diff --git a/accessible/src/base/nsAccessiblePivot.cpp b/accessible/src/base/nsAccessiblePivot.cpp
index 43e1b6efb99..d0f712b599a 100644
--- a/accessible/src/base/nsAccessiblePivot.cpp
+++ b/accessible/src/base/nsAccessiblePivot.cpp
@@ -300,47 +300,114 @@ nsAccessiblePivot::MoveNextByText(TextBoundaryType aBoundary, bool* aResult)
 
   *aResult = false;
 
-  int32_t oldStart = mStartOffset, oldEnd = mEndOffset;
-  HyperTextAccessible* text = mPosition->AsHyperText();
-  Accessible* oldPosition = mPosition;
-  while (!text) {
-    oldPosition = mPosition;
-    mPosition = mPosition->Parent();
-    text = mPosition->AsHyperText();
-  }
+  int32_t tempStart = mStartOffset, tempEnd = mEndOffset;
+  Accessible* tempPosition = mPosition;
+  Accessible* root = GetActiveRoot();
+  while (true) {
+    Accessible* curPosition = tempPosition;
+    HyperTextAccessible* text;
+    // Find the nearest text node using a preorder traversal starting from
+    // the current node.
+    if (!(text = tempPosition->AsHyperText())) {
+      text = SearchForText(tempPosition, false);
+      if (!text)
+        return NS_OK;
+      if (text != curPosition)
+        tempStart = tempEnd = -1;
+      tempPosition = text;
+    }
 
-  if (mEndOffset == -1)
-    mEndOffset = text != oldPosition ? text->GetChildOffset(oldPosition) : 0;
+    // If the search led to the parent of the node we started on (e.g. when
+    // starting on a text leaf), start the text movement from the end of that
+    // node, otherwise we just default to 0.
+    if (tempEnd == -1)
+      tempEnd = text == curPosition->Parent() ?
+                text->GetChildOffset(curPosition) : 0;
 
-  if (mEndOffset == text->CharacterCount())
+    // If there's no more text on the current node, try to find the next text
+    // node; if there isn't one, bail out.
+    if (tempEnd == text->CharacterCount()) {
+      if (tempPosition == root)
+        return NS_OK;
+
+      // If we're currently sitting on a link, try move to either the next
+      // sibling or the parent, whichever is closer to the current end
+      // offset. Otherwise, do a forward search for the next node to land on
+      // (we don't do this in the first case because we don't want to go to the
+      // subtree).
+      Accessible* sibling = tempPosition->NextSibling();
+      if (tempPosition->IsLink()) {
+        if (sibling && sibling->IsLink()) {
+          tempStart = tempEnd = -1;
+          tempPosition = sibling;
+        } else {
+          tempStart = tempPosition->StartOffset();
+          tempEnd = tempPosition->EndOffset();
+          tempPosition = tempPosition->Parent();
+        }
+      } else {
+        tempPosition = SearchForText(tempPosition, false);
+        if (!tempPosition)
+          return NS_OK;
+        tempStart = tempEnd = -1;
+      }
+      continue;
+    }
+
+    AccessibleTextBoundary startBoundary, endBoundary;
+    switch (aBoundary) {
+      case CHAR_BOUNDARY:
+        startBoundary = nsIAccessibleText::BOUNDARY_CHAR;
+        endBoundary = nsIAccessibleText::BOUNDARY_CHAR;
+        break;
+      case WORD_BOUNDARY:
+        startBoundary = nsIAccessibleText::BOUNDARY_WORD_START;
+        endBoundary = nsIAccessibleText::BOUNDARY_WORD_END;
+        break;
+      default:
+        return NS_ERROR_INVALID_ARG;
+    }
+
+    nsAutoString unusedText;
+    int32_t newStart = 0, newEnd = 0, currentEnd = tempEnd;
+    text->GetTextAtOffset(tempEnd, endBoundary, &newStart, &tempEnd, unusedText);
+    text->GetTextBeforeOffset(tempEnd, startBoundary, &newStart, &newEnd,
+                              unusedText);
+    int32_t potentialStart = newEnd == tempEnd ? newStart : newEnd;
+    tempStart = potentialStart > tempStart ? potentialStart : currentEnd;
+
+    // The offset range we've obtained might have embedded characters in it,
+    // limit the range to the start of the first occurrence of an embedded
+    // character.
+    Accessible* childAtOffset = nullptr;
+    for (int32_t i = tempStart; i < tempEnd; i++) {
+      childAtOffset = text->GetChildAtOffset(i);
+      if (childAtOffset && nsAccUtils::IsEmbeddedObject(childAtOffset)) {
+        tempEnd = i;
+        break;
+      }
+    }
+    // If there's an embedded character at the very start of the range, we
+    // instead want to traverse into it. So restart the movement with
+    // the child as the starting point.
+    if (childAtOffset && nsAccUtils::IsEmbeddedObject(childAtOffset) &&
+        tempStart == childAtOffset->StartOffset()) {
+      tempPosition = childAtOffset;
+      tempStart = tempEnd = -1;
+      continue;
+    }
+
+    *aResult = true;
+
+    Accessible* startPosition = mPosition;
+    int32_t oldStart = mStartOffset, oldEnd = mEndOffset;
+    mPosition = tempPosition;
+    mStartOffset = tempStart;
+    mEndOffset = tempEnd;
+    NotifyOfPivotChange(startPosition, oldStart, oldEnd,
+                        nsIAccessiblePivot::REASON_TEXT);
     return NS_OK;
-
-  AccessibleTextBoundary startBoundary, endBoundary;
-  switch (aBoundary) {
-    case CHAR_BOUNDARY:
-      startBoundary = nsIAccessibleText::BOUNDARY_CHAR;
-      endBoundary = nsIAccessibleText::BOUNDARY_CHAR;
-      break;
-    case WORD_BOUNDARY:
-      startBoundary = nsIAccessibleText::BOUNDARY_WORD_START;
-      endBoundary = nsIAccessibleText::BOUNDARY_WORD_END;
-      break;
-    default:
-      return NS_ERROR_INVALID_ARG;
   }
-
-  nsAutoString unusedText;
-  int32_t newStart = 0, newEnd = 0;
-  text->GetTextAtOffset(mEndOffset, endBoundary, &newStart, &mEndOffset, unusedText);
-  text->GetTextBeforeOffset(mEndOffset, startBoundary, &newStart, &newEnd,
-                            unusedText);
-  mStartOffset = newEnd == mEndOffset ? newStart : newEnd;
-
-  *aResult = true;
-
-  NotifyOfPivotChange(mPosition, oldStart, oldEnd,
-                      nsIAccessiblePivot::REASON_TEXT);
-  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -350,52 +417,127 @@ nsAccessiblePivot::MovePreviousByText(TextBoundaryType aBoundary, bool* aResult)
 
   *aResult = false;
 
-  int32_t oldStart = mStartOffset, oldEnd = mEndOffset;
-  HyperTextAccessible* text = mPosition->AsHyperText();
-  Accessible* oldPosition = mPosition;
-  while (!text) {
-    oldPosition = mPosition;
-    mPosition = mPosition->Parent();
-    text = mPosition->AsHyperText();
-  }
+  int32_t tempStart = mStartOffset, tempEnd = mEndOffset;
+  Accessible* tempPosition = mPosition;
+  Accessible* root = GetActiveRoot();
+  while (true) {
+    Accessible* curPosition = tempPosition;
+    HyperTextAccessible* text;
+    // Find the nearest text node using a reverse preorder traversal starting
+    // from the current node.
+    if (!(text = tempPosition->AsHyperText())) {
+      text = SearchForText(tempPosition, true);
+      if (!text)
+        return NS_OK;
+      if (text != curPosition)
+        tempStart = tempEnd = -1;
+      tempPosition = text;
+    }
 
-  if (mStartOffset == -1)
-    mStartOffset = text != oldPosition ? text->GetChildOffset(oldPosition) : 0;
+    // If the search led to the parent of the node we started on (e.g. when
+    // starting on a text leaf), start the text movement from the end of that
+    // node, otherwise we just default to 0.
+    if (tempStart == -1) {
+      if (tempPosition != curPosition)
+        tempStart = text == curPosition->Parent() ?
+                    text->GetChildOffset(curPosition) : text->CharacterCount();
+      else
+        tempStart = 0;
+    }
 
-  if (mStartOffset == 0)
+    // If there's no more text on the current node, try to find the previous
+    // text node; if there isn't one, bail out.
+    if (tempStart == 0) {
+      if (tempPosition == root)
+        return NS_OK;
+
+      // If we're currently sitting on a link, try move to either the previous
+      // sibling or the parent, whichever is closer to the current end
+      // offset. Otherwise, do a forward search for the next node to land on
+      // (we don't do this in the first case because we don't want to go to the
+      // subtree).
+      Accessible* sibling = tempPosition->PrevSibling();
+      if (tempPosition->IsLink()) {
+        if (sibling && sibling->IsLink()) {
+          HyperTextAccessible* siblingText = sibling->AsHyperText();
+          tempStart = tempEnd = siblingText ?
+                                siblingText->CharacterCount() : -1;
+          tempPosition = sibling;
+        } else {
+          tempStart = tempPosition->StartOffset();
+          tempEnd = tempPosition->EndOffset();
+          tempPosition = tempPosition->Parent();
+        }
+      } else {
+        HyperTextAccessible* tempText = SearchForText(tempPosition, true);
+        if (!tempText)
+          return NS_OK;
+        tempPosition = tempText;
+        tempStart = tempEnd = tempText->CharacterCount();
+      }
+      continue;
+    }
+
+    AccessibleTextBoundary startBoundary, endBoundary;
+    switch (aBoundary) {
+      case CHAR_BOUNDARY:
+        startBoundary = nsIAccessibleText::BOUNDARY_CHAR;
+        endBoundary = nsIAccessibleText::BOUNDARY_CHAR;
+        break;
+      case WORD_BOUNDARY:
+        startBoundary = nsIAccessibleText::BOUNDARY_WORD_START;
+        endBoundary = nsIAccessibleText::BOUNDARY_WORD_END;
+        break;
+      default:
+        return NS_ERROR_INVALID_ARG;
+    }
+
+    nsAutoString unusedText;
+    int32_t newStart = 0, newEnd = 0, currentStart = tempStart, potentialEnd = 0;
+    text->GetTextBeforeOffset(tempStart, startBoundary, &newStart, &newEnd,
+                              unusedText);
+    if (newStart < tempStart)
+      tempStart = newEnd >= currentStart ? newStart : newEnd;
+    else // XXX: In certain odd cases newStart is equal to tempStart
+      text->GetTextBeforeOffset(tempStart - 1, startBoundary, &newStart,
+                                &tempStart, unusedText);
+    text->GetTextAtOffset(tempStart, endBoundary, &newStart, &potentialEnd,
+                          unusedText);
+    tempEnd = potentialEnd < tempEnd ? potentialEnd : currentStart;
+
+    // The offset range we've obtained might have embedded characters in it,
+    // limit the range to the start of the last occurrence of an embedded
+    // character.
+    Accessible* childAtOffset = nullptr;
+    for (int32_t i = tempEnd - 1; i >= tempStart; i--) {
+      childAtOffset = text->GetChildAtOffset(i);
+      if (childAtOffset && nsAccUtils::IsEmbeddedObject(childAtOffset)) {
+        tempStart = childAtOffset->EndOffset();
+        break;
+      }
+    }
+    // If there's an embedded character at the very end of the range, we
+    // instead want to traverse into it. So restart the movement with
+    // the child as the starting point.
+    if (childAtOffset && nsAccUtils::IsEmbeddedObject(childAtOffset) &&
+        tempEnd == childAtOffset->EndOffset()) {
+      tempPosition = childAtOffset;
+      tempStart = tempEnd = childAtOffset->AsHyperText()->CharacterCount();
+      continue;
+    }
+
+    *aResult = true;
+
+    Accessible* startPosition = mPosition;
+    int32_t oldStart = mStartOffset, oldEnd = mEndOffset;
+    mPosition = tempPosition;
+    mStartOffset = tempStart;
+    mEndOffset = tempEnd;
+
+    NotifyOfPivotChange(startPosition, oldStart, oldEnd,
+                        nsIAccessiblePivot::REASON_TEXT);
     return NS_OK;
-
-  AccessibleTextBoundary startBoundary, endBoundary;
-  switch (aBoundary) {
-    case CHAR_BOUNDARY:
-      startBoundary = nsIAccessibleText::BOUNDARY_CHAR;
-      endBoundary = nsIAccessibleText::BOUNDARY_CHAR;
-      break;
-    case WORD_BOUNDARY:
-      startBoundary = nsIAccessibleText::BOUNDARY_WORD_START;
-      endBoundary = nsIAccessibleText::BOUNDARY_WORD_END;
-      break;
-    default:
-      return NS_ERROR_INVALID_ARG;
   }
-
-  nsAutoString unusedText;
-  int32_t newStart = 0, newEnd = 0;
-  text->GetTextBeforeOffset(mStartOffset, startBoundary, &newStart, &newEnd,
-                            unusedText);
-  if (newStart < mStartOffset)
-    mStartOffset = newEnd == mStartOffset ? newStart : newEnd;
-  else // XXX: In certain odd cases newStart is equal to mStartOffset
-    text->GetTextBeforeOffset(mStartOffset - 1, startBoundary, &newStart,
-                              &mStartOffset, unusedText);
-  text->GetTextAtOffset(mStartOffset, endBoundary, &newStart, &mEndOffset,
-                        unusedText);
-
-  *aResult = true;
-
-  NotifyOfPivotChange(mPosition, oldStart, oldEnd,
-                      nsIAccessiblePivot::REASON_TEXT);
-  return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -636,6 +778,48 @@ nsAccessiblePivot::SearchForward(Accessible* aAccessible,
   return nullptr;
 }
 
+HyperTextAccessible*
+nsAccessiblePivot::SearchForText(Accessible* aAccessible, bool aBackward)
+{
+  Accessible* root = GetActiveRoot();
+  Accessible* accessible = aAccessible;
+  while (true) {
+    Accessible* child = nullptr;
+
+    while ((child = (aBackward ? accessible->LastChild() :
+                                 accessible->FirstChild()))) {
+      accessible = child;
+      if (child->IsHyperText())
+        return child->AsHyperText();
+    }
+
+    Accessible* sibling = nullptr;
+    Accessible* temp = accessible;
+    do {
+      if (temp == root)
+        break;
+
+      if (temp != aAccessible && temp->IsHyperText())
+        return temp->AsHyperText();
+
+      sibling = aBackward ? temp->PrevSibling() : temp->NextSibling();
+
+      if (sibling)
+        break;
+    } while ((temp = temp->Parent()));
+
+    if (!sibling)
+      break;
+
+    accessible = sibling;
+    if (accessible->IsHyperText())
+      return accessible->AsHyperText();
+  }
+
+  return nullptr;
+}
+
+
 bool
 nsAccessiblePivot::NotifyOfPivotChange(Accessible* aOldPosition,
                                        int32_t aOldStart, int32_t aOldEnd,
diff --git a/accessible/src/base/nsAccessiblePivot.h b/accessible/src/base/nsAccessiblePivot.h
index 0c578c72a42..e6d884df5cf 100644
--- a/accessible/src/base/nsAccessiblePivot.h
+++ b/accessible/src/base/nsAccessiblePivot.h
@@ -72,6 +72,12 @@ private:
                              bool aSearchCurrent,
                              nsresult* aResult);
 
+  /*
+   * Search in preorder for the first text accessible.
+   */
+  mozilla::a11y::HyperTextAccessible* SearchForText(Accessible* aAccessible,
+                                                    bool aBackward);
+
   /*
    * Get the effective root for this pivot, either the true root or modal root.
    */
diff --git a/accessible/src/generic/HyperTextAccessible.cpp b/accessible/src/generic/HyperTextAccessible.cpp
index eea26770480..a6d20d7abaa 100644
--- a/accessible/src/generic/HyperTextAccessible.cpp
+++ b/accessible/src/generic/HyperTextAccessible.cpp
@@ -593,14 +593,8 @@ HyperTextAccessible::DOMPointToHypertextOffset(nsINode* aNode,
     // addTextOffset, to put us after the embedded object char. We'll only treat the offset as
     // before the embedded object char if we end at the very beginning of the child.
     addTextOffset = addTextOffset > 0;
-    }
-    else {
-      // Start offset, inclusive
-      // Make sure the offset lands on the embedded object character in order to indicate
-      // the true inner offset is inside the subtree for that link
-      addTextOffset =
-        (nsAccUtils::TextLength(descendantAcc) == addTextOffset) ? 1 : 0;
-    }
+    } else
+      addTextOffset = 0;
 
     descendantAcc = parentAcc;
   }
diff --git a/accessible/src/jsat/AccessFu.jsm b/accessible/src/jsat/AccessFu.jsm
index 0edb9a24515..001a7882eb0 100644
--- a/accessible/src/jsat/AccessFu.jsm
+++ b/accessible/src/jsat/AccessFu.jsm
@@ -19,6 +19,8 @@ const ACCESSFU_DISABLE = 0;
 const ACCESSFU_ENABLE = 1;
 const ACCESSFU_AUTO = 2;
 
+const SCREENREADER_SETTING = 'accessibility.screenreader';
+
 this.AccessFu = {
   /**
    * Initialize chrome-layer accessibility functionality.
@@ -35,8 +37,15 @@ this.AccessFu = {
       Services.obs.addObserver(this, 'Accessibility:Settings', false);
     } catch (x) {
       // Not on Android
-      if (Utils.MozBuildApp === 'b2g') {
-        aWindow.addEventListener('ContentStart', this, false);
+      if (aWindow.navigator.mozSettings) {
+        let lock = aWindow.navigator.mozSettings.createLock();
+        let req = lock.get(SCREENREADER_SETTING);
+        req.addEventListener('success', () => {
+          this._systemPref = req.result[SCREENREADER_SETTING];
+          this._enableOrDisable();
+        });
+        aWindow.navigator.mozSettings.addObserver(
+          SCREENREADER_SETTING, this.handleEvent.bind(this));
       }
     }
 
@@ -56,10 +65,9 @@ this.AccessFu = {
     }
     if (Utils.MozBuildApp === 'mobile/android') {
       Services.obs.removeObserver(this, 'Accessibility:Settings');
-    } else if (Utils.MozBuildApp === 'b2g') {
-      Utils.win.shell.contentBrowser.contentWindow.removeEventListener(
-        'mozContentEvent', this);
-      Utils.win.removeEventListener('ContentStart', this);
+    } else if (Utils.win.navigator.mozSettings) {
+      Utils.win.navigator.mozSettings.removeObserver(
+        SCREENREADER_SETTING, this.handleEvent.bind(this));
     }
     delete this._activatePref;
     Utils.uninit();
@@ -308,20 +316,6 @@ this.AccessFu = {
 
   handleEvent: function handleEvent(aEvent) {
     switch (aEvent.type) {
-      case 'ContentStart':
-      {
-        Utils.win.shell.contentBrowser.contentWindow.addEventListener(
-          'mozContentEvent', this, false, true);
-        break;
-      }
-      case 'mozContentEvent':
-      {
-        if (aEvent.detail.type == 'accessibility-screenreader') {
-          this._systemPref = aEvent.detail.enabled;
-          this._enableOrDisable();
-        }
-        break;
-      }
       case 'TabOpen':
       {
         let mm = Utils.getMessageManager(aEvent.target);
@@ -351,6 +345,15 @@ this.AccessFu = {
         }
         break;
       }
+      default:
+      {
+        // A settings change, it does not have an event type
+        if (aEvent.settingName == SCREENREADER_SETTING) {
+          this._systemPref = aEvent.settingValue;
+          this._enableOrDisable();
+        }
+        break;
+      }
     }
   },
 
diff --git a/accessible/tests/mochitest/events.js b/accessible/tests/mochitest/events.js
index 112b1c482fb..264f168c19b 100644
--- a/accessible/tests/mochitest/events.js
+++ b/accessible/tests/mochitest/events.js
@@ -1541,10 +1541,12 @@ function moveToTextStart(aID)
 /**
  * Move the caret in text accessible.
  */
-function moveCaretToDOMPoint(aID, aNode, aOffset, aExpectedOffset,
-                             aFocusTargetID)
+function moveCaretToDOMPoint(aID, aDOMPointNodeID, aDOMPointOffset,
+                             aExpectedOffset, aFocusTargetID,
+                             aCheckFunc)
 {
   this.target = getAccessible(aID, [nsIAccessibleText]);
+  this.DOMPointNode = getNode(aDOMPointNodeID);
   this.focus = aFocusTargetID ? getAccessible(aFocusTargetID) : null;
   this.focusNode = this.focus ? this.focus.DOMNode : null;
 
@@ -1553,13 +1555,25 @@ function moveCaretToDOMPoint(aID, aNode, aOffset, aExpectedOffset,
     if (this.focusNode)
       this.focusNode.focus();
 
-    window.getSelection().getRangeAt(0).setStart(aNode, aOffset);
+    var selection = this.DOMPointNode.ownerDocument.defaultView.getSelection();
+    var selRange = selection.getRangeAt(0);
+    selRange.setStart(this.DOMPointNode, aDOMPointOffset);
+    selRange.collapse(true);
+
+    selection.removeRange(selRange);
+    selection.addRange(selRange);
   }
 
   this.getID = function moveCaretToDOMPoint_getID()
   {
    return "Set caret on " + prettyName(aID) + " at point: " +
-     prettyName(aNode) + " node with offset " + aOffset;
+     prettyName(aDOMPointNodeID) + " node with offset " + aDOMPointOffset;
+  }
+
+  this.finalCheck = function moveCaretToDOMPoint_finalCheck()
+  {
+    if (aCheckFunc)
+      aCheckFunc.call();
   }
 
   this.eventSeq = [
diff --git a/accessible/tests/mochitest/pivot/doc_virtualcursor_text.html b/accessible/tests/mochitest/pivot/doc_virtualcursor_text.html
index afcc0b92339..aba87bbd8a7 100644
--- a/accessible/tests/mochitest/pivot/doc_virtualcursor_text.html
+++ b/accessible/tests/mochitest/pivot/doc_virtualcursor_text.html
@@ -5,8 +5,25 @@
   <meta charset="utf-8" />
 </head>
 <body>
+  <div id="start-block">This is the very beginning.</div>
   <p id="paragraph-1">
-  This <b>is</b> <a href="#">the</a> test of text.
+  This <b>is</b> <a id="p1-link-1" href="#">the</a> test of text.
   </p>
+  <div id="section-1">A <a id="s1-link-1" href="#">multiword link</a> is here. <a id="s1-link-2" href="#">We</a> will traverse</div>
+  <div id="section-2">into, out, and between the subtrees.</div>
+  <p id="paragraph-2">Singularity.</p>
+  <table>
+    <tr>
+      <td id="cell-1">Magical</td>
+      <td id="cell-2">unicorns</td>
+    </tr>
+    <tr>
+      <td id="cell-3">and wizards</td>
+      <td id="cell-4">really exist.</td>
+    </tr>
+  </table>
+  <div id="section-3">Endless fun!</div>
+  <p id="paragraph-3">Objects<a id="p3-link-1" href="#">adjacent</a>to <a id="p3-link-2" href="#">each</a><a id="p3-link-3" href="#">other</a> should be separate.</p>
+  <div id="end-block">End!</div>
 </body>
 </html>
diff --git a/accessible/tests/mochitest/pivot/test_virtualcursor_text.html b/accessible/tests/mochitest/pivot/test_virtualcursor_text.html
index 4ef48490c6d..de42d7da71c 100644
--- a/accessible/tests/mochitest/pivot/test_virtualcursor_text.html
+++ b/accessible/tests/mochitest/pivot/test_virtualcursor_text.html
@@ -38,7 +38,6 @@
 
       gQueue.push(new setVCPosInvoker(docAcc, null, null,
                                       getAccessible(doc.getElementById('paragraph-1'))));
-
       gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,4],
                   getAccessible(doc.getElementById('paragraph-1'), nsIAccessibleText)));
       gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', CHAR_BOUNDARY, [4,5],
@@ -47,15 +46,170 @@
                   getAccessible(doc.getElementById('paragraph-1'), nsIAccessibleText)));
       gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [5,7],
                   getAccessible(doc.getElementById('paragraph-1'), nsIAccessibleText)));
-      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [8,9],
-                  getAccessible(doc.getElementById('paragraph-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,3],
+                  getAccessible(doc.getElementById('p1-link-1'), nsIAccessibleText)));
       gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [10,14],
                   getAccessible(doc.getElementById('paragraph-1'), nsIAccessibleText)));
-      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [8,9],
-                  getAccessible(doc.getElementById('paragraph-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,3],
+                  getAccessible(doc.getElementById('p1-link-1'), nsIAccessibleText)));
       gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [5,7],
                   getAccessible(doc.getElementById('paragraph-1'), nsIAccessibleText)));
 
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('section-1'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,1],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,9],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [10,14],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [4,6],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [7,12],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,2],
+                  getAccessible(doc.getElementById('s1-link-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [15,19],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [20,28],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,5],
+                  getAccessible(doc.getElementById('section-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [6,10],
+                  getAccessible(doc.getElementById('section-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,5],
+                  getAccessible(doc.getElementById('section-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [20,28],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [15,19],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,2],
+                  getAccessible(doc.getElementById('s1-link-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [7,12],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [4,6],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [10,14],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,9],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,1],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('s1-link-1'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', CHAR_BOUNDARY, [1,2],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', CHAR_BOUNDARY, [0,1],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', CHAR_BOUNDARY, [1,2],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', CHAR_BOUNDARY, [0,1],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', CHAR_BOUNDARY, [1,2],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [2,9],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [10,14],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', CHAR_BOUNDARY, [3,4],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', CHAR_BOUNDARY, [13,14],
+                  getAccessible(doc.getElementById('s1-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('section-2'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', CHAR_BOUNDARY, [27,28],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', CHAR_BOUNDARY, [0,1],
+                  getAccessible(doc.getElementById('section-2'), nsIAccessibleText)));
+
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('paragraph-2'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,12],
+                  getAccessible(doc.getElementById('paragraph-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,7],
+                  getAccessible(doc.getElementById('cell-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,8],
+                  getAccessible(doc.getElementById('cell-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,3],
+                  getAccessible(doc.getElementById('cell-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [4,11],
+                  getAccessible(doc.getElementById('cell-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,6],
+                  getAccessible(doc.getElementById('cell-4'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [7,13],
+                  getAccessible(doc.getElementById('cell-4'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,7],
+                  getAccessible(doc.getElementById('section-3'), nsIAccessibleText)));
+
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('section-3'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,7],
+                  getAccessible(doc.getElementById('section-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [7,13],
+                  getAccessible(doc.getElementById('cell-4'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,6],
+                  getAccessible(doc.getElementById('cell-4'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [4,11],
+                  getAccessible(doc.getElementById('cell-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,3],
+                  getAccessible(doc.getElementById('cell-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,8],
+                  getAccessible(doc.getElementById('cell-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,7],
+                  getAccessible(doc.getElementById('cell-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,12],
+                  getAccessible(doc.getElementById('paragraph-2'), nsIAccessibleText)));
+
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('paragraph-3'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,7],
+                  getAccessible(doc.getElementById('paragraph-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,8],
+                  getAccessible(doc.getElementById('p3-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [8,10],
+                  getAccessible(doc.getElementById('paragraph-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,4],
+                  getAccessible(doc.getElementById('p3-link-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,5],
+                  getAccessible(doc.getElementById('p3-link-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [14,20],
+                  getAccessible(doc.getElementById('paragraph-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,5],
+                  getAccessible(doc.getElementById('p3-link-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,4],
+                  getAccessible(doc.getElementById('p3-link-2'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [8,10],
+                  getAccessible(doc.getElementById('paragraph-3'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,8],
+                  getAccessible(doc.getElementById('p3-link-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,7],
+                  getAccessible(doc.getElementById('paragraph-3'), nsIAccessibleText)));
+
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('s1-link-2'))));
+      // Start with the pivot in the middle of the paragraph
+      gQueue.push(new setVCPosInvoker(docAcc, "moveNext", ObjectTraversalRule, " will traverse"));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [15,19],
+                  getAccessible(doc.getElementById('section-1'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, [0,2],
+                  getAccessible(doc.getElementById('s1-link-2'), nsIAccessibleText)));
+
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('end-block'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,4],
+                  getAccessible(doc.getElementById('end-block'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, null, false));
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('start-block'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'moveNextByText', WORD_BOUNDARY, [0,4],
+                  getAccessible(doc.getElementById('start-block'), nsIAccessibleText)));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, null, false));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, null, false));
+      gQueue.push(new setVCPosInvoker(docAcc, null, null,
+                                      getAccessible(doc.getElementById('start-block'))));
+      gQueue.push(new setVCTextInvoker(docAcc, 'movePreviousByText', WORD_BOUNDARY, null, false));
+
       gQueue.invoke();
     }
 
diff --git a/accessible/tests/mochitest/textcaret/test_general.html b/accessible/tests/mochitest/textcaret/test_general.html
index c2b538d32af..69f83959f18 100644
--- a/accessible/tests/mochitest/textcaret/test_general.html
+++ b/accessible/tests/mochitest/textcaret/test_general.html
@@ -35,6 +35,29 @@
          "Wrong caret offset for " + aID);
     }
 
+    function testCaretOffsets(aList)
+    {
+      for (var i = 0; i < aList.length; i++)
+        testCaretOffset(aList[0][0], aList[0][1]);
+    }
+
+    function queueTraversalList(aList, aFocusNode)
+    {
+      for (var i = 0 ; i < aList.length; i++) {
+        var node = aList[i].DOMPoint[0];
+        var nodeOffset = aList[i].DOMPoint[1];
+
+        var textAcc = aList[i].point[0];
+        var textOffset = aList[i].point[1];
+        var textList = aList[i].pointList;
+        var invoker =
+          new moveCaretToDOMPoint(textAcc, node, nodeOffset, textOffset,
+                                  ((i == 0) ? aFocusNode : null),
+                                  testCaretOffsets.bind(null, textList))
+        gQueue.push(invoker);
+      }
+    }
+
     /**
      * Do tests.
      */
@@ -48,7 +71,7 @@
       turnCaretBrowsing(true);
 
       // test caret offsets
-      testCaretOffset(document, 14);
+      testCaretOffset(document, 16);
       testCaretOffset("textbox", -1);
       testCaretOffset("textarea", -1);
       testCaretOffset("p", -1);
@@ -59,6 +82,49 @@
       gQueue.push(new setCaretOffset("textbox", 1, "textbox"));
       gQueue.push(new setCaretOffset("link", 1, "link"));
       gQueue.push(new setCaretOffset("heading", 1, document));
+
+      // a*b*c
+      var p2Doc = getNode("p2_container").contentDocument;
+      var traversalList = [
+        { // before 'a'
+          DOMPoint: [ getNode("p2", p2Doc).firstChild, 0 ],
+          point: [ getNode("p2", p2Doc), 0 ],
+          pointList: [ [ p2Doc, 0 ] ]
+        },
+        { // after 'a' (before anchor)
+          DOMPoint: [ getNode("p2", p2Doc).firstChild, 1 ],
+          point: [ getNode("p2", p2Doc), 1 ],
+          pointList: [ [ p2Doc, 0 ] ]
+        },
+        { // before 'b' (inside anchor)
+          DOMPoint: [ getNode("p2_a", p2Doc).firstChild, 0 ],
+          point: [ getNode("p2_a", p2Doc), 0 ],
+          pointList: [
+            [ getNode("p2", p2Doc), 1 ],
+            [ p2Doc, 0 ]
+          ]
+        },
+        { // after 'b' (inside anchor)
+          DOMPoint: [ getNode("p2_a", p2Doc).firstChild, 1 ],
+          point: [ getNode("p2_a", p2Doc), 1 ],
+          pointList: [
+            [ getNode("p2", p2Doc), 1 ] ,
+            [ p2Doc, 0 ]
+          ]
+        },
+        { // before 'c' (after anchor)
+          DOMPoint: [ getNode("p2", p2Doc).lastChild, 0 ],
+          point: [ getNode("p2", p2Doc), 2 ],
+          pointList: [ [ p2Doc, 0 ] ]
+        },
+        { // after 'c'
+          DOMPoint: [ getNode("p2", p2Doc).lastChild, 1 ],
+          point: [ getNode("p2", p2Doc), 3 ],
+          pointList: [ [ p2Doc, 0 ] ]
+        }
+      ];
+      queueTraversalList(traversalList, getNode("p2", p2Doc));
+
       gQueue.onFinish = function()
       {
         turnCaretBrowsing(false);
@@ -77,22 +143,27 @@
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=448744"
      title="caretOffset should return -1 if the system caret is not currently with in that particular object">
-    Mozilla Bug 448744
+    Bug 448744
   </a>
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=524115"
      title="HyperText accessible should get focus when the caret is positioned inside of it, text is changed or copied into clipboard by ATs">
-    Mozilla Bug 524115
+    Bug 524115
   </a>
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=546068"
      title="Position is not being updated when atk_text_set_caret_offset is used">
-    Mozilla Bug 546068
+    Bug 546068
+  </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=672717"
+     title="Broken caret when moving into/out of embedded objects with right arrow">
+    Bug 672717
   </a>
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=725581"
      title="caretOffset for textarea should be -1 when textarea doesn't have a focus">
-    Mozilla Bug 725581
+    Bug 725581
   </a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
@@ -104,6 +175,8 @@
   <p id="p" contentEditable="true"><span>text</span><br/>text</p>
   <a id="link" href="about:">about mozilla</a>
   <h5 id="heading">heading</h5>
+  <iframe id="p2_container"
+          src="data:text/html,<p id='p2' contentEditable='true'>a<a id='p2_a' href='mozilla.org'>b</a>c</p>"></iframe>
 
   <div id="eventdump"></div>
 </body>
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 04d50fdef88..6df7c1c7b91 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -135,6 +135,11 @@ pref("browser.search.suggest.enabled", true);
 // tell the search service that we don't really expose the "current engine"
 pref("browser.search.noCurrentEngine", true);
 
+// Enable sparse localization by setting a few package locale overrides
+pref("chrome.override_package.global", "b2g-l10n");
+pref("chrome.override_package.mozapps", "b2g-l10n");
+pref("chrome.override_package.passwordmgr", "b2g-l10n");
+
 // enable xul error pages
 pref("browser.xul.error_pages.enabled", true);
 
diff --git a/b2g/locales/Makefile.in b/b2g/locales/Makefile.in
index 8366e4340bd..b3b1f85b222 100644
--- a/b2g/locales/Makefile.in
+++ b/b2g/locales/Makefile.in
@@ -74,7 +74,6 @@ libs-%:
 
 # Tailored target to just add the chrome processing for multi-locale builds
 chrome-%:
-	@$(MAKE) -C ../../toolkit/locales chrome-$*
 	@$(MAKE) chrome AB_CD=$*
 	@$(MAKE) -C $(DEPTH)/$(MOZ_BRANDING_DIRECTORY)/locales chrome AB_CD=$*
 
diff --git a/b2g/locales/jar.mn b/b2g/locales/jar.mn
index d9397c8c5e1..72a443723c5 100644
--- a/b2g/locales/jar.mn
+++ b/b2g/locales/jar.mn
@@ -13,3 +13,61 @@
 * locale/@AB_CD@/b2g-l10n/netError.dtd             (%chrome/overrides/netError.dtd)
 * locale/@AB_CD@/b2g-l10n/aboutCertError.dtd       (%chrome/overrides/aboutCertError.dtd)
 * locale/@AB_CD@/b2g-l10n/appstrings.properties    (%chrome/overrides/appstrings.properties)
+
+
+# overrides for toolkit l10n, also for en-US
+relativesrcdir toolkit/locales:
+  locale/@AB_CD@/b2g-l10n/overrides/about.dtd                       (%chrome/global/about.dtd)
+  locale/@AB_CD@/b2g-l10n/overrides/aboutAbout.dtd                  (%chrome/global/aboutAbout.dtd)
+  locale/@AB_CD@/b2g-l10n/overrides/aboutRights.dtd                 (%chrome/global/aboutRights.dtd)
+  locale/@AB_CD@/b2g-l10n/overrides/commonDialogs.properties        (%chrome/global/commonDialogs.properties)
+  locale/@AB_CD@/b2g-l10n/overrides/handling/handling.properties    (%chrome/mozapps/handling/handling.properties)
+  locale/@AB_CD@/b2g-l10n/overrides/intl.properties                 (%chrome/global/intl.properties)
+  locale/@AB_CD@/b2g-l10n/overrides/intl.css                        (%chrome/global/intl.css)
+  locale/@AB_CD@/b2g-l10n/overrides/passwordmgr.properties          (%chrome/passwordmgr/passwordmgr.properties)
+  locale/@AB_CD@/b2g-l10n/overrides/search/search.properties        (%chrome/search/search.properties)
+  locale/@AB_CD@/b2g-l10n/overrides/update/updates.properties       (%chrome/mozapps/update/updates.properties)
+# about:support
+  locale/@AB_CD@/b2g-l10n/overrides/global/aboutSupport.dtd         (%chrome/global/aboutSupport.dtd)
+  locale/@AB_CD@/b2g-l10n/overrides/global/aboutSupport.properties  (%chrome/global/aboutSupport.properties)
+#about:crashes
+  locale/@AB_CD@/b2g-l10n/overrides/crashreporter/crashes.dtd         (%crashreporter/crashes.dtd)
+  locale/@AB_CD@/b2g-l10n/overrides/crashreporter/crashes.properties  (%crashreporter/crashes.properties)
+#about:mozilla
+  locale/@AB_CD@/b2g-l10n/overrides/global/mozilla.dtd                (%chrome/global/mozilla.dtd)
+#about:telemetry
+  locale/@AB_CD@/b2g-l10n/overrides/global/aboutTelemetry.dtd         (%chrome/global/aboutTelemetry.dtd)
+  locale/@AB_CD@/b2g-l10n/overrides/global/aboutTelemetry.properties  (%chrome/global/aboutTelemetry.properties)
+
+% override chrome://global/locale/about.dtd chrome://b2g-l10n/locale/overrides/about.dtd
+% override chrome://global/locale/aboutAbout.dtd chrome://b2g-l10n/locale/overrides/aboutAbout.dtd
+% override chrome://global/locale/aboutRights.dtd chrome://b2g-l10n/locale/overrides/aboutRights.dtd
+% override chrome://global/locale/commonDialogs.properties chrome://b2g-l10n/locale/overrides/commonDialogs.properties
+% override chrome://mozapps/locale/handling/handling.properties chrome://b2g-l10n/locale/overrides/handling/handling.properties
+% override chrome://global/locale/intl.properties chrome://b2g-l10n/locale/overrides/intl.properties
+% override chrome://global/locale/intl.css chrome://b2g-l10n/locale/overrides/intl.css
+% override chrome://passwordmgr/locale/passwordmgr.properties chrome://b2g-l10n/locale/overrides/passwordmgr/passwordmgr.properties
+% override chrome://global/locale/search/search.properties chrome://b2g-l10n/locale/overrides/search/search.properties
+% override chrome://mozapps/locale/update/updates.properties chrome://b2g-l10n/locale/overrides/update/updates.properties
+% override chrome://global/locale/aboutSupport.dtd chrome://b2g-l10n/locale/overrides/global/aboutSupport.dtd
+% override chrome://global/locale/aboutSupport.properties chrome://b2g-l10n/locale/overrides/global/aboutSupport.properties
+% override chrome://global/locale/crashes.dtd chrome://b2g-l10n/locale/overrides/crashreporter/crashes.dtd
+% override chrome://global/locale/crashes.properties chrome://b2g-l10n/locale/overrides/crashreporter/crashes.properties
+% override chrome://global/locale/mozilla.dtd chrome://b2g-l10n/locale/overrides/global/mozilla.dtd
+% override chrome://global/locale/aboutTelemetry.dtd chrome://b2g-l10n/locale/overrides/global/aboutTelemetry.dtd
+% override chrome://global/locale/aboutTelemetry.properties chrome://b2g-l10n/locale/overrides/global/aboutTelemetry.properties
+
+# overrides for dom l10n, also for en-US
+relativesrcdir dom/locales:
+  locale/@AB_CD@/b2g-l10n/overrides/charsetTitles.properties    (%chrome/charsetTitles.properties)
+  locale/@AB_CD@/b2g-l10n/overrides/global.dtd                  (%chrome/global.dtd)
+  locale/@AB_CD@/b2g-l10n/overrides/AccessFu.properties         (%chrome/accessibility/AccessFu.properties)
+  locale/@AB_CD@/b2g-l10n/overrides/dom/dom.properties          (%chrome/dom/dom.properties)
+#about:plugins
+  locale/@AB_CD@/b2g-l10n/overrides/plugins.properties          (%chrome/plugins.properties)
+
+% override chrome://global/locale/charsetTitles.properties chrome://b2g-l10n/locale/overrides/charsetTitles.properties
+% override chrome://global/locale/global.dtd chrome://b2g-l10n/locale/overrides/global.dtd
+% override chrome://global/locale/AccessFu.properties chrome://b2g-l10n/locale/overrides/AccessFu.properties
+% override chrome://global/locale/dom/dom.properties chrome://b2g-l10n/locale/overrides/dom/dom.properties
+% override chrome://global/locale/plugins.properties chrome://b2g-l10n/locale/overrides/plugins.properties
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 8ab3b95ade3..552fc8a826c 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1119,18 +1119,25 @@ var gBrowserInit = {
     // If the user manually opens the download manager before the timeout, the
     // downloads will start right away, and getting the service again won't hurt.
     setTimeout(function() {
-      let DownloadsCommon =
-        Cu.import("resource:///modules/DownloadsCommon.jsm", {}).DownloadsCommon;
-      if (DownloadsCommon.useJSTransfer) {
-        // Open the data link without initalizing nsIDownloadManager.
-        DownloadsCommon.initializeAllDataLinks();
-      } else {
-        // Initalizing nsIDownloadManager will trigger the data link.
-        Services.downloads;
+      try {
+        let DownloadsCommon =
+          Cu.import("resource:///modules/DownloadsCommon.jsm", {}).DownloadsCommon;
+        if (DownloadsCommon.useJSTransfer) {
+          // Open the data link without initalizing nsIDownloadManager.
+          DownloadsCommon.initializeAllDataLinks();
+          let DownloadsTaskbar =
+            Cu.import("resource:///modules/DownloadsTaskbar.jsm", {}).DownloadsTaskbar;
+          DownloadsTaskbar.registerIndicator(window);
+        } else {
+          // Initalizing nsIDownloadManager will trigger the data link.
+          Services.downloads;
+          let DownloadTaskbarProgress =
+            Cu.import("resource://gre/modules/DownloadTaskbarProgress.jsm", {}).DownloadTaskbarProgress;
+          DownloadTaskbarProgress.onBrowserWindowLoad(window);
+        }
+      } catch (ex) {
+        Cu.reportError(ex);
       }
-      let DownloadTaskbarProgress =
-        Cu.import("resource://gre/modules/DownloadTaskbarProgress.jsm", {}).DownloadTaskbarProgress;
-      DownloadTaskbarProgress.onBrowserWindowLoad(window);
     }, 10000);
 
     // The object handling the downloads indicator is also initialized here in the
diff --git a/browser/components/downloads/src/DownloadsTaskbar.jsm b/browser/components/downloads/src/DownloadsTaskbar.jsm
new file mode 100644
index 00000000000..18a9fd245b4
--- /dev/null
+++ b/browser/components/downloads/src/DownloadsTaskbar.jsm
@@ -0,0 +1,180 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80 filetype=javascript: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Handles the download progress indicator in the taskbar.
+ */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = [
+  "DownloadsTaskbar",
+];
+
+////////////////////////////////////////////////////////////////////////////////
+//// Globals
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+const Cr = Components.results;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "Downloads",
+                                  "resource://gre/modules/Downloads.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "RecentWindow",
+                                  "resource:///modules/RecentWindow.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "Services",
+                                  "resource://gre/modules/Services.jsm");
+
+XPCOMUtils.defineLazyGetter(this, "gWinTaskbar", function () {
+  if (!("@mozilla.org/windows-taskbar;1" in Cc)) {
+    return null;
+  }
+  let winTaskbar = Cc["@mozilla.org/windows-taskbar;1"]
+                     .getService(Ci.nsIWinTaskbar);
+  return winTaskbar.available && winTaskbar;
+});
+
+XPCOMUtils.defineLazyGetter(this, "gMacTaskbarProgress", function () {
+  return ("@mozilla.org/widget/macdocksupport;1" in Cc) &&
+         Cc["@mozilla.org/widget/macdocksupport;1"]
+           .getService(Ci.nsITaskbarProgress);
+});
+
+////////////////////////////////////////////////////////////////////////////////
+//// DownloadsTaskbar
+
+/**
+ * Handles the download progress indicator in the taskbar.
+ */
+this.DownloadsTaskbar = {
+  /**
+   * Underlying DownloadSummary providing the aggregate download information, or
+   * null if the indicator has never been initialized.
+   */
+  _summary: null,
+
+  /**
+   * nsITaskbarProgress object to which download information is dispatched.
+   * This can be null if the indicator has never been initialized or if the
+   * indicator is currently hidden on Windows.
+   */
+  _taskbarProgress: null,
+
+  /**
+   * This method is called after a new browser window is opened, and ensures
+   * that the download progress indicator is displayed in the taskbar.
+   *
+   * On Windows, the indicator is attached to the first browser window that
+   * calls this method.  When the window is closed, the indicator is moved to
+   * another browser window, if available, in no particular order.  When there
+   * are no browser windows visible, the indicator is hidden.
+   *
+   * On Mac OS X, the indicator is initialized globally when this method is
+   * called for the first time.  Subsequent calls have no effect.
+   *
+   * @param aBrowserWindow
+   *        nsIDOMWindow object of the newly opened browser window to which the
+   *        indicator may be attached.
+   */
+  registerIndicator: function (aBrowserWindow)
+  {
+    if (!this._taskbarProgress) {
+      if (gMacTaskbarProgress) {
+        // On Mac OS X, we have to register the global indicator only once.
+        this._taskbarProgress = gMacTaskbarProgress;
+        // Free the XPCOM reference on shutdown, to prevent detecting a leak.
+        Services.obs.addObserver(() => {
+          this._taskbarProgress = null;
+          gMacTaskbarProgress = null;
+        }, "quit-application-granted", false);
+      } else if (gWinTaskbar) {
+        // On Windows, the indicator is currently hidden because we have no
+        // previous browser window, thus we should attach the indicator now.
+        this._attachIndicator(aBrowserWindow);
+      } else {
+        // The taskbar indicator is not available on this platform.
+        return;
+      }
+    }
+
+    // Ensure that the DownloadSummary object will be created asynchronously.
+    if (!this._summary) {
+      Downloads.getSummary(Downloads.ALL).then(summary => {
+        // In case the method is re-entered, we simply ignore redundant
+        // invocations of the callback, instead of keeping separate state.
+        if (this._summary) {
+          return;
+        }
+        this._summary = summary;
+        return this._summary.addView(this);
+      }).then(null, Cu.reportError);
+    }
+  },
+
+  /**
+   * On Windows, attaches the taskbar indicator to the specified browser window.
+   */
+  _attachIndicator: function (aWindow)
+  {
+    // Activate the indicator on the specified window.
+    let docShell = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
+                          .getInterface(Ci.nsIWebNavigation)
+                          .QueryInterface(Ci.nsIDocShellTreeItem).treeOwner
+                          .QueryInterface(Ci.nsIInterfaceRequestor)
+                          .getInterface(Ci.nsIXULWindow).docShell;
+    this._taskbarProgress = gWinTaskbar.getTaskbarProgress(docShell);
+
+    // If the DownloadSummary object has already been created, we should update
+    // the state of the new indicator, otherwise it will be updated as soon as
+    // the DownloadSummary view is registered.
+    if (this._summary) {
+      this.onSummaryChanged();
+    }
+
+    aWindow.addEventListener("unload", () => {
+      // Locate another browser window, excluding the one being closed.
+      let browserWindow = RecentWindow.getMostRecentBrowserWindow();
+      if (browserWindow) {
+        // Move the progress indicator to the other browser window.
+        this._attachIndicator(browserWindow);
+      } else {
+        // The last browser window has been closed.  We remove the reference to
+        // the taskbar progress object so that the indicator will be registered
+        // again on the next browser window that is opened.
+        this._taskbarProgress = null;
+      }
+    }, false);
+  },
+
+  //////////////////////////////////////////////////////////////////////////////
+  //// DownloadSummary view
+
+  onSummaryChanged: function ()
+  {
+    // If the last browser window has been closed, we have no indicator anymore.
+    if (!this._taskbarProgress) {
+      return;
+    }
+
+    if (this._summary.allHaveStopped || this._summary.progressTotalBytes == 0) {
+      this._taskbarProgress.setProgressState(
+                               Ci.nsITaskbarProgress.STATE_NO_PROGRESS, 0, 0);
+    } else {
+      // For a brief moment before completion, some download components may
+      // report more transferred bytes than the total number of bytes.  Thus,
+      // ensure that we never break the expectations of the progress indicator.
+      let progressCurrentBytes = Math.min(this._summary.progressTotalBytes,
+                                          this._summary.progressCurrentBytes);
+      this._taskbarProgress.setProgressState(
+                               Ci.nsITaskbarProgress.STATE_NORMAL,
+                               progressCurrentBytes,
+                               this._summary.progressTotalBytes);
+    }
+  },
+};
diff --git a/browser/components/downloads/src/moz.build b/browser/components/downloads/src/moz.build
index 2a3a4973dc5..f7b6c7e686c 100644
--- a/browser/components/downloads/src/moz.build
+++ b/browser/components/downloads/src/moz.build
@@ -13,5 +13,6 @@ EXTRA_COMPONENTS += [
 EXTRA_JS_MODULES += [
     'DownloadsCommon.jsm',
     'DownloadsLogger.jsm',
+    'DownloadsTaskbar.jsm',
 ]
 
diff --git a/browser/components/preferences/in-content/main.xul b/browser/components/preferences/in-content/main.xul
index 1e3460772b6..f960ea71579 100644
--- a/browser/components/preferences/in-content/main.xul
+++ b/browser/components/preferences/in-content/main.xul
@@ -215,34 +215,27 @@
               accesskey="&newWindowsAsTabs.accesskey;"
               preference="browser.link.open_newwindow"
               onsyncfrompreference="return gMainPane.readLinkTarget();"
-              onsynctopreference="return gMainPane.writeLinkTarget();"
-              class="indent"/>
+              onsynctopreference="return gMainPane.writeLinkTarget();"/>
 
     <checkbox id="warnCloseMultiple" label="&warnCloseMultipleTabs.label;"
               accesskey="&warnCloseMultipleTabs.accesskey;"
-              preference="browser.tabs.warnOnClose"
-              class="indent"/>
+              preference="browser.tabs.warnOnClose"/>
 
     <checkbox id="warnOpenMany" label="&warnOpenManyTabs.label;"
               accesskey="&warnOpenManyTabs.accesskey;"
-              preference="browser.tabs.warnOnOpen"
-              class="indent"/>
+              preference="browser.tabs.warnOnOpen"/>
 
     <checkbox id="restoreOnDemand" label="&restoreTabsOnDemand.label;"
               accesskey="&restoreTabsOnDemand.accesskey;"
-              preference="browser.sessionstore.restore_on_demand"
-              class="indent"/>
+              preference="browser.sessionstore.restore_on_demand"/>
 
     <checkbox id="switchToNewTabs" label="&switchToNewTabs.label;"
               accesskey="&switchToNewTabs.accesskey;"
-              preference="browser.tabs.loadInBackground"
-              class="indent"/>
+              preference="browser.tabs.loadInBackground"/>
 
 #ifdef XP_WIN
     <checkbox id="showTabsInTaskbar" label="&showTabsInTaskbar.label;"
               accesskey="&showTabsInTaskbar.accesskey;"
-              preference="browser.taskbar.previews.enable"
-              class="indent"/>
+              preference="browser.taskbar.previews.enable"/>
 #endif
-
 </groupbox>
diff --git a/browser/devtools/debugger/test/Makefile.in b/browser/devtools/debugger/test/Makefile.in
index 275083ae5cd..de15fad5367 100644
--- a/browser/devtools/debugger/test/Makefile.in
+++ b/browser/devtools/debugger/test/Makefile.in
@@ -22,6 +22,7 @@ MOCHITEST_BROWSER_TESTS = \
 	browser_dbg_breakpoints-pane.js \
 	browser_dbg_chrome-debugging.js \
 	browser_dbg_clean-exit.js \
+	browser_dbg_clean-exit-window.js \
 	browser_dbg_cmd-blackbox.js \
 	browser_dbg_cmd-break.js \
 	browser_dbg_cmd-dbg.js \
diff --git a/browser/devtools/debugger/test/browser_dbg_clean-exit-window.js b/browser/devtools/debugger/test/browser_dbg_clean-exit-window.js
new file mode 100644
index 00000000000..aa0afc2acf0
--- /dev/null
+++ b/browser/devtools/debugger/test/browser_dbg_clean-exit-window.js
@@ -0,0 +1,90 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * Test that closing a window with the debugger in a paused state exits cleanly.
+ */
+
+let gDebuggee, gPanel, gDebugger, gWindow;
+
+const TAB_URL = EXAMPLE_URL + "doc_inline-debugger-statement.html";
+
+function test() {
+  addWindow(TAB_URL)
+    .then(win => initDebugger(TAB_URL, win))
+    .then(([aTab, aDebuggee, aPanel, aWindow]) => {
+      gDebuggee = aDebuggee;
+      gPanel = aPanel;
+      gDebugger = gPanel.panelWin;
+      gWindow = aWindow;
+
+      return testCleanExit(gWindow);
+    })
+    .then(null, aError => {
+      ok(false, "Got an error: " + aError.message + "\n" + aError.stack);
+    });
+}
+
+function testCleanExit(aWindow) {
+  let deferred = promise.defer();
+
+  gWindow = aWindow;
+  ok(!!gWindow, "Second window created.");
+
+  gWindow.focus();
+
+  let topWindow = Services.wm.getMostRecentWindow("navigator:browser");
+  is(topWindow, gWindow,
+    "The second window is on top.");
+
+  let isActive = promise.defer();
+  let isLoaded = promise.defer();
+
+  promise.all([isActive.promise, isLoaded.promise]).then(() => {
+    gWindow.BrowserChromeTest.runWhenReady(() => {
+      waitForSourceAndCaretAndScopes(gPanel, ".html", 16).then(() => {
+        is(gDebugger.gThreadClient.paused, true,
+          "Should be paused after the debugger statement.");
+        gWindow.close();
+        deferred.resolve();
+        finish();
+      });
+
+      gDebuggee.runDebuggerStatement();
+    });
+  });
+
+  let focusManager = Cc["@mozilla.org/focus-manager;1"].getService(Ci.nsIFocusManager);
+  if (focusManager.activeWindow != gWindow) {
+    gWindow.addEventListener("activate", function onActivate(aEvent) {
+      if (aEvent.target != gWindow) {
+        return;
+      }
+      gWindow.removeEventListener("activate", onActivate, true);
+      isActive.resolve();
+    }, true);
+  } else {
+    isActive.resolve();
+  }
+
+  let contentLocation = gWindow.content.location.href;
+  if (contentLocation != TAB_URL) {
+    gWindow.document.addEventListener("load", function onLoad(aEvent) {
+      if (aEvent.target.documentURI != TAB_URL) {
+        return;
+      }
+      gWindow.document.removeEventListener("load", onLoad, true);
+      isLoaded.resolve();
+    }, true);
+  } else {
+    isLoaded.resolve();
+  }
+  return deferred.promise;
+}
+
+registerCleanupFunction(function() {
+  gWindow = null;
+  gDebuggee = null;
+  gPanel = null;
+  gDebugger = null;
+});
diff --git a/browser/devtools/debugger/test/head.js b/browser/devtools/debugger/test/head.js
index 2cfbc601d65..19c1582c831 100644
--- a/browser/devtools/debugger/test/head.js
+++ b/browser/devtools/debugger/test/head.js
@@ -416,18 +416,18 @@ function backspaceText(aElement, aTimes) {
   }
 }
 
-function getTab(aTarget) {
+function getTab(aTarget, aWindow) {
   if (aTarget instanceof XULElement) {
     return promise.resolve(aTarget);
   } else {
-    return addTab(aTarget);
+    return addTab(aTarget, aWindow);
   }
 }
 
 function initDebugger(aTarget, aWindow) {
   info("Initializing a debugger panel.");
 
-  return getTab(aTarget).then(aTab => {
+  return getTab(aTarget, aWindow).then(aTab => {
     info("Debugee tab added successfully: " + aTarget);
 
     let deferred = promise.defer();
@@ -445,7 +445,7 @@ function initDebugger(aTarget, aWindow) {
         info("Debugger client resumed successfully.");
 
         prepareDebugger(debuggerPanel);
-        deferred.resolve([aTab, debuggee, debuggerPanel]);
+        deferred.resolve([aTab, debuggee, debuggerPanel, aWindow]);
       });
     });
 
diff --git a/browser/devtools/responsivedesign/responsivedesign.jsm b/browser/devtools/responsivedesign/responsivedesign.jsm
index b7c0e90ba00..1052689bbf0 100644
--- a/browser/devtools/responsivedesign/responsivedesign.jsm
+++ b/browser/devtools/responsivedesign/responsivedesign.jsm
@@ -180,12 +180,6 @@ function ResponsiveUI(aWindow, aTab)
   this.buildUI();
   this.checkMenus();
 
-  this.docShell = this.browser.contentWindow.QueryInterface(Ci.nsIInterfaceRequestor)
-                      .getInterface(Ci.nsIWebNavigation)
-                      .QueryInterface(Ci.nsIDocShell);
-
-  this.docShell.deviceSizeIsPageSize = true;
-
   try {
     if (Services.prefs.getBoolPref("devtools.responsiveUI.rotate")) {
       this.rotate();
@@ -258,8 +252,6 @@ ResponsiveUI.prototype = {
     this.browser.removeEventListener("load", this.bound_onPageLoad, true);
     this.browser.removeEventListener("unload", this.bound_onPageUnload, true);
 
-    this.docShell.deviceSizeIsPageSize = false;
-
     if (this._floatingScrollbars)
       switchToNativeScrollbars(this.tab);
 
@@ -296,7 +288,6 @@ ResponsiveUI.prototype = {
     this.container.removeAttribute("responsivemode");
     this.stack.removeAttribute("responsivemode");
 
-    delete this.docShell;
     delete this.tab.__responsiveUI;
     if (this.touchEventHandler)
       this.touchEventHandler.stop();
diff --git a/browser/devtools/responsivedesign/test/Makefile.in b/browser/devtools/responsivedesign/test/Makefile.in
index 6c7567bbca2..42f0be6518b 100644
--- a/browser/devtools/responsivedesign/test/Makefile.in
+++ b/browser/devtools/responsivedesign/test/Makefile.in
@@ -9,7 +9,6 @@ MOCHITEST_BROWSER_FILES := \
 		browser_responsive_cmd.js \
 		browser_responsivecomputedview.js \
 		browser_responsiveui_touch.js \
-		browser_responsive_devicewidth.js \
 		touch.html \
 		head.js \
 		$(NULL)
diff --git a/browser/devtools/responsivedesign/test/browser_responsive_devicewidth.js b/browser/devtools/responsivedesign/test/browser_responsive_devicewidth.js
deleted file mode 100644
index 88437afde4c..00000000000
--- a/browser/devtools/responsivedesign/test/browser_responsive_devicewidth.js
+++ /dev/null
@@ -1,61 +0,0 @@
-/* Any copyright is dedicated to the Public Domain.
-http://creativecommons.org/publicdomain/zero/1.0/ */
-
-function test() {
-  let instance;
-  let mgr = ResponsiveUI.ResponsiveUIManager;
-
-  waitForExplicitFinish();
-
-  gBrowser.selectedTab = gBrowser.addTab();
-  gBrowser.selectedBrowser.addEventListener("load", function onload() {
-    gBrowser.selectedBrowser.removeEventListener("load", onload, true);
-    waitForFocus(startTest, content);
-  }, true);
-
-  content.location = "data:text/html,mop";
-
-  function startTest() {
-    mgr.once("on", function() {executeSoon(onUIOpen)});
-    document.getElementById("Tools:ResponsiveUI").doCommand();
-  }
-
-  function onUIOpen() {
-    instance = gBrowser.selectedTab.__responsiveUI;
-    instance.stack.setAttribute("notransition", "true");
-    ok(instance, "instance of the module is attached to the tab.");
-
-    let mql = content.matchMedia("(max-device-width:100px)")
-
-    ok(!mql.matches, "media query doesn't match.");
-
-    mql.addListener(onMediaChange);
-    instance.setSize(90, 500);
-  }
-
-  function onMediaChange(mql) {
-    mql.removeListener(onMediaChange);
-    ok(mql.matches, "media query matches.");
-    ok(window.screen.width != content.screen.width, "screen.width is not the size of the screen.");
-    is(content.screen.width, 90, "screen.width is the width of the page.");
-    is(content.screen.height, 500, "screen.height is the height of the page.");
-
-
-    let docShell = content.QueryInterface(Ci.nsIInterfaceRequestor)
-                          .getInterface(Ci.nsIWebNavigation)
-                          .QueryInterface(Ci.nsIDocShell);
-
-    mql.addListener(onMediaChange2);
-    docShell.deviceSizeIsPageSize = false;
-  }
-
-  function onMediaChange2(mql) {
-    mql.removeListener(onMediaChange);
-    ok(!mql.matches, "media query has been re-evaluated.");
-    ok(window.screen.width == content.screen.width, "screen.width is not the size of the screen.");
-    instance.stack.removeAttribute("notransition");
-    document.getElementById("Tools:ResponsiveUI").doCommand();
-    gBrowser.removeCurrentTab();
-    finish();
-  }
-}
diff --git a/browser/devtools/styleinspector/computed-view.js b/browser/devtools/styleinspector/computed-view.js
index ca34077a957..44c1ac0b9aa 100644
--- a/browser/devtools/styleinspector/computed-view.js
+++ b/browser/devtools/styleinspector/computed-view.js
@@ -668,16 +668,13 @@ PropertyView.prototype = {
 
   /**
    * Returns the className that should be assigned to the propertyView.
-   *
    * @return string
    */
   get propertyHeaderClassName()
   {
     if (this.visible) {
-      this.tree._darkStripe = !this.tree._darkStripe;
-      let darkValue = this.tree._darkStripe ?
-                      "property-view theme-bg-darker" : "property-view";
-      return darkValue;
+      let isDark = this.tree._darkStripe = !this.tree._darkStripe;
+      return isDark ? "property-view theme-bg-darker" : "property-view";
     }
     return "property-view-hidden";
   },
@@ -690,49 +687,66 @@ PropertyView.prototype = {
   get propertyContentClassName()
   {
     if (this.visible) {
-      let darkValue = this.tree._darkStripe ?
-                      "property-content theme-bg-darker" : "property-content";
-      return darkValue;
+      let isDark = this.tree._darkStripe;
+      return isDark ? "property-content theme-bg-darker" : "property-content";
     }
     return "property-content-hidden";
   },
 
+  /**
+   * Build the markup for on computed style
+   * @return Element
+   */
   buildMain: function PropertyView_buildMain()
   {
     let doc = this.tree.styleDocument;
+    let onToggle = this.onStyleToggle.bind(this);
+
+    // Build the container element
     this.element = doc.createElementNS(HTML_NS, "div");
     this.element.setAttribute("class", this.propertyHeaderClassName);
 
-    this.matchedExpander = doc.createElementNS(HTML_NS, "div");
-    this.matchedExpander.className = "expander theme-twisty";
-    this.matchedExpander.setAttribute("tabindex", "0");
-    this.matchedExpander.addEventListener("click",
-      this.matchedExpanderClick.bind(this), false);
-    this.matchedExpander.addEventListener("keydown", function(aEvent) {
+    // Make it keyboard navigable
+    this.element.setAttribute("tabindex", "0");
+    this.element.addEventListener("keydown", function(aEvent) {
       let keyEvent = Ci.nsIDOMKeyEvent;
       if (aEvent.keyCode == keyEvent.DOM_VK_F1) {
         this.mdnLinkClick();
       }
       if (aEvent.keyCode == keyEvent.DOM_VK_RETURN ||
         aEvent.keyCode == keyEvent.DOM_VK_SPACE) {
-        this.matchedExpanderClick(aEvent);
+        onToggle(aEvent);
       }
     }.bind(this), false);
+
+    // Build the twisty expand/collapse
+    this.matchedExpander = doc.createElementNS(HTML_NS, "div");
+    this.matchedExpander.className = "expander theme-twisty";
+    this.matchedExpander.addEventListener("click", onToggle, false);
     this.element.appendChild(this.matchedExpander);
 
+    // Build the style name element
     this.nameNode = doc.createElementNS(HTML_NS, "div");
-    this.element.appendChild(this.nameNode);
     this.nameNode.setAttribute("class", "property-name theme-fg-color5");
+    // Reset its tabindex attribute otherwise, if an ellipsis is applied
+    // it will be reachable via TABing
+    this.nameNode.setAttribute("tabindex", "");
     this.nameNode.textContent = this.nameNode.title = this.name;
-    this.nameNode.addEventListener("click", function(aEvent) {
-      this.matchedExpander.focus();
-    }.bind(this), false);
+    // Make it hand over the focus to the container
+    this.nameNode.addEventListener("click", () => this.element.focus(), false);
+    this.element.appendChild(this.nameNode);
 
+    // Build the style value element
     this.valueNode = doc.createElementNS(HTML_NS, "div");
-    this.element.appendChild(this.valueNode);
     this.valueNode.setAttribute("class", "property-value theme-fg-color1");
+    // Reset its tabindex attribute otherwise, if an ellipsis is applied
+    // it will be reachable via TABing
+    this.valueNode.setAttribute("tabindex", "");
     this.valueNode.setAttribute("dir", "ltr");
     this.valueNode.textContent = this.valueNode.title = this.value;
+    // Make it hand over the focus to the container
+    this.valueNode.addEventListener("click", () => this.element.focus(), false);
+    this.element.appendChild(this.valueNode);
 
     return this.element;
   },
@@ -836,7 +850,7 @@ PropertyView.prototype = {
    * @param {Event} aEvent Used to determine the class name of the targets click
    * event.
    */
-  matchedExpanderClick: function PropertyView_matchedExpanderClick(aEvent)
+  onStyleToggle: function PropertyView_onStyleToggle(aEvent)
   {
     this.matchedExpanded = !this.matchedExpanded;
     this.refreshMatchedSelectors();
diff --git a/browser/devtools/styleinspector/test/Makefile.in b/browser/devtools/styleinspector/test/Makefile.in
index 91346894eab..e10917f8af0 100644
--- a/browser/devtools/styleinspector/test/Makefile.in
+++ b/browser/devtools/styleinspector/test/Makefile.in
@@ -36,6 +36,7 @@ MOCHITEST_BROWSER_FILES = \
   browser_bug894376_css_value_completion_existing_property_value_pair.js \
   browser_ruleview_bug_902966_revert_value_on_ESC.js \
   browser_ruleview_pseudoelement.js \
+  browser_computedview_bug835808_keyboard_nav.js \
   head.js \
   $(NULL)
 
diff --git a/browser/devtools/styleinspector/test/browser_computedview_bug835808_keyboard_nav.js b/browser/devtools/styleinspector/test/browser_computedview_bug835808_keyboard_nav.js
new file mode 100644
index 00000000000..2a13bb2aad5
--- /dev/null
+++ b/browser/devtools/styleinspector/test/browser_computedview_bug835808_keyboard_nav.js
@@ -0,0 +1,94 @@
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Tests that the style inspector works properly
+
+let doc, computedView, inspector;
+
+function test()
+{
+  waitForExplicitFinish();
+
+  gBrowser.selectedTab = gBrowser.addTab();
+  gBrowser.selectedBrowser.addEventListener("load", function onBrowserLoad(evt) {
+    gBrowser.selectedBrowser.removeEventListener("load", onBrowserLoad, true);
+    doc = content.document;
+    waitForFocus(createDocument, content);
+  }, true);
+
+  content.location = "data:text/html,computed view context menu test";
+}
+
+function createDocument()
+{
+  doc.body.innerHTML = '<style type="text/css"> ' +
+    'span { font-variant: small-caps; color: #000000; } ' +
+    '.nomatches {color: #ff0000;}</style> <div id="first" style="margin: 10em; ' +
+    'font-size: 14pt; font-family: helvetica, sans-serif; color: #AAA">\n' +
+    '<h1>Some header text</h1>\n' +
+    '<p id="salutation" style="font-size: 12pt">hi.</p>\n' +
+    '<p id="body" style="font-size: 12pt">I am a test-case. This text exists ' +
+    'solely to provide some things to <span style="color: yellow">' +
+    'highlight</span> and <span style="font-weight: bold">count</span> ' +
+    'style list-items in the box at right. If you are reading this, ' +
+    'you should go do something else instead. Maybe read a book. Or better ' +
+    'yet, write some test-cases for another bit of code. ' +
+    '<span style="font-style: italic">some text</span></p>\n' +
+    '<p id="closing">more text</p>\n' +
+    '<p>even more text</p>' +
+    '</div>';
+  doc.title = "Computed view keyboard navigation test";
+
+  openComputedView(startTests);
+}
+
+function startTests(aInspector, aComputedView)
+{
+  computedView = aComputedView;
+  inspector = aInspector;
+  testTabThrougStyles();
+}
+
+function endTests()
+{
+  computedView = inspector = doc = null;
+  gBrowser.removeCurrentTab();
+  finish();
+}
+
+function testTabThrougStyles()
+{
+  let span = doc.querySelector("span");
+
+  inspector.once("computed-view-refreshed", () => {
+    // Selecting the first computed style in the list
+    let firstStyle = computedView.styleDocument.querySelector(".property-view");
+    ok(firstStyle, "First computed style found in panel");
+    firstStyle.focus();
+
+    // Tab to select the 2nd style, press return
+    EventUtils.synthesizeKey("VK_TAB", {});
+    EventUtils.synthesizeKey("VK_RETURN", {});
+    inspector.once("computed-view-property-expanded", () => {
+      // Verify the 2nd style has been expanded
+      let secondStyleSelectors = computedView.styleDocument.querySelectorAll(
+        ".property-content .matchedselectors")[1];
+      ok(secondStyleSelectors.childNodes.length > 0, "Matched selectors expanded");
+
+      // Tab back up and test the same thing, with space
+      EventUtils.synthesizeKey("VK_TAB", {shiftKey: true});
+      EventUtils.synthesizeKey("VK_SPACE", {});
+      inspector.once("computed-view-property-expanded", () => {
+        // Verify the 1st style has been expanded too
+        let firstStyleSelectors = computedView.styleDocument.querySelectorAll(
+          ".property-content .matchedselectors")[0];
+        ok(firstStyleSelectors.childNodes.length > 0, "Matched selectors expanded");
+
+        endTests();
+      });
+    });
+  });
+
+  inspector.selection.setNode(span);
+}
diff --git a/browser/themes/linux/devtools/computedview.css b/browser/themes/linux/devtools/computedview.css
index d9a2a9948b0..37ee4b9de03 100644
--- a/browser/themes/linux/devtools/computedview.css
+++ b/browser/themes/linux/devtools/computedview.css
@@ -45,6 +45,7 @@ body {
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
+  outline: 0;
 }
 
 .property-value {
@@ -58,6 +59,7 @@ body {
   background-size: 5px 8px;
   background-position: 2px center;
   padding-left: 10px;
+  outline: 0;
 }
 
 .other-property-value {
diff --git a/browser/themes/osx/devtools/computedview.css b/browser/themes/osx/devtools/computedview.css
index 227fb632b43..ea131ed0b85 100644
--- a/browser/themes/osx/devtools/computedview.css
+++ b/browser/themes/osx/devtools/computedview.css
@@ -63,6 +63,7 @@ body {
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
+  outline: 0;
 }
 
 .property-value {
@@ -76,6 +77,7 @@ body {
   background-size: 5px 8px;
   background-position: 2px center;
   padding-left: 10px;
+  outline: 0;
 }
 
 .other-property-value {
diff --git a/browser/themes/windows/devtools/computedview.css b/browser/themes/windows/devtools/computedview.css
index 227fb632b43..ea131ed0b85 100644
--- a/browser/themes/windows/devtools/computedview.css
+++ b/browser/themes/windows/devtools/computedview.css
@@ -63,6 +63,7 @@ body {
   overflow-x: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
+  outline: 0;
 }
 
 .property-value {
@@ -76,6 +77,7 @@ body {
   background-size: 5px 8px;
   background-position: 2px center;
   padding-left: 10px;
+  outline: 0;
 }
 
 .other-property-value {
diff --git a/build/automation.py.in b/build/automation.py.in
index b6147464f59..8f3984dd0de 100644
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -683,16 +683,15 @@ class Automation(object):
   def killAndGetStackNoScreenshot(self, processPID, utilityPath, debuggerInfo):
     """Kill the process, preferrably in a way that gets us a stack trace."""
     if self.CRASHREPORTER and not debuggerInfo:
-      if self.UNIXISH:
+      if not self.IS_WIN32:
         # ABRT will get picked up by Breakpad's signal handler
         os.kill(processPID, signal.SIGABRT)
         return
-      elif self.IS_WIN32:
+      else:
         # We should have a "crashinject" program in our utility path
         crashinject = os.path.normpath(os.path.join(utilityPath, "crashinject.exe"))
         if os.path.exists(crashinject) and subprocess.Popen([crashinject, str(processPID)]).wait() == 0:
           return
-      #TODO: kill the process such that it triggers Breakpad on OS X (bug 525296)
     self.log.info("Can't trigger Breakpad, just killing process")
     self.killPid(processPID)
 
diff --git a/content/html/content/src/HTMLInputElement.cpp b/content/html/content/src/HTMLInputElement.cpp
index 731dceda681..dc5e9368cf5 100644
--- a/content/html/content/src/HTMLInputElement.cpp
+++ b/content/html/content/src/HTMLInputElement.cpp
@@ -7,7 +7,6 @@
 
 #include "mozilla/DebugOnly.h"
 #include "mozilla/dom/Date.h"
-#include "mozilla/dom/HTMLInputElementBinding.h"
 #include "nsAsyncDOMEvent.h"
 #include "nsAttrValueInlines.h"
 
@@ -4504,6 +4503,11 @@ HTMLInputElement::SetSelectionRange(int32_t aSelectionStart,
       if (!aRv.Failed()) {
         aRv = textControlFrame->ScrollSelectionIntoView();
       }
+
+      nsContentUtils::DispatchTrustedEvent(OwnerDoc(),
+                                           static_cast<nsIDOMHTMLInputElement*>(this),
+                                           NS_LITERAL_STRING("select"), true,
+                                           false);
     }
   }
 }
@@ -4521,6 +4525,113 @@ HTMLInputElement::SetSelectionRange(int32_t aSelectionStart,
   return rv.ErrorCode();
 }
 
+void
+HTMLInputElement::SetRangeText(const nsAString& aReplacement, ErrorResult& aRv)
+{
+  if (!SupportsSetRangeText()) {
+    aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+    return;
+  }
+
+  int32_t start, end;
+  aRv = GetSelectionRange(&start, &end);
+  if (aRv.Failed()) {
+    nsTextEditorState* state = GetEditorState();
+    if (state && state->IsSelectionCached()) {
+      start = state->GetSelectionProperties().mStart;
+      end = state->GetSelectionProperties().mEnd;
+      aRv = NS_OK;
+    }
+  }
+
+  SetRangeText(aReplacement, start, end, mozilla::dom::SelectionMode::Preserve,
+               aRv, start, end);
+}
+
+void
+HTMLInputElement::SetRangeText(const nsAString& aReplacement, uint32_t aStart,
+                               uint32_t aEnd, const SelectionMode& aSelectMode,
+                               ErrorResult& aRv, int32_t aSelectionStart,
+                               int32_t aSelectionEnd)
+{
+  if (!SupportsSetRangeText()) {
+    aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+    return;
+  }
+
+  if (aStart > aEnd) {
+    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return;
+  }
+
+  nsAutoString value;
+  GetValueInternal(value);
+  uint32_t inputValueLength = value.Length();
+
+  if (aStart > inputValueLength) {
+    aStart = inputValueLength;
+  }
+
+  if (aEnd > inputValueLength) {
+    aEnd = inputValueLength;
+  }
+
+  if (aSelectionStart == -1 && aSelectionEnd == -1) {
+      aRv = GetSelectionRange(&aSelectionStart, &aSelectionEnd);
+      if (aRv.Failed()) {
+        nsTextEditorState* state = GetEditorState();
+        if (state && state->IsSelectionCached()) {
+          aSelectionStart = state->GetSelectionProperties().mStart;
+          aSelectionEnd = state->GetSelectionProperties().mEnd;
+          aRv = NS_OK;
+        }
+      }
+  }
+
+  if (aStart < aEnd) {
+    value.Replace(aStart, aEnd - aStart, aReplacement);
+    SetValueInternal(value, false, false);
+  }
+
+  uint32_t newEnd = aStart + aReplacement.Length();
+  int32_t delta =  aReplacement.Length() - (aEnd - aStart);
+
+  switch (aSelectMode) {
+    case mozilla::dom::SelectionMode::Select:
+    {
+      aSelectionStart = aStart;
+      aSelectionEnd = newEnd;
+    }
+    break;
+    case mozilla::dom::SelectionMode::Start:
+    {
+      aSelectionStart = aSelectionEnd = aStart;
+    }
+    break;
+    case mozilla::dom::SelectionMode::End:
+    {
+      aSelectionStart = aSelectionEnd = newEnd;
+    }
+    break;
+    case mozilla::dom::SelectionMode::Preserve:
+    {
+      if ((uint32_t)aSelectionStart > aEnd)
+        aSelectionStart += delta;
+      else if ((uint32_t)aSelectionStart > aStart)
+       aSelectionStart = aStart;
+
+      if ((uint32_t)aSelectionEnd > aEnd)
+        aSelectionEnd += delta;
+      else if ((uint32_t)aSelectionEnd > aStart)
+        aSelectionEnd = newEnd;
+    }
+    break;
+  }
+
+  Optional<nsAString> direction;
+  SetSelectionRange(aSelectionStart, aSelectionEnd, direction, aRv);
+}
+
 int32_t
 HTMLInputElement::GetSelectionStart(ErrorResult& aRv)
 {
diff --git a/content/html/content/src/HTMLInputElement.h b/content/html/content/src/HTMLInputElement.h
index c289c146d6d..27446398393 100644
--- a/content/html/content/src/HTMLInputElement.h
+++ b/content/html/content/src/HTMLInputElement.h
@@ -17,6 +17,7 @@
 #include "nsCOMPtr.h"
 #include "nsIConstraintValidation.h"
 #include "mozilla/dom/HTMLFormElement.h" // for HasEverTriedInvalidSubmit()
+#include "mozilla/dom/HTMLInputElementBinding.h"
 #include "nsIFilePicker.h"
 #include "nsIContentPrefService2.h"
 #include "mozilla/Decimal.h"
@@ -641,6 +642,13 @@ public:
                          const Optional< nsAString >& direction,
                          ErrorResult& aRv);
 
+  void SetRangeText(const nsAString& aReplacement, ErrorResult& aRv);
+
+  void SetRangeText(const nsAString& aReplacement, uint32_t aStart,
+                    uint32_t aEnd, const SelectionMode& aSelectMode,
+                    ErrorResult& aRv, int32_t aSelectionStart = -1,
+                    int32_t aSelectionEnd = -1);
+
   // XPCOM GetAlign() is OK
   void SetAlign(const nsAString& aValue, ErrorResult& aRv)
   {
@@ -1239,6 +1247,15 @@ private:
     return MayFireChangeOnBlur(mType);
   }
 
+  /**
+   * Returns true if setRangeText can be called on element
+   */
+  bool SupportsSetRangeText() const {
+    return mType == NS_FORM_INPUT_TEXT || mType == NS_FORM_INPUT_SEARCH ||
+           mType == NS_FORM_INPUT_URL || mType == NS_FORM_INPUT_TEL ||
+           mType == NS_FORM_INPUT_PASSWORD;
+  }
+
   static bool MayFireChangeOnBlur(uint8_t aType) {
     return IsSingleLineTextControl(false, aType) ||
            aType == NS_FORM_INPUT_RANGE;
diff --git a/content/html/content/test/forms/Makefile.in b/content/html/content/test/forms/Makefile.in
index 6119d2385e0..06359c028e1 100644
--- a/content/html/content/test/forms/Makefile.in
+++ b/content/html/content/test/forms/Makefile.in
@@ -5,6 +5,7 @@
 MOCHITEST_FILES = \
 		save_restore_radio_groups.sjs \
 		test_save_restore_radio_groups.html \
+		test_set_range_text.html \
 		test_change_event.html \
 		test_mozistextfield.html \
 		test_input_attributes_reflection.html \
diff --git a/content/html/content/test/forms/test_set_range_text.html b/content/html/content/test/forms/test_set_range_text.html
new file mode 100644
index 00000000000..8ba01587f51
--- /dev/null
+++ b/content/html/content/test/forms/test_set_range_text.html
@@ -0,0 +1,183 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=850364
+-->
+<head>
+<title>Test for Bug 850364</title>
+<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+<script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=850364">Mozilla Bug 850364</a>
+<p id="display"></p>
+<div id="content">
+
+<!-- "SetRangeText() supported types"-->
+<input type="text" id="input_text"></input>
+<input type="search" id="input_search"></input>
+<input type="url" id="input_url"></input>
+<input type="tel" id="input_tel"></input>
+<input type="password" id="input_password"></input>
+
+<!-- "SetRangeText() non-supported types" -->
+<input type="button" id="input_button"></input>
+<input type="submit" id="input_submit"></input>
+<input type="image" id="input_image"></input>
+<input type="reset" id="input_reset"></input>
+<input type="radio" id="input_radio"></input>
+<input type="checkbox" id="input_checkbox"></input>
+<input type="range" id="input_range"></input>
+<input type="file" id="input_file"></input>
+<input type="email" id="input_email"></input>
+ 
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+  /** Test for Bug 850364 **/
+
+  var SupportedTypes = ["text", "search", "url", "tel", "password"];
+  var NonSupportedTypes = ["button", "submit", "image", "reset", "radio",
+                           "checkbox", "range", "file", "email"];
+
+  SimpleTest.waitForExplicitFinish();
+
+  function TestInputs() {
+
+    var opThrows, elem, i, msg;
+
+    //Non-supported types should throw
+    for (i = 0; i < NonSupportedTypes.length; ++i) {
+      opThrows = false;
+      msg = "input_" + NonSupportedTypes[i];
+      elem = document.getElementById(msg);
+      elem.focus();
+      try {
+        elem.setRangeText("abc");
+      } catch (ex) {
+       opThrows = true;
+      }
+      ok(opThrows, msg + " should throw NotSupportedError");
+    }
+
+    //Supported types should not throw
+    for (i = 0; i < SupportedTypes.length; ++i) {
+      opThrows = false;
+      msg = "input_" + SupportedTypes[i];
+      elem = document.getElementById(msg);
+      elem.focus();
+      try {
+        elem.setRangeText("abc");
+      } catch (ex) {
+          opThrows = true;
+      }
+      is(opThrows, false, msg + " should not throw NotSupportedError");
+
+      elem.addEventListener("select", function (aEvent) {
+        ok(true, "select event should be fired for "+ msg);
+      }, false);
+
+      elem.addEventListener("input", function (aEvent) {
+        ok(false, "input event should NOT be fired for " + msg);
+      }, false);
+
+      //test setRange(replacement)
+      elem.value = "0123456789ABCDEF";
+      elem.setSelectionRange(1, 6);
+      elem.setRangeText("xyz");
+      is(elem.value, "0xyz6789ABCDEF", msg + ".value == \"0xyz6789ABCDEF\"");
+      is(elem.selectionStart, 1, msg + ".selectionStart == 1");
+      is(elem.selectionEnd, 4, msg + ".selectionEnd == 4");
+      elem.setRangeText("mnk");
+      is(elem.value, "0mnk6789ABCDEF", msg + ".value == \"0mnk6789ABCDEF\"");
+
+      //test SetRange(replacement, start, end, mode) with start > end
+      try {
+        elem.setRangeText("abc", 20, 4);
+      } catch (ex) {
+        opThrows = (ex.name == "IndexSizeError" && ex.code == DOMException.INDEX_SIZE_ERR);
+      }
+      is(opThrows, true, msg + " should throw IndexSizeError");
+
+      //test SelectionMode 'select'
+      elem.value = "0123456789ABCDEF";
+      elem.setRangeText("xyz", 4, 9, "select");
+      is(elem.value, "0123xyz9ABCDEF", msg + ".value == \"0123xyz9ABCDEF\"");
+      is(elem.selectionStart, 4, msg + ".selectionStart == 4, with \"select\"");
+      is(elem.selectionEnd, 7, msg + ".selectionEnd == 7, with \"select\"");
+
+      elem.setRangeText("pqm", 6, 25, "select");
+      is(elem.value, "0123xypqm", msg + ".value == \"0123xypqm\"");
+      is(elem.selectionStart, 6, msg + ".selectionStart == 6, with \"select\"");
+      is(elem.selectionEnd, 9, msg + ".selectionEnd == 9, with \"select\"");
+
+      //test SelectionMode 'start'
+      elem.value = "0123456789ABCDEF";
+      elem.setRangeText("xyz", 4, 9, "start");
+      is(elem.value, "0123xyz9ABCDEF", msg + ".value == \"0123xyz9ABCDEF\"");
+      is(elem.selectionStart, 4, msg + ".selectionStart == 4, with \"start\"");
+      is(elem.selectionEnd, 4, msg + ".selectionEnd == 4, with \"start\"");
+
+      elem.setRangeText("pqm", 6, 25, "start");
+      is(elem.value, "0123xypqm", msg + ".value == \"0123xypqm\"");
+      is(elem.selectionStart, 6, msg + ".selectionStart == 6, with \"start\"");
+      is(elem.selectionEnd, 6, msg + ".selectionEnd == 6, with \"start\"");
+
+      //test SelectionMode 'end'
+      elem.value = "0123456789ABCDEF";
+      elem.setRangeText("xyz", 4, 9, "end");
+      is(elem.value, "0123xyz9ABCDEF", msg + ".value == \"0123xyz9ABCDEF\"");
+      is(elem.selectionStart, 7, msg + ".selectionStart == 7, with \"end\"");
+      is(elem.selectionEnd, 7, msg + ".selectionEnd == 7, with \"end\"");
+
+      elem.setRangeText("pqm", 6, 25, "end");
+      is(elem.value, "0123xypqm", msg + ".value == \"0123xypqm\"");
+      is(elem.selectionStart, 9, msg + ".selectionStart == 9, with \"end\"");
+      is(elem.selectionEnd, 9, msg + ".selectionEnd == 9, with \"end\"");
+
+      //test SelectionMode 'preserve' (default)
+
+      //subcase: selection{Start|End} > end
+      elem.value = "0123456789";
+      elem.setSelectionRange(6, 9);
+      elem.setRangeText("Z", 1, 2, "preserve");
+      is(elem.value, "0Z23456789", msg + ".value == \"0Z23456789\"");
+      is(elem.selectionStart, 6, msg + ".selectionStart == 6, with \"preserve\"");
+      is(elem.selectionEnd, 9, msg + ".selectionEnd == 9, with \"preserve\"");
+
+      //subcase: selection{Start|End} < end
+      elem.value = "0123456789";
+      elem.setSelectionRange(4, 5);
+      elem.setRangeText("QRST", 2, 9, "preserve");
+      is(elem.value, "01QRST9", msg + ".value == \"01QRST9\"");
+      is(elem.selectionStart, 2, msg + ".selectionStart == 2, with \"preserve\"");
+      is(elem.selectionEnd, 6, msg + ".selectionEnd == 6, with \"preserve\"");
+
+      //subcase: selectionStart > end, selectionEnd < end
+      elem.value = "0123456789";
+      elem.setSelectionRange(8, 4);
+      elem.setRangeText("QRST", 1, 5);
+      is(elem.value, "0QRST56789", msg + ".value == \"0QRST56789\"");
+      is(elem.selectionStart, 1, msg + ".selectionStart == 1, with \"default\"");
+      is(elem.selectionEnd, 5, msg + ".selectionEnd == 5, with \"default\"");
+
+      //subcase: selectionStart < end, selectionEnd > end
+      elem.value = "0123456789";
+      elem.setSelectionRange(4, 9);
+      elem.setRangeText("QRST", 2, 6);
+      is(elem.value, "01QRST6789", msg + ".value == \"01QRST6789\"");
+      is(elem.selectionStart, 2, msg + ".selectionStart == 2, with \"default\"");
+      is(elem.selectionEnd, 9, msg + ".selectionEnd == 9, with \"default\"");
+    }
+
+    SimpleTest.finish();
+  }
+
+  addLoadEvent(TestInputs);
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/html/document/src/Makefile.in b/content/html/document/src/Makefile.in
deleted file mode 100644
index c9b334ae06c..00000000000
--- a/content/html/document/src/Makefile.in
+++ /dev/null
@@ -1,16 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES += \
-		-I$(srcdir)/../../../base/src \
-		-I$(srcdir)/../../../events/src \
-		-I$(srcdir)/../../content/src \
-		-I$(topsrcdir)/layout/style \
-		-I$(topsrcdir)/dom/base \
-		-I$(topsrcdir)/caps/include \
-		-I$(topsrcdir)/xpcom/ds \
-		$(NULL)
diff --git a/content/html/document/src/moz.build b/content/html/document/src/moz.build
index 7aa28a3c192..5515a31fd5f 100644
--- a/content/html/document/src/moz.build
+++ b/content/html/document/src/moz.build
@@ -33,3 +33,12 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '../../content/src',
+    '/caps/include',
+    '/content/base/src',
+    '/content/events/src',
+    '/dom/base',
+    '/layout/style',
+    '/xpcom/ds',
+]
diff --git a/content/media/AudioNodeEngine.cpp b/content/media/AudioNodeEngine.cpp
index e87e1abf921..b0a0fa78699 100644
--- a/content/media/AudioNodeEngine.cpp
+++ b/content/media/AudioNodeEngine.cpp
@@ -125,6 +125,19 @@ BufferComplexMultiply(const float* aInput,
   }
 }
 
+float
+AudioBufferPeakValue(const float *aInput, uint32_t aSize)
+{
+  float max = 0.0f;
+  for (uint32_t i = 0; i < aSize; i++) {
+    float mag = fabs(aInput[i]);
+    if (mag > max) {
+      max = mag;
+    }
+  }
+  return max;
+}
+
 void
 AudioBlockCopyChannelWithScale(const float aInput[WEBAUDIO_BLOCK_SIZE],
                                const float aScale[WEBAUDIO_BLOCK_SIZE],
diff --git a/content/media/AudioNodeEngine.h b/content/media/AudioNodeEngine.h
index ca0614882ee..ad51fc87d47 100644
--- a/content/media/AudioNodeEngine.h
+++ b/content/media/AudioNodeEngine.h
@@ -134,6 +134,11 @@ void BufferComplexMultiply(const float* aInput,
                            float* aOutput,
                            uint32_t aSize);
 
+/**
+ * Vector maximum element magnitude ( max(abs(aInput)) ).
+ */
+float AudioBufferPeakValue(const float* aInput, uint32_t aSize);
+
 /**
  * In place gain. aScale == 1.0f should be optimized.
  */
diff --git a/content/media/mediasource/Makefile.in b/content/media/mediasource/Makefile.in
deleted file mode 100644
index 6fbe8159b2d..00000000000
--- a/content/media/mediasource/Makefile.in
+++ /dev/null
@@ -1,3 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
diff --git a/content/media/plugins/Makefile.in b/content/media/plugins/Makefile.in
deleted file mode 100644
index 9e99f02e7a4..00000000000
--- a/content/media/plugins/Makefile.in
+++ /dev/null
@@ -1,10 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES	+= \
-		-I$(srcdir)/../../base/src \
-		-I$(srcdir)/../../html/content/src \
-		$(NULL)
diff --git a/content/media/plugins/moz.build b/content/media/plugins/moz.build
index 729551df317..9ce356cff8a 100644
--- a/content/media/plugins/moz.build
+++ b/content/media/plugins/moz.build
@@ -25,3 +25,7 @@ LIBRARY_NAME = 'gkconmediaplugins_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '/content/base/src',
+    '/content/html/content/src',
+    ]
diff --git a/content/media/raw/Makefile.in b/content/media/raw/Makefile.in
deleted file mode 100644
index 3a768f87d4c..00000000000
--- a/content/media/raw/Makefile.in
+++ /dev/null
@@ -1,11 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES	+= \
-		-I$(srcdir)/../../base/src \
-		-I$(srcdir)/../../html/content/src \
-		$(NULL)
diff --git a/content/media/raw/moz.build b/content/media/raw/moz.build
index 7c8e2b0d528..a98ad0a7c36 100644
--- a/content/media/raw/moz.build
+++ b/content/media/raw/moz.build
@@ -23,3 +23,7 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '/content/base/src',
+    '/content/html/content/src',
+]
diff --git a/content/media/webaudio/AudioContext.cpp b/content/media/webaudio/AudioContext.cpp
index 0056bfa7312..e308ba495b2 100644
--- a/content/media/webaudio/AudioContext.cpp
+++ b/content/media/webaudio/AudioContext.cpp
@@ -396,8 +396,11 @@ AudioContext::CreatePeriodicWave(const Float32Array& aRealData,
   }
 
   nsRefPtr<PeriodicWave> periodicWave =
-    new PeriodicWave(this, aRealData.Data(), aRealData.Length(),
-                     aImagData.Data(), aImagData.Length());
+    new PeriodicWave(this, aRealData.Data(), aImagData.Data(),
+                     aImagData.Length(), aRv);
+  if (aRv.Failed()) {
+    return nullptr;
+  }
   return periodicWave.forget();
 }
 
diff --git a/content/media/webaudio/FFTBlock.h b/content/media/webaudio/FFTBlock.h
index b3b1993cc05..baa5440aaa9 100644
--- a/content/media/webaudio/FFTBlock.h
+++ b/content/media/webaudio/FFTBlock.h
@@ -39,11 +39,14 @@ public:
   CreateInterpolatedBlock(const FFTBlock& block0,
                           const FFTBlock& block1, double interp);
 
+  // Transform FFTSize() points of aData and store the result internally.
   void PerformFFT(const float* aData)
   {
     EnsureFFT();
     kiss_fftr(mFFT, aData, mOutputBuffer.Elements());
   }
+  // Inverse-transform internal data and store the resulting FFTSize()
+  // points in aData.
   void PerformInverseFFT(float* aData)
   {
     EnsureIFFT();
@@ -52,6 +55,27 @@ public:
       aData[i] /= mFFTSize;
     }
   }
+  // Inverse-transform the FFTSize()/2+1 points of data in each
+  // of aRealDataIn and aImagDataIn and store the resulting
+  // FFTSize() points in aRealDataOut.
+  void PerformInverseFFT(float* aRealDataIn,
+                         float *aImagDataIn,
+                         float *aRealDataOut)
+  {
+    EnsureIFFT();
+    const uint32_t inputSize = mFFTSize / 2 + 1;
+    nsTArray<kiss_fft_cpx> inputBuffer;
+    inputBuffer.SetLength(inputSize);
+    for (uint32_t i = 0; i < inputSize; ++i) {
+      inputBuffer[i].r = aRealDataIn[i];
+      inputBuffer[i].i = aImagDataIn[i];
+    }
+    kiss_fftri(mIFFT, inputBuffer.Elements(), aRealDataOut);
+    for (uint32_t i = 0; i < mFFTSize; ++i) {
+      aRealDataOut[i] /= mFFTSize;
+    }
+  }
+
   void Multiply(const FFTBlock& aFrame)
   {
     BufferComplexMultiply(reinterpret_cast<const float*>(mOutputBuffer.Elements()),
diff --git a/content/media/webaudio/OscillatorNode.cpp b/content/media/webaudio/OscillatorNode.cpp
index efd80c4a863..1e68533f8d2 100644
--- a/content/media/webaudio/OscillatorNode.cpp
+++ b/content/media/webaudio/OscillatorNode.cpp
@@ -9,6 +9,7 @@
 #include "AudioNodeStream.h"
 #include "AudioDestinationNode.h"
 #include "WebAudioUtils.h"
+#include "blink/PeriodicWave.h"
 
 namespace mozilla {
 namespace dom {
@@ -36,6 +37,39 @@ NS_INTERFACE_MAP_END_INHERITING(AudioNode)
 NS_IMPL_ADDREF_INHERITED(OscillatorNode, AudioNode)
 NS_IMPL_RELEASE_INHERITED(OscillatorNode, AudioNode)
 
+static const float sLeak = 0.995f;
+
+class DCBlocker
+{
+public:
+  // These are sane defauts when the initial mPhase is zero
+  DCBlocker(float aLastInput = 0.0f,
+            float aLastOutput = 0.0f,
+            float aPole = 0.995)
+    :mLastInput(aLastInput),
+     mLastOutput(aLastOutput),
+     mPole(aPole)
+  {
+    MOZ_ASSERT(aPole > 0);
+  }
+
+  inline float Process(float aInput)
+  {
+    float out;
+
+    out = mLastOutput * mPole + aInput - mLastInput;
+    mLastOutput = out;
+    mLastInput = aInput;
+
+    return out;
+  }
+private:
+  float mLastInput;
+  float mLastOutput;
+  float mPole;
+};
+
+
 class OscillatorNodeEngine : public AudioNodeEngine
 {
 public:
@@ -50,6 +84,17 @@ public:
     , mDetune(0.f)
     , mType(OscillatorType::Sine)
     , mPhase(0.)
+    , mFinalFrequency(0.0)
+    , mNumberOfHarmonics(0)
+    , mSignalPeriod(0.0)
+    , mAmplitudeAtZero(0.0)
+    , mPhaseIncrement(0.0)
+    , mSquare(0.0)
+    , mTriangle(0.0)
+    , mSaw(0.0)
+    , mPhaseWrap(0.0)
+    , mRecomputeFrequency(true)
+    , mCustomLength(0)
   {
   }
 
@@ -70,6 +115,7 @@ public:
                             const AudioParamTimeline& aValue,
                             TrackRate aSampleRate) MOZ_OVERRIDE
   {
+    mRecomputeFrequency = true;
     switch (aIndex) {
     case FREQUENCY:
       MOZ_ASSERT(mSource && mDestination);
@@ -85,6 +131,7 @@ public:
       NS_ERROR("Bad OscillatorNodeEngine TimelineParameter");
     }
   }
+
   virtual void SetStreamTimeParameter(uint32_t aIndex, TrackTicks aParam)
   {
     switch (aIndex) {
@@ -94,29 +141,127 @@ public:
       NS_ERROR("Bad OscillatorNodeEngine StreamTimeParameter");
     }
   }
+
   virtual void SetInt32Parameter(uint32_t aIndex, int32_t aParam)
   {
     switch (aIndex) {
-    case TYPE: mType = static_cast<OscillatorType>(aParam); break;
-    default:
-      NS_ERROR("Bad OscillatorNodeEngine Int32Parameter");
+      case TYPE:
+        // Set the new type.
+        mType = static_cast<OscillatorType>(aParam);
+        if (mType != OscillatorType::Custom) {
+          // Forget any previous custom data.
+          mCustomLength = 0;
+          mCustom = nullptr;
+          mPeriodicWave = nullptr;
+        }
+        // Update BLIT integrators with the new initial conditions.
+        switch (mType) {
+          case OscillatorType::Sine:
+            mPhase = 0.0;
+            break;
+          case OscillatorType::Square:
+            mPhase = 0.0;
+            // Initial integration condition is -0.5, because our
+            // square has 50% duty cycle.
+            mSquare = -0.5;
+            break;
+          case OscillatorType::Triangle:
+            // Initial mPhase and related integration condition so the
+            // triangle is in the middle of the first upward slope.
+            // XXX actually do the maths and put the right number here.
+            mPhase = (float)(M_PI / 2);
+            mSquare = 0.5;
+            mTriangle = 0.0;
+            break;
+          case OscillatorType::Sawtooth:
+            // Initial mPhase so the oscillator starts at the
+            // middle of the ramp, per spec.
+            mPhase = (float)(M_PI / 2);
+            // mSaw = 0 when mPhase = pi/2.
+            mSaw = 0.0;
+            break;
+          case OscillatorType::Custom:
+            // Custom waveforms don't use BLIT.
+            break;
+          default:
+            NS_ERROR("Bad OscillatorNodeEngine type parameter.");
+        }
+        // End type switch.
+        break;
+      case PERIODICWAVE:
+        MOZ_ASSERT(aParam >= 0, "negative custom array length");
+        mCustomLength = static_cast<uint32_t>(aParam);
+        break;
+      default:
+        NS_ERROR("Bad OscillatorNodeEngine Int32Parameter.");
+    }
+    // End index switch.
+  }
+
+  virtual void SetBuffer(already_AddRefed<ThreadSharedFloatArrayBufferList> aBuffer)
+  {
+    MOZ_ASSERT(mCustomLength, "Custom buffer sent before length");
+    mCustom = aBuffer;
+    MOZ_ASSERT(mCustom->GetChannels() == 2,
+               "PeriodicWave should have sent two channels");
+    mPeriodicWave = WebCore::PeriodicWave::create(mSource->SampleRate(),
+    mCustom->GetData(0), mCustom->GetData(1), mCustomLength);
+  }
+
+  void IncrementPhase()
+  {
+    mPhase += mPhaseIncrement;
+    if (mPhase > mPhaseWrap) {
+      mPhase -= mPhaseWrap;
     }
   }
 
-  double ComputeFrequency(TrackTicks ticks, size_t count)
+  // Square and triangle are using a bipolar band-limited impulse train, saw is
+  // using a normal band-limited impulse train.
+  bool UsesBipolarBLIT() {
+    return mType == OscillatorType::Square || mType == OscillatorType::Triangle;
+  }
+
+  void UpdateFrequencyIfNeeded(TrackTicks ticks, size_t count)
   {
     double frequency, detune;
-    if (mFrequency.HasSimpleValue()) {
+
+    bool simpleFrequency = mFrequency.HasSimpleValue();
+    bool simpleDetune = mDetune.HasSimpleValue();
+
+    // Shortcut if frequency-related AudioParam are not automated, and we
+    // already have computed the frequency information and related parameters.
+    if (simpleFrequency && simpleDetune && !mRecomputeFrequency) {
+      return;
+    }
+
+    if (simpleFrequency) {
       frequency = mFrequency.GetValue();
     } else {
       frequency = mFrequency.GetValueAtTime(ticks, count);
     }
-    if (mDetune.HasSimpleValue()) {
+    if (simpleDetune) {
       detune = mDetune.GetValue();
     } else {
       detune = mDetune.GetValueAtTime(ticks, count);
     }
-    return frequency * pow(2., detune / 1200.);
+
+    mFinalFrequency = frequency * pow(2., detune / 1200.);
+    mRecomputeFrequency = false;
+
+    // When using bipolar BLIT, we divide the signal period by two, because we
+    // are using two BLIT out of phase.
+    mSignalPeriod = UsesBipolarBLIT() ? 0.5 * mSource->SampleRate() / mFinalFrequency
+                                      : mSource->SampleRate() / mFinalFrequency;
+    // Wrap the phase accordingly:
+    mPhaseWrap = UsesBipolarBLIT() || mType == OscillatorType::Sine ? 2 * M_PI
+                                   : M_PI;
+    // Even number of harmonics for bipolar blit, odd otherwise.
+    mNumberOfHarmonics = UsesBipolarBLIT() ? 2 * floor(0.5 * mSignalPeriod)
+                                           : 2 * floor(0.5 * mSignalPeriod) + 1;
+    mPhaseIncrement = mType == OscillatorType::Sine ? 2 * M_PI / mSignalPeriod
+                                                    : M_PI / mSignalPeriod;
+    mAmplitudeAtZero = mNumberOfHarmonics / mSignalPeriod;
   }
 
   void FillBounds(float* output, TrackTicks ticks,
@@ -141,95 +286,138 @@ public:
     }
   }
 
-  void ComputeSine(AudioChunk *aOutput)
+  float BipolarBLIT()
   {
-    AllocateAudioBlock(1, aOutput);
-    float* output = static_cast<float*>(const_cast<void*>(aOutput->mChannelData[0]));
+    float blit;
+    float denom = sin(mPhase);
 
-    TrackTicks ticks = mSource->GetCurrentPosition();
-    uint32_t start, end;
-    FillBounds(output, ticks, start, end);
-
-    double rate = 2.*M_PI / mSource->SampleRate();
-    double phase = mPhase;
-    for (uint32_t i = start; i < end; ++i) {
-      phase += ComputeFrequency(ticks, i) * rate;
-      output[i] = sin(phase);
-    }
-    mPhase = phase;
-    while (mPhase > 2.0*M_PI) {
-      // Rescale to avoid precision reductions on long runs.
-      mPhase -= 2.0*M_PI;
-    }
-  }
-
-  void ComputeSquare(AudioChunk *aOutput)
-  {
-    AllocateAudioBlock(1, aOutput);
-    float* output = static_cast<float*>(const_cast<void*>(aOutput->mChannelData[0]));
-
-    TrackTicks ticks = mSource->GetCurrentPosition();
-    uint32_t start, end;
-    FillBounds(output, ticks, start, end);
-
-    double rate = 1.0 / mSource->SampleRate();
-    double phase = mPhase;
-    for (uint32_t i = start; i < end; ++i) {
-      phase += ComputeFrequency(ticks, i) * rate;
-      if (phase > 1.0) {
-        phase -= 1.0;
-      }
-      output[i] = phase < 0.5 ? 1.0 : -1.0;
-    }
-    mPhase = phase;
-  }
-
-  void ComputeSawtooth(AudioChunk *aOutput)
-  {
-    AllocateAudioBlock(1, aOutput);
-    float* output = static_cast<float*>(const_cast<void*>(aOutput->mChannelData[0]));
-
-    TrackTicks ticks = mSource->GetCurrentPosition();
-    uint32_t start, end;
-    FillBounds(output, ticks, start, end);
-
-    double rate = 1.0 / mSource->SampleRate();
-    double phase = mPhase;
-    for (uint32_t i = start; i < end; ++i) {
-      phase += ComputeFrequency(ticks, i) * rate;
-      if (phase > 1.0) {
-        phase -= 1.0;
-      }
-      output[i] = phase < 0.5 ? 2.0*phase : 2.0*(phase - 1.0);
-    }
-    mPhase = phase;
-  }
-
-  void ComputeTriangle(AudioChunk *aOutput)
-  {
-    AllocateAudioBlock(1, aOutput);
-    float* output = static_cast<float*>(const_cast<void*>(aOutput->mChannelData[0]));
-
-    TrackTicks ticks = mSource->GetCurrentPosition();
-    uint32_t start, end;
-    FillBounds(output, ticks, start, end);
-
-    double rate = 1.0 / mSource->SampleRate();
-    double phase = mPhase;
-    for (uint32_t i = start; i < end; ++i) {
-      phase += ComputeFrequency(ticks, i) * rate;
-      if (phase > 1.0) {
-        phase -= 1.0;
-      }
-      if (phase < 0.25) {
-        output[i] = 4.0*phase;
-      } else if (phase < 0.75) {
-        output[i] = 1.0 - 4.0*(phase - 0.25);
+    if (fabs(denom) < std::numeric_limits<float>::epsilon()) {
+      if (mPhase < 0.1f || mPhase > 2 * M_PI - 0.1f) {
+        blit = mAmplitudeAtZero;
       } else {
-        output[i] = 4.0*(phase - 0.75) - 1.0;
+        blit = -mAmplitudeAtZero;
       }
+    } else {
+      blit = sin(mNumberOfHarmonics * mPhase);
+      blit /= mSignalPeriod * denom;
+    }
+    return blit;
+  }
+
+  float UnipolarBLIT()
+  {
+    float blit;
+    float denom = sin(mPhase);
+
+    if (fabs(denom) <= std::numeric_limits<float>::epsilon()) {
+      blit = mAmplitudeAtZero;
+    } else {
+      blit = sin(mNumberOfHarmonics * mPhase);
+      blit /= mSignalPeriod * denom;
+    }
+
+    return blit;
+  }
+
+  void ComputeSine(float * aOutput, TrackTicks ticks, uint32_t aStart, uint32_t aEnd)
+  {
+    for (uint32_t i = aStart; i < aEnd; ++i) {
+      UpdateFrequencyIfNeeded(ticks, i);
+
+      aOutput[i] = sin(mPhase);
+
+      IncrementPhase();
+    }
+  }
+
+  void ComputeSquare(float * aOutput, TrackTicks ticks, uint32_t aStart, uint32_t aEnd)
+  {
+    for (uint32_t i = aStart; i < aEnd; ++i) {
+      UpdateFrequencyIfNeeded(ticks, i);
+      // Integration to get us a square. It turns out we can have a
+      // pure integrator here.
+      mSquare += BipolarBLIT();
+      aOutput[i] = mSquare;
+      // maybe we want to apply a gain, the wg has not decided yet
+      aOutput[i] *= 1.5;
+      IncrementPhase();
+    }
+  }
+
+  void ComputeSawtooth(float * aOutput, TrackTicks ticks, uint32_t aStart, uint32_t aEnd)
+  {
+    float dcoffset;
+    for (uint32_t i = aStart; i < aEnd; ++i) {
+      UpdateFrequencyIfNeeded(ticks, i);
+      // DC offset so the Saw does not ramp up to infinity when integrating.
+      dcoffset = mFinalFrequency / mSource->SampleRate();
+      // Integrate and offset so we get mAmplitudeAtZero sawtooth. We have a
+      // very low frequency component somewhere here, but I'm not sure where.
+      mSaw += UnipolarBLIT() - dcoffset;
+      // reverse the saw so we are spec compliant
+      aOutput[i] = -mSaw * 1.5;
+
+      IncrementPhase();
+    }
+  }
+
+  void ComputeTriangle(float * aOutput, TrackTicks ticks, uint32_t aStart, uint32_t aEnd)
+  {
+    for (uint32_t i = aStart; i < aEnd; ++i) {
+      UpdateFrequencyIfNeeded(ticks, i);
+      // Integrate to get a square
+      mSquare += BipolarBLIT();
+      // Leaky integrate to get a triangle. We get too much dc offset if we don't
+      // leaky integrate here.
+      // C6 = k0 / period
+      // (period is samplingrate / frequency, k0 = (PI/2)/(2*PI)) = 0.25
+      float C6 = 0.25 / (mSource->SampleRate() / mFinalFrequency);
+      mTriangle = mTriangle * sLeak + mSquare + C6;
+      // DC Block, and scale back to [-1.0; 1.0]
+      aOutput[i] = mDCBlocker.Process(mTriangle) / (mSignalPeriod/2) * 1.5;
+
+      IncrementPhase();
+    }
+  }
+
+  void ComputeCustom(float* aOutput,
+                     TrackTicks ticks,
+                     uint32_t aStart,
+                     uint32_t aEnd)
+  {
+    MOZ_ASSERT(mPeriodicWave, "No custom waveform data");
+
+    uint32_t periodicWaveSize = mPeriodicWave->periodicWaveSize();
+    float* higherWaveData = nullptr;
+    float* lowerWaveData = nullptr;
+    float tableInterpolationFactor;
+    float rate = 1.0 / mSource->SampleRate();
+ 
+    for (uint32_t i = aStart; i < aEnd; ++i) {
+      UpdateFrequencyIfNeeded(ticks, i);
+      mPeriodicWave->waveDataForFundamentalFrequency(mFinalFrequency,
+                                                     lowerWaveData,
+                                                     higherWaveData,
+                                                     tableInterpolationFactor);
+      // mPhase runs 0..periodicWaveSize here instead of 0..2*M_PI.
+      mPhase += periodicWaveSize * mFinalFrequency * rate;
+      if (mPhase >= periodicWaveSize) {
+        mPhase -= periodicWaveSize;
+      }
+      // Bilinear interpolation between adjacent samples in each table.
+      uint32_t j1 = floor(mPhase);
+      uint32_t j2 = j1 + 1;
+      if (j2 >= periodicWaveSize) {
+        j2 -= periodicWaveSize;
+      }
+      float sampleInterpolationFactor = mPhase - j1;
+      float lower = sampleInterpolationFactor * lowerWaveData[j1] +
+                    (1 - sampleInterpolationFactor) * lowerWaveData[j2];
+      float higher = sampleInterpolationFactor * higherWaveData[j1] +
+                    (1 - sampleInterpolationFactor) * higherWaveData[j2];
+      aOutput[i] = tableInterpolationFactor * lower +
+                   (1 - tableInterpolationFactor) * higher;
     }
-    mPhase = phase;
   }
 
   void ComputeSilence(AudioChunk *aOutput)
@@ -261,25 +449,38 @@ public:
       *aFinished = true;
       return;
     }
+
+    AllocateAudioBlock(1, aOutput);
+    float* output = static_cast<float*>(
+        const_cast<void*>(aOutput->mChannelData[0]));
+
+    uint32_t start, end;
+    FillBounds(output, ticks, start, end);
+
     // Synthesize the correct waveform.
-    switch (mType) {
+    switch(mType) {
       case OscillatorType::Sine:
-        ComputeSine(aOutput);
+        ComputeSine(output, ticks, start, end);
         break;
       case OscillatorType::Square:
-        ComputeSquare(aOutput);
-        break;
-      case OscillatorType::Sawtooth:
-        ComputeSawtooth(aOutput);
+        ComputeSquare(output, ticks, start, end);
         break;
       case OscillatorType::Triangle:
-        ComputeTriangle(aOutput);
+        ComputeTriangle(output, ticks, start, end);
+        break;
+      case OscillatorType::Sawtooth:
+        ComputeSawtooth(output, ticks, start, end);
+        break;
+      case OscillatorType::Custom:
+        ComputeCustom(output, ticks, start, end);
         break;
       default:
         ComputeSilence(aOutput);
-    }
+    };
+
   }
 
+  DCBlocker mDCBlocker;
   AudioNodeStream* mSource;
   AudioNodeStream* mDestination;
   TrackTicks mStart;
@@ -287,7 +488,20 @@ public:
   AudioParamTimeline mFrequency;
   AudioParamTimeline mDetune;
   OscillatorType mType;
-  double mPhase;
+  float mPhase;
+  float mFinalFrequency;
+  uint32_t mNumberOfHarmonics;
+  float mSignalPeriod;
+  float mAmplitudeAtZero;
+  float mPhaseIncrement;
+  float mSquare;
+  float mTriangle;
+  float mSaw;
+  float mPhaseWrap;
+  bool mRecomputeFrequency;
+  nsRefPtr<ThreadSharedFloatArrayBufferList> mCustom;
+  uint32_t mCustomLength;
+  nsAutoPtr<WebCore::PeriodicWave> mPeriodicWave;
 };
 
 OscillatorNode::OscillatorNode(AudioContext* aContext)
@@ -338,10 +552,25 @@ OscillatorNode::SendDetuneToStream(AudioNode* aNode)
 void
 OscillatorNode::SendTypeToStream()
 {
-  SendInt32ParameterToStream(OscillatorNodeEngine::TYPE, static_cast<int32_t>(mType));
   if (mType == OscillatorType::Custom) {
-    // TODO: Send the custom wave table somehow
+    // The engine assumes we'll send the custom data before updating the type.
+    SendPeriodicWaveToStream();
   }
+  SendInt32ParameterToStream(OscillatorNodeEngine::TYPE, static_cast<int32_t>(mType));
+}
+
+void OscillatorNode::SendPeriodicWaveToStream()
+{
+  NS_ASSERTION(mType == OscillatorType::Custom,
+               "Sending custom waveform to engine thread with non-custom type");
+  AudioNodeStream* ns = static_cast<AudioNodeStream*>(mStream.get());
+  MOZ_ASSERT(ns, "Missing node stream.");
+  MOZ_ASSERT(mPeriodicWave, "Send called without PeriodicWave object.");
+  SendInt32ParameterToStream(OscillatorNodeEngine::PERIODICWAVE,
+                             mPeriodicWave->DataLength());
+  nsRefPtr<ThreadSharedFloatArrayBufferList> data =
+    mPeriodicWave->GetThreadSharedBuffer();
+  ns->SetBuffer(data.forget());
 }
 
 void
diff --git a/content/media/webaudio/OscillatorNode.h b/content/media/webaudio/OscillatorNode.h
index ca19c931fcb..8059b9c485a 100644
--- a/content/media/webaudio/OscillatorNode.h
+++ b/content/media/webaudio/OscillatorNode.h
@@ -77,9 +77,10 @@ public:
       // Shut up the compiler warning
       break;
     }
-
     if (aType == OscillatorType::Custom) {
-      aRv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+      // ::Custom can only be set by setPeriodicWave().
+      // https://github.com/WebAudio/web-audio-api/issues/105 for exception.
+      aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
       return;
     }
     mType = aType;
@@ -108,6 +109,7 @@ public:
   void SetPeriodicWave(PeriodicWave& aPeriodicWave)
   {
     mPeriodicWave = &aPeriodicWave;
+    // SendTypeToStream will call SendPeriodicWaveToStream for us.
     mType = OscillatorType::Custom;
     SendTypeToStream();
   }
@@ -120,6 +122,7 @@ private:
   static void SendFrequencyToStream(AudioNode* aNode);
   static void SendDetuneToStream(AudioNode* aNode);
   void SendTypeToStream();
+  void SendPeriodicWaveToStream();
 
 private:
   OscillatorType mType;
diff --git a/content/media/webaudio/PeriodicWave.cpp b/content/media/webaudio/PeriodicWave.cpp
index c156e5b8f2c..76c6202c451 100644
--- a/content/media/webaudio/PeriodicWave.cpp
+++ b/content/media/webaudio/PeriodicWave.cpp
@@ -18,13 +18,30 @@ NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(PeriodicWave, Release)
 
 PeriodicWave::PeriodicWave(AudioContext* aContext,
                            const float* aRealData,
-                           uint32_t aRealDataLength,
                            const float* aImagData,
-                           uint32_t aImagDataLength)
+                           const uint32_t aLength,
+                           ErrorResult& aRv)
   : mContext(aContext)
 {
   MOZ_ASSERT(aContext);
   SetIsDOMBinding();
+
+  // Caller should have checked this and thrown.
+  MOZ_ASSERT(aLength > 0);
+  MOZ_ASSERT(aLength <= 4096);
+  mLength = aLength;
+
+  // Copy coefficient data. The two arrays share an allocation.
+  mCoefficients = new ThreadSharedFloatArrayBufferList(2);
+  float* buffer = static_cast<float*>(malloc(aLength*sizeof(float)*2));
+  if (buffer == nullptr) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+  PodCopy(buffer, aRealData, aLength);
+  mCoefficients->SetData(0, buffer, buffer);
+  PodCopy(buffer+aLength, aImagData, aLength);
+  mCoefficients->SetData(1, nullptr, buffer+aLength);
 }
 
 JSObject*
@@ -33,6 +50,6 @@ PeriodicWave::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
   return PeriodicWaveBinding::Wrap(aCx, aScope, this);
 }
 
-}
-}
+} // namespace dom
+} // namespace mozilla
 
diff --git a/content/media/webaudio/PeriodicWave.h b/content/media/webaudio/PeriodicWave.h
index c980f3ac970..8acb517cf13 100644
--- a/content/media/webaudio/PeriodicWave.h
+++ b/content/media/webaudio/PeriodicWave.h
@@ -12,6 +12,7 @@
 #include "mozilla/Attributes.h"
 #include "EnableWebAudioCheck.h"
 #include "AudioContext.h"
+#include "AudioNodeEngine.h"
 #include "nsAutoPtr.h"
 
 namespace mozilla {
@@ -24,9 +25,9 @@ class PeriodicWave MOZ_FINAL : public nsWrapperCache,
 public:
   PeriodicWave(AudioContext* aContext,
                const float* aRealData,
-               uint32_t aRealDataLength,
                const float* aImagData,
-               uint32_t aImagDataLength);
+               const uint32_t aLength,
+               ErrorResult& aRv);
 
   NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(PeriodicWave)
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(PeriodicWave)
@@ -39,12 +40,23 @@ public:
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
 
+  uint32_t DataLength() const
+  {
+    return mLength;
+  }
+
+  ThreadSharedFloatArrayBufferList* GetThreadSharedBuffer() const
+  {
+    return mCoefficients;
+  }
+
 private:
   nsRefPtr<AudioContext> mContext;
+  nsRefPtr<ThreadSharedFloatArrayBufferList> mCoefficients;
+  uint32_t mLength;
 };
 
 }
 }
 
 #endif
-
diff --git a/content/media/webaudio/blink/PeriodicWave.cpp b/content/media/webaudio/blink/PeriodicWave.cpp
new file mode 100644
index 00000000000..eadeea9d237
--- /dev/null
+++ b/content/media/webaudio/blink/PeriodicWave.cpp
@@ -0,0 +1,297 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PeriodicWave.h"
+#include <algorithm>
+#include <cmath>
+#include "mozilla/FFTBlock.h"
+
+const unsigned PeriodicWaveSize = 4096; // This must be a power of two.
+const unsigned NumberOfRanges = 36; // There should be 3 * log2(PeriodicWaveSize) 1/3 octave ranges.
+const float CentsPerRange = 1200 / 3; // 1/3 Octave.
+
+using namespace mozilla;
+using mozilla::dom::OscillatorType;
+
+namespace WebCore {
+
+PeriodicWave* PeriodicWave::create(float sampleRate,
+                                   const float* real,
+                                   const float* imag,
+                                   size_t numberOfComponents)
+{
+    bool isGood = real && imag && numberOfComponents > 0 &&
+         numberOfComponents <= PeriodicWaveSize;
+    MOZ_ASSERT(isGood);
+    if (isGood) {
+        PeriodicWave* periodicWave = new PeriodicWave(sampleRate);
+        periodicWave->createBandLimitedTables(real, imag, numberOfComponents);
+        return periodicWave;
+    }
+    return 0;
+}
+
+PeriodicWave* PeriodicWave::createSine(float sampleRate)
+{
+      PeriodicWave* periodicWave = new PeriodicWave(sampleRate);
+          periodicWave->generateBasicWaveform(OscillatorType::Sine);
+              return periodicWave;
+}
+
+PeriodicWave* PeriodicWave::createSquare(float sampleRate)
+{
+      PeriodicWave* periodicWave = new PeriodicWave(sampleRate);
+          periodicWave->generateBasicWaveform(OscillatorType::Square);
+              return periodicWave;
+}
+
+PeriodicWave* PeriodicWave::createSawtooth(float sampleRate)
+{
+      PeriodicWave* periodicWave = new PeriodicWave(sampleRate);
+          periodicWave->generateBasicWaveform(OscillatorType::Sawtooth);
+              return periodicWave;
+}
+
+PeriodicWave* PeriodicWave::createTriangle(float sampleRate)
+{
+      PeriodicWave* periodicWave = new PeriodicWave(sampleRate);
+          periodicWave->generateBasicWaveform(OscillatorType::Triangle);
+              return periodicWave;
+}
+
+PeriodicWave::PeriodicWave(float sampleRate)
+    : m_sampleRate(sampleRate)
+    , m_periodicWaveSize(PeriodicWaveSize)
+    , m_numberOfRanges(NumberOfRanges)
+    , m_centsPerRange(CentsPerRange)
+{
+    float nyquist = 0.5 * m_sampleRate;
+    m_lowestFundamentalFrequency = nyquist / maxNumberOfPartials();
+    m_rateScale = m_periodicWaveSize / m_sampleRate;
+}
+
+void PeriodicWave::waveDataForFundamentalFrequency(float fundamentalFrequency, float* &lowerWaveData, float* &higherWaveData, float& tableInterpolationFactor)
+{
+    // Negative frequencies are allowed, in which case we alias
+    // to the positive frequency.
+    fundamentalFrequency = fabsf(fundamentalFrequency);
+
+    // Calculate the pitch range.
+    float ratio = fundamentalFrequency > 0 ? fundamentalFrequency / m_lowestFundamentalFrequency : 0.5;
+    float centsAboveLowestFrequency = logf(ratio)/logf(2.0f) * 1200;
+
+    // Add one to round-up to the next range just in time to truncate
+    // partials before aliasing occurs.
+    float pitchRange = 1 + centsAboveLowestFrequency / m_centsPerRange;
+
+    pitchRange = std::max(pitchRange, 0.0f);
+    pitchRange = std::min(pitchRange, static_cast<float>(m_numberOfRanges - 1));
+
+    // The words "lower" and "higher" refer to the table data having
+    // the lower and higher numbers of partials. It's a little confusing
+    // since the range index gets larger the more partials we cull out.
+    // So the lower table data will have a larger range index.
+    unsigned rangeIndex1 = static_cast<unsigned>(pitchRange);
+    unsigned rangeIndex2 = rangeIndex1 < m_numberOfRanges - 1 ? rangeIndex1 + 1 : rangeIndex1;
+
+    lowerWaveData = m_bandLimitedTables[rangeIndex2]->Elements();
+    higherWaveData = m_bandLimitedTables[rangeIndex1]->Elements();
+
+    // Ranges from 0 -> 1 to interpolate between lower -> higher.
+    tableInterpolationFactor = pitchRange - rangeIndex1;
+}
+
+unsigned PeriodicWave::maxNumberOfPartials() const
+{
+    return m_periodicWaveSize / 2;
+}
+
+unsigned PeriodicWave::numberOfPartialsForRange(unsigned rangeIndex) const
+{
+    // Number of cents below nyquist where we cull partials.
+    float centsToCull = rangeIndex * m_centsPerRange;
+
+    // A value from 0 -> 1 representing what fraction of the partials to keep.
+    float cullingScale = pow(2, -centsToCull / 1200);
+
+    // The very top range will have all the partials culled.
+    unsigned numberOfPartials = cullingScale * maxNumberOfPartials();
+
+    return numberOfPartials;
+}
+
+// Convert into time-domain wave buffers.
+// One table is created for each range for non-aliasing playback
+// at different playback rates. Thus, higher ranges have more
+// high-frequency partials culled out.
+void PeriodicWave::createBandLimitedTables(const float* realData, const float* imagData, unsigned numberOfComponents)
+{
+    float normalizationScale = 1;
+
+    unsigned fftSize = m_periodicWaveSize;
+    unsigned halfSize = fftSize / 2 + 1;
+    unsigned i;
+
+    numberOfComponents = std::min(numberOfComponents, halfSize);
+
+    m_bandLimitedTables.SetCapacity(m_numberOfRanges);
+
+    for (unsigned rangeIndex = 0; rangeIndex < m_numberOfRanges; ++rangeIndex) {
+        // This FFTBlock is used to cull partials (represented by frequency bins).
+        FFTBlock frame(fftSize);
+        float* realP = new float[halfSize];
+        float* imagP = new float[halfSize];
+
+        // Copy from loaded frequency data and scale.
+        float scale = fftSize;
+        AudioBufferCopyWithScale(realData, scale, realP, numberOfComponents);
+        AudioBufferCopyWithScale(imagData, scale, imagP, numberOfComponents);
+
+        // If fewer components were provided than 1/2 FFT size,
+        // then clear the remaining bins.
+        for (i = numberOfComponents; i < halfSize; ++i) {
+            realP[i] = 0;
+            imagP[i] = 0;
+        }
+
+        // Generate complex conjugate because of the way the
+        // inverse FFT is defined.
+        float minusOne = -1;
+        AudioBufferInPlaceScale(imagP, 1, minusOne, halfSize);
+
+        // Find the starting bin where we should start culling.
+        // We need to clear out the highest frequencies to band-limit
+        // the waveform.
+        unsigned numberOfPartials = numberOfPartialsForRange(rangeIndex);
+
+        // Cull the aliasing partials for this pitch range.
+        for (i = numberOfPartials + 1; i < halfSize; ++i) {
+            realP[i] = 0;
+            imagP[i] = 0;
+        }
+        // Clear nyquist if necessary.
+        if (numberOfPartials < halfSize)
+            realP[halfSize-1] = 0;
+
+        // Clear any DC-offset.
+        realP[0] = 0;
+
+        // Clear values which have no effect.
+        imagP[0] = 0;
+        imagP[halfSize-1] = 0;
+
+        // Create the band-limited table.
+        AudioFloatArray* table = new AudioFloatArray(m_periodicWaveSize);
+        m_bandLimitedTables.AppendElement(table);
+
+        // Apply an inverse FFT to generate the time-domain table data.
+        float* data = m_bandLimitedTables[rangeIndex]->Elements();
+        frame.PerformInverseFFT(realP, imagP, data);
+
+        // For the first range (which has the highest power), calculate
+        // its peak value then compute normalization scale.
+        if (!rangeIndex) {
+            float maxValue;
+            maxValue = AudioBufferPeakValue(data, m_periodicWaveSize);
+
+            if (maxValue)
+                normalizationScale = 1.0f / maxValue;
+        }
+
+        // Apply normalization scale.
+        AudioBufferInPlaceScale(data, 1, normalizationScale, m_periodicWaveSize);
+    }
+}
+
+void PeriodicWave::generateBasicWaveform(OscillatorType shape)
+{
+    const float piFloat = M_PI;
+    unsigned fftSize = periodicWaveSize();
+    unsigned halfSize = fftSize / 2 + 1;
+
+    AudioFloatArray real(halfSize);
+    AudioFloatArray imag(halfSize);
+    float* realP = real.Elements();
+    float* imagP = imag.Elements();
+
+    // Clear DC and Nyquist.
+    realP[0] = 0;
+    imagP[0] = 0;
+    realP[halfSize-1] = 0;
+    imagP[halfSize-1] = 0;
+
+    for (unsigned n = 1; n < halfSize; ++n) {
+        float omega = 2 * piFloat * n;
+        float invOmega = 1 / omega;
+
+        // Fourier coefficients according to standard definition.
+        float a; // Coefficient for cos().
+        float b; // Coefficient for sin().
+
+        // Calculate Fourier coefficients depending on the shape.
+        // Note that the overall scaling (magnitude) of the waveforms
+        // is normalized in createBandLimitedTables().
+        switch (shape) {
+        case OscillatorType::Sine:
+            // Standard sine wave function.
+            a = 0;
+            b = (n == 1) ? 1 : 0;
+            break;
+        case OscillatorType::Square:
+            // Square-shaped waveform with the first half its maximum value
+            // and the second half its minimum value.
+            a = 0;
+            b = invOmega * ((n & 1) ? 2 : 0);
+            break;
+        case OscillatorType::Sawtooth:
+            // Sawtooth-shaped waveform with the first half ramping from
+            // zero to maximum and the second half from minimum to zero.
+            a = 0;
+            b = -invOmega * cos(0.5 * omega);
+            break;
+        case OscillatorType::Triangle:
+            // Triangle-shaped waveform going from its maximum value to
+            // its minimum value then back to the maximum value.
+            a = (4 - 4 * cos(0.5 * omega)) / (n * n * piFloat * piFloat);
+            b = 0;
+            break;
+        default:
+            NS_NOTREACHED("invalid oscillator type");
+            a = 0;
+            b = 0;
+            break;
+        }
+
+        realP[n] = a;
+        imagP[n] = b;
+    }
+
+    createBandLimitedTables(realP, imagP, halfSize);
+}
+
+} // namespace WebCore
diff --git a/content/media/webaudio/blink/PeriodicWave.h b/content/media/webaudio/blink/PeriodicWave.h
new file mode 100644
index 00000000000..9949e8bea78
--- /dev/null
+++ b/content/media/webaudio/blink/PeriodicWave.h
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PeriodicWave_h
+#define PeriodicWave_h
+
+#include "mozilla/dom/OscillatorNodeBinding.h"
+#include <nsAutoPtr.h>
+#include <nsTArray.h>
+
+namespace WebCore {
+
+typedef nsTArray<float> AudioFloatArray;
+
+class PeriodicWave {
+public:
+    static PeriodicWave* createSine(float sampleRate);
+    static PeriodicWave* createSquare(float sampleRate);
+    static PeriodicWave* createSawtooth(float sampleRate);
+    static PeriodicWave* createTriangle(float sampleRate);
+
+    // Creates an arbitrary periodic wave given the frequency components
+    // (Fourier coefficients).
+    static PeriodicWave* create(float sampleRate,
+                                const float* real,
+                                const float* imag,
+                                size_t numberOfComponents);
+
+    // Returns pointers to the lower and higher wave data for the pitch range
+    // containing the given fundamental frequency. These two tables are in
+    // adjacent "pitch" ranges where the higher table will have the maximum
+    // number of partials which won't alias when played back at this
+    // fundamental frequency. The lower wave is the next range containing fewer
+    // partials than the higher wave. Interpolation between these two tables
+    // can be made according to tableInterpolationFactor. Where values
+    // from 0 -> 1 interpolate between lower -> higher.
+    void waveDataForFundamentalFrequency(float, float* &lowerWaveData, float* &higherWaveData, float& tableInterpolationFactor);
+
+    // Returns the scalar multiplier to the oscillator frequency to calculate
+    // wave buffer phase increment.
+    float rateScale() const { return m_rateScale; }
+
+    unsigned periodicWaveSize() const { return m_periodicWaveSize; }
+    float sampleRate() const { return m_sampleRate; }
+
+private:
+    explicit PeriodicWave(float sampleRate);
+
+    void generateBasicWaveform(mozilla::dom::OscillatorType);
+
+    float m_sampleRate;
+    unsigned m_periodicWaveSize;
+    unsigned m_numberOfRanges;
+    float m_centsPerRange;
+
+    // The lowest frequency (in Hertz) where playback will include all of the
+    // partials.  Playing back lower than this frequency will gradually lose
+    // more high-frequency information.
+    // This frequency is quite low (~10Hz @ // 44.1KHz)
+    float m_lowestFundamentalFrequency;
+
+    float m_rateScale;
+
+    unsigned numberOfRanges() const { return m_numberOfRanges; }
+
+    // Maximum possible number of partials (before culling).
+    unsigned maxNumberOfPartials() const;
+
+    unsigned numberOfPartialsForRange(unsigned rangeIndex) const;
+
+    // Creates tables based on numberOfComponents Fourier coefficients.
+    void createBandLimitedTables(const float* real, const float* imag, unsigned numberOfComponents);
+    nsTArray<nsAutoPtr<AudioFloatArray> > m_bandLimitedTables;
+};
+
+} // namespace WebCore
+
+#endif // PeriodicWave_h
diff --git a/content/media/webaudio/blink/moz.build b/content/media/webaudio/blink/moz.build
index fc0e3e3a18f..4168bc8cf2e 100644
--- a/content/media/webaudio/blink/moz.build
+++ b/content/media/webaudio/blink/moz.build
@@ -17,6 +17,7 @@ CPP_SOURCES += [
     'HRTFElevation.cpp',
     'HRTFKernel.cpp',
     'HRTFPanner.cpp',
+    'PeriodicWave.cpp',
     'Reverb.cpp',
     'ReverbAccumulationBuffer.cpp',
     'ReverbConvolver.cpp',
diff --git a/content/media/webaudio/test/test_oscillatorNode.html b/content/media/webaudio/test/test_oscillatorNode.html
index f8d6a0412fb..4f15e5613ee 100644
--- a/content/media/webaudio/test/test_oscillatorNode.html
+++ b/content/media/webaudio/test/test_oscillatorNode.html
@@ -22,10 +22,10 @@ addLoadEvent(function() {
   is(osc.type, "sine", "Correct default type");
   expectException(function() {
     osc.type = "custom";
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INVALID_STATE_ERR);
   expectException(function() {
     osc.type = osc.CUSTOM;
-  }, DOMException.NOT_SUPPORTED_ERR);
+  }, DOMException.INVALID_STATE_ERR);
   is(osc.type, "sine", "Cannot set the type to custom");
   is(osc.frequency.value, 440, "Correct default frequency value");
   is(osc.detune.value, 0, "Correct default detine value");
@@ -43,6 +43,12 @@ addLoadEvent(function() {
     osc.type = types[i];
   }
 
+  // Verify setPeriodicWave()
+  var real = new Float32Array([1.0, 0.5, 0.25, 0.125]);
+  var imag = new Float32Array([1.0, 0.7, -1.0, 0.5]);
+  osc.setPeriodicWave(context.createPeriodicWave(real, imag));
+  is(osc.type, "custom", "Failed to set custom waveform");
+
   SimpleTest.finish();
 });
 
diff --git a/content/smil/Makefile.in b/content/smil/Makefile.in
deleted file mode 100644
index e127ed31561..00000000000
--- a/content/smil/Makefile.in
+++ /dev/null
@@ -1,10 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES += 	\
-		-I$(srcdir)/../base/src \
-		-I$(srcdir)/../../layout/style \
-		-I$(srcdir)/../events/src \
-		$(NULL)
diff --git a/content/smil/moz.build b/content/smil/moz.build
index 0e4c6f74569..2892d20f10f 100644
--- a/content/smil/moz.build
+++ b/content/smil/moz.build
@@ -67,3 +67,8 @@ LIBXUL_LIBRARY = True
 
 LIBRARY_NAME = 'gkconsmil_s'
 
+LOCAL_INCLUDES += [
+    '../base/src',
+    '../events/src',
+    '/layout/style',
+]
diff --git a/content/svg/document/src/Makefile.in b/content/svg/document/src/Makefile.in
deleted file mode 100644
index fe72b0d45a8..00000000000
--- a/content/svg/document/src/Makefile.in
+++ /dev/null
@@ -1,17 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES	+= \
-		-I$(srcdir) \
-		-I$(srcdir)/../../../xml/document/src \
-		-I$(srcdir)/../../../html/document/src \
-		-I$(srcdir)/../../../../layout/style \
-		-I$(srcdir)/../../../base/src \
-		-I$(srcdir)/../../../events/src \
-		-I$(topsrcdir)/xpcom/ds \
-		-I$(topsrcdir)/content/svg/content/src \
-		$(NULL)
diff --git a/content/svg/document/src/moz.build b/content/svg/document/src/moz.build
index d0723654f0f..b5b5f8264f8 100644
--- a/content/svg/document/src/moz.build
+++ b/content/svg/document/src/moz.build
@@ -20,3 +20,12 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '/content/base/src',
+    '/content/events/src',
+    '/content/html/document/src',
+    '/content/svg/content/src',
+    '/content/xml/document/src',
+    '/layout/style',
+    '/xpcom/ds',
+]
diff --git a/content/xbl/src/Makefile.in b/content/xbl/src/Makefile.in
deleted file mode 100644
index a0f13f47b16..00000000000
--- a/content/xbl/src/Makefile.in
+++ /dev/null
@@ -1,18 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES	= \
-		-I$(srcdir)/../../base/src \
-		-I$(srcdir)/../../html/document/src \
-		-I$(srcdir)/../../xml/document/src \
-		-I$(srcdir)/../../xul/content/src \
-		-I$(srcdir)/../../xul/document/src \
-		-I$(srcdir)/../../events/src \
-		-I$(srcdir)/../../../layout/style \
-		-I$(srcdir)/../../../dom/base \
-		-I$(topsrcdir)/xpcom/ds \
-		$(NULL)
diff --git a/content/xbl/src/moz.build b/content/xbl/src/moz.build
index e3cfed1451f..71a1f0537e4 100644
--- a/content/xbl/src/moz.build
+++ b/content/xbl/src/moz.build
@@ -44,3 +44,14 @@ MSVC_ENABLE_PGO = True
 
 LIBRARY_NAME = 'gkconxbl_s'
 
+LOCAL_INCLUDES += [
+    '/content/base/src',
+    '/content/events/src',
+    '/content/html/document/src',
+    '/content/xml/document/src',
+    '/content/xul/content/src',
+    '/content/xul/document/src',
+    '/dom/base',
+    '/layout/style',
+    '/xpcom/ds',
+]
diff --git a/content/xml/document/src/Makefile.in b/content/xml/document/src/Makefile.in
deleted file mode 100644
index 0bdbcd70a1e..00000000000
--- a/content/xml/document/src/Makefile.in
+++ /dev/null
@@ -1,18 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES	= \
-		-I$(srcdir) \
-		-I$(srcdir)/../../../html/document/src \
-		-I$(srcdir)/../../../../layout/style \
-		-I$(srcdir)/../../../base/src \
-		-I$(srcdir)/../../../xul/content/src \
-		-I$(srcdir)/../../../events/src \
-		-I$(srcdir)/../../../../dom/base \
-		-I$(srcdir)/../../../../caps/include \
-		-I$(topsrcdir)/xpcom/ds \
-		$(NULL)
diff --git a/content/xml/document/src/moz.build b/content/xml/document/src/moz.build
index 105fe79cff1..d7770082265 100644
--- a/content/xml/document/src/moz.build
+++ b/content/xml/document/src/moz.build
@@ -25,3 +25,13 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '/caps/include',
+    '/content/base/src',
+    '/content/events/src',
+    '/content/html/document/src',
+    '/content/xul/content/src',
+    '/dom/base',
+    '/layout/style',
+    '/xpcom/ds',
+    ]
diff --git a/content/xslt/src/base/Makefile.in b/content/xslt/src/base/Makefile.in
deleted file mode 100644
index c967747abe0..00000000000
--- a/content/xslt/src/base/Makefile.in
+++ /dev/null
@@ -1,13 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES += \
-	-I$(srcdir)/../../public \
-	-I$(srcdir) \
-	-I$(srcdir)/../xml \
-	-I$(srcdir)/../xpath \
-	-I$(srcdir)/../xslt \
-	$(NULL)
diff --git a/content/xslt/src/base/moz.build b/content/xslt/src/base/moz.build
index 073bd662fe4..23f8719f328 100644
--- a/content/xslt/src/base/moz.build
+++ b/content/xslt/src/base/moz.build
@@ -20,3 +20,9 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../../public',
+    '../xml',
+    '../xpath',
+    '../xslt',
+]
diff --git a/content/xslt/src/xml/Makefile.in b/content/xslt/src/xml/Makefile.in
deleted file mode 100644
index 225e6c8041d..00000000000
--- a/content/xslt/src/xml/Makefile.in
+++ /dev/null
@@ -1,13 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES += \
-	-I$(srcdir)/../base \
-	-I$(srcdir) \
-	-I$(srcdir)/../xpath \
-	-I$(srcdir)/../xslt \
-	-I$(srcdir)/../../../base/src \
-	$(NULL)
diff --git a/content/xslt/src/xml/moz.build b/content/xslt/src/xml/moz.build
index 471e2db7c0f..d1d85e57190 100644
--- a/content/xslt/src/xml/moz.build
+++ b/content/xslt/src/xml/moz.build
@@ -17,3 +17,9 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../base',
+    '../xpath',
+    '../xslt',
+    '/content/base/src',
+]
diff --git a/content/xslt/src/xpath/Makefile.in b/content/xslt/src/xpath/Makefile.in
deleted file mode 100644
index 462cf326fc8..00000000000
--- a/content/xslt/src/xpath/Makefile.in
+++ /dev/null
@@ -1,12 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES += \
-	-I$(srcdir)/../base \
-	-I$(srcdir)/../xml \
-	-I$(srcdir) \
-	-I$(srcdir)/../xslt \
-	$(NULL)
diff --git a/content/xslt/src/xpath/moz.build b/content/xslt/src/xpath/moz.build
index 23e60da2f68..33422fb1d47 100644
--- a/content/xslt/src/xpath/moz.build
+++ b/content/xslt/src/xpath/moz.build
@@ -57,3 +57,8 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../base',
+    '../xml',
+    '../xslt',
+]
diff --git a/content/xslt/src/xslt/Makefile.in b/content/xslt/src/xslt/Makefile.in
deleted file mode 100644
index 2388cc5d542..00000000000
--- a/content/xslt/src/xslt/Makefile.in
+++ /dev/null
@@ -1,18 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# For nsDependentJSString
-LOCAL_INCLUDES += \
-  -I$(topsrcdir)/dom/base \
-  $(NULL)
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES += \
-	-I$(srcdir) \
-	-I$(srcdir)/../base \
-	-I$(srcdir)/../xml \
-	-I$(srcdir)/../xpath \
-	-I$(srcdir)/../../../base/src \
-	$(NULL)
diff --git a/content/xslt/src/xslt/moz.build b/content/xslt/src/xslt/moz.build
index c86961f4263..5ecc48c310b 100644
--- a/content/xslt/src/xslt/moz.build
+++ b/content/xslt/src/xslt/moz.build
@@ -50,3 +50,12 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+# For nsDependentJSString
+LOCAL_INCLUDES += ["/dom/base"]
+
+LOCAL_INCLUDES += [
+    '../base',
+    '../xml',
+    '../xpath',
+    '/content/base/src',
+]
diff --git a/content/xul/content/src/Makefile.in b/content/xul/content/src/Makefile.in
deleted file mode 100644
index 385bcdf8e44..00000000000
--- a/content/xul/content/src/Makefile.in
+++ /dev/null
@@ -1,21 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES	= \
-	-I$(srcdir)/../../document/src \
-	-I$(srcdir)/../../templates/src \
-	-I$(srcdir)/../../../xml/content/src \
-	-I$(srcdir)/../../../base/src \
-	-I$(srcdir)/../../../xml/document/src \
-	-I$(srcdir)/../../../../layout/generic \
-	-I$(srcdir)/../../../../layout/style \
-	-I$(srcdir)/../../../../layout/xul/base/src \
-	-I$(srcdir)/../../../html/content/src \
-	-I$(srcdir)/../../../events/src \
-	-I$(srcdir)/../../../xbl/src \
-	-I$(topsrcdir)/xpcom/ds \
-	$(NULL)
diff --git a/content/xul/content/src/moz.build b/content/xul/content/src/moz.build
index 2c209b0cf72..e34d55b3f07 100644
--- a/content/xul/content/src/moz.build
+++ b/content/xul/content/src/moz.build
@@ -19,3 +19,17 @@ if CONFIG['MOZ_XUL']:
 
 FAIL_ON_WARNINGS = True
 
+LOCAL_INCLUDES += [
+    '../../document/src',
+    '../../templates/src',
+    '/content/base/src',
+    '/content/events/src',
+    '/content/html/content/src',
+    '/content/xbl/src',
+    '/content/xml/content/src',
+    '/content/xml/document/src',
+    '/layout/generic',
+    '/layout/style',
+    '/layout/xul/base/src',
+    '/xpcom/ds',
+]
diff --git a/content/xul/document/src/Makefile.in b/content/xul/document/src/Makefile.in
deleted file mode 100644
index f956dda749a..00000000000
--- a/content/xul/document/src/Makefile.in
+++ /dev/null
@@ -1,20 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES	= -I$(srcdir)/../../../base/src \
-		  -I$(srcdir)/../../content/src \
-		  -I$(srcdir)/../../templates/src \
-		  -I$(srcdir)/../../../../layout/base \
-		  -I$(srcdir)/../../../../layout/generic \
-		  -I$(srcdir)/../../../../layout/style \
-		  -I$(srcdir)/../../../../layout/xul/base/src \
-		  -I$(srcdir)/../../../xml/document/src \
-		  -I$(srcdir)/../../../xbl/src \
-		  -I$(srcdir)/../../../events/src \
-		  -I$(topsrcdir)/xpcom/ds \
-		  -I$(topsrcdir)/dom/base \
-		  $(NULL)
diff --git a/content/xul/document/src/moz.build b/content/xul/document/src/moz.build
index 04924010927..d8fb48e9034 100644
--- a/content/xul/document/src/moz.build
+++ b/content/xul/document/src/moz.build
@@ -27,3 +27,17 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '/content/base/src',
+    '/content/events/src',
+    '/content/xbl/src',
+    '/content/xml/document/src',
+    '/content/xul/content/src',
+    '/content/xul/templates/src',
+    '/dom/base',
+    '/layout/base',
+    '/layout/generic',
+    '/layout/style',
+    '/layout/xul/base/src',
+    '/xpcom/ds',
+]
diff --git a/content/xul/templates/src/Makefile.in b/content/xul/templates/src/Makefile.in
deleted file mode 100644
index 390009456a5..00000000000
--- a/content/xul/templates/src/Makefile.in
+++ /dev/null
@@ -1,12 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES	= -I$(srcdir)/../../../base/src \
-		  -I$(srcdir)/../../content/src \
-		  -I$(srcdir)/../../../../dom/base \
-		  -I$(srcdir)/../../../../layout/xul/tree/ \
-		  $(NULL)
diff --git a/content/xul/templates/src/moz.build b/content/xul/templates/src/moz.build
index 9317155aba5..a9f05d4a819 100644
--- a/content/xul/templates/src/moz.build
+++ b/content/xul/templates/src/moz.build
@@ -41,3 +41,9 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '../../content/src',
+    '/content/base/src',
+    '/dom/base',
+    '/layout/xul/tree/',
+]
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 5d94f93dbb3..d2845d5bd06 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -750,7 +750,6 @@ nsDocShell::nsDocShell():
     mIsAppTab(false),
     mUseGlobalHistory(false),
     mInPrivateBrowsing(false),
-    mDeviceSizeIsPageSize(false),
     mFiredUnloadEvent(false),
     mEODForCurrentDocument(false),
     mURIResultedInDocument(false),
@@ -3933,27 +3932,6 @@ nsDocShell::GetCurrentSHEntry(nsISHEntry** aEntry, bool* aOSHE)
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDocShell::SetDeviceSizeIsPageSize(bool aValue)
-{
-    if (mDeviceSizeIsPageSize != aValue) {
-      mDeviceSizeIsPageSize = aValue;
-      nsRefPtr<nsPresContext> presContext;
-      GetPresContext(getter_AddRefs(presContext));
-      if (presContext) {
-          presContext->MediaFeatureValuesChanged(presContext->eAlwaysRebuildStyle);
-      }
-    }
-    return NS_OK;
-}
-
-NS_IMETHODIMP
-nsDocShell::GetDeviceSizeIsPageSize(bool* aValue)
-{
-    *aValue = mDeviceSizeIsPageSize;
-    return NS_OK;
-}
-
 void
 nsDocShell::ClearFrameHistory(nsISHEntry* aEntry)
 {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 4b9aa2458ca..d6eb1d14ba1 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -809,7 +809,6 @@ protected:
     bool                       mIsAppTab;
     bool                       mUseGlobalHistory;
     bool                       mInPrivateBrowsing;
-    bool                       mDeviceSizeIsPageSize;
 
     // This boolean is set to true right before we fire pagehide and generally
     // unset when we embed a new content viewer.  While it's true no navigation
diff --git a/docshell/base/nsIDocShell.idl b/docshell/base/nsIDocShell.idl
index 32683fc1de7..0447f39733f 100644
--- a/docshell/base/nsIDocShell.idl
+++ b/docshell/base/nsIDocShell.idl
@@ -916,12 +916,4 @@ interface nsIDocShell : nsIDocShellTreeItem
     */
   boolean isCommandEnabled(in string command);
   void doCommand(in string command);
-
-  /**
-   * If deviceSizeIsPageSize is set to true, device-width/height media queries
-   * will be calculated from the page size, not the device size.
-   *
-   * Used by the Responsive Design View.
-   */
-  [infallible] attribute boolean deviceSizeIsPageSize;
 };
diff --git a/docshell/build/Makefile.in b/docshell/build/Makefile.in
deleted file mode 100644
index 4b2b8c1c3b7..00000000000
--- a/docshell/build/Makefile.in
+++ /dev/null
@@ -1,28 +0,0 @@
-# 
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-EXPORT_LIBRARY = 1
-SHARED_LIBRARY_LIBS= \
-		../base/$(LIB_PREFIX)basedocshell_s.$(LIB_SUFFIX) \
-		$(DEPTH)/uriloader/base/$(LIB_PREFIX)uriloaderbase_s.$(LIB_SUFFIX) \
-		$(DEPTH)/uriloader/exthandler/$(LIB_PREFIX)exthandler_s.$(LIB_SUFFIX) \
-		$(DEPTH)/uriloader/prefetch/$(LIB_PREFIX)prefetch_s.$(LIB_SUFFIX) \
-		../shistory/src/$(LIB_PREFIX)shistory_s.$(LIB_SUFFIX) \
-		$(NULL)
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES	= \
-		-I$(srcdir) \
-		-I$(srcdir)/../base \
-		-I$(srcdir)/../shistory/src \
-		-I$(topsrcdir)/uriloader/base \
-		-I$(topsrcdir)/uriloader/prefetch \
-		-I$(topsrcdir)/uriloader/exthandler \
-		$(NULL)
-
-ifeq (cocoa,$(MOZ_WIDGET_TOOLKIT))
-LOCAL_INCLUDES += -I$(topsrcdir)/uriloader/exthandler/mac
-endif
diff --git a/docshell/build/moz.build b/docshell/build/moz.build
index 3d9c5030fca..f3b92d23ed0 100644
--- a/docshell/build/moz.build
+++ b/docshell/build/moz.build
@@ -18,3 +18,13 @@ LIBRARY_NAME = 'docshell'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../base',
+    '../shistory/src/',
+    '/uriloader/base',
+    '/uriloader/exthandler',
+    '/uriloader/prefetch',
+    ]
+
+if CONFIG["MOZ_WIDGET_TOOLKIT"] == "cocoa":
+    LOCAL_INCLUDES += ['/uriloader/exthandler/mac']
diff --git a/docshell/shistory/src/Makefile.in b/docshell/shistory/src/Makefile.in
deleted file mode 100644
index 4d38db3ec62..00000000000
--- a/docshell/shistory/src/Makefile.in
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES += -I$(srcdir)/../../base
diff --git a/docshell/shistory/src/moz.build b/docshell/shistory/src/moz.build
index 4ca6d43c5a8..c6c3baed257 100644
--- a/docshell/shistory/src/moz.build
+++ b/docshell/shistory/src/moz.build
@@ -25,3 +25,6 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '/docshell/base',
+]
diff --git a/docshell/test/navigation/NavigationUtils.js b/docshell/test/navigation/NavigationUtils.js
index cf422ad2f94..72c19da61a8 100644
--- a/docshell/test/navigation/NavigationUtils.js
+++ b/docshell/test/navigation/NavigationUtils.js
@@ -93,6 +93,10 @@ function isInaccessible(wnd, message) {
   }
 }
 
+function getSubframe(win, i) {
+  return SpecialPowers.unwrap(SpecialPowers.wrap(win)[i]);
+}
+
 ///////////////////////////////////////////////////////////////////////////
 // Functions that require UniversalXPConnect privilege
 ///////////////////////////////////////////////////////////////////////////
diff --git a/docshell/test/navigation/test_bug13871.html b/docshell/test/navigation/test_bug13871.html
index 9ff0b9bb553..f0d08428c57 100644
--- a/docshell/test/navigation/test_bug13871.html
+++ b/docshell/test/navigation/test_bug13871.html
@@ -9,17 +9,18 @@
       iframe { width: 90%; height: 50px; }
     </style>
 <script>
+
 window.onload = function () {
-  navigateByLocation(window0.frames[0]);
+  navigateByLocation(getSubframe(window0, 0));
   navigateByOpen("window1_child0");
   navigateByForm("window2_child0");
   navigateByHyperlink("window3_child0");
 
   xpcWaitForFinishedFrames(function() {
-    isInaccessible(window0.frames[0], "Should not be able to navigate off-domain frame by setting location.");
-    isInaccessible(window1.frames[0], "Should not be able to navigate off-domain frame by calling window.open.");
-    isInaccessible(window2.frames[0], "Should not be able to navigate off-domain frame by submitting form.");
-    isInaccessible(window3.frames[0], "Should not be able to navigate off-domain frame by targeted hyperlink.");
+    isInaccessible(getSubframe(window0, 0), "Should not be able to navigate off-domain frame by setting location.");
+    isInaccessible(getSubframe(window1, 0), "Should not be able to navigate off-domain frame by calling window.open.");
+    isInaccessible(getSubframe(window2, 0), "Should not be able to navigate off-domain frame by submitting form.");
+    isInaccessible(getSubframe(window3, 0), "Should not be able to navigate off-domain frame by targeted hyperlink.");
 
     window0.close();
     window1.close();
diff --git a/docshell/test/navigation/test_grandchild.html b/docshell/test/navigation/test_grandchild.html
index 439145b3edb..fcb9cd860b7 100644
--- a/docshell/test/navigation/test_grandchild.html
+++ b/docshell/test/navigation/test_grandchild.html
@@ -14,16 +14,16 @@ if (!navigator.platform.startsWith("Win")) {
 }
 
 window.onload = function () {
-  navigateByLocation(frames[0].frames[0]);
+  navigateByLocation(getSubframe(getSubframe(frames, 0), 0));
   navigateByOpen("child1_child0");
   navigateByForm("child2_child0");
   navigateByHyperlink("child3_child0");
 
   xpcWaitForFinishedFrames(function() {
-    isNavigated(frames[0].frames[0], "Should be able to navigate off-domain grandchild by setting location.");
-    isNavigated(frames[1].frames[0], "Should be able to navigate off-domain grandchild by calling window.open.");
-    isNavigated(frames[2].frames[0], "Should be able to navigate off-domain grandchild by submitting form.");
-    isNavigated(frames[3].frames[0], "Should be able to navigate off-domain grandchild by targeted hyperlink.");
+    isNavigated(getSubframe(getSubframe(frames, 0), 0), "Should be able to navigate off-domain grandchild by setting location.");
+    isNavigated(getSubframe(getSubframe(frames, 1), 0), "Should be able to navigate off-domain grandchild by calling window.open.");
+    isNavigated(getSubframe(getSubframe(frames, 2), 0), "Should be able to navigate off-domain grandchild by submitting form.");
+    isNavigated(getSubframe(getSubframe(frames, 3), 0), "Should be able to navigate off-domain grandchild by targeted hyperlink.");
 
     xpcCleanupWindows();
     SimpleTest.finish();
diff --git a/docshell/test/navigation/test_sibling-off-domain.html b/docshell/test/navigation/test_sibling-off-domain.html
index ba7942798ee..c88ec26d548 100644
--- a/docshell/test/navigation/test_sibling-off-domain.html
+++ b/docshell/test/navigation/test_sibling-off-domain.html
@@ -11,7 +11,7 @@
 <script>
 window.onload = function () {
   document.getElementById('active').innerHTML =
-      '<iframe src="http://test1.example.org:80/tests/docshell/test/navigation/navigate.html#parent.frames[0],location"></iframe>' +
+      '<iframe src="http://test1.example.org:80/tests/docshell/test/navigation/navigate.html#SpecialPowers.unwrap(SpecialPowers.wrap(parent).frames[0]),location"></iframe>' +
       '<iframe src="http://test1.example.org:80/tests/docshell/test/navigation/navigate.html#child1,open"></iframe>' +
       '<iframe src="http://test1.example.org:80/tests/docshell/test/navigation/navigate.html#child2,form"></iframe>' +
       '<iframe src="http://test1.example.org:80/tests/docshell/test/navigation/navigate.html#child3,hyperlink"></iframe>';
diff --git a/dom/activities/src/Makefile.in b/dom/activities/src/Makefile.in
deleted file mode 100644
index 7515f97e0f9..00000000000
--- a/dom/activities/src/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/activities/src/moz.build b/dom/activities/src/moz.build
index 965cbe4704e..d9351acd6d8 100644
--- a/dom/activities/src/moz.build
+++ b/dom/activities/src/moz.build
@@ -34,3 +34,6 @@ LIBXUL_LIBRARY = True
 
 LIBRARY_NAME = 'dom_activities_s'
 
+LOCAL_INCLUDES += [
+    '/dom/base',
+]
diff --git a/dom/base/nsScreen.cpp b/dom/base/nsScreen.cpp
index 59af10c630a..5aa1c1ff1c9 100644
--- a/dom/base/nsScreen.cpp
+++ b/dom/base/nsScreen.cpp
@@ -385,19 +385,6 @@ nsScreen::SlowMozUnlockOrientation()
   return NS_OK;
 }
 
-bool
-nsScreen::IsDeviceSizePageSize()
-{
-  nsPIDOMWindow* owner = GetOwner();
-  if (owner) {
-    nsIDocShell* docShell = owner->GetDocShell();
-    if (docShell) {
-      return docShell->GetDeviceSizeIsPageSize();
-    }
-  }
-  return false;
-}
-
 /* virtual */
 JSObject*
 nsScreen::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope)
diff --git a/dom/base/nsScreen.h b/dom/base/nsScreen.h
index a989710db35..1837e44d12c 100644
--- a/dom/base/nsScreen.h
+++ b/dom/base/nsScreen.h
@@ -51,15 +51,6 @@ public:
   int32_t GetWidth(ErrorResult& aRv)
   {
     nsRect rect;
-    if (IsDeviceSizePageSize()) {
-      nsCOMPtr<nsPIDOMWindow> owner = GetOwner();
-      if (owner) {
-        int32_t innerWidth = 0;
-        aRv = owner->GetInnerWidth(&innerWidth);
-        return innerWidth;
-      }
-    }
-
     aRv = GetRect(rect);
     return rect.width;
   }
@@ -67,15 +58,6 @@ public:
   int32_t GetHeight(ErrorResult& aRv)
   {
     nsRect rect;
-    if (IsDeviceSizePageSize()) {
-      nsCOMPtr<nsPIDOMWindow> owner = GetOwner();
-      if (owner) {
-        int32_t innerHeight = 0;
-        aRv = owner->GetInnerHeight(&innerHeight);
-        return innerHeight;
-      }
-    }
-
     aRv = GetRect(rect);
     return rect.height;
   }
@@ -155,8 +137,6 @@ private:
 
   LockPermission GetLockOrientationPermission() const;
 
-  bool IsDeviceSizePageSize();
-
   nsRefPtr<FullScreenEventListener> mEventListener;
 };
 
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index f532780afad..d4de0ee48b5 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -3505,7 +3505,12 @@ for (uint32_t i = 0; i < length; ++i) {
                 raise NoSuchDescriptorError("Can't handle member callbacks in "
                                             "workers; need to sort out rooting"
                                             "issues")
-            declType = CGGeneric("JS::Rooted<JSObject*>")
+            if isOptional:
+                # We have a specialization of Optional that will use a
+                # Rooted for the storage here.
+                declType = CGGeneric("JS::Handle<JSObject*>")
+            else:
+                declType = CGGeneric("JS::Rooted<JSObject*>")            
             conversion = "  ${declName} = &${val}.toObject();\n"
             declArgs = "cx"
         else:
diff --git a/dom/cellbroadcast/interfaces/Makefile.in b/dom/cellbroadcast/interfaces/Makefile.in
deleted file mode 100644
index e2f1f0e3373..00000000000
--- a/dom/cellbroadcast/interfaces/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/cellbroadcast/src/Makefile.in b/dom/cellbroadcast/src/Makefile.in
deleted file mode 100644
index e2f1f0e3373..00000000000
--- a/dom/cellbroadcast/src/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/file/Makefile.in b/dom/file/Makefile.in
deleted file mode 100644
index 7515f97e0f9..00000000000
--- a/dom/file/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/file/moz.build b/dom/file/moz.build
index 6e1de211437..44f536477f8 100644
--- a/dom/file/moz.build
+++ b/dom/file/moz.build
@@ -61,3 +61,6 @@ LIBXUL_LIBRARY = True
 
 LIBRARY_NAME = 'domfile_s'
 
+LOCAL_INCLUDES += [
+    '../base',
+]
diff --git a/dom/icc/interfaces/Makefile.in b/dom/icc/interfaces/Makefile.in
deleted file mode 100644
index e2f1f0e3373..00000000000
--- a/dom/icc/interfaces/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/interfaces/devicestorage/Makefile.in b/dom/interfaces/devicestorage/Makefile.in
deleted file mode 100644
index 7515f97e0f9..00000000000
--- a/dom/interfaces/devicestorage/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/messages/interfaces/Makefile.in b/dom/messages/interfaces/Makefile.in
deleted file mode 100644
index 7515f97e0f9..00000000000
--- a/dom/messages/interfaces/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/mobilemessage/interfaces/Makefile.in b/dom/mobilemessage/interfaces/Makefile.in
deleted file mode 100644
index e2f1f0e3373..00000000000
--- a/dom/mobilemessage/interfaces/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/network/interfaces/Makefile.in b/dom/network/interfaces/Makefile.in
deleted file mode 100644
index e2f1f0e3373..00000000000
--- a/dom/network/interfaces/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/promise/Makefile.in b/dom/promise/Makefile.in
deleted file mode 100644
index 95fcf427e24..00000000000
--- a/dom/promise/Makefile.in
+++ /dev/null
@@ -1,8 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES += \
-  -I$(topsrcdir)/dom/workers \
-  -I$(topsrcdir)/dom/base \
-  $(NULL)
diff --git a/dom/promise/moz.build b/dom/promise/moz.build
index 600cc09007f..c133c7ad74a 100644
--- a/dom/promise/moz.build
+++ b/dom/promise/moz.build
@@ -25,3 +25,7 @@ LIBXUL_LIBRARY = True
 
 LIBRARY_NAME = 'dompromise_s'
 
+LOCAL_INCLUDES += [
+    '../base',
+    '../workers',
+]
diff --git a/dom/src/events/Makefile.in b/dom/src/events/Makefile.in
deleted file mode 100644
index 0dbd610f6f0..00000000000
--- a/dom/src/events/Makefile.in
+++ /dev/null
@@ -1,9 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES	+= -I$(topsrcdir)/dom/base
-INCLUDES	+= -I$(topsrcdir)/content/base/src
diff --git a/dom/src/events/moz.build b/dom/src/events/moz.build
index 785d62ab299..0c2372d05c9 100644
--- a/dom/src/events/moz.build
+++ b/dom/src/events/moz.build
@@ -18,3 +18,7 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    "/content/base/src",
+    "/dom/base",
+]
diff --git a/dom/src/json/Makefile.in b/dom/src/json/Makefile.in
deleted file mode 100644
index c47d819ff4e..00000000000
--- a/dom/src/json/Makefile.in
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = \
-		-I$(srcdir)/../base \
-		-I$(topsrcdir)/content/events/src
diff --git a/dom/src/json/moz.build b/dom/src/json/moz.build
index bd6446fc606..5057d70a483 100644
--- a/dom/src/json/moz.build
+++ b/dom/src/json/moz.build
@@ -22,3 +22,6 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '/content/base/src',
+]
diff --git a/dom/src/jsurl/Makefile.in b/dom/src/jsurl/Makefile.in
deleted file mode 100644
index 54b64c69fff..00000000000
--- a/dom/src/jsurl/Makefile.in
+++ /dev/null
@@ -1,10 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES += \
-		-I$(srcdir) \
-		-I$(topsrcdir)/dom/base \
-		-I$(topsrcdir)/netwerk/base/src \
-		$(NULL)
diff --git a/dom/src/jsurl/moz.build b/dom/src/jsurl/moz.build
index d405530d6bf..5f65e824ff8 100644
--- a/dom/src/jsurl/moz.build
+++ b/dom/src/jsurl/moz.build
@@ -22,3 +22,7 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    "/dom/base",
+    "/netwerk/base/src",
+]
diff --git a/dom/src/offline/Makefile.in b/dom/src/offline/Makefile.in
deleted file mode 100644
index e1d5ab6c86b..00000000000
--- a/dom/src/offline/Makefile.in
+++ /dev/null
@@ -1,9 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = \
-		-I$(topsrcdir)/dom/base \
-		-I$(topsrcdir)/content/base/src \
-		-I$(topsrcdir)/content/events/src
diff --git a/dom/src/offline/moz.build b/dom/src/offline/moz.build
index 7dac4c99525..274b55afb8a 100644
--- a/dom/src/offline/moz.build
+++ b/dom/src/offline/moz.build
@@ -19,3 +19,8 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    "/content/base/src",
+    "/content/events/src",
+    "/dom/base",
+]
diff --git a/dom/tests/mochitest/bugs/iframe_bug440572.html b/dom/tests/mochitest/bugs/iframe_bug440572.html
index 8a2fdce05bd..8ce5ef9ff21 100644
--- a/dom/tests/mochitest/bugs/iframe_bug440572.html
+++ b/dom/tests/mochitest/bugs/iframe_bug440572.html
@@ -5,7 +5,7 @@
 var success = 0;
 
 try {
-  parent[name].success = 1;
+  SpecialPowers.unwrap(SpecialPowers.wrap(parent)[name]).success = 1;
 } catch (e) {
   parent.postMessage(e, "http://mochi.test:8888");
 }
diff --git a/dom/tests/mochitest/bugs/test_bug850517.html b/dom/tests/mochitest/bugs/test_bug850517.html
index 4ae076fd73a..40383301294 100644
--- a/dom/tests/mochitest/bugs/test_bug850517.html
+++ b/dom/tests/mochitest/bugs/test_bug850517.html
@@ -16,7 +16,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850517
   function go() {
     var ifrA = $('a');
     var ifrB = $('b');
-    var sb = new SpecialPowers.Cu.Sandbox('http://www.example.com');
+    var sb = new SpecialPowers.Cu.Sandbox(SpecialPowers.Services.scriptSecurityManager.getSystemPrincipal());
     sb.win = window;
     sb.childA = ifrA.contentWindow;
     sb.childB = ifrB.contentWindow;
@@ -26,8 +26,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850517
     SpecialPowers.Cu.evalInSandbox('is(win.theoneandonly, childA, "Named child resolution works via Xray");', sb);
     ifrA.removeAttribute('name');
     is(typeof window.theoneandonly, 'undefined', "Revocation works");
-    SpecialPowers.Cu.evalInSandbox('try { win.theoneandonly; ok(false, "Should have thrown"); } ' +
-                                   'catch (e) {ok(!!/denied/.exec(e) && !!/theoneandonly/.exec(e), "Revocation works via Xray");};', sb);
+    SpecialPowers.Cu.evalInSandbox('is(typeof win.theoneandonly, "undefined", "Revocation works via Xray");', sb);
     ifrB.setAttribute('name', 'theoneandonly');
     is(window.theoneandonly.frameElement, ifrB, "Another mule kicking in the same old stall");
     SpecialPowers.Cu.evalInSandbox('is(win.theoneandonly, childB, "Another mule via Xray");', sb);
diff --git a/dom/tests/mochitest/whatwg/postMessage_onOther.html b/dom/tests/mochitest/whatwg/postMessage_onOther.html
index dd4cf370a18..d2a6d74f7d6 100644
--- a/dom/tests/mochitest/whatwg/postMessage_onOther.html
+++ b/dom/tests/mochitest/whatwg/postMessage_onOther.html
@@ -50,6 +50,8 @@
 
     function receiveSubDomain(evt)
     {
+      var topframe =
+        SpecialPowers.unwrap(SpecialPowers.wrap(window).parent.topDomainFrame);
       if (evt.origin !== "http://mochi.test:8888")
       {
         fail("wrong top-domain origin: " + evt.origin);
@@ -62,12 +64,13 @@
       }
 
       document.domain = "example.com";
-      window.parent.topDomainFrame.postMessage("domain-switch",
-                                               "http://example.com");
+      topframe.postMessage("domain-switch", "http://example.com");
     }
     
     function receiveTopDomain(evt)
     {
+      var subframe =
+        SpecialPowers.unwrap(SpecialPowers.wrap(window).parent.subDomainFrame);
       if (evt.origin !== "http://test1.example.com")
       {
         fail("wrong subdomain origin: " + evt.origin);
@@ -78,14 +81,14 @@
         fail("wrong subdomain message: " + evt.origin);
         return;
       }
-      if (evt.source !== window.parent.subDomainFrame)
+      if (evt.source !== subframe)
       {
         fail("wrong source on message from subdomain");
         return;
       }
 
       document.domain = "example.com";
-      window.parent.subDomainFrame.testSiblingPostMessage();
+      subframe.testSiblingPostMessage();
     }
 
     function testSiblingPostMessage()
diff --git a/dom/voicemail/Makefile.in b/dom/voicemail/Makefile.in
deleted file mode 100644
index e2f1f0e3373..00000000000
--- a/dom/voicemail/Makefile.in
+++ /dev/null
@@ -1,5 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/dom/dom-config.mk
diff --git a/dom/voicemail/moz.build b/dom/voicemail/moz.build
index 8f31a41ee1b..34a59fb71da 100644
--- a/dom/voicemail/moz.build
+++ b/dom/voicemail/moz.build
@@ -28,3 +28,6 @@ LIBXUL_LIBRARY = True
 
 LIBRARY_NAME = 'domvoicemail_s'
 
+LOCAL_INCLUDES += [
+    '../base',
+]
diff --git a/dom/webidl/HTMLInputElement.webidl b/dom/webidl/HTMLInputElement.webidl
index d8cf6f33103..ba1bb610f2e 100644
--- a/dom/webidl/HTMLInputElement.webidl
+++ b/dom/webidl/HTMLInputElement.webidl
@@ -12,6 +12,13 @@
  * and create derivative works of this document.
  */
 
+enum SelectionMode {
+  "select",
+  "start",
+  "end",
+  "preserve",
+};
+
 interface nsIControllers;
 
 interface HTMLInputElement : HTMLElement {
@@ -114,8 +121,11 @@ interface HTMLInputElement : HTMLElement {
            attribute long selectionEnd;
   [Throws]
            attribute DOMString selectionDirection;
-  // Bug 850364 void setRangeText(DOMString replacement);
-  // Bug 850364 setRangeText(DOMString replacement, unsigned long start, unsigned long end, optional SelectionMode selectionMode);
+  [Throws]
+  void setRangeText(DOMString replacement);
+  [Throws]
+  void setRangeText(DOMString replacement, unsigned long start,
+    unsigned long end, optional SelectionMode selectionMode = "preserve");
 
   // also has obsolete members
 };
diff --git a/dom/workers/Makefile.in b/dom/workers/Makefile.in
deleted file mode 100644
index 36593c7eca7..00000000000
--- a/dom/workers/Makefile.in
+++ /dev/null
@@ -1,11 +0,0 @@
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = \
-  -I$(topsrcdir)/content/base/src \
-  -I$(topsrcdir)/content/events/src \
-  -I$(topsrcdir)/dom/base \
-  -I$(topsrcdir)/dom/system \
-  -I$(topsrcdir)/xpcom/build \
-  $(NULL)
diff --git a/dom/workers/moz.build b/dom/workers/moz.build
index 2166e848263..fb451be25fe 100644
--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@@ -58,3 +58,10 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '../base',
+    '../system',
+    '/content/base/src',
+    '/content/events/src',
+    '/xpcom/build',
+]
diff --git a/editor/libeditor/base/Makefile.in b/editor/libeditor/base/Makefile.in
deleted file mode 100644
index 304d81aad2b..00000000000
--- a/editor/libeditor/base/Makefile.in
+++ /dev/null
@@ -1,13 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES += \
-		-I$(topsrcdir)/editor/libeditor/text \
-		-I$(topsrcdir)/editor/txmgr/src \
-		-I$(topsrcdir)/content/base/src \
-		-I$(topsrcdir)/content/events/src \
-		-I$(topsrcdir)/layout/style \
-		-I$(topsrcdir)/extensions/spellcheck/src \
-		$(NULL)
diff --git a/editor/libeditor/base/moz.build b/editor/libeditor/base/moz.build
index 6afad0b2cf3..4415e6647be 100644
--- a/editor/libeditor/base/moz.build
+++ b/editor/libeditor/base/moz.build
@@ -39,3 +39,11 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../text',
+    '/content/base/src',
+    '/content/events/src',
+    '/editor/txmgr/src',
+    '/extensions/spellcheck/src',
+    '/layout/style',
+]
diff --git a/editor/libeditor/html/Makefile.in b/editor/libeditor/html/Makefile.in
deleted file mode 100644
index 158234971ce..00000000000
--- a/editor/libeditor/html/Makefile.in
+++ /dev/null
@@ -1,19 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES        += -I$(topsrcdir)/editor/libeditor/base \
-                   -I$(topsrcdir)/editor/libeditor/text \
-                   -I$(topsrcdir)/editor/txmgr/src \
-                   -I$(topsrcdir)/content/base/src \
-                   -I$(topsrcdir)/layout/style \
-                   $(NULL)
-
-LOCAL_INCLUDES += \
-  -I$(topsrcdir)/layout/generic \
-  -I$(topsrcdir)/layout/tables \
-  -I$(topsrcdir)/layout/xul/base/src \
-  $(null)
diff --git a/editor/libeditor/html/moz.build b/editor/libeditor/html/moz.build
index b175d014769..869085d9400 100644
--- a/editor/libeditor/html/moz.build
+++ b/editor/libeditor/html/moz.build
@@ -34,3 +34,13 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../base',
+    '../text',
+    '/content/base/src',
+    '/editor/txmgr/src',
+    '/layout/generic',
+    '/layout/style',
+    '/layout/tables',
+    '/layout/xul/base/src',
+]
diff --git a/editor/libeditor/text/Makefile.in b/editor/libeditor/text/Makefile.in
deleted file mode 100644
index bbc7083df0f..00000000000
--- a/editor/libeditor/text/Makefile.in
+++ /dev/null
@@ -1,12 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-INCLUDES	+= \
-		-I$(topsrcdir)/editor/libeditor/base \
-		-I$(topsrcdir)/editor/txmgr/src \
-		-I$(topsrcdir)/content/base/src \
-		$(NULL)
diff --git a/editor/libeditor/text/moz.build b/editor/libeditor/text/moz.build
index 0d221320b71..a1b968195ff 100644
--- a/editor/libeditor/text/moz.build
+++ b/editor/libeditor/text/moz.build
@@ -23,3 +23,8 @@ FAIL_ON_WARNINGS = True
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../base',
+    '/content/base/src',
+    '/editor/txmgr/src',
+]
diff --git a/intl/uconv/ucvcn/Makefile.in b/intl/uconv/ucvcn/Makefile.in
deleted file mode 100644
index ed7d3d8d1a3..00000000000
--- a/intl/uconv/ucvcn/Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = -I$(srcdir)/../util
diff --git a/intl/uconv/ucvcn/moz.build b/intl/uconv/ucvcn/moz.build
index 560e1cdf06e..c5afb06a3a4 100644
--- a/intl/uconv/ucvcn/moz.build
+++ b/intl/uconv/ucvcn/moz.build
@@ -25,3 +25,6 @@ LIBRARY_NAME = 'ucvcn_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../util',
+]
diff --git a/intl/uconv/ucvibm/Makefile.in b/intl/uconv/ucvibm/Makefile.in
deleted file mode 100644
index ed7d3d8d1a3..00000000000
--- a/intl/uconv/ucvibm/Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = -I$(srcdir)/../util
diff --git a/intl/uconv/ucvibm/moz.build b/intl/uconv/ucvibm/moz.build
index 8fa07f1de89..4de6f9c8efd 100644
--- a/intl/uconv/ucvibm/moz.build
+++ b/intl/uconv/ucvibm/moz.build
@@ -39,3 +39,6 @@ LIBRARY_NAME = 'ucvibm_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../util',
+]
diff --git a/intl/uconv/ucvja/Makefile.in b/intl/uconv/ucvja/Makefile.in
deleted file mode 100644
index 0ae97e27907..00000000000
--- a/intl/uconv/ucvja/Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES	= -I$(srcdir)/../util
diff --git a/intl/uconv/ucvja/moz.build b/intl/uconv/ucvja/moz.build
index 01856877541..2c479df2fe6 100644
--- a/intl/uconv/ucvja/moz.build
+++ b/intl/uconv/ucvja/moz.build
@@ -23,3 +23,6 @@ LIBRARY_NAME = 'ucvja_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../util',
+]
diff --git a/intl/uconv/ucvko/Makefile.in b/intl/uconv/ucvko/Makefile.in
deleted file mode 100644
index ed7d3d8d1a3..00000000000
--- a/intl/uconv/ucvko/Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = -I$(srcdir)/../util
diff --git a/intl/uconv/ucvko/moz.build b/intl/uconv/ucvko/moz.build
index 8a5f613eea4..96fa98d348f 100644
--- a/intl/uconv/ucvko/moz.build
+++ b/intl/uconv/ucvko/moz.build
@@ -22,3 +22,6 @@ LIBRARY_NAME = 'ucvko_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../util',
+]
diff --git a/intl/uconv/ucvlatin/Makefile.in b/intl/uconv/ucvlatin/Makefile.in
deleted file mode 100644
index d5cea2de78d..00000000000
--- a/intl/uconv/ucvlatin/Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = -I$(srcdir)/../util -I$(srcdir)/../src
diff --git a/intl/uconv/ucvlatin/moz.build b/intl/uconv/ucvlatin/moz.build
index 20ae6bfceb4..dbb98b98719 100644
--- a/intl/uconv/ucvlatin/moz.build
+++ b/intl/uconv/ucvlatin/moz.build
@@ -131,3 +131,7 @@ LIBRARY_NAME = 'ucvlatin_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../src',
+    '../util',
+]
diff --git a/intl/uconv/ucvtw/Makefile.in b/intl/uconv/ucvtw/Makefile.in
deleted file mode 100644
index ed7d3d8d1a3..00000000000
--- a/intl/uconv/ucvtw/Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES = -I$(srcdir)/../util
diff --git a/intl/uconv/ucvtw/moz.build b/intl/uconv/ucvtw/moz.build
index 17862e5bd6c..e6d4dcf0d90 100644
--- a/intl/uconv/ucvtw/moz.build
+++ b/intl/uconv/ucvtw/moz.build
@@ -22,3 +22,6 @@ LIBRARY_NAME = 'ucvtw_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../util',
+]
diff --git a/intl/uconv/ucvtw2/Makefile.in b/intl/uconv/ucvtw2/Makefile.in
deleted file mode 100644
index 0ae97e27907..00000000000
--- a/intl/uconv/ucvtw2/Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-LOCAL_INCLUDES	= -I$(srcdir)/../util
diff --git a/intl/uconv/ucvtw2/moz.build b/intl/uconv/ucvtw2/moz.build
index 9498037214e..2c9d9d15283 100644
--- a/intl/uconv/ucvtw2/moz.build
+++ b/intl/uconv/ucvtw2/moz.build
@@ -19,3 +19,6 @@ LIBRARY_NAME = 'ucvtw2_s'
 
 LIBXUL_LIBRARY = True
 
+LOCAL_INCLUDES += [
+    '../util',
+]
diff --git a/js/src/jit-test/tests/asm.js/testFloatingPoint.js b/js/src/jit-test/tests/asm.js/testFloatingPoint.js
index 67a44feaa1a..a552c41292a 100644
--- a/js/src/jit-test/tests/asm.js/testFloatingPoint.js
+++ b/js/src/jit-test/tests/asm.js/testFloatingPoint.js
@@ -90,6 +90,10 @@ var f = asmLink(asmCompile(USE_ASM + "function f(i,j) { i=i|0;j=j|0; return +(((
 assertEq(f(1,0), 0);
 assertEq(f(-Math.pow(2,31),-1), 0);
 
+var {f,g} = asmLink(asmCompile(USE_ASM + "function f() { return 3.5 } function g(d) { d=+d; return +(d+3.5) } return {f:f,g:g}"));
+assertEq(f(), 3.5);
+assertEq(g(1), 1+3.5);
+
 var buf = new ArrayBuffer(4096);
 var f64 = new Float64Array(buf);
 var i32 = new Int32Array(buf);
diff --git a/js/src/jit/AsmJS.cpp b/js/src/jit/AsmJS.cpp
index dde5ae4a814..2f84e602f37 100644
--- a/js/src/jit/AsmJS.cpp
+++ b/js/src/jit/AsmJS.cpp
@@ -1261,7 +1261,6 @@ class MOZ_STACK_CLASS ModuleCompiler
 
     char *                         errorString_;
     uint32_t                       errorOffset_;
-    uint32_t                       bodyStart_;
 
     int64_t                        usecBefore_;
     SlowFunctionVector             slowFunctions_;
@@ -1291,7 +1290,6 @@ class MOZ_STACK_CLASS ModuleCompiler
         globalAccesses_(cx),
         errorString_(NULL),
         errorOffset_(UINT32_MAX),
-        bodyStart_(parser.tokenStream.currentToken().pos.end),
         usecBefore_(PRMJ_Now()),
         slowFunctions_(cx),
         finishedFunctionBodies_(false)
@@ -1339,7 +1337,12 @@ class MOZ_STACK_CLASS ModuleCompiler
             return false;
         }
 
-        module_ = cx_->new_<AsmJSModule>();
+        // The record offset in the char buffer officially begins the char
+        // after the "use asm" processing directive statement (including any
+        // semicolon).
+        uint32_t charsBegin = parser_.tokenStream.currentToken().pos.end;
+
+        module_ = cx_->new_<AsmJSModule>(parser_.ss, charsBegin);
         if (!module_)
             return false;
 
@@ -1674,36 +1677,37 @@ class MOZ_STACK_CLASS ModuleCompiler
 #endif
     }
 
-    bool staticallyLink(ScopedJSDeletePtr<AsmJSModule> *module, ScopedJSFreePtr<char> *report) {
-        // Record the ScriptSource and [begin, end) range of the module in case
-        // the link-time validation fails in LinkAsmJS and we need to re-parse
-        // the entire module from scratch.
-        uint32_t bodyEnd = parser_.tokenStream.currentToken().pos.end;
-        module_->initSourceDesc(parser_.ss, bodyStart_, bodyEnd);
+    bool extractModule(ScopedJSDeletePtr<AsmJSModule> *module, AsmJSStaticLinkData *linkData)
+    {
+        module_->initCharsEnd(parser_.tokenStream.currentToken().pos.end);
 
-        // Finish the code section.
         masm_.finish();
         if (masm_.oom())
             return false;
 
+#if defined(JS_CPU_ARM)
+        // Now that compilation has finished, we need to update offsets to
+        // reflect actual offsets (an ARM distinction).
+        for (unsigned i = 0; i < module_->numHeapAccesses(); i++) {
+            AsmJSHeapAccess &a = module_->heapAccess(i);
+            a.setOffset(masm_.actualOffset(a.offset()));
+        }
+#endif
+
         // The returned memory is owned by module_.
-        uint8_t *code = module_->allocateCodeAndGlobalSegment(cx_, masm_.bytesNeeded());
-        if (!code)
+        if (!module_->allocateAndCopyCode(cx_, masm_))
             return false;
 
-        // Copy the buffer into executable memory (c.f. IonCode::copyFrom).
-        masm_.executableCopy(code);
-        masm_.processCodeLabels(code);
+        // c.f. IonCode::copyFrom
         JS_ASSERT(masm_.jumpRelocationTableBytes() == 0);
         JS_ASSERT(masm_.dataRelocationTableBytes() == 0);
         JS_ASSERT(masm_.preBarrierTableBytes() == 0);
         JS_ASSERT(!masm_.hasEnteredExitFrame());
 
-        // Patch everything that needs an absolute address:
-
 #ifdef JS_ION_PERF
-        // Fix up the code offsets.  Note the endCodeOffset should not be filtered through
-        // 'actualOffset' as it is generated using 'size()' rather than a label.
+        // Fix up the code offsets.  Note the endCodeOffset should not be
+        // filtered through 'actualOffset' as it is generated using 'size()'
+        // rather than a label.
         for (unsigned i = 0; i < module_->numPerfFunctions(); i++) {
             AsmJSModule::ProfiledFunction &func = module_->perfProfiledFunction(i);
             func.startCodeOffset = masm_.actualOffset(func.startCodeOffset);
@@ -1722,40 +1726,58 @@ class MOZ_STACK_CLASS ModuleCompiler
         }
 #endif
 
-        // Exit points
-        for (unsigned i = 0; i < module_->numExits(); i++) {
-            module_->exitIndexToGlobalDatum(i).exit = module_->interpExitTrampoline(module_->exit(i));
-            module_->exitIndexToGlobalDatum(i).fun = NULL;
-        }
-        module_->setOperationCallbackExit(code + masm_.actualOffset(operationCallbackLabel_.offset()));
+        // Some link information does not need to be permanently stored in the
+        // AsmJSModule since it is not needed after staticallyLink (which
+        // occurs during compilation and on cache deserialization). This link
+        // information is collected into AsmJSStaticLinkData which can then be
+        // serialized/deserialized alongside the AsmJSModule.
 
-        // Function-pointer table entries
-        for (unsigned i = 0; i < funcPtrTables_.length(); i++) {
-            FuncPtrTable &table = funcPtrTables_[i];
-            uint8_t **data = module_->globalDataOffsetToFuncPtrTable(table.globalDataOffset());
-            for (unsigned j = 0; j < table.numElems(); j++)
-                data[j] = code + masm_.actualOffset(table.elem(j).code()->offset());
+        linkData->operationCallbackExitOffset = masm_.actualOffset(operationCallbackLabel_.offset());
+
+        // CodeLabels produced during codegen
+        for (size_t i = 0; i < masm_.numCodeLabels(); i++) {
+            CodeLabel src = masm_.codeLabel(i);
+            int32_t labelOffset = src.dest()->offset();
+            int32_t targetOffset = masm_.actualOffset(src.src()->offset());
+            // The patched uses of a label embed a linked list where the
+            // to-be-patched immediate is the offset of the next to-be-patched
+            // instruction.
+            while (labelOffset != LabelBase::INVALID_OFFSET) {
+                size_t patchAtOffset = masm_.labelOffsetToPatchOffset(labelOffset);
+                AsmJSStaticLinkData::RelativeLink link;
+                link.patchAtOffset = patchAtOffset;
+                link.targetOffset = targetOffset;
+                if (!linkData->relativeLinks.append(link))
+                    return false;
+                labelOffset = *(uintptr_t *)(module_->codeBase() + patchAtOffset);
+            }
         }
 
-        // Fix up heap/global accesses now that compilation has finished
-#ifdef JS_CPU_ARM
-        // The AsmJSHeapAccess offsets need to be updated to reflect the
-        // "actualOffset" (an ARM distinction).
-        for (unsigned i = 0; i < module_->numHeapAccesses(); i++) {
-            AsmJSHeapAccess &a = module_->heapAccess(i);
-            a.setOffset(masm_.actualOffset(a.offset()));
+        // Function-pointer-table entries
+        for (unsigned tableIndex = 0; tableIndex < funcPtrTables_.length(); tableIndex++) {
+            FuncPtrTable &table = funcPtrTables_[tableIndex];
+            unsigned tableBaseOffset = module_->offsetOfGlobalData() + table.globalDataOffset();
+            for (unsigned elemIndex = 0; elemIndex < table.numElems(); elemIndex++) {
+                AsmJSStaticLinkData::RelativeLink link;
+                link.patchAtOffset = tableBaseOffset + elemIndex * sizeof(uint8_t*);
+                link.targetOffset = masm_.actualOffset(table.elem(elemIndex).code()->offset());
+                if (!linkData->relativeLinks.append(link))
+                    return false;
+            }
         }
-        JS_ASSERT(globalAccesses_.length() == 0);
-#else
+
+        // Global-data-section accesses
+#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
+        uint8_t *code = module_->codeBase();
         for (unsigned i = 0; i < globalAccesses_.length(); i++) {
             AsmJSGlobalAccess a = globalAccesses_[i];
             masm_.patchAsmJSGlobalAccess(a.offset, code, module_->globalData(), a.globalDataOffset);
         }
+#else
+        JS_ASSERT(globalAccesses_.empty());
 #endif
 
         *module = module_.forget();
-
-        buildCompilationTimeReport(report);
         return true;
     }
 };
@@ -6371,7 +6393,7 @@ GenerateStubs(ModuleCompiler &m)
 static bool
 FinishModule(ModuleCompiler &m,
              ScopedJSDeletePtr<AsmJSModule> *module,
-             ScopedJSFreePtr<char> *compilationTimeReport)
+             AsmJSStaticLinkData *linkData)
 {
     LifoAlloc lifo(LIFO_ALLOC_PRIMARY_CHUNK_SIZE);
     TempAllocator alloc(&lifo);
@@ -6380,7 +6402,7 @@ FinishModule(ModuleCompiler &m,
     if (!GenerateStubs(m))
         return false;
 
-    return m.staticallyLink(module, compilationTimeReport);
+    return m.extractModule(module, linkData);
 }
 
 static bool
@@ -6435,7 +6457,14 @@ CheckModule(ExclusiveContext *cx, AsmJSParser &parser, ParseNode *stmtList,
     if (tk != TOK_EOF && tk != TOK_RC)
         return m.fail(NULL, "top-level export (return) must be the last statement");
 
-    return FinishModule(m, module, compilationTimeReport);
+    AsmJSStaticLinkData linkData(cx);
+    if (!FinishModule(m, module, &linkData))
+        return false;
+
+    (*module)->staticallyLink(linkData);
+
+    m.buildCompilationTimeReport(compilationTimeReport);
+    return true;
 }
 
 static bool
diff --git a/js/src/jit/AsmJSLink.cpp b/js/src/jit/AsmJSLink.cpp
index c895bca508c..1a1e37b5420 100644
--- a/js/src/jit/AsmJSLink.cpp
+++ b/js/src/jit/AsmJSLink.cpp
@@ -409,9 +409,9 @@ HandleDynamicLinkFailure(JSContext *cx, CallArgs args, AsmJSModule &module, Hand
     if (cx->isExceptionPending())
         return false;
 
-    const AsmJSModuleSourceDesc &desc= module.sourceDesc();
-    uint32_t length = desc.bufEnd() - desc.bufStart();
-    Rooted<JSStableString*> src(cx, desc.scriptSource()->substring(cx, desc.bufStart(), desc.bufEnd()));
+    uint32_t begin = module.charsBegin();
+    uint32_t end = module.charsEnd();
+    Rooted<JSStableString*> src(cx, module.scriptSource()->substring(cx, begin, end));
     if (!src)
         return false;
 
@@ -432,11 +432,11 @@ HandleDynamicLinkFailure(JSContext *cx, CallArgs args, AsmJSModule &module, Hand
 
     CompileOptions options(cx);
     options.setPrincipals(cx->compartment()->principals)
-           .setOriginPrincipals(desc.scriptSource()->originPrincipals())
+           .setOriginPrincipals(module.scriptSource()->originPrincipals())
            .setCompileAndGo(false)
            .setNoScriptRval(false);
 
-    if (!frontend::CompileFunctionBody(cx, &fun, options, formals, src->chars().get(), length))
+    if (!frontend::CompileFunctionBody(cx, &fun, options, formals, src->chars().get(), end - begin))
         return false;
 
     // Call the function we just recompiled.
@@ -464,7 +464,7 @@ HandleDynamicLinkFailure(JSContext *cx, CallArgs args, AsmJSModule &module, Hand
 static bool
 SendFunctionsToVTune(JSContext *cx, AsmJSModule &module)
 {
-    uint8_t *base = module.functionCode();
+    uint8_t *base = module.codeBase();
 
     for (unsigned i = 0; i < module.numProfiledFunctions(); i++) {
         const AsmJSModule::ProfiledFunction &func = module.profiledFunction(i);
@@ -507,8 +507,8 @@ SendFunctionsToPerf(JSContext *cx, AsmJSModule &module)
     if (!PerfFuncEnabled())
         return true;
 
-    uintptr_t base = (uintptr_t) module.functionCode();
-    const char *filename = module.sourceDesc().scriptSource()->filename();
+    uintptr_t base = (uintptr_t) module.codeBase();
+    const char *filename = module.scriptSource()->filename();
 
     for (unsigned i = 0; i < module.numPerfFunctions(); i++) {
         const AsmJSModule::ProfiledFunction &func = module.perfProfiledFunction(i);
@@ -534,8 +534,8 @@ SendBlocksToPerf(JSContext *cx, AsmJSModule &module)
     if (!PerfBlockEnabled())
         return true;
 
-    unsigned long funcBaseAddress = (unsigned long) module.functionCode();
-    const char *filename = module.sourceDesc().scriptSource()->filename();
+    unsigned long funcBaseAddress = (unsigned long) module.codeBase();
+    const char *filename = module.scriptSource()->filename();
 
     for (unsigned i = 0; i < module.numPerfBlocksFunctions(); i++) {
         const AsmJSModule::ProfiledBlocksFunction &func = module.perfProfiledBlocksFunction(i);
diff --git a/js/src/jit/AsmJSModule.cpp b/js/src/jit/AsmJSModule.cpp
index 4df4c06f3e6..e66fcde1743 100644
--- a/js/src/jit/AsmJSModule.cpp
+++ b/js/src/jit/AsmJSModule.cpp
@@ -20,6 +20,7 @@
 #include "jsobjinlines.h"
 
 using namespace js;
+using namespace jit;
 
 void
 AsmJSModule::initHeap(Handle<ArrayBufferObject*> heap, JSContext *cx)
@@ -79,21 +80,21 @@ static void
 DeallocateExecutableMemory(uint8_t *code, size_t totalBytes)
 {
 #ifdef XP_WIN
-        JS_ALWAYS_TRUE(VirtualFree(code, 0, MEM_RELEASE));
+    JS_ALWAYS_TRUE(VirtualFree(code, 0, MEM_RELEASE));
 #else
-        JS_ALWAYS_TRUE(munmap(code, totalBytes) == 0);
+    JS_ALWAYS_TRUE(munmap(code, totalBytes) == 0);
 #endif
 }
 
-uint8_t *
-AsmJSModule::allocateCodeAndGlobalSegment(ExclusiveContext *cx, size_t bytesNeeded)
+bool
+AsmJSModule::allocateAndCopyCode(ExclusiveContext *cx, MacroAssembler &masm)
 {
     JS_ASSERT(!code_);
 
     // The global data section sits immediately after the executable (and
     // other) data allocated by the MacroAssembler, so ensure it is
     // double-aligned.
-    pod.codeBytes_ = AlignBytes(bytesNeeded, sizeof(double));
+    pod.codeBytes_ = AlignBytes(masm.bytesNeeded(), sizeof(double));
 
     // The entire region is allocated via mmap/VirtualAlloc which requires
     // units of pages.
@@ -101,14 +102,52 @@ AsmJSModule::allocateCodeAndGlobalSegment(ExclusiveContext *cx, size_t bytesNeed
 
     code_ = AllocateExecutableMemory(cx, pod.totalBytes_);
     if (!code_)
-        return NULL;
+        return false;
 
     JS_ASSERT(uintptr_t(code_) % AsmJSPageSize == 0);
-    return code_;
+    masm.executableCopy(code_);
+    return true;
+}
+
+void
+AsmJSModule::staticallyLink(const AsmJSStaticLinkData &linkData)
+{
+    // Process AsmJSStaticLinkData:
+
+    operationCallbackExit_ = code_ + linkData.operationCallbackExitOffset;
+
+    for (size_t i = 0; i < linkData.relativeLinks.length(); i++) {
+        AsmJSStaticLinkData::RelativeLink link = linkData.relativeLinks[i];
+        *(void **)(code_ + link.patchAtOffset) = code_ + link.targetOffset;
+    }
+
+    // Initialize global data segment
+
+    for (size_t i = 0; i < exits_.length(); i++) {
+        exitIndexToGlobalDatum(i).exit = interpExitTrampoline(exits_[i]);
+        exitIndexToGlobalDatum(i).fun = NULL;
+    }
+}
+
+AsmJSModule::AsmJSModule(ScriptSource *scriptSource, uint32_t charsBegin)
+  : globalArgumentName_(NULL),
+    importArgumentName_(NULL),
+    bufferArgumentName_(NULL),
+    minHeapLength_(AsmJSAllocationGranularity),
+    code_(NULL),
+    operationCallbackExit_(NULL),
+    linked_(false),
+    charsBegin_(charsBegin),
+    scriptSource_(scriptSource)
+{
+    mozilla::PodZero(&pod);
+    scriptSource_->incref();
 }
 
 AsmJSModule::~AsmJSModule()
 {
+    scriptSource_->decref();
+
     if (code_) {
         for (unsigned i = 0; i < numExits(); i++) {
             AsmJSModule::ExitDatum &exitDatum = exitIndexToGlobalDatum(i);
diff --git a/js/src/jit/AsmJSModule.h b/js/src/jit/AsmJSModule.h
index 544084174cc..35ed0969315 100644
--- a/js/src/jit/AsmJSModule.h
+++ b/js/src/jit/AsmJSModule.h
@@ -38,6 +38,30 @@ enum AsmJSMathBuiltin
     AsmJSMathBuiltin_abs, AsmJSMathBuiltin_atan2, AsmJSMathBuiltin_imul
 };
 
+// Static-link data is used to patch a module either after it has been
+// compiled or deserialized with various absolute addresses (of code or
+// data in the process) or relative addresses (of code or data in the same
+// AsmJSModule). Since AsmJSStaticLinkData can be serialized alongside the
+// AsmJSModule and isn't needed after compilation/deserialization, it
+// doesn't need to be stored in the AsmJSModule.
+struct AsmJSStaticLinkData
+{
+    struct RelativeLink
+    {
+        uint32_t patchAtOffset;
+        uint32_t targetOffset;
+    };
+
+    typedef Vector<RelativeLink> RelativeLinkVector;
+
+    size_t operationCallbackExitOffset;
+    RelativeLinkVector relativeLinks;
+
+    AsmJSStaticLinkData(ExclusiveContext *cx)
+      : relativeLinks(cx)
+    {}
+};
+
 // An asm.js module represents the collection of functions nested inside a
 // single outer "use asm" function. For example, this asm.js module:
 //   function() { "use asm"; function f() {} function g() {} return f }
@@ -327,6 +351,7 @@ class AsmJSModule
 #endif
 
     struct Pod {
+        uint32_t                          charsLength_;
         uint32_t                          numGlobalVars_;
         uint32_t                          numFFIs_;
         size_t                            funcPtrTableAndExitBytes_;
@@ -342,22 +367,13 @@ class AsmJSModule
     bool                                  linked_;
     HeapPtr<ArrayBufferObject>            maybeHeap_;
 
-    AsmJSModuleSourceDesc                 sourceDesc_;
+    uint32_t                              charsBegin_;
+    ScriptSource *                        scriptSource_;
+
     FunctionCountsVector                  functionCounts_;
 
   public:
-    explicit AsmJSModule()
-      : globalArgumentName_(NULL),
-        importArgumentName_(NULL),
-        bufferArgumentName_(NULL),
-        minHeapLength_(AsmJSAllocationGranularity),
-        code_(NULL),
-        operationCallbackExit_(NULL),
-        linked_(false)
-    {
-        mozilla::PodZero(&pod);
-    }
-
+    explicit AsmJSModule(ScriptSource *scriptSource, uint32_t charsBegin);
     ~AsmJSModule();
 
     void trace(JSTracer *trc) {
@@ -390,6 +406,21 @@ class AsmJSModule
             MarkStringUnbarriered(trc, &bufferArgumentName_, "asm.js buffer argument name");
     }
 
+    ScriptSource *scriptSource() const {
+        JS_ASSERT(scriptSource_ != NULL);
+        return scriptSource_;
+    }
+    uint32_t charsBegin() const {
+        return charsBegin_;
+    }
+    void initCharsEnd(uint32_t charsEnd) {
+        JS_ASSERT(charsEnd >= charsBegin_);
+        pod.charsLength_ = charsEnd - charsBegin_;
+    }
+    uint32_t charsEnd() const {
+        return charsBegin_ + pod.charsLength_;
+    }
+
     bool addGlobalVarInitConstant(const Value &v, uint32_t *globalIndex) {
         JS_ASSERT(pod.funcPtrTableAndExitBytes_ == 0);
         if (pod.numGlobalVars_ == UINT32_MAX)
@@ -568,11 +599,13 @@ class AsmJSModule
     //   2. interleaved function-pointer tables and exits. These are allocated
     //      while type checking function bodies (as exits and uses of
     //      function-pointer tables are encountered).
-    uint8_t *globalData() const {
+    size_t offsetOfGlobalData() const {
         JS_ASSERT(code_);
-        return code_ + pod.codeBytes_;
+        return pod.codeBytes_;
+    }
+    uint8_t *globalData() const {
+        return code_ + offsetOfGlobalData();
     }
-
     size_t globalDataBytes() const {
         return sizeof(void*) +
                pod.numGlobalVars_ * sizeof(uint64_t) +
@@ -614,8 +647,7 @@ class AsmJSModule
         return pod.functionBytes_;
     }
     bool containsPC(void *pc) const {
-        uint8_t *code = functionCode();
-        return pc >= code && pc < (code + functionBytes());
+        return pc >= code_ && pc < (code_ + functionBytes());
     }
 
     bool addHeapAccesses(const jit::AsmJSHeapAccessVector &accesses) {
@@ -640,17 +672,15 @@ class AsmJSModule
         return minHeapLength_;
     }
 
-    uint8_t *allocateCodeAndGlobalSegment(ExclusiveContext *cx, size_t bytesNeeded);
+    bool allocateAndCopyCode(ExclusiveContext *cx, jit::MacroAssembler &masm);
+    void staticallyLink(const AsmJSStaticLinkData &linkData);
 
-    uint8_t *functionCode() const {
+    uint8_t *codeBase() const {
         JS_ASSERT(code_);
         JS_ASSERT(uintptr_t(code_) % AsmJSPageSize == 0);
         return code_;
     }
 
-    void setOperationCallbackExit(uint8_t *ptr) {
-        operationCallbackExit_ = ptr;
-    }
     uint8_t *operationCallbackExit() const {
         return operationCallbackExit_;
     }
@@ -694,13 +724,6 @@ class AsmJSModule
         return bufferArgumentName_;
     }
 
-    void initSourceDesc(ScriptSource *scriptSource, uint32_t bufStart, uint32_t bufEnd) {
-        sourceDesc_.init(scriptSource, bufStart, bufEnd);
-    }
-    const AsmJSModuleSourceDesc &sourceDesc() const {
-        return sourceDesc_;
-    }
-
     void detachIonCompilation(size_t exitIndex) const {
         exitIndexToGlobalDatum(exitIndex).exit = interpExitTrampoline(exit(exitIndex));
     }
diff --git a/js/src/jit/AsmJSSignalHandlers.cpp b/js/src/jit/AsmJSSignalHandlers.cpp
index fd3e50eb6f6..9ba748b6fce 100644
--- a/js/src/jit/AsmJSSignalHandlers.cpp
+++ b/js/src/jit/AsmJSSignalHandlers.cpp
@@ -268,7 +268,7 @@ static const AsmJSHeapAccess *
 LookupHeapAccess(const AsmJSModule &module, uint8_t *pc)
 {
     JS_ASSERT(module.containsPC(pc));
-    size_t targetOffset = pc - module.functionCode();
+    size_t targetOffset = pc - module.codeBase();
 
     if (module.numHeapAccesses() == 0)
         return NULL;
@@ -489,7 +489,7 @@ HandleException(PEXCEPTION_POINTERS exception)
         activation->setResumePC(pc);
         *ppc = module.operationCallbackExit();
         DWORD oldProtect;
-        if (!VirtualProtect(module.functionCode(), module.functionBytes(), PAGE_EXECUTE, &oldProtect))
+        if (!VirtualProtect(module.codeBase(), module.functionBytes(), PAGE_EXECUTE, &oldProtect))
             MOZ_CRASH();
         return true;
     }
@@ -685,7 +685,7 @@ HandleMachException(JSRuntime *rt, const ExceptionRequest &request)
     if (module.containsPC(faultingAddress)) {
         activation->setResumePC(pc);
         *ppc = module.operationCallbackExit();
-        mprotect(module.functionCode(), module.functionBytes(), PROT_EXEC);
+        mprotect(module.codeBase(), module.functionBytes(), PROT_EXEC);
 
         // Update the thread state with the new pc.
         kret = thread_set_state(rtThread, x86_THREAD_STATE, (thread_state_t)&state, x86_THREAD_STATE_COUNT);
@@ -919,7 +919,7 @@ HandleSignal(int signum, siginfo_t *info, void *ctx)
     if (module.containsPC(faultingAddress)) {
         activation->setResumePC(pc);
         *ppc = module.operationCallbackExit();
-        mprotect(module.functionCode(), module.functionBytes(), PROT_EXEC);
+        mprotect(module.codeBase(), module.functionBytes(), PROT_EXEC);
         return true;
     }
 
@@ -1040,10 +1040,10 @@ js::TriggerOperationCallbackForAsmJSCode(JSRuntime *rt)
 
 #if defined(XP_WIN)
     DWORD oldProtect;
-    if (!VirtualProtect(module.functionCode(), module.functionBytes(), PAGE_NOACCESS, &oldProtect))
+    if (!VirtualProtect(module.codeBase(), module.functionBytes(), PAGE_NOACCESS, &oldProtect))
         MOZ_CRASH();
 #else  // assume Unix
-    if (mprotect(module.functionCode(), module.functionBytes(), PROT_NONE))
+    if (mprotect(module.codeBase(), module.functionBytes(), PROT_NONE))
         MOZ_CRASH();
 #endif
 }
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index d568cbd658c..c73c8da8204 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -4817,6 +4817,16 @@ ICSetElem_Fallback::Compiler::generateStubCode(MacroAssembler &masm)
     return tailCallVM(DoSetElemFallbackInfo, masm);
 }
 
+void
+BaselineScript::noteArrayWriteHole(uint32_t pcOffset)
+{
+    ICEntry &entry = icEntryFromPCOffset(pcOffset);
+    ICFallbackStub *stub = entry.fallbackStub();
+
+    if (stub->isSetElem_Fallback())
+        stub->toSetElem_Fallback()->noteArrayWriteHole();
+}
+
 //
 // SetElem_Dense
 //
diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h
index d197005f2c3..3f10c72d4d8 100644
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -3375,6 +3375,13 @@ class ICSetElem_Fallback : public ICFallbackStub
         return space->allocate<ICSetElem_Fallback>(code);
     }
 
+    void noteArrayWriteHole() {
+        extra_ = 1;
+    }
+    bool hasArrayWriteHole() const {
+        return extra_;
+    }
+
     // Compiler for this stub kind.
     class Compiler : public ICStubCompiler {
       protected:
diff --git a/js/src/jit/BaselineInspector.cpp b/js/src/jit/BaselineInspector.cpp
index 25a880ffa3b..4f427bbd2e9 100644
--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -26,6 +26,12 @@ SetElemICInspector::sawOOBDenseWrite() const
         if (stub->isSetElem_DenseAdd())
             return true;
     }
+
+    // Check for a write hole bit on the SetElem_Fallback stub.
+    ICStub *stub = icEntry_->fallbackStub();
+    if (stub->isSetElem_Fallback())
+        return stub->toSetElem_Fallback()->hasArrayWriteHole();
+
     return false;
 }
 
diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h
index fc892a5b395..15a58650101 100644
--- a/js/src/jit/BaselineJIT.h
+++ b/js/src/jit/BaselineJIT.h
@@ -267,6 +267,7 @@ struct BaselineScript
     void toggleSPS(bool enable);
 
     void noteAccessedGetter(uint32_t pcOffset);
+    void noteArrayWriteHole(uint32_t pcOffset);
 
     static size_t offsetOfFlags() {
         return offsetof(BaselineScript, flags_);
diff --git a/js/src/jit/BytecodeAnalysis.cpp b/js/src/jit/BytecodeAnalysis.cpp
index eb7a88697ec..e7dd8a55bd8 100644
--- a/js/src/jit/BytecodeAnalysis.cpp
+++ b/js/src/jit/BytecodeAnalysis.cpp
@@ -15,7 +15,9 @@ using namespace js::jit;
 
 BytecodeAnalysis::BytecodeAnalysis(JSScript *script)
   : script_(script),
-    infos_()
+    infos_(),
+    usesScopeChain_(false),
+    hasTryFinally_(false)
 {
 }
 
@@ -144,6 +146,26 @@ BytecodeAnalysis::init(JSContext *cx)
             }
             break;
 
+          case JSOP_NAME:
+          case JSOP_CALLNAME:
+          case JSOP_BINDNAME:
+          case JSOP_SETNAME:
+          case JSOP_DELNAME:
+          case JSOP_GETALIASEDVAR:
+          case JSOP_CALLALIASEDVAR:
+          case JSOP_SETALIASEDVAR:
+          case JSOP_LAMBDA:
+          case JSOP_DEFFUN:
+          case JSOP_DEFVAR:
+          case JSOP_DEFCONST:
+          case JSOP_SETCONST:
+            usesScopeChain_ = true;
+            break;
+
+          case JSOP_FINALLY:
+            hasTryFinally_ = true;
+            break;
+
           default:
             break;
         }
diff --git a/js/src/jit/BytecodeAnalysis.h b/js/src/jit/BytecodeAnalysis.h
index c6e457dc0d3..275a6753e0b 100644
--- a/js/src/jit/BytecodeAnalysis.h
+++ b/js/src/jit/BytecodeAnalysis.h
@@ -39,6 +39,9 @@ class BytecodeAnalysis
     JSScript *script_;
     Vector<BytecodeInfo, 0, IonAllocPolicy> infos_;
 
+    bool usesScopeChain_;
+    bool hasTryFinally_;
+
   public:
     explicit BytecodeAnalysis(JSScript *script);
 
@@ -54,6 +57,14 @@ class BytecodeAnalysis
             return &infos_[pc - script_->code];
         return NULL;
     }
+
+    bool usesScopeChain() {
+        return usesScopeChain_;
+    }
+
+    bool hasTryFinally() {
+        return hasTryFinally_;
+    }
 };
 
 
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 8e84755c22c..dfd057fb30e 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1355,12 +1355,10 @@ CodeGenerator::visitTypeBarrierV(LTypeBarrierV *lir)
     ValueOperand operand = ToValue(lir, LTypeBarrierV::Input);
     Register scratch = ToTempRegisterOrInvalid(lir->temp());
 
-    Label matched, miss;
-    masm.guardTypeSet(operand, lir->mir()->resultTypeSet(), scratch, &matched, &miss);
-    masm.jump(&miss);
+    Label miss;
+    masm.guardTypeSet(operand, lir->mir()->resultTypeSet(), scratch, &miss);
     if (!bailoutFrom(&miss, lir->snapshot()))
         return false;
-    masm.bind(&matched);
     return true;
 }
 
@@ -1370,12 +1368,10 @@ CodeGenerator::visitTypeBarrierO(LTypeBarrierO *lir)
     Register obj = ToRegister(lir->object());
     Register scratch = ToTempRegisterOrInvalid(lir->temp());
 
-    Label matched, miss;
-    masm.guardObjectType(obj, lir->mir()->resultTypeSet(), scratch, &matched, &miss);
-    masm.jump(&miss);
+    Label miss;
+    masm.guardObjectType(obj, lir->mir()->resultTypeSet(), scratch, &miss);
     if (!bailoutFrom(&miss, lir->snapshot()))
         return false;
-    masm.bind(&matched);
     return true;
 }
 
@@ -1386,11 +1382,9 @@ CodeGenerator::visitMonitorTypes(LMonitorTypes *lir)
     Register scratch = ToTempUnboxRegister(lir->temp());
 
     Label matched, miss;
-    masm.guardTypeSet(operand, lir->mir()->typeSet(), scratch, &matched, &miss);
-    masm.jump(&miss);
+    masm.guardTypeSet(operand, lir->mir()->typeSet(), scratch, &miss);
     if (!bailoutFrom(&miss, lir->snapshot()))
         return false;
-    masm.bind(&matched);
     return true;
 }
 
@@ -2321,10 +2315,7 @@ CodeGenerator::generateArgumentsChecks()
         // ... * sizeof(Value)          - Scale by value size.
         // ArgToStackOffset(...)        - Compute displacement within arg vector.
         int32_t offset = ArgToStackOffset((i - info.startArgSlot()) * sizeof(Value));
-        Label matched;
-        masm.guardTypeSet(Address(StackPointer, offset), types, temp, &matched, &miss);
-        masm.jump(&miss);
-        masm.bind(&matched);
+        masm.guardTypeSet(Address(StackPointer, offset), types, temp, &miss);
     }
 
     if (miss.used() && !bailoutFrom(&miss, graph.entrySnapshot()))
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 2cc61bb0451..db049b00aae 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -1606,9 +1606,6 @@ IonCompile(JSContext *cx, JSScript *script,
                         script);
 #endif
 
-    if (!script->ensureRanAnalysis(cx))
-        return AbortReason_Alloc;
-
     LifoAlloc *alloc = cx->new_<LifoAlloc>(BUILDER_LIFO_ALLOC_PRIMARY_CHUNK_SIZE);
     if (!alloc)
         return AbortReason_Alloc;
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index cc8afb64a63..a0cfc43272c 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -42,6 +42,7 @@ IonBuilder::IonBuilder(JSContext *cx, TempAllocator *temp, MIRGraph *graph,
     cx(cx),
     baselineFrame_(baselineFrame),
     abortReason_(AbortReason_Disable),
+    analysis_(info->script()),
     loopDepth_(loopDepth),
     callerResumePoint_(NULL),
     callerBuilder_(NULL),
@@ -229,14 +230,14 @@ IonBuilder::canEnterInlinedFunction(JSFunction *target)
     if (target->isHeavyweight())
         return false;
 
-    RootedScript targetScript(cx, target->nonLazyScript());
-
-    if (!targetScript->ensureRanAnalysis(cx))
-        return false;
+    JSScript *targetScript = target->nonLazyScript();
 
     if (targetScript->uninlineable)
         return false;
 
+    if (!targetScript->analyzedArgsUsage())
+        return false;
+
     if (targetScript->needsArgsObj())
         return false;
 
@@ -273,7 +274,7 @@ IonBuilder::canInlineTarget(JSFunction *target, bool constructing)
         return false;
     }
 
-    RootedScript inlineScript(cx, target->nonLazyScript());
+    JSScript *inlineScript = target->nonLazyScript();
     ExecutionMode executionMode = info().executionMode();
     if (!CanIonCompile(inlineScript, executionMode)) {
         IonSpew(IonSpew_Inlining, "%s:%d Cannot inline due to disable Ion compilation",
@@ -370,7 +371,7 @@ IonBuilder::analyzeNewLoopTypes(MBasicBlock *entry, jsbytecode *start, jsbytecod
             continue;
         if (slot >= info().firstStackSlot())
             continue;
-        if (!script()->analysis()->maybeCode(pc))
+        if (!analysis().maybeInfo(pc))
             continue;
 
         MPhi *phi = entry->getSlot(slot)->toPhi();
@@ -491,11 +492,23 @@ IonBuilder::pushLoop(CFGState::State initial, jsbytecode *stopAt, MBasicBlock *e
 }
 
 bool
-IonBuilder::build()
+IonBuilder::init()
 {
     if (!script()->ensureHasBytecodeTypeMap(cx))
         return false;
 
+    if (!analysis().init(cx))
+        return false;
+
+    return true;
+}
+
+bool
+IonBuilder::build()
+{
+    if (!init())
+        return false;
+
     setCurrentAndSpecializePhis(newBlock(pc));
     if (!current)
         return false;
@@ -633,11 +646,11 @@ bool
 IonBuilder::buildInline(IonBuilder *callerBuilder, MResumePoint *callerResumePoint,
                         CallInfo &callInfo)
 {
-    inlineCallInfo_ = &callInfo;
-
-    if (!script()->ensureHasBytecodeTypeMap(cx))
+    if (!init())
         return false;
 
+    inlineCallInfo_ = &callInfo;
+
     IonSpew(IonSpew_Scripts, "Inlining script %s:%d (%p)",
             script()->filename(), script()->lineno, (void *)script());
 
@@ -842,7 +855,7 @@ IonBuilder::initScopeChain(MDefinition *callee)
     // from earlier.  However, always make a scope chain when |needsArgsObj| is true
     // for the script, since arguments object construction requires the scope chain
     // to be passed in.
-    if (!info().needsArgsObj() && !script()->analysis()->usesScopeChain())
+    if (!info().needsArgsObj() && !analysis().usesScopeChain())
         return true;
 
     // The scope chain is only tracked in scripts that have NAME opcodes which
@@ -1438,21 +1451,15 @@ IonBuilder::inspectOpcode(JSOp op)
         return true;
 
       case JSOP_NEWINIT:
-      {
         if (GET_UINT8(pc) == JSProto_Array)
             return jsop_newarray(0);
-        RootedObject baseObj(cx, NULL);
-        return jsop_newobject(baseObj);
-      }
+        return jsop_newobject(NULL);
 
       case JSOP_NEWARRAY:
         return jsop_newarray(GET_UINT24(pc));
 
       case JSOP_NEWOBJECT:
-      {
-        RootedObject baseObj(cx, info().getObject(pc));
-        return jsop_newobject(baseObj);
-      }
+        return jsop_newobject(info().getObject(pc));
 
       case JSOP_INITELEM:
         return jsop_initelem();
@@ -1462,7 +1469,7 @@ IonBuilder::inspectOpcode(JSOp op)
 
       case JSOP_INITPROP:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
         return jsop_initprop(name);
       }
 
@@ -1501,8 +1508,8 @@ IonBuilder::inspectOpcode(JSOp op)
       case JSOP_GETGNAME:
       case JSOP_CALLGNAME:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
-        RootedObject obj(cx, &script()->global());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
+        JSObject *obj = &script()->global();
         bool succeeded;
         if (!getStaticName(obj, name, &succeeded))
             return false;
@@ -1514,22 +1521,22 @@ IonBuilder::inspectOpcode(JSOp op)
 
       case JSOP_SETGNAME:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
-        RootedObject obj(cx, &script()->global());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
+        JSObject *obj = &script()->global();
         return setStaticName(obj, name);
       }
 
       case JSOP_NAME:
       case JSOP_CALLNAME:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
         return jsop_getname(name);
       }
 
       case JSOP_GETINTRINSIC:
       case JSOP_CALLINTRINSIC:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
         return jsop_intrinsic(name);
       }
 
@@ -1601,20 +1608,20 @@ IonBuilder::inspectOpcode(JSOp op)
       case JSOP_GETPROP:
       case JSOP_CALLPROP:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
         return jsop_getprop(name);
       }
 
       case JSOP_SETPROP:
       case JSOP_SETNAME:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
         return jsop_setprop(name);
       }
 
       case JSOP_DELPROP:
       {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
+        PropertyName *name = info().getAtom(pc)->asPropertyName();
         return jsop_delprop(name);
       }
 
@@ -3361,7 +3368,7 @@ IonBuilder::jsop_try()
         return abort("Try-catch support disabled");
 
     // Try-finally is not yet supported.
-    if (script()->analysis()->hasTryFinally())
+    if (analysis().hasTryFinally())
         return abort("Has try-finally");
 
     // Try-catch within inline frames is not yet supported.
@@ -3407,7 +3414,7 @@ IonBuilder::jsop_try()
         return false;
 
     MBasicBlock *successor;
-    if (script()->analysis()->maybeCode(afterTry)) {
+    if (analysis().maybeInfo(afterTry)) {
         successor = newBlock(current, afterTry);
         if (!successor)
             return false;
@@ -3732,8 +3739,7 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
 
     // Create new |this| on the caller-side for inlined constructors.
     if (callInfo.constructing()) {
-        RootedFunction targetRoot(cx, target);
-        MDefinition *thisDefn = createThis(targetRoot, callInfo.fun());
+        MDefinition *thisDefn = createThis(target, callInfo.fun());
         if (!thisDefn)
             return false;
         callInfo.setThis(thisDefn);
@@ -3751,11 +3757,14 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
     callInfo.popFormals(current);
     current->push(callInfo.fun());
 
-    RootedScript calleeScript(cx, target->nonLazyScript());
-    BaselineInspector inspector(cx, target->nonLazyScript());
+    JSScript *calleeScript = target->nonLazyScript();
+    BaselineInspector inspector(cx, calleeScript);
 
     // Improve type information of |this| when not set.
-    if (callInfo.constructing() && !callInfo.thisArg()->resultTypeSet()) {
+    if (callInfo.constructing() &&
+        !callInfo.thisArg()->resultTypeSet() &&
+        calleeScript->types)
+    {
         types::StackTypeSet *types = types::TypeScript::ThisTypes(calleeScript);
         if (!types->unknown()) {
             MTypeBarrier *barrier = MTypeBarrier::New(callInfo.thisArg(), cloneTypeSet(types), Bailout_Normal);
@@ -3766,7 +3775,7 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
 
     // Start inlining.
     LifoAlloc *alloc = GetIonContext()->temp->lifoAlloc();
-    CompileInfo *info = alloc->new_<CompileInfo>(calleeScript.get(), target,
+    CompileInfo *info = alloc->new_<CompileInfo>(calleeScript, target,
                                                  (jsbytecode *)NULL, callInfo.constructing(),
                                                  this->info().executionMode());
     if (!info)
@@ -3780,7 +3789,6 @@ IonBuilder::inlineScriptedCall(CallInfo &callInfo, JSFunction *target)
     IonBuilder inlineBuilder(cx, &temp(), &graph(), &inspector, info, NULL,
                              inliningDepth_ + 1, loopDepth_);
     if (!inlineBuilder.buildInline(this, outerResumePoint, callInfo)) {
-        JS_ASSERT(calleeScript->hasAnalysis());
         if (cx->isExceptionPending()) {
             IonSpew(IonSpew_Abort, "Inline builder raised exception.");
             abortReason_ = AbortReason_Error;
@@ -3938,7 +3946,7 @@ IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
             return false;
         }
 
-        if (targetScript->analysis()->hasLoops()) {
+        if (targetScript->hasLoops()) {
             IonSpew(IonSpew_Inlining, "%s:%d - Vetoed: big function that contains a loop",
                                       targetScript->filename(), targetScript->lineno);
             return false;
@@ -4160,8 +4168,7 @@ IonBuilder::inlineGenericFallback(JSFunction *target, CallInfo &callInfo, MBasic
 
     // Generate an MCall, which uses stateful |current|.
     setCurrentAndSpecializePhis(fallbackBlock);
-    RootedFunction targetRooted(cx, target);
-    if (!makeCall(targetRooted, fallbackInfo, clonedAtCallsite))
+    if (!makeCall(target, fallbackInfo, clonedAtCallsite))
         return false;
 
     // Pass return block to caller as |current|.
@@ -4502,7 +4509,6 @@ IonBuilder::createDeclEnvObject(MDefinition *callee, MDefinition *scope)
     // compilation, it is used by the background compilation thread and thus
     // cannot use the Nursery.
 
-    RootedScript script(cx, script_);
     RootedFunction fun(cx, info().fun());
     RootedObject templateObj(cx, DeclEnvObject::createTemplateObject(cx, fun, gc::TenuredHeap));
     if (!templateObj)
@@ -4634,10 +4640,10 @@ IonBuilder::getSingletonPrototype(JSFunction *target)
 }
 
 MDefinition *
-IonBuilder::createThisScriptedSingleton(HandleFunction target, MDefinition *callee)
+IonBuilder::createThisScriptedSingleton(JSFunction *target, MDefinition *callee)
 {
     // Get the singleton prototype (if exists)
-    RootedObject proto(cx, getSingletonPrototype(target));
+    JSObject *proto = getSingletonPrototype(target);
     if (!proto)
         return NULL;
 
@@ -4646,13 +4652,14 @@ IonBuilder::createThisScriptedSingleton(HandleFunction target, MDefinition *call
 
     // Generate an inline path to create a new |this| object with
     // the given singleton prototype.
-    types::TypeObject *type = cx->getNewType(&JSObject::class_, proto.get(), target);
+    types::TypeObject *type = cx->getNewType(&JSObject::class_, proto, target);
     if (!type)
         return NULL;
     if (!types::TypeScript::ThisTypes(target->nonLazyScript())->hasType(types::Type::ObjectType(type)))
         return NULL;
 
-    RootedObject templateObject(cx, CreateThisForFunctionWithProto(cx, target, proto, TenuredObject));
+    RootedObject targetRoot(cx, target);
+    JSObject *templateObject = CreateThisForFunctionWithProto(cx, targetRoot, proto, TenuredObject);
     if (!templateObject)
         return NULL;
 
@@ -4667,7 +4674,7 @@ IonBuilder::createThisScriptedSingleton(HandleFunction target, MDefinition *call
 }
 
 MDefinition *
-IonBuilder::createThis(HandleFunction target, MDefinition *callee)
+IonBuilder::createThis(JSFunction *target, MDefinition *callee)
 {
     // Create this for unknown target
     if (!target) {
@@ -4709,7 +4716,7 @@ IonBuilder::jsop_funcall(uint32_t argc)
 
     // If |Function.prototype.call| may be overridden, don't optimize callsite.
     types::TemporaryTypeSet *calleeTypes = current->peek(calleeDepth)->resultTypeSet();
-    RootedFunction native(cx, getSingleCallTarget(calleeTypes));
+    JSFunction *native = getSingleCallTarget(calleeTypes);
     if (!native || !native->isNative() || native->native() != &js_fun_call) {
         CallInfo callInfo(cx, false);
         if (!callInfo.init(current, argc))
@@ -4720,7 +4727,7 @@ IonBuilder::jsop_funcall(uint32_t argc)
 
     // Extract call target.
     types::TemporaryTypeSet *funTypes = current->peek(funcDepth)->resultTypeSet();
-    RootedFunction target(cx, getSingleCallTarget(funTypes));
+    JSFunction *target = getSingleCallTarget(funTypes);
 
     // Unwrap the (JSFunction *) parameter.
     MPassArg *passFunc = current->peek(funcDepth)->toPassArg();
@@ -4764,7 +4771,7 @@ IonBuilder::jsop_funapply(uint32_t argc)
     int calleeDepth = -((int)argc + 2);
 
     types::TemporaryTypeSet *calleeTypes = current->peek(calleeDepth)->resultTypeSet();
-    RootedFunction native(cx, getSingleCallTarget(calleeTypes));
+    JSFunction *native = getSingleCallTarget(calleeTypes);
     if (argc != 2) {
         CallInfo callInfo(cx, false);
         if (!callInfo.init(current, argc))
@@ -4816,7 +4823,7 @@ IonBuilder::jsop_funapplyarguments(uint32_t argc)
 
     // Extract call target.
     types::TemporaryTypeSet *funTypes = current->peek(funcDepth)->resultTypeSet();
-    RootedFunction target(cx, getSingleCallTarget(funTypes));
+    JSFunction *target = getSingleCallTarget(funTypes);
 
     // When this script isn't inlined, use MApplyArgs,
     // to copy the arguments from the stack and call the function
@@ -4963,7 +4970,7 @@ IonBuilder::jsop_call(uint32_t argc, bool constructing)
         return false;
 
     // No inline, just make the call.
-    RootedFunction target(cx, NULL);
+    JSFunction *target = NULL;
     if (targets.length() == 1)
         target = &targets[0]->as<JSFunction>();
 
@@ -4971,7 +4978,7 @@ IonBuilder::jsop_call(uint32_t argc, bool constructing)
 }
 
 MDefinition *
-IonBuilder::makeCallsiteClone(HandleFunction target, MDefinition *fun)
+IonBuilder::makeCallsiteClone(JSFunction *target, MDefinition *fun)
 {
     // Bake in the clone eagerly if we have a known target. We have arrived here
     // because TI told us that the known target is a should-clone-at-callsite
@@ -4993,7 +5000,7 @@ IonBuilder::makeCallsiteClone(HandleFunction target, MDefinition *fun)
 }
 
 static bool
-TestShouldDOMCall(JSContext *cx, types::TypeSet *inTypes, HandleFunction func,
+TestShouldDOMCall(JSContext *cx, types::TypeSet *inTypes, JSFunction *func,
                   JSJitInfo::OpType opType)
 {
     if (!func->isNative() || !func->jitInfo())
@@ -5022,9 +5029,8 @@ TestShouldDOMCall(JSContext *cx, types::TypeSet *inTypes, HandleFunction func,
                 return false;
         }
 
-        JSObject *typeProto = curType->proto;
-        RootedObject proto(cx, typeProto);
-        if (!instanceChecker(proto, jinfo->protoID, jinfo->depth))
+        RootedObject protoRoot(cx, curType->proto);
+        if (!instanceChecker(protoRoot, jinfo->protoID, jinfo->depth))
             return false;
     }
 
@@ -5087,7 +5093,7 @@ ArgumentTypesMatch(MDefinition *def, types::TemporaryTypeSet *calleeTypes)
 }
 
 bool
-IonBuilder::testNeedsArgumentCheck(JSContext *cx, HandleFunction target, CallInfo &callInfo)
+IonBuilder::testNeedsArgumentCheck(JSContext *cx, JSFunction *target, CallInfo &callInfo)
 {
     // If we have a known target, check if the caller arg types are a subset of callee.
     // Since typeset accumulates and can't decrease that means we don't need to check
@@ -5095,8 +5101,8 @@ IonBuilder::testNeedsArgumentCheck(JSContext *cx, HandleFunction target, CallInf
     if (!target->isInterpreted())
         return true;
 
-    RootedScript targetScript(cx, target->nonLazyScript());
-    if (!targetScript->hasAnalysis())
+    JSScript *targetScript = target->nonLazyScript();
+    if (!targetScript->types)
         return true;
 
     if (!ArgumentTypesMatch(callInfo.thisArg(), cloneTypeSet(types::TypeScript::ThisTypes(targetScript))))
@@ -5115,7 +5121,7 @@ IonBuilder::testNeedsArgumentCheck(JSContext *cx, HandleFunction target, CallInf
 }
 
 MCall *
-IonBuilder::makeCallHelper(HandleFunction target, CallInfo &callInfo, bool cloneAtCallsite)
+IonBuilder::makeCallHelper(JSFunction *target, CallInfo &callInfo, bool cloneAtCallsite)
 {
     JS_ASSERT(callInfo.isWrapped());
 
@@ -5236,7 +5242,7 @@ DOMCallNeedsBarrier(const JSJitInfo* jitinfo, types::TemporaryTypeSet *types)
 }
 
 bool
-IonBuilder::makeCall(HandleFunction target, CallInfo &callInfo, bool cloneAtCallsite)
+IonBuilder::makeCall(JSFunction *target, CallInfo &callInfo, bool cloneAtCallsite)
 {
     // Constructor calls to non-constructors should throw. We don't want to use
     // CallKnown in this case.
@@ -5274,7 +5280,7 @@ IonBuilder::jsop_eval(uint32_t argc)
     if (calleeTypes && calleeTypes->empty())
         return jsop_call(argc, /* constructing = */ false);
 
-    RootedFunction singleton(cx, getSingleCallTarget(calleeTypes));
+    JSFunction *singleton = getSingleCallTarget(calleeTypes);
     if (!singleton)
         return abort("No singleton callee for eval()");
 
@@ -5335,7 +5341,7 @@ IonBuilder::jsop_eval(uint32_t argc)
                 if (!evalCallInfo.init(current, /* argc = */ 0))
                     return false;
 
-                return makeCall(NullPtr(), evalCallInfo, false);
+                return makeCall(NULL, evalCallInfo, false);
             }
         }
 
@@ -5373,19 +5379,18 @@ IonBuilder::jsop_compare(JSOp op)
 JSObject *
 IonBuilder::getNewArrayTemplateObject(uint32_t count)
 {
-    RootedScript scriptRoot(cx, script());
-    NewObjectKind newKind = types::UseNewTypeForInitializer(cx, scriptRoot, pc, JSProto_Array);
+    NewObjectKind newKind = types::UseNewTypeForInitializer(cx, script(), pc, JSProto_Array);
 
     // Do not allocate template objects in the nursery.
     if (newKind == GenericObject)
         newKind = TenuredObject;
 
-    RootedObject templateObject(cx, NewDenseUnallocatedArray(cx, count, NULL, newKind));
+    JSObject *templateObject = NewDenseUnallocatedArray(cx, count, NULL, newKind);
     if (!templateObject)
         return NULL;
 
     if (newKind != SingletonObject) {
-        types::TypeObject *type = types::TypeScript::InitObject(cx, scriptRoot, pc, JSProto_Array);
+        types::TypeObject *type = types::TypeScript::InitObject(cx, script(), pc, JSProto_Array);
         if (!type)
             return NULL;
         templateObject->setType(type);
@@ -5423,22 +5428,21 @@ IonBuilder::jsop_newarray(uint32_t count)
 }
 
 bool
-IonBuilder::jsop_newobject(HandleObject baseObj)
+IonBuilder::jsop_newobject(JSObject *baseObj)
 {
     // Don't bake in the TypeObject for non-CNG scripts.
     JS_ASSERT(script()->compileAndGo);
 
-    RootedObject templateObject(cx);
-
-    RootedScript scriptRoot(cx, script());
-    NewObjectKind newKind = types::UseNewTypeForInitializer(cx, scriptRoot, pc, JSProto_Object);
+    NewObjectKind newKind = types::UseNewTypeForInitializer(cx, script(), pc, JSProto_Object);
 
     // Do not allocate template objects in the nursery.
     if (newKind == GenericObject)
         newKind = TenuredObject;
 
+    JSObject *templateObject;
     if (baseObj) {
-        templateObject = CopyInitializerObject(cx, baseObj, newKind);
+        RootedObject baseObjRoot(cx, baseObj);
+        templateObject = CopyInitializerObject(cx, baseObjRoot, newKind);
     } else {
         gc::AllocKind allocKind = GuessObjectGCKind(0);
         templateObject = NewBuiltinClassInstance(cx, &JSObject::class_, allocKind, newKind);
@@ -5448,7 +5452,7 @@ IonBuilder::jsop_newobject(HandleObject baseObj)
         return false;
 
     if (newKind != SingletonObject) {
-        types::TypeObject *type = types::TypeScript::InitObject(cx, scriptRoot, pc, JSProto_Object);
+        types::TypeObject *type = types::TypeScript::InitObject(cx, script(), pc, JSProto_Object);
         if (!type)
             return false;
         templateObject->setType(type);
@@ -5555,19 +5559,19 @@ CanEffectlesslyCallLookupGenericOnObject(JSContext *cx, JSObject *obj, jsid id)
 }
 
 bool
-IonBuilder::jsop_initprop(HandlePropertyName name)
+IonBuilder::jsop_initprop(PropertyName *name)
 {
     MDefinition *value = current->pop();
     MDefinition *obj = current->peek(-1);
 
     RootedObject templateObject(cx, obj->toNewObject()->templateObject());
 
-    RootedObject holder(cx);
-    RootedShape shape(cx);
     RootedId id(cx, NameToId(name));
     if (!CanEffectlesslyCallLookupGenericOnObject(cx, templateObject, id))
         return abort("INITPROP template object is special");
 
+    RootedObject holder(cx);
+    RootedShape shape(cx);
     bool res = LookupPropertyWithFlags(cx, templateObject, id,
                                        0, &holder, &shape);
     if (!res)
@@ -5672,7 +5676,8 @@ IonBuilder::addBlock(MBasicBlock *block, uint32_t loopDepth)
 MBasicBlock *
 IonBuilder::newBlock(MBasicBlock *predecessor, jsbytecode *pc)
 {
-    MBasicBlock *block = MBasicBlock::New(graph(), info(), predecessor, pc, MBasicBlock::NORMAL);
+    MBasicBlock *block = MBasicBlock::New(graph(), &analysis(), info(),
+                                          predecessor, pc, MBasicBlock::NORMAL);
     return addBlock(block, loopDepth_);
 }
 
@@ -5694,7 +5699,8 @@ IonBuilder::newBlockPopN(MBasicBlock *predecessor, jsbytecode *pc, uint32_t popp
 MBasicBlock *
 IonBuilder::newBlockAfter(MBasicBlock *at, MBasicBlock *predecessor, jsbytecode *pc)
 {
-    MBasicBlock *block = MBasicBlock::New(graph(), info(), predecessor, pc, MBasicBlock::NORMAL);
+    MBasicBlock *block = MBasicBlock::New(graph(), &analysis(), info(),
+                                          predecessor, pc, MBasicBlock::NORMAL);
     if (!block)
         return NULL;
     graph().insertBlockAfter(at, block);
@@ -5704,7 +5710,8 @@ IonBuilder::newBlockAfter(MBasicBlock *at, MBasicBlock *predecessor, jsbytecode
 MBasicBlock *
 IonBuilder::newBlock(MBasicBlock *predecessor, jsbytecode *pc, uint32_t loopDepth)
 {
-    MBasicBlock *block = MBasicBlock::New(graph(), info(), predecessor, pc, MBasicBlock::NORMAL);
+    MBasicBlock *block = MBasicBlock::New(graph(), &analysis(), info(),
+                                          predecessor, pc, MBasicBlock::NORMAL);
     return addBlock(block, loopDepth);
 }
 
@@ -5730,7 +5737,7 @@ IonBuilder::newOsrPreheader(MBasicBlock *predecessor, jsbytecode *loopEntry)
         uint32_t slot = info().scopeChainSlot();
 
         MInstruction *scopev;
-        if (script()->analysis()->usesScopeChain()) {
+        if (analysis().usesScopeChain()) {
             scopev = MOsrScopeChain::New(entry);
         } else {
             // Use an undefined value if the script does not need its scope
@@ -5975,8 +5982,8 @@ IonBuilder::maybeInsertResume()
 }
 
 static inline bool
-TestSingletonProperty(JSContext *cx, HandleObject obj, JSObject *singleton,
-                      HandleId id, bool *isKnownConstant)
+TestSingletonProperty(JSContext *cx, JSObject *obj, JSObject *singleton,
+                      jsid id, bool *isKnownConstant)
 {
     // We would like to completely no-op property/global accesses which can
     // produce only a particular JSObject. When indicating the access result is
@@ -5999,9 +6006,12 @@ TestSingletonProperty(JSContext *cx, HandleObject obj, JSObject *singleton,
     if (!CanEffectlesslyCallLookupGenericOnObject(cx, obj, id))
         return true;
 
+    RootedObject objRoot(cx, obj);
+    RootedId idRoot(cx, id);
+
     RootedObject holder(cx);
     RootedShape shape(cx);
-    if (!JSObject::lookupGeneric(cx, obj, id, &holder, &shape))
+    if (!JSObject::lookupGeneric(cx, objRoot, idRoot, &holder, &shape))
         return false;
     if (!shape)
         return true;
@@ -6032,7 +6042,7 @@ TestSingletonProperty(JSContext *cx, HandleObject obj, JSObject *singleton,
 
 static inline bool
 TestSingletonPropertyTypes(JSContext *cx, MDefinition *obj, JSObject *singleton,
-                           HandleObject globalObj, HandleId id,
+                           JSObject *globalObj, jsid id,
                            bool *isKnownConstant, bool *testObject,
                            bool *testString)
 {
@@ -6055,7 +6065,7 @@ TestSingletonPropertyTypes(JSContext *cx, MDefinition *obj, JSObject *singleton,
     if (id != types::IdToTypeId(id))
         return true;
 
-    RootedObject objectSingleton(cx, types ? types->getSingleton() : NULL);
+    JSObject *objectSingleton = types ? types->getSingleton() : NULL;
     if (objectSingleton)
         return TestSingletonProperty(cx, objectSingleton, singleton, id, isKnownConstant);
 
@@ -6116,9 +6126,8 @@ TestSingletonPropertyTypes(JSContext *cx, MDefinition *obj, JSObject *singleton,
 
             if (object->proto) {
                 // Test this type.
-                RootedObject proto(cx, object->proto);
                 bool thoughtConstant = false;
-                if (!TestSingletonProperty(cx, proto, singleton, id, &thoughtConstant))
+                if (!TestSingletonProperty(cx, object->proto, singleton, id, &thoughtConstant))
                     return false;
                 if (!thoughtConstant)
                     return true;
@@ -6219,8 +6228,10 @@ IonBuilder::pushTypeBarrier(MInstruction *ins, types::TemporaryTypeSet *observed
 }
 
 bool
-IonBuilder::getStaticName(HandleObject staticObject, HandlePropertyName name, bool *psucceeded)
+IonBuilder::getStaticName(JSObject *staticObject, PropertyName *name, bool *psucceeded)
 {
+    jsid id = NameToId(name);
+
     JS_ASSERT(staticObject->is<GlobalObject>() || staticObject->is<CallObject>());
 
     *psucceeded = true;
@@ -6235,11 +6246,9 @@ IonBuilder::getStaticName(HandleObject staticObject, HandlePropertyName name, bo
             return pushConstant(cx->runtime()->positiveInfinityValue);
     }
 
-    RootedId id(cx, NameToId(name));
-
     // For the fastest path, the property must be found, and it must be found
     // as a normal data property on exactly the global object.
-    RootedShape shape(cx, staticObject->nativeLookup(cx, id));
+    Shape *shape = staticObject->nativeLookup(cx, id);
     if (!shape || !shape->hasDefaultGetter() || !shape->hasSlot()) {
         *psucceeded = false;
         return true;
@@ -6339,9 +6348,9 @@ jit::NeedsPostBarrier(CompileInfo &info, MDefinition *value)
 }
 
 bool
-IonBuilder::setStaticName(HandleObject staticObject, HandlePropertyName name)
+IonBuilder::setStaticName(JSObject *staticObject, PropertyName *name)
 {
-    RootedId id(cx, NameToId(name));
+    jsid id = NameToId(name);
 
     JS_ASSERT(staticObject->is<GlobalObject>() || staticObject->is<CallObject>());
 
@@ -6352,7 +6361,7 @@ IonBuilder::setStaticName(HandleObject staticObject, HandlePropertyName name)
 
     // For the fastest path, the property must be found, and it must be found
     // as a normal data property on exactly the global object.
-    RootedShape shape(cx, staticObject->nativeLookup(cx, id));
+    Shape *shape = staticObject->nativeLookup(cx, id);
     if (!shape || !shape->hasDefaultSetter() || !shape->writable() || !shape->hasSlot())
         return jsop_setprop(name);
 
@@ -6413,7 +6422,7 @@ IonBuilder::setStaticName(HandleObject staticObject, HandlePropertyName name)
 }
 
 bool
-IonBuilder::jsop_getname(HandlePropertyName name)
+IonBuilder::jsop_getname(PropertyName *name)
 {
     MDefinition *object;
     if (js_CodeSpec[*pc].format & JOF_GNAME) {
@@ -6442,7 +6451,7 @@ IonBuilder::jsop_getname(HandlePropertyName name)
 }
 
 bool
-IonBuilder::jsop_intrinsic(HandlePropertyName name)
+IonBuilder::jsop_intrinsic(PropertyName *name)
 {
     types::TemporaryTypeSet *types = bytecodeTypes(pc);
     JSValueType type = types->getKnownTypeTag();
@@ -6462,8 +6471,9 @@ IonBuilder::jsop_intrinsic(HandlePropertyName name)
     }
 
     // Bake in the intrinsic. Make sure that TI agrees with us on the type.
+    RootedPropertyName nameRoot(cx, name);
     RootedValue vp(cx, UndefinedValue());
-    if (!cx->global()->getIntrinsicValue(cx, name, &vp))
+    if (!cx->global()->getIntrinsicValue(cx, nameRoot, &vp))
         return false;
 
     JS_ASSERT(types->hasType(types::GetValueType(vp)));
@@ -6478,7 +6488,7 @@ IonBuilder::jsop_intrinsic(HandlePropertyName name)
 bool
 IonBuilder::jsop_bindname(PropertyName *name)
 {
-    JS_ASSERT(script()->analysis()->usesScopeChain());
+    JS_ASSERT(analysis().usesScopeChain());
 
     MDefinition *scopeChain = current->scopeChain();
     MBindNameCache *ins = MBindNameCache::New(scopeChain, name, script(), pc);
@@ -7356,13 +7366,10 @@ IonBuilder::jsop_setelem_dense(types::TemporaryTypeSet::DoubleConversion convers
         MOZ_ASSUME_UNREACHABLE("Unknown double conversion");
     }
 
-    bool writeHole;
+    bool writeHole = false;
     if (safety == SetElem_Normal) {
-        writeHole = script()->analysis()->getCode(pc).arrayWriteHole;
         SetElemICInspector icInspect(inspector->setElemICInspector(pc));
-        writeHole |= icInspect.sawOOBDenseWrite();
-    } else {
-        writeHole = false;
+        writeHole = icInspect.sawOOBDenseWrite();
     }
 
     // Use MStoreElementHole if this SETELEM has written to out-of-bounds
@@ -7485,7 +7492,7 @@ IonBuilder::jsop_length()
     if (jsop_length_fastPath())
         return true;
 
-    RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
+    PropertyName *name = info().getAtom(pc)->asPropertyName();
     return jsop_getprop(name);
 }
 
@@ -7693,7 +7700,7 @@ TestClassHasAccessorHook(const Class *clasp, bool isGetter)
 }
 
 inline bool
-TestTypeHasOwnProperty(JSContext *cx, types::TypeObject *typeObj, HandleId id, bool &cont)
+TestTypeHasOwnProperty(JSContext *cx, types::TypeObject *typeObj, jsid id, bool &cont)
 {
     cont = true;
     types::HeapTypeSet *propSet = typeObj->getProperty(cx, types::IdToTypeId(id), false);
@@ -7705,11 +7712,11 @@ TestTypeHasOwnProperty(JSContext *cx, types::TypeObject *typeObj, HandleId id, b
 }
 
 inline bool
-TestCommonAccessorProtoChain(JSContext *cx, HandleId id, bool isGetter, JSObject *foundProto,
+TestCommonAccessorProtoChain(JSContext *cx, jsid id, bool isGetter, JSObject *foundProto,
                              JSObject *obj, bool &cont)
 {
     cont = false;
-    RootedObject curObj(cx, obj);
+    JSObject *curObj = obj;
     JSObject *stopAt = foundProto->getProto();
     while (curObj != stopAt) {
         // Don't optimize if we have a hook that would have to be called.
@@ -7753,7 +7760,7 @@ TestCommonAccessorProtoChain(JSContext *cx, HandleId id, bool isGetter, JSObject
 }
 
 inline bool
-SearchCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types, HandleId id, bool isGetter,
+SearchCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types, jsid id, bool isGetter,
                      JSObject *&found, JSObject *&foundProto, bool &cont)
 {
     cont = false;
@@ -7798,9 +7805,10 @@ SearchCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types, HandleId id,
         if (!CanEffectlesslyCallLookupGenericOnObject(cx, curObj, id))
             return true;
 
+        RootedId idRoot(cx, id);
         RootedObject proto(cx);
         RootedShape shape(cx);
-        if (!JSObject::lookupGeneric(cx, curObj, id, &proto, &shape))
+        if (!JSObject::lookupGeneric(cx, curObj, idRoot, &proto, &shape))
             return false;
 
         if (!shape)
@@ -7847,7 +7855,7 @@ SearchCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types, HandleId id,
 }
 
 inline bool
-FreezePropTypeSets(JSContext *cx, types::TemporaryTypeSet *types, JSObject *foundProto, HandleId id)
+FreezePropTypeSets(JSContext *cx, types::TemporaryTypeSet *types, JSObject *foundProto, jsid id)
 {
     types::TypeObject *curType;
     for (unsigned i = 0; i < types->getObjectCount(); i++) {
@@ -7892,7 +7900,7 @@ FreezePropTypeSets(JSContext *cx, types::TemporaryTypeSet *types, JSObject *foun
 }
 
 inline bool
-IonBuilder::TestCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types, HandleId id,
+IonBuilder::testCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types, jsid id,
                                JSFunction **funcp, bool isGetter, bool *isDOM,
                                MDefinition **guardOut)
 {
@@ -7949,7 +7957,7 @@ bool
 IonBuilder::annotateGetPropertyCache(JSContext *cx, MDefinition *obj, MGetPropertyCache *getPropCache,
                                     types::TemporaryTypeSet *objTypes, types::TemporaryTypeSet *pushedTypes)
 {
-    RootedId id(cx, NameToId(getPropCache->name()));
+    jsid id = NameToId(getPropCache->name());
     if (id != types::IdToTypeId(id))
         return true;
 
@@ -8116,9 +8124,9 @@ IonBuilder::storeSlot(MDefinition *obj, Shape *shape, MDefinition *value, bool n
 }
 
 bool
-IonBuilder::jsop_getprop(HandlePropertyName name)
+IonBuilder::jsop_getprop(PropertyName *name)
 {
-    RootedId id(cx, NameToId(name));
+    jsid id = NameToId(name);
 
     bool emitted = false;
 
@@ -8191,14 +8199,14 @@ IonBuilder::getPropTryArgumentsLength(bool *emitted)
 }
 
 bool
-IonBuilder::getPropTryConstant(bool *emitted, HandleId id, types::TemporaryTypeSet *types)
+IonBuilder::getPropTryConstant(bool *emitted, jsid id, types::TemporaryTypeSet *types)
 {
     JS_ASSERT(*emitted == false);
     JSObject *singleton = types ? types->getSingleton() : NULL;
     if (!singleton)
         return true;
 
-    RootedObject global(cx, &script()->global());
+    JSObject *global = &script()->global();
 
     bool isConstant, testObject, testString;
     if (!TestSingletonPropertyTypes(cx, current->peek(-1), singleton, global, id,
@@ -8229,7 +8237,7 @@ IonBuilder::getPropTryConstant(bool *emitted, HandleId id, types::TemporaryTypeS
 }
 
 bool
-IonBuilder::getPropTryDefiniteSlot(bool *emitted, HandlePropertyName name,
+IonBuilder::getPropTryDefiniteSlot(bool *emitted, PropertyName *name,
                                    bool barrier, types::TemporaryTypeSet *types)
 {
     JS_ASSERT(*emitted == false);
@@ -8260,7 +8268,7 @@ IonBuilder::getPropTryDefiniteSlot(bool *emitted, HandlePropertyName name,
 }
 
 bool
-IonBuilder::getPropTryCommonGetter(bool *emitted, HandleId id,
+IonBuilder::getPropTryCommonGetter(bool *emitted, jsid id,
                                    bool barrier, types::TemporaryTypeSet *types)
 {
     JS_ASSERT(*emitted == false);
@@ -8270,16 +8278,15 @@ IonBuilder::getPropTryCommonGetter(bool *emitted, HandleId id,
 
     types::TemporaryTypeSet *objTypes = current->peek(-1)->resultTypeSet();
 
-    if (!TestCommonPropFunc(cx, objTypes, id, &commonGetter, true, &isDOM, &guard))
+    if (!testCommonPropFunc(cx, objTypes, id, &commonGetter, true, &isDOM, &guard))
         return false;
     if (!commonGetter)
         return true;
 
     MDefinition *obj = current->pop();
-    RootedFunction getter(cx, commonGetter);
 
-    if (isDOM && TestShouldDOMCall(cx, objTypes, getter, JSJitInfo::Getter)) {
-        const JSJitInfo *jitinfo = getter->jitInfo();
+    if (isDOM && TestShouldDOMCall(cx, objTypes, commonGetter, JSJitInfo::Getter)) {
+        const JSJitInfo *jitinfo = commonGetter->jitInfo();
         MGetDOMProperty *get = MGetDOMProperty::New(jitinfo, obj, guard);
         current->add(get);
         current->push(get);
@@ -8314,11 +8321,11 @@ IonBuilder::getPropTryCommonGetter(bool *emitted, HandleId id,
         return false;
 
     // Inline if we can, otherwise, forget it and just generate a call.
-    if (makeInliningDecision(getter, callInfo) && getter->isInterpreted()) {
-        if (!inlineScriptedCall(callInfo, getter))
+    if (makeInliningDecision(commonGetter, callInfo) && commonGetter->isInterpreted()) {
+        if (!inlineScriptedCall(callInfo, commonGetter))
             return false;
     } else {
-        if (!makeCall(getter, callInfo, false))
+        if (!makeCall(commonGetter, callInfo, false))
             return false;
     }
 
@@ -8342,7 +8349,7 @@ CanInlinePropertyOpShapes(const Vector<Shape *> &shapes)
 }
 
 bool
-IonBuilder::getPropTryInlineAccess(bool *emitted, HandlePropertyName name, HandleId id,
+IonBuilder::getPropTryInlineAccess(bool *emitted, PropertyName *name, jsid id,
                                    bool barrier, types::TemporaryTypeSet *types)
 {
     JS_ASSERT(*emitted == false);
@@ -8403,13 +8410,11 @@ IonBuilder::getPropTryInlineAccess(bool *emitted, HandlePropertyName name, Handl
 }
 
 bool
-IonBuilder::getPropTryCache(bool *emitted, HandlePropertyName name, HandleId id,
+IonBuilder::getPropTryCache(bool *emitted, PropertyName *name, jsid id,
                             bool barrier, types::TemporaryTypeSet *types)
 {
     JS_ASSERT(*emitted == false);
-    bool accessGetter =
-        script()->analysis()->getCode(pc).accessGetter ||
-        inspector->hasSeenAccessedGetter(pc);
+    bool accessGetter = inspector->hasSeenAccessedGetter(pc);
 
     MDefinition *obj = current->peek(-1);
 
@@ -8488,12 +8493,12 @@ IonBuilder::needsToMonitorMissingProperties(types::TemporaryTypeSet *types)
 }
 
 bool
-IonBuilder::jsop_setprop(HandlePropertyName name)
+IonBuilder::jsop_setprop(PropertyName *name)
 {
     MDefinition *value = current->pop();
     MDefinition *obj = current->pop();
 
-    RootedId id(cx, NameToId(name));
+    jsid id = NameToId(name);
     bool emitted = false;
 
     // Always use a call if we are doing the definite properties analysis and
@@ -8542,7 +8547,7 @@ IonBuilder::jsop_setprop(HandlePropertyName name)
 
 bool
 IonBuilder::setPropTryCommonSetter(bool *emitted, MDefinition *obj,
-                                   HandlePropertyName name, HandleId id,
+                                   PropertyName *name, jsid id,
                                    MDefinition *value)
 {
     JS_ASSERT(*emitted == false);
@@ -8551,7 +8556,7 @@ IonBuilder::setPropTryCommonSetter(bool *emitted, MDefinition *obj,
     bool isDOM;
 
     types::TemporaryTypeSet *objTypes = obj->resultTypeSet();
-    if (!TestCommonPropFunc(cx, objTypes, id, &commonSetter, false, &isDOM, NULL))
+    if (!testCommonPropFunc(cx, objTypes, id, &commonSetter, false, &isDOM, NULL))
         return false;
 
     if (!commonSetter)
@@ -8562,10 +8567,9 @@ IonBuilder::setPropTryCommonSetter(bool *emitted, MDefinition *obj,
     // Setters can be called even if the property write needs a type
     // barrier, as calling the setter does not actually write any data
     // properties.
-    RootedFunction setter(cx, commonSetter);
 
     // Try emitting dom call.
-    if (!setPropTryCommonDOMSetter(emitted, obj, value, setter, isDOM))
+    if (!setPropTryCommonDOMSetter(emitted, obj, value, commonSetter, isDOM))
         return false;
 
     if (*emitted)
@@ -8586,7 +8590,7 @@ IonBuilder::setPropTryCommonSetter(bool *emitted, MDefinition *obj,
             return false;
     }
 
-    pushConstant(ObjectValue(*setter));
+    pushConstant(ObjectValue(*commonSetter));
 
     MPassArg *wrapper = MPassArg::New(obj);
     current->push(wrapper);
@@ -8606,15 +8610,15 @@ IonBuilder::setPropTryCommonSetter(bool *emitted, MDefinition *obj,
     callInfo.markAsSetter();
 
     // Inline the setter if we can.
-    if (makeInliningDecision(setter, callInfo) && setter->isInterpreted()) {
-        if (!inlineScriptedCall(callInfo, setter))
+    if (makeInliningDecision(commonSetter, callInfo) && commonSetter->isInterpreted()) {
+        if (!inlineScriptedCall(callInfo, commonSetter))
             return false;
 
         *emitted = true;
         return true;
     }
 
-    MCall *call = makeCallHelper(setter, callInfo, false);
+    MCall *call = makeCallHelper(commonSetter, callInfo, false);
     if (!call)
         return false;
 
@@ -8628,7 +8632,7 @@ IonBuilder::setPropTryCommonSetter(bool *emitted, MDefinition *obj,
 
 bool
 IonBuilder::setPropTryCommonDOMSetter(bool *emitted, MDefinition *obj,
-                                      MDefinition *value, HandleFunction setter,
+                                      MDefinition *value, JSFunction *setter,
                                       bool isDOM)
 {
     JS_ASSERT(*emitted == false);
@@ -8656,7 +8660,7 @@ IonBuilder::setPropTryCommonDOMSetter(bool *emitted, MDefinition *obj,
 
 bool
 IonBuilder::setPropTryDefiniteSlot(bool *emitted, MDefinition *obj,
-                                   HandlePropertyName name, MDefinition *value,
+                                   PropertyName *name, MDefinition *value,
                                    bool barrier, types::TemporaryTypeSet *objTypes)
 {
     JS_ASSERT(*emitted == false);
@@ -8684,7 +8688,7 @@ IonBuilder::setPropTryDefiniteSlot(bool *emitted, MDefinition *obj,
 
 bool
 IonBuilder::setPropTryInlineAccess(bool *emitted, MDefinition *obj,
-                                   HandlePropertyName name, HandleId id,
+                                   PropertyName *name, jsid id,
                                    MDefinition *value, bool barrier,
                                    types::TemporaryTypeSet *objTypes)
 {
@@ -8748,7 +8752,7 @@ IonBuilder::setPropTryInlineAccess(bool *emitted, MDefinition *obj,
 
 bool
 IonBuilder::setPropTryCache(bool *emitted, MDefinition *obj,
-                            HandlePropertyName name, MDefinition *value,
+                            PropertyName *name, MDefinition *value,
                             bool barrier, types::TemporaryTypeSet *objTypes)
 {
     JS_ASSERT(*emitted == false);
@@ -8756,7 +8760,7 @@ IonBuilder::setPropTryCache(bool *emitted, MDefinition *obj,
     // Emit SetPropertyCache.
     MSetPropertyCache *ins = MSetPropertyCache::New(obj, value, name, script()->strict, barrier);
 
-    RootedId id(cx, NameToId(name));
+    jsid id = NameToId(name);
     if (!objTypes || objTypes->propertyNeedsBarrier(cx, id))
         ins->setNeedsBarrier();
 
@@ -8771,7 +8775,7 @@ IonBuilder::setPropTryCache(bool *emitted, MDefinition *obj,
 }
 
 bool
-IonBuilder::jsop_delprop(HandlePropertyName name)
+IonBuilder::jsop_delprop(PropertyName *name)
 {
     MDefinition *obj = current->pop();
 
@@ -8840,7 +8844,7 @@ IonBuilder::jsop_lambda(JSFunction *fun)
     if (fun->isInterpreted() && !fun->getOrCreateScript(cx))
         return false;
 
-    JS_ASSERT(script()->analysis()->usesScopeChain());
+    JS_ASSERT(analysis().usesScopeChain());
     if (fun->isArrow())
         return abort("bound arrow function");
     if (fun->isNative() && IsAsmJSModuleNative(fun->native()))
@@ -8858,7 +8862,7 @@ IonBuilder::jsop_defvar(uint32_t index)
 {
     JS_ASSERT(JSOp(*pc) == JSOP_DEFVAR || JSOp(*pc) == JSOP_DEFCONST);
 
-    RootedPropertyName name(cx, script()->getName(index));
+    PropertyName *name = script()->getName(index);
 
     // Bake in attrs.
     unsigned attrs = JSPROP_ENUMERATE | JSPROP_PERMANENT;
@@ -8866,7 +8870,7 @@ IonBuilder::jsop_defvar(uint32_t index)
         attrs |= JSPROP_READONLY;
 
     // Pass the ScopeChain.
-    JS_ASSERT(script()->analysis()->usesScopeChain());
+    JS_ASSERT(analysis().usesScopeChain());
 
     // Bake the name pointer into the MDefVar.
     MDefVar *defvar = MDefVar::New(name, attrs, current->scopeChain());
@@ -8878,11 +8882,11 @@ IonBuilder::jsop_defvar(uint32_t index)
 bool
 IonBuilder::jsop_deffun(uint32_t index)
 {
-    RootedFunction fun(cx, script()->getFunction(index));
+    JSFunction *fun = script()->getFunction(index);
     if (fun->isNative() && IsAsmJSModuleNative(fun->native()))
         return abort("asm.js module function");
 
-    JS_ASSERT(script()->analysis()->usesScopeChain());
+    JS_ASSERT(analysis().usesScopeChain());
 
     MDefFun *deffun = MDefFun::New(fun, current->scopeChain());
     current->add(deffun);
@@ -9047,7 +9051,7 @@ IonBuilder::walkScopeChain(unsigned hops)
 }
 
 bool
-IonBuilder::hasStaticScopeObject(ScopeCoordinate sc, MutableHandleObject pcall)
+IonBuilder::hasStaticScopeObject(ScopeCoordinate sc, JSObject **pcall)
 {
     JSScript *outerScript = ScopeCoordinateFunctionScript(cx, script(), pc);
     if (!outerScript || !outerScript->treatAsRunOnce)
@@ -9078,7 +9082,7 @@ IonBuilder::hasStaticScopeObject(ScopeCoordinate sc, MutableHandleObject pcall)
             environment->as<CallObject>().callee().nonLazyScript() == outerScript)
         {
             JS_ASSERT(environment->hasSingletonType());
-            pcall.set(environment);
+            *pcall = environment;
             return true;
         }
         environment = environment->enclosingScope();
@@ -9095,7 +9099,7 @@ IonBuilder::hasStaticScopeObject(ScopeCoordinate sc, MutableHandleObject pcall)
             scope->as<CallObject>().callee().nonLazyScript() == outerScript)
         {
             JS_ASSERT(scope->hasSingletonType());
-            pcall.set(scope);
+            *pcall = scope;
             return true;
         }
     }
@@ -9106,9 +9110,9 @@ IonBuilder::hasStaticScopeObject(ScopeCoordinate sc, MutableHandleObject pcall)
 bool
 IonBuilder::jsop_getaliasedvar(ScopeCoordinate sc)
 {
-    RootedObject call(cx);
+    JSObject *call = NULL;
     if (hasStaticScopeObject(sc, &call) && call) {
-        RootedPropertyName name(cx, ScopeCoordinateName(cx, script(), pc));
+        PropertyName *name = ScopeCoordinateName(cx, script(), pc);
         bool succeeded;
         if (!getStaticName(call, name, &succeeded))
             return false;
@@ -9118,7 +9122,7 @@ IonBuilder::jsop_getaliasedvar(ScopeCoordinate sc)
 
     MDefinition *obj = walkScopeChain(sc.hops);
 
-    RootedShape shape(cx, ScopeCoordinateToStaticScopeShape(cx, script(), pc));
+    Shape *shape = ScopeCoordinateToStaticScopeShape(cx, script(), pc);
 
     MInstruction *load;
     if (shape->numFixedSlots() <= sc.slot) {
@@ -9140,7 +9144,7 @@ IonBuilder::jsop_getaliasedvar(ScopeCoordinate sc)
 bool
 IonBuilder::jsop_setaliasedvar(ScopeCoordinate sc)
 {
-    RootedObject call(cx);
+    JSObject *call = NULL;
     if (hasStaticScopeObject(sc, &call)) {
         uint32_t depth = current->stackDepth() + 1;
         if (depth > current->nslots()) {
@@ -9148,7 +9152,7 @@ IonBuilder::jsop_setaliasedvar(ScopeCoordinate sc)
                 return false;
         }
         MDefinition *value = current->pop();
-        RootedPropertyName name(cx, ScopeCoordinateName(cx, script(), pc));
+        PropertyName *name = ScopeCoordinateName(cx, script(), pc);
 
         if (call) {
             // Push the object on the stack to match the bound object expected in
@@ -9171,7 +9175,7 @@ IonBuilder::jsop_setaliasedvar(ScopeCoordinate sc)
     MDefinition *rval = current->peek(-1);
     MDefinition *obj = walkScopeChain(sc.hops);
 
-    RootedShape shape(cx, ScopeCoordinateToStaticScopeShape(cx, script(), pc));
+    Shape *shape = ScopeCoordinateToStaticScopeShape(cx, script(), pc);
 
     if (NeedsPostBarrier(info(), rval))
         current->add(MPostWriteBarrier::New(obj, rval));
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 6483a1d6a6a..530eec264d0 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -12,6 +12,7 @@
 // This file declares the data structures for building a MIRGraph from a
 // JSScript.
 
+#include "jit/BytecodeAnalysis.h"
 #include "jit/MIR.h"
 #include "jit/MIRGraph.h"
 
@@ -330,8 +331,8 @@ class IonBuilder : public MIRGenerator
     JSObject *getSingletonPrototype(JSFunction *target);
 
     MDefinition *createThisScripted(MDefinition *callee);
-    MDefinition *createThisScriptedSingleton(HandleFunction target, MDefinition *callee);
-    MDefinition *createThis(HandleFunction target, MDefinition *callee);
+    MDefinition *createThisScriptedSingleton(JSFunction *target, MDefinition *callee);
+    MDefinition *createThis(JSFunction *target, MDefinition *callee);
     MInstruction *createDeclEnvObject(MDefinition *callee, MDefinition *scopeObj);
     MInstruction *createCallObject(MDefinition *callee, MDefinition *scopeObj);
 
@@ -347,7 +348,7 @@ class IonBuilder : public MIRGenerator
 
     bool invalidatedIdempotentCache();
 
-    bool hasStaticScopeObject(ScopeCoordinate sc, MutableHandleObject pcall);
+    bool hasStaticScopeObject(ScopeCoordinate sc, JSObject **pcall);
     bool loadSlot(MDefinition *obj, Shape *shape, MIRType rvalType,
                   bool barrier, types::TemporaryTypeSet *types);
     bool storeSlot(MDefinition *obj, Shape *shape, MDefinition *value, bool needsBarrier,
@@ -355,33 +356,33 @@ class IonBuilder : public MIRGenerator
 
     // jsop_getprop() helpers.
     bool getPropTryArgumentsLength(bool *emitted);
-    bool getPropTryConstant(bool *emitted, HandleId id, types::TemporaryTypeSet *types);
-    bool getPropTryDefiniteSlot(bool *emitted, HandlePropertyName name,
+    bool getPropTryConstant(bool *emitted, jsid id, types::TemporaryTypeSet *types);
+    bool getPropTryDefiniteSlot(bool *emitted, PropertyName *name,
                                 bool barrier, types::TemporaryTypeSet *types);
-    bool getPropTryCommonGetter(bool *emitted, HandleId id,
+    bool getPropTryCommonGetter(bool *emitted, jsid id,
                                 bool barrier, types::TemporaryTypeSet *types);
-    bool getPropTryInlineAccess(bool *emitted, HandlePropertyName name, HandleId id,
+    bool getPropTryInlineAccess(bool *emitted, PropertyName *name, jsid id,
                                 bool barrier, types::TemporaryTypeSet *types);
-    bool getPropTryCache(bool *emitted, HandlePropertyName name, HandleId id,
+    bool getPropTryCache(bool *emitted, PropertyName *name, jsid id,
                          bool barrier, types::TemporaryTypeSet *types);
     bool needsToMonitorMissingProperties(types::TemporaryTypeSet *types);
 
     // jsop_setprop() helpers.
     bool setPropTryCommonSetter(bool *emitted, MDefinition *obj,
-                                HandlePropertyName name, HandleId id,
+                                PropertyName *name, jsid id,
                                 MDefinition *value);
     bool setPropTryCommonDOMSetter(bool *emitted, MDefinition *obj,
-                                   MDefinition *value, HandleFunction setter,
+                                   MDefinition *value, JSFunction *setter,
                                    bool isDOM);
     bool setPropTryDefiniteSlot(bool *emitted, MDefinition *obj,
-                                HandlePropertyName name, MDefinition *value,
+                                PropertyName *name, MDefinition *value,
                                 bool barrier, types::TemporaryTypeSet *objTypes);
     bool setPropTryInlineAccess(bool *emitted, MDefinition *obj,
-                                HandlePropertyName name, HandleId id,
+                                PropertyName *name, jsid id,
                                 MDefinition *value, bool barrier,
                                 types::TemporaryTypeSet *objTypes);
     bool setPropTryCache(bool *emitted, MDefinition *obj,
-                         HandlePropertyName name, MDefinition *value,
+                         PropertyName *name, MDefinition *value,
                          bool barrier, types::TemporaryTypeSet *objTypes);
 
     // jsop_setelem() helpers.
@@ -432,10 +433,10 @@ class IonBuilder : public MIRGenerator
     bool jsop_dup2();
     bool jsop_loophead(jsbytecode *pc);
     bool jsop_compare(JSOp op);
-    bool getStaticName(HandleObject staticObject, HandlePropertyName name, bool *psucceeded);
-    bool setStaticName(HandleObject staticObject, HandlePropertyName name);
-    bool jsop_getname(HandlePropertyName name);
-    bool jsop_intrinsic(HandlePropertyName name);
+    bool getStaticName(JSObject *staticObject, PropertyName *name, bool *psucceeded);
+    bool setStaticName(JSObject *staticObject, PropertyName *name);
+    bool jsop_getname(PropertyName *name);
+    bool jsop_intrinsic(PropertyName *name);
     bool jsop_bindname(PropertyName *name);
     bool jsop_getelem();
     bool jsop_getelem_dense(MDefinition *obj, MDefinition *index);
@@ -455,16 +456,16 @@ class IonBuilder : public MIRGenerator
     bool jsop_runonce();
     bool jsop_rest();
     bool jsop_not();
-    bool jsop_getprop(HandlePropertyName name);
-    bool jsop_setprop(HandlePropertyName name);
-    bool jsop_delprop(HandlePropertyName name);
+    bool jsop_getprop(PropertyName *name);
+    bool jsop_setprop(PropertyName *name);
+    bool jsop_delprop(PropertyName *name);
     bool jsop_delelem();
     bool jsop_newarray(uint32_t count);
-    bool jsop_newobject(HandleObject baseObj);
+    bool jsop_newobject(JSObject *baseObj);
     bool jsop_initelem();
     bool jsop_initelem_array();
     bool jsop_initelem_getter_setter();
-    bool jsop_initprop(HandlePropertyName name);
+    bool jsop_initprop(PropertyName *name);
     bool jsop_initprop_getter_setter(PropertyName *name);
     bool jsop_regexp(RegExpObject *reobj);
     bool jsop_object(JSObject *obj);
@@ -581,17 +582,17 @@ class IonBuilder : public MIRGenerator
                                   MTypeObjectDispatch *dispatch, MGetPropertyCache *cache,
                                   MBasicBlock **fallbackTarget);
 
-    bool testNeedsArgumentCheck(JSContext *cx, HandleFunction target, CallInfo &callInfo);
+    bool testNeedsArgumentCheck(JSContext *cx, JSFunction *target, CallInfo &callInfo);
 
-    MDefinition *makeCallsiteClone(HandleFunction target, MDefinition *fun);
-    MCall *makeCallHelper(HandleFunction target, CallInfo &callInfo, bool cloneAtCallsite);
-    bool makeCall(HandleFunction target, CallInfo &callInfo, bool cloneAtCallsite);
+    MDefinition *makeCallsiteClone(JSFunction *target, MDefinition *fun);
+    MCall *makeCallHelper(JSFunction *target, CallInfo &callInfo, bool cloneAtCallsite);
+    bool makeCall(JSFunction *target, CallInfo &callInfo, bool cloneAtCallsite);
 
     MDefinition *patchInlinedReturn(CallInfo &callInfo, MBasicBlock *exit, MBasicBlock *bottom);
     MDefinition *patchInlinedReturns(CallInfo &callInfo, MIRGraphExits &exits, MBasicBlock *bottom);
 
-    inline bool TestCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types,
-                                   HandleId id, JSFunction **funcp,
+    inline bool testCommonPropFunc(JSContext *cx, types::TemporaryTypeSet *types,
+                                   jsid id, JSFunction **funcp,
                                    bool isGetter, bool *isDOM,
                                    MDefinition **guardOut);
 
@@ -640,10 +641,18 @@ class IonBuilder : public MIRGenerator
     AbortReason abortReason() { return abortReason_; }
 
   private:
+    bool init();
+
     JSContext *cx;
     BaselineFrame *baselineFrame_;
     AbortReason abortReason_;
 
+    // Basic analysis information about the script.
+    BytecodeAnalysis analysis_;
+    BytecodeAnalysis &analysis() {
+        return analysis_;
+    }
+
     jsbytecode *pc;
     MBasicBlock *current;
     uint32_t loopDepth_;
diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp
index 164929de513..663455e3b86 100644
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -1949,7 +1949,7 @@ SetPropertyIC::attachNativeExisting(JSContext *cx, IonScript *ion, HandleObject
     MacroAssembler masm(cx);
     RepatchStubAppender attacher(*this);
 
-    Label failures;
+    Label failures, barrierFailure;
     masm.branchPtr(Assembler::NotEqual,
                    Address(object(), JSObject::offsetOfShape()),
                    ImmGCPtr(obj->lastProperty()), &failures);
@@ -1973,20 +1973,10 @@ SetPropertyIC::attachNativeExisting(JSContext *cx, IonScript *ion, HandleObject
             JS_ASSERT(propTypes);
             JS_ASSERT(!propTypes->unknown());
 
-            Label barrierSuccess;
-            Label barrierFailure;
-
             Register scratchReg = object();
             masm.push(scratchReg);
 
-            masm.guardTypeSet(valReg, propTypes, scratchReg,
-                                &barrierSuccess, &barrierFailure);
-
-            masm.bind(&barrierFailure);
-            masm.pop(object());
-            masm.jump(&failures);
-
-            masm.bind(&barrierSuccess);
+            masm.guardTypeSet(valReg, propTypes, scratchReg, &barrierFailure);
             masm.pop(object());
         }
     }
@@ -2012,6 +2002,11 @@ SetPropertyIC::attachNativeExisting(JSContext *cx, IonScript *ion, HandleObject
 
     attacher.jumpRejoin(masm);
 
+    if (barrierFailure.used()) {
+        masm.bind(&barrierFailure);
+        masm.pop(object());
+    }
+
     masm.bind(&failures);
     attacher.jumpNextStub(masm);
 
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index dd14cb4a34a..040a1704080 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -64,113 +64,167 @@ class TypeWrapper {
 
 template <typename Source, typename TypeSet> void
 MacroAssembler::guardTypeSet(const Source &address, const TypeSet *types,
-                             Register scratch, Label *matched, Label *miss)
+                             Register scratch, Label *miss)
 {
     JS_ASSERT(!types->unknown());
 
+    Label matched;
+    types::Type tests[7] = {
+        types::Type::Int32Type(),
+        types::Type::UndefinedType(),
+        types::Type::BooleanType(),
+        types::Type::StringType(),
+        types::Type::NullType(),
+        types::Type::MagicArgType(),
+        types::Type::AnyObjectType()
+    };
+
+    // The double type also implies Int32.
+    // So replace the int32 test with the double one.
+    if (types->hasType(types::Type::DoubleType())) {
+        JS_ASSERT(types->hasType(types::Type::Int32Type()));
+        tests[0] = types::Type::DoubleType();
+    }
+
     Register tag = extractTag(address, scratch);
 
-    if (types->hasType(types::Type::DoubleType())) {
-        // The double type also implies Int32.
-        JS_ASSERT(types->hasType(types::Type::Int32Type()));
-        branchTestNumber(Equal, tag, matched);
-    } else if (types->hasType(types::Type::Int32Type())) {
-        branchTestInt32(Equal, tag, matched);
+    // Emit all typed tests.
+    BranchType lastBranch;
+    for (size_t i = 0; i < 7; i++) {
+        if (!types->hasType(tests[i]))
+            continue;
+
+        if (lastBranch.isInitialized())
+            lastBranch.emit(*this);
+        lastBranch = BranchType(Equal, tag, tests[i], &matched);
     }
 
-    if (types->hasType(types::Type::UndefinedType()))
-        branchTestUndefined(Equal, tag, matched);
-    if (types->hasType(types::Type::BooleanType()))
-        branchTestBoolean(Equal, tag, matched);
-    if (types->hasType(types::Type::StringType()))
-        branchTestString(Equal, tag, matched);
-    if (types->hasType(types::Type::NullType()))
-        branchTestNull(Equal, tag, matched);
-    if (types->hasType(types::Type::MagicArgType()))
-        branchTestMagic(Equal, tag, matched);
+    // If this is the last check, invert the last branch.
+    if (types->hasType(types::Type::AnyObjectType()) || !types->getObjectCount()) {
+        if (!lastBranch.isInitialized()) {
+            jump(miss);
+            return;
+        }
 
-    if (types->hasType(types::Type::AnyObjectType())) {
-        branchTestObject(Equal, tag, matched);
-    } else if (types->getObjectCount()) {
-        JS_ASSERT(scratch != InvalidReg);
-        branchTestObject(NotEqual, tag, miss);
-        Register obj = extractObject(address, scratch);
-        guardObjectType(obj, types, scratch, matched, miss);
+        lastBranch.invertCondition();
+        lastBranch.relink(miss);
+        lastBranch.emit(*this);
+
+        bind(&matched);
+        return;
     }
+
+    if (lastBranch.isInitialized())
+        lastBranch.emit(*this);
+
+    // Test specific objects.
+    JS_ASSERT(scratch != InvalidReg);
+    branchTestObject(NotEqual, tag, miss);
+    Register obj = extractObject(address, scratch);
+    guardObjectType(obj, types, scratch, miss);
+
+    bind(&matched);
 }
 
 template <typename TypeSet> void
 MacroAssembler::guardObjectType(Register obj, const TypeSet *types,
-                                Register scratch, Label *matched, Label *miss)
+                                Register scratch, Label *miss)
 {
     JS_ASSERT(!types->unknown());
     JS_ASSERT(!types->hasType(types::Type::AnyObjectType()));
     JS_ASSERT(types->getObjectCount());
     JS_ASSERT(scratch != InvalidReg);
 
-    // Note: Some platforms give the same register for obj and scratch.
-    // Make sure when writing to scratch, the obj register isn't used anymore!
+    Label matched;
 
+    BranchGCPtr lastBranch;
+    JS_ASSERT(!lastBranch.isInitialized());
     bool hasTypeObjects = false;
     unsigned count = types->getObjectCount();
     for (unsigned i = 0; i < count; i++) {
-        if (JSObject *object = types->getSingleObject(i))
-            branchPtr(Equal, obj, ImmGCPtr(object), matched);
-        else if (types->getTypeObject(i))
-            hasTypeObjects = true;
+        if (!types->getSingleObject(i)) {
+            hasTypeObjects = hasTypeObjects || types->getTypeObject(i);
+            continue;
+        }
+
+        if (lastBranch.isInitialized())
+            lastBranch.emit(*this);
+
+        JSObject *object = types->getSingleObject(i);
+        lastBranch = BranchGCPtr(Equal, obj, ImmGCPtr(object), &matched);
     }
 
     if (hasTypeObjects) {
+        // Note: Some platforms give the same register for obj and scratch.
+        // Make sure when writing to scratch, the obj register isn't used anymore!
         loadPtr(Address(obj, JSObject::offsetOfType()), scratch);
 
         for (unsigned i = 0; i < count; i++) {
-            if (types::TypeObject *object = types->getTypeObject(i))
-                branchPtr(Equal, scratch, ImmGCPtr(object), matched);
+            if (!types->getTypeObject(i))
+                continue;
+
+            if (lastBranch.isInitialized())
+                lastBranch.emit(*this);
+
+            types::TypeObject *object = types->getTypeObject(i);
+            lastBranch = BranchGCPtr(Equal, scratch, ImmGCPtr(object), &matched);
         }
     }
+
+    if (!lastBranch.isInitialized()) {
+        jump(miss);
+        return;
+    }
+
+    lastBranch.invertCondition();
+    lastBranch.relink(miss);
+    lastBranch.emit(*this);
+
+    bind(&matched);
+    return;
 }
 
 template <typename Source> void
 MacroAssembler::guardType(const Source &address, types::Type type,
-                          Register scratch, Label *matched, Label *miss)
+                          Register scratch, Label *miss)
 {
     TypeWrapper wrapper(type);
-    guardTypeSet(address, &wrapper, scratch, matched, miss);
+    guardTypeSet(address, &wrapper, scratch, miss);
 }
 
 template void MacroAssembler::guardTypeSet(const Address &address, const types::TemporaryTypeSet *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 template void MacroAssembler::guardTypeSet(const ValueOperand &value, const types::TemporaryTypeSet *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 
 template void MacroAssembler::guardTypeSet(const Address &address, const types::HeapTypeSet *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 template void MacroAssembler::guardTypeSet(const ValueOperand &value, const types::HeapTypeSet *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 template void MacroAssembler::guardTypeSet(const TypedOrValueRegister &reg, const types::HeapTypeSet *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 
 template void MacroAssembler::guardTypeSet(const Address &address, const types::TypeSet *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 template void MacroAssembler::guardTypeSet(const ValueOperand &value, const types::TypeSet *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 
 template void MacroAssembler::guardTypeSet(const Address &address, const TypeWrapper *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 template void MacroAssembler::guardTypeSet(const ValueOperand &value, const TypeWrapper *types,
-                                           Register scratch, Label *matched, Label *miss);
+                                           Register scratch, Label *miss);
 
 template void MacroAssembler::guardObjectType(Register obj, const types::TemporaryTypeSet *types,
-                                              Register scratch, Label *matched, Label *miss);
+                                              Register scratch, Label *miss);
 template void MacroAssembler::guardObjectType(Register obj, const types::TypeSet *types,
-                                              Register scratch, Label *matched, Label *miss);
+                                              Register scratch, Label *miss);
 template void MacroAssembler::guardObjectType(Register obj, const TypeWrapper *types,
-                                              Register scratch, Label *matched, Label *miss);
+                                              Register scratch, Label *miss);
 
 template void MacroAssembler::guardType(const Address &address, types::Type type,
-                                        Register scratch, Label *matched, Label *miss);
+                                        Register scratch, Label *miss);
 template void MacroAssembler::guardType(const ValueOperand &value, types::Type type,
-                                        Register scratch, Label *matched, Label *miss);
+                                        Register scratch, Label *miss);
 
 void
 MacroAssembler::PushRegsInMask(RegisterSet set)
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 37c6b47d079..461f24c385a 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -54,6 +54,120 @@ class MacroAssembler : public MacroAssemblerSpecific
         }
     };
 
+    /*
+     * Base class for creating a branch.
+     */
+    class Branch
+    {
+        bool init_;
+        Condition cond_;
+        Label *jump_;
+        Register reg_;
+
+      public:
+        Branch()
+          : init_(false),
+            cond_(Equal),
+            jump_(NULL),
+            reg_(Register::FromCode(0))      // Quell compiler warnings.
+        { }
+
+        Branch(Condition cond, Register reg, Label *jump)
+          : init_(true),
+            cond_(cond),
+            jump_(jump),
+            reg_(reg)
+        { }
+
+        bool isInitialized() const {
+            return init_;
+        }
+
+        Condition cond() const {
+            return cond_;
+        }
+
+        Label *jump() const {
+            return jump_;
+        }
+
+        Register reg() const {
+            return reg_;
+        }
+
+        void invertCondition() {
+            cond_ = InvertCondition(cond_);
+        }
+
+        void relink(Label *jump) {
+            jump_ = jump;
+        }
+
+        virtual void emit(MacroAssembler &masm) = 0;
+    };
+
+    /*
+     * Creates a branch based on a specific types::Type.
+     * Note: emits number test (int/double) for types::Type::DoubleType()
+     */
+    class BranchType : public Branch
+    {
+        types::Type type_;
+
+      public:
+        BranchType()
+          : Branch(),
+            type_(types::Type::UnknownType())
+        { }
+
+        BranchType(Condition cond, Register reg, types::Type type, Label *jump)
+          : Branch(cond, reg, jump),
+            type_(type)
+        { }
+
+        void emit(MacroAssembler &masm) {
+            JS_ASSERT(isInitialized());
+            MIRType mirType = MIRType_None;
+
+            if (type_.isPrimitive())
+                mirType = MIRTypeFromValueType(type_.primitive());
+            else if (type_.isAnyObject())
+                mirType = MIRType_Object;
+            else
+                MOZ_ASSUME_UNREACHABLE("Unknown conversion to mirtype");
+
+            if (mirType == MIRType_Double)
+                masm.branchTestNumber(cond(), reg(), jump());
+            else
+                masm.branchTestMIRType(cond(), reg(), mirType, jump());
+        }
+
+    };
+
+    /*
+     * Creates a branch based on a GCPtr.
+     */
+    class BranchGCPtr : public Branch
+    {
+        ImmGCPtr ptr_;
+
+      public:
+        BranchGCPtr()
+          : Branch(),
+            ptr_(ImmGCPtr(NULL))
+        { }
+
+        BranchGCPtr(Condition cond, Register reg, ImmGCPtr ptr, Label *jump)
+          : Branch(cond, reg, jump),
+            ptr_(ptr)
+        { }
+
+        void emit(MacroAssembler &masm) {
+            JS_ASSERT(isInitialized());
+            masm.branchPtr(cond(), reg(), ptr_, jump());
+        }
+    };
+
     mozilla::Maybe<AutoRooter> autoRooter_;
     mozilla::Maybe<IonContext> ionContext_;
     mozilla::Maybe<AutoIonContextAlloc> alloc_;
@@ -160,14 +274,11 @@ class MacroAssembler : public MacroAssemblerSpecific
     // Emits a test of a value against all types in a TypeSet. A scratch
     // register is required.
     template <typename Source, typename TypeSet>
-    void guardTypeSet(const Source &address, const TypeSet *types, Register scratch,
-                      Label *matched, Label *miss);
+    void guardTypeSet(const Source &address, const TypeSet *types, Register scratch, Label *miss);
     template <typename TypeSet>
-    void guardObjectType(Register obj, const TypeSet *types,
-                         Register scratch, Label *matched, Label *miss);
+    void guardObjectType(Register obj, const TypeSet *types, Register scratch, Label *miss);
     template <typename Source>
-    void guardType(const Source &address, types::Type type, Register scratch,
-                   Label *matched, Label *miss);
+    void guardType(const Source &address, types::Type type, Register scratch, Label *miss);
 
     void loadObjShape(Register objReg, Register dest) {
         loadPtr(Address(objReg, JSObject::offsetOfShape()), dest);
@@ -202,10 +313,6 @@ class MacroAssembler : public MacroAssemblerSpecific
 
     template <typename Value>
     Condition testMIRType(Condition cond, const Value &val, MIRType type) {
-        JS_ASSERT(type == MIRType_Null    || type == MIRType_Undefined  ||
-                  type == MIRType_Boolean || type == MIRType_Int32      ||
-                  type == MIRType_String  || type == MIRType_Object     ||
-                  type == MIRType_Double);
         switch (type) {
           case MIRType_Null:        return testNull(cond, val);
           case MIRType_Undefined:   return testUndefined(cond, val);
@@ -214,6 +321,7 @@ class MacroAssembler : public MacroAssemblerSpecific
           case MIRType_String:      return testString(cond, val);
           case MIRType_Object:      return testObject(cond, val);
           case MIRType_Double:      return testDouble(cond, val);
+          case MIRType_Magic:       return testMagic(cond, val);
           default:
             MOZ_ASSUME_UNREACHABLE("Bad MIRType");
         }
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 957377d1765..9461c54e07e 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -324,8 +324,9 @@ IonBuilder::inlineArrayPopShift(CallInfo &callInfo, MArrayPopShift::Mode mode)
         return InliningStatus_NotInlined;
     if (thisTypes->hasObjectFlags(cx, unhandledFlags))
         return InliningStatus_NotInlined;
-    RootedScript script(cx, script_);
-    if (types::ArrayPrototypeHasIndexedProperty(cx, script))
+
+    RootedScript scriptRoot(cx, script());
+    if (types::ArrayPrototypeHasIndexedProperty(cx, scriptRoot))
         return InliningStatus_NotInlined;
 
     callInfo.unwrapArgs();
@@ -387,8 +388,9 @@ IonBuilder::inlineArrayPush(CallInfo &callInfo)
     {
         return InliningStatus_NotInlined;
     }
-    RootedScript script(cx, script_);
-    if (types::ArrayPrototypeHasIndexedProperty(cx, script))
+
+    RootedScript scriptRoot(cx, script());
+    if (types::ArrayPrototypeHasIndexedProperty(cx, scriptRoot))
         return InliningStatus_NotInlined;
 
     types::TemporaryTypeSet::DoubleConversion conversion = thisTypes->convertDoubleElements(cx);
@@ -455,8 +457,8 @@ IonBuilder::inlineArrayConcat(CallInfo &callInfo)
     }
 
     // Watch out for indexed properties on the prototype.
-    RootedScript script(cx, script_);
-    if (types::ArrayPrototypeHasIndexedProperty(cx, script))
+    RootedScript scriptRoot(cx, script());
+    if (types::ArrayPrototypeHasIndexedProperty(cx, scriptRoot))
         return InliningStatus_NotInlined;
 
     // Require the 'this' types to have a specific type matching the current
@@ -467,7 +469,7 @@ IonBuilder::inlineArrayConcat(CallInfo &callInfo)
     types::TypeObject *thisType = thisTypes->getTypeObject(0);
     if (!thisType ||
         thisType->unknownProperties() ||
-        &thisType->proto->global() != &script->global())
+        &thisType->proto->global() != &script()->global())
     {
         return InliningStatus_NotInlined;
     }
@@ -511,7 +513,7 @@ IonBuilder::inlineArrayConcat(CallInfo &callInfo)
     }
 
     // Inline the call.
-    RootedObject templateObj(cx, NewDenseEmptyArray(cx, thisType->proto, TenuredObject));
+    JSObject *templateObj = NewDenseEmptyArray(cx, thisType->proto, TenuredObject);
     if (!templateObj)
         return InliningStatus_Error;
     templateObj->setType(thisType);
@@ -701,7 +703,7 @@ IonBuilder::inlineMathPow(CallInfo &callInfo)
     // Optimize some constant powers.
     if (callInfo.getArg(1)->isConstant()) {
         double pow;
-        RootedValue v(GetIonContext()->cx, callInfo.getArg(1)->toConstant()->value());
+        Value v = callInfo.getArg(1)->toConstant()->value();
         if (!ToNumber(GetIonContext()->cx, v, &pow))
             return InliningStatus_Error;
 
@@ -895,7 +897,7 @@ IonBuilder::inlineStringObject(CallInfo &callInfo)
     callInfo.unwrapArgs();
 
     RootedString emptyString(cx, cx->runtime()->emptyString);
-    RootedObject templateObj(cx, StringObject::create(cx, emptyString, TenuredObject));
+    JSObject *templateObj = StringObject::create(cx, emptyString, TenuredObject);
     if (!templateObj)
         return InliningStatus_Error;
 
@@ -1309,7 +1311,7 @@ IonBuilder::inlineParallelArrayTail(CallInfo &callInfo,
 
     // Create the MIR to allocate the new parallel array.  Take the type
     // object is taken from the prediction set.
-    RootedObject templateObject(cx, ParallelArrayObject::newInstance(cx, TenuredObject));
+    JSObject *templateObject = ParallelArrayObject::newInstance(cx, TenuredObject);
     if (!templateObject)
         return InliningStatus_Error;
     templateObject->setType(typeObject);
@@ -1373,7 +1375,7 @@ IonBuilder::inlineNewDenseArrayForParallelExecution(CallInfo &callInfo)
         return InliningStatus_NotInlined;
     types::TypeObject *typeObject = returnTypes->getTypeObject(0);
 
-    RootedObject templateObject(cx, NewDenseAllocatedArray(cx, 0, NULL, TenuredObject));
+    JSObject *templateObject = NewDenseAllocatedArray(cx, 0, NULL, TenuredObject);
     if (!templateObject)
         return InliningStatus_Error;
     templateObject->setType(typeObject);
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 7bcacc8b6b7..ac41db67fb4 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -1502,7 +1502,7 @@ class MInitProp
     CompilerRootPropertyName name_;
 
   protected:
-    MInitProp(MDefinition *obj, HandlePropertyName name, MDefinition *value)
+    MInitProp(MDefinition *obj, PropertyName *name, MDefinition *value)
       : name_(name)
     {
         setOperand(0, obj);
@@ -1513,7 +1513,7 @@ class MInitProp
   public:
     INSTRUCTION_HEADER(InitProp)
 
-    static MInitProp *New(MDefinition *obj, HandlePropertyName name, MDefinition *value) {
+    static MInitProp *New(MDefinition *obj, PropertyName *name, MDefinition *value) {
         return new MInitProp(obj, name, value);
     }
 
@@ -4327,7 +4327,7 @@ class MDefFun : public MUnaryInstruction
     CompilerRootFunction fun_;
 
   private:
-    MDefFun(HandleFunction fun, MDefinition *scopeChain)
+    MDefFun(JSFunction *fun, MDefinition *scopeChain)
       : MUnaryInstruction(scopeChain),
         fun_(fun)
     {}
@@ -4335,7 +4335,7 @@ class MDefFun : public MUnaryInstruction
   public:
     INSTRUCTION_HEADER(DefFun)
 
-    static MDefFun *New(HandleFunction fun, MDefinition *scopeChain) {
+    static MDefFun *New(JSFunction *fun, MDefinition *scopeChain) {
         return new MDefFun(fun, scopeChain);
     }
 
@@ -5327,7 +5327,7 @@ class MArrayConcat
 {
     CompilerRootObject templateObj_;
 
-    MArrayConcat(MDefinition *lhs, MDefinition *rhs, HandleObject templateObj)
+    MArrayConcat(MDefinition *lhs, MDefinition *rhs, JSObject *templateObj)
       : MBinaryInstruction(lhs, rhs),
         templateObj_(templateObj)
     {
@@ -5338,7 +5338,7 @@ class MArrayConcat
   public:
     INSTRUCTION_HEADER(ArrayConcat)
 
-    static MArrayConcat *New(MDefinition *lhs, MDefinition *rhs, HandleObject templateObj) {
+    static MArrayConcat *New(MDefinition *lhs, MDefinition *rhs, JSObject *templateObj) {
         return new MArrayConcat(lhs, rhs, templateObj);
     }
 
@@ -5924,7 +5924,7 @@ class MGetPropertyCache
 
     InlinePropertyTable *inlinePropertyTable_;
 
-    MGetPropertyCache(MDefinition *obj, HandlePropertyName name)
+    MGetPropertyCache(MDefinition *obj, PropertyName *name)
       : MUnaryInstruction(obj),
         name_(name),
         idempotent_(false),
@@ -5943,7 +5943,7 @@ class MGetPropertyCache
   public:
     INSTRUCTION_HEADER(GetPropertyCache)
 
-    static MGetPropertyCache *New(MDefinition *obj, HandlePropertyName name) {
+    static MGetPropertyCache *New(MDefinition *obj, PropertyName *name) {
         return new MGetPropertyCache(obj, name);
     }
 
@@ -6025,7 +6025,7 @@ class MGetPropertyPolymorphic
     Vector<Entry, 4, IonAllocPolicy> shapes_;
     CompilerRootPropertyName name_;
 
-    MGetPropertyPolymorphic(MDefinition *obj, HandlePropertyName name)
+    MGetPropertyPolymorphic(MDefinition *obj, PropertyName *name)
       : MUnaryInstruction(obj),
         name_(name)
     {
@@ -6040,7 +6040,7 @@ class MGetPropertyPolymorphic
   public:
     INSTRUCTION_HEADER(GetPropertyPolymorphic)
 
-    static MGetPropertyPolymorphic *New(MDefinition *obj, HandlePropertyName name) {
+    static MGetPropertyPolymorphic *New(MDefinition *obj, PropertyName *name) {
         return new MGetPropertyPolymorphic(obj, name);
     }
 
@@ -6683,7 +6683,7 @@ class MGetNameCache
     CompilerRootPropertyName name_;
     AccessKind kind_;
 
-    MGetNameCache(MDefinition *obj, HandlePropertyName name, AccessKind kind)
+    MGetNameCache(MDefinition *obj, PropertyName *name, AccessKind kind)
       : MUnaryInstruction(obj),
         name_(name),
         kind_(kind)
@@ -6694,7 +6694,7 @@ class MGetNameCache
   public:
     INSTRUCTION_HEADER(GetNameCache)
 
-    static MGetNameCache *New(MDefinition *obj, HandlePropertyName name, AccessKind kind) {
+    static MGetNameCache *New(MDefinition *obj, PropertyName *name, AccessKind kind) {
         return new MGetNameCache(obj, name, kind);
     }
     TypePolicy *typePolicy() {
@@ -6715,7 +6715,7 @@ class MCallGetIntrinsicValue : public MNullaryInstruction
 {
     CompilerRootPropertyName name_;
 
-    MCallGetIntrinsicValue(HandlePropertyName name)
+    MCallGetIntrinsicValue(PropertyName *name)
       : name_(name)
     {
         setResultType(MIRType_Value);
@@ -6724,7 +6724,7 @@ class MCallGetIntrinsicValue : public MNullaryInstruction
   public:
     INSTRUCTION_HEADER(CallGetIntrinsicValue)
 
-    static MCallGetIntrinsicValue *New(HandlePropertyName name) {
+    static MCallGetIntrinsicValue *New(PropertyName *name) {
         return new MCallGetIntrinsicValue(name);
     }
     PropertyName *name() const {
@@ -6780,7 +6780,7 @@ class MSetPropertyInstruction : public MBinaryInstruction
     bool needsBarrier_;
 
   protected:
-    MSetPropertyInstruction(MDefinition *obj, MDefinition *value, HandlePropertyName name,
+    MSetPropertyInstruction(MDefinition *obj, MDefinition *value, PropertyName *name,
                             bool strict)
       : MBinaryInstruction(obj, value),
         name_(name), strict_(strict), needsBarrier_(true)
@@ -6835,7 +6835,7 @@ class MDeleteProperty
     CompilerRootPropertyName name_;
 
   protected:
-    MDeleteProperty(MDefinition *val, HandlePropertyName name)
+    MDeleteProperty(MDefinition *val, PropertyName *name)
       : MUnaryInstruction(val),
         name_(name)
     {
@@ -6845,7 +6845,7 @@ class MDeleteProperty
   public:
     INSTRUCTION_HEADER(DeleteProperty)
 
-    static MDeleteProperty *New(MDefinition *obj, HandlePropertyName name) {
+    static MDeleteProperty *New(MDefinition *obj, PropertyName *name) {
         return new MDeleteProperty(obj, name);
     }
     MDefinition *value() const {
@@ -6892,7 +6892,7 @@ class MCallSetProperty
   : public MSetPropertyInstruction,
     public CallSetElementPolicy
 {
-    MCallSetProperty(MDefinition *obj, MDefinition *value, HandlePropertyName name, bool strict)
+    MCallSetProperty(MDefinition *obj, MDefinition *value, PropertyName *name, bool strict)
       : MSetPropertyInstruction(obj, value, name, strict)
     {
     }
@@ -6900,7 +6900,7 @@ class MCallSetProperty
   public:
     INSTRUCTION_HEADER(CallSetProperty)
 
-    static MCallSetProperty *New(MDefinition *obj, MDefinition *value, HandlePropertyName name, bool strict) {
+    static MCallSetProperty *New(MDefinition *obj, MDefinition *value, PropertyName *name, bool strict) {
         return new MCallSetProperty(obj, value, name, strict);
     }
 
@@ -6918,7 +6918,7 @@ class MSetPropertyCache
 {
     bool needsTypeBarrier_;
 
-    MSetPropertyCache(MDefinition *obj, MDefinition *value, HandlePropertyName name, bool strict,
+    MSetPropertyCache(MDefinition *obj, MDefinition *value, PropertyName *name, bool strict,
                       bool typeBarrier)
       : MSetPropertyInstruction(obj, value, name, strict),
         needsTypeBarrier_(typeBarrier)
@@ -6928,7 +6928,7 @@ class MSetPropertyCache
   public:
     INSTRUCTION_HEADER(SetPropertyCache)
 
-    static MSetPropertyCache *New(MDefinition *obj, MDefinition *value, HandlePropertyName name,
+    static MSetPropertyCache *New(MDefinition *obj, MDefinition *value, PropertyName *name,
                                   bool strict, bool typeBarrier) {
         return new MSetPropertyCache(obj, value, name, strict, typeBarrier);
     }
@@ -6980,7 +6980,7 @@ class MCallGetProperty
     CompilerRootPropertyName name_;
     bool idempotent_;
 
-    MCallGetProperty(MDefinition *value, HandlePropertyName name)
+    MCallGetProperty(MDefinition *value, PropertyName *name)
       : MUnaryInstruction(value), name_(name),
         idempotent_(false)
     {
@@ -6990,7 +6990,7 @@ class MCallGetProperty
   public:
     INSTRUCTION_HEADER(CallGetProperty)
 
-    static MCallGetProperty *New(MDefinition *value, HandlePropertyName name) {
+    static MCallGetProperty *New(MDefinition *value, PropertyName *name) {
         return new MCallGetProperty(value, name);
     }
     MDefinition *value() const {
@@ -8022,7 +8022,7 @@ class MNewStringObject :
 {
     CompilerRootObject templateObj_;
 
-    MNewStringObject(MDefinition *input, HandleObject templateObj)
+    MNewStringObject(MDefinition *input, JSObject *templateObj)
       : MUnaryInstruction(input),
         templateObj_(templateObj)
     {
@@ -8032,7 +8032,7 @@ class MNewStringObject :
   public:
     INSTRUCTION_HEADER(NewStringObject)
 
-    static MNewStringObject *New(MDefinition *input, HandleObject templateObj) {
+    static MNewStringObject *New(MDefinition *input, JSObject *templateObj) {
         return new MNewStringObject(input, templateObj);
     }
 
diff --git a/js/src/jit/MIRGraph.cpp b/js/src/jit/MIRGraph.cpp
index 29f34871224..fa5f39d8685 100644
--- a/js/src/jit/MIRGraph.cpp
+++ b/js/src/jit/MIRGraph.cpp
@@ -158,7 +158,7 @@ MIRGraph::forkJoinSlice()
 }
 
 MBasicBlock *
-MBasicBlock::New(MIRGraph &graph, CompileInfo &info,
+MBasicBlock::New(MIRGraph &graph, BytecodeAnalysis *analysis, CompileInfo &info,
                  MBasicBlock *pred, jsbytecode *entryPc, Kind kind)
 {
     JS_ASSERT(entryPc != NULL);
@@ -167,7 +167,7 @@ MBasicBlock::New(MIRGraph &graph, CompileInfo &info,
     if (!block->init())
         return NULL;
 
-    if (!block->inherit(pred, 0))
+    if (!block->inherit(analysis, pred, 0))
         return NULL;
 
     return block;
@@ -181,7 +181,7 @@ MBasicBlock::NewPopN(MIRGraph &graph, CompileInfo &info,
     if (!block->init())
         return NULL;
 
-    if (!block->inherit(pred, popped))
+    if (!block->inherit(NULL, pred, popped))
         return NULL;
 
     return block;
@@ -210,14 +210,14 @@ MBasicBlock *
 MBasicBlock::NewPendingLoopHeader(MIRGraph &graph, CompileInfo &info,
                                   MBasicBlock *pred, jsbytecode *entryPc)
 {
-    return MBasicBlock::New(graph, info, pred, entryPc, PENDING_LOOP_HEADER);
+    return MBasicBlock::New(graph, NULL, info, pred, entryPc, PENDING_LOOP_HEADER);
 }
 
 MBasicBlock *
 MBasicBlock::NewSplitEdge(MIRGraph &graph, CompileInfo &info, MBasicBlock *pred)
 {
     return pred->pc()
-           ? MBasicBlock::New(graph, info, pred, pred->pc(), SPLIT_EDGE)
+           ? MBasicBlock::New(graph, NULL, info, pred, pred->pc(), SPLIT_EDGE)
            : MBasicBlock::NewAsmJS(graph, info, pred, SPLIT_EDGE);
 }
 
@@ -323,7 +323,7 @@ MBasicBlock::copySlots(MBasicBlock *from)
 }
 
 bool
-MBasicBlock::inherit(MBasicBlock *pred, uint32_t popped)
+MBasicBlock::inherit(BytecodeAnalysis *analysis, MBasicBlock *pred, uint32_t popped)
 {
     if (pred) {
         stackPosition_ = pred->stackPosition_;
@@ -332,7 +332,7 @@ MBasicBlock::inherit(MBasicBlock *pred, uint32_t popped)
         if (kind_ != PENDING_LOOP_HEADER)
             copySlots(pred);
     } else {
-        uint32_t stackDepth = info().script()->analysis()->getCode(pc()).stackDepth;
+        uint32_t stackDepth = analysis->info(pc()).stackDepth;
         stackPosition_ = info().firstStackSlot() + stackDepth;
         JS_ASSERT(stackPosition_ >= popped);
         stackPosition_ -= popped;
diff --git a/js/src/jit/MIRGraph.h b/js/src/jit/MIRGraph.h
index 4140551c532..a253743bdb6 100644
--- a/js/src/jit/MIRGraph.h
+++ b/js/src/jit/MIRGraph.h
@@ -18,6 +18,7 @@
 namespace js {
 namespace jit {
 
+class BytecodeAnalysis;
 class MBasicBlock;
 class MIRGraph;
 class MStart;
@@ -46,7 +47,7 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
     MBasicBlock(MIRGraph &graph, CompileInfo &info, jsbytecode *pc, Kind kind);
     bool init();
     void copySlots(MBasicBlock *from);
-    bool inherit(MBasicBlock *pred, uint32_t popped);
+    bool inherit(BytecodeAnalysis *analysis, MBasicBlock *pred, uint32_t popped);
     bool inheritResumePoint(MBasicBlock *pred);
     void assertUsesAreNotWithin(MUseIterator use, MUseIterator end);
 
@@ -67,7 +68,7 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
 
     // Creates a new basic block for a MIR generator. If |pred| is not NULL,
     // its slots and stack depth are initialized from |pred|.
-    static MBasicBlock *New(MIRGraph &graph, CompileInfo &info,
+    static MBasicBlock *New(MIRGraph &graph, BytecodeAnalysis *analysis, CompileInfo &info,
                             MBasicBlock *pred, jsbytecode *entryPc, Kind kind);
     static MBasicBlock *NewPopN(MIRGraph &graph, CompileInfo &info,
                                 MBasicBlock *pred, jsbytecode *entryPc, Kind kind, uint32_t popn);
diff --git a/js/src/jit/arm/Assembler-arm.cpp b/js/src/jit/arm/Assembler-arm.cpp
index c2c2beeeed1..a47f3c04abb 100644
--- a/js/src/jit/arm/Assembler-arm.cpp
+++ b/js/src/jit/arm/Assembler-arm.cpp
@@ -900,7 +900,7 @@ Assembler::processCodeLabels(uint8_t *rawCode)
 void
 Assembler::writeCodePointer(AbsoluteLabel *absoluteLabel) {
     JS_ASSERT(!absoluteLabel->bound());
-    BufferOffset off = writeInst(-1);
+    BufferOffset off = writeInst(LabelBase::INVALID_OFFSET);
 
     // x86/x64 makes general use of AbsoluteLabel and weaves a linked list of
     // uses of an AbsoluteLabel through the assembly. ARM only uses labels
diff --git a/js/src/jit/arm/Assembler-arm.h b/js/src/jit/arm/Assembler-arm.h
index 08a08f2d900..3ea43cb8d1e 100644
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@@ -1375,6 +1375,12 @@ class Assembler
     void copyPreBarrierTable(uint8_t *dest);
 
     bool addCodeLabel(CodeLabel label);
+    size_t numCodeLabels() const {
+        return codeLabels_.length();
+    }
+    CodeLabel codeLabel(size_t i) {
+        return codeLabels_[i];
+    }
 
     // Size of the instruction stream, in bytes.
     size_t size() const;
@@ -1627,9 +1633,14 @@ class Assembler
     void retarget(Label *label, Label *target);
     // I'm going to pretend this doesn't exist for now.
     void retarget(Label *label, void *target, Relocation::Kind reloc);
-    //    void Bind(IonCode *code, AbsoluteLabel *label, const void *address);
+
     void Bind(uint8_t *rawCode, AbsoluteLabel *label, const void *address);
 
+    // See Bind
+    size_t labelOffsetToPatchOffset(size_t offset) {
+        return actualOffset(offset);
+    }
+
     void call(Label *label);
     void call(void *target);
 
@@ -1640,8 +1651,8 @@ class Assembler
     static void TraceDataRelocations(JSTracer *trc, IonCode *code, CompactBufferReader &reader);
 
   protected:
-    void addPendingJump(BufferOffset src, void *target, Relocation::Kind kind) {
-        enoughMemory_ &= jumps_.append(RelativePatch(src, target, kind));
+    void addPendingJump(BufferOffset src, ImmPtr target, Relocation::Kind kind) {
+        enoughMemory_ &= jumps_.append(RelativePatch(src, target.value, kind));
         if (kind == Relocation::IONCODE)
             writeRelocation(src);
     }
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index be3d9db8a1c..da1ec1c3af3 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -1692,7 +1692,7 @@ MacroAssemblerARMCompat::callWithExitFrame(IonCode *target)
     uint32_t descriptor = MakeFrameDescriptor(framePushed(), IonFrame_OptimizedJS);
     Push(Imm32(descriptor)); // descriptor
 
-    addPendingJump(m_buffer.nextOffset(), target->raw(), Relocation::IONCODE);
+    addPendingJump(m_buffer.nextOffset(), ImmPtr(target->raw()), Relocation::IONCODE);
     RelocStyle rs;
     if (hasMOVWT())
         rs = L_MOVWT;
@@ -1710,7 +1710,7 @@ MacroAssemblerARMCompat::callWithExitFrame(IonCode *target, Register dynStack)
     makeFrameDescriptor(dynStack, IonFrame_OptimizedJS);
     Push(dynStack); // descriptor
 
-    addPendingJump(m_buffer.nextOffset(), target->raw(), Relocation::IONCODE);
+    addPendingJump(m_buffer.nextOffset(), ImmPtr(target->raw()), Relocation::IONCODE);
     RelocStyle rs;
     if (hasMOVWT())
         rs = L_MOVWT;
@@ -3756,7 +3756,7 @@ MacroAssemblerARMCompat::toggledCall(IonCode *target, bool enabled)
 {
     BufferOffset bo = nextOffset();
     CodeOffsetLabel offset(bo.getOffset());
-    addPendingJump(bo, target->raw(), Relocation::IONCODE);
+    addPendingJump(bo, ImmPtr(target->raw()), Relocation::IONCODE);
     ma_movPatchable(ImmPtr(target->raw()), ScratchRegister, Always, hasMOVWT() ? L_MOVWT : L_LDR);
     if (enabled)
         ma_blx(ScratchRegister);
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 6e59039608c..f008266fc1f 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -536,17 +536,17 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
         // for now, assume that it'll be nearby?
         as_bl(label, Always);
     }
-    void call(ImmWord word) {
-        BufferOffset bo = m_buffer.nextOffset();
-        addPendingJump(bo, (void*)word.value, Relocation::HARDCODED);
-        ma_call((void *) word.value);
+    void call(ImmWord imm) {
+        call(ImmPtr((void*)imm.value));
     }
     void call(ImmPtr imm) {
-        call(ImmWord(uintptr_t(imm.value)));
+        BufferOffset bo = m_buffer.nextOffset();
+        addPendingJump(bo, imm, Relocation::HARDCODED);
+        ma_call(imm.value);
     }
     void call(IonCode *c) {
         BufferOffset bo = m_buffer.nextOffset();
-        addPendingJump(bo, c->raw(), Relocation::IONCODE);
+        addPendingJump(bo, ImmPtr(c->raw()), Relocation::IONCODE);
         RelocStyle rs;
         if (hasMOVWT())
             rs = L_MOVWT;
@@ -558,7 +558,7 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
     }
     void branch(IonCode *c) {
         BufferOffset bo = m_buffer.nextOffset();
-        addPendingJump(bo, c->raw(), Relocation::IONCODE);
+        addPendingJump(bo, ImmPtr(c->raw()), Relocation::IONCODE);
         RelocStyle rs;
         if (hasMOVWT())
             rs = L_MOVWT;
diff --git a/js/src/jit/shared/Assembler-x86-shared.h b/js/src/jit/shared/Assembler-x86-shared.h
index 819a75d89f1..52bd38313e9 100644
--- a/js/src/jit/shared/Assembler-x86-shared.h
+++ b/js/src/jit/shared/Assembler-x86-shared.h
@@ -189,6 +189,9 @@ class AssemblerX86Shared
     size_t numCodeLabels() const {
         return codeLabels_.length();
     }
+    CodeLabel codeLabel(size_t i) {
+        return codeLabels_[i];
+    }
 
     // Size of the instruction stream, in bytes.
     size_t size() const {
@@ -666,6 +669,11 @@ class AssemblerX86Shared
         label->bind();
     }
 
+    // See Bind and JSC::X86Assembler::setPointer.
+    size_t labelOffsetToPatchOffset(size_t offset) {
+        return offset - sizeof(void*);
+    }
+
     void ret() {
         masm.ret();
     }
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index e30407f56de..bbe11a76844 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -250,7 +250,7 @@ CodeGeneratorX86Shared::generateOutOfLineCode()
         masm.push(Imm32(frameSize()));
 
         IonCode *handler = gen->ionRuntime()->getGenericBailoutHandler();
-        masm.jmp(handler->raw(), Relocation::IONCODE);
+        masm.jmp(ImmPtr(handler->raw()), Relocation::IONCODE);
     }
 
     return true;
@@ -264,7 +264,7 @@ class BailoutJump {
     { }
 #ifdef JS_CPU_X86
     void operator()(MacroAssembler &masm, uint8_t *code) const {
-        masm.j(cond_, code, Relocation::HARDCODED);
+        masm.j(cond_, ImmPtr(code), Relocation::HARDCODED);
     }
 #endif
     void operator()(MacroAssembler &masm, Label *label) const {
@@ -280,7 +280,7 @@ class BailoutLabel {
     { }
 #ifdef JS_CPU_X86
     void operator()(MacroAssembler &masm, uint8_t *code) const {
-        masm.retarget(label_, code, Relocation::HARDCODED);
+        masm.retarget(label_, ImmPtr(code), Relocation::HARDCODED);
     }
 #endif
     void operator()(MacroAssembler &masm, Label *label) const {
diff --git a/js/src/jit/x64/Assembler-x64.cpp b/js/src/jit/x64/Assembler-x64.cpp
index 5b893f55c09..a4e1de620cc 100644
--- a/js/src/jit/x64/Assembler-x64.cpp
+++ b/js/src/jit/x64/Assembler-x64.cpp
@@ -94,15 +94,15 @@ Assembler::writeRelocation(JmpSrc src, Relocation::Kind reloc)
 }
 
 void
-Assembler::addPendingJump(JmpSrc src, void *target, Relocation::Kind reloc)
+Assembler::addPendingJump(JmpSrc src, ImmPtr target, Relocation::Kind reloc)
 {
-    JS_ASSERT(target);
+    JS_ASSERT(target.value != NULL);
 
     // Emit reloc before modifying the jump table, since it computes a 0-based
     // index. This jump is not patchable at runtime.
     if (reloc == Relocation::IONCODE)
         writeRelocation(src, reloc);
-    enoughMemory_ &= jumps_.append(RelativePatch(src.offset(), target, reloc));
+    enoughMemory_ &= jumps_.append(RelativePatch(src.offset(), target.value, reloc));
 }
 
 size_t
diff --git a/js/src/jit/x64/Assembler-x64.h b/js/src/jit/x64/Assembler-x64.h
index 2e7d9fa5ca5..58cb7aa4d75 100644
--- a/js/src/jit/x64/Assembler-x64.h
+++ b/js/src/jit/x64/Assembler-x64.h
@@ -313,7 +313,7 @@ class Assembler : public AssemblerX86Shared
 
   private:
     void writeRelocation(JmpSrc src, Relocation::Kind reloc);
-    void addPendingJump(JmpSrc src, void *target, Relocation::Kind reloc);
+    void addPendingJump(JmpSrc src, ImmPtr target, Relocation::Kind reloc);
 
   protected:
     size_t addPatchableJump(JmpSrc src, Relocation::Kind reloc);
@@ -714,25 +714,25 @@ class Assembler : public AssemblerX86Shared
         }
     }
 
-    void jmp(void *target, Relocation::Kind reloc = Relocation::HARDCODED) {
+    void jmp(ImmPtr target, Relocation::Kind reloc = Relocation::HARDCODED) {
         JmpSrc src = masm.jmp();
         addPendingJump(src, target, reloc);
     }
-    void j(Condition cond, void *target,
+    void j(Condition cond, ImmPtr target,
            Relocation::Kind reloc = Relocation::HARDCODED) {
         JmpSrc src = masm.jCC(static_cast<JSC::X86Assembler::Condition>(cond));
         addPendingJump(src, target, reloc);
     }
 
     void jmp(IonCode *target) {
-        jmp(target->raw(), Relocation::IONCODE);
+        jmp(ImmPtr(target->raw()), Relocation::IONCODE);
     }
     void j(Condition cond, IonCode *target) {
-        j(cond, target->raw(), Relocation::IONCODE);
+        j(cond, ImmPtr(target->raw()), Relocation::IONCODE);
     }
     void call(IonCode *target) {
         JmpSrc src = masm.call();
-        addPendingJump(src, target->raw(), Relocation::IONCODE);
+        addPendingJump(src, ImmPtr(target->raw()), Relocation::IONCODE);
     }
 
     // Emit a CALL or CMP (nop) instruction. ToggleCall can be used to patch
@@ -740,7 +740,7 @@ class Assembler : public AssemblerX86Shared
     CodeOffsetLabel toggledCall(IonCode *target, bool enabled) {
         CodeOffsetLabel offset(size());
         JmpSrc src = enabled ? masm.call() : masm.cmp_eax();
-        addPendingJump(src, target->raw(), Relocation::IONCODE);
+        addPendingJump(src, ImmPtr(target->raw()), Relocation::IONCODE);
         JS_ASSERT(size() - offset.offset() == ToggledCallSize());
         return offset;
     }
diff --git a/js/src/jit/x86/Assembler-x86.h b/js/src/jit/x86/Assembler-x86.h
index 58a912f3bf5..b3f296232a6 100644
--- a/js/src/jit/x86/Assembler-x86.h
+++ b/js/src/jit/x86/Assembler-x86.h
@@ -237,8 +237,8 @@ class Assembler : public AssemblerX86Shared
     void writeRelocation(JmpSrc src) {
         jumpRelocations_.writeUnsigned(src.offset());
     }
-    void addPendingJump(JmpSrc src, void *target, Relocation::Kind kind) {
-        enoughMemory_ &= jumps_.append(RelativePatch(src.offset(), target, kind));
+    void addPendingJump(JmpSrc src, ImmPtr target, Relocation::Kind kind) {
+        enoughMemory_ &= jumps_.append(RelativePatch(src.offset(), target.value, kind));
         if (kind == Relocation::IONCODE)
             writeRelocation(src);
     }
@@ -395,32 +395,32 @@ class Assembler : public AssemblerX86Shared
         return masm.currentOffset();
     }
 
-    void jmp(void *target, Relocation::Kind reloc = Relocation::HARDCODED) {
+    void jmp(ImmPtr target, Relocation::Kind reloc = Relocation::HARDCODED) {
         JmpSrc src = masm.jmp();
         addPendingJump(src, target, reloc);
     }
-    void j(Condition cond, void *target,
+    void j(Condition cond, ImmPtr target,
            Relocation::Kind reloc = Relocation::HARDCODED) {
         JmpSrc src = masm.jCC(static_cast<JSC::X86Assembler::Condition>(cond));
         addPendingJump(src, target, reloc);
     }
 
     void jmp(IonCode *target) {
-        jmp(target->raw(), Relocation::IONCODE);
+        jmp(ImmPtr(target->raw()), Relocation::IONCODE);
     }
     void j(Condition cond, IonCode *target) {
-        j(cond, target->raw(), Relocation::IONCODE);
+        j(cond, ImmPtr(target->raw()), Relocation::IONCODE);
     }
     void call(IonCode *target) {
         JmpSrc src = masm.call();
-        addPendingJump(src, target->raw(), Relocation::IONCODE);
+        addPendingJump(src, ImmPtr(target->raw()), Relocation::IONCODE);
     }
     void call(ImmWord target) {
-        JmpSrc src = masm.call();
-        addPendingJump(src, (void*)target.value, Relocation::HARDCODED);
+        call(ImmPtr((void*)target.value));
     }
     void call(ImmPtr target) {
-        call(ImmWord(uintptr_t(target.value)));
+        JmpSrc src = masm.call();
+        addPendingJump(src, target, Relocation::HARDCODED);
     }
 
     // Emit a CALL or CMP (nop) instruction. ToggleCall can be used to patch
@@ -428,7 +428,7 @@ class Assembler : public AssemblerX86Shared
     CodeOffsetLabel toggledCall(IonCode *target, bool enabled) {
         CodeOffsetLabel offset(size());
         JmpSrc src = enabled ? masm.call() : masm.cmp_eax();
-        addPendingJump(src, target->raw(), Relocation::IONCODE);
+        addPendingJump(src, ImmPtr(target->raw()), Relocation::IONCODE);
         JS_ASSERT(size() - offset.offset() == ToggledCallSize());
         return offset;
     }
@@ -440,7 +440,7 @@ class Assembler : public AssemblerX86Shared
 
     // Re-routes pending jumps to an external target, flushing the label in the
     // process.
-    void retarget(Label *label, void *target, Relocation::Kind reloc) {
+    void retarget(Label *label, ImmPtr target, Relocation::Kind reloc) {
         JSC::MacroAssembler::Label jsclabel;
         if (label->used()) {
             bool more;
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index e7877837886..c3bbf1aa726 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -78,13 +78,6 @@ class Bytecode
     /* Whether this is a catch/finally entry point. */
     bool exceptionEntry : 1;
 
-    /*
-     * Dynamically observed state about the execution of this opcode. These are
-     * hints about the script for use during compilation.
-     */
-    bool arrayWriteHole: 1;     /* SETELEM which has written to an array hole. */
-    bool accessGetter: 1;       /* Property read on a shape with a getter hook. */
-
     /* Stack depth before this opcode. */
     uint32_t stackDepth;
 
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 4e13ea34233..391cc52a903 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -4802,7 +4802,7 @@ JS_DecompileScript(JSContext *cx, JSScript *scriptArg, const char *name, unsigne
     if (fun)
         return JS_DecompileFunction(cx, fun, indent);
     bool haveSource = script->scriptSource()->hasSourceData();
-    if (!haveSource && !JSScript::loadSource(cx, script, &haveSource))
+    if (!haveSource && !JSScript::loadSource(cx, script->scriptSource(), &haveSource))
         return NULL;
     return haveSource ? script->sourceData(cx) : js_NewStringCopyZ<CanGC>(cx, "[no source]");
 }
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 46957ad9fc8..88a050a1cb8 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -1143,22 +1143,6 @@ js::IsInRequest(JSContext *cx)
 }
 #endif
 
-void
-AsmJSModuleSourceDesc::init(ScriptSource *scriptSource, uint32_t bufStart, uint32_t bufEnd)
-{
-    JS_ASSERT(scriptSource_ == NULL);
-    scriptSource_ = scriptSource;
-    bufStart_ = bufStart;
-    bufEnd_ = bufEnd;
-    scriptSource_->incref();
-}
-
-AsmJSModuleSourceDesc::~AsmJSModuleSourceDesc()
-{
-    if (scriptSource_)
-        scriptSource_->decref();
-}
-
 #ifdef JSGC_GENERATIONAL
 JS_FRIEND_API(void)
 JS_StoreObjectPostBarrierCallback(JSContext* cx,
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index 0a03fda9857..d2f86285d71 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -203,7 +203,7 @@ struct JSFunctionSpecWithHelp {
 extern JS_FRIEND_API(bool)
 JS_DefineFunctionsWithHelp(JSContext *cx, JSObject *obj, const JSFunctionSpecWithHelp *fs);
 
-typedef bool (* JS_SourceHook)(JSContext *cx, JS::Handle<JSScript*> script,
+typedef bool (* JS_SourceHook)(JSContext *cx, const char *filename,
                                jschar **src, uint32_t *length);
 
 extern JS_FRIEND_API(void)
@@ -1574,31 +1574,6 @@ extern JS_FRIEND_API(bool)
 CheckDefineProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::HandleValue value,
                     JSPropertyOp getter, JSStrictPropertyOp setter, unsigned attrs);
 
-class ScriptSource;
-
-// An AsmJSModuleSourceDesc object holds a reference to the ScriptSource
-// containing an asm.js module as well as the [begin, end) range of the
-// module's chars within the ScriptSource.
-class AsmJSModuleSourceDesc
-{
-    ScriptSource *scriptSource_;
-    uint32_t bufStart_;
-    uint32_t bufEnd_;
-
-  public:
-    AsmJSModuleSourceDesc() : scriptSource_(NULL), bufStart_(UINT32_MAX), bufEnd_(UINT32_MAX) {}
-    void init(ScriptSource *scriptSource, uint32_t bufStart, uint32_t bufEnd);
-    ~AsmJSModuleSourceDesc();
-
-    ScriptSource *scriptSource() const { JS_ASSERT(scriptSource_ != NULL); return scriptSource_; }
-    uint32_t bufStart() const { JS_ASSERT(bufStart_ != UINT32_MAX); return bufStart_; }
-    uint32_t bufEnd() const { JS_ASSERT(bufStart_ != UINT32_MAX); return bufEnd_; }
-
-  private:
-    AsmJSModuleSourceDesc(const AsmJSModuleSourceDesc &) MOZ_DELETE;
-    void operator=(const AsmJSModuleSourceDesc &) MOZ_DELETE;
-};
-
 } /* namespace js */
 
 extern JS_FRIEND_API(bool)
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index bdf46e188c5..0e5b5918638 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -649,7 +649,7 @@ js::FunctionToString(JSContext *cx, HandleFunction fun, bool bodyOnly, bool lamb
     }
     bool haveSource = fun->isInterpreted() && !fun->isSelfHostedBuiltin();
     if (haveSource && !script->scriptSource()->hasSourceData() &&
-        !JSScript::loadSource(cx, script, &haveSource))
+        !JSScript::loadSource(cx, script->scriptSource(), &haveSource))
     {
         return NULL;
     }
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 0347d1b2f79..3f43dafe905 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -4040,12 +4040,6 @@ NativeGetInline(JSContext *cx,
     {
         jsbytecode *pc;
         JSScript *script = cx->currentScript(&pc);
-        if (script && script->hasAnalysis()) {
-            analyze::Bytecode *code = script->analysis()->maybeCode(pc);
-            if (code)
-                code->accessGetter = true;
-        }
-
 #ifdef JS_ION
         if (script && script->hasBaselineScript()) {
             switch (JSOp(*pc)) {
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 7cfd12c03bf..32765aee5aa 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -991,19 +991,18 @@ ScriptSource::adjustDataSize(size_t nbytes)
 }
 
 /* static */ bool
-JSScript::loadSource(JSContext *cx, HandleScript script, bool *worked)
+JSScript::loadSource(JSContext *cx, ScriptSource *ss, bool *worked)
 {
-    JS_ASSERT(!script->scriptSource()->hasSourceData());
+    JS_ASSERT(!ss->hasSourceData());
     *worked = false;
-    if (!cx->runtime()->sourceHook || !script->scriptSource()->sourceRetrievable())
+    if (!cx->runtime()->sourceHook || !ss->sourceRetrievable())
         return true;
     jschar *src = NULL;
     uint32_t length;
-    if (!cx->runtime()->sourceHook(cx, script, &src, &length))
+    if (!cx->runtime()->sourceHook(cx, ss->filename(), &src, &length))
         return false;
     if (!src)
         return true;
-    ScriptSource *ss = script->scriptSource();
     ss->setSource(src, length);
     *worked = true;
     return true;
@@ -2960,6 +2959,20 @@ JSScript::updateBaselineOrIonRaw()
 #endif
 }
 
+bool
+JSScript::hasLoops()
+{
+    if (!hasTrynotes())
+        return false;
+    JSTryNote *tn = trynotes()->vector;
+    JSTryNote *tnlimit = tn + trynotes()->length;
+    for (; tn < tnlimit; tn++) {
+        if (tn->kind == JSTRY_ITER || tn->kind == JSTRY_LOOP)
+            return true;
+    }
+    return false;
+}
+
 static inline void
 LazyScriptHash(uint32_t lineno, uint32_t column, uint32_t begin, uint32_t end,
                HashNumber hashes[3])
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 680b5ae0ad1..12cc33a0856 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -797,7 +797,7 @@ class JSScript : public js::gc::Cell
 
     JSFlatString *sourceData(JSContext *cx);
 
-    static bool loadSource(JSContext *cx, js::HandleScript scr, bool *worked);
+    static bool loadSource(JSContext *cx, js::ScriptSource *ss, bool *worked);
 
     void setSourceObject(js::ScriptSourceObject *object);
     js::ScriptSourceObject *sourceObject() const;
@@ -932,6 +932,8 @@ class JSScript : public js::gc::Cell
         return reinterpret_cast<js::TryNoteArray *>(data + trynotesOffset());
     }
 
+    bool hasLoops();
+
     js::HeapPtrAtom &getAtom(size_t index) const {
         JS_ASSERT(index < natoms);
         return atoms[index];
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 0e2f1a4ccba..759c57c4e5d 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -3715,7 +3715,12 @@ DebuggerSource_getText(JSContext *cx, unsigned argc, Value *vp)
     THIS_DEBUGSOURCE_REFERENT(cx, argc, vp, "(get text)", args, obj, sourceObject);
 
     ScriptSource *ss = sourceObject->source();
-    JSString *str = ss->substring(cx, 0, ss->length());
+    bool hasSourceData = ss->hasSourceData();
+    if (!ss->hasSourceData() && !JSScript::loadSource(cx, ss, &hasSourceData))
+        return false;
+
+    JSString *str = hasSourceData ? ss->substring(cx, 0, ss->length())
+                                  : js_NewStringCopyZ<CanGC>(cx, "[no source]");
     if (!str)
         return false;
 
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 15130f61d80..0f0a30e93a7 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -1224,24 +1224,23 @@ ModOperation(JSContext *cx, HandleScript script, jsbytecode *pc, HandleValue lhs
 
 static JS_ALWAYS_INLINE bool
 SetObjectElementOperation(JSContext *cx, Handle<JSObject*> obj, HandleId id, const Value &value,
-                          bool strict, JSScript *maybeScript = NULL, jsbytecode *pc = NULL)
+                          bool strict, JSScript *script = NULL, jsbytecode *pc = NULL)
 {
-    RootedScript script(cx, maybeScript);
     types::TypeScript::MonitorAssign(cx, obj, id);
 
+#ifdef JS_ION
     if (obj->isNative() && JSID_IS_INT(id)) {
         uint32_t length = obj->getDenseInitializedLength();
         int32_t i = JSID_TO_INT(id);
         if ((uint32_t)i >= length) {
             // Annotate script if provided with information (e.g. baseline)
-            if (script && script->hasAnalysis()) {
-                JS_ASSERT(pc);
-                script->analysis()->getCode(pc).arrayWriteHole = true;
-            }
+            if (script && script->hasBaselineScript() && *pc == JSOP_SETELEM)
+                script->baselineScript()->noteArrayWriteHole(pc - script->code);
         }
     }
+#endif
 
-    if (obj->isNative() && !obj->setHadElementsAccess(cx))
+    if (obj->isNative() && !JSID_IS_INT(id) && !obj->setHadElementsAccess(cx))
         return false;
 
     RootedValue tmp(cx, value);
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 5f0bcfab4c3..f6d0575577c 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -2849,8 +2849,7 @@ ReadSourceFromFilename(JSContext *cx, const char *filename, jschar **src, uint32
   function. See the comment in the XPCJSRuntime constructor.
 */
 static bool
-SourceHook(JSContext *cx, JS::Handle<JSScript*> script, jschar **src,
-           uint32_t *length)
+SourceHook(JSContext *cx, const char *filename, jschar **src, uint32_t *length)
 {
   *src = NULL;
   *length = 0;
@@ -2858,7 +2857,6 @@ SourceHook(JSContext *cx, JS::Handle<JSScript*> script, jschar **src,
   if (!nsContentUtils::IsCallerChrome())
     return true;
 
-  const char *filename = JS_GetScriptFilename(cx, script);
   if (!filename)
     return true;
 
diff --git a/js/xpconnect/src/XPCWrappedJSClass.cpp b/js/xpconnect/src/XPCWrappedJSClass.cpp
index 1e4c9c69f6f..ac123f4f25e 100644
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -252,10 +252,7 @@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext* cx,
 
         JS_SetOptions(cx, oldOpts);
 
-        if (!success) {
-            MOZ_ASSERT(JS_IsExceptionPending(cx),
-                       "JS failed without setting an exception!");
-
+        if (!success && JS_IsExceptionPending(cx)) {
             RootedValue jsexception(cx, NullValue());
 
             if (JS_GetPendingException(cx, jsexception.address())) {
@@ -290,6 +287,8 @@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext* cx,
             // Don't report if reporting was disabled by someone else.
             if (!(oldOpts & JSOPTION_DONT_REPORT_UNCAUGHT))
                 JS_ReportPendingException(cx);
+        } else if (!success) {
+            NS_WARNING("QI hook ran OOMed - this is probably a bug!");
         }
     }
 
diff --git a/js/xpconnect/tests/mochitest/test_sameOriginPolicy.html b/js/xpconnect/tests/mochitest/test_sameOriginPolicy.html
index 1969e517c36..2505170c8e9 100644
--- a/js/xpconnect/tests/mochitest/test_sameOriginPolicy.html
+++ b/js/xpconnect/tests/mochitest/test_sameOriginPolicy.html
@@ -40,9 +40,7 @@ function check(obj, prop, allowed, write) {
 var crossOriginReadableWindowProps = ['blur', 'close', 'closed', 'focus',
                                       'frames', 'location', 'length',
                                       'opener', 'parent', 'postMessage',
-                                      'self', 'top', 'window',
-                                      /* indexed and named accessors */
-                                      '0', 'subframe'];
+                                      'self', 'top', 'window'];
 
 function isCrossOriginReadable(obj, prop) {
   if (obj == "Window")
diff --git a/js/xpconnect/wrappers/AccessCheck.cpp b/js/xpconnect/wrappers/AccessCheck.cpp
index 4856c5c5811..3ee33ea8074 100644
--- a/js/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/xpconnect/wrappers/AccessCheck.cpp
@@ -165,49 +165,6 @@ IsPermitted(const char *name, JSFlatString *prop, bool set)
 #undef R
 #undef W
 
-static bool
-IsFrameId(JSContext *cx, JSObject *objArg, jsid idArg)
-{
-    RootedObject obj(cx, objArg);
-    RootedId id(cx, idArg);
-
-    obj = JS_ObjectToInnerObject(cx, obj);
-    MOZ_ASSERT(!js::IsWrapper(obj));
-    XPCWrappedNative *wn = IS_WN_REFLECTOR(obj) ? XPCWrappedNative::Get(obj)
-                                                : nullptr;
-    if (!wn) {
-        return false;
-    }
-
-    nsCOMPtr<nsIDOMWindow> domwin(do_QueryWrappedNative(wn));
-    if (!domwin) {
-        return false;
-    }
-
-    nsCOMPtr<nsIDOMWindowCollection> col;
-    domwin->GetFrames(getter_AddRefs(col));
-    if (!col) {
-        return false;
-    }
-
-    if (JSID_IS_INT(id)) {
-        col->Item(JSID_TO_INT(id), getter_AddRefs(domwin));
-    } else if (JSID_IS_STRING(id)) {
-        nsAutoString str(JS_GetInternedStringChars(JSID_TO_STRING(id)));
-        col->NamedItem(str, getter_AddRefs(domwin));
-    } else {
-        return false;
-    }
-
-    return domwin != nullptr;
-}
-
-static bool
-IsWindow(const char *name)
-{
-    return name[0] == 'W' && !strcmp(name, "Window");
-}
-
 bool
 AccessCheck::isCrossOriginAccessPermitted(JSContext *cx, JSObject *wrapperArg, jsid idArg,
                                           Wrapper::Action act)
@@ -243,22 +200,6 @@ AccessCheck::isCrossOriginAccessPermitted(JSContext *cx, JSObject *wrapperArg, j
             return true;
     }
 
-    if (act != Wrapper::GET)
-        return false;
-
-    // Check for frame IDs. If we're resolving named frames, make sure to only
-    // resolve ones that don't shadow native properties. See bug 860494.
-    if (IsWindow(name)) {
-        if (JSID_IS_STRING(id) && !XrayUtils::IsXrayResolving(cx, wrapper, id)) {
-            bool wouldShadow = false;
-            if (!XrayUtils::HasNativeProperty(cx, wrapper, id, &wouldShadow) ||
-                wouldShadow)
-            {
-                return false;
-            }
-        }
-        return IsFrameId(cx, obj, id);
-    }
     return false;
 }
 
diff --git a/layout/base/RestyleManager.cpp b/layout/base/RestyleManager.cpp
index ce76ae12258..ef9daf9e2a8 100644
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@@ -350,7 +350,16 @@ RestyleManager::RecomputePosition(nsIFrame* aFrame)
 
     // Move the frame
     if (display->mPosition == NS_STYLE_POSITION_STICKY) {
-      StickyScrollContainer::ComputeStickyOffsets(aFrame);
+      // Update sticky positioning for an entire element at once when
+      // RecomputePosition is called with the first continuation in a chain.
+      if (!aFrame->GetPrevContinuation()) {
+        StickyScrollContainer::ComputeStickyOffsets(aFrame);
+        StickyScrollContainer* ssc =
+          StickyScrollContainer::GetStickyScrollContainerForFrame(aFrame);
+        if (ssc) {
+          ssc->PositionContinuations(aFrame);
+        }
+      }
     } else {
       MOZ_ASSERT(NS_STYLE_POSITION_RELATIVE == display->mPosition,
                  "Unexpected type of positioning");
@@ -362,14 +371,14 @@ RestyleManager::RecomputePosition(nsIFrame* aFrame)
       NS_ASSERTION(newOffsets.left == -newOffsets.right &&
                    newOffsets.top == -newOffsets.bottom,
                    "ComputeRelativeOffsets should return valid results");
+
+      // nsHTMLReflowState::ApplyRelativePositioning would work here, but
+      // since we've already checked mPosition and aren't changing the frame's
+      // normal position, go ahead and add the offsets directly.
+      aFrame->SetPosition(aFrame->GetNormalPosition() +
+                          nsPoint(newOffsets.left, newOffsets.top));
     }
 
-    nsPoint position = aFrame->GetNormalPosition();
-
-    // This handles both relative and sticky positioning.
-    nsHTMLReflowState::ApplyRelativePositioning(aFrame, newOffsets, &position);
-    aFrame->SetPosition(position);
-
     return true;
   }
 
diff --git a/layout/base/nsPresContext.cpp b/layout/base/nsPresContext.cpp
index e6ad4034349..637031f0709 100644
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -2672,17 +2672,6 @@ bool nsPresContext::GetPaintFlashing() const
   return mPaintFlashing;
 }
 
-bool
-nsPresContext::IsDeviceSizePageSize()
-{
-  bool isDeviceSizePageSize = false;
-  nsCOMPtr<nsIDocShell> docShell(do_QueryReferent(mContainer));
-  if (docShell) {
-    isDeviceSizePageSize = docShell->GetDeviceSizeIsPageSize();
-  }
-  return isDeviceSizePageSize;
-}
-
 nsRootPresContext::nsRootPresContext(nsIDocument* aDocument,
                                      nsPresContextType aType)
   : nsPresContext(aDocument, aType),
diff --git a/layout/base/nsPresContext.h b/layout/base/nsPresContext.h
index 1a5566573d9..e11b74b7d41 100644
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -1003,8 +1003,6 @@ public:
     mExistThrottledUpdates = aExistThrottledUpdates;
   }
 
-  bool IsDeviceSizePageSize();
-
 protected:
   friend class nsRunnableMethod<nsPresContext>;
   NS_HIDDEN_(void) ThemeChangedInternal();
diff --git a/layout/generic/StickyScrollContainer.cpp b/layout/generic/StickyScrollContainer.cpp
index 8210ba893bd..6b2ca7acf5e 100644
--- a/layout/generic/StickyScrollContainer.cpp
+++ b/layout/generic/StickyScrollContainer.cpp
@@ -129,6 +129,9 @@ void
 StickyScrollContainer::ComputeStickyLimits(nsIFrame* aFrame, nsRect* aStick,
                                            nsRect* aContain) const
 {
+  NS_ASSERTION(!aFrame->GetPrevContinuation(),
+               "Can't sticky position individual continuations");
+
   aStick->SetRect(nscoord_MIN/2, nscoord_MIN/2, nscoord_MAX, nscoord_MAX);
   aContain->SetRect(nscoord_MIN/2, nscoord_MIN/2, nscoord_MAX, nscoord_MAX);
 
@@ -146,17 +149,16 @@ StickyScrollContainer::ComputeStickyLimits(nsIFrame* aFrame, nsRect* aStick,
     nsLayoutUtils::IsProperAncestorFrame(scrolledFrame, cbFrame),
     "Scroll frame should be an ancestor of the containing block");
 
-  nsRect rect = aFrame->GetRect();
-  nsMargin margin = aFrame->GetUsedMargin();
+  nsRect rect =
+    nsLayoutUtils::GetAllInFlowRectsUnion(aFrame, aFrame->GetParent());
 
   // Containing block limits
   if (cbFrame != scrolledFrame) {
-    nsMargin cbBorderPadding = cbFrame->GetUsedBorderAndPadding();
-    aContain->SetRect(nsPoint(cbBorderPadding.left, cbBorderPadding.top) -
-                      aFrame->GetParent()->GetOffsetTo(cbFrame),
-                      cbFrame->GetContentRectRelativeToSelf().Size() -
-                      rect.Size());
-    aContain->Deflate(margin);
+    *aContain = nsLayoutUtils::GetAllInFlowRectsUnion(cbFrame, cbFrame);
+    aContain->MoveBy(-aFrame->GetParent()->GetOffsetTo(cbFrame));
+    aContain->Deflate(cbFrame->GetUsedBorderAndPadding());
+    aContain->Deflate(aFrame->GetUsedMargin());
+    aContain->Deflate(nsMargin(0, rect.width, rect.height, 0));
   }
 
   nsMargin sfPadding = scrolledFrame->GetUsedPadding();
@@ -197,6 +199,10 @@ StickyScrollContainer::ComputeStickyLimits(nsIFrame* aFrame, nsRect* aStick,
     aStick->SetRightEdge(mScrollPosition.x + sfPadding.left + sfSize.width -
                          computedOffsets->right - rect.width - sfOffset.x);
   }
+
+  // These limits are for the bounding box of aFrame's continuations. Convert
+  // to limits for aFrame itself.
+  aStick->MoveBy(aFrame->GetPosition() - rect.TopLeft());
 }
 
 nsPoint
@@ -255,6 +261,22 @@ StickyScrollContainer::GetScrollRanges(nsIFrame* aFrame, nsRect* aOuter,
   }
 }
 
+void
+StickyScrollContainer::PositionContinuations(nsIFrame* aFrame)
+{
+  NS_ASSERTION(!aFrame->GetPrevContinuation(),
+               "Should be starting from the first continuation");
+  nsPoint newPosition = ComputePosition(aFrame);
+  nsPoint translation = newPosition - aFrame->GetPosition();
+  aFrame->SetPosition(newPosition);
+
+  // Move all continuation frames by the same amount.
+  for (nsIFrame* cont = aFrame->GetNextContinuation(); cont;
+       cont = cont->GetNextContinuation()) {
+    cont->SetPosition(cont->GetPosition() + translation);
+  }
+}
+
 void
 StickyScrollContainer::UpdatePositions(nsPoint aScrollPosition,
                                        nsIFrame* aSubtreeRoot)
@@ -272,12 +294,18 @@ StickyScrollContainer::UpdatePositions(nsPoint aScrollPosition,
   oct.SetSubtreeRoot(aSubtreeRoot);
   for (nsTArray<nsIFrame*>::size_type i = 0; i < mFrames.Length(); i++) {
     nsIFrame* f = mFrames[i];
+
     if (aSubtreeRoot) {
       // Reflowing the scroll frame, so recompute offsets.
       ComputeStickyOffsets(f);
     }
-    f->SetPosition(ComputePosition(f));
-    oct.AddFrame(f);
+    // mFrames will only contain first continuations, because we filter in
+    // nsIFrame::Init.
+    PositionContinuations(f);
+
+    for (nsIFrame* cont = f; cont; cont = cont->GetNextContinuation()) {
+      oct.AddFrame(cont);
+    }
   }
   oct.Flush();
 }
diff --git a/layout/generic/StickyScrollContainer.h b/layout/generic/StickyScrollContainer.h
index 3b29a8dca8e..e919ed8e92a 100644
--- a/layout/generic/StickyScrollContainer.h
+++ b/layout/generic/StickyScrollContainer.h
@@ -63,6 +63,11 @@ public:
    */
   void GetScrollRanges(nsIFrame* aFrame, nsRect* aOuter, nsRect* aInner) const;
 
+  /**
+   * Compute and set the position of a frame and its following continuations.
+   */
+  void PositionContinuations(nsIFrame* aFrame);
+
   /**
    * Compute and set the position of all sticky frames, given the current
    * scroll position of the scroll frame. If not in reflow, aSubtreeRoot should
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index 67a331942d2..4ba20a8dcf8 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -512,6 +512,7 @@ nsFrame::Init(nsIContent*      aContent,
     mState |= NS_FRAME_MAY_BE_TRANSFORMED;
   }
   if (disp->mPosition == NS_STYLE_POSITION_STICKY &&
+      !aPrevInFlow &&
       !(mState & NS_FRAME_IS_NONDISPLAY)) {
     StickyScrollContainer* ssc =
       StickyScrollContainer::GetStickyScrollContainerForFrame(this);
diff --git a/layout/generic/nsHTMLReflowState.cpp b/layout/generic/nsHTMLReflowState.cpp
index 94020f5fc4a..fd1ff62c324 100644
--- a/layout/generic/nsHTMLReflowState.cpp
+++ b/layout/generic/nsHTMLReflowState.cpp
@@ -871,7 +871,14 @@ nsHTMLReflowState::ApplyRelativePositioning(nsIFrame* aFrame,
   const nsStyleDisplay* display = aFrame->StyleDisplay();
   if (NS_STYLE_POSITION_RELATIVE == display->mPosition) {
     *aPosition += nsPoint(aComputedOffsets.left, aComputedOffsets.top);
-  } else if (NS_STYLE_POSITION_STICKY == display->mPosition) {
+  } else if (NS_STYLE_POSITION_STICKY == display->mPosition &&
+             !aFrame->GetNextContinuation() && !aFrame->GetPrevContinuation()) {
+    // Sticky positioning for elements with multiple frames needs to be
+    // computed all at once. We can't safely do that here because we might be
+    // partway through (re)positioning the frames, so leave it until the scroll
+    // container reflows and calls StickyScrollContainer::UpdatePositions.
+    // For single-frame sticky positioned elements, though, go ahead and apply
+    // it now to avoid unnecessary overflow updates later.
     StickyScrollContainer* ssc =
       StickyScrollContainer::GetStickyScrollContainerForFrame(aFrame);
     if (ssc) {
diff --git a/layout/reftests/position-sticky/ahem.css b/layout/reftests/position-sticky/ahem.css
new file mode 100644
index 00000000000..884a41198b8
--- /dev/null
+++ b/layout/reftests/position-sticky/ahem.css
@@ -0,0 +1,4 @@
+@font-face {
+  font-family: "Ahem";
+  src: url(../fonts/Ahem.ttf);
+}
diff --git a/layout/reftests/position-sticky/column-contain-1-ref.html b/layout/reftests/position-sticky/column-contain-1-ref.html
new file mode 100644
index 00000000000..39ed2b1cb66
--- /dev/null
+++ b/layout/reftests/position-sticky/column-contain-1-ref.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        line-height: 1;
+      }
+      #contain {
+        -moz-column-count: 2;
+        column-count: 2;
+        -moz-column-rule: 1px solid black;
+        column-rule: 1px solid black;
+        height: 200px;
+        width: 200px;
+      }
+      #fill {
+        height: 390px;
+        background: blue;
+      }
+      #sticky {
+        position: relative;
+        left: 190px;
+        width: 10px;
+        height: 10px;
+        background: black;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      <div id="contain">
+        <div id="sticky"></div>
+        <div id="fill"></div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/column-contain-1a.html b/layout/reftests/position-sticky/column-contain-1a.html
new file mode 100644
index 00000000000..136851dc9d8
--- /dev/null
+++ b/layout/reftests/position-sticky/column-contain-1a.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <title>CSS Test: Sticky Positioning - multiframe containing-block element</title>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="match" href="column-contain-1-ref.html">
+    <meta name="assert" content="Sticky positioning with a multiple-frame containing-block element should stay contained within the bounding box of all that element's frames">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        line-height: 1;
+      }
+      #contain {
+        -moz-column-count: 2;
+        column-count: 2;
+        -moz-column-rule: 1px solid black;
+        column-rule: 1px solid black;
+        height: 200px;
+        width: 200px;
+      }
+      #fill {
+        height: 390px;
+        background: blue;
+      }
+      #sticky {
+        position: sticky;
+        left: 190px;
+        width: 10px;
+        height: 10px;
+        background: black;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      <div id="contain">
+        <div id="sticky"></div>
+        <div id="fill"></div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/column-contain-1b.html b/layout/reftests/position-sticky/column-contain-1b.html
new file mode 100644
index 00000000000..f9e16681e25
--- /dev/null
+++ b/layout/reftests/position-sticky/column-contain-1b.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <title>CSS Test: Sticky Positioning - multiframe containing-block element</title>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="match" href="column-contain-1-ref.html">
+    <meta name="assert" content="Sticky positioning with a multiple-frame containing-block element should stay contained within the bounding box of all that element's frames">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        line-height: 1;
+      }
+      #columns {
+        -moz-column-count: 2;
+        column-count: 2;
+        -moz-column-rule: 1px solid black;
+        column-rule: 1px solid black;
+        height: 200px;
+        width: 200px;
+      }
+      #fill {
+        height: 390px;
+        background: blue;
+      }
+      #sticky {
+        position: sticky;
+        left: 190px;
+        width: 10px;
+        height: 10px;
+        background: black;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      <div id="columns">
+        <div id="contain">
+          <div id="sticky"></div>
+          <div id="fill"></div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/inline-1-ref.html b/layout/reftests/position-sticky/inline-1-ref.html
new file mode 100644
index 00000000000..2c3bc2470f0
--- /dev/null
+++ b/layout/reftests/position-sticky/inline-1-ref.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="stylesheet" type="text/css" href="ahem.css">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        position: relative;
+        font: 10px/1 Ahem;
+      }
+      #sticky {
+        position: absolute;
+        top: 20px;
+        left: 20px;
+      }
+      #hidden {
+        visibility: hidden;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      hello <div id="sticky"><span id="hidden">hello </span>there<br>everyone</div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/inline-1.html b/layout/reftests/position-sticky/inline-1.html
new file mode 100644
index 00000000000..f2569fc7942
--- /dev/null
+++ b/layout/reftests/position-sticky/inline-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <title>CSS Test: Sticky Positioning - inline</title>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="match" href="inline-1-ref.html">
+    <meta name="assert" content="Sticky positioning on inline elements should use the bounding box of all continuations">
+    <link rel="stylesheet" type="text/css" href="ahem.css">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        font: 10px/1 Ahem;
+      }
+      #sticky {
+        position: sticky;
+        top: 20px;
+        left: 20px;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      hello <span id="sticky">there<br>everyone</span>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/inline-2-ref.html b/layout/reftests/position-sticky/inline-2-ref.html
new file mode 100644
index 00000000000..98aabacc75f
--- /dev/null
+++ b/layout/reftests/position-sticky/inline-2-ref.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="stylesheet" type="text/css" href="ahem.css">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        position: relative;
+        font: 10px/1 Ahem;
+      }
+      #sticky {
+        position: absolute;
+        top: 30px;
+        left: 30px;
+      }
+      #hidden {
+        visibility: hidden;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      hello <div id="sticky"><span id="hidden">hello </span>there<br>everyone</div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/inline-2.html b/layout/reftests/position-sticky/inline-2.html
new file mode 100644
index 00000000000..7ebfa2a349f
--- /dev/null
+++ b/layout/reftests/position-sticky/inline-2.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html class="reftest-wait">
+  <head>
+    <title>CSS Test: Sticky Positioning - inline, dynamic changes</title>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="match" href="inline-2-ref.html">
+    <meta name="assert" content="Sticky positioning on inline elements should move all continuations when the offsets are changed">
+    <meta name="flags" content="dom">
+    <link rel="stylesheet" type="text/css" href="ahem.css">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        font: 10px/1 Ahem;
+      }
+      #sticky {
+        position: sticky;
+        top: 20px;
+        left: 20px;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      hello <span id="sticky">there<br>everyone</span>
+    </div>
+    <script type="text/javascript">
+      document.addEventListener("MozReftestInvalidate", function() {
+        document.getElementById("sticky").style.top = "30px";
+        document.getElementById("sticky").style.left = "30px";
+        document.documentElement.removeAttribute("class");
+      }, false);
+    </script>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/inline-3-ref.html b/layout/reftests/position-sticky/inline-3-ref.html
new file mode 100644
index 00000000000..ace95403b31
--- /dev/null
+++ b/layout/reftests/position-sticky/inline-3-ref.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="stylesheet" type="text/css" href="ahem.css">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        position: relative;
+        font: 10px/1 Ahem;
+      }
+      #sticky {
+        position: absolute;
+        top: 20px;
+        left: 10px;
+      }
+      #hidden {
+        visibility: hidden;
+      }
+      b {
+        display: inline-block;
+        width: 40px;
+        height: 10px;
+        background: black;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      <b></b><span id="sticky"><b id="hidden"></b><b></b><br><b></b></span>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/inline-3.html b/layout/reftests/position-sticky/inline-3.html
new file mode 100644
index 00000000000..0a28e74e424
--- /dev/null
+++ b/layout/reftests/position-sticky/inline-3.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <head>
+    <title>CSS Test: Sticky Positioning - inline with margins</title>
+    <link rel="author" title="Corey Ford" href="mailto:cford@mozilla.com">
+    <link rel="match" href="inline-3-ref.html">
+    <meta name="assert" content="Sticky positioning on inline elements should keep the bounding box of all continuations' margin boxes contained">
+    <link rel="stylesheet" type="text/css" href="ahem.css">
+    <style>
+      #scroll {
+        overflow: hidden;
+        height: 200px;
+        font: 10px/1 Ahem;
+      }
+      #sticky {
+        position: sticky;
+        top: 20px;
+        left: 20px;
+        margin-right: 10px;
+      }
+      #contain {
+        width: 90px;
+        font-size: 10px;
+      }
+      b {
+        display: inline-block;
+        width: 40px;
+        height: 10px;
+        background: black;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="scroll">
+      <div id="contain">
+        <b></b><span id="sticky"><b></b><br><b></b></span>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/reftests/position-sticky/reftest.list b/layout/reftests/position-sticky/reftest.list
index 0d7fed3963b..9abd7ae355d 100644
--- a/layout/reftests/position-sticky/reftest.list
+++ b/layout/reftests/position-sticky/reftest.list
@@ -41,3 +41,8 @@ fuzzy-if(Android,4,1) == containing-block-1.html containing-block-1-ref.html
 == overconstrained-1.html overconstrained-1-ref.html
 == overconstrained-2.html overconstrained-2-ref.html
 == overconstrained-3.html overconstrained-3-ref.html
+== inline-1.html inline-1-ref.html
+== inline-2.html inline-2-ref.html
+fails == inline-3.html inline-3-ref.html # bug 916302
+fails == column-contain-1a.html column-contain-1-ref.html
+== column-contain-1b.html column-contain-1-ref.html
diff --git a/layout/style/nsMediaFeatures.cpp b/layout/style/nsMediaFeatures.cpp
index 883436f7a10..7feaeb3966d 100644
--- a/layout/style/nsMediaFeatures.cpp
+++ b/layout/style/nsMediaFeatures.cpp
@@ -111,19 +111,14 @@ static nsSize
 GetDeviceSize(nsPresContext* aPresContext)
 {
     nsSize size;
-
-    if (aPresContext->IsDeviceSizePageSize()) {
-        size = GetSize(aPresContext);
-    } else if (aPresContext->IsRootPaginatedDocument()) {
+    if (aPresContext->IsRootPaginatedDocument())
         // We want the page size, including unprintable areas and margins.
         // XXX The spec actually says we want the "page sheet size", but
         // how is that different?
         size = aPresContext->GetPageSize();
-    } else {
+    else
         GetDeviceContextFor(aPresContext)->
             GetDeviceSurfaceDimensions(size.width, size.height);
-    }
-
     return size;
 }
 
diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index a35ecc06bea..b9639a32b6c 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -2257,7 +2257,7 @@ public class GeckoAppShell
         sEventDispatcher.registerEventListener(event, listener);
     }
 
-    static EventDispatcher getEventDispatcher() {
+    public static EventDispatcher getEventDispatcher() {
         return sEventDispatcher;
     }
 
diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index 2a93655da6c..8becefd39a9 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -220,14 +220,12 @@ FENNEC_JAVA_FILES = \
   home/BookmarkThumbnailView.java \
   home/BrowserSearch.java \
   home/HistoryPage.java \
-  home/HomeCursorLoaderCallbacks.java \
   home/HomeFragment.java \
   home/HomeListView.java \
   home/HomePager.java \
   home/HomePagerTabStrip.java \
   home/HomeBanner.java \
   home/FadedTextView.java \
-  home/FaviconsLoader.java \
   home/LastTabsPage.java \
   home/MostRecentPage.java \
   home/MostVisitedPage.java \
diff --git a/mobile/android/base/android-services-files.mk b/mobile/android/base/android-services-files.mk
index f883ba29f38..59880c8c512 100644
--- a/mobile/android/base/android-services-files.mk
+++ b/mobile/android/base/android-services-files.mk
@@ -25,6 +25,7 @@ SYNC_JAVA_FILES := \
   background/bagheera/BagheeraRequestDelegate.java \
   background/bagheera/BoundedByteArrayEntity.java \
   background/bagheera/DeflateHelper.java \
+  background/common/DateUtils.java \
   background/common/log/Logger.java \
   background/common/log/writers/AndroidLevelCachingLogWriter.java \
   background/common/log/writers/AndroidLogWriter.java \
diff --git a/mobile/android/base/animation/PropertyAnimator.java b/mobile/android/base/animation/PropertyAnimator.java
index 5eb51516642..c163b08ff2f 100644
--- a/mobile/android/base/animation/PropertyAnimator.java
+++ b/mobile/android/base/animation/PropertyAnimator.java
@@ -160,12 +160,17 @@ public class PropertyAnimator implements Runnable {
         }
 
         // Try to start animation after any on-going layout round
-        // in the current view tree.
-        if (treeObserver != null && treeObserver.isAlive()) {
+        // in the current view tree. OnPreDrawListener seems broken
+        // on pre-Honeycomb devices, start animation immediatelly
+        // in this case.
+        if (Build.VERSION.SDK_INT >= 11 && treeObserver != null && treeObserver.isAlive()) {
             treeObserver.addOnPreDrawListener(new ViewTreeObserver.OnPreDrawListener() {
                 @Override
                 public boolean onPreDraw() {
-                    treeObserver.removeOnPreDrawListener(this);
+                    if (treeObserver.isAlive()) {
+                        treeObserver.removeOnPreDrawListener(this);
+                    }
+
                     mFramePoster.postFirstAnimationFrame();
                     return true;
                 }
diff --git a/mobile/android/base/background/common/DateUtils.java b/mobile/android/base/background/common/DateUtils.java
new file mode 100644
index 00000000000..05412224d74
--- /dev/null
+++ b/mobile/android/base/background/common/DateUtils.java
@@ -0,0 +1,43 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.background.common;
+
+import java.util.Calendar;
+import java.util.Formatter;
+import java.util.TimeZone;
+
+public class DateUtils {
+  private static final TimeZone UTC = TimeZone.getTimeZone("UTC");
+
+  public static final class DateFormatter {
+    private final Calendar calendar;
+    private final Formatter formatter;
+    private final StringBuilder builder;
+
+    public DateFormatter() {
+      this.calendar = Calendar.getInstance(UTC);
+      this.builder = new StringBuilder();              // So we can reset it.
+      this.formatter = new Formatter(this.builder, null);
+    }
+
+    public String getDateString(long time) {
+      calendar.setTimeInMillis(time);
+      builder.setLength(0);
+      return formatter.format("%04d-%02d-%02d",
+                              calendar.get(Calendar.YEAR),
+                              calendar.get(Calendar.MONTH) + 1,      // 0-indexed.
+                              calendar.get(Calendar.DAY_OF_MONTH))
+                      .toString();
+    }
+
+    public String getDateStringForDay(long day) {
+      return getDateString(GlobalConstants.MILLISECONDS_PER_DAY * day);
+    }
+  }
+
+  public static int getDay(final long time) {
+    return (int) Math.floor(time / GlobalConstants.MILLISECONDS_PER_DAY);
+  }
+}
diff --git a/mobile/android/base/background/common/GlobalConstants.java.in b/mobile/android/base/background/common/GlobalConstants.java.in
index a58ff6bf97b..206052a636e 100644
--- a/mobile/android/base/background/common/GlobalConstants.java.in
+++ b/mobile/android/base/background/common/GlobalConstants.java.in
@@ -47,4 +47,8 @@ public class GlobalConstants {
   public static String GECKO_PREFERENCES_CLASS = "org.mozilla.gecko.GeckoPreferences";
   public static String GECKO_BROADCAST_ANNOUNCEMENTS_PREF_METHOD  = "broadcastAnnouncementsPref";
   public static String GECKO_BROADCAST_HEALTHREPORT_UPLOAD_PREF_METHOD  = "broadcastHealthReportUploadPref";
+
+  // Common time values.
+  public static final long MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;
+  public static final long MILLISECONDS_PER_SIX_MONTHS = 180 * MILLISECONDS_PER_DAY;
 }
diff --git a/mobile/android/base/background/healthreport/EnvironmentBuilder.java b/mobile/android/base/background/healthreport/EnvironmentBuilder.java
index 9d223d54af2..cb53a7afce0 100644
--- a/mobile/android/base/background/healthreport/EnvironmentBuilder.java
+++ b/mobile/android/base/background/healthreport/EnvironmentBuilder.java
@@ -9,6 +9,7 @@ import java.util.Iterator;
 import org.json.JSONObject;
 import org.mozilla.gecko.AppConstants;
 import org.mozilla.gecko.SysInfo;
+import org.mozilla.gecko.background.common.GlobalConstants;
 import org.mozilla.gecko.background.common.log.Logger;
 
 import android.content.ContentProvider;
@@ -77,7 +78,7 @@ public class EnvironmentBuilder {
     e.sysName = SysInfo.getName();
     e.sysVersion = SysInfo.getReleaseVersion();
 
-    e.profileCreation = (int) (info.getProfileCreationTime() / HealthReportConstants.MILLISECONDS_PER_DAY);
+    e.profileCreation = (int) (info.getProfileCreationTime() / GlobalConstants.MILLISECONDS_PER_DAY);
 
     // Corresponds to Gecko pref "extensions.blocklist.enabled".
     e.isBlocklistEnabled = (info.isBlocklistEnabled() ? 1 : 0);
diff --git a/mobile/android/base/background/healthreport/HealthReportConstants.java.in b/mobile/android/base/background/healthreport/HealthReportConstants.java.in
index cc6f9c44eb2..d2814278fa5 100644
--- a/mobile/android/base/background/healthreport/HealthReportConstants.java.in
+++ b/mobile/android/base/background/healthreport/HealthReportConstants.java.in
@@ -5,6 +5,8 @@
 
 package org.mozilla.gecko.background.healthreport;
 
+import org.mozilla.gecko.background.common.GlobalConstants;
+
 public class HealthReportConstants {
   public static final String HEALTH_AUTHORITY = "@ANDROID_PACKAGE_NAME@.health";
   public static final String GLOBAL_LOG_TAG = "GeckoHealth";
@@ -15,9 +17,6 @@ public class HealthReportConstants {
    */
   public static final long EARLIEST_LAST_PING = 1367500000000L;
 
-  public static final long MILLISECONDS_PER_DAY = 24 * 60 * 60 * 1000;
-  public static final long MILLISECONDS_PER_SIX_MONTHS = 180 * MILLISECONDS_PER_DAY;
-
   // Not `final` so we have the option to turn this on at runtime with a magic addon.
   public static boolean UPLOAD_FEATURE_DISABLED = false;
 
@@ -29,15 +28,15 @@ public class HealthReportConstants {
   // intent is scheduled to be called by the Android Alarm Manager, not how
   // frequently we actually submit.
   public static final String PREF_SUBMISSION_INTENT_INTERVAL_MSEC = "healthreport_submission_intent_interval_msec";
-  public static final long DEFAULT_SUBMISSION_INTENT_INTERVAL_MSEC = MILLISECONDS_PER_DAY / 24;
+  public static final long DEFAULT_SUBMISSION_INTENT_INTERVAL_MSEC = GlobalConstants.MILLISECONDS_PER_DAY / 24;
 
   public static final String ACTION_HEALTHREPORT_UPLOAD_PREF = "@ANDROID_PACKAGE_NAME@.HEALTHREPORT_UPLOAD_PREF";
 
   public static final String PREF_MINIMUM_TIME_BETWEEN_UPLOADS = "healthreport_time_between_uploads";
-  public static final long DEFAULT_MINIMUM_TIME_BETWEEN_UPLOADS = MILLISECONDS_PER_DAY;
+  public static final long DEFAULT_MINIMUM_TIME_BETWEEN_UPLOADS = GlobalConstants.MILLISECONDS_PER_DAY;
 
   public static final String PREF_MINIMUM_TIME_BEFORE_FIRST_SUBMISSION = "healthreport_time_before_first_submission";
-  public static final long DEFAULT_MINIMUM_TIME_BEFORE_FIRST_SUBMISSION = MILLISECONDS_PER_DAY;
+  public static final long DEFAULT_MINIMUM_TIME_BEFORE_FIRST_SUBMISSION = GlobalConstants.MILLISECONDS_PER_DAY;
 
   public static final String PREF_MINIMUM_TIME_AFTER_FAILURE = "healthreport_time_after_failure";
   public static final long DEFAULT_MINIMUM_TIME_AFTER_FAILURE = DEFAULT_SUBMISSION_INTENT_INTERVAL_MSEC;
diff --git a/mobile/android/base/background/healthreport/HealthReportDatabaseStorage.java b/mobile/android/base/background/healthreport/HealthReportDatabaseStorage.java
index 9ac4117e2dc..eb6227b8096 100644
--- a/mobile/android/base/background/healthreport/HealthReportDatabaseStorage.java
+++ b/mobile/android/base/background/healthreport/HealthReportDatabaseStorage.java
@@ -12,6 +12,7 @@ import java.util.concurrent.Executor;
 import java.util.concurrent.Executors;
 
 import org.json.JSONObject;
+import org.mozilla.gecko.background.common.DateUtils;
 import org.mozilla.gecko.background.common.log.Logger;
 import org.mozilla.gecko.background.healthreport.HealthReportStorage.MeasurementFields.FieldSpec;
 
@@ -1029,7 +1030,7 @@ public class HealthReportDatabaseStorage implements HealthReportStorage {
 
   @Override
   public int getDay(long time) {
-    return HealthReportUtils.getDay(time);
+    return DateUtils.getDay(time);
   }
 
   @Override
diff --git a/mobile/android/base/background/healthreport/HealthReportGenerator.java b/mobile/android/base/background/healthreport/HealthReportGenerator.java
index d57e150522f..426a1c336a9 100644
--- a/mobile/android/base/background/healthreport/HealthReportGenerator.java
+++ b/mobile/android/base/background/healthreport/HealthReportGenerator.java
@@ -10,6 +10,7 @@ import java.util.Set;
 
 import org.json.JSONException;
 import org.json.JSONObject;
+import org.mozilla.gecko.background.common.DateUtils.DateFormatter;
 import org.mozilla.gecko.background.common.log.Logger;
 import org.mozilla.gecko.background.healthreport.HealthReportStorage.Field;
 
@@ -22,9 +23,11 @@ public class HealthReportGenerator {
   private static final String LOG_TAG = "GeckoHealthGen";
 
   private final HealthReportStorage storage;
+  private final DateFormatter dateFormatter;
 
   public HealthReportGenerator(HealthReportStorage storage) {
     this.storage = storage;
+    this.dateFormatter = new DateFormatter();
   }
 
   @SuppressWarnings("static-method")
@@ -76,10 +79,10 @@ public class HealthReportGenerator {
     JSONObject document = new JSONObject();
 
     if (lastPingTime >= HealthReportConstants.EARLIEST_LAST_PING) {
-      document.put("lastPingDate", HealthReportUtils.getDateString(lastPingTime));
+      document.put("lastPingDate", dateFormatter.getDateString(lastPingTime));
     }
 
-    document.put("thisPingDate", HealthReportUtils.getDateString(now()));
+    document.put("thisPingDate", dateFormatter.getDateString(now()));
     document.put("version", PAYLOAD_VERSION);
 
     document.put("environments", getEnvironmentsJSON(currentEnvironment, envs));
@@ -147,7 +150,7 @@ public class HealthReportGenerator {
 
         if (dateChanged) {
           if (dateObject != null) {
-            days.put(HealthReportUtils.getDateStringForDay(lastDate), dateObject);
+            days.put(dateFormatter.getDateStringForDay(lastDate), dateObject);
           }
           dateObject = new JSONObject();
           lastDate = cDate;
@@ -179,7 +182,7 @@ public class HealthReportGenerator {
         cursor.moveToNext();
         continue;
       }
-      days.put(HealthReportUtils.getDateStringForDay(lastDate), dateObject);
+      days.put(dateFormatter.getDateStringForDay(lastDate), dateObject);
     } finally {
       cursor.close();
     }
diff --git a/mobile/android/base/background/healthreport/HealthReportUtils.java b/mobile/android/base/background/healthreport/HealthReportUtils.java
index e3c849a74f0..4c72b52d73a 100644
--- a/mobile/android/base/background/healthreport/HealthReportUtils.java
+++ b/mobile/android/base/background/healthreport/HealthReportUtils.java
@@ -4,13 +4,10 @@
 
 package org.mozilla.gecko.background.healthreport;
 
-import java.text.SimpleDateFormat;
 import java.util.HashSet;
 import java.util.Iterator;
-import java.util.Locale;
 import java.util.Set;
 import java.util.SortedSet;
-import java.util.TimeZone;
 import java.util.TreeSet;
 import java.util.UUID;
 
@@ -25,24 +22,10 @@ import android.net.Uri;
 public class HealthReportUtils {
   public static final String LOG_TAG = HealthReportUtils.class.getSimpleName();
 
-  public static int getDay(final long time) {
-    return (int) Math.floor(time / HealthReportConstants.MILLISECONDS_PER_DAY);
-  }
-
   public static String getEnvironmentHash(final String input) {
     return DigestUtils.shaHex(input);
   }
 
-  public static String getDateStringForDay(long day) {
-    return getDateString(HealthReportConstants.MILLISECONDS_PER_DAY * day);
-  }
-
-  public static String getDateString(long time) {
-    final SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd", Locale.US);
-    format.setTimeZone(TimeZone.getTimeZone("UTC"));
-    return format.format(time);
-  }
-
   /**
    * Take an environment URI (one that identifies an environment) and produce an
    * event URI.
diff --git a/mobile/android/base/background/healthreport/upload/AndroidSubmissionClient.java b/mobile/android/base/background/healthreport/upload/AndroidSubmissionClient.java
index efce5e68271..addd248ba39 100644
--- a/mobile/android/base/background/healthreport/upload/AndroidSubmissionClient.java
+++ b/mobile/android/base/background/healthreport/upload/AndroidSubmissionClient.java
@@ -10,6 +10,7 @@ import java.util.Collection;
 import org.json.JSONObject;
 import org.mozilla.gecko.background.bagheera.BagheeraClient;
 import org.mozilla.gecko.background.bagheera.BagheeraRequestDelegate;
+import org.mozilla.gecko.background.common.GlobalConstants;
 import org.mozilla.gecko.background.common.log.Logger;
 import org.mozilla.gecko.background.healthreport.EnvironmentBuilder;
 import org.mozilla.gecko.background.healthreport.HealthReportConstants;
@@ -103,7 +104,7 @@ public class AndroidSubmissionClient implements SubmissionClient {
         return;
       }
 
-      long since = localTime - HealthReportConstants.MILLISECONDS_PER_SIX_MONTHS;
+      long since = localTime - GlobalConstants.MILLISECONDS_PER_SIX_MONTHS;
       long last = Math.max(getLastUploadLocalTime(), HealthReportConstants.EARLIEST_LAST_PING);
 
       if (!storage.hasEventSince(last)) {
diff --git a/mobile/android/base/health/BrowserHealthReporter.java b/mobile/android/base/health/BrowserHealthReporter.java
index 4b2c754fbb2..0a2309fe7fc 100644
--- a/mobile/android/base/health/BrowserHealthReporter.java
+++ b/mobile/android/base/health/BrowserHealthReporter.java
@@ -14,6 +14,7 @@ import org.mozilla.gecko.GeckoEvent;
 import org.mozilla.gecko.GeckoProfile;
 
 import org.mozilla.gecko.background.healthreport.EnvironmentBuilder;
+import org.mozilla.gecko.background.common.GlobalConstants;
 import org.mozilla.gecko.background.healthreport.HealthReportConstants;
 import org.mozilla.gecko.background.healthreport.HealthReportDatabaseStorage;
 import org.mozilla.gecko.background.healthreport.HealthReportGenerator;
@@ -124,7 +125,7 @@ public class BrowserHealthReporter implements GeckoEventListener {
         GeckoProfile profile = GeckoAppShell.getGeckoInterface().getProfile();
         String profilePath = profile.getDir().getAbsolutePath();
 
-        long since = System.currentTimeMillis() - HealthReportConstants.MILLISECONDS_PER_SIX_MONTHS;
+        long since = System.currentTimeMillis() - GlobalConstants.MILLISECONDS_PER_SIX_MONTHS;
         long lastPingTime = Math.max(getLastUploadLocalTime(), HealthReportConstants.EARLIEST_LAST_PING);
 
         return generateReport(since, lastPingTime, profilePath);
diff --git a/mobile/android/base/home/BookmarksPage.java b/mobile/android/base/home/BookmarksPage.java
index f3c28e4cb40..238a7e95385 100644
--- a/mobile/android/base/home/BookmarksPage.java
+++ b/mobile/android/base/home/BookmarksPage.java
@@ -179,7 +179,7 @@ public class BookmarksPage extends HomeFragment {
         BrowserDB.invalidateCachedState();
 
         // Create callbacks before the initial loader is started.
-        mLoaderCallbacks = new CursorLoaderCallbacks(activity, getLoaderManager());
+        mLoaderCallbacks = new CursorLoaderCallbacks();
         mThumbnailsLoaderCallbacks = new ThumbnailsLoaderCallbacks();
         loadIfVisible();
     }
@@ -453,11 +453,7 @@ public class BookmarksPage extends HomeFragment {
     /**
      * Loader callbacks for the LoaderManager of this fragment.
      */
-    private class CursorLoaderCallbacks extends HomeCursorLoaderCallbacks {
-        public CursorLoaderCallbacks(Context context, LoaderManager loaderManager) {
-            super(context, loaderManager);
-        }
-
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
         @Override
         public Loader<Cursor> onCreateLoader(int id, Bundle args) {
             switch(id) {
@@ -472,11 +468,9 @@ public class BookmarksPage extends HomeFragment {
                 case LOADER_ID_TOP_BOOKMARKS: {
                     return new TopBookmarksLoader(getActivity());
                 }
-
-                default: {
-                    return super.onCreateLoader(id, args);
-                }
             }
+
+            return null;
         }
 
         @Override
@@ -485,7 +479,6 @@ public class BookmarksPage extends HomeFragment {
             switch(loaderId) {
                 case LOADER_ID_BOOKMARKS_LIST: {
                     mListAdapter.swapCursor(c);
-                    loadFavicons(c);
                     mList.setHeaderDividersEnabled(c != null && c.getCount() > 0);
                     break;
                 }
@@ -509,11 +502,6 @@ public class BookmarksPage extends HomeFragment {
                     }
                     break;
                 }
-
-                default: {
-                    super.onLoadFinished(loader, c);
-                    break;
-                }
             }
         }
 
@@ -534,18 +522,8 @@ public class BookmarksPage extends HomeFragment {
                         break;
                     }
                 }
-
-                default: {
-                    super.onLoaderReset(loader);
-                    break;
-                }
             }
         }
-
-        @Override
-        public void onFaviconsLoaded() {
-            mListAdapter.notifyDataSetChanged();
-        }
     }
 
     /**
diff --git a/mobile/android/base/home/BrowserSearch.java b/mobile/android/base/home/BrowserSearch.java
index d641ab14578..b7a512f3bdf 100644
--- a/mobile/android/base/home/BrowserSearch.java
+++ b/mobile/android/base/home/BrowserSearch.java
@@ -104,7 +104,7 @@ public class BrowserSearch extends HomeFragment
     // Whether search suggestions are enabled or not
     private boolean mSuggestionsEnabled;
 
-    // Callbacks used for the search and favicon cursor loaders
+    // Callbacks used for the search loader
     private CursorLoaderCallbacks mCursorLoaderCallbacks;
 
     // Callbacks used for the search suggestion loader
@@ -286,17 +286,15 @@ public class BrowserSearch extends HomeFragment
     public void onActivityCreated(Bundle savedInstanceState) {
         super.onActivityCreated(savedInstanceState);
 
-        final Activity activity = getActivity();
-
         // Intialize the search adapter
-        mAdapter = new SearchAdapter(activity);
+        mAdapter = new SearchAdapter(getActivity());
         mList.setAdapter(mAdapter);
 
         // Only create an instance when we need it
         mSuggestionLoaderCallbacks = null;
 
         // Create callbacks before the initial loader is started
-        mCursorLoaderCallbacks = new CursorLoaderCallbacks(activity, getLoaderManager());
+        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
         loadIfVisible();
     }
 
@@ -772,49 +770,26 @@ public class BrowserSearch extends HomeFragment
         }
     }
 
-    private class CursorLoaderCallbacks extends HomeCursorLoaderCallbacks {
-        public CursorLoaderCallbacks(Context context, LoaderManager loaderManager) {
-            super(context, loaderManager);
-        }
-
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
         @Override
         public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-            if (id == LOADER_ID_SEARCH) {
-                return SearchLoader.createInstance(getActivity(), args);
-            } else {
-                return super.onCreateLoader(id, args);
-            }
+            return SearchLoader.createInstance(getActivity(), args);
         }
 
         @Override
         public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-            if (loader.getId() == LOADER_ID_SEARCH) {
-                mAdapter.swapCursor(c);
+            mAdapter.swapCursor(c);
 
-                // We should handle autocompletion based on the search term
-                // associated with the currently loader that has just provided
-                // the results.
-                SearchCursorLoader searchLoader = (SearchCursorLoader) loader;
-                handleAutocomplete(searchLoader.getSearchTerm(), c);
-
-                loadFavicons(c);
-            } else {
-                super.onLoadFinished(loader, c);
-            }
+            // We should handle autocompletion based on the search term
+            // associated with the currently loader that has just provided
+            // the results.
+            SearchCursorLoader searchLoader = (SearchCursorLoader) loader;
+            handleAutocomplete(searchLoader.getSearchTerm(), c);
         }
 
         @Override
         public void onLoaderReset(Loader<Cursor> loader) {
-            if (loader.getId() == LOADER_ID_SEARCH) {
-                mAdapter.swapCursor(null);
-            } else {
-                super.onLoaderReset(loader);
-            }
-        }
-
-        @Override
-        public void onFaviconsLoaded() {
-            mAdapter.notifyDataSetChanged();
+            mAdapter.swapCursor(null);
         }
     }
 
diff --git a/mobile/android/base/home/FaviconsLoader.java b/mobile/android/base/home/FaviconsLoader.java
deleted file mode 100644
index b5da2d7b029..00000000000
--- a/mobile/android/base/home/FaviconsLoader.java
+++ /dev/null
@@ -1,115 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.home;
-
-import org.mozilla.gecko.favicons.Favicons;
-import org.mozilla.gecko.db.BrowserDB;
-import org.mozilla.gecko.db.BrowserDB.URLColumns;
-import org.mozilla.gecko.gfx.BitmapUtils;
-
-import android.content.ContentResolver;
-import android.content.Context;
-import android.database.Cursor;
-import android.graphics.Bitmap;
-import android.os.Bundle;
-import android.support.v4.app.LoaderManager;
-import android.support.v4.app.LoaderManager.LoaderCallbacks;
-import android.support.v4.content.Loader;
-
-import java.util.ArrayList;
-
-/**
- * Encapsulates the implementation of the favicons cursorloader.
- */
-class FaviconsLoader {
-    // Argument containing list of urls for the favicons loader
-    private static final String FAVICONS_LOADER_URLS_ARG = "urls";
-
-    private FaviconsLoader() {
-    }
-
-    private static ArrayList<String> getUrlsWithoutFavicon(Cursor c) {
-        ArrayList<String> urls = new ArrayList<String>();
-
-        if (c == null || !c.moveToFirst()) {
-            return urls;
-        }
-
-        do {
-            final String url = c.getString(c.getColumnIndexOrThrow(URLColumns.URL));
-
-            // We only want to load favicons from DB if they are not in the
-            // memory cache yet. The url is null for bookmark folders.
-            if (url == null || Favicons.getFaviconFromMemCache(url) != null) {
-                continue;
-            }
-
-            urls.add(url);
-        } while (c.moveToNext());
-
-        return urls;
-    }
-
-    private static void storeFaviconsInMemCache(Cursor c) {
-        if (c == null || !c.moveToFirst()) {
-            return;
-        }
-
-        do {
-            final String url = c.getString(c.getColumnIndexOrThrow(URLColumns.URL));
-            final byte[] b = c.getBlob(c.getColumnIndexOrThrow(URLColumns.FAVICON));
-
-            if (b == null) {
-                continue;
-            }
-
-            Bitmap favicon = BitmapUtils.decodeByteArray(b);
-            if (favicon == null) {
-                continue;
-            }
-
-            favicon = Favicons.scaleImage(favicon);
-            Favicons.putFaviconInMemCache(url, favicon);
-        } while (c.moveToNext());
-    }
-
-    public static void restartFromCursor(LoaderManager manager, int loaderId,
-            LoaderCallbacks<Cursor> callbacks, Cursor c) {
-        // If there urls without in-memory favicons, trigger a new loader
-        // to load the images from disk to memory.
-        ArrayList<String> urls = getUrlsWithoutFavicon(c);
-        if (urls.size() > 0) {
-            Bundle args = new Bundle();
-            args.putStringArrayList(FAVICONS_LOADER_URLS_ARG, urls);
-
-            manager.restartLoader(loaderId, args, callbacks);
-        }
-    }
-
-    public static Loader<Cursor> createInstance(Context context, Bundle args) {
-        final ArrayList<String> urls = args.getStringArrayList(FAVICONS_LOADER_URLS_ARG);
-        return new FaviconsCursorLoader(context, urls);
-    }
-
-    private static class FaviconsCursorLoader extends SimpleCursorLoader {
-        private final ArrayList<String> mUrls;
-
-        public FaviconsCursorLoader(Context context, ArrayList<String> urls) {
-            super(context);
-            mUrls = urls;
-        }
-
-        @Override
-        public Cursor loadCursor() {
-            final ContentResolver cr = getContext().getContentResolver();
-
-            Cursor c = BrowserDB.getFaviconsForUrls(cr, mUrls);
-            storeFaviconsInMemCache(c);
-
-            return c;
-        }
-    }
-}
diff --git a/mobile/android/base/home/HomeBanner.java b/mobile/android/base/home/HomeBanner.java
index cc4fc7cc94b..b4adfb95326 100644
--- a/mobile/android/base/home/HomeBanner.java
+++ b/mobile/android/base/home/HomeBanner.java
@@ -5,16 +5,31 @@
 
 package org.mozilla.gecko.home;
 
+import org.mozilla.gecko.GeckoAppShell;
+import org.mozilla.gecko.GeckoEvent;
 import org.mozilla.gecko.R;
+import org.mozilla.gecko.gfx.BitmapUtils;
+import org.mozilla.gecko.util.GeckoEventListener;
+import org.mozilla.gecko.util.ThreadUtils;
+
+import org.json.JSONException;
+import org.json.JSONObject;
 
 import android.content.Context;
+import android.graphics.drawable.Drawable;
+import android.text.TextUtils;
 import android.util.AttributeSet;
+import android.util.Log;
 import android.view.LayoutInflater;
 import android.view.View;
 import android.widget.ImageButton;
+import android.widget.ImageView;
 import android.widget.LinearLayout;
+import android.widget.TextView;
 
-public class HomeBanner extends LinearLayout {
+public class HomeBanner extends LinearLayout
+                        implements GeckoEventListener {
+    private static final String LOGTAG = "GeckoHomeBanner";
 
     public HomeBanner(Context context) {
         this(context, null);
@@ -43,9 +58,78 @@ public class HomeBanner extends LinearLayout {
                 HomeBanner.this.setVisibility(View.GONE);
             }
         });
+
+        setOnClickListener(new View.OnClickListener() {
+            @Override
+            public void onClick(View v) {
+                // Send the current message id back to JS.
+                GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("HomeBanner:Click", (String) getTag()));
+            }
+        });
+
+        GeckoAppShell.getEventDispatcher().registerEventListener("HomeBanner:Data", this);
+        GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("HomeBanner:Get", null));
     }
 
+    @Override
+    public void onDetachedFromWindow() {
+        super.onDetachedFromWindow();
+
+        GeckoAppShell.getEventDispatcher().unregisterEventListener("HomeBanner:Data", this);
+     }
+
     public boolean isDismissed() {
         return (getVisibility() == View.GONE);
     }
+
+    @Override
+    public void handleMessage(String event, JSONObject message) {
+        try {
+            // Store the current message id to pass back to JS in the view's OnClickListener.
+            setTag(message.getString("id"));
+
+            final String text = message.getString("text");
+            final TextView textView = (TextView) findViewById(R.id.text);
+
+            // Update the banner message on the UI thread.
+            ThreadUtils.postToUiThread(new Runnable() {
+                @Override
+                public void run() {
+                    textView.setText(text);
+                    setVisibility(View.VISIBLE);
+                }
+            });
+        } catch (JSONException e) {
+            Log.e(LOGTAG, "Exception handling " + event + " message", e);
+            return;
+        }
+
+        final String iconURI = message.optString("iconURI");
+        final ImageView iconView = (ImageView) findViewById(R.id.icon);
+
+        if (TextUtils.isEmpty(iconURI)) {
+            // Hide the image view if we don't have an icon to show.
+            iconView.setVisibility(View.GONE);
+            return;
+        }
+
+        BitmapUtils.getDrawable(getContext(), iconURI, new BitmapUtils.BitmapLoader() {
+            @Override
+            public void onBitmapFound(final Drawable d) {
+                // Bail if getDrawable doesn't find anything.
+                if (d == null) {
+                    iconView.setVisibility(View.GONE);
+                    return;
+                }
+
+                // Update the banner icon on the UI thread.
+                ThreadUtils.postToUiThread(new Runnable() {
+                    @Override
+                    public void run() {
+                        iconView.setImageDrawable(d);
+                    }
+                });
+            }
+        });
+    }
 }
diff --git a/mobile/android/base/home/HomeCursorLoaderCallbacks.java b/mobile/android/base/home/HomeCursorLoaderCallbacks.java
deleted file mode 100644
index 1ff2d732f6c..00000000000
--- a/mobile/android/base/home/HomeCursorLoaderCallbacks.java
+++ /dev/null
@@ -1,58 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko.home;
-
-import android.content.Context;
-import android.database.Cursor;
-import android.os.Bundle;
-import android.support.v4.app.LoaderManager;
-import android.support.v4.app.LoaderManager.LoaderCallbacks;
-import android.support.v4.content.Loader;
-
-/**
- * Cursor loader callbacks that takes care loading favicons into memory.
- */
-abstract class HomeCursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
-
-    // Cursor loader ID for favicons query
-    private static final int LOADER_ID_FAVICONS = 100;
-
-    private final Context mContext;
-    private final LoaderManager mLoaderManager;
-
-    public HomeCursorLoaderCallbacks(Context context, LoaderManager loaderManager) {
-        mContext = context;
-        mLoaderManager = loaderManager;
-    }
-
-    public void loadFavicons(Cursor cursor) {
-        FaviconsLoader.restartFromCursor(mLoaderManager, LOADER_ID_FAVICONS, this, cursor);
-    }
-
-    @Override
-    public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-        if (id == LOADER_ID_FAVICONS) {
-            return FaviconsLoader.createInstance(mContext, args);
-        }
-
-        return null;
-    }
-
-    @Override
-    public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-        if (loader.getId() == LOADER_ID_FAVICONS) {
-            onFaviconsLoaded();
-        }
-    }
-
-    @Override
-    public void onLoaderReset(Loader<Cursor> loader) {
-        // Do nothing by default.
-    }
-
-    // Callback for favicons loaded in memory.
-    public abstract void onFaviconsLoaded();
-}
diff --git a/mobile/android/base/home/LastTabsPage.java b/mobile/android/base/home/LastTabsPage.java
index 3a08eea2952..87b80b1445d 100644
--- a/mobile/android/base/home/LastTabsPage.java
+++ b/mobile/android/base/home/LastTabsPage.java
@@ -142,14 +142,12 @@ public class LastTabsPage extends HomeFragment {
     public void onActivityCreated(Bundle savedInstanceState) {
         super.onActivityCreated(savedInstanceState);
 
-        final Activity activity = getActivity();
-
         // Intialize adapter
-        mAdapter = new LastTabsAdapter(activity);
+        mAdapter = new LastTabsAdapter(getActivity());
         mList.setAdapter(mAdapter);
 
         // Create callbacks before the initial loader is started
-        mCursorLoaderCallbacks = new CursorLoaderCallbacks(activity, getLoaderManager());
+        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
         loadIfVisible();
     }
 
@@ -262,43 +260,21 @@ public class LastTabsPage extends HomeFragment {
         }
     }
 
-    private class CursorLoaderCallbacks extends HomeCursorLoaderCallbacks {
-        public CursorLoaderCallbacks(Context context, LoaderManager loaderManager) {
-            super(context, loaderManager);
-        }
-
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
         @Override
         public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-            if (id == LOADER_ID_LAST_TABS) {
-                return new LastTabsCursorLoader(getActivity());
-            } else {
-                return super.onCreateLoader(id, args);
-            }
+            return new LastTabsCursorLoader(getActivity());
         }
 
         @Override
         public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-            if (loader.getId() == LOADER_ID_LAST_TABS) {
-                mAdapter.swapCursor(c);
-                updateUiFromCursor(c);
-                loadFavicons(c);
-            } else {
-                super.onLoadFinished(loader, c);
-            }
+            mAdapter.swapCursor(c);
+            updateUiFromCursor(c);
         }
 
         @Override
         public void onLoaderReset(Loader<Cursor> loader) {
-            if (loader.getId() == LOADER_ID_LAST_TABS) {
-                mAdapter.swapCursor(null);
-            } else {
-                super.onLoaderReset(loader);
-            }
-        }
-
-        @Override
-        public void onFaviconsLoaded() {
-            mAdapter.notifyDataSetChanged();
+            mAdapter.swapCursor(null);
         }
     }
 }
diff --git a/mobile/android/base/home/MostRecentPage.java b/mobile/android/base/home/MostRecentPage.java
index fe262e9d4e1..0d79ca37106 100644
--- a/mobile/android/base/home/MostRecentPage.java
+++ b/mobile/android/base/home/MostRecentPage.java
@@ -17,6 +17,7 @@ import android.content.Context;
 import android.database.Cursor;
 import android.os.Bundle;
 import android.support.v4.app.LoaderManager;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
 import android.support.v4.content.Loader;
 import android.util.SparseArray;
 import android.view.LayoutInflater;
@@ -127,14 +128,12 @@ public class MostRecentPage extends HomeFragment {
     public void onActivityCreated(Bundle savedInstanceState) {
         super.onActivityCreated(savedInstanceState);
 
-        final Activity activity = getActivity();
-
         // Intialize adapter
-        mAdapter = new MostRecentAdapter(activity);
+        mAdapter = new MostRecentAdapter(getActivity());
         mList.setAdapter(mAdapter);
 
         // Create callbacks before the initial loader is started
-        mCursorLoaderCallbacks = new CursorLoaderCallbacks(activity, getLoaderManager());
+        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
         loadIfVisible();
     }
 
@@ -360,43 +359,21 @@ public class MostRecentPage extends HomeFragment {
         }
     }
 
-    private class CursorLoaderCallbacks extends HomeCursorLoaderCallbacks {
-        public CursorLoaderCallbacks(Context context, LoaderManager loaderManager) {
-            super(context, loaderManager);
-        }
-
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
         @Override
         public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-            if (id == LOADER_ID_HISTORY) {
-                return new MostRecentCursorLoader(getActivity());
-            } else {
-                return super.onCreateLoader(id, args);
-            }
+            return new MostRecentCursorLoader(getActivity());
         }
 
         @Override
         public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-            if (loader.getId() == LOADER_ID_HISTORY) {
-                mAdapter.swapCursor(c);
-                updateUiFromCursor(c);
-                loadFavicons(c);
-            } else {
-                super.onLoadFinished(loader, c);
-            }
+            mAdapter.swapCursor(c);
+            updateUiFromCursor(c);
         }
 
         @Override
         public void onLoaderReset(Loader<Cursor> loader) {
-            if (loader.getId() == LOADER_ID_HISTORY) {
-                mAdapter.swapCursor(null);
-            } else {
-                super.onLoaderReset(loader);
-            }
-        }
-
-        @Override
-        public void onFaviconsLoaded() {
-            mAdapter.notifyDataSetChanged();
+            mAdapter.swapCursor(null);
         }
    }
 }
diff --git a/mobile/android/base/home/MostVisitedPage.java b/mobile/android/base/home/MostVisitedPage.java
index fff8e9ec0af..9315049aa13 100644
--- a/mobile/android/base/home/MostVisitedPage.java
+++ b/mobile/android/base/home/MostVisitedPage.java
@@ -16,6 +16,7 @@ import android.content.Context;
 import android.database.Cursor;
 import android.os.Bundle;
 import android.support.v4.app.LoaderManager;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
 import android.support.v4.content.Loader;
 import android.support.v4.widget.CursorAdapter;
 import android.view.LayoutInflater;
@@ -129,14 +130,12 @@ public class MostVisitedPage extends HomeFragment {
     public void onActivityCreated(Bundle savedInstanceState) {
         super.onActivityCreated(savedInstanceState);
 
-        final Activity activity = getActivity();
-
         // Intialize the search adapter
-        mAdapter = new VisitedAdapter(activity, null);
+        mAdapter = new VisitedAdapter(getActivity(), null);
         mList.setAdapter(mAdapter);
 
         // Create callbacks before the initial loader is started
-        mCursorLoaderCallbacks = new CursorLoaderCallbacks(activity, getLoaderManager());
+        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
         loadIfVisible();
     }
 
@@ -206,43 +205,21 @@ public class MostVisitedPage extends HomeFragment {
         }
     }
 
-    private class CursorLoaderCallbacks extends HomeCursorLoaderCallbacks {
-        public CursorLoaderCallbacks(Context context, LoaderManager loaderManager) {
-            super(context, loaderManager);
-        }
-
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
         @Override
         public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-            if (id == LOADER_ID_FRECENCY) {
-                return new FrecencyCursorLoader(getActivity());
-            } else {
-                return super.onCreateLoader(id, args);
-            }
+            return new FrecencyCursorLoader(getActivity());
         }
 
         @Override
         public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-            if (loader.getId() == LOADER_ID_FRECENCY) {
-                mAdapter.swapCursor(c);
-                updateUiFromCursor(c);
-                loadFavicons(c);
-            } else {
-                super.onLoadFinished(loader, c);
-            }
+            mAdapter.swapCursor(c);
+            updateUiFromCursor(c);
         }
 
         @Override
         public void onLoaderReset(Loader<Cursor> loader) {
-            if (loader.getId() == LOADER_ID_FRECENCY) {
-                mAdapter.swapCursor(null);
-            } else {
-                super.onLoaderReset(loader);
-            }
-        }
-
-        @Override
-        public void onFaviconsLoaded() {
-            mAdapter.notifyDataSetChanged();
+            mAdapter.swapCursor(null);
         }
     }
 }
diff --git a/mobile/android/base/home/PinBookmarkDialog.java b/mobile/android/base/home/PinBookmarkDialog.java
index 3e20ea80578..90b0ab9082a 100644
--- a/mobile/android/base/home/PinBookmarkDialog.java
+++ b/mobile/android/base/home/PinBookmarkDialog.java
@@ -14,6 +14,7 @@ import android.database.Cursor;
 import android.os.Bundle;
 import android.support.v4.app.DialogFragment;
 import android.support.v4.app.LoaderManager;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
 import android.support.v4.content.Loader;
 import android.support.v4.widget.CursorAdapter;
 import android.text.Editable;
@@ -38,9 +39,6 @@ class PinBookmarkDialog extends DialogFragment {
     // Cursor loader ID for search query
     private static final int LOADER_ID_SEARCH = 0;
 
-    // Cursor loader ID for favicons query
-    private static final int LOADER_ID_FAVICONS = 1;
-
     // Holds the current search term to use in the query
     private String mSearchTerm;
 
@@ -53,7 +51,7 @@ class PinBookmarkDialog extends DialogFragment {
     // Search results
     private ListView mList;
 
-    // Callbacks used for the search and favicon cursor loaders
+    // Callbacks used for the search loader
     private CursorLoaderCallbacks mLoaderCallbacks;
 
     // Bookmark selected listener
@@ -125,15 +123,14 @@ class PinBookmarkDialog extends DialogFragment {
     public void onActivityCreated(Bundle savedInstanceState) {
         super.onActivityCreated(savedInstanceState);
 
-        final Activity activity = getActivity();
         final LoaderManager manager = getLoaderManager();
 
         // Initialize the search adapter
-        mAdapter = new SearchAdapter(activity);
+        mAdapter = new SearchAdapter(getActivity());
         mList.setAdapter(mAdapter);
 
         // Create callbacks before the initial loader is started
-        mLoaderCallbacks = new CursorLoaderCallbacks(activity, manager);
+        mLoaderCallbacks = new CursorLoaderCallbacks();
 
         // Reconnect to the loader only if present
         manager.initLoader(LOADER_ID_SEARCH, null, mLoaderCallbacks);
@@ -179,42 +176,20 @@ class PinBookmarkDialog extends DialogFragment {
         }
     }
 
-    private class CursorLoaderCallbacks extends HomeCursorLoaderCallbacks {
-        public CursorLoaderCallbacks(Context context, LoaderManager loaderManager) {
-            super(context, loaderManager);
-        }
-
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
         @Override
         public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-            if (id == LOADER_ID_SEARCH) {
-                return SearchLoader.createInstance(getActivity(), args);
-            } else {
-                return super.onCreateLoader(id, args);
-            }
+            return SearchLoader.createInstance(getActivity(), args);
         }
 
         @Override
         public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-            if (loader.getId() == LOADER_ID_SEARCH) {
-                mAdapter.swapCursor(c);
-                loadFavicons(c);
-            } else {
-                super.onLoadFinished(loader, c);
-            }
+            mAdapter.swapCursor(c);
         }
 
         @Override
         public void onLoaderReset(Loader<Cursor> loader) {
-            if (loader.getId() == LOADER_ID_SEARCH) {
-                mAdapter.swapCursor(null);
-            } else {
-                super.onLoaderReset(loader);
-            }
-        }
-
-        @Override
-        public void onFaviconsLoaded() {
-            mAdapter.notifyDataSetChanged();
+            mAdapter.swapCursor(null);
         }
     }
 }
diff --git a/mobile/android/base/home/ReadingListPage.java b/mobile/android/base/home/ReadingListPage.java
index 62fc9a558a6..4bf43467d35 100644
--- a/mobile/android/base/home/ReadingListPage.java
+++ b/mobile/android/base/home/ReadingListPage.java
@@ -219,33 +219,18 @@ public class ReadingListPage extends HomeFragment {
     private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
         @Override
         public Loader<Cursor> onCreateLoader(int id, Bundle args) {
-            switch(id) {
-                case LOADER_ID_READING_LIST:
-                    return new ReadingListLoader(getActivity());
-            }
-            return null;
+            return new ReadingListLoader(getActivity());
         }
 
         @Override
         public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
-            final int loaderId = loader.getId();
-            switch(loaderId) {
-                case LOADER_ID_READING_LIST:
-                    mAdapter.swapCursor(c);
-                    break;
-           }
-
-           updateUiFromCursor(c);
+            mAdapter.swapCursor(c);
+            updateUiFromCursor(c);
         }
 
         @Override
         public void onLoaderReset(Loader<Cursor> loader) {
-            final int loaderId = loader.getId();
-            switch(loaderId) {
-                case LOADER_ID_READING_LIST:
-                    mAdapter.swapCursor(null);
-                    break;
-            }
+            mAdapter.swapCursor(null);
         }
     }
 }
diff --git a/mobile/android/base/home/TwoLinePageRow.java b/mobile/android/base/home/TwoLinePageRow.java
index a82b1d797d0..c70ae2b693f 100644
--- a/mobile/android/base/home/TwoLinePageRow.java
+++ b/mobile/android/base/home/TwoLinePageRow.java
@@ -10,14 +10,19 @@ import org.mozilla.gecko.R;
 import org.mozilla.gecko.Tab;
 import org.mozilla.gecko.Tabs;
 import org.mozilla.gecko.db.BrowserContract.Combined;
+import org.mozilla.gecko.db.BrowserDB;
 import org.mozilla.gecko.db.BrowserDB.URLColumns;
 import org.mozilla.gecko.gfx.BitmapUtils;
 import org.mozilla.gecko.util.ThreadUtils;
+import org.mozilla.gecko.util.UiAsyncTask;
 import org.mozilla.gecko.widget.FaviconView;
 
+import android.content.ContentResolver;
 import android.content.Context;
 import android.database.Cursor;
 import android.graphics.Bitmap;
+import android.os.AsyncTask;
+import android.os.Build;
 import android.text.TextUtils;
 import android.util.AttributeSet;
 import android.view.Gravity;
@@ -40,6 +45,8 @@ public class TwoLinePageRow extends LinearLayout
     // The URL for the page corresponding to this view.
     private String mPageUrl;
 
+    private LoadFaviconTask mLoadFaviconTask;
+
     public TwoLinePageRow(Context context) {
         this(context, null);
     }
@@ -74,6 +81,8 @@ public class TwoLinePageRow extends LinearLayout
                 Tabs.unregisterOnTabsChangedListener(TwoLinePageRow.this);
             }
         });
+
+        cancelLoadFaviconTask();
     }
 
     @Override
@@ -130,6 +139,16 @@ public class TwoLinePageRow extends LinearLayout
         updateDisplayedUrl();
     }
 
+    /**
+     * Cancels any pending favicon loading task associated with this view.
+     */
+    private void cancelLoadFaviconTask() {
+        if (mLoadFaviconTask != null) {
+            mLoadFaviconTask.cancel(true);
+            mLoadFaviconTask = null;
+        }
+    }
+
     /**
      * Replaces the page URL with "Switch to tab" if there is already a tab open with that URL.
      */
@@ -163,24 +182,33 @@ public class TwoLinePageRow extends LinearLayout
         // bar view - this is the equivalent of getDisplayTitle() in Tab.java
         setTitle(TextUtils.isEmpty(title) ? url : title);
 
+        // No need to do extra work if the URL associated with this view
+        // hasn't changed.
+        if (TextUtils.equals(mPageUrl, url)) {
+            return;
+        }
+
         updateDisplayedUrl(url);
+        cancelLoadFaviconTask();
 
-        int faviconIndex = cursor.getColumnIndex(URLColumns.FAVICON);
-        if (faviconIndex != -1) {
-            byte[] b = cursor.getBlob(faviconIndex);
-
-            Bitmap favicon = null;
-            if (b != null) {
-                Bitmap bitmap = BitmapUtils.decodeByteArray(b);
-                if (bitmap != null) {
-                    favicon = Favicons.scaleImage(bitmap);
-                }
-            }
-
+        // First, try to find the favicon in the memory cache. If it's not
+        // cached yet, try to load it from the database, off main thread.
+        final Bitmap favicon = Favicons.getFaviconFromMemCache(url);
+        if (favicon != null) {
             setFaviconWithUrl(favicon, url);
         } else {
-            // If favicons is not on the cursor, try to fetch it from the memory cache
-            setFaviconWithUrl(Favicons.getFaviconFromMemCache(url), url);
+            // Show blank image until the new favicon finishes loading
+            mFavicon.clearImage();
+
+            mLoadFaviconTask = new LoadFaviconTask(url);
+
+            // Try to use a thread pool instead of serial execution of tasks
+            // to add more throughput to the favicon loading routines.
+            if (Build.VERSION.SDK_INT >= 11) {
+                mLoadFaviconTask.executeOnExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
+            } else {
+                mLoadFaviconTask.execute();
+            }
         }
 
         // Don't show bookmark/reading list icon, if not needed.
@@ -213,4 +241,37 @@ public class TwoLinePageRow extends LinearLayout
             setBookmarkIcon(NO_ICON);
         }
     }
+
+    private class LoadFaviconTask extends AsyncTask<Void, Void, Bitmap> {
+        private final String mUrl;
+
+        public LoadFaviconTask(String url) {
+            mUrl = url;
+        }
+
+        @Override
+        public Bitmap doInBackground(Void... params) {
+            Bitmap favicon = Favicons.getFaviconFromMemCache(mUrl);
+            if (favicon == null) {
+                final ContentResolver cr = getContext().getContentResolver();
+
+                final Bitmap faviconFromDb = BrowserDB.getFaviconForUrl(cr, mUrl);
+                if (faviconFromDb != null) {
+                    favicon = Favicons.scaleImage(faviconFromDb);
+                    Favicons.putFaviconInMemCache(mUrl, favicon);
+                }
+            }
+
+            return favicon;
+        }
+
+        @Override
+        public void onPostExecute(Bitmap favicon) {
+            if (TextUtils.equals(mPageUrl, mUrl)) {
+                setFaviconWithUrl(favicon, mUrl);
+            }
+
+            mLoadFaviconTask = null;
+        }
+    }
 }
diff --git a/mobile/android/base/resources/layout/home_banner.xml b/mobile/android/base/resources/layout/home_banner.xml
index e8a54586d38..cc2e34b1cd9 100644
--- a/mobile/android/base/resources/layout/home_banner.xml
+++ b/mobile/android/base/resources/layout/home_banner.xml
@@ -9,13 +9,13 @@
                 android:layout_width="48dip"
                 android:layout_height="48dip"
                 android:layout_marginLeft="10dp"
-                android:layout_marginRight="10dp"
                 android:scaleType="centerInside"/>
 
      <TextView android:id="@+id/text"
                android:layout_width="0dip"
                android:layout_height="fill_parent"
                android:layout_weight="1"
+               android:layout_marginLeft="10dp"
                android:paddingTop="7dp"
                android:paddingBottom="7dp"
                android:textAppearance="@style/TextAppearance.Widget.HomeBanner"
diff --git a/mobile/android/base/widget/FaviconView.java b/mobile/android/base/widget/FaviconView.java
index 1a8a84ea36b..bfff38b6dd2 100644
--- a/mobile/android/base/widget/FaviconView.java
+++ b/mobile/android/base/widget/FaviconView.java
@@ -64,7 +64,7 @@ public class FaviconView extends ImageView {
     private void formatImage() {
         // If we're called before bitmap is set, just show the default.
         if (mIconBitmap == null) {
-            setImageResource(0);
+            setImageResource(R.drawable.favicon);
             hideBackground();
             return;
         }
@@ -72,6 +72,7 @@ public class FaviconView extends ImageView {
         // If we're called before size set, abort.
         if (mActualWidth == 0 || mActualHeight == 0) {
             hideBackground();
+            setImageResource(R.drawable.favicon);
             return;
         }
 
@@ -154,6 +155,14 @@ public class FaviconView extends ImageView {
         formatImage();
     }
 
+    /**
+     * Clear image and background shown by this view.
+     */
+    public void clearImage() {
+        setImageResource(0);
+        hideBackground();
+    }
+
     /**
      * Update the displayed image and apply the scaling logic.
      * The scaling logic will attempt to resize the image to fit correctly inside the view in a way
diff --git a/mobile/android/modules/Home.jsm b/mobile/android/modules/Home.jsm
new file mode 100644
index 00000000000..b409e193503
--- /dev/null
+++ b/mobile/android/modules/Home.jsm
@@ -0,0 +1,132 @@
+// -*- Mode: js2; tab-width: 2; indent-tabs-mode: nil; js2-basic-offset: 2; js2-skip-preprocessor-directives: t; -*-
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["Home"];
+
+const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/Services.jsm");
+
+// See bug 915424
+function resolveGeckoURI(aURI) {
+  if (!aURI)
+    throw "Can't resolve an empty uri";
+
+  if (aURI.startsWith("chrome://")) {
+    let registry = Cc['@mozilla.org/chrome/chrome-registry;1'].getService(Ci["nsIChromeRegistry"]);
+    return registry.convertChromeURL(Services.io.newURI(aURI, null, null)).spec;
+  } else if (aURI.startsWith("resource://")) {
+    let handler = Services.io.getProtocolHandler("resource").QueryInterface(Ci.nsIResProtocolHandler);
+    return handler.resolveURI(Services.io.newURI(aURI, null, null));
+  }
+  return aURI;
+}
+
+function sendMessageToJava(message) {
+  return Services.androidBridge.handleGeckoMessage(JSON.stringify(message));
+}
+
+function BannerMessage(options) {
+  let uuidgen = Cc["@mozilla.org/uuid-generator;1"].getService(Ci.nsIUUIDGenerator);
+  this.id = uuidgen.generateUUID().toString();
+
+  if ("text" in options && options.text != null)
+    this.text = options.text;
+
+  if ("icon" in options && options.icon != null)
+    this.iconURI = resolveGeckoURI(options.icon);
+
+  if ("onclick" in options && typeof options.onclick === "function")
+    this.onclick = options.onclick;
+}
+
+let HomeBanner = {
+  // Holds the messages that will rotate through the banner.
+  _messages: {},
+
+  // A queue used to keep track of which message to show next.
+  _queue: [],
+
+  observe: function(subject, topic, data) {
+    switch(topic) {
+      case "HomeBanner:Get":
+        this._handleGet();
+        break;
+
+      case "HomeBanner:Click":
+        this._handleClick(data);
+        break;
+    }
+  },
+
+  _handleGet: function() {
+    // Get the message from the front of the queue, then add it back
+    // to the end of the queue to show it again later.
+    let id = this._queue.shift();
+    this._queue.push(id);
+
+    let message = this._messages[id];
+    sendMessageToJava({
+      type: "HomeBanner:Data",
+      id: message.id,
+      text: message.text,
+      iconURI: message.iconURI
+    });
+  },
+
+  _handleClick: function(id) {
+    let message = this._messages[id];
+    if (message.onclick)
+      message.onclick();
+  },
+
+  /**
+   * Adds a new banner message to the rotation.
+   *
+   * @return id Unique identifer for the message.
+   */
+  add: function(options) {
+    let message = new BannerMessage(options);
+    this._messages[message.id] = message;
+
+    // Add the new message to the end of the queue.
+    this._queue.push(message.id);
+
+    // If this is the first message we're adding, add
+    // observers to listen for requests from the Java UI.
+    if (Object.keys(this._messages).length == 1) {
+      Services.obs.addObserver(this, "HomeBanner:Get", false);
+      Services.obs.addObserver(this, "HomeBanner:Click", false);
+    }
+
+    return message.id;
+  },
+
+  /**
+   * Removes a banner message from the rotation.
+   *
+   * @param id The id of the message to remove.
+   */
+  remove: function(id) {
+    delete this._messages[id];
+
+    // Remove the message from the queue.
+    let index = this._queue.indexOf(id);
+    this._queue.splice(index, 1);
+
+    // If there are no more messages, remove the observers.
+    if (Object.keys(this._messages).length == 0) {
+      Services.obs.removeObserver(this, "HomeBanner:Get");
+      Services.obs.removeObserver(this, "HomeBanner:Click");
+    }
+  }
+};
+
+// Public API
+this.Home = {
+  banner: HomeBanner
+}
diff --git a/mobile/android/modules/moz.build b/mobile/android/modules/moz.build
index 5f1dcf446ce..1aa40d1b719 100644
--- a/mobile/android/modules/moz.build
+++ b/mobile/android/modules/moz.build
@@ -6,6 +6,7 @@
 
 EXTRA_JS_MODULES += [
     'ContactService.jsm',
+    'Home.jsm',
     'JNI.jsm',
     'LightweightThemeConsumer.jsm',
     'OrderedBroadcast.jsm',
diff --git a/mobile/android/services/java-sources.mn b/mobile/android/services/java-sources.mn
index 21d6c4c1cde..d184a0ed2bd 100644
--- a/mobile/android/services/java-sources.mn
+++ b/mobile/android/services/java-sources.mn
@@ -12,6 +12,7 @@ background/bagheera/BagheeraClient.java
 background/bagheera/BagheeraRequestDelegate.java
 background/bagheera/BoundedByteArrayEntity.java
 background/bagheera/DeflateHelper.java
+background/common/DateUtils.java
 background/common/log/Logger.java
 background/common/log/writers/AndroidLevelCachingLogWriter.java
 background/common/log/writers/AndroidLogWriter.java
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index fdad23365ac..f4c4622d324 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -1822,7 +1822,11 @@ pref("layout.css.filters.enabled", false);
 pref("layout.css.flexbox.enabled", true);
 
 // Is support for CSS sticky positioning enabled?
+#ifdef RELEASE_BUILD
 pref("layout.css.sticky.enabled", false);
+#else
+pref("layout.css.sticky.enabled", true);
+#endif
 
 // Is support for the CSS4 image-orientation property enabled?
 pref("layout.css.image-orientation.enabled", true);
diff --git a/netwerk/test/TestSTSParser.cpp b/netwerk/test/TestSTSParser.cpp
index 47986275eff..8e0a7bfeffe 100644
--- a/netwerk/test/TestSTSParser.cpp
+++ b/netwerk/test/TestSTSParser.cpp
@@ -2,15 +2,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-//#define MOZILLA_INTERNAL_API
-
 #include "TestHarness.h"
 #include <stdio.h>
-#include "plstr.h"
 #include "nsNetUtil.h"
-#include "nsStringGlue.h"
 #include "nsISiteSecurityService.h"
-#include "nsIPermissionManager.h"
 
 #define EXPECT_SUCCESS(rv, ...) \
   PR_BEGIN_MACRO \
@@ -40,8 +35,7 @@
 bool
 TestSuccess(const char* hdr, bool extraTokens,
             uint64_t expectedMaxAge, bool expectedIncludeSubdomains,
-            nsISiteSecurityService* sss,
-            nsIPermissionManager* pm)
+            nsISiteSecurityService* sss)
 {
   nsCOMPtr<nsIURI> dummyUri;
   nsresult rv = NS_NewURI(getter_AddRefs(dummyUri), "https://foo.com/bar.html");
@@ -68,8 +62,7 @@ TestSuccess(const char* hdr, bool extraTokens,
 }
 
 bool TestFailure(const char* hdr,
-                 nsISiteSecurityService* sss,
-                 nsIPermissionManager* pm)
+                 nsISiteSecurityService* sss)
 {
   nsCOMPtr<nsIURI> dummyUri;
   nsresult rv = NS_NewURI(getter_AddRefs(dummyUri), "https://foo.com/bar.html");
@@ -102,10 +95,6 @@ main(int32_t argc, char *argv[])
     sss = do_GetService("@mozilla.org/ssservice;1", &rv);
     NS_ENSURE_SUCCESS(rv, -1);
 
-    nsCOMPtr<nsIPermissionManager> pm;
-    pm = do_GetService("@mozilla.org/permissionmanager;1", &rv);
-    NS_ENSURE_SUCCESS(rv, -1);
-
     int rv0, rv1;
 
     nsTArray<bool> rvs(24);
@@ -114,42 +103,42 @@ main(int32_t argc, char *argv[])
     printf("*** Attempting to parse valid STS headers ...\n");
 
     // SHOULD SUCCEED:
-    rvs.AppendElement(TestSuccess("max-age=100", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age  =100", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess(" max-age=100", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age = 100 ", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age = \"100\" ", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age=\"100\"", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess(" max-age =\"100\" ", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("\tmax-age\t=\t\"100\"\t", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age  =       100             ", false, 100, false, sss, pm));
+    rvs.AppendElement(TestSuccess("max-age=100", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("max-age  =100", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess(" max-age=100", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("max-age = 100 ", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("max-age = \"100\" ", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("max-age=\"100\"", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess(" max-age =\"100\" ", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("\tmax-age\t=\t\"100\"\t", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("max-age  =       100             ", false, 100, false, sss));
 
-    rvs.AppendElement(TestSuccess("maX-aGe=100", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("MAX-age  =100", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("max-AGE=100", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("Max-Age = 100 ", false, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("MAX-AGE = 100 ", false, 100, false, sss, pm));
+    rvs.AppendElement(TestSuccess("maX-aGe=100", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("MAX-age  =100", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("max-AGE=100", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("Max-Age = 100 ", false, 100, false, sss));
+    rvs.AppendElement(TestSuccess("MAX-AGE = 100 ", false, 100, false, sss));
 
-    rvs.AppendElement(TestSuccess("max-age=100;includeSubdomains", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age=100\t; includeSubdomains", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess(" max-age=100; includeSubdomains", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age = 100 ; includeSubdomains", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age  =       100             ; includeSubdomains", false, 100, true, sss, pm));
+    rvs.AppendElement(TestSuccess("max-age=100;includeSubdomains", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess("max-age=100\t; includeSubdomains", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess(" max-age=100; includeSubdomains", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess("max-age = 100 ; includeSubdomains", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess("max-age  =       100             ; includeSubdomains", false, 100, true, sss));
 
-    rvs.AppendElement(TestSuccess("maX-aGe=100; includeSUBDOMAINS", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess("MAX-age  =100; includeSubDomains", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess("max-AGE=100; iNcLuDeSuBdoMaInS", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess("Max-Age = 100; includesubdomains ", false, 100, true, sss, pm));
-    rvs.AppendElement(TestSuccess("INCLUDESUBDOMAINS;MaX-AgE = 100 ", false, 100, true, sss, pm));
+    rvs.AppendElement(TestSuccess("maX-aGe=100; includeSUBDOMAINS", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess("MAX-age  =100; includeSubDomains", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess("max-AGE=100; iNcLuDeSuBdoMaInS", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess("Max-Age = 100; includesubdomains ", false, 100, true, sss));
+    rvs.AppendElement(TestSuccess("INCLUDESUBDOMAINS;MaX-AgE = 100 ", false, 100, true, sss));
     // Turns out, the actual directive is entirely optional (hence the
     // trailing semicolon)
-    rvs.AppendElement(TestSuccess("max-age=100;includeSubdomains;", true, 100, true, sss, pm));
+    rvs.AppendElement(TestSuccess("max-age=100;includeSubdomains;", true, 100, true, sss));
 
     // these are weird tests, but are testing that some extended syntax is
     // still allowed (but it is ignored)
-    rvs.AppendElement(TestSuccess("max-age=100 ; includesubdomainsSomeStuff", true, 100, false, sss, pm));
-    rvs.AppendElement(TestSuccess("\r\n\t\t    \tcompletelyUnrelated = foobar; max-age= 34520103    \t \t; alsoUnrelated;asIsThis;\tincludeSubdomains\t\t \t", true, 34520103, true, sss, pm));
-    rvs.AppendElement(TestSuccess("max-age=100; unrelated=\"quoted \\\"thingy\\\"\"", true, 100, false, sss, pm));
+    rvs.AppendElement(TestSuccess("max-age=100 ; includesubdomainsSomeStuff", true, 100, false, sss));
+    rvs.AppendElement(TestSuccess("\r\n\t\t    \tcompletelyUnrelated = foobar; max-age= 34520103    \t \t; alsoUnrelated;asIsThis;\tincludeSubdomains\t\t \t", true, 34520103, true, sss));
+    rvs.AppendElement(TestSuccess("max-age=100; unrelated=\"quoted \\\"thingy\\\"\"", true, 100, false, sss));
 
     rv0 = rvs.Contains(false) ? 1 : 0;
     if (rv0 == 0)
@@ -160,37 +149,37 @@ main(int32_t argc, char *argv[])
     // SHOULD FAIL:
     printf("*** Attempting to parse invalid STS headers (should not parse)...\n");
     // invalid max-ages
-    rvs.AppendElement(TestFailure("max-age", sss, pm));
-    rvs.AppendElement(TestFailure("max-age ", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=p", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=*1p2", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=.20032", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=!20032", sss, pm));
-    rvs.AppendElement(TestFailure("max-age==20032", sss, pm));
+    rvs.AppendElement(TestFailure("max-age", sss));
+    rvs.AppendElement(TestFailure("max-age ", sss));
+    rvs.AppendElement(TestFailure("max-age=p", sss));
+    rvs.AppendElement(TestFailure("max-age=*1p2", sss));
+    rvs.AppendElement(TestFailure("max-age=.20032", sss));
+    rvs.AppendElement(TestFailure("max-age=!20032", sss));
+    rvs.AppendElement(TestFailure("max-age==20032", sss));
 
     // invalid headers
-    rvs.AppendElement(TestFailure("foobar", sss, pm));
-    rvs.AppendElement(TestFailure("maxage=100", sss, pm));
-    rvs.AppendElement(TestFailure("maxa-ge=100", sss, pm));
-    rvs.AppendElement(TestFailure("max-ag=100", sss, pm));
-    rvs.AppendElement(TestFailure("includesubdomains", sss, pm));
-    rvs.AppendElement(TestFailure(";", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=\"100", sss, pm));
+    rvs.AppendElement(TestFailure("foobar", sss));
+    rvs.AppendElement(TestFailure("maxage=100", sss));
+    rvs.AppendElement(TestFailure("maxa-ge=100", sss));
+    rvs.AppendElement(TestFailure("max-ag=100", sss));
+    rvs.AppendElement(TestFailure("includesubdomains", sss));
+    rvs.AppendElement(TestFailure(";", sss));
+    rvs.AppendElement(TestFailure("max-age=\"100", sss));
     // The max-age directive here doesn't conform to the spec, so it MUST
     // be ignored. Consequently, the REQUIRED max-age directive is not
     // present in this header, and so it is invalid.
-    rvs.AppendElement(TestFailure("max-age=100, max-age=200; includeSubdomains", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=100 includesubdomains", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=100 bar foo", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=100randomstuffhere", sss, pm));
+    rvs.AppendElement(TestFailure("max-age=100, max-age=200; includeSubdomains", sss));
+    rvs.AppendElement(TestFailure("max-age=100 includesubdomains", sss));
+    rvs.AppendElement(TestFailure("max-age=100 bar foo", sss));
+    rvs.AppendElement(TestFailure("max-age=100randomstuffhere", sss));
     // All directives MUST appear only once in an STS header field.
-    rvs.AppendElement(TestFailure("max-age=100; max-age=200", sss, pm));
-    rvs.AppendElement(TestFailure("includeSubdomains; max-age=200; includeSubdomains", sss, pm));
-    rvs.AppendElement(TestFailure("max-age=200; includeSubdomains; includeSubdomains", sss, pm));
+    rvs.AppendElement(TestFailure("max-age=100; max-age=200", sss));
+    rvs.AppendElement(TestFailure("includeSubdomains; max-age=200; includeSubdomains", sss));
+    rvs.AppendElement(TestFailure("max-age=200; includeSubdomains; includeSubdomains", sss));
     // The includeSubdomains directive is valueless.
-    rvs.AppendElement(TestFailure("max-age=100; includeSubdomains=unexpected", sss, pm));
+    rvs.AppendElement(TestFailure("max-age=100; includeSubdomains=unexpected", sss));
     // LWS must have at least one space or horizontal tab
-    rvs.AppendElement(TestFailure("\r\nmax-age=200", sss, pm));
+    rvs.AppendElement(TestFailure("\r\nmax-age=200", sss));
 
     rv1 = rvs.Contains(false) ? 1 : 0;
     if (rv1 == 0)
diff --git a/testing/talos/talos.json b/testing/talos/talos.json
index e5c3bcce39c..0b7488b249b 100644
--- a/testing/talos/talos.json
+++ b/testing/talos/talos.json
@@ -1,11 +1,11 @@
 {
     "talos.zip": {
-        "url": "http://talos-bundles.pvt.build.mozilla.org/zips/talos.ca2229a32cb6.zip",
+        "url": "http://talos-bundles.pvt.build.mozilla.org/zips/talos.e11c30b59cef.zip",
         "path": ""
     },
     "global": {
         "talos_repo": "http://hg.mozilla.org/build/talos",
-        "talos_revision": "655c5140970c"
+        "talos_revision": "e11c30b59cef"
     },
     "suites": {
         "chromez": {
@@ -52,5 +52,43 @@
                 "C:/slave/talos-data/talos/xperf.config"
             ]
         }
+    },
+    "mobile-suites": {
+        "remote-ts": {
+            "tests": ["ts_paint"]
+        },
+        "remote-tsvgx": {
+            "tests": ["tsvgx"],
+            "talos_options": [
+                "--noChrome"
+            ]
+        },
+        "remote-tcanvasmark": {
+            "tests": ["tcanvasmark"],
+            "talos_options": [
+                "--noChrome"
+            ]
+        },
+        "remote-trobopan": {
+            "tests": ["trobopan"],
+            "talos_options": [
+                "--fennecIDs", "../fennec_ids.txt"
+            ]
+        },
+        "remote-troboprovider": {
+            "tests": ["tprovider"],
+            "talos_options": [
+                "--fennecIDs", "../fennec_ids.txt"
+            ]
+        },
+        "remote-trobocheck2": {
+            "tests": ["tcheck2"],
+            "talos_options": [
+                "--fennecIDs", "../fennec_ids.txt"
+            ]
+        },
+        "remote-tp4m_nochrome": {
+            "tests": ["tp4m"]
+        }
     }
 }
diff --git a/toolkit/components/aboutmemory/content/aboutMemory.js b/toolkit/components/aboutmemory/content/aboutMemory.js
index 53b76fed419..809eb4ae953 100644
--- a/toolkit/components/aboutmemory/content/aboutMemory.js
+++ b/toolkit/components/aboutmemory/content/aboutMemory.js
@@ -483,6 +483,9 @@ function updateAboutMemoryFromReporters()
 }
 
 // Increment this if the JSON format changes.
+//
+// If/when this changes to 2, the beLenient() function and its use can be
+// removed.
 var gCurrentFileFormatVersion = 1;
 
 /**
@@ -958,8 +961,29 @@ function getPCollsByProcess(aProcessReports)
                   "non-sentence explicit description");
 
     } else {
-      assertInput(gSentenceRegExp.test(aDescription),
-                  "non-sentence other description");
+      const kLenientPrefixes =
+        ['rss/', 'pss/', 'size/', 'swap/', 'compartments/', 'ghost-windows/'];
+      let beLenient = function(aUnsafePath) {
+        for (let i = 0; i < kLenientPrefixes.length; i++) {
+          if (aUnsafePath.startsWith(kLenientPrefixes[i])) {
+            return true;
+          }
+        }
+        return false;
+      }
+
+      // In general, non-explicit reports should have a description that is a
+      // complete sentence.  However, we want to be able to read old saved
+      // reports, so we are lenient in a couple of situations where we used to
+      // allow non-sentence descriptions:
+      // - smaps reports (which were removed in bug 912165);
+      // - compartment and ghost-window reports (which had empty descriptions
+      //   prior to bug 911641).
+      if (!beLenient(aUnsafePath)) {
+        assertInput(gSentenceRegExp.test(aDescription),
+                    "non-sentence other description: " + aUnsafePath + ", " +
+                    aDescription);
+      }
     }
 
     assert(aPresence === undefined ||
@@ -1737,7 +1761,9 @@ function appendTreeElements(aP, aRoot, aProcess, aPadText)
       tIsInvalid = true;
       let unsafePath = aUnsafeNames.join("/");
       gUnsafePathsWithInvalidValuesForThisProcess.push(unsafePath);
-      reportAssertionFailure("Invalid value for " + flipBackslashes(unsafePath));
+      reportAssertionFailure("Invalid value (" + aT._amount + " / " +
+                             aRoot._amount + ") for " +
+                             flipBackslashes(unsafePath));
     }
 
     // For non-leaf nodes, the entire sub-tree is put within a span so it can
diff --git a/toolkit/components/aboutmemory/tests/Makefile.in b/toolkit/components/aboutmemory/tests/Makefile.in
index 0f2d2dd6cb4..df8f3b55c32 100644
--- a/toolkit/components/aboutmemory/tests/Makefile.in
+++ b/toolkit/components/aboutmemory/tests/Makefile.in
@@ -17,6 +17,8 @@ MOCHITEST_CHROME_FILES	= \
 
 ifndef MOZ_ASAN
 MOCHITEST_CHROME_FILES += \
+  remote.xul \
   test_memoryReporters.xul \
+  test_memoryReporters2.xul \
   $(NULL)
 endif
diff --git a/toolkit/components/aboutmemory/tests/memory-reports-good.json b/toolkit/components/aboutmemory/tests/memory-reports-good.json
index 8c5c2412a54..f3ec6ff4b00 100644
--- a/toolkit/components/aboutmemory/tests/memory-reports-good.json
+++ b/toolkit/components/aboutmemory/tests/memory-reports-good.json
@@ -7,6 +7,13 @@
     {"process": "Main Process (pid NNN)", "path": "other/a", "kind": 2, "units": 0, "amount": 209715, "description": "Other a."},
     {"process": "Main Process (pid NNN)", "path": "explicit/a/b", "kind": 1, "units": 0, "amount": 52428800, "description": "A b."},
 
+    {"process": "Main Process (pid NNN)", "path": "size/a", "kind": 1, "units": 0, "amount": 1024, "description": "non-sentence"},
+    {"process": "Main Process (pid NNN)", "path": "rss/a", "kind": 1, "units": 0, "amount": 1024, "description": "non-sentence"},
+    {"process": "Main Process (pid NNN)", "path": "pss/a", "kind": 1, "units": 0, "amount": 1024, "description": "non-sentence"},
+    {"process": "Main Process (pid NNN)", "path": "swap/a", "kind": 1, "units": 0, "amount": 1024, "description": "non-sentence"},
+    {"process": "Main Process (pid NNN)", "path": "compartments/system/a", "kind": 1, "units": 0, "amount": 1024, "description": ""},
+    {"process": "Main Process (pid NNN)", "path": "ghost-windows/a", "kind": 1, "units": 0, "amount": 1024, "description": ""},
+
     {"process": "Explicit-only process", "path": "explicit/a/b", "kind": 1, "units": 0, "amount": 100000, "description": "A b."},
 
     {"process": "Other-only process", "path": "a/b", "kind": 1, "units": 0, "amount": 100000, "description": "A b."},
diff --git a/toolkit/components/aboutmemory/tests/remote.xul b/toolkit/components/aboutmemory/tests/remote.xul
new file mode 100644
index 00000000000..7d691013055
--- /dev/null
+++ b/toolkit/components/aboutmemory/tests/remote.xul
@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<window title="Remote browser"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <!-- test results are displayed in the html:body -->
+  <p>Remote browser</p>
+
+  <browser type="content" src="about:blank" id="remote" remote="true"/>
+</window>
diff --git a/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul b/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
index 38c55f7d858..a99a1c175e8 100644
--- a/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
+++ b/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
@@ -213,10 +213,28 @@ Explicit Allocations\n\
 \n\
 Other Measurements\n\
 \n\
+1,024 B (100.0%) -- compartments\n\
+└──1,024 B (100.0%) ── system/a\n\
+\n\
+1,024 B (100.0%) -- ghost-windows\n\
+└──1,024 B (100.0%) ── a\n\
+\n\
 314,572 B (100.0%) -- other\n\
 ├──209,715 B (66.67%) ── a\n\
 └──104,857 B (33.33%) ── b\n\
 \n\
+1,024 B (100.0%) -- pss\n\
+└──1,024 B (100.0%) ── a\n\
+\n\
+1,024 B (100.0%) -- rss\n\
+└──1,024 B (100.0%) ── a\n\
+\n\
+1,024 B (100.0%) -- size\n\
+└──1,024 B (100.0%) ── a\n\
+\n\
+1,024 B (100.0%) -- swap\n\
+└──1,024 B (100.0%) ── a\n\
+\n\
 262,144,000 B ── heap-allocated\n\
 \n\
 Other-only process\n\
@@ -309,12 +327,13 @@ Other Measurements\n\
     // This loads a pre-existing file that is valid.
     { filename: "memory-reports-good.json", expected: expectedGood, dumpFirst: false },
 
-    // This dumps to a file and then reads it back in.  The output is the same as the first test.
+    // This dumps to a file and then reads it back in.
     { filename: "memory-reports-dumped.json.gz", expected: expectedGood2, dumpFirst: true },
 
     // This loads a pre-existing file that is invalid.
     { filename: "memory-reports-bad.json",  expected: expectedBad, dumpFirst: false },
 
+    // This loads a pre-existing diff file.
     { filename: "memory-reports-diff1.json", filename2: "memory-reports-diff2.json",  expected: expectedDiff, dumpFirst: false }
   ];
 
diff --git a/toolkit/components/aboutmemory/tests/test_aboutmemory4.xul b/toolkit/components/aboutmemory/tests/test_aboutmemory4.xul
index 22ce18777e4..000711a36ae 100644
--- a/toolkit/components/aboutmemory/tests/test_aboutmemory4.xul
+++ b/toolkit/components/aboutmemory/tests/test_aboutmemory4.xul
@@ -108,10 +108,28 @@ Explicit Allocations\n\
 \n\
 Other Measurements\n\
 \n\
+0.00 MB (100.0%) -- compartments\n\
+└──0.00 MB (100.0%) ── system/a\n\
+\n\
+0.00 MB (100.0%) -- ghost-windows\n\
+└──0.00 MB (100.0%) ── a\n\
+\n\
 0.30 MB (100.0%) -- other\n\
 ├──0.20 MB (66.67%) ── a\n\
 └──0.10 MB (33.33%) ── b\n\
 \n\
+0.00 MB (100.0%) -- pss\n\
+└──0.00 MB (100.0%) ── a\n\
+\n\
+0.00 MB (100.0%) -- rss\n\
+└──0.00 MB (100.0%) ── a\n\
+\n\
+0.00 MB (100.0%) -- size\n\
+└──0.00 MB (100.0%) ── a\n\
+\n\
+0.00 MB (100.0%) -- swap\n\
+└──0.00 MB (100.0%) ── a\n\
+\n\
 250.00 MB ── heap-allocated\n\
 \n\
 Other-only process\n\
diff --git a/toolkit/components/aboutmemory/tests/test_memoryReporters.xul b/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
index 10f11b060d0..c83fd09e3fd 100644
--- a/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
+++ b/toolkit/components/aboutmemory/tests/test_memoryReporters.xul
@@ -1,9 +1,10 @@
 <?xml version="1.0"?>
 <?xml-stylesheet type="text/css" href="chrome://global/skin"?>
 <?xml-stylesheet type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"?>
-<window title="Memory reporter"
+<window title="Memory reporters"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
-  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
 
   <!-- This file tests (in a rough fashion) whether the memory reporters are
        producing sensible results.  test_aboutmemory.xul tests the
@@ -29,7 +30,6 @@
   const Ci = Components.interfaces;
   const Cr = Components.results;
 
-  const kUnknown = -1;
   const NONHEAP = Ci.nsIMemoryReporter.KIND_NONHEAP;
   const HEAP    = Ci.nsIMemoryReporter.KIND_HEAP;
   const OTHER   = Ci.nsIMemoryReporter.KIND_OTHER;
@@ -149,7 +149,7 @@
     ok(aAmounts.length == 1, aName + " has " + aAmounts.length + " report");
     let n = aAmounts[0];
     // Check the size is reasonable -- i.e. not ridiculously large or small.
-    ok(n === kUnknown || (100 * 1000 <= n && n <= 10 * 1000 * 1000 * 1000),
+    ok(100 * 1000 <= n && n <= 10 * 1000 * 1000 * 1000,
        aName + "'s size is reasonable");
   }
 
diff --git a/toolkit/components/aboutmemory/tests/test_memoryReporters2.xul b/toolkit/components/aboutmemory/tests/test_memoryReporters2.xul
new file mode 100644
index 00000000000..38d5ed9edc2
--- /dev/null
+++ b/toolkit/components/aboutmemory/tests/test_memoryReporters2.xul
@@ -0,0 +1,112 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+<window title="Memory reporters with child processes"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"/>
+
+  <!-- test results are displayed in the html:body -->
+  <body xmlns="http://www.w3.org/1999/xhtml">
+  </body>
+
+  <!-- test code goes here -->
+  <script type="application/javascript"><![CDATA[
+
+  const Cc = Components.classes;
+  const Ci = Components.interfaces;
+
+  SimpleTest.waitForExplicitFinish();
+
+  // We want to know when a remote process sends us an update.
+  let os = Cc["@mozilla.org/observer-service;1"]
+             .getService(Ci.nsIObserverService);
+  os.addObserver(childMemoryReporterUpdate, "child-memory-reporter-update", false);
+
+  let numRemotes = 3;
+
+  // Create some remote processes, and set up message-passing so that go() is
+  // called once per process, once it is fully initialized.
+  let remotes = [];
+  SpecialPowers.pushPrefEnv({"set": [["dom.ipc.processCount", 3]]}, function() {
+    for (let i = 0; i < numRemotes; i++) {
+      let w = remotes[i] = window.open("remote.xul", "", "chrome");
+
+      w.addEventListener("load", function loadHandler() {
+        w.removeEventListener("load", loadHandler);
+        let remoteBrowser = w.document.getElementById("remote");
+        let mm = remoteBrowser.messageManager;
+        mm.addMessageListener("test:ready", function readyHandler() {
+          mm.removeMessageListener("test:ready", readyHandler);
+          remoteReady();
+        });
+        mm.loadFrameScript("data:," + encodeURI("sendAsyncMessage('test:ready');"), true);
+      });
+    }
+  });
+
+  let numReady = 0;
+
+  function remoteReady()
+  {
+    numReady++;
+    if (numReady == numRemotes) {
+      // All the remote processes are ready.  Ask them for memory reports.
+      os.notifyObservers(null, "child-memory-reporter-request", null);
+    }
+  }
+
+  let numUpdates = 0;
+
+  function childMemoryReporterUpdate()
+  {
+    numUpdates++;
+    if (numUpdates == numRemotes) {
+      // All the remote processes have reported back.  Check reports.
+      let vsizes = {};
+
+      // Get all the reports.
+      let mgr = Cc["@mozilla.org/memory-reporter-manager;1"].
+                getService(Ci.nsIMemoryReporterManager);
+      let e = mgr.enumerateReporters();
+      while (e.hasMoreElements()) {
+        let r = e.getNext().QueryInterface(Ci.nsIMemoryReporter);
+        r.collectReports(function(aProcess, aPath, aKind, aUnits, aAmount, aDesc) {
+          if (aPath === "vsize") {
+            ok(100 * 1000 <= aAmount && aAmount <= 10 * 1000 * 1000 * 1000,
+               "vsize is reasonable");
+            vsizes[aProcess] = aAmount;
+          }
+        }, null);
+      }
+
+      // Close the remote processes.
+      for (let i = 0; i < numRemotes; i++) {
+        remotes[i].close();
+      }
+
+      // Check the results.
+
+      let processes = Object.keys(vsizes);
+      ok(processes.length == numRemotes + 1, "correct vsize count");
+
+      let numEmptyProcesses = 0, numNonEmptyProcesses = 0;
+      for (let i = 0; i < processes.length; i++) {
+        if (processes[i] == "") {
+          numEmptyProcesses++;
+        } else {
+          ok(processes[i].startsWith("Content ("),
+             "correct non-empty process name prefix");
+          numNonEmptyProcesses++;
+        }
+      }
+      ok(numEmptyProcesses == 1, "correct empty process name count");
+      ok(numNonEmptyProcesses == numRemotes,
+                                 "correct non-empty process name count");
+
+      SimpleTest.finish();
+    }
+  }
+  ]]></script>
+</window>
diff --git a/toolkit/components/social/MessagePortWorker.js b/toolkit/components/social/MessagePortWorker.js
index 29f889cd5ae..80d495472b5 100644
--- a/toolkit/components/social/MessagePortWorker.js
+++ b/toolkit/components/social/MessagePortWorker.js
@@ -19,7 +19,9 @@ WorkerPort.prototype = {
   },
 
   _onerror: function fw_WorkerPort_onerror(err) {
-    throw new Error("Port " + this + " handler failed: " + err);
+    // We throw an object that "derives" from the exception, but with
+    // a more detailed message.
+    throw {message: "Port " + this + " handler failed: " + err.message, __proto__: err};
   }
 }
 
diff --git a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/exception_handler.cc b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/exception_handler.cc
index 98b8e069bc1..a7e5725cf76 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/exception_handler.cc
+++ b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/exception_handler.cc
@@ -626,7 +626,6 @@ bool ExceptionHandler::InstallHandler() {
   if (gProtectedData.handler != NULL) {
     return false;
   }
-#if TARGET_OS_IPHONE
   if (!IsOutOfProcess()) {
     struct sigaction sa;
     memset(&sa, 0, sizeof(sa));
@@ -646,7 +645,6 @@ bool ExceptionHandler::InstallHandler() {
     mprotect(gProtectedData.protected_buffer, PAGE_SIZE, PROT_READ);
 #endif
   }
-#endif
 
   try {
 #if USE_PROTECTED_ALLOCATIONS
diff --git a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/minidump_generator.cc b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/minidump_generator.cc
index 85c53ebbb8f..809e684fa0d 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/mac/handler/minidump_generator.cc
+++ b/toolkit/crashreporter/google-breakpad/src/client/mac/handler/minidump_generator.cc
@@ -787,9 +787,22 @@ bool MinidumpGenerator::GetThreadState(thread_act_t target_thread,
         *count = final_size;
         return true;
       }
+#endif
+#ifdef HAS_X86_SUPPORT
+    case CPU_TYPE_I386:
+    case CPU_TYPE_X86_64: {
+        size_t state_size = cpu_type_ == CPU_TYPE_I386 ?
+            sizeof(i386_thread_state_t) : sizeof(x86_thread_state64_t);
+        size_t final_size =
+            std::min(static_cast<size_t>(*count), state_size);
+        memcpy(state, &task_context_->uc_mcontext->__ss, final_size);
+        *count = final_size;
+        return true;
+      }
 #endif
     }
   }
+
   thread_state_flavor_t flavor;
   switch (cpu_type_) {
 #ifdef HAS_ARM_SUPPORT
diff --git a/toolkit/crashreporter/google-breakpad/src/client/mac/tests/exception_handler_test.cc b/toolkit/crashreporter/google-breakpad/src/client/mac/tests/exception_handler_test.cc
index d108d432185..e19944d0871 100644
--- a/toolkit/crashreporter/google-breakpad/src/client/mac/tests/exception_handler_test.cc
+++ b/toolkit/crashreporter/google-breakpad/src/client/mac/tests/exception_handler_test.cc
@@ -122,10 +122,46 @@ void ExceptionHandlerTest::InProcessCrash(bool aborting) {
   char minidump_file[PATH_MAX];
   ssize_t nbytes = read(fds[0], minidump_file, sizeof(minidump_file));
   ASSERT_NE(0, nbytes);
-  // Ensure that minidump file exists and is > 0 bytes.
-  struct stat st;
-  ASSERT_EQ(0, stat(minidump_file, &st));
-  ASSERT_LT(0, st.st_size);
+
+  Minidump minidump(minidump_file);
+  ASSERT_TRUE(minidump.Read());
+
+  MinidumpException* exception = minidump.GetException();
+  ASSERT_TRUE(exception);
+
+  const MDRawExceptionStream* raw_exception = exception->exception();
+  ASSERT_TRUE(raw_exception);
+
+  if (aborting) {
+    EXPECT_EQ(MD_EXCEPTION_MAC_SOFTWARE,
+              raw_exception->exception_record.exception_code);
+    EXPECT_EQ(MD_EXCEPTION_CODE_MAC_ABORT,
+              raw_exception->exception_record.exception_flags);
+  } else {
+    EXPECT_EQ(MD_EXCEPTION_MAC_BAD_ACCESS,
+              raw_exception->exception_record.exception_code);
+#if defined(__x86_64__)
+    EXPECT_EQ(MD_EXCEPTION_CODE_MAC_INVALID_ADDRESS,
+              raw_exception->exception_record.exception_flags);
+#elif defined(__i386__)
+    EXPECT_EQ(MD_EXCEPTION_CODE_MAC_PROTECTION_FAILURE,
+              raw_exception->exception_record.exception_flags);
+#endif
+  }
+
+  const MinidumpContext* context = exception->GetContext();
+  ASSERT_TRUE(context);
+
+  uint64_t instruction_pointer;
+  ASSERT_TRUE(context->GetInstructionPointer(&instruction_pointer));
+
+  // Ideally would like to sanity check that abort() is on the stack
+  // but that's hard.
+  MinidumpMemoryList* memory_list = minidump.GetMemoryList();
+  ASSERT_TRUE(memory_list);
+  MinidumpMemoryRegion* region =
+      memory_list->GetMemoryRegionForAddress(instruction_pointer);
+  EXPECT_TRUE(region);
 
   // Child process should have exited with a zero status.
   int ret;
@@ -138,11 +174,9 @@ TEST_F(ExceptionHandlerTest, InProcess) {
   InProcessCrash(false);
 }
 
-#if TARGET_OS_IPHONE
 TEST_F(ExceptionHandlerTest, InProcessAbort) {
   InProcessCrash(true);
 }
-#endif
 
 static bool DumpNameMDCallback(const char *dump_dir, const char *file_name,
                                void *context, bool success) {
diff --git a/toolkit/crashreporter/test/CrashTestUtils.jsm b/toolkit/crashreporter/test/CrashTestUtils.jsm
index 9ba544473f8..21a12275116 100644
--- a/toolkit/crashreporter/test/CrashTestUtils.jsm
+++ b/toolkit/crashreporter/test/CrashTestUtils.jsm
@@ -1,4 +1,5 @@
-// XXXkhuey this needs a license header.
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 this.EXPORTED_SYMBOLS = ["CrashTestUtils"];
 
@@ -16,6 +17,7 @@ this.CrashTestUtils = {
   CRASH_RUNTIMEABORT:          2,
   CRASH_OOM:                   3,
   CRASH_MOZ_CRASH:             4,
+  CRASH_ABORT:                 5,
 
   // Constants for dumpHasStream()
   // From google_breakpad/common/minidump_format.h
diff --git a/toolkit/crashreporter/test/nsTestCrasher.cpp b/toolkit/crashreporter/test/nsTestCrasher.cpp
index 72f04688544..6287999a561 100644
--- a/toolkit/crashreporter/test/nsTestCrasher.cpp
+++ b/toolkit/crashreporter/test/nsTestCrasher.cpp
@@ -46,6 +46,7 @@ const int16_t CRASH_PURE_VIRTUAL_CALL     = 1;
 const int16_t CRASH_RUNTIMEABORT          = 2;
 const int16_t CRASH_OOM                   = 3;
 const int16_t CRASH_MOZ_CRASH             = 4;
+const int16_t CRASH_ABORT                 = 5;
 
 extern "C" NS_EXPORT
 void Crash(int16_t how)
@@ -76,6 +77,10 @@ void Crash(int16_t how)
     MOZ_CRASH();
     break;
   }
+  case CRASH_ABORT: {
+    abort();
+    break;
+  }
   default:
     break;
   }
diff --git a/toolkit/crashreporter/test/unit/test_crash_abort.js b/toolkit/crashreporter/test/unit/test_crash_abort.js
new file mode 100644
index 00000000000..67008346f8d
--- /dev/null
+++ b/toolkit/crashreporter/test/unit/test_crash_abort.js
@@ -0,0 +1,16 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+function run_test()
+{
+  // Try crashing with an abort().
+  do_crash(function() {
+             crashType = CrashTestUtils.CRASH_ABORT;
+             crashReporter.annotateCrashReport("TestKey", "TestValue");
+           },
+           function(mdump, extra) {
+             do_check_eq(extra.TestKey, "TestValue");
+           },
+          // process will exit with a zero exit status
+          true);
+}
diff --git a/toolkit/crashreporter/test/unit/xpcshell.ini b/toolkit/crashreporter/test/unit/xpcshell.ini
index b055441dca6..8b2771fa42a 100644
--- a/toolkit/crashreporter/test/unit/xpcshell.ini
+++ b/toolkit/crashreporter/test/unit/xpcshell.ini
@@ -8,6 +8,9 @@ tail =
 [test_crash_oom.js]
 skip-if = os == 'win' && debug
 
+[test_crash_abort.js]
+skip-if = os == 'win'
+
 [test_crashreporter.js]
 [test_crashreporter_crash.js]
 [test_crashreporter_crash_profile_lock.js]
diff --git a/toolkit/devtools/server/actors/script.js b/toolkit/devtools/server/actors/script.js
index 1d9b3692b23..0ae4530dcf6 100644
--- a/toolkit/devtools/server/actors/script.js
+++ b/toolkit/devtools/server/actors/script.js
@@ -288,9 +288,17 @@ EventLoopStack.prototype = {
    * The URL of the debuggee who pushed the event loop on top of the stack.
    */
   get lastPausedUrl() {
-    return this.size > 0
-      ? this._inspector.lastNestRequestor.url
-      : null;
+    let url = null;
+    if (this.size > 0) {
+      try {
+        url = this._inspector.lastNestRequestor.url
+      } catch (e) {
+        // The tab's URL getter may throw if the tab is destroyed by the time
+        // this code runs, but we don't really care at this point.
+        dumpn(e);
+      }
+    }
+    return url;
   },
 
   /**
@@ -936,7 +944,7 @@ ThreadActor.prototype = {
     // In case of multiple nested event loops (due to multiple debuggers open in
     // different tabs or multiple debugger clients connected to the same tab)
     // only allow resumption in a LIFO order.
-    if (this._nestedEventLoops.size
+    if (this._nestedEventLoops.size && this._nestedEventLoops.lastPausedUrl
         && this._nestedEventLoops.lastPausedUrl !== this._hooks.url) {
       return {
         error: "wrongOrder",
diff --git a/toolkit/library/Makefile.in b/toolkit/library/Makefile.in
index 817044c1a31..e76907f93c1 100644
--- a/toolkit/library/Makefile.in
+++ b/toolkit/library/Makefile.in
@@ -147,7 +147,6 @@ COMPONENT_LIBS += \
   mediasniffer \
   gkgfx \
   gklayout \
-  docshell \
   embedcomponents \
   webbrwsr \
   nsappshell \
@@ -168,6 +167,15 @@ COMPONENT_LIBS += \
   diskspacewatcher \
   $(NULL)
 
+SHARED_LIBRARY_LIBS += \
+	 $(DEPTH)/docshell/base/$(LIB_PREFIX)basedocshell_s.$(LIB_SUFFIX) \
+	 $(DEPTH)/uriloader/base/$(LIB_PREFIX)uriloaderbase_s.$(LIB_SUFFIX) \
+	 $(DEPTH)/uriloader/exthandler/$(LIB_PREFIX)exthandler_s.$(LIB_SUFFIX) \
+	 $(DEPTH)/uriloader/prefetch/$(LIB_PREFIX)prefetch_s.$(LIB_SUFFIX) \
+	 $(DEPTH)/docshell/shistory/src/$(LIB_PREFIX)shistory_s.$(LIB_SUFFIX) \
+	 $(DEPTH)/docshell/build/$(LIB_PREFIX)docshell.$(LIB_SUFFIX) \
+  $(NULL)
+
 ifeq (gonk,$(MOZ_WIDGET_TOOLKIT))
 COMPONENT_LIBS += \
   domwifi_s \
diff --git a/widget/cocoa/nsLookAndFeel.mm b/widget/cocoa/nsLookAndFeel.mm
index 938224f881f..2fd0ff2e451 100644
--- a/widget/cocoa/nsLookAndFeel.mm
+++ b/widget/cocoa/nsLookAndFeel.mm
@@ -249,7 +249,7 @@ nsLookAndFeel::NativeGetColor(ColorID aID, nscolor &aColor)
       aColor = GetColorFromNSColor([NSColor selectedMenuItemTextColor]);
       break;      
     case eColorID__moz_mac_disabledtoolbartext:
-      aColor = NS_RGB(0x3F,0x3F,0x3F);
+      aColor = GetColorFromNSColor([NSColor disabledControlTextColor]);
       break;
     case eColorID__moz_mac_menuselect:
       aColor = GetColorFromNSColor([NSColor alternateSelectedControlColor]);
diff --git a/widget/tests/test_platform_colors.xul b/widget/tests/test_platform_colors.xul
index c6777648de9..5a4bc40c7c6 100644
--- a/widget/tests/test_platform_colors.xul
+++ b/widget/tests/test_platform_colors.xul
@@ -75,7 +75,7 @@ var colors = {
   "-moz-mac-menushadow": ["rgb(163, 163, 163)"],
   "-moz-mac-menutextdisable": ["rgb(152, 152, 152)", "rgb(136, 136, 136)"],
   "-moz-mac-menutextselect": ["rgb(255, 255, 255)"],
-  "-moz-mac-disabledtoolbartext": ["rgb(63, 63, 63)"],
+  "-moz-mac-disabledtoolbartext": ["rgb(127, 127, 127)"],
   "-moz-mac-secondaryhighlight": ["rgb(212, 212, 212)"],
   "-moz-menuhover": ["rgb(115, 132, 153)", "rgb(127, 127, 127)", "rgb(56, 117, 215)", "rgb(255, 193, 31)", "rgb(243, 70, 72)", "rgb(255, 138, 34)", "rgb(102, 197, 71)", "rgb(140, 78, 184)"],
   "-moz-menuhovertext": ["rgb(255, 255, 255)", "rgb(255, 254, 254)", "rgb(254, 255, 254)"],
diff --git a/xpcom/ds/Makefile.in b/xpcom/ds/Makefile.in
deleted file mode 100644
index 992f4970bc1..00000000000
--- a/xpcom/ds/Makefile.in
+++ /dev/null
@@ -1,10 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-MOZILLA_INTERNAL_API = 1
-
-include $(topsrcdir)/config/rules.mk
-
-LOCAL_INCLUDES += -I$(srcdir)/../io
diff --git a/xpcom/ds/moz.build b/xpcom/ds/moz.build
index 4f29be69263..4a4103f4790 100644
--- a/xpcom/ds/moz.build
+++ b/xpcom/ds/moz.build
@@ -119,3 +119,6 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '../io',
+]
diff --git a/xpcom/reflect/xptcall/src/Makefile.in b/xpcom/reflect/xptcall/src/Makefile.in
deleted file mode 100644
index c2a1da78b5f..00000000000
--- a/xpcom/reflect/xptcall/src/Makefile.in
+++ /dev/null
@@ -1,16 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-MOZILLA_INTERNAL_API = 1
-
-# we don't want the shared lib, but we want to force the creation of a static lib.
-FORCE_STATIC_LIB = 1
-
-
-include $(topsrcdir)/config/rules.mk
-
-DEFINES		+= -DIMPL_LIBXUL
-
-LOCAL_INCLUDES += -I$(srcdir)/../../xptinfo/src
diff --git a/xpcom/reflect/xptcall/src/moz.build b/xpcom/reflect/xptcall/src/moz.build
index 4b47db7ed1a..ffd7e4c54d1 100644
--- a/xpcom/reflect/xptcall/src/moz.build
+++ b/xpcom/reflect/xptcall/src/moz.build
@@ -16,3 +16,8 @@ LIBRARY_NAME = 'xptcall'
 
 MSVC_ENABLE_PGO = True
 
+LIBXUL_LIBRARY = True
+
+LOCAL_INCLUDES += [
+    '/xpcom/reflect/xptinfo/src',
+]
diff --git a/xpcom/reflect/xptinfo/public/Makefile.in b/xpcom/reflect/xptinfo/public/Makefile.in
deleted file mode 100644
index c14c389e2be..00000000000
--- a/xpcom/reflect/xptinfo/public/Makefile.in
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-include $(topsrcdir)/config/rules.mk
-
-CFLAGS		+= -DEXPORT_XPCI_API
diff --git a/xpcom/reflect/xptinfo/src/Makefile.in b/xpcom/reflect/xptinfo/src/Makefile.in
deleted file mode 100644
index e8221baf221..00000000000
--- a/xpcom/reflect/xptinfo/src/Makefile.in
+++ /dev/null
@@ -1,17 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-MOZILLA_INTERNAL_API = 1
-
-# we don't want the shared lib, but we want to force the creation of a static lib.
-FORCE_STATIC_LIB = 1
-
-
-include $(topsrcdir)/config/rules.mk
-
-# For nsManifestLineReader class.
-LOCAL_INCLUDES	= -I$(srcdir)/../../../ds
-
-DEFINES += -DIMPL_LIBXUL
diff --git a/xpcom/reflect/xptinfo/src/moz.build b/xpcom/reflect/xptinfo/src/moz.build
index f257aab15a1..b2104cdf857 100644
--- a/xpcom/reflect/xptinfo/src/moz.build
+++ b/xpcom/reflect/xptinfo/src/moz.build
@@ -17,3 +17,9 @@ LIBRARY_NAME = 'xptinfo'
 
 MSVC_ENABLE_PGO = True
 
+LIBXUL_LIBRARY = True
+
+# For nsManifestLineReader class.
+LOCAL_INCLUDES += [
+    '/xpcom/ds',
+]
diff --git a/xpcom/threads/Makefile.in b/xpcom/threads/Makefile.in
deleted file mode 100644
index cfb6a17d9f9..00000000000
--- a/xpcom/threads/Makefile.in
+++ /dev/null
@@ -1,8 +0,0 @@
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-MOZILLA_INTERNAL_API = 1
-LOCAL_INCLUDES	= -I$(srcdir)/../components
-LOCAL_INCLUDES = -I$(srcdir)/../build
diff --git a/xpcom/threads/moz.build b/xpcom/threads/moz.build
index c31d1f03cc9..e621f886f9c 100644
--- a/xpcom/threads/moz.build
+++ b/xpcom/threads/moz.build
@@ -55,3 +55,6 @@ LIBXUL_LIBRARY = True
 
 MSVC_ENABLE_PGO = True
 
+LOCAL_INCLUDES += [
+    '../build',
+]