Merge m-c to f-t

2024-09-13 09:24:08 -07:00 · 2016-01-10 15:46:16 -08:00 · 2016-01-10 15:46:16 -08:00 · 6379f6fdf4
commit 6379f6fdf4
parent 0092001b54 bb18ebbaaa
173 changed files with 7483 additions and 316 deletions
--- a/b2g/components/test/unit/xpcshell.ini
+++ b/b2g/components/test/unit/xpcshell.ini
@ -18,6 +18,9 @@ tail =
 [test_logcapture.js]

 [test_logcapture_gonk.js]
+# can be slow because of what the test does, so let's give it some more time
+# to avoid intermittents: bug 1212395
+requesttimeoutfactor = 2
 # only run on b2g builds due to requiring b2g-specific log files to exist
 skip-if = toolkit != "gonk"

@ -26,6 +29,9 @@ skip-if = toolkit != "gonk"
 [test_logshake.js]

 [test_logshake_gonk.js]
+# can be slow because of what the test does, so let's give it some more time
+# to avoid intermittents: bug 1144499
+requesttimeoutfactor = 2
 head = head_logshake_gonk.js
 # only run on b2g builds due to requiring b2g-specific log files to exist
 skip-if = (toolkit != "gonk")
@ -52,6 +58,9 @@ head = file_killswitch.js
 skip-if = ((toolkit != "gonk") || (toolkit == "gonk" && debug))

 [test_persistentdatablock_gonk.js]
+# can be slow because of what the test does, so let's give it some more time
+# to avoid intermittents: bug 1235290
+requesttimeoutfactor = 2
 head = file_persistentdatablock.js
 skip-if = (toolkit != "gonk")

--- a/b2g/config/aries/sources.xml
+++ b/b2g/config/aries/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/emulator-l/sources.xml
+++ b/b2g/config/emulator-l/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@ -1,9 +1,9 @@
 {
    "git": {
-        "git_revision": "0e6160a58b41b48a8e4bb75ab9e722d9491251f4", 
+        "git_revision": "260e51a4262f75341e037e583dfc8f6835b5ab31", 
        "remote": "https://git.mozilla.org/releases/gaia.git", 
        "branch": ""
    }, 
-    "revision": "378762c5cb465ea89edfa93dfe81aa1af3993572", 
+    "revision": "1af9f0deab127d830bbd4e29651fed46614104f8", 
    "repo_path": "integration/gaia-central"
 }
--- a/b2g/config/nexus-4-kk/sources.xml
+++ b/b2g/config/nexus-4-kk/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/b2g/config/nexus-5-l/sources.xml
+++ b/b2g/config/nexus-5-l/sources.xml
@ -21,7 +21,7 @@
  <!--
    B2G repositories for all targets
    -->
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="0e6160a58b41b48a8e4bb75ab9e722d9491251f4"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="260e51a4262f75341e037e583dfc8f6835b5ab31"/>
  <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="4a962bdab532e18f53e9d2d114c349983262c6b7"/>
  <project name="moztt" path="external/moztt" remote="b2g" revision="99c333dab00ed79baff9e1cf76b320aee8e1c123"/>
  <project name="platform_hardware_libhardware_moz" path="hardware/libhardware_moz" remote="b2g" revision="fdf3a143dc777e5f9d33a88373af7ea161d3b440"/>
--- a/dom/animation/Animation.cpp
+++ b/dom/animation/Animation.cpp
@ -83,6 +83,15 @@ namespace {
 // Animation interface:
 //
 // ---------------------------------------------------------------------------
+void
+Animation::SetId(const nsAString& aId)
+{
+  if (mId == aId) {
+    return;
+  }
+  mId = aId;
+  nsNodeUtils::AnimationChanged(this);
+}

 void
 Animation::SetEffect(KeyframeEffectReadOnly* aEffect)
--- a/dom/animation/Animation.h
+++ b/dom/animation/Animation.h
@ -92,7 +92,8 @@ public:
  };

  // Animation interface methods
-
+  void GetId(nsAString& aResult) const { aResult = mId; }
+  void SetId(const nsAString& aId);
  KeyframeEffectReadOnly* GetEffect() const { return mEffect; }
  void SetEffect(KeyframeEffectReadOnly* aEffect);
  AnimationTimeline* GetTimeline() const { return mTimeline; }
@ -431,6 +432,8 @@ protected:
  // in that case mFinished is immediately reset to represent a new current
  // finished promise.
  bool mFinishedIsResolved;
+
+  nsString mId;
 };

 } // namespace dom
--- a/dom/animation/test/chrome/test_animation_observers.html
+++ b/dom/animation/test/chrome/test_animation_observers.html
@ -763,6 +763,27 @@ function assert_records(expected, desc) {
    });
  });

+  addAsyncAnimTest("change_id", aOptions, function*() {
+    e.style.animation = "anim 100s";
+
+    var animation = div.getAnimations()[0];
+    yield await_frame();
+    assert_records([{ added: [animation], changed: [], removed: []}],
+                   "records after creation");
+    animation.id = "new id";
+    yield await_frame();
+    assert_records([{ added: [], changed: [animation], removed: []}],
+                   "records after id is changed");
+
+    animation.id = "new id";
+    yield await_frame();
+    assert_records([],
+                   "records after assigning same value with id");
+
+    e.style.animation = "";
+    yield await_frame();
+  });
+
  // Test that making a redundant change to currentTime while an Animation
  // is pause-pending still generates a change MutationRecord since setting
  // the currentTime to any value in this state aborts the pending pause.
--- a/dom/animation/test/css-animations/file_animation-id.html
+++ b/dom/animation/test/css-animations/file_animation-id.html
@ -0,0 +1,27 @@
+<!doctype html>
+<meta charset=utf-8>
+<script src="../testcommon.js"></script>
+<style>
+@keyframes abc { }
+</style>
+<body>
+<script>
+'use strict';
+
+
+test(function(t) {
+  var div = addDiv(t);
+  div.style.animation = 'abc 100s';
+  var animation = div.getAnimations()[0];
+
+  assert_equals(animation.id, '', 'id for CSS Animation is initially empty');
+
+  animation.id = 'anim'
+
+  assert_equals(animation.id, 'anim', 'animation.id reflects the value set');
+  }, 'Animation.id for CSS Animations');
+
+done();
+</script>
+</body>
+</html>
--- a/dom/animation/test/css-animations/test_animation-id.html
+++ b/dom/animation/test/css-animations/test_animation-id.html
@ -0,0 +1,15 @@
+<!doctype html>
+<meta charset=utf-8>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<script>
+'use strict';
+setup({explicit_done: true});
+SpecialPowers.pushPrefEnv(
+  { "set": [["dom.animations-api.core.enabled", true]]},
+  function() {
+    window.open("file_animation-id.html");
+  });
+</script>
+</html>
--- a/dom/animation/test/mochitest.ini
+++ b/dom/animation/test/mochitest.ini
@ -14,6 +14,8 @@ support-files = css-animations/file_animation-currenttime.html
 support-files = css-animations/file_animation-finish.html
 [css-animations/test_animation-finished.html]
 support-files = css-animations/file_animation-finished.html
+[css-animations/test_animation-id.html]
+support-files = css-animations/file_animation-id.html
 [css-animations/test_animation-oncancel.html]
 support-files = css-animations/file_animation-oncancel.html
 [css-animations/test_animation-onfinish.html]
--- a/dom/media/platforms/omx/GonkOmxPlatformLayer.cpp
+++ b/dom/media/platforms/omx/GonkOmxPlatformLayer.cpp
@ -8,6 +8,11 @@
 #include "OmxPromiseLayer.h"
 #include "GonkOmxPlatformLayer.h"
 #include "MediaInfo.h"
+#include "ImageContainer.h"
+#include "mozilla/Monitor.h"
+#include "mozilla/layers/TextureClient.h"
+#include "mozilla/layers/GrallocTextureClient.h"
+#include "mozilla/layers/ImageBridgeChild.h"
 #include <binder/MemoryDealer.h>
 #include <media/IOMX.h>
 #include <utils/List.h>
@ -21,6 +26,12 @@ extern mozilla::LogModule* GetPDMLog();

 #define LOG(arg, ...) MOZ_LOG(GetPDMLog(), mozilla::LogLevel::Debug, ("GonkOmxPlatformLayer:: " arg, ##__VA_ARGS__))

+#define CHECK_ERR(err)                    \
+  if (err != OK)                       {  \
+    LOG("error %d at %s", err, __func__); \
+    return NS_ERROR_FAILURE;              \
+  }                                       \
+
 using namespace android;

 namespace mozilla {
@ -114,29 +125,211 @@ public:
 protected:
  RefPtr<TaskQueue> mTaskQueue;
  // TODO:
-  //   we should combination both event handlers into one. And we should provide
+  //   we should combine both event handlers into one. And we should provide
  //   an unified way for event handling in OmxPlatforLayer class.
  RefPtr<OmxPromiseLayer> mPromiseLayer;
  RefPtr<OmxDataDecoder> mClient;
 };

-GonkBufferData::GonkBufferData(android::IOMX::buffer_id aId, bool aLiveInLocal, android::IMemory* aMemory)
-  : BufferData((OMX_BUFFERHEADERTYPE*)aId)
-  , mId(aId)
+// This class allocates Gralloc buffer and manages TextureClient's recycle.
+class GonkTextureClientRecycleHandler : public layers::ITextureClientRecycleAllocator
+{
+  typedef MozPromise<layers::TextureClient*, nsresult, /* IsExclusive = */ true> TextureClientRecyclePromise;
+
+public:
+  GonkTextureClientRecycleHandler(OMX_VIDEO_PORTDEFINITIONTYPE& aDef)
+    : ITextureClientRecycleAllocator()
+    , mMonitor("GonkTextureClientRecycleHandler")
+  {
+    // Allocate Gralloc texture memory.
+    layers::GrallocTextureData* textureData =
+      layers::GrallocTextureData::Create(gfx::IntSize(aDef.nFrameWidth, aDef.nFrameHeight),
+                                         aDef.eColorFormat,
+                                         gfx::BackendType::NONE,
+                                         GraphicBuffer::USAGE_HW_TEXTURE | GraphicBuffer::USAGE_SW_READ_OFTEN,
+                                         layers::ImageBridgeChild::GetSingleton());
+
+    mGraphBuffer = textureData->GetGraphicBuffer();
+    MOZ_ASSERT(mGraphBuffer.get());
+
+    mTextureClient =
+      layers::TextureClient::CreateWithData(textureData,
+                                            layers::TextureFlags::DEALLOCATE_CLIENT | layers::TextureFlags::RECYCLE,
+                                            layers::ImageBridgeChild::GetSingleton());
+    MOZ_ASSERT(mTextureClient);
+
+    mPromise.SetMonitor(&mMonitor);
+  }
+
+  RefPtr<TextureClientRecyclePromise> WaitforRecycle()
+  {
+    MonitorAutoLock lock(mMonitor);
+    MOZ_ASSERT(!!mGraphBuffer.get());
+
+    mTextureClient->SetRecycleAllocator(this);
+    return mPromise.Ensure(__func__);
+  }
+
+  // DO NOT use smart pointer to receive TextureClient; otherwise it will
+  // distrupt the reference count.
+  layers::TextureClient* GetTextureClient()
+  {
+    return mTextureClient;
+  }
+
+  GraphicBuffer* GetGraphicBuffer()
+  {
+    MonitorAutoLock lock(mMonitor);
+    return mGraphBuffer.get();
+  }
+
+  // This function is called from layers thread.
+  void RecycleTextureClient(layers::TextureClient* aClient) override
+  {
+    MOZ_ASSERT(mTextureClient == aClient);
+
+    // Clearing the recycle allocator drops a reference, so make sure we stay alive
+    // for the duration of this function.
+    RefPtr<GonkTextureClientRecycleHandler> kungFuDeathGrip(this);
+    aClient->SetRecycleAllocator(nullptr);
+
+    {
+      MonitorAutoLock lock(mMonitor);
+      mPromise.ResolveIfExists(mTextureClient, __func__);
+    }
+  }
+
+  void Shutdown()
+  {
+    MonitorAutoLock lock(mMonitor);
+
+    mPromise.RejectIfExists(NS_ERROR_FAILURE, __func__);
+
+    // DO NOT clear TextureClient here.
+    // The ref count could be 1 and RecycleCallback will be called if we clear
+    // the ref count here. That breaks the whole mechanism. (RecycleCallback
+    // should be called from layers)
+    mGraphBuffer = nullptr;
+  }
+
+private:
+  // Because TextureClient calls RecycleCallbackl when ref count is 1, so we
+  // should hold only one reference here and use raw pointer when out of this
+  // class.
+  RefPtr<layers::TextureClient> mTextureClient;
+
+  // It is protected by mMonitor.
+  sp<android::GraphicBuffer> mGraphBuffer;
+
+  // It is protected by mMonitor.
+  MozPromiseHolder<TextureClientRecyclePromise> mPromise;
+
+  Monitor mMonitor;
+};
+
+GonkBufferData::GonkBufferData(bool aLiveInLocal,
+                               GonkOmxPlatformLayer* aGonkPlatformLayer)
+  : BufferData(nullptr)
+  , mId(0)
+  , mGonkPlatformLayer(aGonkPlatformLayer)
 {
  if (!aLiveInLocal) {
-    mLocalBuffer = new OMX_BUFFERHEADERTYPE;
-    PodZero(mLocalBuffer.get());
-    // aMemory is a IPC memory, it is safe to use it here.
-    mLocalBuffer->pBuffer = (OMX_U8*)aMemory->pointer();
-    mBuffer = mLocalBuffer.get();
+    mMirrorBuffer = new OMX_BUFFERHEADERTYPE;
+    PodZero(mMirrorBuffer.get());
+    mBuffer = mMirrorBuffer.get();
  }
 }

+void
+GonkBufferData::ReleaseBuffer()
+{
+  if (mTextureClientRecycleHandler) {
+    mTextureClientRecycleHandler->Shutdown();
+    mTextureClientRecycleHandler = nullptr;
+  }
+}
+
+nsresult
+GonkBufferData::InitSharedMemory(android::IMemory* aMemory)
+{
+  MOZ_RELEASE_ASSERT(mMirrorBuffer.get());
+
+  // aMemory is a IPC memory, it is safe to use it here.
+  mBuffer->pBuffer = (OMX_U8*)aMemory->pointer();
+  mBuffer->nAllocLen = aMemory->size();
+  return NS_OK;
+}
+
+nsresult
+GonkBufferData::InitLocalBuffer(IOMX::buffer_id aId)
+{
+  MOZ_RELEASE_ASSERT(!mMirrorBuffer.get());
+
+  mBuffer = (OMX_BUFFERHEADERTYPE*)aId;
+  return NS_OK;
+}
+
+nsresult
+GonkBufferData::InitGraphicBuffer(OMX_VIDEO_PORTDEFINITIONTYPE& aDef)
+{
+  mTextureClientRecycleHandler = new GonkTextureClientRecycleHandler(aDef);
+
+  if (!mTextureClientRecycleHandler->GetGraphicBuffer()) {
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_OK;
+}
+
+already_AddRefed<MediaData>
+GonkBufferData::GetPlatformMediaData()
+{
+  if (mGonkPlatformLayer->GetTrackInfo()->GetAsAudioInfo()) {
+    // This is audio decoding.
+    return nullptr;
+  }
+
+  MOZ_RELEASE_ASSERT(mTextureClientRecycleHandler);
+
+  VideoInfo info;
+  info.mDisplay = mGonkPlatformLayer->GetTrackInfo()->GetAsVideoInfo()->mDisplay;
+  info.mImage = mGonkPlatformLayer->GetTrackInfo()->GetAsVideoInfo()->mImage;
+  RefPtr<VideoData> data = VideoData::Create(info,
+                                             mGonkPlatformLayer->GetImageContainer(),
+                                             0,
+                                             mBuffer->nTimeStamp,
+                                             1,
+                                             mTextureClientRecycleHandler->GetTextureClient(),
+                                             false,
+                                             0,
+                                             info.mImage);
+  LOG("GetMediaData: %p, disp width %d, height %d, pic width %d, height %d, time %ld",
+      this, info.mDisplay.width, info.mDisplay.height,
+      info.mImage.width, info.mImage.height, mBuffer->nTimeStamp);
+
+  // Get TextureClient Promise here to wait for resolved.
+  RefPtr<GonkBufferData> self(this);
+  mTextureClientRecycleHandler->WaitforRecycle()
+    ->Then(mGonkPlatformLayer->GetTaskQueue(), __func__,
+           [self] () {
+             // Waiting for texture to be freed.
+             self->mTextureClientRecycleHandler->GetTextureClient()->WaitForBufferOwnership();
+             self->mPromise.ResolveIfExists(self, __func__);
+           },
+           [self] () {
+             OmxBufferFailureHolder failure(OMX_ErrorUndefined, self);
+             self->mPromise.RejectIfExists(failure, __func__);
+           });
+
+  return data.forget();
+}
+
 GonkOmxPlatformLayer::GonkOmxPlatformLayer(OmxDataDecoder* aDataDecoder,
                                           OmxPromiseLayer* aPromiseLayer,
-                                           TaskQueue* aTaskQueue)
+                                           TaskQueue* aTaskQueue,
+                                           layers::ImageContainer* aImageContainer)
  : mTaskQueue(aTaskQueue)
+  , mImageContainer(aImageContainer)
  , mNode(0)
  , mQuirks(0)
  , mUsingHardwareCodec(false)
@ -169,8 +362,27 @@ GonkOmxPlatformLayer::AllocateOmxBuffer(OMX_DIRTYPE aType,
    }
  }

-  size_t t = def.nBufferCountActual * def.nBufferSize;
-  LOG("Buffer count %d, buffer size %d", def.nBufferCountActual, def.nBufferSize);
+  size_t t = 0;
+
+  // Configure video output GraphicBuffer for video decoding acceleration.
+  bool useGralloc = false;
+  if ((aType == OMX_DirOutput) &&
+      (mQuirks & OMXCodec::kRequiresAllocateBufferOnOutputPorts) &&
+      (def.eDomain == OMX_PortDomainVideo)) {
+    if (NS_FAILED(EnableOmxGraphicBufferPort(def))) {
+      return NS_ERROR_FAILURE;
+    }
+
+    LOG("Enable OMX GraphicBuffer port, number %d, width %d, height %d", def.nBufferCountActual,
+        def.format.video.nFrameWidth, def.format.video.nFrameHeight);
+
+    useGralloc = true;
+
+    t = 1024; // MemoryDealer doesn't like 0, it's just for MemoryDealer happy.
+  } else {
+    t = def.nBufferCountActual * def.nBufferSize;
+    LOG("Buffer count %d, buffer size %d", def.nBufferCountActual, def.nBufferSize);
+  }

  bool liveinlocal = mOmx->livesLocally(mNode, getpid());

@ -178,24 +390,47 @@ GonkOmxPlatformLayer::AllocateOmxBuffer(OMX_DIRTYPE aType,
  // lives in mediaserver.
  mMemoryDealer[aType] = new MemoryDealer(t, "Gecko-OMX");
  for (OMX_U32 i = 0; i < def.nBufferCountActual; ++i) {
-    sp<IMemory> mem = mMemoryDealer[aType]->allocate(def.nBufferSize);
-    MOZ_ASSERT(mem.get());
-
+    RefPtr<GonkBufferData> buffer;
    IOMX::buffer_id bufferID;
    status_t st;
+    nsresult rv;

-    if ((mQuirks & OMXCodec::kRequiresAllocateBufferOnInputPorts && aType == OMX_DirInput) ||
-        (mQuirks & OMXCodec::kRequiresAllocateBufferOnOutputPorts && aType == OMX_DirOutput)) {
-      st = mOmx->allocateBufferWithBackup(mNode, aType, mem, &bufferID);
+    buffer = new GonkBufferData(liveinlocal, this);
+    if (useGralloc) {
+      // Buffer is lived remotely. Use GraphicBuffer for decoded video frame display.
+      rv = buffer->InitGraphicBuffer(def.format.video);
+      NS_ENSURE_SUCCESS(rv, rv);
+      st = mOmx->useGraphicBuffer(mNode,
+                                  def.nPortIndex,
+                                  buffer->mTextureClientRecycleHandler->GetGraphicBuffer(),
+                                  &bufferID);
+      CHECK_ERR(st);
    } else {
-      st = mOmx->useBuffer(mNode, aType, mem, &bufferID);
+      sp<IMemory> mem = mMemoryDealer[aType]->allocate(def.nBufferSize);
+      MOZ_ASSERT(mem.get());
+
+      if ((mQuirks & OMXCodec::kRequiresAllocateBufferOnInputPorts && aType == OMX_DirInput) ||
+          (mQuirks & OMXCodec::kRequiresAllocateBufferOnOutputPorts && aType == OMX_DirOutput)) {
+        // Buffer is lived remotely. We allocate a local OMX_BUFFERHEADERTYPE
+        // as the mirror of the remote OMX_BUFFERHEADERTYPE.
+        st = mOmx->allocateBufferWithBackup(mNode, aType, mem, &bufferID);
+        CHECK_ERR(st);
+        rv = buffer->InitSharedMemory(mem.get());
+        NS_ENSURE_SUCCESS(rv, rv);
+      } else {
+        // Buffer is lived locally, bufferID is the actually OMX_BUFFERHEADERTYPE
+        // pointer.
+        st = mOmx->useBuffer(mNode, aType, mem, &bufferID);
+        CHECK_ERR(st);
+        rv = buffer->InitLocalBuffer(bufferID);
+        NS_ENSURE_SUCCESS(rv, rv);
+      }
    }

-    if (st != OK) {
-      return NS_ERROR_FAILURE;
-    }
+    rv = buffer->SetBufferId(bufferID);
+    NS_ENSURE_SUCCESS(rv, rv);

-    aBufferList->AppendElement(new GonkBufferData(bufferID, liveinlocal, mem.get()));
+    aBufferList->AppendElement(buffer);
  }

  return NS_OK;
@ -206,12 +441,15 @@ GonkOmxPlatformLayer::ReleaseOmxBuffer(OMX_DIRTYPE aType,
                                       BUFFERLIST* aBufferList)
 {
  status_t st;
-  for (uint32_t i = 0; i < aBufferList->Length(); i++) {
-    IOMX::buffer_id id = (OMX_BUFFERHEADERTYPE*) aBufferList->ElementAt(i)->ID();
+  uint32_t len = aBufferList->Length();
+  for (uint32_t i = 0; i < len; i++) {
+    GonkBufferData* buffer = static_cast<GonkBufferData*>(aBufferList->ElementAt(i).get());
+    IOMX::buffer_id id = (OMX_BUFFERHEADERTYPE*) buffer->ID();
    st = mOmx->freeBuffer(mNode, aType, id);
    if (st != OK) {
      return NS_ERROR_FAILURE;
    }
+    buffer->ReleaseBuffer();
  }
  aBufferList->Clear();
  mMemoryDealer[aType].clear();
@ -219,6 +457,17 @@ GonkOmxPlatformLayer::ReleaseOmxBuffer(OMX_DIRTYPE aType,
  return NS_OK;
 }

+nsresult
+GonkOmxPlatformLayer::EnableOmxGraphicBufferPort(OMX_PARAM_PORTDEFINITIONTYPE& aDef)
+{
+  status_t st;
+
+  st = mOmx->enableGraphicBuffers(mNode, aDef.nPortIndex, OMX_TRUE);
+  CHECK_ERR(st);
+
+  return NS_OK;
+}
+
 OMX_ERRORTYPE
 GonkOmxPlatformLayer::GetState(OMX_STATETYPE* aType)
 {
@ -261,6 +510,7 @@ GonkOmxPlatformLayer::Shutdown()
 OMX_ERRORTYPE
 GonkOmxPlatformLayer::InitOmxToStateLoaded(const TrackInfo* aInfo)
 {
+  mInfo = aInfo;
  status_t err = mOmxClient.connect();
  if (err != OK) {
      return OMX_ErrorUndefined;
@ -270,11 +520,11 @@ GonkOmxPlatformLayer::InitOmxToStateLoaded(const TrackInfo* aInfo)
    return OMX_ErrorUndefined;
  }

-  // In Gonk, the software compoment name has prefix "OMX.google". It needs to
+  // In Gonk, the software component name has prefix "OMX.google". It needs to
  // have a way to use hardware codec first.
  android::Vector<OMXCodec::CodecNameAndQuirks> matchingCodecs;
  const char* swcomponent = nullptr;
-  OMXCodec::findMatchingCodecs(aInfo->mMimeType.Data(),
+  OMXCodec::findMatchingCodecs(mInfo->mMimeType.Data(),
                               0,
                               nullptr,
                               0,
@ -289,14 +539,15 @@ GonkOmxPlatformLayer::InitOmxToStateLoaded(const TrackInfo* aInfo)
        mUsingHardwareCodec = true;
        return OMX_ErrorNone;
      }
+      LOG("failed to load component %s", componentName);
    }
  }

  // TODO: in android ICS, the software codec is allocated in mediaserver by
-  //       default, it may be necessay to allocate it in local process.
+  //       default, it may be necessary to allocate it in local process.
  //
  // fallback to sw codec
-  if (LoadComponent(swcomponent)) {
+  if (swcomponent && LoadComponent(swcomponent)) {
    return OMX_ErrorNone;
  }

@ -318,7 +569,7 @@ GonkOmxPlatformLayer::EmptyThisBuffer(BufferData* aData)
 OMX_ERRORTYPE
 GonkOmxPlatformLayer::FillThisBuffer(BufferData* aData)
 {
-  return (OMX_ERRORTYPE)mOmx->fillBuffer(mNode, (IOMX::buffer_id)aData->mBuffer);
+  return (OMX_ERRORTYPE)mOmx->fillBuffer(mNode, (IOMX::buffer_id)aData->ID());
 }

 OMX_ERRORTYPE
@ -329,6 +580,14 @@ GonkOmxPlatformLayer::SendCommand(OMX_COMMANDTYPE aCmd,
  return  (OMX_ERRORTYPE)mOmx->sendCommand(mNode, aCmd, aParam1);
 }

+template<class T> void
+GonkOmxPlatformLayer::InitOmxParameter(T* aParam)
+{
+  PodZero(aParam);
+  aParam->nSize = sizeof(T);
+  aParam->nVersion.s.nVersionMajor = 1;
+}
+
 bool
 GonkOmxPlatformLayer::LoadComponent(const char* aName)
 {
@ -342,12 +601,16 @@ GonkOmxPlatformLayer::LoadComponent(const char* aName)
  return false;
 }

-template<class T> void
-GonkOmxPlatformLayer::InitOmxParameter(T* aParam)
+layers::ImageContainer*
+GonkOmxPlatformLayer::GetImageContainer()
 {
-  PodZero(aParam);
-  aParam->nSize = sizeof(T);
-  aParam->nVersion.s.nVersionMajor = 1;
+  return mImageContainer;
+}
+
+const TrackInfo*
+GonkOmxPlatformLayer::GetTrackInfo()
+{
+  return mInfo;
 }

 } // mozilla
--- a/dom/media/platforms/omx/GonkOmxPlatformLayer.h
+++ b/dom/media/platforms/omx/GonkOmxPlatformLayer.h
@ -13,62 +13,102 @@
 #include "OMX_Component.h"
 #include <utils/RefBase.h>
 #include <media/stagefright/OMXClient.h>
+#include "mozilla/layers/TextureClientRecycleAllocator.h"

 namespace android {
-class MemoryDealer;
 class IMemory;
+class MemoryDealer;
 }

 namespace mozilla {

 class GonkOmxObserver;
+class GonkOmxPlatformLayer;
+class GonkTextureClientRecycleHandler;

 /*
 * Due to Android's omx node could live in local process (client) or remote
- * process (mediaserver).
+ * process (mediaserver). And there are 3 kinds of buffer in Android OMX.
 *
- * When it is in local process, the IOMX::buffer_id is OMX_BUFFERHEADERTYPE
+ * 1.
+ * When buffer is in local process, the IOMX::buffer_id is OMX_BUFFERHEADERTYPE
 * pointer actually, it is safe to use it directly.
 *
- * When it is in remote process, the OMX_BUFFERHEADERTYPE pointer is 'IN' the
+ * 2.
+ * When buffer is in remote process, the OMX_BUFFERHEADERTYPE pointer is 'IN' the
 * remote process. It can't be used in local process, so here it allocates a
- * local OMX_BUFFERHEADERTYPE.
+ * local OMX_BUFFERHEADERTYPE. The raw/decoded data is in the android shared
+ * memory, IMemory.
+ *
+ * 3.
+ * When buffer is in remote process for the display output port. It uses
+ * GraphicBuffer to accelerate the decoding and display.
+ *
 */
 class GonkBufferData : public OmxPromiseLayer::BufferData {
 protected:
  virtual ~GonkBufferData() {}

 public:
-  // aMemory is an IPC based memory which will be used as the pBuffer in
-  // mLocalBuffer.
-  GonkBufferData(android::IOMX::buffer_id aId, bool aLiveInLocal, android::IMemory* aMemory);
+  GonkBufferData(bool aLiveInLocal,
+                 GonkOmxPlatformLayer* aLayer);

  BufferID ID() override
  {
    return mId;
  }

+  already_AddRefed<MediaData> GetPlatformMediaData() override;
+
  bool IsLocalBuffer()
  {
-    return !!mLocalBuffer.get();
+    return !!mMirrorBuffer.get();
  }

+  void ReleaseBuffer();
+
+  nsresult SetBufferId(android::IOMX::buffer_id aId)
+  {
+    mId = aId;
+    return NS_OK;
+  }
+
+  // The mBuffer is in local process. And aId is actually the OMX_BUFFERHEADERTYPE
+  // pointer. It doesn't need a mirror buffer.
+  nsresult InitLocalBuffer(android::IOMX::buffer_id aId);
+
+  // aMemory is an IPC based memory which will be used as the pBuffer in
+  // mBuffer. And the mBuffer will be the mirror OMX_BUFFERHEADERTYPE
+  // of the one in the remote process.
+  nsresult InitSharedMemory(android::IMemory* aMemory);
+
+  // GraphicBuffer is for video decoding acceleration on output port.
+  // Then mBuffer is the mirror OMX_BUFFERHEADERTYPE of the one in the remote
+  // process.
+  nsresult InitGraphicBuffer(OMX_VIDEO_PORTDEFINITIONTYPE& aDef);
+
  // Android OMX uses this id to pass the buffer between OMX component and
  // client.
  android::IOMX::buffer_id mId;

-  // mLocalBuffer are used only when the omx node is in mediaserver.
+  // mMirrorBuffer are used only when the omx node is in mediaserver.
  // Due to IPC problem, the mId is the OMX_BUFFERHEADERTYPE address in mediaserver.
  // It can't mapping to client process, so we need a local OMX_BUFFERHEADERTYPE
-  // here.
-  nsAutoPtr<OMX_BUFFERHEADERTYPE> mLocalBuffer;
+  // here to mirror the remote OMX_BUFFERHEADERTYPE in mediaserver.
+  nsAutoPtr<OMX_BUFFERHEADERTYPE> mMirrorBuffer;
+
+  // It creates GraphicBuffer and manages TextureClient.
+  RefPtr<GonkTextureClientRecycleHandler> mTextureClientRecycleHandler;
+
+  GonkOmxPlatformLayer* mGonkPlatformLayer;
 };

 class GonkOmxPlatformLayer : public OmxPlatformLayer {
 public:
  GonkOmxPlatformLayer(OmxDataDecoder* aDataDecoder,
                       OmxPromiseLayer* aPromiseLayer,
-                       TaskQueue* aTaskQueue);
+                       TaskQueue* aTaskQueue,
+                       layers::ImageContainer* aImageContainer);

  nsresult AllocateOmxBuffer(OMX_DIRTYPE aType, BUFFERLIST* aBufferList) override;

@ -97,17 +137,32 @@ public:
  nsresult Shutdown() override;

  // TODO:
-  // There is another InitOmxParameter in OmxDataDecoder. They need to combinate
+  // There is another InitOmxParameter in OmxDataDecoder. They need to combine
  // to one function.
  template<class T> void InitOmxParameter(T* aParam);

 protected:
+  friend GonkBufferData;
+
+  layers::ImageContainer* GetImageContainer();
+
+  const TrackInfo* GetTrackInfo();
+
+  TaskQueue* GetTaskQueue()
+  {
+    return mTaskQueue;
+  }
+
+  nsresult EnableOmxGraphicBufferPort(OMX_PARAM_PORTDEFINITIONTYPE& aDef);
+
  bool LoadComponent(const char* aName);

  friend class GonkOmxObserver;

  RefPtr<TaskQueue> mTaskQueue;

+  RefPtr<layers::ImageContainer> mImageContainer;
+
  // OMX_DirInput is 0, OMX_DirOutput is 1.
  android::sp<android::MemoryDealer> mMemoryDealer[2];

@ -122,6 +177,8 @@ protected:
  uint32_t mQuirks;

  bool mUsingHardwareCodec;
+
+  const TrackInfo* mInfo;
 };

 }
--- a/dom/media/platforms/omx/OmxDataDecoder.cpp
+++ b/dom/media/platforms/omx/OmxDataDecoder.cpp
@ -61,7 +61,8 @@ void GetPortIndex(nsTArray<uint32_t>& aPortIndex) {
 }

 OmxDataDecoder::OmxDataDecoder(const TrackInfo& aTrackInfo,
-                               MediaDataDecoderCallback* aCallback)
+                               MediaDataDecoderCallback* aCallback,
+                               layers::ImageContainer* aImageContainer)
  : mMonitor("OmxDataDecoder")
  , mOmxTaskQueue(CreateMediaDecodeTaskQueue())
  , mWatchManager(this, mOmxTaskQueue)
@ -75,7 +76,7 @@ OmxDataDecoder::OmxDataDecoder(const TrackInfo& aTrackInfo,
  , mCallback(aCallback)
 {
  LOG("(%p)", this);
-  mOmxLayer = new OmxPromiseLayer(mOmxTaskQueue, this);
+  mOmxLayer = new OmxPromiseLayer(mOmxTaskQueue, this, aImageContainer);

  nsCOMPtr<nsIRunnable> r =
    NS_NewRunnableMethod(this, &OmxDataDecoder::InitializationTask);
@ -85,7 +86,6 @@ OmxDataDecoder::OmxDataDecoder(const TrackInfo& aTrackInfo,
 OmxDataDecoder::~OmxDataDecoder()
 {
  LOG("(%p)", this);
-  mWatchManager.Shutdown();
 }

 void
@ -123,15 +123,11 @@ OmxDataDecoder::Init()
  //       Omx component.
  InvokeAsync(mOmxTaskQueue, mOmxLayer.get(), __func__, &OmxPromiseLayer::Init,
              mOmxTaskQueue, mTrackInfo.get())
-    ->Then(mReaderTaskQueue, __func__,
+    ->Then(mOmxTaskQueue, __func__,
      [self] () {
        // Omx state should be OMX_StateIdle.
-        nsCOMPtr<nsIRunnable> r =
-          NS_NewRunnableFunction([self] () {
-            self->mOmxState = self->mOmxLayer->GetState();
-            MOZ_ASSERT(self->mOmxState != OMX_StateIdle);
-          });
-        self->mOmxTaskQueue->Dispatch(r.forget());
+        self->mOmxState = self->mOmxLayer->GetState();
+        MOZ_ASSERT(self->mOmxState != OMX_StateIdle);
      },
      [self] () {
        self->RejectInitPromise(DecoderFailureReason::INIT_ERROR, __func__);
@ -191,9 +187,6 @@ OmxDataDecoder::Drain()
 {
  LOG("(%p)", this);

-  // TODO: For video decoding, it needs to copy the latest video frame to yuv
-  //       and output to layer again, because all video buffers will be released
-  //       later.
  nsCOMPtr<nsIRunnable> r =
    NS_NewRunnableMethod(this, &OmxDataDecoder::SendEosBuffer);
  mOmxTaskQueue->Dispatch(r.forget());
@ -233,7 +226,7 @@ OmxDataDecoder::DoAsyncShutdown()
 {
  LOG("(%p)", this);
  MOZ_ASSERT(mOmxTaskQueue->IsCurrentThreadIn());
-  MOZ_ASSERT(mFlushing);
+  MOZ_ASSERT(!mFlushing);

  mWatchManager.Unwatch(mOmxState, &OmxDataDecoder::OmxStateRunner);
  mWatchManager.Unwatch(mPortSettingsChanged, &OmxDataDecoder::PortSettingsChanged);
@ -255,25 +248,17 @@ OmxDataDecoder::DoAsyncShutdown()
             RefPtr<OmxCommandPromise> p =
               self->mOmxLayer->SendCommand(OMX_CommandStateSet, OMX_StateLoaded, nullptr);

-             LOG("DoAsyncShutdown: collecting buffers...");
-             self->CollectBufferPromises(OMX_DirMax)
-               ->Then(self->mOmxTaskQueue, __func__,
-                   [self] () {
-                   // According to spec 3.1.1.2.2.1:
-                   // OMX_StateLoaded needs to be sent before releasing buffers.
-                   // And state transition from OMX_StateIdle to OMX_StateLoaded
-                   // is completed when all of the buffers have been removed
-                   // from the component.
-                   // Here the buffer promises are not resolved due to displaying
-                   // in layer, it needs to wait before the layer returns the
-                   // buffers.
-                   LOG("DoAsyncShutdown: all buffers collected, releasing buffers...");
-                   self->ReleaseBuffers(OMX_DirInput);
-                   self->ReleaseBuffers(OMX_DirOutput);
-                   },
-                   [self] () {
-                     self->mOmxLayer->Shutdown();
-                   });
+             // According to spec 3.1.1.2.2.1:
+             // OMX_StateLoaded needs to be sent before releasing buffers.
+             // And state transition from OMX_StateIdle to OMX_StateLoaded
+             // is completed when all of the buffers have been removed
+             // from the component.
+             // Here the buffer promises are not resolved due to displaying
+             // in layer, it needs to wait before the layer returns the
+             // buffers.
+             LOG("DoAsyncShutdown: releasing buffers...");
+             self->ReleaseBuffers(OMX_DirInput);
+             self->ReleaseBuffers(OMX_DirOutput);

             return p;
           },
@ -285,6 +270,8 @@ OmxDataDecoder::DoAsyncShutdown()
           [self] () {
             LOG("DoAsyncShutdown: OMX_StateLoaded, it is safe to shutdown omx");
             self->mOmxLayer->Shutdown();
+             self->mWatchManager.Shutdown();
+             self->mOmxLayer = nullptr;

             MonitorAutoLock lock(self->mMonitor);
             self->mShuttingDown = false;
@ -292,6 +279,8 @@ OmxDataDecoder::DoAsyncShutdown()
           },
           [self] () {
             self->mOmxLayer->Shutdown();
+             self->mWatchManager.Shutdown();
+             self->mOmxLayer = nullptr;

             MonitorAutoLock lock(self->mMonitor);
             self->mShuttingDown = false;
@ -299,40 +288,11 @@ OmxDataDecoder::DoAsyncShutdown()
           });
 }

-void
-OmxDataDecoder::CheckIfInputExhausted()
-{
-  MOZ_ASSERT(mOmxTaskQueue->IsCurrentThreadIn());
-  MOZ_ASSERT(!mCheckingInputExhausted);
-
-  mCheckingInputExhausted = false;
-
-  if (mMediaRawDatas.Length()) {
-    return;
-  }
-
-  // When all input buffers are not in omx component, it means all samples have
-  // been fed into OMX component.
-  for (auto buf : mInPortBuffers) {
-    if (buf->mStatus == BufferData::BufferStatus::OMX_COMPONENT) {
-      return;
-    }
-  }
-
-  // When all output buffers are held by component, it means client is waiting for output.
-  for (auto buf : mOutPortBuffers) {
-    if (buf->mStatus != BufferData::BufferStatus::OMX_COMPONENT) {
-      return;
-    }
-  }
-
-  LOG("Call InputExhausted()");
-  mCallback->InputExhausted();
-}
-
 void
 OmxDataDecoder::OutputAudio(BufferData* aBufferData)
 {
+  // TODO: it'd be better to move these code to BufferData::GetPlatformMediaData() or
+  //       some kind of abstract layer.
  MOZ_ASSERT(mOmxTaskQueue->IsCurrentThreadIn());
  OMX_BUFFERHEADERTYPE* buf = aBufferData->mBuffer;
  AudioInfo* info = mTrackInfo->GetAsAudioInfo();
@ -357,31 +317,80 @@ OmxDataDecoder::OutputAudio(BufferData* aBufferData)
  aBufferData->mStatus = BufferData::BufferStatus::FREE;
 }

+void
+OmxDataDecoder::OutputVideo(BufferData* aBufferData)
+{
+  MOZ_ASSERT(mOmxTaskQueue->IsCurrentThreadIn());
+
+  RefPtr<MediaData> data = aBufferData->GetPlatformMediaData();
+  MOZ_RELEASE_ASSERT(data);
+
+  VideoData* video(data->As<VideoData>());
+  if (aBufferData->mRawData) {
+    video->mTime = aBufferData->mRawData->mTime;
+    video->mTimecode = aBufferData->mRawData->mTimecode;
+    video->mOffset = aBufferData->mRawData->mOffset;
+    video->mDuration = aBufferData->mRawData->mDuration;
+    video->mKeyframe = aBufferData->mRawData->mKeyframe;
+  }
+
+  aBufferData->mStatus = BufferData::BufferStatus::OMX_CLIENT_OUTPUT;
+
+  // TextureClient's recycle callback is called when reference count of
+  // TextureClient becomes 1. In most cases, the last reference count is held
+  // by ITextureClientRecycleAllocator.
+  // And then promise will be resolved in the callback.
+  // TODO:
+  //   Because it is gonk specific behaviour, it needs to find a way to
+  //   proper abstracting it.
+  MOZ_RELEASE_ASSERT(aBufferData->mPromise.IsEmpty());
+  RefPtr<OmxBufferPromise> p = aBufferData->mPromise.Ensure(__func__);
+
+  RefPtr<OmxDataDecoder> self = this;
+  RefPtr<BufferData> buffer = aBufferData;
+  p->Then(mOmxTaskQueue, __func__,
+          [self, buffer] () {
+            MOZ_RELEASE_ASSERT(buffer->mStatus == BufferData::BufferStatus::OMX_CLIENT_OUTPUT);
+            buffer->mStatus = BufferData::BufferStatus::FREE;
+            self->FillAndEmptyBuffers();
+          },
+          [buffer] () {
+            MOZ_RELEASE_ASSERT(buffer->mStatus == BufferData::BufferStatus::OMX_CLIENT_OUTPUT);
+            buffer->mStatus = BufferData::BufferStatus::FREE;
+          });
+
+  mCallback->Output(video);
+}
+
 void
 OmxDataDecoder::FillBufferDone(BufferData* aData)
 {
  MOZ_ASSERT(!aData || aData->mStatus == BufferData::BufferStatus::OMX_CLIENT);

-  if (mTrackInfo->IsAudio()) {
-    OutputAudio(aData);
-  } else {
-    MOZ_ASSERT(0);
+  // Don't output sample when flush or shutting down, especially for video
+  // decoded frame. Because video decoded frame has a promise in BufferData
+  // waiting for layer to resolve it via recycle callback on Gonk, if other
+  // module doesn't send it to layer, it will cause a unresolved promise and
+  // waiting for resolve infinitely.
+  if (mFlushing || mShuttingDown) {
+    LOG("mFlush or mShuttingDown, drop data");
+    aData->mStatus = BufferData::BufferStatus::FREE;
+    return;
  }

  if (aData->mBuffer->nFlags & OMX_BUFFERFLAG_EOS) {
+    // Reach eos, it's an empty data so it doesn't need to output.
    EndOfStream();
+    aData->mStatus = BufferData::BufferStatus::FREE;
  } else {
-    FillAndEmptyBuffers();
-
-    // If the latest decoded sample's MediaRawData is also the latest input
-    // sample, it means there is no input data in queue and component, calling
-    // CheckIfInputExhausted().
-    if (aData->mRawData == mLatestInputRawData && !mCheckingInputExhausted) {
-      mCheckingInputExhausted = true;
-      nsCOMPtr<nsIRunnable> r =
-        NS_NewRunnableMethod(this, &OmxDataDecoder::CheckIfInputExhausted);
-      mOmxTaskQueue->Dispatch(r.forget());
+    if (mTrackInfo->IsAudio()) {
+      OutputAudio(aData);
+    } else if (mTrackInfo->IsVideo()) {
+      OutputVideo(aData);
+    } else {
+      MOZ_ASSERT(0);
    }
+    FillAndEmptyBuffers();
  }
 }

@ -399,6 +408,30 @@ OmxDataDecoder::EmptyBufferDone(BufferData* aData)
  // Nothing to do when status of input buffer is OMX_CLIENT.
  aData->mStatus = BufferData::BufferStatus::FREE;
  FillAndEmptyBuffers();
+
+  // There is no way to know if component gets enough raw samples to generate
+  // output, especially for video decoding. So here it needs to request raw
+  // samples aggressively.
+  if (!mCheckingInputExhausted && !mMediaRawDatas.Length()) {
+    mCheckingInputExhausted = true;
+
+    RefPtr<OmxDataDecoder> self = this;
+    nsCOMPtr<nsIRunnable> r =
+      NS_NewRunnableFunction([self] () {
+        MOZ_ASSERT(self->mOmxTaskQueue->IsCurrentThreadIn());
+
+        self->mCheckingInputExhausted = false;
+
+        if (self->mMediaRawDatas.Length()) {
+          return;
+        }
+
+        LOG("Call InputExhausted()");
+        self->mCallback->InputExhausted();
+      });
+
+    mOmxTaskQueue->Dispatch(r.forget());
+  }
 }

 void
@ -427,7 +460,7 @@ OmxDataDecoder::FillAndEmptyBuffers()

  // Trigger input port.
  while (!!mMediaRawDatas.Length()) {
-    // input buffer must be usedi by component if there is data available.
+    // input buffer must be used by component if there is data available.
    RefPtr<BufferData> inbuf = FindAvailableBuffer(OMX_DirInput);
    if (!inbuf) {
      LOG("no input buffer!");
@ -435,10 +468,12 @@ OmxDataDecoder::FillAndEmptyBuffers()
    }

    RefPtr<MediaRawData> data = mMediaRawDatas[0];
+    // Buffer size should large enough for raw data.
+    MOZ_RELEASE_ASSERT(inbuf->mBuffer->nAllocLen >= data->Size());
+
    memcpy(inbuf->mBuffer->pBuffer, data->Data(), data->Size());
    inbuf->mBuffer->nFilledLen = data->Size();
    inbuf->mBuffer->nOffset = 0;
-    // TODO: the frame size could larger than buffer size in video case.
    inbuf->mBuffer->nFlags = inbuf->mBuffer->nAllocLen > data->Size() ?
                             OMX_BUFFERFLAG_ENDOFFRAME : 0;
    inbuf->mBuffer->nTimeStamp = data->mTime;
@ -454,7 +489,6 @@ OmxDataDecoder::FillAndEmptyBuffers()
    mOmxLayer->EmptyBuffer(inbuf)->Then(mOmxTaskQueue, __func__, this,
                                        &OmxDataDecoder::EmptyBufferDone,
                                        &OmxDataDecoder::EmptyBufferFailure);
-    mLatestInputRawData.swap(mMediaRawDatas[0]);
    mMediaRawDatas.RemoveElementAt(0);
  }

@ -551,9 +585,11 @@ OmxDataDecoder::OmxStateRunner()
    // Config codec parameters by minetype.
    if (mTrackInfo->IsAudio()) {
      ConfigAudioCodec();
+    } else if (mTrackInfo->IsVideo()) {
+      ConfigVideoCodec();
    }

-    // Send OpenMax state commane to OMX_StateIdle.
+    // Send OpenMax state command to OMX_StateIdle.
    RefPtr<OmxDataDecoder> self = this;
    mOmxLayer->SendCommand(OMX_CommandStateSet, OMX_StateIdle, nullptr)
      ->Then(mOmxTaskQueue, __func__,
@ -589,7 +625,7 @@ OmxDataDecoder::OmxStateRunner()
               self->RejectInitPromise(DecoderFailureReason::INIT_ERROR, __func__);
             });
  } else if (mOmxState == OMX_StateExecuting) {
-    // Config codec once it gets OMX_StateExecuting state.
+    // Configure codec once it gets OMX_StateExecuting state.
    FillCodecConfigDataToOmx();
  } else {
    MOZ_ASSERT(0);
@ -618,32 +654,87 @@ OmxDataDecoder::ConfigAudioCodec()
  }
 }

+void
+OmxDataDecoder::ConfigVideoCodec()
+{
+  OMX_ERRORTYPE err;
+  const VideoInfo* videoInfo = mTrackInfo->GetAsVideoInfo();
+
+  OMX_PARAM_PORTDEFINITIONTYPE def;
+
+  // Set up in/out port definition.
+  nsTArray<uint32_t> ports;
+  GetPortIndex(ports);
+  for (auto idx : ports) {
+    InitOmxParameter(&def);
+    def.nPortIndex = idx;
+    err = mOmxLayer->GetParameter(OMX_IndexParamPortDefinition,
+                                  &def,
+                                  sizeof(def));
+    if (err != OMX_ErrorNone) {
+      return;
+    }
+
+    def.format.video.nFrameWidth =  videoInfo->mDisplay.width;
+    def.format.video.nFrameHeight = videoInfo->mDisplay.height;
+    def.format.video.nStride = videoInfo->mImage.width;
+    def.format.video.nSliceHeight = videoInfo->mImage.height;
+
+    // TODO: it needs to add other formats like webm, mp4, h263... etc.
+    OMX_VIDEO_CODINGTYPE codetype;
+    if (videoInfo->mMimeType.EqualsLiteral("video/avc")) {
+      codetype = OMX_VIDEO_CodingAVC;
+    }
+
+    if (def.eDir == OMX_DirInput) {
+      def.format.video.eCompressionFormat = codetype;
+      def.format.video.eColorFormat = OMX_COLOR_FormatUnused;
+    } else {
+      def.format.video.eCompressionFormat = OMX_VIDEO_CodingUnused;
+    }
+
+    err = mOmxLayer->SetParameter(OMX_IndexParamPortDefinition,
+                                  &def,
+                                  sizeof(def));
+    if (err != OMX_ErrorNone) {
+      return;
+    }
+  }
+}
+
 void
 OmxDataDecoder::FillCodecConfigDataToOmx()
 {
-  // Codec config data should be the first sample running on Omx TaskQueue.
+  // Codec configure data should be the first sample running on Omx TaskQueue.
  MOZ_ASSERT(mOmxTaskQueue->IsCurrentThreadIn());
  MOZ_ASSERT(!mMediaRawDatas.Length());
  MOZ_ASSERT(mOmxState == OMX_StateIdle || mOmxState == OMX_StateExecuting);


  RefPtr<BufferData> inbuf = FindAvailableBuffer(OMX_DirInput);
+  RefPtr<MediaByteBuffer> csc;
  if (mTrackInfo->IsAudio()) {
-    AudioInfo* audio_info = mTrackInfo->GetAsAudioInfo();
-    memcpy(inbuf->mBuffer->pBuffer,
-           audio_info->mCodecSpecificConfig->Elements(),
-           audio_info->mCodecSpecificConfig->Length());
-    inbuf->mBuffer->nFilledLen = audio_info->mCodecSpecificConfig->Length();
-    inbuf->mBuffer->nOffset = 0;
-    inbuf->mBuffer->nFlags = (OMX_BUFFERFLAG_ENDOFFRAME | OMX_BUFFERFLAG_CODECCONFIG);
-  } else {
-    MOZ_ASSERT(0);
+    csc = mTrackInfo->GetAsAudioInfo()->mCodecSpecificConfig;
+  } else if (mTrackInfo->IsVideo()) {
+    csc = mTrackInfo->GetAsVideoInfo()->mCodecSpecificConfig;
  }

-  LOG("Feed codec configure data to OMX component");
-  mOmxLayer->EmptyBuffer(inbuf)->Then(mOmxTaskQueue, __func__, this,
-                                      &OmxDataDecoder::EmptyBufferDone,
-                                      &OmxDataDecoder::EmptyBufferFailure);
+  MOZ_RELEASE_ASSERT(csc);
+
+  // Some codecs like h264, its codec specific data is at the first packet, not in container.
+  if (csc->Length()) {
+    memcpy(inbuf->mBuffer->pBuffer,
+           csc->Elements(),
+           csc->Length());
+    inbuf->mBuffer->nFilledLen = csc->Length();
+    inbuf->mBuffer->nOffset = 0;
+    inbuf->mBuffer->nFlags = (OMX_BUFFERFLAG_ENDOFFRAME | OMX_BUFFERFLAG_CODECCONFIG);
+
+    LOG("Feed codec configure data to OMX component");
+    mOmxLayer->EmptyBuffer(inbuf)->Then(mOmxTaskQueue, __func__, this,
+                                        &OmxDataDecoder::EmptyBufferDone,
+                                        &OmxDataDecoder::EmptyBufferFailure);
+  }
 }

 bool
--- a/dom/media/platforms/omx/OmxDataDecoder.h
+++ b/dom/media/platforms/omx/OmxDataDecoder.h
@ -27,7 +27,7 @@ typedef OmxPromiseLayer::BUFFERLIST BUFFERLIST;
 *   2. Keeping the buffers between client and component.
 *   3. Manage the OMX state.
 *
- * From the definiton in OpenMax spec. "2.2.1", there are 3 major roles in
+ * From the definition in OpenMax spec. "2.2.1", there are 3 major roles in
 * OpenMax IL.
 *
 * IL client:
@ -54,7 +54,8 @@ protected:

 public:
  OmxDataDecoder(const TrackInfo& aTrackInfo,
-                 MediaDataDecoderCallback* aCallback);
+                 MediaDataDecoderCallback* aCallback,
+                 layers::ImageContainer* aImageContainer);

  RefPtr<InitPromise> Init() override;

@ -90,10 +91,11 @@ protected:

  void NotifyError(OMX_ERRORTYPE aError, const char* aLine);

-  // Config audio codec.
+  // Configure audio codec.
  // Some codec may just ignore this and rely on codec specific data in
  // FillCodecConfigDataToOmx().
  void ConfigAudioCodec();
+  void ConfigVideoCodec();

  // Sending codec specific data to OMX component. OMX component could send a
  // OMX_EventPortSettingsChanged back to client. And then client needs to
@ -110,10 +112,7 @@ protected:

  void OutputAudio(BufferData* aBufferData);

-  // Notify InputExhausted when:
-  //   1. all input buffers are not held by component.
-  //   2. all output buffers are waiting for filling complete.
-  void CheckIfInputExhausted();
+  void OutputVideo(BufferData* aBufferData);

  // Buffer can be released if its status is not OMX_COMPONENT or
  // OMX_CLIENT_OUTPUT.
@ -182,9 +181,6 @@ protected:
  // It is access in Omx TaskQueue.
  nsTArray<RefPtr<MediaRawData>> mMediaRawDatas;

-  // It is access in Omx TaskQueue. The latest input MediaRawData.
-  RefPtr<MediaRawData> mLatestInputRawData;
-
  BUFFERLIST mInPortBuffers;

  BUFFERLIST mOutPortBuffers;
--- a/dom/media/platforms/omx/OmxDecoderModule.cpp
+++ b/dom/media/platforms/omx/OmxDecoderModule.cpp
@ -16,7 +16,8 @@ OmxDecoderModule::CreateVideoDecoder(const VideoInfo& aConfig,
                                     FlushableTaskQueue* aVideoTaskQueue,
                                     MediaDataDecoderCallback* aCallback)
 {
-  return nullptr;
+  RefPtr<OmxDataDecoder> decoder = new OmxDataDecoder(aConfig, aCallback, aImageContainer);
+  return decoder.forget();
 }

 already_AddRefed<MediaDataDecoder>
@ -24,7 +25,7 @@ OmxDecoderModule::CreateAudioDecoder(const AudioInfo& aConfig,
                                     FlushableTaskQueue* aAudioTaskQueue,
                                     MediaDataDecoderCallback* aCallback)
 {
-  RefPtr<OmxDataDecoder> decoder = new OmxDataDecoder(aConfig, aCallback);
+  RefPtr<OmxDataDecoder> decoder = new OmxDataDecoder(aConfig, aCallback, nullptr);
  return decoder.forget();
 }

@ -43,7 +44,8 @@ OmxDecoderModule::DecoderNeedsConversion(const TrackInfo& aConfig) const
 bool
 OmxDecoderModule::SupportsMimeType(const nsACString& aMimeType) const
 {
-  return aMimeType.EqualsLiteral("audio/mp4a-latm");
+  return aMimeType.EqualsLiteral("audio/mp4a-latm") ||
+         aMimeType.EqualsLiteral("video/avc");
 }

 }
--- a/dom/media/platforms/omx/OmxPlatformLayer.h
+++ b/dom/media/platforms/omx/OmxPlatformLayer.h
@ -16,6 +16,7 @@
 namespace mozilla {

 class TrackInfo;
+class VideoData;

 /*
 * This class the the abstract layer of the platform OpenMax IL implementation.
--- a/dom/media/platforms/omx/OmxPromiseLayer.cpp
+++ b/dom/media/platforms/omx/OmxPromiseLayer.cpp
@ -8,7 +8,7 @@
 #include "OmxPlatformLayer.h"
 #include "OmxDataDecoder.h"

-#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION < 21
+#if defined(MOZ_WIDGET_GONK) && (ANDROID_VERSION == 20 || ANDROID_VERSION == 19)
 #include "GonkOmxPlatformLayer.h"
 #endif

@ -24,11 +24,13 @@ namespace mozilla {

 extern void GetPortIndex(nsTArray<uint32_t>& aPortIndex);

-OmxPromiseLayer::OmxPromiseLayer(TaskQueue* aTaskQueue, OmxDataDecoder* aDataDecoder)
+OmxPromiseLayer::OmxPromiseLayer(TaskQueue* aTaskQueue,
+                                 OmxDataDecoder* aDataDecoder,
+                                 layers::ImageContainer* aImageContainer)
  : mTaskQueue(aTaskQueue)
 {
-#if defined(MOZ_WIDGET_GONK) && ANDROID_VERSION < 21
-  mPlatformLayer = new GonkOmxPlatformLayer(aDataDecoder, this, aTaskQueue);
+#if defined(MOZ_WIDGET_GONK) && (ANDROID_VERSION == 20 || ANDROID_VERSION == 19)
+  mPlatformLayer = new GonkOmxPlatformLayer(aDataDecoder, this, aTaskQueue, aImageContainer);
 #endif
  MOZ_ASSERT(!!mPlatformLayer);
 }
@ -182,16 +184,7 @@ void
 OmxPromiseLayer::EmptyFillBufferDone(OMX_DIRTYPE aType, BufferData::BufferID aID)
 {
  RefPtr<BufferData> holder = FindAndRemoveBufferHolder(aType, aID);
-  MOZ_ASSERT(!!holder);
-  LOG("EmptyFillBufferDone: type %d, buffer %p", aType, holder->mBuffer);
-  if (holder) {
-    if (aType == OMX_DirOutput) {
-      holder->mRawData = nullptr;
-      holder->mRawData = FindAndRemoveRawData(holder->mBuffer->nTimeStamp);
-    }
-    holder->mStatus = BufferData::BufferStatus::OMX_CLIENT;
-    holder->mPromise.Resolve(holder, __func__);
-  }
+  EmptyFillBufferDone(aType, holder);
 }

 RefPtr<OmxPromiseLayer::OmxCommandPromise>
@ -203,7 +196,7 @@ OmxPromiseLayer::SendCommand(OMX_COMMANDTYPE aCmd, OMX_U32 aParam1, OMX_PTR aCmd

    // Some coomponents don't send event with OMX_ALL, they send flush complete
    // event with input port and another event for output port.
-    // In prupose of better compatibility, we inteprete the OMX_ALL to OMX_DirInput
+    // In prupose of better compatibility, we interpret the OMX_ALL to OMX_DirInput
    // and OMX_DirOutput flush separately.
    OMX_DIRTYPE types[] = {OMX_DIRTYPE::OMX_DirInput, OMX_DIRTYPE::OMX_DirOutput};
    for(const auto type : types) {
@ -217,7 +210,7 @@ OmxPromiseLayer::SendCommand(OMX_COMMANDTYPE aCmd, OMX_U32 aParam1, OMX_PTR aCmd
      }
    }

-    // Don't overlay more than one fush command, some components can't overlay flush commands.
+    // Don't overlay more than one flush command, some components can't overlay flush commands.
    // So here we send another flush after receiving the previous flush completed event.
    if (mFlushCommands.Length()) {
      OMX_ERRORTYPE err =
@ -306,6 +299,8 @@ OmxPromiseLayer::Event(OMX_EVENTTYPE aEvent, OMX_U32 aData1, OMX_U32 aData2)
      } else if (cmd == OMX_CommandPortEnable) {
        OmxCommandFailureHolder failure(OMX_ErrorUndefined, OMX_CommandPortEnable);
        mPortEnablePromise.Reject(failure, __func__);
+      } else {
+        return false;
      }
      break;
    }
--- a/dom/media/platforms/omx/OmxPromiseLayer.h
+++ b/dom/media/platforms/omx/OmxPromiseLayer.h
@ -14,9 +14,10 @@

 namespace mozilla {

-class TrackInfo;
 class OmxPlatformLayer;
 class OmxDataDecoder;
+class TrackInfo;
+class MediaData;

 /* This class acts as a middle layer between OmxDataDecoder and the underlying
 * OmxPlatformLayer.
@ -38,7 +39,9 @@ protected:
 public:
  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(OmxPromiseLayer)

-  OmxPromiseLayer(TaskQueue* aTaskQueue, OmxDataDecoder* aDataDecoder);
+  OmxPromiseLayer(TaskQueue* aTaskQueue,
+                  OmxDataDecoder* aDataDecoder,
+                  layers::ImageContainer* aImageContainer);

  class BufferData;

@ -125,6 +128,15 @@ public:
      return mBuffer;
    }

+    // Return the platform dependent MediaData().
+    // For example, it returns the MediaData with Gralloc texture.
+    // If it returns nullptr, then caller uses the normal way to
+    // create MediaData().
+    virtual already_AddRefed<MediaData> GetPlatformMediaData()
+    {
+      return nullptr;
+    }
+
    // The buffer could be used by several objects. And only one object owns the
    // buffer the same time.
    //   FREE:
@ -162,7 +174,7 @@ public:
    // records of the original data from demuxer, like duration, stream offset...etc.
    RefPtr<MediaRawData> mRawData;

-    // Because OMX buffer works acorssing threads, so it uses a promise
+    // Because OMX buffer works across threads, so it uses a promise
    // for each buffer when the buffer is used by Omx component.
    MozPromiseHolder<OmxBufferPromise> mPromise;
    BufferStatus mStatus;
@ -179,7 +191,7 @@ public:
  already_AddRefed<BufferData>
  FindAndRemoveBufferHolder(OMX_DIRTYPE aType, BufferData::BufferID aId);

-  // Return truen if event is handled.
+  // Return true if event is handled.
  bool Event(OMX_EVENTTYPE aEvent, OMX_U32 aData1, OMX_U32 aData2);

 protected:
@ -208,9 +220,9 @@ protected:

 private:
  // Elements are added to holders when FillBuffer() or FillBuffer(). And
-  // removing elelments when the promise is resolved. Buffers in these lists
+  // removing element when the promise is resolved. Buffers in these lists
  // should NOT be used by other component; for example, output it to audio
-  // output. These list should be empty when engine is about to shutdown.
+  // output. These lists should be empty when engine is about to shutdown.
  //
  // Note:
  //      There bufferlist should not be used by other class directly.
--- a/dom/tv/TVSimulatorService.js
+++ b/dom/tv/TVSimulatorService.js
@ -17,7 +17,6 @@ Cu.import("resource://gre/modules/Services.jsm");

 const TV_SIMULATOR_DUMMY_DIRECTORY   = "dummy";
 const TV_SIMULATOR_DUMMY_FILE        = "settings.json";
-const TV_SIMULATOR_MOCK_DATA         = Services.prefs.getCharPref("dom.testing.tv_mock_data");

 // See http://seanyhlin.github.io/TV-Manager-API/#idl-def-TVSourceType
 const TV_SOURCE_TYPES = ["dvb-t","dvb-t2","dvb-c","dvb-c2","dvb-s",
@ -51,16 +50,19 @@ TVSimulatorService.prototype = {
      return;
    }

+    // I try to load the testing mock data if related preference are already set.
+    // Otherwise, use to the simulation data from prefences.
+    // See /dom/tv/test/mochitest/head.js for more details.
    let settingStr = "";
    try {
-      if (TV_SIMULATOR_MOCK_DATA) {
-        settingStr = TV_SIMULATOR_MOCK_DATA;
-      } else {
-        settingStr = this._getDummyData();
-      }
+      settingStr = Services.prefs.getCharPref("dom.testing.tv_mock_data");
    } catch(e) {
-      debug("Error occurred : " + e );
-      return;
+      try {
+        settingStr = this._getDummyData();
+      } catch(e) {
+        debug("TV Simulator service failed to load simulation data: " + e);
+        return;
+      }
    }

    let settingsObj;
@ -178,7 +180,7 @@ TVSimulatorService.prototype = {
          }

          // Sort the program according to the startTime
-	  wrapChannelData.programs.sort(function(a, b) {
+          wrapChannelData.programs.sort(function(a, b) {
            return a.startTime - b.startTime;
          });
          wrapTunerData.channels.set(channel.number, wrapChannelData);
@ -252,8 +254,8 @@ TVSimulatorService.prototype = {

    this._scanCompleteTimer = Cc["@mozilla.org/timer;1"]
                                .createInstance(Ci.nsITimer);
-    rv = this._scanCompleteTimer.initWithCallback(this, 10,
-                                                  Ci.nsITimer.TYPE_ONE_SHOT);
+    let rv = this._scanCompleteTimer.initWithCallback(this, 10,
+                                                      Ci.nsITimer.TYPE_ONE_SHOT);
    return Cr.NS_OK;
  },

--- a/dom/webidl/Animation.webidl
+++ b/dom/webidl/Animation.webidl
@ -14,6 +14,7 @@ enum AnimationPlayState { "idle", "pending", "running", "paused", "finished" };

 [Func="nsDocument::IsWebAnimationsEnabled"]
 interface Animation : EventTarget {
+  attribute DOMString id;
  // Bug 1049975: Make 'effect' writeable
  [Pure]
  readonly attribute AnimationEffectReadOnly? effect;
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@ -660,7 +660,7 @@ TextureClient::TextureClientRecycleCallback(TextureClient* aClient, void* aClosu
 }

 void
-TextureClient::SetRecycleAllocator(TextureClientRecycleAllocator* aAllocator)
+TextureClient::SetRecycleAllocator(ITextureClientRecycleAllocator* aAllocator)
 {
  mRecycleAllocator = aAllocator;
  if (aAllocator) {
--- a/gfx/layers/client/TextureClient.h
+++ b/gfx/layers/client/TextureClient.h
@ -57,7 +57,7 @@ class TextureData;
 struct RawTextureBuffer;
 class RawYCbCrTextureBuffer;
 class TextureClient;
-class TextureClientRecycleAllocator;
+class ITextureClientRecycleAllocator;
 #ifdef GFX_DEBUG_TRACK_CLIENTS_IN_POOL
 class TextureClientPool;
 #endif
@ -569,8 +569,8 @@ public:

  ISurfaceAllocator* GetAllocator() { return mAllocator; }

-  TextureClientRecycleAllocator* GetRecycleAllocator() { return mRecycleAllocator; }
-  void SetRecycleAllocator(TextureClientRecycleAllocator* aAllocator);
+  ITextureClientRecycleAllocator* GetRecycleAllocator() { return mRecycleAllocator; }
+  void SetRecycleAllocator(ITextureClientRecycleAllocator* aAllocator);

  /// If you add new code that uses this method, you are probably doing something wrong.
  TextureData* GetInternalData() { return mData; }
@ -604,7 +604,7 @@ protected:

  RefPtr<ISurfaceAllocator> mAllocator;
  RefPtr<TextureChild> mActor;
-  RefPtr<TextureClientRecycleAllocator> mRecycleAllocator;
+  RefPtr<ITextureClientRecycleAllocator> mRecycleAllocator;
  RefPtr<AsyncTransactionWaiter> mRemoveFromCompositableWaiter;

  TextureData* mData;
--- a/gfx/layers/client/TextureClientRecycleAllocator.h
+++ b/gfx/layers/client/TextureClientRecycleAllocator.h
@ -18,6 +18,19 @@ namespace layers {

 class TextureClientHolder;

+class ITextureClientRecycleAllocator
+{
+protected:
+  virtual ~ITextureClientRecycleAllocator() {}
+
+public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(ITextureClientRecycleAllocator)
+
+protected:
+  friend class TextureClient;
+  virtual void RecycleTextureClient(TextureClient* aClient) = 0;
+};
+
 class ITextureClientAllocationHelper
 {
 public:
@ -52,14 +65,12 @@ public:
 * By default this uses TextureClient::CreateForDrawing to allocate new texture
 * clients.
 */
-class TextureClientRecycleAllocator
+class TextureClientRecycleAllocator : public ITextureClientRecycleAllocator
 {
 protected:
  virtual ~TextureClientRecycleAllocator();

 public:
-  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(TextureClientRecycleAllocator)
-
  explicit TextureClientRecycleAllocator(CompositableForwarder* aAllocator);

  void SetMaxPoolSize(uint32_t aMax);
@ -85,10 +96,8 @@ protected:

  RefPtr<CompositableForwarder> mSurfaceAllocator;

-private:
-  friend class TextureClient;
  friend class DefaultTextureClientAllocationHelper;
-  void RecycleTextureClient(TextureClient* aClient);
+  void RecycleTextureClient(TextureClient* aClient) override;

  static const uint32_t kMaxPooledSized = 2;
  uint32_t mMaxPooledSize;
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@ -204,6 +204,8 @@ private:
  DECL_GFX_PREF(Live, "dom.w3c_touch_events.enabled",          TouchEventsEnabled, int32_t, 0);

  DECL_GFX_PREF(Live, "general.smoothScroll",                  SmoothScrollEnabled, bool, true);
+  DECL_GFX_PREF(Live, "general.smoothScroll.currentVelocityWeighting",
+                SmoothScrollCurrentVelocityWeighting, float, 0.25);
  DECL_GFX_PREF(Live, "general.smoothScroll.durationToIntervalRatio",
                SmoothScrollDurationToIntervalRatio, int32_t, 200);
  DECL_GFX_PREF(Live, "general.smoothScroll.mouseWheel",       WheelSmoothScrollEnabled, bool, true);
@ -211,6 +213,8 @@ private:
                WheelSmoothScrollMaxDurationMs, int32_t, 400);
  DECL_GFX_PREF(Live, "general.smoothScroll.mouseWheel.durationMinMS",
                WheelSmoothScrollMinDurationMs, int32_t, 200);
+  DECL_GFX_PREF(Live, "general.smoothScroll.stopDecelerationWeighting",
+                SmoothScrollStopDecelerationWeighting, float, 0.4f);

  DECL_GFX_PREF(Once, "gfx.android.rgb16.force",               AndroidRGB16Force, bool, false);
 #if defined(ANDROID)
--- a/js/src/asmjs/WasmModule.h
+++ b/js/src/asmjs/WasmModule.h
@ -22,6 +22,7 @@
 #include "asmjs/WasmTypes.h"
 #include "gc/Barrier.h"
 #include "vm/MallocProvider.h"
+#include "vm/NativeObject.h"

 namespace js {

--- a/js/src/jit-test/tests/basic/bug1238003.js
+++ b/js/src/jit-test/tests/basic/bug1238003.js
@ -0,0 +1,15 @@
+function f(str) {
+   if (typeof str === 'string')
+      str = new RegExp(str);
+   for (var i = 0; i < 2000; i++)
+      str.test('foo');
+}
+f("abc");
+
+function g(str) {
+   if (typeof str === 'string')
+      str = new RegExp(str);
+   for (var i = 0; i < 2000; i++)
+      str.exec('foo');
+}
+g("abc");
--- a/js/src/jit/ExecutableAllocator.cpp
+++ b/js/src/jit/ExecutableAllocator.cpp
@ -27,6 +27,7 @@

 #include "jit/ExecutableAllocator.h"

+#include "jit/JitCompartment.h"
 #include "js/MemoryMetrics.h"

 #ifdef __APPLE__
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@ -7516,7 +7516,10 @@ class MRegExp : public MNullaryInstruction

 class MRegExpMatcher
  : public MAryInstruction<4>,
-    public NoTypePolicy::Data
+    public Mix4Policy<ObjectPolicy<0>,
+                      StringPolicy<1>,
+                      IntPolicy<2>,
+                      BooleanPolicy<3> >::Data
 {
  private:

@ -7571,7 +7574,10 @@ class MRegExpMatcher

 class MRegExpTester
  : public MAryInstruction<4>,
-    public NoTypePolicy::Data
+    public Mix4Policy<ObjectPolicy<0>,
+                      StringPolicy<1>,
+                      IntPolicy<2>,
+                      BooleanPolicy<3> >::Data
 {
  private:

--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@ -433,6 +433,23 @@ template bool ConvertToStringPolicy<0>::staticAdjustInputs(TempAllocator& alloc,
 template bool ConvertToStringPolicy<1>::staticAdjustInputs(TempAllocator& alloc, MInstruction* ins);
 template bool ConvertToStringPolicy<2>::staticAdjustInputs(TempAllocator& alloc, MInstruction* ins);

+template <unsigned Op>
+bool
+BooleanPolicy<Op>::staticAdjustInputs(TempAllocator& alloc, MInstruction* def)
+{
+    MDefinition* in = def->getOperand(Op);
+    if (in->type() == MIRType_Boolean)
+        return true;
+
+    MUnbox* replace = MUnbox::New(alloc, in, MIRType_Boolean, MUnbox::Fallible);
+    def->block()->insertBefore(def, replace);
+    def->replaceOperand(Op, replace);
+
+    return replace->typePolicy()->adjustInputs(alloc, replace);
+}
+
+template bool BooleanPolicy<3>::staticAdjustInputs(TempAllocator& alloc, MInstruction* def);
+
 template <unsigned Op>
 bool
 IntPolicy<Op>::staticAdjustInputs(TempAllocator& alloc, MInstruction* def)
@ -1227,6 +1244,7 @@ FilterTypeSetPolicy::adjustInputs(TempAllocator& alloc, MInstruction* ins)
    _(Mix3Policy<StringPolicy<0>, IntPolicy<1>, IntPolicy<2>>)          \
    _(Mix3Policy<StringPolicy<0>, ObjectPolicy<1>, StringPolicy<2> >)   \
    _(Mix3Policy<StringPolicy<0>, StringPolicy<1>, StringPolicy<2> >)   \
+    _(Mix4Policy<ObjectPolicy<0>, StringPolicy<1>, IntPolicy<2>, BooleanPolicy<3>>) \
    _(Mix4Policy<ObjectPolicy<0>, IntPolicy<1>, IntPolicy<2>, IntPolicy<3>>) \
    _(Mix4Policy<ObjectPolicy<0>, IntPolicy<1>, TruncateToInt32Policy<2>, TruncateToInt32Policy<3> >) \
    _(Mix3Policy<ObjectPolicy<0>, CacheIdPolicy<1>, NoFloatPolicy<2>>)  \
--- a/js/src/jit/TypePolicy.h
+++ b/js/src/jit/TypePolicy.h
@ -168,6 +168,18 @@ class ConvertToStringPolicy final : public TypePolicy
    }
 };

+// Expect an Boolean for operand Op. If the input is a Value, it is unboxed.
+template <unsigned Op>
+class BooleanPolicy final : private TypePolicy
+{
+  public:
+    EMPTY_DATA_;
+    static bool staticAdjustInputs(TempAllocator& alloc, MInstruction* def);
+    virtual bool adjustInputs(TempAllocator& alloc, MInstruction* def) override {
+        return staticAdjustInputs(alloc, def);
+    }
+};
+
 // Expect an Int for operand Op. If the input is a Value, it is unboxed.
 template <unsigned Op>
 class IntPolicy final : private TypePolicy
--- a/layout/generic/AsyncScrollBase.cpp
+++ b/layout/generic/AsyncScrollBase.cpp
@ -4,6 +4,7 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 #include "AsyncScrollBase.h"
+#include "gfxPrefs.h"

 using namespace mozilla;

@ -77,26 +78,23 @@ AsyncScrollBase::InitializeHistory(TimeStamp aTime)
  mPrevEventTime[2] = mPrevEventTime[1]  - maxDelta;
 }

-const double kCurrentVelocityWeighting = 0.25;
-const double kStopDecelerationWeighting = 0.4;
-
 void
 AsyncScrollBase::InitTimingFunction(nsSMILKeySpline& aTimingFunction,
                                    nscoord aCurrentPos,
                                    nscoord aCurrentVelocity,
                                    nscoord aDestination)
 {
-  if (aDestination == aCurrentPos || kCurrentVelocityWeighting == 0) {
-    aTimingFunction.Init(0, 0, 1 - kStopDecelerationWeighting, 1);
+  if (aDestination == aCurrentPos || gfxPrefs::SmoothScrollCurrentVelocityWeighting() == 0) {
+    aTimingFunction.Init(0, 0, 1 - gfxPrefs::SmoothScrollStopDecelerationWeighting(), 1);
    return;
  }

  const TimeDuration oneSecond = TimeDuration::FromSeconds(1);
  double slope = aCurrentVelocity * (mDuration / oneSecond) / (aDestination - aCurrentPos);
  double normalization = sqrt(1.0 + slope * slope);
-  double dt = 1.0 / normalization * kCurrentVelocityWeighting;
-  double dxy = slope / normalization * kCurrentVelocityWeighting;
-  aTimingFunction.Init(dt, dxy, 1 - kStopDecelerationWeighting, 1);
+  double dt = 1.0 / normalization * gfxPrefs::SmoothScrollCurrentVelocityWeighting();
+  double dxy = slope / normalization * gfxPrefs::SmoothScrollCurrentVelocityWeighting();
+  aTimingFunction.Init(dt, dxy, 1 - gfxPrefs::SmoothScrollStopDecelerationWeighting(), 1);
 }

 nsPoint
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@ -2530,10 +2530,6 @@ ScrollFrameHelper::ScrollToImpl(nsPoint aPt, const nsRect& aRange, nsIAtom* aOri
    needImageVisibilityUpdate = true;
  }

-  if (needImageVisibilityUpdate) {
-    presContext->PresShell()->ScheduleImageVisibilityUpdate();
-  }
-
  // notify the listeners.
  for (uint32_t i = 0; i < mListeners.Length(); i++) {
    mListeners[i]->ScrollPositionWillChange(pt.x, pt.y);
@ -2564,9 +2560,17 @@ ScrollFrameHelper::ScrollToImpl(nsPoint aPt, const nsRect& aRange, nsIAtom* aOri

    if (!displayPort.IsEqualEdges(oldDisplayPort)) {
      mOuter->SchedulePaint();
+
+      if (needImageVisibilityUpdate) {
+        presContext->PresShell()->ScheduleImageVisibilityUpdate();
+      }
    }
  } else {
    mOuter->SchedulePaint();
+
+    if (needImageVisibilityUpdate) {
+      presContext->PresShell()->ScheduleImageVisibilityUpdate();
+    }
  }

  if (mOuter->ChildrenHavePerspective()) {
@ -2677,11 +2681,10 @@ struct HoveredStateComparator

 void
 ScrollFrameHelper::AppendScrollPartsTo(nsDisplayListBuilder*   aBuilder,
-                                           const nsRect&           aDirtyRect,
-                                           const nsDisplayListSet& aLists,
-                                           bool                    aUsingDisplayPort,
-                                           bool                    aCreateLayer,
-                                           bool                    aPositioned)
+                                       const nsRect&           aDirtyRect,
+                                       const nsDisplayListSet& aLists,
+                                       bool                    aCreateLayer,
+                                       bool                    aPositioned)
 {
  nsITheme* theme = mOuter->PresContext()->GetTheme();
  if (theme &&
@ -2735,9 +2738,12 @@ ScrollFrameHelper::AppendScrollPartsTo(nsDisplayListBuilder*   aBuilder,
    }

    // The display port doesn't necessarily include the scrollbars, so just
-    // include all of the scrollbars if we have a display port.
-    nsRect dirty = aUsingDisplayPort ?
-      scrollParts[i]->GetVisualOverflowRectRelativeToParent() : aDirtyRect;
+    // include all of the scrollbars if we are in a RCD-RSF. We only do
+    // this for the root scrollframe of the root content document, which is
+    // zoomable, and where the scrollbar sizes are bounded by the widget.
+    nsRect dirty = mIsRoot && mOuter->PresContext()->IsRootContentDocument()
+                   ? scrollParts[i]->GetVisualOverflowRectRelativeToParent()
+                   : aDirtyRect;
    nsDisplayListBuilder::AutoBuildingDisplayList
      buildingForChild(aBuilder, scrollParts[i],
                       dirty + mOuter->GetOffsetTo(scrollParts[i]), true);
@ -2969,7 +2975,7 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,

    if (addScrollBars) {
      // Add classic scrollbars.
-      AppendScrollPartsTo(aBuilder, aDirtyRect, aLists, usingDisplayPort,
+      AppendScrollPartsTo(aBuilder, aDirtyRect, aLists,
                          createLayersForScrollbars, false);
    }

@ -2981,7 +2987,7 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,

    if (addScrollBars) {
      // Add overlay scrollbars.
-      AppendScrollPartsTo(aBuilder, aDirtyRect, aLists, usingDisplayPort,
+      AppendScrollPartsTo(aBuilder, aDirtyRect, aLists,
                          createLayersForScrollbars, true);
    }

@ -3020,7 +3026,7 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
  // Note that this does not apply for overlay scrollbars; those are drawn
  // in the positioned-elements layer on top of everything else by the call
  // to AppendScrollPartsTo(..., true) further down.
-  AppendScrollPartsTo(aBuilder, aDirtyRect, aLists, usingDisplayPort,
+  AppendScrollPartsTo(aBuilder, aDirtyRect, aLists,
                      createLayersForScrollbars, false);

  const nsStyleDisplay* disp = mOuter->StyleDisplay();
@ -3105,7 +3111,7 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
      }

      DisplayListClipState::AutoSaveRestore clipStateForScrollClip(aBuilder);
-      if (usingDisplayPort) {
+      if (mWillBuildScrollableLayer) {
        if (mClipAllDescendants) {
          clipStateForScrollClip.TurnClipIntoScrollClipForContentDescendants(aBuilder, sf);
        } else {
@ -3134,7 +3140,7 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
      }

      DisplayListClipState::AutoSaveRestore clipStateForScrollClip(aBuilder);
-      if (usingDisplayPort) {
+      if (mWillBuildScrollableLayer) {
        if (mClipAllDescendants) {
          clipStateForScrollClip.TurnClipIntoScrollClipForContentDescendants(aBuilder, sf);
        } else {
@ -3213,7 +3219,7 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
    }
  }
  // Now display overlay scrollbars and the resizer, if we have one.
-  AppendScrollPartsTo(aBuilder, aDirtyRect, scrolledContent, usingDisplayPort,
+  AppendScrollPartsTo(aBuilder, aDirtyRect, scrolledContent,
                      createLayersForScrollbars, true);
  scrolledContent.MoveTo(aLists);
 }
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@ -78,7 +78,6 @@ public:
  void AppendScrollPartsTo(nsDisplayListBuilder*   aBuilder,
                           const nsRect&           aDirtyRect,
                           const nsDisplayListSet& aLists,
-                           bool                    aUsingDisplayPort,
                           bool                    aCreateLayer,
                           bool                    aPositioned);

--- a/layout/mathml/nsMathMLmmultiscriptsFrame.cpp
+++ b/layout/mathml/nsMathMLmmultiscriptsFrame.cpp
@ -203,6 +203,14 @@ nsMathMLmmultiscriptsFrame::PlaceMultiScript(nsPresContext*  aPresContext,
    scriptSpace = nsPresContext::CSSPointsToAppUnits(0.5f);
  }

+  // Try and read sub and sup drops from the MATH table.
+  if (mathFont) {
+    subDrop = mathFont->
+      GetMathConstant(gfxFontEntry::SubscriptBaselineDropMin, oneDevPixel);
+    supDrop = mathFont->
+      GetMathConstant(gfxFontEntry::SuperscriptBaselineDropMax, oneDevPixel);
+  }
+
  // force the scriptSpace to be at least 1 pixel
  nscoord onePixel = nsPresContext::CSSPixelsToAppUnits(1);
  scriptSpace = std::max(onePixel, scriptSpace);
@ -390,8 +398,11 @@ nsMathMLmmultiscriptsFrame::PlaceMultiScript(nsPresContext*  aPresContext,
        // subscript
        subScriptFrame = childFrame;
        GetReflowAndBoundingMetricsFor(subScriptFrame, subScriptSize, bmSubScript);
-        // get the subdrop from the subscript font
-        GetSubDropFromChild (subScriptFrame, subDrop, aFontSizeInflation);
+        if (!mathFont) {
+          // get the subdrop from the subscript font
+          GetSubDropFromChild (subScriptFrame, subDrop, aFontSizeInflation);
+        }
+
        // parameter v, Rule 18a, App. G, TeXbook
        minSubScriptShift = bmBase.descent + subDrop;
        trySubScriptShift = std::max(minSubScriptShift,subScriptShift);
@ -431,8 +442,10 @@ nsMathMLmmultiscriptsFrame::PlaceMultiScript(nsPresContext*  aPresContext,
        // supscript
        supScriptFrame = childFrame;
        GetReflowAndBoundingMetricsFor(supScriptFrame, supScriptSize, bmSupScript);
-        // get the supdrop from the supscript font
-        GetSupDropFromChild (supScriptFrame, supDrop, aFontSizeInflation);
+        if (!mathFont) {
+          // get the supdrop from the supscript font
+          GetSupDropFromChild (supScriptFrame, supDrop, aFontSizeInflation);
+        }
        // parameter u, Rule 18a, App. G, TeXbook
        minSupScriptShift = bmBase.ascent - supDrop;
        nscoord superscriptBottomMin;
--- a/layout/mathml/tests/test_opentype-scripts.html
+++ b/layout/mathml/tests/test_opentype-scripts.html
@ -9,7 +9,7 @@
    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
    <meta charset="utf-8"/>
    <style type="text/css">
-      math {
+      math, mspace {
        font-size: 10px;
      }
      @font-face {
@ -44,6 +44,10 @@
        font-family: scripts-8;
        src: url(/tests/fonts/math/scripts-8.otf);
      }
+      @font-face {
+        font-family: scripts-9;
+        src: url(/tests/fonts/math/scripts-9.otf);
+      }
    </style>
    <script type="text/javascript">
      SimpleTest.waitForExplicitFinish();
@ -107,6 +111,14 @@
        ok(almostEqual(getBox("ref10").bottom - getBox("sup10").bottom, 9 * 10),
           "Bad SuperscriptBottomMin");

+        ok(almostEqual(getBox("base11").bottom + 3 * 10,
+                       getBox("sub11").top),
+           "Bad SubscriptBaselineDrop");
+
+        ok(almostEqual(getBox("base11").top + 5 * 10,
+                       getBox("sup11").bottom),
+           "Bad SuperscriptBaselineDrop");
+
        SimpleTest.finish();
      }
    </script>
@ -264,5 +276,17 @@
      </math>
    </p>

+    <p>
+      <math style="font-family: scripts-9;">
+        <msubsup>
+          <mspace id="base11" height="10em" depth="10em"
+                  width="1em" mathbackground="red"/>
+          <mspace id="sub11"
+                  height="0em" depth="1em" width="1em" mathbackground="green"/>
+          <mspace id="sup11"
+                  height="1em" depth="0em" width="1em" mathbackground="blue"/>
+        </msubsup>
+      </math>
+    </p>
  </body>
 </html>
--- a/layout/reftests/fonts/math/generate.py
+++ b/layout/reftests/fonts/math/generate.py
@ -479,6 +479,11 @@ f = newMathFont("scripts-8")
 f.math.SuperscriptBottomMin = 9 * em
 saveMathFont(f)

+f = newMathFont("scripts-9")
+f.math.SubscriptBaselineDropMin = 3 * em
+f.math.SuperscriptBaselineDropMax = 5 * em
+saveMathFont(f)
+
 ################################################################################
 # Testing Limits Parameters
 f = newMathFont("limits-1")
--- a/layout/reftests/fonts/math/mochitest.ini
+++ b/layout/reftests/fonts/math/mochitest.ini
@ -31,6 +31,7 @@ support-files =
  /tests/fonts/math/scripts-6.otf
  /tests/fonts/math/scripts-7.otf
  /tests/fonts/math/scripts-8.otf
+  /tests/fonts/math/scripts-9.otf
  /tests/fonts/math/stack-1.otf
  /tests/fonts/math/stack-2.otf
  /tests/fonts/math/stack-3.otf
--- a/layout/reftests/fonts/math/scripts-9.otf
+++ b/layout/reftests/fonts/math/scripts-9.otf
--- a/layout/tools/reftest/remotereftest.py
+++ b/layout/tools/reftest/remotereftest.py
@ -272,6 +272,7 @@ class RemoteReftest(RefTest):

        try:
            self._devicemanager.pushDir(profileDir, options.remoteProfile)
+            self._devicemanager.chmodDir(options.remoteProfile)
        except devicemanager.DMError:
            print "Automation Error: Failed to copy profiledir to device"
            raise
@ -283,6 +284,7 @@ class RemoteReftest(RefTest):
        RefTest.copyExtraFilesToProfile(self, options, profile)
        try:
            self._devicemanager.pushDir(profileDir, options.remoteProfile)
+            self._devicemanager.chmodDir(options.remoteProfile)
        except devicemanager.DMError:
            print "Automation Error: Failed to copy extra files to device"
            raise
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@ -2127,6 +2127,9 @@ pref("general.smoothScroll.other", true);
 // intervals).
 // This defines how longer is the duration compared to events interval (percentage)
 pref("general.smoothScroll.durationToIntervalRatio", 200);
+// These two prefs determine the timing function.
+pref("general.smoothScroll.currentVelocityWeighting", "0.25");
+pref("general.smoothScroll.stopDecelerationWeighting", "0.4");

 pref("profile.confirm_automigration",true);
 // profile.migration_behavior determines how the profiles root is set
--- a/netwerk/base/ARefBase.h
+++ b/netwerk/base/ARefBase.h
@ -7,6 +7,8 @@
 #ifndef mozilla_net_ARefBase_h
 #define mozilla_net_ARefBase_h

+#include "nscore.h"
+
 namespace mozilla { namespace net {

 // This is an abstract class that can be pointed to by either
--- a/netwerk/base/CaptivePortalService.cpp
+++ b/netwerk/base/CaptivePortalService.cpp
@ -6,6 +6,7 @@
 #include "mozilla/Services.h"
 #include "mozilla/Preferences.h"
 #include "nsIObserverService.h"
+#include "nsServiceManagerUtils.h"
 #include "nsXULAppAPI.h"

 #define kInterfaceName "captive-portal-inteface"
--- a/netwerk/base/CaptivePortalService.h
+++ b/netwerk/base/CaptivePortalService.h
@ -11,6 +11,7 @@
 #include "nsWeakReference.h"
 #include "nsITimer.h"
 #include "nsCOMArray.h"
+#include "mozilla/TimeStamp.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/base/ClosingService.cpp
+++ b/netwerk/base/ClosingService.cpp
@ -122,6 +122,11 @@ ClosingService::StartInternal()
 nsresult
 ClosingService::AttachIOLayer(PRFileDesc *aFd)
 {
+  // We are going to remove ClosingService soon.
+  // This change is going to turn it off, so ClosingService is not used.
+  // Bug 1238010.
+  return NS_OK;
+
  if (!sTcpUdpPRCloseLayerMethodsPtr) {
    return NS_OK;
  }
--- a/netwerk/base/EventTokenBucket.cpp
+++ b/netwerk/base/EventTokenBucket.cpp
@ -7,9 +7,11 @@
 #include "EventTokenBucket.h"

 #include "nsICancelable.h"
+#include "nsIIOService.h"
 #include "nsNetCID.h"
+#include "nsNetUtil.h"
+#include "nsServiceManagerUtils.h"
 #include "nsSocketTransportService2.h"
-
 #ifdef DEBUG
 #include "MainThreadUtils.h"
 #endif
--- a/netwerk/base/LoadContextInfo.cpp
+++ b/netwerk/base/LoadContextInfo.cpp
@ -4,10 +4,13 @@

 #include "LoadContextInfo.h"

+#include "mozilla/dom/ToJSValue.h"
 #include "nsIChannel.h"
 #include "nsILoadContext.h"
 #include "nsIWebNavigation.h"
+#include "nsNetUtil.h"

+using namespace mozilla::dom;
 namespace mozilla {
 namespace net {

--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@ -14,11 +14,14 @@
 #include "nsIDocument.h"
 #include "nsIDOMDocument.h"
 #include "nsIFrameLoader.h"
+#include "nsIInterfaceRequestorUtils.h"
 #include "nsISupportsImpl.h"
 #include "nsISupportsUtils.h"
 #include "nsContentUtils.h"
 #include "nsGlobalWindow.h"

+using namespace mozilla::dom;
+
 namespace mozilla {

 LoadInfo::LoadInfo(nsIPrincipal* aLoadingPrincipal,
--- a/netwerk/base/MemoryDownloader.cpp
+++ b/netwerk/base/MemoryDownloader.cpp
@ -6,6 +6,7 @@
 #include "MemoryDownloader.h"

 #include "mozilla/Assertions.h"
+#include "nsIInputStream.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/base/Predictor.cpp
+++ b/netwerk/base/Predictor.cpp
@ -38,6 +38,7 @@
 #include "mozilla/Telemetry.h"

 #include "mozilla/net/NeckoCommon.h"
+#include "mozilla/net/NeckoParent.h"

 #include "LoadContextInfo.h"
 #include "mozilla/ipc/URIUtils.h"
--- a/netwerk/base/RedirectChannelRegistrar.h
+++ b/netwerk/base/RedirectChannelRegistrar.h
@ -11,6 +11,7 @@
 #include "nsIParentChannel.h"
 #include "nsInterfaceHashtable.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/Mutex.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/base/nsBaseChannel.cpp
+++ b/netwerk/base/nsBaseChannel.cpp
@ -22,6 +22,7 @@
 #include "nsXULAppAPI.h"
 #include "nsContentSecurityManager.h"
 #include "LoadInfo.h"
+#include "nsServiceManagerUtils.h"

 // This class is used to suspend a request across a function scope.
 class ScopedRequestSuspender {
--- a/netwerk/base/nsChannelClassifier.cpp
+++ b/netwerk/base/nsChannelClassifier.cpp
@ -27,6 +27,7 @@
 #include "nsISecurityEventSink.h"
 #include "nsIURL.h"
 #include "nsIWebProgressListener.h"
+#include "nsNetUtil.h"
 #include "nsPIDOMWindow.h"
 #include "nsXULAppAPI.h"

--- a/netwerk/base/nsDirectoryIndexStream.cpp
+++ b/netwerk/base/nsDirectoryIndexStream.cpp
@ -39,7 +39,8 @@

 //#define THREADSAFE_I18N

-static mozilla::LazyLogModule gLog("nsDirectoryIndexStream");
+using namespace mozilla;
+static LazyLogModule gLog("nsDirectoryIndexStream");

 nsDirectoryIndexStream::nsDirectoryIndexStream()
    : mOffset(0), mStatus(NS_OK), mPos(0)
--- a/netwerk/base/nsDownloader.cpp
+++ b/netwerk/base/nsDownloader.cpp
@ -4,6 +4,7 @@

 #include "nsDownloader.h"
 #include "nsIInputStream.h"
+#include "nsIOutputStream.h"
 #include "nsDirectoryServiceUtils.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsNetUtil.h"
--- a/netwerk/base/nsIOService.cpp
+++ b/netwerk/base/nsIOService.cpp
@ -40,6 +40,7 @@
 #include "nsPIDNSService.h"
 #include "nsIProtocolProxyService2.h"
 #include "MainThreadUtils.h"
+#include "nsINode.h"
 #include "nsIWidget.h"
 #include "nsThreadUtils.h"
 #include "mozilla/LoadInfo.h"
--- a/netwerk/base/nsIncrementalDownload.cpp
+++ b/netwerk/base/nsIncrementalDownload.cpp
@ -27,6 +27,7 @@
 #include <algorithm>
 #include "nsIContentPolicy.h"
 #include "nsContentUtils.h"
+#include "mozilla/UniquePtr.h"

 // Default values used to initialize a nsIncrementalDownload object.
 #define DEFAULT_CHUNK_SIZE (4096 * 16)  // bytes
@ -37,6 +38,8 @@
 // Number of times to retry a failed byte-range request.
 #define MAX_RETRY_COUNT 20

+using namespace mozilla;
+
 //-----------------------------------------------------------------------------

 static nsresult
--- a/netwerk/base/nsNetUtil.cpp
+++ b/netwerk/base/nsNetUtil.cpp
@ -10,6 +10,7 @@
 #include "mozilla/LoadContext.h"
 #include "mozilla/LoadInfo.h"
 #include "mozilla/BasePrincipal.h"
+#include "mozilla/Telemetry.h"
 #include "nsNetUtil.h"
 #include "nsNetUtil.inl"
 #include "mozIApplicationClearPrivateDataParams.h"
@ -73,6 +74,9 @@

 #include <limits>

+using namespace mozilla;
+using namespace mozilla::net;
+
 nsresult /*NS_NewChannelWithNodeAndTriggeringPrincipal */
 NS_NewChannelWithTriggeringPrincipal(nsIChannel           **outChannel,
                                     nsIURI                *aUri,
--- a/netwerk/base/nsNetUtil.h
+++ b/netwerk/base/nsNetUtil.h
@ -17,6 +17,7 @@
 #include "nsIIOService.h"
 #include "mozilla/Services.h"
 #include "nsNetCID.h"
+#include "nsServiceManagerUtils.h"

 class nsIURI;
 class nsIPrincipal;
--- a/netwerk/base/nsProtocolProxyService.cpp
+++ b/netwerk/base/nsProtocolProxyService.cpp
@ -25,6 +25,7 @@
 #include "nsString.h"
 #include "nsNetUtil.h"
 #include "nsNetCID.h"
+#include "plstr.h"
 #include "prnetdb.h"
 #include "nsPACMan.h"
 #include "nsProxyRelease.h"
--- a/netwerk/base/nsSecCheckWrapChannel.cpp
+++ b/netwerk/base/nsSecCheckWrapChannel.cpp
@ -6,6 +6,8 @@
 #include "nsContentSecurityManager.h"
 #include "nsSecCheckWrapChannel.h"
 #include "nsIForcePendingChannel.h"
+#include "nsIStreamListener.h"
+#include "mozilla/Logging.h"
 #include "nsCOMPtr.h"

 static mozilla::LazyLogModule gChannelWrapperLog("ChannelWrapper");
--- a/netwerk/base/nsUDPSocket.cpp
+++ b/netwerk/base/nsUDPSocket.cpp
@ -21,6 +21,7 @@
 #include "nsNetAddr.h"
 #include "nsNetSegmentUtils.h"
 #include "NetworkActivityMonitor.h"
+#include "nsServiceManagerUtils.h"
 #include "nsStreamUtils.h"
 #include "nsIPipe.h"
 #include "prerror.h"
@ -38,6 +39,7 @@ using namespace mozilla::net;
 using namespace mozilla;

 static const uint32_t UDP_PACKET_CHUNK_SIZE = 1400;
+static NS_DEFINE_CID(kSocketTransportServiceCID2, NS_SOCKETTRANSPORTSERVICE_CID);

 //-----------------------------------------------------------------------------

@ -262,7 +264,7 @@ nsUDPSocket::nsUDPSocket()
  {
    // This call can fail if we're offline, for example.
    nsCOMPtr<nsISocketTransportService> sts =
-        do_GetService(kSocketTransportServiceCID);
+        do_GetService(kSocketTransportServiceCID2);
  }

  mSts = gSocketTransportService;
--- a/netwerk/cache/nsDiskCacheBinding.cpp
+++ b/netwerk/cache/nsDiskCacheBinding.cpp
@ -12,7 +12,7 @@
 #include "nsDiskCacheBinding.h"
 #include "nsCacheService.h"

-
+using namespace mozilla;

 /******************************************************************************
 *  static hash table callback functions
--- a/netwerk/cache/nsDiskCacheDeviceSQL.cpp
+++ b/netwerk/cache/nsDiskCacheDeviceSQL.cpp
@ -32,6 +32,8 @@
 #include "nsILoadContextInfo.h"
 #include "nsThreadUtils.h"
 #include "nsISerializable.h"
+#include "nsIInputStream.h"
+#include "nsIOutputStream.h"
 #include "nsSerializationHelper.h"

 #include "mozIStorageService.h"
--- a/netwerk/cache/nsMemoryCacheDevice.cpp
+++ b/netwerk/cache/nsMemoryCacheDevice.cpp
@ -27,7 +27,7 @@
 // Entries with no expiration go in the first queue.

 const char *gMemoryDeviceID      = "memory";
-
+using namespace mozilla;

 nsMemoryCacheDevice::nsMemoryCacheDevice()
    : mInitialized(false),
--- a/netwerk/cache2/CacheFileUtils.cpp
+++ b/netwerk/cache2/CacheFileUtils.cpp
@ -2,10 +2,12 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

+#include "CacheIndex.h"
 #include "CacheLog.h"
 #include "CacheFileUtils.h"
 #include "LoadContextInfo.h"
 #include "mozilla/Tokenizer.h"
+#include "mozilla/Telemetry.h"
 #include "nsCOMPtr.h"
 #include "nsAutoPtr.h"
 #include "nsString.h"
--- a/netwerk/cache2/CacheStorageService.h
+++ b/netwerk/cache2/CacheStorageService.h
@ -15,6 +15,7 @@
 #include "nsString.h"
 #include "nsThreadUtils.h"
 #include "nsProxyRelease.h"
+#include "mozilla/Monitor.h"
 #include "mozilla/Mutex.h"
 #include "mozilla/Atomics.h"
 #include "mozilla/TimeStamp.h"
--- a/netwerk/ipc/NeckoParent.cpp
+++ b/netwerk/ipc/NeckoParent.cpp
@ -42,6 +42,7 @@
 #include "nsPrincipal.h"
 #include "nsIOService.h"
 #include "nsINetworkPredictor.h"
+#include "nsINetworkPredictorVerifier.h"
 #include "mozilla/net/OfflineObserver.h"
 #include "nsISpeculativeConnect.h"

--- a/netwerk/ipc/RemoteOpenFileChild.cpp
+++ b/netwerk/ipc/RemoteOpenFileChild.cpp
@ -17,6 +17,7 @@
 #include "nsProxyRelease.h"
 #include "SerializedLoadContext.h"
 #include "nsNetUtil.h"
+#include "nsIFileURL.h"

 // needed to alloc/free NSPR file descriptors
 #include "private/pprio.h"
--- a/netwerk/protocol/about/nsAboutBloat.cpp
+++ b/netwerk/protocol/about/nsAboutBloat.cpp
@ -17,6 +17,7 @@
 #include "prtime.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsIFile.h"
+#include "nsNetUtil.h"

 static void GC_gcollect() {}

--- a/netwerk/protocol/about/nsAboutCacheEntry.cpp
+++ b/netwerk/protocol/about/nsAboutCacheEntry.cpp
@ -18,6 +18,7 @@
 #include "nsInputStreamPump.h"
 #include "CacheFileUtils.h"
 #include <algorithm>
+#include "nsIPipe.h"

 using namespace mozilla::net;

--- a/netwerk/protocol/about/nsAboutProtocolHandler.cpp
+++ b/netwerk/protocol/about/nsAboutProtocolHandler.cpp
@ -17,6 +17,7 @@
 #include "nsIObjectOutputStream.h"
 #include "nsAutoPtr.h"
 #include "nsIWritablePropertyBag2.h"
+#include "nsIChannel.h"

 static NS_DEFINE_CID(kSimpleURICID,     NS_SIMPLEURI_CID);
 static NS_DEFINE_CID(kNestedAboutURICID, NS_NESTEDABOUTURI_CID);
--- a/netwerk/protocol/data/DataChannelParent.cpp
+++ b/netwerk/protocol/data/DataChannelParent.cpp
@ -7,6 +7,7 @@
 #include "DataChannelParent.h"
 #include "mozilla/Assertions.h"
 #include "nsNetUtil.h"
+#include "nsIChannel.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/protocol/file/nsFileProtocolHandler.cpp
+++ b/netwerk/protocol/file/nsFileProtocolHandler.cpp
@ -4,6 +4,7 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

+#include "nsIFile.h"
 #include "nsFileProtocolHandler.h"
 #include "nsFileChannel.h"
 #include "nsStandardURL.h"
--- a/netwerk/protocol/ftp/FTPChannelParent.cpp
+++ b/netwerk/protocol/ftp/FTPChannelParent.cpp
@ -6,6 +6,8 @@
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 #include "mozilla/net/FTPChannelParent.h"
+#include "nsStringStream.h"
+#include "mozilla/net/ChannelEventQueue.h"
 #include "mozilla/dom/TabParent.h"
 #include "nsFTPChannel.h"
 #include "nsNetCID.h"
--- a/netwerk/protocol/ftp/FTPChannelParent.h
+++ b/netwerk/protocol/ftp/FTPChannelParent.h
@ -26,6 +26,7 @@ class PBrowserOrId;
 } // namespace dom

 namespace net {
+class ChannelEventQueue;

 class FTPChannelParent final : public PFTPChannelParent
                             , public nsIParentChannel
--- a/netwerk/protocol/ftp/nsFtpConnectionThread.cpp
+++ b/netwerk/protocol/ftp/nsFtpConnectionThread.cpp
@ -42,6 +42,7 @@
 #include "nsIURI.h"
 #include "nsILoadInfo.h"
 #include "nsNullPrincipal.h"
+#include "nsIAuthPrompt2.h"

 #ifdef MOZ_WIDGET_GONK
 #include "NetStatistics.h"
--- a/netwerk/protocol/ftp/nsFtpProtocolHandler.h
+++ b/netwerk/protocol/ftp/nsFtpProtocolHandler.h
@ -82,6 +82,7 @@ private:

 extern nsFtpProtocolHandler *gFtpHandler;

+#include "mozilla/Logging.h"
 extern mozilla::LazyLogModule gFTPLog;

 #endif // !nsFtpProtocolHandler_h__
--- a/netwerk/protocol/http/Http2Compression.cpp
+++ b/netwerk/protocol/http/Http2Compression.cpp
@ -17,6 +17,7 @@
 #include "Http2HuffmanIncoming.h"
 #include "Http2HuffmanOutgoing.h"
 #include "mozilla/StaticPtr.h"
+#include "nsHttpHandler.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/protocol/http/Http2Session.cpp
+++ b/netwerk/protocol/http/Http2Session.cpp
@ -36,6 +36,7 @@
 #include "sslt.h"
 #include "mozilla/Snprintf.h"
 #include "nsSocketTransportService2.h"
+#include "nsNetUtil.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/protocol/http/Http2Stream.h
+++ b/netwerk/protocol/http/Http2Stream.h
@ -15,6 +15,8 @@
 #include "nsISupportsPriority.h"

 class nsStandardURL;
+class nsIInputStream;
+class nsIOutputStream;

 namespace mozilla {
 namespace net {
--- a/netwerk/protocol/http/HttpBaseChannel.cpp
+++ b/netwerk/protocol/http/HttpBaseChannel.cpp
@ -47,6 +47,10 @@
 #include "nsILoadGroupChild.h"
 #include "mozilla/ConsoleReportCollector.h"
 #include "LoadInfo.h"
+#include "nsISSLSocketControl.h"
+#include "mozilla/Telemetry.h"
+#include "nsIURL.h"
+#include "nsIConsoleService.h"

 #include <algorithm>

--- a/netwerk/protocol/http/HttpBaseChannel.h
+++ b/netwerk/protocol/http/HttpBaseChannel.h
@ -42,6 +42,7 @@
 #include "nsIHttpChannel.h"
 #include "nsISecurityConsoleMessage.h"
 #include "nsCOMArray.h"
+#include "mozilla/net/ChannelEventQueue.h"

 class nsPerformance;
 class nsISecurityConsoleMessage;
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@ -17,6 +17,7 @@
 #include "mozilla/net/NeckoChild.h"
 #include "mozilla/net/HttpChannelChild.h"

+#include "nsISupportsPrimitives.h"
 #include "nsChannelClassifier.h"
 #include "nsStringStream.h"
 #include "nsHttpHandler.h"
@ -36,6 +37,7 @@
 #include "nsContentSecurityManager.h"
 #include "nsIDeprecationWarner.h"
 #include "nsICompressConvStats.h"
+#include "nsStreamUtils.h"

 #ifdef OS_POSIX
 #include "chrome/common/file_descriptor_set_posix.h"
@ -62,29 +64,6 @@ static_assert(FileDescriptorSet::MAX_DESCRIPTORS_PER_MESSAGE == 250,

 } // namespace

-// A stream listener interposed between the nsInputStreamPump used for intercepted channels
-// and this channel's original listener. This is only used to ensure the original listener
-// sees the channel as the request object, and to synthesize OnStatus and OnProgress notifications.
-class InterceptStreamListener : public nsIStreamListener
-                              , public nsIProgressEventSink
-{
-  RefPtr<HttpChannelChild> mOwner;
-  nsCOMPtr<nsISupports> mContext;
-  virtual ~InterceptStreamListener() {}
- public:
-  InterceptStreamListener(HttpChannelChild* aOwner, nsISupports* aContext)
-  : mOwner(aOwner)
-  , mContext(aContext)
-  {
-  }
-
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIREQUESTOBSERVER
-  NS_DECL_NSISTREAMLISTENER
-  NS_DECL_NSIPROGRESSEVENTSINK
-
-  void Cleanup();
-};

 NS_IMPL_ISUPPORTS(InterceptStreamListener,
                  nsIStreamListener,
--- a/netwerk/protocol/http/HttpChannelChild.h
+++ b/netwerk/protocol/http/HttpChannelChild.h
@ -313,6 +313,30 @@ private:
  friend class OverrideRunnable;
 };

+// A stream listener interposed between the nsInputStreamPump used for intercepted channels
+// and this channel's original listener. This is only used to ensure the original listener
+// sees the channel as the request object, and to synthesize OnStatus and OnProgress notifications.
+class InterceptStreamListener : public nsIStreamListener
+                              , public nsIProgressEventSink
+{
+  RefPtr<HttpChannelChild> mOwner;
+  nsCOMPtr<nsISupports> mContext;
+  virtual ~InterceptStreamListener() {}
+ public:
+  InterceptStreamListener(HttpChannelChild* aOwner, nsISupports* aContext)
+  : mOwner(aOwner)
+  , mContext(aContext)
+  {
+  }
+
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIREQUESTOBSERVER
+  NS_DECL_NSISTREAMLISTENER
+  NS_DECL_NSIPROGRESSEVENTSINK
+
+  void Cleanup();
+};
+
 //-----------------------------------------------------------------------------
 // inline functions
 //-----------------------------------------------------------------------------
--- a/netwerk/protocol/http/HttpChannelParent.cpp
+++ b/netwerk/protocol/http/HttpChannelParent.cpp
@ -38,6 +38,7 @@
 #include "nsIPrompt.h"
 #include "nsIWindowWatcher.h"
 #include "nsIDocument.h"
+#include "nsStringStream.h"

 using mozilla::BasePrincipal;
 using namespace mozilla::dom;
--- a/netwerk/protocol/http/HttpChannelParent.h
+++ b/netwerk/protocol/http/HttpChannelParent.h
@ -40,6 +40,7 @@ class PBrowserOrId;
 namespace net {

 class HttpChannelParentListener;
+class ChannelEventQueue;

 // Note: nsIInterfaceRequestor must be the first base so that do_QueryObject()
 // works correctly on this object, as it's needed to compute a void* pointing to
--- a/netwerk/protocol/http/HttpChannelParentListener.cpp
+++ b/netwerk/protocol/http/HttpChannelParentListener.cpp
@ -14,6 +14,7 @@
 #include "nsIHttpEventSink.h"
 #include "nsIPackagedAppChannelListener.h"
 #include "nsIHttpHeaderVisitor.h"
+#include "nsQueryObject.h"

 using mozilla::Unused;

--- a/netwerk/protocol/http/HttpChannelParentListener.h
+++ b/netwerk/protocol/http/HttpChannelParentListener.h
@ -13,6 +13,7 @@
 #include "nsIRedirectResultListener.h"
 #include "nsIPackagedAppChannelListener.h"
 #include "nsINetworkInterceptController.h"
+#include "nsIStreamListener.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/protocol/http/InterceptedChannel.cpp
+++ b/netwerk/protocol/http/InterceptedChannel.cpp
@ -15,6 +15,7 @@
 #include "nsHttpResponseHead.h"
 #include "mozilla/ConsoleReportCollector.h"
 #include "mozilla/dom/ChannelInfo.h"
+#include "nsIChannelEventSink.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/protocol/http/NullHttpChannel.cpp
+++ b/netwerk/protocol/http/NullHttpChannel.cpp
@ -6,6 +6,7 @@
 #include "nsContentUtils.h"
 #include "nsContentSecurityManager.h"
 #include "nsIScriptSecurityManager.h"
+#include "nsIStreamListener.h"

 namespace mozilla {
 namespace net {
--- a/netwerk/protocol/http/NullHttpTransaction.cpp
+++ b/netwerk/protocol/http/NullHttpTransaction.cpp
@ -14,6 +14,7 @@
 #include "nsIHttpActivityObserver.h"
 #include "NullHttpChannel.h"
 #include "nsQueryObject.h"
+#include "nsNetUtil.h"

 namespace mozilla {
 namespace net {
--- a/Show More
+++ b/Show More