diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index f6f1761c482..19e104231fc 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1244,6 +1244,9 @@ pref("services.sync.prefs.sync.addons.ignoreUserEnabledChanges", true);
 pref("services.sync.prefs.sync.app.update.mode", true);
 pref("services.sync.prefs.sync.browser.formfill.enable", true);
 pref("services.sync.prefs.sync.browser.link.open_newwindow", true);
+pref("services.sync.prefs.sync.browser.newtabpage.enabled", true);
+pref("services.sync.prefs.sync.browser.newtabpage.enhanced", true);
+pref("services.sync.prefs.sync.browser.newtabpage.pinned", true);
 pref("services.sync.prefs.sync.browser.offline-apps.notify", true);
 pref("services.sync.prefs.sync.browser.safebrowsing.enabled", true);
 pref("services.sync.prefs.sync.browser.safebrowsing.malware.enabled", true);
diff --git a/browser/devtools/debugger/test/browser.ini b/browser/devtools/debugger/test/browser.ini
index c7b0eebc2d0..ce5c3330bd5 100644
--- a/browser/devtools/debugger/test/browser.ini
+++ b/browser/devtools/debugger/test/browser.ini
@@ -392,13 +392,13 @@ skip-if = e10s
 [browser_dbg_searchbox-parse.js]
 skip-if = e10s
 [browser_dbg_source-maps-01.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_source-maps-02.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_source-maps-03.js]
-skip-if = e10s
+skip-if = e10s && debug
 [browser_dbg_source-maps-04.js]
-skip-if = e10s
+skip-if = e10s # Bug 1093535
 [browser_dbg_sources-cache.js]
 skip-if = e10s
 [browser_dbg_sources-labels.js]
diff --git a/browser/devtools/debugger/test/browser_dbg_source-maps-01.js b/browser/devtools/debugger/test/browser_dbg_source-maps-01.js
index 7b8119460b4..07e579eb4f2 100644
--- a/browser/devtools/debugger/test/browser_dbg_source-maps-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_source-maps-01.js
@@ -9,13 +9,12 @@
 const TAB_URL = EXAMPLE_URL + "doc_binary_search.html";
 const COFFEE_URL = EXAMPLE_URL + "code_binary_search.coffee";
 
-let gTab, gDebuggee, gPanel, gDebugger;
+let gTab, gPanel, gDebugger;
 let gEditor, gSources;
 
 function test() {
-  initDebugger(TAB_URL).then(([aTab, aDebuggee, aPanel]) => {
+  initDebugger(TAB_URL).then(([aTab,, aPanel]) => {
     gTab = aTab;
-    gDebuggee = aDebuggee;
     gPanel = aPanel;
     gDebugger = gPanel.panelWin;
     gEditor = gDebugger.DebuggerView.editor;
@@ -119,7 +118,7 @@ function testHitBreakpoint() {
 
     // This will cause the breakpoint to be hit, and put us back in the
     // paused state.
-    gDebuggee.binary_search([0, 2, 3, 5, 7, 10], 5);
+    callInTab(gTab, "binary_search", [0, 2, 3, 5, 7, 10], 5);
   });
 
   return deferred.promise;
@@ -157,7 +156,6 @@ function testStepping() {
 
 registerCleanupFunction(function() {
   gTab = null;
-  gDebuggee = null;
   gPanel = null;
   gDebugger = null;
   gEditor = null;
diff --git a/browser/devtools/debugger/test/browser_dbg_source-maps-02.js b/browser/devtools/debugger/test/browser_dbg_source-maps-02.js
index 7059ecfc2e7..569686884f5 100644
--- a/browser/devtools/debugger/test/browser_dbg_source-maps-02.js
+++ b/browser/devtools/debugger/test/browser_dbg_source-maps-02.js
@@ -8,12 +8,12 @@
 const TAB_URL = EXAMPLE_URL + "doc_binary_search.html";
 const JS_URL = EXAMPLE_URL + "code_binary_search.js";
 
-let gDebuggee, gPanel, gDebugger, gEditor;
+let gTab, gPanel, gDebugger, gEditor;
 let gSources, gFrames, gPrefs, gOptions;
 
 function test() {
-  initDebugger(TAB_URL).then(([aTab, aDebuggee, aPanel]) => {
-    gDebuggee = aDebuggee;
+  initDebugger(TAB_URL).then(([aTab,, aPanel]) => {
+    gTab = aTab;
     gPanel = aPanel;
     gDebugger = gPanel.panelWin;
     gEditor = gDebugger.DebuggerView.editor;
@@ -81,7 +81,7 @@ function testSetBreakpoint() {
 
       // This will cause the breakpoint to be hit, and put us back in the
       // paused state.
-      gDebuggee.binary_search([0, 2, 3, 5, 7, 10], 5);
+      callInTab(gTab, "binary_search", [0, 2, 3, 5, 7, 10], 5);
     });
   });
 
@@ -135,7 +135,7 @@ function testResume() {
 }
 
 registerCleanupFunction(function() {
-  gDebuggee = null;
+  gTab = null;
   gPanel = null;
   gDebugger = null;
   gEditor = null;
diff --git a/browser/devtools/debugger/test/browser_dbg_source-maps-03.js b/browser/devtools/debugger/test/browser_dbg_source-maps-03.js
index 7441b1eba5e..560f0b54520 100644
--- a/browser/devtools/debugger/test/browser_dbg_source-maps-03.js
+++ b/browser/devtools/debugger/test/browser_dbg_source-maps-03.js
@@ -8,12 +8,12 @@
 const TAB_URL = EXAMPLE_URL + "doc_minified.html";
 const JS_URL = EXAMPLE_URL + "code_math.js";
 
-let gDebuggee, gPanel, gDebugger;
+let gTab, gPanel, gDebugger;
 let gEditor, gSources, gFrames;
 
 function test() {
-  initDebugger(TAB_URL).then(([aTab, aDebuggee, aPanel]) => {
-    gDebuggee = aDebuggee;
+  initDebugger(TAB_URL).then(([aTab,, aPanel]) => {
+    gTab = aTab;
     gPanel = aPanel;
     gDebugger = gPanel.panelWin;
     gEditor = gDebugger.DebuggerView.editor;
@@ -64,7 +64,7 @@ function testSetBreakpoint() {
 
       // This will cause the breakpoint to be hit, and put us back in the
       // paused state.
-      gDebuggee.arithmetic();
+      callInTab(gTab, "arithmetic");
     });
   });
 
@@ -72,7 +72,7 @@ function testSetBreakpoint() {
 }
 
 registerCleanupFunction(function() {
-  gDebuggee = null;
+  gTab = null;
   gPanel = null;
   gDebugger = null;
   gEditor = null;
diff --git a/browser/devtools/debugger/test/browser_dbg_source-maps-04.js b/browser/devtools/debugger/test/browser_dbg_source-maps-04.js
index 759449efc17..f759c781a68 100644
--- a/browser/devtools/debugger/test/browser_dbg_source-maps-04.js
+++ b/browser/devtools/debugger/test/browser_dbg_source-maps-04.js
@@ -16,7 +16,7 @@ DevToolsUtils.reportingDisabled = true;
 let gPanel, gDebugger, gFrames, gSources, gPrefs, gOptions;
 
 function test() {
-  initDebugger(TAB_URL).then(([aTab, aDebuggee, aPanel]) => {
+  initDebugger(TAB_URL).then(([aTab,, aPanel]) => {
     gPanel = aPanel;
     gDebugger = gPanel.panelWin;
     gFrames = gDebugger.DebuggerView.StackFrames;
diff --git a/browser/devtools/debugger/test/code_frame-script.js b/browser/devtools/debugger/test/code_frame-script.js
index 3a4f5c8bbba..5cc700e643f 100644
--- a/browser/devtools/debugger/test/code_frame-script.js
+++ b/browser/devtools/debugger/test/code_frame-script.js
@@ -10,9 +10,10 @@ loadSubScript("chrome://marionette/content/EventUtils.js", EventUtils);
 dump("Frame script loaded.\n");
 
 addMessageListener("test:call", function (message) {
-  dump("Calling function with name " + message.data + ".\n");
+  dump("Calling function with name " + message.data.name + ".\n");
 
-  XPCNativeWrapper.unwrap(content)[message.data]();
+  let data = message.data;
+  XPCNativeWrapper.unwrap(content)[data.name].apply(undefined, data.args);
   sendAsyncMessage("test:call");
 });
 
diff --git a/browser/devtools/debugger/test/head.js b/browser/devtools/debugger/test/head.js
index 4384df6d733..81ceea4a131 100644
--- a/browser/devtools/debugger/test/head.js
+++ b/browser/devtools/debugger/test/head.js
@@ -963,7 +963,10 @@ function waitForMessageFromTab(tab, name) {
 function callInTab(tab, name) {
   info("Calling function with name " + name + " in tab.");
 
-  sendMessageToTab(tab, "test:call", name);
+  sendMessageToTab(tab, "test:call", {
+    name: name,
+    args: Array.prototype.slice.call(arguments, 2)
+  });
   waitForMessageFromTab(tab, "test:call");
 }
 
diff --git a/dom/base/WebSocket.cpp b/dom/base/WebSocket.cpp
index 0f148ee348e..92d18faa0e4 100644
--- a/dom/base/WebSocket.cpp
+++ b/dom/base/WebSocket.cpp
@@ -2296,6 +2296,12 @@ WebSocketImpl::CancelInternal()
 {
   AssertIsOnTargetThread();
 
+   // If CancelInternal is called by a runnable, we may already be disconnected
+   // by the time it runs.
+  if (mDisconnected) {
+    return NS_OK;
+  }
+
   int64_t readyState = mWebSocket->ReadyState();
   if (readyState == WebSocket::CLOSING || readyState == WebSocket::CLOSED) {
     return NS_OK;
diff --git a/dom/base/nsCSPContext.cpp b/dom/base/nsCSPContext.cpp
index 1c55efc5eb5..6daab49ccd9 100644
--- a/dom/base/nsCSPContext.cpp
+++ b/dom/base/nsCSPContext.cpp
@@ -185,8 +185,9 @@ nsCSPContext::ShouldLoad(nsContentPolicyType aContentType,
       // decision may be wrong due to the inability to get the nonce, and will
       // incorrectly fail the unit tests.
       if (!isPreload) {
+        nsCOMPtr<nsIURI> originalURI = do_QueryInterface(aExtra);
         this->AsyncReportViolation(aContentLocation,
-                                   mSelfURI,
+                                   originalURI,   /* in case of redirect originalURI is not null */
                                    violatedDirective,
                                    p,             /* policy index        */
                                    EmptyString(), /* no observer subject */
@@ -418,7 +419,7 @@ nsCSPContext::GetAllowsHash(const nsAString& aContent,
       mPolicies[p]->getDirectiveStringForContentType(                          \
                         nsIContentPolicy::TYPE_ ## contentPolicyType,          \
                         violatedDirective);                                    \
-      this->AsyncReportViolation(selfISupports, mSelfURI, violatedDirective, p, \
+      this->AsyncReportViolation(selfISupports, nullptr, violatedDirective, p, \
                                  NS_LITERAL_STRING(observerTopic),             \
                                  aSourceFile, aScriptSample, aLineNum);        \
     }                                                                          \
@@ -540,6 +541,23 @@ nsCSPContext::SetRequestContext(nsIURI* aSelfURI,
   return NS_OK;
 }
 
+/**
+ * Sends CSP violation reports to all sources listed under report-uri.
+ *
+ * @param aBlockedContentSource
+ *        Either a CSP Source (like 'self', as string) or nsIURI: the source
+ *        of the violation.
+ * @param aOriginalUri
+ *        The original URI if the blocked content is a redirect, else null
+ * @param aViolatedDirective
+ *        the directive that was violated (string).
+ * @param aSourceFile
+ *        name of the file containing the inline script violation
+ * @param aScriptSample
+ *        a sample of the violating inline script
+ * @param aLineNum
+ *        source line number of the violation (if available)
+ */
 nsresult
 nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
                           nsIURI* aOriginalURI,
@@ -569,7 +587,15 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
     nsCOMPtr<nsIURI> uri = do_QueryInterface(aBlockedContentSource);
     // could be a string or URI
     if (uri) {
-      uri->GetSpecIgnoringRef(reportBlockedURI);
+      // aOriginalURI will only be *not* null in case of a redirect in which
+      // case aOriginalURI is the uri before the redirect.
+      if (aOriginalURI) {
+        // do not report anything else than the origin in case of a redirect, see:
+        // http://www.w3.org/TR/CSP/#violation-reports
+        uri->GetPrePath(reportBlockedURI);
+      } else {
+        uri->GetSpecIgnoringRef(reportBlockedURI);
+      }
     } else {
       nsCOMPtr<nsISupportsCString> cstr = do_QueryInterface(aBlockedContentSource);
       if (cstr) {
@@ -585,11 +611,9 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
   }
 
   // document-uri
-  if (aOriginalURI) {
-    nsAutoCString reportDocumentURI;
-    aOriginalURI->GetSpecIgnoringRef(reportDocumentURI);
-    report.mCsp_report.mDocument_uri = NS_ConvertUTF8toUTF16(reportDocumentURI);
-  }
+  nsAutoCString reportDocumentURI;
+  mSelfURI->GetSpecIgnoringRef(reportDocumentURI);
+  report.mCsp_report.mDocument_uri = NS_ConvertUTF8toUTF16(reportDocumentURI);
 
   // original-policy
   nsAutoString originalPolicy;
@@ -731,7 +755,7 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
 
     rv = cp->ShouldLoad(nsIContentPolicy::TYPE_CSP_REPORT,
                         reportURI,
-                        aOriginalURI,
+                        mSelfURI,
                         nullptr,        // Context
                         EmptyCString(), // mime type
                         nullptr,        // Extra parameter
@@ -1047,7 +1071,7 @@ nsCSPContext::PermitsAncestry(nsIDocShell* aDocShell, bool* outPermitsAncestry)
         bool okToSendAncestor = NS_SecurityCompareURIs(ancestorsArray[a], mSelfURI, true);
 
         this->AsyncReportViolation((okToSendAncestor ? ancestorsArray[a] : nullptr),
-                                   mSelfURI,
+                                   nullptr,       /* originalURI in case of redirect */
                                    violatedDirective,
                                    i,             /* policy index        */
                                    EmptyString(), /* no observer subject */
@@ -1080,7 +1104,7 @@ nsCSPContext::PermitsBaseURI(nsIURI* aURI, bool* outPermitsBaseURI)
       nsAutoString violatedDirective;
       mPolicies[i]->getDirectiveStringForBaseURI(violatedDirective);
       this->AsyncReportViolation(aURI,
-                                 mSelfURI,
+                                 nullptr,       /* originalURI in case of redirect */
                                  violatedDirective,
                                  i,             /* policy index        */
                                  EmptyString(), /* no observer subject */
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 0f854169f99..5f5c3d76e94 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -275,8 +275,13 @@ NS_IMETHODIMP
 nsDOMWindowUtils::UpdateLayerTree()
 {
   if (nsIPresShell* presShell = GetPresShell()) {
+    presShell->FlushPendingNotifications(Flush_Display);
     nsRefPtr<nsViewManager> vm = presShell->GetViewManager();
-    vm->ProcessPendingUpdates();
+    nsView* view = vm->GetRootView();
+    if (view) {
+      presShell->Paint(view, view->GetBounds(),
+          nsIPresShell::PAINT_LAYERS | nsIPresShell::PAINT_SYNC_DECODE_IMAGES);
+    }
   }
   return NS_OK;
 }
diff --git a/dom/media/webspeech/recognition/SpeechRecognition.cpp b/dom/media/webspeech/recognition/SpeechRecognition.cpp
index 582c89d0c4b..dcde7e07879 100644
--- a/dom/media/webspeech/recognition/SpeechRecognition.cpp
+++ b/dom/media/webspeech/recognition/SpeechRecognition.cpp
@@ -940,11 +940,11 @@ NS_IMPL_ISUPPORTS(SpeechRecognition::GetUserMediaSuccessCallback, nsIDOMGetUserM
 NS_IMETHODIMP
 SpeechRecognition::GetUserMediaSuccessCallback::OnSuccess(nsISupports* aStream)
 {
-  DOMLocalMediaStream *localStream = nullptr;
-  nsresult rv = CallQueryInterface(aStream, &localStream);
-  if (NS_SUCCEEDED(rv)) {
-    mRecognition->StartRecording(localStream);
+  nsRefPtr<DOMMediaStream> stream = do_QueryObject(aStream);
+  if (!stream) {
+    return NS_ERROR_NO_INTERFACE;
   }
+  mRecognition->StartRecording(stream);
   return NS_OK;
 }
 
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index f90f638df4e..c65b516f66d 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -43,6 +43,44 @@ using namespace mozilla::gfx;
 
 #include "DeprecatedPremultiplyTables.h"
 
+extern "C" {
+
+/**
+ * Dump a raw image to the default log.  This function is exported
+ * from libxul, so it can be called from any library in addition to
+ * (of course) from a debugger.
+ *
+ * Note: this helper currently assumes that all 2-bytepp images are
+ * r5g6b5, and that all 4-bytepp images are r8g8b8a8.
+ */
+NS_EXPORT
+void mozilla_dump_image(void* bytes, int width, int height, int bytepp,
+                        int strideBytes)
+{
+    if (0 == strideBytes) {
+        strideBytes = width * bytepp;
+    }
+    SurfaceFormat format;
+    // TODO more flexible; parse string?
+    switch (bytepp) {
+    case 2:
+        format = SurfaceFormat::R5G6B5;
+        break;
+    case 4:
+    default:
+        format = SurfaceFormat::R8G8B8A8;
+        break;
+    }
+
+    RefPtr<DataSourceSurface> surf =
+        Factory::CreateWrappingDataSourceSurface((uint8_t*)bytes, strideBytes,
+                                                 gfx::IntSize(width, height),
+                                                 format);
+    gfxUtils::DumpAsDataURI(surf);
+}
+
+}
+
 static const uint8_t PremultiplyValue(uint8_t a, uint8_t v) {
     return gfxUtils::sPremultiplyTable[a*256+v];
 }
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 6e80cdb062a..621943ab4a4 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -1223,7 +1223,9 @@ static const JSStdName builtin_property_names[] = {
     { EAGER_ATOM(SIMD), JSProto_SIMD },
     { EAGER_ATOM(TypedObject), JSProto_TypedObject },
 #endif
+#ifdef ENABLE_SHARED_ARRAY_BUFFER
     { EAGER_ATOM(Atomics), JSProto_Atomics },
+#endif
 
     { 0, JSProto_LIMIT }
 };
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index eb48f3b9afa..230d504aeb5 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -1424,6 +1424,8 @@ public:
     PAINT_LAYERS = 0x01,
     /* Composite layers to the window. */
     PAINT_COMPOSITE = 0x02,
+    /* Sync-decode images. */
+    PAINT_SYNC_DECODE_IMAGES = 0x04
   };
   virtual void Paint(nsView* aViewToPaint, const nsRegion& aDirtyRegion,
                      uint32_t aFlags) = 0;
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 6649c08c3f2..8e8cc087064 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -6270,7 +6270,8 @@ PresShell::Paint(nsView*        aViewToPaint,
       NS_WARNING("Must complete empty transaction when compositing!");
     }
 
-    if (!(frame->GetStateBits() & NS_FRAME_UPDATE_LAYER_TREE) &&
+    if (!(aFlags & PAINT_SYNC_DECODE_IMAGES) &&
+        !(frame->GetStateBits() & NS_FRAME_UPDATE_LAYER_TREE) &&
         !mNextPaintCompressed) {
       NotifySubDocInvalidationFunc computeInvalidFunc =
         presContext->MayHavePaintEventListenerInSubDocument() ? nsPresContext::NotifySubDocInvalidation : 0;
@@ -6323,6 +6324,9 @@ PresShell::Paint(nsView*        aViewToPaint,
   if (!(aFlags & PAINT_COMPOSITE)) {
     flags |= nsLayoutUtils::PAINT_NO_COMPOSITE;
   }
+  if (aFlags & PAINT_SYNC_DECODE_IMAGES) {
+    flags |= nsLayoutUtils::PAINT_SYNC_DECODE_IMAGES;
+  }
   if (mNextPaintCompressed) {
     flags |= nsLayoutUtils::PAINT_COMPRESSED;
     mNextPaintCompressed = false;
diff --git a/layout/base/tests/bug1093686_inner.html b/layout/base/tests/bug1093686_inner.html
new file mode 100644
index 00000000000..527673108e7
--- /dev/null
+++ b/layout/base/tests/bug1093686_inner.html
@@ -0,0 +1,84 @@
+<!DOCTYPE HTML>
+<html id="html" style="height:100%">
+<head>
+  <title>Testing effect of listener on body</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <style>
+  .target { position:absolute; left:200px; top:200px; width:200px; height:200px; background:blue; }
+  </style>
+</head>
+<body id="body" onload="setTimeout(runTest, 0)" style="margin:0; width:100%; height:100%; overflow:hidden">
+<div id="content">
+  <div id="ruler" style="position:absolute; left:0; top:0; width:1mozmm; height:0;"></div>
+  <div class="target" id="t"></div>
+</div>
+<pre id="test">
+<script type="application/javascript">
+var eventTarget;
+window.onmousedown = function(event) { eventTarget = event.target; };
+
+// Make sure the target div is "clickable" by adding a click listener on it.
+document.getElementById('t').addEventListener('click', function(e) {
+  parent.ok(true, "target was clicked on");
+}, false);
+
+// Helper functions
+
+function testMouseClick(aX, aY, aExpectedId, aMsg) {
+  eventTarget = null;
+  synthesizeMouseAtPoint(aX, aY, {});
+  try {
+    parent.is(eventTarget.id, aExpectedId,
+       "checking offset " + aX + "," + aY + " hit " + aExpectedId + " [" + aMsg + "]");
+  } catch (ex) {
+    parent.ok(false, "checking offset " + aX + "," + aY + " hit " + aExpectedId + " [" + aMsg + "]; got " + eventTarget);
+  }
+}
+
+function testWithAndWithoutBodyListener(aX, aY, aExpectedId, aMsg) {
+  var func = function(e) {
+    // no-op function
+    parent.ok(true, "body was clicked on");
+  };
+  testMouseClick(aX, aY, aExpectedId, aMsg + " without listener on body");
+  document.body.addEventListener("click", func, false);
+  testMouseClick(aX, aY, aExpectedId, aMsg + " with listener on body");
+  document.body.removeEventListener("click", func, false);
+}
+
+// Main tests
+
+var mm;
+function runTest() {
+  mm = document.getElementById("ruler").getBoundingClientRect().width;
+  parent.ok(4*mm >= 10, "WARNING: mm " + mm + " too small in this configuration. Test results will be bogus");
+
+  // Test near the target, check it hits the target
+  testWithAndWithoutBodyListener(200 - 2*mm, 200 - 2*mm, "t", "basic click retargeting");
+  // Test on the target, check it hits the target
+  testWithAndWithoutBodyListener(200 + 2*mm, 200 + 2*mm, "t", "direct click");
+  // Test outside the target, check it hits the root
+  testWithAndWithoutBodyListener(40, 40, "body", "click way outside target");
+
+  SpecialPowers.pushPrefEnv({"set": [["ui.mouse.radius.enabled", false]]}, runTest2);
+}
+
+function runTest2() {
+  // In this test, mouse event retargeting is disabled.
+
+  // Test near the target, check it hits the body
+  testWithAndWithoutBodyListener(200 - 2*mm, 200 - 2*mm, "body", "basic click retargeting");
+  // Test on the target, check it hits the target
+  testWithAndWithoutBodyListener(200 + 2*mm, 200 + 2*mm, "t", "direct click");
+  // Test outside the target, check it hits the root
+  testWithAndWithoutBodyListener(40, 40, "body", "click way outside target");
+
+  parent.finishTest();
+}
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/base/tests/mochitest.ini b/layout/base/tests/mochitest.ini
index d8119b7f69c..1d3421c663d 100644
--- a/layout/base/tests/mochitest.ini
+++ b/layout/base/tests/mochitest.ini
@@ -506,3 +506,5 @@ support-files = bug1078327_inner.html
 [test_bug1080361.html]
 support-files = bug1080361_inner.html
 [test_touchcaret_visibility.html]
+[test_bug1093686.html]
+support-files = bug1093686_inner.html
diff --git a/layout/base/tests/test_bug1093686.html b/layout/base/tests/test_bug1093686.html
new file mode 100644
index 00000000000..7b63f0ba554
--- /dev/null
+++ b/layout/base/tests/test_bug1093686.html
@@ -0,0 +1,41 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1093686
+-->
+  <head>
+    <meta charset="utf-8">
+    <title>Testing effect of listener on body with respect to event retargeting</title>
+    <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+    <script type="text/javascript">
+      var iframe = undefined;
+      function prepareTest() {
+        SimpleTest.waitForExplicitFinish();
+        iframe = document.getElementById("testFrame");
+        turnOnEventRetargeting(startTest);
+      }
+      function turnOnEventRetargeting(callback) {
+        SpecialPowers.pushPrefEnv({
+          "set": [
+            ["ui.mouse.radius.enabled", true],
+            ["ui.mouse.radius.inputSource.touchOnly", false],
+            ["ui.mouse.radius.leftmm", 8],
+            ["ui.mouse.radius.topmm", 12],
+            ["ui.mouse.radius.rightmm", 8],
+            ["ui.mouse.radius.bottommm", 4]
+          ]
+        }, callback);
+      }
+      function startTest() {
+        iframe.src = "bug1093686_inner.html";
+      }
+      function finishTest() {
+        SimpleTest.finish();
+      }
+    </script>
+  </head>
+  <body onload="prepareTest()">
+    <iframe id="testFrame" height="700" width="700"></iframe>
+  </body>
+</html>
diff --git a/memory/build/jemalloc_config.c b/memory/build/jemalloc_config.c
index e3db4d044cd..ac55a8eada0 100644
--- a/memory/build/jemalloc_config.c
+++ b/memory/build/jemalloc_config.c
@@ -10,7 +10,7 @@
 #include "mozilla/Types.h"
 
 /* Override some jemalloc defaults */
-MFBT_DATA const char * je_(malloc_conf) = "narenas:1,lg_chunk:20";
+MFBT_DATA const char * je_(malloc_conf) = "narenas:1,lg_chunk:20,tcache:false";
 
 #ifdef ANDROID
 #include <android/log.h>
diff --git a/netwerk/protocol/websocket/WebSocketChannelChild.cpp b/netwerk/protocol/websocket/WebSocketChannelChild.cpp
index 1ac8f3a60e5..cbac2d72600 100644
--- a/netwerk/protocol/websocket/WebSocketChannelChild.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannelChild.cpp
@@ -120,6 +120,31 @@ WebSocketChannelChild::DispatchToTargetThread(ChannelEvent *aChannelEvent)
                           NS_DISPATCH_NORMAL);
 }
 
+class EventTargetDispatcher : public ChannelEvent
+{
+public:
+  EventTargetDispatcher(ChannelEvent* aChannelEvent,
+                        nsIEventTarget* aEventTarget)
+    : mChannelEvent(aChannelEvent)
+    , mEventTarget(aEventTarget)
+  {}
+
+  void Run()
+  {
+    if (mEventTarget) {
+      mEventTarget->Dispatch(new WrappedChannelEvent(mChannelEvent.forget()),
+                             NS_DISPATCH_NORMAL);
+      return;
+    }
+
+    mChannelEvent->Run();
+  }
+
+private:
+  nsAutoPtr<ChannelEvent> mChannelEvent;
+  nsCOMPtr<nsIEventTarget> mEventTarget;
+};
+
 class StartEvent : public ChannelEvent
 {
  public:
@@ -154,8 +179,10 @@ WebSocketChannelChild::RecvOnStart(const nsCString& aProtocol,
                                    const bool& aEncrypted)
 {
   if (mEventQ->ShouldEnqueue()) {
-    mEventQ->Enqueue(new StartEvent(this, aProtocol, aExtensions,
-                                    aEffectiveURL, aEncrypted));
+    mEventQ->Enqueue(new EventTargetDispatcher(
+                       new StartEvent(this, aProtocol, aExtensions,
+                                      aEffectiveURL, aEncrypted),
+                       mTargetThread));
   } else if (mTargetThread) {
     DispatchToTargetThread(new StartEvent(this, aProtocol, aExtensions,
                                           aEffectiveURL, aEncrypted));
@@ -205,7 +232,8 @@ bool
 WebSocketChannelChild::RecvOnStop(const nsresult& aStatusCode)
 {
   if (mEventQ->ShouldEnqueue()) {
-    mEventQ->Enqueue(new StopEvent(this, aStatusCode));
+    mEventQ->Enqueue(new EventTargetDispatcher(
+                       new StopEvent(this, aStatusCode), mTargetThread));
   } else if (mTargetThread) {
     DispatchToTargetThread(new StopEvent(this, aStatusCode));
   } else {
@@ -253,7 +281,8 @@ bool
 WebSocketChannelChild::RecvOnMessageAvailable(const nsCString& aMsg)
 {
   if (mEventQ->ShouldEnqueue()) {
-    mEventQ->Enqueue(new MessageEvent(this, aMsg, false));
+    mEventQ->Enqueue(new EventTargetDispatcher(
+                       new MessageEvent(this, aMsg, false), mTargetThread));
   } else if (mTargetThread) {
     DispatchToTargetThread(new MessageEvent(this, aMsg, false));
    } else {
@@ -276,7 +305,8 @@ bool
 WebSocketChannelChild::RecvOnBinaryMessageAvailable(const nsCString& aMsg)
 {
   if (mEventQ->ShouldEnqueue()) {
-    mEventQ->Enqueue(new MessageEvent(this, aMsg, true));
+    mEventQ->Enqueue(new EventTargetDispatcher(
+                       new MessageEvent(this, aMsg, true), mTargetThread));
   } else if (mTargetThread) {
     DispatchToTargetThread(new MessageEvent(this, aMsg, true));
   } else {
@@ -317,7 +347,8 @@ bool
 WebSocketChannelChild::RecvOnAcknowledge(const uint32_t& aSize)
 {
   if (mEventQ->ShouldEnqueue()) {
-    mEventQ->Enqueue(new AcknowledgeEvent(this, aSize));
+    mEventQ->Enqueue(new EventTargetDispatcher(
+                       new AcknowledgeEvent(this, aSize), mTargetThread));
   } else if (mTargetThread) {
     DispatchToTargetThread(new AcknowledgeEvent(this, aSize));
   } else {
@@ -362,7 +393,9 @@ WebSocketChannelChild::RecvOnServerClose(const uint16_t& aCode,
                                          const nsCString& aReason)
 {
   if (mEventQ->ShouldEnqueue()) {
-    mEventQ->Enqueue(new ServerCloseEvent(this, aCode, aReason));
+    mEventQ->Enqueue(new EventTargetDispatcher(
+                       new ServerCloseEvent(this, aCode, aReason),
+                       mTargetThread));
   } else if (mTargetThread) {
     DispatchToTargetThread(new ServerCloseEvent(this, aCode, aReason));
   } else {
diff --git a/testing/marionette/client/marionette/runner/base.py b/testing/marionette/client/marionette/runner/base.py
index 7df55565e61..901a64716e9 100644
--- a/testing/marionette/client/marionette/runner/base.py
+++ b/testing/marionette/client/marionette/runner/base.py
@@ -23,6 +23,7 @@ from mozhttpd import MozHttpd
 from mozlog.structured.structuredlog import get_default_logger
 from moztest.adapters.unit import StructuredTestRunner, StructuredTestResult
 from moztest.results import TestResultCollection, TestResult, relevant_line
+import mozversion
 
 class MarionetteTest(TestResult):
 
@@ -712,7 +713,18 @@ setReq.onerror = function() {
         for test in tests:
             self.add_test(test)
 
-        self.logger.suite_start(self.tests)
+        version_info = mozversion.get_version(binary=self.bin,
+                                              sources=self.sources,
+                                              dm_type=os.environ.get('DM_TRANS', 'adb'))
+
+        device_info = None
+        if self.capabilities['device'] != 'desktop' and self.capabilities['browserName'] == 'B2G':
+            dm = get_dm(self.marionette)
+            device_info = dm.getInfo()
+
+        self.logger.suite_start(self.tests,
+                                version_info=version_info,
+                                device_info=device_info)
 
         for test in self.manifest_skipped_tests:
             name = os.path.basename(test['path'])
diff --git a/testing/marionette/client/requirements.txt b/testing/marionette/client/requirements.txt
index 721059c1a91..3d0da6d9d8b 100644
--- a/testing/marionette/client/requirements.txt
+++ b/testing/marionette/client/requirements.txt
@@ -5,7 +5,7 @@ mozinfo >= 0.7
 mozprocess >= 0.9
 mozrunner >= 6.2
 mozdevice >= 0.37
-mozlog >= 2.6
+mozlog >= 2.7
 moznetwork >= 0.21
 mozcrash >= 0.5
 mozprofile >= 0.7
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index 010726a4410..a8a7fa7014a 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -929,10 +929,6 @@ nsWindow::OnGlobalAndroidEvent(AndroidGeckoEvent *ae)
             }
             break;
 
-        case AndroidGeckoEvent::COMPOSITOR_CREATE:
-            win->CreateLayerManager(ae->Width(), ae->Height());
-            break;
-
         case AndroidGeckoEvent::COMPOSITOR_PAUSE:
             // The compositor gets paused when the app is about to go into the
             // background. While the compositor is paused, we need to ensure that
@@ -944,6 +940,10 @@ nsWindow::OnGlobalAndroidEvent(AndroidGeckoEvent *ae)
             sCompositorPaused = true;
             break;
 
+        case AndroidGeckoEvent::COMPOSITOR_CREATE:
+            win->CreateLayerManager(ae->Width(), ae->Height());
+            // Fallthrough
+
         case AndroidGeckoEvent::COMPOSITOR_RESUME:
             // When we receive this, the compositor has already been told to
             // resume. (It turns out that waiting till we reach here to tell
diff --git a/xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp b/xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp
index 946b7e37ba6..c1c536b09b2 100644
--- a/xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp
+++ b/xpcom/reflect/xptcall/md/unix/xptcinvoke_arm.cpp
@@ -224,6 +224,7 @@ static inline void copy_dword(uint32_t* &ireg_args,
     *(uint64_t *)ireg_args = data;
     ireg_args += 2;
   } else {
+    ireg_args = end;
     if ((uint32_t)stack_args & 4) {
       stack_args++;
     }