannel.h
@@ -31,7 +31,7 @@ public:
   static bool Enabled(JSContext* aCx, JSObject* aGlobal);
 
 public:
-  MessageChannel(nsPIDOMWindow* aWindow);
+  explicit MessageChannel(nsPIDOMWindow* aWindow);
 
   nsPIDOMWindow*
   GetParentObject() const
diff --git a/dom/base/MessagePort.cpp b/dom/base/MessagePort.cpp
index e2777b99a1c..87202409362 100644
--- a/dom/base/MessagePort.cpp
+++ b/dom/base/MessagePort.cpp
@@ -28,7 +28,7 @@ class DispatchEventRunnable : public nsRunnable
   friend class MessagePort;
 
   public:
-    DispatchEventRunnable(MessagePort* aPort)
+    explicit DispatchEventRunnable(MessagePort* aPort)
       : mPort(aPort)
     {
     }
diff --git a/dom/base/MessagePort.h b/dom/base/MessagePort.h
index 2d4f123c2ab..ca3e8dd74f4 100644
--- a/dom/base/MessagePort.h
+++ b/dom/base/MessagePort.h
@@ -20,7 +20,7 @@ class PostMessageRunnable;
 class MessagePortBase : public DOMEventTargetHelper
 {
 protected:
-  MessagePortBase(nsPIDOMWindow* aWindow);
+  explicit MessagePortBase(nsPIDOMWindow* aWindow);
   MessagePortBase();
 
 public:
@@ -61,7 +61,7 @@ public:
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(MessagePort,
                                            DOMEventTargetHelper)
 
-  MessagePort(nsPIDOMWindow* aWindow);
+  explicit MessagePort(nsPIDOMWindow* aWindow);
 
   virtual JSObject*
   WrapObject(JSContext* aCx) MOZ_OVERRIDE;
diff --git a/dom/base/nsDOMWindowUtils.h b/dom/base/nsDOMWindowUtils.h
index e22dfe3a737..b78d658c1e0 100644
--- a/dom/base/nsDOMWindowUtils.h
+++ b/dom/base/nsDOMWindowUtils.h
@@ -58,7 +58,7 @@ class nsDOMWindowUtils MOZ_FINAL : public nsIDOMWindowUtils,
                                    public nsSupportsWeakReference
 {
 public:
-  nsDOMWindowUtils(nsGlobalWindow *aWindow);
+  explicit nsDOMWindowUtils(nsGlobalWindow *aWindow);
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMWINDOWUTILS
 
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index 82ef6424a65..5f8baa885f3 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -710,7 +710,7 @@ nsFocusManager::WindowRaised(nsIDOMWindow* aWindow)
     // disable selection mousedown state on activation
     // XXXndeakin P3 not sure if this is necessary, but it doesn't hurt
     nsRefPtr<nsFrameSelection> frameSelection = presShell->FrameSelection();
-    frameSelection->SetMouseDownState(false);
+    frameSelection->SetDragState(false);
   }
 
   Focus(currentWindow, currentFocus, 0, true, false, true, true);
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index fac504e856c..c45414f18ea 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -8646,7 +8646,7 @@ nsGlobalWindow::EnterModalState()
 
       if (activeShell) {
         nsRefPtr<nsFrameSelection> frameSelection = activeShell->FrameSelection();
-        frameSelection->SetMouseDownState(false);
+        frameSelection->SetDragState(false);
       }
     }
   }
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 31a8811bdc1..d187f63d75b 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -523,7 +523,7 @@ public:
                            mozilla::ErrorResult& aRv);
 
   // Object Management
-  nsGlobalWindow(nsGlobalWindow *aOuterWindow);
+  explicit nsGlobalWindow(nsGlobalWindow *aOuterWindow);
 
   static nsGlobalWindow *FromSupports(nsISupports *supports)
   {
@@ -1666,7 +1666,7 @@ public:
   // nsIDOMChromeWindow interface
   NS_DECL_NSIDOMCHROMEWINDOW
 
-  nsGlobalChromeWindow(nsGlobalWindow *aOuterWindow)
+  explicit nsGlobalChromeWindow(nsGlobalWindow *aOuterWindow)
     : nsGlobalWindow(aOuterWindow),
       mGroupMessageManagers(1)
   {
@@ -1733,7 +1733,7 @@ class nsGlobalModalWindow : public nsGlobalWindow,
                             public nsIDOMModalContentWindow
 {
 public:
-  nsGlobalModalWindow(nsGlobalWindow *aOuterWindow)
+  explicit nsGlobalModalWindow(nsGlobalWindow *aOuterWindow)
     : nsGlobalWindow(aOuterWindow)
   {
     mIsModalContentWindow = true;
diff --git a/dom/base/nsPIDOMWindow.h b/dom/base/nsPIDOMWindow.h
index e062fa3b1f8..3e10e7380f2 100644
--- a/dom/base/nsPIDOMWindow.h
+++ b/dom/base/nsPIDOMWindow.h
@@ -729,7 +729,7 @@ protected:
   // be null if and only if the created window itself is an outer
   // window. In all other cases aOuterWindow should be the outer
   // window for the inner window that is being created.
-  nsPIDOMWindow(nsPIDOMWindow *aOuterWindow);
+  explicit nsPIDOMWindow(nsPIDOMWindow *aOuterWindow);
 
   ~nsPIDOMWindow();
 
@@ -842,7 +842,7 @@ class NS_AUTO_POPUP_STATE_PUSHER
 {
 public:
 #ifdef MOZILLA_INTERNAL_API
-  NS_AUTO_POPUP_STATE_PUSHER(PopupControlState aState, bool aForce = false)
+  explicit NS_AUTO_POPUP_STATE_PUSHER(PopupControlState aState, bool aForce = false)
     : mOldState(::PushPopupControlState(aState, aForce))
   {
   }
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 4a7f25cc327..3f616e43f43 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -10448,6 +10448,59 @@ def stripTrailingWhitespace(text):
     lines = text.splitlines()
     return '\n'.join(line.rstrip() for line in lines) + tail
 
+class MemberProperties:
+    def __init__(self):
+        self.isGenericMethod = False
+        self.isCrossOriginMethod = False
+        self.isPromiseReturningMethod = False
+        self.isGenericGetter = False
+        self.isLenientGetter = False
+        self.isCrossOriginGetter = False
+        self.isGenericSetter = False
+        self.isLenientSetter = False
+        self.isCrossOriginSetter = False
+        self.isJsonifier = False
+
+def memberProperties(m, descriptor):
+    props = MemberProperties()
+    if m.isMethod():
+        if m == descriptor.operations['Jsonifier']:
+            props.isGenericMethod = descriptor.needsSpecialGenericOps()
+            props.isJsonifier = True
+        elif (not m.isIdentifierLess() or m == descriptor.operations['Stringifier']):
+            if not m.isStatic() and descriptor.interface.hasInterfacePrototypeObject():
+                if m.returnsPromise() and descriptor.needsSpecialGenericOps():
+                    props.isPromiseReturningMethod = True
+                if m.getExtendedAttribute("CrossOriginCallable"):
+                    props.isCrossOriginMethod = True
+                elif descriptor.needsSpecialGenericOps():
+                    props.isGenericMethod = True
+    elif m.isAttr():
+        if not m.isStatic() and descriptor.interface.hasInterfacePrototypeObject():
+            if m.hasLenientThis():
+                props.isLenientGetter = True
+            elif m.getExtendedAttribute("CrossOriginReadable"):
+                props.isCrossOriginGetter = True
+            elif descriptor.needsSpecialGenericOps():
+                props.isGenericGetter = True
+        if not m.readonly:
+            if not m.isStatic() and descriptor.interface.hasInterfacePrototypeObject():
+                if m.hasLenientThis():
+                    props.isLenientSetter = True
+                elif IsCrossOriginWritable(m, descriptor):
+                    props.isCrossOriginSetter = True
+                elif descriptor.needsSpecialGenericOps():
+                    props.isGenericSetter = True
+        elif m.getExtendedAttribute("PutForwards"):
+            if IsCrossOriginWritable(m, descriptor):
+                props.isCrossOriginSetter = True
+            elif descriptor.needsSpecialGenericOps():
+                props.isGenericSetter = True
+        elif m.getExtendedAttribute("Replaceable"):
+            if descriptor.needsSpecialGenericOps():
+                props.isGenericSetter = True
+
+    return props
 
 class CGDescriptor(CGThing):
     def __init__(self, descriptor):
@@ -10467,9 +10520,9 @@ class CGDescriptor(CGThing):
                                   descriptor.nativeType))
         # These are set to true if at least one non-static
         # method/getter/setter or jsonifier exist on the interface.
-        (hasMethod, hasGetter, hasLenientGetter, hasSetter, hasJsonifier,
-            hasLenientSetter,
-            hasPromiseReturningMethod) = False, False, False, False, False, False, False
+        (hasMethod, hasGetter, hasLenientGetter, hasSetter, hasLenientSetter,
+            hasPromiseReturningMethod) = False, False, False, False, False, False
+        jsonifierMethod = None
         crossOriginMethods, crossOriginGetters, crossOriginSetters = set(), set(), set()
         for n in descriptor.interface.namedConstructors:
             cgThings.append(CGClassConstructor(descriptor, n,
@@ -10479,29 +10532,26 @@ class CGDescriptor(CGThing):
                 continue
             if not isMaybeExposedIn(m, descriptor):
                 continue
-            if m.isMethod() and m == descriptor.operations['Jsonifier']:
-                hasJsonifier = True
-                hasMethod = descriptor.needsSpecialGenericOps()
-                jsonifierMethod = m
-            elif (m.isMethod() and
-                  (not m.isIdentifierLess() or m == descriptor.operations['Stringifier'])):
-                if m.isStatic():
-                    assert descriptor.interface.hasInterfaceObject()
-                    cgThings.append(CGStaticMethod(descriptor, m))
-                    if m.returnsPromise():
-                        cgThings.append(CGStaticMethodJitinfo(m))
-                elif descriptor.interface.hasInterfacePrototypeObject():
-                    specializedMethod = CGSpecializedMethod(descriptor, m)
-                    cgThings.append(specializedMethod)
-                    if m.returnsPromise():
-                        if descriptor.needsSpecialGenericOps():
-                            hasPromiseReturningMethod = True
-                        cgThings.append(CGMethodPromiseWrapper(descriptor, specializedMethod))
-                    cgThings.append(CGMemberJITInfo(descriptor, m))
-                    if m.getExtendedAttribute("CrossOriginCallable"):
-                        crossOriginMethods.add(m.identifier.name)
-                    elif descriptor.needsSpecialGenericOps():
-                        hasMethod = True
+
+            props = memberProperties(m, descriptor)
+
+            if m.isMethod():
+                if props.isJsonifier:
+                    jsonifierMethod = m
+                elif not m.isIdentifierLess() or m == descriptor.operations['Stringifier']:
+                    if m.isStatic():
+                        assert descriptor.interface.hasInterfaceObject()
+                        cgThings.append(CGStaticMethod(descriptor, m))
+                        if m.returnsPromise():
+                            cgThings.append(CGStaticMethodJitinfo(m))
+                    elif descriptor.interface.hasInterfacePrototypeObject():
+                        specializedMethod = CGSpecializedMethod(descriptor, m)
+                        cgThings.append(specializedMethod)
+                        if m.returnsPromise():
+                            cgThings.append(CGMethodPromiseWrapper(descriptor, specializedMethod))
+                        cgThings.append(CGMemberJITInfo(descriptor, m))
+                        if props.isCrossOriginMethod:
+                            crossOriginMethods.add(m.identifier.name)
             elif m.isAttr():
                 if m.stringifier:
                     raise TypeError("Stringifier attributes not supported yet. "
@@ -10512,12 +10562,8 @@ class CGDescriptor(CGThing):
                     cgThings.append(CGStaticGetter(descriptor, m))
                 elif descriptor.interface.hasInterfacePrototypeObject():
                     cgThings.append(CGSpecializedGetter(descriptor, m))
-                    if m.hasLenientThis():
-                        hasLenientGetter = True
-                    elif m.getExtendedAttribute("CrossOriginReadable"):
+                    if props.isCrossOriginGetter:
                         crossOriginGetters.add(m.identifier.name)
-                    elif descriptor.needsSpecialGenericOps():
-                        hasGetter = True
                 if not m.readonly:
                     for extAttr in ["PutForwards", "Replaceable"]:
                         if m.getExtendedAttribute(extAttr):
@@ -10530,26 +10576,27 @@ class CGDescriptor(CGThing):
                         cgThings.append(CGStaticSetter(descriptor, m))
                     elif descriptor.interface.hasInterfacePrototypeObject():
                         cgThings.append(CGSpecializedSetter(descriptor, m))
-                        if m.hasLenientThis():
-                            hasLenientSetter = True
-                        elif IsCrossOriginWritable(m, descriptor):
+                        if props.isCrossOriginSetter:
                             crossOriginSetters.add(m.identifier.name)
-                        elif descriptor.needsSpecialGenericOps():
-                            hasSetter = True
                 elif m.getExtendedAttribute("PutForwards"):
                     cgThings.append(CGSpecializedForwardingSetter(descriptor, m))
-                    if IsCrossOriginWritable(m, descriptor):
+                    if props.isCrossOriginSetter:
                         crossOriginSetters.add(m.identifier.name)
-                    elif descriptor.needsSpecialGenericOps():
-                        hasSetter = True
                 elif m.getExtendedAttribute("Replaceable"):
                     cgThings.append(CGSpecializedReplaceableSetter(descriptor, m))
-                    if descriptor.needsSpecialGenericOps():
-                        hasSetter = True
                 if (not m.isStatic() and
                     descriptor.interface.hasInterfacePrototypeObject()):
                     cgThings.append(CGMemberJITInfo(descriptor, m))
-        if hasJsonifier:
+
+            hasMethod = hasMethod or props.isGenericMethod
+            hasPromiseReturningMethod = (hasPromiseReturningMethod or
+                                         props.isPromiseReturningMethod)
+            hasGetter = hasGetter or props.isGenericGetter
+            hasLenientGetter = hasLenientGetter or props.isLenientGetter
+            hasSetter = hasSetter or props.isGenericSetter
+            hasLenientSetter = hasLenientSetter or props.isLenientSetter
+
+        if jsonifierMethod:
             cgThings.append(CGJsonifierMethod(descriptor, jsonifierMethod))
             cgThings.append(CGMemberJITInfo(descriptor, jsonifierMethod))
         if hasMethod:
@@ -11603,10 +11650,30 @@ class CGBindingRoot(CGThing):
     """
     def __init__(self, config, prefix, webIDLFile):
         bindingHeaders = {}
+        bindingDeclareHeaders = dict.fromkeys((
+            'mozilla/dom/BindingDeclarations.h',
+            'mozilla/dom/Nullable.h',
+            'mozilla/ErrorResult.h',
+            ),
+            True)
+
         descriptors = config.getDescriptors(webIDLFile=webIDLFile,
                                             hasInterfaceOrInterfacePrototypeObject=True,
                                             skipGen=False)
 
+        def descriptorHasCrossOriginProperties(desc):
+            def hasCrossOriginProperty(m):
+                props = memberProperties(m, desc)
+                return (props.isCrossOriginMethod or
+                        props.isCrossOriginGetter or
+                        props.isCrossOriginSetter)
+
+            return any(hasCrossOriginProperty(m) for m in desc.interface.members)
+
+        bindingDeclareHeaders["jsapi.h"] = any(descriptorHasCrossOriginProperties(d) for d in descriptors)
+        bindingDeclareHeaders["jspubtd.h"] = not bindingDeclareHeaders["jsapi.h"]
+        bindingDeclareHeaders["js/RootingAPI.h"] = not bindingDeclareHeaders["jsapi.h"]
+
         def descriptorRequiresPreferences(desc):
             iface = desc.interface
             return any(m.getExtendedAttribute("Pref") for m in iface.members + [iface])
@@ -11647,6 +11714,7 @@ class CGBindingRoot(CGThing):
                                                     isCallback=True)
         jsImplemented = config.getDescriptors(webIDLFile=webIDLFile,
                                               isJSImplemented=True)
+        bindingDeclareHeaders["nsWeakReference.h"] = jsImplemented
         bindingHeaders["nsPIDOMWindow.h"] = jsImplemented
         bindingHeaders["AtomList.h"] = hasNonEmptyDictionaries or jsImplemented or callbackDescriptors
 
@@ -11751,21 +11819,15 @@ class CGBindingRoot(CGThing):
         bindingHeaders = [header
                           for header, include in bindingHeaders.iteritems()
                           if include]
-        declareIncludes = [
-            'mozilla/dom/BindingDeclarations.h',
-            'mozilla/dom/Nullable.h',
-            'mozilla/ErrorResult.h',
-            'jspubtd.h',
-            'js/RootingAPI.h',
-        ]
-        if jsImplemented:
-            declareIncludes.append('nsWeakReference.h')
+        bindingDeclareHeaders = [header
+                                 for header, include in bindingDeclareHeaders.iteritems()
+                                 if include]
 
         curr = CGHeaders(descriptors,
                          dictionaries,
                          mainCallbacks + workerCallbacks,
                          callbackDescriptors,
-                         declareIncludes,
+                         bindingDeclareHeaders,
                          bindingHeaders,
                          prefix,
                          curr,
diff --git a/dom/bindings/TypedArray.h b/dom/bindings/TypedArray.h
index de70cca4b9b..ca3e19567ca 100644
--- a/dom/bindings/TypedArray.h
+++ b/dom/bindings/TypedArray.h
@@ -233,7 +233,7 @@ class TypedArrayCreator
   typedef nsTArray<typename TypedArrayType::element_type> ArrayType;
 
   public:
-    TypedArrayCreator(const ArrayType& aArray)
+    explicit TypedArrayCreator(const ArrayType& aArray)
       : mArray(aArray)
     {}
 
@@ -298,7 +298,7 @@ class MOZ_STACK_CLASS RootedTypedArray : public ArrayType,
                                          private TypedArrayRooter<ArrayType>
 {
 public:
-  RootedTypedArray(JSContext* cx MOZ_GUARD_OBJECT_NOTIFIER_PARAM) :
+  explicit RootedTypedArray(JSContext* cx MOZ_GUARD_OBJECT_NOTIFIER_PARAM) :
     ArrayType(),
     TypedArrayRooter<ArrayType>(cx,
                                 MOZ_THIS_IN_INITIALIZER_LIST()
diff --git a/dom/datastore/DataStoreChangeNotifier.jsm b/dom/datastore/DataStoreChangeNotifier.jsm
index 64951f3ca43..bbf44a1f7ce 100644
--- a/dom/datastore/DataStoreChangeNotifier.jsm
+++ b/dom/datastore/DataStoreChangeNotifier.jsm
@@ -23,12 +23,33 @@ XPCOMUtils.defineLazyServiceGetter(this, "dataStoreService",
                                    "@mozilla.org/datastore-service;1",
                                    "nsIDataStoreService");
 
+XPCOMUtils.defineLazyServiceGetter(this, "systemMessenger",
+                                   "@mozilla.org/system-message-internal;1",
+                                   "nsISystemMessagesInternal");
+
+var kSysMsgOnChangeShortTimeoutSec =
+    Services.prefs.getIntPref("dom.datastore.sysMsgOnChangeShortTimeoutSec");
+var kSysMsgOnChangeLongTimeoutSec =
+    Services.prefs.getIntPref("dom.datastore.sysMsgOnChangeLongTimeoutSec");
+
 this.DataStoreChangeNotifier = {
   children: [],
   messages: [ "DataStore:Changed", "DataStore:RegisterForMessages",
               "DataStore:UnregisterForMessages",
               "child-process-shutdown" ],
 
+  // These hashes are used for storing the mapping between the datastore
+  // identifiers (name | owner manifest URL) and their correspondent timers. 
+  // The object literal is defined as below:
+  //
+  // {
+  //   "datastore name 1|owner manifest URL 1": timer1,
+  //   "datastore name 2|owner manifest URL 2": timer2,
+  //   ...
+  // }
+  sysMsgOnChangeShortTimers: {},
+  sysMsgOnChangeLongTimers: {},
+
   init: function() {
     debug("init");
 
@@ -59,7 +80,8 @@ this.DataStoreChangeNotifier = {
   },
 
   broadcastMessage: function broadcastMessage(aData) {
-    debug("Broadast");
+    debug("broadcast");
+
     this.children.forEach(function(obj) {
       if (obj.store == aData.store && obj.owner == aData.owner) {
         obj.mm.sendAsyncMessage("DataStore:Changed:Return:OK", aData);
@@ -67,6 +89,69 @@ this.DataStoreChangeNotifier = {
     });
   },
 
+  broadcastSystemMessage: function(aStore, aOwner) {
+    debug("broadcastSystemMessage");
+
+    // Clear relevant timers.
+    var storeKey = aStore + "|" + aOwner;
+    var shortTimer = this.sysMsgOnChangeShortTimers[storeKey];
+    if (shortTimer) {
+      shortTimer.cancel();
+      delete this.sysMsgOnChangeShortTimers[storeKey];
+    }
+    var longTimer = this.sysMsgOnChangeLongTimers[storeKey];
+    if (longTimer) {
+      longTimer.cancel();
+      delete this.sysMsgOnChangeLongTimers[storeKey];
+    }
+
+    // Get all the manifest URLs of the apps which can access the datastore.
+    var manifestURLs = dataStoreService.getAppManifestURLsForDataStore(aStore);
+    var enumerate = manifestURLs.enumerate();
+    while (enumerate.hasMoreElements()) {
+      var manifestURL = enumerate.getNext().QueryInterface(Ci.nsISupportsString);
+      debug("Notify app " + manifestURL + " of datastore updates");
+      // Send the system message 'datastore-update-{store name}' to all the
+      // pages for these apps. With the manifest URL of the owner in the message
+      // payload, it notifies the consumer a sync operation should be performed.
+      systemMessenger.sendMessage("datastore-update-" + aStore,
+                                  { owner: aOwner },
+                                  null,
+                                  Services.io.newURI(manifestURL, null, null));
+    }
+  },
+
+  // Use the following logic to broadcast system messages in a moderate pattern.
+  // 1. When an entry is changed, start a short timer and a long timer.
+  // 2. If an entry is changed while the short timer is running, reset it.
+  //    Do not reset the long timer.
+  // 3. Once either fires, broadcast the system message and cancel both timers.
+  setSystemMessageTimeout: function(aStore, aOwner) {
+    debug("setSystemMessageTimeout");
+
+    var storeKey = aStore + "|" + aOwner;
+    
+    // Reset the short timer.
+    var shortTimer = this.sysMsgOnChangeShortTimers[storeKey];
+    if (!shortTimer) {
+      shortTimer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+      this.sysMsgOnChangeShortTimers[storeKey] = shortTimer;
+    } else {
+      shortTimer.cancel();
+    }
+    shortTimer.initWithCallback({ notify: this.broadcastSystemMessage.bind(this, aStore, aOwner) },
+                                kSysMsgOnChangeShortTimeoutSec * 1000,
+                                Ci.nsITimer.TYPE_ONE_SHOT);
+
+    // Set the long timer if necessary.
+    if (!this.sysMsgOnChangeLongTimers[storeKey]) {
+      var longTimer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
+      this.sysMsgOnChangeLongTimers[storeKey] = longTimer;
+      longTimer.initWithCallback({ notify: this.broadcastSystemMessage.bind(this, aStore, aOwner) },
+                                 kSysMsgOnChangeLongTimeoutSec * 1000,
+                                 Ci.nsITimer.TYPE_ONE_SHOT);
+    }
+  },
 
   receiveMessage: function(aMessage) {
     debug("receiveMessage ");
@@ -89,6 +174,7 @@ this.DataStoreChangeNotifier = {
     switch (aMessage.name) {
       case "DataStore:Changed":
         this.broadcastMessage(aMessage.data);
+        this.setSystemMessageTimeout(aMessage.data.store, aMessage.data.owner);
         break;
 
       case "DataStore:RegisterForMessages":
diff --git a/dom/datastore/DataStoreService.cpp b/dom/datastore/DataStoreService.cpp
index a30a513a8d7..580246bc54b 100644
--- a/dom/datastore/DataStoreService.cpp
+++ b/dom/datastore/DataStoreService.cpp
@@ -33,9 +33,11 @@
 #include "nsIDocument.h"
 #include "nsIDOMGlobalPropertyInitializer.h"
 #include "nsIIOService.h"
+#include "nsIMutableArray.h"
 #include "nsIObserverService.h"
 #include "nsIPermissionManager.h"
 #include "nsIScriptSecurityManager.h"
+#include "nsISupportsPrimitives.h"
 #include "nsIUUIDGenerator.h"
 #include "nsPIDOMWindow.h"
 #include "nsIURI.h"
@@ -375,6 +377,24 @@ GetDataStoreInfosEnumerator(const uint32_t& aAppId,
   return PL_DHASH_NEXT;
 }
 
+PLDHashOperator
+GetAppManifestURLsEnumerator(const uint32_t& aAppId,
+                             DataStoreInfo* aInfo,
+                             void* aUserData)
+{
+  AssertIsInMainProcess();
+  MOZ_ASSERT(NS_IsMainThread());
+
+  auto* manifestURLs = static_cast<nsIMutableArray*>(aUserData);
+  nsCOMPtr<nsISupportsString> manifestURL(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
+  if (manifestURL) {
+    manifestURL->SetData(aInfo->mManifestURL);
+    manifestURLs->AppendElement(manifestURL, false);
+  }
+
+  return PL_DHASH_NEXT;
+}
+
 // This class is useful to enumerate the add permissions for each app.
 class MOZ_STACK_CLASS AddPermissionsData
 {
@@ -1057,6 +1077,31 @@ DataStoreService::GetDataStoreInfos(const nsAString& aName,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+DataStoreService::GetAppManifestURLsForDataStore(const nsAString& aName,
+                                                 nsIArray** aManifestURLs)
+{
+  ASSERT_PARENT_PROCESS()
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsCOMPtr<nsIMutableArray> manifestURLs = do_CreateInstance(NS_ARRAY_CONTRACTID);
+  if (!manifestURLs) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  HashApp* apps = nullptr;
+  if (mStores.Get(aName, &apps)) {
+    apps->EnumerateRead(GetAppManifestURLsEnumerator, manifestURLs.get());
+  }
+  if (mAccessStores.Get(aName, &apps)) {
+    apps->EnumerateRead(GetAppManifestURLsEnumerator, manifestURLs.get());
+  }
+
+  *aManifestURLs = manifestURLs;
+  NS_ADDREF(*aManifestURLs);
+  return NS_OK;
+}
+
 bool
 DataStoreService::CheckPermission(nsIPrincipal* aPrincipal)
 {
diff --git a/dom/datastore/nsIDataStoreService.idl b/dom/datastore/nsIDataStoreService.idl
index b2b3d658630..adb2b2f50ff 100644
--- a/dom/datastore/nsIDataStoreService.idl
+++ b/dom/datastore/nsIDataStoreService.idl
@@ -7,8 +7,9 @@
 
 interface nsIDOMWindow;
 interface nsIPrincipal;
+interface nsIArray;
 
-[scriptable, uuid(9b59c49a-0cd7-11e4-b096-74d02b97e723)]
+[scriptable, uuid(79944b1c-187d-11e4-abb6-74d02b97e723)]
 interface nsIDataStoreService : nsISupports
 {
   void installDataStore(in unsigned long appId,
@@ -27,5 +28,7 @@ interface nsIDataStoreService : nsISupports
                             in DOMString name,
                             in DOMString owner);
 
+  nsIArray getAppManifestURLsForDataStore(in DOMString name);
+
   boolean checkPermission(in nsIPrincipal principal);
 };
diff --git a/dom/datastore/tests/file_notify_system_message.html b/dom/datastore/tests/file_notify_system_message.html
new file mode 100644
index 00000000000..05e9153cd07
--- /dev/null
+++ b/dom/datastore/tests/file_notify_system_message.html
@@ -0,0 +1,122 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for DataStore - notify updates with system messages</title>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+  <script type="application/javascript;version=1.7">
+
+  var gStore;
+  var gChangeId = null;
+  var gChangeOperation = null;
+  var gIsSystemMessageFired = false;
+
+  function is(a, b, msg) {
+    alert((a === b ? 'OK' : 'KO') + ' ' + msg)
+  }
+
+  function ok(a, msg) {
+    alert((a ? 'OK' : 'KO')+ ' ' + msg)
+  }
+
+  function cbError() {
+    alert('KO error');
+  }
+
+  function finish() {
+    alert('DONE');
+  }
+
+  function testGetDataStores() {
+    navigator.getDataStores('foo').then(function(stores) {
+      is(stores.length, 1, "getDataStores('foo') returns 1 element");
+      is(stores[0].name, 'foo', 'The dataStore.name is foo');
+      is(stores[0].readOnly, false, 'The dataStore foo is not in readonly');
+
+      gStore = stores[0];
+      runTest();
+    }, cbError);
+  }
+
+  function testStoreAdd(value, expectedId) {
+    gStore.add(value).then(function(id) {
+      is(id, expectedId, "store.add() is called");
+    }, cbError);
+  }
+
+  function eventListener(evt) {
+    ok(evt instanceof DataStoreChangeEvent, "DataStoreChangeEvent has been received");
+    ok(evt, "OnChangeListener is called with data");
+    is(/[0-9a-zA-Z]{8}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{4}-[0-9a-zA-Z]{12}/.test(evt.revisionId), true, "event.revisionId returns something");
+    is(evt.id, gChangeId, "OnChangeListener is called with the right ID: " + evt.id);
+    is(evt.operation, gChangeOperation, "OnChangeListener is called with the right operation:" + evt.operation + " " + gChangeOperation);
+    runTest();
+  }
+
+  function onDatastoreUpdateFoo(message) {
+    gIsSystemMessageFired = true;
+    ok(true, "System message 'datastore-update-foo' has been received");
+    runTest();
+  }
+
+  var tests = [
+    // Test for GetDataStore.
+    testGetDataStores,
+
+    // Add onchange = function.
+    function() {
+      gStore.onchange = eventListener;
+      is(gStore.onchange, eventListener, "onChange is set");
+      runTest();
+    },
+
+    // Set system message handler.
+    function() {
+      navigator.mozSetMessageHandler('datastore-update-foo', onDatastoreUpdateFoo);
+      runTest();
+    },
+
+    // Add.
+    function() { gChangeId = 1; gChangeOperation = 'added';
+                 testStoreAdd({ number: 42 }, 1); },
+
+    // Remove event listener.
+    function() {
+      gStore.removeEventListener('change', eventListener);
+      runTest();
+    },
+
+    // Wait enough amount of time for the system message to fire.
+    function() {
+      setTimeout(runTest, 10000);
+    },
+
+    // Ensure the system message has fired and no more pending ones.
+    function() {
+      ok(!navigator.mozHasPendingMessage('datastore-update-foo'), "No more pending system message");
+      ok(gIsSystemMessageFired, "The system message has fired");
+      runTest();
+    }
+  ];
+
+  function runTest() {
+    if (!tests.length) {
+      finish();
+      return;
+    }
+
+    var test = tests.shift();
+    test();
+  }
+
+  runTest();
+  </script>
+</pre>
+</body>
+</html>
diff --git a/dom/datastore/tests/mochitest.ini b/dom/datastore/tests/mochitest.ini
index fd3972597db..e1ca2818206 100644
--- a/dom/datastore/tests/mochitest.ini
+++ b/dom/datastore/tests/mochitest.ini
@@ -30,6 +30,7 @@ support-files =
   file_sync_common.js
   file_bug1008044.html
   file_bug957086.html
+  file_notify_system_message.html
 
 [test_app_install.html]
 [test_readonly.html]
@@ -50,3 +51,5 @@ support-files =
 [test_transactions.html]
 [test_bug1008044.html]
 [test_bug957086.html]
+[test_notify_system_message.html]
+skip-if = toolkit == 'gonk' # b2g
diff --git a/dom/datastore/tests/test_app_install.html b/dom/datastore/tests/test_app_install.html
index c03f249326d..8c326d33704 100644
--- a/dom/datastore/tests/test_app_install.html
+++ b/dom/datastore/tests/test_app_install.html
@@ -10,10 +10,6 @@
 <div id="container"></div>
   <script type="application/javascript;version=1.7">
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
 
   var gBaseURL = 'http://test/tests/dom/datastore/tests/';
@@ -26,8 +22,14 @@
      { "type": "webapps-manage", "allow": 1, "context": document }],
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, function() {
+
+        if (SpecialPowers.isMainProcess()) {
+          SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+        }
         gGenerator.next(); });
     });
 
diff --git a/dom/datastore/tests/test_arrays.html b/dom/datastore/tests/test_arrays.html
index a1d81a2f48b..513a6de28f6 100644
--- a/dom/datastore/tests/test_arrays.html
+++ b/dom/datastore/tests/test_arrays.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -116,10 +122,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_basic.html b/dom/datastore/tests/test_basic.html
index 25d6637ef50..c774b146c9f 100644
--- a/dom/datastore/tests/test_basic.html
+++ b/dom/datastore/tests/test_basic.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -116,10 +122,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_basic_worker.html b/dom/datastore/tests/test_basic_worker.html
index be940e8771b..70fadecd8fa 100644
--- a/dom/datastore/tests/test_basic_worker.html
+++ b/dom/datastore/tests/test_basic_worker.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -116,10 +122,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_bug1008044.html b/dom/datastore/tests/test_bug1008044.html
index 97164c396ca..c22131f2379 100644
--- a/dom/datastore/tests/test_bug1008044.html
+++ b/dom/datastore/tests/test_bug1008044.html
@@ -77,12 +77,18 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.ipc.browser_frames.oop_by_default", true],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -117,10 +123,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_bug924104.html b/dom/datastore/tests/test_bug924104.html
index 5b22acf11db..3896a108b30 100644
--- a/dom/datastore/tests/test_bug924104.html
+++ b/dom/datastore/tests/test_bug924104.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -116,10 +122,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_bug957086.html b/dom/datastore/tests/test_bug957086.html
index 1abb1f4c153..ac8f31ee09b 100644
--- a/dom/datastore/tests/test_bug957086.html
+++ b/dom/datastore/tests/test_bug957086.html
@@ -81,12 +81,18 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.ipc.browser_frames.oop_by_default", true],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -124,10 +130,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_bug976311.html b/dom/datastore/tests/test_bug976311.html
index 4922dd2db35..35f9aba480a 100644
--- a/dom/datastore/tests/test_bug976311.html
+++ b/dom/datastore/tests/test_bug976311.html
@@ -82,11 +82,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -124,10 +130,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_bug986056.html b/dom/datastore/tests/test_bug986056.html
index 2376f71483c..3d14cb666c5 100644
--- a/dom/datastore/tests/test_bug986056.html
+++ b/dom/datastore/tests/test_bug986056.html
@@ -75,12 +75,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
-    // Enabling mozBrowser
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.pushPrefEnv({"set": [["dom.mozBrowserFramesEnabled", true]]}, runTest);
     },
@@ -134,10 +139,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_certifiedApp.html b/dom/datastore/tests/test_certifiedApp.html
index 0b78ccbc814..e4a328c2d0d 100644
--- a/dom/datastore/tests/test_certifiedApp.html
+++ b/dom/datastore/tests/test_certifiedApp.html
@@ -77,6 +77,8 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", false]]}, runTest);
     },
@@ -89,6 +91,10 @@
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -123,10 +129,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_changes.html b/dom/datastore/tests/test_changes.html
index 434c4c0f4c7..c2a67b1addd 100644
--- a/dom/datastore/tests/test_changes.html
+++ b/dom/datastore/tests/test_changes.html
@@ -121,12 +121,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
-    // Enabling mozBrowser
     function() {
+   	  if (SpecialPowers.isMainProcess()) {
+   	    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+   	  }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.pushPrefEnv({"set": [["dom.mozBrowserFramesEnabled", true]]}, runTest);
     },
@@ -169,10 +174,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_duplicate.html b/dom/datastore/tests/test_duplicate.html
index e9ecca2ab9a..8589d440826 100644
--- a/dom/datastore/tests/test_duplicate.html
+++ b/dom/datastore/tests/test_duplicate.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -116,10 +122,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_keys.html b/dom/datastore/tests/test_keys.html
index dced0354ef3..9bc2ac2b88b 100644
--- a/dom/datastore/tests/test_keys.html
+++ b/dom/datastore/tests/test_keys.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -116,10 +122,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_notify_system_message.html b/dom/datastore/tests/test_notify_system_message.html
new file mode 100644
index 00000000000..dc32f79f5a5
--- /dev/null
+++ b/dom/datastore/tests/test_notify_system_message.html
@@ -0,0 +1,138 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Test for DataStore - notify updates with system messages</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<div id="container"></div>
+  <script type="application/javascript;version=1.7">
+
+  var gHostedManifestURL = 'http://test/tests/dom/datastore/tests/file_app.sjs?testToken=file_notify_system_message.html';
+  var gHostedPageURL = 'http://mochi.test:8888/tests/dom/datastore/tests/file_notify_system_message.html';
+  var gApp;
+
+  function cbError() {
+    ok(false, "Error callback invoked");
+    finish();
+  }
+
+  function installApp() {
+    var request = navigator.mozApps.install(gHostedManifestURL);
+    request.onerror = cbError;
+    request.onsuccess = function() {
+      gApp = request.result;
+      runTest();
+    }
+  }
+
+  function uninstallApp() {
+    // Uninstall the app.
+    var request = navigator.mozApps.mgmt.uninstall(gApp);
+    request.onerror = cbError;
+    request.onsuccess = function() {
+      // All done.
+      info("All done");
+      runTest();
+    }
+  }
+
+  function testApp() {
+    var ifr = document.createElement('iframe');
+    ifr.setAttribute('mozbrowser', 'true');
+    ifr.setAttribute('mozapp', gApp.manifestURL);
+    ifr.setAttribute('src', gApp.manifest.launch_path);
+    var domParent = document.getElementById('container');
+
+    // Set us up to listen for messages from the app.
+    var listener = function(e) {
+      var message = e.detail.message;
+      if (/^OK/.exec(message)) {
+        ok(true, "Message from app: " + message);
+      } else if (/KO/.exec(message)) {
+        ok(false, "Message from app: " + message);
+      } else if (/DONE/.exec(message)) {
+        ok(true, "Messaging from app complete");
+        ifr.removeEventListener('mozbrowsershowmodalprompt', listener);
+        domParent.removeChild(ifr);
+        runTest();
+      }
+    }
+
+    // This event is triggered when the app calls "alert".
+    ifr.addEventListener('mozbrowsershowmodalprompt', listener, false);
+    domParent.appendChild(ifr);
+  }
+
+  var tests = [
+    // Permissions.
+    function() {
+      SpecialPowers.pushPermissions(
+        [{ "type": "browser", "allow": 1, "context": document },
+         { "type": "embed-apps", "allow": 1, "context": document },
+         { "type": "webapps-manage", "allow": 1, "context": document }], runTest);
+    },
+
+    // Preferences.
+    function() {
+      SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
+                                         ["dom.sysmsg.enabled", true],
+                                         ["dom.testing.ignore_ipc_principal", true],
+                                         ["dom.testing.datastore_enabled_for_hosted_apps", true],
+                                         ["dom.mozBrowserFramesEnabled", true]]}, runTest);
+    },
+
+    function() {
+      SpecialPowers.setAllAppsLaunchable(true);
+      // No confirmation needed when an app is installed.
+      SpecialPowers.autoConfirmAppInstall(runTest);
+    },
+
+    function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+        SpecialPowers.Cu.import("resource://gre/modules/Services.jsm");
+        var ioService = SpecialPowers.Cc["@mozilla.org/network/io-service;1"]
+                                     .getService(SpecialPowers.Ci.nsIIOService);
+        var systemMessenger = SpecialPowers.Cc["@mozilla.org/system-message-internal;1"]
+                              .getService(SpecialPowers.Ci.nsISystemMessagesInternal);
+        systemMessenger.registerPage("datastore-update-foo",
+                                     ioService.newURI(gHostedPageURL, null, null),
+                                     ioService.newURI(gHostedManifestURL, null, null));
+      }
+      runTest();
+    },
+
+    // Installing the app.
+    installApp,
+
+    // Run tests in app.
+    testApp,
+
+    // Uninstall the app.
+    uninstallApp
+  ];
+
+  function runTest() {
+    if (!tests.length) {
+      finish();
+      return;
+    }
+
+    var test = tests.shift();
+    test();
+  }
+
+  function finish() {
+    SimpleTest.finish();
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  runTest();
+  </script>
+</body>
+</html>
diff --git a/dom/datastore/tests/test_oop.html b/dom/datastore/tests/test_oop.html
index 989904341e6..e275b2d1b3d 100644
--- a/dom/datastore/tests/test_oop.html
+++ b/dom/datastore/tests/test_oop.html
@@ -77,12 +77,18 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.ipc.browser_frames.oop_by_default", true],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -117,10 +123,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_oop_events.html b/dom/datastore/tests/test_oop_events.html
index d97d674c8a9..c57f93de657 100644
--- a/dom/datastore/tests/test_oop_events.html
+++ b/dom/datastore/tests/test_oop_events.html
@@ -105,12 +105,18 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.ipc.browser_frames.oop_by_default", true],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -147,10 +153,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_readonly.html b/dom/datastore/tests/test_readonly.html
index 559b8d0f3eb..52541cd2618 100644
--- a/dom/datastore/tests/test_readonly.html
+++ b/dom/datastore/tests/test_readonly.html
@@ -30,6 +30,10 @@
   }
 
   function runTest() {
+    if (SpecialPowers.isMainProcess()) {
+      SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+    }
+
     SpecialPowers.setAllAppsLaunchable(true);
     SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
 
@@ -95,12 +99,10 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                     ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                     ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                      ["dom.testing.ignore_ipc_principal", true],
                                      ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
   </script>
diff --git a/dom/datastore/tests/test_sync.html b/dom/datastore/tests/test_sync.html
index b45472c88ba..15ab46c910c 100644
--- a/dom/datastore/tests/test_sync.html
+++ b/dom/datastore/tests/test_sync.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
     },
@@ -115,10 +121,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_sync_worker.html b/dom/datastore/tests/test_sync_worker.html
index 904edea96e8..4e1d5d0507f 100644
--- a/dom/datastore/tests/test_sync_worker.html
+++ b/dom/datastore/tests/test_sync_worker.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
     },
@@ -115,10 +121,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/datastore/tests/test_transactions.html b/dom/datastore/tests/test_transactions.html
index 7607b11fa5c..26d974aa1cb 100644
--- a/dom/datastore/tests/test_transactions.html
+++ b/dom/datastore/tests/test_transactions.html
@@ -77,11 +77,17 @@
     // Preferences
     function() {
       SpecialPowers.pushPrefEnv({"set": [["dom.datastore.enabled", true],
+                                         ["dom.datastore.sysMsgOnChangeShortTimeoutSec", 1],
+                                         ["dom.datastore.sysMsgOnChangeLongTimeoutSec", 3],
                                          ["dom.testing.ignore_ipc_principal", true],
                                          ["dom.testing.datastore_enabled_for_hosted_apps", true]]}, runTest);
     },
 
     function() {
+      if (SpecialPowers.isMainProcess()) {
+        SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
+      }
+
       SpecialPowers.setAllAppsLaunchable(true);
       SpecialPowers.setBoolPref("dom.mozBrowserFramesEnabled", true);
       runTest();
@@ -116,10 +122,6 @@
     SimpleTest.finish();
   }
 
-  if (SpecialPowers.isMainProcess()) {
-    SpecialPowers.Cu.import("resource://gre/modules/DataStoreChangeNotifier.jsm");
-  }
-
   SimpleTest.waitForExplicitFinish();
   runTest();
   </script>
diff --git a/dom/events/DOMEventTargetHelper.h b/dom/events/DOMEventTargetHelper.h
index 42fbfa28685..5995dd306f1 100644
--- a/dom/events/DOMEventTargetHelper.h
+++ b/dom/events/DOMEventTargetHelper.h
@@ -36,7 +36,7 @@ public:
     , mHasOrHasHadOwnerWindow(false)
   {
   }
-  DOMEventTargetHelper(nsPIDOMWindow* aWindow)
+  explicit DOMEventTargetHelper(nsPIDOMWindow* aWindow)
     : mParentObject(nullptr)
     , mOwnerWindow(nullptr)
     , mHasOrHasHadOwnerWindow(false)
@@ -45,7 +45,7 @@ public:
     // All objects coming through here are WebIDL objects
     SetIsDOMBinding();
   }
-  DOMEventTargetHelper(DOMEventTargetHelper* aOther)
+  explicit DOMEventTargetHelper(DOMEventTargetHelper* aOther)
     : mParentObject(nullptr)
     , mOwnerWindow(nullptr)
     , mHasOrHasHadOwnerWindow(false)
diff --git a/dom/events/Event.h b/dom/events/Event.h
index 1736f96eedf..5eefc5c72b6 100644
--- a/dom/events/Event.h
+++ b/dom/events/Event.h
@@ -44,7 +44,7 @@ public:
   Event(EventTarget* aOwner,
         nsPresContext* aPresContext,
         WidgetEvent* aEvent);
-  Event(nsPIDOMWindow* aWindow);
+  explicit Event(nsPIDOMWindow* aWindow);
 
 protected:
   virtual ~Event();
diff --git a/dom/events/EventDispatcher.h b/dom/events/EventDispatcher.h
index c886481a2d7..546961f6c0e 100644
--- a/dom/events/EventDispatcher.h
+++ b/dom/events/EventDispatcher.h
@@ -198,7 +198,7 @@ public:
 class EventChainPostVisitor : public mozilla::EventChainVisitor
 {
 public:
-  EventChainPostVisitor(EventChainVisitor& aOther)
+  explicit EventChainPostVisitor(EventChainVisitor& aOther)
     : EventChainVisitor(aOther.mPresContext, aOther.mEvent,
                         aOther.mDOMEvent, aOther.mEventStatus)
   {
diff --git a/dom/events/EventListenerManager.h b/dom/events/EventListenerManager.h
index 4f7ec1571f1..369e544c8c0 100644
--- a/dom/events/EventListenerManager.h
+++ b/dom/events/EventListenerManager.h
@@ -211,7 +211,7 @@ public:
     }
   };
 
-  EventListenerManager(dom::EventTarget* aTarget);
+  explicit EventListenerManager(dom::EventTarget* aTarget);
 
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(EventListenerManager)
 
diff --git a/dom/events/EventStateManager.cpp b/dom/events/EventStateManager.cpp
index 09b905a6a83..21b156943c4 100644
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -1444,10 +1444,10 @@ EventStateManager::FireContextClick()
         nsRefPtr<nsFrameSelection> frameSel =
           mCurrentTarget->GetFrameSelection();
         
-        if (frameSel && frameSel->GetMouseDownState()) {
+        if (frameSel && frameSel->GetDragState()) {
           // note that this can cause selection changed events to fire if we're in
           // a text field, which will null out mCurrentTarget
-          frameSel->SetMouseDownState(false);
+          frameSel->SetDragState(false);
         }
       }
 
@@ -1566,7 +1566,7 @@ EventStateManager::GenerateDragGesture(nsPresContext* aPresContext,
     if (mCurrentTarget)
     {
       nsRefPtr<nsFrameSelection> frameSel = mCurrentTarget->GetFrameSelection();
-      if (frameSel && frameSel->GetMouseDownState()) {
+      if (frameSel && frameSel->GetDragState()) {
         StopTrackingDragGesture();
         return;
       }
@@ -2908,7 +2908,7 @@ EventStateManager::PostHandleEvent(nsPresContext* aPresContext,
       nsIPresShell *shell = presContext->GetPresShell();
       if (shell) {
         nsRefPtr<nsFrameSelection> frameSelection = shell->FrameSelection();
-        frameSelection->SetMouseDownState(false);
+        frameSelection->SetDragState(false);
       }
     }
     break;
diff --git a/dom/events/JSEventHandler.h b/dom/events/JSEventHandler.h
index 2b6a8b4b216..6a25e401aaa 100644
--- a/dom/events/JSEventHandler.h
+++ b/dom/events/JSEventHandler.h
@@ -35,17 +35,17 @@ public:
   {
   }
 
-  TypedEventHandler(dom::EventHandlerNonNull* aHandler)
+  explicit TypedEventHandler(dom::EventHandlerNonNull* aHandler)
   {
     Assign(aHandler, eNormal);
   }
 
-  TypedEventHandler(dom::OnErrorEventHandlerNonNull* aHandler)
+  explicit TypedEventHandler(dom::OnErrorEventHandlerNonNull* aHandler)
   {
     Assign(aHandler, eOnError);
   }
 
-  TypedEventHandler(dom::OnBeforeUnloadEventHandlerNonNull* aHandler)
+  explicit TypedEventHandler(dom::OnBeforeUnloadEventHandlerNonNull* aHandler)
   {
     Assign(aHandler, eOnBeforeUnload);
   }
diff --git a/dom/events/StorageEvent.h b/dom/events/StorageEvent.h
index 26518f95252..447c3c24506 100644
--- a/dom/events/StorageEvent.h
+++ b/dom/events/StorageEvent.h
@@ -28,7 +28,7 @@ public:
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(StorageEvent, Event)
 
-  StorageEvent(EventTarget* aOwner);
+  explicit StorageEvent(EventTarget* aOwner);
 
 protected:
   virtual ~StorageEvent();
diff --git a/dom/indexedDB/FileInfo.h b/dom/indexedDB/FileInfo.h
index 51512e01ce2..9272bd16d7c 100644
--- a/dom/indexedDB/FileInfo.h
+++ b/dom/indexedDB/FileInfo.h
@@ -19,7 +19,7 @@ class FileInfo
   friend class FileManager;
 
 public:
-  FileInfo(FileManager* aFileManager)
+  explicit FileInfo(FileManager* aFileManager)
   : mFileManager(aFileManager)
   { }
 
diff --git a/dom/indexedDB/IDBRequest.h b/dom/indexedDB/IDBRequest.h
index 8aef8070000..d628b5a7998 100644
--- a/dom/indexedDB/IDBRequest.h
+++ b/dom/indexedDB/IDBRequest.h
@@ -153,8 +153,8 @@ public:
   IMPL_EVENT_HANDLER(error);
 
 protected:
-  IDBRequest(IDBDatabase* aDatabase);
-  IDBRequest(nsPIDOMWindow* aOwner);
+  explicit IDBRequest(IDBDatabase* aDatabase);
+  explicit IDBRequest(nsPIDOMWindow* aOwner);
   ~IDBRequest();
 
   // At most one of these three fields can be non-null.
@@ -221,7 +221,7 @@ public:
   IMPL_EVENT_HANDLER(upgradeneeded);
 
 protected:
-  IDBOpenDBRequest(nsPIDOMWindow* aOwner);
+  explicit IDBOpenDBRequest(nsPIDOMWindow* aOwner);
   ~IDBOpenDBRequest();
 
   // Only touched on the main thread.
diff --git a/dom/indexedDB/IDBWrapperCache.h b/dom/indexedDB/IDBWrapperCache.h
index 61bb224d710..129cc0b3129 100644
--- a/dom/indexedDB/IDBWrapperCache.h
+++ b/dom/indexedDB/IDBWrapperCache.h
@@ -35,10 +35,10 @@ public:
 #endif
 
 protected:
-  IDBWrapperCache(DOMEventTargetHelper* aOwner)
+  explicit IDBWrapperCache(DOMEventTargetHelper* aOwner)
     : DOMEventTargetHelper(aOwner), mScriptOwner(nullptr)
   { }
-  IDBWrapperCache(nsPIDOMWindow* aOwner)
+  explicit IDBWrapperCache(nsPIDOMWindow* aOwner)
     : DOMEventTargetHelper(aOwner), mScriptOwner(nullptr)
   { }
 
diff --git a/dom/ipc/ContentBridgeParent.h b/dom/ipc/ContentBridgeParent.h
index 85fc9277049..13fd8d9b92e 100644
--- a/dom/ipc/ContentBridgeParent.h
+++ b/dom/ipc/ContentBridgeParent.h
@@ -17,7 +17,7 @@ class ContentBridgeParent : public PContentBridgeParent
                           , public nsIContentParent
 {
 public:
-  ContentBridgeParent(Transport* aTransport);
+  explicit ContentBridgeParent(Transport* aTransport);
 
   NS_DECL_ISUPPORTS
 
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 5f2bfcd9fea..96c08893e19 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -3526,7 +3526,7 @@ ContentParent::DoSendAsyncMessage(JSContext* aCx,
     if (aCpows && !GetCPOWManager()->Wrap(aCx, aCpows, &cpows)) {
         return false;
     }
-    return SendAsyncMessage(nsString(aMessage), data, cpows, aPrincipal);
+    return SendAsyncMessage(nsString(aMessage), data, cpows, Principal(aPrincipal));
 }
 
 bool
diff --git a/dom/ipc/PermissionMessageUtils.h b/dom/ipc/PermissionMessageUtils.h
index 16f7c7192ff..af81165f9ec 100644
--- a/dom/ipc/PermissionMessageUtils.h
+++ b/dom/ipc/PermissionMessageUtils.h
@@ -17,7 +17,7 @@ class Principal {
 
 public:
   Principal() : mPrincipal(nullptr) {}
-  Principal(nsIPrincipal* aPrincipal) : mPrincipal(aPrincipal) {}
+  explicit Principal(nsIPrincipal* aPrincipal) : mPrincipal(aPrincipal) {}
   operator nsIPrincipal*() const { return mPrincipal.get(); }
 
 private:
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 3628698e8d0..0837e97db51 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -2783,11 +2783,11 @@ TabChild::DoSendBlockingMessage(JSContext* aCx,
   }
   if (aIsSync) {
     return SendSyncMessage(PromiseFlatString(aMessage), data, cpows,
-                           aPrincipal, aJSONRetVal);
+                           Principal(aPrincipal), aJSONRetVal);
   }
 
   return CallRpcMessage(PromiseFlatString(aMessage), data, cpows,
-                        aPrincipal, aJSONRetVal);
+                        Principal(aPrincipal), aJSONRetVal);
 }
 
 bool
@@ -2808,7 +2808,7 @@ TabChild::DoSendAsyncMessage(JSContext* aCx,
     }
   }
   return SendAsyncMessage(PromiseFlatString(aMessage), data, cpows,
-                          aPrincipal);
+                          Principal(aPrincipal));
 }
 
 TabChild*
diff --git a/dom/ipc/TabChild.h b/dom/ipc/TabChild.h
index 8559ee9fea0..b0c01785fd7 100644
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -62,7 +62,7 @@ class TabChildGlobal : public DOMEventTargetHelper,
                        public nsIGlobalObject
 {
 public:
-  TabChildGlobal(TabChildBase* aTabChild);
+  explicit TabChildGlobal(TabChildBase* aTabChild);
   void Init();
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(TabChildGlobal, DOMEventTargetHelper)
@@ -147,7 +147,7 @@ protected:
 class ContentListener MOZ_FINAL : public nsIDOMEventListener
 {
 public:
-  ContentListener(TabChild* aTabChild) : mTabChild(aTabChild) {}
+  explicit ContentListener(TabChild* aTabChild) : mTabChild(aTabChild) {}
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMEVENTLISTENER
 protected:
diff --git a/dom/ipc/TabContext.h b/dom/ipc/TabContext.h
index 1da69c8fe1d..309e34c252d 100644
--- a/dom/ipc/TabContext.h
+++ b/dom/ipc/TabContext.h
@@ -254,7 +254,7 @@ public:
    * This constructor copies the information in aContext and sets IsValid() as
    * appropriate.
    */
-  MaybeInvalidTabContext(const IPCTabContext& aContext);
+  explicit MaybeInvalidTabContext(const IPCTabContext& aContext);
 
   /**
    * Was the IPCTabContext we received in our constructor valid?
diff --git a/dom/media/tests/crashtests/crashtests.list b/dom/media/tests/crashtests/crashtests.list
index 2acec66506e..e967583d3c4 100644
--- a/dom/media/tests/crashtests/crashtests.list
+++ b/dom/media/tests/crashtests/crashtests.list
@@ -3,14 +3,14 @@ default-preferences  pref(media.peerconnection.enabled,true) pref(media.navigato
 load 780790.html
 load 791270.html
 load 791278.html
-load 791330.html
+skip-if(Android||B2G) load 791330.html # bug 909925
 load 799419.html
 load 802982.html
 load 812785.html
 load 834100.html
 load 836349.html
 load 837324.html
-load 855796.html
+skip-if(Android||B2G) load 855796.html # bug 909925
 load 860143.html
 load 861958.html
-load 863929.html
+skip-if(Android||B2G) load 863929.html # bug 909925
diff --git a/dom/messages/SystemMessageInternal.js b/dom/messages/SystemMessageInternal.js
index 72708689626..74e24e38129 100644
--- a/dom/messages/SystemMessageInternal.js
+++ b/dom/messages/SystemMessageInternal.js
@@ -192,31 +192,48 @@ SystemMessageInternal.prototype = {
     // clean it up from the pending message queue when apps receive it.
     let messageID = gUUIDGenerator.generateUUID().toString();
 
-    debug("Sending " + aType + " " + JSON.stringify(aMessage) +
-      " for " + aPageURI.spec + " @ " + aManifestURI.spec +
-      '; extra: ' + JSON.stringify(aExtra));
-
-    let result = this._sendMessageCommon(aType,
-                                         aMessage,
-                                         messageID,
-                                         aPageURI.spec,
-                                         aManifestURI.spec,
-                                         aExtra);
-    debug("Returned status of sending message: " + result);
-
-    // Don't need to open the pages and queue the system message
-    // which was not allowed to be sent.
-    if (result === MSG_SENT_FAILURE_PERM_DENIED) {
-      return;
+    let manifestURL = aManifestURI.spec;
+    let pageURLs = [];
+    if (aPageURI) {
+      pageURLs.push(aPageURI.spec);
+    } else {
+      // Send this message to all the registered pages of the app if |aPageURI|
+      // is not specified.
+      for (let i = 0; i < this._pages.length; i++) {
+        let page = this._pages[i];
+        if (page.type === aType && page.manifestURL === manifestURL) {
+          pageURLs.push(page.pageURL);
+        }
+      }
     }
 
-    let page = this._findPage(aType, aPageURI.spec, aManifestURI.spec);
-    if (page) {
-      // Queue this message in the corresponding pages.
-      this._queueMessage(page, aMessage, messageID);
+    pageURLs.forEach(function(aPageURL) {
+      debug("Sending " + aType + " " + JSON.stringify(aMessage) +
+        " for " + aPageURL + " @ " + manifestURL +
+        '; extra: ' + JSON.stringify(aExtra));
 
-      this._openAppPage(page, aMessage, aExtra, result);
-    }
+      let result = this._sendMessageCommon(aType,
+                                           aMessage,
+                                           messageID,
+                                           aPageURL,
+                                           manifestURL,
+                                           aExtra);
+      debug("Returned status of sending message: " + result);
+
+      // Don't need to open the pages and queue the system message
+      // which was not allowed to be sent.
+      if (result === MSG_SENT_FAILURE_PERM_DENIED) {
+        return;
+      }
+
+      let page = this._findPage(aType, aPageURL, manifestURL);
+      if (page) {
+        // Queue this message in the corresponding pages.
+        this._queueMessage(page, aMessage, messageID);
+
+        this._openAppPage(page, aMessage, aExtra, result);
+      }
+    }, this);
   },
 
   broadcastMessage: function(aType, aMessage, aExtra) {
diff --git a/dom/messages/SystemMessagePermissionsChecker.jsm b/dom/messages/SystemMessagePermissionsChecker.jsm
index 433c8759875..89bcf675734 100644
--- a/dom/messages/SystemMessagePermissionsChecker.jsm
+++ b/dom/messages/SystemMessagePermissionsChecker.jsm
@@ -15,7 +15,8 @@ Cu.import("resource://gre/modules/PermissionsTable.jsm");
 Cu.import("resource://gre/modules/PermissionSettings.jsm");
 
 this.EXPORTED_SYMBOLS = ["SystemMessagePermissionsChecker",
-                         "SystemMessagePermissionsTable"];
+                         "SystemMessagePermissionsTable",
+                         "SystemMessagePrefixPermissionsTable"];
 
 function debug(aStr) {
   // dump("SystemMessagePermissionsChecker.jsm: " + aStr + "\n");
@@ -122,6 +123,18 @@ this.SystemMessagePermissionsTable = {
   }
 };
 
+// This table maps system message prefix to permission(s), indicating only
+// the system messages with specified prefixes granted by the page's permissions
+// are allowed to be registered or sent to that page. Note the empty permission
+// set means this type of system message is always permitted.
+//
+// Note that this table is only used when the permission checker can't find a
+// match in SystemMessagePermissionsTable listed above.
+
+this.SystemMessagePrefixPermissionsTable = {
+  "datastore-update-": { },
+};
+
 this.SystemMessagePermissionsChecker = {
   /**
    * Return all the needed permission names for the given system message.
@@ -140,16 +153,26 @@ this.SystemMessagePermissionsChecker = {
 
     let permNames = SystemMessagePermissionsTable[aSysMsgName];
     if (permNames === undefined) {
-      debug("'" + aSysMsgName + "' is not associated with permissions. " +
-            "Please add them to the SystemMessagePermissionsTable.");
-      return null;
+      // Try to look up in the prefix table.
+      for (let sysMsgPrefix in SystemMessagePrefixPermissionsTable) {
+        if (aSysMsgName.indexOf(sysMsgPrefix) === 0) {
+          permNames = SystemMessagePrefixPermissionsTable[sysMsgPrefix];
+          break;
+        }
+      }
+
+      if (permNames === undefined) {
+        debug("'" + aSysMsgName + "' is not associated with permissions. " +
+              "Please add them to the SystemMessage[Prefix]PermissionsTable.");
+        return null;
+      }
     }
 
     let object = { };
     for (let permName in permNames) {
       if (PermissionsTable[permName] === undefined) {
         debug("'" + permName + "' for '" + aSysMsgName + "' is invalid. " +
-              "Please correct it in the SystemMessagePermissionsTable.");
+              "Please correct it in the SystemMessage[Prefix]PermissionsTable.");
         return null;
       }
 
@@ -157,7 +180,7 @@ this.SystemMessagePermissionsChecker = {
       let access = permNames[permName];
       if (!access || !Array.isArray(access)) {
         debug("'" + permName + "' is not associated with access array. " +
-              "Please correct it in the SystemMessagePermissionsTable.");
+              "Please correct it in the SystemMessage[Prefix]PermissionsTable.");
         return null;
       }
       object[permName] = appendAccessToPermName(permName, access);
diff --git a/dom/messages/interfaces/nsISystemMessagesInternal.idl b/dom/messages/interfaces/nsISystemMessagesInternal.idl
index 8df78278f07..450206b2ba5 100644
--- a/dom/messages/interfaces/nsISystemMessagesInternal.idl
+++ b/dom/messages/interfaces/nsISystemMessagesInternal.idl
@@ -13,10 +13,12 @@ interface nsIDOMWindow;
 interface nsISystemMessagesInternal : nsISupports
 {
   /*
-   * Allow any internal user to broadcast a message of a given type.
+   * Allow any internal user to send a message of a given type to a given page
+   * of an app. The message will be sent to all the registered pages of the app
+   * when |pageURI| is not specified.
    * @param type        The type of the message to be sent.
    * @param message     The message payload.
-   * @param pageURI     The URI of the page that will be opened.
+   * @param pageURI     The URI of the page that will be opened. Nullable.
    * @param manifestURI The webapp's manifest URI.
    * @param extra       Extra opaque information that will be passed around in the observer
    *                    notification to open the page.
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index c2837b800c3..cb105212681 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -1833,7 +1833,7 @@ nsEventStatus nsPluginInstanceOwner::ProcessEvent(const WidgetGUIEvent& anEvent)
         // Ignore mouse-moved events that happen as part of a dragging
         // operation that started over another frame.  See bug 525078.
         nsRefPtr<nsFrameSelection> frameselection = mObjectFrame->GetFrameSelection();
-        if (!frameselection->GetMouseDownState() ||
+        if (!frameselection->GetDragState() ||
           (nsIPresShell::GetCapturingContent() == mObjectFrame->GetContent())) {
           synthCocoaEvent.type = NPCocoaEventMouseMoved;
           synthCocoaEvent.data.mouse.pluginX = static_cast<double>(ptPx.x);
diff --git a/dom/tests/mochitest/bugs/iframe_bug440572.html b/dom/tests/mochitest/bugs/iframe_bug440572.html
index 8a2fdce05bd..c8d9f8fe296 100644
--- a/dom/tests/mochitest/bugs/iframe_bug440572.html
+++ b/dom/tests/mochitest/bugs/iframe_bug440572.html
@@ -6,11 +6,11 @@ var success = 0;
 
 try {
   parent[name].success = 1;
+  parent.postMessage(success ? "success" : "failure", "http://mochi.test:8888");
 } catch (e) {
-  parent.postMessage(e, "http://mochi.test:8888");
+  parent.postMessage(e.toString(), "http://mochi.test:8888");
 }
 
-parent.postMessage(success ? "success" : "failure", "http://mochi.test:8888");
 </script>
 <p>Move on, nothing to see here...</p>
 </body>
diff --git a/dom/tests/mochitest/bugs/test_bug440572.html b/dom/tests/mochitest/bugs/test_bug440572.html
index db6e4a8f373..a86f141374a 100644
--- a/dom/tests/mochitest/bugs/test_bug440572.html
+++ b/dom/tests/mochitest/bugs/test_bug440572.html
@@ -27,9 +27,10 @@ window.addEventListener("message", receiveMessage, false);
 
 function runtests()
 {
-  for (i in messages) {
-    is(messages[i], "success", "test in frame failed.");
-  }
+  is(messages.length, 3, "received the right number of messages.");
+  is(messages[0], "success", "test in frame failed.");
+  isnot(messages[1], "success", "parent[\"content\"] should be the WebIDL property of Window.");
+  isnot(messages[2], "success", "parent[\"dump\"] should be the WebIDL property of Window.");
 
   SimpleTest.finish();
 }
diff --git a/dom/webidl/Node.webidl b/dom/webidl/Node.webidl
index d30053bc706..5025460a304 100644
--- a/dom/webidl/Node.webidl
+++ b/dom/webidl/Node.webidl
@@ -56,7 +56,7 @@ interface Node : EventTarget {
 
   [SetterThrows, Pure]
            attribute DOMString? nodeValue;
-  [SetterThrows, Pure]
+  [Throws, Pure]
            attribute DOMString? textContent;
   [Throws]
   Node insertBefore(Node node, Node? child);
diff --git a/dom/xbl/nsBindingManager.h b/dom/xbl/nsBindingManager.h
index 1dd5855d234..5e23fc223f1 100644
--- a/dom/xbl/nsBindingManager.h
+++ b/dom/xbl/nsBindingManager.h
@@ -47,7 +47,7 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
-  nsBindingManager(nsIDocument* aDocument);
+  explicit nsBindingManager(nsIDocument* aDocument);
 
   nsXBLBinding* GetBindingWithContent(nsIContent* aContent);
 
diff --git a/dom/xbl/nsXBLBinding.h b/dom/xbl/nsXBLBinding.h
index fe216102353..238575cb64a 100644
--- a/dom/xbl/nsXBLBinding.h
+++ b/dom/xbl/nsXBLBinding.h
@@ -40,7 +40,7 @@ class nsAnonymousContentList;
 class nsXBLBinding MOZ_FINAL
 {
 public:
-  nsXBLBinding(nsXBLPrototypeBinding* aProtoBinding);
+  explicit nsXBLBinding(nsXBLPrototypeBinding* aProtoBinding);
   nsXBLBinding(mozilla::dom::ShadowRoot* aShadowRoot, nsXBLPrototypeBinding* aProtoBinding);
 
   /**
diff --git a/intl/unicharutil/nsSaveAsCharset.cpp b/intl/unicharutil/nsSaveAsCharset.cpp
index d3dc9ab3ddd..b8916a89106 100644
--- a/intl/unicharutil/nsSaveAsCharset.cpp
+++ b/intl/unicharutil/nsSaveAsCharset.cpp
@@ -356,7 +356,7 @@ nsresult nsSaveAsCharset::SetupCharsetList(const char *charsetList)
     mCharsetListIndex = -1;
   }
 
-  nsCWhitespaceTokenizer tokenizer = nsDependentCString(charsetList);
+  nsCWhitespaceTokenizer tokenizer((nsDependentCString(charsetList)));
   while (tokenizer.hasMoreTokens()) {
     ParseString(tokenizer.nextToken(), ',', mCharsetList);
   }
diff --git a/ipc/glue/GeckoChildProcessHost.h b/ipc/glue/GeckoChildProcessHost.h
index 0ee598a5055..885ea411875 100644
--- a/ipc/glue/GeckoChildProcessHost.h
+++ b/ipc/glue/GeckoChildProcessHost.h
@@ -41,8 +41,8 @@ public:
 
   static ChildPrivileges DefaultChildPrivileges();
 
-  GeckoChildProcessHost(GeckoProcessType aProcessType,
-                        ChildPrivileges aPrivileges=base::PRIVILEGES_DEFAULT);
+  explicit GeckoChildProcessHost(GeckoProcessType aProcessType,
+                                 ChildPrivileges aPrivileges=base::PRIVILEGES_DEFAULT);
 
   ~GeckoChildProcessHost();
 
diff --git a/ipc/glue/MessageChannel.h b/ipc/glue/MessageChannel.h
index e93ead05ac9..dd771406d0e 100644
--- a/ipc/glue/MessageChannel.h
+++ b/ipc/glue/MessageChannel.h
@@ -57,7 +57,7 @@ class MessageChannel : HasResultCodes
     typedef IPC::Message Message;
     typedef mozilla::ipc::Transport Transport;
 
-    MessageChannel(MessageListener *aListener);
+    explicit MessageChannel(MessageListener *aListener);
     ~MessageChannel();
 
     // "Open" from the perspective of the transport layer; the underlying
@@ -381,7 +381,7 @@ class MessageChannel : HasResultCodes
     class RefCountedTask
     {
       public:
-        RefCountedTask(CancelableTask* aTask)
+        explicit RefCountedTask(CancelableTask* aTask)
           : mTask(aTask)
         { }
       private:
@@ -401,7 +401,7 @@ class MessageChannel : HasResultCodes
     class DequeueTask : public Task
     {
       public:
-        DequeueTask(RefCountedTask* aTask)
+        explicit DequeueTask(RefCountedTask* aTask)
           : mTask(aTask)
         { }
         void Run() { mTask->Run(); }
@@ -441,7 +441,7 @@ class MessageChannel : HasResultCodes
 
     class AutoEnterPendingReply {
       public:
-        AutoEnterPendingReply(size_t &replyVar)
+        explicit AutoEnterPendingReply(size_t &replyVar)
           : mReplyVar(replyVar)
         {
             mReplyVar++;
@@ -487,7 +487,7 @@ class MessageChannel : HasResultCodes
     class AutoEnterRPCTransaction
     {
       public:
-       AutoEnterRPCTransaction(MessageChannel *aChan)
+       explicit AutoEnterRPCTransaction(MessageChannel *aChan)
         : mChan(aChan),
           mOldTransaction(mChan->mCurrentRPCTransaction)
        {
diff --git a/js/src/jit/arm/Assembler-arm.cpp b/js/src/jit/arm/Assembler-arm.cpp
index 75f54835065..220486b56ee 100644
--- a/js/src/jit/arm/Assembler-arm.cpp
+++ b/js/src/jit/arm/Assembler-arm.cpp
@@ -560,20 +560,20 @@ Assembler::finish()
     isFinished = true;
 
     for (unsigned int i = 0; i < tmpDataRelocations_.length(); i++) {
-        int offset = tmpDataRelocations_[i].getOffset();
-        int real_offset = offset + m_buffer.poolSizeBefore(offset);
+        size_t offset = tmpDataRelocations_[i].getOffset();
+        size_t real_offset = offset + m_buffer.poolSizeBefore(offset);
         dataRelocations_.writeUnsigned(real_offset);
     }
 
     for (unsigned int i = 0; i < tmpJumpRelocations_.length(); i++) {
-        int offset = tmpJumpRelocations_[i].getOffset();
-        int real_offset = offset + m_buffer.poolSizeBefore(offset);
+        size_t offset = tmpJumpRelocations_[i].getOffset();
+        size_t real_offset = offset + m_buffer.poolSizeBefore(offset);
         jumpRelocations_.writeUnsigned(real_offset);
     }
 
     for (unsigned int i = 0; i < tmpPreBarriers_.length(); i++) {
-        int offset = tmpPreBarriers_[i].getOffset();
-        int real_offset = offset + m_buffer.poolSizeBefore(offset);
+        size_t offset = tmpPreBarriers_[i].getOffset();
+        size_t real_offset = offset + m_buffer.poolSizeBefore(offset);
         preBarriers_.writeUnsigned(real_offset);
     }
 }
diff --git a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
index 52fce480716..6ce4bc8ab36 100644
--- a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
+++ b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
@@ -727,7 +727,7 @@ struct AssemblerBufferWithConstantPools : public AssemblerBuffer<SliceSize, Inst
         canNotPlacePoolMaxInst_ = maxInst;
 #endif
 
-        canNotPlacePool_++;
+        canNotPlacePool_ = true;
     }
 
     void leaveNoPool() {
@@ -738,7 +738,7 @@ struct AssemblerBufferWithConstantPools : public AssemblerBuffer<SliceSize, Inst
         MOZ_ASSERT(this->nextOffset().getOffset() - canNotPlacePoolStartOffset_ <= canNotPlacePoolMaxInst_ * InstSize);
     }
 
-    ptrdiff_t poolSizeBefore(ptrdiff_t offset) const {
+    size_t poolSizeBefore(size_t offset) const {
         // Linear search of the poolInfo to find the pool before the given
         // buffer offset, and then return the cumulative size of the pools
         // before this offset. This is used to convert a buffer offset to its
@@ -783,13 +783,13 @@ struct AssemblerBufferWithConstantPools : public AssemblerBuffer<SliceSize, Inst
     }
 
   private:
-    void patchBranch(Inst *i, int curpool, BufferOffset branch) {
+    void patchBranch(Inst *i, unsigned curpool, BufferOffset branch) {
         const Inst *ci = i;
         ptrdiff_t offset = Asm::GetBranchOffset(ci);
         // If the offset is 0, then there is nothing to do.
         if (offset == 0)
             return;
-        int destOffset = branch.getOffset() + offset;
+        unsigned destOffset = branch.getOffset() + offset;
         if (offset > 0) {
             while (curpool < numDumps_ && poolInfo_[curpool].offset <= destOffset) {
                 offset += poolInfo_[curpool].size;
@@ -798,13 +798,8 @@ struct AssemblerBufferWithConstantPools : public AssemblerBuffer<SliceSize, Inst
         } else {
             // Ignore the pool that comes next, since this is a backwards
             // branch.
-            curpool--;
-            while (curpool >= 0 && poolInfo_[curpool].offset > destOffset) {
-                offset -= poolInfo_[curpool].size;
-                curpool--;
-            }
-            // Can't assert anything here, since the first pool may be after the
-            // target.
+            for (int p = curpool - 1; p >= 0 && poolInfo_[p].offset > destOffset; p--)
+                offset -= poolInfo_[p].size;
         }
         Asm::RetargetNearBranch(i, offset, false);
     }
diff --git a/layout/base/SelectionCarets.cpp b/layout/base/SelectionCarets.cpp
index badbfb87d6a..10d61f96a39 100644
--- a/layout/base/SelectionCarets.cpp
+++ b/layout/base/SelectionCarets.cpp
@@ -150,13 +150,13 @@ SelectionCarets::HandleEvent(WidgetEvent* aEvent)
       mDragMode = START_FRAME;
       mCaretCenterToDownPointOffsetY = GetCaretYCenterPosition() - ptInCanvas.y;
       SetSelectionDirection(false);
-      SetMouseDownState(true);
+      SetSelectionDragState(true);
       return nsEventStatus_eConsumeNoDefault;
     } else if (mVisible && IsOnRect(GetEndFrameRect(), ptInCanvas, inflateSize)) {
       mDragMode = END_FRAME;
       mCaretCenterToDownPointOffsetY = GetCaretYCenterPosition() - ptInCanvas.y;
       SetSelectionDirection(true);
-      SetMouseDownState(true);
+      SetSelectionDragState(true);
       return nsEventStatus_eConsumeNoDefault;
     } else {
       mDragMode = NONE;
@@ -171,7 +171,7 @@ SelectionCarets::HandleEvent(WidgetEvent* aEvent)
     if (mDragMode != NONE) {
       // Only care about same id
       if (mActiveTouchId == nowTouchId) {
-        SetMouseDownState(false);
+        SetSelectionDragState(false);
         mDragMode = NONE;
         mActiveTouchId = -1;
       }
@@ -521,11 +521,11 @@ SelectionCarets::SelectWord()
 
   nsIFrame* caretFocusFrame = GetCaretFocusFrame();
   nsRefPtr<nsFrameSelection> fs = caretFocusFrame->GetFrameSelection();
-  fs->SetMouseDownState(true);
+  fs->SetDragState(true);
   nsFrame* frame = static_cast<nsFrame*>(ptFrame);
   nsresult rs = frame->SelectByTypeAtPoint(mPresShell->GetPresContext(), ptInFrame,
                                            eSelectWord, eSelectWord, 0);
-  fs->SetMouseDownState(false);
+  fs->SetDragState(false);
 
   // Clear maintain selection otherwise we cannot select less than a word
   fs->MaintainSelection();
@@ -695,14 +695,14 @@ SelectionCarets::GetCaretYCenterPosition()
 }
 
 void
-SelectionCarets::SetMouseDownState(bool aState)
+SelectionCarets::SetSelectionDragState(bool aState)
 {
   nsIFrame* caretFocusFrame = GetCaretFocusFrame();
   nsRefPtr<nsFrameSelection> fs = caretFocusFrame->GetFrameSelection();
-  if (fs->GetMouseDownState() == aState) {
+  if (fs->GetDragState() == aState) {
     return;
   }
-  fs->SetMouseDownState(aState);
+  fs->SetDragState(aState);
 
   if (aState) {
     fs->StartBatchChanges();
diff --git a/layout/base/SelectionCarets.h b/layout/base/SelectionCarets.h
index 6288836b2bf..42163623868 100644
--- a/layout/base/SelectionCarets.h
+++ b/layout/base/SelectionCarets.h
@@ -118,10 +118,10 @@ private:
   nscoord GetCaretYCenterPosition();
 
   /**
-   * Simulate mouse down state when we change the selection range.
+   * Simulate drag state when we change the selection range.
    * Hence, the selection change event will fire normally.
    */
-  void SetMouseDownState(bool aState);
+  void SetSelectionDragState(bool aState);
 
   void SetSelectionDirection(bool aForward);
 
diff --git a/layout/base/TouchCaret.cpp b/layout/base/TouchCaret.cpp
index 6f47e8b6497..3beecc67fb1 100644
--- a/layout/base/TouchCaret.cpp
+++ b/layout/base/TouchCaret.cpp
@@ -465,6 +465,22 @@ TouchCaret::CancelExpirationTimer()
   }
 }
 
+void
+TouchCaret::SetSelectionDragState(bool aState)
+{
+  nsCOMPtr<nsIPresShell> presShell = do_QueryReferent(mPresShell);
+  if (!presShell) {
+    return;
+  }
+
+  nsRefPtr<nsCaret> caret = presShell->GetCaret();
+  nsISelection* caretSelection = caret->GetCaretDOMSelection();
+  nsRect focusRect;
+  nsIFrame* caretFocusFrame = caret->GetGeometry(caretSelection, &focusRect);
+  nsRefPtr<nsFrameSelection> fs = caretFocusFrame->GetFrameSelection();
+  fs->SetDragState(aState);
+}
+
 nsEventStatus
 TouchCaret::HandleEvent(WidgetEvent* aEvent)
 {
@@ -628,6 +644,7 @@ TouchCaret::HandleMouseUpEvent(WidgetMouseEvent* aEvent)
 
     case TOUCHCARET_MOUSEDRAG_ACTIVE:
       if (aEvent->button == WidgetMouseEvent::eLeftButton) {
+        SetSelectionDragState(false);
         LaunchExpirationTimer();
         SetState(TOUCHCARET_NONE);
         status = nsEventStatus_eConsumeNoDefault;
@@ -672,6 +689,7 @@ TouchCaret::HandleTouchUpEvent(WidgetTouchEvent* aEvent)
 
     case TOUCHCARET_TOUCHDRAG_ACTIVE:
       if (mTouchesId.Length() == 0) {
+        SetSelectionDragState(false);
         // No more finger on the screen.
         SetState(TOUCHCARET_NONE);
         LaunchExpirationTimer();
@@ -717,6 +735,7 @@ TouchCaret::HandleMouseDownEvent(WidgetMouseEvent* aEvent)
       if (aEvent->button == WidgetMouseEvent::eLeftButton) {
         nsPoint point = GetEventPosition(aEvent);
         if (IsOnTouchCaret(point)) {
+          SetSelectionDragState(true);
           // Cache distence of the event point to the center of touch caret.
           mCaretCenterToDownPointOffsetY = GetCaretYCenterPosition() - point.y;
           // Enter TOUCHCARET_MOUSEDRAG_ACTIVE state and cancel the timer.
@@ -769,6 +788,7 @@ TouchCaret::HandleTouchDownEvent(WidgetTouchEvent* aEvent)
           int32_t touchId = aEvent->touches[i]->Identifier();
           nsPoint point = GetEventPosition(aEvent, touchId);
           if (IsOnTouchCaret(point)) {
+            SetSelectionDragState(true);
             // Touch start position is contained in touch caret.
             mActiveTouchId = touchId;
             // Cache distance of the event point to the center of touch caret.
diff --git a/layout/base/TouchCaret.h b/layout/base/TouchCaret.h
index 95f453683b9..00b9e94eb80 100644
--- a/layout/base/TouchCaret.h
+++ b/layout/base/TouchCaret.h
@@ -148,6 +148,15 @@ private:
    */
   nsPoint GetEventPosition(WidgetTouchEvent* aEvent, int32_t aIdentifier);
 
+  /**
+   * Set mouse down state in nsFrameSelection, we'll set state to true when
+   * user start dragging caret and set state to false when user release the
+   * caret. The reason for setting this state is it will fire drag reason
+   * when moving caret and fire mouseup reason when releasing caret. So that
+   * the display behavior of copy/paste menu becomes more reasonable.
+   */
+  void SetSelectionDragState(bool aState);
+
   /**
    * Get the coordinates of a given mouse event, relative to canvas frame.
    * @param aEvent the event
diff --git a/layout/base/nsPresShell.h b/layout/base/nsPresShell.h
index 76242cee9da..87cd5a537a1 100644
--- a/layout/base/nsPresShell.h
+++ b/layout/base/nsPresShell.h
@@ -552,7 +552,7 @@ protected:
   {
     nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
     if (frameSelection) {
-      frameSelection->SetMouseDownState(false);
+      frameSelection->SetDragState(false);
     }
     if (gCaptureInfo.mContent &&
         gCaptureInfo.mContent->OwnerDoc() == mDocument) {
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 27c8aa73894..f18b3e8e713 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -2774,7 +2774,7 @@ nsFrame::HandlePress(nsPresContext* aPresContext,
   if (mouseEvent->clickCount > 1) {
     // These methods aren't const but can't actually delete anything,
     // so no need for nsWeakFrame.
-    fc->SetMouseDownState(true);
+    fc->SetDragState(true);
     fc->SetMouseDoubleDown(true);
     return HandleMultiplePress(aPresContext, mouseEvent, aEventStatus, control);
   }
@@ -2812,7 +2812,7 @@ nsFrame::HandlePress(nsPresContext* aPresContext,
                                 &target);
   if (NS_SUCCEEDED(rv) && parentContent)
   {
-    fc->SetMouseDownState(true);
+    fc->SetDragState(true);
     return fc->HandleTableSelection(parentContent, contentOffset, target,
                                     mouseEvent);
   }
@@ -2861,13 +2861,13 @@ nsFrame::HandlePress(nsPresContext* aPresContext,
     }
 
     if (inSelection) {
-      fc->SetMouseDownState(false);
+      fc->SetDragState(false);
       fc->SetDelayedCaretData(mouseEvent);
       return NS_OK;
     }
   }
 
-  fc->SetMouseDownState(true);
+  fc->SetDragState(true);
 
   // Do not touch any nsFrame members after this point without adding
   // weakFrame checks.
@@ -2889,7 +2889,7 @@ nsFrame::HandlePress(nsPresContext* aPresContext,
     // -moz-user-select: all or a non-text node without children).
     // Therefore, disable selection extension during mouse moves.
     // XXX This is a bit hacky; shouldn't editor be able to deal with this?
-    fc->SetMouseDownState(false);
+    fc->SetDragState(false);
   }
 
   return rv;
@@ -3090,7 +3090,7 @@ NS_IMETHODIMP nsFrame::HandleDrag(nsPresContext* aPresContext,
   nsIPresShell *presShell = aPresContext->PresShell();
 
   nsRefPtr<nsFrameSelection> frameselection = GetFrameSelection();
-  bool mouseDown = frameselection->GetMouseDownState();
+  bool mouseDown = frameselection->GetDragState();
   if (!mouseDown)
     return NS_OK;
 
@@ -3174,7 +3174,7 @@ HandleFrameSelection(nsFrameSelection*         aFrameSelection,
       //  * that's the normal click position to use (although really, in
       //    the normal case, small movements that don't count as a drag
       //    can do selection)
-      aFrameSelection->SetMouseDownState(true);
+      aFrameSelection->SetDragState(true);
 
       rv = aFrameSelection->HandleClick(aOffsets.content,
                                         aOffsets.StartOffset(),
@@ -3186,7 +3186,7 @@ HandleFrameSelection(nsFrameSelection*         aFrameSelection,
         return rv;
       }
     } else if (aParentContentForTableSel) {
-      aFrameSelection->SetMouseDownState(false);
+      aFrameSelection->SetDragState(false);
       rv = aFrameSelection->HandleTableSelection(
                               aParentContentForTableSel,
                               aContentOffsetForTableSel,
@@ -3199,7 +3199,7 @@ HandleFrameSelection(nsFrameSelection*         aFrameSelection,
     aFrameSelection->SetDelayedCaretData(0);
   }
 
-  aFrameSelection->SetMouseDownState(false);
+  aFrameSelection->SetDragState(false);
   aFrameSelection->StopAutoScrollTimer();
 
   return NS_OK;
@@ -3238,7 +3238,7 @@ NS_IMETHODIMP nsFrame::HandleRelease(nsPresContext* aPresContext,
       // If not, the user must have clicked in a part of the selection.
       // Place the caret before continuing!
 
-      bool mouseDown = frameselection->GetMouseDownState();
+      bool mouseDown = frameselection->GetDragState();
 
       if (!mouseDown && frameselection->HasDelayedCaretData() &&
           frameselection->GetClickCountInDelayedCaretData() < 2) {
@@ -3278,7 +3278,7 @@ NS_IMETHODIMP nsFrame::HandleRelease(nsPresContext* aPresContext,
   }
 
   if (frameSelection) {
-    frameSelection->SetMouseDownState(false);
+    frameSelection->SetDragState(false);
     frameSelection->StopAutoScrollTimer();
   }
 
diff --git a/layout/generic/nsFrameSelection.h b/layout/generic/nsFrameSelection.h
index b2ab3e8fa3d..5b7a4c92f02 100644
--- a/layout/generic/nsFrameSelection.h
+++ b/layout/generic/nsFrameSelection.h
@@ -332,18 +332,18 @@ public:
                                     int32_t aContentLength,
                                     bool aSlowCheck) const;
 
-  /** SetMouseDownState(bool);
-   *  sets the mouse state to aState for resons of drag state.
-   * @param aState is the new state of mousedown
+  /** SetDragState(bool);
+   *  sets the drag state to aState for resons of drag state.
+   * @param aState is the new state of drag
    */
   /*unsafe*/
-  void SetMouseDownState(bool aState);
+  void SetDragState(bool aState);
 
-  /** GetMouseDownState(bool *);
-   *  gets the mouse state to aState for resons of drag state.
-   * @param aState will hold the state of mousedown
+  /** GetDragState(bool *);
+   *  gets the drag state to aState for resons of drag state.
+   * @param aState will hold the state of drag
    */
-  bool GetMouseDownState() const { return mMouseDownState; }
+  bool GetDragState() const { return mDragState; }
 
   /**
     if we are in table cell selection mode. aka ctrl click in table cell
@@ -718,7 +718,7 @@ private:
   bool mChangesDuringBatching;
   bool mNotifyFrames;
   bool mDragSelectingCells;
-  bool mMouseDownState;   //for drag purposes
+  bool mDragState;   //for drag purposes
   bool mMouseDoubleDownState; //has the doubleclick down happened
   bool mDesiredXSet;
 
diff --git a/layout/generic/nsSelection.cpp b/layout/generic/nsSelection.cpp
index d61138744f5..115f5de876c 100644
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -707,7 +707,7 @@ void
 nsFrameSelection::Init(nsIPresShell *aShell, nsIContent *aLimiter)
 {
   mShell = aShell;
-  mMouseDownState = false;
+  mDragState = false;
   mDesiredXSet = false;
   mLimiter = aLimiter;
   mCaretMovementStyle =
@@ -1652,14 +1652,14 @@ nsFrameSelection::LookUpSelection(nsIContent *aContent,
 }
 
 void
-nsFrameSelection::SetMouseDownState(bool aState)
+nsFrameSelection::SetDragState(bool aState)
 {
-  if (mMouseDownState == aState)
+  if (mDragState == aState)
     return;
 
-  mMouseDownState = aState;
+  mDragState = aState;
     
-  if (!mMouseDownState)
+  if (!mDragState)
   {
     mDragSelectingCells = false;
     PostReason(nsISelectionListener::MOUSEUP_REASON);
@@ -2073,7 +2073,7 @@ nsFrameSelection::HandleTableSelection(nsINode* aParentContent,
   NS_ENSURE_TRUE(aParentContent, NS_ERROR_NULL_POINTER);
   NS_ENSURE_TRUE(aMouseEvent, NS_ERROR_NULL_POINTER);
 
-  if (mMouseDownState && mDragSelectingCells && (aTarget & nsISelectionPrivate::TABLESELECTION_TABLE))
+  if (mDragState && mDragSelectingCells && (aTarget & nsISelectionPrivate::TABLESELECTION_TABLE))
   {
     // We were selecting cells and user drags mouse in table border or inbetween cells,
     //  just do nothing
@@ -2098,7 +2098,7 @@ nsFrameSelection::HandleTableSelection(nsINode* aParentContent,
   nsSelectionBatcher selectionBatcher(mDomSelections[index]);
 
   int32_t startRowIndex, startColIndex, curRowIndex, curColIndex;
-  if (mMouseDownState && mDragSelectingCells)
+  if (mDragState && mDragSelectingCells)
   {
     // We are drag-selecting
     if (aTarget != nsISelectionPrivate::TABLESELECTION_TABLE)
@@ -2182,7 +2182,7 @@ printf("HandleTableSelection: Dragged into a new cell\n");
   else 
   {
     // Not dragging  -- mouse event is down or up
-    if (mMouseDownState)
+    if (mDragState)
     {
 #ifdef DEBUG_TABLE_SELECTION
 printf("HandleTableSelection: Mouse down event\n");
diff --git a/layout/reftests/font-matching/reftest.list b/layout/reftests/font-matching/reftest.list
index e3271cfdfeb..5844cdf041d 100644
--- a/layout/reftests/font-matching/reftest.list
+++ b/layout/reftests/font-matching/reftest.list
@@ -91,5 +91,5 @@ random-if(!(cocoaWidget||winWidget)) == arial-arabic.html arial-arabic-ref.html
 
 != syntheticbold-rotated.html syntheticbold-rotated-ref.html
 
-HTTP(..) == font-synthesis-1.html font-synthesis-1-ref.html
-HTTP(..) == font-synthesis-2.html font-synthesis-2-ref.html
+pref(layout.css.font-features.enabled,true) HTTP(..) == font-synthesis-1.html font-synthesis-1-ref.html
+pref(layout.css.font-features.enabled,true) HTTP(..) == font-synthesis-2.html font-synthesis-2-ref.html
diff --git a/media/mtransport/test/transport_unittests.cpp b/media/mtransport/test/transport_unittests.cpp
index fac3b59c38c..8ee32c74911 100644
--- a/media/mtransport/test/transport_unittests.cpp
+++ b/media/mtransport/test/transport_unittests.cpp
@@ -9,6 +9,7 @@
 #include <iostream>
 #include <string>
 #include <map>
+#include <algorithm>
 
 #include "mozilla/UniquePtr.h"
 
@@ -18,6 +19,7 @@
 #include "nspr.h"
 #include "nss.h"
 #include "ssl.h"
+#include "sslproto.h"
 
 #include "nsThreadUtils.h"
 #include "nsXPCOM.h"
@@ -291,7 +293,9 @@ class TransportTestPeer : public sigslot::has_slots<> {
                                   TransportLayerDtls::SERVER)),
         streams_(), candidates_(),
         peer_(nullptr),
-        gathering_complete_(false)
+        gathering_complete_(false),
+        enabled_cipersuites_(),
+        disabled_cipersuites_()
  {
     std::vector<NrIceStunServer> stun_servers;
     UniquePtr<NrIceStunServer> server(NrIceStunServer::Create(
@@ -361,6 +365,18 @@ class TransportTestPeer : public sigslot::has_slots<> {
     }
   }
 
+  void SetupSrtp() {
+    // this mimics the setup we do elsewhere
+    std::vector<uint16_t> srtp_ciphers;
+    srtp_ciphers.push_back(SRTP_AES128_CM_HMAC_SHA1_80);
+    srtp_ciphers.push_back(SRTP_AES128_CM_HMAC_SHA1_32);
+
+    SetSrtpCiphers(srtp_ciphers);
+ }
+
+  void SetSrtpCiphers(std::vector<uint16_t>& srtp_ciphers) {
+    ASSERT_TRUE(NS_SUCCEEDED(dtls_->SetSrtpCiphers(srtp_ciphers)));
+  }
 
   void ConnectSocket_s(TransportTestPeer *peer) {
     nsresult res;
@@ -374,9 +390,22 @@ class TransportTestPeer : public sigslot::has_slots<> {
     ASSERT_EQ((nsresult)NS_OK, flow_->PushLayer(lossy_));
     ASSERT_EQ((nsresult)NS_OK, flow_->PushLayer(dtls_));
 
+    TweakCiphers(dtls_->internal_fd());
+
     flow_->SignalPacketReceived.connect(this, &TransportTestPeer::PacketReceived);
   }
 
+  void TweakCiphers(PRFileDesc* fd) {
+    for (auto it = enabled_cipersuites_.begin();
+         it != enabled_cipersuites_.end(); ++it) {
+      SSL_CipherPrefSet(fd, *it, PR_TRUE);
+    }
+    for (auto it = disabled_cipersuites_.begin();
+         it != disabled_cipersuites_.end(); ++it) {
+      SSL_CipherPrefSet(fd, *it, PR_FALSE);
+    }
+  }
+
   void ConnectSocket(TransportTestPeer *peer) {
     RUN_ON_THREAD(test_utils->sts_target(),
                   WrapRunnable(this, & TransportTestPeer::ConnectSocket_s,
@@ -517,6 +546,12 @@ class TransportTestPeer : public sigslot::has_slots<> {
     lossy_->SetInspector(Move(inspector));
   }
 
+  void SetCipherSuiteChanges(const std::vector<uint16_t>& enableThese,
+                             const std::vector<uint16_t>& disableThese) {
+    disabled_cipersuites_ = disableThese;
+    enabled_cipersuites_ = enableThese;
+  }
+
   TransportLayer::State state() {
     TransportLayer::State tstate;
 
@@ -536,6 +571,31 @@ class TransportTestPeer : public sigslot::has_slots<> {
 
   size_t received() { return received_; }
 
+  uint16_t cipherSuite() const {
+    nsresult rv;
+    uint16_t cipher;
+    RUN_ON_THREAD(test_utils->sts_target(),
+                  WrapRunnableRet(dtls_, &TransportLayerDtls::GetCipherSuite,
+                                  &cipher, &rv));
+
+    if (NS_FAILED(rv)) {
+      return TLS_NULL_WITH_NULL_NULL; // i.e., not good
+    }
+    return cipher;
+  }
+
+  uint16_t srtpCipher() const {
+    nsresult rv;
+    uint16_t cipher;
+    RUN_ON_THREAD(test_utils->sts_target(),
+                  WrapRunnableRet(dtls_, &TransportLayerDtls::GetSrtpCipher,
+                                  &cipher, &rv));
+    if (NS_FAILED(rv)) {
+      return 0; // the SRTP equivalent of TLS_NULL_WITH_NULL_NULL
+    }
+    return cipher;
+  }
+
  private:
   std::string name_;
   nsCOMPtr<nsIEventTarget> target_;
@@ -554,6 +614,8 @@ class TransportTestPeer : public sigslot::has_slots<> {
   bool gathering_complete_;
   unsigned char fingerprint_[TransportLayerDtls::kMaxDigestLength];
   size_t fingerprint_len_;
+  std::vector<uint16_t> enabled_cipersuites_;
+  std::vector<uint16_t> disabled_cipersuites_;
 };
 
 
@@ -587,6 +649,11 @@ class TransportTest : public ::testing::Test {
     p2_ = new TransportTestPeer(target_, "P2");
   }
 
+  void SetupSrtp() {
+    p1_->SetupSrtp();
+    p2_->SetupSrtp();
+  }
+
   void SetDtlsPeer(int digests = 1, unsigned int damage = 0) {
     p1_->SetDtlsPeer(p2_, digests, damage);
     p2_->SetDtlsPeer(p1_, digests, damage);
@@ -607,6 +674,9 @@ class TransportTest : public ::testing::Test {
 
     ASSERT_TRUE_WAIT(p1_->connected(), 10000);
     ASSERT_TRUE_WAIT(p2_->connected(), 10000);
+
+    ASSERT_EQ(p1_->cipherSuite(), p2_->cipherSuite());
+    ASSERT_EQ(p1_->srtpCipher(), p2_->srtpCipher());
   }
 
   void ConnectSocketExpectFail() {
@@ -662,8 +732,26 @@ TEST_F(TransportTest, TestNoDtlsVerificationSettings) {
 TEST_F(TransportTest, TestConnect) {
   SetDtlsPeer();
   ConnectSocket();
+
+  // check that we got the right suite
+  ASSERT_EQ(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, p1_->cipherSuite());
+
+  // no SRTP on this one
+  ASSERT_EQ(0, p1_->srtpCipher());
 }
 
+TEST_F(TransportTest, TestConnectSrtp) {
+  SetupSrtp();
+  SetDtlsPeer();
+  ConnectSocket();
+
+  ASSERT_EQ(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, p1_->cipherSuite());
+
+  // SRTP is on
+  ASSERT_EQ(SRTP_AES128_CM_HMAC_SHA1_80, p1_->srtpCipher());
+}
+
+
 TEST_F(TransportTest, TestConnectDestroyFlowsMainThread) {
   SetDtlsPeer();
   ConnectSocket();
@@ -740,6 +828,65 @@ TEST_F(TransportTest, TestTransferIce) {
   TransferTest(1);
 }
 
+// test the default configuration against a peer that supports only
+// one of the mandatory-to-implement suites, which should succeed
+static void ConfigureOneCipher(TransportTestPeer* peer, uint16_t suite) {
+  std::vector<uint16_t> justOne;
+  justOne.push_back(suite);
+  std::vector<uint16_t> everythingElse(SSL_GetImplementedCiphers(),
+                                       SSL_GetImplementedCiphers()
+                                       + SSL_GetNumImplementedCiphers());
+  std::remove(everythingElse.begin(), everythingElse.end(), suite);
+  peer->SetCipherSuiteChanges(justOne, everythingElse);
+}
+
+TEST_F(TransportTest, TestCipherMismatch) {
+  SetDtlsPeer();
+  ConfigureOneCipher(p1_, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256);
+  ConfigureOneCipher(p2_, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA);
+  ConnectSocketExpectFail();
+}
+
+TEST_F(TransportTest, TestCipherMandatoryOnlyGcm) {
+  SetDtlsPeer();
+  ConfigureOneCipher(p1_, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256);
+  ConnectSocket();
+  ASSERT_EQ(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, p1_->cipherSuite());
+}
+
+TEST_F(TransportTest, TestCipherMandatoryOnlyCbc) {
+  SetDtlsPeer();
+  ConfigureOneCipher(p1_, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA);
+  ConnectSocket();
+  ASSERT_EQ(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, p1_->cipherSuite());
+}
+
+TEST_F(TransportTest, TestSrtpMismatch) {
+  std::vector<uint16_t> setA;
+  setA.push_back(SRTP_AES128_CM_HMAC_SHA1_80);
+  std::vector<uint16_t> setB;
+  setB.push_back(SRTP_AES128_CM_HMAC_SHA1_32);
+
+  p1_->SetSrtpCiphers(setA);
+  p2_->SetSrtpCiphers(setB);
+  SetDtlsPeer();
+  ConnectSocket();
+
+  ASSERT_EQ(0, p1_->srtpCipher());
+  ASSERT_EQ(0, p2_->srtpCipher());
+}
+
+// NSS doesn't support DHE suites on the server end.
+// This checks to see if we barf when that's the only option available.
+TEST_F(TransportTest, TestDheOnlyFails) {
+  SetDtlsPeer();
+
+  // p2_ is the client
+  // setting this on p1_ (the server) causes NSS to assert
+  ConfigureOneCipher(p2_, TLS_DHE_RSA_WITH_AES_128_CBC_SHA);
+  ConnectSocketExpectFail();
+}
+
 TEST(PushTests, LayerFail) {
   mozilla::RefPtr<TransportFlow> flow = new TransportFlow();
   nsresult rv;
@@ -760,7 +907,6 @@ TEST(PushTests, LayerFail) {
   ASSERT_EQ(true, destroyed1);
 }
 
-
 TEST(PushTests, LayersFail) {
   mozilla::RefPtr<TransportFlow> flow = new TransportFlow();
   nsresult rv;
diff --git a/media/mtransport/transportlayer.h b/media/mtransport/transportlayer.h
index c607c66afe8..ce5b94661aa 100644
--- a/media/mtransport/transportlayer.h
+++ b/media/mtransport/transportlayer.h
@@ -29,7 +29,7 @@ enum {
 };
 
 #define TRANSPORT_LAYER_ID(name) \
-  virtual const std::string id() { return name; } \
+  virtual const std::string id() const { return name; } \
   static std::string ID() { return name; }
 
 // Abstract base class for network transport layers.
@@ -81,10 +81,10 @@ class TransportLayer : public sigslot::has_slots<> {
                          SignalPacketReceived;
 
   // Return the layer id for this layer
-  virtual const std::string id() = 0;
+  virtual const std::string id() const = 0;
 
   // The id of the flow
-  const std::string& flow_id() {
+  const std::string& flow_id() const {
     return flow_id_;
   }
 
@@ -92,7 +92,7 @@ class TransportLayer : public sigslot::has_slots<> {
   virtual void WasInserted() {}
   virtual void SetState(State state, const char *file, unsigned line);
   // Check if we are on the right thread
-  void CheckThread() {
+  void CheckThread() const {
     NS_ABORT_IF_FALSE(CheckThreadInt(), "Wrong thread");
   }
 
@@ -105,7 +105,7 @@ class TransportLayer : public sigslot::has_slots<> {
  private:
   DISALLOW_COPY_ASSIGN(TransportLayer);
 
-  bool CheckThreadInt() {
+  bool CheckThreadInt() const {
     bool on;
 
     if (!target_)  // OK if no thread set.
diff --git a/media/mtransport/transportlayerdtls.cpp b/media/mtransport/transportlayerdtls.cpp
index c4c8a274d94..250ce1c3b16 100644
--- a/media/mtransport/transportlayerdtls.cpp
+++ b/media/mtransport/transportlayerdtls.cpp
@@ -500,11 +500,11 @@ bool TransportLayerDtls::Setup() {
     }
   }
 
-  // Require TLS 1.1. Perhaps some day in the future we will allow
-  // TLS 1.0 for stream modes.
+  // Require TLS 1.1 or 1.2. Perhaps some day in the future we will allow TLS
+  // 1.0 for stream modes.
   SSLVersionRange version_range = {
     SSL_LIBRARY_VERSION_TLS_1_1,
-    SSL_LIBRARY_VERSION_TLS_1_1
+    SSL_LIBRARY_VERSION_TLS_1_2
   };
 
   rv = SSL_VersionRangeSet(ssl_fd, &version_range);
@@ -549,16 +549,8 @@ bool TransportLayerDtls::Setup() {
     return false;
   }
 
-  // Set the SRTP ciphers
-  if (srtp_ciphers_.size()) {
-    // Note: std::vector is guaranteed to contiguous
-    rv = SSL_SetSRTPCiphers(ssl_fd, &srtp_ciphers_[0],
-                            srtp_ciphers_.size());
-
-    if (rv != SECSuccess) {
-      MOZ_MTLOG(ML_ERROR, "Couldn't set SRTP cipher suite");
-      return false;
-    }
+  if (!SetupCipherSuites(ssl_fd)) {
+    return false;
   }
 
   // Certificate validation
@@ -588,6 +580,135 @@ bool TransportLayerDtls::Setup() {
   return true;
 }
 
+// Ciphers we need to enable.  These are on by default in standard firefox
+// builds, but can be disabled with prefs and they aren't on in our unit tests
+// since that uses NSS default configuration.
+// Only override prefs to comply with MUST statements in the security-arch.
+static const uint32_t EnabledCiphers[] = {
+  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+};
+
+// Disalbe all NSS suites modes without PFS or with old and rusty ciphersuites.
+// Anything outside this list is governed by the usual combination of policy
+// and user preferences.
+static const uint32_t DisabledCiphers[] = {
+  TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
+  TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+  TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+  TLS_ECDHE_RSA_WITH_RC4_128_SHA,
+
+  TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
+  TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
+  TLS_DHE_DSS_WITH_RC4_128_SHA,
+
+  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
+  TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+  TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
+  TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
+  TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
+  TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
+  TLS_ECDH_RSA_WITH_RC4_128_SHA,
+
+  TLS_RSA_WITH_AES_128_GCM_SHA256,
+  TLS_RSA_WITH_AES_128_CBC_SHA,
+  TLS_RSA_WITH_AES_128_CBC_SHA256,
+  TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
+  TLS_RSA_WITH_AES_256_CBC_SHA,
+  TLS_RSA_WITH_AES_256_CBC_SHA256,
+  TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
+  TLS_RSA_WITH_SEED_CBC_SHA,
+  SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,
+  TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+  TLS_RSA_WITH_RC4_128_SHA,
+  TLS_RSA_WITH_RC4_128_MD5,
+
+  TLS_DHE_RSA_WITH_DES_CBC_SHA,
+  TLS_DHE_DSS_WITH_DES_CBC_SHA,
+  SSL_RSA_FIPS_WITH_DES_CBC_SHA,
+  TLS_RSA_WITH_DES_CBC_SHA,
+
+  TLS_RSA_EXPORT1024_WITH_RC4_56_SHA,
+  TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA,
+
+  TLS_RSA_EXPORT_WITH_RC4_40_MD5,
+  TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,
+
+  TLS_ECDHE_ECDSA_WITH_NULL_SHA,
+  TLS_ECDHE_RSA_WITH_NULL_SHA,
+  TLS_ECDH_ECDSA_WITH_NULL_SHA,
+  TLS_ECDH_RSA_WITH_NULL_SHA,
+
+  TLS_RSA_WITH_NULL_SHA,
+  TLS_RSA_WITH_NULL_SHA256,
+  TLS_RSA_WITH_NULL_MD5,
+};
+
+bool TransportLayerDtls::SetupCipherSuites(PRFileDesc* ssl_fd) const {
+  SECStatus rv;
+
+  // Set the SRTP ciphers
+  if (!srtp_ciphers_.empty()) {
+    // Note: std::vector is guaranteed to contiguous
+    rv = SSL_SetSRTPCiphers(ssl_fd, &srtp_ciphers_[0], srtp_ciphers_.size());
+
+    if (rv != SECSuccess) {
+      MOZ_MTLOG(ML_ERROR, "Couldn't set SRTP cipher suite");
+      return false;
+    }
+  }
+
+  for (size_t i = 0; i < PR_ARRAY_SIZE(EnabledCiphers); ++i) {
+    MOZ_MTLOG(ML_INFO, LAYER_INFO << "Enabling: " << EnabledCiphers[i]);
+    rv = SSL_CipherPrefSet(ssl_fd, EnabledCiphers[i], PR_TRUE);
+    if (rv != SECSuccess) {
+      MOZ_MTLOG(ML_ERROR, LAYER_INFO <<
+                "Unable to enable suite: " << EnabledCiphers[i]);
+      return false;
+    }
+  }
+
+  for (size_t i = 0; i < PR_ARRAY_SIZE(DisabledCiphers); ++i) {
+    MOZ_MTLOG(ML_INFO, LAYER_INFO << "Disabling: " << DisabledCiphers[i]);
+
+    PRBool enabled = false;
+    rv = SSL_CipherPrefGet(ssl_fd, DisabledCiphers[i], &enabled);
+    if (rv != SECSuccess) {
+      MOZ_MTLOG(ML_NOTICE, LAYER_INFO <<
+                "Unable to check if suite is enabled: " << DisabledCiphers[i]);
+      return false;
+    }
+    if (enabled) {
+      rv = SSL_CipherPrefSet(ssl_fd, DisabledCiphers[i], PR_FALSE);
+      if (rv != SECSuccess) {
+        MOZ_MTLOG(ML_NOTICE, LAYER_INFO <<
+                  "Unable to disable suite: " << DisabledCiphers[i]);
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+nsresult TransportLayerDtls::GetCipherSuite(uint16_t* cipherSuite) const {
+  CheckThread();
+  if (!cipherSuite) {
+    MOZ_MTLOG(ML_ERROR, LAYER_INFO << "GetCipherSuite passed a nullptr");
+    return NS_ERROR_NULL_POINTER;
+  }
+  if (state_ != TS_OPEN) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+  SSLChannelInfo info;
+  SECStatus rv = SSL_GetChannelInfo(ssl_fd_, &info, sizeof(info));
+  if (rv != SECSuccess) {
+    MOZ_MTLOG(ML_NOTICE, LAYER_INFO << "GetCipherSuite can't get channel info");
+    return NS_ERROR_FAILURE;
+  }
+  *cipherSuite = info.cipherSuite;
+  return NS_OK;
+}
 
 void TransportLayerDtls::StateChange(TransportLayer *layer, State state) {
   if (state <= state_) {
@@ -800,7 +921,7 @@ nsresult TransportLayerDtls::SetSrtpCiphers(std::vector<uint16_t> ciphers) {
   return NS_OK;
 }
 
-nsresult TransportLayerDtls::GetSrtpCipher(uint16_t *cipher) {
+nsresult TransportLayerDtls::GetSrtpCipher(uint16_t *cipher) const {
   CheckThread();
   SECStatus rv = SSL_GetSRTPCipher(ssl_fd_, cipher);
   if (rv != SECSuccess) {
diff --git a/media/mtransport/transportlayerdtls.h b/media/mtransport/transportlayerdtls.h
index 3e821f931a0..007714dfb62 100644
--- a/media/mtransport/transportlayerdtls.h
+++ b/media/mtransport/transportlayerdtls.h
@@ -73,8 +73,10 @@ class TransportLayerDtls : public TransportLayer {
                                  const unsigned char *digest_value,
                                  size_t digest_len);
 
+  nsresult GetCipherSuite(uint16_t* cipherSuite) const;
+
   nsresult SetSrtpCiphers(std::vector<uint16_t> ciphers);
-  nsresult GetSrtpCipher(uint16_t *cipher);
+  nsresult GetSrtpCipher(uint16_t *cipher) const;
 
   nsresult ExportKeyingMaterial(const std::string& label,
                                 bool use_context,
@@ -96,6 +98,9 @@ class TransportLayerDtls : public TransportLayer {
   void PacketReceived(TransportLayer* layer, const unsigned char *data,
                       size_t len);
 
+  // For testing use only.  Returns the fd.
+  PRFileDesc* internal_fd() { CheckThread(); return ssl_fd_.rwget(); }
+
   TRANSPORT_LAYER_ID("dtls")
 
   private:
@@ -126,6 +131,7 @@ class TransportLayerDtls : public TransportLayer {
 
 
   bool Setup();
+  bool SetupCipherSuites(PRFileDesc* ssl_fd) const;
   void Handshake();
 
   static SECStatus GetClientAuthDataHook(void *arg, PRFileDesc *fd,
diff --git a/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.cc b/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.cc
index 1a8deb117c9..dd2d7152efb 100644
--- a/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.cc
+++ b/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.cc
@@ -359,7 +359,12 @@ int32_t DesktopCaptureImpl::Init(const char* uniqueId,
     MouseCursorMonitor * pMouseCursorMonitor = MouseCursorMonitor::CreateForScreen(webrtc::DesktopCaptureOptions::CreateDefault(), webrtc::kFullDesktopScreenId);
     desktop_capturer_cursor_composer_.reset(new DesktopAndCursorComposer(pAppCapturer, pMouseCursorMonitor));
   } else if (type == Screen) {
-    ScreenCapturer *pScreenCapturer = ScreenCapturer::Create();
+
+    DesktopCaptureOptions options = DesktopCaptureOptions::CreateDefault();
+    // Leave desktop effects enabled during WebRTC captures.
+    options.set_disable_effects(false);
+
+    ScreenCapturer *pScreenCapturer = ScreenCapturer::Create(options);
     if (!pScreenCapturer) {
       return -1;
     }
@@ -368,7 +373,7 @@ int32_t DesktopCaptureImpl::Init(const char* uniqueId,
     pScreenCapturer->SelectScreen(screenid);
     pScreenCapturer->SetMouseShapeObserver(this);
 
-    MouseCursorMonitor * pMouseCursorMonitor = MouseCursorMonitor::CreateForScreen(webrtc::DesktopCaptureOptions::CreateDefault(), screenid);
+    MouseCursorMonitor * pMouseCursorMonitor = MouseCursorMonitor::CreateForScreen(options, screenid);
     desktop_capturer_cursor_composer_.reset(new DesktopAndCursorComposer(pScreenCapturer, pMouseCursorMonitor));
   } else if (type == Window) {
     WindowCapturer *pWindowCapturer = WindowCapturer::Create();
diff --git a/mfbt/WeakPtr.h b/mfbt/WeakPtr.h
index ebcb9250674..58960ad6177 100644
--- a/mfbt/WeakPtr.h
+++ b/mfbt/WeakPtr.h
@@ -183,7 +183,7 @@ public:
     return *this = aOther->SelfReferencingWeakPtr();
   }
 
-  WeakPtr(T* aOther)
+  MOZ_IMPLICIT WeakPtr(T* aOther)
   {
     *this = aOther;
   }
diff --git a/mfbt/tests/TestPair.cpp b/mfbt/tests/TestPair.cpp
index 37aa2c69410..940174df0f3 100644
--- a/mfbt/tests/TestPair.cpp
+++ b/mfbt/tests/TestPair.cpp
@@ -29,21 +29,21 @@ using mozilla::Pair;
 INSTANTIATE(int, int, prim1, 2 * sizeof(int));
 INSTANTIATE(int, long, prim2, 2 * sizeof(long));
 
-struct EmptyClass { EmptyClass(int) {} };
-struct NonEmpty { char mC; NonEmpty(int) {} };
+struct EmptyClass { explicit EmptyClass(int) {} };
+struct NonEmpty { char mC; explicit NonEmpty(int) {} };
 
 INSTANTIATE(int, EmptyClass, both1, sizeof(int));
 INSTANTIATE(int, NonEmpty, both2, 2 * sizeof(int));
 INSTANTIATE(EmptyClass, NonEmpty, both3, 1);
 
-struct A { char dummy; A(int) {} };
-struct B : A { B(int aI) : A(aI) {} };
+struct A { char dummy; explicit A(int) {} };
+struct B : A { explicit B(int aI) : A(aI) {} };
 
 INSTANTIATE(A, A, class1, 2);
 INSTANTIATE(A, B, class2, 2);
 INSTANTIATE(A, EmptyClass, class3, 1);
 
-struct OtherEmpty : EmptyClass { OtherEmpty(int aI) : EmptyClass(aI) {} };
+struct OtherEmpty : EmptyClass { explicit OtherEmpty(int aI) : EmptyClass(aI) {} };
 
 // C++11 requires distinct objects of the same type, within the same "most
 // derived object", to have different addresses.  Pair allocates its elements as
diff --git a/mfbt/tests/TestSplayTree.cpp b/mfbt/tests/TestSplayTree.cpp
index b49371f3237..e1511e1abe0 100644
--- a/mfbt/tests/TestSplayTree.cpp
+++ b/mfbt/tests/TestSplayTree.cpp
@@ -89,7 +89,7 @@ static int gValues[] = {
 
 struct SplayInt : SplayTreeNode<SplayInt>
 {
-  SplayInt(int aValue) : mValue(aValue) {}
+  explicit SplayInt(int aValue) : mValue(aValue) {}
 
   static int compare(const SplayInt& aOne, const SplayInt& aTwo)
   {
diff --git a/mobile/android/base/locales/en-US/android_strings.dtd b/mobile/android/base/locales/en-US/android_strings.dtd
index 0f955247c8f..b362037399e 100644
--- a/mobile/android/base/locales/en-US/android_strings.dtd
+++ b/mobile/android/base/locales/en-US/android_strings.dtd
@@ -149,7 +149,7 @@
 <!ENTITY pref_clear_private_data2 "Clear now">
 <!ENTITY pref_clear_private_data_category "Clear private data">
 <!ENTITY pref_clear_on_exit_title "Always clear when quitting">
-<!ENTITY pref_clear_on_exit_summary "&brandShortName; will automatically clear your data whenever you select &quot;Quit&quot; from the main menu">
+<!ENTITY pref_clear_on_exit_summary2 "&brandShortName; will automatically clear your data whenever you select \u0022Quit\u0022 from the main menu">
 <!ENTITY pref_clear_on_exit_dialog_title "Select which data to clear">
 <!ENTITY pref_plugins "Plugins">
 <!ENTITY pref_plugins_enabled "Enabled">
diff --git a/mobile/android/base/resources/xml/preferences_privacy.xml b/mobile/android/base/resources/xml/preferences_privacy.xml
index 6c5d88e4630..fe7dc640291 100644
--- a/mobile/android/base/resources/xml/preferences_privacy.xml
+++ b/mobile/android/base/resources/xml/preferences_privacy.xml
@@ -51,7 +51,7 @@
                             gecko:initialValues="@array/pref_clear_on_exit_defaults"
 
                             android:title="@string/pref_clear_on_exit_title"
-                            android:summary="@string/pref_clear_on_exit_summary"
+                            android:summary="@string/pref_clear_on_exit_summary2"
 
                             android:dialogTitle="@string/pref_clear_on_exit_dialog_title"
                             android:positiveButtonText="@string/button_set"/>
diff --git a/mobile/android/base/strings.xml.in b/mobile/android/base/strings.xml.in
index a06578f3fb9..babc2c6e0a6 100644
--- a/mobile/android/base/strings.xml.in
+++ b/mobile/android/base/strings.xml.in
@@ -169,7 +169,7 @@
   <string name="pref_clear_private_data">&pref_clear_private_data2;</string>
   <string name="pref_clear_private_data_category">&pref_clear_private_data_category;</string>
   <string name="pref_clear_on_exit_title">&pref_clear_on_exit_title;</string>
-  <string name="pref_clear_on_exit_summary">&pref_clear_on_exit_summary;</string>
+  <string name="pref_clear_on_exit_summary2">&pref_clear_on_exit_summary2;</string>
   <string name="pref_clear_on_exit_dialog_title">&pref_clear_on_exit_dialog_title;</string>
   <string name="pref_plugins">&pref_plugins;</string>
   <string name="pref_plugins_enabled">&pref_plugins_enabled;</string>
diff --git a/modules/libjar/zipwriter/src/StreamFunctions.cpp b/modules/libjar/zipwriter/StreamFunctions.cpp
similarity index 100%
rename from modules/libjar/zipwriter/src/StreamFunctions.cpp
rename to modules/libjar/zipwriter/StreamFunctions.cpp
diff --git a/modules/libjar/zipwriter/src/StreamFunctions.h b/modules/libjar/zipwriter/StreamFunctions.h
similarity index 100%
rename from modules/libjar/zipwriter/src/StreamFunctions.h
rename to modules/libjar/zipwriter/StreamFunctions.h
diff --git a/modules/libjar/zipwriter/src/ZipWriterModule.cpp b/modules/libjar/zipwriter/ZipWriterModule.cpp
similarity index 100%
rename from modules/libjar/zipwriter/src/ZipWriterModule.cpp
rename to modules/libjar/zipwriter/ZipWriterModule.cpp
diff --git a/modules/libjar/zipwriter/moz.build b/modules/libjar/zipwriter/moz.build
index 47e64e62391..5a4f32d31be 100644
--- a/modules/libjar/zipwriter/moz.build
+++ b/modules/libjar/zipwriter/moz.build
@@ -4,6 +4,23 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-DIRS += ['public', 'src']
 TEST_DIRS += ['test']
 
+XPIDL_SOURCES += [
+    'nsIZipWriter.idl',
+]
+
+XPIDL_MODULE = 'zipwriter'
+
+UNIFIED_SOURCES += [
+    'nsDeflateConverter.cpp',
+    'nsZipDataStream.cpp',
+    'nsZipHeader.cpp',
+    'nsZipWriter.cpp',
+    'StreamFunctions.cpp',
+    'ZipWriterModule.cpp',
+]
+
+MSVC_ENABLE_PGO = True
+
+FINAL_LIBRARY = 'xul'
diff --git a/modules/libjar/zipwriter/src/nsDeflateConverter.cpp b/modules/libjar/zipwriter/nsDeflateConverter.cpp
similarity index 100%
rename from modules/libjar/zipwriter/src/nsDeflateConverter.cpp
rename to modules/libjar/zipwriter/nsDeflateConverter.cpp
diff --git a/modules/libjar/zipwriter/src/nsDeflateConverter.h b/modules/libjar/zipwriter/nsDeflateConverter.h
similarity index 100%
rename from modules/libjar/zipwriter/src/nsDeflateConverter.h
rename to modules/libjar/zipwriter/nsDeflateConverter.h
diff --git a/modules/libjar/zipwriter/public/nsIZipWriter.idl b/modules/libjar/zipwriter/nsIZipWriter.idl
similarity index 100%
rename from modules/libjar/zipwriter/public/nsIZipWriter.idl
rename to modules/libjar/zipwriter/nsIZipWriter.idl
diff --git a/modules/libjar/zipwriter/src/nsZipDataStream.cpp b/modules/libjar/zipwriter/nsZipDataStream.cpp
similarity index 100%
rename from modules/libjar/zipwriter/src/nsZipDataStream.cpp
rename to modules/libjar/zipwriter/nsZipDataStream.cpp
diff --git a/modules/libjar/zipwriter/src/nsZipDataStream.h b/modules/libjar/zipwriter/nsZipDataStream.h
similarity index 100%
rename from modules/libjar/zipwriter/src/nsZipDataStream.h
rename to modules/libjar/zipwriter/nsZipDataStream.h
diff --git a/modules/libjar/zipwriter/src/nsZipHeader.cpp b/modules/libjar/zipwriter/nsZipHeader.cpp
similarity index 100%
rename from modules/libjar/zipwriter/src/nsZipHeader.cpp
rename to modules/libjar/zipwriter/nsZipHeader.cpp
diff --git a/modules/libjar/zipwriter/src/nsZipHeader.h b/modules/libjar/zipwriter/nsZipHeader.h
similarity index 100%
rename from modules/libjar/zipwriter/src/nsZipHeader.h
rename to modules/libjar/zipwriter/nsZipHeader.h
diff --git a/modules/libjar/zipwriter/src/nsZipWriter.cpp b/modules/libjar/zipwriter/nsZipWriter.cpp
similarity index 100%
rename from modules/libjar/zipwriter/src/nsZipWriter.cpp
rename to modules/libjar/zipwriter/nsZipWriter.cpp
diff --git a/modules/libjar/zipwriter/src/nsZipWriter.h b/modules/libjar/zipwriter/nsZipWriter.h
similarity index 100%
rename from modules/libjar/zipwriter/src/nsZipWriter.h
rename to modules/libjar/zipwriter/nsZipWriter.h
diff --git a/modules/libjar/zipwriter/public/moz.build b/modules/libjar/zipwriter/public/moz.build
deleted file mode 100644
index 193d8cef81b..00000000000
--- a/modules/libjar/zipwriter/public/moz.build
+++ /dev/null
@@ -1,12 +0,0 @@
-# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-XPIDL_SOURCES += [
-    'nsIZipWriter.idl',
-]
-
-XPIDL_MODULE = 'zipwriter'
-
diff --git a/modules/libjar/zipwriter/src/moz.build b/modules/libjar/zipwriter/src/moz.build
deleted file mode 100644
index e1aca964a51..00000000000
--- a/modules/libjar/zipwriter/src/moz.build
+++ /dev/null
@@ -1,18 +0,0 @@
-# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
-# vim: set filetype=python:
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-UNIFIED_SOURCES += [
-    'nsDeflateConverter.cpp',
-    'nsZipDataStream.cpp',
-    'nsZipHeader.cpp',
-    'nsZipWriter.cpp',
-    'StreamFunctions.cpp',
-    'ZipWriterModule.cpp',
-]
-
-MSVC_ENABLE_PGO = True
-
-FINAL_LIBRARY = 'xul'
diff --git a/netwerk/base/public/nsAsyncRedirectVerifyHelper.h b/netwerk/base/public/nsAsyncRedirectVerifyHelper.h
index 56e839cf1bc..a8260f8b90c 100644
--- a/netwerk/base/public/nsAsyncRedirectVerifyHelper.h
+++ b/netwerk/base/public/nsAsyncRedirectVerifyHelper.h
@@ -92,7 +92,7 @@ private:
 class nsAsyncRedirectAutoCallback
 {
 public:
-    nsAsyncRedirectAutoCallback(nsIAsyncVerifyRedirectCallback* aCallback)
+    explicit nsAsyncRedirectAutoCallback(nsIAsyncVerifyRedirectCallback* aCallback)
         : mCallback(aCallback)
     {
         mResult = NS_OK;
diff --git a/netwerk/base/public/nsStreamListenerWrapper.h b/netwerk/base/public/nsStreamListenerWrapper.h
index af9bd2bcedc..2db58e51c81 100644
--- a/netwerk/base/public/nsStreamListenerWrapper.h
+++ b/netwerk/base/public/nsStreamListenerWrapper.h
@@ -17,7 +17,7 @@ class nsStreamListenerWrapper MOZ_FINAL : public nsIStreamListener
                                         , public nsIThreadRetargetableStreamListener
 {
 public:
-  nsStreamListenerWrapper(nsIStreamListener *listener)
+  explicit nsStreamListenerWrapper(nsIStreamListener *listener)
     : mListener(listener)
   {
     NS_ASSERTION(mListener, "no stream listener specified");
diff --git a/netwerk/base/public/nsURIHashKey.h b/netwerk/base/public/nsURIHashKey.h
index 7f391c34b8c..a3b54754a9b 100644
--- a/netwerk/base/public/nsURIHashKey.h
+++ b/netwerk/base/public/nsURIHashKey.h
@@ -19,7 +19,7 @@ public:
     typedef nsIURI* KeyType;
     typedef const nsIURI* KeyTypePointer;
 
-    nsURIHashKey(const nsIURI* aKey) :
+    explicit nsURIHashKey(const nsIURI* aKey) :
         mKey(const_cast<nsIURI*>(aKey)) { MOZ_COUNT_CTOR(nsURIHashKey); }
     nsURIHashKey(const nsURIHashKey& toCopy) :
         mKey(toCopy.mKey) { MOZ_COUNT_CTOR(nsURIHashKey); }
diff --git a/netwerk/base/src/Dashboard.cpp b/netwerk/base/src/Dashboard.cpp
index c06284a077c..fee88a5e6ce 100644
--- a/netwerk/base/src/Dashboard.cpp
+++ b/netwerk/base/src/Dashboard.cpp
@@ -141,7 +141,7 @@ public:
     void StartTimer(uint32_t aTimeout);
     void StopTimer();
 
-    ConnectionData(Dashboard *target)
+    explicit ConnectionData(Dashboard *target)
     {
         mThread = nullptr;
         mDashboard = target;
diff --git a/netwerk/base/src/EventTokenBucket.cpp b/netwerk/base/src/EventTokenBucket.cpp
index 5ffd5fffcfe..78714705440 100644
--- a/netwerk/base/src/EventTokenBucket.cpp
+++ b/netwerk/base/src/EventTokenBucket.cpp
@@ -34,7 +34,7 @@ public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSICANCELABLE
 
-  TokenBucketCancelable(class ATokenBucketEvent *event);
+  explicit TokenBucketCancelable(class ATokenBucketEvent *event);
   void Fire();
 
 private:
diff --git a/netwerk/base/src/NetworkActivityMonitor.cpp b/netwerk/base/src/NetworkActivityMonitor.cpp
index 71086022be0..a758703697b 100644
--- a/netwerk/base/src/NetworkActivityMonitor.cpp
+++ b/netwerk/base/src/NetworkActivityMonitor.cpp
@@ -151,7 +151,7 @@ nsNetMon_AcceptRead(PRFileDesc *listenSock,
 
 class NotifyNetworkActivity : public nsRunnable {
 public:
-  NotifyNetworkActivity(NetworkActivityMonitor::Direction aDirection)
+  explicit NotifyNetworkActivity(NetworkActivityMonitor::Direction aDirection)
     : mDirection(aDirection)
   {}
   NS_IMETHOD Run()
diff --git a/netwerk/base/src/Predictor.cpp b/netwerk/base/src/Predictor.cpp
index 007c0682d10..08904e7ad0a 100644
--- a/netwerk/base/src/Predictor.cpp
+++ b/netwerk/base/src/Predictor.cpp
@@ -803,7 +803,7 @@ Predictor::EnsureInitStorage()
 class PredictorThreadShutdownRunner : public nsRunnable
 {
 public:
-  PredictorThreadShutdownRunner(nsIThread *ioThread)
+  explicit PredictorThreadShutdownRunner(nsIThread *ioThread)
     :mIOThread(ioThread)
   { }
 
diff --git a/netwerk/base/src/nsAsyncStreamCopier.cpp b/netwerk/base/src/nsAsyncStreamCopier.cpp
index c415368cc44..c92fede2d24 100644
--- a/netwerk/base/src/nsAsyncStreamCopier.cpp
+++ b/netwerk/base/src/nsAsyncStreamCopier.cpp
@@ -31,7 +31,7 @@ public:
      * @param aCopier
      *        The nsAsyncStreamCopier requesting the information.
      */
-    AsyncApplyBufferingPolicyEvent(nsAsyncStreamCopier* aCopier)
+    explicit AsyncApplyBufferingPolicyEvent(nsAsyncStreamCopier* aCopier)
         : mCopier(aCopier)
       , mTarget(NS_GetCurrentThread())
       { }
diff --git a/netwerk/base/src/nsBaseChannel.cpp b/netwerk/base/src/nsBaseChannel.cpp
index 119b59877da..c339c7c9a7a 100644
--- a/netwerk/base/src/nsBaseChannel.cpp
+++ b/netwerk/base/src/nsBaseChannel.cpp
@@ -27,7 +27,7 @@ CopyProperties(const nsAString &key, nsIVariant *data, void *closure)
 // This class is used to suspend a request across a function scope.
 class ScopedRequestSuspender {
 public:
-  ScopedRequestSuspender(nsIRequest *request)
+  explicit ScopedRequestSuspender(nsIRequest *request)
     : mRequest(request) {
     if (mRequest && NS_FAILED(mRequest->Suspend())) {
       NS_WARNING("Couldn't suspend pump");
diff --git a/netwerk/base/src/nsBaseContentStream.h b/netwerk/base/src/nsBaseContentStream.h
index a8708cae637..992c8733ece 100644
--- a/netwerk/base/src/nsBaseContentStream.h
+++ b/netwerk/base/src/nsBaseContentStream.h
@@ -40,7 +40,7 @@ public:
   NS_DECL_NSIINPUTSTREAM
   NS_DECL_NSIASYNCINPUTSTREAM
 
-  nsBaseContentStream(bool nonBlocking)
+  explicit nsBaseContentStream(bool nonBlocking)
     : mStatus(NS_OK)
     , mNonBlocking(nonBlocking) {
   }
diff --git a/netwerk/base/src/nsIOService.cpp b/netwerk/base/src/nsIOService.cpp
index 02c0e9c2c34..de9a726b391 100644
--- a/netwerk/base/src/nsIOService.cpp
+++ b/netwerk/base/src/nsIOService.cpp
@@ -497,7 +497,7 @@ nsIOService::GetProtocolFlags(const char* scheme, uint32_t *flags)
 class AutoIncrement
 {
     public:
-        AutoIncrement(uint32_t *var) : mVar(var)
+        explicit AutoIncrement(uint32_t *var) : mVar(var)
         {
             ++*var;
         }
diff --git a/netwerk/base/src/nsLoadGroup.cpp b/netwerk/base/src/nsLoadGroup.cpp
index c238207925b..58d150d1f01 100644
--- a/netwerk/base/src/nsLoadGroup.cpp
+++ b/netwerk/base/src/nsLoadGroup.cpp
@@ -50,7 +50,7 @@ static PRLogModuleInfo* gLoadGroupLog = nullptr;
 class RequestMapEntry : public PLDHashEntryHdr
 {
 public:
-    RequestMapEntry(nsIRequest *aRequest) :
+    explicit RequestMapEntry(nsIRequest *aRequest) :
         mKey(aRequest)
     {
     }
diff --git a/netwerk/base/src/nsLoadGroup.h b/netwerk/base/src/nsLoadGroup.h
index 988f3dbd07a..28d4c29a9c5 100644
--- a/netwerk/base/src/nsLoadGroup.h
+++ b/netwerk/base/src/nsLoadGroup.h
@@ -49,7 +49,7 @@ public:
     ////////////////////////////////////////////////////////////////////////////
     // nsLoadGroup methods:
 
-    nsLoadGroup(nsISupports* outer);
+    explicit nsLoadGroup(nsISupports* outer);
 
     nsresult Init();
 
diff --git a/netwerk/base/src/nsMediaFragmentURIParser.h b/netwerk/base/src/nsMediaFragmentURIParser.h
index 837a28db969..e80a2b4c73d 100644
--- a/netwerk/base/src/nsMediaFragmentURIParser.h
+++ b/netwerk/base/src/nsMediaFragmentURIParser.h
@@ -33,10 +33,10 @@ class nsMediaFragmentURIParser
 {
 public:
   // Create a parser with the provided URI.
-  nsMediaFragmentURIParser(nsIURI* aURI);
+  explicit nsMediaFragmentURIParser(nsIURI* aURI);
 
   // Create a parser with the provided URI reference portion.
-  nsMediaFragmentURIParser(nsCString& aRef);
+  explicit nsMediaFragmentURIParser(nsCString& aRef);
 
   // True if a valid temporal media fragment indicated a start time.
   bool HasStartTime() const { return !mStart.empty(); }
diff --git a/netwerk/base/src/nsNetAddr.h b/netwerk/base/src/nsNetAddr.h
index d1cacffd5bf..3d37686dae1 100644
--- a/netwerk/base/src/nsNetAddr.h
+++ b/netwerk/base/src/nsNetAddr.h
@@ -19,7 +19,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSINETADDR
 
-  nsNetAddr(mozilla::net::NetAddr* addr);
+  explicit nsNetAddr(mozilla::net::NetAddr* addr);
 
 private:
   mozilla::net::NetAddr mAddr;
diff --git a/netwerk/base/src/nsPACMan.cpp b/netwerk/base/src/nsPACMan.cpp
index 6dff4fad555..0bc551c5081 100644
--- a/netwerk/base/src/nsPACMan.cpp
+++ b/netwerk/base/src/nsPACMan.cpp
@@ -97,7 +97,7 @@ private:
 class ShutdownThread MOZ_FINAL : public nsRunnable
 {
 public:
-  ShutdownThread(nsIThread *thread)
+  explicit ShutdownThread(nsIThread *thread)
     : mThread(thread)
   {
   }
@@ -122,7 +122,7 @@ private:
 class PACLoadComplete MOZ_FINAL : public nsRunnable
 {
 public:
-  PACLoadComplete(nsPACMan *aPACMan)
+  explicit PACLoadComplete(nsPACMan *aPACMan)
     : mPACMan(aPACMan)
   {
   }
@@ -149,7 +149,7 @@ class ExecutePACThreadAction MOZ_FINAL : public nsRunnable
 {
 public:
   // by default we just process the queue
-  ExecutePACThreadAction(nsPACMan *aPACMan)
+  explicit ExecutePACThreadAction(nsPACMan *aPACMan)
     : mPACMan(aPACMan)
     , mCancel(false)
     , mSetupPAC(false)
diff --git a/netwerk/base/src/nsProxyInfo.h b/netwerk/base/src/nsProxyInfo.h
index e0a46eac29a..bc55180134e 100644
--- a/netwerk/base/src/nsProxyInfo.h
+++ b/netwerk/base/src/nsProxyInfo.h
@@ -44,7 +44,7 @@ public:
 private:
   friend class nsProtocolProxyService;
 
-  nsProxyInfo(const char *type = nullptr)
+  explicit nsProxyInfo(const char *type = nullptr)
     : mType(type)
     , mPort(-1)
     , mFlags(0)
diff --git a/netwerk/base/src/nsRequestObserverProxy.h b/netwerk/base/src/nsRequestObserverProxy.h
index 448e98a47f7..9379268b207 100644
--- a/netwerk/base/src/nsRequestObserverProxy.h
+++ b/netwerk/base/src/nsRequestObserverProxy.h
@@ -41,7 +41,7 @@ protected:
 class nsARequestObserverEvent : public nsRunnable
 {
 public:
-    nsARequestObserverEvent(nsIRequest *);
+    explicit nsARequestObserverEvent(nsIRequest *);
 
 protected:
     virtual ~nsARequestObserverEvent() {}
diff --git a/netwerk/base/src/nsServerSocket.cpp b/netwerk/base/src/nsServerSocket.cpp
index 2dab5eb8066..eb7317d3abd 100644
--- a/netwerk/base/src/nsServerSocket.cpp
+++ b/netwerk/base/src/nsServerSocket.cpp
@@ -410,7 +410,7 @@ class ServerSocketListenerProxy MOZ_FINAL : public nsIServerSocketListener
   ~ServerSocketListenerProxy() {}
 
 public:
-  ServerSocketListenerProxy(nsIServerSocketListener* aListener)
+  explicit ServerSocketListenerProxy(nsIServerSocketListener* aListener)
     : mListener(new nsMainThreadPtrHolder<nsIServerSocketListener>(aListener))
     , mTargetThread(do_GetCurrentThread())
   { }
diff --git a/netwerk/base/src/nsSimpleNestedURI.h b/netwerk/base/src/nsSimpleNestedURI.h
index ab1322645a7..d7e5e1308be 100644
--- a/netwerk/base/src/nsSimpleNestedURI.h
+++ b/netwerk/base/src/nsSimpleNestedURI.h
@@ -35,7 +35,7 @@ public:
 
     // Constructor that should generally be used when constructing an object of
     // this class with |operator new|.
-    nsSimpleNestedURI(nsIURI* innerURI);
+    explicit nsSimpleNestedURI(nsIURI* innerURI);
 
     NS_DECL_ISUPPORTS_INHERITED
     NS_DECL_NSINESTEDURI
diff --git a/netwerk/base/src/nsSocketTransport2.cpp b/netwerk/base/src/nsSocketTransport2.cpp
index 4ee99e58aa1..d3261d02014 100644
--- a/netwerk/base/src/nsSocketTransport2.cpp
+++ b/netwerk/base/src/nsSocketTransport2.cpp
@@ -1194,7 +1194,7 @@ nsSocketTransport::InitiateSocket()
             netaddr->GetAddress(ipaddr);
             fprintf_stderr(stderr,
                            "FATAL ERROR: Non-local network connections are disabled and a connection "
-                           "attempt to %s (%s) was made.\n You should only access hostnames "
+                           "attempt to %s (%s) was made.\nYou should only access hostnames "
                            "available via the test networking proxy (if running mochitests) "
                            "or from a test-specific httpd.js server (if running xpcshell tests). "
                            "Browser services should be disabled or redirected to a local server.\n",
@@ -1608,7 +1608,7 @@ nsSocketTransport::GetFD_Locked()
 class ThunkPRClose : public nsRunnable
 {
 public:
-  ThunkPRClose(PRFileDesc *fd) : mFD(fd) {}
+  explicit ThunkPRClose(PRFileDesc *fd) : mFD(fd) {}
 
   NS_IMETHOD Run()
   {
diff --git a/netwerk/base/src/nsSocketTransport2.h b/netwerk/base/src/nsSocketTransport2.h
index ca2db7e4c1b..d043a1ee8f0 100644
--- a/netwerk/base/src/nsSocketTransport2.h
+++ b/netwerk/base/src/nsSocketTransport2.h
@@ -47,7 +47,7 @@ public:
     NS_DECL_NSIINPUTSTREAM
     NS_DECL_NSIASYNCINPUTSTREAM
 
-    nsSocketInputStream(nsSocketTransport *);
+    explicit nsSocketInputStream(nsSocketTransport *);
     virtual ~nsSocketInputStream();
 
     bool     IsReferenced() { return mReaderRefCnt > 0; }
@@ -77,7 +77,7 @@ public:
     NS_DECL_NSIOUTPUTSTREAM
     NS_DECL_NSIASYNCOUTPUTSTREAM
 
-    nsSocketOutputStream(nsSocketTransport *);
+    explicit nsSocketOutputStream(nsSocketTransport *);
     virtual ~nsSocketOutputStream();
 
     bool     IsReferenced() { return mWriterRefCnt > 0; }
@@ -181,8 +181,8 @@ private:
     public:
       typedef mozilla::MutexAutoLock MutexAutoLock;
 
-      PRFileDescAutoLock(nsSocketTransport *aSocketTransport,
-                         nsresult *aConditionWhileLocked = nullptr)
+      explicit PRFileDescAutoLock(nsSocketTransport *aSocketTransport,
+                                  nsresult *aConditionWhileLocked = nullptr)
         : mSocketTransport(aSocketTransport)
         , mFd(nullptr)
       {
@@ -223,7 +223,7 @@ private:
     class LockedPRFileDesc
     {
     public:
-      LockedPRFileDesc(nsSocketTransport *aSocketTransport)
+      explicit LockedPRFileDesc(nsSocketTransport *aSocketTransport)
         : mSocketTransport(aSocketTransport)
         , mFd(nullptr)
       {
diff --git a/netwerk/base/src/nsStandardURL.h b/netwerk/base/src/nsStandardURL.h
index e70578f87b2..635bfdf4d80 100644
--- a/netwerk/base/src/nsStandardURL.h
+++ b/netwerk/base/src/nsStandardURL.h
@@ -61,7 +61,7 @@ public:
     virtual size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
     virtual size_t SizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
-    nsStandardURL(bool aSupportsFileURL = false);
+    explicit nsStandardURL(bool aSupportsFileURL = false);
 
     static void InitGlobalObjects();
     static void ShutdownGlobalObjects();
@@ -111,7 +111,7 @@ public: /* internal -- HPUX compiler can't handle this being private */
     class nsSegmentEncoder
     {
     public:
-        nsSegmentEncoder(const char *charset);
+        explicit nsSegmentEncoder(const char *charset);
 
         // Encode the given segment if necessary, and return the length of
         // the encoded segment.  The encoded segment is appended to |buf|
diff --git a/netwerk/base/src/nsTemporaryFileInputStream.h b/netwerk/base/src/nsTemporaryFileInputStream.h
index 2b124cd21e2..d63f48b288f 100644
--- a/netwerk/base/src/nsTemporaryFileInputStream.h
+++ b/netwerk/base/src/nsTemporaryFileInputStream.h
@@ -20,7 +20,7 @@ public:
     friend class nsTemporaryFileInputStream;
   public:
     NS_INLINE_DECL_THREADSAFE_REFCOUNTING(FileDescOwner)
-    FileDescOwner(PRFileDesc* aFD)
+    explicit FileDescOwner(PRFileDesc* aFD)
       : mFD(aFD),
         mMutex("FileDescOwner::mMutex")
     {
diff --git a/netwerk/base/src/nsUDPSocket.cpp b/netwerk/base/src/nsUDPSocket.cpp
index 481c0766cfb..7a9705674aa 100644
--- a/netwerk/base/src/nsUDPSocket.cpp
+++ b/netwerk/base/src/nsUDPSocket.cpp
@@ -685,7 +685,7 @@ class SocketListenerProxy MOZ_FINAL : public nsIUDPSocketListener
   ~SocketListenerProxy() {}
 
 public:
-  SocketListenerProxy(nsIUDPSocketListener* aListener)
+  explicit SocketListenerProxy(nsIUDPSocketListener* aListener)
     : mListener(new nsMainThreadPtrHolder<nsIUDPSocketListener>(aListener))
     , mTargetThread(do_GetCurrentThread())
   { }
diff --git a/netwerk/cache/nsCacheEntry.h b/netwerk/cache/nsCacheEntry.h
index 408edf811a8..6772ab513b8 100644
--- a/netwerk/cache/nsCacheEntry.h
+++ b/netwerk/cache/nsCacheEntry.h
@@ -238,7 +238,7 @@ public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSICACHEENTRYINFO
 
-    nsCacheEntryInfo(nsCacheEntry* entry)
+    explicit nsCacheEntryInfo(nsCacheEntry* entry)
         :   mCacheEntry(entry)
     {
     }
diff --git a/netwerk/cache/nsCacheService.cpp b/netwerk/cache/nsCacheService.cpp
index f941596e79b..2e5eebdc200 100644
--- a/netwerk/cache/nsCacheService.cpp
+++ b/netwerk/cache/nsCacheService.cpp
@@ -227,7 +227,7 @@ NS_IMPL_ISUPPORTS(nsSetDiskSmartSizeCallback, nsITimerCallback)
 class nsSetSmartSizeEvent: public nsRunnable 
 {
 public:
-    nsSetSmartSizeEvent(int32_t smartSize)
+    explicit nsSetSmartSizeEvent(int32_t smartSize)
         : mSmartSize(smartSize) {}
 
     NS_IMETHOD Run() 
@@ -974,7 +974,7 @@ nsCacheProfilePrefObserver::CacheCompressionLevel()
 
 class nsProcessRequestEvent : public nsRunnable {
 public:
-    nsProcessRequestEvent(nsCacheRequest *aRequest)
+    explicit nsProcessRequestEvent(nsCacheRequest *aRequest)
     {
         MOZ_EVENT_TRACER_NAME_OBJECT(aRequest, aRequest->mKey.get());
         MOZ_EVENT_TRACER_WAIT(aRequest, "net::cache::ProcessRequest");
@@ -1347,7 +1347,7 @@ namespace {
 class EvictionNotifierRunnable : public nsRunnable
 {
 public:
-    EvictionNotifierRunnable(nsISupports* aSubject)
+    explicit EvictionNotifierRunnable(nsISupports* aSubject)
         : mSubject(aSubject)
     { }
 
diff --git a/netwerk/cache/nsCacheService.h b/netwerk/cache/nsCacheService.h
index f6f44447d53..a54b584f85b 100644
--- a/netwerk/cache/nsCacheService.h
+++ b/netwerk/cache/nsCacheService.h
@@ -393,7 +393,7 @@ private:
 // execution scope.
 class nsCacheServiceAutoLock {
 public:
-    nsCacheServiceAutoLock(mozilla::Telemetry::ID mainThreadLockerID) {
+    explicit nsCacheServiceAutoLock(mozilla::Telemetry::ID mainThreadLockerID) {
         nsCacheService::Lock(mainThreadLockerID);
     }
     ~nsCacheServiceAutoLock() {
diff --git a/netwerk/cache/nsCacheUtils.cpp b/netwerk/cache/nsCacheUtils.cpp
index 89f04506866..536052ada67 100644
--- a/netwerk/cache/nsCacheUtils.cpp
+++ b/netwerk/cache/nsCacheUtils.cpp
@@ -12,7 +12,7 @@ using namespace mozilla;
 
 class nsDestroyThreadEvent : public nsRunnable {
 public:
-  nsDestroyThreadEvent(nsIThread *thread)
+  explicit nsDestroyThreadEvent(nsIThread *thread)
     : mThread(thread)
   {}
   NS_IMETHOD Run()
diff --git a/netwerk/cache/nsCacheUtils.h b/netwerk/cache/nsCacheUtils.h
index 611a41575e3..1ce27de8b4c 100644
--- a/netwerk/cache/nsCacheUtils.h
+++ b/netwerk/cache/nsCacheUtils.h
@@ -19,7 +19,7 @@ class nsIThread;
   */
 class nsShutdownThread : public nsRunnable {
 public:
-  nsShutdownThread(nsIThread *aThread);
+  explicit nsShutdownThread(nsIThread *aThread);
   ~nsShutdownThread();
 
   NS_IMETHOD Run();
diff --git a/netwerk/cache/nsDiskCacheDevice.cpp b/netwerk/cache/nsDiskCacheDevice.cpp
index 3adc71e351f..771414107f9 100644
--- a/netwerk/cache/nsDiskCacheDevice.cpp
+++ b/netwerk/cache/nsDiskCacheDevice.cpp
@@ -84,7 +84,7 @@ private:
 
 class nsEvictDiskCacheEntriesEvent : public nsRunnable {
 public:
-    nsEvictDiskCacheEntriesEvent(nsDiskCacheDevice *device)
+    explicit nsEvictDiskCacheEntriesEvent(nsDiskCacheDevice *device)
         : mDevice(device) {}
 
     NS_IMETHOD Run()
@@ -182,7 +182,7 @@ public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSICACHEDEVICEINFO
 
-    nsDiskCacheDeviceInfo(nsDiskCacheDevice* device)
+    explicit nsDiskCacheDeviceInfo(nsDiskCacheDevice* device)
         :   mDevice(device)
     {
     }
diff --git a/netwerk/cache/nsDiskCacheDeviceSQL.cpp b/netwerk/cache/nsDiskCacheDeviceSQL.cpp
index 50706cbd0e8..57f6728e867 100644
--- a/netwerk/cache/nsDiskCacheDeviceSQL.cpp
+++ b/netwerk/cache/nsDiskCacheDeviceSQL.cpp
@@ -91,7 +91,7 @@ DecomposeCacheEntryKey(const nsCString *fullKey,
 class AutoResetStatement
 {
   public:
-    AutoResetStatement(mozIStorageStatement *s)
+    explicit AutoResetStatement(mozIStorageStatement *s)
       : mStatement(s) {}
     ~AutoResetStatement() { mStatement->Reset(); }
     mozIStorageStatement *operator->() { return mStatement; }
@@ -275,7 +275,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSICACHEDEVICEINFO
 
-  nsOfflineCacheDeviceInfo(nsOfflineCacheDevice* device)
+  explicit nsOfflineCacheDeviceInfo(nsOfflineCacheDevice* device)
     : mDevice(device)
   {}
 
@@ -861,7 +861,7 @@ nsApplicationCache::GetUsage(uint32_t *usage)
 
 class nsCloseDBEvent : public nsRunnable {
 public:
-  nsCloseDBEvent(mozIStorageConnection *aDB)
+  explicit nsCloseDBEvent(mozIStorageConnection *aDB)
   {
     mDB = aDB;
   }
diff --git a/netwerk/cache/nsDiskCacheDeviceSQL.h b/netwerk/cache/nsDiskCacheDeviceSQL.h
index 2f16a3f6271..895068b5ef5 100644
--- a/netwerk/cache/nsDiskCacheDeviceSQL.h
+++ b/netwerk/cache/nsDiskCacheDeviceSQL.h
@@ -47,7 +47,7 @@ public:
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_MOZISTORAGEFUNCTION
 
-  nsOfflineCacheEvictionFunction(nsOfflineCacheDevice *device)
+  explicit nsOfflineCacheEvictionFunction(nsOfflineCacheDevice *device)
     : mDevice(device)
   {}
 
diff --git a/netwerk/cache/nsDiskCacheStreams.h b/netwerk/cache/nsDiskCacheStreams.h
index 8cde75db091..5017eed8072 100644
--- a/netwerk/cache/nsDiskCacheStreams.h
+++ b/netwerk/cache/nsDiskCacheStreams.h
@@ -23,7 +23,7 @@ class nsDiskCacheDevice;
 
 class nsDiskCacheStreamIO : public nsIOutputStream {
 public:
-    nsDiskCacheStreamIO(nsDiskCacheBinding *   binding);
+    explicit nsDiskCacheStreamIO(nsDiskCacheBinding *   binding);
     
     NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIOUTPUTSTREAM
diff --git a/netwerk/cache/nsMemoryCacheDevice.h b/netwerk/cache/nsMemoryCacheDevice.h
index 472fb9483d4..165a2b76438 100644
--- a/netwerk/cache/nsMemoryCacheDevice.h
+++ b/netwerk/cache/nsMemoryCacheDevice.h
@@ -110,7 +110,7 @@ public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSICACHEDEVICEINFO
 
-    nsMemoryCacheDeviceInfo(nsMemoryCacheDevice* device)
+    explicit nsMemoryCacheDeviceInfo(nsMemoryCacheDevice* device)
         :   mDevice(device)
     {
     }
diff --git a/netwerk/cache2/CacheEntry.h b/netwerk/cache2/CacheEntry.h
index bd4db8a577a..0235b157d89 100644
--- a/netwerk/cache2/CacheEntry.h
+++ b/netwerk/cache2/CacheEntry.h
@@ -354,7 +354,7 @@ private:
 class CacheEntryHandle : public nsICacheEntry
 {
 public:
-  CacheEntryHandle(CacheEntry* aEntry);
+  explicit CacheEntryHandle(CacheEntry* aEntry);
   CacheEntry* Entry() const { return mEntry; }
 
   NS_DECL_THREADSAFE_ISUPPORTS
@@ -376,7 +376,7 @@ private:
   virtual ~CacheOutputCloseListener();
 
   NS_DECL_NSIRUNNABLE
-  CacheOutputCloseListener(CacheEntry* aEntry);
+  explicit CacheOutputCloseListener(CacheEntry* aEntry);
 
 private:
   nsRefPtr<CacheEntry> mEntry;
diff --git a/netwerk/cache2/CacheFile.cpp b/netwerk/cache2/CacheFile.cpp
index a398bb3941b..a5766fb6045 100644
--- a/netwerk/cache2/CacheFile.cpp
+++ b/netwerk/cache2/CacheFile.cpp
@@ -110,7 +110,7 @@ class DoomFileHelper : public CacheFileIOListener
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
 
-  DoomFileHelper(CacheFileListener *aListener)
+  explicit DoomFileHelper(CacheFileListener *aListener)
     : mListener(aListener)
   {
     MOZ_COUNT_CTOR(DoomFileHelper);
@@ -409,7 +409,7 @@ CacheFile::OnFileOpened(CacheFileHandle *aHandle, nsresult aResult)
   class AutoFailDoomListener
   {
   public:
-    AutoFailDoomListener(CacheFileHandle *aHandle)
+    explicit AutoFailDoomListener(CacheFileHandle *aHandle)
       : mHandle(aHandle)
       , mAlreadyDoomed(false)
     {}
diff --git a/netwerk/cache2/CacheFile.h b/netwerk/cache2/CacheFile.h
index d9f9f71a7dc..5c4e0f4de11 100644
--- a/netwerk/cache2/CacheFile.h
+++ b/netwerk/cache2/CacheFile.h
@@ -219,7 +219,7 @@ private:
 
 class CacheFileAutoLock {
 public:
-  CacheFileAutoLock(CacheFile *aFile)
+  explicit CacheFileAutoLock(CacheFile *aFile)
     : mFile(aFile)
     , mLocked(true)
   {
diff --git a/netwerk/cache2/CacheFileIOManager.cpp b/netwerk/cache2/CacheFileIOManager.cpp
index db49a238718..08aa54be8bf 100644
--- a/netwerk/cache2/CacheFileIOManager.cpp
+++ b/netwerk/cache2/CacheFileIOManager.cpp
@@ -906,7 +906,7 @@ protected:
 
 class ReleaseNSPRHandleEvent : public nsRunnable {
 public:
-  ReleaseNSPRHandleEvent(CacheFileHandle *aHandle)
+  explicit ReleaseNSPRHandleEvent(CacheFileHandle *aHandle)
     : mHandle(aHandle)
   {
     MOZ_COUNT_CTOR(ReleaseNSPRHandleEvent);
diff --git a/netwerk/cache2/CacheFileIOManager.h b/netwerk/cache2/CacheFileIOManager.h
index 00c0d454c7b..2ca76ec9497 100644
--- a/netwerk/cache2/CacheFileIOManager.h
+++ b/netwerk/cache2/CacheFileIOManager.h
@@ -112,7 +112,7 @@ public:
     typedef const SHA1Sum::Hash& KeyType;
     typedef const SHA1Sum::Hash* KeyTypePointer;
 
-    HandleHashKey(KeyTypePointer aKey)
+    explicit HandleHashKey(KeyTypePointer aKey)
     {
       MOZ_COUNT_CTOR(HandleHashKey);
       mHash = (SHA1Sum::Hash*)new uint8_t[SHA1Sum::kHashSize];
diff --git a/netwerk/cache2/CacheFileInputStream.h b/netwerk/cache2/CacheFileInputStream.h
index a62efdd564b..d920493b859 100644
--- a/netwerk/cache2/CacheFileInputStream.h
+++ b/netwerk/cache2/CacheFileInputStream.h
@@ -27,7 +27,7 @@ class CacheFileInputStream : public nsIAsyncInputStream
   NS_DECL_NSISEEKABLESTREAM
 
 public:
-  CacheFileInputStream(CacheFile *aFile);
+  explicit CacheFileInputStream(CacheFile *aFile);
 
   NS_IMETHOD OnChunkRead(nsresult aResult, CacheFileChunk *aChunk);
   NS_IMETHOD OnChunkWritten(nsresult aResult, CacheFileChunk *aChunk);
diff --git a/netwerk/cache2/CacheHashUtils.h b/netwerk/cache2/CacheHashUtils.h
index ed3013355d3..4e25e25511b 100644
--- a/netwerk/cache2/CacheHashUtils.h
+++ b/netwerk/cache2/CacheHashUtils.h
@@ -35,7 +35,7 @@ public:
   static Hash16_t Hash16(const char* aData, uint32_t aSize,
                          uint32_t aInitval=0);
 
-  CacheHash(uint32_t aInitval=0);
+  explicit CacheHash(uint32_t aInitval=0);
 
   void     Update(const char *aData, uint32_t aLen);
   Hash32_t GetHash();
diff --git a/netwerk/cache2/CacheIndex.cpp b/netwerk/cache2/CacheIndex.cpp
index 5a0aa9dcab3..aa493e5d635 100644
--- a/netwerk/cache2/CacheIndex.cpp
+++ b/netwerk/cache2/CacheIndex.cpp
@@ -166,7 +166,7 @@ class FileOpenHelper : public CacheFileIOListener
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
 
-  FileOpenHelper(CacheIndex* aIndex)
+  explicit FileOpenHelper(CacheIndex* aIndex)
     : mIndex(aIndex)
     , mCanceled(false)
   {}
@@ -1822,7 +1822,7 @@ CacheIndex::RemoveIndexFromDisk()
 class WriteLogHelper
 {
 public:
-  WriteLogHelper(PRFileDesc *aFD)
+  explicit WriteLogHelper(PRFileDesc *aFD)
     : mStatus(NS_OK)
     , mFD(aFD)
     , mBufSize(kMaxBufSize)
diff --git a/netwerk/cache2/CacheIndex.h b/netwerk/cache2/CacheIndex.h
index 928cac3830b..3bf8f286094 100644
--- a/netwerk/cache2/CacheIndex.h
+++ b/netwerk/cache2/CacheIndex.h
@@ -87,7 +87,7 @@ public:
   typedef const SHA1Sum::Hash& KeyType;
   typedef const SHA1Sum::Hash* KeyTypePointer;
 
-  CacheIndexEntry(KeyTypePointer aKey)
+  explicit CacheIndexEntry(KeyTypePointer aKey)
   {
     MOZ_COUNT_CTOR(CacheIndexEntry);
     mRec = new CacheIndexRecord();
@@ -970,7 +970,7 @@ private:
     }
 
   private:
-    DiskConsumptionObserver(nsWeakPtr const &aWeakObserver)
+    explicit DiskConsumptionObserver(nsWeakPtr const &aWeakObserver)
       : mObserver(aWeakObserver) { }
     virtual ~DiskConsumptionObserver() { }
 
@@ -998,7 +998,7 @@ private:
 
 class CacheIndexAutoLock {
 public:
-  CacheIndexAutoLock(CacheIndex *aIndex)
+  explicit CacheIndexAutoLock(CacheIndex *aIndex)
     : mIndex(aIndex)
     , mLocked(true)
   {
@@ -1030,7 +1030,7 @@ private:
 
 class CacheIndexAutoUnlock {
 public:
-  CacheIndexAutoUnlock(CacheIndex *aIndex)
+  explicit CacheIndexAutoUnlock(CacheIndex *aIndex)
     : mIndex(aIndex)
     , mLocked(false)
   {
diff --git a/netwerk/cache2/CacheStorage.h b/netwerk/cache2/CacheStorage.h
index d86a9feec59..617af805d46 100644
--- a/netwerk/cache2/CacheStorage.h
+++ b/netwerk/cache2/CacheStorage.h
@@ -34,7 +34,7 @@ public:
     ALL_ENTRIES
   };
 
-  CacheEntryTable(EType aType) : mType(aType) { }
+  explicit CacheEntryTable(EType aType) : mType(aType) { }
   EType Type() const
   {
     return mType;
diff --git a/netwerk/cache2/CacheStorageService.cpp b/netwerk/cache2/CacheStorageService.cpp
index 146354570e7..ddd45b1004a 100644
--- a/netwerk/cache2/CacheStorageService.cpp
+++ b/netwerk/cache2/CacheStorageService.cpp
@@ -357,7 +357,7 @@ private:
   class OnCacheEntryInfoRunnable : public nsRunnable
   {
   public:
-    OnCacheEntryInfoRunnable(WalkDiskCacheRunnable* aWalker)
+    explicit OnCacheEntryInfoRunnable(WalkDiskCacheRunnable* aWalker)
       : mWalker(aWalker)
     {
     }
@@ -1498,7 +1498,7 @@ class CacheEntryDoomByKeyCallback : public CacheFileIOListener
 public:
   NS_DECL_THREADSAFE_ISUPPORTS
 
-  CacheEntryDoomByKeyCallback(nsICacheEntryDoomCallback* aCallback)
+  explicit CacheEntryDoomByKeyCallback(nsICacheEntryDoomCallback* aCallback)
     : mCallback(aCallback) { }
 
 private:
@@ -1688,7 +1688,7 @@ CacheStorageService::DoomStorageEntries(nsCSubstring const& aContextKey,
   class Callback : public nsRunnable
   {
   public:
-    Callback(nsICacheEntryDoomCallback* aCallback) : mCallback(aCallback) { }
+    explicit Callback(nsICacheEntryDoomCallback* aCallback) : mCallback(aCallback) { }
     NS_IMETHODIMP Run()
     {
       mCallback->OnCacheEntryDoomed(NS_OK);
diff --git a/netwerk/cache2/CacheStorageService.h b/netwerk/cache2/CacheStorageService.h
index 379deb4e753..f604a5bcf4a 100644
--- a/netwerk/cache2/CacheStorageService.h
+++ b/netwerk/cache2/CacheStorageService.h
@@ -59,7 +59,7 @@ protected:
     DONT_REPORT = 1 << 1
   };
 
-  CacheMemoryConsumer(uint32_t aFlags);
+  explicit CacheMemoryConsumer(uint32_t aFlags);
   ~CacheMemoryConsumer() { DoMemoryReport(0); }
   void DoMemoryReport(uint32_t aCurrentSize);
 };
@@ -306,7 +306,7 @@ private:
       MEMORY,
     } mType;
 
-    MemoryPool(EType aType);
+    explicit MemoryPool(EType aType);
     ~MemoryPool();
 
     nsTArray<nsRefPtr<CacheEntry> > mFrecencyArray;
diff --git a/netwerk/cache2/OldWrappers.cpp b/netwerk/cache2/OldWrappers.cpp
index 5b485072e27..1022ed1f920 100644
--- a/netwerk/cache2/OldWrappers.cpp
+++ b/netwerk/cache2/OldWrappers.cpp
@@ -39,7 +39,7 @@ namespace { // anon
 class DoomCallbackSynchronizer : public nsRunnable
 {
 public:
-  DoomCallbackSynchronizer(nsICacheEntryDoomCallback* cb) : mCB(cb)
+  explicit DoomCallbackSynchronizer(nsICacheEntryDoomCallback* cb) : mCB(cb)
   {
     MOZ_COUNT_CTOR(DoomCallbackSynchronizer);
   }
@@ -92,7 +92,7 @@ class DoomCallbackWrapper : public nsICacheListener
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSICACHELISTENER
 
-  DoomCallbackWrapper(nsICacheEntryDoomCallback* cb) : mCB(cb)
+  explicit DoomCallbackWrapper(nsICacheEntryDoomCallback* cb) : mCB(cb)
   {
     MOZ_COUNT_CTOR(DoomCallbackWrapper);
   }
@@ -498,7 +498,7 @@ class MetaDataVisitorWrapper : public nsICacheMetaDataVisitor
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSICACHEMETADATAVISITOR
-  MetaDataVisitorWrapper(nsICacheEntryMetaDataVisitor* cb) : mCB(cb) {}
+  explicit MetaDataVisitorWrapper(nsICacheEntryMetaDataVisitor* cb) : mCB(cb) {}
   nsCOMPtr<nsICacheEntryMetaDataVisitor> mCB;
 };
 
diff --git a/netwerk/cache2/OldWrappers.h b/netwerk/cache2/OldWrappers.h
index 79b05cb1913..98be07e7636 100644
--- a/netwerk/cache2/OldWrappers.h
+++ b/netwerk/cache2/OldWrappers.h
@@ -45,8 +45,8 @@ public:
   NS_IMETHOD HasWriteAccess(bool aWriteOnly, bool *aWriteAccess);
   NS_IMETHOD VisitMetaData(nsICacheEntryMetaDataVisitor*);
 
-  _OldCacheEntryWrapper(nsICacheEntryDescriptor* desc);
-  _OldCacheEntryWrapper(nsICacheEntryInfo* info);
+  explicit _OldCacheEntryWrapper(nsICacheEntryDescriptor* desc);
+  explicit _OldCacheEntryWrapper(nsICacheEntryInfo* info);
 
 private:
   virtual ~_OldCacheEntryWrapper();
@@ -162,7 +162,7 @@ public:
   static nsresult Get(nsICacheStorageConsumptionObserver* aCallback);
 
 private:
-  _OldGetDiskConsumption(nsICacheStorageConsumptionObserver* aCallback);
+  explicit _OldGetDiskConsumption(nsICacheStorageConsumptionObserver* aCallback);
   virtual ~_OldGetDiskConsumption() {}
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSICACHEVISITOR
diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp
index db32fa5b391..043898dac8e 100644
--- a/netwerk/cookie/nsCookieService.cpp
+++ b/netwerk/cookie/nsCookieService.cpp
@@ -357,7 +357,7 @@ LogSuccess(bool aSetCookie, nsIURI *aHostURI, const nsAFlatCString &aCookieStrin
 class DBListenerErrorHandler : public mozIStorageStatementCallback
 {
 protected:
-  DBListenerErrorHandler(DBState* dbState) : mDBState(dbState) { }
+  explicit DBListenerErrorHandler(DBState* dbState) : mDBState(dbState) { }
   nsRefPtr<DBState> mDBState;
   virtual const char *GetOpType() = 0;
 
@@ -397,7 +397,7 @@ private:
 public:
   NS_DECL_ISUPPORTS
 
-  InsertCookieDBListener(DBState* dbState) : DBListenerErrorHandler(dbState) { }
+  explicit InsertCookieDBListener(DBState* dbState) : DBListenerErrorHandler(dbState) { }
   NS_IMETHOD HandleResult(mozIStorageResultSet*)
   {
     NS_NOTREACHED("Unexpected call to InsertCookieDBListener::HandleResult");
@@ -433,7 +433,7 @@ private:
 public:
   NS_DECL_ISUPPORTS
 
-  UpdateCookieDBListener(DBState* dbState) : DBListenerErrorHandler(dbState) { }
+  explicit UpdateCookieDBListener(DBState* dbState) : DBListenerErrorHandler(dbState) { }
   NS_IMETHOD HandleResult(mozIStorageResultSet*)
   {
     NS_NOTREACHED("Unexpected call to UpdateCookieDBListener::HandleResult");
@@ -461,7 +461,7 @@ private:
 public:
   NS_DECL_ISUPPORTS
 
-  RemoveCookieDBListener(DBState* dbState) : DBListenerErrorHandler(dbState) { }
+  explicit RemoveCookieDBListener(DBState* dbState) : DBListenerErrorHandler(dbState) { }
   NS_IMETHOD HandleResult(mozIStorageResultSet*)
   {
     NS_NOTREACHED("Unexpected call to RemoveCookieDBListener::HandleResult");
@@ -490,7 +490,7 @@ private:
 public:
   NS_DECL_ISUPPORTS
 
-  ReadCookieDBListener(DBState* dbState)
+  explicit ReadCookieDBListener(DBState* dbState)
     : DBListenerErrorHandler(dbState)
     , mCanceled(false)
   {
@@ -566,7 +566,7 @@ class CloseCookieDBListener MOZ_FINAL :  public mozIStorageCompletionCallback
   ~CloseCookieDBListener() {}
 
 public:
-  CloseCookieDBListener(DBState* dbState) : mDBState(dbState) { }
+  explicit CloseCookieDBListener(DBState* dbState) : mDBState(dbState) { }
   nsRefPtr<DBState> mDBState;
   NS_DECL_ISUPPORTS
 
@@ -1484,7 +1484,7 @@ RebuildDBCallback(nsCookieEntry *aEntry,
     nsCookie* cookie = cookies[i];
 
     if (!cookie->IsSession()) {
-      bindCookieParameters(paramsArray, aEntry, cookie);
+      bindCookieParameters(paramsArray, nsCookieKey(aEntry), cookie);
     }
   }
 
diff --git a/netwerk/cookie/nsCookieService.h b/netwerk/cookie/nsCookieService.h
index 50033dd3f0a..4809be87333 100644
--- a/netwerk/cookie/nsCookieService.h
+++ b/netwerk/cookie/nsCookieService.h
@@ -66,7 +66,7 @@ public:
     , mInBrowserElement(inBrowser)
   {}
 
-  nsCookieKey(KeyTypePointer other)
+  explicit nsCookieKey(KeyTypePointer other)
     : mBaseDomain(other->mBaseDomain)
     , mAppId(other->mAppId)
     , mInBrowserElement(other->mInBrowserElement)
@@ -122,7 +122,7 @@ class nsCookieEntry : public nsCookieKey
     typedef nsTArray< nsRefPtr<nsCookie> > ArrayType;
     typedef ArrayType::index_type IndexType;
 
-    nsCookieEntry(KeyTypePointer aKey)
+    explicit nsCookieEntry(KeyTypePointer aKey)
      : nsCookieKey(aKey)
     {}
 
diff --git a/netwerk/dns/DNS.h b/netwerk/dns/DNS.h
index 35df4ef0878..e3beaf5646b 100644
--- a/netwerk/dns/DNS.h
+++ b/netwerk/dns/DNS.h
@@ -118,7 +118,7 @@ union NetAddr {
 // which is converted to a mozilla::dns::NetAddr.
 class NetAddrElement : public LinkedListElement<NetAddrElement> {
 public:
-  NetAddrElement(const PRNetAddr *prNetAddr);
+  explicit NetAddrElement(const PRNetAddr *prNetAddr);
   NetAddrElement(const NetAddrElement& netAddr);
   ~NetAddrElement();
 
diff --git a/netwerk/dns/nsDNSService2.cpp b/netwerk/dns/nsDNSService2.cpp
index 573a70e2da9..aafbdb9d89f 100644
--- a/netwerk/dns/nsDNSService2.cpp
+++ b/netwerk/dns/nsDNSService2.cpp
@@ -57,7 +57,7 @@ public:
     NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSIDNSRECORD
 
-    nsDNSRecord(nsHostRecord *hostRecord)
+    explicit nsDNSRecord(nsHostRecord *hostRecord)
         : mHostRecord(hostRecord)
         , mIter(nullptr)
         , mIterGenCnt(-1)
@@ -342,7 +342,7 @@ nsDNSAsyncRequest::Cancel(nsresult reason)
 class nsDNSSyncRequest : public nsResolveHostCallback
 {
 public:
-    nsDNSSyncRequest(PRMonitor *mon)
+    explicit nsDNSSyncRequest(PRMonitor *mon)
         : mDone(false)
         , mStatus(NS_OK)
         , mMonitor(mon) {}
diff --git a/netwerk/dns/nsEffectiveTLDService.h b/netwerk/dns/nsEffectiveTLDService.h
index e900efdf14d..e807e46015b 100644
--- a/netwerk/dns/nsEffectiveTLDService.h
+++ b/netwerk/dns/nsEffectiveTLDService.h
@@ -36,7 +36,7 @@ public:
   typedef const char* KeyType;
   typedef const char* KeyTypePointer;
 
-  nsDomainEntry(KeyTypePointer aEntry)
+  explicit nsDomainEntry(KeyTypePointer aEntry)
   {
   }
 
diff --git a/netwerk/dns/nsHostResolver.h b/netwerk/dns/nsHostResolver.h
index b894da6f5fa..3c60152eab5 100644
--- a/netwerk/dns/nsHostResolver.h
+++ b/netwerk/dns/nsHostResolver.h
@@ -106,7 +106,7 @@ private:
     // of gencnt.
     nsTArray<nsCString> mBlacklistedItems;
 
-    nsHostRecord(const nsHostKey *key);           /* use Create() instead */
+    explicit nsHostRecord(const nsHostKey *key);           /* use Create() instead */
    ~nsHostRecord();
 };
 
@@ -239,8 +239,8 @@ public:
     size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
 
 private:
-    nsHostResolver(uint32_t maxCacheEntries = 50, uint32_t maxCacheLifetime = 60,
-                   uint32_t lifetimeGracePeriod = 0);
+   explicit nsHostResolver(uint32_t maxCacheEntries = 50, uint32_t maxCacheLifetime = 60,
+                            uint32_t lifetimeGracePeriod = 0);
    ~nsHostResolver();
 
     nsresult Init();
diff --git a/netwerk/ipc/ChannelEventQueue.h b/netwerk/ipc/ChannelEventQueue.h
index ac2a0935d03..3b654a4b566 100644
--- a/netwerk/ipc/ChannelEventQueue.h
+++ b/netwerk/ipc/ChannelEventQueue.h
@@ -40,7 +40,7 @@ class ChannelEventQueue MOZ_FINAL
   NS_INLINE_DECL_REFCOUNTING(ChannelEventQueue)
 
  public:
-  ChannelEventQueue(nsISupports *owner)
+  explicit ChannelEventQueue(nsISupports *owner)
     : mSuspendCount(0)
     , mSuspended(false)
     , mForced(false)
@@ -165,7 +165,7 @@ ChannelEventQueue::MaybeFlushQueue()
 class AutoEventEnqueuer
 {
  public:
-  AutoEventEnqueuer(ChannelEventQueue *queue) : mEventQueue(queue) {
+  explicit AutoEventEnqueuer(ChannelEventQueue *queue) : mEventQueue(queue) {
     mEventQueue->StartForcedQueueing();
   }
   ~AutoEventEnqueuer() {
diff --git a/netwerk/ipc/RemoteOpenFileParent.h b/netwerk/ipc/RemoteOpenFileParent.h
index 644afa357b9..4564ca1f381 100644
--- a/netwerk/ipc/RemoteOpenFileParent.h
+++ b/netwerk/ipc/RemoteOpenFileParent.h
@@ -18,7 +18,7 @@ namespace net {
 class RemoteOpenFileParent : public PRemoteOpenFileParent
 {
 public:
-  RemoteOpenFileParent(nsIFileURL* aURI)
+  explicit RemoteOpenFileParent(nsIFileURL* aURI)
   : mURI(aURI)
   {}
 
diff --git a/netwerk/protocol/data/nsDataChannel.h b/netwerk/protocol/data/nsDataChannel.h
index d39b9920462..7fdab0e2e8e 100644
--- a/netwerk/protocol/data/nsDataChannel.h
+++ b/netwerk/protocol/data/nsDataChannel.h
@@ -14,7 +14,7 @@ class nsIInputStream;
 
 class nsDataChannel : public nsBaseChannel {
 public:
-    nsDataChannel(nsIURI *uri) {
+    explicit nsDataChannel(nsIURI *uri) {
         SetURI(uri);
     }
 
diff --git a/netwerk/protocol/file/nsFileChannel.h b/netwerk/protocol/file/nsFileChannel.h
index f38665746d8..8a5e7e91f56 100644
--- a/netwerk/protocol/file/nsFileChannel.h
+++ b/netwerk/protocol/file/nsFileChannel.h
@@ -20,7 +20,7 @@ public:
   NS_DECL_NSIFILECHANNEL
   NS_DECL_NSIUPLOADCHANNEL
 
-  nsFileChannel(nsIURI *uri);
+  explicit nsFileChannel(nsIURI *uri);
 
 protected:
   ~nsFileChannel();
diff --git a/netwerk/protocol/ftp/FTPChannelChild.cpp b/netwerk/protocol/ftp/FTPChannelChild.cpp
index 1e29c111b92..06927f0a281 100644
--- a/netwerk/protocol/ftp/FTPChannelChild.cpp
+++ b/netwerk/protocol/ftp/FTPChannelChild.cpp
@@ -544,7 +544,7 @@ FTPChannelChild::DoFailedAsyncOpen(const nsresult& statusCode)
 class FTPFlushedForDiversionEvent : public ChannelEvent
 {
  public:
-  FTPFlushedForDiversionEvent(FTPChannelChild* aChild)
+  explicit FTPFlushedForDiversionEvent(FTPChannelChild* aChild)
   : mChild(aChild)
   {
     MOZ_RELEASE_ASSERT(aChild);
@@ -601,7 +601,7 @@ FTPChannelChild::RecvDivertMessages()
 class FTPDeleteSelfEvent : public ChannelEvent
 {
  public:
-  FTPDeleteSelfEvent(FTPChannelChild* aChild)
+  explicit FTPDeleteSelfEvent(FTPChannelChild* aChild)
   : mChild(aChild) {}
   void Run() { mChild->DoDeleteSelf(); }
  private:
diff --git a/netwerk/protocol/ftp/FTPChannelChild.h b/netwerk/protocol/ftp/FTPChannelChild.h
index 2cdf02676ed..c578b67548b 100644
--- a/netwerk/protocol/ftp/FTPChannelChild.h
+++ b/netwerk/protocol/ftp/FTPChannelChild.h
@@ -53,7 +53,7 @@ public:
   NS_IMETHOD Suspend();
   NS_IMETHOD Resume();
 
-  FTPChannelChild(nsIURI* uri);
+  explicit FTPChannelChild(nsIURI* uri);
 
   void AddIPDLReference();
   void ReleaseIPDLReference();
diff --git a/netwerk/protocol/ftp/nsFTPChannel.cpp b/netwerk/protocol/ftp/nsFTPChannel.cpp
index d4cafa2860c..4932abd926b 100644
--- a/netwerk/protocol/ftp/nsFTPChannel.cpp
+++ b/netwerk/protocol/ftp/nsFTPChannel.cpp
@@ -136,7 +136,7 @@ class FTPEventSinkProxy MOZ_FINAL : public nsIFTPEventSink
     ~FTPEventSinkProxy() {}
 
 public:
-    FTPEventSinkProxy(nsIFTPEventSink* aTarget)
+    explicit FTPEventSinkProxy(nsIFTPEventSink* aTarget)
         : mTarget(aTarget)
         , mTargetThread(do_GetCurrentThread())
     { }
diff --git a/netwerk/protocol/http/Http2Session.h b/netwerk/protocol/http/Http2Session.h
index 90ab1c7020a..fd98b11e121 100644
--- a/netwerk/protocol/http/Http2Session.h
+++ b/netwerk/protocol/http/Http2Session.h
@@ -41,7 +41,7 @@ public:
   NS_DECL_NSAHTTPSEGMENTREADER
   NS_DECL_NSAHTTPSEGMENTWRITER
 
-  Http2Session(nsISocketTransport *);
+  explicit Http2Session(nsISocketTransport *);
 
   bool AddStream(nsAHttpTransaction *, int32_t,
                  bool, nsIInterfaceRequestor *);
diff --git a/netwerk/protocol/http/HttpBaseChannel.h b/netwerk/protocol/http/HttpBaseChannel.h
index 0e1d6b68385..e2da7b14ce7 100644
--- a/netwerk/protocol/http/HttpBaseChannel.h
+++ b/netwerk/protocol/http/HttpBaseChannel.h
@@ -393,7 +393,7 @@ template <class T>
 class HttpAsyncAborter
 {
 public:
-  HttpAsyncAborter(T *derived) : mThis(derived), mCallOnResume(0) {}
+  explicit HttpAsyncAborter(T *derived) : mThis(derived), mCallOnResume(0) {}
 
   // Aborts channel: calls OnStart/Stop with provided status, removes channel
   // from loadGroup.
diff --git a/netwerk/protocol/http/HttpChannelChild.cpp b/netwerk/protocol/http/HttpChannelChild.cpp
index 91f494bfed9..f3efdbaddf8 100644
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -728,7 +728,7 @@ HttpChannelChild::DoNotifyListenerCleanup()
 class DeleteSelfEvent : public ChannelEvent
 {
  public:
-  DeleteSelfEvent(HttpChannelChild* child) : mChild(child) {}
+  explicit DeleteSelfEvent(HttpChannelChild* child) : mChild(child) {}
   void Run() { mChild->DeleteSelf(); }
  private:
   HttpChannelChild* mChild;
@@ -852,7 +852,7 @@ HttpChannelChild::Redirect1Begin(const uint32_t& newChannelId,
 class Redirect3Event : public ChannelEvent
 {
  public:
-  Redirect3Event(HttpChannelChild* child) : mChild(child) {}
+  explicit Redirect3Event(HttpChannelChild* child) : mChild(child) {}
   void Run() { mChild->Redirect3Complete(); }
  private:
   HttpChannelChild* mChild;
@@ -872,7 +872,7 @@ HttpChannelChild::RecvRedirect3Complete()
 class HttpFlushedForDiversionEvent : public ChannelEvent
 {
  public:
-  HttpFlushedForDiversionEvent(HttpChannelChild* aChild)
+  explicit HttpFlushedForDiversionEvent(HttpChannelChild* aChild)
   : mChild(aChild)
   {
     MOZ_RELEASE_ASSERT(aChild);
diff --git a/netwerk/protocol/http/HttpChannelParentListener.h b/netwerk/protocol/http/HttpChannelParentListener.h
index f3a120bd86d..9a5ccb7e4f7 100644
--- a/netwerk/protocol/http/HttpChannelParentListener.h
+++ b/netwerk/protocol/http/HttpChannelParentListener.h
@@ -32,7 +32,7 @@ public:
   NS_DECL_NSIREQUESTOBSERVER
   NS_DECL_NSISTREAMLISTENER
 
-  HttpChannelParentListener(HttpChannelParent* aInitialChannel);
+  explicit HttpChannelParentListener(HttpChannelParent* aInitialChannel);
 
   // For channel diversion from child to parent.
   nsresult DivertTo(nsIStreamListener *aListener);
diff --git a/netwerk/protocol/http/SpdySession3.h b/netwerk/protocol/http/SpdySession3.h
index 2f0bf6a6f2a..8abe056757d 100644
--- a/netwerk/protocol/http/SpdySession3.h
+++ b/netwerk/protocol/http/SpdySession3.h
@@ -40,7 +40,7 @@ public:
   NS_DECL_NSAHTTPSEGMENTREADER
   NS_DECL_NSAHTTPSEGMENTWRITER
 
-  SpdySession3(nsISocketTransport *);
+  explicit SpdySession3(nsISocketTransport *);
 
   bool AddStream(nsAHttpTransaction *, int32_t,
                  bool, nsIInterfaceRequestor *);
diff --git a/netwerk/protocol/http/SpdySession31.h b/netwerk/protocol/http/SpdySession31.h
index 44f7cc715c7..cd9a15133d6 100644
--- a/netwerk/protocol/http/SpdySession31.h
+++ b/netwerk/protocol/http/SpdySession31.h
@@ -39,7 +39,7 @@ public:
   NS_DECL_NSAHTTPSEGMENTREADER
   NS_DECL_NSAHTTPSEGMENTWRITER
 
-  SpdySession31(nsISocketTransport *);
+  explicit SpdySession31(nsISocketTransport *);
 
   bool AddStream(nsAHttpTransaction *, int32_t,
                  bool, nsIInterfaceRequestor *);
diff --git a/netwerk/protocol/http/TunnelUtils.cpp b/netwerk/protocol/http/TunnelUtils.cpp
index 5fa2778ab7d..5e369543f4a 100644
--- a/netwerk/protocol/http/TunnelUtils.cpp
+++ b/netwerk/protocol/http/TunnelUtils.cpp
@@ -917,7 +917,7 @@ public:
   NS_DECL_NSITRANSPORT
   NS_DECL_NSISOCKETTRANSPORT
 
-  SocketTransportShim(nsISocketTransport *aWrapped)
+  explicit SocketTransportShim(nsISocketTransport *aWrapped)
     : mWrapped(aWrapped)
   {};
 
@@ -936,7 +936,7 @@ public:
 
   friend class SpdyConnectTransaction;
 
-  OutputStreamShim(SpdyConnectTransaction *aTrans)
+  explicit OutputStreamShim(SpdyConnectTransaction *aTrans)
     : mCallback(nullptr)
     , mStatus(NS_OK)
   {
@@ -960,7 +960,7 @@ public:
 
   friend class SpdyConnectTransaction;
 
-  InputStreamShim(SpdyConnectTransaction *aTrans)
+  explicit InputStreamShim(SpdyConnectTransaction *aTrans)
     : mCallback(nullptr)
     , mStatus(NS_OK)
   {
diff --git a/netwerk/protocol/http/nsHttpAuthCache.h b/netwerk/protocol/http/nsHttpAuthCache.h
index 01049953e5a..0e79b51f36d 100644
--- a/netwerk/protocol/http/nsHttpAuthCache.h
+++ b/netwerk/protocol/http/nsHttpAuthCache.h
@@ -244,7 +244,7 @@ private:
     public:
       NS_DECL_ISUPPORTS
       NS_DECL_NSIOBSERVER
-      AppDataClearObserver(nsHttpAuthCache* aOwner) : mOwner(aOwner) {}
+      explicit AppDataClearObserver(nsHttpAuthCache* aOwner) : mOwner(aOwner) {}
       nsHttpAuthCache* mOwner;
     };
 
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index a03c5da41bf..d2475a01c9e 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -154,7 +154,7 @@ WillRedirect(const nsHttpResponseHead * response)
 class AutoRedirectVetoNotifier
 {
 public:
-    AutoRedirectVetoNotifier(nsHttpChannel* channel) : mChannel(channel)
+    explicit AutoRedirectVetoNotifier(nsHttpChannel* channel) : mChannel(channel)
     {
       if (mChannel->mHasAutoRedirectVetoNotifier) {
         MOZ_CRASH("Nested AutoRedirectVetoNotifier on the stack");
@@ -2807,12 +2807,21 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
     bool doValidation = false;
     bool canAddImsHeader = true;
 
+    bool isForcedValid = false;
+    entry->GetIsForcedValid(&isForcedValid);
+
     // Cached entry is not the entity we request (see bug #633743)
     if (ResponseWouldVary(entry)) {
         LOG(("Validating based on Vary headers returning TRUE\n"));
         canAddImsHeader = false;
         doValidation = true;
     }
+    // Check isForcedValid to see if it is possible to skip validation
+    // See netwerk/cache2/nsICacheEntry.idl for details
+    else if (isForcedValid) {
+        LOG(("NOT validating based on isForcedValid being true.\n"));
+        doValidation = false;
+    }
     // If the LOAD_FROM_CACHE flag is set, any cached data can simply be used
     else if (mLoadFlags & nsIRequest::LOAD_FROM_CACHE) {
         LOG(("NOT validating based on LOAD_FROM_CACHE load flag\n"));
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index cf567a88868..758e75494a8 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -160,7 +160,7 @@ public: /* internal necko use only */
     class AutoCacheWaitFlags
     {
     public:
-      AutoCacheWaitFlags(nsHttpChannel* channel)
+      explicit AutoCacheWaitFlags(nsHttpChannel* channel)
         : mChannel(channel)
         , mKeep(0)
       {
diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.h b/netwerk/protocol/http/nsHttpConnectionMgr.h
index 73a67e9776f..bf766288175 100644
--- a/netwerk/protocol/http/nsHttpConnectionMgr.h
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.h
@@ -274,7 +274,7 @@ private:
     class nsConnectionEntry
     {
     public:
-        nsConnectionEntry(nsHttpConnectionInfo *ci);
+        explicit nsConnectionEntry(nsHttpConnectionInfo *ci);
         ~nsConnectionEntry();
 
         nsRefPtr<nsHttpConnectionInfo> mConnInfo;
@@ -401,7 +401,7 @@ private:
         NS_DECL_THREADSAFE_ISUPPORTS
         NS_DECL_NSAHTTPCONNECTION(mConn)
 
-        nsConnectionHandle(nsHttpConnection *conn) { NS_ADDREF(mConn = conn); }
+        explicit nsConnectionHandle(nsHttpConnection *conn) { NS_ADDREF(mConn = conn); }
 
         nsHttpConnection *mConn;
     };
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 61a1b95c320..5e52ba3e430 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -1743,7 +1743,7 @@ nsHttpTransaction::ReleaseBlockingTransaction()
 
 class DeleteHttpTransaction : public nsRunnable {
 public:
-    DeleteHttpTransaction(nsHttpTransaction *trans)
+    explicit DeleteHttpTransaction(nsHttpTransaction *trans)
         : mTrans(trans)
     {}
 
diff --git a/netwerk/protocol/websocket/WebSocketChannelChild.cpp b/netwerk/protocol/websocket/WebSocketChannelChild.cpp
index fd4d172a518..d1bdc602deb 100644
--- a/netwerk/protocol/websocket/WebSocketChannelChild.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannelChild.cpp
@@ -83,7 +83,7 @@ WebSocketChannelChild::ReleaseIPDLReference()
 class WrappedChannelEvent : public nsRunnable
 {
 public:
-  WrappedChannelEvent(ChannelEvent *aChannelEvent)
+  explicit WrappedChannelEvent(ChannelEvent *aChannelEvent)
     : mChannelEvent(aChannelEvent)
   {
     MOZ_RELEASE_ASSERT(aChannelEvent);
diff --git a/netwerk/protocol/websocket/WebSocketChannelChild.h b/netwerk/protocol/websocket/WebSocketChannelChild.h
index 91248d510a4..d3a94a72cde 100644
--- a/netwerk/protocol/websocket/WebSocketChannelChild.h
+++ b/netwerk/protocol/websocket/WebSocketChannelChild.h
@@ -21,7 +21,7 @@ class WebSocketChannelChild : public BaseWebSocketChannel,
                               public PWebSocketChild
 {
  public:
-  WebSocketChannelChild(bool aSecure);
+  explicit WebSocketChannelChild(bool aSecure);
 
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSITHREADRETARGETABLEREQUEST
diff --git a/netwerk/protocol/wyciwyg/nsWyciwygChannel.cpp b/netwerk/protocol/wyciwyg/nsWyciwygChannel.cpp
index e14f521617c..42c6d00f412 100644
--- a/netwerk/protocol/wyciwyg/nsWyciwygChannel.cpp
+++ b/netwerk/protocol/wyciwyg/nsWyciwygChannel.cpp
@@ -31,7 +31,7 @@ typedef mozilla::net::LoadContextInfo LoadContextInfo;
 // Must release mChannel on the main thread
 class nsWyciwygAsyncEvent : public nsRunnable {
 public:
-  nsWyciwygAsyncEvent(nsWyciwygChannel *aChannel) : mChannel(aChannel) {}
+  explicit nsWyciwygAsyncEvent(nsWyciwygChannel *aChannel) : mChannel(aChannel) {}
 
   ~nsWyciwygAsyncEvent()
   {
@@ -49,7 +49,7 @@ protected:
 
 class nsWyciwygSetCharsetandSourceEvent : public nsWyciwygAsyncEvent {
 public:
-  nsWyciwygSetCharsetandSourceEvent(nsWyciwygChannel *aChannel)
+  explicit nsWyciwygSetCharsetandSourceEvent(nsWyciwygChannel *aChannel)
     : nsWyciwygAsyncEvent(aChannel) {}
 
   NS_IMETHOD Run()
diff --git a/netwerk/sctp/datachannel/DataChannel.h b/netwerk/sctp/datachannel/DataChannel.h
index 6b6e3c96722..7c5f4457ddc 100644
--- a/netwerk/sctp/datachannel/DataChannel.h
+++ b/netwerk/sctp/datachannel/DataChannel.h
@@ -114,7 +114,7 @@ public:
     virtual void NotifyDataChannel(already_AddRefed<DataChannel> channel) = 0;
   };
 
-  DataChannelConnection(DataConnectionListener *listener);
+  explicit DataChannelConnection(DataConnectionListener *listener);
 
   bool Init(unsigned short aPort, uint16_t aNumStreams, bool aUsingDtls);
   void Destroy(); // So we can spawn refs tied to runnables in shutdown
diff --git a/netwerk/socket/nsSOCKSSocketProvider.h b/netwerk/socket/nsSOCKSSocketProvider.h
index aa98a2804d1..d468ec36ed3 100644
--- a/netwerk/socket/nsSOCKSSocketProvider.h
+++ b/netwerk/socket/nsSOCKSSocketProvider.h
@@ -21,7 +21,7 @@ public:
     NS_DECL_THREADSAFE_ISUPPORTS
     NS_DECL_NSISOCKETPROVIDER
 
-    nsSOCKSSocketProvider(uint32_t version) : mVersion(version) {}
+    explicit nsSOCKSSocketProvider(uint32_t version) : mVersion(version) {}
 
     static nsresult CreateV4(nsISupports *, REFNSIID aIID, void **aResult);
     static nsresult CreateV5(nsISupports *, REFNSIID aIID, void **aResult);
diff --git a/netwerk/wifi/nsWifiMonitor.h b/netwerk/wifi/nsWifiMonitor.h
index 4d0d6b07b84..7d517891dad 100644
--- a/netwerk/wifi/nsWifiMonitor.h
+++ b/netwerk/wifi/nsWifiMonitor.h
@@ -38,7 +38,7 @@ class nsWifiListener
 {
  public:
 
-  nsWifiListener(nsMainThreadPtrHolder<nsIWifiListener>* aListener)
+  explicit nsWifiListener(nsMainThreadPtrHolder<nsIWifiListener>* aListener)
   {
     mListener = aListener;
     mHasSentData = false;
diff --git a/security/build/nss.def b/security/build/nss.def
index 12f37e26935..bab85974138 100644
--- a/security/build/nss.def
+++ b/security/build/nss.def
@@ -624,6 +624,8 @@ SGN_NewContext
 SGN_Update
 SSL_AuthCertificateComplete
 SSL_AuthCertificateHook
+SSL_CipherPrefGet
+SSL_CipherPrefSet
 SSL_CipherPrefSetDefault
 SSL_ClearSessionCache
 SSL_ConfigSecureServer
diff --git a/security/manager/ssl/src/ScopedNSSTypes.h b/security/manager/ssl/src/ScopedNSSTypes.h
index a1ea3c45d76..306e796ffe2 100644
--- a/security/manager/ssl/src/ScopedNSSTypes.h
+++ b/security/manager/ssl/src/ScopedNSSTypes.h
@@ -267,7 +267,7 @@ SECITEM_AllocItem(SECItem & item, uint32_t len)
 class ScopedAutoSECItem MOZ_FINAL : public SECItem
 {
 public:
-  ScopedAutoSECItem(uint32_t initialAllocatedLen = 0)
+  explicit ScopedAutoSECItem(uint32_t initialAllocatedLen = 0)
   {
     data = nullptr;
     len = 0;
diff --git a/services/fxaccounts/FxAccounts.jsm b/services/fxaccounts/FxAccounts.jsm
index 5fb78a72ff7..a4f9a72124a 100644
--- a/services/fxaccounts/FxAccounts.jsm
+++ b/services/fxaccounts/FxAccounts.jsm
@@ -303,7 +303,12 @@ function FxAccountsInternal() {
 
   // We don't reference |profileDir| in the top-level module scope
   // as we may be imported before we know where it is.
+  // We only want the fancy new LoginManagerStorage on desktop.
+#if defined(MOZ_B2G)
   this.signedInUserStorage = new JSONStorage({
+#else
+  this.signedInUserStorage = new LoginManagerStorage({
+#endif
     filename: DEFAULT_STORAGE_FILENAME,
     baseDir: OS.Constants.Path.profileDir,
   });
@@ -901,6 +906,194 @@ JSONStorage.prototype = {
   }
 };
 
+/**
+ * LoginManagerStorage constructor that creates instances that may set/get
+ * from a combination of a clear-text JSON file and stored securely in
+ * the nsILoginManager.
+ *
+ * @param options {
+ *                  filename: of the plain-text file to write to
+ *                  baseDir: directory where the file resides
+ *                }
+ * @return instance
+ */
+
+function LoginManagerStorage(options) {
+  // we reuse the JSONStorage for writing the plain-text stuff.
+  this.jsonStorage = new JSONStorage(options);
+}
+
+LoginManagerStorage.prototype = {
+  // The fields in the credentials JSON object that are stored in plain-text
+  // in the profile directory.  All other fields are stored in the login manager,
+  // and thus are only available when the master-password is unlocked.
+
+  // a hook point for testing.
+  get _isLoggedIn() {
+    return Services.logins.isLoggedIn;
+  },
+
+  // Clear any data from the login manager.  Returns true if the login manager
+  // was unlocked (even if no existing logins existed) or false if it was
+  // locked (meaning we don't even know if it existed or not.)
+  _clearLoginMgrData: Task.async(function* () {
+    try { // Services.logins might be third-party and broken...
+      yield Services.logins.initializationPromise;
+      if (!this._isLoggedIn) {
+        return false;
+      }
+      let logins = Services.logins.findLogins({}, FXA_PWDMGR_HOST, null, FXA_PWDMGR_REALM);
+      for (let login of logins) {
+        Services.logins.removeLogin(login);
+      }
+      return true;
+    } catch (ex) {
+      log.error("Failed to clear login data: ${}", ex);
+      return false;
+    }
+  }),
+
+  set: Task.async(function* (contents) {
+    if (!contents) {
+      // User is signing out - write the null to the json file.
+      yield this.jsonStorage.set(contents);
+
+      // And nuke it from the login manager.
+      let cleared = yield this._clearLoginMgrData();
+      if (!cleared) {
+        // just log a message - we verify that the email address matches when
+        // we reload it, so having a stale entry doesn't really hurt.
+        log.info("not removing credentials from login manager - not logged in");
+      }
+      return;
+    }
+
+    // We are saving actual data.
+    // Split the data into 2 chunks - one to go to the plain-text, and the
+    // other to write to the login manager.
+    let toWriteJSON = {version: contents.version};
+    let accountDataJSON = toWriteJSON.accountData = {};
+    let toWriteLoginMgr = {version: contents.version};
+    let accountDataLoginMgr = toWriteLoginMgr.accountData = {};
+    for (let [name, value] of Iterator(contents.accountData)) {
+      if (FXA_PWDMGR_PLAINTEXT_FIELDS.indexOf(name) >= 0) {
+        accountDataJSON[name] = value;
+      } else {
+        accountDataLoginMgr[name] = value;
+      }
+    }
+    yield this.jsonStorage.set(toWriteJSON);
+
+    try { // Services.logins might be third-party and broken...
+      // and the stuff into the login manager.
+      yield Services.logins.initializationPromise;
+      // If MP is locked we silently fail - the user may need to re-auth
+      // next startup.
+      if (!this._isLoggedIn) {
+        log.info("not saving credentials to login manager - not logged in");
+        return;
+      }
+      // write the rest of the data to the login manager.
+      let loginInfo = new Components.Constructor(
+         "@mozilla.org/login-manager/loginInfo;1", Ci.nsILoginInfo, "init");
+      let login = new loginInfo(FXA_PWDMGR_HOST,
+                                null, // aFormSubmitURL,
+                                FXA_PWDMGR_REALM, // aHttpRealm,
+                                contents.accountData.email, // aUsername
+                                JSON.stringify(toWriteLoginMgr), // aPassword
+                                "", // aUsernameField
+                                "");// aPasswordField
+
+      let existingLogins = Services.logins.findLogins({}, FXA_PWDMGR_HOST, null,
+                                                      FXA_PWDMGR_REALM);
+      if (existingLogins.length) {
+        Services.logins.modifyLogin(existingLogins[0], login);
+      } else {
+        Services.logins.addLogin(login);
+      }
+    } catch (ex) {
+      log.error("Failed to save data to the login manager: ${}", ex);
+    }
+  }),
+
+  get: Task.async(function* () {
+    // we need to suck some data from the .json file in the profile dir and
+    // some other from the login manager.
+    let data = yield this.jsonStorage.get();
+    if (!data) {
+      // no user logged in, nuke the storage data incase we couldn't remove
+      // it previously and then we are done.
+      yield this._clearLoginMgrData();
+      return null;
+    }
+
+    // if we have encryption keys it must have been saved before we
+    // used the login manager, so re-save it.
+    if (data.accountData.kA || data.accountData.kB || data.keyFetchToken) {
+      // We need to migrate, but the MP might be locked (eg, on the first run
+      // with this enabled, we will get here very soon after startup, so will
+      // certainly be locked.)  This means we can't actually store the data in
+      // the login manager (and thus might lose it if we migrated now)
+      // So if the MP is locked, we *don't* migrate, but still just return
+      // the subset of data we now store in the JSON.
+      // This will cause sync to notice the lack of keys, force an unlock then
+      // re-fetch the account data to see if the keys are there.  At *that*
+      // point we will end up back here, but because the MP is now unlocked
+      // we can actually perform the migration.
+      if (!this._isLoggedIn) {
+        // return the "safe" subset but leave the storage alone.
+        log.info("account data needs migration to the login manager but the MP is locked.");
+        let result = {
+          version: data.version,
+          accountData: {},
+        };
+        for (let fieldName of FXA_PWDMGR_PLAINTEXT_FIELDS) {
+          result.accountData[fieldName] = data.accountData[fieldName];
+        }
+        return result;
+      }
+      // actually migrate - just calling .set() will split everything up.
+      log.info("account data is being migrated to the login manager.");
+      yield this.set(data);
+    }
+
+    try { // Services.logins might be third-party and broken...
+      // read the data from the login manager and merge it for return.
+      yield Services.logins.initializationPromise;
+
+      if (!this._isLoggedIn) {
+        log.info("returning partial account data as the login manager is locked.");
+        return data;
+      }
+
+      let logins = Services.logins.findLogins({}, FXA_PWDMGR_HOST, null, FXA_PWDMGR_REALM);
+      if (logins.length == 0) {
+        // This could happen if the MP was locked when we wrote the data.
+        log.info("Can't find the rest of the credentials in the login manager");
+        return data;
+      }
+      let login = logins[0];
+      if (login.username == data.accountData.email) {
+        let lmData = JSON.parse(login.password);
+        if (lmData.version == data.version) {
+          // Merge the login manager data
+          copyObjectProperties(lmData.accountData, data.accountData);
+        } else {
+          log.info("version field in the login manager doesn't match - ignoring it");
+          yield this._clearLoginMgrData();
+        }
+      } else {
+        log.info("username in the login manager doesn't match - ignoring it");
+        yield this._clearLoginMgrData();
+      }
+    } catch (ex) {
+      log.error("Failed to get data from the login manager: ${}", ex);
+    }
+    return data;
+  }),
+
+}
+
 // A getter for the instance to export
 XPCOMUtils.defineLazyGetter(this, "fxAccounts", function() {
   let a = new FxAccounts();
diff --git a/services/fxaccounts/FxAccountsCommon.js b/services/fxaccounts/FxAccountsCommon.js
index d3a2756f2f9..267e5ecdb7a 100644
--- a/services/fxaccounts/FxAccountsCommon.js
+++ b/services/fxaccounts/FxAccountsCommon.js
@@ -178,5 +178,18 @@ SERVER_ERRNO_TO_ERROR[ERRNO_INCORRECT_EMAIL_CASE]           = ERROR_INCORRECT_EM
 SERVER_ERRNO_TO_ERROR[ERRNO_SERVICE_TEMP_UNAVAILABLE]       = ERROR_SERVICE_TEMP_UNAVAILABLE;
 SERVER_ERRNO_TO_ERROR[ERRNO_UNKNOWN_ERROR]                  = ERROR_UNKNOWN;
 
+// FxAccounts has the ability to "split" the credentials between a plain-text
+// JSON file in the profile dir and in the login manager.
+// These constants relate to that.
+
+// The fields we save in the plaintext JSON.
+// See bug 1013064 comments 23-25 for why the sessionToken is "safe"
+this.FXA_PWDMGR_PLAINTEXT_FIELDS = ["email", "verified", "authAt",
+                                    "sessionToken", "uid"];
+// The pseudo-host we use in the login manager
+this.FXA_PWDMGR_HOST = "chrome://FirefoxAccounts";
+// The realm we use in the login manager.
+this.FXA_PWDMGR_REALM = "Firefox Accounts credentials";
+
 // Allow this file to be imported via Components.utils.import().
 this.EXPORTED_SYMBOLS = Object.keys(this);
diff --git a/services/fxaccounts/moz.build b/services/fxaccounts/moz.build
index 3d2e212613d..7b62b35bc89 100644
--- a/services/fxaccounts/moz.build
+++ b/services/fxaccounts/moz.build
@@ -10,12 +10,15 @@ TEST_DIRS += ['tests']
 
 EXTRA_JS_MODULES += [
   'Credentials.jsm',
-  'FxAccounts.jsm',
   'FxAccountsClient.jsm',
   'FxAccountsCommon.js',
   'FxAccountsOAuthClient.jsm',
 ]
 
+EXTRA_PP_JS_MODULES += [
+  'FxAccounts.jsm',
+]
+
 # For now, we will only be using the FxA manager in B2G.
 if CONFIG['MOZ_B2G']:
   EXTRA_JS_MODULES += ['FxAccountsManager.jsm']
diff --git a/services/fxaccounts/tests/xpcshell/test_loginmgr_storage.js b/services/fxaccounts/tests/xpcshell/test_loginmgr_storage.js
index 297b2569170..a9cf5f4499b 100644
--- a/services/fxaccounts/tests/xpcshell/test_loginmgr_storage.js
+++ b/services/fxaccounts/tests/xpcshell/test_loginmgr_storage.js
@@ -103,6 +103,119 @@ add_task(function test_MPLocked() {
   yield fxa.signOut(/* localOnly = */ true)
 });
 
+add_task(function test_migrationMPUnlocked() {
+  // first manually save a signedInUser.json to simulate a first-run with
+  // pre-migrated data.
+  let fxa = new FxAccounts({});
+
+  let creds = {
+    email: "test@example.com",
+    sessionToken: "sessionToken",
+    kA: "the kA value",
+    kB: "the kB value",
+    verified: true
+  };
+  let toWrite = {
+    version: fxa.version,
+    accountData: creds,
+  }
+
+  let path = OS.Path.join(OS.Constants.Path.profileDir, "signedInUser.json");
+  yield CommonUtils.writeJSON(toWrite, path);
+
+  // now load it - it should migrate.
+  let data = yield fxa.getSignedInUser();
+  Assert.deepEqual(data, creds, "we got all the data back");
+
+  // and verify it was actually migrated - re-read signedInUser back.
+  let data = yield CommonUtils.readJSON(path);
+
+  Assert.strictEqual(data.accountData.email, creds.email, "correct email in the clear text");
+  Assert.strictEqual(data.accountData.sessionToken, creds.sessionToken, "correct sessionToken in the clear text");
+  Assert.strictEqual(data.accountData.verified, creds.verified, "correct verified flag");
+
+  Assert.ok(!("kA" in data.accountData), "kA not stored in clear text");
+  Assert.ok(!("kB" in data.accountData), "kB not stored in clear text");
+
+  let login = getLoginMgrData();
+  Assert.strictEqual(login.username, creds.email, "email matches");
+  let loginData = JSON.parse(login.password);
+  Assert.strictEqual(loginData.version, data.version, "same version flag in both places");
+  Assert.strictEqual(loginData.accountData.kA, creds.kA, "correct kA in the login mgr");
+  Assert.strictEqual(loginData.accountData.kB, creds.kB, "correct kB in the login mgr");
+
+  Assert.ok(!("email" in loginData), "email not stored in the login mgr json");
+  Assert.ok(!("sessionToken" in loginData), "sessionToken not stored in the login mgr json");
+  Assert.ok(!("verified" in loginData), "verified not stored in the login mgr json");
+
+  yield fxa.signOut(/* localOnly = */ true);
+  Assert.strictEqual(getLoginMgrData(), null, "login mgr data deleted on logout");
+});
+
+add_task(function test_migrationMPLocked() {
+  // first manually save a signedInUser.json to simulate a first-run with
+  // pre-migrated data.
+  let fxa = new FxAccounts({});
+
+  let creds = {
+    email: "test@example.com",
+    sessionToken: "sessionToken",
+    kA: "the kA value",
+    kB: "the kB value",
+    verified: true
+  };
+  let toWrite = {
+    version: fxa.version,
+    accountData: creds,
+  }
+
+  let path = OS.Path.join(OS.Constants.Path.profileDir, "signedInUser.json");
+  yield CommonUtils.writeJSON(toWrite, path);
+
+  // pretend the MP is locked.
+  fxa.internal.signedInUserStorage.__defineGetter__("_isLoggedIn", function() false);
+
+  // now load it - it should *not* migrate, but should only give the JSON-safe
+  // data back.
+  let data = yield fxa.getSignedInUser();
+  Assert.ok(!data.kA);
+  Assert.ok(!data.kB);
+
+  // and verify the data on disk wan't migrated.
+  data = yield CommonUtils.readJSON(path);
+  Assert.deepEqual(data, toWrite);
+
+  // Now "unlock" and re-ask for the signedInUser - it should migrate.
+  fxa.internal.signedInUserStorage.__defineGetter__("_isLoggedIn", function() true);
+  data = yield fxa.getSignedInUser();
+  // this time we should have got all the data, not just the JSON-safe fields.
+  Assert.strictEqual(data.kA, creds.kA);
+  Assert.strictEqual(data.kB, creds.kB);
+
+  // And verify the data in the JSON was migrated
+  data = yield CommonUtils.readJSON(path);
+  Assert.strictEqual(data.accountData.email, creds.email, "correct email in the clear text");
+  Assert.strictEqual(data.accountData.sessionToken, creds.sessionToken, "correct sessionToken in the clear text");
+  Assert.strictEqual(data.accountData.verified, creds.verified, "correct verified flag");
+
+  Assert.ok(!("kA" in data.accountData), "kA not stored in clear text");
+  Assert.ok(!("kB" in data.accountData), "kB not stored in clear text");
+
+  let login = getLoginMgrData();
+  Assert.strictEqual(login.username, creds.email, "email matches");
+  let loginData = JSON.parse(login.password);
+  Assert.strictEqual(loginData.version, data.version, "same version flag in both places");
+  Assert.strictEqual(loginData.accountData.kA, creds.kA, "correct kA in the login mgr");
+  Assert.strictEqual(loginData.accountData.kB, creds.kB, "correct kB in the login mgr");
+
+  Assert.ok(!("email" in loginData), "email not stored in the login mgr json");
+  Assert.ok(!("sessionToken" in loginData), "sessionToken not stored in the login mgr json");
+  Assert.ok(!("verified" in loginData), "verified not stored in the login mgr json");
+
+  yield fxa.signOut(/* localOnly = */ true);
+  Assert.strictEqual(getLoginMgrData(), null, "login mgr data deleted on logout");
+});
+
 add_task(function test_consistentWithMPEdgeCases() {
   let fxa = new FxAccounts({});
 
diff --git a/services/fxaccounts/tests/xpcshell/xpcshell.ini b/services/fxaccounts/tests/xpcshell/xpcshell.ini
index 637ee551e22..7c5a678efff 100644
--- a/services/fxaccounts/tests/xpcshell/xpcshell.ini
+++ b/services/fxaccounts/tests/xpcshell/xpcshell.ini
@@ -5,6 +5,8 @@ tail =
 [test_accounts.js]
 [test_client.js]
 [test_credentials.js]
+[test_loginmgr_storage.js]
+skip-if = appname == 'b2g' # login manager storage only used on desktop.
 [test_manager.js]
 run-if = appname == 'b2g'
 reason = FxAccountsManager is only available for B2G for now
diff --git a/services/sync/Weave.js b/services/sync/Weave.js
index 961bb7f0c45..d7befe15b93 100644
--- a/services/sync/Weave.js
+++ b/services/sync/Weave.js
@@ -108,16 +108,6 @@ WeaveService.prototype = {
     }
   },
 
-  /**
-   * Returns whether the password engine is allowed. We explicitly disallow
-   * the password engine when a master password is used to ensure those can't
-   * be accessed without the master key.
-   */
-  get allowPasswordsEngine() {
-    // This doesn't apply to old-style sync, it's only an issue for FxA.
-    return !this.fxAccountsEnabled || !Utils.mpEnabled();
-  },
-
   /**
    * Whether Sync appears to be enabled.
    *
diff --git a/services/sync/modules/browserid_identity.js b/services/sync/modules/browserid_identity.js
index 3b0e290ffcf..b489807cc8f 100644
--- a/services/sync/modules/browserid_identity.js
+++ b/services/sync/modules/browserid_identity.js
@@ -399,7 +399,10 @@ this.BrowserIDManager.prototype = {
    * The current state of the auth credentials.
    *
    * This essentially validates that enough credentials are available to use
-   * Sync.
+   * Sync, although it effectively ignores the state of the master-password -
+   * if that's locked and that's the only problem we can see, say everything
+   * is OK - unlockAndVerifyAuthState will be used to perform the unlock
+   * and re-verification if necessary.
    */
   get currentAuthState() {
     if (this._authFailureReason) {
@@ -416,14 +419,53 @@ this.BrowserIDManager.prototype = {
 
     // No need to check this.syncKey as our getter for that attribute
     // uses this.syncKeyBundle
-    // If bundle creation started, but failed.
-    if (this._shouldHaveSyncKeyBundle && !this.syncKeyBundle) {
-      return LOGIN_FAILED_NO_PASSPHRASE;
+    // If bundle creation started, but failed due to any reason other than
+    // the MP being locked...
+    if (this._shouldHaveSyncKeyBundle && !this.syncKeyBundle && !Utils.mpLocked()) {
+      // Return a state that says a re-auth is necessary so we can get keys.
+      return LOGIN_FAILED_LOGIN_REJECTED;
     }
 
     return STATUS_OK;
   },
 
+  // Do we currently have keys, or do we have enough that we should be able
+  // to successfully fetch them?
+  _canFetchKeys: function() {
+    let userData = this._signedInUser;
+    // a keyFetchToken means we can almost certainly grab them.
+    // kA and kB means we already have them.
+    return userData && (userData.keyFetchToken || (userData.kA && userData.kB));
+  },
+
+  /**
+   * Verify the current auth state, unlocking the master-password if necessary.
+   *
+   * Returns a promise that resolves with the current auth state after
+   * attempting to unlock.
+   */
+  unlockAndVerifyAuthState: function() {
+    if (this._canFetchKeys()) {
+      return Promise.resolve(STATUS_OK);
+    }
+    // so no keys - ensure MP unlocked.
+    if (!Utils.ensureMPUnlocked()) {
+      // user declined to unlock, so we don't know if they are stored there.
+      return Promise.resolve(MASTER_PASSWORD_LOCKED);
+    }
+    // now we are unlocked we must re-fetch the user data as we may now have
+    // the details that were previously locked away.
+    return this._fxaService.getSignedInUser().then(
+      accountData => {
+        this._updateSignedInUser(accountData);
+        // If we still can't get keys it probably means the user authenticated
+        // without unlocking the MP or cleared the saved logins, so we've now
+        // lost them - the user will need to reauth before continuing.
+        return this._canFetchKeys() ? STATUS_OK : LOGIN_FAILED_LOGIN_REJECTED;
+      }
+    );
+  },
+
   /**
    * Do we have a non-null, not yet expired token for the user currently
    * signed in?
@@ -449,6 +491,14 @@ this.BrowserIDManager.prototype = {
     let fxa = this._fxaService;
     let userData = this._signedInUser;
 
+    // We need kA and kB for things to work.  If we don't have them, just
+    // return null for the token - sync calling unlockAndVerifyAuthState()
+    // before actually syncing will setup the error states if necessary.
+    if (!this._canFetchKeys()) {
+      log.info("_fetchTokenForUser has no keys to use.");
+      return null;
+    }
+
     log.info("Fetching assertion and token from: " + tokenServerURI);
 
     let maybeFetchKeys = () => {
@@ -524,7 +574,8 @@ this.BrowserIDManager.prototype = {
           // set it to the "fatal" LOGIN_FAILED_LOGIN_REJECTED reason.
           this._authFailureReason = LOGIN_FAILED_LOGIN_REJECTED;
         } else {
-          this._log.error("Non-authentication error in _fetchTokenForUser: " + err.message);
+          this._log.error("Non-authentication error in _fetchTokenForUser: "
+                          + (err.message || err));
           // for now assume it is just a transient network related problem.
           this._authFailureReason = LOGIN_FAILED_NETWORK_ERROR;
         }
diff --git a/services/sync/modules/engines/passwords.js b/services/sync/modules/engines/passwords.js
index ff5414578b2..7786fd9af08 100644
--- a/services/sync/modules/engines/passwords.js
+++ b/services/sync/modules/engines/passwords.js
@@ -36,28 +36,6 @@ PasswordEngine.prototype = {
   _recordObj: LoginRec,
   applyIncomingBatchSize: PASSWORDS_STORE_BATCH_SIZE,
 
-  get isAllowed() {
-    return Cc["@mozilla.org/weave/service;1"]
-             .getService(Ci.nsISupports)
-             .wrappedJSObject
-             .allowPasswordsEngine;
-  },
-
-  get enabled() {
-    // If we are disabled due to !isAllowed(), we must take care to ensure the
-    // engine has actually had the enabled setter called which reflects this state.
-    let prefVal = SyncEngine.prototype.__lookupGetter__("enabled").call(this);
-    let newVal = this.isAllowed && prefVal;
-    if (newVal != prefVal) {
-      this.enabled = newVal;
-    }
-    return newVal;
-  },
-
-  set enabled(val) {
-    SyncEngine.prototype.__lookupSetter__("enabled").call(this, this.isAllowed && val);
-  },
-
   _syncFinish: function _syncFinish() {
     SyncEngine.prototype._syncFinish.call(this);
 
diff --git a/services/sync/modules/identity.js b/services/sync/modules/identity.js
index cb7a1f58423..27129b827bf 100644
--- a/services/sync/modules/identity.js
+++ b/services/sync/modules/identity.js
@@ -377,6 +377,25 @@ IdentityManager.prototype = {
     return STATUS_OK;
   },
 
+  /**
+   * Verify the current auth state, unlocking the master-password if necessary.
+   *
+   * Returns a promise that resolves with the current auth state after
+   * attempting to unlock.
+   */
+  unlockAndVerifyAuthState: function() {
+    // Try to fetch the passphrase - this will prompt for MP unlock as a
+    // side-effect...
+    try {
+      this.syncKey;
+    } catch (ex) {
+      this._log.debug("Fetching passphrase threw " + ex +
+                      "; assuming master password locked.");
+      return Promise.resolve(MASTER_PASSWORD_LOCKED);
+    }
+    return Promise.resolve(STATUS_OK);
+  },
+
   /**
    * Persist credentials to password store.
    *
diff --git a/services/sync/modules/service.js b/services/sync/modules/service.js
index 7102dd7bae6..4ab113e896f 100644
--- a/services/sync/modules/service.js
+++ b/services/sync/modules/service.js
@@ -684,17 +684,21 @@ Sync11Service.prototype = {
       return false;
     }
 
-    // Unlock master password, or return.
     // Attaching auth credentials to a request requires access to
     // passwords, which means that Resource.get can throw MP-related
     // exceptions!
-    // Try to fetch the passphrase first, while we still have control.
-    try {
-      this.identity.syncKey;
-    } catch (ex) {
-      this._log.debug("Fetching passphrase threw " + ex +
-                      "; assuming master password locked.");
-      this.status.login = MASTER_PASSWORD_LOCKED;
+    // So we ask the identity to verify the login state after unlocking the
+    // master password (ie, this call is expected to prompt for MP unlock
+    // if necessary) while we still have control.
+    let cb = Async.makeSpinningCallback();
+    this.identity.unlockAndVerifyAuthState().then(
+      result => cb(null, result),
+      cb
+    );
+    let unlockedState = cb.wait();
+    this._log.debug("Fetching unlocked auth state returned " + unlockedState);
+    if (unlockedState != STATUS_OK) {
+      this.status.login = unlockedState;
       return false;
     }
 
diff --git a/services/sync/modules/util.js b/services/sync/modules/util.js
index 194e0b285ca..4691428613f 100644
--- a/services/sync/modules/util.js
+++ b/services/sync/modules/util.js
@@ -19,6 +19,13 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm", this);
 Cu.import("resource://gre/modules/osfile.jsm", this);
 Cu.import("resource://gre/modules/Task.jsm", this);
 
+// FxAccountsCommon.js doesn't use a "namespace", so create one here.
+XPCOMUtils.defineLazyGetter(this, "FxAccountsCommon", function() {
+  let FxAccountsCommon = {};
+  Cu.import("resource://gre/modules/FxAccountsCommon.js", FxAccountsCommon);
+  return FxAccountsCommon;
+});
+
 /*
  * Utility functions
  */
@@ -594,8 +601,11 @@ this.Utils = {
       return this._syncCredentialsHosts;
     }
     let result = new Set();
-    // the legacy sync host.
+    // the legacy sync host
     result.add(PWDMGR_HOST);
+    // the FxA host
+    result.add(FxAccountsCommon.FXA_PWDMGR_HOST);
+    //
     // The FxA hosts - these almost certainly all have the same hostname, but
     // better safe than sorry...
     for (let prefName of ["identity.fxaccounts.remote.force_auth.uri",
diff --git a/services/sync/tests/unit/test_browserid_identity.js b/services/sync/tests/unit/test_browserid_identity.js
index 947b026fdbc..f2ec7cc0a25 100644
--- a/services/sync/tests/unit/test_browserid_identity.js
+++ b/services/sync/tests/unit/test_browserid_identity.js
@@ -83,9 +83,23 @@ add_task(function test_initialializeWithCurrentIdentity() {
   }
 );
 
+add_task(function test_initialializeWithNoKeys() {
+    _("Verify start after initializeWithCurrentIdentity without kA, kB or keyFetchToken");
+    let identityConfig = makeIdentityConfig();
+    delete identityConfig.fxaccount.user.kA;
+    delete identityConfig.fxaccount.user.kB;
+    // there's no keyFetchToken by default, so the initialize should fail.
+    configureFxAccountIdentity(browseridManager, identityConfig);
+
+    yield browseridManager.initializeWithCurrentIdentity();
+    yield browseridManager.whenReadyToAuthenticate.promise;
+    do_check_eq(Status.login, LOGIN_SUCCEEDED, "login succeeded even without keys");
+    do_check_false(browseridManager._canFetchKeys(), "_canFetchKeys reflects lack of keys");
+});
 
 add_test(function test_getResourceAuthenticator() {
     _("BrowserIDManager supplies a Resource Authenticator callback which returns a Hawk header.");
+    configureFxAccountIdentity(browseridManager);
     let authenticator = browseridManager.getResourceAuthenticator();
     do_check_true(!!authenticator);
     let req = {uri: CommonUtils.makeURI(
@@ -240,6 +254,7 @@ add_test(function test_RESTResourceAuthenticatorSkew() {
 add_task(function test_ensureLoggedIn() {
   configureFxAccountIdentity(browseridManager);
   yield browseridManager.initializeWithCurrentIdentity();
+  yield browseridManager.whenReadyToAuthenticate.promise;
   Assert.equal(Status.login, LOGIN_SUCCEEDED, "original initialize worked");
   yield browseridManager.ensureLoggedIn();
   Assert.equal(Status.login, LOGIN_SUCCEEDED, "original ensureLoggedIn worked");
diff --git a/services/sync/tests/unit/test_password_mpenabled.js b/services/sync/tests/unit/test_password_mpenabled.js
deleted file mode 100644
index 637969ee0a7..00000000000
--- a/services/sync/tests/unit/test_password_mpenabled.js
+++ /dev/null
@@ -1,137 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
-   http://creativecommons.org/publicdomain/zero/1.0/ */
-
-Cu.import("resource://gre/modules/Log.jsm");
-Cu.import("resource://services-sync/stages/enginesync.js");
-Cu.import("resource://services-sync/util.js");
-Cu.import("resource://services-sync/engines/passwords.js");
-Cu.import("resource://services-sync/service.js");
-Cu.import("resource://testing-common/services/sync/utils.js");
-
-function run_test() {
-  initTestLogging("Trace");
-  run_next_test();
-}
-
-add_test(function test_simple() {
-  ensureLegacyIdentityManager();
-  // Stub fxAccountsEnabled
-  let xpcs = Cc["@mozilla.org/weave/service;1"]
-             .getService(Components.interfaces.nsISupports)
-             .wrappedJSObject;
-  let fxaEnabledGetter = xpcs.__lookupGetter__("fxAccountsEnabled");
-  xpcs.__defineGetter__("fxAccountsEnabled", () => true);
-
-  // Stub mpEnabled.
-  let mpEnabledF = Utils.mpEnabled;
-  let mpEnabled = false;
-  Utils.mpEnabled = function() mpEnabled;
-
-  let manager = Service.engineManager;
-
-  Service.engineManager.register(PasswordEngine);
-  let engine = Service.engineManager.get("passwords");
-  let wipeCount = 0;
-  let engineWipeServerF = engine.wipeServer;
-  engine.wipeServer = function() {
-    ++wipeCount;
-  }
-
-  // A server for the metadata.
-  let server  = new SyncServer();
-  let johndoe = server.registerUser("johndoe", "password");
-  johndoe.createContents({
-    meta: {global: {engines: {passwords: {version: engine.version,
-                                          syncID: engine.syncID}}}},
-    crypto: {},
-    clients: {}
-  });
-  server.start();
-  setBasicCredentials("johndoe", "password", "abcdeabcdeabcdeabcdeabcdea");
-  Service.serverURL = server.baseURI;
-  Service.clusterURL = server.baseURI;
-
-  let engineSync = new EngineSynchronizer(Service);
-  engineSync._log.level = Log.Level.Trace;
-
-  function assertEnabled(expected, message) {
-    Assert.strictEqual(engine.enabled, expected, message);
-    // The preference *must* reflect the actual state.
-    Assert.strictEqual(Svc.Prefs.get("engine." + engine.prefName), expected,
-                       message + " (pref should match enabled state)");
-  }
-
-  try {
-    assertEnabled(true, "password engine should be enabled by default")
-    let engineMeta = Service.recordManager.get(engine.metaURL);
-    // This engine should be in the meta/global
-    Assert.notStrictEqual(engineMeta.payload.engines[engine.name], undefined,
-                          "The engine should appear in the metadata");
-    Assert.ok(!engineMeta.changed, "the metadata for the password engine hasn't changed");
-
-    // (pretend to) enable a master-password
-    mpEnabled = true;
-    // The password engine should be locally disabled...
-    assertEnabled(false, "if mp is locked the engine should be disabled");
-    // ...but not declined.
-    Assert.ok(!manager.isDeclined("passwords"), "password engine is not declined");
-    // Next time a sync would happen, we call _updateEnabledEngines(), which
-    // would remove the engine from the metadata - call that now.
-    engineSync._updateEnabledEngines();
-    // The global meta should no longer list the engine.
-    engineMeta = Service.recordManager.get(engine.metaURL);
-    Assert.strictEqual(engineMeta.payload.engines[engine.name], undefined,
-                       "The engine should have vanished");
-    // And we should have wiped the server data.
-    Assert.strictEqual(wipeCount, 1, "wipeServer should have been called");
-
-    // Now simulate an incoming meta/global indicating the engine should be
-    // enabled.  We should fail to actually enable it - the pref should remain
-    // false and we wipe the server for anything another device might have
-    // stored.
-    let meta = {
-      payload: {
-        engines: {
-          "passwords": {"version":1,"syncID":"yfBi2v7PpFO2"},
-        },
-      },
-    };
-    engineSync._updateEnabledFromMeta(meta, 3, manager);
-    Assert.strictEqual(wipeCount, 2, "wipeServer should have been called");
-    Assert.ok(!manager.isDeclined("passwords"), "password engine is not declined");
-    assertEnabled(false, "engine still not enabled locally");
-
-    // Let's turn the MP off - but *not* re-enable it locally.
-    mpEnabled = false;
-    // Just disabling the MP isn't enough to force it back to enabled.
-    assertEnabled(false, "engine still not enabled locally");
-    // Another incoming metadata record with the engine enabled should cause
-    // it to be enabled locally.
-    meta = {
-      payload: {
-        engines: {
-          "passwords": 1,
-        },
-      },
-    };
-    engineSync._updateEnabledFromMeta(meta, 3, manager);
-    Assert.strictEqual(wipeCount, 2, "wipeServer should *not* have been called again");
-    Assert.ok(!manager.isDeclined("passwords"), "password engine is not declined");
-    // It should be enabled locally.
-    assertEnabled(true, "engine now enabled locally");
-    // Next time a sync starts it should magically re-appear in our meta/global
-    engine._syncStartup();
-    //engineSync._updateEnabledEngines();
-    engineMeta = Service.recordManager.get(engine.metaURL);
-    Assert.equal(engineMeta.payload.engines[engine.name].version, engine.version,
-                 "The engine should re-appear in the metadata");
-  } finally {
-    // restore the damage we did above...
-    engine.wipeServer = engineWipeServerF;
-    engine._store.wipe();
-    // Un-stub mpEnabled and fxAccountsEnabled
-    Utils.mpEnabled = mpEnabledF;
-    xpcs.__defineGetter__("fxAccountsEnabled", fxaEnabledGetter);
-    server.stop(run_next_test);
-  }
-});
diff --git a/services/sync/tests/unit/xpcshell.ini b/services/sync/tests/unit/xpcshell.ini
index fcba6e3ab3d..72570125b34 100644
--- a/services/sync/tests/unit/xpcshell.ini
+++ b/services/sync/tests/unit/xpcshell.ini
@@ -169,5 +169,3 @@ skip-if = debug
 
 [test_healthreport.js]
 skip-if = ! healthreport
-
-[test_password_mpenabled.js]
diff --git a/testing/crashtest/crashtests.list b/testing/crashtest/crashtests.list
index 90c58028558..f127f59a5e0 100644
--- a/testing/crashtest/crashtests.list
+++ b/testing/crashtest/crashtests.list
@@ -8,14 +8,12 @@ include ../../accessible/tests/crashtests/crashtests.list
 include ../../content/base/crashtests/crashtests.list
 include ../../content/html/content/crashtests/crashtests.list
 include ../../content/html/document/crashtests/crashtests.list
+include ../../content/media/test/crashtests/crashtests.list
 include ../../content/svg/content/src/crashtests/crashtests.list
 include ../../content/xul/content/crashtests/crashtests.list
 include ../../content/xul/document/crashtests/crashtests.list
 include ../../content/xul/templates/src/crashtests/crashtests.list
 
-# Bug 868152 - webaudio crash on tegra platform
-skip-if(Android) include ../../content/media/test/crashtests/crashtests.list
-
 include ../../docshell/base/crashtests/crashtests.list
 
 include ../../dom/base/crashtests/crashtests.list
@@ -33,7 +31,7 @@ include ../../dom/xml/crashtests/crashtests.list
 include ../../dom/xslt/crashtests/crashtests.list
 
 # Bug 811873 - mozRTCPeerConnection doesn't support remote browser yet
-skip-if(B2G||browserIsRemote||!webrtc) include ../../dom/media/tests/crashtests/crashtests.list
+skip-if(browserIsRemote||!webrtc) include ../../dom/media/tests/crashtests/crashtests.list
 
 include ../../editor/crashtests.list
 
diff --git a/testing/mozbase/mozlog/setup.py b/testing/mozbase/mozlog/setup.py
index 0cd067f6d12..74f93a7ed9c 100644
--- a/testing/mozbase/mozlog/setup.py
+++ b/testing/mozbase/mozlog/setup.py
@@ -5,7 +5,7 @@
 from setuptools import setup, find_packages
 
 PACKAGE_NAME = 'mozlog'
-PACKAGE_VERSION = '2.2'
+PACKAGE_VERSION = '2.2.1'
 
 setup(name=PACKAGE_NAME,
       version=PACKAGE_VERSION,
diff --git a/tools/mercurial/hgsetup/config.py b/tools/mercurial/hgsetup/config.py
index 78e3bb6408a..e7f9d830d70 100644
--- a/tools/mercurial/hgsetup/config.py
+++ b/tools/mercurial/hgsetup/config.py
@@ -16,6 +16,10 @@ HOST_FINGERPRINTS = {
 }
 
 
+class HgIncludeException(Exception):
+    pass
+
+
 class MercurialConfig(object):
     """Interface for manipulating a Mercurial config file."""
 
@@ -35,6 +39,15 @@ class MercurialConfig(object):
         else:
             infile = None
 
+        # Mercurial configuration files allow an %include directive to include
+        # other files, this is not supported by ConfigObj, so throw a useful
+        # error saying this.
+        with open(infile, 'r') as f:
+            for line in f:
+                if line.startswith('%include'):
+                    raise HgIncludeException(
+                        '%include directive is not supported by MercurialConfig')
+
         # write_empty_values is necessary to prevent built-in extensions (which
         # have no value) from being dropped on write.
         # list_values aren't needed by Mercurial and disabling them prevents
diff --git a/tools/mercurial/hgsetup/wizard.py b/tools/mercurial/hgsetup/wizard.py
index b2c10895e2b..cbb0161c07a 100644
--- a/tools/mercurial/hgsetup/wizard.py
+++ b/tools/mercurial/hgsetup/wizard.py
@@ -23,6 +23,7 @@ from mozversioncontrol.repoupdate import (
 )
 
 from .config import (
+    HgIncludeException,
     HOST_FINGERPRINTS,
     MercurialConfig,
 )
@@ -195,6 +196,10 @@ class MercurialSetupWizard(object):
                 print(error.message)
 
             return 1
+        except HgIncludeException as e:
+            print(e.message)
+
+            return 1
 
         print(INITIAL_MESSAGE)
         raw_input()
diff --git a/uriloader/base/nsDocLoader.h b/uriloader/base/nsDocLoader.h
index b1431fffb5a..057ae6ddf4c 100644
--- a/uriloader/base/nsDocLoader.h
+++ b/uriloader/base/nsDocLoader.h
@@ -209,7 +209,7 @@ protected:
         // Weak mRequest is ok; we'll be told if it decides to go away.
         nsIRequest * const mRequest;
 
-        nsStatusInfo(nsIRequest* aRequest) :
+        explicit nsStatusInfo(nsIRequest* aRequest) :
             mRequest(aRequest)
         {
             MOZ_COUNT_CTOR(nsStatusInfo);
@@ -222,7 +222,7 @@ protected:
 
     struct nsRequestInfo : public PLDHashEntryHdr
     {
-        nsRequestInfo(const void* key)
+        explicit nsRequestInfo(const void* key)
             : mKey(key), mCurrentProgress(0), mMaxProgress(0), mUploading(false)
             , mLastStatus(nullptr)
         {
diff --git a/uriloader/exthandler/nsHandlerService.js b/uriloader/exthandler/nsHandlerService.js
index 4e1672ed3a5..0b93243fe83 100644
--- a/uriloader/exthandler/nsHandlerService.js
+++ b/uriloader/exthandler/nsHandlerService.js
@@ -569,8 +569,8 @@ HandlerService.prototype = {
       if (!objpath)
         return null;
       
-      let interface = this._getValue(aHandlerAppID, NC_INTERFACE);
-      if (!interface)
+      let iface = this._getValue(aHandlerAppID, NC_INTERFACE);
+      if (!iface)
         return null;
       
       handlerApp = Cc["@mozilla.org/uriloader/dbus-handler-app;1"].
@@ -578,7 +578,7 @@ HandlerService.prototype = {
       handlerApp.service   = service;
       handlerApp.method    = method;
       handlerApp.objectPath   = objpath;
-      handlerApp.dBusInterface = interface;
+      handlerApp.dBusInterface = iface;
       
     }
     else
diff --git a/widget/nsIWidget.h b/widget/nsIWidget.h
index fceaff168e4..dac93db2d84 100644
--- a/widget/nsIWidget.h
+++ b/widget/nsIWidget.h
@@ -244,7 +244,7 @@ struct nsIMEUpdatePreference {
   {
   }
 
-  nsIMEUpdatePreference(Notifications aWantUpdates)
+  explicit nsIMEUpdatePreference(Notifications aWantUpdates)
     : mWantUpdates(aWantUpdates | DEFAULT_CONDITIONS_OF_NOTIFYING_CHANGES)
   {
   }
@@ -369,7 +369,7 @@ struct IMEState {
 
   IMEState() : mEnabled(ENABLED), mOpen(DONT_CHANGE_OPEN_STATE) { }
 
-  IMEState(Enabled aEnabled, Open aOpen = DONT_CHANGE_OPEN_STATE) :
+  explicit IMEState(Enabled aEnabled, Open aOpen = DONT_CHANGE_OPEN_STATE) :
     mEnabled(aEnabled), mOpen(aOpen)
   {
   }
@@ -452,8 +452,8 @@ struct InputContextAction {
   {
   }
 
-  InputContextAction(Cause aCause,
-                     FocusChange aFocusChange = FOCUS_NOT_CHANGED) :
+  explicit InputContextAction(Cause aCause,
+                              FocusChange aFocusChange = FOCUS_NOT_CHANGED) :
     mCause(aCause), mFocusChange(aFocusChange)
   {
   }
@@ -510,7 +510,7 @@ enum IMEMessage MOZ_ENUM_TYPE(int8_t)
 
 struct IMENotification
 {
-  IMENotification(IMEMessage aMessage)
+  MOZ_IMPLICIT IMENotification(IMEMessage aMessage)
     : mMessage(aMessage)
   {
     switch (aMessage) {
diff --git a/widget/xpwidgets/GfxInfoCollector.h b/widget/xpwidgets/GfxInfoCollector.h
index c4c1a618ee1..66c35fe9672 100644
--- a/widget/xpwidgets/GfxInfoCollector.h
+++ b/widget/xpwidgets/GfxInfoCollector.h
@@ -29,7 +29,7 @@ class MOZ_STACK_CLASS InfoObject
 
   private:
   // We need to ensure that this object lives on the stack so that GC sees it properly
-  InfoObject(JSContext *aCx);
+  explicit InfoObject(JSContext *aCx);
   InfoObject(InfoObject&);
 
   JSContext *mCx;
diff --git a/xpcom/base/nsMemoryInfoDumper.cpp b/xpcom/base/nsMemoryInfoDumper.cpp
index 3585abbf3b6..8b87396408f 100644
--- a/xpcom/base/nsMemoryInfoDumper.cpp
+++ b/xpcom/base/nsMemoryInfoDumper.cpp
@@ -319,7 +319,7 @@ class nsDumpGCAndCCLogsCallbackHolder MOZ_FINAL : public nsIDumpGCAndCCLogsCallb
 public:
   NS_DECL_ISUPPORTS
 
-  nsDumpGCAndCCLogsCallbackHolder(nsIDumpGCAndCCLogsCallback* aCallback)
+  explicit nsDumpGCAndCCLogsCallbackHolder(nsIDumpGCAndCCLogsCallback* aCallback)
     : mCallback(aCallback)
   {
   }
@@ -430,7 +430,7 @@ class DumpReportCallback MOZ_FINAL : public nsIHandleReportCallback
 public:
   NS_DECL_ISUPPORTS
 
-  DumpReportCallback(nsGZFileWriter* aWriter)
+  explicit DumpReportCallback(nsGZFileWriter* aWriter)
     : mIsFirst(true)
     , mWriter(aWriter)
   {
diff --git a/xpcom/base/nsMemoryReporterManager.cpp b/xpcom/base/nsMemoryReporterManager.cpp
index 00ebea78f15..5547b567240 100644
--- a/xpcom/base/nsMemoryReporterManager.cpp
+++ b/xpcom/base/nsMemoryReporterManager.cpp
@@ -1861,7 +1861,7 @@ namespace {
 class MinimizeMemoryUsageRunnable : public nsRunnable
 {
 public:
-  MinimizeMemoryUsageRunnable(nsIRunnable* aCallback)
+  explicit MinimizeMemoryUsageRunnable(nsIRunnable* aCallback)
     : mCallback(aCallback)
     , mRemainingIters(sNumIters)
   {
diff --git a/xpcom/base/nsMessageLoop.cpp b/xpcom/base/nsMessageLoop.cpp
index a04ad8cfa81..90a717b90b2 100644
--- a/xpcom/base/nsMessageLoop.cpp
+++ b/xpcom/base/nsMessageLoop.cpp
@@ -59,7 +59,7 @@ class MessageLoopTimerCallback
   : public nsITimerCallback
 {
 public:
-  MessageLoopTimerCallback(MessageLoopIdleTask* aTask);
+  explicit MessageLoopTimerCallback(MessageLoopIdleTask* aTask);
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSITIMERCALLBACK
diff --git a/xpcom/build/FileLocation.h b/xpcom/build/FileLocation.h
index d27175031eb..1fc5e353a20 100644
--- a/xpcom/build/FileLocation.h
+++ b/xpcom/build/FileLocation.h
@@ -36,7 +36,7 @@ public:
   /**
    * Constructor for plain files
    */
-  FileLocation(nsIFile *file);
+  explicit FileLocation(nsIFile *file);
 
   /**
    * Constructors for path within an archive. The archive can be given either
diff --git a/xpcom/build/IOInterposer.cpp b/xpcom/build/IOInterposer.cpp
index 03f8944cafe..d33ee03b96e 100644
--- a/xpcom/build/IOInterposer.cpp
+++ b/xpcom/build/IOInterposer.cpp
@@ -79,7 +79,7 @@ public:
 class PerThreadData
 {
 public:
-  PerThreadData(bool aIsMainThread = false)
+  explicit PerThreadData(bool aIsMainThread = false)
     : mIsMainThread(aIsMainThread)
     , mIsHandlingObservation(false)
     , mCurrentGeneration(0)
diff --git a/xpcom/build/IOInterposerPrivate.h b/xpcom/build/IOInterposerPrivate.h
index 0ba84abc7d0..84a80512267 100644
--- a/xpcom/build/IOInterposerPrivate.h
+++ b/xpcom/build/IOInterposerPrivate.h
@@ -71,7 +71,7 @@ private:
 class MonitorAutoLock
 {
 public:
-  MonitorAutoLock(Monitor &aMonitor)
+  explicit MonitorAutoLock(Monitor &aMonitor)
     : mMonitor(aMonitor)
   {
     mMonitor.Lock();
@@ -99,7 +99,7 @@ private:
 class MonitorAutoUnlock
 {
 public:
-  MonitorAutoUnlock(Monitor &aMonitor)
+  explicit MonitorAutoUnlock(Monitor &aMonitor)
     : mMonitor(aMonitor)
   {
     mMonitor.Unlock();
@@ -145,7 +145,7 @@ private:
 class AutoLock
 {
 public:
-  AutoLock(Mutex& aLock)
+  explicit AutoLock(Mutex& aLock)
     : mLock(aLock)
   {
     mLock.Lock();
diff --git a/xpcom/build/LateWriteChecks.cpp b/xpcom/build/LateWriteChecks.cpp
index 891998314c3..dfdc8661f38 100644
--- a/xpcom/build/LateWriteChecks.cpp
+++ b/xpcom/build/LateWriteChecks.cpp
@@ -94,7 +94,7 @@ static void RecordStackWalker(void *aPC, void *aSP, void *aClosure)
 class LateWriteObserver MOZ_FINAL : public IOInterposeObserver
 {
 public:
-  LateWriteObserver(const char* aProfileDirectory)
+  explicit LateWriteObserver(const char* aProfileDirectory)
     : mProfileDirectory(PL_strdup(aProfileDirectory))
   {
   }
diff --git a/xpcom/build/NSPRInterposer.cpp b/xpcom/build/NSPRInterposer.cpp
index dfa57b20fa1..3b55da149f1 100644
--- a/xpcom/build/NSPRInterposer.cpp
+++ b/xpcom/build/NSPRInterposer.cpp
@@ -27,7 +27,7 @@ PRFileInfo64FN sFileInfo64Fn = nullptr;
 class NSPRIOAutoObservation : public IOInterposeObserver::Observation
 {
 public:
-  NSPRIOAutoObservation(IOInterposeObserver::Operation aOp)
+  explicit NSPRIOAutoObservation(IOInterposeObserver::Operation aOp)
     : IOInterposeObserver::Observation(aOp, "NSPRIOInterposer")
   {
   }
diff --git a/xpcom/components/ManifestParser.cpp b/xpcom/components/ManifestParser.cpp
index 3fc18a7daa6..53bcf1e730e 100644
--- a/xpcom/components/ManifestParser.cpp
+++ b/xpcom/components/ManifestParser.cpp
@@ -153,7 +153,7 @@ IsNewline(char aChar)
 namespace {
 struct AutoPR_smprintf_free
 {
-  AutoPR_smprintf_free(char* aBuf) : mBuf(aBuf) {}
+  explicit AutoPR_smprintf_free(char* aBuf) : mBuf(aBuf) {}
 
   ~AutoPR_smprintf_free()
   {
diff --git a/xpcom/components/nsCategoryManager.h b/xpcom/components/nsCategoryManager.h
index 5c4c6cb853f..f2bf0e55a1c 100644
--- a/xpcom/components/nsCategoryManager.h
+++ b/xpcom/components/nsCategoryManager.h
@@ -34,7 +34,7 @@ class nsIMemoryReporter;
 class CategoryLeaf : public nsDepCharHashKey
 {
 public:
-  CategoryLeaf(const char* aKey) : nsDepCharHashKey(aKey), value(nullptr) {}
+  explicit CategoryLeaf(const char* aKey) : nsDepCharHashKey(aKey), value(nullptr) {}
   const char* value;
 };
 
diff --git a/xpcom/components/nsComponentManager.cpp b/xpcom/components/nsComponentManager.cpp
index 4ccfd7153fc..e51c267b6a6 100644
--- a/xpcom/components/nsComponentManager.cpp
+++ b/xpcom/components/nsComponentManager.cpp
@@ -215,7 +215,7 @@ namespace {
 class MOZ_STACK_CLASS MutexLock
 {
 public:
-  MutexLock(SafeMutex& aMutex)
+  explicit MutexLock(SafeMutex& aMutex)
     : mMutex(aMutex)
     , mLocked(false)
   {
diff --git a/xpcom/components/nsComponentManager.h b/xpcom/components/nsComponentManager.h
index d15a4dbd19e..ff51441fb4c 100644
--- a/xpcom/components/nsComponentManager.h
+++ b/xpcom/components/nsComponentManager.h
@@ -78,7 +78,7 @@ extern const mozilla::Module kXPCOMModule;
 class SafeMutex
 {
 public:
-  SafeMutex(const char* aName)
+  explicit SafeMutex(const char* aName)
     : mMutex(aName)
     , mOwnerThread(nullptr)
   {
@@ -212,14 +212,14 @@ public:
     {
     }
 
-    KnownModule(const mozilla::Module* aModule)
+    explicit KnownModule(const mozilla::Module* aModule)
       : mModule(aModule)
       , mLoaded(false)
       , mFailed(false)
     {
     }
 
-    KnownModule(mozilla::FileLocation& aFile)
+    explicit KnownModule(mozilla::FileLocation& aFile)
       : mModule(nullptr)
       , mFile(aFile)
       , mLoader(nullptr)
diff --git a/xpcom/ds/nsExpirationTracker.h b/xpcom/ds/nsExpirationTracker.h
index 24da7c64bd2..7b7d26f32f3 100644
--- a/xpcom/ds/nsExpirationTracker.h
+++ b/xpcom/ds/nsExpirationTracker.h
@@ -83,7 +83,7 @@ public:
    * period is zero, then we don't use a timer and rely on someone calling
    * AgeOneGeneration explicitly.
    */
-  nsExpirationTracker(uint32_t aTimerPeriod)
+  explicit nsExpirationTracker(uint32_t aTimerPeriod)
     : mTimerPeriod(aTimerPeriod)
     , mNewestGeneration(0)
     , mInAgeOneGeneration(false)
@@ -238,7 +238,7 @@ public:
     uint32_t mGeneration;
     uint32_t mIndex;
   public:
-    Iterator(nsExpirationTracker<T, K>* aTracker)
+    explicit Iterator(nsExpirationTracker<T, K>* aTracker)
       : mTracker(aTracker)
       , mGeneration(0)
       , mIndex(0)
diff --git a/xpcom/ds/nsWhitespaceTokenizer.h b/xpcom/ds/nsWhitespaceTokenizer.h
index 7b196e0de6b..b6b1d9096bc 100644
--- a/xpcom/ds/nsWhitespaceTokenizer.h
+++ b/xpcom/ds/nsWhitespaceTokenizer.h
@@ -17,7 +17,7 @@ class nsTWhitespaceTokenizer
   typedef typename DependentSubstringType::substring_type SubstringType;
 
 public:
-    nsTWhitespaceTokenizer(const SubstringType& aSource)
+    explicit nsTWhitespaceTokenizer(const SubstringType& aSource)
         : mIter(aSource.Data(), aSource.Length()),
           mEnd(aSource.Data() + aSource.Length(), aSource.Data(),
                aSource.Length()),
@@ -85,7 +85,7 @@ class nsWhitespaceTokenizerTemplate
   : public nsTWhitespaceTokenizer<nsDependentSubstring, IsWhitespace>
 {
 public:
-  nsWhitespaceTokenizerTemplate(const nsSubstring& aSource)
+  explicit nsWhitespaceTokenizerTemplate(const nsSubstring& aSource)
     : nsTWhitespaceTokenizer<nsDependentSubstring, IsWhitespace>(aSource)
   {
   }
@@ -98,7 +98,7 @@ class nsCWhitespaceTokenizerTemplate
   : public nsTWhitespaceTokenizer<nsDependentCSubstring, IsWhitespace>
 {
 public:
-  nsCWhitespaceTokenizerTemplate(const nsCSubstring& aSource)
+  explicit nsCWhitespaceTokenizerTemplate(const nsCSubstring& aSource)
     : nsTWhitespaceTokenizer<nsDependentCSubstring, IsWhitespace>(aSource)
   {
   }
diff --git a/xpcom/io/nsPipe3.cpp b/xpcom/io/nsPipe3.cpp
index 009bbda1f29..327f51daec5 100644
--- a/xpcom/io/nsPipe3.cpp
+++ b/xpcom/io/nsPipe3.cpp
@@ -109,7 +109,7 @@ public:
   NS_DECL_NSISEARCHABLEINPUTSTREAM
   NS_DECL_NSICLASSINFO
 
-  nsPipeInputStream(nsPipe* aPipe)
+  explicit nsPipeInputStream(nsPipe* aPipe)
     : mPipe(aPipe)
     , mReaderRefCnt(0)
     , mLogicalOffset(0)
@@ -176,7 +176,7 @@ public:
   NS_DECL_NSIASYNCOUTPUTSTREAM
   NS_DECL_NSICLASSINFO
 
-  nsPipeOutputStream(nsPipe* aPipe)
+  explicit nsPipeOutputStream(nsPipe* aPipe)
     : mPipe(aPipe)
     , mWriterRefCnt(0)
     , mLogicalOffset(0)
diff --git a/xpcom/io/nsUnicharInputStream.cpp b/xpcom/io/nsUnicharInputStream.cpp
index cfe6fe6184c..ee302948945 100644
--- a/xpcom/io/nsUnicharInputStream.cpp
+++ b/xpcom/io/nsUnicharInputStream.cpp
@@ -26,7 +26,7 @@
 class StringUnicharInputStream MOZ_FINAL : public nsIUnicharInputStream
 {
 public:
-  StringUnicharInputStream(const nsAString& aString) :
+  explicit StringUnicharInputStream(const nsAString& aString) :
     mString(aString), mPos(0), mLen(aString.Length()) { }
 
   NS_DECL_ISUPPORTS
diff --git a/xpcom/reflect/xptinfo/xptiprivate.h b/xpcom/reflect/xptinfo/xptiprivate.h
index 123f2f8e0e7..4b46e090e5d 100644
--- a/xpcom/reflect/xptinfo/xptiprivate.h
+++ b/xpcom/reflect/xptinfo/xptiprivate.h
@@ -107,7 +107,7 @@ public:
     const char* GetEntryNameAt(uint16_t i);
 
 private:
-    xptiTypelibGuts(XPTHeader* aHeader)
+    explicit xptiTypelibGuts(XPTHeader* aHeader)
         : mHeader(aHeader)
     { }
     ~xptiTypelibGuts();
@@ -128,7 +128,7 @@ class xptiInfoFlags
 {
     enum {STATE_MASK = 3};
 public:
-    xptiInfoFlags(uint8_t n) : mData(n) {}
+    explicit xptiInfoFlags(uint8_t n) : mData(n) {}
     xptiInfoFlags(const xptiInfoFlags& r) : mData(r.mData) {}
 
     static uint8_t GetStateMask()
@@ -334,7 +334,7 @@ public:
     NS_IMETHOD GetIIDForParamNoAlloc(uint16_t methodIndex, const nsXPTParamInfo * param, nsIID *iid) { return !mEntry ? NS_ERROR_UNEXPECTED : mEntry->GetIIDForParamNoAlloc(methodIndex, param, iid); }
 
 public:
-    xptiInterfaceInfo(xptiInterfaceEntry* entry);
+    explicit xptiInterfaceInfo(xptiInterfaceEntry* entry);
 
     void Invalidate() 
         {NS_IF_RELEASE(mParent); mEntry = nullptr;}
diff --git a/xpcom/tests/TestCOMArray.cpp b/xpcom/tests/TestCOMArray.cpp
index 545990650f7..c3be1f63f4e 100644
--- a/xpcom/tests/TestCOMArray.cpp
+++ b/xpcom/tests/TestCOMArray.cpp
@@ -29,7 +29,7 @@ class Foo MOZ_FINAL : public IFoo {
 
 public:
 
-  Foo(int32_t aID);
+  explicit Foo(int32_t aID);
 
   // nsISupports implementation
   NS_DECL_ISUPPORTS
diff --git a/xpcom/tests/TestHarness.h b/xpcom/tests/TestHarness.h
index b20b3d1e2e5..564504c078a 100644
--- a/xpcom/tests/TestHarness.h
+++ b/xpcom/tests/TestHarness.h
@@ -100,8 +100,8 @@ class ScopedXPCOM : public nsIDirectoryServiceProvider2
   public:
     NS_DECL_ISUPPORTS
 
-    ScopedXPCOM(const char* testName,
-                nsIDirectoryServiceProvider *dirSvcProvider = nullptr)
+    explicit ScopedXPCOM(const char* testName,
+                         nsIDirectoryServiceProvider *dirSvcProvider = nullptr)
     : mDirSvcProvider(dirSvcProvider)
     {
       mTestName = testName;
diff --git a/xpcom/tests/TestHashtables.cpp b/xpcom/tests/TestHashtables.cpp
index 5d3ac01b912..ef5eefd138c 100644
--- a/xpcom/tests/TestHashtables.cpp
+++ b/xpcom/tests/TestHashtables.cpp
@@ -21,7 +21,7 @@ namespace TestHashtables {
 class TestUniChar // for nsClassHashtable
 {
 public:
-  TestUniChar(uint32_t aWord)
+  explicit TestUniChar(uint32_t aWord)
   {
     printf("    TestUniChar::TestUniChar() %u\n", aWord);
     mWord = aWord;
@@ -70,7 +70,7 @@ public:
   typedef const char* KeyType;
   typedef const char* KeyTypePointer;
 
-  EntityToUnicodeEntry(const char* aKey) { mNode = nullptr; }
+  explicit EntityToUnicodeEntry(const char* aKey) { mNode = nullptr; }
   EntityToUnicodeEntry(const EntityToUnicodeEntry& aEntry) { mNode = aEntry.mNode; }
   ~EntityToUnicodeEntry() { }
 
diff --git a/xpcom/tests/TestObserverService.cpp b/xpcom/tests/TestObserverService.cpp
index ebe2b3f3499..4c1058e95b7 100644
--- a/xpcom/tests/TestObserverService.cpp
+++ b/xpcom/tests/TestObserverService.cpp
@@ -34,7 +34,7 @@ class TestObserver MOZ_FINAL : public nsIObserver,
                                public nsSupportsWeakReference
 {
 public:
-    TestObserver( const nsAString &name )
+    explicit TestObserver( const nsAString &name )
         : mName( name ) {
     }
     NS_DECL_ISUPPORTS
diff --git a/xpcom/tests/TestRacingServiceManager.cpp b/xpcom/tests/TestRacingServiceManager.cpp
index 1852cf34d83..23ba19981fb 100644
--- a/xpcom/tests/TestRacingServiceManager.cpp
+++ b/xpcom/tests/TestRacingServiceManager.cpp
@@ -67,7 +67,7 @@ bool gMainThreadWaiting = false;
 class AutoCreateAndDestroyReentrantMonitor
 {
 public:
-  AutoCreateAndDestroyReentrantMonitor(ReentrantMonitor** aReentrantMonitorPtr)
+  explicit AutoCreateAndDestroyReentrantMonitor(ReentrantMonitor** aReentrantMonitorPtr)
   : mReentrantMonitorPtr(aReentrantMonitorPtr) {
     *aReentrantMonitorPtr =
       new ReentrantMonitor("TestRacingServiceManager::AutoMon");
diff --git a/xpcom/tests/TestThreadPoolListener.cpp b/xpcom/tests/TestThreadPoolListener.cpp
index 05a91293c0a..9b0b10a4125 100644
--- a/xpcom/tests/TestThreadPoolListener.cpp
+++ b/xpcom/tests/TestThreadPoolListener.cpp
@@ -115,7 +115,7 @@ Listener::OnThreadShuttingDown()
 class AutoCreateAndDestroyReentrantMonitor
 {
 public:
-  AutoCreateAndDestroyReentrantMonitor(ReentrantMonitor** aReentrantMonitorPtr)
+  explicit AutoCreateAndDestroyReentrantMonitor(ReentrantMonitor** aReentrantMonitorPtr)
   : mReentrantMonitorPtr(aReentrantMonitorPtr) {
     *aReentrantMonitorPtr = new ReentrantMonitor("TestThreadPoolListener::AutoMon");
     TEST_ASSERTION(*aReentrantMonitorPtr, "Out of memory!");
diff --git a/xpcom/threads/TimerThread.cpp b/xpcom/threads/TimerThread.cpp
index 767f0e5c2bb..3ac8f24473e 100644
--- a/xpcom/threads/TimerThread.cpp
+++ b/xpcom/threads/TimerThread.cpp
@@ -51,7 +51,7 @@ namespace {
 class TimerObserverRunnable : public nsRunnable
 {
 public:
-  TimerObserverRunnable(nsIObserver* aObserver)
+  explicit TimerObserverRunnable(nsIObserver* aObserver)
     : mObserver(aObserver)
   {
   }
diff --git a/xpcom/threads/nsThread.cpp b/xpcom/threads/nsThread.cpp
index d62e923160e..f3f7fe2d1ad 100644
--- a/xpcom/threads/nsThread.cpp
+++ b/xpcom/threads/nsThread.cpp
@@ -243,7 +243,7 @@ struct nsThreadShutdownContext
 class nsThreadShutdownAckEvent : public nsRunnable
 {
 public:
-  nsThreadShutdownAckEvent(nsThreadShutdownContext* aCtx)
+  explicit nsThreadShutdownAckEvent(nsThreadShutdownContext* aCtx)
     : mShutdownContext(aCtx)
   {
   }