diff --git a/Makefile.in b/Makefile.in
index 2a87a8abdfc..94b9a08f862 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -92,7 +92,10 @@ include backend.RecursiveMakeBackend.pp
 
 default:: backend.RecursiveMakeBackend
 
-install_manifests := bin idl include public private sdk
+install_manifests := \
+  $(addprefix dist/,bin idl include public private sdk) \
+  _tests \
+  $(NULL)
 install_manifest_depends = \
   CLOBBER \
   $(configure_dir)/configure \
@@ -110,7 +113,7 @@ endif
 endif
 
 .PHONY: install-manifests
-install-manifests: $(addprefix install-dist-,$(install_manifests))
+install-manifests: $(addprefix install-,$(install_manifests))
 
 # process_install_manifest needs to be invoked with --no-remove when building
 # js as standalone because automated builds are building nspr separately and
@@ -121,15 +124,17 @@ ifdef JS_STANDALONE
 NO_REMOVE=1
 endif
 
-.PHONY: $(addprefix install-dist-,$(install_manifests))
-$(addprefix install-dist-,$(install_manifests)): install-dist-%: $(install_manifest_depends)
+.PHONY: $(addprefix install-,$(install_manifests))
+$(addprefix install-,$(filter dist/%,$(install_manifests))): install-dist/%: $(install_manifest_depends)
 	$(call py_action,process_install_manifest,$(if $(NO_REMOVE),--no-remove )$(DIST)/$* _build_manifests/install/dist_$*)
 
-.PHONY: install-tests
-install-manifests: install-tests
-install-tests: $(install_manifest_depends)
+install-_tests: $(install_manifest_depends)
 	$(call py_action,process_install_manifest,$(if $(NO_REMOVE),--no-remove )_tests _build_manifests/install/tests)
 
+# For compatibility
+.PHONY: install-tests
+install-tests: install-_tests
+
 include $(topsrcdir)/build/moz-automation.mk
 
 # _tests should be purged during cleaning. However, we don't want it purged
@@ -141,23 +146,25 @@ endif
 # Windows PGO builds don't perform a clean before the 2nd pass. So, we want
 # to preserve content for the 2nd pass on Windows. Everywhere else, we always
 # process the install manifests as part of export.
+# For the binaries rule, not all the install manifests matter, so force only
+# the interesting ones to be done.
 ifdef MOZ_PROFILE_USE
 ifndef NO_PROFILE_GUIDED_OPTIMIZE
 ifneq ($(OS_ARCH)_$(GNU_CC), WINNT_)
 export:: install-manifests
 binaries::
-	@$(MAKE) install-manifests NO_REMOVE=1
+	@$(MAKE) install-manifests NO_REMOVE=1 install_manifests=dist/include
 endif
 endif
 else # !MOZ_PROFILE_USE (normal build)
 export:: install-manifests
 binaries::
-	@$(MAKE) install-manifests NO_REMOVE=1
+	@$(MAKE) install-manifests NO_REMOVE=1 install_manifests=dist/include
 endif
 
 # For historical reasons that are unknown, $(DIST)/sdk is always blown away
 # with no regard for PGO passes. This decision could probably be revisited.
-export:: install-dist-sdk
+export:: install-dist/sdk
 
 ifndef JS_STANDALONE
 ifdef ENABLE_TESTS
diff --git a/accessible/base/SelectionManager.cpp b/accessible/base/SelectionManager.cpp
index d846e356bc8..1469390b166 100644
--- a/accessible/base/SelectionManager.cpp
+++ b/accessible/base/SelectionManager.cpp
@@ -154,6 +154,12 @@ SelectionManager::ProcessTextSelChangeEvent(AccEvent* aEvent)
     return;
 
   Selection* selection = caretCntr->DOMSelection();
+
+  // XXX Sometimes we can't get a selection for caretCntr, in that case assume
+  // event->mSel is correct.
+  if (!selection)
+    selection = event->mSel;
+
   mCaretOffset = caretCntr->DOMPointToOffset(selection->GetFocusNode(),
                                              selection->FocusOffset());
   mAccWithCaret = caretCntr;
@@ -179,8 +185,7 @@ SelectionManager::NotifySelectionChanged(nsIDOMDocument* aDOMDocument,
     logging::SelChange(aSelection, document, aReason);
 #endif
 
-  // Don't fire events until document is loaded.
-  if (document && document->IsContentLoaded()) {
+  if (document) {
     // Selection manager has longer lifetime than any document accessible,
     // so that we are guaranteed that the notification is processed before
     // the selection manager is destroyed.
diff --git a/accessible/base/TreeWalker.cpp b/accessible/base/TreeWalker.cpp
index 8e97e38c7a6..4ac1ee27b5f 100644
--- a/accessible/base/TreeWalker.cpp
+++ b/accessible/base/TreeWalker.cpp
@@ -12,36 +12,17 @@
 #include "mozilla/dom/ChildIterator.h"
 #include "mozilla/dom/Element.h"
 
+using namespace mozilla;
 using namespace mozilla::a11y;
 
-////////////////////////////////////////////////////////////////////////////////
-// WalkState
-////////////////////////////////////////////////////////////////////////////////
-
-namespace mozilla {
-namespace a11y {
-
-struct WalkState
-{
-  WalkState(nsIContent *aContent, uint32_t aFilter) :
-    content(aContent), prevState(nullptr), iter(aContent, aFilter) {}
-
-  nsCOMPtr<nsIContent> content;
-  WalkState *prevState;
-  dom::AllChildrenIterator iter;
-};
-
-} // namespace a11y
-} // namespace mozilla
-
 ////////////////////////////////////////////////////////////////////////////////
 // TreeWalker
 ////////////////////////////////////////////////////////////////////////////////
 
 TreeWalker::
   TreeWalker(Accessible* aContext, nsIContent* aContent, uint32_t aFlags) :
-  mDoc(aContext->Document()), mContext(aContext),
-  mFlags(aFlags), mState(nullptr)
+  mDoc(aContext->Document()), mContext(aContext), mAnchorNode(aContent),
+  mFlags(aFlags)
 {
   NS_ASSERTION(aContent, "No node for the accessible tree walker!");
 
@@ -50,17 +31,13 @@ TreeWalker::
   mChildFilter |= nsIContent::eSkipPlaceholderContent;
 
   if (aContent)
-    mState = new WalkState(aContent, mChildFilter);
+    PushState(aContent);
 
   MOZ_COUNT_CTOR(TreeWalker);
 }
 
 TreeWalker::~TreeWalker()
 {
-  // Clear state stack from memory
-  while (mState)
-    PopState();
-
   MOZ_COUNT_DTOR(TreeWalker);
 }
 
@@ -68,74 +45,66 @@ TreeWalker::~TreeWalker()
 // TreeWalker: private
 
 Accessible*
-TreeWalker::NextChildInternal(bool aNoWalkUp)
+TreeWalker::NextChild()
 {
-  if (!mState || !mState->content)
+  if (mStateStack.IsEmpty())
     return nullptr;
 
-  while (nsIContent* childNode = mState->iter.GetNextChild()) {
-    bool isSubtreeHidden = false;
-    Accessible* accessible = mFlags & eWalkCache ?
-      mDoc->GetAccessible(childNode) :
-      GetAccService()->GetOrCreateAccessible(childNode, mContext,
-                                             &isSubtreeHidden);
+  dom::AllChildrenIterator* top = &mStateStack[mStateStack.Length() - 1];
+  while (top) {
+    while (nsIContent* childNode = top->GetNextChild()) {
+      bool isSubtreeHidden = false;
+      Accessible* accessible = mFlags & eWalkCache ?
+        mDoc->GetAccessible(childNode) :
+        GetAccService()->GetOrCreateAccessible(childNode, mContext,
+                                               &isSubtreeHidden);
 
-    if (accessible)
-      return accessible;
-
-    // Walk down into subtree to find accessibles.
-    if (!isSubtreeHidden && childNode->IsElement()) {
-      PushState(childNode);
-      accessible = NextChildInternal(true);
       if (accessible)
         return accessible;
+
+      // Walk down into subtree to find accessibles.
+      if (!isSubtreeHidden && childNode->IsElement())
+        top = PushState(childNode);
     }
+
+    top = PopState();
   }
 
-  // No more children, get back to the parent.
-  nsIContent* anchorNode = mState->content;
-  PopState();
-  if (aNoWalkUp)
-    return nullptr;
-
-  if (mState)
-    return NextChildInternal(false);
-
   // If we traversed the whole subtree of the anchor node. Move to next node
   // relative anchor node within the context subtree if possible.
   if (mFlags != eWalkContextTree)
     return nullptr;
 
-  while (anchorNode != mContext->GetNode()) {
-    nsINode* parentNode = anchorNode->GetFlattenedTreeParent();
+  nsINode* contextNode = mContext->GetNode();
+  while (mAnchorNode != contextNode) {
+    nsINode* parentNode = mAnchorNode->GetFlattenedTreeParent();
     if (!parentNode || !parentNode->IsElement())
       return nullptr;
 
-    PushState(parentNode->AsElement());
-    while (nsIContent* childNode = mState->iter.GetNextChild()) {
-      if (childNode == anchorNode)
-        return NextChildInternal(false);
+    nsIContent* parent = parentNode->AsElement();
+    top = mStateStack.AppendElement(dom::AllChildrenIterator(parent,
+                                                             mChildFilter));
+    while (nsIContent* childNode = top->GetNextChild()) {
+      if (childNode == mAnchorNode) {
+        mAnchorNode = parent;
+        return NextChild();
+      }
     }
-    PopState();
 
-    anchorNode = parentNode->AsElement();
+    // XXX We really should never get here, it means we're trying to find an
+    // accessible for a dom node where iterating over its parent's children
+    // doesn't return it. However this sometimes happens when we're asked for
+    // the nearest accessible to place holder content which we ignore.
+    mAnchorNode = parent;
   }
 
   return nullptr;
 }
 
-void
+dom::AllChildrenIterator*
 TreeWalker::PopState()
 {
-  WalkState* prevToLastState = mState->prevState;
-  delete mState;
-  mState = prevToLastState;
-}
-
-void
-TreeWalker::PushState(nsIContent* aContent)
-{
-  WalkState* nextToLastState = new WalkState(aContent, mChildFilter);
-  nextToLastState->prevState = mState;
-  mState = nextToLastState;
+  size_t length = mStateStack.Length();
+  mStateStack.RemoveElementAt(length - 1);
+  return mStateStack.IsEmpty() ? nullptr : &mStateStack[mStateStack.Length() - 1];
 }
diff --git a/accessible/base/TreeWalker.h b/accessible/base/TreeWalker.h
index aa993b1679b..d34e5e9bb2e 100644
--- a/accessible/base/TreeWalker.h
+++ b/accessible/base/TreeWalker.h
@@ -8,6 +8,8 @@
 
 #include "mozilla/Attributes.h"
 #include <stdint.h>
+#include "mozilla/dom/ChildIterator.h"
+#include "nsCOMPtr.h"
 
 class nsIContent;
 
@@ -17,8 +19,6 @@ namespace a11y {
 class Accessible;
 class DocAccessible;
 
-struct WalkState;
-
 /**
  * This class is used to walk the DOM tree to create accessible tree.
  */
@@ -50,43 +50,36 @@ public:
    *       rejected during tree creation then the caller should be unbind it
    *       from the document.
    */
-  Accessible* NextChild()
-  {
-    return NextChildInternal(false);
-  }
+  Accessible* NextChild();
 
 private:
   TreeWalker();
   TreeWalker(const TreeWalker&);
   TreeWalker& operator =(const TreeWalker&);
 
-  /**
-   * Return the next child accessible.
-   *
-   * @param  aNoWalkUp  [in] specifies the walk direction, true means we
-   *                     shouldn't go up through the tree if we failed find
-   *                     accessible children.
-   */
-  Accessible* NextChildInternal(bool aNoWalkUp);
-
   /**
    * Create new state for the given node and push it on top of stack.
    *
    * @note State stack is used to navigate up/down the DOM subtree during
    *        accessible children search.
    */
-  void PushState(nsIContent* aNode);
+  dom::AllChildrenIterator* PushState(nsIContent* aContent)
+  {
+    return mStateStack.AppendElement(dom::AllChildrenIterator(aContent,
+                                                              mChildFilter));
+  }
 
   /**
    * Pop state from stack.
    */
-  void PopState();
+  dom::AllChildrenIterator* PopState();
 
   DocAccessible* mDoc;
   Accessible* mContext;
+  nsIContent* mAnchorNode;
+  nsAutoTArray<dom::AllChildrenIterator, 20> mStateStack;
   int32_t mChildFilter;
   uint32_t mFlags;
-  WalkState* mState;
 };
 
 } // namespace a11y
diff --git a/accessible/jsat/OutputGenerator.jsm b/accessible/jsat/OutputGenerator.jsm
index bc0db475c78..7f9689f872a 100644
--- a/accessible/jsat/OutputGenerator.jsm
+++ b/accessible/jsat/OutputGenerator.jsm
@@ -596,6 +596,10 @@ this.UtteranceGenerator = {  // jshint ignore:line
       aOutput.push({string: 'stateUnavailable'});
     }
 
+    if (aState.contains(States.READONLY)) {
+      aOutput.push({string: 'stateReadonly'});
+    }
+
     // Don't utter this in Jelly Bean, we let TalkBack do it for us there.
     // This is because we expose the checked information on the node itself.
     // XXX: this means the checked state is always appended to the end,
diff --git a/accessible/tests/mochitest/events.js b/accessible/tests/mochitest/events.js
index 7782ceffb30..06935d48a4d 100644
--- a/accessible/tests/mochitest/events.js
+++ b/accessible/tests/mochitest/events.js
@@ -1743,10 +1743,11 @@ function textChangeChecker(aID, aStart, aEnd, aTextOrFunc, aIsInserted, aFromUse
 /**
  * Caret move events checker.
  */
-function caretMoveChecker(aCaretOffset, aTargetOrFunc, aTargetFuncArg)
+function caretMoveChecker(aCaretOffset, aTargetOrFunc, aTargetFuncArg,
+                          aIsAsync)
 {
   this.__proto__ = new invokerChecker(EVENT_TEXT_CARET_MOVED,
-                                      aTargetOrFunc, aTargetFuncArg);
+                                      aTargetOrFunc, aTargetFuncArg, aIsAsync);
 
   this.check = function caretMoveChecker_check(aEvent)
   {
@@ -1756,6 +1757,12 @@ function caretMoveChecker(aCaretOffset, aTargetOrFunc, aTargetFuncArg)
   }
 }
 
+function asyncCaretMoveChecker(aCaretOffset, aTargetOrFunc, aTargetFuncArg)
+{
+  this.__proto__ = new caretMoveChecker(aCaretOffset, aTargetOrFunc,
+                                        aTargetFuncArg, true);
+}
+
 /**
  * Text selection change checker.
  */
diff --git a/accessible/tests/mochitest/events/a11y.ini b/accessible/tests/mochitest/events/a11y.ini
index 50dd2e8060d..6b549c854ab 100644
--- a/accessible/tests/mochitest/events/a11y.ini
+++ b/accessible/tests/mochitest/events/a11y.ini
@@ -46,6 +46,7 @@ skip-if = os == 'win' || os == 'linux'
 [test_namechange.xul]
 [test_namechange.html]
 [test_scroll.xul]
+[test_scroll_caret.xul]
 [test_selection.html]
 skip-if = buildapp == 'mulet'
 [test_selection.xul]
diff --git a/accessible/tests/mochitest/events/scroll.html b/accessible/tests/mochitest/events/scroll.html
index df71fd45946..562e0a38259 100644
--- a/accessible/tests/mochitest/events/scroll.html
+++ b/accessible/tests/mochitest/events/scroll.html
@@ -119,5 +119,63 @@
     text text text text text text text text text text text text text text <br>
     text text text text text text text text text text text text text text <br>
   </p>
+
+  <h1 id="heading_1">heading 1</h1>
+  <p style="color: blue">
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+    text text text text text text text text text text text text text text <br>
+  </p>
 </body>
 <html>
diff --git a/accessible/tests/mochitest/events/test_scroll_caret.xul b/accessible/tests/mochitest/events/test_scroll_caret.xul
new file mode 100644
index 00000000000..57e27747f13
--- /dev/null
+++ b/accessible/tests/mochitest/events/test_scroll_caret.xul
@@ -0,0 +1,91 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<?xml-stylesheet href="chrome://mochikit/content/tests/SimpleTest/test.css"
+                 type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js" />
+  <script type="application/javascript"
+          src="chrome://mochikit/content/chrome-harness.js"/>
+
+  <script type="application/javascript"
+          src="../common.js" />
+  <script type="application/javascript"
+          src="../role.js" />
+  <script type="application/javascript"
+          src="../states.js" />
+  <script type="application/javascript"
+          src="../events.js" />
+  <script type="application/javascript"
+          src="../browser.js"></script>
+
+  <script type="application/javascript">
+  <![CDATA[
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Tests
+
+    function getAnchorJumpInTabDocument(aTabIdx)
+    {
+      var tabDoc = aTabIdx ? tabDocumentAt(aTabIdx) : currentTabDocument();
+      return tabDoc.querySelector("h1[id='heading_1']");
+    }
+
+    function loadTab(aURL)
+    {
+      this.eventSeq = [
+        new asyncInvokerChecker(EVENT_DOCUMENT_LOAD_COMPLETE, currentTabDocument),
+        new asyncCaretMoveChecker(0, getAnchorJumpInTabDocument)
+      ];
+
+      this.invoke = function loadTab_invoke()
+      {
+        tabBrowser().loadURI(aURL);
+      }
+
+      this.getID = function loadTab_getID()
+      {
+        return "load tab: " + aURL;
+      }
+    }
+
+    //gA11yEventDumpToConsole = true; // debug stuff
+
+    var gQueue = null;
+    function doTest()
+    {
+      gQueue = new eventQueue();
+
+      var url = "http://mochi.test:8888/a11y/accessible/tests/mochitest/events/scroll.html#heading_1";
+      gQueue.push(new loadTab(url));
+      gQueue.onFinish = function() { closeBrowserWindow(); }
+
+      gQueue.invoke(); // Will call SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    openBrowserWindow(doTest);
+  ]]>
+  </script>
+
+  <vbox flex="1" style="overflow: auto;">
+    <body xmlns="http://www.w3.org/1999/xhtml">
+      <a target="_blank"
+         href="https://bugzilla.mozilla.org/show_bug.cgi?id=1056459"
+         title="Make sure caret move event is fired when document receive focus">
+        Mozilla Bug 1056459
+      </a>
+
+      <p id="display"></p>
+      <div id="content" style="display: none">
+      </div>
+      <pre id="test">
+      </pre>
+    </body>
+
+    <vbox id="eventdump"></vbox>
+  </vbox>
+</window>
diff --git a/accessible/tests/mochitest/jsat/test_output.html b/accessible/tests/mochitest/jsat/test_output.html
index 01b4e2ebef4..8a19d394277 100644
--- a/accessible/tests/mochitest/jsat/test_output.html
+++ b/accessible/tests/mochitest/jsat/test_output.html
@@ -232,6 +232,22 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=753984
             {"string": "entry"}]],
           expectedBraille: [[{"string": "entryAbbr"}, "I am required"],
                             ["I am required", {"string": "entryAbbr"}]]
+        }, {
+          // test unavailable state utterance on inputs
+          accOrElmOrID: "readonlyInput",
+          expectedUtterance: [[{"string": "stateReadonly"}, {"string": "entry"},
+            "No edits"], ["No edits", {"string": "stateReadonly"},
+            {"string": "entry"}]],
+          expectedBraille: [[{"string": "entryAbbr"}, "No edits"],
+                            ["No edits", {"string": "entryAbbr"}]]
+        }, {
+          // test unavailable state utterance on textareas
+          accOrElmOrID: "readonlyTextarea",
+          expectedUtterance: [[{"string": "stateReadonly"}, {"string": "textarea"},
+            "No editing"], ["No editing", {"string": "stateReadonly"},
+            {"string": "textarea"}]],
+          expectedBraille: [[{"string": "textareaAbbr"}, "No editing"],
+                            ["No editing", {"string": "textareaAbbr"}]]
         }, {
           // test has popup state utterance
           accOrElmOrID: "hasPopupButton",
@@ -486,6 +502,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=753984
       <button id="expandedButton" aria-expanded="true">I am expanded</button>
       <button id="collapsedButton" aria-expanded="false">I am collapsed</button>
       <input id="requiredInput" required placeholder="I am required" />
+      <input id="readonlyInput" readonly value="No edits" />
+      <textarea id="readonlyTextarea" readonly>No editing</textarea>
       <button id="hasPopupButton" aria-haspopup="true">I have a popup</button>
       <div role="tablist">
         <a id="tab1" href="#" role="tab" aria-selected="true">Account</a>
diff --git a/accessible/tests/mochitest/text/test_words.html b/accessible/tests/mochitest/text/test_words.html
index f282a062fee..dff90bfeab8 100644
--- a/accessible/tests/mochitest/text/test_words.html
+++ b/accessible/tests/mochitest/text/test_words.html
@@ -92,6 +92,8 @@
       testWordAt("div17", 3, "you", kOk);
       testWordAt("div17", 4, "here", kTodo);
 
+      testWords("input_1", ["foo", "bar"]);
+
       SimpleTest.finish();
     }
 
@@ -125,5 +127,7 @@
   <div id="div16">3+4*5=23</div>
   <div id="div17">Hello. Friend, are you here?!</div>
   </pre>
+  <input id="input_1" type="text" value="foo bar" placeholder="something or other">
+
 </body>
 </html>
diff --git a/addon-sdk/source/lib/sdk/system/child_process/subprocess.js b/addon-sdk/source/lib/sdk/system/child_process/subprocess.js
index c445b6dda35..493583e6581 100644
--- a/addon-sdk/source/lib/sdk/system/child_process/subprocess.js
+++ b/addon-sdk/source/lib/sdk/system/child_process/subprocess.js
@@ -193,9 +193,9 @@ const LRESULT = ctypes.size_t;
 const ULONG_PTR = ctypes.uintptr_t;
 const PVOID = ctypes.voidptr_t;
 const LPVOID = PVOID;
-const LPCTSTR = ctypes.jschar.ptr;
-const LPCWSTR = ctypes.jschar.ptr;
-const LPTSTR = ctypes.jschar.ptr;
+const LPCTSTR = ctypes.char16_t.ptr;
+const LPCWSTR = ctypes.char16_t.ptr;
+const LPTSTR = ctypes.char16_t.ptr;
 const LPSTR = ctypes.char.ptr;
 const LPCSTR = ctypes.char.ptr;
 const LPBYTE = ctypes.char.ptr;
@@ -707,8 +707,8 @@ function subprocess_win32(options) {
         if(environment.length) {
             //An environment block consists of
             //a null-terminated block of null-terminated strings.
-            //Using CREATE_UNICODE_ENVIRONMENT so needs to be jschar
-            environment = ctypes.jschar.array()(environment.join('\0') + '\0');
+            //Using CREATE_UNICODE_ENVIRONMENT so needs to be char16_t
+            environment = ctypes.char16_t.array()(environment.join('\0') + '\0');
         } else {
             environment = null;
         }
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index d002a1c69fb..f33f0c648d4 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -971,17 +971,17 @@ pref("apz.x_stationary_size_multiplier", "1.5");
 pref("apz.y_stationary_size_multiplier", "1.8");
 pref("apz.enlarge_displayport_when_clipped", true);
 // Use "sticky" axis locking
-pref("apz.axis_lock_mode", 2);
+pref("apz.axis_lock.mode", 2);
 pref("apz.subframe.enabled", true);
 
 // Overscroll-related settings
 pref("apz.overscroll.enabled", true);
-pref("apz.overscroll.fling_friction", "0.02");
+pref("apz.overscroll.fling_friction", "0.05");
 pref("apz.overscroll.fling_stopped_threshold", "0.4");
 pref("apz.overscroll.stretch_factor", "0.5");
-pref("apz.overscroll.snap_back.spring_stiffness", "0.6");
+pref("apz.overscroll.snap_back.spring_stiffness", "0.05");
 pref("apz.overscroll.snap_back.spring_friction", "0.1");
-pref("apz.overscroll.snap_back.mass", "1200");
+pref("apz.overscroll.snap_back.mass", "100");
 
 // This preference allows FirefoxOS apps (and content, I think) to force
 // the use of software (instead of hardware accelerated) 2D canvases by
@@ -1003,8 +1003,8 @@ pref("dom.wakelock.enabled", true);
 // Enable touch caret by default
 pref("touchcaret.enabled", true);
 
-// Disable selection caret by default
-pref("selectioncaret.enabled", false);
+// Enable selection caret by default
+pref("selectioncaret.enabled", true);
 
 // Enable sync and mozId with Firefox Accounts.
 pref("services.sync.fxaccounts.enabled", true);
diff --git a/b2g/app/nsBrowserApp.cpp b/b2g/app/nsBrowserApp.cpp
index 57a533ba103..69036a070ae 100644
--- a/b2g/app/nsBrowserApp.cpp
+++ b/b2g/app/nsBrowserApp.cpp
@@ -283,15 +283,17 @@ int main(int argc, _CONST char* argv[])
      */
     _argv = new char *[argc + 1];
     for (int i = 0; i < argc; i++) {
-      _argv[i] = strdup(argv[i]);
+      size_t len = strlen(argv[i]) + 1;
+      _argv[i] = new char[len];
       MOZ_ASSERT(_argv[i] != nullptr);
+      memcpy(_argv[i], argv[i], len);
     }
     _argv[argc] = nullptr;
 
     result = do_main(argc, _argv);
 
     for (int i = 0; i < argc; i++) {
-      free(_argv[i]);
+      delete[] _argv[i];
     }
     delete[] _argv;
   }
diff --git a/b2g/components/SystemAppProxy.jsm b/b2g/components/SystemAppProxy.jsm
index 54bdb2b6991..fc44c7b1521 100644
--- a/b2g/components/SystemAppProxy.jsm
+++ b/b2g/components/SystemAppProxy.jsm
@@ -110,10 +110,10 @@ let SystemAppProxy = {
     if (content) {
       content.removeEventListener.apply(content, arguments);
     } else {
-      let idx = this._pendingListeners.indexOf(listener);
-      if (idx != -1) {
-        this._pendingListeners.splice(idx, 1);
-      }
+      this._pendingListeners = this._pendingListeners.filter(
+        args => {
+          return args[0] != name || args[1] != listener;
+        });
     }
   },
 
diff --git a/b2g/components/test/mochitest/systemapp_helper.js b/b2g/components/test/mochitest/systemapp_helper.js
index dfffcd3969e..80e30b0096d 100644
--- a/b2g/components/test/mochitest/systemapp_helper.js
+++ b/b2g/components/test/mochitest/systemapp_helper.js
@@ -94,7 +94,7 @@ let steps = [
     // Ensure that listener being registered before the system app is ready
     // are correctly removed from the pending list
     function removedListener() {
-      assert(false, "Listener isn't correctly removed from the pending list");
+      assert.ok(false, "Listener isn't correctly removed from the pending list");
     }
     SystemAppProxy.addEventListener("mozChromeEvent", removedListener);
     SystemAppProxy.removeEventListener("mozChromeEvent", removedListener);
diff --git a/b2g/config/dolphin/sources.xml b/b2g/config/dolphin/sources.xml
index 0459d237766..889e33ce938 100644
--- a/b2g/config/dolphin/sources.xml
+++ b/b2g/config/dolphin/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="fe92ddd450e03b38edb2d465de7897971d68ac68">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
@@ -120,14 +120,14 @@
   <project name="platform/system/media" path="system/media" revision="7ff72c2ea2496fa50b5e8a915e56e901c3ccd240"/>
   <project name="platform/system/netd" path="system/netd" revision="3ae56364946d4a5bf5a5f83f12f9a45a30398e33"/>
   <project name="platform/system/security" path="system/security" revision="ee8068b9e7bfb2770635062fc9c2035be2142bd8"/>
-  <project name="platform/system/vold" path="system/vold" revision="118dec582647895a863dbbce8ec26bc7af457bbe"/>
+  <project name="platform/system/vold" path="system/vold" revision="2e43efe1b30d0b98574d293059556aebd2f46454"/>
   <!--original fetch url was http://sprdsource.spreadtrum.com:8085/b2g/android-->
   <remote fetch="https://git.mozilla.org/external/sprd-aosp" name="sprd-aosp"/>
   <default remote="sprd-aosp" revision="sprdb2g_gonk4.4" sync-j="4"/>
   <!-- Stock Android things -->
   <project name="platform/external/icu4c" path="external/icu4c" revision="2bb01561780583cc37bc667f0ea79f48a122d8a2"/>
   <!-- dolphin specific things -->
-  <project name="device/sprd" path="device/sprd" revision="3ba0b8b4e3f55d68f84603218e522d054a723532"/>
+  <project name="device/sprd" path="device/sprd" revision="ebb1ce6af72efe15c6919e2ceb9ee805ce2e5960"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="4e58336019b5cbcfd134caf55b142236cf986618"/>
   <project name="platform/frameworks/av" path="frameworks/av" revision="facca8d3e35431b66f85a4eb42bc6c5b24bd04da"/>
   <project name="platform/hardware/akm" path="hardware/akm" revision="6d3be412647b0eab0adff8a2768736cf4eb68039"/>
diff --git a/b2g/config/emulator-ics/sources.xml b/b2g/config/emulator-ics/sources.xml
index 024cc6acdd9..3045b6f9624 100644
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -19,13 +19,13 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>
diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index 85c7bf517d7..24043ad9964 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -17,10 +17,10 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
@@ -130,6 +130,7 @@
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="3a9a17613cc685aa232432566ad6cc607eab4ec1"/>
   <project name="device_generic_goldfish" path="device/generic/goldfish" remote="b2g" revision="197cd9492b9fadaa915c5daf36ff557f8f4a8d1c"/>
   <project name="platform/external/libnfc-nci" path="external/libnfc-nci" revision="7d33aaf740bbf6c7c6e9c34a92b371eda311b66b"/>
+  <project name="libnfcemu" path="external/libnfcemu" remote="b2g" revision="682e556367e0049bb3ae127cec6e6c459abca1b0"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="57b16fcb790bdf0b53b3c6435a37ccc8ca90ed36"/>
   <project name="platform/external/wpa_supplicant_8" path="external/wpa_supplicant_8" revision="0e56e450367cd802241b27164a2979188242b95f"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="9f28c4faea3b2f01db227b2467b08aeba96d9bec"/>
diff --git a/b2g/config/emulator-kk/sources.xml b/b2g/config/emulator-kk/sources.xml
index 4819625f781..1cdc7c51b86 100644
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="fe92ddd450e03b38edb2d465de7897971d68ac68">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="f92a936f2aa97526d4593386754bdbf02db07a12"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="6e47ff2790f5656b5b074407829ceecf3e6188c4"/>
diff --git a/b2g/config/emulator/sources.xml b/b2g/config/emulator/sources.xml
index 024cc6acdd9..3045b6f9624 100644
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -19,13 +19,13 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
   <project name="platform_external_qemu" path="external/qemu" remote="b2g" revision="c058843242068d0df7c107e09da31b53d2e08fa6"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="dd924f92906085b831bf1cbbc7484d3c043d613c"/>
   <project name="platform/bionic" path="bionic" revision="c72b8f6359de7ed17c11ddc9dfdde3f615d188a9"/>
diff --git a/b2g/config/flame-kk/sources.xml b/b2g/config/flame-kk/sources.xml
index 2af82d93711..92bc54a8e40 100644
--- a/b2g/config/flame-kk/sources.xml
+++ b/b2g/config/flame-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="fe92ddd450e03b38edb2d465de7897971d68ac68">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
@@ -23,7 +23,7 @@
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <!-- Stock Android things -->
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/i686-linux-glibc2.7-4.6" revision="95bb5b66b3ec5769c3de8d3f25d681787418e7d2"/>
   <project groups="linux" name="platform/prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" path="prebuilts/gcc/linux-x86/host/x86_64-linux-glibc2.7-4.6" revision="ebdad82e61c16772f6cd47e9f11936bf6ebe9aa0"/>
@@ -132,7 +132,7 @@
   <!-- Flame specific things -->
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="1bb28abbc215f45220620af5cd60a8ac1be93722"/>
   <project name="device/qcom/common" path="device/qcom/common" revision="da9043131590b23754c6411e8704c1dc425b0ead"/>
-  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="84136f83161a8445afb3e16076913a309087874a"/>
+  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="540314ae9c56394c6b1f17a267db9f25c5acb9d6"/>
   <project name="codeaurora_kernel_msm" path="kernel" remote="b2g" revision="893238eb1215f8fd4f3747169170cc5e1cc33969"/>
   <project name="kernel_lk" path="bootable/bootloader/lk" remote="b2g" revision="9e62af4da848d56841bdde326f9bba26c743c33a"/>
   <project name="platform/external/bluetooth/bluedroid" path="external/bluetooth/bluedroid" revision="082a1f98422e6a6b56f61218d6fcf465e85d4c58"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index 401325af0b6..1e1096a4179 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -17,10 +17,10 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
@@ -122,7 +122,7 @@
   <!-- Flame specific things -->
   <project name="device/generic/armv7-a-neon" path="device/generic/armv7-a-neon" revision="e8a318f7690092e639ba88891606f4183e846d3f"/>
   <project name="device/qcom/common" path="device/qcom/common" revision="878804e0becfe5635bb8ccbf2671333d546c6fb6"/>
-  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="f686fa63e8766a4799cffab0b072c7b80194c4fc"/>
+  <project name="device-flame" path="device/t2m/flame" remote="b2g" revision="55ba09d8edffe7daffd954986b913319fd97890f"/>
   <project name="codeaurora_kernel_msm" path="kernel" remote="b2g" revision="ebb14165369f5edc3f335d5bde6eef8439073589"/>
   <project name="kernel_lk" path="bootable/bootloader/lk" remote="b2g" revision="9eb619d2efdf4bd121587d8296f5c10481f750b8"/>
   <project name="platform_bootable_recovery" path="bootable/recovery" remote="b2g" revision="e81502511cda303c803e63f049574634bc96f9f2"/>
diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index d7e366e234b..cca134c91b9 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -4,6 +4,6 @@
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "c24176cfc9d128e5673782e05532f09ff94d09c5", 
+    "revision": "d43b2e2dba496f624d62c1b72a22dc5e34953fbd", 
     "repo_path": "/integration/gaia-central"
 }
diff --git a/b2g/config/hamachi/sources.xml b/b2g/config/hamachi/sources.xml
index 2f99b159cc7..46efccca07e 100644
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -17,12 +17,12 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
   <project name="platform/bionic" path="bionic" revision="d2eb6c7b6e1bc7643c17df2d9d9bcb1704d0b9ab"/>
diff --git a/b2g/config/helix/sources.xml b/b2g/config/helix/sources.xml
index bb4a0621727..2ceb321aa57 100644
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -15,7 +15,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index 68e43094fd0..777547ad810 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -17,10 +17,10 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <project name="valgrind" path="external/valgrind" remote="b2g" revision="daa61633c32b9606f58799a3186395fd2bbb8d8c"/>
   <project name="vex" path="external/VEX" remote="b2g" revision="47f031c320888fe9f3e656602588565b52d43010"/>
   <!-- Stock Android things -->
diff --git a/b2g/config/wasabi/sources.xml b/b2g/config/wasabi/sources.xml
index 664fd181a86..898a891345c 100644
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -17,12 +17,12 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5765c62163bcb7fde5ebfd211881117de31a7c46"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="4abb193ddae0f9780ad12ffe5e31772feee3926a"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="6969df171e5295f855f12d12db0382048e6892e7"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="562d357b72279a9e35d4af5aeecc8e1ffa2f44f1"/>
-  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="7af569a39a6a7d01a58093a01b16644c2c0f5657"/>
+  <project name="apitrace" path="external/apitrace" remote="apitrace" revision="facdb3593e63dcbb740709303a5b2527113c50a0"/>
   <project name="gonk-patches" path="patches" remote="b2g" revision="223a2421006e8f5da33f516f6891c87cae86b0f6"/>
   <!-- Stock Android things -->
   <project name="platform/abi/cpp" path="abi/cpp" revision="6426040f1be4a844082c9769171ce7f5341a5528"/>
diff --git a/b2g/dev/app/moz.build b/b2g/dev/app/moz.build
index bdb19346930..6fbe8159b2d 100644
--- a/b2g/dev/app/moz.build
+++ b/b2g/dev/app/moz.build
@@ -1,6 +1,3 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-DIST_SUBDIR = 'browser'
-export('DIST_SUBDIR')
diff --git a/browser/app/moz.build b/browser/app/moz.build
index 3d22eab10b0..f6570585f06 100644
--- a/browser/app/moz.build
+++ b/browser/app/moz.build
@@ -72,3 +72,6 @@ if CONFIG['MOZ_LINKER']:
 
 if CONFIG['HAVE_CLOCK_MONOTONIC']:
     OS_LIBS += CONFIG['REALTIME_LIBS']
+
+if CONFIG['MOZ_OPTIMIZE']:
+    DEFINES['MOZ_OPTIMIZE'] = True
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 9311f93041a..685631d90c7 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1131,13 +1131,6 @@ pref("browser.zoom.updateBackgroundTabs", true);
 // The breakpad report server to link to in about:crashes
 pref("breakpad.reportURL", "https://crash-stats.mozilla.com/report/index/");
 
-#ifndef RELEASE_BUILD
-// Override submission of plugin hang reports to a different processing server
-// for the smaller-volume nightly/aurora populations.
-pref("toolkit.crashreporter.pluginHangSubmitURL",
-     "https://hang-reports.mozilla.org/submit");
-#endif
-
 // URL for "Learn More" for Crash Reporter
 pref("toolkit.crashreporter.infoURL",
      "https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter");
@@ -1184,6 +1177,25 @@ pref("browser.tabs.remote", false);
 #endif
 pref("browser.tabs.remote.autostart", false);
 
+#if defined(MOZ_CONTENT_SANDBOX) && defined(XP_WIN)
+// This controls whether the content process on Windows is sandboxed.
+// You also need to be using remote tabs, see above.
+// on = full sandbox enabled
+// warn = warn only sandbox enabled
+// anything else = sandbox disabled
+// This will probably require a restart.
+pref("browser.tabs.remote.sandbox", "off");
+
+// This is essentially the same logic that decides whether nsStackWalk.cpp gets
+// built, which we use for the stack trace. See xpcom/base/moz.build
+#if !defined(MOZ_OPTIMIZE) || defined(MOZ_PROFILING) || defined(DEBUG)
+// This controls the depth of stack trace that is logged when the warn only
+// sandbox reports that a resource access request has been blocked.
+// This does not require a restart to take effect.
+pref("browser.tabs.remote.sandbox.warnOnlyStackTraceDepth", 0);
+#endif
+#endif
+
 // This pref governs whether we attempt to work around problems caused by
 // plugins using OS calls to manipulate the cursor while running out-of-
 // process.  These workarounds all involve intercepting (hooking) certain
@@ -1267,6 +1279,7 @@ pref("services.sync.prefs.sync.privacy.clearOnShutdown.siteSettings", true);
 pref("services.sync.prefs.sync.privacy.donottrackheader.enabled", true);
 pref("services.sync.prefs.sync.privacy.donottrackheader.value", true);
 pref("services.sync.prefs.sync.privacy.sanitize.sanitizeOnShutdown", true);
+pref("services.sync.prefs.sync.privacy.trackingprotection.enabled", true);
 pref("services.sync.prefs.sync.security.OCSP.enabled", true);
 pref("services.sync.prefs.sync.security.OCSP.require", true);
 pref("services.sync.prefs.sync.security.default_personal_cert", true);
diff --git a/browser/base/content/aboutneterror/netError.xhtml b/browser/base/content/aboutNetError.xhtml
similarity index 99%
rename from browser/base/content/aboutneterror/netError.xhtml
rename to browser/base/content/aboutNetError.xhtml
index e1f173f6d61..f7326af1775 100644
--- a/browser/base/content/aboutneterror/netError.xhtml
+++ b/browser/base/content/aboutNetError.xhtml
@@ -20,7 +20,6 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
   <head>
     <title>&loadError.label;</title>
-    <link rel="stylesheet" href="chrome://browser/content/aboutneterror/netError.css" type="text/css" media="all" />
     <link rel="stylesheet" href="chrome://browser/skin/aboutNetError.css" type="text/css" media="all" />
     <!-- If the location of the favicon is changed here, the FAVICON_ERRORPAGE_URL symbol in
          toolkit/components/places/src/nsFaviconService.h should be updated. -->
diff --git a/browser/base/content/aboutneterror/netError.css b/browser/base/content/aboutneterror/netError.css
deleted file mode 100644
index 14b206b9954..00000000000
--- a/browser/base/content/aboutneterror/netError.css
+++ /dev/null
@@ -1,69 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-@import url("chrome://global/skin/in-content/common.css");
-
-body {
-  display: flex;
-  box-sizing: padding-box;
-  min-height: 100vh;
-  padding: 0 48px;
-  align-items: center;
-  justify-content: center;
-}
-
-ul, ol {
-  margin: 0;
-  padding: 0;
-  -moz-margin-start: 1em;
-}
-
-ul > li, ol > li {
-  margin-bottom: .5em;
-}
-
-ul {
-  list-style: disc;
-}
-
-#errorPageContainer {
-  min-width: 320px;
-  max-width: 512px;
-}
-
-#errorTitleText {
-  background: url("info.svg") left 0 no-repeat;
-  background-size: 1.2em;
-  -moz-margin-start: -2em;
-  -moz-padding-start: 2em;
-}
-
-#errorTitleText:-moz-dir(rtl) {
-  background-position: right 0;
-}
-
-#errorTryAgain {
-  margin-top: 1.2em;
-  min-width: 150px
-}
-
-#errorContainer {
-  display: none;
-}
-
-@media (max-width: 675px) {
-  #errorTitleText {
-    padding-top: 0;
-    background-image: none;
-    -moz-padding-start: 0;
-    -moz-margin-start: 0;
-  }
-}
-
-/* Pressing the retry button will cause the cursor to flicker from a pointer to
- * not-allowed. Override the disabled cursor behaviour since we will never show
- * the button disabled as the initial state. */
-button:disabled {
-  cursor: pointer;
-}
diff --git a/browser/base/content/browser-addons.js b/browser/base/content/browser-addons.js
index 5698340514f..542f62f7ff1 100644
--- a/browser/base/content/browser-addons.js
+++ b/browser/base/content/browser-addons.js
@@ -44,8 +44,11 @@ const gXPInstallObserver = {
     } catch (e) {
       browser = winOrBrowser;
     }
-    if (!browser)
+    // Note that the above try/catch will pass through dead object proxies and
+    // other degenerate objects. Make sure the browser is bonafide.
+    if (!browser || gBrowser.browsers.indexOf(browser) == -1)
       return;
+
     const anchorID = "addons-notification-icon";
     var messageString, action;
     var brandShortName = brandBundle.getString("brandShortName");
@@ -80,8 +83,16 @@ const gXPInstallObserver = {
                               action, null, options);
       break;
     case "addon-install-blocked":
+      let originatingHost;
+      try {
+        originatingHost = installInfo.originatingURI.host;
+      } catch (ex) {
+        // Need to deal with missing originatingURI and with about:/data: URIs more gracefully,
+        // see bug 1063418 - but for now, bail:
+        return;
+      }
       messageString = gNavigatorBundle.getFormattedString("xpinstallPromptWarning",
-                        [brandShortName, installInfo.originatingURI.host]);
+                        [brandShortName, originatingHost]);
 
       let secHistogram = Components.classes["@mozilla.org/base/telemetry;1"].getService(Ci.nsITelemetry).getHistogramById("SECURITY_UI");
       action = {
diff --git a/browser/base/content/browser-places.js b/browser/base/content/browser-places.js
index 3907daed592..f92e2639b43 100644
--- a/browser/base/content/browser-places.js
+++ b/browser/base/content/browser-places.js
@@ -504,12 +504,21 @@ function HistoryMenu(aPopupShowingEvent) {
 }
 
 HistoryMenu.prototype = {
+  _getClosedTabCount() {
+    // SessionStore doesn't track the hidden window, so just return zero then.
+    if (window == Services.appShell.hiddenDOMWindow) {
+      return 0;
+    }
+
+    return SessionStore.getClosedTabCount(window);
+  },
+
   toggleRecentlyClosedTabs: function HM_toggleRecentlyClosedTabs() {
     // enable/disable the Recently Closed Tabs sub menu
     var undoMenu = this._rootElt.getElementsByClassName("recentlyClosedTabsMenu")[0];
 
     // no restorable tabs, so disable menu
-    if (SessionStore.getClosedTabCount(window) == 0)
+    if (this._getClosedTabCount() == 0)
       undoMenu.setAttribute("disabled", true);
     else
       undoMenu.removeAttribute("disabled");
@@ -527,7 +536,7 @@ HistoryMenu.prototype = {
       undoPopup.removeChild(undoPopup.firstChild);
 
     // no restorable tabs, so make sure menu is disabled, and return
-    if (SessionStore.getClosedTabCount(window) == 0) {
+    if (this._getClosedTabCount() == 0) {
       undoMenu.setAttribute("disabled", true);
       return;
     }
diff --git a/browser/base/content/browser-thumbnails.js b/browser/base/content/browser-thumbnails.js
index bb2d2bce328..454a5022248 100644
--- a/browser/base/content/browser-thumbnails.js
+++ b/browser/base/content/browser-thumbnails.js
@@ -125,6 +125,10 @@ let gBrowserThumbnails = {
 
   // FIXME: This should be part of the PageThumbs API. (bug 1062414)
   _shouldCapture: function Thumbnails_shouldCapture(aBrowser) {
+    // Don't try to capture in e10s yet (because of bug 698371)
+    if (gMultiProcessBrowser)
+      return false;
+
     // Capture only if it's the currently selected tab.
     if (aBrowser != gBrowser.selectedBrowser)
       return false;
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index d07579831e0..ff97b34b4dc 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -2336,6 +2336,9 @@ let BrowserOnClick = {
 
     let originalTarget = event.originalTarget;
     let ownerDoc = originalTarget.ownerDocument;
+    if (!ownerDoc) {
+      return;
+    }
 
     if (gMultiProcessBrowser &&
         ownerDoc.documentURI.toLowerCase() == "about:newtab") {
diff --git a/browser/base/content/content.js b/browser/base/content/content.js
index 750ea6bc9dc..7550f13eb74 100644
--- a/browser/base/content/content.js
+++ b/browser/base/content/content.js
@@ -370,6 +370,9 @@ let ClickEventHandler = {
 
     let originalTarget = event.originalTarget;
     let ownerDoc = originalTarget.ownerDocument;
+    if (!ownerDoc) {
+      return;
+    }
 
     // Handle click events from about pages
     if (ownerDoc.documentURI.startsWith("about:certerror")) {
diff --git a/browser/base/content/sanitize.js b/browser/base/content/sanitize.js
index b3dd06ede93..47528de5720 100644
--- a/browser/base/content/sanitize.js
+++ b/browser/base/content/sanitize.js
@@ -390,6 +390,11 @@ Sanitizer.prototype = {
         for each (var host in hosts) {
           pwmgr.setLoginSavingEnabled(host, true);
         }
+
+        // Clear site security settings
+        var sss = Cc["@mozilla.org/ssservice;1"]
+                    .getService(Ci.nsISiteSecurityService);
+        sss.clearAll();
       },
 
       get canClear()
diff --git a/browser/base/content/sync/aboutSyncTabs.js b/browser/base/content/sync/aboutSyncTabs.js
index 50073dfeb00..27af4448645 100644
--- a/browser/base/content/sync/aboutSyncTabs.js
+++ b/browser/base/content/sync/aboutSyncTabs.js
@@ -4,10 +4,22 @@
 
 const Cu = Components.utils;
 
+Cu.import("resource://services-common/utils.js");
 Cu.import("resource://services-sync/main.js");
 Cu.import("resource:///modules/PlacesUIUtils.jsm");
 Cu.import("resource://gre/modules/PlacesUtils.jsm", this);
 Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "Promise",
+                                  "resource://gre/modules/Promise.jsm");
+
+#ifdef MOZ_SERVICES_CLOUDSYNC
+XPCOMUtils.defineLazyModuleGetter(this, "CloudSync",
+                                  "resource://gre/modules/CloudSync.jsm");
+#else
+let CloudSync = null;
+#endif
 
 let RemoteTabViewer = {
   _tabsList: null,
@@ -16,6 +28,8 @@ let RemoteTabViewer = {
     Services.obs.addObserver(this, "weave:service:login:finish", false);
     Services.obs.addObserver(this, "weave:engine:sync:finish", false);
 
+    Services.obs.addObserver(this, "cloudsync:tabs:update", false);
+
     this._tabsList = document.getElementById("tabsList");
 
     this.buildList(true);
@@ -24,63 +38,62 @@ let RemoteTabViewer = {
   uninit: function () {
     Services.obs.removeObserver(this, "weave:service:login:finish");
     Services.obs.removeObserver(this, "weave:engine:sync:finish");
+
+    Services.obs.removeObserver(this, "cloudsync:tabs:update");
   },
 
-  buildList: function(force) {
-    if (!Weave.Service.isLoggedIn || !this._refetchTabs(force))
-      return;
-    //XXXzpao We should say something about not being logged in & not having data
-    //        or tell the appropriate condition. (bug 583344)
-
-    this._generateTabList();
-  },
-
-  createItem: function(attrs) {
+  createItem: function (attrs) {
     let item = document.createElement("richlistitem");
 
-    // Copy the attributes from the argument into the item
-    for (let attr in attrs)
+    // Copy the attributes from the argument into the item.
+    for (let attr in attrs) {
       item.setAttribute(attr, attrs[attr]);
+    }
 
-    if (attrs["type"] == "tab")
+    if (attrs["type"] == "tab") {
       item.label = attrs.title != "" ? attrs.title : attrs.url;
+    }
 
     return item;
   },
 
-  filterTabs: function(event) {
+  filterTabs: function (event) {
     let val = event.target.value.toLowerCase();
     let numTabs = this._tabsList.getRowCount();
     let clientTabs = 0;
     let currentClient = null;
-    for (let i = 0;i < numTabs;i++) {
+
+    for (let i = 0; i < numTabs; i++) {
       let item = this._tabsList.getItemAtIndex(i);
       let hide = false;
       if (item.getAttribute("type") == "tab") {
-        if (!item.getAttribute("url").toLowerCase().contains(val) && 
-            !item.getAttribute("title").toLowerCase().contains(val))
+        if (!item.getAttribute("url").toLowerCase().contains(val) &&
+            !item.getAttribute("title").toLowerCase().contains(val)) {
           hide = true;
-        else
+        } else {
           clientTabs++;
+        }
       }
       else if (item.getAttribute("type") == "client") {
         if (currentClient) {
-          if (clientTabs == 0)
+          if (clientTabs == 0) {
             currentClient.hidden = true;
+          }
         }
         currentClient = item;
         clientTabs = 0;
       }
       item.hidden = hide;
     }
-    if (clientTabs == 0)
+    if (clientTabs == 0) {
       currentClient.hidden = true;
+    }
   },
 
-  openSelected: function() {
+  openSelected: function () {
     let items = this._tabsList.selectedItems;
     let urls = [];
-    for (let i = 0;i < items.length;i++) {
+    for (let i = 0; i < items.length; i++) {
       if (items[i].getAttribute("type") == "tab") {
         urls.push(items[i].getAttribute("url"));
         let index = this._tabsList.getIndexOfItem(items[i]);
@@ -93,7 +106,7 @@ let RemoteTabViewer = {
     }
   },
 
-  bookmarkSingleTab: function() {
+  bookmarkSingleTab: function () {
     let item = this._tabsList.selectedItems[0];
     let uri = Weave.Utils.makeURI(item.getAttribute("url"));
     let title = item.getAttribute("title");
@@ -108,14 +121,15 @@ let RemoteTabViewer = {
                                      }, window.top);
   },
 
-  bookmarkSelectedTabs: function() {
+  bookmarkSelectedTabs: function () {
     let items = this._tabsList.selectedItems;
     let URIs = [];
-    for (let i = 0;i < items.length;i++) {
+    for (let i = 0; i < items.length; i++) {
       if (items[i].getAttribute("type") == "tab") {
         let uri = Weave.Utils.makeURI(items[i].getAttribute("url"));
-        if (!uri)
+        if (!uri) {
           continue;
+        }
 
         URIs.push(uri);
       }
@@ -133,7 +147,7 @@ let RemoteTabViewer = {
     try {
       let iconURI = Weave.Utils.makeURI(iconUri);
       return PlacesUtils.favicons.getFaviconLinkForIcon(iconURI).spec;
-    } catch(ex) {
+    } catch (ex) {
       // Do nothing.
     }
 
@@ -141,16 +155,58 @@ let RemoteTabViewer = {
     return defaultIcon || PlacesUtils.favicons.defaultFavicon.spec;
   },
 
-  _generateTabList: function() {
-    let engine = Weave.Service.engineManager.get("tabs");
+  _waitingForBuildList: false,
+
+  _buildListRequested: false,
+
+  buildList: function (force) {
+    if (this._waitingForBuildList) {
+      this._buildListRequested = true;
+      return;
+    }
+
+    this._waitingForBuildList = true;
+    this._buildListRequested = false;
+
+    this._clearTabList();
+
+    if (Weave.Service.isLoggedIn && this._refetchTabs(force)) {
+      this._generateWeaveTabList();
+    } else {
+      //XXXzpao We should say something about not being logged in & not having data
+      //        or tell the appropriate condition. (bug 583344)
+    }
+
+    function complete() {
+      this._waitingForBuildList = false;
+      if (this._buildListRequested) {
+        CommonUtils.nextTick(this.buildList, this);
+      }
+    }
+
+    if (CloudSync && CloudSync.ready && CloudSync().tabsReady && CloudSync().tabs.hasRemoteTabs()) {
+      this._generateCloudSyncTabList()
+          .then(complete, complete);
+    } else {
+      complete();
+    }
+  },
+
+  _clearTabList: function () {
     let list = this._tabsList;
 
-    // clear out existing richlistitems
+    // Clear out existing richlistitems.
     let count = list.getRowCount();
     if (count > 0) {
-      for (let i = count - 1; i >= 0; i--)
+      for (let i = count - 1; i >= 0; i--) {
         list.removeItemAt(i);
+      }
     }
+  },
+
+  _generateWeaveTabList: function () {
+    let engine = Weave.Service.engineManager.get("tabs");
+    let list = this._tabsList;
 
     let seenURLs = new Set();
     let localURLs = engine.getOpenURLs();
@@ -189,7 +245,37 @@ let RemoteTabViewer = {
     }
   },
 
-  adjustContextMenu: function(event) {
+  _generateCloudSyncTabList: function () {
+    let updateTabList = function (remoteTabs) {
+      let list = this._tabsList;
+
+      for each (let client in remoteTabs) {
+        let clientAttrs = {
+          type: "client",
+          clientName: client.name,
+        };
+
+        let clientEnt = this.createItem(clientAttrs);
+        list.appendChild(clientEnt);
+
+        for (let tab of client.tabs) {
+          let tabAttrs = {
+            type: "tab",
+            title: tab.title,
+            url: tab.url,
+            icon: this.getIcon(tab.icon),
+          };
+          let tabEnt = this.createItem(tabAttrs);
+          list.appendChild(tabEnt);
+        }
+      }
+    }.bind(this);
+
+    return CloudSync().tabs.getRemoteTabs()
+                           .then(updateTabList, Promise.reject);
+  },
+
+  adjustContextMenu: function (event) {
     let mode = "all";
     switch (this._tabsList.selectedItems.length) {
       case 0:
@@ -201,33 +287,40 @@ let RemoteTabViewer = {
         mode = "multiple";
         break;
     }
+
     let menu = document.getElementById("tabListContext");
     let el = menu.firstChild;
     while (el) {
       let showFor = el.getAttribute("showFor");
-      if (showFor)
+      if (showFor) {
         el.hidden = showFor != mode && showFor != "all";
+      }
 
       el = el.nextSibling;
     }
   },
 
-  _refetchTabs: function(force) {
+  _refetchTabs: function (force) {
     if (!force) {
       // Don't bother refetching tabs if we already did so recently
       let lastFetch = 0;
       try {
         lastFetch = Services.prefs.getIntPref("services.sync.lastTabFetch");
       }
-      catch (e) { /* Just use the default value of 0 */ }
+      catch (e) {
+        /* Just use the default value of 0 */
+      }
+
       let now = Math.floor(Date.now() / 1000);
-      if (now - lastFetch < 30)
+      if (now - lastFetch < 30) {
         return false;
+      }
     }
 
-    // if Clients hasn't synced yet this session, need to sync it as well
-    if (Weave.Service.clientsEngine.lastSync == 0)
+    // if Clients hasn't synced yet this session, we need to sync it as well.
+    if (Weave.Service.clientsEngine.lastSync == 0) {
       Weave.Service.clientsEngine.sync();
+    }
 
     // Force a sync only for the tabs engine
     let engine = Weave.Service.engineManager.get("tabs");
@@ -239,21 +332,26 @@ let RemoteTabViewer = {
     return true;
   },
 
-  observe: function(subject, topic, data) {
+  observe: function (subject, topic, data) {
     switch (topic) {
       case "weave:service:login:finish":
         this.buildList(true);
         break;
       case "weave:engine:sync:finish":
-        if (subject == "tabs")
-          this._generateTabList();
+        if (subject == "tabs") {
+          this.buildList(false);
+        }
+        break;
+      case "cloudsync:tabs:update":
+        this.buildList(false);
         break;
     }
   },
 
-  handleClick: function(event) {
-    if (event.target.getAttribute("type") != "tab")
+  handleClick: function (event) {
+    if (event.target.getAttribute("type") != "tab") {
       return;
+    }
 
     if (event.button == 1) {
       let url = event.target.getAttribute("url");
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 2c1af22e9b1..741baa911d1 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -372,6 +372,16 @@
         </body>
       </method>
 
+      <method name="getBrowserForContentWindow">
+        <parameter name="aWindow"/>
+        <body>
+          <![CDATA[
+            var tab = this._getTabForContentWindow(aWindow);
+            return tab ? tab.linkedBrowser : null;
+          ]]>
+        </body>
+      </method>
+
       <method name="_getTabForContentWindow">
         <parameter name="aWindow"/>
         <body>
@@ -388,7 +398,9 @@
           }
 
           for (let i = 0; i < this.browsers.length; i++) {
-            if (this.browsers[i].contentWindow == aWindow)
+            // NB: We use contentWindowAsCPOW so that this code works both
+            // for remote browsers as well. aWindow may be a CPOW.
+            if (this.browsers[i].contentWindowAsCPOW == aWindow)
               return this.tabs[i];
           }
           return null;
diff --git a/browser/base/content/test/general/browser_searchSuggestionUI.js b/browser/base/content/test/general/browser_searchSuggestionUI.js
index f38de4c8076..d5afd06b334 100644
--- a/browser/base/content/test/general/browser_searchSuggestionUI.js
+++ b/browser/base/content/test/general/browser_searchSuggestionUI.js
@@ -143,6 +143,7 @@ add_task(function* formHistory() {
   let deferred = Promise.defer();
   Services.obs.addObserver(function onAdd(subj, topic, data) {
     if (data == "formhistory-add") {
+      Services.obs.removeObserver(onAdd, "satchel-storage-changed");
       executeSoon(() => deferred.resolve());
     }
   }, "satchel-storage-changed", false);
@@ -167,8 +168,9 @@ add_task(function* formHistory() {
 
   // Wait for Satchel.
   deferred = Promise.defer();
-  Services.obs.addObserver(function onAdd(subj, topic, data) {
+  Services.obs.addObserver(function onRemove(subj, topic, data) {
     if (data == "formhistory-remove") {
+      Services.obs.removeObserver(onRemove, "satchel-storage-changed");
       executeSoon(() => deferred.resolve());
     }
   }, "satchel-storage-changed", false);
diff --git a/browser/base/jar.mn b/browser/base/jar.mn
index 9aee2941027..373b196b342 100644
--- a/browser/base/jar.mn
+++ b/browser/base/jar.mn
@@ -46,9 +46,7 @@ browser.jar:
         content/browser/abouthome/restore-large@2x.png (content/abouthome/restore-large@2x.png)
         content/browser/abouthome/mozilla@2x.png       (content/abouthome/mozilla@2x.png)
 
-        content/browser/aboutneterror/netError.xhtml   (content/aboutneterror/netError.xhtml)
-        content/browser/aboutneterror/netError.css     (content/aboutneterror/netError.css)
-        content/browser/aboutneterror/info.svg         (content/aboutneterror/info.svg)
+        content/browser/aboutNetError.xhtml            (content/aboutNetError.xhtml)
 
 #ifdef MOZ_SERVICES_HEALTHREPORT
         content/browser/abouthealthreport/abouthealth.xhtml   (content/abouthealthreport/abouthealth.xhtml)
@@ -111,7 +109,7 @@ browser.jar:
         content/browser/pageinfo/security.js          (content/pageinfo/security.js)
 #ifdef MOZ_SERVICES_SYNC
         content/browser/sync/aboutSyncTabs.xul        (content/sync/aboutSyncTabs.xul)
-        content/browser/sync/aboutSyncTabs.js         (content/sync/aboutSyncTabs.js)
+*       content/browser/sync/aboutSyncTabs.js         (content/sync/aboutSyncTabs.js)
         content/browser/sync/aboutSyncTabs.css        (content/sync/aboutSyncTabs.css)
         content/browser/sync/aboutSyncTabs-bindings.xml  (content/sync/aboutSyncTabs-bindings.xml)
 *       content/browser/sync/setup.xul                (content/sync/setup.xul)
@@ -175,4 +173,4 @@ browser.jar:
 % overlay chrome://browser/content/browser.xul chrome://browser/content/report-phishing-overlay.xul
 #endif
 
-% override chrome://global/content/netError.xhtml chrome://browser/content/aboutneterror/netError.xhtml
+% override chrome://global/content/netError.xhtml chrome://browser/content/aboutNetError.xhtml
diff --git a/browser/components/customizableui/CustomizableUI.jsm b/browser/components/customizableui/CustomizableUI.jsm
index 268a6e49089..85727b90afc 100644
--- a/browser/components/customizableui/CustomizableUI.jsm
+++ b/browser/components/customizableui/CustomizableUI.jsm
@@ -1845,12 +1845,25 @@ let CustomizableUIInternal = {
     if (gInBatchStack || !gDirty) {
       return;
     }
-    let state = { placements: gPlacements,
+    // Clone because we want to modify this map:
+    let state = { placements: new Map(gPlacements),
                   seen: gSeenWidgets,
                   dirtyAreaCache: gDirtyAreaCache,
                   currentVersion: kVersion,
                   newElementCount: gNewElementCount };
 
+    // Merge in previously saved areas if not present in gPlacements.
+    // This way, state is still persisted for e.g. temporarily disabled
+    // add-ons - see bug 989338.
+    if (gSavedState && gSavedState.placements) {
+      for (let area of Object.keys(gSavedState.placements)) {
+        if (!state.placements.has(area)) {
+          let placements = gSavedState.placements[area];
+          state.placements.set(area, placements);
+        }
+      }
+    }
+
     LOG("Saving state.");
     let serialized = JSON.stringify(state, this.serializerHelper);
     LOG("State saved as: " + serialized);
diff --git a/browser/components/customizableui/test/browser.ini b/browser/components/customizableui/test/browser.ini
index 2838ce287f2..5c4721df215 100644
--- a/browser/components/customizableui/test/browser.ini
+++ b/browser/components/customizableui/test/browser.ini
@@ -104,6 +104,7 @@ skip-if = os == "linux"
 [browser_985815_propagate_setToolbarVisibility.js]
 [browser_981305_separator_insertion.js]
 [browser_988072_sidebar_events.js]
+[browser_989338_saved_placements_not_resaved.js]
 [browser_989751_subviewbutton_class.js]
 [browser_987177_destroyWidget_xul.js]
 [browser_987177_xul_wrapper_updating.js]
diff --git a/browser/components/customizableui/test/browser_989338_saved_placements_not_resaved.js b/browser/components/customizableui/test/browser_989338_saved_placements_not_resaved.js
new file mode 100644
index 00000000000..61c3567f5f4
--- /dev/null
+++ b/browser/components/customizableui/test/browser_989338_saved_placements_not_resaved.js
@@ -0,0 +1,56 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const BUTTONID = "test-widget-saved-earlier";
+const AREAID = "test-area-saved-earlier";
+
+let hadSavedState;
+function test() {
+  // Hack our way into the module to fake a saved state that isn't there...
+  let backstagePass = Cu.import("resource:///modules/CustomizableUI.jsm", {});
+  hadSavedState = backstagePass.gSavedState != null;
+  if (!hadSavedState) {
+    backstagePass.gSavedState = {placements: {}};
+  }
+  backstagePass.gSavedState.placements[AREAID] = [BUTTONID];
+  // Put bogus stuff in the saved state for the nav-bar, so as to check the current placements
+  // override this one...
+  backstagePass.gSavedState.placements[CustomizableUI.AREA_NAVBAR] = ["bogus-navbar-item"];
+
+  backstagePass.gDirty = true;
+  backstagePass.CustomizableUIInternal.saveState();
+
+  let newSavedState = JSON.parse(Services.prefs.getCharPref("browser.uiCustomization.state"));
+  let savedArea = Array.isArray(newSavedState.placements[AREAID]);
+  ok(savedArea, "Should have re-saved the state, even though the area isn't registered");
+
+  if (savedArea) {
+    placementArraysEqual(AREAID, newSavedState.placements[AREAID], [BUTTONID]);
+  }
+  ok(!backstagePass.gPlacements.has(AREAID), "Placements map shouldn't have been affected");
+
+  let savedNavbar = Array.isArray(newSavedState.placements[CustomizableUI.AREA_NAVBAR]);
+  ok(savedNavbar, "Should have saved nav-bar contents");
+  if (savedNavbar) {
+    placementArraysEqual(CustomizableUI.AREA_NAVBAR, newSavedState.placements[CustomizableUI.AREA_NAVBAR],
+                         CustomizableUI.getWidgetIdsInArea(CustomizableUI.AREA_NAVBAR));
+  }
+};
+
+registerCleanupFunction(function() {
+  let backstagePass = Cu.import("resource:///modules/CustomizableUI.jsm", {});
+  if (!hadSavedState) {
+    backstagePass.gSavedState = null;
+  } else {
+    let savedPlacements = backstagePass.gSavedState.placements;
+    delete savedPlacements[AREAID];
+    let realNavBarPlacements = CustomizableUI.getWidgetIdsInArea(CustomizableUI.AREA_NAVBAR);
+    savedPlacements[CustomizableUI.AREA_NAVBAR] = realNavBarPlacements;
+  }
+  backstagePass.gDirty = true;
+  backstagePass.CustomizableUIInternal.saveState();
+});
+
diff --git a/browser/components/places/PlacesUIUtils.jsm b/browser/components/places/PlacesUIUtils.jsm
index 842f549e034..9dd52ab31df 100644
--- a/browser/components/places/PlacesUIUtils.jsm
+++ b/browser/components/places/PlacesUIUtils.jsm
@@ -19,6 +19,13 @@ XPCOMUtils.defineLazyModuleGetter(this, "PluralForm",
 XPCOMUtils.defineLazyModuleGetter(this, "PrivateBrowsingUtils",
                                   "resource://gre/modules/PrivateBrowsingUtils.jsm");
 
+#ifdef MOZ_SERVICES_CLOUDSYNC
+XPCOMUtils.defineLazyModuleGetter(this, "CloudSync",
+                                  "resource://gre/modules/CloudSync.jsm");
+#else
+let CloudSync = null;
+#endif
+
 #ifdef MOZ_SERVICES_SYNC
 XPCOMUtils.defineLazyModuleGetter(this, "Weave",
                                   "resource://services-sync/main.js");
@@ -569,7 +576,7 @@ this.PlacesUIUtils = {
       var uriList = PlacesUtils.toISupportsString(urls.join("|"));
       var args = Cc["@mozilla.org/supports-array;1"].
                   createInstance(Ci.nsISupportsArray);
-      args.AppendElement(uriList);      
+      args.AppendElement(uriList);
       browserWindow = Services.ww.openWindow(aWindow,
                                              "chrome://browser/content/browser.xul",
                                              null, "chrome,dialog=no,all", args);
@@ -1002,17 +1009,18 @@ this.PlacesUIUtils = {
   },
 
   shouldShowTabsFromOtherComputersMenuitem: function() {
-    // If Sync isn't configured yet, then don't show the menuitem.
-    return Weave.Status.checkSetup() != Weave.CLIENT_NOT_CONFIGURED &&
-           Weave.Svc.Prefs.get("firstSync", "") != "notReady";
+    let weaveOK = Weave.Status.checkSetup() != Weave.CLIENT_NOT_CONFIGURED &&
+                  Weave.Svc.Prefs.get("firstSync", "") != "notReady";
+    let cloudSyncOK = CloudSync && CloudSync.ready && CloudSync().tabsReady && CloudSync().tabs.hasRemoteTabs();
+    return weaveOK || cloudSyncOK;
   },
 
   shouldEnableTabsFromOtherComputersMenuitem: function() {
-    // The tabs engine might never be inited (if services.sync.registerEngines
-    // is modified), so make sure we avoid undefined errors.
-    return Weave.Service.isLoggedIn &&
-           Weave.Service.engineManager.get("tabs") &&
-           Weave.Service.engineManager.get("tabs").enabled;
+    let weaveEnabled = Weave.Service.isLoggedIn &&
+                       Weave.Service.engineManager.get("tabs") &&
+                       Weave.Service.engineManager.get("tabs").enabled;
+    let cloudSyncEnabled = CloudSync && CloudSync.ready && CloudSync().tabsReady && CloudSync().tabs.hasRemoteTabs();
+    return weaveEnabled || cloudSyncEnabled;
   },
 };
 
diff --git a/browser/components/places/content/history-panel.js b/browser/components/places/content/history-panel.js
index f12f360b737..bb8f63ada4b 100644
--- a/browser/components/places/content/history-panel.js
+++ b/browser/components/places/content/history-panel.js
@@ -3,6 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+Components.utils.import("resource://gre/modules/TelemetryStopwatch.jsm");
+
 var gHistoryTree;
 var gSearchBox;
 var gHistoryGrouping = "";
@@ -79,10 +81,16 @@ function searchHistory(aInput)
   options.resultType = resultType;
   options.includeHidden = !!aInput;
 
+  if (gHistoryGrouping == "lastvisited")
+    this.TelemetryStopwatch.start("HISTORY_LASTVISITED_TREE_QUERY_TIME_MS");
+
   // call load() on the tree manually
   // instead of setting the place attribute in history-panel.xul
   // otherwise, we will end up calling load() twice
   gHistoryTree.load([query], options);
+
+  if (gHistoryGrouping == "lastvisited")
+    this.TelemetryStopwatch.finish("HISTORY_LASTVISITED_TREE_QUERY_TIME_MS");
 }
 
 window.addEventListener("SidebarFocused",
diff --git a/browser/components/places/content/places.js b/browser/components/places/content/places.js
index 3df96b063f5..6fcc5ad4b12 100644
--- a/browser/components/places/content/places.js
+++ b/browser/components/places/content/places.js
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+Components.utils.import("resource://gre/modules/TelemetryStopwatch.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "MigrationUtils",
                                   "resource:///modules/MigrationUtils.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "Task",
@@ -16,6 +17,7 @@ XPCOMUtils.defineLazyModuleGetter(this, "DownloadUtils",
                                   "resource://gre/modules/DownloadUtils.jsm");
 
 const RESTORE_FILEPICKER_FILTER_EXT = "*.json;*.jsonlz4";
+const HISTORY_LIBRARY_SEARCH_TELEMETRY = "PLACES_HISTORY_LIBRARY_SEARCH_TIME_MS";
 
 var PlacesOrganizer = {
   _places: null,
@@ -855,7 +857,9 @@ var PlacesSearchBox = {
           currentView.load([query], options);
         }
         else {
+          TelemetryStopwatch.start(HISTORY_LIBRARY_SEARCH_TELEMETRY);
           currentView.applyFilter(filterString, null, true);
+          TelemetryStopwatch.finish(HISTORY_LIBRARY_SEARCH_TELEMETRY);
         }
         break;
       case "downloads":
diff --git a/browser/components/preferences/advanced.js b/browser/components/preferences/advanced.js
index c196cdc75ef..702c2a3ba8c 100644
--- a/browser/components/preferences/advanced.js
+++ b/browser/components/preferences/advanced.js
@@ -659,7 +659,7 @@ var gAdvancedPane = {
     }
     try {
       const DRIVE_FIXED = 3;
-      const LPCWSTR = ctypes.jschar.ptr;
+      const LPCWSTR = ctypes.char16_t.ptr;
       const UINT = ctypes.uint32_t;
       let kernel32 = ctypes.open("kernel32");
       let GetDriveType = kernel32.declare("GetDriveTypeW", ctypes.default_abi, UINT, LPCWSTR);
diff --git a/browser/components/preferences/tests/browser_cookies_exceptions.js b/browser/components/preferences/tests/browser_cookies_exceptions.js
index c47c7fc3dbb..38d4ae69437 100644
--- a/browser/components/preferences/tests/browser_cookies_exceptions.js
+++ b/browser/components/preferences/tests/browser_cookies_exceptions.js
@@ -133,7 +133,9 @@ function windowLoad(event, win, dialog) {
         return;
 
       if (tests[currentTest].observances.length == 0) {
-        // Should fail here as we are not expecting a notification.
+        // Should fail here as we are not expecting a notification, but we don't.
+        // See bug 1063410.
+        return;
       }
 
       let permission = aSubject.QueryInterface(Ci.nsIPermission);
diff --git a/browser/devtools/framework/ToolboxProcess.jsm b/browser/devtools/framework/ToolboxProcess.jsm
index 9424b6679dc..1ed28e2f2d5 100644
--- a/browser/devtools/framework/ToolboxProcess.jsm
+++ b/browser/devtools/framework/ToolboxProcess.jsm
@@ -5,7 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 "use strict";
 
-const { classes: Cc, interfaces: Ci, utils: Cu } = Components;
+const { classes: Cc, interfaces: Ci, utils: Cu, results: Cr } = Components;
 
 const DBG_XUL = "chrome://browser/content/devtools/framework/toolbox-process-window.xul";
 const CHROME_DEBUGGER_PROFILE_NAME = "chrome_debugger_profile";
diff --git a/browser/devtools/framework/sidebar.js b/browser/devtools/framework/sidebar.js
index 3c17276eb05..073c3ae2af4 100644
--- a/browser/devtools/framework/sidebar.js
+++ b/browser/devtools/framework/sidebar.js
@@ -70,12 +70,16 @@ ToolSidebar.prototype = {
 
     let tab = this._tabbox.tabs.appendItem();
     tab.setAttribute("label", ""); // Avoid showing "undefined" while the tab is loading
+    tab.setAttribute("id", "sidebar-tab-" + id);
+
+    let onIFrameLoaded = (event) => {
+      let doc = event.target;
+      let win = doc.defaultView;
+      tab.setAttribute("label", doc.title);
 
-    let onIFrameLoaded = () => {
-      tab.setAttribute("label", iframe.contentDocument.title);
       iframe.removeEventListener("load", onIFrameLoaded, true);
-      if ("setPanel" in iframe.contentWindow) {
-        iframe.contentWindow.setPanel(this._toolPanel, iframe);
+      if ("setPanel" in win) {
+        win.setPanel(this._toolPanel, iframe);
       }
       this.emit(id + "-ready");
     };
@@ -109,6 +113,27 @@ ToolSidebar.prototype = {
     this.emit("new-tab-registered", id);
   },
 
+  /**
+   * Remove an existing tab.
+   */
+  removeTab: function(id) {
+    let tab = this._tabbox.tabs.querySelector("tab#sidebar-tab-" + id);
+    if (!tab) {
+      return;
+    }
+
+    tab.remove();
+
+    let panel = this.getTab(id);
+    if (panel) {
+      panel.remove();
+    }
+
+    this._tabs.delete(id);
+
+    this.emit("tab-unregistered", id);
+  },
+
   /**
    * Select a specific tab.
    */
diff --git a/browser/devtools/framework/test/browser_toolbox_sidebar.js b/browser/devtools/framework/test/browser_toolbox_sidebar.js
index f9ec0611179..752580da995 100644
--- a/browser/devtools/framework/test/browser_toolbox_sidebar.js
+++ b/browser/devtools/framework/test/browser_toolbox_sidebar.js
@@ -108,6 +108,7 @@ function test() {
     for (let tab of tabs) {
       is(tab.getAttribute("label"), label++, "Tab has the right title");
     }
+
     is(label, 4, "Found the right amount of tabs.");
     is(panel.sidebar._tabbox.selectedPanel, panels[0], "First tab is selected");
     ok(panel.sidebar.getCurrentTabID(), "tab1", "getCurrentTabID() is correct");
@@ -119,13 +120,32 @@ function test() {
         panel.sidebar.hide();
         is(panel.sidebar._tabbox.getAttribute("hidden"), "true", "Sidebar hidden");
         is(panel.sidebar.getWindowForTab("tab1").location.href, tab1URL, "Window is accessible");
-        testWidth(panel);
+        testRemoval(panel);
       });
     });
 
     panel.sidebar.select("tab2");
   }
 
+  function testRemoval(panel) {
+    panel.sidebar.once("tab-unregistered", function(event, id) {
+      info(event);
+      registeredTabs[id] = false;
+
+      is(id, "tab3", "The right tab must be removed");
+
+      let tabs = panel.sidebar._tabbox.querySelectorAll("tab");
+      let panels = panel.sidebar._tabbox.querySelectorAll("tabpanel");
+
+      is(tabs.length, 2, "There is the right number of tabs");
+      is(panels.length, 2, "There is the right number of panels");
+
+      testWidth(panel);
+    });
+
+    panel.sidebar.removeTab("tab3");
+  }
+
   function testWidth(panel) {
     let tabbox = panel.panelDoc.getElementById("sidebar");
     tabbox.width = 420;
diff --git a/browser/devtools/framework/toolbox.js b/browser/devtools/framework/toolbox.js
index a92427e81a4..37b2208d50f 100644
--- a/browser/devtools/framework/toolbox.js
+++ b/browser/devtools/framework/toolbox.js
@@ -1520,7 +1520,9 @@ Toolbox.prototype = {
     this._telemetry.toolClosed("toolbox");
     this._telemetry.destroy();
 
-    return this._destroyer = promise.all(outstanding).then(() => {
+    // Finish all outstanding tasks (successfully or not) before destroying the
+    // target.
+    this._destroyer = promise.all(outstanding).then(null, console.error).then(() => {
       // Targets need to be notified that the toolbox is being torn down.
       // This is done after other destruction tasks since it may tear down
       // fronts and the debugger transport which earlier destroy methods may
@@ -1533,7 +1535,7 @@ Toolbox.prototype = {
       this.highlighterUtils.release();
       target.off("close", this.destroy);
       return target.destroy();
-    }).then(() => {
+    }, console.error).then(() => {
       this.emit("destroyed");
 
       // We need to grab a reference to win before this._host is destroyed.
@@ -1552,6 +1554,20 @@ Toolbox.prototype = {
            .garbageCollect();
       }
     }).then(null, console.error);
+
+    let leakCheckObserver = ({wrappedJSObject: barrier}) => {
+      // Make the leak detector wait until this toolbox is properly destroyed.
+      barrier.client.addBlocker("DevTools: Wait until toolbox is destroyed",
+                                this._destroyer);
+    };
+
+    let topic = "shutdown-leaks-before-check";
+    Services.obs.addObserver(leakCheckObserver, topic, false);
+    this._destroyer.then(() => {
+      Services.obs.removeObserver(leakCheckObserver, topic);
+    });
+
+    return this._destroyer;
   },
 
   _highlighterReady: function() {
diff --git a/browser/devtools/inspector/inspector-panel.js b/browser/devtools/inspector/inspector-panel.js
index db742577381..b3e343ce01c 100644
--- a/browser/devtools/inspector/inspector-panel.js
+++ b/browser/devtools/inspector/inspector-panel.js
@@ -736,6 +736,19 @@ InspectorPanel.prototype = {
     }
   },
 
+  /**
+   * Show DOM properties
+   */
+  showDOMProperties: function InspectorPanel_showDOMProperties() {
+    this._toolbox.openSplitConsole().then(() => {
+      let panel = this._toolbox.getPanel("webconsole");
+      let jsterm = panel.hud.jsterm;
+
+      jsterm.execute("inspect($0)");
+      jsterm.focusInput();
+    });
+  },
+
   /**
    * Clear any pseudo-class locks applied to the current hierarchy.
    */
diff --git a/browser/devtools/inspector/inspector.xul b/browser/devtools/inspector/inspector.xul
index dfae344d029..f4be54f26ea 100644
--- a/browser/devtools/inspector/inspector.xul
+++ b/browser/devtools/inspector/inspector.xul
@@ -55,6 +55,9 @@
       <menuitem id="node-menu-copyimagedatauri"
         label="&inspectorCopyImageDataUri.label;"
         oncommand="inspector.copyImageDataUri()"/>
+      <menuitem id="node-menu-showdomproperties"
+        label="&inspectorShowDOMProperties.label;"
+        oncommand="inspector.showDOMProperties()"/>
       <menuseparator/>
       <menuitem id="node-menu-pasteouterhtml"
         label="&inspectorHTMLPasteOuter.label;"
diff --git a/browser/devtools/inspector/test/browser_inspector_menu.js b/browser/devtools/inspector/test/browser_inspector_menu.js
index 4c53a60449a..8c7184be8e7 100644
--- a/browser/devtools/inspector/test/browser_inspector_menu.js
+++ b/browser/devtools/inspector/test/browser_inspector_menu.js
@@ -80,11 +80,12 @@ registerCleanupFunction(() => {
 });
 
 let test = asyncTest(function* () {
-  let { inspector } = yield openInspectorForURL(TEST_URL);
+  let { inspector, toolbox } = yield openInspectorForURL(TEST_URL);
 
   yield testMenuItemSensitivity();
   yield testPasteOuterHTMLMenuItemSensitivity();
   yield testCopyMenuItems();
+  yield testShowDOMProperties();
   yield testPasteOuterHTMLMenu();
   yield testDeleteNode();
   yield testDeleteRootNode();
@@ -154,6 +155,27 @@ let test = asyncTest(function* () {
     }
   }
 
+  function* testShowDOMProperties() {
+    info("Testing 'Show DOM Properties' menu item.");
+    let showDOMPropertiesNode = inspector.panelDoc.getElementById("node-menu-showdomproperties");
+    ok(showDOMPropertiesNode, "the popup menu has a show dom properties item");
+
+    let consoleOpened = toolbox.once("webconsole-ready");
+
+    info("Triggering 'Show DOM Properties' and waiting for inspector open");
+    dispatchCommandEvent(showDOMPropertiesNode);
+    yield consoleOpened;
+
+    let webconsoleUI = toolbox.getPanel("webconsole").hud.ui;
+    let messagesAdded = webconsoleUI.once("messages-added");
+    yield messagesAdded;
+
+    info("Checking if 'inspect($0)' was evaluated");
+    ok(webconsoleUI.jsterm.history[0] === 'inspect($0)');
+
+    yield toolbox.toggleSplitConsole();
+  }
+
   function* testPasteOuterHTMLMenu() {
     info("Testing that 'Paste Outer HTML' menu item works.");
     clipboard.set("this was pasted");
diff --git a/browser/devtools/markupview/markup-view.css b/browser/devtools/markupview/markup-view.css
index a5d7dff360d..15a3d526c7a 100644
--- a/browser/devtools/markupview/markup-view.css
+++ b/browser/devtools/markupview/markup-view.css
@@ -36,6 +36,9 @@
 .html-editor-inner {
   border: solid .1px;
   flex: 1 1 main-size;
+
+  /* Keep the editor away from the markup view floating scrollbars */
+  -moz-margin-end: 12px;
 }
 
 .html-editor iframe {
diff --git a/browser/devtools/shared/widgets/TableWidget.js b/browser/devtools/shared/widgets/TableWidget.js
index a8ca10b3be6..cd189fdc365 100644
--- a/browser/devtools/shared/widgets/TableWidget.js
+++ b/browser/devtools/shared/widgets/TableWidget.js
@@ -593,7 +593,7 @@ Column.prototype = {
    * Selects the row at the `index` index
    */
   selectRowAt: function(index) {
-    if (this.selectedRow) {
+    if (this.selectedRow != null) {
       this.cells[this.items[this.selectedRow]].toggleClass("theme-selected");
     }
     if (index < 0) {
@@ -930,7 +930,7 @@ Cell.prototype = {
 
   set value(value) {
     this._value = value;
-    if (!value) {
+    if (value == null) {
       this.label.setAttribute("value", "");
       return;
     }
diff --git a/browser/devtools/tilt/test/browser_tilt_02_notifications-tabs.js b/browser/devtools/tilt/test/browser_tilt_02_notifications-tabs.js
index 435af263cf5..980a499c209 100644
--- a/browser/devtools/tilt/test/browser_tilt_02_notifications-tabs.js
+++ b/browser/devtools/tilt/test/browser_tilt_02_notifications-tabs.js
@@ -17,6 +17,10 @@ function notification(win, topic) {
   }
 
   let { notification, window } = expected.shift();
+  if (Cu.isDeadWrapper(window)) {
+    // Sometimes we end up with a nuked window reference here :-(
+    return;
+  }
   is(topic, notification, "Saw the expected notification");
   is(win, window, "Saw the expected window");
 }
diff --git a/browser/devtools/webconsole/console-output.js b/browser/devtools/webconsole/console-output.js
index 681783a06b9..4dc34edefd2 100644
--- a/browser/devtools/webconsole/console-output.js
+++ b/browser/devtools/webconsole/console-output.js
@@ -1785,6 +1785,12 @@ Messages.ConsoleTable.prototype = Heritage.extend(Messages.Extended.prototype,
             this._columns["_index"] = l10n.getStr("table.index");
           }
 
+          if (data.class == "Array") {
+            if (index == parseInt(index)) {
+              index = parseInt(index);
+            }
+          }
+
           let property = ownProperties[index].value;
           let item = { _index: index };
 
@@ -1832,10 +1838,9 @@ Messages.ConsoleTable.prototype = Heritage.extend(Messages.Extended.prototype,
       }
 
       let rowCount = 0;
-      for (let index of Object.keys(entries || {})) {
-        let [key, value] = entries[index];
+      for (let [key, value] of entries) {
         let item = {
-          _index: index,
+          _index: rowCount,
           _key: this._renderValueGrip(key, { concise: true }),
           _value: this._renderValueGrip(value, { concise: true })
         };
@@ -1857,11 +1862,10 @@ Messages.ConsoleTable.prototype = Heritage.extend(Messages.Extended.prototype,
       }
 
       let rowCount = 0;
-      for (let index of Object.keys(entries || {})) {
-        let value = entries[index];
+      for (let entry of entries) {
         let item = {
-          _index : index,
-          _value: this._renderValueGrip(value, { concise: true })
+          _index : rowCount,
+          _value: this._renderValueGrip(entry, { concise: true })
         };
 
         this._data.push(item);
diff --git a/browser/devtools/webconsole/test/browser_webconsole_output_table.js b/browser/devtools/webconsole/test/browser_webconsole_output_table.js
index d1fbdd8dfcd..1d73e1fe3be 100644
--- a/browser/devtools/webconsole/test/browser_webconsole_output_table.js
+++ b/browser/devtools/webconsole/test/browser_webconsole_output_table.js
@@ -12,27 +12,27 @@ const TEST_DATA = [
   {
     command: "console.table(languages1)",
     data: [
-        { _index: "0", name: "\"JavaScript\"", fileExtension: "Array[1]" },
-        { _index: "1", name: "Object", fileExtension: "\".ts\"" },
-        { _index: "2", name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
+        { _index: 0, name: "\"JavaScript\"", fileExtension: "Array[1]" },
+        { _index: 1, name: "Object", fileExtension: "\".ts\"" },
+        { _index: 2, name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
     ],
     columns: { _index: "(index)", name: "name", fileExtension: "fileExtension" }
   },
   {
     command: "console.table(languages1, 'name')",
     data: [
-        { _index: "0", name: "\"JavaScript\"", fileExtension: "Array[1]" },
-        { _index: "1", name: "Object", fileExtension: "\".ts\"" },
-        { _index: "2", name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
+        { _index: 0, name: "\"JavaScript\"", fileExtension: "Array[1]" },
+        { _index: 1, name: "Object", fileExtension: "\".ts\"" },
+        { _index: 2, name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
     ],
     columns: { _index: "(index)", name: "name" }
   },
   {
     command: "console.table(languages1, ['name'])",
     data: [
-        { _index: "0", name: "\"JavaScript\"", fileExtension: "Array[1]" },
-        { _index: "1", name: "Object", fileExtension: "\".ts\"" },
-        { _index: "2", name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
+        { _index: 0, name: "\"JavaScript\"", fileExtension: "Array[1]" },
+        { _index: 1, name: "Object", fileExtension: "\".ts\"" },
+        { _index: 2, name: "\"CoffeeScript\"", fileExtension: "\".coffee\"" }
     ],
     columns: { _index: "(index)", name: "name" }
   },
@@ -47,8 +47,8 @@ const TEST_DATA = [
   {
     command: "console.table([[1, 2], [3, 4]])",
     data: [
-      { _index: "0", 0: "1", 1: "2" },
-      { _index: "1", 0: "3", 1: "4" }
+      { _index: 0, 0: "1", 1: "2" },
+      { _index: 1, 0: "3", 1: "4" }
     ],
     columns: { _index: "(index)", 0: "0", 1: "1" }
   },
@@ -93,19 +93,19 @@ const TEST_DATA = [
   {
     command: "console.table(mySet)",
     data: [
-      { _index: "0", _value: "1" },
-      { _index: "1", _value: "5" },
-      { _index: "2", _value: "\"some text\"" },
-      { _index: "3", _value: "null" },
-      { _index: "4", _value: "undefined" }
+      { _index: 0, _value: "1" },
+      { _index: 1, _value: "5" },
+      { _index: 2, _value: "\"some text\"" },
+      { _index: 3, _value: "null" },
+      { _index: 4, _value: "undefined" }
     ],
     columns: { _index: "(iteration index)", _value: "Values" }
   },
   {
     command: "console.table(myMap)",
     data: [
-      { _index: "0", _key: "\"a string\"", _value: "\"value associated with 'a string'\"" },
-      { _index: "1", _key: "5", _value: "\"value associated with 5\"" },
+      { _index: 0, _key: "\"a string\"", _value: "\"value associated with 'a string'\"" },
+      { _index: 1, _key: "5", _value: "\"value associated with 5\"" },
     ],
     columns: { _index: "(iteration index)", _key: "Key", _value: "Values" }
   }
diff --git a/browser/devtools/webide/themes/webide.css b/browser/devtools/webide/themes/webide.css
index 4410ddbe662..09c7544a5e3 100644
--- a/browser/devtools/webide/themes/webide.css
+++ b/browser/devtools/webide/themes/webide.css
@@ -67,6 +67,8 @@ window.busy-determined #action-busy-undetermined {
 
 #project-panel-button {
   -moz-box-pack: start;
+  width: 150px;
+  max-width: 150px;
 }
 
 #project-panel-button > .panel-button-image {
@@ -86,6 +88,7 @@ window.busy-determined #action-busy-undetermined {
 }
 
 #project-panel-button > .panel-button-label {
+  width: 150px;
   max-width: 150px;
 }
 
diff --git a/browser/locales/en-US/chrome/browser/devtools/inspector.dtd b/browser/locales/en-US/chrome/browser/devtools/inspector.dtd
index 27efa3718c8..b05ffa52b5d 100644
--- a/browser/locales/en-US/chrome/browser/devtools/inspector.dtd
+++ b/browser/locales/en-US/chrome/browser/devtools/inspector.dtd
@@ -22,3 +22,5 @@
 <!ENTITY inspectorSearchHTML.key            "F">
 
 <!ENTITY inspectorCopyImageDataUri.label       "Copy Image Data-URL">
+
+<!ENTITY inspectorShowDOMProperties.label       "Show DOM Properties">
diff --git a/browser/metro/base/content/sanitize.js b/browser/metro/base/content/sanitize.js
index 94eacfee02e..aa177c7753c 100644
--- a/browser/metro/base/content/sanitize.js
+++ b/browser/metro/base/content/sanitize.js
@@ -134,6 +134,11 @@ Sanitizer.prototype = {
         for each (var host in hosts) {
           pwmgr.setLoginSavingEnabled(host, true);
         }
+
+        // Clear site security settings
+        var sss = Cc["@mozilla.org/ssservice;1"]
+                    .getService(Ci.nsISiteSecurityService);
+        sss.clearAll();
       },
 
       get canClear()
diff --git a/browser/metro/components/LoginManagerPrompter.js b/browser/metro/components/LoginManagerPrompter.js
index 0689a1702a4..f21538714fe 100644
--- a/browser/metro/components/LoginManagerPrompter.js
+++ b/browser/metro/components/LoginManagerPrompter.js
@@ -123,6 +123,12 @@ LoginManagerPrompter.prototype = {
     },
 
 
+    setE10sData : function (aBrowser) {
+      // XXX Implement me!
+      throw new Error("Not Yet Implemented");
+    },
+
+
     /*
      * promptToSavePassword
      *
diff --git a/browser/metro/profile/metro.js b/browser/metro/profile/metro.js
index 3cb38e0f09d..d57bb276323 100644
--- a/browser/metro/profile/metro.js
+++ b/browser/metro/profile/metro.js
@@ -57,7 +57,7 @@ pref("apz.x_skate_size_multiplier", "2.5");
 pref("apz.y_skate_size_multiplier", "2.5");
 pref("apz.min_skate_speed", "10.0");
 // 0 = free, 1 = standard, 2 = sticky
-pref("apz.axis_lock_mode", 2);
+pref("apz.axis_lock.mode", 2);
 pref("apz.cross_slide.enabled", true);
 pref("apz.subframe.enabled", true);
 
diff --git a/browser/modules/ContentSearch.jsm b/browser/modules/ContentSearch.jsm
index ebb9b0daf0e..02a1a8616ce 100644
--- a/browser/modules/ContentSearch.jsm
+++ b/browser/modules/ContentSearch.jsm
@@ -87,21 +87,30 @@ this.ContentSearch = {
   // { controller, previousFormHistoryResult }.  See _onMessageGetSuggestions.
   _suggestionMap: new WeakMap(),
 
+  // Resolved when we finish shutting down.
+  _destroyedPromise: null,
+
   init: function () {
     Cc["@mozilla.org/globalmessagemanager;1"].
       getService(Ci.nsIMessageListenerManager).
       addMessageListener(INBOUND_MESSAGE, this);
     Services.obs.addObserver(this, "browser-search-engine-modified", false);
+    Services.obs.addObserver(this, "shutdown-leaks-before-check", false);
   },
 
   destroy: function () {
+    if (this._destroyedPromise) {
+      return this._destroyedPromise;
+    }
+
     Cc["@mozilla.org/globalmessagemanager;1"].
       getService(Ci.nsIMessageListenerManager).
       removeMessageListener(INBOUND_MESSAGE, this);
     Services.obs.removeObserver(this, "browser-search-engine-modified");
+    Services.obs.removeObserver(this, "shutdown-leaks-before-check");
 
     this._eventQueue.length = 0;
-    return Promise.resolve(this._currentEventPromise);
+    return this._destroyedPromise = Promise.resolve(this._currentEventPromise);
   },
 
   /**
@@ -148,6 +157,10 @@ this.ContentSearch = {
       });
       this._processEventQueue();
       break;
+    case "shutdown-leaks-before-check":
+      subj.wrappedJSObject.client.addBlocker(
+        "ContentSearch: Wait until the service is destroyed", () => this.destroy());
+      break;
     }
   },
 
diff --git a/browser/modules/test/browser_ContentSearch.js b/browser/modules/test/browser_ContentSearch.js
index 4bee1a73499..c4629860dee 100644
--- a/browser/modules/test/browser_ContentSearch.js
+++ b/browser/modules/test/browser_ContentSearch.js
@@ -45,7 +45,7 @@ add_task(function* SetCurrentEngine() {
     info("Test observed " + data);
     if (data == "engine-current") {
       ok(true, "Test observed engine-current");
-      Services.obs.removeObserver(obs, "browser-search-engine-modified", false);
+      Services.obs.removeObserver(obs, "browser-search-engine-modified");
       deferred.resolve();
     }
   }, "browser-search-engine-modified", false);
@@ -188,6 +188,7 @@ add_task(function* GetSuggestions_AddFormHistoryEntry_RemoveFormHistoryEntry() {
   let deferred = Promise.defer();
   Services.obs.addObserver(function onAdd(subj, topic, data) {
     if (data == "formhistory-add") {
+      Services.obs.removeObserver(onAdd, "satchel-storage-changed");
       executeSoon(() => deferred.resolve());
     }
   }, "satchel-storage-changed", false);
@@ -224,6 +225,7 @@ add_task(function* GetSuggestions_AddFormHistoryEntry_RemoveFormHistoryEntry() {
   deferred = Promise.defer();
   Services.obs.addObserver(function onRemove(subj, topic, data) {
     if (data == "formhistory-remove") {
+      Services.obs.removeObserver(onRemove, "satchel-storage-changed");
       executeSoon(() => deferred.resolve());
     }
   }, "satchel-storage-changed", false);
diff --git a/browser/modules/test/browser_SignInToWebsite.js b/browser/modules/test/browser_SignInToWebsite.js
index d562234fe47..e3a417045de 100644
--- a/browser/modules/test/browser_SignInToWebsite.js
+++ b/browser/modules/test/browser_SignInToWebsite.js
@@ -255,7 +255,8 @@ function test_auth() {
 
   let winObs = new WindowObserver(function(authWin) {
     ok(authWin, "Authentication window opened");
-    ok(authWin.contentWindow.location);
+    // See bug 1063404.
+    // ok(authWin.location);
   });
 
   Services.ww.registerNotification(winObs);
diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn
index e60fd8d1ccb..faba4c43bbd 100644
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -14,6 +14,7 @@ browser.jar:
   skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
   skin/classic/browser/aboutCertError_sectionExpanded.png
   skin/classic/browser/aboutNetError.css                        (../shared/aboutNetError.css)
+  skin/classic/browser/aboutNetError_info.svg                   (../shared/aboutNetError_info.svg)
   skin/classic/browser/aboutSocialError.css
 #ifdef MOZ_SERVICES_SYNC
   skin/classic/browser/aboutSyncTabs.css
diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn
index ca4733382d0..25abe78e440 100644
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -6,6 +6,7 @@ browser.jar:
 % skin browser classic/1.0 %skin/classic/browser/
   skin/classic/browser/sanitizeDialog.css                   (sanitizeDialog.css)
   skin/classic/browser/aboutNetError.css                    (../shared/aboutNetError.css)
+  skin/classic/browser/aboutNetError_info.svg               (../shared/aboutNetError_info.svg)
 * skin/classic/browser/aboutSessionRestore.css              (aboutSessionRestore.css)
   skin/classic/browser/aboutSessionRestore-window-icon.png
   skin/classic/browser/aboutWelcomeBack.css                 (../shared/aboutWelcomeBack.css)
diff --git a/browser/themes/shared/aboutNetError.css b/browser/themes/shared/aboutNetError.css
index 66c2acfc468..71da6fbf795 100644
--- a/browser/themes/shared/aboutNetError.css
+++ b/browser/themes/shared/aboutNetError.css
@@ -1 +1,69 @@
-/* This deliberately left empty for themes to use/override. */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+@import url("chrome://global/skin/in-content/common.css");
+
+body {
+  display: flex;
+  box-sizing: padding-box;
+  min-height: 100vh;
+  padding: 0 48px;
+  align-items: center;
+  justify-content: center;
+}
+
+ul, ol {
+  margin: 0;
+  padding: 0;
+  -moz-margin-start: 1em;
+}
+
+ul > li, ol > li {
+  margin-bottom: .5em;
+}
+
+ul {
+  list-style: disc;
+}
+
+#errorPageContainer {
+  min-width: 320px;
+  max-width: 512px;
+}
+
+#errorTitleText {
+  background: url("aboutNetError_info.svg") left 0 no-repeat;
+  background-size: 1.2em;
+  -moz-margin-start: -2em;
+  -moz-padding-start: 2em;
+}
+
+#errorTitleText:-moz-dir(rtl) {
+  background-position: right 0;
+}
+
+#errorTryAgain {
+  margin-top: 1.2em;
+  min-width: 150px
+}
+
+#errorContainer {
+  display: none;
+}
+
+@media (max-width: 675px) {
+  #errorTitleText {
+    padding-top: 0;
+    background-image: none;
+    -moz-padding-start: 0;
+    -moz-margin-start: 0;
+  }
+}
+
+/* Pressing the retry button will cause the cursor to flicker from a pointer to
+ * not-allowed. Override the disabled cursor behaviour since we will never show
+ * the button disabled as the initial state. */
+button:disabled {
+  cursor: pointer;
+}
diff --git a/browser/base/content/aboutneterror/info.svg b/browser/themes/shared/aboutNetError_info.svg
similarity index 100%
rename from browser/base/content/aboutneterror/info.svg
rename to browser/themes/shared/aboutNetError_info.svg
diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn
index a9f3825ae9b..19b72ad38e6 100644
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -16,6 +16,7 @@ browser.jar:
         skin/classic/browser/aboutCertError_sectionCollapsed-rtl.png
         skin/classic/browser/aboutCertError_sectionExpanded.png
         skin/classic/browser/aboutNetError.css                       (../shared/aboutNetError.css)
+        skin/classic/browser/aboutNetError_info.svg                  (../shared/aboutNetError_info.svg)
         skin/classic/browser/aboutSocialError.css
 #ifdef MOZ_SERVICES_SYNC
         skin/classic/browser/aboutSyncTabs.css
@@ -430,6 +431,7 @@ browser.jar:
         skin/classic/aero/browser/aboutCertError_sectionCollapsed-rtl.png
         skin/classic/aero/browser/aboutCertError_sectionExpanded.png
         skin/classic/aero/browser/aboutNetError.css                   (../shared/aboutNetError.css)
+        skin/classic/aero/browser/aboutNetError_info.svg              (../shared/aboutNetError_info.svg)
         skin/classic/aero/browser/aboutSocialError.css
 #ifdef MOZ_SERVICES_SYNC
         skin/classic/aero/browser/aboutSyncTabs.css
diff --git a/build/autoconf/android.m4 b/build/autoconf/android.m4
index 27cb924447b..8862a73b5c0 100644
--- a/build/autoconf/android.m4
+++ b/build/autoconf/android.m4
@@ -250,6 +250,45 @@ AC_SUBST([STLPORT_LIBS])
 
 ])
 
+AC_DEFUN([MOZ_ANDROID_GOOGLE_PLAY_SERVICES],
+[
+
+if test -n "$MOZ_NATIVE_DEVICES" ; then
+    AC_SUBST(MOZ_NATIVE_DEVICES)
+
+    AC_MSG_CHECKING([for google play services])
+    GOOGLE_PLAY_SERVICES_LIB="${ANDROID_SDK_ROOT}/extras/google/google_play_services/libproject/google-play-services_lib/libs/google-play-services.jar"
+    GOOGLE_PLAY_SERVICES_RES="${ANDROID_SDK_ROOT}/extras/google/google_play_services/libproject/google-play-services_lib/res"
+    AC_SUBST(GOOGLE_PLAY_SERVICES_LIB)
+    AC_SUBST(GOOGLE_PLAY_SERVICES_RES)
+    if ! test -e $GOOGLE_PLAY_SERVICES_LIB ; then
+        AC_MSG_ERROR([You must download Google Play Services to build with native video casting support enabled.  Run the Android SDK tool and install Google Play Services under Extras.  See http://developer.android.com/google/play-services/setup.html for more info. (looked for $GOOGLE_PLAY_SERVICES_LIB) ])
+    fi
+    AC_MSG_RESULT([$GOOGLE_PLAY_SERVICES_LIB])
+
+    ANDROID_APPCOMPAT_LIB="$ANDROID_COMPAT_DIR_BASE/v7/appcompat/libs/android-support-v7-appcompat.jar"
+    ANDROID_APPCOMPAT_RES="$ANDROID_COMPAT_DIR_BASE/v7/appcompat/res"
+    AC_MSG_CHECKING([for v7 appcompat library])
+    if ! test -e $ANDROID_APPCOMPAT_LIB ; then
+        AC_MSG_ERROR([You must download the v7 app compat Android support library when targeting Android with native video casting support enabled.  Run the Android SDK tool and install Android Support Library under Extras.  See https://developer.android.com/tools/extras/support-library.html for more info. (looked for $ANDROID_APPCOMPAT_LIB)])
+    fi
+    AC_MSG_RESULT([$ANDROID_APPCOMPAT_LIB])
+    AC_SUBST(ANDROID_APPCOMPAT_LIB)
+    AC_SUBST(ANDROID_APPCOMPAT_RES)
+
+    ANDROID_MEDIAROUTER_LIB="$ANDROID_COMPAT_DIR_BASE/v7/mediarouter/libs/android-support-v7-mediarouter.jar"
+    ANDROID_MEDIAROUTER_RES="$ANDROID_COMPAT_DIR_BASE/v7/mediarouter/res"
+    AC_MSG_CHECKING([for v7 mediarouter library])
+    if ! test -e $ANDROID_MEDIAROUTER_LIB ; then
+        AC_MSG_ERROR([You must download the v7 media router Android support library when targeting Android with native video casting support enabled.  Run the Android SDK tool and install Android Support Library under Extras.  See https://developer.android.com/tools/extras/support-library.html for more info. (looked for $ANDROID_MEDIAROUTER_LIB)])
+    fi
+    AC_MSG_RESULT([$ANDROID_MEDIAROUTER_LIB])
+    AC_SUBST(ANDROID_MEDIAROUTER_LIB)
+    AC_SUBST(ANDROID_MEDIAROUTER_RES)
+fi
+
+])
+
 AC_DEFUN([MOZ_ANDROID_SDK],
 [
 
@@ -347,40 +386,6 @@ case "$target" in
     fi
     AC_MSG_RESULT([$ANDROID_COMPAT_LIB])
 
-    if test -n "$MOZ_NATIVE_DEVICES" ; then
-        AC_SUBST(MOZ_NATIVE_DEVICES)
-
-        AC_MSG_CHECKING([for google play services])
-        GOOGLE_PLAY_SERVICES_LIB="${ANDROID_SDK_ROOT}/extras/google/google_play_services/libproject/google-play-services_lib/libs/google-play-services.jar"
-        GOOGLE_PLAY_SERVICES_RES="${ANDROID_SDK_ROOT}/extras/google/google_play_services/libproject/google-play-services_lib/res"
-        AC_SUBST(GOOGLE_PLAY_SERVICES_LIB)
-        AC_SUBST(GOOGLE_PLAY_SERVICES_RES)
-        if ! test -e $GOOGLE_PLAY_SERVICES_LIB ; then
-            AC_MSG_ERROR([You must download Google Play Services to build with native video casting support enabled.  Run the Android SDK tool and install Google Play Services under Extras.  See http://developer.android.com/google/play-services/setup.html for more info. (looked for $GOOGLE_PLAY_SERVICES_LIB) ])
-        fi
-        AC_MSG_RESULT([$GOOGLE_PLAY_SERVICES_LIB])
-
-        ANDROID_APPCOMPAT_LIB="$ANDROID_COMPAT_DIR_BASE/v7/appcompat/libs/android-support-v7-appcompat.jar"
-        ANDROID_APPCOMPAT_RES="$ANDROID_COMPAT_DIR_BASE/v7/appcompat/res"
-        AC_MSG_CHECKING([for v7 appcompat library])
-        if ! test -e $ANDROID_APPCOMPAT_LIB ; then
-            AC_MSG_ERROR([You must download the v7 app compat Android support library when targeting Android with native video casting support enabled.  Run the Android SDK tool and install Android Support Library under Extras.  See https://developer.android.com/tools/extras/support-library.html for more info. (looked for $ANDROID_APPCOMPAT_LIB)])
-        fi
-        AC_MSG_RESULT([$ANDROID_APPCOMPAT_LIB])
-        AC_SUBST(ANDROID_APPCOMPAT_LIB)
-        AC_SUBST(ANDROID_APPCOMPAT_RES)
-
-        ANDROID_MEDIAROUTER_LIB="$ANDROID_COMPAT_DIR_BASE/v7/mediarouter/libs/android-support-v7-mediarouter.jar"
-        ANDROID_MEDIAROUTER_RES="$ANDROID_COMPAT_DIR_BASE/v7/mediarouter/res"
-        AC_MSG_CHECKING([for v7 mediarouter library])
-        if ! test -e $ANDROID_MEDIAROUTER_LIB ; then
-            AC_MSG_ERROR([You must download the v7 media router Android support library when targeting Android with native video casting support enabled.  Run the Android SDK tool and install Android Support Library under Extras.  See https://developer.android.com/tools/extras/support-library.html for more info. (looked for $ANDROID_MEDIAROUTER_LIB)])
-        fi
-        AC_MSG_RESULT([$ANDROID_MEDIAROUTER_LIB])
-        AC_SUBST(ANDROID_MEDIAROUTER_LIB)
-        AC_SUBST(ANDROID_MEDIAROUTER_RES)
-    fi
-
     dnl Google has a history of moving the Android tools around.  We don't
     dnl care where they are, so let's try to find them anywhere we can.
     ALL_ANDROID_TOOLS_PATHS="$ANDROID_TOOLS:$ANDROID_BUILD_TOOLS:$ANDROID_PLATFORM_TOOLS"
@@ -408,6 +413,16 @@ case "$target" in
     ;;
 esac
 
+MOZ_ARG_ENABLE_BOOL(android-resource-constrained,
+[  --enable-android-resource-constrained
+                          exclude hi-res images and similar from the final APK],
+    MOZ_ANDROID_RESOURCE_CONSTRAINED=1)
+
+if test -n "$MOZ_ANDROID_RESOURCE_CONSTRAINED"; then
+    AC_DEFINE(MOZ_ANDROID_RESOURCE_CONSTRAINED, $MOZ_ANDROID_RESOURCE_CONSTRAINED)
+    AC_SUBST(MOZ_ANDROID_RESOURCE_CONSTRAINED)
+fi
+
 MOZ_ARG_WITH_STRING(android-min-sdk,
 [  --with-android-min-sdk=[VER]     Impose a minimum Firefox for Android SDK version],
 [ MOZ_ANDROID_MIN_SDK_VERSION=$withval ])
@@ -428,10 +443,12 @@ if test -n "$MOZ_ANDROID_MIN_SDK_VERSION"; then
     fi
 
     AC_DEFINE_UNQUOTED(MOZ_ANDROID_MIN_SDK_VERSION, $MOZ_ANDROID_MIN_SDK_VERSION)
+    AC_SUBST(MOZ_ANDROID_MIN_SDK_VERSION)
 fi
 
 if test -n "$MOZ_ANDROID_MAX_SDK_VERSION"; then
     AC_DEFINE_UNQUOTED(MOZ_ANDROID_MAX_SDK_VERSION, $MOZ_ANDROID_MAX_SDK_VERSION)
+    AC_SUBST(MOZ_ANDROID_MAX_SDK_VERSION)
 fi
 
 ])
diff --git a/build/automation.py.in b/build/automation.py.in
index d3cfa972632..ac4fa28a239 100644
--- a/build/automation.py.in
+++ b/build/automation.py.in
@@ -684,7 +684,7 @@ class Automation(object):
         import fix_stack_using_bpsyms as stackFixerModule
         stackFixerFunction = lambda line: stackFixerModule.fixSymbols(line, symbolsPath)
         del sys.path[0]
-      elif self.IS_DEBUG_BUILD and self.IS_MAC and False:
+      elif self.IS_DEBUG_BUILD and self.IS_MAC:
         # Run each line through a function in fix_macosx_stack.py (uses atos)
         sys.path.insert(0, utilityPath)
         import fix_macosx_stack as stackFixerModule
diff --git a/build/mobile/remoteautomation.py b/build/mobile/remoteautomation.py
index 1bee7668e7f..59806cefdfd 100644
--- a/build/mobile/remoteautomation.py
+++ b/build/mobile/remoteautomation.py
@@ -126,7 +126,8 @@ class RemoteAutomation(Automation):
                 self.deleteANRs()
             except DMError:
                 print "Error pulling %s" % traces
-                pass
+            except IOError:
+                print "Error pulling %s" % traces
         else:
             print "%s not found" % traces
 
diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
index c2825ffac72..e85c9f89dd8 100644
--- a/caps/nsScriptSecurityManager.cpp
+++ b/caps/nsScriptSecurityManager.cpp
@@ -33,6 +33,7 @@
 #include "nsTextFormatter.h"
 #include "nsIStringBundle.h"
 #include "nsNetUtil.h"
+#include "nsIEffectiveTLDService.h"
 #include "nsIProperties.h"
 #include "nsDirectoryServiceDefs.h"
 #include "nsIFile.h"
@@ -580,6 +581,35 @@ DenyAccessIfURIHasFlags(nsIURI* aURI, uint32_t aURIFlags)
     return NS_OK;
 }
 
+static bool
+EqualOrSubdomain(nsIURI* aProbeArg, nsIURI* aBase)
+{
+    // Make a clone of the incoming URI, because we're going to mutate it.
+    nsCOMPtr<nsIURI> probe;
+    nsresult rv = aProbeArg->Clone(getter_AddRefs(probe));
+    NS_ENSURE_SUCCESS(rv, false);
+
+    nsCOMPtr<nsIEffectiveTLDService> tldService = do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
+    NS_ENSURE_TRUE(tldService, false);
+    while (true) {
+        if (nsScriptSecurityManager::SecurityCompareURIs(probe, aBase)) {
+            return true;
+        }
+
+        nsAutoCString host, newHost;
+        nsresult rv = probe->GetHost(host);
+        NS_ENSURE_SUCCESS(rv, false);
+
+        rv = tldService->GetNextSubDomain(host, newHost);
+        if (rv == NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
+            return false;
+        }
+        NS_ENSURE_SUCCESS(rv, false);
+        rv = probe->SetHost(newHost);
+        NS_ENSURE_SUCCESS(rv, false);
+    }
+}
+
 NS_IMETHODIMP
 nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
                                                    nsIURI *aTargetURI,
@@ -796,7 +826,7 @@ nsScriptSecurityManager::CheckLoadURIWithPrincipal(nsIPrincipal* aPrincipal,
         // Allow domains that were whitelisted in the prefs. In 99.9% of cases,
         // this array is empty.
         for (size_t i = 0; i < mFileURIWhitelist.Length(); ++i) {
-            if (SecurityCompareURIs(mFileURIWhitelist[i], sourceURI)) {
+            if (EqualOrSubdomain(sourceURI, mFileURIWhitelist[i])) {
                 return NS_OK;
             }
         }
@@ -1426,7 +1456,15 @@ nsScriptSecurityManager::AddSitesToFileURIWhitelist(const nsCString& aSiteList)
     {
         // Grab the current site.
         bound = SkipUntil<IsWhitespace>(aSiteList, base);
-        auto site = Substring(aSiteList, base, bound - base);
+        nsAutoCString site(Substring(aSiteList, base, bound - base));
+
+        // Check if the URI is schemeless. If so, add both http and https.
+        nsAutoCString unused;
+        if (NS_FAILED(sIOService->ExtractScheme(site, unused))) {
+            AddSitesToFileURIWhitelist(NS_LITERAL_CSTRING("http://") + site);
+            AddSitesToFileURIWhitelist(NS_LITERAL_CSTRING("https://") + site);
+            continue;
+        }
 
         // Convert it to a URI and add it to our list.
         nsCOMPtr<nsIURI> uri;
diff --git a/caps/tests/mochitest/test_bug995943.xul b/caps/tests/mochitest/test_bug995943.xul
index d6554d523e9..29d715f1eeb 100644
--- a/caps/tests/mochitest/test_bug995943.xul
+++ b/caps/tests/mochitest/test_bug995943.xul
@@ -82,11 +82,18 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=995943
       pushPrefs.bind(null, [['capability.policy.policynames', ',somepolicy, someotherpolicy, '],
                             ['capability.policy.somepolicy.checkloaduri.enabled', 'allaccess'],
                             ['capability.policy.someotherpolicy.checkloaduri.enabled', 'nope'],
-                            ['capability.policy.somepolicy.sites', ' http://example.org   https://example.com'],
+                            ['capability.policy.somepolicy.sites', ' http://example.org   test1.example.com https://test2.example.com '],
                             ['capability.policy.someotherpolicy.sites', 'http://example.net ']]))
     .then(checkLoadFileURI.bind(null, 'http://example.org', true))
-    .then(checkLoadFileURI.bind(null, 'http://example.com', false))
+    .then(checkLoadFileURI.bind(null, 'http://test2.example.com', false))
+    .then(checkLoadFileURI.bind(null, 'https://test2.example.com', true))
+    .then(checkLoadFileURI.bind(null, 'http://sub1.test2.example.com', false))
+    .then(checkLoadFileURI.bind(null, 'https://sub1.test2.example.com', true))
     .then(checkLoadFileURI.bind(null, 'http://example.net', false))
+    .then(checkLoadFileURI.bind(null, 'http://test1.example.com', true))
+    .then(checkLoadFileURI.bind(null, 'https://test1.example.com', true))
+    .then(checkLoadFileURI.bind(null, 'http://sub1.test1.example.com', true))
+    .then(checkLoadFileURI.bind(null, 'https://sub1.test1.example.com', true))
     .then(pushPrefs.bind(null, [['capability.policy.someotherpolicy.checkloaduri.enabled', 'allAccess']]))
     .then(checkLoadFileURI.bind(null, 'http://example.net', true))
     .then(popPrefs)
diff --git a/config/check_spidermonkey_style.py b/config/check_spidermonkey_style.py
index d5956280a37..8aa5150eb32 100644
--- a/config/check_spidermonkey_style.py
+++ b/config/check_spidermonkey_style.py
@@ -399,6 +399,10 @@ def do_file(filename, inclname, file_kind, f, all_inclnames, included_h_inclname
 
     # Extract the #include statements as a tree of IBlocks and IIncludes.
     for linenum, line in enumerate(f, start=1):
+        # We're only interested in lines that contain a '#'.
+        if not '#' in line:
+            continue
+
         # Look for a |#include "..."| line.
         m = re.match(r'\s*#\s*include\s+"([^"]*)"', line)
         if m is not None:
@@ -482,16 +486,12 @@ def do_file(filename, inclname, file_kind, f, all_inclnames, included_h_inclname
             error(filename, str(include1.linenum) + ':' + str(include2.linenum),
                   include1.quote() + ' should be included after ' + include2.quote())
 
-    # The #include statements in the files in assembler/ have all manner of implicit
-    # ordering requirements.  Boo.  Ignore them.
-    skip_order_checking = inclname.startswith('assembler/')
-
     # Check the extracted #include statements, both individually, and the ordering of
     # adjacent pairs that live in the same block.
     def pair_traverse(prev, this):
         if this.isLeaf():
             check_include_statement(this)
-            if prev is not None and prev.isLeaf() and not skip_order_checking:
+            if prev is not None and prev.isLeaf():
                 check_includes_order(prev, this)
         else:
             for prev2, this2 in zip([None] + this.kids[0:-1], this.kids):
diff --git a/config/config.mk b/config/config.mk
index c91db9a154e..1d1e9c29da2 100644
--- a/config/config.mk
+++ b/config/config.mk
@@ -255,19 +255,6 @@ endif
 #
 _ENABLE_PIC=1
 
-# Determine if module being compiled is destined
-# to be merged into libxul
-
-ifneq (,$(filter xul xul-%,$(FINAL_LIBRARY) $(LIBRARY_NAME)))
-  LIBXUL_LIBRARY := 1
-endif
-
-ifdef LIBXUL_LIBRARY
-ifdef IS_COMPONENT
-$(error IS_COMPONENT is set, but is not compatible with LIBXUL_LIBRARY)
-endif
-endif
-
 # PGO on MSVC is opt-in
 ifdef _MSC_VER
 ifndef MSVC_ENABLE_PGO
@@ -316,22 +303,6 @@ ifdef _MSC_VER
 OS_LDFLAGS += $(DELAYLOAD_LDFLAGS)
 endif # _MSC_VER
 
-ifneq (,$(LIBXUL_LIBRARY))
-DEFINES += -DMOZILLA_INTERNAL_API
-endif
-
-# Force XPCOM/widget/gfx methods to be _declspec(dllexport) when we're
-# building libxul libraries
-ifdef LIBXUL_LIBRARY
-DEFINES += \
-	  -DIMPL_LIBXUL \
-		$(NULL)
-
-ifndef JS_SHARED_LIBRARY
-DEFINES += -DSTATIC_EXPORTABLE_JS_API
-endif
-endif
-
 MAKE_JARS_FLAGS = \
 	-t $(topsrcdir) \
 	-f $(MOZ_CHROME_FILE_FORMAT) \
diff --git a/config/external/nss/nss.def b/config/external/nss/nss.def
index 991b7f423f1..a5d3653122d 100644
--- a/config/external/nss/nss.def
+++ b/config/external/nss/nss.def
@@ -491,6 +491,7 @@ SECITEM_CompareItem
 SECITEM_CompareItem_Util
 SECITEM_CopyItem
 SECITEM_CopyItem_Util
+SECITEM_DupArray
 SECITEM_DupItem
 SECITEM_DupItem_Util
 SECITEM_FreeItem
diff --git a/configure.in b/configure.in
index baf69885373..adccfd95592 100644
--- a/configure.in
+++ b/configure.in
@@ -4599,6 +4599,14 @@ AC_DEFINE_UNQUOTED(MOZ_DISTRIBUTION_ID,"$MOZ_DISTRIBUTION_ID")
 AC_SUBST(MOZ_DISTRIBUTION_ID)
 
 
+dnl ========================================================
+dnl Google Play Services, placed here so it can depend on
+dnl values set by configure.sh above.
+dnl ========================================================
+
+MOZ_ANDROID_GOOGLE_PLAY_SERVICES
+
+
 dnl ========================================================
 dnl = Pango
 dnl ========================================================
@@ -5631,7 +5639,7 @@ if test -n "${JAVA_BIN_PATH}" -o \
     AC_MSG_ERROR([The program keytool was not found.  Set \$JAVA_HOME to your Java SDK directory or use --with-java-bin-path={java-bin-dir}])
   fi
 
-  AC_MSG_CHECKING([for minimum required javac version = 1.7])
+  AC_MSG_CHECKING([for minimum required javac version >= 1.7])
 
   dnl Javac spits out something like `javac 1.7.0`. This line cuts off the 'javac'
   _javac_version=$($JAVAC -version 2>&1 | cut -d ' ' -f 2)
@@ -5645,8 +5653,8 @@ if test -n "${JAVA_BIN_PATH}" -o \
 
   dnl Fail if we have a version other than 1.7.X
   if test "$_javac_major_version" -ne "1" -o \
-      \( "$_javac_minor_version" -ne "7" \); then
-      AC_MSG_ERROR([javac 1.7 is required.])
+       \( "$_javac_minor_version" -lt "7" \); then
+      AC_MSG_ERROR([javac 1.7 or higher is required.])
   fi
 fi
 
@@ -6395,10 +6403,17 @@ if test -n "$gonkdir"; then
     MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX
 fi
 
-MOZ_ARG_ENABLE_BOOL(content-sandbox,
-[  --enable-content-sandbox        Enable sandboxing support for content-processes],
-    MOZ_CONTENT_SANDBOX=1,
-    MOZ_CONTENT_SANDBOX=)
+case "$OS_TARGET:$NIGHTLY_BUILD" in
+WINNT:1)
+    MOZ_CONTENT_SANDBOX=$MOZ_SANDBOX
+    ;;
+*)
+    MOZ_ARG_ENABLE_BOOL(content-sandbox,
+    [  --enable-content-sandbox        Enable sandboxing support for content-processes],
+        MOZ_CONTENT_SANDBOX=1,
+        MOZ_CONTENT_SANDBOX=)
+    ;;
+esac
 
 if test -n "$MOZ_CONTENT_SANDBOX"; then
     AC_DEFINE(MOZ_CONTENT_SANDBOX)
@@ -8336,6 +8351,12 @@ if test -n "$MOZ_SERVICES_SYNC"; then
   AC_DEFINE(MOZ_SERVICES_SYNC)
 fi
 
+dnl Build Services/CloudSync if required
+AC_SUBST(MOZ_SERVICES_CLOUDSYNC)
+if test -n "$MOZ_SERVICES_CLOUDSYNC"; then
+  AC_DEFINE(MOZ_SERVICES_CLOUDSYNC)
+fi
+
 dnl Build Captive Portal Detector if required
 AC_SUBST(MOZ_CAPTIVEDETECT)
 if test -n "$MOZ_CAPTIVEDETECT"; then
diff --git a/content/base/public/Element.h b/content/base/public/Element.h
index bc6fd702649..d95e11af7e7 100644
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -983,6 +983,62 @@ public:
    */
   nsresult SetBoolAttr(nsIAtom* aAttr, bool aValue);
 
+  /**
+   * Helper method for NS_IMPL_ENUM_ATTR_DEFAULT_VALUE.
+   * Gets the enum value string of an attribute and using a default value if
+   * the attribute is missing or the string is an invalid enum value.
+   *
+   * @param aType     the name of the attribute.
+   * @param aDefault  the default value if the attribute is missing or invalid.
+   * @param aResult   string corresponding to the value [out].
+   */
+  void GetEnumAttr(nsIAtom* aAttr,
+                   const char* aDefault,
+                   nsAString& aResult) const;
+
+  /**
+   * Helper method for NS_IMPL_ENUM_ATTR_DEFAULT_MISSING_INVALID_VALUES.
+   * Gets the enum value string of an attribute and using the default missing
+   * value if the attribute is missing or the default invalid value if the
+   * string is an invalid enum value.
+   *
+   * @param aType            the name of the attribute.
+   * @param aDefaultMissing  the default value if the attribute is missing.  If
+                             null and the attribute is missing, aResult will be
+                             set to the null DOMString; this only matters for
+                             cases in which we're reflecting a nullable string.
+   * @param aDefaultInvalid  the default value if the attribute is invalid.
+   * @param aResult          string corresponding to the value [out].
+   */
+  void GetEnumAttr(nsIAtom* aAttr,
+                   const char* aDefaultMissing,
+                   const char* aDefaultInvalid,
+                   nsAString& aResult) const;
+
+  /**
+   * Unset an attribute.
+   */
+  void UnsetAttr(nsIAtom* aAttr, ErrorResult& aError)
+  {
+    aError = UnsetAttr(kNameSpaceID_None, aAttr, true);
+  }
+
+  /**
+   * Set an attribute in the simplest way possible.
+   */
+  void SetAttr(nsIAtom* aAttr, const nsAString& aValue, ErrorResult& aError)
+  {
+    aError = SetAttr(kNameSpaceID_None, aAttr, aValue, true);
+  }
+
+  /**
+   * Set a content attribute via a reflecting nullable string IDL
+   * attribute (e.g. a CORS attribute).  If DOMStringIsNull(aValue),
+   * this will actually remove the content attribute.
+   */
+  void SetOrRemoveNullableStringAttr(nsIAtom* aName, const nsAString& aValue,
+                                     ErrorResult& aError);
+
   /**
    * Retrieve the ratio of font-size-inflated text font size to computed font
    * size for this element. This will query the element for its primary frame,
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index c302b48d33a..bafadecdd61 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -2349,8 +2349,6 @@ public:
   virtual nsHTMLDocument* AsHTMLDocument() { return nullptr; }
   virtual mozilla::dom::SVGDocument* AsSVGDocument() { return nullptr; }
 
-  virtual JSObject* WrapObject(JSContext *aCx) MOZ_OVERRIDE;
-
   // Each import tree has exactly one master document which is
   // the root of the tree, and owns the browser context.
   virtual already_AddRefed<nsIDocument> MasterDocument() = 0;
diff --git a/content/base/src/Element.cpp b/content/base/src/Element.cpp
index dc60324705a..3fde7ee3418 100644
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -3107,6 +3107,50 @@ Element::SetBoolAttr(nsIAtom* aAttr, bool aValue)
   return UnsetAttr(kNameSpaceID_None, aAttr, true);
 }
 
+void
+Element::GetEnumAttr(nsIAtom* aAttr,
+                     const char* aDefault,
+                     nsAString& aResult) const
+{
+  GetEnumAttr(aAttr, aDefault, aDefault, aResult);
+}
+
+void
+Element::GetEnumAttr(nsIAtom* aAttr,
+                     const char* aDefaultMissing,
+                     const char* aDefaultInvalid,
+                     nsAString& aResult) const
+{
+  const nsAttrValue* attrVal = mAttrsAndChildren.GetAttr(aAttr);
+
+  aResult.Truncate();
+
+  if (!attrVal) {
+    if (aDefaultMissing) {
+      AppendASCIItoUTF16(nsDependentCString(aDefaultMissing), aResult);
+    } else {
+      SetDOMStringToNull(aResult);
+    }
+  } else {
+    if (attrVal->Type() == nsAttrValue::eEnum) {
+      attrVal->GetEnumString(aResult, true);
+    } else if (aDefaultInvalid) {
+      AppendASCIItoUTF16(nsDependentCString(aDefaultInvalid), aResult);
+    }
+  }
+}
+
+void
+Element::SetOrRemoveNullableStringAttr(nsIAtom* aName, const nsAString& aValue,
+                                       ErrorResult& aError)
+{
+  if (DOMStringIsNull(aValue)) {
+    UnsetAttr(aName, aError);
+  } else {
+    SetAttr(aName, aValue, aError);
+  }
+}
+
 Directionality
 Element::GetComputedDirectionality() const
 {
diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
index 9d2ec923678..469cb783d84 100644
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -6408,7 +6408,7 @@ nsContentUtils::IsPatternMatching(nsAString& aValue, nsAString& aPattern,
 
   JS::Rooted<JSObject*> re(cx,
     JS_NewUCRegExpObjectNoStatics(cx,
-                                  static_cast<jschar*>(aPattern.BeginWriting()),
+                                  static_cast<char16_t*>(aPattern.BeginWriting()),
                                   aPattern.Length(), 0));
   if (!re) {
     JS_ClearPendingException(cx);
@@ -6418,7 +6418,7 @@ nsContentUtils::IsPatternMatching(nsAString& aValue, nsAString& aPattern,
   JS::Rooted<JS::Value> rval(cx, JS::NullValue());
   size_t idx = 0;
   if (!JS_ExecuteRegExpNoStatics(cx, re,
-                                 static_cast<jschar*>(aValue.BeginWriting()),
+                                 static_cast<char16_t*>(aValue.BeginWriting()),
                                  aValue.Length(), &idx, true, &rval)) {
     JS_ClearPendingException(cx);
     return true;
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index ef81e2585b0..7c114cdfedd 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -150,6 +150,9 @@
 #include "nsHtml5TreeOpExecutor.h"
 #include "mozilla/dom/HTMLLinkElement.h"
 #include "mozilla/dom/HTMLMediaElement.h"
+#ifdef MOZ_MEDIA_NAVIGATOR
+#include "mozilla/MediaManager.h"
+#endif // MOZ_MEDIA_NAVIGATOR
 #ifdef MOZ_WEBRTC
 #include "IPeerConnection.h"
 #endif // MOZ_WEBRTC
@@ -8503,6 +8506,14 @@ nsDocument::CanSavePresentation(nsIRequest *aNewRequest)
    return false;
   }
 
+#ifdef MOZ_MEDIA_NAVIGATOR
+  // Check if we have active GetUserMedia use
+  if (MediaManager::Exists() && win &&
+      MediaManager::Get()->IsWindowStillActive(win->WindowID())) {
+    return false;
+  }
+#endif // MOZ_MEDIA_NAVIGATOR
+
 #ifdef MOZ_WEBRTC
   // Check if we have active PeerConnections
   nsCOMPtr<IPeerConnectionManager> pcManager =
@@ -12258,54 +12269,6 @@ nsDocument::Evaluate(const nsAString& aExpression, nsIDOMNode* aContextNode,
                                     aInResult, aResult);
 }
 
-// This is just a hack around the fact that window.document is not
-// [Unforgeable] yet.
-JSObject*
-nsIDocument::WrapObject(JSContext *aCx)
-{
-  MOZ_ASSERT(IsDOMBinding());
-
-  JS::Rooted<JSObject*> obj(aCx, nsINode::WrapObject(aCx));
-  if (!obj) {
-    return nullptr;
-  }
-
-  nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(GetInnerWindow());
-  if (!win ||
-      static_cast<nsGlobalWindow*>(win.get())->IsDOMBinding()) {
-    // No window or window on new DOM binding, nothing else to do here.
-    return obj;
-  }
-
-  if (this != win->GetExtantDoc()) {
-    // We're not the current document; we're also done here
-    return obj;
-  }
-
-  JSAutoCompartment ac(aCx, obj);
-
-  JS::Rooted<JS::Value> winVal(aCx);
-  nsresult rv = nsContentUtils::WrapNative(aCx, win, &NS_GET_IID(nsIDOMWindow),
-                                           &winVal,
-                                           false);
-  if (NS_FAILED(rv)) {
-    Throw(aCx, rv);
-    return nullptr;
-  }
-
-  NS_NAMED_LITERAL_STRING(doc_str, "document");
-
-  JS::Rooted<JSObject*> winObj(aCx, &winVal.toObject());
-  if (!JS_DefineUCProperty(aCx, winObj, doc_str.get(),
-                           doc_str.Length(), obj,
-                           JSPROP_READONLY | JSPROP_ENUMERATE,
-                           JS_PropertyStub, JS_StrictPropertyStub)) {
-    return nullptr;
-  }
-
-  return obj;
-}
-
 XPathEvaluator*
 nsIDocument::XPathEvaluator()
 {
diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index 3fb8e2cefd0..efe1658c1a4 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -64,7 +64,6 @@
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/dom/DOMImplementation.h"
 #include "mozilla/dom/StyleSheetList.h"
-#include "nsIDOMTouchEvent.h"
 #include "nsDataHashtable.h"
 #include "mozilla/TimeStamp.h"
 #include "mozilla/Attributes.h"
diff --git a/content/base/src/nsFrameMessageManager.cpp b/content/base/src/nsFrameMessageManager.cpp
index b5478bc164b..a221b65f30a 100644
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -512,7 +512,7 @@ nsFrameMessageManager::GetDelayedFrameScripts(JSContext* aCx, JS::MutableHandle<
 }
 
 static bool
-JSONCreator(const jschar* aBuf, uint32_t aLen, void* aData)
+JSONCreator(const char16_t* aBuf, uint32_t aLen, void* aData)
 {
   nsAString* result = static_cast<nsAString*>(aData);
   result->Append(static_cast<const char16_t*>(aBuf),
@@ -542,7 +542,7 @@ GetParamsForMessage(JSContext* aCx,
   NS_ENSURE_TRUE(!json.IsEmpty(), false);
 
   JS::Rooted<JS::Value> val(aCx, JS::NullValue());
-  NS_ENSURE_TRUE(JS_ParseJSON(aCx, static_cast<const jschar*>(json.get()),
+  NS_ENSURE_TRUE(JS_ParseJSON(aCx, static_cast<const char16_t*>(json.get()),
                               json.Length(), &val), false);
 
   return WriteStructuredClone(aCx, val, aBuffer, aClosure);
@@ -638,7 +638,7 @@ nsFrameMessageManager::SendMessage(const nsAString& aMessageName,
     }
 
     JS::Rooted<JS::Value> ret(aCx);
-    if (!JS_ParseJSON(aCx, static_cast<const jschar*>(retval[i].get()),
+    if (!JS_ParseJSON(aCx, static_cast<const char16_t*>(retval[i].get()),
                       retval[i].Length(), &ret)) {
       return NS_ERROR_UNEXPECTED;
     }
@@ -996,7 +996,7 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
       }
       JS::Rooted<JSString*> jsMessage(cx,
         JS_NewUCStringCopyN(cx,
-                            static_cast<const jschar*>(aMessage.BeginReading()),
+                            static_cast<const char16_t*>(aMessage.BeginReading()),
                             aMessage.Length()));
       NS_ENSURE_TRUE(jsMessage, NS_ERROR_OUT_OF_MEMORY);
       JS::Rooted<JS::Value> syncv(cx, JS::BooleanValue(aIsSync));
@@ -1489,7 +1489,7 @@ nsFrameScriptExecutor::TryCacheLoadAndCompileScript(const nsAString& aURL,
   nsCOMPtr<nsIInputStream> input;
   channel->Open(getter_AddRefs(input));
   nsString dataString;
-  jschar* dataStringBuf = nullptr;
+  char16_t* dataStringBuf = nullptr;
   size_t dataStringLength = 0;
   uint64_t avail64 = 0;
   if (input && NS_SUCCEEDED(input->Available(&avail64)) && avail64) {
diff --git a/content/base/src/nsScriptLoader.cpp b/content/base/src/nsScriptLoader.cpp
index ff20540f649..657d2488d9d 100644
--- a/content/base/src/nsScriptLoader.cpp
+++ b/content/base/src/nsScriptLoader.cpp
@@ -109,7 +109,7 @@ public:
   bool mIsInline;         // Is the script inline or loaded?
   bool mHasSourceMapURL;  // Does the HTTP header have a source map url?
   nsString mSourceMapURL; // Holds source map url for loaded scripts
-  jschar* mScriptTextBuf;   // Holds script text for non-inline scripts. Don't
+  char16_t* mScriptTextBuf; // Holds script text for non-inline scripts. Don't
   size_t mScriptTextLength; // use nsString so we can give ownership to jsapi.
   uint32_t mJSVersion;
   nsCOMPtr<nsIURI> mURI;
@@ -898,7 +898,7 @@ nsScriptLoader::ProcessRequest(nsScriptLoadRequest* aRequest, void **aOffThreadT
 
   NS_ENSURE_ARG(aRequest);
   nsAutoString textData;
-  const jschar* scriptBuf = nullptr;
+  const char16_t* scriptBuf = nullptr;
   size_t scriptLength = 0;
   JS::SourceBufferHolder::Ownership giveScriptOwnership =
     JS::SourceBufferHolder::NoOwnership;
@@ -1278,7 +1278,7 @@ DetectByteOrderMark(const unsigned char* aBytes, int32_t aLen, nsCString& oChars
 nsScriptLoader::ConvertToUTF16(nsIChannel* aChannel, const uint8_t* aData,
                                uint32_t aLength, const nsAString& aHintCharset,
                                nsIDocument* aDocument,
-                               jschar*& aBufOut, size_t& aLengthOut)
+                               char16_t*& aBufOut, size_t& aLengthOut)
 {
   if (!aLength) {
     aBufOut = nullptr;
@@ -1335,7 +1335,7 @@ nsScriptLoader::ConvertToUTF16(nsIChannel* aChannel, const uint8_t* aData,
                                  aLength, &unicodeLength);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  aBufOut = static_cast<jschar*>(js_malloc(unicodeLength * sizeof(jschar)));
+  aBufOut = static_cast<char16_t*>(js_malloc(unicodeLength * sizeof(char16_t)));
   if (!aBufOut) {
     aLengthOut = 0;
     return NS_ERROR_OUT_OF_MEMORY;
diff --git a/content/base/src/nsScriptLoader.h b/content/base/src/nsScriptLoader.h
index 9449d0118b6..6f5e80b76d3 100644
--- a/content/base/src/nsScriptLoader.h
+++ b/content/base/src/nsScriptLoader.h
@@ -170,17 +170,17 @@ public:
    *                     attribute). May be the empty string.
    * @param aDocument    Document which the data is loaded for. Must not be
    *                     null.
-   * @param aBufOut      [out] jschar array allocated by ConvertToUTF16 and
+   * @param aBufOut      [out] char16_t array allocated by ConvertToUTF16 and
    *                     containing data converted to unicode.  Caller must
    *                     js_free() this data when no longer needed.
    * @param aLengthOut   [out] Length of array returned in aBufOut in number
-   *                     of jschars.
+   *                     of char16_t code units.
    */
   static nsresult ConvertToUTF16(nsIChannel* aChannel, const uint8_t* aData,
                                  uint32_t aLength,
                                  const nsAString& aHintCharset,
                                  nsIDocument* aDocument,
-                                 jschar*& aBufOut, size_t& aLengthOut);
+                                 char16_t*& aBufOut, size_t& aLengthOut);
 
   /**
    * Processes any pending requests that are ready for processing.
diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
index 0791da2b707..ab087b844e0 100644
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -766,7 +766,7 @@ nsXMLHttpRequest::CreateResponseParsedJSON(JSContext* aCx)
   // The Unicode converter has already zapped the BOM if there was one
   JS::Rooted<JS::Value> value(aCx);
   if (!JS_ParseJSON(aCx,
-                    static_cast<const jschar*>(mResponseText.get()), mResponseText.Length(),
+                    static_cast<const char16_t*>(mResponseText.get()), mResponseText.Length(),
                     &value)) {
     return NS_ERROR_FAILURE;
   }
@@ -4074,8 +4074,8 @@ ArrayBufferBuilder::mapToFileInPackage(const nsCString& aFile,
     return rv;
   }
   nsZipItem* zipItem = zip->GetItem(aFile.get());
-  if (NS_FAILED(rv)) {
-    return rv;
+  if (!zipItem) {
+    return NS_ERROR_FILE_TARGET_DOES_NOT_EXIST;
   }
 
   // If file was added to the package as stored(uncompressed), map to the
diff --git a/content/base/test/test_bug345339.html b/content/base/test/test_bug345339.html
index 92a54e80afe..4025d572e80 100644
--- a/content/base/test/test_bug345339.html
+++ b/content/base/test/test_bug345339.html
@@ -36,7 +36,8 @@ function afterLoad() {
              .getService(SpecialPowers.Ci.nsIProperties)
              .get("TmpD", SpecialPowers.Ci.nsILocalFile);
     file.append("345339_test.file");
-    file.createUnique(SpecialPowers.Ci.nsIFile.NORMAL_FILE_TYPE, 0666);
+    // Only the file's path is used, so it doesn't need to be created.
+    // See also bug 1058977.
     filePath = file.path;
 
     SpecialPowers.wrap(iframeDoc).getElementById("file").value = filePath;
diff --git a/content/html/content/public/HTMLMediaElement.h b/content/html/content/public/HTMLMediaElement.h
index 4316bc271a4..923dde489e9 100755
--- a/content/html/content/public/HTMLMediaElement.h
+++ b/content/html/content/public/HTMLMediaElement.h
@@ -363,10 +363,16 @@ public:
 
   // XPCOM GetCurrentSrc() is OK
 
-  // XPCOM GetCrossorigin() is OK
-  void SetCrossOrigin(const nsAString& aValue, ErrorResult& aRv)
+  void GetCrossOrigin(nsAString& aResult)
   {
-    SetHTMLAttr(nsGkAtoms::crossorigin, aValue, aRv);
+    // Null for both missing and invalid defaults is ok, since we
+    // always parse to an enum value, so we don't need an invalid
+    // default, and we _want_ the missing default to be null.
+    GetEnumAttr(nsGkAtoms::crossorigin, nullptr, aResult);
+  }
+  void SetCrossOrigin(const nsAString& aCrossOrigin, ErrorResult& aError)
+  {
+    SetOrRemoveNullableStringAttr(nsGkAtoms::crossorigin, aCrossOrigin, aError);
   }
 
   uint16_t NetworkState() const
diff --git a/content/html/content/src/HTMLImageElement.cpp b/content/html/content/src/HTMLImageElement.cpp
index 4cd291120e3..19763be8513 100644
--- a/content/html/content/src/HTMLImageElement.cpp
+++ b/content/html/content/src/HTMLImageElement.cpp
@@ -151,11 +151,6 @@ HTMLImageElement::SetItemValueText(const nsAString& aValue)
   SetSrc(aValue);
 }
 
-// crossorigin is not "limited to only known values" per spec, so it's
-// just a string attr purposes of the DOM crossOrigin property.
-// TODO: It is now (bug 880997).
-NS_IMPL_STRING_ATTR(HTMLImageElement, CrossOrigin, crossorigin)
-
 bool
 HTMLImageElement::Draggable() const
 {
diff --git a/content/html/content/src/HTMLImageElement.h b/content/html/content/src/HTMLImageElement.h
index bd547f5e72c..f2b2468597f 100644
--- a/content/html/content/src/HTMLImageElement.h
+++ b/content/html/content/src/HTMLImageElement.h
@@ -142,9 +142,16 @@ public:
   {
     SetHTMLAttr(nsGkAtoms::srcset, aSrcset, aError);
   }
+  void GetCrossOrigin(nsAString& aResult)
+  {
+    // Null for both missing and invalid defaults is ok, since we
+    // always parse to an enum value, so we don't need an invalid
+    // default, and we _want_ the missing default to be null.
+    GetEnumAttr(nsGkAtoms::crossorigin, nullptr, aResult);
+  }
   void SetCrossOrigin(const nsAString& aCrossOrigin, ErrorResult& aError)
   {
-    SetHTMLAttr(nsGkAtoms::crossorigin, aCrossOrigin, aError);
+    SetOrRemoveNullableStringAttr(nsGkAtoms::crossorigin, aCrossOrigin, aError);
   }
   void SetUseMap(const nsAString& aUseMap, ErrorResult& aError)
   {
diff --git a/content/html/content/src/HTMLLinkElement.cpp b/content/html/content/src/HTMLLinkElement.cpp
index 81a9934c870..1b03afb6864 100644
--- a/content/html/content/src/HTMLLinkElement.cpp
+++ b/content/html/content/src/HTMLLinkElement.cpp
@@ -117,7 +117,6 @@ NS_IMPL_STRING_ATTR(HTMLLinkElement, Rel, rel)
 NS_IMPL_STRING_ATTR(HTMLLinkElement, Rev, rev)
 NS_IMPL_STRING_ATTR(HTMLLinkElement, Target, target)
 NS_IMPL_STRING_ATTR(HTMLLinkElement, Type, type)
-NS_IMPL_STRING_ATTR(HTMLLinkElement, CrossOrigin, crossorigin)
 
 void
 HTMLLinkElement::GetItemValueText(nsAString& aValue)
diff --git a/content/html/content/src/HTMLLinkElement.h b/content/html/content/src/HTMLLinkElement.h
index 7e278913708..a7f454360dc 100644
--- a/content/html/content/src/HTMLLinkElement.h
+++ b/content/html/content/src/HTMLLinkElement.h
@@ -90,10 +90,16 @@ public:
   {
     SetHTMLAttr(nsGkAtoms::href, aHref, aRv);
   }
-  // XPCOM GetCrossOrigin is fine.
-  void SetCrossOrigin(const nsAString& aCrossOrigin, ErrorResult& aRv)
+  void GetCrossOrigin(nsAString& aResult)
   {
-    SetHTMLAttr(nsGkAtoms::crossorigin, aCrossOrigin, aRv);
+    // Null for both missing and invalid defaults is ok, since we
+    // always parse to an enum value, so we don't need an invalid
+    // default, and we _want_ the missing default to be null.
+    GetEnumAttr(nsGkAtoms::crossorigin, nullptr, aResult);
+  }
+  void SetCrossOrigin(const nsAString& aCrossOrigin, ErrorResult& aError)
+  {
+    SetOrRemoveNullableStringAttr(nsGkAtoms::crossorigin, aCrossOrigin, aError);
   }
   // XPCOM GetRel is fine.
   void SetRel(const nsAString& aRel, ErrorResult& aRv)
diff --git a/content/html/content/src/HTMLMediaElement.cpp b/content/html/content/src/HTMLMediaElement.cpp
index b27532f7199..437f2ade7c2 100755
--- a/content/html/content/src/HTMLMediaElement.cpp
+++ b/content/html/content/src/HTMLMediaElement.cpp
@@ -470,7 +470,6 @@ NS_INTERFACE_MAP_END_INHERITING(nsGenericHTMLElement)
 
 // nsIDOMHTMLMediaElement
 NS_IMPL_URI_ATTR(HTMLMediaElement, Src, src)
-NS_IMPL_STRING_ATTR(HTMLMediaElement, CrossOrigin, crossorigin)
 NS_IMPL_BOOL_ATTR(HTMLMediaElement, Controls, controls)
 NS_IMPL_BOOL_ATTR(HTMLMediaElement, Autoplay, autoplay)
 NS_IMPL_BOOL_ATTR(HTMLMediaElement, Loop, loop)
diff --git a/content/html/content/src/HTMLScriptElement.cpp b/content/html/content/src/HTMLScriptElement.cpp
index 85e52b91f57..56630f2b3b1 100644
--- a/content/html/content/src/HTMLScriptElement.cpp
+++ b/content/html/content/src/HTMLScriptElement.cpp
@@ -137,7 +137,6 @@ NS_IMPL_URI_ATTR(HTMLScriptElement, Src, src)
 NS_IMPL_STRING_ATTR(HTMLScriptElement, Type, type)
 NS_IMPL_STRING_ATTR(HTMLScriptElement, HtmlFor, _for)
 NS_IMPL_STRING_ATTR(HTMLScriptElement, Event, event)
-NS_IMPL_STRING_ATTR(HTMLScriptElement, CrossOrigin, crossorigin)
 
 void
 HTMLScriptElement::SetCharset(const nsAString& aCharset, ErrorResult& rv)
@@ -181,12 +180,6 @@ HTMLScriptElement::SetEvent(const nsAString& aEvent, ErrorResult& rv)
   SetHTMLAttr(nsGkAtoms::event, aEvent, rv);
 }
 
-void
-HTMLScriptElement::SetCrossOrigin(const nsAString& aCrossOrigin, ErrorResult& rv)
-{
-  SetHTMLAttr(nsGkAtoms::crossorigin, aCrossOrigin, rv);
-}
-
 nsresult
 HTMLScriptElement::GetAsync(bool* aValue)
 {
diff --git a/content/html/content/src/HTMLScriptElement.h b/content/html/content/src/HTMLScriptElement.h
index c301c59221d..1b89bc6114a 100644
--- a/content/html/content/src/HTMLScriptElement.h
+++ b/content/html/content/src/HTMLScriptElement.h
@@ -68,7 +68,17 @@ public:
   void SetType(const nsAString& aType, ErrorResult& rv);
   void SetHtmlFor(const nsAString& aHtmlFor, ErrorResult& rv);
   void SetEvent(const nsAString& aEvent, ErrorResult& rv);
-  void SetCrossOrigin(const nsAString& aCrossOrigin, ErrorResult& rv);
+  void GetCrossOrigin(nsAString& aResult)
+  {
+    // Null for both missing and invalid defaults is ok, since we
+    // always parse to an enum value, so we don't need an invalid
+    // default, and we _want_ the missing default to be null.
+    GetEnumAttr(nsGkAtoms::crossorigin, nullptr, aResult);
+  }
+  void SetCrossOrigin(const nsAString& aCrossOrigin, ErrorResult& aError)
+  {
+    SetOrRemoveNullableStringAttr(nsGkAtoms::crossorigin, aCrossOrigin, aError);
+  }
   bool Async();
   void SetAsync(bool aValue, ErrorResult& rv);
 
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index 6385e9439f2..2e048a89ed8 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -347,7 +347,7 @@ nsGenericHTMLElement::GetOffsetRect(CSSIntRect& aRect)
   }
 
   nsIContent* offsetParent = nullptr;
-  Element* docElement = GetCurrentDoc()->GetRootElement();
+  Element* docElement = GetComposedDoc()->GetRootElement();
   nsIContent* content = frame->GetContent();
 
   if (content && (content->IsHTML(nsGkAtoms::body) || content == docElement)) {
@@ -398,7 +398,7 @@ nsGenericHTMLElement::GetOffsetRect(CSSIntRect& aRect)
       // parent chain. We want the offset parent in this case to be
       // the body, so we just get the body element from the document.
 
-      nsCOMPtr<nsIDOMHTMLDocument> html_doc(do_QueryInterface(GetCurrentDoc()));
+      nsCOMPtr<nsIDOMHTMLDocument> html_doc(do_QueryInterface(GetComposedDoc()));
 
       if (html_doc) {
         offsetParent = static_cast<nsHTMLDocument*>(html_doc.get())->GetBody();
@@ -1766,37 +1766,6 @@ nsGenericHTMLElement::GetURIListAttr(nsIAtom* aAttr, nsAString& aResult)
   return NS_OK;
 }
 
-void
-nsGenericHTMLElement::GetEnumAttr(nsIAtom* aAttr,
-                                  const char* aDefault,
-                                  nsAString& aResult) const
-{
-  GetEnumAttr(aAttr, aDefault, aDefault, aResult);
-}
-
-void
-nsGenericHTMLElement::GetEnumAttr(nsIAtom* aAttr,
-                                  const char* aDefaultMissing,
-                                  const char* aDefaultInvalid,
-                                  nsAString& aResult) const
-{
-  const nsAttrValue* attrVal = mAttrsAndChildren.GetAttr(aAttr);
-
-  aResult.Truncate();
-
-  if (!attrVal) {
-    if (aDefaultMissing) {
-      AppendASCIItoUTF16(nsDependentCString(aDefaultMissing), aResult);
-    }
-  } else {
-    if (attrVal->Type() == nsAttrValue::eEnum) {
-      attrVal->GetEnumString(aResult, true);
-    } else if (aDefaultInvalid) {
-      AppendASCIItoUTF16(nsDependentCString(aDefaultInvalid), aResult);
-    }
-  }
-}
-
 HTMLMenuElement*
 nsGenericHTMLElement::GetContextMenu() const
 {
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index d4487319c44..a5da08dce70 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -1011,11 +1011,11 @@ protected:
   }
   void SetHTMLAttr(nsIAtom* aName, const nsAString& aValue, mozilla::ErrorResult& aError)
   {
-    aError = SetAttr(kNameSpaceID_None, aName, aValue, true);
+    mozilla::dom::Element::SetAttr(aName, aValue, aError);
   }
   void UnsetHTMLAttr(nsIAtom* aName, mozilla::ErrorResult& aError)
   {
-    aError = UnsetAttr(kNameSpaceID_None, aName, true);
+    mozilla::dom::Element::UnsetAttr(aName, aError);
   }
   void SetHTMLBoolAttr(nsIAtom* aName, bool aValue, mozilla::ErrorResult& aError)
   {
@@ -1122,35 +1122,6 @@ protected:
    */
   nsresult GetURIListAttr(nsIAtom* aAttr, nsAString& aResult);
 
-  /**
-   * Helper method for NS_IMPL_ENUM_ATTR_DEFAULT_VALUE.
-   * Gets the enum value string of an attribute and using a default value if
-   * the attribute is missing or the string is an invalid enum value.
-   *
-   * @param aType     the name of the attribute.
-   * @param aDefault  the default value if the attribute is missing or invalid.
-   * @param aResult   string corresponding to the value [out].
-   */
-  void GetEnumAttr(nsIAtom* aAttr,
-                               const char* aDefault,
-                               nsAString& aResult) const;
-
-  /**
-   * Helper method for NS_IMPL_ENUM_ATTR_DEFAULT_MISSING_INVALID_VALUES.
-   * Gets the enum value string of an attribute and using the default missing
-   * value if the attribute is missing or the default invalid value if the
-   * string is an invalid enum value.
-   *
-   * @param aType            the name of the attribute.
-   * @param aDefaultMissing  the default value if the attribute is missing.
-   * @param aDefaultInvalid  the default value if the attribute is invalid.
-   * @param aResult          string corresponding to the value [out].
-   */
-  void GetEnumAttr(nsIAtom* aAttr,
-                               const char* aDefaultMissing,
-                               const char* aDefaultInvalid,
-                               nsAString& aResult) const;
-
   /**
    * Locates the nsIEditor associated with this node.  In general this is
    * equivalent to GetEditorInternal(), but for designmode or contenteditable,
diff --git a/content/html/content/test/forms/chrome.ini b/content/html/content/test/forms/chrome.ini
index 7cab0e5de7a..0c8fa82314c 100644
--- a/content/html/content/test/forms/chrome.ini
+++ b/content/html/content/test/forms/chrome.ini
@@ -1,2 +1,5 @@
 [DEFAULT]
+support-files =
+  submit_invalid_file.sjs
 [test_autocompleteinfo.html]
+[test_submit_invalid_file.html]
diff --git a/content/html/content/test/forms/mochitest.ini b/content/html/content/test/forms/mochitest.ini
index f542918e148..2be29111a0a 100644
--- a/content/html/content/test/forms/mochitest.ini
+++ b/content/html/content/test/forms/mochitest.ini
@@ -1,7 +1,6 @@
 [DEFAULT]
 support-files =
   save_restore_radio_groups.sjs
-  submit_invalid_file.sjs
   test_input_number_data.js
 
 [test_bug1039548.html]
@@ -91,7 +90,6 @@ skip-if = e10s
 [test_step_attribute.html]
 skip-if = e10s
 [test_stepup_stepdown.html]
-[test_submit_invalid_file.html]
 [test_textarea_attributes_reflection.html]
 [test_validation.html]
 skip-if = buildapp == 'b2g' || e10s # b2g(374 total, bug 901848, no keygen support) b2g-debug(374 total, bug 901848, no keygen support) b2g-desktop(374 total, bug 901848, no keygen support)
diff --git a/content/html/content/test/forms/test_change_event.html b/content/html/content/test/forms/test_change_event.html
index bf7d1510a94..3e0430dfe7a 100644
--- a/content/html/content/test/forms/test_change_event.html
+++ b/content/html/content/test/forms/test_change_event.html
@@ -67,7 +67,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=722599
 
   function testUserInput() {
     //Simulating an OK click and with a file name return.
-    MockFilePicker.useAnyFile();
+    MockFilePicker.useBlobFile();
     MockFilePicker.returnValue = MockFilePicker.returnOK;
     var input = document.getElementById('fileInput');
     input.focus();
diff --git a/content/html/content/test/forms/test_input_event.html b/content/html/content/test/forms/test_input_event.html
index 4537d8fb25b..31159ae8b1e 100644
--- a/content/html/content/test/forms/test_input_event.html
+++ b/content/html/content/test/forms/test_input_event.html
@@ -59,7 +59,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=851780
 
   function testUserInput() {
     // Simulating an OK click and with a file name return.
-    MockFilePicker.useAnyFile();
+    MockFilePicker.useBlobFile();
     MockFilePicker.returnValue = MockFilePicker.returnOK;
     var input = document.getElementById('fileInput');
     input.focus();
diff --git a/content/html/content/test/forms/test_max_attribute.html b/content/html/content/test/forms/test_max_attribute.html
index 5d2bf5487e3..15acb74541b 100644
--- a/content/html/content/test/forms/test_max_attribute.html
+++ b/content/html/content/test/forms/test_max_attribute.html
@@ -179,17 +179,12 @@ for (var test of data) {
                                 .getService(SpecialPowers.Ci.nsIProperties);
       var file = dirSvc.get("ProfD", SpecialPowers.Ci.nsIFile);
       file.append('635499_file');
-      var outStream = SpecialPowers.Cc["@mozilla.org/network/file-output-stream;1"].
-                      createInstance(SpecialPowers.Ci.nsIFileOutputStream);
-      outStream.init(file, 0x02 | 0x08 | 0x20, // write, create, truncate
-                     0666, 0);
-      outStream.write("foo", 3);
-      outStream.close();
+      // Only the file's path is used, so it doesn't need to be created.
+      // See also bug 1058977.
 
       SpecialPowers.wrap(input).value = file.path;
       checkValidity(input, true, apply, apply);
 
-      file.remove(false);
       break;
     case 'date':
       input.max = '2012-06-27';
diff --git a/content/html/content/test/forms/test_min_attribute.html b/content/html/content/test/forms/test_min_attribute.html
index 473879d6631..b114ff928b1 100644
--- a/content/html/content/test/forms/test_min_attribute.html
+++ b/content/html/content/test/forms/test_min_attribute.html
@@ -177,17 +177,12 @@ for (var test of data) {
                                 .getService(SpecialPowers.Ci.nsIProperties);
       var file = dirSvc.get("ProfD", SpecialPowers.Ci.nsIFile);
       file.append('635499_file');
-      var outStream = SpecialPowers.Cc["@mozilla.org/network/file-output-stream;1"].
-                      createInstance(SpecialPowers.Ci.nsIFileOutputStream);
-      outStream.init(file, 0x02 | 0x08 | 0x20, // write, create, truncate
-                     0666, 0);
-      outStream.write("foo", 3);
-      outStream.close();
+      // Only the file's path is used, so it doesn't need to be created.
+      // See also bug 1058977.
 
       SpecialPowers.wrap(input).value = file.path;
       checkValidity(input, true, apply, apply);
 
-      file.remove(false);
       break;
     case 'date':
       input.value = '2012-06-28';
diff --git a/content/html/content/test/forms/test_required_attribute.html b/content/html/content/test/forms/test_required_attribute.html
index 5e111844a9e..398acf2ce49 100644
--- a/content/html/content/test/forms/test_required_attribute.html
+++ b/content/html/content/test/forms/test_required_attribute.html
@@ -308,22 +308,18 @@ function checkInputRequiredValidityForFile()
   element.type = 'file'
   document.forms[0].appendChild(element);
 
-  function createFileWithData(fileName, fileData) {
+  function createFile(fileName) {
     var dirSvc = SpecialPowers.Cc["@mozilla.org/file/directory_service;1"]
                               .getService(SpecialPowers.Ci.nsIProperties);
     var testFile = dirSvc.get("ProfD", SpecialPowers.Ci.nsIFile);
     testFile.append(fileName);
-    var outStream = SpecialPowers.Cc["@mozilla.org/network/file-output-stream;1"].
-                    createInstance(SpecialPowers.Ci.nsIFileOutputStream);
-    outStream.init(testFile, 0x02 | 0x08 | 0x20, // write, create, truncate
-                   0666, 0);
-    outStream.write(fileData, fileData.length);
-    outStream.close();
+    // Only the file's path is used, so it doesn't need to be created.
+    // See also bug 1058977.
 
     return testFile;
   }
 
-  var file = createFileWithData("345822_file", "file content");
+  var file = createFile("345822_file");
 
   SpecialPowers.wrap(element).value = "";
   element.required = false;
@@ -350,7 +346,6 @@ function checkInputRequiredValidityForFile()
 
   element.required = true;
   SpecialPowers.wrap(element).value = '';
-  file.remove(false);
   document.forms[0].removeChild(element);
   checkSufferingFromBeingMissing(element, true);
 }
diff --git a/content/html/content/test/forms/test_step_attribute.html b/content/html/content/test/forms/test_step_attribute.html
index e692fa13d7b..2bcd21fbbfb 100644
--- a/content/html/content/test/forms/test_step_attribute.html
+++ b/content/html/content/test/forms/test_step_attribute.html
@@ -132,17 +132,12 @@ for (var test of data) {
                                 .getService(SpecialPowers.Ci.nsIProperties);
       var file = dirSvc.get("ProfD", SpecialPowers.Ci.nsIFile);
       file.append('635499_file');
-      var outStream = SpecialPowers.Cc["@mozilla.org/network/file-output-stream;1"].
-                      createInstance(SpecialPowers.Ci.nsIFileOutputStream);
-      outStream.init(file, 0x02 | 0x08 | 0x20, // write, create, truncate
-                     0666, 0);
-      outStream.write("foo", 3);
-      outStream.close();
+      // Only the file's path is used, so it doesn't need to be created.
+      // See also bug 1058977.
 
       SpecialPowers.wrap(input).value = file.path;
       checkValidity(input, true, apply);
 
-      file.remove(false);
       break;
     case 'date':
       // For date, the step is calulated on the timestamp since 1970-01-01
diff --git a/content/html/content/test/forms/test_submit_invalid_file.html b/content/html/content/test/forms/test_submit_invalid_file.html
index 76a7255ce7e..145d8f456e3 100644
--- a/content/html/content/test/forms/test_submit_invalid_file.html
+++ b/content/html/content/test/forms/test_submit_invalid_file.html
@@ -6,14 +6,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=702949
 <head>
   <meta charset="utf-8">
   <title>Test invalid file submission</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=702949">Mozilla Bug 702949</a>
 <p id="display"></p>
 <div id="content" style="display: none">
-  <form action='submit_invalid_file.sjs' method='post' target='result'
+  <form action='http://mochi.test:8888/chrome/content/html/content/test/forms/submit_invalid_file.sjs' method='post' target='result'
         enctype='multipart/form-data'>
     <input type='file' name='file'>
   </form>
diff --git a/content/html/content/test/reflect.js b/content/html/content/test/reflect.js
index 1e71d40ccdc..f73f2251903 100644
--- a/content/html/content/test/reflect.js
+++ b/content/html/content/test/reflect.js
@@ -248,6 +248,7 @@ function reflectUnsignedInt(aParameters)
  *     OR
  *    defaultValue        Object   [optional] object containing two attributes, 'invalid' and 'missing'
  *  - unsupportedValues   Array    [optional] valid values we do not support
+ *  - nullable            boolean  [optional] whether the attribute is nullable
  */
 function reflectLimitedEnumerated(aParameters)
 {
@@ -266,60 +267,73 @@ function reflectLimitedEnumerated(aParameters)
                                     ? aParameters.defaultValue : aParameters.defaultValue.missing
   var unsupportedValues = aParameters.unsupportedValues !== undefined
                             ? aParameters.unsupportedValues : [];
+  var nullable = aParameters.nullable;
 
   ok(idlAttr in element, idlAttr + " should be an IDL attribute of this element");
-  is(typeof element[idlAttr], "string", "'" + idlAttr + "' IDL attribute should be a string");
+  if (nullable) {
+    // The missing value default is null, which is typeof == "object"
+    is(typeof element[idlAttr], "object", "'" + idlAttr + "' IDL attribute should be null, which has typeof == object");
+    ise(element[idlAttr], null, "'" + idlAttr + "' IDL attribute should be null");
+  } else {
+    is(typeof element[idlAttr], "string", "'" + idlAttr + "' IDL attribute should be a string");
+  }
+
+  if (nullable) {
+    element.setAttribute(contentAttr, "something");
+    // Now it will be a string
+    is(typeof element[idlAttr], "string", "'" + idlAttr + "' IDL attribute should be a string");
+  }
 
   // Explicitly check the default value.
   element.removeAttribute(contentAttr);
-  is(element[idlAttr], defaultValueMissing,
-     "When no attribute is set, the value should be the default value.");
+  ise(element[idlAttr], defaultValueMissing,
+      "When no attribute is set, the value should be the default value.");
 
   // Check valid values.
   validValues.forEach(function (v) {
     element.setAttribute(contentAttr, v);
-    is(element[idlAttr], v,
-       v + " should be accepted as a valid value for " + idlAttr);
-    is(element.getAttribute(contentAttr), v,
-       "Content attribute should return the value it has been set to.");
+    ise(element[idlAttr], v,
+        "'" + v + "' should be accepted as a valid value for " + idlAttr);
+    ise(element.getAttribute(contentAttr), v,
+        "Content attribute should return the value it has been set to.");
     element.removeAttribute(contentAttr);
 
     element.setAttribute(contentAttr, v.toUpperCase());
-    is(element[idlAttr], v,
-       "Enumerated attributes should be case-insensitive.");
-    is(element.getAttribute(contentAttr), v.toUpperCase(),
-       "Content attribute should not be lower-cased.");
+    ise(element[idlAttr], v,
+        "Enumerated attributes should be case-insensitive.");
+    ise(element.getAttribute(contentAttr), v.toUpperCase(),
+        "Content attribute should not be lower-cased.");
     element.removeAttribute(contentAttr);
 
     element[idlAttr] = v;
-    is(element[idlAttr], v,
-       v + " should be accepted as a valid value for " + idlAttr);
-    is(element.getAttribute(contentAttr), v,
-       "Content attribute should return the value it has been set to.");
+    ise(element[idlAttr], v,
+        "'" + v + "' should be accepted as a valid value for " + idlAttr);
+    ise(element.getAttribute(contentAttr), v,
+        "Content attribute should return the value it has been set to.");
     element.removeAttribute(contentAttr);
 
     element[idlAttr] = v.toUpperCase();
-    is(element[idlAttr], v,
-       "Enumerated attributes should be case-insensitive.");
-    is(element.getAttribute(contentAttr), v.toUpperCase(),
-       "Content attribute should not be lower-cased.");
+    ise(element[idlAttr], v,
+        "Enumerated attributes should be case-insensitive.");
+    ise(element.getAttribute(contentAttr), v.toUpperCase(),
+        "Content attribute should not be lower-cased.");
     element.removeAttribute(contentAttr);
   });
 
   // Check invalid values.
   invalidValues.forEach(function (v) {
     element.setAttribute(contentAttr, v);
-    is(element[idlAttr], defaultValueInvalid,
-       "When the content attribute is set to an invalid value, the default value should be returned.");
-    is(element.getAttribute(contentAttr), v,
-       "Content attribute should not have been changed.");
+    ise(element[idlAttr], defaultValueInvalid,
+        "When the content attribute is set to an invalid value, the default value should be returned.");
+    ise(element.getAttribute(contentAttr), v,
+        "Content attribute should not have been changed.");
     element.removeAttribute(contentAttr);
 
     element[idlAttr] = v;
-    is(element[idlAttr], defaultValueInvalid,
-       "When the value is set to an invalid value, the default value should be returned.");
-    is(element.getAttribute(contentAttr), v,
-       "Content attribute should not have been changed.");
+    ise(element[idlAttr], defaultValueInvalid,
+        "When the value is set to an invalid value, the default value should be returned.");
+    ise(element.getAttribute(contentAttr), v,
+        "Content attribute should not have been changed.");
     element.removeAttribute(contentAttr);
   });
 
@@ -328,7 +342,7 @@ function reflectLimitedEnumerated(aParameters)
   unsupportedValues.forEach(function (v) {
     element.setAttribute(contentAttr, v);
     todo_is(element[idlAttr], v,
-            v + " should be accepted as a valid value for " + idlAttr);
+            "'" + v + "' should be accepted as a valid value for " + idlAttr);
     is(element.getAttribute(contentAttr), v,
        "Content attribute should return the value it has been set to.");
     element.removeAttribute(contentAttr);
@@ -342,7 +356,7 @@ function reflectLimitedEnumerated(aParameters)
 
     element[idlAttr] = v;
     todo_is(element[idlAttr], v,
-            v + " should be accepted as a valid value for " + idlAttr);
+            "'" + v + "' should be accepted as a valid value for " + idlAttr);
     is(element.getAttribute(contentAttr), v,
        "Content attribute should return the value it has been set to.");
     element.removeAttribute(contentAttr);
@@ -354,6 +368,18 @@ function reflectLimitedEnumerated(aParameters)
        "Content attribute should not be lower-cased.");
     element.removeAttribute(contentAttr);
   });
+
+  if (nullable) {
+    ise(defaultValueMissing, null,
+	"Missing default value should be null for nullable attributes");
+    ok(validValues.length > 0, "We better have at least one valid value");
+    element.setAttribute(contentAttr, validValues[0]);
+    ok(element.hasAttribute(contentAttr),
+       "Should have content attribute: we just set it");
+    element[idlAttr] = null;
+    ok(!element.hasAttribute(contentAttr),
+       "Should have removed content attribute");
+  }
 }
 
 /**
diff --git a/content/html/content/test/test_bug592802.html b/content/html/content/test/test_bug592802.html
index 8e5ae54e81d..c2c9df9ed58 100644
--- a/content/html/content/test/test_bug592802.html
+++ b/content/html/content/test/test_bug592802.html
@@ -60,7 +60,7 @@ SimpleTest.waitForFocus(function() {
   b2.click();
 
   // Now, we can launch tests when file picker isn't canceled.
-  MockFilePicker.useAnyFile();
+  MockFilePicker.useBlobFile();
   MockFilePicker.returnValue = MockFilePicker.returnOK;
 
   var b = document.getElementById('b');
diff --git a/content/html/content/test/test_bug742549.html b/content/html/content/test/test_bug742549.html
index 72ecfba9889..5ab88f36e32 100644
--- a/content/html/content/test/test_bug742549.html
+++ b/content/html/content/test/test_bug742549.html
@@ -24,10 +24,17 @@ var els = [ document.createElement("script"),
             document.createElementNS("http://www.w3.org/2000/svg", "script") ]
 
 for (var i = 0; i < els.length; ++i) {
-  reflectString({
+  reflectLimitedEnumerated({
     element: els[i],
     attribute: { content: "crossorigin", idl: "crossOrigin" },
-    otherValues: [ "anonymous", "use-credentials" ]
+    // "" is a valid value per spec, but gets mapped to the "anonymous" state,
+    // just like invalid values, so just list it under invalidValues
+    validValues: [ "anonymous", "use-credentials" ],
+    invalidValues: [
+      "", "  aNOnYmous   ", "  UsE-CreDEntIALS  ", "foobar", "FOOBAR", " fOoBaR  "
+    ],
+    defaultValue: { invalid: "anonymous", missing: null },
+    nullable: true,
   })
 }
 
diff --git a/content/html/content/test/test_img_attributes_reflection.html b/content/html/content/test/test_img_attributes_reflection.html
index 03dcf27c3e1..0272cfa9e08 100644
--- a/content/html/content/test/test_img_attributes_reflection.html
+++ b/content/html/content/test/test_img_attributes_reflection.html
@@ -26,15 +26,17 @@ reflectURL({
 
 todo("srcset" in document.createElement("img"), "Should implement srcset")
 
-// TODO: Bug 880997 - Make crossOrigin a limited enumerated attribute.
-reflectString({
+reflectLimitedEnumerated({
   element: document.createElement("img"),
   attribute: "crossOrigin",
-  otherValues: [
-    "", "anonymous", "ANONYMOUS", "  aNOnYmous    ",
-    "use-credentials", "USE-CREDENTIALS", "   UsE-CreDEntIALS      ",
-    "foobar", "FOOBAR", "  fOoBaR  "
-  ]
+  // "" is a valid value per spec, but gets mapped to the "anonymous" state,
+  // just like invalid values, so just list it under invalidValues
+  validValues: [ "anonymous", "use-credentials" ],
+  invalidValues: [
+    "", "  aNOnYmous   ", "  UsE-CreDEntIALS  ", "foobar", "FOOBAR", " fOoBaR  "
+  ],
+  defaultValue: { invalid: "anonymous", missing: null },
+  nullable: true,
 })
 
 reflectString({
diff --git a/content/html/content/test/test_link_attributes_reflection.html b/content/html/content/test/test_link_attributes_reflection.html
index e2ad56a1f76..db092f0efaa 100644
--- a/content/html/content/test/test_link_attributes_reflection.html
+++ b/content/html/content/test/test_link_attributes_reflection.html
@@ -21,12 +21,19 @@ reflectURL({
   attribute: "href",
 });
 
-// .crossOrigin (String)
-reflectString({
+// .crossOrigin (String or null)
+reflectLimitedEnumerated({
   element: document.createElement("link"),
   attribute: "crossOrigin",
-  otherValues: ["anonymous", "use-credentials"],
-});
+  // "" is a valid value per spec, but gets mapped to the "anonymous" state,
+  // just like invalid values, so just list it under invalidValues
+  validValues: [ "anonymous", "use-credentials" ],
+  invalidValues: [
+    "", "  aNOnYmous   ", "  UsE-CreDEntIALS  ", "foobar", "FOOBAR", " fOoBaR  "
+  ],
+  defaultValue: { invalid: "anonymous", missing: null },
+  nullable: true,
+})
 
 // .rel (String)
 reflectString({
diff --git a/content/media/DOMMediaStream.h b/content/media/DOMMediaStream.h
index efdfb7360a2..c5a82d4b12b 100644
--- a/content/media/DOMMediaStream.h
+++ b/content/media/DOMMediaStream.h
@@ -30,7 +30,9 @@ class nsXPCClassInfo;
 
 namespace mozilla {
 
+class DOMLocalMediaStream;
 class MediaStream;
+class MediaEngineSource;
 
 namespace dom {
 class AudioNode;
@@ -102,6 +104,8 @@ public:
 
   virtual void StopTrack(TrackID aTrackID);
 
+  virtual DOMLocalMediaStream* AsDOMLocalMediaStream() { return nullptr; }
+
   bool IsFinished();
   /**
    * Returns a principal indicating who may access this stream. The stream contents
@@ -301,6 +305,8 @@ public:
 
   virtual void Stop();
 
+  virtual MediaEngineSource* GetMediaEngine(TrackID aTrackID) { return nullptr; }
+
   /**
    * Create an nsDOMLocalMediaStream whose underlying stream is a SourceMediaStream.
    */
diff --git a/content/media/VideoUtils.h b/content/media/VideoUtils.h
index adcb49ebfb8..e4217330e62 100644
--- a/content/media/VideoUtils.h
+++ b/content/media/VideoUtils.h
@@ -168,9 +168,10 @@ static const int32_t MAX_VIDEO_HEIGHT = 3000;
 void ScaleDisplayByAspectRatio(nsIntSize& aDisplay, float aAspectRatio);
 
 // The amount of virtual memory reserved for thread stacks.
-#if (defined(XP_WIN) || defined(XP_MACOSX) || defined(LINUX)) && \
-    !defined(MOZ_ASAN)
+#if (defined(XP_WIN) || defined(LINUX)) && !defined(MOZ_ASAN)
 #define MEDIA_THREAD_STACK_SIZE (128 * 1024)
+#elif defined(XP_MACOSX) && !defined(MOZ_ASAN)
+#define MEDIA_THREAD_STACK_SIZE (256 * 1024)
 #else
 // All other platforms use their system defaults.
 #define MEDIA_THREAD_STACK_SIZE nsIThreadManager::DEFAULT_STACK_SIZE
diff --git a/content/media/fmp4/apple/AppleUtils.h b/content/media/fmp4/apple/AppleUtils.h
index d5ac736c420..f7506065661 100644
--- a/content/media/fmp4/apple/AppleUtils.h
+++ b/content/media/fmp4/apple/AppleUtils.h
@@ -64,7 +64,10 @@ public:
   {
     return &mRef;
   }
+
 private:
+  // Copy operator isn't supported and is not implemented.
+  AutoCFRelease<T>& operator=(const AutoCFRelease<T>&);
   T mRef;
 };
 
diff --git a/content/media/fmp4/apple/AppleVTDecoder.cpp b/content/media/fmp4/apple/AppleVTDecoder.cpp
index 5f44d9266d2..a18072dc472 100644
--- a/content/media/fmp4/apple/AppleVTDecoder.cpp
+++ b/content/media/fmp4/apple/AppleVTDecoder.cpp
@@ -6,17 +6,19 @@
 
 #include <CoreFoundation/CFString.h>
 
+#include "AppleCMLinker.h"
 #include "AppleUtils.h"
+#include "AppleVTDecoder.h"
+#include "AppleVTLinker.h"
 #include "mp4_demuxer/DecoderData.h"
 #include "MP4Reader.h"
 #include "MP4Decoder.h"
+#include "MediaData.h"
+#include "MacIOSurfaceImage.h"
+#include "mozilla/ArrayUtils.h"
 #include "nsAutoPtr.h"
 #include "nsThreadUtils.h"
-#include "AppleCMLinker.h"
-#include "AppleVTDecoder.h"
-#include "AppleVTLinker.h"
 #include "prlog.h"
-#include "MediaData.h"
 #include "VideoUtils.h"
 
 #ifdef PR_LOGGING
@@ -197,7 +199,6 @@ PlatformCallback(void* decompressionOutputRefCon,
   }
   if (flags & kVTDecodeInfo_FrameDropped) {
     NS_WARNING("  ...frame dropped...");
-    return;
   }
   MOZ_ASSERT(CFGetTypeID(image) == CVPixelBufferGetTypeID(),
     "VideoToolbox returned an unexpected image type");
@@ -239,81 +240,34 @@ nsresult
 AppleVTDecoder::OutputFrame(CVPixelBufferRef aImage,
                             nsAutoPtr<FrameRef> aFrameRef)
 {
-  size_t width = CVPixelBufferGetWidth(aImage);
-  size_t height = CVPixelBufferGetHeight(aImage);
-  LOG("  got decoded frame data... %ux%u %s", width, height,
-      CVPixelBufferIsPlanar(aImage) ? "planar" : "chunked");
-#ifdef DEBUG
-  size_t planes = CVPixelBufferGetPlaneCount(aImage);
-  for (size_t i = 0; i < planes; ++i) {
-    size_t stride = CVPixelBufferGetBytesPerRowOfPlane(aImage, i);
-    LOG("     plane %u %ux%u rowbytes %u",
-        (unsigned)i,
-        CVPixelBufferGetWidthOfPlane(aImage, i),
-        CVPixelBufferGetHeightOfPlane(aImage, i),
-        (unsigned)stride);
-  }
-  MOZ_ASSERT(planes == 2);
-#endif // DEBUG
-
-  VideoData::YCbCrBuffer buffer;
-
-  // Lock the returned image data.
-  CVReturn rv = CVPixelBufferLockBaseAddress(aImage, kCVPixelBufferLock_ReadOnly);
-  if (rv != kCVReturnSuccess) {
-    NS_ERROR("error locking pixel data");
-    mCallback->Error();
-    return NS_ERROR_FAILURE;
-  }
-  // Y plane.
-  buffer.mPlanes[0].mData =
-    static_cast<uint8_t*>(CVPixelBufferGetBaseAddressOfPlane(aImage, 0));
-  buffer.mPlanes[0].mStride = CVPixelBufferGetBytesPerRowOfPlane(aImage, 0);
-  buffer.mPlanes[0].mWidth = width;
-  buffer.mPlanes[0].mHeight = height;
-  buffer.mPlanes[0].mOffset = 0;
-  buffer.mPlanes[0].mSkip = 0;
-  // Cb plane.
-  buffer.mPlanes[1].mData =
-    static_cast<uint8_t*>(CVPixelBufferGetBaseAddressOfPlane(aImage, 1));
-  buffer.mPlanes[1].mStride = CVPixelBufferGetBytesPerRowOfPlane(aImage, 1);
-  buffer.mPlanes[1].mWidth = (width+1) / 2;
-  buffer.mPlanes[1].mHeight = (height+1) / 2;
-  buffer.mPlanes[1].mOffset = 0;
-  buffer.mPlanes[1].mSkip = 1;
-  // Cr plane.
-  buffer.mPlanes[2].mData =
-    static_cast<uint8_t*>(CVPixelBufferGetBaseAddressOfPlane(aImage, 1));
-  buffer.mPlanes[2].mStride = CVPixelBufferGetBytesPerRowOfPlane(aImage, 1);
-  buffer.mPlanes[2].mWidth = (width+1) / 2;
-  buffer.mPlanes[2].mHeight = (height+1) / 2;
-  buffer.mPlanes[2].mOffset = 1;
-  buffer.mPlanes[2].mSkip = 1;
+  IOSurfacePtr surface = MacIOSurfaceLib::CVPixelBufferGetIOSurface(aImage);
+  MOZ_ASSERT(surface, "VideoToolbox didn't return an IOSurface backed buffer");
 
+  nsRefPtr<MacIOSurface> macSurface = new MacIOSurface(surface);
   // Bounds.
   VideoInfo info;
-  info.mDisplay = nsIntSize(width, height);
+  info.mDisplay = nsIntSize(macSurface->GetWidth(), macSurface->GetHeight());
   info.mHasVideo = true;
   gfx::IntRect visible = gfx::IntRect(0,
                                       0,
                                       mConfig.display_width,
                                       mConfig.display_height);
 
-  // Copy the image data into our own format.
+  nsRefPtr<layers::Image> image =
+    mImageContainer->CreateImage(ImageFormat::MAC_IOSURFACE);
+  layers::MacIOSurfaceImage* videoImage =
+    static_cast<layers::MacIOSurfaceImage*>(image.get());
+  videoImage->SetSurface(macSurface);
+
   nsAutoPtr<VideoData> data;
-  data =
-    VideoData::Create(info,
-                      mImageContainer,
-                      nullptr,
-                      aFrameRef->byte_offset,
-                      aFrameRef->composition_timestamp,
-                      aFrameRef->duration,
-                      buffer,
-                      aFrameRef->is_sync_point,
-                      aFrameRef->decode_timestamp,
-                      visible);
-  // Unlock the returned image data.
-  CVPixelBufferUnlockBaseAddress(aImage, kCVPixelBufferLock_ReadOnly);
+  data = VideoData::CreateFromImage(info,
+                                    mImageContainer,
+                                    aFrameRef->byte_offset,
+                                    aFrameRef->composition_timestamp,
+                                    aFrameRef->duration, image.forget(),
+                                    aFrameRef->is_sync_point,
+                                    aFrameRef->decode_timestamp,
+                                    visible);
 
   if (!data) {
     NS_ERROR("Couldn't create VideoData for frame");
@@ -446,31 +400,43 @@ AppleVTDecoder::InitializeSession()
   }
 
   // Contruct video decoder selection spec.
-  AutoCFRelease<CFMutableDictionaryRef> spec =
-    CFDictionaryCreateMutable(NULL, 0,
-                              &kCFTypeDictionaryKeyCallBacks,
-                              &kCFTypeDictionaryValueCallBacks);
-// FIXME: Enabling hardware acceleration causes crashes in
-// VTDecompressionSessionCreate() with multiple videos. Bug 1055694
-#if 0
-  // This key is supported (or ignored) but not declared prior to OSX 10.9.
-  AutoCFRelease<CFStringRef>
-        kVTVideoDecoderSpecification_EnableHardwareAcceleratedVideoDecoder =
-        CFStringCreateWithCString(NULL, "EnableHardwareAcceleratedVideoDecoder",
-            kCFStringEncodingUTF8);
+  AutoCFRelease<CFDictionaryRef> spec = CreateDecoderSpecification();
 
-  CFDictionarySetValue(spec,
-      kVTVideoDecoderSpecification_EnableHardwareAcceleratedVideoDecoder,
-      kCFBooleanTrue);
-#endif
+  // Contruct output configuration.
+  AutoCFRelease<CFDictionaryRef> IOSurfaceProperties =
+    CFDictionaryCreate(NULL,
+                       NULL,
+                       NULL,
+                       0,
+                       &kCFTypeDictionaryKeyCallBacks,
+                       &kCFTypeDictionaryValueCallBacks);
+
+  SInt32 PixelFormatTypeValue = kCVPixelFormatType_32BGRA;
+  AutoCFRelease<CFNumberRef> PixelFormatTypeNumber =
+    CFNumberCreate(NULL, kCFNumberSInt32Type, &PixelFormatTypeValue);
+
+  const void* outputKeys[] = { kCVPixelBufferIOSurfacePropertiesKey,
+                               kCVPixelBufferPixelFormatTypeKey,
+                               kCVPixelBufferOpenGLCompatibilityKey };
+  const void* outputValues[] = { IOSurfaceProperties,
+                                 PixelFormatTypeNumber,
+                                 kCFBooleanTrue };
+  AutoCFRelease<CFDictionaryRef> outputConfiguration =
+    CFDictionaryCreate(NULL,
+                       outputKeys,
+                       outputValues,
+                       ArrayLength(outputKeys),
+                       &kCFTypeDictionaryKeyCallBacks,
+                       &kCFTypeDictionaryValueCallBacks);
 
   VTDecompressionOutputCallbackRecord cb = { PlatformCallback, this };
   rv = VTDecompressionSessionCreate(NULL, // Allocator.
                                     mFormat,
                                     spec, // Video decoder selection.
-                                    NULL, // Output video format.
+                                    outputConfiguration, // Output video format.
                                     &cb,
                                     &mSession);
+
   if (rv != noErr) {
     NS_ERROR("Couldn't create decompression session!");
     return NS_ERROR_FAILURE;
@@ -479,4 +445,21 @@ AppleVTDecoder::InitializeSession()
   return NS_OK;
 }
 
+CFDictionaryRef
+AppleVTDecoder::CreateDecoderSpecification()
+{
+  if (!AppleVTLinker::GetPropHWAccel()) {
+    return nullptr;
+  }
+
+  const void* specKeys[] = { AppleVTLinker::GetPropHWAccel() };
+  const void* specValues[] = { kCFBooleanTrue };
+  return CFDictionaryCreate(NULL,
+                            specKeys,
+                            specValues,
+                            ArrayLength(specKeys),
+                            &kCFTypeDictionaryKeyCallBacks,
+                            &kCFTypeDictionaryValueCallBacks);
+}
+
 } // namespace mozilla
diff --git a/content/media/fmp4/apple/AppleVTDecoder.h b/content/media/fmp4/apple/AppleVTDecoder.h
index 836c6c4865c..9b26569e8ed 100644
--- a/content/media/fmp4/apple/AppleVTDecoder.h
+++ b/content/media/fmp4/apple/AppleVTDecoder.h
@@ -55,6 +55,8 @@ private:
   nsresult WaitForAsynchronousFrames();
   void DrainReorderedFrames();
   void ClearReorderedFrames();
+
+  CFDictionaryRef CreateDecoderSpecification();
 };
 
 } // namespace mozilla
diff --git a/content/media/fmp4/apple/AppleVTLinker.cpp b/content/media/fmp4/apple/AppleVTLinker.cpp
index 74cd1ae6d8c..b983e93c553 100644
--- a/content/media/fmp4/apple/AppleVTLinker.cpp
+++ b/content/media/fmp4/apple/AppleVTLinker.cpp
@@ -24,6 +24,7 @@ AppleVTLinker::sLinkStatus = LinkStatus_INIT;
 
 void* AppleVTLinker::sLink = nullptr;
 nsrefcnt AppleVTLinker::sRefCount = 0;
+CFStringRef AppleVTLinker::skPropHWAccel = nullptr;
 
 #define LINK_FUNC(func) typeof(func) func;
 #include "AppleVTFunctions.h"
@@ -58,6 +59,10 @@ AppleVTLinker::Link()
 #include "AppleVTFunctions.h"
 #undef LINK_FUNC
 
+  // Will only resolve in 10.9 and later.
+  skPropHWAccel =
+    GetIOConst("kVTVideoDecoderSpecification_EnableHardwareAcceleratedVideoDecoder");
+
   LOG("Loaded VideoToolbox framework.");
   sLinkStatus = LinkStatus_SUCCEEDED;
   return true;
@@ -83,7 +88,25 @@ AppleVTLinker::Unlink()
     LOG("Unlinking VideoToolbox framework.");
     dlclose(sLink);
     sLink = nullptr;
+    skPropHWAccel = nullptr;
   }
 }
 
+/* static */ CFStringRef
+AppleVTLinker::GetIOConst(const char* symbol)
+{
+  CFStringRef* address = (CFStringRef*)dlsym(sLink, symbol);
+  if (!address) {
+    return nullptr;
+  }
+
+  return *address;
+}
+
+/* static */ CFStringRef
+AppleVTLinker::GetPropHWAccel()
+{
+  return skPropHWAccel;
+}
+
 } // namespace mozilla
diff --git a/content/media/fmp4/apple/AppleVTLinker.h b/content/media/fmp4/apple/AppleVTLinker.h
index a69b04e9480..9d7122cd393 100644
--- a/content/media/fmp4/apple/AppleVTLinker.h
+++ b/content/media/fmp4/apple/AppleVTLinker.h
@@ -22,16 +22,20 @@ class AppleVTLinker
 public:
   static bool Link();
   static void Unlink();
+  static CFStringRef GetPropHWAccel();
 
 private:
   static void* sLink;
   static nsrefcnt sRefCount;
+  static CFStringRef skPropHWAccel;
 
   static enum LinkStatus {
     LinkStatus_INIT = 0,
     LinkStatus_FAILED,
     LinkStatus_SUCCEEDED
   } sLinkStatus;
+
+  static CFStringRef GetIOConst(const char* symbol);
 };
 
 #define LINK_FUNC(func) extern typeof(func)* func;
diff --git a/content/media/gmp/GMPProcessParent.cpp b/content/media/gmp/GMPProcessParent.cpp
index fceb8b21796..d16976cdbea 100644
--- a/content/media/gmp/GMPProcessParent.cpp
+++ b/content/media/gmp/GMPProcessParent.cpp
@@ -9,10 +9,6 @@
 #include "base/string_util.h"
 #include "base/process_util.h"
 
-#ifdef XP_WIN
-#include <codecvt>
-#endif
-
 #include <string>
 
 using std::vector;
@@ -50,9 +46,8 @@ GMPProcessParent::Launch(int32_t aTimeoutMs)
   vector<string> args;
   args.push_back(mGMPPath);
 
-#ifdef XP_WIN
-  std::wstring_convert<std::codecvt_utf8<wchar_t>> converter;
-  std::wstring wGMPPath = converter.from_bytes(mGMPPath.c_str());
+#if defined(XP_WIN) && defined(MOZ_SANDBOX)
+  std::wstring wGMPPath = UTF8ToWide(mGMPPath.c_str());
   mAllowedFilesRead.push_back(wGMPPath + L"\\*");
 #endif
 
diff --git a/content/media/gmp/GMPStorageParent.cpp b/content/media/gmp/GMPStorageParent.cpp
index 9ec343febaf..0480b747c0e 100644
--- a/content/media/gmp/GMPStorageParent.cpp
+++ b/content/media/gmp/GMPStorageParent.cpp
@@ -82,7 +82,7 @@ GetGMPStorageDir(nsIFile** aTempDir, const nsString& aOrigin)
   // process (a UUID or somesuch), we can just append it un-hashed here.
   // This should reduce the chance of hash collsions exposing data.
   nsAutoString nodeIdHash;
-  nodeIdHash.AppendInt(HashString(aOrigin.get()));
+  nodeIdHash.AppendInt(HashString(static_cast<const char16_t*>(aOrigin.get())));
   rv = tmpFile->Append(nodeIdHash);
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
diff --git a/content/media/imagecapture/CaptureTask.cpp b/content/media/imagecapture/CaptureTask.cpp
index 539e8ad54f9..3f8181c6987 100644
--- a/content/media/imagecapture/CaptureTask.cpp
+++ b/content/media/imagecapture/CaptureTask.cpp
@@ -96,7 +96,7 @@ CaptureTask::NotifyQueuedTrackChanges(MediaStreamGraph* aGraph, TrackID aID,
   class EncodeComplete : public dom::EncodeCompleteCallback
   {
   public:
-    EncodeComplete(CaptureTask* aTask) : mTask(aTask) {}
+    explicit EncodeComplete(CaptureTask* aTask) : mTask(aTask) {}
 
     nsresult ReceiveBlob(already_AddRefed<dom::DOMFile> aBlob) MOZ_OVERRIDE
     {
@@ -167,7 +167,7 @@ CaptureTask::PostTrackEndEvent()
   class TrackEndRunnable : public nsRunnable
   {
   public:
-    TrackEndRunnable(CaptureTask* aTask)
+    explicit TrackEndRunnable(CaptureTask* aTask)
       : mTask(aTask) {}
 
     NS_IMETHOD Run()
diff --git a/content/media/imagecapture/ImageCapture.cpp b/content/media/imagecapture/ImageCapture.cpp
index de1dce95df8..ac0eee44c0b 100644
--- a/content/media/imagecapture/ImageCapture.cpp
+++ b/content/media/imagecapture/ImageCapture.cpp
@@ -11,8 +11,10 @@
 #include "mozilla/dom/ImageCaptureErrorEvent.h"
 #include "mozilla/dom/ImageCaptureErrorEventBinding.h"
 #include "mozilla/dom/VideoStreamTrack.h"
+#include "nsDOMFile.h"
 #include "nsIDocument.h"
 #include "CaptureTask.h"
+#include "MediaEngine.h"
 
 namespace mozilla {
 
@@ -77,6 +79,69 @@ ImageCapture::GetVideoStreamTrack() const
   return mVideoStreamTrack;
 }
 
+nsresult
+ImageCapture::TakePhotoByMediaEngine()
+{
+  // Callback for TakPhoto(), it also monitor the principal. If principal
+  // changes, it returns PHOTO_ERROR with security error.
+  class TakePhotoCallback : public MediaEngineSource::PhotoCallback,
+                            public DOMMediaStream::PrincipalChangeObserver
+  {
+  public:
+    TakePhotoCallback(DOMMediaStream* aStream, ImageCapture* aImageCapture)
+      : mStream(aStream)
+      , mImageCapture(aImageCapture)
+      , mPrincipalChanged(false)
+    {
+      MOZ_ASSERT(NS_IsMainThread());
+      mStream->AddPrincipalChangeObserver(this);
+    }
+
+    void PrincipalChanged(DOMMediaStream* aMediaStream) MOZ_OVERRIDE
+    {
+      mPrincipalChanged = true;
+    }
+
+    nsresult PhotoComplete(already_AddRefed<DOMFile> aBlob) MOZ_OVERRIDE
+    {
+      nsRefPtr<DOMFile> blob = aBlob;
+
+      if (mPrincipalChanged) {
+        return PhotoError(NS_ERROR_DOM_SECURITY_ERR);
+      }
+      return mImageCapture->PostBlobEvent(blob);
+    }
+
+    nsresult PhotoError(nsresult aRv) MOZ_OVERRIDE
+    {
+      return mImageCapture->PostErrorEvent(ImageCaptureError::PHOTO_ERROR, aRv);
+    }
+
+  protected:
+    ~TakePhotoCallback()
+    {
+      MOZ_ASSERT(NS_IsMainThread());
+      mStream->RemovePrincipalChangeObserver(this);
+    }
+
+    nsRefPtr<DOMMediaStream> mStream;
+    nsRefPtr<ImageCapture> mImageCapture;
+    bool mPrincipalChanged;
+  };
+
+  nsRefPtr<DOMMediaStream> domStream = mVideoStreamTrack->GetStream();
+  DOMLocalMediaStream* domLocalStream = domStream->AsDOMLocalMediaStream();
+  if (domLocalStream) {
+    nsRefPtr<MediaEngineSource> mediaEngine =
+      domLocalStream->GetMediaEngine(mVideoStreamTrack->GetTrackID());
+    nsRefPtr<MediaEngineSource::PhotoCallback> callback =
+      new TakePhotoCallback(domStream, this);
+    return mediaEngine->TakePhoto(callback);
+  }
+
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 void
 ImageCapture::TakePhoto(ErrorResult& aResult)
 {
@@ -90,12 +155,20 @@ ImageCapture::TakePhoto(ErrorResult& aResult)
     return;
   }
 
-  nsRefPtr<CaptureTask> task =
-    new CaptureTask(this, mVideoStreamTrack->GetTrackID());
+  // Try if MediaEngine supports taking photo.
+  nsresult rv = TakePhotoByMediaEngine();
 
-  // It adds itself into MediaStreamGraph, so ImageCapture doesn't need to hold the
-  // reference.
-  task->AttachStream();
+  // It falls back to MediaStreamGraph image capture if MediaEngine doesn't
+  // support TakePhoto().
+  if (rv == NS_ERROR_NOT_IMPLEMENTED) {
+    IC_LOG("MediaEngine doesn't support TakePhoto(), it falls back to MediaStreamGraph.");
+    nsRefPtr<CaptureTask> task =
+      new CaptureTask(this, mVideoStreamTrack->GetTrackID());
+
+    // It adds itself into MediaStreamGraph, so ImageCapture doesn't need to hold
+    // the reference.
+    task->AttachStream();
+  }
 }
 
 nsresult
diff --git a/content/media/imagecapture/ImageCapture.h b/content/media/imagecapture/ImageCapture.h
index fa585de0f94..b32547f4d33 100644
--- a/content/media/imagecapture/ImageCapture.h
+++ b/content/media/imagecapture/ImageCapture.h
@@ -41,6 +41,11 @@ class VideoStreamTrack;
  *  be sent back as a JPG format via Blob event.
  *
  *  All the functions in ImageCapture are run in main thread.
+ *
+ *  There are two ways to capture image, MediaEngineSource and MediaStreamGraph.
+ *  When the implementation of MediaEngineSource supports TakePhoto() in platform
+ *  like B2G, it uses the platform camera to grab image. Otherwise, it falls back
+ *  to the MediaStreamGraph way.
  */
 
 class ImageCapture MOZ_FINAL : public DOMEventTargetHelper
@@ -86,6 +91,10 @@ public:
 protected:
   virtual ~ImageCapture();
 
+  // Capture image by MediaEngine. If it's not support taking photo, this function
+  // should return NS_ERROR_NOT_IMPLEMENTED.
+  nsresult TakePhotoByMediaEngine();
+
   nsRefPtr<VideoStreamTrack> mVideoStreamTrack;
 };
 
diff --git a/content/media/mediasource/MediaSource.cpp b/content/media/mediasource/MediaSource.cpp
index 87540a0d0df..d27891982aa 100644
--- a/content/media/mediasource/MediaSource.cpp
+++ b/content/media/mediasource/MediaSource.cpp
@@ -339,6 +339,7 @@ MediaSource::Detach()
   }
   mDecoder->DetachMediaSource();
   mDecoder = nullptr;
+  mFirstSourceBufferInitialization = false;
   SetReadyState(MediaSourceReadyState::Closed);
   mDuration = UnspecifiedNaN<double>();
   if (mActiveSourceBuffers) {
@@ -395,6 +396,7 @@ MediaSource::MediaSource(nsPIDOMWindow* aWindow)
   , mDuration(UnspecifiedNaN<double>())
   , mDecoder(nullptr)
   , mReadyState(MediaSourceReadyState::Closed)
+  , mFirstSourceBufferInitialization(false)
 {
   MOZ_ASSERT(NS_IsMainThread());
   mSourceBuffers = new SourceBufferList(this);
@@ -482,6 +484,29 @@ MediaSource::NotifyEvicted(double aStart, double aEnd)
   mSourceBuffers->Evict(aStart, aEnd);
 }
 
+void
+MediaSource::QueueInitializationEvent()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  if (!mFirstSourceBufferInitialization) {
+    mFirstSourceBufferInitialization = true;
+  }
+  MSE_DEBUG("MediaSource(%p)::QueueInitializationEvent()", this);
+  nsRefPtr<nsIRunnable> task =
+    NS_NewRunnableMethod(this, &MediaSource::InitializationEvent);
+  NS_DispatchToMainThread(task);
+}
+
+void
+MediaSource::InitializationEvent()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+  MSE_DEBUG("MediaSource(%p)::InitializationEvent()", this);
+  if (mDecoder) {
+    mDecoder->PrepareReaderInitialization();
+  }
+}
+
 nsPIDOMWindow*
 MediaSource::GetParentObject() const
 {
diff --git a/content/media/mediasource/MediaSource.h b/content/media/mediasource/MediaSource.h
index d37c406ba76..e89b5f02b9c 100644
--- a/content/media/mediasource/MediaSource.h
+++ b/content/media/mediasource/MediaSource.h
@@ -90,6 +90,14 @@ public:
   // that were evicted are provided.
   void NotifyEvicted(double aStart, double aEnd);
 
+  // Queue InitializationEvent to run on the main thread.  Called when a
+  // SourceBuffer has an initialization segment appended, but only
+  // dispatched the first time (using mFirstSourceBufferInitialization).
+  // Demarcates the point in time at which only currently registered
+  // TrackBuffers are treated as essential by the MediaSourceReader for
+  // initialization.
+  void QueueInitializationEvent();
+
 private:
   ~MediaSource();
 
@@ -101,6 +109,8 @@ private:
 
   void DurationChange(double aNewDuration, ErrorResult& aRv);
 
+  void InitializationEvent();
+
   double mDuration;
 
   nsRefPtr<SourceBufferList> mSourceBuffers;
@@ -109,6 +119,8 @@ private:
   nsRefPtr<MediaSourceDecoder> mDecoder;
 
   MediaSourceReadyState mReadyState;
+
+  bool mFirstSourceBufferInitialization;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(MediaSource, MOZILLA_DOM_MEDIASOURCE_IMPLEMENTATION_IID)
diff --git a/content/media/mediasource/MediaSourceDecoder.cpp b/content/media/mediasource/MediaSourceDecoder.cpp
index 55a190cb96a..39063c492b7 100644
--- a/content/media/mediasource/MediaSourceDecoder.cpp
+++ b/content/media/mediasource/MediaSourceDecoder.cpp
@@ -173,19 +173,17 @@ MediaSourceDecoder::SetMediaSourceDuration(double aDuration)
 }
 
 void
-MediaSourceDecoder::WaitForData()
+MediaSourceDecoder::NotifyTimeRangesChanged()
 {
-  MSE_DEBUG("MediaSourceDecoder(%p)::WaitForData()", this);
-  ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
-  mon.Wait();
-}
-
-void
-MediaSourceDecoder::NotifyGotData()
-{
-  MSE_DEBUG("MediaSourceDecoder(%p)::NotifyGotData()", this);
   ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
   mon.NotifyAll();
 }
 
+void
+MediaSourceDecoder::PrepareReaderInitialization()
+{
+  MOZ_ASSERT(mReader);
+  mReader->PrepareInitialization();
+}
+
 } // namespace mozilla
diff --git a/content/media/mediasource/MediaSourceDecoder.h b/content/media/mediasource/MediaSourceDecoder.h
index ec058f63b4d..6efa09eb5ba 100644
--- a/content/media/mediasource/MediaSourceDecoder.h
+++ b/content/media/mediasource/MediaSourceDecoder.h
@@ -55,11 +55,13 @@ public:
 
   void SetMediaSourceDuration(double aDuration);
 
-  // Provide a mechanism for MediaSourceReader to block waiting on data from a SourceBuffer.
-  void WaitForData();
+  // Called whenever a TrackBuffer has new data appended or a new decoder
+  // initializes.  Safe to call from any thread.
+  void NotifyTimeRangesChanged();
 
-  // Called whenever a SourceBuffer has new data appended.
-  void NotifyGotData();
+  // Indicates the point in time at which the reader should consider
+  // registered TrackBuffers essential for initialization.
+  void PrepareReaderInitialization();
 
 private:
   // The owning MediaSource holds a strong reference to this decoder, and
diff --git a/content/media/mediasource/MediaSourceReader.cpp b/content/media/mediasource/MediaSourceReader.cpp
index 906544e014b..72e868d2a05 100644
--- a/content/media/mediasource/MediaSourceReader.cpp
+++ b/content/media/mediasource/MediaSourceReader.cpp
@@ -46,19 +46,33 @@ MediaSourceReader::MediaSourceReader(MediaSourceDecoder* aDecoder)
   , mEnded(false)
   , mAudioIsSeeking(false)
   , mVideoIsSeeking(false)
+  , mHasEssentialTrackBuffers(false)
 {
 }
 
+void
+MediaSourceReader::PrepareInitialization()
+{
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+  MSE_DEBUG("MediaSourceReader(%p)::PrepareInitialization trackBuffers=%u",
+            this, mTrackBuffers.Length());
+  mEssentialTrackBuffers.AppendElements(mTrackBuffers);
+  mHasEssentialTrackBuffers = true;
+  mDecoder->NotifyWaitingForResourcesStatusChanged();
+}
+
 bool
 MediaSourceReader::IsWaitingMediaResources()
 {
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-  for (uint32_t i = 0; i < mTrackBuffers.Length(); ++i) {
-    if (!mTrackBuffers[i]->IsReady()) {
+
+  for (uint32_t i = 0; i < mEssentialTrackBuffers.Length(); ++i) {
+    if (!mEssentialTrackBuffers[i]->IsReady()) {
       return true;
     }
   }
-  return mTrackBuffers.IsEmpty();
+
+  return !mHasEssentialTrackBuffers;
 }
 
 void
@@ -70,16 +84,15 @@ MediaSourceReader::RequestAudioData()
     GetCallback()->OnDecodeError();
     return;
   }
-  if (SwitchAudioReader(double(mLastAudioTime) / USECS_PER_S)) {
-    MSE_DEBUGV("MediaSourceReader(%p)::RequestAudioData switching audio reader", this);
-  }
+  mAudioIsSeeking = false;
+  SwitchAudioReader(double(mLastAudioTime) / USECS_PER_S);
   mAudioReader->RequestAudioData();
 }
 
 void
 MediaSourceReader::OnAudioDecoded(AudioData* aSample)
 {
-  MSE_DEBUGV("MediaSourceReader(%p)::OnAudioDecoded mTime=%lld mDuration=%lld d=%d",
+  MSE_DEBUGV("MediaSourceReader(%p)::OnAudioDecoded [mTime=%lld mDuration=%lld mDiscontinuity=%d]",
              this, aSample->mTime, aSample->mDuration, aSample->mDiscontinuity);
   if (mDropAudioBeforeThreshold) {
     if (aSample->mTime < mTimeThreshold) {
@@ -92,14 +105,12 @@ MediaSourceReader::OnAudioDecoded(AudioData* aSample)
     mDropAudioBeforeThreshold = false;
   }
 
-  // If we are seeking we need to make sure the first sample decoded after
-  // that seek has the mDiscontinuity field set to ensure the media decoder
-  // state machine picks up that the seek is complete.
-  if (mAudioIsSeeking) {
-    mAudioIsSeeking = false;
-    aSample->mDiscontinuity = true;
+  // Any OnAudioDecoded callbacks received while mAudioIsSeeking must be not
+  // update our last used timestamp, as these are emitted by the reader we're
+  // switching away from.
+  if (!mAudioIsSeeking) {
+    mLastAudioTime = aSample->mTime + aSample->mDuration;
   }
-  mLastAudioTime = aSample->mTime + aSample->mDuration;
   GetCallback()->OnAudioDecoded(aSample);
 }
 
@@ -134,16 +145,15 @@ MediaSourceReader::RequestVideoData(bool aSkipToNextKeyframe, int64_t aTimeThres
     mDropAudioBeforeThreshold = true;
     mDropVideoBeforeThreshold = true;
   }
-  if (SwitchVideoReader(double(mLastVideoTime) / USECS_PER_S)) {
-    MSE_DEBUGV("MediaSourceReader(%p)::RequestVideoData switching video reader", this);
-  }
+  mVideoIsSeeking = false;
+  SwitchVideoReader(double(mLastVideoTime) / USECS_PER_S);
   mVideoReader->RequestVideoData(aSkipToNextKeyframe, aTimeThreshold);
 }
 
 void
 MediaSourceReader::OnVideoDecoded(VideoData* aSample)
 {
-  MSE_DEBUGV("MediaSourceReader(%p)::OnVideoDecoded mTime=%lld mDuration=%lld d=%d",
+  MSE_DEBUGV("MediaSourceReader(%p)::OnVideoDecoded [mTime=%lld mDuration=%lld mDiscontinuity=%d]",
              this, aSample->mTime, aSample->mDuration, aSample->mDiscontinuity);
   if (mDropVideoBeforeThreshold) {
     if (aSample->mTime < mTimeThreshold) {
@@ -156,14 +166,12 @@ MediaSourceReader::OnVideoDecoded(VideoData* aSample)
     mDropVideoBeforeThreshold = false;
   }
 
-  // If we are seeking we need to make sure the first sample decoded after
-  // that seek has the mDiscontinuity field set to ensure the media decoder
-  // state machine picks up that the seek is complete.
-  if (mVideoIsSeeking) {
-    mVideoIsSeeking = false;
-    aSample->mDiscontinuity = true;
+  // Any OnVideoDecoded callbacks received while mVideoIsSeeking must be not
+  // update our last used timestamp, as these are emitted by the reader we're
+  // switching away from.
+  if (!mVideoIsSeeking) {
+    mLastVideoTime = aSample->mTime + aSample->mDuration;
   }
-  mLastVideoTime = aSample->mTime + aSample->mDuration;
   GetCallback()->OnVideoDecoded(aSample);
 }
 
@@ -195,70 +203,115 @@ void
 MediaSourceReader::Shutdown()
 {
   MediaDecoderReader::Shutdown();
-  for (uint32_t i = 0; i < mTrackBuffers.Length(); ++i) {
-    mTrackBuffers[i]->Shutdown();
-  }
-  mTrackBuffers.Clear();
   mAudioTrack = nullptr;
   mAudioReader = nullptr;
   mVideoTrack = nullptr;
   mVideoReader = nullptr;
+  for (uint32_t i = 0; i < mTrackBuffers.Length(); ++i) {
+    mTrackBuffers[i]->Shutdown();
+  }
+  mTrackBuffers.Clear();
 }
 
 void
 MediaSourceReader::BreakCycles()
 {
   MediaDecoderReader::BreakCycles();
-    for (uint32_t i = 0; i < mTrackBuffers.Length(); ++i) {
-    mTrackBuffers[i]->BreakCycles();
-  }
-  mTrackBuffers.Clear();
   mAudioTrack = nullptr;
   mAudioReader = nullptr;
   mVideoTrack = nullptr;
   mVideoReader = nullptr;
+  for (uint32_t i = 0; i < mTrackBuffers.Length(); ++i) {
+    mTrackBuffers[i]->BreakCycles();
+  }
+  mTrackBuffers.Clear();
+}
+
+bool
+MediaSourceReader::CanSelectAudioReader(MediaDecoderReader* aNewReader)
+{
+  AudioInfo currentInfo = mAudioReader->GetMediaInfo().mAudio;
+  AudioInfo newInfo = aNewReader->GetMediaInfo().mAudio;
+
+  // TODO: We can't handle switching audio formats yet.
+  if (currentInfo.mRate != newInfo.mRate ||
+      currentInfo.mChannels != newInfo.mChannels) {
+    MSE_DEBUGV("MediaSourceReader(%p)::CanSelectAudioReader(%p) skip reader due to format mismatch",
+               this, aNewReader);
+    return false;
+  }
+
+  if (aNewReader->AudioQueue().AtEndOfStream()) {
+    MSE_DEBUGV("MediaSourceReader(%p)::CanSelectAudioReader(%p) skip reader due to queue EOS",
+               this, aNewReader);
+    return false;
+  }
+
+  return true;
+}
+
+bool
+MediaSourceReader::CanSelectVideoReader(MediaDecoderReader* aNewReader)
+{
+  if (aNewReader->VideoQueue().AtEndOfStream()) {
+    MSE_DEBUGV("MediaSourceReader(%p)::CanSelectVideoReader(%p) skip reader due to queue EOS",
+               this, aNewReader);
+    return false;
+  }
+
+  return true;
+}
+
+already_AddRefed<MediaDecoderReader>
+MediaSourceReader::SelectReader(double aTarget,
+                                bool (MediaSourceReader::*aCanSelectReader)(MediaDecoderReader*),
+                                const nsTArray<nsRefPtr<SourceBufferDecoder>>& aTrackDecoders)
+{
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+
+  // Consider decoders in order of newest to oldest, as a newer decoder
+  // providing a given buffered range is expected to replace an older one.
+  for (int32_t i = aTrackDecoders.Length() - 1; i >= 0; --i) {
+    nsRefPtr<MediaDecoderReader> newReader = aTrackDecoders[i]->GetReader();
+
+    // Check the track-type-specific aspects first, as it's assumed these
+    // are cheaper than a buffered range comparison, which seems worthwhile
+    // to avoid on any reader we'd subsequently reject.
+    if (!(this->*aCanSelectReader)(newReader)) {
+      continue;
+    }
+
+    nsRefPtr<dom::TimeRanges> ranges = new dom::TimeRanges();
+    aTrackDecoders[i]->GetBuffered(ranges);
+    if (ranges->Find(aTarget) == dom::TimeRanges::NoIndex) {
+      MSE_DEBUGV("MediaSourceReader(%p)::SelectReader(%f) newReader=%p target not in ranges=%s",
+                 this, aTarget, newReader.get(), DumpTimeRanges(ranges).get());
+      continue;
+    }
+
+    return newReader.forget();
+  }
+
+  return nullptr;
 }
 
 bool
 MediaSourceReader::SwitchAudioReader(double aTarget)
 {
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-  // XXX: Can't handle adding an audio track after ReadMetadata yet.
+  // XXX: Can't handle adding an audio track after ReadMetadata.
   if (!mAudioTrack) {
     return false;
   }
-  auto& decoders = mAudioTrack->Decoders();
-  for (uint32_t i = 0; i < decoders.Length(); ++i) {
-    nsRefPtr<dom::TimeRanges> ranges = new dom::TimeRanges();
-    decoders[i]->GetBuffered(ranges);
-
-    MediaDecoderReader* newReader = decoders[i]->GetReader();
-    MSE_DEBUGV("MediaDecoderReader(%p)::SwitchAudioReader(%f) audioReader=%p reader=%p ranges=%s",
-               this, aTarget, mAudioReader.get(), newReader, DumpTimeRanges(ranges).get());
-
-    AudioInfo targetInfo = newReader->GetMediaInfo().mAudio;
-    AudioInfo currentInfo = mAudioReader->GetMediaInfo().mAudio;
-
-    // TODO: We can't handle switching audio formats yet.
-    if (currentInfo.mRate != targetInfo.mRate ||
-        currentInfo.mChannels != targetInfo.mChannels) {
-      continue;
-    }
-
-    if (ranges->Find(aTarget) != dom::TimeRanges::NoIndex) {
-      if (newReader->AudioQueue().AtEndOfStream()) {
-        continue;
-      }
-      if (mAudioReader) {
-        mAudioReader->SetIdle();
-      }
-      mAudioReader = newReader;
-      MSE_DEBUG("MediaDecoderReader(%p)::SwitchAudioReader(%f) switching to audio reader %p",
-                this, aTarget, mAudioReader.get());
-      return true;
-    }
+  nsRefPtr<MediaDecoderReader> newReader = SelectReader(aTarget,
+                                                        &MediaSourceReader::CanSelectAudioReader,
+                                                        mAudioTrack->Decoders());
+  if (newReader && newReader != mAudioReader) {
+    mAudioReader->SetIdle();
+    mAudioReader = newReader;
+    MSE_DEBUGV("MediaSourceReader(%p)::SwitchAudioReader switched reader to %p", this, mAudioReader.get());
+    return true;
   }
-
   return false;
 }
 
@@ -266,33 +319,19 @@ bool
 MediaSourceReader::SwitchVideoReader(double aTarget)
 {
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-  // XXX: Can't handle adding a video track after ReadMetadata yet.
+  // XXX: Can't handle adding a video track after ReadMetadata.
   if (!mVideoTrack) {
     return false;
   }
-  auto& decoders = mVideoTrack->Decoders();
-  for (uint32_t i = 0; i < decoders.Length(); ++i) {
-    nsRefPtr<dom::TimeRanges> ranges = new dom::TimeRanges();
-    decoders[i]->GetBuffered(ranges);
-
-    MediaDecoderReader* newReader = decoders[i]->GetReader();
-    MSE_DEBUGV("MediaDecoderReader(%p)::SwitchVideoReader(%f) videoReader=%p reader=%p ranges=%s",
-               this, aTarget, mVideoReader.get(), newReader, DumpTimeRanges(ranges).get());
-
-    if (ranges->Find(aTarget) != dom::TimeRanges::NoIndex) {
-      if (newReader->VideoQueue().AtEndOfStream()) {
-        continue;
-      }
-      if (mVideoReader) {
-        mVideoReader->SetIdle();
-      }
-      mVideoReader = newReader;
-      MSE_DEBUG("MediaDecoderReader(%p)::SwitchVideoReader(%f) switching to video reader %p",
-                this, aTarget, mVideoReader.get());
-      return true;
-    }
+  nsRefPtr<MediaDecoderReader> newReader = SelectReader(aTarget,
+                                                        &MediaSourceReader::CanSelectVideoReader,
+                                                        mVideoTrack->Decoders());
+  if (newReader && newReader != mVideoReader) {
+    mVideoReader->SetIdle();
+    mVideoReader = newReader;
+    MSE_DEBUGV("MediaSourceReader(%p)::SwitchVideoReader switched reader to %p", this, mVideoReader.get());
+    return true;
   }
-
   return false;
 }
 
@@ -367,6 +406,7 @@ void
 MediaSourceReader::OnTrackBufferConfigured(TrackBuffer* aTrackBuffer, const MediaInfo& aInfo)
 {
   ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+  MOZ_ASSERT(aTrackBuffer->IsReady());
   MOZ_ASSERT(mTrackBuffers.Contains(aTrackBuffer));
   if (aInfo.HasAudio() && !mAudioTrack) {
     MSE_DEBUG("MediaSourceReader(%p)::OnTrackBufferConfigured %p audio", this, aTrackBuffer);
@@ -398,6 +438,21 @@ private:
   nsRefPtr<AbstractMediaDecoder> mDecoder;
 };
 
+void
+MediaSourceReader::WaitForTimeRange(double aTime)
+{
+  MSE_DEBUG("MediaSourceReader(%p)::WaitForTimeRange(%f)", this, aTime);
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+
+  // Loop until we have the requested time range in the active TrackBuffers.
+  // Ideally, this wait loop would use an async request and callback
+  // instead.  Bug 1056441 covers that change.
+  while (!TrackBuffersContainTime(aTime) && !IsShutdown() && !IsEnded()) {
+    MSE_DEBUG("MediaSourceReader(%p)::WaitForTimeRange(%f) waiting", this, aTime);
+    mon.Wait();
+  }
+}
+
 bool
 MediaSourceReader::TrackBuffersContainTime(double aTime)
 {
@@ -433,14 +488,7 @@ MediaSourceReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
     NS_DispatchToMainThread(new ChangeToHaveMetadata(mDecoder));
   }
 
-  // Loop until we have the requested time range in the source buffers.
-  // This is a workaround for our lack of async functionality in the
-  // MediaDecoderStateMachine. Bug 979104 implements what we need and
-  // we'll remove this for an async approach based on that in bug 1056441.
-  while (!TrackBuffersContainTime(target) && !IsShutdown() && !IsEnded()) {
-    MSE_DEBUG("MediaSourceReader(%p)::Seek waiting for target=%f", this, target);
-    static_cast<MediaSourceDecoder*>(mDecoder)->WaitForData();
-  }
+  WaitForTimeRange(target);
 
   if (IsShutdown()) {
     return NS_ERROR_FAILURE;
@@ -448,8 +496,8 @@ MediaSourceReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
 
   if (mAudioTrack) {
     mAudioIsSeeking = true;
-    DebugOnly<bool> ok = SwitchAudioReader(target);
-    MOZ_ASSERT(ok && static_cast<SourceBufferDecoder*>(mAudioReader->GetDecoder())->ContainsTime(target));
+    SwitchAudioReader(target);
+    MOZ_ASSERT(static_cast<SourceBufferDecoder*>(mAudioReader->GetDecoder())->ContainsTime(target));
     nsresult rv = mAudioReader->Seek(aTime, aStartTime, aEndTime, aCurrentTime);
     MSE_DEBUG("MediaSourceReader(%p)::Seek audio reader=%p rv=%x", this, mAudioReader.get(), rv);
     if (NS_FAILED(rv)) {
@@ -458,8 +506,8 @@ MediaSourceReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
   }
   if (mVideoTrack) {
     mVideoIsSeeking = true;
-    DebugOnly<bool> ok = SwitchVideoReader(target);
-    MOZ_ASSERT(ok && static_cast<SourceBufferDecoder*>(mVideoReader->GetDecoder())->ContainsTime(target));
+    SwitchVideoReader(target);
+    MOZ_ASSERT(static_cast<SourceBufferDecoder*>(mVideoReader->GetDecoder())->ContainsTime(target));
     nsresult rv = mVideoReader->Seek(aTime, aStartTime, aEndTime, aCurrentTime);
     MSE_DEBUG("MediaSourceReader(%p)::Seek video reader=%p rv=%x", this, mVideoReader.get(), rv);
     if (NS_FAILED(rv)) {
@@ -472,11 +520,15 @@ MediaSourceReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
 nsresult
 MediaSourceReader::ReadMetadata(MediaInfo* aInfo, MetadataTags** aTags)
 {
-  MSE_DEBUG("MediaSourceReader(%p)::ReadMetadata tracks=%u", this, mTrackBuffers.Length());
+  bool waiting = IsWaitingMediaResources();
+  MSE_DEBUG("MediaSourceReader(%p)::ReadMetadata waiting=%d tracks=%u/%u audio=%p video=%p",
+            this, waiting, mEssentialTrackBuffers.Length(), mTrackBuffers.Length(),
+            mAudioTrack.get(), mVideoTrack.get());
   // ReadMetadata is called *before* checking IsWaitingMediaResources.
-  if (IsWaitingMediaResources()) {
+  if (waiting) {
     return NS_OK;
   }
+  mEssentialTrackBuffers.Clear();
   if (!mAudioTrack && !mVideoTrack) {
     MSE_DEBUG("MediaSourceReader(%p)::ReadMetadata missing track: mAudioTrack=%p mVideoTrack=%p",
               this, mAudioTrack.get(), mVideoTrack.get());
diff --git a/content/media/mediasource/MediaSourceReader.h b/content/media/mediasource/MediaSourceReader.h
index 9f49c15e372..a2cf3d7f0fd 100644
--- a/content/media/mediasource/MediaSourceReader.h
+++ b/content/media/mediasource/MediaSourceReader.h
@@ -40,6 +40,10 @@ public:
     return NS_OK;
   }
 
+  // Indicates the point in time at which the reader should consider
+  // registered TrackBuffers essential for initialization.
+  void PrepareInitialization();
+
   bool IsWaitingMediaResources() MOZ_OVERRIDE;
 
   void RequestAudioData() MOZ_OVERRIDE;
@@ -101,10 +105,32 @@ private:
   bool SwitchAudioReader(double aTarget);
   bool SwitchVideoReader(double aTarget);
 
+  // Return a reader from the set available in aTrackDecoders that is considered
+  // usable by the aCanUserReader callback and has data available in the range
+  // requested by aTarget.
+  // aCanSelectReader is passed each reader available in aTrackDecoders and is
+  // expected to return true if the reader is considerable selectable.
+  already_AddRefed<MediaDecoderReader> SelectReader(double aTarget,
+                                                    bool (MediaSourceReader::*aCanSelectReader)(MediaDecoderReader*),
+                                                    const nsTArray<nsRefPtr<SourceBufferDecoder>>& aTrackDecoders);
+
+  // Passed to SelectReader to enforce any track format specific requirements.
+  // In the case of CanSelectAudioReader, verifies that aNewReader has a
+  // matching audio format to the existing reader, as format switching is not
+  // yet supported.
+  bool CanSelectAudioReader(MediaDecoderReader* aNewReader);
+  bool CanSelectVideoReader(MediaDecoderReader* aNewReader);
+
+  // Waits on the decoder monitor for aTime to become available in the active
+  // TrackBuffers.  Used to block a Seek call until the necessary data has been
+  // provided to the relevant SourceBuffers.
+  void WaitForTimeRange(double aTime);
+
   nsRefPtr<MediaDecoderReader> mAudioReader;
   nsRefPtr<MediaDecoderReader> mVideoReader;
 
   nsTArray<nsRefPtr<TrackBuffer>> mTrackBuffers;
+  nsTArray<nsRefPtr<TrackBuffer>> mEssentialTrackBuffers;
   nsRefPtr<TrackBuffer> mAudioTrack;
   nsRefPtr<TrackBuffer> mVideoTrack;
 
@@ -125,6 +151,8 @@ private:
   // after a seek.
   bool mAudioIsSeeking;
   bool mVideoIsSeeking;
+
+  bool mHasEssentialTrackBuffers;
 };
 
 } // namespace mozilla
diff --git a/content/media/mediasource/SourceBuffer.cpp b/content/media/mediasource/SourceBuffer.cpp
index d68359d83a6..c340739e4dd 100644
--- a/content/media/mediasource/SourceBuffer.cpp
+++ b/content/media/mediasource/SourceBuffer.cpp
@@ -440,8 +440,13 @@ SourceBuffer::Remove(double aStart, double aEnd, ErrorResult& aRv)
     return;
   }
   StartUpdating();
-  /// TODO: Run coded frame removal algorithm asynchronously (would call StopUpdating()).
-  StopUpdating();
+  /// TODO: Run coded frame removal algorithm.
+
+  // Run the final step of the coded frame removal algorithm asynchronously
+  // to ensure the SourceBuffer's updating flag transition behaves as
+  // required by the spec.
+  nsCOMPtr<nsIRunnable> event = NS_NewRunnableMethod(this, &SourceBuffer::StopUpdating);
+  NS_DispatchToMainThread(event);
 }
 
 void
@@ -561,9 +566,10 @@ SourceBuffer::AppendData(const uint8_t* aData, uint32_t aLength, ErrorResult& aR
   // TODO: Run coded frame eviction algorithm.
   // TODO: Test buffer full flag.
   StartUpdating();
-  // TODO: Run buffer append algorithm asynchronously (would call StopUpdating()).
+  // TODO: Run more of the buffer append algorithm asynchronously.
   if (mParser->IsInitSegmentPresent(aData, aLength)) {
     MSE_DEBUG("SourceBuffer(%p)::AppendData: New initialization segment.", this);
+    mMediaSource->QueueInitializationEvent();
     mTrackBuffer->DiscardDecoder();
     if (!mTrackBuffer->NewDecoder()) {
       aRv.Throw(NS_ERROR_FAILURE); // XXX: Review error handling.
@@ -631,13 +637,16 @@ SourceBuffer::AppendData(const uint8_t* aData, uint32_t aLength, ErrorResult& aR
     // the current start point.
     mMediaSource->NotifyEvicted(0.0, GetBufferedStart());
   }
-  StopUpdating();
+
+  // Run the final step of the buffer append algorithm asynchronously to
+  // ensure the SourceBuffer's updating flag transition behaves as required
+  // by the spec.
+  nsCOMPtr<nsIRunnable> event = NS_NewRunnableMethod(this, &SourceBuffer::StopUpdating);
+  NS_DispatchToMainThread(event);
 
   // Schedule the state machine thread to ensure playback starts
   // if required when data is appended.
   mMediaSource->GetDecoder()->ScheduleStateMachineThread();
-
-  mMediaSource->GetDecoder()->NotifyGotData();
 }
 
 double
diff --git a/content/media/mediasource/TrackBuffer.cpp b/content/media/mediasource/TrackBuffer.cpp
index a1659bd366c..1807bd3b077 100644
--- a/content/media/mediasource/TrackBuffer.cpp
+++ b/content/media/mediasource/TrackBuffer.cpp
@@ -91,6 +91,7 @@ TrackBuffer::Shutdown()
   for (uint32_t i = 0; i < mDecoders.Length(); ++i) {
     mDecoders[i]->GetReader()->Shutdown();
   }
+  mInitializedDecoders.Clear();
   NS_DispatchToMainThread(new ReleaseDecoderTask(mDecoders));
   MOZ_ASSERT(mDecoders.IsEmpty());
   mParentDecoder = nullptr;
@@ -105,10 +106,13 @@ TrackBuffer::AppendData(const uint8_t* aData, uint32_t aLength)
   }
 
   SourceBufferResource* resource = mCurrentDecoder->GetResource();
+  int64_t appendOffset = resource->GetLength();
+  resource->AppendData(aData, aLength);
   // XXX: For future reference: NDA call must run on the main thread.
   mCurrentDecoder->NotifyDataArrived(reinterpret_cast<const char*>(aData),
-                                     aLength, resource->GetLength());
-  resource->AppendData(aData, aLength);
+                                     aLength, appendOffset);
+  mParentDecoder->NotifyTimeRangesChanged();
+
   return true;
 }
 
@@ -135,8 +139,9 @@ TrackBuffer::EvictBefore(double aTime)
 double
 TrackBuffer::Buffered(dom::TimeRanges* aRanges)
 {
+  ReentrantMonitorAutoEnter mon(mParentDecoder->GetReentrantMonitor());
   MOZ_ASSERT(NS_IsMainThread());
-  // XXX check default if mDecoders empty?
+
   double highestEndTime = 0;
 
   for (uint32_t i = 0; i < mDecoders.Length(); ++i) {
@@ -163,6 +168,7 @@ TrackBuffer::NewDecoder()
   }
   ReentrantMonitorAutoEnter mon(mParentDecoder->GetReentrantMonitor());
   mCurrentDecoder = decoder;
+  mDecoders.AppendElement(decoder);
 
   mLastStartTimestamp = 0;
   mLastEndTimestamp = UnspecifiedNaN<double>();
@@ -206,6 +212,10 @@ TrackBuffer::InitializeDecoder(nsRefPtr<SourceBufferDecoder> aDecoder)
     MSE_DEBUG("TrackBuffer(%p): Reader %p failed to initialize rv=%x audio=%d video=%d",
               this, reader, rv, mi.HasAudio(), mi.HasVideo());
     aDecoder->SetTaskQueue(nullptr);
+    {
+        ReentrantMonitorAutoEnter mon(mParentDecoder->GetReentrantMonitor());
+        mDecoders.RemoveElement(aDecoder);
+    }
     NS_DispatchToMainThread(new ReleaseDecoderTask(aDecoder));
     return;
   }
@@ -230,14 +240,15 @@ TrackBuffer::RegisterDecoder(nsRefPtr<SourceBufferDecoder> aDecoder)
   aDecoder->SetTaskQueue(nullptr);
   const MediaInfo& info = aDecoder->GetReader()->GetMediaInfo();
   // Initialize the track info since this is the first decoder.
-  if (mDecoders.IsEmpty()) {
+  if (mInitializedDecoders.IsEmpty()) {
     mHasAudio = info.HasAudio();
     mHasVideo = info.HasVideo();
     mParentDecoder->OnTrackBufferConfigured(this, info);
   } else if ((info.HasAudio() && !mHasAudio) || (info.HasVideo() && !mHasVideo)) {
     MSE_DEBUG("TrackBuffer(%p)::RegisterDecoder with mismatched audio/video tracks", this);
   }
-  mDecoders.AppendElement(aDecoder);
+  mInitializedDecoders.AppendElement(aDecoder);
+  mParentDecoder->NotifyTimeRangesChanged();
 }
 
 void
@@ -270,7 +281,7 @@ bool
 TrackBuffer::IsReady()
 {
   ReentrantMonitorAutoEnter mon(mParentDecoder->GetReentrantMonitor());
-  MOZ_ASSERT((mHasAudio || mHasVideo) || mDecoders.IsEmpty());
+  MOZ_ASSERT((mHasAudio || mHasVideo) || mInitializedDecoders.IsEmpty());
   return HasInitSegment() && (mHasAudio || mHasVideo);
 }
 
@@ -300,9 +311,9 @@ bool
 TrackBuffer::ContainsTime(double aTime)
 {
   ReentrantMonitorAutoEnter mon(mParentDecoder->GetReentrantMonitor());
-  for (uint32_t i = 0; i < mDecoders.Length(); ++i) {
+  for (uint32_t i = 0; i < mInitializedDecoders.Length(); ++i) {
     nsRefPtr<dom::TimeRanges> r = new dom::TimeRanges();
-    mDecoders[i]->GetBuffered(r);
+    mInitializedDecoders[i]->GetBuffered(r);
     if (r->Find(aTime) != dom::TimeRanges::NoIndex) {
       return true;
     }
@@ -317,7 +328,9 @@ TrackBuffer::BreakCycles()
   for (uint32_t i = 0; i < mDecoders.Length(); ++i) {
     mDecoders[i]->GetReader()->BreakCycles();
   }
-  mDecoders.Clear();
+  mInitializedDecoders.Clear();
+  NS_DispatchToMainThread(new ReleaseDecoderTask(mDecoders));
+  MOZ_ASSERT(mDecoders.IsEmpty());
   mParentDecoder = nullptr;
 }
 
@@ -333,7 +346,7 @@ const nsTArray<nsRefPtr<SourceBufferDecoder>>&
 TrackBuffer::Decoders()
 {
   // XXX assert OnDecodeThread
-  return mDecoders;
+  return mInitializedDecoders;
 }
 
 } // namespace mozilla
diff --git a/content/media/mediasource/TrackBuffer.h b/content/media/mediasource/TrackBuffer.h
index ac6b18aefd5..ba37c973ae8 100644
--- a/content/media/mediasource/TrackBuffer.h
+++ b/content/media/mediasource/TrackBuffer.h
@@ -77,9 +77,9 @@ public:
   // Call ResetDecode() on each decoder in mDecoders.
   void ResetDecode();
 
-  // Returns a reference to mDecoders, used by MediaSourceReader to select
-  // decoders.
-  // TODO: Refactor to a clenaer interface between TrackBuffer and MediaSourceReader.
+  // Returns a reference to mInitializedDecoders, used by MediaSourceReader
+  // to select decoders.
+  // TODO: Refactor to a cleaner interface between TrackBuffer and MediaSourceReader.
   const nsTArray<nsRefPtr<SourceBufferDecoder>>& Decoders();
 
 private:
@@ -102,10 +102,14 @@ private:
   // NewDecoder.
   RefPtr<MediaTaskQueue> mTaskQueue;
 
-  // All of the initialized decoders managed by this TrackBuffer.  Access
-  // protected by mParentDecoder's monitor.
+  // All of the decoders managed by this TrackBuffer.  Access protected by
+  // mParentDecoder's monitor.
   nsTArray<nsRefPtr<SourceBufferDecoder>> mDecoders;
 
+  // Contains only the initialized decoders managed by this TrackBuffer.
+  // Access protected by mParentDecoder's monitor.
+  nsTArray<nsRefPtr<SourceBufferDecoder>> mInitializedDecoders;
+
   // The decoder that the owning SourceBuffer is currently appending data to.
   nsRefPtr<SourceBufferDecoder> mCurrentDecoder;
 
diff --git a/content/media/mediasource/test/crashtests/931388.html b/content/media/mediasource/test/crashtests/931388.html
new file mode 100644
index 00000000000..cdb5bd9add0
--- /dev/null
+++ b/content/media/mediasource/test/crashtests/931388.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var v = document.createElement('video');
+  v.src = URL.createObjectURL(new MediaSource());
+  v.play();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/content/media/mediasource/test/crashtests/crashtests.list b/content/media/mediasource/test/crashtests/crashtests.list
index 7803deeefb4..e16ec261d25 100644
--- a/content/media/mediasource/test/crashtests/crashtests.list
+++ b/content/media/mediasource/test/crashtests/crashtests.list
@@ -1,3 +1,4 @@
 test-pref(media.mediasource.enabled,true) load 926665.html
+test-pref(media.mediasource.enabled,true) load 931388.html
 test-pref(media.mediasource.enabled,true) load 1005366.html
 test-pref(media.mediasource.enabled,true) load 1059035.html
diff --git a/content/media/mediasource/test/mediasource.js b/content/media/mediasource/test/mediasource.js
new file mode 100644
index 00000000000..bca2fd2b528
--- /dev/null
+++ b/content/media/mediasource/test/mediasource.js
@@ -0,0 +1,20 @@
+// Helpers for Media Source Extensions tests
+
+function runWithMSE(testFunction) {
+  addLoadEvent(() => SpecialPowers.pushPrefEnv({"set": [[ "media.mediasource.enabled", true ]]}, testFunction));
+}
+
+function fetchWithXHR(uri, onLoadFunction) {
+  var xhr = new XMLHttpRequest();
+  xhr.open("GET", uri, true);
+  xhr.responseType = "blob";
+  xhr.addEventListener("load", function (e) {
+    is(xhr.status, 200, "fetchWithXHR load uri='" + uri + "' status=" + xhr.status);
+    var rdr = new FileReader();
+    rdr.addEventListener("load", function (e) {
+      onLoadFunction(e.target.result);
+    });
+    rdr.readAsArrayBuffer(e.target.response);
+  });
+  xhr.send();
+};
diff --git a/content/media/mediasource/test/mochitest.ini b/content/media/mediasource/test/mochitest.ini
index f566151b471..58a4cdf9053 100644
--- a/content/media/mediasource/test/mochitest.ini
+++ b/content/media/mediasource/test/mochitest.ini
@@ -1,12 +1,13 @@
 [DEFAULT]
-skip-if = e10s
-support-files = seek.webm seek.webm^headers^
+skip-if = e10s || buildapp == 'b2g' # b2g( ReferenceError: MediaSource is not defined)
+support-files =
+  mediasource.js
+  seek.webm seek.webm^headers^
+  seek_lowres.webm seek_lowres.webm^headers^
 
+[test_BufferedSeek.html]
+[test_FrameSelection.html]
 [test_MediaSource.html]
-skip-if = buildapp == 'b2g' # b2g( ReferenceError: MediaSource is not defined)
-
-[test_SplitAppend.html]
-skip-if = buildapp == 'b2g' # b2g( ReferenceError: MediaSource is not defined)
-
 [test_SplitAppendDelay.html]
-skip-if = buildapp == 'b2g' # b2g( ReferenceError: MediaSource is not defined)
+[test_SplitAppend.html]
+
diff --git a/content/media/mediasource/test/seek_lowres.webm b/content/media/mediasource/test/seek_lowres.webm
new file mode 100644
index 00000000000..8a76e064703
Binary files /dev/null and b/content/media/mediasource/test/seek_lowres.webm differ
diff --git a/content/media/mediasource/test/seek_lowres.webm^headers^ b/content/media/mediasource/test/seek_lowres.webm^headers^
new file mode 100644
index 00000000000..4030ea1d3dd
--- /dev/null
+++ b/content/media/mediasource/test/seek_lowres.webm^headers^
@@ -0,0 +1 @@
+Cache-Control: no-store
diff --git a/content/media/mediasource/test/test_BufferedSeek.html b/content/media/mediasource/test/test_BufferedSeek.html
new file mode 100644
index 00000000000..bb87efb5677
--- /dev/null
+++ b/content/media/mediasource/test/test_BufferedSeek.html
@@ -0,0 +1,63 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>MSE: seeking in buffered range</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+runWithMSE(function () {
+  var ms = new MediaSource();
+
+  var v = document.createElement("video");
+  v.preload = "auto";
+  v.src = URL.createObjectURL(ms);
+  document.body.appendChild(v);
+
+  ms.addEventListener("sourceopen", function () {
+    var sb = ms.addSourceBuffer("video/webm");
+
+    fetchWithXHR("seek.webm", function (arrayBuffer) {
+      sb.appendBuffer(new Uint8Array(arrayBuffer));
+      sb.addEventListener("updateend", function () {
+        ms.endOfStream()
+      });
+    });
+
+    var target = 2;
+
+    v.addEventListener("loadedmetadata", function () {
+      if (v.currentTime != target &&
+          v.buffered.length &&
+          target >= v.buffered.start(0) &&
+          target < v.buffered.end(0)) {
+        v.currentTime = target;
+      }
+    });
+
+    var wasSeeking = false;
+
+    v.addEventListener("seeking", function () {
+      wasSeeking = true;
+      is(v.currentTime, target, "Video currentTime not at target");
+    });
+
+    v.addEventListener("seeked", function () {
+      ok(wasSeeking, "Received expected seeking and seeked events");
+      is(v.currentTime, target, "Video currentTime not at target");
+      v.parentNode.removeChild(v);
+      SimpleTest.finish();
+    });
+  });
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/mediasource/test/test_FrameSelection.html b/content/media/mediasource/test/test_FrameSelection.html
new file mode 100644
index 00000000000..c69626d19cd
--- /dev/null
+++ b/content/media/mediasource/test/test_FrameSelection.html
@@ -0,0 +1,79 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>MSE: verify correct frames selected for given position</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+runWithMSE(function () {
+  var ms = new MediaSource();
+
+  var v = document.createElement("video");
+  v.preload = "auto";
+  v.src = URL.createObjectURL(ms);
+  document.body.appendChild(v);
+
+  ms.addEventListener("sourceopen", function () {
+    var sb = ms.addSourceBuffer("video/webm");
+
+    fetchWithXHR("seek.webm", function (arrayBuffer) {
+      // Append entire file covering range [0, 4].
+      sb.appendBuffer(new Uint8Array(arrayBuffer));
+    });
+
+    var targets = [{ currentTime: 3, videoWidth: 160, videoHeight: 120 },
+                   { currentTime: 2, videoWidth: 160, videoHeight: 120 },
+                   { currentTime: 0, videoWidth: 320, videoHeight: 240 }];
+    var target;
+
+    v.addEventListener("loadedmetadata", function () {
+      is(v.currentTime, 0, "currentTime has incorrect initial value");
+      is(v.videoWidth, 320, "videoWidth has incorrect initial value");
+      is(v.videoHeight, 240, "videoHeight has incorrect initial value");
+
+      fetchWithXHR("seek_lowres.webm", function (arrayBuffer) {
+        // Append initialization segment.
+        sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 438));
+        var first = true;
+        sb.addEventListener("updateend", function () {
+          if (first) {
+            // Append media segment covering range [2, 4].
+            sb.appendBuffer(new Uint8Array(arrayBuffer, 51003));
+            first = false;
+          } else {
+            ms.endOfStream();
+          }
+        });
+        target = targets.shift();
+        v.currentTime = target.currentTime;
+      });
+    });
+
+    v.addEventListener("seeked", function () {
+      is(v.currentTime, target.currentTime, "Video currentTime not at target");
+
+      is(v.videoWidth, target.videoWidth, "videoWidth has incorrect final value");
+      is(v.videoHeight, target.videoHeight, "videoHeight has incorrect final value");
+
+      target = targets.shift();
+      if (target) {
+        v.currentTime = target.currentTime;
+      } else {
+        v.parentNode.removeChild(v);
+        SimpleTest.finish();
+      }
+    });
+  });
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/mediasource/test/test_MediaSource.html b/content/media/mediasource/test/test_MediaSource.html
index a23d1e801ad..20d56390604 100644
--- a/content/media/mediasource/test/test_MediaSource.html
+++ b/content/media/mediasource/test/test_MediaSource.html
@@ -1,8 +1,9 @@
 <!DOCTYPE HTML>
 <html>
 <head>
-  <title>Test whether we can create an MediaSource interface</title>
+  <title>MSE: basic functionality</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
@@ -11,71 +12,73 @@
 
 SimpleTest.waitForExplicitFinish();
 
-addLoadEvent(function() {
-  ok(!window.MediaSource, "MediaSource should be hidden behind a pref");
-  var accessThrows = false;
-  try {
-    new MediaSource();
-  } catch (e) {
-    accessThrows = true;
-  }
-  ok(accessThrows, "MediaSource should be hidden behind a pref");
-  SpecialPowers.pushPrefEnv({"set": [[ "media.mediasource.enabled", true ]]},
-                            function () {
-    SpecialPowers.setBoolPref("media.mediasource.enabled", true);
-    var ms = new MediaSource();
-    ok(ms, "Create a MediaSource object");
-    ok(ms instanceof EventTarget, "MediaSource must be an EventTarget");
-    is(ms.readyState, "closed", "New MediaSource must be in closed state");
-    // Force wrapper creation, tests for leaks.
-    ms.foo = null;
-    var o = URL.createObjectURL(ms);
-    ok(o, "Create an objectURL from the MediaSource");
-    var v = document.createElement("video");
-    v.preload = "auto";
-    document.body.appendChild(v);
-    v.src = o;
-    ms.addEventListener("sourceopen", function () {
-      ok(true, "Receive a sourceopen event");
-      is(ms.readyState, "open", "MediaSource must be in open state after sourceopen");
-      var sb = ms.addSourceBuffer("video/webm");
-      ok(sb, "Create a SourceBuffer");
-      is(ms.sourceBuffers.length, 1, "MediaSource.sourceBuffers is expected length");
-      is(ms.sourceBuffers[0], sb, "SourceBuffer in list matches our SourceBuffer");
-      fetch("seek.webm", function (blob) {
-        var r = new FileReader();
-        r.addEventListener("load", function (e) {
-          sb.appendBuffer(new Uint8Array(e.target.result));
-          ms.endOfStream();
-          v.play();
-        });
-        r.readAsArrayBuffer(blob);
-      });
+addLoadEvent(function () {
+  ok(!window.MediaSource && !window.SourceBuffer && !window.SourceBufferList,
+     "MediaSource should be hidden behind a pref");
+  SimpleTest.doesThrow(() => new MediaSource, "MediaSource should be hidden behind a pref");
+});
+
+runWithMSE(function () {
+  SimpleTest.doesThrow(() => new SourceBuffer, "new SourceBuffer should fail");
+  SimpleTest.doesThrow(() => new SourceBufferList, "new SourceBufferList direct should fail");
+
+  var ms = new MediaSource();
+  ok(ms, "Create a MediaSource object");
+  ok(ms instanceof EventTarget, "MediaSource must be an EventTarget");
+  is(ms.readyState, "closed", "New MediaSource must be in closed state");
+
+  // Wrapper creation, tests for leaks.
+  SpecialPowers.wrap(ms);
+
+  // Set an expando to force wrapper creation, tests for leaks.
+  ms.foo = null;
+
+  var o = URL.createObjectURL(ms);
+  ok(o, "Create an objectURL from the MediaSource");
+
+  var v = document.createElement("video");
+  v.preload = "auto";
+  v.src = o;
+  document.body.appendChild(v);
+
+  ms.addEventListener("sourceopen", function () {
+    ok(true, "Receive a sourceopen event");
+    is(ms.readyState, "open", "MediaSource must be in open state after sourceopen");
+    var sb = ms.addSourceBuffer("video/webm");
+    ok(sb, "Create a SourceBuffer");
+    is(ms.sourceBuffers.length, 1, "MediaSource.sourceBuffers is expected length");
+    is(ms.sourceBuffers[0], sb, "SourceBuffer in list matches our SourceBuffer");
+    is(ms.activeSourceBuffers[0], sb, "SourceBuffer in active list matches our SourceBuffer");
+
+    fetchWithXHR("seek.webm", function (arrayBuffer) {
+      sb.appendBuffer(new Uint8Array(arrayBuffer));
+      is(sb.updating, true, "SourceBuffer.updating is expected value after appendBuffer");
     });
-    ms.addEventListener("sourceended", function () {
-      ok(true, "Receive a sourceended event");
-      is(ms.readyState, "ended", "MediaSource must be in ended state after sourceended");
+
+    sb.addEventListener("update", function () {
+      is(sb.updating, false, "SourceBuffer.updating is expected value in update event");
+      ms.endOfStream();
     });
-    v.addEventListener("ended", function () {
-      is(v.duration, 4, "Video has correct duration");
-      v.parentNode.removeChild(v);
-      SimpleTest.finish();
+
+    sb.addEventListener("updateend", function () {
+      is(sb.updating, false, "SourceBuffer.updating is expected value in updateend event");
+      v.play();
     });
   });
+
+  ms.addEventListener("sourceended", function () {
+    ok(true, "Receive a sourceended event");
+    is(ms.readyState, "ended", "MediaSource must be in ended state after sourceended");
+  });
+
+  v.addEventListener("ended", function () {
+    is(v.duration, 4, "Video has correct duration");
+    is(v.currentTime, 4, "Video has played to end");
+    v.parentNode.removeChild(v);
+    SimpleTest.finish();
+  });
 });
 
-function fetch(src, cb) {
-  var xhr = new XMLHttpRequest();
-  xhr.open("GET", src, true);
-  xhr.responseType = "blob";
-  xhr.addEventListener("load", function (e) {
-    if (xhr.status != 200) {
-      return false;
-    }
-    cb(xhr.response);
-  });
-  xhr.send();
-};
 </script>
 </pre>
 </body>
diff --git a/content/media/mediasource/test/test_SplitAppend.html b/content/media/mediasource/test/test_SplitAppend.html
index d0265b41f83..353ac50fe2e 100644
--- a/content/media/mediasource/test/test_SplitAppend.html
+++ b/content/media/mediasource/test/test_SplitAppend.html
@@ -1,8 +1,9 @@
 <!DOCTYPE HTML>
 <html>
 <head>
-  <title>Test whether we can create an MediaSource interface</title>
+  <title>MSE: append initialization and media segment separately</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
@@ -11,72 +12,40 @@
 
 SimpleTest.waitForExplicitFinish();
 
-addLoadEvent(function() {
-  ok(!window.MediaSource, "MediaSource should be hidden behind a pref");
-  var accessThrows = false;
-  try {
-    new MediaSource();
-  } catch (e) {
-    accessThrows = true;
-  }
-  ok(accessThrows, "MediaSource should be hidden behind a pref");
-  SpecialPowers.pushPrefEnv({"set": [[ "media.mediasource.enabled", true ]]},
-                            function () {
-    SpecialPowers.setBoolPref("media.mediasource.enabled", true);
-    var ms = new MediaSource();
-    ok(ms, "Create a MediaSource object");
-    ok(ms instanceof EventTarget, "MediaSource must be an EventTarget");
-    is(ms.readyState, "closed", "New MediaSource must be in closed state");
-    // Force wrapper creation, tests for leaks.
-    ms.foo = null;
-    var o = URL.createObjectURL(ms);
-    ok(o, "Create an objectURL from the MediaSource");
-    var v = document.createElement("video");
-    v.preload = "auto";
-    document.body.appendChild(v);
-    v.src = o;
-    ms.addEventListener("sourceopen", function () {
-      ok(true, "Receive a sourceopen event");
-      is(ms.readyState, "open", "MediaSource must be in open state after sourceopen");
-      var sb = ms.addSourceBuffer("video/webm");
-      ok(sb, "Create a SourceBuffer");
-      is(ms.sourceBuffers.length, 1, "MediaSource.sourceBuffers is expected length");
-      is(ms.sourceBuffers[0], sb, "SourceBuffer in list matches our SourceBuffer");
-      fetch("seek.webm", function (blob) {
-        var r = new FileReader();
-        r.addEventListener("load", function (e) {
-          sb.appendBuffer(new Uint8Array(e.target.result, 0, 318));
-          sb.appendBuffer(new Uint8Array(e.target.result, 318));
+runWithMSE(function () {
+  var ms = new MediaSource();
+
+  var v = document.createElement("video");
+  v.preload = "auto";
+  v.src = URL.createObjectURL(ms);
+  document.body.appendChild(v);
+
+  ms.addEventListener("sourceopen", function () {
+    var sb = ms.addSourceBuffer("video/webm");
+
+    fetchWithXHR("seek.webm", function (arrayBuffer) {
+      sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 318));
+      var first = true;
+      sb.addEventListener("updateend", function () {
+        if (first) {
+          sb.appendBuffer(new Uint8Array(arrayBuffer, 318));
+          first = false;
+        } else {
           ms.endOfStream();
-          v.play();
-        });
-        r.readAsArrayBuffer(blob);
+        }
       });
+      v.play();
     });
-    ms.addEventListener("sourceended", function () {
-      ok(true, "Receive a sourceended event");
-      is(ms.readyState, "ended", "MediaSource must be in ended state after sourceended");
-    });
-    v.addEventListener("ended", function () {
-      is(v.duration, 4, "Video has correct duration");
-      v.parentNode.removeChild(v);
-      SimpleTest.finish();
-    });
+  });
+
+  v.addEventListener("ended", function () {
+    is(v.duration, 4, "Video has correct duration");
+    is(v.currentTime, 4, "Video has played to end");
+    v.parentNode.removeChild(v);
+    SimpleTest.finish();
   });
 });
 
-function fetch(src, cb) {
-  var xhr = new XMLHttpRequest();
-  xhr.open("GET", src, true);
-  xhr.responseType = "blob";
-  xhr.addEventListener("load", function (e) {
-    if (xhr.status != 200) {
-      return false;
-    }
-    cb(xhr.response);
-  });
-  xhr.send();
-};
 </script>
 </pre>
 </body>
diff --git a/content/media/mediasource/test/test_SplitAppendDelay.html b/content/media/mediasource/test/test_SplitAppendDelay.html
index 4fc63bd5fe6..8602ee656e6 100644
--- a/content/media/mediasource/test/test_SplitAppendDelay.html
+++ b/content/media/mediasource/test/test_SplitAppendDelay.html
@@ -1,8 +1,9 @@
 <!DOCTYPE HTML>
 <html>
 <head>
-  <title>Test whether we can create an MediaSource interface</title>
+  <title>MSE: append segments with delay</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
@@ -11,74 +12,42 @@
 
 SimpleTest.waitForExplicitFinish();
 
-addLoadEvent(function() {
-  ok(!window.MediaSource, "MediaSource should be hidden behind a pref");
-  var accessThrows = false;
-  try {
-    new MediaSource();
-  } catch (e) {
-    accessThrows = true;
-  }
-  ok(accessThrows, "MediaSource should be hidden behind a pref");
-  SpecialPowers.pushPrefEnv({"set": [[ "media.mediasource.enabled", true ]]},
-                            function () {
-    SpecialPowers.setBoolPref("media.mediasource.enabled", true);
-    var ms = new MediaSource();
-    ok(ms, "Create a MediaSource object");
-    ok(ms instanceof EventTarget, "MediaSource must be an EventTarget");
-    is(ms.readyState, "closed", "New MediaSource must be in closed state");
-    // Force wrapper creation, tests for leaks.
-    ms.foo = null;
-    var o = URL.createObjectURL(ms);
-    ok(o, "Create an objectURL from the MediaSource");
-    var v = document.createElement("video");
-    v.preload = "auto";
-    document.body.appendChild(v);
-    v.src = o;
-    ms.addEventListener("sourceopen", function () {
-      ok(true, "Receive a sourceopen event");
-      is(ms.readyState, "open", "MediaSource must be in open state after sourceopen");
-      var sb = ms.addSourceBuffer("video/webm");
-      ok(sb, "Create a SourceBuffer");
-      is(ms.sourceBuffers.length, 1, "MediaSource.sourceBuffers is expected length");
-      is(ms.sourceBuffers[0], sb, "SourceBuffer in list matches our SourceBuffer");
-      fetch("seek.webm", function (blob) {
-        var r = new FileReader();
-        r.addEventListener("load", function (e) {
-          sb.appendBuffer(new Uint8Array(e.target.result, 0, 318));
+runWithMSE(function () {
+  var ms = new MediaSource();
+
+  var v = document.createElement("video");
+  v.preload = "auto";
+  v.src = URL.createObjectURL(ms);
+  document.body.appendChild(v);
+
+  ms.addEventListener("sourceopen", function () {
+    var sb = ms.addSourceBuffer("video/webm");
+
+    fetchWithXHR("seek.webm", function (arrayBuffer) {
+      sb.appendBuffer(new Uint8Array(arrayBuffer, 0, 318));
+      var first = true;
+      sb.addEventListener("updateend", function () {
+        if (first) {
           window.setTimeout(function () {
-            sb.appendBuffer(new Uint8Array(e.target.result, 318));
-            ms.endOfStream();
+            sb.appendBuffer(new Uint8Array(arrayBuffer, 318));
+            first = false;
           }, 1000);
-          v.play();
-        });
-        r.readAsArrayBuffer(blob);
+        } else {
+          ms.endOfStream();
+        }
       });
+      v.play();
     });
-    ms.addEventListener("sourceended", function () {
-      ok(true, "Receive a sourceended event");
-      is(ms.readyState, "ended", "MediaSource must be in ended state after sourceended");
-    });
-    v.addEventListener("ended", function () {
-      is(v.duration, 4, "Video has correct duration");
-      v.parentNode.removeChild(v);
-      SimpleTest.finish();
-    });
+  });
+
+  v.addEventListener("ended", function () {
+    is(v.duration, 4, "Video has correct duration");
+    is(v.currentTime, 4, "Video has played to end");
+    v.parentNode.removeChild(v);
+    SimpleTest.finish();
   });
 });
 
-function fetch(src, cb) {
-  var xhr = new XMLHttpRequest();
-  xhr.open("GET", src, true);
-  xhr.responseType = "blob";
-  xhr.addEventListener("load", function (e) {
-    if (xhr.status != 200) {
-      return false;
-    }
-    cb(xhr.response);
-  });
-  xhr.send();
-};
 </script>
 </pre>
 </body>
diff --git a/content/media/ogg/OggCodecState.cpp b/content/media/ogg/OggCodecState.cpp
index bc348a14a6b..8456d2a0756 100644
--- a/content/media/ogg/OggCodecState.cpp
+++ b/content/media/ogg/OggCodecState.cpp
@@ -1104,6 +1104,9 @@ static const long SKELETON_4_0_MIN_HEADER_LEN = 80;
 // Minimum length in bytes of a Skeleton 4.0 index packet.
 static const long SKELETON_4_0_MIN_INDEX_LEN = 42;
 
+// Minimum length in bytes of a Skeleton 3.0/4.0 Fisbone packet.
+static const long SKELETON_MIN_FISBONE_LEN = 52;
+
 // Minimum possible size of a compressed index keypoint.
 static const size_t MIN_KEY_POINT_SIZE = 2;
 
@@ -1127,18 +1130,34 @@ static const size_t INDEX_FIRST_NUMER_OFFSET = 26;
 static const size_t INDEX_LAST_NUMER_OFFSET = 34;
 static const size_t INDEX_KEYPOINT_OFFSET = 42;
 
+// Byte-offsets of the fields in the Skeleton Fisbone packet.
+static const size_t FISBONE_MSG_FIELDS_OFFSET = 8;
+static const size_t FISBONE_SERIALNO_OFFSET = 12;
+
 static bool IsSkeletonBOS(ogg_packet* aPacket)
 {
-  return aPacket->bytes >= SKELETON_MIN_HEADER_LEN && 
+  static_assert(SKELETON_MIN_HEADER_LEN >= 8,
+                "Minimum length of skeleton BOS header incorrect");
+  return aPacket->bytes >= SKELETON_MIN_HEADER_LEN &&
          memcmp(reinterpret_cast<char*>(aPacket->packet), "fishead", 8) == 0;
 }
 
 static bool IsSkeletonIndex(ogg_packet* aPacket)
 {
+  static_assert(SKELETON_4_0_MIN_INDEX_LEN >= 5,
+                "Minimum length of skeleton index header incorrect");
   return aPacket->bytes >= SKELETON_4_0_MIN_INDEX_LEN &&
          memcmp(reinterpret_cast<char*>(aPacket->packet), "index", 5) == 0;
 }
 
+static bool IsSkeletonFisbone(ogg_packet* aPacket)
+{
+  static_assert(SKELETON_MIN_FISBONE_LEN >= 8,
+                "Minimum length of skeleton fisbone header incorrect");
+  return aPacket->bytes >= SKELETON_MIN_FISBONE_LEN &&
+         memcmp(reinterpret_cast<char*>(aPacket->packet), "fisbone", 8) == 0;
+}
+
 // Reads a variable length encoded integer at p. Will not read
 // past aLimit. Returns pointer to character after end of integer.
 static const unsigned char* ReadVariableLengthInt(const unsigned char* p,
@@ -1367,6 +1386,85 @@ nsresult SkeletonState::GetDuration(const nsTArray<uint32_t>& aTracks,
   return duration.isValid() ? NS_OK : NS_ERROR_FAILURE;
 }
 
+bool SkeletonState::DecodeFisbone(ogg_packet* aPacket)
+{
+  if (aPacket->bytes < static_cast<long>(FISBONE_MSG_FIELDS_OFFSET + 4)) {
+    return false;
+  }
+  uint32_t offsetMsgField = LittleEndian::readUint32(aPacket->packet + FISBONE_MSG_FIELDS_OFFSET);
+
+  if (aPacket->bytes < static_cast<long>(FISBONE_SERIALNO_OFFSET + 4)) {
+      return false;
+  }
+  uint32_t serialno = LittleEndian::readUint32(aPacket->packet + FISBONE_SERIALNO_OFFSET);
+
+  CheckedUint32 checked_fields_pos = CheckedUint32(FISBONE_MSG_FIELDS_OFFSET) + offsetMsgField;
+  if (!checked_fields_pos.isValid() ||
+      aPacket->bytes < static_cast<int64_t>(checked_fields_pos.value())) {
+    return false;
+  }
+  int64_t msgLength = aPacket->bytes - checked_fields_pos.value();
+  char* msgProbe = (char*)aPacket->packet + checked_fields_pos.value();
+  char* msgHead = msgProbe;
+  nsAutoPtr<MessageField> field(new MessageField());
+
+  const static FieldPatternType kFieldTypeMaps[] = {
+      {"Content-Type:", eContentType},
+      {"Role:", eRole},
+      {"Name:", eName},
+      {"Language:", eLanguage},
+      {"Title:", eTitle},
+      {"Display-hint:", eDisplayHint},
+      {"Altitude:", eAltitude},
+      {"TrackOrder:", eTrackOrder},
+      {"Track dependencies:", eTrackDependencies}
+  };
+
+  bool isContentTypeParsed = false;
+  while (msgLength > 1) {
+    if (*msgProbe == '\r' && *(msgProbe+1) == '\n') {
+      nsAutoCString strMsg(msgHead, msgProbe-msgHead);
+      for (size_t i = 0; i < ArrayLength(kFieldTypeMaps); i++) {
+        if (strMsg.Find(kFieldTypeMaps[i].mPatternToRecognize) != -1) {
+          // The content of message header fields follows [RFC2822], and the
+          // mandatory message field must be encoded in US-ASCII, others
+          // must be be encoded in UTF-8. "Content-Type" must come first
+          // for all of message header fields.
+          // See http://svn.annodex.net/standards/draft-pfeiffer-oggskeleton-current.txt.
+          if (i != 0 && !isContentTypeParsed) {
+            return false;
+          }
+
+          if ((i == 0 && IsASCII(strMsg)) || (i != 0 && IsUTF8(strMsg))) {
+            EMsgHeaderType eHeaderType = kFieldTypeMaps[i].mMsgHeaderType;
+            if (!field->mValuesStore.Contains(eHeaderType)) {
+              uint32_t nameLen = strlen(kFieldTypeMaps[i].mPatternToRecognize);
+              field->mValuesStore.Put(eHeaderType, new nsCString(msgHead+nameLen,
+                                                                 msgProbe-msgHead-nameLen));
+            }
+            isContentTypeParsed = i==0 ? true : isContentTypeParsed;
+          }
+          break;
+        }
+      }
+      msgProbe += 2;
+      msgLength -= 2;
+      msgHead = msgProbe;
+      continue;
+    }
+    msgLength--;
+    msgProbe++;
+  };
+
+  if (!mMsgFieldStore.Contains(serialno)) {
+    mMsgFieldStore.Put(serialno, field.forget());
+  } else {
+    return false;
+  }
+
+  return true;
+}
+
 bool SkeletonState::DecodeHeader(ogg_packet* aPacket)
 {
   nsAutoRef<ogg_packet> autoRelease(aPacket);
@@ -1396,6 +1494,8 @@ bool SkeletonState::DecodeHeader(ogg_packet* aPacket)
     return true;
   } else if (IsSkeletonIndex(aPacket) && mVersion >= SKELETON_VERSION(4,0)) {
     return DecodeIndex(aPacket);
+  } else if (IsSkeletonFisbone(aPacket)) {
+    return DecodeFisbone(aPacket);
   } else if (aPacket->e_o_s) {
     mDoneReadingHeaders = true;
     return true;
diff --git a/content/media/ogg/OggCodecState.h b/content/media/ogg/OggCodecState.h
index 87458d9da68..b115f31a567 100644
--- a/content/media/ogg/OggCodecState.h
+++ b/content/media/ogg/OggCodecState.h
@@ -382,10 +382,35 @@ private:
 // version numbers.
 #define SKELETON_VERSION(major, minor) (((major)<<16)|(minor))
 
+enum EMsgHeaderType {
+  eContentType,
+  eRole,
+  eName,
+  eLanguage,
+  eTitle,
+  eDisplayHint,
+  eAltitude,
+  eTrackOrder,
+  eTrackDependencies
+};
+
+typedef struct {
+  const char* mPatternToRecognize;
+  EMsgHeaderType mMsgHeaderType;
+} FieldPatternType;
+
+// Stores the message information for different logical bitstream.
+typedef struct {
+  nsClassHashtable<nsUint32HashKey, nsCString> mValuesStore;
+} MessageField;
+
 class SkeletonState : public OggCodecState {
 public:
   explicit SkeletonState(ogg_page* aBosPage);
   ~SkeletonState();
+
+  nsClassHashtable<nsUint32HashKey, MessageField> mMsgFieldStore;
+
   CodecType GetType() { return TYPE_SKELETON; }
   bool DecodeHeader(ogg_packet* aPacket);
   int64_t Time(int64_t granulepos) { return -1; }
@@ -454,6 +479,8 @@ private:
 
   // Decodes an index packet. Returns false on failure.
   bool DecodeIndex(ogg_packet* aPacket);
+  // Decodes an fisbone packet. Returns false on failure.
+  bool DecodeFisbone(ogg_packet* aPacket);
 
   // Gets the keypoint you must seek to in order to get the keyframe required
   // to render the stream at time aTarget on stream with serial aSerialno.
diff --git a/content/media/ogg/OggReader.cpp b/content/media/ogg/OggReader.cpp
index 054c07394ea..d7eff58e5f7 100644
--- a/content/media/ogg/OggReader.cpp
+++ b/content/media/ogg/OggReader.cpp
@@ -86,6 +86,51 @@ PageSync(MediaResource* aResource,
 // is about 4300 bytes, so we read the file in chunks larger than that.
 static const int PAGE_STEP = 8192;
 
+// Return the corresponding category in aKind based on the following specs.
+// (https://www.whatwg.org/specs/web-apps/current-
+// work/multipage/embedded-content.html#dom-audiotrack-kind) &
+// (http://wiki.xiph.org/SkeletonHeaders)
+static const nsString GetKind(const nsCString& aRole)
+{
+  if (aRole.Find("audio/main") != -1 || aRole.Find("video/main") != -1) {
+    return NS_LITERAL_STRING("main");
+  } else if (aRole.Find("audio/alternate") != -1 ||
+             aRole.Find("video/alternate") != -1) {
+    return NS_LITERAL_STRING("alternative");
+  } else if (aRole.Find("audio/audiodesc") != -1) {
+    return NS_LITERAL_STRING("descriptions");
+  } else if (aRole.Find("audio/described") != -1) {
+    return NS_LITERAL_STRING("main-desc");
+  } else if (aRole.Find("audio/dub") != -1) {
+    return NS_LITERAL_STRING("translation");
+  } else if (aRole.Find("audio/commentary") != -1) {
+    return NS_LITERAL_STRING("commentary");
+  } else if (aRole.Find("video/sign") != -1) {
+    return NS_LITERAL_STRING("sign");
+  } else if (aRole.Find("video/captioned") != -1) {
+    return NS_LITERAL_STRING("captions");
+  } else if (aRole.Find("video/subtitled") != -1) {
+    return NS_LITERAL_STRING("subtitles");
+  }
+  return EmptyString();
+}
+
+static void InitTrack(MessageField* aMsgInfo, TrackInfo* aInfo, bool aEnable)
+{
+  MOZ_ASSERT(aMsgInfo);
+  MOZ_ASSERT(aInfo);
+
+  nsCString* sName = aMsgInfo->mValuesStore.Get(eName);
+  nsCString* sRole = aMsgInfo->mValuesStore.Get(eRole);
+  nsCString* sTitle = aMsgInfo->mValuesStore.Get(eTitle);
+  nsCString* sLanguage = aMsgInfo->mValuesStore.Get(eLanguage);
+  aInfo->Init(sName? NS_ConvertUTF8toUTF16(*sName):EmptyString(),
+              sRole? GetKind(*sRole):EmptyString(),
+              sTitle? NS_ConvertUTF8toUTF16(*sTitle):EmptyString(),
+              sLanguage? NS_ConvertUTF8toUTF16(*sLanguage):EmptyString(),
+              aEnable);
+}
+
 OggReader::OggReader(AbstractMediaDecoder* aDecoder)
   : MediaDecoderReader(aDecoder),
     mMonitor("OggReader"),
@@ -165,6 +210,7 @@ bool OggReader::ReadHeaders(OggCodecState* aState)
 
 void OggReader::BuildSerialList(nsTArray<uint32_t>& aTracks)
 {
+  // Obtaining seek index information for currently active bitstreams.
   if (HasVideo()) {
     aTracks.AppendElement(mTheoraState->mSerial);
   }
@@ -179,6 +225,159 @@ void OggReader::BuildSerialList(nsTArray<uint32_t>& aTracks)
   }
 }
 
+void OggReader::SetupTargetTheora(TheoraState* aTheoraState)
+{
+  if (mTheoraState) {
+    mTheoraState->Reset();
+  }
+  nsIntRect picture = nsIntRect(aTheoraState->mInfo.pic_x,
+                                aTheoraState->mInfo.pic_y,
+                                aTheoraState->mInfo.pic_width,
+                                aTheoraState->mInfo.pic_height);
+
+  nsIntSize displaySize = nsIntSize(aTheoraState->mInfo.pic_width,
+                                    aTheoraState->mInfo.pic_height);
+
+  // Apply the aspect ratio to produce the intrinsic display size we report
+  // to the element.
+  ScaleDisplayByAspectRatio(displaySize, aTheoraState->mPixelAspectRatio);
+
+  nsIntSize frameSize(aTheoraState->mInfo.frame_width,
+                      aTheoraState->mInfo.frame_height);
+  if (IsValidVideoRegion(frameSize, picture, displaySize)) {
+    // Video track's frame sizes will not overflow. Activate the video track.
+    mPicture = picture;
+
+    VideoFrameContainer* container = mDecoder->GetVideoFrameContainer();
+    if (container) {
+      container->SetCurrentFrame(gfxIntSize(displaySize.width, displaySize.height),
+                                 nullptr,
+                                 TimeStamp::Now());
+    }
+
+    // Copy Theora info data for time computations on other threads.
+    memcpy(&mTheoraInfo, &aTheoraState->mInfo, sizeof(mTheoraInfo));
+
+    mTheoraState = aTheoraState;
+    mTheoraSerial = aTheoraState->mSerial;
+  }
+}
+
+void OggReader::SetupTargetVorbis(VorbisState* aVorbisState)
+{
+  if (mVorbisState) {
+    mVorbisState->Reset();
+  }
+  // Copy Vorbis info data for time computations on other threads.
+  memcpy(&mVorbisInfo, &aVorbisState->mInfo, sizeof(mVorbisInfo));
+  mVorbisInfo.codec_setup = nullptr;
+  mVorbisState = aVorbisState;
+  mVorbisSerial = aVorbisState->mSerial;
+}
+
+void OggReader::SetupTargetOpus(OpusState* aOpusState)
+{
+  if (mOpusState) {
+    mOpusState->Reset();
+  }
+  mOpusState = aOpusState;
+  mOpusSerial = aOpusState->mSerial;
+  mOpusPreSkip = aOpusState->mPreSkip;
+}
+
+void OggReader::SetupTargetSkeleton(SkeletonState* aSkeletonState)
+{
+  // Setup skeleton related information after mVorbisState & mTheroState
+  // being set (if they exist).
+  if (aSkeletonState) {
+    if (!HasAudio() && !HasVideo()) {
+      // We have a skeleton track, but no audio or video, may as well disable
+      // the skeleton, we can't do anything useful with this media.
+      aSkeletonState->Deactivate();
+    } else if (ReadHeaders(aSkeletonState) && aSkeletonState->HasIndex()) {
+      // Extract the duration info out of the index, so we don't need to seek to
+      // the end of resource to get it.
+      nsAutoTArray<uint32_t, 2> tracks;
+      BuildSerialList(tracks);
+      int64_t duration = 0;
+      if (NS_SUCCEEDED(aSkeletonState->GetDuration(tracks, duration))) {
+        ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+        mDecoder->SetMediaDuration(duration);
+        LOG(PR_LOG_DEBUG, ("Got duration from Skeleton index %lld", duration));
+      }
+    }
+  }
+}
+
+void OggReader::SetupMediaTracksInfo(const nsTArray<uint32_t>& aSerials)
+{
+  // For each serial number
+  // 1. Retrieve a codecState from mCodecStore by this serial number.
+  // 2. Retrieve a message field from mMsgFieldStore by this serial number.
+  // 3. For now, skip if the serial number refers to a non-primary bitstream.
+  // 4. Setup track and other audio/video related information per different types.
+  for (size_t i = 0; i < aSerials.Length(); i++) {
+    uint32_t serial = aSerials[i];
+    OggCodecState* codecState = mCodecStore.Get(serial);
+
+    MessageField* msgInfo = nullptr;
+    if (mSkeletonState && mSkeletonState->mMsgFieldStore.Contains(serial)) {
+      mSkeletonState->mMsgFieldStore.Get(serial, &msgInfo);
+    }
+
+    if (codecState->GetType() == OggCodecState::TYPE_THEORA) {
+      TheoraState* theoraState = static_cast<TheoraState*>(codecState);
+      if (!(mTheoraState && mTheoraState->mSerial == theoraState->mSerial)) {
+        continue;
+      }
+
+      if (msgInfo) {
+        InitTrack(msgInfo, &mInfo.mVideo.mTrackInfo, mTheoraState == theoraState);
+      }
+
+      nsIntRect picture = nsIntRect(theoraState->mInfo.pic_x,
+                                    theoraState->mInfo.pic_y,
+                                    theoraState->mInfo.pic_width,
+                                    theoraState->mInfo.pic_height);
+      nsIntSize displaySize = nsIntSize(theoraState->mInfo.pic_width,
+                                        theoraState->mInfo.pic_height);
+      nsIntSize frameSize(theoraState->mInfo.frame_width,
+                          theoraState->mInfo.frame_height);
+      ScaleDisplayByAspectRatio(displaySize, theoraState->mPixelAspectRatio);
+      mInfo.mVideo.mDisplay = displaySize;
+      mInfo.mVideo.mHasVideo = IsValidVideoRegion(frameSize, picture, displaySize)? true:false;
+    } else if (codecState->GetType() == OggCodecState::TYPE_VORBIS) {
+      VorbisState* vorbisState = static_cast<VorbisState*>(codecState);
+      if (!(mVorbisState && mVorbisState->mSerial == vorbisState->mSerial)) {
+        continue;
+      }
+
+      if (msgInfo) {
+        InitTrack(msgInfo, &mInfo.mAudio.mTrackInfo, mVorbisState == vorbisState);
+      }
+
+      mInfo.mAudio.mHasAudio = true;
+      mInfo.mAudio.mRate = vorbisState->mInfo.rate;
+      mInfo.mAudio.mChannels = vorbisState->mInfo.channels;
+#ifdef MOZ_OPUS
+    } else if (codecState->GetType() == OggCodecState::TYPE_OPUS) {
+      OpusState* opusState = static_cast<OpusState*>(codecState);
+      if (!(mOpusState && mOpusState->mSerial == opusState->mSerial)) {
+        continue;
+      }
+
+      if (msgInfo) {
+        InitTrack(msgInfo, &mInfo.mAudio.mTrackInfo, mOpusState == opusState);
+      }
+
+      mInfo.mAudio.mHasAudio = true;
+      mInfo.mAudio.mRate = opusState->mRate;
+      mInfo.mAudio.mChannels = opusState->mChannels;
+#endif
+    }
+  }
+}
+
 nsresult OggReader::ReadMetadata(MediaInfo* aInfo,
                                  MetadataTags** aTags)
 {
@@ -193,6 +392,7 @@ nsresult OggReader::ReadMetadata(MediaInfo* aInfo,
 
   ogg_page page;
   nsAutoTArray<OggCodecState*,4> bitstreams;
+  nsTArray<uint32_t> serials;
   bool readAllBOS = false;
   while (!readAllBOS) {
     if (!ReadOggPage(&page)) {
@@ -215,41 +415,7 @@ nsresult OggReader::ReadMetadata(MediaInfo* aInfo,
       codecState = OggCodecState::Create(&page);
       mCodecStore.Add(serial, codecState);
       bitstreams.AppendElement(codecState);
-      if (codecState &&
-          codecState->GetType() == OggCodecState::TYPE_VORBIS &&
-          !mVorbisState)
-      {
-        // First Vorbis bitstream, we'll play this one. Subsequent Vorbis
-        // bitstreams will be ignored.
-        mVorbisState = static_cast<VorbisState*>(codecState);
-      }
-      if (codecState &&
-          codecState->GetType() == OggCodecState::TYPE_THEORA &&
-          !mTheoraState)
-      {
-        // First Theora bitstream, we'll play this one. Subsequent Theora
-        // bitstreams will be ignored.
-        mTheoraState = static_cast<TheoraState*>(codecState);
-      }
-#ifdef MOZ_OPUS
-      if (codecState &&
-          codecState->GetType() == OggCodecState::TYPE_OPUS &&
-          !mOpusState)
-      {
-        if (mOpusEnabled) {
-          mOpusState = static_cast<OpusState*>(codecState);
-        } else {
-          NS_WARNING("Opus decoding disabled."
-                     " See media.opus.enabled in about:config");
-        }
-      }
-#endif /* MOZ_OPUS */
-      if (codecState &&
-          codecState->GetType() == OggCodecState::TYPE_SKELETON &&
-          !mSkeletonState)
-      {
-        mSkeletonState = static_cast<SkeletonState*>(codecState);
-      }
+      serials.AppendElement(serial);
     }
 
     codecState = mCodecStore.Get(serial);
@@ -261,96 +427,56 @@ nsresult OggReader::ReadMetadata(MediaInfo* aInfo,
   }
 
   // We've read all BOS pages, so we know the streams contained in the media.
-  // Now process all available header packets in the active Theora, Vorbis and
-  // Skeleton streams.
-
-  // Deactivate any non-primary bitstreams.
-  for (uint32_t i = 0; i < bitstreams.Length(); i++) {
+  // 1. Process all available header packets in the Theora, Vorbis/Opus bitstreams.
+  // 2. Find the first encountered Theora/Vorbis/Opus bitstream, and configure
+  //    it as the target A/V bitstream.
+  // 3. Deactivate the rest of bitstreams for now, until we have MediaInfo
+  //    support multiple track infos.
+  for (uint32_t i = 0; i < bitstreams.Length(); ++i) {
     OggCodecState* s = bitstreams[i];
-    if (s != mVorbisState &&
+    if (s) {
+      if (s->GetType() == OggCodecState::TYPE_THEORA && ReadHeaders(s)) {
+        if (!mTheoraState) {
+          TheoraState* theoraState = static_cast<TheoraState*>(s);
+          SetupTargetTheora(theoraState);
+        } else {
+          s->Deactivate();
+        }
+      } else if (s->GetType() == OggCodecState::TYPE_VORBIS && ReadHeaders(s)) {
+        if (!mVorbisState) {
+          VorbisState* vorbisState = static_cast<VorbisState*>(s);
+          SetupTargetVorbis(vorbisState);
+          *aTags = vorbisState->GetTags();
+        } else {
+          s->Deactivate();
+        }
 #ifdef MOZ_OPUS
-        s != mOpusState &&
-#endif /* MOZ_OPUS */
-        s != mTheoraState && s != mSkeletonState) {
-      s->Deactivate();
-    }
-  }
-
-  if (mTheoraState && ReadHeaders(mTheoraState)) {
-    nsIntRect picture = nsIntRect(mTheoraState->mInfo.pic_x,
-                                  mTheoraState->mInfo.pic_y,
-                                  mTheoraState->mInfo.pic_width,
-                                  mTheoraState->mInfo.pic_height);
-
-    nsIntSize displaySize = nsIntSize(mTheoraState->mInfo.pic_width,
-                                      mTheoraState->mInfo.pic_height);
-
-    // Apply the aspect ratio to produce the intrinsic display size we report
-    // to the element.
-    ScaleDisplayByAspectRatio(displaySize, mTheoraState->mPixelAspectRatio);
-
-    nsIntSize frameSize(mTheoraState->mInfo.frame_width,
-                        mTheoraState->mInfo.frame_height);
-    if (IsValidVideoRegion(frameSize, picture, displaySize)) {
-      // Video track's frame sizes will not overflow. Activate the video track.
-      mInfo.mVideo.mHasVideo = true;
-      mInfo.mVideo.mDisplay = displaySize;
-      mPicture = picture;
-
-      VideoFrameContainer* container = mDecoder->GetVideoFrameContainer();
-      if (container) {
-        container->SetCurrentFrame(gfxIntSize(displaySize.width, displaySize.height),
-                                   nullptr,
-                                   TimeStamp::Now());
+      } else if (s->GetType() == OggCodecState::TYPE_OPUS && ReadHeaders(s)) {
+        if (mOpusEnabled) {
+          if (!mOpusState) {
+            OpusState* opusState = static_cast<OpusState*>(s);
+            SetupTargetOpus(opusState);
+            *aTags = opusState->GetTags();
+          } else {
+            s->Deactivate();
+          }
+        } else {
+          NS_WARNING("Opus decoding disabled."
+                     " See media.opus.enabled in about:config");
+        }
+#endif // MOZ_OPUS
+      } else if (s->GetType() == OggCodecState::TYPE_SKELETON && !mSkeletonState) {
+        mSkeletonState = static_cast<SkeletonState*>(s);
+      } else {
+        // Deactivate any non-primary bitstreams.
+        s->Deactivate();
       }
 
-      // Copy Theora info data for time computations on other threads.
-      memcpy(&mTheoraInfo, &mTheoraState->mInfo, sizeof(mTheoraInfo));
-      mTheoraSerial = mTheoraState->mSerial;
     }
   }
 
-  if (mVorbisState && ReadHeaders(mVorbisState)) {
-    mInfo.mAudio.mHasAudio = true;
-    mInfo.mAudio.mRate = mVorbisState->mInfo.rate;
-    mInfo.mAudio.mChannels = mVorbisState->mInfo.channels;
-    // Copy Vorbis info data for time computations on other threads.
-    memcpy(&mVorbisInfo, &mVorbisState->mInfo, sizeof(mVorbisInfo));
-    mVorbisInfo.codec_setup = nullptr;
-    mVorbisSerial = mVorbisState->mSerial;
-    *aTags = mVorbisState->GetTags();
-  } else {
-    memset(&mVorbisInfo, 0, sizeof(mVorbisInfo));
-  }
-#ifdef MOZ_OPUS
-  if (mOpusState && ReadHeaders(mOpusState)) {
-    mInfo.mAudio.mHasAudio = true;
-    mInfo.mAudio.mRate = mOpusState->mRate;
-    mInfo.mAudio.mChannels = mOpusState->mChannels;
-    mOpusSerial = mOpusState->mSerial;
-    mOpusPreSkip = mOpusState->mPreSkip;
-
-    *aTags = mOpusState->GetTags();
-  }
-#endif
-  if (mSkeletonState) {
-    if (!HasAudio() && !HasVideo()) {
-      // We have a skeleton track, but no audio or video, may as well disable
-      // the skeleton, we can't do anything useful with this media.
-      mSkeletonState->Deactivate();
-    } else if (ReadHeaders(mSkeletonState) && mSkeletonState->HasIndex()) {
-      // Extract the duration info out of the index, so we don't need to seek to
-      // the end of resource to get it.
-      nsAutoTArray<uint32_t, 2> tracks;
-      BuildSerialList(tracks);
-      int64_t duration = 0;
-      if (NS_SUCCEEDED(mSkeletonState->GetDuration(tracks, duration))) {
-        ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-        mDecoder->SetMediaDuration(duration);
-        LOG(PR_LOG_DEBUG, ("Got duration from Skeleton index %lld", duration));
-      }
-    }
-  }
+  SetupTargetSkeleton(mSkeletonState);
+  SetupMediaTracksInfo(serials);
 
   if (HasAudio() || HasVideo()) {
     ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
@@ -673,42 +799,55 @@ bool OggReader::ReadOggChain()
     return false;
   }
 
-  nsAutoPtr<MediaInfo> info(new MediaInfo());
+  MessageField* msgInfo = nullptr;
+  if (mSkeletonState && mSkeletonState->mMsgFieldStore.Contains(serial)) {
+    mSkeletonState->mMsgFieldStore.Get(serial, &msgInfo);
+  }
+
   if ((newVorbisState && ReadHeaders(newVorbisState)) &&
       (mVorbisState->mInfo.rate == newVorbisState->mInfo.rate) &&
       (mVorbisState->mInfo.channels == newVorbisState->mInfo.channels)) {
-    mVorbisState->Reset();
-    mVorbisState = newVorbisState;
-    mVorbisSerial = mVorbisState->mSerial;
+
+    SetupTargetVorbis(newVorbisState);
     LOG(PR_LOG_DEBUG, ("New vorbis ogg link, serial=%d\n", mVorbisSerial));
+
+    if (msgInfo) {
+      InitTrack(msgInfo, &mInfo.mAudio.mTrackInfo, true);
+    }
+    mInfo.mAudio.mRate = newVorbisState->mInfo.rate;
+    mInfo.mAudio.mChannels = newVorbisState->mInfo.channels;
+
     chained = true;
-    info->mAudio.mRate = mVorbisState->mInfo.rate;
-    info->mAudio.mChannels = mVorbisState->mInfo.channels;
-    tags = mVorbisState->GetTags();
+    tags = newVorbisState->GetTags();
   }
 
 #ifdef MOZ_OPUS
   if ((newOpusState && ReadHeaders(newOpusState)) &&
       (mOpusState->mRate == newOpusState->mRate) &&
       (mOpusState->mChannels == newOpusState->mChannels)) {
-    mOpusState->Reset();
-    mOpusState = newOpusState;
-    mOpusSerial = mOpusState->mSerial;
+
+    SetupTargetOpus(newOpusState);
+
+    if (msgInfo) {
+      InitTrack(msgInfo, &mInfo.mAudio.mTrackInfo, true);
+    }
+    mInfo.mAudio.mRate = newOpusState->mRate;
+    mInfo.mAudio.mChannels = newOpusState->mChannels;
+
     chained = true;
-    info->mAudio.mRate = mOpusState->mRate;
-    info->mAudio.mChannels = mOpusState->mChannels;
-    tags = mOpusState->GetTags();
+    tags = newOpusState->GetTags();
   }
 #endif
 
   if (chained) {
     SetChained(true);
     {
-      info->mAudio.mHasAudio = HasAudio();
-      info->mVideo.mHasVideo = HasVideo();
-      int rate = info->mAudio.mRate;
+      mInfo.mAudio.mHasAudio = HasAudio();
+      mInfo.mVideo.mHasVideo = HasVideo();
+      nsAutoPtr<MediaInfo> info(new MediaInfo());
+      *info = mInfo;
       ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-      mDecoder->QueueMetadata((mDecodedAudioFrames * USECS_PER_S) / rate,
+      mDecoder->QueueMetadata((mDecodedAudioFrames * USECS_PER_S) / mInfo.mAudio.mRate,
                               info.forget(), tags);
     }
     return true;
@@ -1024,7 +1163,6 @@ int64_t OggReader::RangeEndTime(int64_t aStartOffset,
         endTime = -1;
         break;
       }
-
       continue;
     }
 
@@ -1054,7 +1192,6 @@ int64_t OggReader::RangeEndTime(int64_t aStartOffset,
 
     OggCodecState* codecState = nullptr;
     codecState = mCodecStore.Get(serial);
-
     if (!codecState) {
       // This page is from a bitstream which we haven't encountered yet.
       // It's probably from a new "link" in a "chained" ogg. Don't
@@ -1143,7 +1280,9 @@ OggReader::SelectSeekRange(const nsTArray<SeekRange>& ranges,
 
 OggReader::IndexedSeekResult OggReader::RollbackIndexedSeek(int64_t aOffset)
 {
-  mSkeletonState->Deactivate();
+  if (mSkeletonState) {
+    mSkeletonState->Deactivate();
+  }
   MediaResource* resource = mDecoder->GetResource();
   NS_ENSURE_TRUE(resource != nullptr, SEEK_FATAL_ERROR);
   nsresult res = resource->Seek(nsISeekableStream::NS_SEEK_SET, aOffset);
diff --git a/content/media/ogg/OggReader.h b/content/media/ogg/OggReader.h
index 82006b4e1de..12a581b56a4 100644
--- a/content/media/ogg/OggReader.h
+++ b/content/media/ogg/OggReader.h
@@ -268,6 +268,13 @@ private:
   // various SkeletonState functions.
   void BuildSerialList(nsTArray<uint32_t>& aTracks);
 
+  // Setup target bitstreams for decoding.
+  void SetupTargetTheora(TheoraState* aTheoraState);
+  void SetupTargetVorbis(VorbisState* aVorbisState);
+  void SetupTargetOpus(OpusState* aOpusState);
+  void SetupTargetSkeleton(SkeletonState* aSkeletonState);
+  void SetupMediaTracksInfo(const nsTArray<uint32_t>& aSerials);
+
   OggCodecStore mCodecStore;
 
   // Decode state of the Theora bitstream we're decoding, if we have video.
diff --git a/content/media/test/manifest.js b/content/media/test/manifest.js
index 485ee8f9d28..895996b45cf 100644
--- a/content/media/test/manifest.js
+++ b/content/media/test/manifest.js
@@ -250,6 +250,70 @@ var gInvalidTests = [
   { name:"invalid-preskip.webm", type:"audio/webm; codecs=opus"},
 ];
 
+// Files to check different cases of ogg skeleton information.
+// sample-fisbone-skeleton4.ogv
+// - Skeleton v4, w/ Content-Type,Role,Name,Language,Title for both theora/vorbis
+// sample-fisbone-wrong-header.ogv
+// - Skeleton v4, wrong message field sequence for vorbis
+// multiple-bos-more-header-fields.ogg
+// - Skeleton v3, w/ Content-Type,Role,Name,Language,Title for both theora/vorbis
+// seek.ogv
+// - No skeleton, but theora
+// audio-overhang.ogg
+// - No skeleton, but vorbis
+var gMultitrackInfoOggPlayList = [
+  { name:"sample-fisbone-skeleton4.ogv", type:"video/ogg", duration:5.049 },
+  { name:"sample-fisbone-wrong-header.ogv", type:"video/ogg", duration:5.049 },
+  { name:"multiple-bos-more-header-fileds.ogg", type:"video/ogg", duration:0.431 },
+  { name:"seek.ogv", type:"video/ogg", duration:3.996 },
+  { name:"audio-gaps.ogg", type:"audio/ogg", duration:2.208 }
+];
+// Pre-parsed results of gMultitrackInfoOggPlayList.
+var gOggTrackInfoResults = {
+  "sample-fisbone-skeleton4.ogv" : {
+    "audio_id":" audio_1",
+    "audio_kind":"main",
+    "audio_language":" en-US",
+    "audio_label":" Audio track for test",
+    "video_id":" video_1",
+    "video_kind":"main",
+    "video_language":" fr",
+    "video_label":" Video track for test"
+  },
+  "sample-fisbone-wrong-header.ogv" : {
+    "audio_id":"1",
+    "audio_kind":"main",
+    "audio_language":"",
+    "audio_label":"",
+    "video_id":" video_1",
+    "video_kind":"main",
+    "video_language":" fr",
+    "video_label":" Video track for test"
+  },
+  "multiple-bos-more-header-fileds.ogg" : {
+    "audio_id":"1",
+    "audio_kind":"main",
+    "audio_language":"",
+    "audio_label":"",
+    "video_id":"2",
+    "video_kind":"main",
+    "video_language":"",
+    "video_label":""
+  },
+  "seek.ogv" : {
+    "video_id":"2",
+    "video_kind":"main",
+    "video_language":"",
+    "video_label":""
+  },
+  "audio-gaps.ogg" : {
+    "audio_id":"1",
+    "audio_kind":"main",
+    "audio_language":"",
+    "audio_label":""
+  }
+};
+
 // Converts a path/filename to a file:// URI which we can load from disk.
 // Optionally checks whether the file actually exists on disk at the location
 // we've specified.
diff --git a/content/media/test/mochitest.ini b/content/media/test/mochitest.ini
index 1e54cd44238..e14c2cb3627 100644
--- a/content/media/test/mochitest.ini
+++ b/content/media/test/mochitest.ini
@@ -173,6 +173,8 @@ support-files =
   manifest.js
   multiple-bos.ogg
   multiple-bos.ogg^headers^
+  multiple-bos-more-header-fileds.ogg
+  multiple-bos-more-header-fileds.ogg^headers^
   no-cues.webm
   no-cues.webm^headers^
   noContentLength.sjs
@@ -203,6 +205,10 @@ support-files =
   region.vtt
   sample.3gp
   sample.3g2
+  sample-fisbone-skeleton4.ogv
+  sample-fisbone-skeleton4.ogv^headers^
+  sample-fisbone-wrong-header.ogv
+  sample-fisbone-wrong-header.ogv^headers^
   seek.ogv
   seek.ogv^headers^
   seek.webm
@@ -371,6 +377,7 @@ skip-if = buildapp == 'b2g' || toolkit == 'android' # mimetype check, bug 969289
 [test_mediatrack_consuming_mediaresource.html]
 [test_mediatrack_consuming_mediastream.html]
 [test_mediatrack_events.html]
+[test_mediatrack_parsing_ogg.html]
 [test_mediatrack_replay_from_end.html]
 [test_metadata.html]
 [test_mixed_principals.html]
@@ -454,7 +461,6 @@ skip-if = buildapp == 'b2g' # bug 1021682
 [test_vttparser.html]
 [test_webvtt_disabled.html]
 
-
 # The tests below contain backend-specific tests. Write backend independent
 # tests rather than adding to this list.
 [test_can_play_type_webm.html]
diff --git a/content/media/test/multiple-bos-more-header-fileds.ogg b/content/media/test/multiple-bos-more-header-fileds.ogg
new file mode 100644
index 00000000000..c9721cb98eb
Binary files /dev/null and b/content/media/test/multiple-bos-more-header-fileds.ogg differ
diff --git a/content/media/test/multiple-bos-more-header-fileds.ogg^headers^ b/content/media/test/multiple-bos-more-header-fileds.ogg^headers^
new file mode 100644
index 00000000000..4030ea1d3dd
--- /dev/null
+++ b/content/media/test/multiple-bos-more-header-fileds.ogg^headers^
@@ -0,0 +1 @@
+Cache-Control: no-store
diff --git a/content/media/test/sample-fisbone-skeleton4.ogv b/content/media/test/sample-fisbone-skeleton4.ogv
new file mode 100644
index 00000000000..20babf078f2
Binary files /dev/null and b/content/media/test/sample-fisbone-skeleton4.ogv differ
diff --git a/content/media/test/sample-fisbone-skeleton4.ogv^headers^ b/content/media/test/sample-fisbone-skeleton4.ogv^headers^
new file mode 100644
index 00000000000..4030ea1d3dd
--- /dev/null
+++ b/content/media/test/sample-fisbone-skeleton4.ogv^headers^
@@ -0,0 +1 @@
+Cache-Control: no-store
diff --git a/content/media/test/sample-fisbone-wrong-header.ogv b/content/media/test/sample-fisbone-wrong-header.ogv
new file mode 100644
index 00000000000..22814660218
Binary files /dev/null and b/content/media/test/sample-fisbone-wrong-header.ogv differ
diff --git a/content/media/test/sample-fisbone-wrong-header.ogv^headers^ b/content/media/test/sample-fisbone-wrong-header.ogv^headers^
new file mode 100644
index 00000000000..4030ea1d3dd
--- /dev/null
+++ b/content/media/test/sample-fisbone-wrong-header.ogv^headers^
@@ -0,0 +1 @@
+Cache-Control: no-store
diff --git a/content/media/test/test_mediatrack_parsing_ogg.html b/content/media/test/test_mediatrack_parsing_ogg.html
new file mode 100644
index 00000000000..06f04a378e7
--- /dev/null
+++ b/content/media/test/test_mediatrack_parsing_ogg.html
@@ -0,0 +1,72 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test events of media track interfaces</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <script type="text/javascript" src="manifest.js"></script>
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+var manager = new MediaTestManager;
+
+function localCheckMetadata(msg, e) {
+  ok(msg in gOggTrackInfoResults, "File: " + msg + " is in pre-parsed gOggTrackInfoResults list");
+  var r = gOggTrackInfoResults[msg];
+
+  var hasExpectedAudio = r && r.hasOwnProperty("audio_id");
+  var hasExpectedVideo = r && r.hasOwnProperty("video_id");
+
+  var hasParsedAudio = e.audioTracks.length >= 1;
+  var hasParsedVideo = e.videoTracks.length >= 1;
+
+  ok(!(hasExpectedAudio ^ hasParsedAudio), "Check availability of expected/parsed audio");
+  ok(!(hasExpectedVideo ^ hasParsedVideo), "Check availability of expected/parsed video");
+  if (hasParsedAudio) {
+    is(e.audioTracks.length, 1, "The length of audio track should be 1");
+    is(e.audioTracks[0].id, r.audio_id, "File: " + msg + ", Audio track id");
+    is(e.audioTracks[0].kind, r.audio_kind, "File: " + msg + ", Audio track kind");
+    is(e.audioTracks[0].language, r.audio_language, "File: " + msg + ", Audio track language");
+    is(e.audioTracks[0].label, r.audio_label, "File: " + msg + ", Audio track label");
+  }
+  if (hasParsedVideo) {
+    is(e.videoTracks.length, 1, "The length of video track should be 1");
+    is(e.videoTracks[0].id, r.video_id, "File: " + msg + ", Video track id");
+    is(e.videoTracks[0].kind, r.video_kind, "File: " + msg + ", Video track kind");
+    is(e.videoTracks[0].language, r.video_language, "File: " + msg + ", Video track language");
+    is(e.videoTracks[0].label, r.video_label, "File: " + msg + ", Video track label");
+  }
+}
+
+function startTest(test, token) {
+  var v = document.createElement('video');
+  v.preload = "metadata";
+  v.token = token;
+  manager.started(token);
+
+  v.src = test.name;
+  v.name = test.name;
+
+  v.onloadedmetadata = function(evt) {
+    localCheckMetadata(evt.target.name, evt.target);
+    evt.target.finished = true;
+    evt.target.onloadedmetadata = null;
+    removeNodeAndSource(evt.target);
+    manager.finished(evt.target.token);
+  };
+
+  document.body.appendChild(v);
+}
+
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv({"set": [["media.track.enabled", true]]},
+  function() {
+  	manager.runTests(gMultitrackInfoOggPlayList, startTest);
+  }
+);
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/webrtc/MediaEngine.h b/content/media/webrtc/MediaEngine.h
index 43c7b950442..3dff908fd87 100644
--- a/content/media/webrtc/MediaEngine.h
+++ b/content/media/webrtc/MediaEngine.h
@@ -10,9 +10,14 @@
 #include "DOMMediaStream.h"
 #include "MediaStreamGraph.h"
 #include "mozilla/dom/MediaStreamTrackBinding.h"
+#include "mozilla/dom/VideoStreamTrack.h"
 
 namespace mozilla {
 
+namespace dom {
+class DOMFile;
+}
+
 struct VideoTrackConstraintsN;
 struct AudioTrackConstraintsN;
 
@@ -137,6 +142,29 @@ public:
   /* Returns the type of media source (camera, microphone, screen, window, etc) */
   virtual const MediaSourceType GetMediaSource() = 0;
 
+  // Callback interface for TakePhoto(). Either PhotoComplete() or PhotoError()
+  // should be called.
+  class PhotoCallback {
+  public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(PhotoCallback)
+
+    // aBlob is the image captured by MediaEngineSource. It is
+    // called on main thread.
+    virtual nsresult PhotoComplete(already_AddRefed<dom::DOMFile> aBlob) = 0;
+
+    // It is called on main thread. aRv is the error code.
+    virtual nsresult PhotoError(nsresult aRv) = 0;
+
+  protected:
+    virtual ~PhotoCallback() {}
+  };
+
+  /* If implementation of MediaEngineSource supports TakePhoto(), the picture
+   * should be return via aCallback object. Otherwise, it returns NS_ERROR_NOT_IMPLEMENTED.
+   * Currently, only Gonk MediaEngineSource implementation supports it.
+   */
+  virtual nsresult TakePhoto(PhotoCallback* aCallback) = 0;
+
   /* Return false if device is currently allocated or started */
   bool IsAvailable() {
     if (mState == kAllocated || mState == kStarted) {
diff --git a/content/media/webrtc/MediaEngineDefault.h b/content/media/webrtc/MediaEngineDefault.h
index cead01643ba..f72ec1e937d 100644
--- a/content/media/webrtc/MediaEngineDefault.h
+++ b/content/media/webrtc/MediaEngineDefault.h
@@ -65,6 +65,11 @@ public:
     return MediaSourceType::Camera;
   }
 
+  virtual nsresult TakePhoto(PhotoCallback* aCallback)
+  {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSITIMERCALLBACK
 
@@ -125,6 +130,11 @@ public:
     return MediaSourceType::Microphone;
   }
 
+  virtual nsresult TakePhoto(PhotoCallback* aCallback)
+  {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSITIMERCALLBACK
 
diff --git a/content/media/webrtc/MediaEngineTabVideoSource.h b/content/media/webrtc/MediaEngineTabVideoSource.h
index 9f5441b8609..4b6d91c721e 100644
--- a/content/media/webrtc/MediaEngineTabVideoSource.h
+++ b/content/media/webrtc/MediaEngineTabVideoSource.h
@@ -34,6 +34,11 @@ class MediaEngineTabVideoSource : public MediaEngineVideoSource, nsIDOMEventList
       return MediaSourceType::Browser;
     }
 
+    virtual nsresult TakePhoto(PhotoCallback* aCallback)
+    {
+      return NS_ERROR_NOT_IMPLEMENTED;
+    }
+
     void Draw();
 
     class StartRunnable : public nsRunnable {
diff --git a/content/media/webrtc/MediaEngineWebRTC.h b/content/media/webrtc/MediaEngineWebRTC.h
index ca7fe54689d..c3ae80a7dc3 100644
--- a/content/media/webrtc/MediaEngineWebRTC.h
+++ b/content/media/webrtc/MediaEngineWebRTC.h
@@ -80,7 +80,7 @@ class GetCameraNameRunnable;
  * MainThread:
  *   mCaptureIndex, mLastCapture, mState,  mWidth, mHeight,
  *
- * Where mWidth, mHeight, mImage are protected by mMonitor
+ * Where mWidth, mHeight, mImage, mPhotoCallbacks are protected by mMonitor
  *       mState is protected by mCallbackMonitor
  * Other variable is accessed only from single thread
  */
@@ -175,6 +175,11 @@ public:
 
 #ifndef MOZ_B2G_CAMERA
   NS_DECL_THREADSAFE_ISUPPORTS
+
+  nsresult TakePhoto(PhotoCallback* aCallback)
+  {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
 #else
   // We are subclassed from CameraControlListener, which implements a
   // threadsafe reference-count for us.
@@ -193,6 +198,9 @@ public:
   void SnapshotImpl();
   void RotateImage(layers::Image* aImage, uint32_t aWidth, uint32_t aHeight);
   void Notify(const mozilla::hal::ScreenConfiguration& aConfiguration);
+
+  nsresult TakePhoto(PhotoCallback* aCallback) MOZ_OVERRIDE;
+
 #endif
 
   // This runnable is for creating a temporary file on the main thread.
@@ -230,6 +238,7 @@ private:
   // This is only modified on MainThread (AllocImpl and DeallocImpl)
   nsRefPtr<ICameraControl> mCameraControl;
   nsCOMPtr<nsIDOMFile> mLastCapture;
+  nsTArray<nsRefPtr<PhotoCallback>> mPhotoCallbacks;
 
   // These are protected by mMonitor below
   int mRotation;
@@ -330,6 +339,11 @@ public:
     return MediaSourceType::Microphone;
   }
 
+  virtual nsresult TakePhoto(PhotoCallback* aCallback)
+  {
+    return NS_ERROR_NOT_IMPLEMENTED;
+  }
+
   // VoEMediaProcess.
   void Process(int channel, webrtc::ProcessingTypes type,
                int16_t audio10ms[], int length,
diff --git a/content/media/webrtc/MediaEngineWebRTCVideo.cpp b/content/media/webrtc/MediaEngineWebRTCVideo.cpp
index 1e381c1bc19..de975509ace 100644
--- a/content/media/webrtc/MediaEngineWebRTCVideo.cpp
+++ b/content/media/webrtc/MediaEngineWebRTCVideo.cpp
@@ -877,18 +877,95 @@ MediaEngineWebRTCVideoSource::GetRotation()
 void
 MediaEngineWebRTCVideoSource::OnUserError(UserContext aContext, nsresult aError)
 {
-  ReentrantMonitorAutoEnter sync(mCallbackMonitor);
-  mCallbackMonitor.Notify();
+  {
+    // Scope the monitor, since there is another monitor below and we don't want
+    // unexpected deadlock.
+    ReentrantMonitorAutoEnter sync(mCallbackMonitor);
+    mCallbackMonitor.Notify();
+  }
+
+  // A main thread runnable to send error code to all queued PhotoCallbacks.
+  class TakePhotoError : public nsRunnable {
+  public:
+    TakePhotoError(nsTArray<nsRefPtr<PhotoCallback>>& aCallbacks,
+                   nsresult aRv)
+      : mRv(aRv)
+    {
+      mCallbacks.SwapElements(aCallbacks);
+    }
+
+    NS_IMETHOD Run()
+    {
+      uint32_t callbackNumbers = mCallbacks.Length();
+      for (uint8_t i = 0; i < callbackNumbers; i++) {
+        mCallbacks[i]->PhotoError(mRv);
+      }
+      // PhotoCallback needs to dereference on main thread.
+      mCallbacks.Clear();
+      return NS_OK;
+    }
+
+  protected:
+    nsTArray<nsRefPtr<PhotoCallback>> mCallbacks;
+    nsresult mRv;
+  };
+
+  if (aContext == UserContext::kInTakePicture) {
+    MonitorAutoLock lock(mMonitor);
+    if (mPhotoCallbacks.Length()) {
+      NS_DispatchToMainThread(new TakePhotoError(mPhotoCallbacks, aError));
+    }
+  }
 }
 
 void
 MediaEngineWebRTCVideoSource::OnTakePictureComplete(uint8_t* aData, uint32_t aLength, const nsAString& aMimeType)
 {
-  ReentrantMonitorAutoEnter sync(mCallbackMonitor);
-  mLastCapture = dom::DOMFile::CreateMemoryFile(static_cast<void*>(aData),
-                                                static_cast<uint64_t>(aLength),
-                                                aMimeType);
-  mCallbackMonitor.Notify();
+  // It needs to start preview because Gonk camera will stop preview while
+  // taking picture.
+  mCameraControl->StartPreview();
+
+  // Create a main thread runnable to generate a blob and call all current queued
+  // PhotoCallbacks.
+  class GenerateBlobRunnable : public nsRunnable {
+  public:
+    GenerateBlobRunnable(nsTArray<nsRefPtr<PhotoCallback>>& aCallbacks,
+                         uint8_t* aData,
+                         uint32_t aLength,
+                         const nsAString& aMimeType)
+    {
+      mCallbacks.SwapElements(aCallbacks);
+      mPhoto.AppendElements(aData, aLength);
+      mMimeType = aMimeType;
+    }
+
+    NS_IMETHOD Run()
+    {
+      nsRefPtr<dom::DOMFile> blob =
+        dom::DOMFile::CreateMemoryFile(mPhoto.Elements(), mPhoto.Length(), mMimeType);
+      uint32_t callbackCounts = mCallbacks.Length();
+      for (uint8_t i = 0; i < callbackCounts; i++) {
+        nsRefPtr<dom::DOMFile> tempBlob = blob;
+        mCallbacks[i]->PhotoComplete(tempBlob.forget());
+      }
+      // PhotoCallback needs to dereference on main thread.
+      mCallbacks.Clear();
+      return NS_OK;
+    }
+
+    nsTArray<nsRefPtr<PhotoCallback>> mCallbacks;
+    nsTArray<uint8_t> mPhoto;
+    nsString mMimeType;
+  };
+
+  // All elements in mPhotoCallbacks will be swapped in GenerateBlobRunnable
+  // constructor. This captured image will be sent to all the queued
+  // PhotoCallbacks in this runnable.
+  MonitorAutoLock lock(mMonitor);
+  if (mPhotoCallbacks.Length()) {
+    NS_DispatchToMainThread(
+      new GenerateBlobRunnable(mPhotoCallbacks, aData, aLength, aMimeType));
+  }
 }
 
 void
@@ -976,6 +1053,28 @@ MediaEngineWebRTCVideoSource::OnNewPreviewFrame(layers::Image* aImage, uint32_t
 
   return true; // return true because we're accepting the frame
 }
+
+nsresult
+MediaEngineWebRTCVideoSource::TakePhoto(PhotoCallback* aCallback)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  MonitorAutoLock lock(mMonitor);
+
+  // If other callback exists, that means there is a captured picture on the way,
+  // it doesn't need to TakePicture() again.
+  if (!mPhotoCallbacks.Length()) {
+    nsresult rv = mCameraControl->TakePicture();
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+  }
+
+  mPhotoCallbacks.AppendElement(aCallback);
+
+  return NS_OK;
+}
+
 #endif
 
 }
diff --git a/content/svg/content/src/SVGScriptElement.cpp b/content/svg/content/src/SVGScriptElement.cpp
index f3023d7e6f0..3f975ab3e57 100644
--- a/content/svg/content/src/SVGScriptElement.cpp
+++ b/content/svg/content/src/SVGScriptElement.cpp
@@ -91,15 +91,19 @@ SVGScriptElement::SetType(const nsAString & aType, ErrorResult& rv)
 }
 
 void
-SVGScriptElement::GetCrossOrigin(nsAString & aOrigin)
+SVGScriptElement::GetCrossOrigin(nsAString & aCrossOrigin)
 {
-  GetAttr(kNameSpaceID_None, nsGkAtoms::crossorigin, aOrigin);
+  // Null for both missing and invalid defaults is ok, since we
+  // always parse to an enum value, so we don't need an invalid
+  // default, and we _want_ the missing default to be null.
+  GetEnumAttr(nsGkAtoms::crossorigin, nullptr, aCrossOrigin);
 }
 
 void
-SVGScriptElement::SetCrossOrigin(const nsAString & aOrigin, ErrorResult& rv)
+SVGScriptElement::SetCrossOrigin(const nsAString & aCrossOrigin,
+                                 ErrorResult& aError)
 {
-  rv = SetAttr(kNameSpaceID_None, nsGkAtoms::crossorigin, aOrigin, true);
+  SetOrRemoveNullableStringAttr(nsGkAtoms::crossorigin, aCrossOrigin, aError);
 }
 
 already_AddRefed<SVGAnimatedString>
diff --git a/content/svg/content/src/SVGScriptElement.h b/content/svg/content/src/SVGScriptElement.h
index f79c31f0443..51c35178b8b 100644
--- a/content/svg/content/src/SVGScriptElement.h
+++ b/content/svg/content/src/SVGScriptElement.h
@@ -66,8 +66,8 @@ public:
   // WebIDL
   void GetType(nsAString & aType);
   void SetType(const nsAString & aType, ErrorResult& rv);
-  void GetCrossOrigin(nsAString & aOrigin);
-  void SetCrossOrigin(const nsAString & aOrigin, ErrorResult& rv);
+  void GetCrossOrigin(nsAString & aCrossOrigin);
+  void SetCrossOrigin(const nsAString & aCrossOrigin, ErrorResult& aError);
   already_AddRefed<SVGAnimatedString> Href();
 
 protected:
diff --git a/content/svg/content/test/mochitest.ini b/content/svg/content/test/mochitest.ini
index 4f5a87d0e1e..626075349dc 100644
--- a/content/svg/content/test/mochitest.ini
+++ b/content/svg/content/test/mochitest.ini
@@ -16,6 +16,7 @@ support-files =
   getSubStringLength-helper.svg
   matrixUtils.js
   MutationEventChecker.js
+  object-delayed-intrinsic-size.sjs
   pointer-events.js
   scientific-helper.svg
   selectSubString-helper.svg
@@ -50,6 +51,7 @@ skip-if = true
 [test_lengthParsing.html]
 [test_nonAnimStrings.xhtml]
 [test_non-scaling-stroke.html]
+[test_object-delayed-intrinsic-size.html]
 [test_onerror.xhtml]
 [test_pathAnimInterpolation.xhtml]
 [test_pathLength.html]
diff --git a/content/svg/content/test/object-delayed-intrinsic-size.sjs b/content/svg/content/test/object-delayed-intrinsic-size.sjs
new file mode 100644
index 00000000000..0f98c4dc1e7
--- /dev/null
+++ b/content/svg/content/test/object-delayed-intrinsic-size.sjs
@@ -0,0 +1,24 @@
+
+var timer = null;
+
+function handleRequest(request, response)
+{
+  response.processAsync();
+
+  response.setStatusLine(null, 200, "OK");
+  response.setHeader("Content-Type", "image/svg+xml", false);
+
+  // We need some body output or else gecko will not do an initial reflow
+  // while waiting for the rest of the document to load:
+  response.bodyOutputStream.write("\n", 1);
+
+  timer = Components.classes["@mozilla.org/timer;1"]
+                    .createInstance(Components.interfaces.nsITimer);
+  timer.initWithCallback(function()
+  {
+    var body = "<svg xmlns='http://www.w3.org/2000/svg' width='70' height='0'></svg>";
+    response.bodyOutputStream.write(body, body.length);
+    response.finish();
+  }, 1000 /* milliseconds */, Components.interfaces.nsITimer.TYPE_ONE_SHOT);
+}
+
diff --git a/content/svg/content/test/test_object-delayed-intrinsic-size.html b/content/svg/content/test/test_object-delayed-intrinsic-size.html
new file mode 100644
index 00000000000..c89029daa75
--- /dev/null
+++ b/content/svg/content/test/test_object-delayed-intrinsic-size.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1063073
+-->
+<html>
+  <head>
+    <title>Test that &lt;object&gt; embedding SVG and using its intrinsic
+           size will resize if the &lt;object&gt; gets a reflow before the
+           root-&lt;svg&gt; gets its nsSVGOuterSVGFrame
+    </title>
+    <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+    <script>
+
+// This test checks for a race condition. If it fails intermittently then it
+// may actually be a full failure.
+
+SimpleTest.waitForExplicitFinish();
+
+function runTest()
+{
+  var object = document.querySelector("object");
+  var cs = document.defaultView.getComputedStyle(object, "");
+  var width = cs.getPropertyValue("width");
+  is(width, "70px", "Check that the &lt;object&gt; size updated");
+  SimpleTest.finish();
+}
+
+    </script>
+  </head>
+  <body onload="runTest();">
+    <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1063073">Mozilla Bug 1063073</a>
+    <p id="display"></p>
+    <div id="content">
+      <object style="border:1px solid black" type="image/svg+xml"
+              data="object-delayed-intrinsic-size.sjs"></object>
+    </div>
+  </body>
+</html>
+
diff --git a/content/xul/document/src/XULDocument.h b/content/xul/document/src/XULDocument.h
index df158fbc69b..aa987d2cd26 100644
--- a/content/xul/document/src/XULDocument.h
+++ b/content/xul/document/src/XULDocument.h
@@ -455,7 +455,7 @@ protected:
      * If the current transcluded script is being compiled off thread, the
      * source for that script.
      */
-    jschar* mOffThreadCompileStringBuf;
+    char16_t* mOffThreadCompileStringBuf;
     size_t mOffThreadCompileStringLength;
 
     /**
diff --git a/docshell/base/nsDefaultURIFixup.cpp b/docshell/base/nsDefaultURIFixup.cpp
index 0061f3ea886..f233c03d621 100644
--- a/docshell/base/nsDefaultURIFixup.cpp
+++ b/docshell/base/nsDefaultURIFixup.cpp
@@ -386,14 +386,35 @@ nsDefaultURIFixup::GetFixupURIInfo(const nsACString& aStringURI, uint32_t aFixup
         info->mFixupCreatedAlternateURI = MakeAlternateURI(info->mFixedURI);
     }
 
+    // If there is no relevent dot in the host, do we require the domain to
+    // be whitelisted?
+    if (info->mFixedURI) {
+        if (aFixupFlags & FIXUP_FLAG_REQUIRE_WHITELISTED_HOST) {
+
+            nsAutoCString asciiHost;
+            if (NS_SUCCEEDED(info->mFixedURI->GetAsciiHost(asciiHost)) &&
+                !asciiHost.IsEmpty()) {
+
+                uint32_t dotLoc = uint32_t(asciiHost.FindChar('.'));
+
+                if ((dotLoc == uint32_t(kNotFound) || dotLoc == asciiHost.Length() - 1)) {
+                    if (IsDomainWhitelisted(asciiHost, dotLoc)) {
+                        info->mPreferredURI = info->mFixedURI;
+                    }
+                } else {
+                    info->mPreferredURI = info->mFixedURI;
+                }
+            }
+        } else {
+            info->mPreferredURI = info->mFixedURI;
+        }
+
+        return NS_OK;
+    }
+
     // If we still haven't been able to construct a valid URI, try to force a
     // keyword match.  This catches search strings with '.' or ':' in them.
-    if (info->mFixedURI)
-    {
-        info->mPreferredURI = info->mFixedURI;
-    }
-    else if (sFixupKeywords && (aFixupFlags & FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP))
-    {
+    if (sFixupKeywords && (aFixupFlags & FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP)) {
         rv = KeywordToURI(aStringURI, aPostData, getter_AddRefs(info->mPreferredURI));
         if (NS_SUCCEEDED(rv) && info->mPreferredURI)
         {
@@ -964,26 +985,17 @@ void nsDefaultURIFixup::KeywordURIFixup(const nsACString & aURIString,
               (dotLoc == lastDotLoc && (dotLoc == 0 || dotLoc == aURIString.Length() - 1))) &&
              colonLoc == uint32_t(kNotFound) && qMarkLoc == uint32_t(kNotFound))
     {
+
         nsAutoCString asciiHost;
         if (aFixupInfo->mFixedURI &&
             NS_SUCCEEDED(aFixupInfo->mFixedURI->GetAsciiHost(asciiHost)) &&
-            !asciiHost.IsEmpty())
-        {
-            // Check if this domain is whitelisted as an actual
-            // domain (which will prevent a keyword query)
-            // NB: any processing of the host here should stay in sync with
-            // code in the front-end(s) that set the pref.
-            nsAutoCString pref("browser.fixup.domainwhitelist.");
-            if (dotLoc == aURIString.Length() - 1) {
-              pref.Append(Substring(asciiHost, 0, asciiHost.Length() - 1));
-            } else {
-              pref.Append(asciiHost);
-            }
-            if (Preferences::GetBool(pref.get(), false))
-            {
+            !asciiHost.IsEmpty()) {
+
+            if (IsDomainWhitelisted(asciiHost, dotLoc)) {
                 return;
             }
         }
+
         // If we get here, we don't have a valid URI, or we did but the
         // host is not whitelisted, so we do a keyword search *anyway*:
         rv = KeywordToURI(aFixupInfo->mOriginalInput, aPostData,
@@ -995,6 +1007,25 @@ void nsDefaultURIFixup::KeywordURIFixup(const nsACString & aURIString,
     }
 }
 
+bool nsDefaultURIFixup::IsDomainWhitelisted(const nsAutoCString aAsciiHost,
+                                            const uint32_t aDotLoc)
+{
+    // Check if this domain is whitelisted as an actual
+    // domain (which will prevent a keyword query)
+    // NB: any processing of the host here should stay in sync with
+    // code in the front-end(s) that set the pref.
+
+    nsAutoCString pref("browser.fixup.domainwhitelist.");
+
+    if (aDotLoc == aAsciiHost.Length() - 1) {
+      pref.Append(Substring(aAsciiHost, 0, aAsciiHost.Length() - 1));
+    } else {
+      pref.Append(aAsciiHost);
+    }
+
+    return Preferences::GetBool(pref.get(), false);
+}
+
 
 nsresult NS_NewURIFixup(nsIURIFixup **aURIFixup)
 {
diff --git a/docshell/base/nsDefaultURIFixup.h b/docshell/base/nsDefaultURIFixup.h
index ab92e242bcd..1088349ff59 100644
--- a/docshell/base/nsDefaultURIFixup.h
+++ b/docshell/base/nsDefaultURIFixup.h
@@ -37,6 +37,8 @@ private:
     bool PossiblyHostPortUrl(const nsACString& aUrl);
     bool MakeAlternateURI(nsIURI *aURI);
     bool IsLikelyFTP(const nsCString& aHostSpec);
+    bool IsDomainWhitelisted(const nsAutoCString aAsciiHost,
+                             const uint32_t aDotLoc);
 };
 
 class nsDefaultURIFixupInfo : public nsIURIFixupInfo
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index fed0345c7c6..41fcc8b28c6 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -9416,14 +9416,7 @@ nsDocShell::InternalLoad(nsIURI * aURI,
         aLoadType == LOAD_HISTORY ||
         aLoadType == LOAD_LINK) {
 
-        nsCOMPtr<nsIURI> currentURI;
-        if (sURIFixup && mCurrentURI) {
-            rv = sURIFixup->CreateExposableURI(mCurrentURI,
-                                               getter_AddRefs(currentURI));
-            NS_ENSURE_SUCCESS(rv, rv);
-        } else {
-            currentURI = mCurrentURI;
-        }
+        nsCOMPtr<nsIURI> currentURI = mCurrentURI;
         // Split currentURI and aURI on the '#' character.  Make sure we read
         // the return values of SplitURIAtHash; if it fails, we don't want to
         // allow a short-circuited navigation.
@@ -9439,6 +9432,19 @@ nsDocShell::InternalLoad(nsIURI * aURI,
                                   NS_SUCCEEDED(splitRv2) &&
                                   curBeforeHash.Equals(newBeforeHash);
 
+        if (!sameExceptHashes && sURIFixup && currentURI &&
+            NS_SUCCEEDED(splitRv2)) {
+          // Maybe aURI came from the exposable form of currentURI?
+          nsCOMPtr<nsIURI> currentExposableURI;
+          rv = sURIFixup->CreateExposableURI(currentURI,
+                                             getter_AddRefs(currentExposableURI));
+          NS_ENSURE_SUCCESS(rv, rv);
+          splitRv1 = nsContentUtils::SplitURIAtHash(currentExposableURI,
+                                                    curBeforeHash, curHash);
+          sameExceptHashes = NS_SUCCEEDED(splitRv1) &&
+            curBeforeHash.Equals(newBeforeHash);
+        }
+
         bool historyNavBetweenSameDoc = false;
         if (mOSHE && aSHEntry) {
             // We're doing a history load.
diff --git a/docshell/base/nsIURIFixup.idl b/docshell/base/nsIURIFixup.idl
index 71a24d37a12..7384f8c99d8 100644
--- a/docshell/base/nsIURIFixup.idl
+++ b/docshell/base/nsIURIFixup.idl
@@ -63,7 +63,7 @@ interface nsIURIFixupInfo : nsISupports
 /**
  * Interface implemented by objects capable of fixing up strings into URIs
  */
-[scriptable, uuid(80d4932e-bb2e-4afb-98e0-de9cc9ea7d82)]
+[scriptable, uuid(49298f2b-3630-4874-aecc-522300a7fead)]
 interface nsIURIFixup : nsISupports
 {
     /** No fixup flags. */
@@ -83,12 +83,18 @@ interface nsIURIFixup : nsISupports
     const unsigned long FIXUP_FLAGS_MAKE_ALTERNATE_URI = 2;
 
     /**
+     * For an input that may be just a domain with only 1 level (eg, "mozilla"),
+     * require that the host be whitelisted.
+     *
+     * Overridden by FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP.
+     */
+    const unsigned long FIXUP_FLAG_REQUIRE_WHITELISTED_HOST = 4;
+
+    /*
      * Fix common scheme typos.
      */
     const unsigned long FIXUP_FLAG_FIX_SCHEME_TYPOS = 8;
 
-    /* Note that flag 4 is available. */
-
     /**
      * Converts an internal URI (e.g. a wyciwyg URI) into one which we can
      * expose to the user, for example on the URL bar.
diff --git a/docshell/test/unit/test_nsDefaultURIFixup_info.js b/docshell/test/unit/test_nsDefaultURIFixup_info.js
index c63f5cb2207..fb1b7ddb67b 100644
--- a/docshell/test/unit/test_nsDefaultURIFixup_info.js
+++ b/docshell/test/unit/test_nsDefaultURIFixup_info.js
@@ -3,7 +3,8 @@ let urifixup = Cc["@mozilla.org/docshell/urifixup;1"].
 
 Components.utils.import("resource://gre/modules/Services.jsm");
 
-let prefList = ["browser.fixup.typo.scheme", "keyword.enabled"];
+let prefList = ["browser.fixup.typo.scheme", "keyword.enabled",
+                "browser.fixup.domainwhitelist.whitelisted"];
 for (let pref of prefList) {
   Services.prefs.setBoolPref(pref, true);
 }
@@ -34,7 +35,8 @@ do_register_cleanup(function() {
 let flagInputs = [
   urifixup.FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP,
   urifixup.FIXUP_FLAGS_MAKE_ALTERNATE_URI,
-  urifixup.FIXUP_FLAG_FIX_SCHEME_TYPOS
+  urifixup.FIXUP_FLAG_FIX_SCHEME_TYPOS,
+  urifixup.FIXUP_FLAG_REQUIRE_WHITELISTED_HOST,
 ];
 
 flagInputs.concat([
@@ -44,42 +46,192 @@ flagInputs.concat([
   flagInputs[0] | flagInputs[1] | flagInputs[2]
 ]);
 
-let testcases = [
-  ["http://www.mozilla.org", "http://www.mozilla.org/", null, false, false],
-  ["http://127.0.0.1/", "http://127.0.0.1/", null, false, false],
-  ["file:///foo/bar", "file:///foo/bar", null, false, false],
-  ["://www.mozilla.org", "http://www.mozilla.org/", null, false, true],
-  ["www.mozilla.org", "http://www.mozilla.org/", null, false, true],
-  ["http://mozilla/", "http://mozilla/", "http://www.mozilla.com/", false, false],
-  ["http://test./", "http://test./", "http://www.test./", false, false],
-  ["127.0.0.1", "http://127.0.0.1/", null, false, true],
-  ["1234", "http://1234/", "http://www.1234.com/", true, true],
-  ["host/foo.txt", "http://host/foo.txt", "http://www.host.com/foo.txt", false, true],
-  ["mozilla", "http://mozilla/", "http://www.mozilla.com/", true, true],
-  ["test.", "http://test./", "http://www.test./", true, true],
-  [".test", "http://.test/", "http://www..test/", true, true],
-  ["mozilla is amazing", null, null, true, true],
-  ["mozilla ", "http://mozilla/", "http://www.mozilla.com/", true, true],
-  ["   mozilla  ", "http://mozilla/", "http://www.mozilla.com/", true, true],
-  ["mozilla \\", null, null, true, true],
-  ["mozilla \\ foo.txt", null, null, true, true],
-  ["mozilla \\\r foo.txt", null, null, true, true],
-  ["mozilla\n", "http://mozilla/", "http://www.mozilla.com/", true, true],
-  ["mozilla \r\n", "http://mozilla/", "http://www.mozilla.com/", true, true],
-  ["moz\r\nfirefox\nos\r", "http://mozfirefoxos/", "http://www.mozfirefoxos.com/", true, true],
-  ["moz\r\n firefox\n", null, null, true, true],
-  ["", null, null, true, true],
-  ["[]", null, null, true, true]
-];
+/*
+  The following properties are supported for these test cases:
+  {
+    input: "", // Input string, required
+    fixedURI: "", // Expected fixedURI
+    alternateURI: "", // Expected alternateURI
+    keywordLookup: false, // Whether a keyword lookup is expected
+    protocolChange: false, // Whether a protocol change is expected
+    affectedByWhitelist: false, // Whether the input host is affected by the whitelist
+    inWhitelist: false, // Whether the input host is in the whitelist
+  }
+*/
+let testcases = [ {
+    input: "http://www.mozilla.org",
+    fixedURI: "http://www.mozilla.org/",
+  }, {
+    input: "http://127.0.0.1/",
+    fixedURI: "http://127.0.0.1/",
+  }, {
+    input: "file:///foo/bar",
+    fixedURI: "file:///foo/bar",
+  }, {
+    input: "://www.mozilla.org",
+    fixedURI: "http://www.mozilla.org/",
+    protocolChange: true,
+  }, {
+    input: "www.mozilla.org",
+    fixedURI: "http://www.mozilla.org/",
+    protocolChange: true,
+  }, {
+    input: "http://mozilla/",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+  }, {
+    input: "http://test./",
+    fixedURI: "http://test./",
+    alternateURI: "http://www.test./",
+  }, {
+    input: "127.0.0.1",
+    fixedURI: "http://127.0.0.1/",
+    protocolChange: true,
+  }, {
+    input: "1234",
+    fixedURI: "http://1234/",
+    alternateURI: "http://www.1234.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "host/foo.txt",
+    fixedURI: "http://host/foo.txt",
+    alternateURI: "http://www.host.com/foo.txt",
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "mozilla",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "test.",
+    fixedURI: "http://test./",
+    alternateURI: "http://www.test./",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: ".test",
+    fixedURI: "http://.test/",
+    alternateURI: "http://www..test/",
+    keywordLookup: true,
+    protocolChange: true,
+  }, {
+    input: "mozilla is amazing",
+    keywordLookup: true,
+    protocolChange: true,
+  }, {
+    input: "mozilla ",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "   mozilla  ",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "mozilla \\",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "mozilla \\ foo.txt",
+    keywordLookup: true,
+    protocolChange: true,
+  }, {
+    input: "mozilla \\\r foo.txt",
+    keywordLookup: true,
+    protocolChange: true,
+  }, {
+    input: "mozilla\n",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "mozilla \r\n",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "moz\r\nfirefox\nos\r",
+    fixedURI: "http://mozfirefoxos/",
+    alternateURI: "http://www.mozfirefoxos.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  }, {
+    input: "moz\r\n firefox\n",
+    keywordLookup: true,
+    protocolChange: true,
+  }, {
+    input: "",
+    keywordLookup: true,
+    protocolChange: true,
+  }, {
+    input: "[]",
+    keywordLookup: true,
+    protocolChange: true,
+  }, {
+    input: "http://whitelisted/",
+    fixedURI: "http://whitelisted/",
+    alternateURI: "http://www.whitelisted.com/",
+    affectedByWhitelist: true,
+    inWhitelist: true,
+  }];
 
 if (Services.appinfo.OS.toLowerCase().startsWith("win")) {
-  testcases.push(["C:\\some\\file.txt", "file:///C:/some/file.txt", null, false, true]);
-  testcases.push(["//mozilla", "http://mozilla/", "http://www.mozilla.com/", false, true]);
-  testcases.push(["mozilla\\", "http://mozilla/", "http://www.mozilla.com/", true, true]);
+  testcases.push({
+    input: "C:\\some\\file.txt",
+    fixedURI: "file:///C:/some/file.txt",
+    protocolChange: true,
+  });
+  testcases.push({
+    input: "//mozilla",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+    protocolChange: true,
+    affectedByWhitelist: true,
+  });
+  testcases.push({
+    input: "mozilla\\",
+    fixedURI: "http://mozilla/",
+    alternateURI: "http://www.mozilla.com/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  });
 } else {
-  testcases.push(["/some/file.txt", "file:///some/file.txt", null, false, true]);
-  testcases.push(["//mozilla", "file:////mozilla", null, false, true]);
-  testcases.push(["mozilla\\", "http://mozilla\\/", "http://www.mozilla/", true, true]);
+  testcases.push({
+    input: "/some/file.txt",
+    fixedURI: "file:///some/file.txt",
+    protocolChange: true,
+  });
+  testcases.push({
+    input: "//mozilla",
+    fixedURI: "file:////mozilla",
+    protocolChange: true,
+  });
+  testcases.push({
+    input: "mozilla\\",
+    fixedURI: "http://mozilla\\/",
+    alternateURI: "http://www.mozilla/",
+    keywordLookup: true,
+    protocolChange: true,
+    affectedByWhitelist: true,
+  });
 }
 
 function sanitize(input) {
@@ -87,8 +239,20 @@ function sanitize(input) {
 }
 
 function run_test() {
-  for (let [testInput, expectedFixedURI, alternativeURI,
-            expectKeywordLookup, expectProtocolChange] of testcases) {
+  for (let { input: testInput,
+             fixedURI: expectedFixedURI,
+             alternateURI: alternativeURI,
+             keywordLookup: expectKeywordLookup,
+             protocolChange: expectProtocolChange,
+             affectedByWhitelist: affectedByWhitelist,
+             inWhitelist: inWhitelist } of testcases) {
+
+    // Explicitly force these into a boolean
+    expectKeywordLookup = !!expectKeywordLookup;
+    expectProtocolChange = !!expectProtocolChange;
+    affectedByWhitelist = !!affectedByWhitelist;
+    inWhitelist = !!inWhitelist;
+
     for (let flags of flagInputs) {
       let info;
       let fixupURIOnly = null;
@@ -109,10 +273,12 @@ function run_test() {
         continue;
       }
 
-      do_print("Checking " + testInput + " with flags " + flags);
+      do_print("Checking \"" + testInput + "\" with flags " + flags);
 
       // Both APIs should then also be using the same spec.
-      do_check_eq(fixupURIOnly.spec, info.preferredURI.spec);
+      do_check_eq(!!fixupURIOnly, !!info.preferredURI);
+      if (fixupURIOnly)
+        do_check_eq(fixupURIOnly.spec, info.preferredURI.spec);
 
       let isFileURL = expectedFixedURI && expectedFixedURI.startsWith("file");
 
@@ -131,10 +297,25 @@ function run_test() {
       do_check_eq(info.fixupCreatedAlternateURI, makeAlternativeURI && alternativeURI != null);
 
       // Check the preferred URI
-      if (couldDoKeywordLookup && expectKeywordLookup) {
+      let requiresWhitelistedDomain = flags & urifixup.FIXUP_FLAG_REQUIRE_WHITELISTED_HOST
+      if (couldDoKeywordLookup) {
+        if (expectKeywordLookup) {
+          if (!affectedByWhitelist || (affectedByWhitelist && !inWhitelist)) {
         let urlparamInput = encodeURIComponent(sanitize(testInput)).replace("%20", "+", "g");
         let searchURL = kSearchEngineURL.replace("{searchTerms}", urlparamInput);
         do_check_eq(info.preferredURI.spec, searchURL);
+      } else {
+            do_check_eq(info.preferredURI, null);
+          }
+        } else {
+          do_check_eq(info.preferredURI.spec, info.fixedURI.spec);
+        }
+      } else if (requiresWhitelistedDomain) {
+        // Not a keyword search, but we want to enforce the host whitelist
+        if (!affectedByWhitelist || (affectedByWhitelist && inWhitelist))
+          do_check_eq(info.preferredURI.spec, info.fixedURI.spec);
+        else
+          do_check_eq(info.preferredURI, null);
       } else {
         // In these cases, we should never be doing a keyword lookup and
         // the fixed URI should be preferred:
diff --git a/dom/apps/Webapps.jsm b/dom/apps/Webapps.jsm
index 7d14d02982f..e7b6f1bbbb8 100755
--- a/dom/apps/Webapps.jsm
+++ b/dom/apps/Webapps.jsm
@@ -633,10 +633,23 @@ this.DOMApplicationRegistry = {
 
       yield this.loadCurrentRegistry();
 
+      try {
+        let systemManifestURL =
+          Services.prefs.getCharPref("b2g.system_manifest_url");
+        let systemAppFound =
+          this.webapps.some(v => v.manifestURL == systemManifestURL);
+
+        // We configured a system app but can't find it. That prevents us
+        // from starting so we clear our registry to start again from scratch.
+        if (!systemAppFound) {
+          runUpdate = true;
+        }
+      } catch(e) {} // getCharPref will throw on non-b2g platforms. That's ok.
+
       if (runUpdate) {
 
         // Run migration before uninstall of core apps happens.
-        Services.obs.notifyObservers(null, "webapps-before-update-merge", null);        
+        Services.obs.notifyObservers(null, "webapps-before-update-merge", null);
 
 #ifdef MOZ_WIDGET_GONK
         yield this.installSystemApps();
diff --git a/dom/asmjscache/AsmJSCache.cpp b/dom/asmjscache/AsmJSCache.cpp
index fcd7b3c9c92..7e7bb651722 100644
--- a/dom/asmjscache/AsmJSCache.cpp
+++ b/dom/asmjscache/AsmJSCache.cpp
@@ -1584,8 +1584,8 @@ static const uint32_t sAsmJSCookie = 0x600d600d;
 
 bool
 OpenEntryForRead(nsIPrincipal* aPrincipal,
-                 const jschar* aBegin,
-                 const jschar* aLimit,
+                 const char16_t* aBegin,
+                 const char16_t* aLimit,
                  size_t* aSize,
                  const uint8_t** aMemory,
                  intptr_t* aFile)
@@ -1643,8 +1643,8 @@ CloseEntryForRead(size_t aSize,
 bool
 OpenEntryForWrite(nsIPrincipal* aPrincipal,
                   bool aInstalled,
-                  const jschar* aBegin,
-                  const jschar* aEnd,
+                  const char16_t* aBegin,
+                  const char16_t* aEnd,
                   size_t aSize,
                   uint8_t** aMemory,
                   intptr_t* aFile)
diff --git a/dom/asmjscache/AsmJSCache.h b/dom/asmjscache/AsmJSCache.h
index ee182b370f1..9ddf61de63a 100644
--- a/dom/asmjscache/AsmJSCache.h
+++ b/dom/asmjscache/AsmJSCache.h
@@ -80,8 +80,8 @@ struct WriteParams
 // Parameters specific to opening a cache entry for reading
 struct ReadParams
 {
-  const jschar* mBegin;
-  const jschar* mLimit;
+  const char16_t* mBegin;
+  const char16_t* mLimit;
 
   ReadParams()
   : mBegin(nullptr),
@@ -103,8 +103,8 @@ struct ReadParams
 
 bool
 OpenEntryForRead(nsIPrincipal* aPrincipal,
-                 const jschar* aBegin,
-                 const jschar* aLimit,
+                 const char16_t* aBegin,
+                 const char16_t* aLimit,
                  size_t* aSize,
                  const uint8_t** aMemory,
                  intptr_t *aHandle);
@@ -115,8 +115,8 @@ CloseEntryForRead(size_t aSize,
 bool
 OpenEntryForWrite(nsIPrincipal* aPrincipal,
                   bool aInstalled,
-                  const jschar* aBegin,
-                  const jschar* aEnd,
+                  const char16_t* aBegin,
+                  const char16_t* aEnd,
                   size_t aSize,
                   uint8_t** aMemory,
                   intptr_t* aHandle);
diff --git a/dom/base/Console.cpp b/dom/base/Console.cpp
index c309a15a14f..b83705f517d 100644
--- a/dom/base/Console.cpp
+++ b/dom/base/Console.cpp
@@ -911,9 +911,8 @@ Console::Method(JSContext* aCx, MethodName aMethodName,
       nsGlobalWindow *win = static_cast<nsGlobalWindow*>(mWindow.get());
       MOZ_ASSERT(win);
 
-      ErrorResult rv;
-      nsRefPtr<nsPerformance> performance = win->GetPerformance(rv);
-      if (rv.Failed() || !performance) {
+      nsRefPtr<nsPerformance> performance = win->GetPerformance();
+      if (!performance) {
         return;
       }
 
diff --git a/dom/base/ImageEncoder.cpp b/dom/base/ImageEncoder.cpp
index 4dab71515be..a27c7199cb7 100644
--- a/dom/base/ImageEncoder.cpp
+++ b/dom/base/ImageEncoder.cpp
@@ -21,7 +21,7 @@ namespace dom {
 // template parameter, we need to move this class outside.
 class SurfaceHelper : public nsRunnable {
 public:
-  SurfaceHelper(TemporaryRef<layers::Image> aImage) : mImage(aImage) {}
+  explicit SurfaceHelper(TemporaryRef<layers::Image> aImage) : mImage(aImage) {}
 
   // It retrieves a SourceSurface reference and convert color format on main
   // thread and passes DataSourceSurface to caller thread.
diff --git a/dom/base/Navigator.cpp b/dom/base/Navigator.cpp
index af5aba0d014..44630079d4a 100644
--- a/dom/base/Navigator.cpp
+++ b/dom/base/Navigator.cpp
@@ -377,9 +377,11 @@ Navigator::GetAppName(nsAString& aAppName)
  *
  * An empty array will be returned if there is no valid languages.
  */
-void
+/* static */ void
 Navigator::GetAcceptLanguages(nsTArray<nsString>& aLanguages)
 {
+  MOZ_ASSERT(NS_IsMainThread());
+
   // E.g. "de-de, en-us,en".
   const nsAdoptingString& acceptLang =
     Preferences::GetLocalizedString("intl.accept_languages");
@@ -438,7 +440,7 @@ Navigator::GetLanguage(nsAString& aLanguage)
     aLanguage.Truncate();
   }
 
-    return NS_OK;
+  return NS_OK;
 }
 
 void
diff --git a/dom/base/Navigator.h b/dom/base/Navigator.h
index f98dd85d231..a083bf6fb51 100644
--- a/dom/base/Navigator.h
+++ b/dom/base/Navigator.h
@@ -267,7 +267,8 @@ public:
   void GetOwnPropertyNames(JSContext* aCx, nsTArray<nsString>& aNames,
                            ErrorResult& aRv);
   void GetLanguages(nsTArray<nsString>& aLanguages);
-  void GetAcceptLanguages(nsTArray<nsString>& aLanguages);
+
+  static void GetAcceptLanguages(nsTArray<nsString>& aLanguages);
 
   // WebIDL helper methods
   static bool HasWakeLockSupport(JSContext* /* unused*/, JSObject* /*unused */);
diff --git a/dom/base/WindowNamedPropertiesHandler.cpp b/dom/base/WindowNamedPropertiesHandler.cpp
index dc8da122974..c3dbd4b463b 100644
--- a/dom/base/WindowNamedPropertiesHandler.cpp
+++ b/dom/base/WindowNamedPropertiesHandler.cpp
@@ -69,19 +69,6 @@ ShouldExposeChildWindow(nsString& aNameBeingResolved, nsIDOMWindow *aChild)
                              aNameBeingResolved, eCaseMatters);
 }
 
-static nsGlobalWindow*
-GetWindowFromGlobal(JSObject* aGlobal)
-{
-  nsGlobalWindow* win;
-  if (NS_SUCCEEDED(UNWRAP_OBJECT(Window, aGlobal, win))) {
-    return win;
-  }
-  XPCWrappedNative* wrapper = XPCWrappedNative::Get(aGlobal);
-  nsCOMPtr<nsPIDOMWindow> piWin = do_QueryWrappedNative(wrapper);
-  MOZ_ASSERT(piWin);
-  return static_cast<nsGlobalWindow*>(piWin.get());
-}
-
 bool
 WindowNamedPropertiesHandler::getOwnPropDescriptor(JSContext* aCx,
                                                    JS::Handle<JSObject*> aProxy,
@@ -106,7 +93,7 @@ WindowNamedPropertiesHandler::getOwnPropDescriptor(JSContext* aCx,
   }
 
   // Grab the DOM window.
-  nsGlobalWindow* win = GetWindowFromGlobal(global);
+  nsGlobalWindow* win = xpc::WindowOrNull(global);
   if (win->Length() > 0) {
     nsCOMPtr<nsIDOMWindow> childWin = win->GetChildWindow(str);
     if (childWin && ShouldExposeChildWindow(str, childWin)) {
@@ -178,7 +165,7 @@ WindowNamedPropertiesHandler::ownPropNames(JSContext* aCx,
                                            JS::AutoIdVector& aProps) const
 {
   // Grab the DOM window.
-  nsGlobalWindow* win = GetWindowFromGlobal(JS_GetGlobalForObject(aCx, aProxy));
+  nsGlobalWindow* win = xpc::WindowOrNull(JS_GetGlobalForObject(aCx, aProxy));
   nsTArray<nsString> names;
   win->GetSupportedNames(names);
   // Filter out the ones we wouldn't expose from getOwnPropertyDescriptor.
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index 89d950ca0f0..efdbba4c1c0 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -35,7 +35,6 @@
 #include "nsIXPConnect.h"
 #include "xptcall.h"
 #include "nsTArray.h"
-#include "nsDocument.h" // nsDOMStyleSheetList
 #include "nsDOMBlobBuilder.h"
 
 // General helper includes
@@ -51,18 +50,12 @@
 #include "mozilla/Telemetry.h"
 
 // Window scriptable helper includes
-#include "nsIDocShell.h"
-#include "nsJSUtils.h"
 #include "nsScriptNameSpaceManager.h"
 #include "nsIJSNativeInitializer.h"
-#include "nsJSEnvironment.h"
 
 // DOM base includes
-#include "nsIDOMLocation.h"
 #include "nsIDOMWindow.h"
 #include "nsPIDOMWindow.h"
-#include "nsIDOMJSWindow.h"
-#include "nsIDOMChromeWindow.h"
 #include "nsIDOMConstructor.h"
 
 // DOM core includes
@@ -134,10 +127,7 @@
 
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/Likely.h"
-#include "WindowNamedPropertiesHandler.h"
 #include "nsIInterfaceInfoManager.h"
-#include "mozilla/dom/EventTargetBinding.h"
-#include "mozilla/dom/WindowBinding.h"
 
 #ifdef MOZ_TIME_MANAGER
 #include "TimeManager.h"
@@ -151,14 +141,6 @@ static NS_DEFINE_CID(kDOMSOF_CID, NS_DOM_SCRIPT_OBJECT_FACTORY_CID);
 // NOTE: DEFAULT_SCRIPTABLE_FLAGS and DOM_DEFAULT_SCRIPTABLE_FLAGS
 //       are defined in nsIDOMClassInfo.h.
 
-#define WINDOW_SCRIPTABLE_FLAGS                                               \
- (nsIXPCScriptable::WANT_PRECREATE |                                          \
-  nsIXPCScriptable::WANT_POSTCREATE |                                         \
-  nsIXPCScriptable::WANT_ENUMERATE |                                          \
-  nsIXPCScriptable::DONT_ENUM_QUERY_INTERFACE |                               \
-  nsIXPCScriptable::IS_GLOBAL_OBJECT |                                        \
-  nsIXPCScriptable::WANT_OUTER_OBJECT)
-
 #define ARRAY_SCRIPTABLE_FLAGS                                                \
   (DOM_DEFAULT_SCRIPTABLE_FLAGS       |                                       \
    nsIXPCScriptable::WANT_GETPROPERTY |                                       \
@@ -244,17 +226,6 @@ DOMCI_DATA_NO_CLASS(XULPopupElement)
 static nsDOMClassInfoData sClassInfoData[] = {
   // Base classes
 
-  // The Window class lets you QI into interfaces that are not in the
-  // flattened set (i.e. nsIXPCScriptable::CLASSINFO_INTERFACES_ONLY
-  // is not set), because of this make sure all scriptable interfaces
-  // that are implemented by nsGlobalWindow can securely be exposed
-  // to JS.
-
-
-  NS_DEFINE_CLASSINFO_DATA(Window, nsWindowSH,
-                           DEFAULT_SCRIPTABLE_FLAGS |
-                           WINDOW_SCRIPTABLE_FLAGS)
-
   NS_DEFINE_CLASSINFO_DATA(DOMPrototype, nsDOMConstructorSH,
                            DOM_BASE_SCRIPTABLE_FLAGS |
                            nsIXPCScriptable::WANT_PRECREATE |
@@ -300,11 +271,6 @@ static nsDOMClassInfoData sClassInfoData[] = {
                                       DEFAULT_SCRIPTABLE_FLAGS)
 #endif
 
-  // DOM Chrome Window class.
-  NS_DEFINE_CHROME_XBL_CLASSINFO_DATA(ChromeWindow, nsWindowSH,
-                                      DEFAULT_SCRIPTABLE_FLAGS |
-                                      WINDOW_SCRIPTABLE_FLAGS)
-
 #ifdef MOZ_XUL
   NS_DEFINE_CHROME_XBL_CLASSINFO_DATA(XULTemplateBuilder, nsDOMGenericSH,
                                       DEFAULT_SCRIPTABLE_FLAGS)
@@ -335,10 +301,6 @@ static nsDOMClassInfoData sClassInfoData[] = {
   NS_DEFINE_CLASSINFO_DATA(File, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
-  NS_DEFINE_CLASSINFO_DATA(ModalContentWindow, nsWindowSH,
-                           DEFAULT_SCRIPTABLE_FLAGS |
-                           WINDOW_SCRIPTABLE_FLAGS)
-
   NS_DEFINE_CLASSINFO_DATA(MozSmsMessage, nsDOMGenericSH,
                            DOM_DEFAULT_SCRIPTABLE_FLAGS)
 
@@ -424,10 +386,7 @@ nsIXPConnect *nsDOMClassInfo::sXPConnect = nullptr;
 bool nsDOMClassInfo::sIsInitialized = false;
 
 
-jsid nsDOMClassInfo::sLocation_id        = JSID_VOID;
 jsid nsDOMClassInfo::sConstructor_id     = JSID_VOID;
-jsid nsDOMClassInfo::sTop_id             = JSID_VOID;
-jsid nsDOMClassInfo::sDocument_id        = JSID_VOID;
 jsid nsDOMClassInfo::sWrappedJSObject_id = JSID_VOID;
 
 static const JSClass *sObjectClass = nullptr;
@@ -519,10 +478,7 @@ nsDOMClassInfo::DefineStaticJSVals(JSContext *cx)
   else                                                                        \
       return NS_ERROR_OUT_OF_MEMORY;
 
-  SET_JSID_TO_STRING(sLocation_id,        cx, "location");
   SET_JSID_TO_STRING(sConstructor_id,     cx, "constructor");
-  SET_JSID_TO_STRING(sTop_id,             cx, "top");
-  SET_JSID_TO_STRING(sDocument_id,        cx, "document");
   SET_JSID_TO_STRING(sWrappedJSObject_id, cx, "wrappedJSObject");
 
   return NS_OK;
@@ -734,29 +690,6 @@ nsDOMClassInfo::RegisterExternalClasses()
     d.mInterfaces = interface_list;                                           \
   }
 
-#ifdef MOZ_B2G
-#define DOM_CLASSINFO_WINDOW_MAP_ENTRIES                                       \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMWindow)                                        \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMWindowB2G)                                     \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMJSWindow)                                      \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMEventTarget)                                   \
-  DOM_CLASSINFO_MAP_ENTRY(nsIInlineEventHandlers)                              \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMWindowPerformance)                             \
-  DOM_CLASSINFO_MAP_ENTRY(nsIInterfaceRequestor)                               \
-  DOM_CLASSINFO_MAP_CONDITIONAL_ENTRY(nsITouchEventReceiver,                   \
-                                      TouchEvent::PrefEnabled())
-#else // !MOZ_B2G
-#define DOM_CLASSINFO_WINDOW_MAP_ENTRIES                                       \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMWindow)                                        \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMJSWindow)                                      \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMEventTarget)                                   \
-  DOM_CLASSINFO_MAP_ENTRY(nsIInlineEventHandlers)                              \
-  DOM_CLASSINFO_MAP_ENTRY(nsIDOMWindowPerformance)                             \
-  DOM_CLASSINFO_MAP_ENTRY(nsIInterfaceRequestor)                               \
-  DOM_CLASSINFO_MAP_CONDITIONAL_ENTRY(nsITouchEventReceiver,                   \
-                                      TouchEvent::PrefEnabled())
-#endif // MOZ_B2G
-
 nsresult
 nsDOMClassInfo::Init()
 {
@@ -778,13 +711,6 @@ nsDOMClassInfo::Init()
 
   AutoSafeJSContext cx;
 
-  DOM_CLASSINFO_MAP_BEGIN(Window, nsIDOMWindow)
-    DOM_CLASSINFO_WINDOW_MAP_ENTRIES
-#ifdef MOZ_WEBSPEECH
-    DOM_CLASSINFO_MAP_ENTRY(nsISpeechSynthesisGetter)
-#endif
-  DOM_CLASSINFO_MAP_END
-
   DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(DOMPrototype, nsIDOMDOMConstructor)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMDOMConstructor)
   DOM_CLASSINFO_MAP_END
@@ -838,14 +764,6 @@ nsDOMClassInfo::Init()
   DOM_CLASSINFO_MAP_END
 #endif
 
-  DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(ChromeWindow, nsIDOMWindow)
-    DOM_CLASSINFO_WINDOW_MAP_ENTRIES
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMChromeWindow)
-#ifdef MOZ_WEBSPEECH
-    DOM_CLASSINFO_MAP_ENTRY(nsISpeechSynthesisGetter)
-#endif
-  DOM_CLASSINFO_MAP_END
-
 #ifdef MOZ_XUL
   DOM_CLASSINFO_MAP_BEGIN(XULTemplateBuilder, nsIXULTemplateBuilder)
     DOM_CLASSINFO_MAP_ENTRY(nsIXULTemplateBuilder)
@@ -890,14 +808,6 @@ nsDOMClassInfo::Init()
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMFile)
   DOM_CLASSINFO_MAP_END
 
-  DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(ModalContentWindow, nsIDOMWindow)
-    DOM_CLASSINFO_WINDOW_MAP_ENTRIES
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMModalContentWindow)
-#ifdef MOZ_WEBSPEECH
-    DOM_CLASSINFO_MAP_ENTRY(nsISpeechSynthesisGetter)
-#endif
-  DOM_CLASSINFO_MAP_END
-
   DOM_CLASSINFO_MAP_BEGIN(MozSmsMessage, nsIDOMMozSmsMessage)
      DOM_CLASSINFO_MAP_ENTRY(nsIDOMMozSmsMessage)
   DOM_CLASSINFO_MAP_END
@@ -1317,15 +1227,6 @@ nsDOMClassInfo::HasInstance(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   return NS_ERROR_UNEXPECTED;
 }
 
-NS_IMETHODIMP
-nsDOMClassInfo::OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                            JSObject * obj, JSObject * *_retval)
-{
-  NS_WARNING("nsDOMClassInfo::OuterObject Don't call me!");
-
-  return NS_ERROR_UNEXPECTED;
-}
-
 static nsresult
 GetExternalClassInfo(nsScriptNameSpaceManager *aNameSpaceManager,
                      const nsAString &aName,
@@ -1465,7 +1366,7 @@ nsDOMClassInfo::PostCreatePrototype(JSContext * cx, JSObject * aProto)
 
   // Don't overwrite a property set by content.
   bool contentDefinedProperty;
-  if (!::JS_AlreadyHasOwnUCProperty(cx, global, reinterpret_cast<const jschar*>(mData->mNameUTF16),
+  if (!::JS_AlreadyHasOwnUCProperty(cx, global, reinterpret_cast<const char16_t*>(mData->mNameUTF16),
                                     NS_strlen(mData->mNameUTF16),
                                     &contentDefinedProperty)) {
     return NS_ERROR_FAILURE;
@@ -1555,146 +1456,13 @@ nsDOMClassInfo::ShutDown()
     }
   }
 
-  sLocation_id        = JSID_VOID;
   sConstructor_id     = JSID_VOID;
-  sTop_id             = JSID_VOID;
-  sDocument_id        = JSID_VOID;
   sWrappedJSObject_id = JSID_VOID;
 
   NS_IF_RELEASE(sXPConnect);
   sIsInitialized = false;
 }
 
-// Window helper
-
-NS_IMETHODIMP
-nsWindowSH::PreCreate(nsISupports *nativeObj, JSContext *cx,
-                      JSObject *globalObj, JSObject **parentObj)
-{
-  // Normally ::PreCreate() is used to give XPConnect the parent
-  // object for the object that's being wrapped, this parent object is
-  // set as the parent of the wrapper and it's also used to find the
-  // right scope for the object being wrapped. Now, in the case of the
-  // global object the wrapper shouldn't have a parent but we supply
-  // one here anyway (the global object itself) and this will be used
-  // by XPConnect only to find the right scope, once the scope is
-  // found XPConnect will find the existing wrapper (which always
-  // exists since it's created on window construction), since an
-  // existing wrapper is found the parent we supply here is ignored
-  // after the wrapper is found.
-
-  nsCOMPtr<nsIScriptGlobalObject> sgo(do_QueryInterface(nativeObj));
-  NS_ASSERTION(sgo, "nativeObj not a global object!");
-
-  nsGlobalWindow *win = nsGlobalWindow::FromSupports(nativeObj);
-  NS_ASSERTION(win->IsInnerWindow(), "Should be inner window.");
-
-  // We sometimes get a disconnected window during file api test. :-(
-  if (!win->GetOuterWindowInternal())
-    return NS_ERROR_FAILURE;
-
-  // If we're bootstrapping, we don't have a JS object yet.
-  if (win->GetOuterWindowInternal()->IsCreatingInnerWindow())
-    return NS_OK;
-
-  return SetParentToWindow(win, parentObj);
-}
-
-NS_IMETHODIMP
-nsWindowSH::PostCreatePrototype(JSContext* aCx, JSObject* aProto)
-{
-  JS::Rooted<JSObject*> proto(aCx, aProto);
-
-  nsresult rv = nsDOMClassInfo::PostCreatePrototype(aCx, proto);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // We should probably move this into the CreateInterfaceObjects for Window
-  // once it is on WebIDL bindings.
-  WindowNamedPropertiesHandler::Install(aCx, proto);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsWindowSH::PostCreate(nsIXPConnectWrappedNative *wrapper,
-                       JSContext *cx, JSObject *obj)
-{
-  JS::Rooted<JSObject*> window(cx, obj);
-
-#ifdef DEBUG
-  nsCOMPtr<nsIScriptGlobalObject> sgo(do_QueryWrappedNative(wrapper));
-
-  NS_ASSERTION(sgo && sgo->GetGlobalJSObject() == obj,
-               "Multiple wrappers created for global object!");
-#endif
-
-  const NativeProperties* windowProperties =
-    WindowBinding::sNativePropertyHooks->mNativeProperties.regular;
-  const NativeProperties* eventTargetProperties =
-    EventTargetBinding::sNativePropertyHooks->mNativeProperties.regular;
-
-  if (!DefineWebIDLBindingUnforgeablePropertiesOnXPCObject(cx, window, windowProperties) ||
-      !DefineWebIDLBindingUnforgeablePropertiesOnXPCObject(cx, window, eventTargetProperties)) {
-    return NS_ERROR_FAILURE;
-  }
-
-  if (!GlobalPropertiesAreOwn()) {
-    return NS_OK;
-  }
-
-  return DefineWebIDLBindingPropertiesOnXPCObject(cx, window, windowProperties) &&
-         DefineWebIDLBindingPropertiesOnXPCObject(cx, window, eventTargetProperties) ?
-         NS_OK : NS_ERROR_FAILURE;
-}
-
-struct ResolveGlobalNameClosure
-{
-  JSContext* cx;
-  JS::Handle<JSObject*> obj;
-  bool* retval;
-};
-
-static PLDHashOperator
-ResolveGlobalName(const nsAString& aName,
-                  const nsGlobalNameStruct& aNameStruct,
-                  void* aClosure)
-{
-  ResolveGlobalNameClosure* closure =
-    static_cast<ResolveGlobalNameClosure*>(aClosure);
-  JS::Rooted<JS::Value> dummy(closure->cx);
-  bool ok = JS_LookupUCProperty(closure->cx, closure->obj,
-                                aName.BeginReading(), aName.Length(),
-                                &dummy);
-  if (!ok) {
-    *closure->retval = false;
-    return PL_DHASH_STOP;
-  }
-  return PL_DHASH_NEXT;
-}
-
-NS_IMETHODIMP
-nsWindowSH::Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                      JSObject *aObj, bool *_retval)
-{
-  JS::Rooted<JSObject*> obj(cx, aObj);
-  if (!xpc::WrapperFactory::IsXrayWrapper(obj)) {
-    *_retval = JS_EnumerateStandardClasses(cx, obj);
-    if (!*_retval) {
-      return NS_OK;
-    }
-
-    // Now resolve everything from the namespace manager
-    nsScriptNameSpaceManager *nameSpaceManager = GetNameSpaceManager();
-    if (!nameSpaceManager) {
-      NS_ERROR("Can't get namespace manager.");
-      return NS_ERROR_UNEXPECTED;
-    }
-    ResolveGlobalNameClosure closure = { cx, obj, _retval };
-    nameSpaceManager->EnumerateGlobalNames(ResolveGlobalName, &closure);
-  }
-
-  return NS_OK;
-}
-
 static nsDOMConstructorFunc
 FindConstructorFunc(const nsDOMClassInfoData *aDOMClassInfoData)
 {
@@ -2265,23 +2033,6 @@ GetXPCProto(nsIXPConnect *aXPConnect, JSContext *cx, nsGlobalWindow *aWin,
     nsDOMClassInfoID ci_id = (nsDOMClassInfoID)id;
 
     ci = NS_GetDOMClassInfoInstance(ci_id);
-
-    // In most cases we want to find the wrapped native prototype in
-    // aWin's scope and use that prototype for
-    // ClassName.prototype. But in the case where we're setting up
-    // "Window.prototype" or "ChromeWindow.prototype" we want to do
-    // the look up in aWin's outer window's scope since the inner
-    // window's wrapped native prototype comes from the outer
-    // window's scope.
-    if (ci_id == eDOMClassInfo_Window_id ||
-        ci_id == eDOMClassInfo_ModalContentWindow_id ||
-        ci_id == eDOMClassInfo_ChromeWindow_id) {
-      nsGlobalWindow *scopeWindow = aWin->GetOuterWindowInternal();
-
-      if (scopeWindow) {
-        aWin = scopeWindow;
-      }
-    }
   }
   else {
     ci = nsDOMClassInfo::GetClassInfoInstance(aNameStruct->mData);
@@ -2498,6 +2249,7 @@ LookupComponentsShim(JSContext *cx, JS::Handle<JSObject*> global,
                      nsPIDOMWindow *win,
                      JS::MutableHandle<JSPropertyDescriptor> desc);
 
+// static
 bool
 nsWindowSH::NameStructEnabled(JSContext* aCx, nsGlobalWindow *aWin,
                               const nsAString& aName,
@@ -2732,7 +2484,7 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
     // set up the prototype chain.  This will go ahead and define things on the
     // actual window's global.
     nsCOMPtr<nsIXPConnectJSObjectHolder> proto_holder;
-    rv = GetXPCProto(sXPConnect, cx, aWin, name_struct,
+    rv = GetXPCProto(nsDOMClassInfo::sXPConnect, cx, aWin, name_struct,
                      getter_AddRefs(proto_holder));
     NS_ENSURE_SUCCESS(rv, rv);
     bool isXray = xpc::WrapperFactory::IsXrayWrapper(obj);
@@ -2755,7 +2507,8 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
       ci_data = name_struct->mData;
     }
 
-    return ResolvePrototype(sXPConnect, aWin, cx, obj, class_name, ci_data,
+    return ResolvePrototype(nsDOMClassInfo::sXPConnect, aWin, cx, obj,
+                            class_name, ci_data,
                             name_struct, nameSpaceManager, dot_prototype,
                             desc);
   }
@@ -2763,7 +2516,8 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
   if (name_struct->mType == nsGlobalNameStruct::eTypeClassProto) {
     // We don't have a XPConnect prototype object, let ResolvePrototype create
     // one.
-    return ResolvePrototype(sXPConnect, aWin, cx, obj, class_name, nullptr,
+    return ResolvePrototype(nsDOMClassInfo::sXPConnect, aWin, cx, obj,
+                            class_name, nullptr,
                             name_struct, nameSpaceManager, nullptr, desc);
   }
 
@@ -2776,7 +2530,7 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
     // constructor is an alias for (for example for Image we need the prototype
     // for HTMLImageElement).
     nsCOMPtr<nsIXPConnectJSObjectHolder> proto_holder;
-    rv = GetXPCProto(sXPConnect, cx, aWin, alias_struct,
+    rv = GetXPCProto(nsDOMClassInfo::sXPConnect, cx, aWin, alias_struct,
                      getter_AddRefs(proto_holder));
     NS_ENSURE_SUCCESS(rv, rv);
 
@@ -2792,7 +2546,8 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
       return NS_ERROR_UNEXPECTED;
     }
 
-    return ResolvePrototype(sXPConnect, aWin, cx, obj, class_name, ci_data,
+    return ResolvePrototype(nsDOMClassInfo::sXPConnect, aWin, cx, obj,
+                            class_name, ci_data,
                             name_struct, nameSpaceManager, nullptr, desc);
   }
 
@@ -2860,77 +2615,6 @@ nsWindowSH::GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
   return rv;
 }
 
-template<class Interface>
-static nsresult
-LocationSetterGuts(JSContext *cx, JSObject *obj, JS::MutableHandle<JS::Value> vp)
-{
-  // This function duplicates some of the logic in XPC_WN_HelperSetProperty
-  obj = js::CheckedUnwrap(obj, /* stopAtOuter = */ false);
-  if (!IS_WN_REFLECTOR(obj))
-      return NS_ERROR_XPC_BAD_CONVERT_JS;
-  XPCWrappedNative *wrapper = XPCWrappedNative::Get(obj);
-
-  // The error checks duplicate code in THROW_AND_RETURN_IF_BAD_WRAPPER
-  NS_ENSURE_TRUE(!wrapper || wrapper->IsValid(), NS_ERROR_XPC_HAS_BEEN_SHUTDOWN);
-
-  nsCOMPtr<Interface> xpcomObj = do_QueryWrappedNative(wrapper, obj);
-  NS_ENSURE_TRUE(xpcomObj, NS_ERROR_UNEXPECTED);
-
-  nsCOMPtr<nsIDOMLocation> location;
-  nsresult rv = xpcomObj->GetLocation(getter_AddRefs(location));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // Grab the value we're being set to before we stomp on |vp|
-  JS::Rooted<JSString*> val(cx, JS::ToString(cx, vp));
-  NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
-
-  // Make sure |val| stays alive below
-  JS::Anchor<JSString *> anchor(val);
-
-  // We have to wrap location into vp before null-checking location, to
-  // avoid assigning the wrong thing into the slot.
-  rv = WrapNative(cx, location, &NS_GET_IID(nsIDOMLocation), true, vp);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  if (!location) {
-    // Make this a no-op
-    return NS_OK;
-  }
-
-  nsAutoJSString str;
-  NS_ENSURE_TRUE(str.init(cx, val), NS_ERROR_UNEXPECTED);
-
-  return location->SetHref(str);
-}
-
-template<class Interface>
-static bool
-LocationSetter(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<jsid> id, bool strict,
-               JS::MutableHandle<JS::Value> vp)
-{
-  nsresult rv = LocationSetterGuts<Interface>(cx, obj, vp);
-  if (NS_FAILED(rv)) {
-    xpc::Throw(cx, rv);
-    return false;
-  }
-
-  return true;
-}
-
-static bool
-LocationSetterUnwrapper(JSContext *cx, JS::Handle<JSObject*> obj_, JS::Handle<jsid> id,
-                        bool strict, JS::MutableHandle<JS::Value> vp)
-{
-  JS::Rooted<JSObject*> obj(cx, obj_);
-
-  JSObject *wrapped = XPCWrapper::UnsafeUnwrapSecurityWrapper(obj);
-  if (wrapped) {
-    obj = wrapped;
-  }
-
-  return LocationSetter<nsIDOMWindow>(cx, obj, id, strict, vp);
-}
-
 struct InterfaceShimEntry {
   const char *geckoName;
   const char *domName;
@@ -3019,200 +2703,6 @@ LookupComponentsShim(JSContext *cx, JS::Handle<JSObject*> global,
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                       JSObject *obj_, jsid id_, JSObject **objp,
-                       bool *_retval)
-{
-  JS::Rooted<JSObject*> obj(cx, obj_);
-  JS::Rooted<jsid> id(cx, id_);
-
-  if (!JSID_IS_STRING(id)) {
-    return NS_OK;
-  }
-
-  MOZ_ASSERT(*_retval == true); // guaranteed by XPC_WN_Helper_NewResolve
-
-  nsGlobalWindow *win = nsGlobalWindow::FromWrapper(wrapper);
-  MOZ_ASSERT(win->IsInnerWindow());
-
-  // Don't resolve standard classes on XrayWrappers, only resolve them if we're
-  // resolving on the real global object.
-  bool isXray = xpc::WrapperFactory::IsXrayWrapper(obj);
-  if (!isXray) {
-    bool did_resolve = false;
-    if (!JS_ResolveStandardClass(cx, obj, id, &did_resolve)) {
-      // Return NS_OK to avoid stomping over the exception that was passed
-      // down from the ResolveStandardClass call.
-      *_retval = false;
-      return NS_OK;
-    }
-
-    if (did_resolve) {
-      *objp = obj;
-      return NS_OK;
-    }
-  }
-
-  // WebIDL quickstubs handle location for us, but Xrays don't see those.  So if
-  // we're an Xray, we have to resolve stuff here to make "window.location =
-  // someString" work.
-  if (sLocation_id == id && isXray) {
-    nsCOMPtr<nsIDOMLocation> location;
-    nsresult rv = win->GetLocation(getter_AddRefs(location));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    JS::Rooted<JS::Value> v(cx);
-    rv = WrapNative(cx, location, &NS_GET_IID(nsIDOMLocation), true, &v);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    bool ok = JS_DefinePropertyById(cx, obj, id, v,
-                                    JSPROP_PERMANENT | JSPROP_ENUMERATE,
-                                    JS_PropertyStub, LocationSetterUnwrapper);
-
-    if (!ok) {
-      return NS_ERROR_FAILURE;
-    }
-
-    *objp = obj;
-
-    return NS_OK;
-  }
-
-  // WebIDL quickstubs handle "top" for us, but Xrays don't see those.  So if
-  // we're an Xray and we want "top" to be JSPROP_PERMANENT, we need to resolve
-  // it here.
-  if (sTop_id == id && isXray) {
-    nsCOMPtr<nsIDOMWindow> top;
-    nsresult rv = win->GetScriptableTop(getter_AddRefs(top));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    JS::Rooted<JS::Value> v(cx);
-    js::AssertSameCompartment(cx, obj);
-    rv = WrapNative(cx, top, &NS_GET_IID(nsIDOMWindow), true, &v);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    // Hold on to the top window object as a global property so we
-    // don't need to worry about losing expando properties etc.
-    if (!JS_DefinePropertyById(cx, obj, id, v,
-                               JSPROP_READONLY | JSPROP_PERMANENT |
-                               JSPROP_ENUMERATE,
-                               JS_PropertyStub, JS_StrictPropertyStub)) {
-      return NS_ERROR_FAILURE;
-    }
-    *objp = obj;
-
-    return NS_OK;
-  }
-
-  if (isXray) {
-    // We promise to resolve on the underlying object first.  That will create
-    // the actual interface object if needed and store it in a data structure
-    // hanging off the global.  Then our second call will wrap up in an Xray as
-    // needed.  We do things this way because we use the existence of the
-    // object in that data structure as a flag that indicates that its name
-    // (and any relevant named constructor names) has been resolved before;
-    // this allows us to avoid re-resolving in the Xray case if the property is
-    // deleted by page script.
-    JS::Rooted<JSObject*> global(cx,
-      js::UncheckedUnwrap(obj, /* stopAtOuter = */ false));
-    JSAutoCompartment ac(cx, global);
-    JS::Rooted<JSPropertyDescriptor> desc(cx);
-    if (!win->DoNewResolve(cx, global, id, &desc)) {
-      return NS_ERROR_FAILURE;
-    }
-    // If we have an object here, that means we resolved the property.
-    // But if the value is undefined, that means that GlobalResolve
-    // also already defined it, so we don't have to.
-    if (desc.object() && !desc.value().isUndefined() &&
-        !JS_DefinePropertyById(cx, global, id, desc.value(),
-                               desc.attributes(),
-                               desc.getter(), desc.setter())) {
-      return NS_ERROR_FAILURE;
-    }
-  }
-
-  JS::Rooted<JSPropertyDescriptor> desc(cx);
-  if (!win->DoNewResolve(cx, obj, id, &desc)) {
-    return NS_ERROR_FAILURE;
-  }
-  if (desc.object()) {
-    // If we have an object here, that means we resolved the property.
-    // But if the value is undefined, that means that GlobalResolve
-    // also already defined it, so we don't have to.  Note that in the
-    // Xray case we should never see undefined.
-    MOZ_ASSERT_IF(isXray, !desc.value().isUndefined());
-    if (!desc.value().isUndefined() &&
-        !JS_DefinePropertyById(cx, obj, id, desc.value(),
-                               desc.attributes(),
-                               desc.getter(), desc.setter())) {
-      return NS_ERROR_FAILURE;
-    }
-
-    *objp = obj;
-    return NS_OK;
-  }
-
-  if (sDocument_id == id) {
-    nsCOMPtr<nsIDocument> document = win->GetDoc();
-    JS::Rooted<JS::Value> v(cx);
-    nsresult rv = WrapNative(cx, document, document,
-                             &NS_GET_IID(nsIDOMDocument), &v, false);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    // nsIDocument::WrapObject will handle defining the property.
-    *objp = obj;
-
-    // NB: We need to do this for any Xray wrapper.
-    if (xpc::WrapperFactory::IsXrayWrapper(obj)) {
-      *_retval = JS_WrapValue(cx, &v) &&
-                 JS_DefineProperty(cx, obj, "document", v,
-                                   JSPROP_READONLY | JSPROP_ENUMERATE,
-                                   JS_PropertyStub, JS_StrictPropertyStub);
-      if (!*_retval) {
-        return NS_ERROR_UNEXPECTED;
-      }
-    }
-
-    return NS_OK;
-  }
-
-  return nsDOMGenericSH::NewResolve(wrapper, cx, obj, id, objp, _retval);
-}
-
-NS_IMETHODIMP
-nsWindowSH::OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                        JSObject * obj, JSObject * *_retval)
-{
-  nsGlobalWindow *origWin = nsGlobalWindow::FromWrapper(wrapper);
-  nsGlobalWindow *win = origWin->GetOuterWindowInternal();
-
-  if (!win) {
-    // If we no longer have an outer window. No code should ever be
-    // running on a window w/o an outer, which means this hook should
-    // never be called when we have no outer. But just in case, return
-    // null to prevent leaking an inner window to code in a different
-    // window.
-    *_retval = nullptr;
-    return NS_ERROR_UNEXPECTED;
-  }
-
-  JS::Rooted<JSObject*> winObj(cx, win->FastGetGlobalJSObject());
-  MOZ_ASSERT(winObj);
-
-  // Note that while |wrapper| is same-compartment with cx, the outer window
-  // might not be. If we're running script in an inactive scope and evalute
-  // |this|, the outer window is actually a cross-compartment wrapper. So we
-  // need to wrap here.
-  if (!JS_WrapObject(cx, &winObj)) {
-    *_retval = nullptr;
-    return NS_ERROR_UNEXPECTED;
-  }
-
-  *_retval = winObj;
-  return NS_OK;
-}
-
 // EventTarget helper
 
 NS_IMETHODIMP
diff --git a/dom/base/nsDOMClassInfo.h b/dom/base/nsDOMClassInfo.h
index 77e353f7317..bada4260535 100644
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@@ -68,10 +68,11 @@ struct nsExternalDOMClassInfoData : public nsDOMClassInfoData
 #define MARK_EXTERNAL(_ptr) (nsIClassInfo*)(uintptr_t(_ptr) | 0x1)
 #define IS_EXTERNAL(_ptr) (uintptr_t(_ptr) & 0x1)
 
+class nsWindowSH;
 
 class nsDOMClassInfo : public nsXPCClassInfo
 {
-  friend class nsHTMLDocumentSH;
+  friend class nsWindowSH;
 
 protected:
   virtual ~nsDOMClassInfo();
@@ -156,10 +157,7 @@ protected:
   static bool sIsInitialized;
 
 public:
-  static jsid sLocation_id;
   static jsid sConstructor_id;
-  static jsid sTop_id;
-  static jsid sDocument_id;
   static jsid sWrappedJSObject_id;
 };
 
@@ -230,46 +228,20 @@ public:
   }
 };
 
-// Window scriptable helper
-
-class nsWindowSH : public nsDOMGenericSH
+// A place to hang some static methods that we should really consider
+// moving to be nsGlobalWindow member methods.  See bug 1062418.
+class nsWindowSH
 {
 protected:
-  explicit nsWindowSH(nsDOMClassInfoData *aData) : nsDOMGenericSH(aData)
-  {
-  }
-
-  virtual ~nsWindowSH()
-  {
-  }
-
   static nsresult GlobalResolve(nsGlobalWindow *aWin, JSContext *cx,
                                 JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
                                 JS::MutableHandle<JSPropertyDescriptor> desc);
 
   friend class nsGlobalWindow;
 public:
-  NS_IMETHOD PreCreate(nsISupports *nativeObj, JSContext *cx,
-                       JSObject *globalObj, JSObject **parentObj) MOZ_OVERRIDE;
-  NS_IMETHOD PostCreatePrototype(JSContext * cx, JSObject * proto) MOZ_OVERRIDE;
-  NS_IMETHOD PostCreate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj) MOZ_OVERRIDE;
-  NS_IMETHOD Enumerate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                       JSObject *obj, bool *_retval) MOZ_OVERRIDE;
-  NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
-                        JSObject *obj, jsid id, JSObject **objp,
-                        bool *_retval) MOZ_OVERRIDE;
-  NS_IMETHOD OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx,
-                         JSObject * obj, JSObject * *_retval) MOZ_OVERRIDE;
-
   static bool NameStructEnabled(JSContext* aCx, nsGlobalWindow *aWin,
                                 const nsAString& aName,
                                 const nsGlobalNameStruct& aNameStruct);
-
-  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
-  {
-    return new nsWindowSH(aData);
-  }
 };
 
 
diff --git a/dom/base/nsDOMClassInfoClasses.h b/dom/base/nsDOMClassInfoClasses.h
index c6de41eca5f..41c9fca5f71 100644
--- a/dom/base/nsDOMClassInfoClasses.h
+++ b/dom/base/nsDOMClassInfoClasses.h
@@ -4,7 +4,6 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 // IWYU pragma: private, include "nsDOMClassInfoID.h"
 
-DOMCI_CLASS(Window)
 DOMCI_CLASS(DOMPrototype)
 DOMCI_CLASS(DOMConstructor)
 
@@ -26,9 +25,6 @@ DOMCI_CLASS(TreeSelection)
 DOMCI_CLASS(TreeContentView)
 #endif
 
-// DOM Chrome Window class, almost identical to Window
-DOMCI_CLASS(ChromeWindow)
-
 #ifdef MOZ_XUL
 DOMCI_CLASS(XULTemplateBuilder)
 DOMCI_CLASS(XULTreeBuilder)
@@ -50,9 +46,6 @@ DOMCI_CLASS(XPathNSResolver)
 DOMCI_CLASS(Blob)
 DOMCI_CLASS(File)
 
-// DOM modal content window class, almost identical to Window
-DOMCI_CLASS(ModalContentWindow)
-
 DOMCI_CLASS(MozSmsMessage)
 DOMCI_CLASS(MozMmsMessage)
 DOMCI_CLASS(MozMobileMessageThread)
diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 311d2fb57a8..9eeab72b619 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -3612,6 +3612,23 @@ nsDOMWindowUtils::RunBeforeNextEvent(nsIRunnable *runnable)
   return appShell->RunBeforeNextEvent(runnable);
 }
 
+NS_IMETHODIMP
+nsDOMWindowUtils::RequestCompositorProperty(const nsAString& property,
+                                            float* aResult)
+{
+  MOZ_RELEASE_ASSERT(nsContentUtils::IsCallerChrome());
+
+  if (nsIWidget* widget = GetWidget()) {
+    mozilla::layers::LayerManager* manager = widget->GetLayerManager();
+    if (manager) {
+      *aResult = manager->RequestProperty(property);
+      return NS_OK;
+    }
+  }
+
+  return NS_ERROR_NOT_AVAILABLE;
+}
+
 NS_IMETHODIMP
 nsDOMWindowUtils::GetOMTAStyle(nsIDOMElement* aElement,
                                const nsAString& aProperty,
diff --git a/dom/base/nsFocusManager.cpp b/dom/base/nsFocusManager.cpp
index 7b0765df17a..3e25711af14 100644
--- a/dom/base/nsFocusManager.cpp
+++ b/dom/base/nsFocusManager.cpp
@@ -35,6 +35,7 @@
 #include "nsIObjectFrame.h"
 #include "nsBindingManager.h"
 #include "nsStyleCoord.h"
+#include "SelectionCarets.h"
 
 #include "mozilla/ContentEvents.h"
 #include "mozilla/dom/Element.h"
@@ -1545,6 +1546,11 @@ nsFocusManager::Blur(nsPIDOMWindow* aWindowToClear,
     return true;
   }
 
+  nsRefPtr<SelectionCarets> selectionCarets = presShell->GetSelectionCarets();
+  if (selectionCarets) {
+    selectionCarets->SetVisibility(false);
+  }
+
   bool clearFirstBlurEvent = false;
   if (!mFirstBlurEvent) {
     mFirstBlurEvent = content;
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 5d29547473c..e713f9d5286 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -1125,10 +1125,7 @@ nsGlobalWindow::nsGlobalWindow(nsGlobalWindow *aOuterWindow)
   // Initialize the PRCList (this).
   PR_INIT_CLIST(this);
 
-  if (Preferences::GetBool("dom.window_experimental_bindings") ||
-      !aOuterWindow) {
-    SetIsDOMBinding();
-  }
+  SetIsDOMBinding();
 
   if (aOuterWindow) {
     // |this| is an inner window, add this inner window to the outer
@@ -1640,20 +1637,12 @@ nsGlobalWindow::FreeInnerObjects()
 // nsGlobalWindow::nsISupports
 //*****************************************************************************
 
-DOMCI_DATA(Window, nsGlobalWindow)
-
 // QueryInterface implementation for nsGlobalWindow
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsGlobalWindow)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   // Make sure this matches the cast in nsGlobalWindow::FromWrapper()
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMEventTarget)
   NS_INTERFACE_MAP_ENTRY(nsIDOMWindow)
-#ifdef MOZ_B2G
-  NS_INTERFACE_MAP_ENTRY(nsIDOMWindowB2G)
-#endif // MOZ_B2G
-#ifdef MOZ_WEBSPEECH
-  NS_INTERFACE_MAP_ENTRY(nsISpeechSynthesisGetter)
-#endif // MOZ_B2G
   NS_INTERFACE_MAP_ENTRY(nsIDOMJSWindow)
   if (aIID.Equals(NS_GET_IID(nsIDOMWindowInternal))) {
     foundInterface = static_cast<nsIDOMWindowInternal*>(this);
@@ -1673,10 +1662,6 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsGlobalWindow)
   NS_INTERFACE_MAP_ENTRY(nsPIDOMWindow)
   NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
   NS_INTERFACE_MAP_ENTRY(nsIInterfaceRequestor)
-  NS_INTERFACE_MAP_ENTRY(nsIDOMWindowPerformance)
-  NS_INTERFACE_MAP_ENTRY(nsITouchEventReceiver)
-  NS_INTERFACE_MAP_ENTRY(nsIInlineEventHandlers)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(Window)
 NS_INTERFACE_MAP_END
 
 
@@ -2285,22 +2270,10 @@ CreateNativeGlobalForInner(JSContext* aCx,
   uint32_t flags = needComponents ? 0 : nsIXPConnect::OMIT_COMPONENTS_OBJECT;
   flags |= nsIXPConnect::DONT_FIRE_ONNEWGLOBALHOOK;
 
-  if (aNewInner->IsDOMBinding()) {
-    aGlobal.set(WindowBinding::Wrap(aCx, aNewInner, aNewInner, options,
-                                    nsJSPrincipals::get(aPrincipal), false));
-    if (!aGlobal || !xpc::InitGlobalObject(aCx, aGlobal, flags)) {
-      return NS_ERROR_FAILURE;
-    }
-  } else {
-    nsIXPConnect* xpc = nsContentUtils::XPConnect();
-    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-    nsresult rv = xpc->InitClassesWithNewWrappedGlobal(
-      aCx, ToSupports(aNewInner),
-      aPrincipal, flags, options, getter_AddRefs(holder));
-    NS_ENSURE_SUCCESS(rv, rv);
-  
-    aGlobal.set(holder->GetJSObject());
-    MOZ_ASSERT(aGlobal);
+  aGlobal.set(WindowBinding::Wrap(aCx, aNewInner, aNewInner, options,
+                                  nsJSPrincipals::get(aPrincipal), false));
+  if (!aGlobal || !xpc::InitGlobalObject(aCx, aGlobal, flags)) {
+    return NS_ERROR_FAILURE;
   }
 
   MOZ_ASSERT(aNewInner->GetWrapperPreserveColor() == aGlobal);
@@ -2403,8 +2376,8 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
   // having to *always* reach into the inner window to find the
   // document.
   mDoc = aDocument;
-  if (IsInnerWindow() && IsDOMBinding()) {
-    WindowBinding::ClearCachedDocumentValue(cx, this);
+  if (IsInnerWindow()) {
+    ClearDocumentDependentSlots(cx);
   }
 
   // Take this opportunity to clear mSuspendedDoc. Our old inner window is now
@@ -2611,21 +2584,10 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
     // If we created a new inner window above, we need to do the last little bit
     // of initialization now that the dust has settled.
     if (createdInnerWindow) {
-      if (newInnerWindow->IsDOMBinding()) {
-        JS::Rooted<JSObject*> global(cx, newInnerGlobal);
-        JS::Rooted<JSObject*> proto(cx);
-        JS_GetPrototype(cx, global, &proto);
-        WindowNamedPropertiesHandler::Install(cx, proto);
-      } else {
-        nsIXPConnect *xpc = nsContentUtils::XPConnect();
-        nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
-        nsresult rv = xpc->GetWrappedNativeOfJSObject(cx, newInnerGlobal,
-                                                      getter_AddRefs(wrapper));
-        NS_ENSURE_SUCCESS(rv, rv);
-        NS_ABORT_IF_FALSE(wrapper, "bad wrapper");
-        rv = wrapper->FinishInitForWrappedGlobal();
-        NS_ENSURE_SUCCESS(rv, rv);
-      }
+      JS::Rooted<JSObject*> global(cx, newInnerGlobal);
+      JS::Rooted<JSObject*> proto(cx);
+      JS_GetPrototype(cx, global, &proto);
+      WindowNamedPropertiesHandler::Install(cx, proto);
     }
 
     if (!aState) {
@@ -2682,17 +2644,7 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
         newInnerWindow->mLocalStorage = nullptr;
         newInnerWindow->mSessionStorage = nullptr;
 
-        if (newInnerWindow->IsDOMBinding()) {
-          WindowBinding::ClearCachedDocumentValue(cx, newInnerWindow);
-        } else {
-          // We're reusing the inner window for a new document. In this
-          // case we don't clear the inner window's scope, but we must
-          // make sure the cached document property gets updated.
-
-          JS::Rooted<JSObject*> obj(cx,
-                                    currentInner->GetWrapperPreserveColor());
-          ::JS_DeleteProperty(cx, obj, "document");
-        }
+        newInnerWindow->ClearDocumentDependentSlots(cx);
       }
     } else {
       newInnerWindow->InnerSetNewDocument(cx, aDocument);
@@ -2834,9 +2786,7 @@ nsGlobalWindow::InnerSetNewDocument(JSContext* aCx, nsIDocument* aDocument)
 #endif
 
   mDoc = aDocument;
-  if (IsDOMBinding()) {
-    WindowBinding::ClearCachedDocumentValue(aCx, this);
-  }
+  ClearDocumentDependentSlots(aCx);
   mFocusedNode = nullptr;
   mLocalStorage = nullptr;
   mSessionStorage = nullptr;
@@ -3644,25 +3594,11 @@ nsGlobalWindow::GetHistory(nsISupports** aHistory)
 }
 
 nsPerformance*
-nsGlobalWindow::GetPerformance(ErrorResult& aError)
+nsGlobalWindow::GetPerformance()
 {
-  FORWARD_TO_INNER_OR_THROW(GetPerformance, (aError), aError, nullptr);
+  FORWARD_TO_INNER(GetPerformance, (), nullptr);
 
-  nsPerformance* p = nsPIDOMWindow::GetPerformance();
-  if (!p) {
-    aError.Throw(NS_ERROR_FAILURE);
-  }
-  return p;
-}
-
-NS_IMETHODIMP
-nsGlobalWindow::GetPerformance(nsISupports** aPerformance)
-{
-  ErrorResult rv;
-  nsCOMPtr<nsISupports> performance = GetPerformance(rv);
-  performance.forget(aPerformance);
-
-  return rv.ErrorCode();
+  return nsPIDOMWindow::GetPerformance();
 }
 
 nsPerformance*
@@ -3830,19 +3766,6 @@ nsGlobalWindow::GetSpeechSynthesis(ErrorResult& aError)
 
   return mSpeechSynthesis;
 }
-
-NS_IMETHODIMP
-nsGlobalWindow::GetSpeechSynthesis(nsISupports** aSpeechSynthesis)
-{
-  ErrorResult rv;
-  nsCOMPtr<nsISupports> speechSynthesis;
-  if (Preferences::GetBool("media.webspeech.synth.enabled")) {
-    speechSynthesis = GetSpeechSynthesis(rv);
-  }
-  speechSynthesis.forget(aSpeechSynthesis);
-
-  return rv.ErrorCode();
-}
 #endif
 
 already_AddRefed<nsIDOMWindow>
@@ -13409,12 +13332,9 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsGlobalChromeWindow,
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mGroupMessageManagers)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
-DOMCI_DATA(ChromeWindow, nsGlobalChromeWindow)
-
 // QueryInterface implementation for nsGlobalChromeWindow
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(nsGlobalChromeWindow)
   NS_INTERFACE_MAP_ENTRY(nsIDOMChromeWindow)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(ChromeWindow)
 NS_INTERFACE_MAP_END_INHERITING(nsGlobalWindow)
 
 NS_IMPL_ADDREF_INHERITED(nsGlobalChromeWindow, nsGlobalWindow)
@@ -13811,11 +13731,8 @@ nsGlobalWindow::GetGroupMessageManager(const nsAString& aGroup,
 // nsGlobalModalWindow implementation
 
 // QueryInterface implementation for nsGlobalModalWindow
-DOMCI_DATA(ModalContentWindow, nsGlobalModalWindow)
-
 NS_INTERFACE_MAP_BEGIN(nsGlobalModalWindow)
   NS_INTERFACE_MAP_ENTRY(nsIDOMModalContentWindow)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(ModalContentWindow)
 NS_INTERFACE_MAP_END_INHERITING(nsGlobalWindow)
 
 NS_IMPL_ADDREF_INHERITED(nsGlobalModalWindow, nsGlobalWindow)
@@ -13928,7 +13845,6 @@ nsGlobalModalWindow::SetReturnValue(nsIVariant *aRetVal)
 bool
 nsGlobalWindow::IsModalContentWindow(JSContext* aCx, JSObject* aGlobal)
 {
-  // For now, have to deal with XPConnect objects here.
   return xpc::WindowOrNull(aGlobal)->IsModalContentWindow();
 }
 
@@ -14027,15 +13943,13 @@ nsGlobalWindow::GetSidebar(OwningExternalOrWindowProxy& aResult,
 #endif
 }
 
-/* static */
-bool
-nsGlobalWindow::WindowOnWebIDL(JSContext* aCx, JSObject* aObj)
+void
+nsGlobalWindow::ClearDocumentDependentSlots(JSContext* aCx)
 {
-  DebugOnly<nsGlobalWindow*> win;
-  MOZ_ASSERT_IF(IsDOMObject(aObj),
-                NS_SUCCEEDED(UNWRAP_OBJECT(Window, aObj, win)));
-
-  return IsDOMObject(aObj);
+  MOZ_ASSERT(IsInnerWindow());
+  MOZ_ASSERT(IsDOMBinding());
+  WindowBinding::ClearCachedDocumentValue(aCx, this);
+  WindowBinding::ClearCachedPerformanceValue(aCx, this);
 }
 
 #ifdef MOZ_B2G
@@ -14108,94 +14022,6 @@ nsGlobalWindow::DisableNetworkEvent(uint32_t aType)
 }
 #endif // MOZ_B2G
 
-#define EVENT(name_, id_, type_, struct_)                                    \
-  NS_IMETHODIMP nsGlobalWindow::GetOn##name_(JSContext *cx,                  \
-                                             JS::MutableHandle<JS::Value> vp) { \
-    EventHandlerNonNull* h = GetOn##name_();                                 \
-    vp.setObjectOrNull(h ? h->Callable().get() : nullptr);                   \
-    return NS_OK;                                                            \
-  }                                                                          \
-  NS_IMETHODIMP nsGlobalWindow::SetOn##name_(JSContext *cx,                  \
-                                             JS::Handle<JS::Value> v) {      \
-    nsRefPtr<EventHandlerNonNull> handler;                                   \
-    JS::Rooted<JSObject*> callable(cx);                                      \
-    if (v.isObject() &&                                                      \
-        JS_ObjectIsCallable(cx, callable = &v.toObject())) {                 \
-      handler = new EventHandlerNonNull(callable, GetIncumbentGlobal());     \
-    }                                                                        \
-    SetOn##name_(handler);                                                   \
-    return NS_OK;                                                            \
-  }
-#define ERROR_EVENT(name_, id_, type_, struct_)                              \
-  NS_IMETHODIMP nsGlobalWindow::GetOn##name_(JSContext *cx,                  \
-                                             JS::MutableHandle<JS::Value> vp) { \
-    EventListenerManager *elm = GetExistingListenerManager();                \
-    if (elm) {                                                               \
-      OnErrorEventHandlerNonNull* h = elm->GetOnErrorEventHandler();         \
-      if (h) {                                                               \
-        vp.setObject(*h->Callable());                                        \
-        return NS_OK;                                                        \
-      }                                                                      \
-    }                                                                        \
-    vp.setNull();                                                            \
-    return NS_OK;                                                            \
-  }                                                                          \
-  NS_IMETHODIMP nsGlobalWindow::SetOn##name_(JSContext *cx,                  \
-                                             JS::Handle<JS::Value> v) {      \
-    EventListenerManager *elm = GetOrCreateListenerManager();                \
-    if (!elm) {                                                              \
-      return NS_ERROR_OUT_OF_MEMORY;                                         \
-    }                                                                        \
-                                                                             \
-    nsRefPtr<OnErrorEventHandlerNonNull> handler;                            \
-    JS::Rooted<JSObject*> callable(cx);                                      \
-    if (v.isObject() &&                                                      \
-        JS_ObjectIsCallable(cx, callable = &v.toObject())) {                 \
-      handler = new OnErrorEventHandlerNonNull(callable, GetIncumbentGlobal()); \
-    }                                                                        \
-    elm->SetEventHandler(handler);                                           \
-    return NS_OK;                                                            \
-  }
-#define BEFOREUNLOAD_EVENT(name_, id_, type_, struct_)                       \
-  NS_IMETHODIMP nsGlobalWindow::GetOn##name_(JSContext *cx,                  \
-                                             JS::MutableHandle<JS::Value> vp) { \
-    EventListenerManager *elm = GetExistingListenerManager();                \
-    if (elm) {                                                               \
-      OnBeforeUnloadEventHandlerNonNull* h =                                 \
-        elm->GetOnBeforeUnloadEventHandler();                                \
-      if (h) {                                                               \
-        vp.setObject(*h->Callable());                                        \
-        return NS_OK;                                                        \
-      }                                                                      \
-    }                                                                        \
-    vp.setNull();                                                            \
-    return NS_OK;                                                            \
-  }                                                                          \
-  NS_IMETHODIMP nsGlobalWindow::SetOn##name_(JSContext *cx,                  \
-                                             JS::Handle<JS::Value> v) {      \
-    EventListenerManager *elm = GetOrCreateListenerManager();                \
-    if (!elm) {                                                              \
-      return NS_ERROR_OUT_OF_MEMORY;                                         \
-    }                                                                        \
-                                                                             \
-    nsRefPtr<OnBeforeUnloadEventHandlerNonNull> handler;                     \
-    JS::Rooted<JSObject*> callable(cx);                                      \
-    if (v.isObject() &&                                                      \
-        JS_ObjectIsCallable(cx, callable = &v.toObject())) {                 \
-      handler = new OnBeforeUnloadEventHandlerNonNull(callable, GetIncumbentGlobal()); \
-    }                                                                        \
-    elm->SetEventHandler(handler);                                           \
-    return NS_OK;                                                            \
-  }
-#define WINDOW_ONLY_EVENT EVENT
-#define TOUCH_EVENT EVENT
-#include "mozilla/EventNameList.h"
-#undef TOUCH_EVENT
-#undef WINDOW_ONLY_EVENT
-#undef BEFOREUNLOAD_EVENT
-#undef ERROR_EVENT
-#undef EVENT
-
 #ifdef _WINDOWS_
 #error "Never include windows.h in this file!"
 #endif
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index 317cc0040bc..fa7cb79e65c 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -43,24 +43,14 @@
 #include "nsFrameMessageManager.h"
 #include "mozilla/LinkedList.h"
 #include "mozilla/TimeStamp.h"
-#include "nsIInlineEventHandlers.h"
 #include "nsWrapperCacheInlines.h"
 #include "nsIIdleObserver.h"
 #include "nsIDocument.h"
-#include "nsIDOMTouchEvent.h"
 #include "mozilla/dom/EventTarget.h"
 #include "mozilla/dom/WindowBinding.h"
 #include "Units.h"
 #include "nsComponentManagerUtils.h"
 
-#ifdef MOZ_B2G
-#include "nsIDOMWindowB2G.h"
-#endif // MOZ_B2G
-
-#ifdef MOZ_WEBSPEECH
-#include "nsISpeechSynthesisGetter.h"
-#endif // MOZ_WEBSPEECH
-
 #define DEFAULT_HOME_PAGE "www.mozilla.org"
 #define PREF_BROWSER_STARTUP_HOMEPAGE "browser.startup.homepage"
 
@@ -329,16 +319,7 @@ class nsGlobalWindow : public mozilla::dom::EventTarget,
                        public nsIDOMJSWindow,
                        public nsSupportsWeakReference,
                        public nsIInterfaceRequestor,
-                       public PRCListStr,
-                       public nsIDOMWindowPerformance,
-                       public nsITouchEventReceiver,
-                       public nsIInlineEventHandlers
-#ifdef MOZ_B2G
-                     , public nsIDOMWindowB2G
-#endif // MOZ_B2G
-#ifdef MOZ_WEBSPEECH
-                     , public nsISpeechSynthesisGetter
-#endif // MOZ_WEBSPEECH
+                       public PRCListStr
 {
 public:
   typedef mozilla::TimeStamp TimeStamp;
@@ -387,19 +368,6 @@ public:
   // nsIDOMWindow
   NS_DECL_NSIDOMWINDOW
 
-#ifdef MOZ_B2G
-  // nsIDOMWindowB2G
-  NS_DECL_NSIDOMWINDOWB2G
-#endif // MOZ_B2G
-
-#ifdef MOZ_WEBSPEECH
-  // nsISpeechSynthesisGetter
-  NS_DECL_NSISPEECHSYNTHESISGETTER
-#endif // MOZ_WEBSPEECH
-
-  // nsIDOMWindowPerformance
-  NS_DECL_NSIDOMWINDOWPERFORMANCE
-
   // nsIDOMJSWindow
   NS_DECL_NSIDOMJSWINDOW
 
@@ -427,12 +395,6 @@ public:
     return GetOuterFromCurrentInner(this);
   }
 
-  // nsITouchEventReceiver
-  NS_DECL_NSITOUCHEVENTRECEIVER
-
-  // nsIInlineEventHandlers
-  NS_DECL_NSIINLINEEVENTHANDLERS
-
   // nsPIDOMWindow
   virtual nsPIDOMWindow* GetPrivateRoot();
 
@@ -823,8 +785,6 @@ public:
     return nullptr;
   }
 
-  static bool WindowOnWebIDL(JSContext* /* unused */, JSObject* aObj);
-
   nsIDOMWindow* GetWindow(mozilla::ErrorResult& aError);
   nsIDOMWindow* GetSelf(mozilla::ErrorResult& aError);
   nsIDocument* GetDocument()
@@ -973,7 +933,7 @@ public:
   int32_t RequestAnimationFrame(mozilla::dom::FrameRequestCallback& aCallback,
                                 mozilla::ErrorResult& aError);
   void CancelAnimationFrame(int32_t aHandle, mozilla::ErrorResult& aError);
-  nsPerformance* GetPerformance(mozilla::ErrorResult& aError);
+  nsPerformance* GetPerformance();
 #ifdef MOZ_WEBSPEECH
   mozilla::dom::SpeechSynthesis*
     GetSpeechSynthesis(mozilla::ErrorResult& aError);
@@ -1399,6 +1359,8 @@ protected:
 
   inline int32_t DOMMinTimeoutValue() const;
 
+  // Clear the document-dependent slots on our JS wrapper.  Inner windows only.
+  void ClearDocumentDependentSlots(JSContext* aCx);
 
   // Inner windows only.
   already_AddRefed<mozilla::dom::StorageEvent>
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 7a72c4eabc3..8b047573435 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -18,6 +18,7 @@
 #include "nsCOMPtr.h"
 #include "nsISupportsPrimitives.h"
 #include "nsReadableUtils.h"
+#include "nsDOMJSUtils.h"
 #include "nsJSUtils.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
@@ -96,10 +97,6 @@ using namespace mozilla::dom;
 
 const size_t gStackSize = 8192;
 
-#ifdef PR_LOGGING
-static PRLogModuleInfo* gJSDiagnostics;
-#endif
-
 // Thank you Microsoft!
 #ifdef CompareString
 #undef CompareString
@@ -351,212 +348,102 @@ NS_HandleScriptError(nsIScriptGlobalObject *aScriptGlobal,
   return called;
 }
 
-namespace mozilla {
-namespace dom {
-
-AsyncErrorReporter::AsyncErrorReporter(JSRuntime* aRuntime,
-                                       JSErrorReport* aErrorReport,
-                                       const char* aFallbackMessage,
-                                       bool aIsChromeError,
-                                       nsPIDOMWindow* aWindow)
-  : mSourceLine(static_cast<const char16_t*>(aErrorReport->uclinebuf))
-  , mLineNumber(aErrorReport->lineno)
-  , mColumn(aErrorReport->column)
-  , mFlags(aErrorReport->flags)
-{
-  if (!aErrorReport->filename) {
-    mFileName.SetIsVoid(true);
-  } else {
-    mFileName.AssignWithConversion(aErrorReport->filename);
-  }
-
-  const char16_t* m = static_cast<const char16_t*>(aErrorReport->ucmessage);
-  if (m) {
-    JSFlatString* name = js::GetErrorTypeName(aRuntime, aErrorReport->exnType);
-    if (name) {
-      AssignJSFlatString(mErrorMsg, name);
-      mErrorMsg.AppendLiteral(": ");
-    }
-    mErrorMsg.Append(m);
-  }
-
-  if (mErrorMsg.IsEmpty() && aFallbackMessage) {
-    mErrorMsg.AssignWithConversion(aFallbackMessage);
-  }
-
-  mCategory = aIsChromeError ? NS_LITERAL_CSTRING("chrome javascript") :
-                               NS_LITERAL_CSTRING("content javascript");
-
-  mInnerWindowID = 0;
-  if (aWindow) {
-    MOZ_ASSERT(aWindow->IsInnerWindow());
-    mInnerWindowID = aWindow->WindowID();
-  }
-}
-
-void
-AsyncErrorReporter::ReportError()
-{
-  nsCOMPtr<nsIScriptError> errorObject =
-    do_CreateInstance("@mozilla.org/scripterror;1");
-  if (!errorObject) {
-    return;
-  }
-
-  nsresult rv = errorObject->InitWithWindowID(mErrorMsg, mFileName,
-                                              mSourceLine, mLineNumber,
-                                              mColumn, mFlags, mCategory,
-                                              mInnerWindowID);
-  if (NS_FAILED(rv)) {
-    return;
-  }
-
-  nsCOMPtr<nsIConsoleService> consoleService =
-    do_GetService(NS_CONSOLESERVICE_CONTRACTID);
-  if (!consoleService) {
-    return;
-  }
-
-  consoleService->LogMessage(errorObject);
-  return;
-}
-
-} // namespace dom
-} // namespace mozilla
-
-class ScriptErrorEvent : public AsyncErrorReporter
+class ScriptErrorEvent : public nsRunnable
 {
 public:
   ScriptErrorEvent(JSRuntime* aRuntime,
-                   JSErrorReport* aErrorReport,
-                   const char* aFallbackMessage,
+                   xpc::ErrorReport* aReport,
                    nsIPrincipal* aScriptOriginPrincipal,
-                   nsIPrincipal* aGlobalPrincipal,
-                   nsPIDOMWindow* aWindow,
                    JS::Handle<JS::Value> aError,
                    bool aDispatchEvent)
-    // Pass an empty category, then compute ours
-    : AsyncErrorReporter(aRuntime, aErrorReport, aFallbackMessage,
-                         nsContentUtils::IsSystemPrincipal(aGlobalPrincipal),
-                         aWindow)
+    : mReport(aReport)
     , mOriginPrincipal(aScriptOriginPrincipal)
     , mDispatchEvent(aDispatchEvent)
     , mError(aRuntime, aError)
-    , mWindow(aWindow)
-  {
-    MOZ_ASSERT_IF(mWindow, mWindow->IsInnerWindow());
-  }
+  {}
 
   NS_IMETHOD Run()
   {
     nsEventStatus status = nsEventStatus_eIgnore;
+    nsPIDOMWindow* win = mReport->mWindow;
+    MOZ_ASSERT(win);
     // First, notify the DOM that we have a script error, but only if
-    // our window is still the current inner, if we're associated with a window.
-    if (mDispatchEvent && (!mWindow || mWindow->IsCurrentInnerWindow())) {
-      nsIDocShell* docShell = mWindow ? mWindow->GetDocShell() : nullptr;
-      if (docShell &&
-          !JSREPORT_IS_WARNING(mFlags) &&
-          !sHandlingScriptError) {
-        AutoRestore<bool> recursionGuard(sHandlingScriptError);
-        sHandlingScriptError = true;
+    // our window is still the current inner.
+    if (mDispatchEvent && win->IsCurrentInnerWindow() &&
+        win->GetDocShell() && !JSREPORT_IS_WARNING(mReport->mFlags) &&
+        !sHandlingScriptError)
+    {
+      AutoRestore<bool> recursionGuard(sHandlingScriptError);
+      sHandlingScriptError = true;
 
-        nsRefPtr<nsPresContext> presContext;
-        docShell->GetPresContext(getter_AddRefs(presContext));
+      nsRefPtr<nsPresContext> presContext;
+      win->GetDocShell()->GetPresContext(getter_AddRefs(presContext));
 
-        ThreadsafeAutoJSContext cx;
-        RootedDictionary<ErrorEventInit> init(cx);
-        init.mCancelable = true;
-        init.mFilename = mFileName;
-        init.mBubbles = true;
+      ThreadsafeAutoJSContext cx;
+      RootedDictionary<ErrorEventInit> init(cx);
+      init.mCancelable = true;
+      init.mFilename = mReport->mFileName;
+      init.mBubbles = true;
 
-        nsCOMPtr<nsIScriptObjectPrincipal> sop(do_QueryInterface(mWindow));
-        NS_ENSURE_STATE(sop);
-        nsIPrincipal* p = sop->GetPrincipal();
-        NS_ENSURE_STATE(p);
+      nsCOMPtr<nsIScriptObjectPrincipal> sop(do_QueryInterface(win));
+      NS_ENSURE_STATE(sop);
+      nsIPrincipal* p = sop->GetPrincipal();
+      NS_ENSURE_STATE(p);
 
-        bool sameOrigin = !mOriginPrincipal;
+      bool sameOrigin = !mOriginPrincipal;
 
-        if (p && !sameOrigin) {
-          if (NS_FAILED(p->Subsumes(mOriginPrincipal, &sameOrigin))) {
-            sameOrigin = false;
-          }
+      if (p && !sameOrigin) {
+        if (NS_FAILED(p->Subsumes(mOriginPrincipal, &sameOrigin))) {
+          sameOrigin = false;
         }
-
-        NS_NAMED_LITERAL_STRING(xoriginMsg, "Script error.");
-        if (sameOrigin) {
-          init.mMessage = mErrorMsg;
-          init.mLineno = mLineNumber;
-          init.mColno = mColumn;
-          init.mError = mError;
-        } else {
-          NS_WARNING("Not same origin error!");
-          init.mMessage = xoriginMsg;
-          init.mLineno = 0;
-        }
-
-        nsRefPtr<ErrorEvent> event =
-          ErrorEvent::Constructor(static_cast<nsGlobalWindow*>(mWindow.get()),
-                                  NS_LITERAL_STRING("error"), init);
-        event->SetTrusted(true);
-
-        EventDispatcher::DispatchDOMEvent(mWindow, nullptr, event, presContext,
-                                          &status);
       }
+
+      NS_NAMED_LITERAL_STRING(xoriginMsg, "Script error.");
+      if (sameOrigin) {
+        init.mMessage = mReport->mErrorMsg;
+        init.mLineno = mReport->mLineNumber;
+        init.mColno = mReport->mColumn;
+        init.mError = mError;
+      } else {
+        NS_WARNING("Not same origin error!");
+        init.mMessage = xoriginMsg;
+        init.mLineno = 0;
+      }
+
+      nsRefPtr<ErrorEvent> event =
+        ErrorEvent::Constructor(static_cast<nsGlobalWindow*>(win),
+                                NS_LITERAL_STRING("error"), init);
+      event->SetTrusted(true);
+
+      EventDispatcher::DispatchDOMEvent(win, nullptr, event, presContext,
+                                        &status);
     }
 
     if (status != nsEventStatus_eConsumeNoDefault) {
-      AsyncErrorReporter::ReportError();
+      mReport->LogToConsole();
     }
 
     return NS_OK;
   }
 
 private:
+  nsRefPtr<xpc::ErrorReport>      mReport;
   nsCOMPtr<nsIPrincipal>          mOriginPrincipal;
   bool                            mDispatchEvent;
   JS::PersistentRootedValue       mError;
-  nsCOMPtr<nsPIDOMWindow>         mWindow;
 
   static bool sHandlingScriptError;
 };
 
 bool ScriptErrorEvent::sHandlingScriptError = false;
 
-// NOTE: This function could be refactored to use the above.  The only reason
-// it has not been done is that the code below only fills the error event
-// after it has a good nsPresContext - whereas using the above function
-// would involve always filling it.  Is that a concern?
+// This temporarily lives here to avoid code churn. It will go away entirely
+// soon.
+namespace xpc {
+
 void
-NS_ScriptErrorReporter(JSContext *cx,
-                       const char *message,
-                       JSErrorReport *report)
+SystemErrorReporter(JSContext *cx, const char *message, JSErrorReport *report)
 {
-  // We don't want to report exceptions too eagerly, but warnings in the
-  // absence of werror are swallowed whole, so report those now.
-  if (!JSREPORT_IS_WARNING(report->flags)) {
-    nsIXPConnect* xpc = nsContentUtils::XPConnect();
-    if (JS::DescribeScriptedCaller(cx)) {
-      xpc->MarkErrorUnreported(cx);
-      return;
-    }
-
-    if (xpc) {
-      nsAXPCNativeCallContext *cc = nullptr;
-      xpc->GetCurrentNativeCallContext(&cc);
-      if (cc) {
-        nsAXPCNativeCallContext *prev = cc;
-        while (NS_SUCCEEDED(prev->GetPreviousCallContext(&prev)) && prev) {
-          uint16_t lang;
-          if (NS_SUCCEEDED(prev->GetLanguage(&lang)) &&
-            lang == nsAXPCNativeCallContext::LANG_JS) {
-            xpc->MarkErrorUnreported(cx);
-            return;
-          }
-        }
-      }
-    }
-  }
-
   JS::Rooted<JS::Value> exception(cx);
   ::JS_GetPendingException(cx, &exception);
 
@@ -564,22 +451,44 @@ NS_ScriptErrorReporter(JSContext *cx,
   ::JS_ClearPendingException(cx);
 
   MOZ_ASSERT(cx == nsContentUtils::GetCurrentJSContext());
-  nsCOMPtr<nsIGlobalObject> globalObject = GetEntryGlobal();
-  if (globalObject) {
+  nsCOMPtr<nsIGlobalObject> globalObject;
 
-    nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(globalObject);
-    MOZ_ASSERT_IF(win, win->IsInnerWindow());
-    nsCOMPtr<nsIScriptObjectPrincipal> scriptPrincipal =
-      do_QueryInterface(globalObject);
-    NS_ASSERTION(scriptPrincipal, "Global objects must implement "
-                 "nsIScriptObjectPrincipal");
+  // The eventual plan is for error reporting to happen in the AutoJSAPI
+  // destructor using the global with which the AutoJSAPI was initialized. We
+  // can't _quite_ do that yet, so we take a sloppy stab at those semantics. If
+  // we have an nsIScriptContext, we'll get the right answer modulo
+  // non-current-inners.
+  //
+  // Otherwise, we just use the privileged junk scope. This has the effect of
+  // causing us to report the error as "chrome javascript" rather than "content
+  // javascript", and not invoking any error reporters. This is exactly what we
+  // want here.
+  if (nsIScriptContext* scx = GetScriptContextFromJSContext(cx)) {
+    nsCOMPtr<nsPIDOMWindow> outer = do_QueryInterface(scx->GetGlobalObject());
+    if (outer) {
+      globalObject = static_cast<nsGlobalWindow*>(outer->GetCurrentInnerWindow());
+    }
+  } else {
+    globalObject = xpc::GetNativeForGlobal(xpc::PrivilegedJunkScope());
+  }
+
+  if (globalObject) {
+    nsRefPtr<xpc::ErrorReport> xpcReport = new xpc::ErrorReport();
+    xpcReport->Init(report, message, globalObject);
+
+    // If there's no window to fire an event at, report it to the console
+    // directly.
+    if (!xpcReport->mWindow) {
+      xpcReport->LogToConsole();
+      return;
+    }
+
+    // Otherwise, we need to asynchronously invoke onerror before we can decide
+    // whether or not to report the error to the console.
     nsContentUtils::AddScriptRunner(
       new ScriptErrorEvent(JS_GetRuntime(cx),
-                           report,
-                           message,
+                           xpcReport,
                            nsJSPrincipals::get(report->originPrincipals),
-                           scriptPrincipal->GetPrincipal(),
-                           win,
                            exception,
                            /* We do not try to report Out Of Memory via a dom
                             * event because the dom event handler would
@@ -590,51 +499,10 @@ NS_ScriptErrorReporter(JSContext *cx,
                             */
                            report->errorNumber != JSMSG_OUT_OF_MEMORY));
   }
-
-  if (nsContentUtils::DOMWindowDumpEnabled()) {
-    // Print it to stderr as well, for the benefit of those invoking
-    // mozilla with -console.
-    nsAutoCString error;
-    error.AssignLiteral("JavaScript ");
-    if (JSREPORT_IS_STRICT(report->flags))
-      error.AppendLiteral("strict ");
-    if (JSREPORT_IS_WARNING(report->flags))
-      error.AppendLiteral("warning: ");
-    else
-      error.AppendLiteral("error: ");
-    error.Append(report->filename);
-    error.AppendLiteral(", line ");
-    error.AppendInt(report->lineno, 10);
-    error.AppendLiteral(": ");
-    if (report->ucmessage) {
-      AppendUTF16toUTF8(reinterpret_cast<const char16_t*>(report->ucmessage),
-                        error);
-    } else {
-      error.Append(message);
-    }
-
-    fprintf(stderr, "%s\n", error.get());
-    fflush(stderr);
-  }
-
-#ifdef PR_LOGGING
-  if (!gJSDiagnostics)
-    gJSDiagnostics = PR_NewLogModule("JSDiagnostics");
-
-  if (gJSDiagnostics) {
-    PR_LOG(gJSDiagnostics,
-           JSREPORT_IS_WARNING(report->flags) ? PR_LOG_WARNING : PR_LOG_ERROR,
-           ("file %s, line %u: %s\n%s%s",
-            report->filename, report->lineno, message,
-            report->linebuf ? report->linebuf : "",
-            (report->linebuf &&
-             report->linebuf[strlen(report->linebuf)-1] != '\n')
-            ? "\n"
-            : ""));
-  }
-#endif
 }
 
+} /* namespace xpc */
+
 #ifdef DEBUG
 // A couple of useful functions to call when you're debugging.
 nsGlobalWindow *
@@ -892,7 +760,7 @@ nsJSContext::InitContext()
   if (!mContext)
     return NS_ERROR_OUT_OF_MEMORY;
 
-  ::JS_SetErrorReporter(mContext, NS_ScriptErrorReporter);
+  JS_SetErrorReporter(mContext, xpc::SystemErrorReporter);
 
   JSOptionChangedCallback(js_options_dot_str, this);
 
@@ -1064,7 +932,7 @@ nsJSContext::AddSupportsPrimitiveTojsvals(nsISupports *aArg, JS::Value *aArgv)
 
       p->GetData(data);
 
-      // cast is probably safe since wchar_t and jschar are expected
+      // cast is probably safe since wchar_t and char16_t are expected
       // to be equivalent; both unsigned 16-bit entities
       JSString *str =
         ::JS_NewUCStringCopyN(cx, data.get(), data.Length());
@@ -2451,8 +2319,8 @@ NotifyGCEndRunnable::Run()
     return NS_OK;
   }
 
-  const jschar oomMsg[3] = { '{', '}', 0 };
-  const jschar *toSend = mMessage.get() ? mMessage.get() : oomMsg;
+  const char16_t oomMsg[3] = { '{', '}', 0 };
+  const char16_t *toSend = mMessage.get() ? mMessage.get() : oomMsg;
   observerService->NotifyObservers(nullptr, "garbage-collection-statistics", toSend);
 
   return NS_OK;
@@ -2822,8 +2690,8 @@ NS_DOMStructuredCloneError(JSContext* cx,
 
 static bool
 AsmJSCacheOpenEntryForRead(JS::Handle<JSObject*> aGlobal,
-                           const jschar* aBegin,
-                           const jschar* aLimit,
+                           const char16_t* aBegin,
+                           const char16_t* aLimit,
                            size_t* aSize,
                            const uint8_t** aMemory,
                            intptr_t *aHandle)
@@ -2837,8 +2705,8 @@ AsmJSCacheOpenEntryForRead(JS::Handle<JSObject*> aGlobal,
 static bool
 AsmJSCacheOpenEntryForWrite(JS::Handle<JSObject*> aGlobal,
                             bool aInstalled,
-                            const jschar* aBegin,
-                            const jschar* aEnd,
+                            const char16_t* aBegin,
+                            const char16_t* aEnd,
                             size_t aSize,
                             uint8_t** aMemory,
                             intptr_t* aHandle)
diff --git a/dom/base/nsJSEnvironment.h b/dom/base/nsJSEnvironment.h
index 43252bc1937..60217f547c9 100644
--- a/dom/base/nsJSEnvironment.h
+++ b/dom/base/nsJSEnvironment.h
@@ -14,7 +14,9 @@
 #include "nsIXPConnect.h"
 #include "nsIArray.h"
 #include "mozilla/Attributes.h"
+#include "nsPIDOMWindow.h"
 #include "nsThreadUtils.h"
+#include "xpcpublic.h"
 
 class nsICycleCollectorListener;
 class nsIXPConnectJSObjectHolder;
@@ -189,30 +191,18 @@ class AsyncErrorReporter : public nsRunnable
 {
 public:
   // aWindow may be null if this error report is not associated with a window
-  AsyncErrorReporter(JSRuntime* aRuntime,
-                     JSErrorReport* aErrorReport,
-                     const char* aFallbackMessage,
-                     bool aIsChromeError, // To determine category
-                     nsPIDOMWindow* aWindow);
+  AsyncErrorReporter(JSRuntime* aRuntime, xpc::ErrorReport* aReport)
+    : mReport(aReport)
+  {}
 
   NS_IMETHOD Run()
   {
-    ReportError();
+    mReport->LogToConsole();
     return NS_OK;
   }
 
 protected:
-  // Do the actual error reporting
-  void ReportError();
-
-  nsString mErrorMsg;
-  nsString mFileName;
-  nsString mSourceLine;
-  nsCString mCategory;
-  uint32_t mLineNumber;
-  uint32_t mColumn;
-  uint32_t mFlags;
-  uint64_t mInnerWindowID;
+  nsRefPtr<xpc::ErrorReport> mReport;
 };
 
 } // namespace dom
@@ -238,9 +228,6 @@ public:
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIJSArgArray, NS_IJSARGARRAY_IID)
 
-/* prototypes */
-void NS_ScriptErrorReporter(JSContext *cx, const char *message, JSErrorReport *report);
-
 JSObject* NS_DOMReadStructuredClone(JSContext* cx,
                                     JSStructuredCloneReader* reader, uint32_t tag,
                                     uint32_t data, void* closure);
diff --git a/dom/bindings/BindingDeclarations.h b/dom/bindings/BindingDeclarations.h
index 0e6a022fac1..d40649b6e0c 100644
--- a/dom/bindings/BindingDeclarations.h
+++ b/dom/bindings/BindingDeclarations.h
@@ -42,8 +42,8 @@ protected:
 private:
   // aString is expected to actually be an nsAString*.  Should only be
   // called from StringifyToJSON.
-  static bool AppendJSONToString(const jschar* aJSONData, uint32_t aDataLength,
-                                 void* aString);
+  static bool AppendJSONToString(const char16_t* aJSONData,
+                                 uint32_t aDataLength, void* aString);
 };
 
 // Struct that serves as a base class for all typed arrays and array buffers and
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index d42a4a54f50..650bd7a2556 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -157,7 +157,7 @@ ErrorResult::ReportTypeError(JSContext* aCx)
 
   Message* message = mMessage;
   const uint32_t argCount = message->mArgs.Length();
-  const jschar* args[11];
+  const char16_t* args[11];
   for (uint32_t i = 0; i < argCount; ++i) {
     args[i] = message->mArgs.ElementAt(i).get();
   }
@@ -1629,9 +1629,7 @@ DictionaryBase::ParseJSON(JSContext* aCx,
   if (aJSON.IsEmpty()) {
     return true;
   }
-  return JS_ParseJSON(aCx,
-                      static_cast<const jschar*>(PromiseFlatString(aJSON).get()),
-                      aJSON.Length(), aVal);
+  return JS_ParseJSON(aCx, PromiseFlatString(aJSON).get(), aJSON.Length(), aVal);
 }
 
 bool
@@ -1645,18 +1643,15 @@ DictionaryBase::StringifyToJSON(JSContext* aCx,
 
 /* static */
 bool
-DictionaryBase::AppendJSONToString(const jschar* aJSONData,
+DictionaryBase::AppendJSONToString(const char16_t* aJSONData,
                                    uint32_t aDataLength,
                                    void* aString)
 {
   nsAString* string = static_cast<nsAString*>(aString);
-  string->Append(static_cast<const char16_t*>(aJSONData),
-                 aDataLength);
+  string->Append(aJSONData, aDataLength);
   return true;
 }
 
-
-
 static JSString*
 ConcatJSString(JSContext* cx, const char* pre, JS::Handle<JSString*> str, const char* post)
 {
@@ -2244,10 +2239,10 @@ ConvertJSValueToByteString(JSContext* cx, JS::Handle<JS::Value> v,
     // and report the error outside the AutoCheckCannotGC scope.
     bool foundBadChar = false;
     size_t badCharIndex;
-    jschar badChar;
+    char16_t badChar;
     {
       JS::AutoCheckCannotGC nogc;
-      const jschar* chars = JS_GetTwoByteStringCharsAndLength(cx, nogc, s, &length);
+      const char16_t* chars = JS_GetTwoByteStringCharsAndLength(cx, nogc, s, &length);
       if (!chars) {
         return false;
       }
@@ -2270,11 +2265,11 @@ ConvertJSValueToByteString(JSContext* cx, JS::Handle<JS::Value> v,
       char index[21];
       static_assert(sizeof(size_t) <= 8, "index array too small");
       PR_snprintf(index, sizeof(index), "%d", badCharIndex);
-      // A jschar is 16 bits long.  The biggest unsigned 16 bit
+      // A char16_t is 16 bits long.  The biggest unsigned 16 bit
       // number (65,535) has 5 digits, plus one more for the null
       // terminator.
       char badCharArray[6];
-      static_assert(sizeof(jschar) <= 2, "badCharArray too small");
+      static_assert(sizeof(char16_t) <= 2, "badCharArray too small");
       PR_snprintf(badCharArray, sizeof(badCharArray), "%d", badChar);
       ThrowErrorMessage(cx, MSG_INVALID_BYTESTRING, index, badCharArray);
       return false;
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 3e54fc67bb8..cf25c091744 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -1145,8 +1145,8 @@ FindEnumStringIndex(JSContext* cx, JS::Handle<JS::Value> v, const EnumEntry* val
       }
       index = FindEnumStringIndexImpl(chars, length, values);
     } else {
-      const jschar* chars = JS_GetTwoByteStringCharsAndLength(cx, nogc, str,
-                                                              &length);
+      const char16_t* chars = JS_GetTwoByteStringCharsAndLength(cx, nogc, str,
+                                                                &length);
       if (!chars) {
         *ok = false;
         return 0;
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index fb398ce10b9..d2867e4dc00 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1596,7 +1596,6 @@ DOMInterfaces = {
 
 'Window': {
     'nativeType': 'nsGlobalWindow',
-    'hasXPConnectImpls': True,
     'binaryNames': {
         'postMessage': 'postMessageMoz',
     },
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 7bf5e5388ab..9ce9474241d 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1216,6 +1216,7 @@ def UnionTypes(descriptors, dictionaries, callbacks, config):
             def addHeadersForType(f):
                 if f.nullable():
                     headers.add("mozilla/dom/Nullable.h")
+                isSequence = f.isSequence()
                 f = f.unroll()
                 if f.isInterface():
                     if f.isSpiderMonkeyInterface():
@@ -1227,10 +1228,14 @@ def UnionTypes(descriptors, dictionaries, callbacks, config):
                                 typeDesc = p.getDescriptor(f.inner.identifier.name)
                             except NoSuchDescriptorError:
                                 continue
-                            if typeDesc.interface.isCallback():
+                            if typeDesc.interface.isCallback() or isSequence:
                                 # Callback interfaces always use strong refs, so
                                 # we need to include the right header to be able
                                 # to Release() in our inlined code.
+                                #
+                                # Similarly, sequences always contain strong
+                                # refs, so we'll need the header to handler
+                                # those.
                                 headers.add(typeDesc.headerFile)
                             else:
                                 declarations.add((typeDesc.nativeType, False))
@@ -2956,12 +2961,6 @@ def CreateBindingJSObject(descriptor, properties, parent):
             js::SetReservedSlot(obj, DOM_OBJECT_SLOT, PRIVATE_TO_JSVAL(aObject));
             """,
             parent=parent)
-        if "Window" in descriptor.interface.identifier.name:
-            create = dedent("""
-                MOZ_ASSERT(false,
-                           "Our current reserved slot situation is unsafe for globals. Fix "
-                           "bug 760095!");
-                """) + create
     create = objDecl + create
 
     if descriptor.nativeOwnership == 'refcounted':
@@ -3386,7 +3385,7 @@ class CGIsPermittedMethod(CGAbstractMethod):
         self.crossOriginSetters = crossOriginSetters
         self.crossOriginMethods = crossOriginMethods
         args = [Argument("JSFlatString*", "prop"),
-                Argument("jschar", "propFirstChar"),
+                Argument("char16_t", "propFirstChar"),
                 Argument("bool", "set")]
         CGAbstractMethod.__init__(self, descriptor, "IsPermitted", "bool", args,
                                   inline=True)
@@ -4657,7 +4656,7 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
 
     if type.isSpiderMonkeyInterface():
         assert not isEnforceRange and not isClamp
-        name = type.name
+        name = type.unroll().name # unroll() because it may be nullable
         arrayType = CGGeneric(name)
         declType = arrayType
         if type.nullable():
@@ -5287,7 +5286,7 @@ class CGArgumentConverter(CGThing):
             "args.hasDefined(${index})").substitute(replacer)
         self.replacementVariables["haveValue"] = haveValueCheck
         self.descriptorProvider = descriptorProvider
-        if self.argument.optional and not self.argument.defaultValue:
+        if self.argument.canHaveMissingValue():
             self.argcAndIndex = replacer
         else:
             self.argcAndIndex = None
@@ -6130,10 +6129,9 @@ class CGCallGenerator(CGThing):
                     return True
                 if a.type.isString():
                     return True
-                if a.optional and not a.defaultValue:
-                    # If a.defaultValue, then it's not going to use an Optional,
-                    # so doesn't need to be const just due to being optional.
-                    # This also covers variadic arguments.
+                if a.canHaveMissingValue():
+                    # This will need an Optional or it's a variadic;
+                    # in both cases it should be const.
                     return True
                 if a.type.isUnion():
                     return True
@@ -6209,8 +6207,6 @@ def getUnionMemberName(type):
         return type.inner.identifier.name
     if type.isEnum():
         return type.inner.identifier.name
-    if type.isArray() or type.isSequence() or type.isMozMap():
-        return str(type)
     return type.name
 
 
@@ -6350,7 +6346,7 @@ def wrapArgIntoCurrentCompartment(arg, value, isMember=True):
     As wrapTypeIntoCurrentCompartment but handles things being optional
     """
     origValue = value
-    isOptional = arg.optional and not arg.defaultValue
+    isOptional = arg.canHaveMissingValue()
     if isOptional:
         value = value + ".Value()"
     wrap = wrapTypeIntoCurrentCompartment(arg.type, value, isMember)
@@ -6857,8 +6853,7 @@ class CGMethodCall(CGThing):
                 # enough that we can examine this argument.  But note that we
                 # still want to claim that optional arguments are optional, in
                 # case undefined was passed in.
-                argIsOptional = (distinguishingArgument(signature).optional and
-                                 not distinguishingArgument(signature).defaultValue)
+                argIsOptional = distinguishingArgument(signature).canHaveMissingValue()
                 testCode = instantiateJSToNativeConversion(
                     getJSToNativeConversionInfo(type, descriptor,
                                                 failureCode=failureCode,
@@ -7144,6 +7139,9 @@ class FakeArgument():
     def allowTreatNonCallableAsNull(self):
         return self._allowTreatNonCallableAsNull
 
+    def canHaveMissingValue(self):
+        return False
+
 
 class CGSetterCall(CGPerSignatureCall):
     """
@@ -7675,9 +7673,7 @@ class CGSpecializedGetter(CGAbstractStaticMethod):
         nativeName = CGSpecializedGetter.makeNativeName(self.descriptor,
                                                         self.attr)
         if self.attr.slotIndex is not None:
-            if (self.descriptor.hasXPConnectImpls and
-                (self.descriptor.interface.identifier.name != 'Window' or
-                 self.attr.identifier.name != 'document')):
+            if self.descriptor.hasXPConnectImpls:
                 raise TypeError("Interface '%s' has XPConnect impls, so we "
                                 "can't use our slot for property '%s'!" %
                                 (self.descriptor.interface.identifier.name,
@@ -11119,10 +11115,9 @@ class CGDictionary(CGThing):
                  isEnforceRange=member.enforceRange,
                  isClamp=member.clamp,
                  isMember="Dictionary",
-                 isOptional=(not member.defaultValue),
+                 isOptional=member.canHaveMissingValue(),
                  defaultValue=member.defaultValue,
-                 sourceDescription=("'%s' member of %s" %
-                                    (member.identifier.name, dictionary.identifier.name))))
+                 sourceDescription=self.getMemberSourceDescription(member)))
             for member in dictionary.members]
 
         # If we have a union member containing something in the same
@@ -11322,7 +11317,7 @@ class CGDictionary(CGThing):
                 self.makeClassName(self.dictionary.parent)))
         for m, _ in self.memberInfo:
             memberName = self.makeMemberName(m.identifier.name)
-            if not m.defaultValue:
+            if m.canHaveMissingValue():
                 memberAssign = CGGeneric(fill(
                     """
                     if (aOther.${name}.WasPassed()) {
@@ -11476,6 +11471,19 @@ class CGDictionary(CGThing):
                       "}\n")
         if member.defaultValue:
             conversion += "${convert}"
+        elif not conversionInfo.dealWithOptional:
+            # We're required, but have no default value.  Make sure
+            # that we throw if we have no value provided.
+            conversion += dedent(
+                """
+                // Skip the undefined check if we have no cx.  In that
+                // situation the caller is default-constructing us and we'll
+                // just assume they know what they're doing.
+                if (cx && (isNull || temp->isUndefined())) {
+                  return ThrowErrorMessage(cx, MSG_MISSING_REQUIRED_DICTIONARY_MEMBER,
+                                           "%s");
+                }
+                ${convert}""" % self.getMemberSourceDescription(member))
         else:
             conversion += (
                 "if (!isNull && !temp->isUndefined()) {\n"
@@ -11491,7 +11499,7 @@ class CGDictionary(CGThing):
         member = memberInfo[0]
         declType = memberInfo[1].declType
         memberLoc = self.makeMemberName(member.identifier.name)
-        if member.defaultValue:
+        if not member.canHaveMissingValue():
             memberData = memberLoc
         else:
             # The data is inside the Optional<>
@@ -11547,7 +11555,7 @@ class CGDictionary(CGThing):
             pre=("do {\n"
                  "  // block for our 'break' successCode and scope for 'temp' and 'currentValue'\n"),
             post="} while(0);\n")
-        if not member.defaultValue:
+        if member.canHaveMissingValue():
             # Only do the conversion if we have a value
             conversion = CGIfWrapper(conversion, "%s.WasPassed()" % memberLoc)
         return conversion
@@ -11556,7 +11564,7 @@ class CGDictionary(CGThing):
         type = member.type
         assert typeNeedsRooting(type)
         memberLoc = self.makeMemberName(member.identifier.name)
-        if member.defaultValue:
+        if not member.canHaveMissingValue():
             memberData = memberLoc
         else:
             # The data is inside the Optional<>
@@ -11597,7 +11605,7 @@ class CGDictionary(CGThing):
         else:
             assert False  # unknown type
 
-        if not member.defaultValue:
+        if member.canHaveMissingValue():
             trace = CGIfWrapper(trace, "%s.WasPassed()" % memberLoc)
 
         return trace.define()
@@ -11609,8 +11617,8 @@ class CGDictionary(CGThing):
         value, so they're safe to trace at all times.
         """
         member, _ = memberInfo
-        if not member.defaultValue:
-            # No default value means no need to set it up front, since it's
+        if member.canHaveMissingValue():
+            # Allowed missing value means no need to set it up front, since it's
             # inside an Optional and won't get traced until it's actually set
             # up.
             return None
@@ -11621,6 +11629,10 @@ class CGDictionary(CGThing):
             return "nullptr"
         return None
 
+    def getMemberSourceDescription(self, member):
+        return ("'%s' member of %s" %
+                (member.identifier.name, self.dictionary.identifier.name))
+
     @staticmethod
     def makeIdName(name):
         return name.replace("-", "_") + "_id"
@@ -12439,7 +12451,8 @@ class CGNativeMember(ClassMethod):
             if not self.typedArraysAreStructs:
                 return "JS::Handle<JSObject*>", False, False
 
-            return type.name, True, True
+            # Unroll for the name, in case we're nullable.
+            return type.unroll().name, True, True
 
         if type.isDOMString() or type.isScalarValueString():
             if isMember:
@@ -12526,8 +12539,7 @@ class CGNativeMember(ClassMethod):
         """
         Get the full argument declaration for an argument
         """
-        decl, ref = self.getArgType(arg.type,
-                                    arg.optional and not arg.defaultValue,
+        decl, ref = self.getArgType(arg.type, arg.canHaveMissingValue(),
                                     "Variadic" if arg.variadic else False)
         if ref:
             decl = CGWrapper(decl, pre="const ", post="&")
@@ -13606,7 +13618,7 @@ class CallbackMember(CGNativeMember):
             jsvalIndex = "%d + idx" % i
         else:
             jsvalIndex = "%d" % i
-            if arg.optional and not arg.defaultValue:
+            if arg.canHaveMissingValue():
                 argval += ".Value()"
         if arg.type.isDOMString():
             # XPConnect string-to-JS conversion wants to mutate the string.  So
@@ -13649,7 +13661,7 @@ class CallbackMember(CGNativeMember):
                 """,
                 arg=arg.identifier.name,
                 conversion=conversion)
-        elif arg.optional and not arg.defaultValue:
+        elif arg.canHaveMissingValue():
             conversion = fill(
                 """
                 if (${argName}.WasPassed()) {
@@ -14383,7 +14395,7 @@ class CGEventMethod(CGNativeMember):
 
     def getArg(self, arg):
         decl, ref = self.getArgType(arg.type,
-                                    arg.optional and not arg.defaultValue,
+                                    arg.canHaveMissingValue(),
                                     "Variadic" if arg.variadic else False)
         if ref:
             decl = CGWrapper(decl, pre="const ", post="&")
diff --git a/dom/bindings/DOMJSProxyHandler.h b/dom/bindings/DOMJSProxyHandler.h
index 827c614d800..988865c19f4 100644
--- a/dom/bindings/DOMJSProxyHandler.h
+++ b/dom/bindings/DOMJSProxyHandler.h
@@ -150,7 +150,7 @@ GetArrayIndexFromId(JSContext* cx, JS::Handle<jsid> id)
   }
   if (MOZ_LIKELY(JSID_IS_ATOM(id))) {
     JSAtom* atom = JSID_TO_ATOM(id);
-    jschar s;
+    char16_t s;
     {
       JS::AutoCheckCannotGC nogc;
       if (js::AtomHasLatin1Chars(atom)) {
diff --git a/dom/bindings/Errors.msg b/dom/bindings/Errors.msg
index e4b520ad84b..e323c427e60 100644
--- a/dom/bindings/Errors.msg
+++ b/dom/bindings/Errors.msg
@@ -59,3 +59,4 @@ MSG_DEF(MSG_INVALID_HEADER_NAME, 1, "{0} is an invalid header name.")
 MSG_DEF(MSG_INVALID_HEADER_VALUE, 1, "{0} is an invalid header value.")
 MSG_DEF(MSG_INVALID_HEADER_SEQUENCE, 0, "Headers require name/value tuples when being initialized by a sequence.")
 MSG_DEF(MSG_PERMISSION_DENIED_TO_PASS_ARG, 1, "Permission denied to pass cross-origin object as {0}.")
+MSG_DEF(MSG_MISSING_REQUIRED_DICTIONARY_MEMBER, 1, "Missing required {0}.")
diff --git a/dom/bindings/crashtests/1010658-1.html b/dom/bindings/crashtests/1010658-1.html
index 3c8dd309b6c..af46069c7c8 100644
--- a/dom/bindings/crashtests/1010658-1.html
+++ b/dom/bindings/crashtests/1010658-1.html
@@ -2,11 +2,6 @@
 <html>
 <head>
 <script>
-
-/*
-user_pref("dom.window_experimental_bindings", true);
-*/
-
 function boom()
 {
     window.__proto__ = null;
diff --git a/dom/bindings/crashtests/1010658-2.html b/dom/bindings/crashtests/1010658-2.html
index 9f0d4f32cf5..4b80242ec94 100644
--- a/dom/bindings/crashtests/1010658-2.html
+++ b/dom/bindings/crashtests/1010658-2.html
@@ -2,11 +2,6 @@
 <html>
 <head>
 <script>
-
-/*
-user_pref("dom.window_experimental_bindings", true);
-*/
-
 function boom()
 {
     window.__proto__ = function(){};
diff --git a/dom/bindings/parser/WebIDL.py b/dom/bindings/parser/WebIDL.py
index 3a6f6895e52..860fa6030e1 100644
--- a/dom/bindings/parser/WebIDL.py
+++ b/dom/bindings/parser/WebIDL.py
@@ -1764,7 +1764,10 @@ class IDLNullableType(IDLType):
         assert not innerType.isVoid()
         assert not innerType == BuiltinTypes[IDLBuiltinType.Types.any]
 
-        IDLType.__init__(self, location, innerType.name)
+        name = innerType.name
+        if innerType.isComplete():
+            name += "OrNull"
+        IDLType.__init__(self, location, name)
         self.inner = innerType
         self.builtin = False
 
@@ -1877,7 +1880,7 @@ class IDLNullableType(IDLType):
                                   "be a union type that itself has a nullable "
                                   "type as a member type", [self.location])
 
-        self.name = self.inner.name
+        self.name = self.inner.name + "OrNull"
         return self
 
     def unroll(self):
@@ -1900,6 +1903,10 @@ class IDLSequenceType(IDLType):
         IDLType.__init__(self, location, parameterType.name)
         self.inner = parameterType
         self.builtin = False
+        # Need to set self.name up front if our inner type is already complete,
+        # since in that case our .complete() won't be called.
+        if self.inner.isComplete():
+            self.name = self.inner.name + "Sequence"
 
     def __eq__(self, other):
         return isinstance(other, IDLSequenceType) and self.inner == other.inner
@@ -1961,7 +1968,7 @@ class IDLSequenceType(IDLType):
 
     def complete(self, scope):
         self.inner = self.inner.complete(scope)
-        self.name = self.inner.name
+        self.name = self.inner.name + "Sequence"
         return self
 
     def unroll(self):
@@ -1987,6 +1994,10 @@ class IDLMozMapType(IDLType):
         IDLType.__init__(self, location, parameterType.name)
         self.inner = parameterType
         self.builtin = False
+        # Need to set self.name up front if our inner type is already complete,
+        # since in that case our .complete() won't be called.
+        if self.inner.isComplete():
+            self.name = self.inner.name + "MozMap"
 
     def __eq__(self, other):
         return isinstance(other, IDLMozMapType) and self.inner == other.inner
@@ -2012,7 +2023,7 @@ class IDLMozMapType(IDLType):
 
     def complete(self, scope):
         self.inner = self.inner.complete(scope)
-        self.name = self.inner.name
+        self.name = self.inner.name + "MozMap"
         return self
 
     def unroll(self):
@@ -2077,9 +2088,6 @@ class IDLUnionType(IDLType):
                 return typeName(type._identifier.object())
             if isinstance(type, IDLObjectWithIdentifier):
                 return typeName(type.identifier)
-            if (isinstance(type, IDLType) and
-                (type.isArray() or type.isSequence() or type.isMozMap)):
-                return str(type)
             return type.name
 
         for (i, type) in enumerate(self.memberTypes):
@@ -3474,6 +3482,9 @@ class IDLArgument(IDLObjectWithIdentifier):
             deps.add(self.defaultValue)
         return deps
 
+    def canHaveMissingValue(self):
+        return self.optional and not self.defaultValue
+
 class IDLCallbackType(IDLType, IDLObjectWithScope):
     def __init__(self, location, parentScope, identifier, returnType, arguments):
         assert isinstance(returnType, IDLType)
@@ -4141,8 +4152,8 @@ class Tokenizer(object):
         "long": "LONG",
         "object": "OBJECT",
         "octet": "OCTET",
-        "optional": "OPTIONAL",
         "Promise": "PROMISE",
+        "required": "REQUIRED",
         "sequence": "SEQUENCE",
         "MozMap": "MOZMAP",
         "short": "SHORT",
@@ -4427,15 +4438,21 @@ class Parser(Tokenizer):
 
     def p_DictionaryMember(self, p):
         """
-            DictionaryMember : Type IDENTIFIER Default SEMICOLON
+            DictionaryMember : Required Type IDENTIFIER Default SEMICOLON
         """
         # These quack a lot like optional arguments, so just treat them that way.
-        t = p[1]
+        t = p[2]
         assert isinstance(t, IDLType)
-        identifier = IDLUnresolvedIdentifier(self.getLocation(p, 2), p[2])
-        defaultValue = p[3]
+        identifier = IDLUnresolvedIdentifier(self.getLocation(p, 3), p[3])
+        defaultValue = p[4]
+        optional = not p[1]
 
-        p[0] = IDLArgument(self.getLocation(p, 2), identifier, t, optional=True,
+        if not optional and defaultValue:
+            raise WebIDLError("Required dictionary members can't have a default value.",
+                              [self.getLocation(p, 4)])
+
+        p[0] = IDLArgument(self.getLocation(p, 3), identifier, t,
+                           optional=optional,
                            defaultValue=defaultValue, variadic=False,
                            dictionaryMember=True)
 
@@ -4633,7 +4650,7 @@ class Parser(Tokenizer):
 
     def p_AttributeRest(self, p):
         """
-            AttributeRest : ReadOnly ATTRIBUTE Type IDENTIFIER SEMICOLON
+            AttributeRest : ReadOnly ATTRIBUTE Type AttributeName SEMICOLON
         """
         location = self.getLocation(p, 2)
         readonly = p[1]
@@ -4962,6 +4979,7 @@ class Parser(Tokenizer):
                          | INTERFACE
                          | LEGACYCALLER
                          | PARTIAL
+                         | REQUIRED
                          | SERIALIZER
                          | SETTER
                          | STATIC
@@ -4972,6 +4990,13 @@ class Parser(Tokenizer):
         """
         p[0] = p[1]
 
+    def p_AttributeName(self, p):
+        """
+            AttributeName : IDENTIFIER
+                          | REQUIRED
+        """
+        p[0] = p[1]
+
     def p_Optional(self, p):
         """
             Optional : OPTIONAL
@@ -4984,6 +5009,18 @@ class Parser(Tokenizer):
         """
         p[0] = False
 
+    def p_Required(self, p):
+        """
+            Required : REQUIRED
+        """
+        p[0] = True
+
+    def p_RequiredEmpty(self, p):
+        """
+            Required :
+        """
+        p[0] = False
+
     def p_Ellipsis(self, p):
         """
             Ellipsis : ELLIPSIS
diff --git a/dom/bindings/parser/tests/test_nullable_equivalency.py b/dom/bindings/parser/tests/test_nullable_equivalency.py
index 86e2d3b70b6..1f72b2c6e67 100644
--- a/dom/bindings/parser/tests/test_nullable_equivalency.py
+++ b/dom/bindings/parser/tests/test_nullable_equivalency.py
@@ -90,7 +90,7 @@ def checkEquivalent(iface, harness):
     for attr in dir(type1):
         if attr.startswith('_') or \
            attr in ['nullable', 'builtin', 'filename', 'location',
-                    'inner', 'QName', 'getDeps'] or \
+                    'inner', 'QName', 'getDeps', 'name'] or \
            (hasattr(type(type1), attr) and not callable(getattr(type1, attr))):
             continue
 
diff --git a/dom/bindings/parser/tests/test_typedef.py b/dom/bindings/parser/tests/test_typedef.py
index 9d2f3b3c2ce..8921985c5ca 100644
--- a/dom/bindings/parser/tests/test_typedef.py
+++ b/dom/bindings/parser/tests/test_typedef.py
@@ -12,7 +12,7 @@ def WebIDLTest(parser, harness):
 
     results = parser.finish()
 
-    harness.check(results[2].members[1].type.name, "Long",
+    harness.check(results[2].members[1].type.name, "LongOrNull",
                   "Should expand typedefs")
 
     parser = parser.reset()
diff --git a/dom/bindings/test/TestBindingHeader.h b/dom/bindings/test/TestBindingHeader.h
index 12c82a03da8..6821639744e 100644
--- a/dom/bindings/test/TestBindingHeader.h
+++ b/dom/bindings/test/TestBindingHeader.h
@@ -603,6 +603,10 @@ public:
   void PassUnion20(JSContext*, const ObjectSequenceOrLong&);
   void PassUnion21(const LongMozMapOrLong&);
   void PassUnion22(JSContext*, const ObjectMozMapOrLong&);
+  void PassUnion23(const ImageDataSequenceOrLong&);
+  void PassUnion24(const ImageDataOrNullSequenceOrLong&);
+  void PassUnion25(const ImageDataSequenceSequenceOrLong&);
+  void PassUnion26(const ImageDataOrNullSequenceSequenceOrLong&);
   void PassUnionWithCallback(const EventHandlerNonNullOrNullOrLong& arg);
   void PassUnionWithByteString(const ByteStringOrLong&);
   void PassUnionWithMozMap(const StringMozMapOrString&);
diff --git a/dom/bindings/test/TestCodeGen.webidl b/dom/bindings/test/TestCodeGen.webidl
index 8d238ef8896..a1d4b2f58d6 100644
--- a/dom/bindings/test/TestCodeGen.webidl
+++ b/dom/bindings/test/TestCodeGen.webidl
@@ -567,6 +567,10 @@ interface TestInterface {
   void passUnion20(optional (sequence<object> or long) arg = []);
   void passUnion21((MozMap<long> or long) arg);
   void passUnion22((MozMap<object> or long) arg);
+  void passUnion23((sequence<ImageData> or long) arg);
+  void passUnion24((sequence<ImageData?> or long) arg);
+  void passUnion25((sequence<sequence<ImageData>> or long) arg);
+  void passUnion26((sequence<sequence<ImageData?>> or long) arg);
   void passUnionWithCallback((EventHandler or long) arg);
   void passUnionWithByteString((ByteString or long) arg);
   void passUnionWithMozMap((MozMap<DOMString> or DOMString) arg);
@@ -951,6 +955,9 @@ dictionary Dict : ParentDict {
   sequence<long>? seq5 = [];
 
   long dashed-name;
+
+  required long requiredLong;
+  required object requiredObject;
 };
 
 dictionary ParentDict : GrandparentDict {
diff --git a/dom/bindings/test/TestExampleGen.webidl b/dom/bindings/test/TestExampleGen.webidl
index f5baaf1d3ed..13a8915cb93 100644
--- a/dom/bindings/test/TestExampleGen.webidl
+++ b/dom/bindings/test/TestExampleGen.webidl
@@ -431,6 +431,10 @@ interface TestExampleInterface {
   void passUnion20(optional (sequence<object> or long) arg = []);
   void passUnion21((MozMap<long> or long) arg);
   void passUnion22((MozMap<object> or long) arg);
+  void passUnion23((sequence<ImageData> or long) arg);
+  void passUnion24((sequence<ImageData?> or long) arg);
+  void passUnion25((sequence<sequence<ImageData>> or long) arg);
+  void passUnion26((sequence<sequence<ImageData?>> or long) arg);
   void passUnionWithCallback((EventHandler or long) arg);
   void passUnionWithByteString((ByteString or long) arg);
   void passUnionWithMozMap((MozMap<DOMString> or DOMString) arg);
diff --git a/dom/bindings/test/TestJSImplGen.webidl b/dom/bindings/test/TestJSImplGen.webidl
index beb9a9b52f5..6ceae35f404 100644
--- a/dom/bindings/test/TestJSImplGen.webidl
+++ b/dom/bindings/test/TestJSImplGen.webidl
@@ -451,6 +451,10 @@ interface TestJSImplInterface {
   void passUnion20(optional (sequence<object> or long) arg = []);
   void passUnion21((MozMap<long> or long) arg);
   void passUnion22((MozMap<object> or long) arg);
+  void passUnion23((sequence<ImageData> or long) arg);
+  void passUnion24((sequence<ImageData?> or long) arg);
+  void passUnion25((sequence<sequence<ImageData>> or long) arg);
+  void passUnion26((sequence<sequence<ImageData?>> or long) arg);
   void passUnionWithCallback((EventHandler or long) arg);
   void passUnionWithByteString((ByteString or long) arg);
   void passUnionWithMozMap((MozMap<DOMString> or DOMString) arg);
diff --git a/dom/bluetooth/bluedroid/BluetoothOppManager.cpp b/dom/bluetooth/bluedroid/BluetoothOppManager.cpp
index 8dffa8b4e20..91a9c6d0abf 100644
--- a/dom/bluetooth/bluedroid/BluetoothOppManager.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothOppManager.cpp
@@ -751,6 +751,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aMessage);
 
+  const uint8_t* data = aMessage->GetData();
   int frameHeaderLength = 0;
 
   // See if this is the first part of each Put packet
@@ -759,8 +760,9 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     // [opcode:1][length:2][Headers:var]
     frameHeaderLength = 3;
 
-    mPacketLength = ((((int)aMessage->mData[1]) << 8) | aMessage->mData[2]) -
-                      frameHeaderLength;
+    mPacketLength = ((static_cast<int>(data[1]) << 8) | data[2]) -
+                    frameHeaderLength;
+
     /**
      * A PUT request from remote devices may be divided into multiple parts.
      * In other words, one request may need to be received multiple times,
@@ -771,7 +773,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     mPutFinalFlag = (aOpCode == ObexRequestCode::PutFinal);
   }
 
-  int dataLength = aMessage->mSize - frameHeaderLength;
+  int dataLength = aMessage->GetSize() - frameHeaderLength;
 
   // Check length before memcpy to prevent from memory pollution
   if (dataLength < 0 ||
@@ -786,7 +788,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   }
 
   memcpy(mReceivedDataBuffer.get() + mPutPacketReceivedLength,
-         &aMessage->mData[frameHeaderLength], dataLength);
+         &data[frameHeaderLength], dataLength);
 
   mPutPacketReceivedLength += dataLength;
 
@@ -799,12 +801,13 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   MOZ_ASSERT(NS_IsMainThread());
 
   uint8_t opCode;
-  int receivedLength = aMessage->mSize;
+  int receivedLength = aMessage->GetSize();
+  const uint8_t* data = aMessage->GetData();
 
   if (mPutPacketReceivedLength > 0) {
     opCode = mPutFinalFlag ? ObexRequestCode::PutFinal : ObexRequestCode::Put;
   } else {
-    opCode = aMessage->mData[0];
+    opCode = data[0];
 
     // When there's a Put packet right after a PutFinal packet,
     // which means it's the start point of a new file.
@@ -821,7 +824,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
     // Section 3.3.1 "Connect", IrOBEX 1.2
     // [opcode:1][length:2][version:1][flags:1][MaxPktSizeWeCanReceive:2]
     // [Headers:var]
-    if (!ParseHeaders(&aMessage->mData[7], receivedLength - 7, &pktHeaders)) {
+    if (!ParseHeaders(&data[7], receivedLength - 7, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -831,7 +834,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Abort) {
     // Section 3.3.5 "Abort", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -841,7 +844,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Disconnect) {
     // Section 3.3.2 "Disconnect", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -924,7 +927,8 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  uint8_t opCode = aMessage->mData[0];
+  const uint8_t* data = aMessage->GetData();
+  uint8_t opCode = data[0];
 
   // Check response code and send out system message as finished if the response
   // code is somehow incorrect.
@@ -981,10 +985,9 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
     AfterOppConnected();
 
     // Keep remote information
-    mRemoteObexVersion = aMessage->mData[3];
-    mRemoteConnectionFlags = aMessage->mData[4];
-    mRemoteMaxPacketLength =
-      (((int)(aMessage->mData[5]) << 8) | aMessage->mData[6]);
+    mRemoteObexVersion = data[3];
+    mRemoteConnectionFlags = data[4];
+    mRemoteMaxPacketLength = ((static_cast<int>(data[5]) << 8) | data[6]);
 
     // The length of file name exceeds maximum length.
     int fileNameByteLen = (mFileName.Length() + 1) * 2;
@@ -1253,8 +1256,7 @@ BluetoothOppManager::SendObexData(uint8_t* aData, uint8_t aOpcode, int aSize)
     mLastCommand = aOpcode;
   }
 
-  UnixSocketRawData* s = new UnixSocketRawData(aSize);
-  memcpy(s->mData, aData, s->mSize);
+  UnixSocketRawData* s = new UnixSocketRawData(aData, aSize);
   mSocket->SendSocketData(s);
 }
 
diff --git a/dom/bluetooth/bluedroid/BluetoothSocket.cpp b/dom/bluetooth/bluedroid/BluetoothSocket.cpp
index a2ef8ae55ee..da2ba029861 100644
--- a/dom/bluetooth/bluedroid/BluetoothSocket.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothSocket.cpp
@@ -319,10 +319,13 @@ DroidSocketImpl::OnSocketCanReceiveWithoutBlocking(int aFd)
   MOZ_ASSERT(!NS_IsMainThread());
   MOZ_ASSERT(!mShuttingDownOnIOThread);
 
-  nsresult rv = ReceiveData(aFd, this);
-  if (NS_FAILED(rv)) {
+  ssize_t res = ReceiveData(aFd, this);
+  if (res < 0) {
+    /* I/O error */
     RemoveWatchers(READ_WATCHER|WRITE_WATCHER);
-    return;
+  } else if (!res) {
+    /* EOF or peer shutdown */
+    RemoveWatchers(READ_WATCHER);
   }
 }
 
diff --git a/dom/bluetooth/bluez/BluetoothHfpManager.cpp b/dom/bluetooth/bluez/BluetoothHfpManager.cpp
index 9922adedc62..0eebcebcbd9 100644
--- a/dom/bluetooth/bluez/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/bluez/BluetoothHfpManager.cpp
@@ -707,7 +707,8 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aSocket);
 
-  nsAutoCString msg((const char*)aMessage->mData.get(), aMessage->mSize);
+  nsAutoCString msg(reinterpret_cast<const char*>(aMessage->GetData()),
+                    aMessage->GetSize());
   msg.StripWhitespace();
 
   nsTArray<nsCString> atCommandValues;
diff --git a/dom/bluetooth/bluez/BluetoothOppManager.cpp b/dom/bluetooth/bluez/BluetoothOppManager.cpp
index e1e4449fd72..19bccd4423e 100644
--- a/dom/bluetooth/bluez/BluetoothOppManager.cpp
+++ b/dom/bluetooth/bluez/BluetoothOppManager.cpp
@@ -774,6 +774,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   MOZ_ASSERT(aMessage);
 
   int frameHeaderLength = 0;
+  const uint8_t* data = aMessage->GetData();
 
   // See if this is the first part of each Put packet
   if (mPutPacketReceivedLength == 0) {
@@ -781,8 +782,8 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     // [opcode:1][length:2][Headers:var]
     frameHeaderLength = 3;
 
-    mPacketLength = ((((int)aMessage->mData[1]) << 8) | aMessage->mData[2]) -
-                      frameHeaderLength;
+    mPacketLength = ((static_cast<int>(data[1]) << 8) | data[2]) -
+                    frameHeaderLength;
     /**
      * A PUT request from remote devices may be divided into multiple parts.
      * In other words, one request may need to be received multiple times,
@@ -793,7 +794,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     mPutFinalFlag = (aOpCode == ObexRequestCode::PutFinal);
   }
 
-  int dataLength = aMessage->mSize - frameHeaderLength;
+  int dataLength = aMessage->GetSize() - frameHeaderLength;
 
   // Check length before memcpy to prevent from memory pollution
   if (dataLength < 0 ||
@@ -808,7 +809,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   }
 
   memcpy(mReceivedDataBuffer.get() + mPutPacketReceivedLength,
-         &aMessage->mData[frameHeaderLength], dataLength);
+         &data[frameHeaderLength], dataLength);
 
   mPutPacketReceivedLength += dataLength;
 
@@ -821,12 +822,13 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   MOZ_ASSERT(NS_IsMainThread());
 
   uint8_t opCode;
-  int receivedLength = aMessage->mSize;
+  int receivedLength = aMessage->GetSize();
+  const uint8_t* data = aMessage->GetData();
 
   if (mPutPacketReceivedLength > 0) {
     opCode = mPutFinalFlag ? ObexRequestCode::PutFinal : ObexRequestCode::Put;
   } else {
-    opCode = aMessage->mData[0];
+    opCode = data[0];
 
     // When there's a Put packet right after a PutFinal packet,
     // which means it's the start point of a new file.
@@ -843,7 +845,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
     // Section 3.3.1 "Connect", IrOBEX 1.2
     // [opcode:1][length:2][version:1][flags:1][MaxPktSizeWeCanReceive:2]
     // [Headers:var]
-    if (!ParseHeaders(&aMessage->mData[7], receivedLength - 7, &pktHeaders)) {
+    if (!ParseHeaders(&data[7], receivedLength - 7, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -853,7 +855,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Abort) {
     // Section 3.3.5 "Abort", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -863,7 +865,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Disconnect) {
     // Section 3.3.2 "Disconnect", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -946,7 +948,8 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  uint8_t opCode = aMessage->mData[0];
+  const uint8_t* data = aMessage->GetData();
+  uint8_t opCode = data[0];
 
   // Check response code and send out system message as finished if the response
   // code is somehow incorrect.
@@ -1003,10 +1006,9 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
     AfterOppConnected();
 
     // Keep remote information
-    mRemoteObexVersion = aMessage->mData[3];
-    mRemoteConnectionFlags = aMessage->mData[4];
-    mRemoteMaxPacketLength =
-      (((int)(aMessage->mData[5]) << 8) | aMessage->mData[6]);
+    mRemoteObexVersion = data[3];
+    mRemoteConnectionFlags = data[4];
+    mRemoteMaxPacketLength = (static_cast<int>(data[5]) << 8) | data[6];
 
     // The length of file name exceeds maximum length.
     int fileNameByteLen = (mFileName.Length() + 1) * 2;
@@ -1274,8 +1276,7 @@ BluetoothOppManager::SendObexData(uint8_t* aData, uint8_t aOpcode, int aSize)
     mLastCommand = aOpcode;
   }
 
-  UnixSocketRawData* s = new UnixSocketRawData(aSize);
-  memcpy(s->mData, aData, s->mSize);
+  UnixSocketRawData* s = new UnixSocketRawData(aData, aSize);
   mSocket->SendSocketData(s);
 }
 
diff --git a/dom/bluetooth2/BluetoothCommon.h b/dom/bluetooth2/BluetoothCommon.h
index 2ac7476bf57..3c92aa9ce5a 100644
--- a/dom/bluetooth2/BluetoothCommon.h
+++ b/dom/bluetooth2/BluetoothCommon.h
@@ -394,6 +394,19 @@ enum BluetoothObjectType {
   TYPE_INVALID
 };
 
+enum BluetoothA2dpAudioState {
+  A2DP_AUDIO_STATE_REMOTE_SUSPEND,
+  A2DP_AUDIO_STATE_STOPPED,
+  A2DP_AUDIO_STATE_STARTED,
+};
+
+enum BluetoothA2dpConnectionState {
+  A2DP_CONNECTION_STATE_DISCONNECTED,
+  A2DP_CONNECTION_STATE_CONNECTING,
+  A2DP_CONNECTION_STATE_CONNECTED,
+  A2DP_CONNECTION_STATE_DISCONNECTING
+};
+
 enum ControlPlayStatus {
   PLAYSTATUS_STOPPED  = 0x00,
   PLAYSTATUS_PLAYING  = 0x01,
@@ -404,6 +417,16 @@ enum ControlPlayStatus {
   PLAYSTATUS_ERROR    = 0xFF,
 };
 
+enum BluetoothAvrcpMediaAttribute {
+  AVRCP_MEDIA_ATTRIBUTE_TITLE,
+  AVRCP_MEDIA_ATTRIBUTE_ARTIST,
+  AVRCP_MEDIA_ATTRIBUTE_ALBUM,
+  AVRCP_MEDIA_ATTRIBUTE_TRACK_NUM,
+  AVRCP_MEDIA_ATTRIBUTE_NUM_TRACKS,
+  AVRCP_MEDIA_ATTRIBUTE_GENRE,
+  AVRCP_MEDIA_ATTRIBUTE_PLAYING_TIME
+};
+
 enum BluetoothAvrcpPlayerAttribute {
   AVRCP_PLAYER_ATTRIBUTE_EQUALIZER,
   AVRCP_PLAYER_ATTRIBUTE_REPEAT,
@@ -433,6 +456,13 @@ enum BluetoothAvrcpNotification {
   AVRCP_NTF_CHANGED
 };
 
+enum BluetoothAvrcpRemoteFeature {
+  AVRCP_REMOTE_FEATURE_NONE,
+  AVRCP_REMOTE_FEATURE_METADATA,
+  AVRCP_REMOTE_FEATURE_ABSOLUTE_VOLUME,
+  AVRCP_REMOTE_FEATURE_BROWSE
+};
+
 struct BluetoothAvrcpElementAttribute {
   uint32_t mId;
   nsString mValue;
@@ -447,6 +477,12 @@ struct BluetoothAvrcpNotificationParam {
   uint8_t mValues[256];
 };
 
+struct BluetoothAvrcpPlayerSettings {
+  uint8_t mNumAttr;
+  uint8_t mIds[256];
+  uint8_t mValues[256];
+};
+
 END_BLUETOOTH_NAMESPACE
 
 #endif // mozilla_dom_bluetooth_bluetoothcommon_h__
diff --git a/dom/bluetooth2/bluedroid/BluetoothA2dpManager.cpp b/dom/bluetooth2/bluedroid/BluetoothA2dpManager.cpp
index fd9c6ac1fd9..12f302bba3a 100644
--- a/dom/bluetooth2/bluedroid/BluetoothA2dpManager.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothA2dpManager.cpp
@@ -8,7 +8,6 @@
 
 #include "BluetoothA2dpManager.h"
 #include "BluetoothCommon.h"
-#include "BluetoothInterface.h"
 #include "BluetoothService.h"
 #include "BluetoothSocket.h"
 #include "BluetoothUtils.h"
@@ -37,173 +36,42 @@ namespace {
 #endif
 } // anonymous namespace
 
-class SinkPropertyChangedHandler : public nsRunnable
-{
-public:
-  SinkPropertyChangedHandler(const BluetoothSignal& aSignal)
-    : mSignal(aSignal)
-  {
-  }
-
-  NS_IMETHOD
-  Run()
-  {
-    MOZ_ASSERT(NS_IsMainThread());
-
-    BluetoothA2dpManager* a2dp = BluetoothA2dpManager::Get();
-    NS_ENSURE_TRUE(a2dp, NS_ERROR_FAILURE);
-    a2dp->HandleSinkPropertyChanged(mSignal);
-
-    return NS_OK;
-  }
-
-private:
-  BluetoothSignal mSignal;
-};
-
-class RequestPlayStatusTask : public nsRunnable
-{
-public:
-  RequestPlayStatusTask()
-  {
-    MOZ_ASSERT(!NS_IsMainThread());
-  }
-
-  nsresult Run()
-  {
-    MOZ_ASSERT(NS_IsMainThread());
-
-    BluetoothSignal signal(NS_LITERAL_STRING(REQUEST_MEDIA_PLAYSTATUS_ID),
-                           NS_LITERAL_STRING(KEY_ADAPTER),
-                           InfallibleTArray<BluetoothNamedValue>());
-
-    BluetoothService* bs = BluetoothService::Get();
-    NS_ENSURE_TRUE(bs, NS_ERROR_FAILURE);
-    bs->DistributeSignal(signal);
-
-    return NS_OK;
-  }
-};
-
-#if ANDROID_VERSION > 17
-class UpdateRegisterNotificationTask : public nsRunnable
-{
-public:
-  UpdateRegisterNotificationTask(BluetoothAvrcpEvent aEvent, uint32_t aParam)
-    : mEvent(aEvent)
-    , mParam(aParam)
-  {
-    MOZ_ASSERT(!NS_IsMainThread());
-  }
-
-  nsresult Run()
-  {
-    MOZ_ASSERT(NS_IsMainThread());
-
-    BluetoothA2dpManager* a2dp = BluetoothA2dpManager::Get();
-    NS_ENSURE_TRUE(a2dp, NS_OK);
-    a2dp->UpdateRegisterNotification(mEvent, mParam);
-    return NS_OK;
-  }
-private:
-  BluetoothAvrcpEvent mEvent;
-  uint32_t mParam;
-};
-
 /*
  * This function maps attribute id and returns corresponding values
- * Attribute id refers to btrc_media_attr_t in bt_rc.h
  */
 static void
-ConvertAttributeString(int aAttrId, nsAString& aAttrStr)
+ConvertAttributeString(BluetoothAvrcpMediaAttribute aAttrId,
+                       nsAString& aAttrStr)
 {
   BluetoothA2dpManager* a2dp = BluetoothA2dpManager::Get();
   NS_ENSURE_TRUE_VOID(a2dp);
 
   switch (aAttrId) {
-    case BTRC_MEDIA_ATTR_TITLE:
+    case AVRCP_MEDIA_ATTRIBUTE_TITLE:
       a2dp->GetTitle(aAttrStr);
       break;
-    case BTRC_MEDIA_ATTR_ARTIST:
+    case AVRCP_MEDIA_ATTRIBUTE_ARTIST:
       a2dp->GetArtist(aAttrStr);
       break;
-    case BTRC_MEDIA_ATTR_ALBUM:
+    case AVRCP_MEDIA_ATTRIBUTE_ALBUM:
       a2dp->GetAlbum(aAttrStr);
       break;
-    case BTRC_MEDIA_ATTR_TRACK_NUM:
+    case AVRCP_MEDIA_ATTRIBUTE_TRACK_NUM:
       aAttrStr.AppendInt(a2dp->GetMediaNumber());
       break;
-    case BTRC_MEDIA_ATTR_NUM_TRACKS:
+    case AVRCP_MEDIA_ATTRIBUTE_NUM_TRACKS:
       aAttrStr.AppendInt(a2dp->GetTotalMediaNumber());
       break;
-    case BTRC_MEDIA_ATTR_GENRE:
+    case AVRCP_MEDIA_ATTRIBUTE_GENRE:
       // TODO: we currently don't support genre from music player
       aAttrStr.Truncate();
       break;
-    case BTRC_MEDIA_ATTR_PLAYING_TIME:
+    case AVRCP_MEDIA_ATTRIBUTE_PLAYING_TIME:
       aAttrStr.AppendInt(a2dp->GetDuration());
       break;
   }
 }
 
-class UpdateElementAttrsTask : public nsRunnable
-{
-public:
-  UpdateElementAttrsTask(uint8_t aNumAttr, const btrc_media_attr_t* aPlayerAttrs)
-  : mNumAttr(aNumAttr)
-  {
-    MOZ_ASSERT(!NS_IsMainThread());
-
-    mAttrs = new BluetoothAvrcpElementAttribute[mNumAttr];
-
-    for (uint8_t i = 0; i < mNumAttr; ++i) {
-      mAttrs[i].mId = aPlayerAttrs[i];
-    }
-  }
-
-  nsresult Run()
-  {
-    MOZ_ASSERT(NS_IsMainThread());
-
-    for (uint8_t i = 0; i < mNumAttr; ++i) {
-      ConvertAttributeString(mAttrs[i].mId, mAttrs[i].mValue);
-    }
-
-    NS_ENSURE_TRUE(sBtAvrcpInterface, NS_OK);
-    sBtAvrcpInterface->GetElementAttrRsp(mNumAttr, mAttrs, nullptr);
-
-    return NS_OK;
-  }
-
-private:
-  uint8_t mNumAttr;
-  nsAutoArrayPtr<BluetoothAvrcpElementAttribute> mAttrs;
-};
-
-class UpdatePassthroughCmdTask : public nsRunnable
-{
-public:
-  UpdatePassthroughCmdTask(const nsAString& aName)
-    : mName(aName)
-  {
-    MOZ_ASSERT(!NS_IsMainThread());
-  }
-
-  nsresult Run()
-  {
-    MOZ_ASSERT(NS_IsMainThread());
-
-    NS_NAMED_LITERAL_STRING(type, "media-button");
-    BroadcastSystemMessage(type, BluetoothValue(mName));
-
-    return NS_OK;
-  }
-private:
-  nsString mName;
-};
-
-#endif
-
 NS_IMETHODIMP
 BluetoothA2dpManager::Observe(nsISupports* aSubject,
                               const char* aTopic,
@@ -233,288 +101,27 @@ BluetoothA2dpManager::Reset()
 }
 
 static void
-AvStatusToSinkString(btav_connection_state_t aStatus, nsAString& aState)
+AvStatusToSinkString(BluetoothA2dpConnectionState aState, nsAString& aString)
 {
-  nsAutoString state;
-  if (aStatus == BTAV_CONNECTION_STATE_DISCONNECTED) {
-    aState = NS_LITERAL_STRING("disconnected");
-  } else if (aStatus == BTAV_CONNECTION_STATE_CONNECTING) {
-    aState = NS_LITERAL_STRING("connecting");
-  } else if (aStatus == BTAV_CONNECTION_STATE_CONNECTED) {
-    aState = NS_LITERAL_STRING("connected");
-  } else if (aStatus == BTAV_CONNECTION_STATE_DISCONNECTING) {
-    aState = NS_LITERAL_STRING("disconnecting");
-  } else {
-    BT_WARNING("Unknown sink state");
-  }
-}
-
-static void
-A2dpConnectionStateCallback(btav_connection_state_t aState,
-                            bt_bdaddr_t* aBdAddress)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-  nsString remoteDeviceBdAddress;
-  BdAddressTypeToString(aBdAddress, remoteDeviceBdAddress);
-
-  nsString a2dpState;
-  AvStatusToSinkString(aState, a2dpState);
-
-  InfallibleTArray<BluetoothNamedValue> props;
-  BT_APPEND_NAMED_VALUE(props, "State", a2dpState);
-
-  BluetoothSignal signal(NS_LITERAL_STRING("AudioSink"),
-                         remoteDeviceBdAddress, props);
-  NS_DispatchToMainThread(new SinkPropertyChangedHandler(signal));
-}
-
-static void
-A2dpAudioStateCallback(btav_audio_state_t aState,
-                       bt_bdaddr_t* aBdAddress)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-  nsString remoteDeviceBdAddress;
-  BdAddressTypeToString(aBdAddress, remoteDeviceBdAddress);
-
-  nsString a2dpState;
-
-  if (aState == BTAV_AUDIO_STATE_STARTED) {
-    a2dpState = NS_LITERAL_STRING("playing");
-  } else if (aState == BTAV_AUDIO_STATE_STOPPED) {
-    // for avdtp state stop stream
-    a2dpState = NS_LITERAL_STRING("connected");
-  } else if (aState == BTAV_AUDIO_STATE_REMOTE_SUSPEND) {
-    // for avdtp state suspend stream from remote side
-    a2dpState = NS_LITERAL_STRING("connected");
-  }
-
-  InfallibleTArray<BluetoothNamedValue> props;
-  BT_APPEND_NAMED_VALUE(props, "State", a2dpState);
-
-  BluetoothSignal signal(NS_LITERAL_STRING("AudioSink"),
-                         remoteDeviceBdAddress, props);
-  NS_DispatchToMainThread(new SinkPropertyChangedHandler(signal));
-}
-
-#if ANDROID_VERSION > 17
-/*
- * Avrcp 1.3 callbacks
- */
-
-/*
- * This function is to request Gaia player application to update
- * current play status.
- * Callback for play status request
- */
-static void
-AvrcpGetPlayStatusCallback()
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-  NS_DispatchToMainThread(new RequestPlayStatusTask());
-}
-
-/*
- * This function is trying to get element attributes, which request from CT
- * Unlike BlueZ only calls UpdateMetaData, bluedroid does not cache meta data
- * information, but instead uses callback AvrcpGetElementAttrCallback and
- * call get_element_attr_rsp() to reply request.
- *
- * Callback to fetch the get element attributes of the current song
- * aNumAttr: It represents the number of attributes requested in aPlayerAttrs
- * aPlayerAttrs: It represents Attribute Ids
- */
-static void
-AvrcpGetElementAttrCallback(uint8_t aNumAttr, btrc_media_attr_t* aPlayerAttrs)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-  NS_DispatchToMainThread(new UpdateElementAttrsTask(aNumAttr, aPlayerAttrs));
-}
-
-/*
- * Callback for register notification (Play state change/track change/...)
- * To reply RegisterNotification INTERIM response
- * See AVRCP 1.3 Spec 25.2
- * aParam: It only valids if event_id is BTRC_EVT_PLAY_POS_CHANGED,
- * which is playback interval time
- */
-static void
-AvrcpRegisterNotificationCallback(btrc_event_id_t aEventId, uint32_t aParam)
-{
-  BluetoothAvrcpEvent event;
-
-  MOZ_ASSERT(!NS_IsMainThread());
-
-  switch (aEventId) {
-    case BTRC_EVT_PLAY_STATUS_CHANGED:
-      event = AVRCP_EVENT_PLAY_STATUS_CHANGED;
-    case BTRC_EVT_TRACK_CHANGE:
-      event = AVRCP_EVENT_TRACK_CHANGE;
-    case BTRC_EVT_TRACK_REACHED_END:
-      event = AVRCP_EVENT_TRACK_REACHED_END;
-    case BTRC_EVT_TRACK_REACHED_START:
-      event = AVRCP_EVENT_TRACK_REACHED_START;
-    case BTRC_EVT_PLAY_POS_CHANGED:
-      event = AVRCP_EVENT_PLAY_POS_CHANGED;
-    case BTRC_EVT_APP_SETTINGS_CHANGED:
-      event = AVRCP_EVENT_APP_SETTINGS_CHANGED;
+  switch (aState) {
+    case A2DP_CONNECTION_STATE_DISCONNECTED:
+      aString.AssignLiteral("disconnected");
+      break;
+    case A2DP_CONNECTION_STATE_CONNECTING:
+      aString.AssignLiteral("connecting");
+      break;
+    case A2DP_CONNECTION_STATE_CONNECTED:
+      aString.AssignLiteral("connected");
+      break;
+    case A2DP_CONNECTION_STATE_DISCONNECTING:
+      aString.AssignLiteral("disconnecting");
       break;
     default:
-      BT_LOGR("Unknown event 0x%x", aEventId);
+      BT_WARNING("Unknown sink state %d", static_cast<int>(aState));
       return;
   }
-
-  NS_DispatchToMainThread(new UpdateRegisterNotificationTask(event, aParam));
 }
 
-/*
- * Player application settings is optional for Avrcp 1.3
- * B2G 1.3 currently does not support Player application setting
- * related functions. Support Player Setting in the future version
- */
-static void
-AvrcpListPlayerAppAttributeCallback()
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-// TODO: Support avrcp application setting related functions
-}
-
-static void
-AvrcpListPlayerAppValuesCallback(btrc_player_attr_t aAttrId)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-// TODO: Support avrcp application setting related functions
-}
-
-static void
-AvrcpGetPlayerAppValueCallback(uint8_t aNumAttr,
-                               btrc_player_attr_t* aPlayerAttrs)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-// TODO: Support avrcp application setting related functions
-}
-
-static void
-AvrcpGetPlayerAppAttrsTextCallback(uint8_t aNumAttr,
-                                   btrc_player_attr_t* PlayerAttrs)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-// TODO: Support avrcp application setting related functions
-}
-
-static void
-AvrcpGetPlayerAppValuesTextCallback(uint8_t aAttrId, uint8_t aNumVal,
-                                    uint8_t* PlayerVals)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-// TODO: Support avrcp application setting related functions
-}
-
-static void
-AvrcpSetPlayerAppValueCallback(btrc_player_settings_t* aPlayerVals)
-{
-  MOZ_ASSERT(!NS_IsMainThread());
-
-// TODO: Support avrcp application setting related functions
-}
-#endif
-
-#if ANDROID_VERSION > 18
-/*
- * This callback function is to get CT features from Feature Bit Mask.
- * If Advanced Control Player bit is set, CT supports
- * volume sync (absolute volume feature). If Browsing bit is set, Avrcp 1.4
- * Browse feature will be supported
- */
-static void
-AvrcpRemoteFeaturesCallback(bt_bdaddr_t* aBdAddress,
-                            btrc_remote_features_t aFeatures)
-{
-// TODO: Support avrcp 1.4 absolute volume/browse
-}
-
-/*
- * This callback function is to get notification that volume changed on the
- * remote car kit (if it supports Avrcp 1.4), not notification from phone.
- */
-static void
-AvrcpRemoteVolumeChangedCallback(uint8_t aVolume, uint8_t aCType)
-{
-// TODO: Support avrcp 1.4 absolute volume/browse
-}
-
-/*
- * This callback function is to handle passthrough commands.
- */
-static void
-AvrcpPassThroughCallback(int aId, int aKeyState)
-{
-  // Fast-forward and rewind key events won't be generated from bluedroid
-  // stack after ANDROID_VERSION > 18, but via passthrough callback.
-  nsAutoString name;
-  NS_ENSURE_TRUE_VOID(aKeyState == AVRC_KEY_PRESS_STATE ||
-                      aKeyState == AVRC_KEY_RELEASE_STATE);
-  switch (aId) {
-    case AVRC_ID_FAST_FOR:
-      if (aKeyState == AVRC_KEY_PRESS_STATE) {
-        name.AssignLiteral("media-fast-forward-button-press");
-      } else {
-        name.AssignLiteral("media-fast-forward-button-release");
-      }
-      break;
-    case AVRC_ID_REWIND:
-      if (aKeyState == AVRC_KEY_PRESS_STATE) {
-        name.AssignLiteral("media-rewind-button-press");
-      } else {
-        name.AssignLiteral("media-rewind-button-release");
-      }
-      break;
-    default:
-      BT_WARNING("Unable to handle the unknown PassThrough command %d", aId);
-      break;
-  }
-  if (!name.IsEmpty()) {
-    NS_DispatchToMainThread(new UpdatePassthroughCmdTask(name));
-  }
-}
-#endif
-
-static btav_callbacks_t sBtA2dpCallbacks = {
-  sizeof(sBtA2dpCallbacks),
-  A2dpConnectionStateCallback,
-  A2dpAudioStateCallback
-};
-
-#if ANDROID_VERSION > 17
-static btrc_callbacks_t sBtAvrcpCallbacks = {
-  sizeof(sBtAvrcpCallbacks),
-#if ANDROID_VERSION > 18
-  AvrcpRemoteFeaturesCallback,
-#endif
-  AvrcpGetPlayStatusCallback,
-  AvrcpListPlayerAppAttributeCallback,
-  AvrcpListPlayerAppValuesCallback,
-  AvrcpGetPlayerAppValueCallback,
-  AvrcpGetPlayerAppAttrsTextCallback,
-  AvrcpGetPlayerAppValuesTextCallback,
-  AvrcpSetPlayerAppValueCallback,
-  AvrcpGetElementAttrCallback,
-  AvrcpRegisterNotificationCallback,
-#if ANDROID_VERSION > 18
-  AvrcpRemoteVolumeChangedCallback,
-  AvrcpPassThroughCallback
-#endif
-};
-#endif
-
 #if ANDROID_VERSION > 17
 class InitAvrcpResultHandler MOZ_FINAL : public BluetoothAvrcpResultHandler
 {
@@ -580,8 +187,8 @@ public:
       return;
     }
 
-    sBtAvrcpInterface->Init(&sBtAvrcpCallbacks,
-                            new InitAvrcpResultHandler(mRes));
+    BluetoothA2dpManager* a2dpManager = BluetoothA2dpManager::Get();
+    sBtAvrcpInterface->Init(a2dpManager, new InitAvrcpResultHandler(mRes));
 #else
     /* ...or signal success otherwise. */
     if (mRes) {
@@ -622,7 +229,8 @@ BluetoothA2dpManager::InitA2dpInterface(BluetoothProfileResultHandler* aRes)
     return;
   }
 
-  sBtA2dpInterface->Init(&sBtA2dpCallbacks, new InitA2dpResultHandler(aRes));
+  BluetoothA2dpManager* a2dpManager = BluetoothA2dpManager::Get();
+  sBtA2dpInterface->Init(a2dpManager, new InitA2dpResultHandler(aRes));
 }
 
 BluetoothA2dpManager::~BluetoothA2dpManager()
@@ -1327,5 +935,230 @@ BluetoothA2dpManager::GetArtist(nsAString& aArtist)
   aArtist.Assign(mArtist);
 }
 
+/*
+ * A2DP Notifications
+ */
+
+void
+BluetoothA2dpManager::ConnectionStateNotification(BluetoothA2dpConnectionState aState,
+                                                  const nsAString& aBdAddr)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsString a2dpState;
+  AvStatusToSinkString(aState, a2dpState);
+
+  InfallibleTArray<BluetoothNamedValue> props;
+  BT_APPEND_NAMED_VALUE(props, "State", a2dpState);
+
+  HandleSinkPropertyChanged(BluetoothSignal(NS_LITERAL_STRING("AudioSink"),
+                                            nsString(aBdAddr), props));
+}
+
+void
+BluetoothA2dpManager::AudioStateNotification(BluetoothA2dpAudioState aState,
+                                             const nsAString& aBdAddr)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsString a2dpState;
+
+  if (aState == A2DP_AUDIO_STATE_STARTED) {
+    a2dpState = NS_LITERAL_STRING("playing");
+  } else if (aState == A2DP_AUDIO_STATE_STOPPED) {
+    // for avdtp state stop stream
+    a2dpState = NS_LITERAL_STRING("connected");
+  } else if (aState == A2DP_AUDIO_STATE_REMOTE_SUSPEND) {
+    // for avdtp state suspend stream from remote side
+    a2dpState = NS_LITERAL_STRING("connected");
+  }
+
+  InfallibleTArray<BluetoothNamedValue> props;
+  BT_APPEND_NAMED_VALUE(props, "State", a2dpState);
+
+  HandleSinkPropertyChanged(BluetoothSignal(NS_LITERAL_STRING("AudioSink"),
+                                            nsString(aBdAddr), props));
+}
+
+/*
+ * AVRCP Notifications
+ */
+
+void
+BluetoothA2dpManager::GetPlayStatusNotification()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  BluetoothService* bs = BluetoothService::Get();
+  if (!bs) {
+    return;
+  }
+
+  bs->DistributeSignal(
+    BluetoothSignal(NS_LITERAL_STRING(REQUEST_MEDIA_PLAYSTATUS_ID),
+                    NS_LITERAL_STRING(KEY_ADAPTER),
+                    InfallibleTArray<BluetoothNamedValue>()));
+}
+
+/* Player application settings is optional for AVRCP 1.3. B2G
+ * currently does not support player-application-setting related
+ * functionality.
+ */
+void
+BluetoothA2dpManager::ListPlayerAppAttrNotification()
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP application-setting-related functions
+}
+
+void
+BluetoothA2dpManager::ListPlayerAppValuesNotification(
+  BluetoothAvrcpPlayerAttribute aAttrId)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP application-setting-related functions
+}
+
+void
+BluetoothA2dpManager::GetPlayerAppValueNotification(
+  uint8_t aNumAttrs, const BluetoothAvrcpPlayerAttribute* aAttrs)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP application-setting-related functions
+}
+
+void
+BluetoothA2dpManager::GetPlayerAppAttrsTextNotification(
+  uint8_t aNumAttrs, const BluetoothAvrcpPlayerAttribute* aAttrs)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP application-setting-related functions
+}
+
+void
+BluetoothA2dpManager::GetPlayerAppValuesTextNotification(
+  uint8_t aAttrId, uint8_t aNumVals, const uint8_t* aValues)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP application-setting-related functions
+}
+
+void
+BluetoothA2dpManager::SetPlayerAppValueNotification(
+  const BluetoothAvrcpPlayerSettings& aSettings)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP application-setting-related functions
+}
+
+/* This method returns element attributes, which are requested from
+ * CT. Unlike BlueZ it calls only UpdateMetaData. Bluedroid does not cache
+ * meta-data information, but instead uses |GetElementAttrNotifications|
+ * and |GetElementAttrRsp| request them.
+ */
+void
+BluetoothA2dpManager::GetElementAttrNotification(
+  uint8_t aNumAttrs, const BluetoothAvrcpMediaAttribute* aAttrs)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsAutoArrayPtr<BluetoothAvrcpElementAttribute> attrs(
+    new BluetoothAvrcpElementAttribute[aNumAttrs]);
+
+  for (uint8_t i = 0; i < aNumAttrs; ++i) {
+    attrs[i].mId = aAttrs[i];
+    ConvertAttributeString(
+      static_cast<BluetoothAvrcpMediaAttribute>(attrs[i].mId),
+      attrs[i].mValue);
+  }
+
+#if ANDROID_VERSION >= 18
+  MOZ_ASSERT(sBtAvrcpInterface);
+  sBtAvrcpInterface->GetElementAttrRsp(aNumAttrs, attrs, nullptr);
+#endif // ANDROID_VERSION >= 18
+}
+
+void
+BluetoothA2dpManager::RegisterNotificationNotification(
+  BluetoothAvrcpEvent aEvent, uint32_t aParam)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  BluetoothA2dpManager* a2dp = BluetoothA2dpManager::Get();
+  if (!a2dp) {
+    return;
+  }
+
+#if ANDROID_VERSION >= 18
+  a2dp->UpdateRegisterNotification(aEvent, aParam);
+#endif // ANDROID_VERSION >= 18
+}
+
+/* This method is used to get CT features from the Feature Bit Mask. If
+ * Advanced Control Player bit is set, the CT supports volume sync (absolute
+ * volume feature). If Browsing bit is set, AVRCP 1.4 Browse feature will be
+ * supported.
+ */
+void
+BluetoothA2dpManager::RemoteFeatureNotification(
+    const nsAString& aBdAddr, unsigned long aFeatures)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP 1.4 absolute volume/browse
+}
+
+/* This method is used to get notifications about volume changes on the
+ * remote car kit (if it supports AVRCP 1.4), not notification from phone.
+ */
+void
+BluetoothA2dpManager::VolumeChangeNotification(uint8_t aVolume,
+                                               uint8_t aCType)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // TODO: Support AVRCP 1.4 absolute volume/browse
+}
+
+void
+BluetoothA2dpManager::PassthroughCmdNotification(int aId, int aKeyState)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // Fast-forward and rewind key events won't be generated from bluedroid
+  // stack after ANDROID_VERSION > 18, but via passthrough callback.
+  nsAutoString name;
+  NS_ENSURE_TRUE_VOID(aKeyState == AVRC_KEY_PRESS_STATE ||
+                      aKeyState == AVRC_KEY_RELEASE_STATE);
+  switch (aId) {
+    case AVRC_ID_FAST_FOR:
+      if (aKeyState == AVRC_KEY_PRESS_STATE) {
+        name.AssignLiteral("media-fast-forward-button-press");
+      } else {
+        name.AssignLiteral("media-fast-forward-button-release");
+      }
+      break;
+    case AVRC_ID_REWIND:
+      if (aKeyState == AVRC_KEY_PRESS_STATE) {
+        name.AssignLiteral("media-rewind-button-press");
+      } else {
+        name.AssignLiteral("media-rewind-button-release");
+      }
+      break;
+    default:
+      BT_WARNING("Unable to handle the unknown PassThrough command %d", aId);
+      return;
+  }
+
+  NS_NAMED_LITERAL_STRING(type, "media-button");
+  BroadcastSystemMessage(type, BluetoothValue(name));
+}
+
 NS_IMPL_ISUPPORTS(BluetoothA2dpManager, nsIObserver)
 
diff --git a/dom/bluetooth2/bluedroid/BluetoothA2dpManager.h b/dom/bluetooth2/bluedroid/BluetoothA2dpManager.h
index b37decab42a..1c34607a5c6 100644
--- a/dom/bluetooth2/bluedroid/BluetoothA2dpManager.h
+++ b/dom/bluetooth2/bluedroid/BluetoothA2dpManager.h
@@ -8,11 +8,14 @@
 #define mozilla_dom_bluetooth_bluetootha2dpmanager_h__
 
 #include "BluetoothCommon.h"
+#include "BluetoothInterface.h"
 #include "BluetoothProfileController.h"
 #include "BluetoothProfileManagerBase.h"
 
 BEGIN_BLUETOOTH_NAMESPACE
 class BluetoothA2dpManager : public BluetoothProfileManagerBase
+                           , public BluetoothA2dpNotificationHandler
+                           , public BluetoothAvrcpNotificationHandler
 {
 public:
   BT_DECL_PROFILE_MGR_BASE
@@ -63,7 +66,6 @@ public:
   void GetArtist(nsAString& aArtist);
 
 private:
-  class SinkPropertyChangedHandler;
   BluetoothA2dpManager();
   void ResetA2dp();
   void ResetAvrcp();
@@ -71,6 +73,46 @@ private:
   void HandleShutdown();
   void NotifyConnectionStatusChanged();
 
+  void ConnectionStateNotification(BluetoothA2dpConnectionState aState,
+                                   const nsAString& aBdAddr) MOZ_OVERRIDE;
+  void AudioStateNotification(BluetoothA2dpAudioState aState,
+                              const nsAString& aBdAddr) MOZ_OVERRIDE;
+
+  void GetPlayStatusNotification() MOZ_OVERRIDE;
+
+  void ListPlayerAppAttrNotification() MOZ_OVERRIDE;
+
+  void ListPlayerAppValuesNotification(
+    BluetoothAvrcpPlayerAttribute aAttrId) MOZ_OVERRIDE;
+
+  void GetPlayerAppValueNotification(
+    uint8_t aNumAttrs,
+    const BluetoothAvrcpPlayerAttribute* aAttrs) MOZ_OVERRIDE;
+
+  void GetPlayerAppAttrsTextNotification(
+    uint8_t aNumAttrs,
+    const BluetoothAvrcpPlayerAttribute* aAttrs) MOZ_OVERRIDE;
+
+  void GetPlayerAppValuesTextNotification(
+    uint8_t aAttrId, uint8_t aNumVals, const uint8_t* aValues) MOZ_OVERRIDE;
+
+  void SetPlayerAppValueNotification(
+    const BluetoothAvrcpPlayerSettings& aSettings) MOZ_OVERRIDE;
+
+  void GetElementAttrNotification(
+    uint8_t aNumAttrs,
+    const BluetoothAvrcpMediaAttribute* aAttrs) MOZ_OVERRIDE;
+
+  void RegisterNotificationNotification(
+    BluetoothAvrcpEvent aEvent, uint32_t aParam) MOZ_OVERRIDE;
+
+  void RemoteFeatureNotification(
+    const nsAString& aBdAddr, unsigned long aFeatures) MOZ_OVERRIDE;
+
+  void VolumeChangeNotification(uint8_t aVolume, uint8_t aCType) MOZ_OVERRIDE;
+
+  void PassthroughCmdNotification(int aId, int aKeyState) MOZ_OVERRIDE;
+
   nsString mDeviceAddress;
   nsRefPtr<BluetoothProfileController> mController;
 
diff --git a/dom/bluetooth2/bluedroid/BluetoothInterface.cpp b/dom/bluetooth2/bluedroid/BluetoothInterface.cpp
index 6af87652fd4..cd19ff66c72 100644
--- a/dom/bluetooth2/bluedroid/BluetoothInterface.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothInterface.cpp
@@ -438,16 +438,6 @@ Convert(bt_device_type_t aIn, BluetoothDeviceType& aOut)
   return NS_OK;
 }
 
-static nsresult
-Convert(const bt_remote_version_t& aIn, BluetoothRemoteInfo& aOut)
-{
-  aOut.mVerMajor = aIn.version;
-  aOut.mVerMinor = aIn.sub_ver;
-  aOut.mManufacturer = aIn.manufacturer;
-
-  return NS_OK;
-}
-
 static nsresult
 Convert(const bt_service_record_t& aIn, BluetoothServiceRecord& aOut)
 {
@@ -715,7 +705,52 @@ Convert(bthf_volume_type_t aIn, BluetoothHandsfreeVolumeType& aOut)
   return NS_OK;
 }
 
+static nsresult
+Convert(btav_connection_state_t aIn, BluetoothA2dpConnectionState& aOut)
+{
+  static const BluetoothA2dpConnectionState sConnectionState[] = {
+    CONVERT(BTAV_CONNECTION_STATE_DISCONNECTED,
+      A2DP_CONNECTION_STATE_DISCONNECTED),
+    CONVERT(BTAV_CONNECTION_STATE_CONNECTING,
+      A2DP_CONNECTION_STATE_CONNECTING),
+    CONVERT(BTAV_CONNECTION_STATE_CONNECTED,
+      A2DP_CONNECTION_STATE_CONNECTED),
+    CONVERT(BTAV_CONNECTION_STATE_DISCONNECTING,
+      A2DP_CONNECTION_STATE_DISCONNECTING),
+  };
+  if (aIn >= MOZ_ARRAY_LENGTH(sConnectionState)) {
+    return NS_ERROR_ILLEGAL_VALUE;
+  }
+  aOut = sConnectionState[aIn];
+  return NS_OK;
+}
+
+static nsresult
+Convert(btav_audio_state_t aIn, BluetoothA2dpAudioState& aOut)
+{
+  static const BluetoothA2dpAudioState sAudioState[] = {
+    CONVERT(BTAV_AUDIO_STATE_REMOTE_SUSPEND, A2DP_AUDIO_STATE_REMOTE_SUSPEND),
+    CONVERT(BTAV_AUDIO_STATE_STOPPED, A2DP_AUDIO_STATE_STOPPED),
+    CONVERT(BTAV_AUDIO_STATE_STARTED, A2DP_AUDIO_STATE_STARTED),
+  };
+  if (aIn >= MOZ_ARRAY_LENGTH(sAudioState)) {
+    return NS_ERROR_ILLEGAL_VALUE;
+  }
+  aOut = sAudioState[aIn];
+  return NS_OK;
+}
+
 #if ANDROID_VERSION >= 18
+static nsresult
+Convert(const bt_remote_version_t& aIn, BluetoothRemoteInfo& aOut)
+{
+  aOut.mVerMajor = aIn.version;
+  aOut.mVerMinor = aIn.sub_ver;
+  aOut.mManufacturer = aIn.manufacturer;
+
+  return NS_OK;
+}
+
 static nsresult
 Convert(ControlPlayStatus aIn, btrc_play_status_t& aOut)
 {
@@ -749,6 +784,23 @@ Convert(enum BluetoothAvrcpPlayerAttribute aIn, btrc_player_attr_t& aOut)
   return NS_OK;
 }
 
+static nsresult
+Convert(btrc_player_attr_t aIn, enum BluetoothAvrcpPlayerAttribute& aOut)
+{
+  static const BluetoothAvrcpPlayerAttribute sPlayerAttr[] = {
+    CONVERT(0, static_cast<BluetoothAvrcpPlayerAttribute>(0)), // invalid, [0] required by gcc
+    CONVERT(BTRC_PLAYER_ATTR_EQUALIZER, AVRCP_PLAYER_ATTRIBUTE_EQUALIZER),
+    CONVERT(BTRC_PLAYER_ATTR_REPEAT, AVRCP_PLAYER_ATTRIBUTE_REPEAT),
+    CONVERT(BTRC_PLAYER_ATTR_SHUFFLE, AVRCP_PLAYER_ATTRIBUTE_SHUFFLE),
+    CONVERT(BTRC_PLAYER_ATTR_SCAN, AVRCP_PLAYER_ATTRIBUTE_SCAN)
+  };
+  if (!aIn || aIn >= MOZ_ARRAY_LENGTH(sPlayerAttr)) {
+    return NS_ERROR_ILLEGAL_VALUE;
+  }
+  aOut = sPlayerAttr[aIn];
+  return NS_OK;
+}
+
 static nsresult
 Convert(enum BluetoothAvrcpStatus aIn, btrc_status_t& aOut)
 {
@@ -784,6 +836,47 @@ Convert(enum BluetoothAvrcpEvent aIn, btrc_event_id_t& aOut)
   return NS_OK;
 }
 
+static nsresult
+Convert(btrc_event_id_t aIn, enum BluetoothAvrcpEvent& aOut)
+{
+  static const BluetoothAvrcpEvent sEventId[] = {
+    CONVERT(0, static_cast<BluetoothAvrcpEvent>(0)), // invalid, [0] required by gcc
+    CONVERT(BTRC_EVT_PLAY_STATUS_CHANGED, AVRCP_EVENT_PLAY_STATUS_CHANGED),
+    CONVERT(BTRC_EVT_TRACK_CHANGE, AVRCP_EVENT_TRACK_CHANGE),
+    CONVERT(BTRC_EVT_TRACK_REACHED_END, AVRCP_EVENT_TRACK_REACHED_END),
+    CONVERT(BTRC_EVT_TRACK_REACHED_START, AVRCP_EVENT_TRACK_REACHED_START),
+    CONVERT(BTRC_EVT_PLAY_POS_CHANGED, AVRCP_EVENT_PLAY_POS_CHANGED),
+    CONVERT(6, static_cast<BluetoothAvrcpEvent>(0)), // invalid, [6] required by gcc
+    CONVERT(7, static_cast<BluetoothAvrcpEvent>(0)), // invalid, [7] required by gcc
+    CONVERT(BTRC_EVT_APP_SETTINGS_CHANGED, AVRCP_EVENT_APP_SETTINGS_CHANGED)
+  };
+  if (!aIn || aIn >= MOZ_ARRAY_LENGTH(sEventId)) {
+    return NS_ERROR_ILLEGAL_VALUE;
+  }
+  aOut = sEventId[aIn];
+  return NS_OK;
+}
+
+static nsresult
+Convert(btrc_media_attr_t aIn, enum BluetoothAvrcpMediaAttribute& aOut)
+{
+  static const BluetoothAvrcpMediaAttribute sEventId[] = {
+    CONVERT(0, static_cast<BluetoothAvrcpMediaAttribute>(0)), // invalid, [0] required by gcc
+    CONVERT(BTRC_MEDIA_ATTR_TITLE, AVRCP_MEDIA_ATTRIBUTE_TITLE),
+    CONVERT(BTRC_MEDIA_ATTR_ARTIST, AVRCP_MEDIA_ATTRIBUTE_ARTIST),
+    CONVERT(BTRC_MEDIA_ATTR_ALBUM, AVRCP_MEDIA_ATTRIBUTE_ALBUM),
+    CONVERT(BTRC_MEDIA_ATTR_TRACK_NUM, AVRCP_MEDIA_ATTRIBUTE_TRACK_NUM),
+    CONVERT(BTRC_MEDIA_ATTR_NUM_TRACKS, AVRCP_MEDIA_ATTRIBUTE_NUM_TRACKS),
+    CONVERT(BTRC_MEDIA_ATTR_GENRE, AVRCP_MEDIA_ATTRIBUTE_GENRE),
+    CONVERT(BTRC_MEDIA_ATTR_PLAYING_TIME, AVRCP_MEDIA_ATTRIBUTE_PLAYING_TIME)
+  };
+  if (!aIn || aIn >= MOZ_ARRAY_LENGTH(sEventId)) {
+    return NS_ERROR_ILLEGAL_VALUE;
+  }
+  aOut = sEventId[aIn];
+  return NS_OK;
+}
+
 static nsresult
 Convert(enum BluetoothAvrcpNotification aIn, btrc_notification_type_t& aOut)
 {
@@ -811,7 +904,28 @@ Convert(const BluetoothAvrcpElementAttribute& aIn, btrc_element_attr_val_t& aOut
   return NS_OK;
 }
 
-#endif
+static nsresult
+Convert(const btrc_player_settings_t& aIn, BluetoothAvrcpPlayerSettings& aOut)
+{
+  aOut.mNumAttr = aIn.num_attr;
+  memcpy(aOut.mIds, aIn.attr_ids, aIn.num_attr);
+  memcpy(aOut.mValues, aIn.attr_values, aIn.num_attr);
+
+  return NS_OK;
+}
+#endif // ANDROID_VERSION >= 18
+
+#if ANDROID_VERSION >= 19
+static nsresult
+Convert(btrc_remote_features_t aIn, unsigned long& aOut)
+{
+  /* The input type's name is misleading. The converted value is
+   * actually a bitmask.
+   */
+  aOut = static_cast<unsigned long>(aIn);
+  return NS_OK;
+}
+#endif // ANDROID_VERSION >= 19
 
 /* |ConvertArray| is a helper for converting arrays. Pass an
  * instance of this structure as the first argument to |Convert|
@@ -2714,6 +2828,69 @@ DispatchBluetoothA2dpResult(
   return rv;
 }
 
+// Notification handling
+//
+
+BluetoothA2dpNotificationHandler::~BluetoothA2dpNotificationHandler()
+{ }
+
+static BluetoothA2dpNotificationHandler* sA2dpNotificationHandler;
+
+struct BluetoothA2dpCallback
+{
+  class A2dpNotificationHandlerWrapper
+  {
+  public:
+    typedef BluetoothA2dpNotificationHandler ObjectType;
+
+    static ObjectType* GetInstance()
+    {
+      MOZ_ASSERT(NS_IsMainThread());
+
+      return sA2dpNotificationHandler;
+    }
+  };
+
+  // Notifications
+
+  typedef BluetoothNotificationRunnable2<A2dpNotificationHandlerWrapper,
+                                         void,
+                                         BluetoothA2dpConnectionState,
+                                         nsString,
+                                         BluetoothA2dpConnectionState,
+                                         const nsAString&>
+    ConnectionStateNotification;
+
+  typedef BluetoothNotificationRunnable2<A2dpNotificationHandlerWrapper,
+                                         void,
+                                         BluetoothA2dpAudioState,
+                                         nsString,
+                                         BluetoothA2dpAudioState,
+                                         const nsAString&>
+    AudioStateNotification;
+
+  // Bluedroid A2DP callbacks
+
+  static void
+  ConnectionState(btav_connection_state_t aState, bt_bdaddr_t* aBdAddr)
+  {
+    ConnectionStateNotification::Dispatch(
+      &BluetoothA2dpNotificationHandler::ConnectionStateNotification,
+      aState, aBdAddr);
+  }
+
+  static void
+  AudioState(btav_audio_state_t aState, bt_bdaddr_t* aBdAddr)
+  {
+    AudioStateNotification::Dispatch(
+      &BluetoothA2dpNotificationHandler::AudioStateNotification,
+      aState, aBdAddr);
+  }
+};
+
+// Interface
+//
+
 BluetoothA2dpInterface::BluetoothA2dpInterface(
   const btav_interface_t* aInterface)
 : mInterface(aInterface)
@@ -2725,10 +2902,19 @@ BluetoothA2dpInterface::~BluetoothA2dpInterface()
 { }
 
 void
-BluetoothA2dpInterface::Init(btav_callbacks_t* aCallbacks,
-                             BluetoothA2dpResultHandler* aRes)
+BluetoothA2dpInterface::Init(
+  BluetoothA2dpNotificationHandler* aNotificationHandler,
+  BluetoothA2dpResultHandler* aRes)
 {
-  bt_status_t status = mInterface->init(aCallbacks);
+  static btav_callbacks_t sCallbacks = {
+    sizeof(sCallbacks),
+    BluetoothA2dpCallback::ConnectionState,
+    BluetoothA2dpCallback::AudioState
+  };
+
+  sA2dpNotificationHandler = aNotificationHandler;
+
+  bt_status_t status = mInterface->init(&sCallbacks);
 
   if (aRes) {
     DispatchBluetoothA2dpResult(aRes, &BluetoothA2dpResultHandler::Init,
@@ -2832,6 +3018,199 @@ DispatchBluetoothAvrcpResult(
   }
   return rv;
 }
+#endif
+
+// Notification handling
+//
+
+BluetoothAvrcpNotificationHandler::~BluetoothAvrcpNotificationHandler()
+{ }
+
+#if ANDROID_VERSION >= 18
+static BluetoothAvrcpNotificationHandler* sAvrcpNotificationHandler;
+
+struct BluetoothAvrcpCallback
+{
+  class AvrcpNotificationHandlerWrapper
+  {
+  public:
+    typedef BluetoothAvrcpNotificationHandler ObjectType;
+
+    static ObjectType* GetInstance()
+    {
+      MOZ_ASSERT(NS_IsMainThread());
+
+      return sAvrcpNotificationHandler;
+    }
+  };
+
+  // Notifications
+
+  typedef BluetoothNotificationRunnable0<AvrcpNotificationHandlerWrapper,
+                                         void>
+    GetPlayStatusNotification;
+
+  typedef BluetoothNotificationRunnable0<AvrcpNotificationHandlerWrapper,
+                                         void>
+    ListPlayerAppAttrNotification;
+
+  typedef BluetoothNotificationRunnable1<AvrcpNotificationHandlerWrapper,
+                                         void,
+                                         BluetoothAvrcpPlayerAttribute>
+    ListPlayerAppValuesNotification;
+
+  typedef BluetoothNotificationRunnable2<AvrcpNotificationHandlerWrapper, void,
+    uint8_t, nsAutoArrayPtr<BluetoothAvrcpPlayerAttribute>,
+    uint8_t, const BluetoothAvrcpPlayerAttribute*>
+    GetPlayerAppValueNotification;
+
+  typedef BluetoothNotificationRunnable2<AvrcpNotificationHandlerWrapper, void,
+    uint8_t, nsAutoArrayPtr<BluetoothAvrcpPlayerAttribute>,
+    uint8_t, const BluetoothAvrcpPlayerAttribute*>
+    GetPlayerAppAttrsTextNotification;
+
+  typedef BluetoothNotificationRunnable3<AvrcpNotificationHandlerWrapper,
+                                         void,
+                                         uint8_t, uint8_t,
+                                         nsAutoArrayPtr<uint8_t>,
+                                         uint8_t, uint8_t, const uint8_t*>
+    GetPlayerAppValuesTextNotification;
+
+  typedef BluetoothNotificationRunnable1<AvrcpNotificationHandlerWrapper,
+                                         void,
+                                         BluetoothAvrcpPlayerSettings,
+                                         const BluetoothAvrcpPlayerSettings&>
+    SetPlayerAppValueNotification;
+
+  typedef BluetoothNotificationRunnable2<AvrcpNotificationHandlerWrapper, void,
+    uint8_t, nsAutoArrayPtr<BluetoothAvrcpMediaAttribute>,
+    uint8_t, const BluetoothAvrcpMediaAttribute*>
+    GetElementAttrNotification;
+
+  typedef BluetoothNotificationRunnable2<AvrcpNotificationHandlerWrapper,
+                                         void,
+                                         BluetoothAvrcpEvent, uint32_t>
+    RegisterNotificationNotification;
+
+#if ANDROID_VERSION >= 19
+  typedef BluetoothNotificationRunnable2<AvrcpNotificationHandlerWrapper,
+                                         void,
+                                         nsString, unsigned long,
+                                         const nsAString&>
+    RemoteFeatureNotification;
+
+  typedef BluetoothNotificationRunnable2<AvrcpNotificationHandlerWrapper,
+                                         void,
+                                         uint8_t, uint8_t>
+    VolumeChangeNotification;
+
+  typedef BluetoothNotificationRunnable2<AvrcpNotificationHandlerWrapper,
+                                         void,
+                                         int, int>
+    PassthroughCmdNotification;
+#endif // ANDROID_VERSION >= 19
+
+  // Bluedroid AVRCP callbacks
+
+  static void
+  GetPlayStatus()
+  {
+    GetPlayStatusNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::GetPlayStatusNotification);
+  }
+
+  static void
+  ListPlayerAppAttr()
+  {
+    ListPlayerAppAttrNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::ListPlayerAppAttrNotification);
+  }
+
+  static void
+  ListPlayerAppValues(btrc_player_attr_t aAttrId)
+  {
+    ListPlayerAppValuesNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::ListPlayerAppValuesNotification,
+      aAttrId);
+  }
+
+  static void
+  GetPlayerAppValue(uint8_t aNumAttrs, btrc_player_attr_t* aAttrs)
+  {
+    GetPlayerAppValueNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::GetPlayerAppValueNotification,
+      aNumAttrs, ConvertArray<btrc_player_attr_t>(aAttrs, aNumAttrs));
+  }
+
+  static void
+  GetPlayerAppAttrsText(uint8_t aNumAttrs, btrc_player_attr_t* aAttrs)
+  {
+    GetPlayerAppAttrsTextNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::GetPlayerAppAttrsTextNotification,
+      aNumAttrs, ConvertArray<btrc_player_attr_t>(aAttrs, aNumAttrs));
+  }
+
+  static void
+  GetPlayerAppValuesText(uint8_t aAttrId, uint8_t aNumVals, uint8_t* aVals)
+  {
+    GetPlayerAppValuesTextNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::GetPlayerAppValuesTextNotification,
+      aAttrId, aNumVals, ConvertArray<uint8_t>(aVals, aNumVals));
+  }
+
+  static void
+  SetPlayerAppValue(btrc_player_settings_t* aVals)
+  {
+    SetPlayerAppValueNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::SetPlayerAppValueNotification,
+      *aVals);
+  }
+
+  static void
+  GetElementAttr(uint8_t aNumAttrs, btrc_media_attr_t* aAttrs)
+  {
+    GetElementAttrNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::GetElementAttrNotification,
+      aNumAttrs, ConvertArray<btrc_media_attr_t>(aAttrs, aNumAttrs));
+  }
+
+  static void
+  RegisterNotification(btrc_event_id_t aEvent, uint32_t aParam)
+  {
+    RegisterNotificationNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::RegisterNotificationNotification,
+      aEvent, aParam);
+  }
+
+#if ANDROID_VERSION >= 19
+  static void
+  RemoteFeature(bt_bdaddr_t* aBdAddr, btrc_remote_features_t aFeatures)
+  {
+    RemoteFeatureNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::RemoteFeatureNotification,
+      aBdAddr, aFeatures);
+  }
+
+  static void
+  VolumeChange(uint8_t aVolume, uint8_t aCType)
+  {
+    VolumeChangeNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::VolumeChangeNotification,
+      aVolume, aCType);
+  }
+
+  static void
+  PassthroughCmd(int aId, int aKeyState)
+  {
+    PassthroughCmdNotification::Dispatch(
+      &BluetoothAvrcpNotificationHandler::PassthroughCmdNotification,
+      aId, aKeyState);
+  }
+#endif // ANDROID_VERSION >= 19
+};
+
+// Interface
+//
 
 BluetoothAvrcpInterface::BluetoothAvrcpInterface(
   const btrc_interface_t* aInterface)
@@ -2844,10 +3223,34 @@ BluetoothAvrcpInterface::~BluetoothAvrcpInterface()
 { }
 
 void
-BluetoothAvrcpInterface::Init(btrc_callbacks_t* aCallbacks,
-                              BluetoothAvrcpResultHandler* aRes)
+BluetoothAvrcpInterface::Init(
+  BluetoothAvrcpNotificationHandler* aNotificationHandler,
+  BluetoothAvrcpResultHandler* aRes)
 {
-  bt_status_t status = mInterface->init(aCallbacks);
+  static btrc_callbacks_t sCallbacks = {
+    sizeof(sCallbacks),
+#if ANDROID_VERSION >= 19
+    BluetoothAvrcpCallback::RemoteFeature,
+#endif
+    BluetoothAvrcpCallback::GetPlayStatus,
+    BluetoothAvrcpCallback::ListPlayerAppAttr,
+    BluetoothAvrcpCallback::ListPlayerAppValues,
+    BluetoothAvrcpCallback::GetPlayerAppValue,
+    BluetoothAvrcpCallback::GetPlayerAppAttrsText,
+    BluetoothAvrcpCallback::GetPlayerAppValuesText,
+    BluetoothAvrcpCallback::SetPlayerAppValue,
+    BluetoothAvrcpCallback::GetElementAttr,
+    BluetoothAvrcpCallback::RegisterNotification
+#if ANDROID_VERSION >= 19
+    ,
+    BluetoothAvrcpCallback::VolumeChange,
+    BluetoothAvrcpCallback::PassthroughCmd
+#endif
+  };
+
+  sAvrcpNotificationHandler = aNotificationHandler;
+
+  bt_status_t status = mInterface->init(&sCallbacks);
 
   if (aRes) {
     DispatchBluetoothAvrcpResult(aRes, &BluetoothAvrcpResultHandler::Init,
diff --git a/dom/bluetooth2/bluedroid/BluetoothInterface.h b/dom/bluetooth2/bluedroid/BluetoothInterface.h
index 92cb877eee9..83ff5158da2 100644
--- a/dom/bluetooth2/bluedroid/BluetoothInterface.h
+++ b/dom/bluetooth2/bluedroid/BluetoothInterface.h
@@ -265,6 +265,26 @@ private:
 // Bluetooth Advanced Audio Interface
 //
 
+class BluetoothA2dpNotificationHandler
+{
+public:
+  virtual ~BluetoothA2dpNotificationHandler();
+
+  virtual void
+  ConnectionStateNotification(BluetoothA2dpConnectionState aState,
+                              const nsAString& aBdAddr)
+  { }
+
+  virtual void
+  AudioStateNotification(BluetoothA2dpAudioState aState,
+                         const nsAString& aBdAddr)
+  { }
+
+protected:
+  BluetoothA2dpNotificationHandler()
+  { }
+};
+
 class BluetoothA2dpResultHandler
 {
 public:
@@ -288,7 +308,7 @@ class BluetoothA2dpInterface
 public:
   friend class BluetoothInterface;
 
-  void Init(btav_callbacks_t *aCallbacks,
+  void Init(BluetoothA2dpNotificationHandler* aNotificationHandler,
             BluetoothA2dpResultHandler* aRes);
   void Cleanup(BluetoothA2dpResultHandler* aRes);
 
@@ -309,6 +329,69 @@ private:
 // Bluetooth AVRCP Interface
 //
 
+class BluetoothAvrcpNotificationHandler
+{
+public:
+  virtual ~BluetoothAvrcpNotificationHandler();
+
+  virtual void
+  GetPlayStatusNotification()
+  { }
+
+  virtual void
+  ListPlayerAppAttrNotification()
+  { }
+
+  virtual void
+  ListPlayerAppValuesNotification(BluetoothAvrcpPlayerAttribute aAttrId)
+  { }
+
+  virtual void
+  GetPlayerAppValueNotification(uint8_t aNumAttrs,
+                                const BluetoothAvrcpPlayerAttribute* aAttrs)
+  { }
+
+  virtual void
+  GetPlayerAppAttrsTextNotification(uint8_t aNumAttrs,
+                                    const BluetoothAvrcpPlayerAttribute* aAttrs)
+  { }
+
+  virtual void
+  GetPlayerAppValuesTextNotification(uint8_t aAttrId, uint8_t aNumVals,
+                                     const uint8_t* aValues)
+  { }
+
+  virtual void
+  SetPlayerAppValueNotification(const BluetoothAvrcpPlayerSettings& aSettings)
+  { }
+
+  virtual void
+  GetElementAttrNotification(uint8_t aNumAttrs,
+                             const BluetoothAvrcpMediaAttribute* aAttrs)
+  { }
+
+  virtual void
+  RegisterNotificationNotification(BluetoothAvrcpEvent aEvent,
+                                   uint32_t aParam)
+  { }
+
+  virtual void
+  RemoteFeatureNotification(const nsAString& aBdAddr, unsigned long aFeatures)
+  { }
+
+  virtual void
+  VolumeChangeNotification(uint8_t aVolume, uint8_t aCType)
+  { }
+
+  virtual void
+  PassthroughCmdNotification(int aId, int aKeyState)
+  { }
+
+protected:
+  BluetoothAvrcpNotificationHandler()
+  { }
+};
+
 class BluetoothAvrcpResultHandler
 {
 public:
@@ -348,7 +431,7 @@ class BluetoothAvrcpInterface
 public:
   friend class BluetoothInterface;
 
-  void Init(btrc_callbacks_t* aCallbacks,
+  void Init(BluetoothAvrcpNotificationHandler* aNotificationHandler,
             BluetoothAvrcpResultHandler* aRes);
   void Cleanup(BluetoothAvrcpResultHandler* aRes);
 
diff --git a/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp b/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp
index 8dffa8b4e20..91a9c6d0abf 100644
--- a/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothOppManager.cpp
@@ -751,6 +751,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aMessage);
 
+  const uint8_t* data = aMessage->GetData();
   int frameHeaderLength = 0;
 
   // See if this is the first part of each Put packet
@@ -759,8 +760,9 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     // [opcode:1][length:2][Headers:var]
     frameHeaderLength = 3;
 
-    mPacketLength = ((((int)aMessage->mData[1]) << 8) | aMessage->mData[2]) -
-                      frameHeaderLength;
+    mPacketLength = ((static_cast<int>(data[1]) << 8) | data[2]) -
+                    frameHeaderLength;
+
     /**
      * A PUT request from remote devices may be divided into multiple parts.
      * In other words, one request may need to be received multiple times,
@@ -771,7 +773,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     mPutFinalFlag = (aOpCode == ObexRequestCode::PutFinal);
   }
 
-  int dataLength = aMessage->mSize - frameHeaderLength;
+  int dataLength = aMessage->GetSize() - frameHeaderLength;
 
   // Check length before memcpy to prevent from memory pollution
   if (dataLength < 0 ||
@@ -786,7 +788,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   }
 
   memcpy(mReceivedDataBuffer.get() + mPutPacketReceivedLength,
-         &aMessage->mData[frameHeaderLength], dataLength);
+         &data[frameHeaderLength], dataLength);
 
   mPutPacketReceivedLength += dataLength;
 
@@ -799,12 +801,13 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   MOZ_ASSERT(NS_IsMainThread());
 
   uint8_t opCode;
-  int receivedLength = aMessage->mSize;
+  int receivedLength = aMessage->GetSize();
+  const uint8_t* data = aMessage->GetData();
 
   if (mPutPacketReceivedLength > 0) {
     opCode = mPutFinalFlag ? ObexRequestCode::PutFinal : ObexRequestCode::Put;
   } else {
-    opCode = aMessage->mData[0];
+    opCode = data[0];
 
     // When there's a Put packet right after a PutFinal packet,
     // which means it's the start point of a new file.
@@ -821,7 +824,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
     // Section 3.3.1 "Connect", IrOBEX 1.2
     // [opcode:1][length:2][version:1][flags:1][MaxPktSizeWeCanReceive:2]
     // [Headers:var]
-    if (!ParseHeaders(&aMessage->mData[7], receivedLength - 7, &pktHeaders)) {
+    if (!ParseHeaders(&data[7], receivedLength - 7, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -831,7 +834,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Abort) {
     // Section 3.3.5 "Abort", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -841,7 +844,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Disconnect) {
     // Section 3.3.2 "Disconnect", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -924,7 +927,8 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  uint8_t opCode = aMessage->mData[0];
+  const uint8_t* data = aMessage->GetData();
+  uint8_t opCode = data[0];
 
   // Check response code and send out system message as finished if the response
   // code is somehow incorrect.
@@ -981,10 +985,9 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
     AfterOppConnected();
 
     // Keep remote information
-    mRemoteObexVersion = aMessage->mData[3];
-    mRemoteConnectionFlags = aMessage->mData[4];
-    mRemoteMaxPacketLength =
-      (((int)(aMessage->mData[5]) << 8) | aMessage->mData[6]);
+    mRemoteObexVersion = data[3];
+    mRemoteConnectionFlags = data[4];
+    mRemoteMaxPacketLength = ((static_cast<int>(data[5]) << 8) | data[6]);
 
     // The length of file name exceeds maximum length.
     int fileNameByteLen = (mFileName.Length() + 1) * 2;
@@ -1253,8 +1256,7 @@ BluetoothOppManager::SendObexData(uint8_t* aData, uint8_t aOpcode, int aSize)
     mLastCommand = aOpcode;
   }
 
-  UnixSocketRawData* s = new UnixSocketRawData(aSize);
-  memcpy(s->mData, aData, s->mSize);
+  UnixSocketRawData* s = new UnixSocketRawData(aData, aSize);
   mSocket->SendSocketData(s);
 }
 
diff --git a/dom/bluetooth2/bluedroid/BluetoothSocket.cpp b/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
index a739d1d2a85..4494a69edaa 100644
--- a/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
@@ -319,10 +319,13 @@ DroidSocketImpl::OnSocketCanReceiveWithoutBlocking(int aFd)
   MOZ_ASSERT(!NS_IsMainThread());
   MOZ_ASSERT(!mShuttingDownOnIOThread);
 
-  nsresult rv = ReceiveData(aFd, this);
-  if (NS_FAILED(rv)) {
+  ssize_t res = ReceiveData(aFd, this);
+  if (res < 0) {
+    /* I/O error */
     RemoveWatchers(READ_WATCHER|WRITE_WATCHER);
-    return;
+  } else if (!res) {
+    /* EOF or peer shutdown */
+    RemoveWatchers(READ_WATCHER);
   }
 }
 
diff --git a/dom/bluetooth2/bluedroid/BluetoothUtils.cpp b/dom/bluetooth2/bluedroid/BluetoothUtils.cpp
index f19d2f9c87a..beedab0faa0 100644
--- a/dom/bluetooth2/bluedroid/BluetoothUtils.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothUtils.cpp
@@ -23,19 +23,6 @@
 
 BEGIN_BLUETOOTH_NAMESPACE
 
-void
-BdAddressTypeToString(bt_bdaddr_t* aBdAddressType, nsAString& aRetBdAddress)
-{
-  uint8_t* addr = aBdAddressType->address;
-  char bdstr[18];
-
-  sprintf(bdstr, "%02x:%02x:%02x:%02x:%02x:%02x",
-          (int)addr[0],(int)addr[1],(int)addr[2],
-          (int)addr[3],(int)addr[4],(int)addr[5]);
-
-  aRetBdAddress = NS_ConvertUTF8toUTF16(bdstr);
-}
-
 void
 UuidToString(const BluetoothUuid& aUuid, nsAString& aString)
 {
diff --git a/dom/bluetooth2/bluedroid/BluetoothUtils.h b/dom/bluetooth2/bluedroid/BluetoothUtils.h
index 2129c613952..9a736182d71 100644
--- a/dom/bluetooth2/bluedroid/BluetoothUtils.h
+++ b/dom/bluetooth2/bluedroid/BluetoothUtils.h
@@ -7,8 +7,6 @@
 #ifndef mozilla_dom_bluetooth_bluetoothutils_h__
 #define mozilla_dom_bluetooth_bluetoothutils_h__
 
-#include <hardware/bluetooth.h>
-
 #include "BluetoothCommon.h"
 #include "js/TypeDecls.h"
 
@@ -18,14 +16,6 @@ class BluetoothNamedValue;
 class BluetoothValue;
 class BluetoothReplyRunnable;
 
-void
-StringToBdAddressType(const nsAString& aBdAddress,
-                      bt_bdaddr_t *aRetBdAddressType);
-
-void
-BdAddressTypeToString(bt_bdaddr_t* aBdAddressType,
-                      nsAString& aRetBdAddress);
-
 void
 UuidToString(const BluetoothUuid& aUuid, nsAString& aString);
 
diff --git a/dom/bluetooth2/bluez/BluetoothHfpManager.cpp b/dom/bluetooth2/bluez/BluetoothHfpManager.cpp
index ffa1af38e47..cd9d4f9044e 100644
--- a/dom/bluetooth2/bluez/BluetoothHfpManager.cpp
+++ b/dom/bluetooth2/bluez/BluetoothHfpManager.cpp
@@ -707,7 +707,8 @@ BluetoothHfpManager::ReceiveSocketData(BluetoothSocket* aSocket,
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(aSocket);
 
-  nsAutoCString msg((const char*)aMessage->mData.get(), aMessage->mSize);
+  nsAutoCString msg(reinterpret_cast<const char*>(aMessage->GetData()),
+                    aMessage->GetSize());
   msg.StripWhitespace();
 
   nsTArray<nsCString> atCommandValues;
diff --git a/dom/bluetooth2/bluez/BluetoothOppManager.cpp b/dom/bluetooth2/bluez/BluetoothOppManager.cpp
index e1e4449fd72..19bccd4423e 100644
--- a/dom/bluetooth2/bluez/BluetoothOppManager.cpp
+++ b/dom/bluetooth2/bluez/BluetoothOppManager.cpp
@@ -774,6 +774,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   MOZ_ASSERT(aMessage);
 
   int frameHeaderLength = 0;
+  const uint8_t* data = aMessage->GetData();
 
   // See if this is the first part of each Put packet
   if (mPutPacketReceivedLength == 0) {
@@ -781,8 +782,8 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     // [opcode:1][length:2][Headers:var]
     frameHeaderLength = 3;
 
-    mPacketLength = ((((int)aMessage->mData[1]) << 8) | aMessage->mData[2]) -
-                      frameHeaderLength;
+    mPacketLength = ((static_cast<int>(data[1]) << 8) | data[2]) -
+                    frameHeaderLength;
     /**
      * A PUT request from remote devices may be divided into multiple parts.
      * In other words, one request may need to be received multiple times,
@@ -793,7 +794,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
     mPutFinalFlag = (aOpCode == ObexRequestCode::PutFinal);
   }
 
-  int dataLength = aMessage->mSize - frameHeaderLength;
+  int dataLength = aMessage->GetSize() - frameHeaderLength;
 
   // Check length before memcpy to prevent from memory pollution
   if (dataLength < 0 ||
@@ -808,7 +809,7 @@ BluetoothOppManager::ComposePacket(uint8_t aOpCode, UnixSocketRawData* aMessage)
   }
 
   memcpy(mReceivedDataBuffer.get() + mPutPacketReceivedLength,
-         &aMessage->mData[frameHeaderLength], dataLength);
+         &data[frameHeaderLength], dataLength);
 
   mPutPacketReceivedLength += dataLength;
 
@@ -821,12 +822,13 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   MOZ_ASSERT(NS_IsMainThread());
 
   uint8_t opCode;
-  int receivedLength = aMessage->mSize;
+  int receivedLength = aMessage->GetSize();
+  const uint8_t* data = aMessage->GetData();
 
   if (mPutPacketReceivedLength > 0) {
     opCode = mPutFinalFlag ? ObexRequestCode::PutFinal : ObexRequestCode::Put;
   } else {
-    opCode = aMessage->mData[0];
+    opCode = data[0];
 
     // When there's a Put packet right after a PutFinal packet,
     // which means it's the start point of a new file.
@@ -843,7 +845,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
     // Section 3.3.1 "Connect", IrOBEX 1.2
     // [opcode:1][length:2][version:1][flags:1][MaxPktSizeWeCanReceive:2]
     // [Headers:var]
-    if (!ParseHeaders(&aMessage->mData[7], receivedLength - 7, &pktHeaders)) {
+    if (!ParseHeaders(&data[7], receivedLength - 7, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -853,7 +855,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Abort) {
     // Section 3.3.5 "Abort", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -863,7 +865,7 @@ BluetoothOppManager::ServerDataHandler(UnixSocketRawData* aMessage)
   } else if (opCode == ObexRequestCode::Disconnect) {
     // Section 3.3.2 "Disconnect", IrOBEX 1.2
     // [opcode:1][length:2][Headers:var]
-    if (!ParseHeaders(&aMessage->mData[3], receivedLength - 3, &pktHeaders)) {
+    if (!ParseHeaders(&data[3], receivedLength - 3, &pktHeaders)) {
       ReplyError(ObexResponseCode::BadRequest);
       return;
     }
@@ -946,7 +948,8 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  uint8_t opCode = aMessage->mData[0];
+  const uint8_t* data = aMessage->GetData();
+  uint8_t opCode = data[0];
 
   // Check response code and send out system message as finished if the response
   // code is somehow incorrect.
@@ -1003,10 +1006,9 @@ BluetoothOppManager::ClientDataHandler(UnixSocketRawData* aMessage)
     AfterOppConnected();
 
     // Keep remote information
-    mRemoteObexVersion = aMessage->mData[3];
-    mRemoteConnectionFlags = aMessage->mData[4];
-    mRemoteMaxPacketLength =
-      (((int)(aMessage->mData[5]) << 8) | aMessage->mData[6]);
+    mRemoteObexVersion = data[3];
+    mRemoteConnectionFlags = data[4];
+    mRemoteMaxPacketLength = (static_cast<int>(data[5]) << 8) | data[6];
 
     // The length of file name exceeds maximum length.
     int fileNameByteLen = (mFileName.Length() + 1) * 2;
@@ -1274,8 +1276,7 @@ BluetoothOppManager::SendObexData(uint8_t* aData, uint8_t aOpcode, int aSize)
     mLastCommand = aOpcode;
   }
 
-  UnixSocketRawData* s = new UnixSocketRawData(aSize);
-  memcpy(s->mData, aData, s->mSize);
+  UnixSocketRawData* s = new UnixSocketRawData(aData, aSize);
   mSocket->SendSocketData(s);
 }
 
diff --git a/dom/canvas/CanvasRenderingContext2D.cpp b/dom/canvas/CanvasRenderingContext2D.cpp
index d29543d1a2c..2f9f254e62f 100644
--- a/dom/canvas/CanvasRenderingContext2D.cpp
+++ b/dom/canvas/CanvasRenderingContext2D.cpp
@@ -564,7 +564,7 @@ DrawTarget* CanvasRenderingContext2D::sErrorTarget = nullptr;
 
 
 CanvasRenderingContext2D::CanvasRenderingContext2D()
-  : mForceSoftware(false)
+  : mRenderingMode(RenderingMode::OpenGLBackendMode)
   // these are the default values from the Canvas spec
   , mWidth(0), mHeight(0)
   , mZero(false), mOpaque(false)
@@ -577,6 +577,12 @@ CanvasRenderingContext2D::CanvasRenderingContext2D()
 {
   sNumLivingContexts++;
   SetIsDOMBinding();
+
+  // The default is to use OpenGL mode
+  if (!gfxPlatform::GetPlatform()->UseAcceleratedSkiaCanvas()) {
+    mRenderingMode = RenderingMode::SoftwareBackendMode;
+  }
+
 }
 
 CanvasRenderingContext2D::~CanvasRenderingContext2D()
@@ -773,24 +779,25 @@ CanvasRenderingContext2D::RedrawUser(const gfxRect& r)
   Redraw(newr);
 }
 
-void CanvasRenderingContext2D::Demote()
+bool CanvasRenderingContext2D::SwitchRenderingMode(RenderingMode aRenderingMode)
 {
-  if (!IsTargetValid() || mForceSoftware || !mStream)
-    return;
-
-  RemoveDemotableContext(this);
+  if (!IsTargetValid() || mRenderingMode == aRenderingMode) {
+    return false;
+  }
 
   RefPtr<SourceSurface> snapshot = mTarget->Snapshot();
   RefPtr<DrawTarget> oldTarget = mTarget;
   mTarget = nullptr;
   mStream = nullptr;
   mResetLayer = true;
-  mForceSoftware = true;
 
-  // Recreate target, now demoted to software only
-  EnsureTarget();
+  // Recreate target using the new rendering mode
+  RenderingMode attemptedMode = EnsureTarget(aRenderingMode);
   if (!IsTargetValid())
-    return;
+    return false;
+
+  // We succeeded, so update mRenderingMode to reflect reality
+  mRenderingMode = attemptedMode;
 
   // Restore the content from the old DrawTarget
   mgfx::Rect r(0, 0, mWidth, mHeight);
@@ -802,6 +809,15 @@ void CanvasRenderingContext2D::Demote()
   }
 
   mTarget->SetTransform(oldTarget->GetTransform());
+
+  return true;
+}
+
+void CanvasRenderingContext2D::Demote()
+{
+  if (SwitchRenderingMode(RenderingMode::SoftwareBackendMode)) {
+    RemoveDemotableContext(this);
+  }
 }
 
 std::vector<CanvasRenderingContext2D*>&
@@ -821,7 +837,9 @@ CanvasRenderingContext2D::DemoteOldestContextIfNecessary()
     return;
 
   CanvasRenderingContext2D* oldest = contexts.front();
-  oldest->Demote();
+  if (oldest->SwitchRenderingMode(RenderingMode::SoftwareBackendMode)) {
+    RemoveDemotableContext(oldest);
+  }
 }
 
 void
@@ -913,11 +931,16 @@ CanvasRenderingContext2D::CheckSizeForSkiaGL(IntSize size) {
   return threshold < 0 || (size.width * size.height) <= threshold;
 }
 
-void
-CanvasRenderingContext2D::EnsureTarget()
+CanvasRenderingContext2D::RenderingMode
+CanvasRenderingContext2D::EnsureTarget(RenderingMode aRenderingMode)
 {
-  if (mTarget) {
-    return;
+  // This would make no sense, so make sure we don't get ourselves in a mess
+  MOZ_ASSERT(mRenderingMode != RenderingMode::DefaultBackendMode);
+
+  RenderingMode mode = (aRenderingMode == RenderingMode::DefaultBackendMode) ? mRenderingMode : aRenderingMode;
+
+  if (mTarget && mode == mRenderingMode) {
+    return mRenderingMode;
   }
 
    // Check that the dimensions are sane
@@ -938,9 +961,7 @@ CanvasRenderingContext2D::EnsureTarget()
     }
 
      if (layerManager) {
-      if (gfxPlatform::GetPlatform()->UseAcceleratedSkiaCanvas() &&
-          !mForceSoftware &&
-          CheckSizeForSkiaGL(size)) {
+      if (mode == RenderingMode::OpenGLBackendMode && CheckSizeForSkiaGL(size)) {
         DemoteOldestContextIfNecessary();
 
         SkiaGLGlue* glue = gfxPlatform::GetPlatform()->GetSkiaGLGlue();
@@ -954,6 +975,7 @@ CanvasRenderingContext2D::EnsureTarget()
             AddDemotableContext(this);
           } else {
             printf_stderr("Failed to create a SkiaGL DrawTarget, falling back to software\n");
+            mode = RenderingMode::SoftwareBackendMode;
           }
         }
 #endif
@@ -962,8 +984,10 @@ CanvasRenderingContext2D::EnsureTarget()
         }
       } else
         mTarget = layerManager->CreateDrawTarget(size, format);
+        mode = RenderingMode::SoftwareBackendMode;
      } else {
         mTarget = gfxPlatform::GetPlatform()->CreateOffscreenCanvasDrawTarget(size, format);
+        mode = RenderingMode::SoftwareBackendMode;
      }
   }
 
@@ -1002,6 +1026,8 @@ CanvasRenderingContext2D::EnsureTarget()
     EnsureErrorTarget();
     mTarget = sErrorTarget;
   }
+
+  return mode;
 }
 
 #ifdef DEBUG
@@ -1114,12 +1140,17 @@ CanvasRenderingContext2D::SetContextOptions(JSContext* aCx, JS::Handle<JS::Value
     return NS_OK;
   }
 
+  // This shouldn't be called before drawing starts, so there should be no drawtarget yet
+  MOZ_ASSERT(!mTarget);
+
   ContextAttributes2D attributes;
   NS_ENSURE_TRUE(attributes.Init(aCx, aOptions), NS_ERROR_UNEXPECTED);
 
   if (Preferences::GetBool("gfx.canvas.willReadFrequently.enable", false)) {
     // Use software when there is going to be a lot of readback
-    mForceSoftware = attributes.mWillReadFrequently;
+    if (attributes.mWillReadFrequently) {
+      mRenderingMode = RenderingMode::SoftwareBackendMode;
+    }
   }
 
   if (!attributes.mAlpha) {
@@ -3496,22 +3527,6 @@ CanvasRenderingContext2D::DrawDirectlyToCanvas(
   NS_ENSURE_SUCCESS_VOID(rv);
 }
 
-static bool
-IsStandardCompositeOp(CompositionOp op)
-{
-    return (op == CompositionOp::OP_SOURCE ||
-            op == CompositionOp::OP_ATOP ||
-            op == CompositionOp::OP_IN ||
-            op == CompositionOp::OP_OUT ||
-            op == CompositionOp::OP_OVER ||
-            op == CompositionOp::OP_DEST_IN ||
-            op == CompositionOp::OP_DEST_OUT ||
-            op == CompositionOp::OP_DEST_OVER ||
-            op == CompositionOp::OP_DEST_ATOP ||
-            op == CompositionOp::OP_ADD ||
-            op == CompositionOp::OP_XOR);
-}
-
 void
 CanvasRenderingContext2D::SetGlobalCompositeOperation(const nsAString& op,
                                                       ErrorResult& error)
@@ -3551,10 +3566,6 @@ CanvasRenderingContext2D::SetGlobalCompositeOperation(const nsAString& op,
   // XXX ERRMSG we need to report an error to developers here! (bug 329026)
   else return;
 
-  if (!IsStandardCompositeOp(comp_op)) {
-    Demote();
-  }
-
 #undef CANVAS_OP_TO_GFX_OP
   CurrentState().op = comp_op;
 }
@@ -3599,10 +3610,6 @@ CanvasRenderingContext2D::GetGlobalCompositeOperation(nsAString& op,
     error.Throw(NS_ERROR_FAILURE);
   }
 
-  if (!IsStandardCompositeOp(comp_op)) {
-    Demote();
-  }
-
 #undef CANVAS_OP_TO_GFX_OP
 }
 
diff --git a/dom/canvas/CanvasRenderingContext2D.h b/dom/canvas/CanvasRenderingContext2D.h
index a1fd4867e20..c6fdff3228b 100644
--- a/dom/canvas/CanvasRenderingContext2D.h
+++ b/dom/canvas/CanvasRenderingContext2D.h
@@ -457,6 +457,15 @@ public:
                            double h, const nsAString& bgColor, uint32_t flags,
                            mozilla::ErrorResult& error);
 
+  enum RenderingMode {
+    SoftwareBackendMode,
+    OpenGLBackendMode,
+    DefaultBackendMode
+  };
+
+  bool SwitchRenderingMode(RenderingMode aRenderingMode);
+
+  // Eventually this should be deprecated. Keeping for now to keep the binding functional.
   void Demote();
 
   nsresult Redraw();
@@ -644,8 +653,10 @@ protected:
    * in creating the target then it will put sErrorTarget in place. If there
    * is in turn an error in creating the sErrorTarget then they would both
    * be null so IsTargetValid() would still return null.
+   *
+   * Returns the actual rendering mode being used by the created target.
    */
-  void EnsureTarget();
+  RenderingMode EnsureTarget(RenderingMode aRenderMode = RenderingMode::DefaultBackendMode);
 
   /*
    * Disposes an old target and prepares to lazily create a new target.
@@ -688,8 +699,7 @@ protected:
   static void AddDemotableContext(CanvasRenderingContext2D* context);
   static void RemoveDemotableContext(CanvasRenderingContext2D* context);
 
-  // Do not use GL
-  bool mForceSoftware;
+  RenderingMode mRenderingMode;
 
   // Member vars
   int32_t mWidth, mHeight;
diff --git a/dom/canvas/WebGLContext.h b/dom/canvas/WebGLContext.h
index 546fa42d462..1a81486464e 100644
--- a/dom/canvas/WebGLContext.h
+++ b/dom/canvas/WebGLContext.h
@@ -534,15 +534,29 @@ public:
     // Allow whatever element types the bindings are willing to pass
     // us in TexSubImage2D
     template<class ElementType>
-    void TexSubImage2D(GLenum target, GLint level,
+    void TexSubImage2D(GLenum texImageTarget, GLint level,
                        GLint xoffset, GLint yoffset, GLenum format,
                        GLenum type, ElementType& elt, ErrorResult& rv)
     {
         if (IsContextLost())
             return;
 
+        const GLenum target = TexImageTargetToTexTarget(texImageTarget);
+        if (target == LOCAL_GL_NONE)
+            return ErrorInvalidEnumInfo("texSubImage2D: target", texImageTarget);
+
+        if (!ValidateTexImageFormatAndType(format, type, WebGLTexImageFunc::TexImage))
+            return;
+
+        if (level < 0)
+            return ErrorInvalidValue("texSubImage2D: level is negative");
+
+        const int32_t maxLevel = MaxTextureLevelForTexImageTarget(texImageTarget);
+        if (level > maxLevel)
+            return ErrorInvalidValue("texSubImage2D: level %d is too large, max is %d", level, maxLevel);
+
         // Trying to handle the video by GPU directly first
-        if (TexImageFromVideoElement(target, level, format, format, type, elt)) {
+        if (TexImageFromVideoElement(texImageTarget, level, format, format, type, elt)) {
             return;
         }
 
@@ -556,7 +570,7 @@ public:
 
         gfx::IntSize size = data->GetSize();
         uint32_t byteLength = data->Stride() * size.height;
-        return TexSubImage2D_base(target, level, xoffset, yoffset,
+        return TexSubImage2D_base(texImageTarget, level, xoffset, yoffset,
                                   size.width, size.height,
                                   data->Stride(), format, type,
                                   data->GetData(), byteLength,
diff --git a/dom/crypto/WebCryptoTask.cpp b/dom/crypto/WebCryptoTask.cpp
index 4c1b6d293b1..bad140e4d4a 100644
--- a/dom/crypto/WebCryptoTask.cpp
+++ b/dom/crypto/WebCryptoTask.cpp
@@ -2964,7 +2964,6 @@ WebCryptoTask::CreateUnwrapKeyTask(JSContext* aCx,
   }
 
   return new FailureTask(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
-
 }
 
 } // namespace dom
diff --git a/dom/devicestorage/nsDeviceStorage.cpp b/dom/devicestorage/nsDeviceStorage.cpp
index b2926ccbf1e..a3d7fe1bfd6 100644
--- a/dom/devicestorage/nsDeviceStorage.cpp
+++ b/dom/devicestorage/nsDeviceStorage.cpp
@@ -871,13 +871,17 @@ DeviceStorageFile::GetRootDirectoryForType(const nsAString& aStorageType,
   InitDirs();
 
 #ifdef MOZ_WIDGET_GONK
+  nsresult rv;
   nsString volMountPoint;
   if (DeviceStorageTypeChecker::IsVolumeBased(aStorageType)) {
     nsCOMPtr<nsIVolumeService> vs = do_GetService(NS_VOLUMESERVICE_CONTRACTID);
     NS_ENSURE_TRUE_VOID(vs);
-    nsresult rv;
     nsCOMPtr<nsIVolume> vol;
     rv = vs->GetVolumeByName(aStorageName, getter_AddRefs(vol));
+    if(NS_FAILED(rv)) {
+      printf_stderr("##### DeviceStorage: GetVolumeByName('%s') failed\n",
+                    NS_LossyConvertUTF16toASCII(aStorageName).get());
+    }
     NS_ENSURE_SUCCESS_VOID(rv);
     vol->GetMountPoint(volMountPoint);
   }
@@ -886,7 +890,12 @@ DeviceStorageFile::GetRootDirectoryForType(const nsAString& aStorageType,
   // Picture directory
   if (aStorageType.EqualsLiteral(DEVICESTORAGE_PICTURES)) {
 #ifdef MOZ_WIDGET_GONK
-    NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+    rv = NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+    if(NS_FAILED(rv)) {
+      printf_stderr("##### DeviceStorage: NS_NewLocalFile failed StorageType: '%s' path '%s'\n",
+                    NS_LossyConvertUTF16toASCII(volMountPoint).get(),
+                    NS_LossyConvertUTF16toASCII(aStorageType).get());
+    }
 #else
     f = sDirs->pictures;
 #endif
@@ -895,7 +904,12 @@ DeviceStorageFile::GetRootDirectoryForType(const nsAString& aStorageType,
   // Video directory
   else if (aStorageType.EqualsLiteral(DEVICESTORAGE_VIDEOS)) {
 #ifdef MOZ_WIDGET_GONK
-    NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+    rv = NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+    if(NS_FAILED(rv)) {
+      printf_stderr("##### DeviceStorage: NS_NewLocalFile failed StorageType: '%s' path '%s'\n",
+                    NS_LossyConvertUTF16toASCII(volMountPoint).get(),
+                    NS_LossyConvertUTF16toASCII(aStorageType).get());
+    }
 #else
     f = sDirs->videos;
 #endif
@@ -904,7 +918,12 @@ DeviceStorageFile::GetRootDirectoryForType(const nsAString& aStorageType,
   // Music directory
   else if (aStorageType.EqualsLiteral(DEVICESTORAGE_MUSIC)) {
 #ifdef MOZ_WIDGET_GONK
-    NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+    rv = NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+    if(NS_FAILED(rv)) {
+      printf_stderr("##### DeviceStorage: NS_NewLocalFile failed StorageType: '%s' path '%s'\n",
+                    NS_LossyConvertUTF16toASCII(volMountPoint).get(),
+                    NS_LossyConvertUTF16toASCII(aStorageType).get());
+    }
 #else
     f = sDirs->music;
 #endif
@@ -919,7 +938,12 @@ DeviceStorageFile::GetRootDirectoryForType(const nsAString& aStorageType,
    // default SDCard
    else if (aStorageType.EqualsLiteral(DEVICESTORAGE_SDCARD)) {
 #ifdef MOZ_WIDGET_GONK
-     NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+     rv = NS_NewLocalFile(volMountPoint, false, getter_AddRefs(f));
+     if(NS_FAILED(rv)) {
+       printf_stderr("##### DeviceStorage: NS_NewLocalFile failed StorageType: '%s' path '%s'\n",
+                     NS_LossyConvertUTF16toASCII(volMountPoint).get(),
+                     NS_LossyConvertUTF16toASCII(aStorageType).get());
+     }
 #else
      f = sDirs->sdcard;
 #endif
@@ -945,6 +969,12 @@ DeviceStorageFile::GetRootDirectoryForType(const nsAString& aStorageType,
 
   if (f) {
     f->Clone(aFile);
+  } else {
+    // This should never happen unless something is severely wrong. So
+    // scream a little.
+    printf_stderr("##### GetRootDirectoryForType('%s', '%s') failed #####",
+                  NS_LossyConvertUTF16toASCII(aStorageType).get(),
+                  NS_LossyConvertUTF16toASCII(aStorageName).get());
   }
 }
 
diff --git a/dom/events/ContentEventHandler.cpp b/dom/events/ContentEventHandler.cpp
index 65f48d9a3ff..8d895285844 100644
--- a/dom/events/ContentEventHandler.cpp
+++ b/dom/events/ContentEventHandler.cpp
@@ -507,9 +507,6 @@ ContentEventHandler::SetRangeFromFlatTextOffset(nsRange* aRange,
     }
 
     if (offset <= aOffset && aOffset < offset + textLength) {
-      nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(content));
-      NS_ASSERTION(domNode, "aContent doesn't have nsIDOMNode!");
-
       uint32_t xpOffset;
       if (!content->IsNodeOfType(nsINode::eTEXT)) {
         xpOffset = 0;
@@ -530,20 +527,18 @@ ContentEventHandler::SetRangeFromFlatTextOffset(nsRange* aRange,
         }
       }
 
-      rv = aRange->SetStart(domNode, int32_t(xpOffset));
+      rv = aRange->SetStart(content, int32_t(xpOffset));
       NS_ENSURE_SUCCESS(rv, rv);
       startSet = true;
       if (aLength == 0) {
         // Ensure that the end offset and the start offset are same.
-        rv = aRange->SetEnd(domNode, int32_t(xpOffset));
+        rv = aRange->SetEnd(content, int32_t(xpOffset));
         NS_ENSURE_SUCCESS(rv, rv);
         return NS_OK;
       }
     }
     if (endOffset <= offset + textLength) {
-      nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(content));
-      NS_ASSERTION(domNode, "aContent doesn't have nsIDOMNode!");
-
+      nsINode* endNode = content;
       uint32_t xpOffset;
       if (content->IsNodeOfType(nsINode::eTEXT)) {
         xpOffset = endOffset - offset;
@@ -562,10 +557,10 @@ ContentEventHandler::SetRangeFromFlatTextOffset(nsRange* aRange,
         if (iter->IsDone()) {
           break;
         }
-        domNode = do_QueryInterface(iter->GetCurrentNode());
+        endNode = iter->GetCurrentNode();
       }
 
-      rv = aRange->SetEnd(domNode, int32_t(xpOffset));
+      rv = aRange->SetEnd(endNode, int32_t(xpOffset));
       NS_ENSURE_SUCCESS(rv, rv);
       return NS_OK;
     }
@@ -577,17 +572,15 @@ ContentEventHandler::SetRangeFromFlatTextOffset(nsRange* aRange,
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(mRootContent));
-  NS_ASSERTION(domNode, "lastContent doesn't have nsIDOMNode!");
   if (!startSet) {
     MOZ_ASSERT(!mRootContent->IsNodeOfType(nsINode::eTEXT));
-    rv = aRange->SetStart(domNode, int32_t(mRootContent->GetChildCount()));
+    rv = aRange->SetStart(mRootContent, int32_t(mRootContent->GetChildCount()));
     NS_ENSURE_SUCCESS(rv, rv);
     if (aNewOffset) {
       *aNewOffset = offset;
     }
   }
-  rv = aRange->SetEnd(domNode, int32_t(mRootContent->GetChildCount()));
+  rv = aRange->SetEnd(mRootContent, int32_t(mRootContent->GetChildCount()));
   NS_ASSERTION(NS_SUCCEEDED(rv), "nsIDOMRange::SetEnd failed");
   return rv;
 }
diff --git a/dom/icc/tests/marionette/test_stk_send_dtmf.js b/dom/icc/tests/marionette/test_stk_send_dtmf.js
index 35298e42c2d..0acc02ec929 100644
--- a/dom/icc/tests/marionette/test_stk_send_dtmf.js
+++ b/dom/icc/tests/marionette/test_stk_send_dtmf.js
@@ -51,7 +51,7 @@ let tests = [
    expect: {name: "send_dtmf_cmd_3_without_alpha_identifier",
             commandQualifier: 0x00,
             iconSelfExplanatory: true,
-            icons: [colorIcon]}},
+            icons: [colorTransparencyIcon]}},
   {command: "d01c810301140082028183850953656e642044544d46ac02c1f29e020101",
    func: testSendDTMF,
    expect: {name: "send_dtmf_cmd_4_with_alpha_identifier",
@@ -64,7 +64,7 @@ let tests = [
    expect: {name: "send_dtmf_cmd_4_without_alpha_identifier",
             commandQualifier: 0x00,
             iconSelfExplanatory: false,
-            icons: [colorIcon]}},
+            icons: [colorTransparencyIcon]}},
   {command: "d028810301140082028183851980041704140420041004120421042204120423041904220415ac02c1f2",
    func: testSendDTMF,
    expect: {name: "send_dtmf_cmd_5_with_alpha_identifier",
diff --git a/dom/icc/tests/marionette/test_stk_setup_call.js b/dom/icc/tests/marionette/test_stk_setup_call.js
index 0f084b3339f..7c5746135ac 100644
--- a/dom/icc/tests/marionette/test_stk_setup_call.js
+++ b/dom/icc/tests/marionette/test_stk_setup_call.js
@@ -109,7 +109,7 @@ let tests = [
             address: "+012340123456,1,2",
             iconSelfExplanatory: false,
             icons: [colorIcon]}},
-  {command: "d04c81030110008202818385165365742075702063616c6c2049636f6e20332e342e318609911032042143651c2c9e02000185165365742075702063616c6c2049636f6e20332e342e329e020005",
+  {command: "d04c81030110008202818385165365742075702063616c6c2049636f6e20332e342e318609911032042143651c2c9e02000185165365742075702063616c6c2049636f6e20332e342e329e020001",
    func: testSetupCall,
    expect: {name: "setup_call_cmd_13",
             commandQualifier: 0x00,
@@ -117,7 +117,7 @@ let tests = [
             callMessage: "Set up call Icon 3.4.2",
             address: "+012340123456,1,2",
             iconSelfExplanatory: true,
-            icons: [colorTransparencyIcon]}},
+            icons: [basicIcon]}},
   {command: "d038810301100082028183850e434f4e4649524d4154494f4e20318609911032042143651c2c850643414c4c2031d004000e00b4d004000600b4",
    func: testSetupCall,
    expect: {name: "setup_call_cmd_14",
diff --git a/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js b/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js
index 8fb0d5999bf..7c7ead27019 100644
--- a/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js
+++ b/dom/icc/tests/marionette/test_stk_setup_idle_mode_text.js
@@ -49,7 +49,7 @@ let tests = [
             commandQualifier: 0x00,
             text: "Idle text",
             iconSelfExplanatory: false,
-            icons: [colorIcon]}},
+            icons: [colorTransparencyIcon]}},
   {command: "d0198103012800820281828d0a0449646c6520746578749e020007",
    func: testSetupIdleModeText,
    expect: {name: "setup_idle_mode_text_cmd_6",
diff --git a/dom/imptests/editing/selecttest/test_collapse.html b/dom/imptests/editing/selecttest/test_collapse.html
index cf86b094d2e..6e56265da05 100644
--- a/dom/imptests/editing/selecttest/test_collapse.html
+++ b/dom/imptests/editing/selecttest/test_collapse.html
@@ -81,7 +81,9 @@ for (var i = 0; i < testRanges.length; i++) {
 	}
 }
 
-generate_tests(testCollapse, tests);
+setup(function () {
+  generate_tests(testCollapse, tests);
+}, { timeout_multiplier: 2 });
 
 testDiv.style.display = "none";
 </script>
diff --git a/dom/indexedDB/KeyPath.cpp b/dom/indexedDB/KeyPath.cpp
index f139134a808..e3ad5b3d289 100644
--- a/dom/indexedDB/KeyPath.cpp
+++ b/dom/indexedDB/KeyPath.cpp
@@ -103,7 +103,7 @@ GetJSValFromKeyPathString(JSContext* aCx,
 
     NS_ASSERTION(!token.IsEmpty(), "Should be a valid keypath");
 
-    const jschar* keyPathChars = token.BeginReading();
+    const char16_t* keyPathChars = token.BeginReading();
     const size_t keyPathLen = token.Length();
 
     bool hasProp;
diff --git a/dom/inputmethod/forms.js b/dom/inputmethod/forms.js
index 151b3ee7316..2377cf1d5d7 100644
--- a/dom/inputmethod/forms.js
+++ b/dom/inputmethod/forms.js
@@ -18,6 +18,10 @@ XPCOMUtils.defineLazyServiceGetter(Services, "fm",
                                    "@mozilla.org/focus-manager;1",
                                    "nsIFocusManager");
 
+XPCOMUtils.defineLazyServiceGetter(Services, "threadManager",
+                                   "@mozilla.org/thread-manager;1",
+                                   "nsIThreadManager");
+
 XPCOMUtils.defineLazyGetter(this, "domWindowUtils", function () {
   return content.QueryInterface(Ci.nsIInterfaceRequestor)
                 .getInterface(Ci.nsIDOMWindowUtils);
@@ -250,9 +254,6 @@ let FormAssistant = {
         this._observer.disconnect();
         this._observer = null;
       }
-      if (!element) {
-        this.focusedElement.blur();
-      }
       if (this._selectionPrivate) {
         this._selectionPrivate.removeSelectionListener(this);
         this._selectionPrivate = null;
@@ -298,8 +299,9 @@ let FormAssistant = {
           });
         });
         if (del && element === self.focusedElement) {
-          // item was deleted, fake a blur so all state gets set correctly
-          self.handleEvent({ target: element, type: "blur" });
+          self.hideKeyboard();
+          self.selectionStart = -1;
+          self.selectionEnd = -1;
         }
       });
 
@@ -378,8 +380,13 @@ let FormAssistant = {
           break;
         }
         // fall through
-      case "blur":
       case "submit":
+        if (this.focusedElement) {
+          this.focusedElement.blur();
+        }
+        break;
+
+      case "blur":
         if (this.focusedElement) {
           this.hideKeyboard();
           this.selectionStart = -1;
@@ -434,6 +441,13 @@ let FormAssistant = {
     }
   },
 
+  waitForNextTick: function(callback) {
+    var tm = Services.threadManager;
+    tm.mainThread.dispatch({
+      run: callback,
+    }, Components.interfaces.nsIThread.DISPATCH_NORMAL);
+  },
+
   receiveMessage: function fa_receiveMessage(msg) {
     let target = this.focusedElement;
     let json = msg.json;
@@ -536,7 +550,10 @@ let FormAssistant = {
         break;
 
       case "Forms:Select:Blur": {
-        this.setFocusedElement(null);
+        if (this.focusedElement) {
+          this.focusedElement.blur();
+        }
+
         break;
       }
 
@@ -649,15 +666,35 @@ let FormAssistant = {
 
     this.setFocusedElement(target);
 
-    let kbOpened = this.sendKeyboardState(target);
-    if (this.isTextInputElement(target))
-      this.isKeyboardOpened = kbOpened;
+    let count = this._focusCounter;
+    this.waitForNextTick(function fa_showKeyboardSync() {
+      if (count !== this._focusCounter) {
+        return;
+      }
+
+      let kbOpened = this.sendKeyboardState(target);
+      if (this.isTextInputElement(target))
+        this.isKeyboardOpened = kbOpened;
+    }.bind(this));
   },
 
   hideKeyboard: function fa_hideKeyboard() {
-    sendAsyncMessage("Forms:Input", { "type": "blur" });
-    this.isKeyboardOpened = false;
     this.setFocusedElement(null);
+
+    let count = this._focusCounter;
+
+    // Wait for the next tick before unset the focused element and etc.
+    // If the user move from one input from another,
+    // the remote process should get one Forms:Input message instead of two.
+    this.waitForNextTick(function fa_hideKeyboardSync() {
+      if (count !== this._focusCounter ||
+          !this.isKeyboardOpened) {
+        return;
+      }
+
+      this.isKeyboardOpened = false;
+      sendAsyncMessage("Forms:Input", { "type": "blur" });
+    }.bind(this));
   },
 
   isFocusableElement: function fa_isFocusableElement(element) {
@@ -738,7 +775,7 @@ let FormAssistant = {
     // one to [0,0] and one to actual value. Both are sent in same tick.
     // Prevent firing two events in that scenario, always only use the last 1.
     //
-    // It is also a workaround for Bug 1053048, which prevents 
+    // It is also a workaround for Bug 1053048, which prevents
     // getSelectionInfo() accessing selectionStart or selectionEnd in the
     // callback function of nsISelectionListener::NotifySelectionChanged().
     if (this._selectionTimeout) {
diff --git a/dom/inputmethod/mochitest/mochitest.ini b/dom/inputmethod/mochitest/mochitest.ini
index 9e6de6b7f6b..b68912b15a6 100644
--- a/dom/inputmethod/mochitest/mochitest.ini
+++ b/dom/inputmethod/mochitest/mochitest.ini
@@ -19,3 +19,4 @@ support-files =
 [test_bug1043828.html]
 [test_delete_focused_element.html]
 [test_sendkey_cancel.html]
+[test_two_inputs.html]
diff --git a/dom/inputmethod/mochitest/test_delete_focused_element.html b/dom/inputmethod/mochitest/test_delete_focused_element.html
index e8d85290438..f940202b483 100644
--- a/dom/inputmethod/mochitest/test_delete_focused_element.html
+++ b/dom/inputmethod/mochitest/test_delete_focused_element.html
@@ -29,12 +29,17 @@ function appFrameScript() {
   content.document.body.appendChild(textarea);
 
   textarea.onfocus = function() {
-    textarea.parentNode.removeChild(textarea);
-    sendAsyncMessage('test:InputMethod:finished', {});
+    content.setTimeout(function() {
+      textarea.parentNode.removeChild(textarea);
+      sendAsyncMessage('test:InputMethod:finished', {});
+    }, 10);
   };
 
   content.setTimeout(function() {
-    textarea.focus();
+    content.setTimeout(function() {
+      textarea.focus();
+    }, 10);
+
     input.parentNode.removeChild(input);
   }, 0);
 }
diff --git a/dom/inputmethod/mochitest/test_two_inputs.html b/dom/inputmethod/mochitest/test_two_inputs.html
new file mode 100644
index 00000000000..803268ba8cb
--- /dev/null
+++ b/dom/inputmethod/mochitest/test_two_inputs.html
@@ -0,0 +1,151 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1057898
+-->
+<head>
+  <title>Test switching between two inputs</title>
+  <script type="application/javascript;version=1.7" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript;version=1.7" src="inputmethod_common.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1057898">Mozilla Bug 1057898</a>
+<p id="display"></p>
+<pre id="test">
+<script class="testbody" type="application/javascript;version=1.7">
+
+inputmethod_setup(function() {
+  runTest();
+});
+
+let appFrameScript = function appFrameScript() {
+  let input1 = content.document.body.firstElementChild;
+  let input2 = content.document.body.children[1];
+
+  let i = 1;
+
+  input1.focus();
+
+  addMessageListener('test:next', function() {
+    i++;
+    switch (i) {
+      case 2:
+        input2.focus();
+
+        break;
+
+      case 3:
+        input2.blur();
+        input2.focus();
+
+        break;
+
+      case 4:
+        input2.blur();
+
+        break;
+
+      case 5:
+        input2.focus();
+        input2.blur();
+
+        input1.focus();
+
+        break;
+
+      case 6:
+        input1.blur();
+
+        break;
+    }
+  });
+};
+
+function runTest() {
+  let im = navigator.mozInputMethod;
+
+  let i = 0;
+  im.oninputcontextchange = function(evt) {
+    var inputcontext = navigator.mozInputMethod.inputcontext;
+
+    i++;
+    switch (i) {
+      // focus on the first input receives the first input context.
+      case 1:
+        ok(!!inputcontext, 'Receving the first input context');
+        is(inputcontext.textAfterCursor, 'First');
+
+        mm.sendAsyncMessage('test:next');
+        break;
+
+      // focus on the second input (implicitly blur the first input)
+      // results the second input context.
+      case 2:
+        ok(!!inputcontext, 'Receving the second input context');
+        is(inputcontext.textAfterCursor, 'Second');
+
+
+        mm.sendAsyncMessage('test:next');
+        break;
+
+      // blur and re-focus on the second input results updated
+      // input context for the second input.
+      case 3:
+        ok(!!inputcontext, 'Receving the second input context');
+        is(inputcontext.textAfterCursor, 'Second');
+
+        mm.sendAsyncMessage('test:next');
+        break;
+
+      // blur on the second input results null input context
+      case 4:
+        is(inputcontext, null, 'Receving null inputcontext');
+
+        mm.sendAsyncMessage('test:next');
+        break;
+
+      // focus and blur on the second input sends no message;
+      // focus on the first input receives the first input context.
+      case 5:
+        ok(!!inputcontext, 'Receving the first input context');
+        is(inputcontext.textAfterCursor, 'First');
+
+        mm.sendAsyncMessage('test:next');
+        break;
+
+      // blur on the first input results null input context
+      case 6:
+        is(inputcontext, null, 'Receving null inputcontext');
+
+        inputmethod_cleanup();
+        break;
+
+      default:
+        ok(false, 'Receving extra inputcontextchange calls');
+        inputmethod_cleanup();
+
+        break;
+    }
+  };
+
+  // Set current page as an input method.
+  SpecialPowers.wrap(im).setActive(true);
+
+  let iframe = document.createElement('iframe');
+  iframe.src = 'data:text/html,<html><body><input value="First"><input value="Second"></body></html>';
+  iframe.setAttribute('mozbrowser', true);
+  document.body.appendChild(iframe);
+
+  let mm = SpecialPowers.getBrowserFrameMessageManager(iframe);
+
+  iframe.addEventListener('mozbrowserloadend', function() {
+    mm.loadFrameScript('data:,(' + encodeURIComponent(appFrameScript.toString()) + ')();', false);
+  });
+}
+
+</script>
+</pre>
+</body>
+</html>
+
diff --git a/dom/interfaces/base/moz.build b/dom/interfaces/base/moz.build
index b9a5b20fd3a..c1422f6e69d 100644
--- a/dom/interfaces/base/moz.build
+++ b/dom/interfaces/base/moz.build
@@ -38,15 +38,5 @@ XPIDL_SOURCES += [
     'nsITabParent.idl',
 ]
 
-if CONFIG['MOZ_B2G']:
-    XPIDL_SOURCES += [
-        'nsIDOMWindowB2G.idl',
-    ]
-
-if CONFIG['MOZ_WEBSPEECH']:
-    XPIDL_SOURCES += [
-        'nsISpeechSynthesisGetter.idl'
-    ]
-
 XPIDL_MODULE = 'dom_base'
 
diff --git a/dom/interfaces/base/nsIDOMWindow.idl b/dom/interfaces/base/nsIDOMWindow.idl
index 4b0fdc4d8c3..5d8134e8350 100644
--- a/dom/interfaces/base/nsIDOMWindow.idl
+++ b/dom/interfaces/base/nsIDOMWindow.idl
@@ -23,7 +23,7 @@ interface nsIVariant;
  * @see <http://www.whatwg.org/html/#window>
  */
 
-[scriptable, uuid(ed7cc4e4-cf5b-42af-9c2e-8df074a01470)]
+[scriptable, uuid(3addc629-754d-4a2a-99a3-449ed1a2e4bd)]
 interface nsIDOMWindow : nsISupports
 {
   // the current browsing context
@@ -478,56 +478,12 @@ interface nsIDOMWindow : nsISupports
    */
   readonly attribute long long mozAnimationStartTime;
 
-  /**
-   * HTML5 event attributes that only apply to windows and <body>/<frameset>
-   */
-  [implicit_jscontext] attribute jsval onafterprint;
-  [implicit_jscontext] attribute jsval onbeforeprint;
-  [implicit_jscontext] attribute jsval onbeforeunload;
-  [implicit_jscontext] attribute jsval onhashchange;
-  [implicit_jscontext] attribute jsval onlanguagechange;
-  [implicit_jscontext] attribute jsval onmessage;
-  [implicit_jscontext] attribute jsval onoffline;
-  [implicit_jscontext] attribute jsval ononline;
-  [implicit_jscontext] attribute jsval onpopstate;
-  [implicit_jscontext] attribute jsval onpagehide;
-  [implicit_jscontext] attribute jsval onpageshow;
-  // Not supported yet
-  // [implicit_jscontext] attribute jsval onredo;
-  [implicit_jscontext] attribute jsval onresize;
-  // Not supported yet
-  // [implicit_jscontext] attribute jsval onstorage;
-  // Not supported yet
-  // [implicit_jscontext] attribute jsval onundo;
-  [implicit_jscontext] attribute jsval onunload;
-
-  /**
-   * Non-HTML5 window-specific event attributes
-   */
-  [implicit_jscontext] attribute jsval ondevicemotion;
-  [implicit_jscontext] attribute jsval ondeviceorientation;
-  [implicit_jscontext] attribute jsval ondeviceproximity;
-  [implicit_jscontext] attribute jsval onuserproximity;
-  [implicit_jscontext] attribute jsval ondevicelight;
-
-  [implicit_jscontext] attribute jsval onmouseenter;
-  [implicit_jscontext] attribute jsval onmouseleave;
-
   /**
    * Console API
    */
   [implicit_jscontext] attribute jsval console;
 };
 
-[scriptable, uuid(2146c906-57f7-486c-a1b4-8cdb57ef577f)]
-interface nsIDOMWindowPerformance : nsISupports
-{
-  /**
-   * A namespace to hold performance related data and statistics.
-   */
-  readonly attribute nsISupports performance;
-};
-
 /**
  * Empty interface for compatibility with older versions.
  * @deprecated Use nsIDOMWindow instead
diff --git a/dom/interfaces/base/nsIDOMWindowB2G.idl b/dom/interfaces/base/nsIDOMWindowB2G.idl
deleted file mode 100644
index f5bfcc90dbd..00000000000
--- a/dom/interfaces/base/nsIDOMWindowB2G.idl
+++ /dev/null
@@ -1,14 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-[scriptable, uuid(96bde2ae-9b74-4f4d-b674-664a67a35b7e)]
-interface nsIDOMWindowB2G : nsISupports
-{
-  [implicit_jscontext] attribute jsval onmoztimechange;
-  [implicit_jscontext] attribute jsval onmoznetworkupload;
-  [implicit_jscontext] attribute jsval onmoznetworkdownload;
-};
\ No newline at end of file
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index 8b17b15f4ee..f7acd3f8dac 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -51,7 +51,7 @@ interface nsITranslationNodeList;
 interface nsIJSRAIIHelper;
 interface nsIContentPermissionRequest;
 
-[scriptable, uuid(11911980-607c-4efd-aacc-de3b9005c058)]
+[scriptable, uuid(669095d8-1b96-472f-a48d-022adde26cfd)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -1673,6 +1673,18 @@ interface nsIDOMWindowUtils : nsISupports {
     */
    AString getOMTAStyle(in nsIDOMElement aElement, in AString aProperty);
 
+   /**
+    * Special function that gets a property syncronously from the last composite
+    * that occured.
+    *
+    * Supported properties:
+    *   "overdraw": Report a percentage between 0 and 999 indicate how many times
+    *               each pixels on the destination window have been touched.
+    *   "missed_hwc": Report a bool if hardware composer is supported but was
+    *                 not used for the last frame.
+    */
+   float requestCompositorProperty(in AString aProperty);
+
    /**
     * If aHandlingInput is true, this informs the event state manager that
     * we're handling user input. Otherwise, this is a no-op (as by default
diff --git a/dom/interfaces/base/nsISpeechSynthesisGetter.idl b/dom/interfaces/base/nsISpeechSynthesisGetter.idl
deleted file mode 100644
index 21611d6bf54..00000000000
--- a/dom/interfaces/base/nsISpeechSynthesisGetter.idl
+++ /dev/null
@@ -1,17 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-/**
- * SpeechSynthesisGetter
- * http://dvcs.w3.org/hg/speech-api/raw-file/tip/speechapi.html#tts-section
- */
-
-[scriptable, uuid(31e6c818-0279-4948-843c-930043f6bafd)]
-interface nsISpeechSynthesisGetter : nsISupports
-{
-  readonly attribute nsISupports speechSynthesis;
-};
diff --git a/dom/interfaces/core/moz.build b/dom/interfaces/core/moz.build
index ffbdc976a57..0f25720b299 100644
--- a/dom/interfaces/core/moz.build
+++ b/dom/interfaces/core/moz.build
@@ -23,7 +23,6 @@ XPIDL_SOURCES += [
     'nsIDOMText.idl',
     'nsIDOMUserDataHandler.idl',
     'nsIDOMXMLDocument.idl',
-    'nsIInlineEventHandlers.idl',
 ]
 
 XPIDL_MODULE = 'dom_core'
diff --git a/dom/interfaces/core/nsIInlineEventHandlers.idl b/dom/interfaces/core/nsIInlineEventHandlers.idl
deleted file mode 100644
index 38ef4c6b78b..00000000000
--- a/dom/interfaces/core/nsIInlineEventHandlers.idl
+++ /dev/null
@@ -1,93 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-#include "domstubs.idl"
-
-%{ C++
-#include "jspubtd.h"
-%}
-
-[scriptable, uuid(6c1fcf3d-119b-4cf4-9437-b9357508976a)]
-interface nsIInlineEventHandlers : nsISupports
-{
-  [implicit_jscontext] attribute jsval onabort;
-  [implicit_jscontext] attribute jsval onblur;
-  [implicit_jscontext] attribute jsval oncanplay;
-  [implicit_jscontext] attribute jsval oncanplaythrough;
-  [implicit_jscontext] attribute jsval onchange;
-  [implicit_jscontext] attribute jsval onclick;
-  [implicit_jscontext] attribute jsval oncontextmenu;
-  // Not supported yet
-  // [implicit_jscontext] attribute jsval oncuechange;
-  [implicit_jscontext] attribute jsval ondblclick;
-  [implicit_jscontext] attribute jsval ondrag;
-  [implicit_jscontext] attribute jsval ondragend;
-  [implicit_jscontext] attribute jsval ondragenter;
-  [implicit_jscontext] attribute jsval ondragleave;
-  [implicit_jscontext] attribute jsval ondragover;
-  [implicit_jscontext] attribute jsval ondragstart;
-  [implicit_jscontext] attribute jsval ondrop;
-  [implicit_jscontext] attribute jsval ondurationchange;
-  [implicit_jscontext] attribute jsval onemptied;
-  [implicit_jscontext] attribute jsval onended;
-  [implicit_jscontext] attribute jsval onerror;
-  [implicit_jscontext] attribute jsval onfocus;
-  [implicit_jscontext] attribute jsval oninput;
-  [implicit_jscontext] attribute jsval oninvalid;
-  [implicit_jscontext] attribute jsval onkeydown;
-  [implicit_jscontext] attribute jsval onkeypress;
-  [implicit_jscontext] attribute jsval onkeyup;
-  [implicit_jscontext] attribute jsval onload;
-  [implicit_jscontext] attribute jsval onloadeddata;
-  [implicit_jscontext] attribute jsval onloadedmetadata;
-  [implicit_jscontext] attribute jsval onloadstart;
-  [implicit_jscontext] attribute jsval onmousedown;
-  [implicit_jscontext] attribute jsval onmousemove;
-  [implicit_jscontext] attribute jsval onmouseout;
-  [implicit_jscontext] attribute jsval onmouseover;
-  [implicit_jscontext] attribute jsval onmouseup;
-  // Not supported yet
-  // [implicit_jscontext] attribute jsval onmousewheel;
-  [implicit_jscontext] attribute jsval onmozfullscreenchange;
-  [implicit_jscontext] attribute jsval onmozfullscreenerror;
-  [implicit_jscontext] attribute jsval onmozpointerlockchange;
-  [implicit_jscontext] attribute jsval onmozpointerlockerror;
-  [implicit_jscontext] attribute jsval onpause;
-  [implicit_jscontext] attribute jsval onplay;
-  [implicit_jscontext] attribute jsval onplaying;
-  [implicit_jscontext] attribute jsval onprogress;
-  [implicit_jscontext] attribute jsval onratechange;
-  [implicit_jscontext] attribute jsval onreset;
-  [implicit_jscontext] attribute jsval onscroll;
-  [implicit_jscontext] attribute jsval onseeked;
-  [implicit_jscontext] attribute jsval onseeking;
-  [implicit_jscontext] attribute jsval onselect;
-  [implicit_jscontext] attribute jsval onshow;
-  [implicit_jscontext] attribute jsval onstalled;
-  [implicit_jscontext] attribute jsval onsubmit;
-  [implicit_jscontext] attribute jsval onsuspend;
-  [implicit_jscontext] attribute jsval ontimeupdate;
-  [implicit_jscontext] attribute jsval onvolumechange;
-  [implicit_jscontext] attribute jsval onwaiting;
-  [implicit_jscontext] attribute jsval onwheel;
-
-  [implicit_jscontext] attribute jsval onpointerdown;
-  [implicit_jscontext] attribute jsval onpointermove;
-  [implicit_jscontext] attribute jsval onpointerout;
-  [implicit_jscontext] attribute jsval onpointerover;
-  [implicit_jscontext] attribute jsval onpointerup;
-  [implicit_jscontext] attribute jsval onpointerenter;
-  [implicit_jscontext] attribute jsval onpointerleave;
-  [implicit_jscontext] attribute jsval ongotpointercapture;
-  [implicit_jscontext] attribute jsval onlostpointercapture;
-  [implicit_jscontext] attribute jsval onpointercancel;
-
-  /**
-   * Non-HTML5 event attributes
-   */
-  [implicit_jscontext] attribute jsval oncopy;
-  [implicit_jscontext] attribute jsval oncut;
-  [implicit_jscontext] attribute jsval onpaste;
-  [implicit_jscontext] attribute jsval onbeforescriptexecute;
-  [implicit_jscontext] attribute jsval onafterscriptexecute;  
-};
diff --git a/dom/interfaces/events/moz.build b/dom/interfaces/events/moz.build
index 6f8d9538ee1..1030ab8c6e9 100644
--- a/dom/interfaces/events/moz.build
+++ b/dom/interfaces/events/moz.build
@@ -28,7 +28,6 @@ XPIDL_SOURCES += [
     'nsIDOMPaintRequest.idl',
     'nsIDOMScrollAreaEvent.idl',
     'nsIDOMSimpleGestureEvent.idl',
-    'nsIDOMTouchEvent.idl',
     'nsIDOMTransitionEvent.idl',
     'nsIDOMUIEvent.idl',
     'nsIDOMWheelEvent.idl',
diff --git a/dom/interfaces/events/nsIDOMTouchEvent.idl b/dom/interfaces/events/nsIDOMTouchEvent.idl
deleted file mode 100644
index fa619cd2f12..00000000000
--- a/dom/interfaces/events/nsIDOMTouchEvent.idl
+++ /dev/null
@@ -1,19 +0,0 @@
-/* vim: set shiftwidth=2 tabstop=8 autoindent cindent expandtab: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIDOMUIEvent.idl"
-%{C++
-#include "nsWeakPtr.h"
-#include "nsPoint.h"
-%}
-interface nsIVariant;
-
-[scriptable, uuid(6d5484f7-92ac-45f8-9388-39b5bad055ce)]
-interface nsITouchEventReceiver : nsISupports {
-  [implicit_jscontext] attribute jsval           ontouchstart;
-  [implicit_jscontext] attribute jsval           ontouchend;
-  [implicit_jscontext] attribute jsval           ontouchmove;
-  [implicit_jscontext] attribute jsval           ontouchcancel;
-};
diff --git a/dom/interfaces/html/nsIDOMHTMLImageElement.idl b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
index 1419ed73258..64574ca794c 100644
--- a/dom/interfaces/html/nsIDOMHTMLImageElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLImageElement.idl
@@ -16,14 +16,13 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[uuid(e83e726a-0aef-4292-938b-253fec691e2f)]
+[uuid(ec18e71c-4f5c-4cc3-aa36-5273168644dc)]
 interface nsIDOMHTMLImageElement : nsISupports
 {
            attribute DOMString        alt;
            attribute DOMString        src;
            attribute DOMString        srcset;
            attribute DOMString        sizes;
-           attribute DOMString        crossOrigin;
            attribute DOMString        useMap;
            attribute boolean          isMap;
            attribute unsigned long    width;
diff --git a/dom/interfaces/html/nsIDOMHTMLLinkElement.idl b/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
index f0ca17bcffa..27cc8fae35d 100644
--- a/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLLinkElement.idl
@@ -16,7 +16,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[uuid(95d6ec66-2754-45bd-a068-49ac1fb45004)]
+[uuid(ee50b7ab-0015-4fbe-89e0-e3feacd4ffde)]
 interface nsIDOMHTMLLinkElement : nsISupports
 {
            [binaryname(MozDisabled)]
@@ -29,5 +29,4 @@ interface nsIDOMHTMLLinkElement : nsISupports
            attribute DOMString        rev;
            attribute DOMString        target;
            attribute DOMString        type;
-           attribute DOMString        crossOrigin;
 };
diff --git a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
index ee58b0df8d6..5ff618ba5f7 100644
--- a/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLMediaElement.idl
@@ -27,7 +27,7 @@ interface nsIDOMMediaStream;
 #endif
 %}
 
-[uuid(0e14e6ad-2074-48b7-a247-e545a3a15131)]
+[uuid(c041d76c-15ce-47ad-b61d-e8755a6db638)]
 interface nsIDOMHTMLMediaElement : nsISupports
 {
   // error state
@@ -37,7 +37,6 @@ interface nsIDOMHTMLMediaElement : nsISupports
            attribute DOMString src;
            attribute nsIDOMMediaStream mozSrcObject;
   readonly attribute DOMString currentSrc;
-           attribute DOMString crossOrigin;
   const unsigned short NETWORK_EMPTY = 0;
   const unsigned short NETWORK_IDLE = 1;
   const unsigned short NETWORK_LOADING = 2;
diff --git a/dom/interfaces/html/nsIDOMHTMLScriptElement.idl b/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
index 6df22e5a17e..ec4cb5b771a 100644
--- a/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLScriptElement.idl
@@ -16,7 +16,7 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[uuid(4627336e-3070-4e73-8f67-3851b54cc0eb)]
+[uuid(fe96dc1c-40e4-4974-9354-e3fce663c3d5)]
 interface nsIDOMHTMLScriptElement : nsISupports
 {
            attribute DOMString        src;
@@ -28,5 +28,4 @@ interface nsIDOMHTMLScriptElement : nsISupports
 
            attribute DOMString        htmlFor;
            attribute DOMString        event;
-           attribute DOMString        crossOrigin;
 };
diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index afc18afa286..cbbd8ef9fbe 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -942,7 +942,12 @@ ContentChild::RecvSetProcessSandbox()
 #endif
     SetContentProcessSandbox();
 #elif defined(XP_WIN)
-    mozilla::SandboxTarget::Instance()->StartSandbox();
+    nsAdoptingString contentSandboxPref =
+        Preferences::GetString("browser.tabs.remote.sandbox");
+    if (contentSandboxPref.EqualsLiteral("on")
+        || contentSandboxPref.EqualsLiteral("warn")) {
+        mozilla::SandboxTarget::Instance()->StartSandbox();
+    }
 #endif
 #endif
     return true;
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 8f4af00bbf7..a26f41107b5 100755
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -651,7 +651,8 @@ ContentParent::GetNewOrPreallocatedAppProcess(mozIApplication* aApp,
                 NS_ERROR("Failed to get manifest URL");
                 return nullptr;
             }
-            process->TransformPreallocatedIntoApp(manifestURL);
+            process->TransformPreallocatedIntoApp(aOpener,
+                                                  manifestURL);
             if (aTookPreAllocated) {
                 *aTookPreAllocated = true;
             }
@@ -799,15 +800,9 @@ ContentParent::GetNewOrUsedBrowserProcess(bool aForBrowserElement,
     // Try to take and transform the preallocated process into browser.
     nsRefPtr<ContentParent> p = PreallocatedProcessManager::Take();
     if (p) {
-        p->TransformPreallocatedIntoBrowser();
+        p->TransformPreallocatedIntoBrowser(aOpener);
     } else {
       // Failed in using the preallocated process: fork from the chrome process.
-#ifdef MOZ_NUWA_PROCESS
-        if (Preferences::GetBool("dom.ipc.processPrelaunch.enabled", false)) {
-            // Wait until the Nuwa process forks a new process.
-            return nullptr;
-        }
-#endif
         p = new ContentParent(/* app = */ nullptr,
                               aOpener,
                               aForBrowserElement,
@@ -898,7 +893,10 @@ ContentParent::RecvCreateChildProcess(const IPCTabContext& aContext,
     }
 
     if (!cp) {
-        return false;
+        *aId = 0;
+        *aIsForApp = false;
+        *aIsForBrowser = false;
+        return true;
     }
 
     *aId = cp->ChildID();
@@ -948,13 +946,15 @@ ContentParent::CreateBrowserOrApp(const TabContext& aContext,
         nsRefPtr<nsIContentParent> constructorSender;
         if (isInContentProcess) {
             MOZ_ASSERT(aContext.IsBrowserElement());
-            constructorSender = CreateContentBridgeParent(aContext, initialPriority);
+            constructorSender =
+                CreateContentBridgeParent(aContext, initialPriority);
         } else {
           if (aOpenerContentParent) {
             constructorSender = aOpenerContentParent;
           } else {
-            constructorSender = GetNewOrUsedBrowserProcess(aContext.IsBrowserElement(),
-                                                                    initialPriority);
+            constructorSender =
+                GetNewOrUsedBrowserProcess(aContext.IsBrowserElement(),
+                                           initialPriority);
           }
         }
         if (constructorSender) {
@@ -1149,6 +1149,9 @@ ContentParent::CreateContentBridgeParent(const TabContext& aContext,
                                        &isForBrowser)) {
         return nullptr;
     }
+    if (id == 0) {
+        return nullptr;
+    }
     if (!child->CallBridgeToChildProcess(id)) {
         return nullptr;
     }
@@ -1381,17 +1384,20 @@ TryGetNameFromManifestURL(const nsAString& aManifestURL,
 }
 
 void
-ContentParent::TransformPreallocatedIntoApp(const nsAString& aAppManifestURL)
+ContentParent::TransformPreallocatedIntoApp(ContentParent* aOpener,
+                                            const nsAString& aAppManifestURL)
 {
     MOZ_ASSERT(IsPreallocated());
+    mOpener = aOpener;
     mAppManifestURL = aAppManifestURL;
     TryGetNameFromManifestURL(aAppManifestURL, mAppName);
 }
 
 void
-ContentParent::TransformPreallocatedIntoBrowser()
+ContentParent::TransformPreallocatedIntoBrowser(ContentParent* aOpener)
 {
     // Reset mAppManifestURL, mIsForBrowser and mOSPrivileges for browser.
+    mOpener = aOpener;
     mAppManifestURL.Truncate();
     mIsForBrowser = true;
 }
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index 8ef5f160c52..e56e5be6102 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -363,11 +363,12 @@ private:
 
     // Transform a pre-allocated app process into a "real" app
     // process, for the specified manifest URL.
-    void TransformPreallocatedIntoApp(const nsAString& aAppManifestURL);
+    void TransformPreallocatedIntoApp(ContentParent* aOpener,
+                                      const nsAString& aAppManifestURL);
 
     // Transform a pre-allocated app process into a browser process. If this
     // returns false, the child process has died.
-    void TransformPreallocatedIntoBrowser();
+    void TransformPreallocatedIntoBrowser(ContentParent* aOpener);
 
     /**
      * Mark this ContentParent as dead for the purposes of Get*().
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index cb94e4fdb30..ba3c6bf93d6 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -492,7 +492,7 @@ TabChildBase::DispatchMessageManagerMessage(const nsAString& aMessageName,
     StructuredCloneData cloneData;
     JSAutoStructuredCloneBuffer buffer;
     if (JS_ParseJSON(cx,
-                      static_cast<const jschar*>(aJSONData.BeginReading()),
+                      static_cast<const char16_t*>(aJSONData.BeginReading()),
                       aJSONData.Length(),
                       &json)) {
         WriteStructuredClone(cx, json, buffer, cloneData.mClosure);
@@ -747,7 +747,10 @@ TabChild::PreloadSlowThings()
 {
     MOZ_ASSERT(!sPreallocatedTab);
 
-    nsRefPtr<TabChild> tab(new TabChild(ContentChild::GetSingleton(),
+    // Pass nullptr to aManager since at this point the TabChild is
+    // not connected to any manager. Any attempt to use the TabChild
+    // in IPC will crash.
+    nsRefPtr<TabChild> tab(new TabChild(nullptr,
                                         TabContext(), /* chromeFlags */ 0));
     if (!NS_SUCCEEDED(tab->Init()) ||
         !tab->InitTabChildGlobal(DONT_LOAD_SCRIPTS)) {
@@ -777,7 +780,9 @@ TabChild::PreloadSlowThings()
 }
 
 /*static*/ already_AddRefed<TabChild>
-TabChild::Create(nsIContentChild* aManager, const TabContext &aContext, uint32_t aChromeFlags)
+TabChild::Create(nsIContentChild* aManager,
+                 const TabContext &aContext,
+                 uint32_t aChromeFlags)
 {
     if (sPreallocatedTab &&
         sPreallocatedTab->mChromeFlags == aChromeFlags &&
@@ -788,6 +793,7 @@ TabChild::Create(nsIContentChild* aManager, const TabContext &aContext, uint32_t
 
         MOZ_ASSERT(!child->mTriedBrowserInit);
 
+        child->mManager = aManager;
         child->SetTabContext(aContext);
         child->NotifyTabContextUpdated();
         return child.forget();
@@ -799,7 +805,9 @@ TabChild::Create(nsIContentChild* aManager, const TabContext &aContext, uint32_t
 }
 
 
-TabChild::TabChild(nsIContentChild* aManager, const TabContext& aContext, uint32_t aChromeFlags)
+TabChild::TabChild(nsIContentChild* aManager,
+                   const TabContext& aContext,
+                   uint32_t aChromeFlags)
   : TabContext(aContext)
   , mRemoteFrame(nullptr)
   , mManager(aManager)
@@ -879,11 +887,6 @@ TabChild::Observe(nsISupports *aSubject,
 
         mContentDocumentIsDisplayed = true;
 
-        // Reset CSS viewport and zoom to default on new page, then
-        // calculate them properly using the actual metadata from the
-        // page.
-        SetCSSViewport(kDefaultViewportSize);
-
         // In some cases before-first-paint gets called before
         // RecvUpdateDimensions is called and therefore before we have an
         // mInnerSize value set. In such cases defer initializing the viewport
diff --git a/dom/ipc/nsIContentChild.cpp b/dom/ipc/nsIContentChild.cpp
index ae224378c69..6af4e6cdf80 100644
--- a/dom/ipc/nsIContentChild.cpp
+++ b/dom/ipc/nsIContentChild.cpp
@@ -67,7 +67,8 @@ nsIContentChild::AllocPBrowserChild(const IPCTabContext& aContext,
     MOZ_CRASH("Invalid TabContext received from the parent process.");
   }
 
-  nsRefPtr<TabChild> child = TabChild::Create(this, tc.GetTabContext(), aChromeFlags);
+  nsRefPtr<TabChild> child =
+    TabChild::Create(this, tc.GetTabContext(), aChromeFlags);
 
   // The ref here is released in DeallocPBrowserChild.
   return child.forget().take();
diff --git a/dom/json/nsJSON.cpp b/dom/json/nsJSON.cpp
index e631324764a..3c9857ab740 100644
--- a/dom/json/nsJSON.cpp
+++ b/dom/json/nsJSON.cpp
@@ -163,7 +163,7 @@ nsJSON::EncodeToStream(nsIOutputStream *aStream,
 }
 
 static bool
-WriteCallback(const jschar *buf, uint32_t len, void *data)
+WriteCallback(const char16_t *buf, uint32_t len, void *data)
 {
   nsJSONWriter *writer = static_cast<nsJSONWriter*>(data);
   nsresult rv =  writer->Write((const char16_t*)buf, (uint32_t)len);
@@ -389,7 +389,7 @@ NS_IMETHODIMP
 nsJSON::DecodeToJSVal(const nsAString &str, JSContext *cx,
                       JS::MutableHandle<JS::Value> result)
 {
-  if (!JS_ParseJSON(cx, static_cast<const jschar*>(PromiseFlatString(str).get()),
+  if (!JS_ParseJSON(cx, static_cast<const char16_t*>(PromiseFlatString(str).get()),
                     str.Length(), result)) {
     return NS_ERROR_UNEXPECTED;
   }
@@ -525,7 +525,7 @@ nsJSONListener::OnStopRequest(nsIRequest *aRequest, nsISupports *aContext,
 
   JS::Rooted<JS::Value> reviver(mCx, JS::NullValue()), value(mCx);
 
-  JS::ConstTwoByteChars chars(reinterpret_cast<const jschar*>(mBufferedChars.Elements()),
+  JS::ConstTwoByteChars chars(reinterpret_cast<const char16_t*>(mBufferedChars.Elements()),
                               mBufferedChars.Length());
   bool ok = JS_ParseJSONWithReviver(mCx, chars.get(),
                                       uint32_t(mBufferedChars.Length()),
diff --git a/dom/locales/en-US/chrome/accessibility/AccessFu.properties b/dom/locales/en-US/chrome/accessibility/AccessFu.properties
index 7775a16872a..c3d099a41ac 100644
--- a/dom/locales/en-US/chrome/accessibility/AccessFu.properties
+++ b/dom/locales/en-US/chrome/accessibility/AccessFu.properties
@@ -157,6 +157,7 @@ statePressed     =    pressed
 stateExpanded    =    expanded
 stateCollapsed   =    collapsed
 stateUnavailable =    unavailable
+stateReadonly    =    readonly
 stateRequired    =    required
 stateTraversed   =    visited
 stateHasPopup    =    has pop up
diff --git a/dom/media/MediaManager.cpp b/dom/media/MediaManager.cpp
index 6596dbb1809..a04116f6dbf 100644
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -159,7 +159,7 @@ HostHasPermission(nsIURI &docURI)
   /*
      Test each domain name in the comma separated list
      after converting from UTF8 to ASCII. Each domain
-     must match exactly: no wildcards are used.
+     must match exactly or have a single leading '*.' wildcard
   */
   do {
     end = domainWhiteList.FindChar(',', begin);
@@ -505,15 +505,18 @@ public:
       (aVideoSource ? DOMMediaStream::HINT_CONTENTS_VIDEO : 0);
 
     nsRefPtr<nsDOMUserMediaStream> stream = new nsDOMUserMediaStream(aListener,
-                                                                     aAudioSource);
+                                                                     aAudioSource,
+                                                                     aVideoSource);
     stream->InitTrackUnionStream(aWindow, hints);
     return stream.forget();
   }
 
   nsDOMUserMediaStream(GetUserMediaCallbackMediaStreamListener* aListener,
-                       MediaEngineSource *aAudioSource) :
+                       MediaEngineSource *aAudioSource,
+                       MediaEngineSource *aVideoSource) :
     mListener(aListener),
     mAudioSource(aAudioSource),
+    mVideoSource(aVideoSource),
     mEchoOn(true),
     mAgcOn(false),
     mNoiseOn(true),
@@ -625,12 +628,32 @@ public:
     GetStream()->AsProcessedStream()->ForwardTrackEnabled(aID, aEnabled);
   }
 
+  virtual DOMLocalMediaStream* AsDOMLocalMediaStream()
+  {
+    return this;
+  }
+
+  virtual MediaEngineSource* GetMediaEngine(TrackID aTrackID)
+  {
+    // MediaEngine supports only one video and on video track now and TrackID is
+    // fixed in MediaEngine.
+    if (aTrackID == kVideoTrack) {
+      return mVideoSource;
+    }
+    else if (aTrackID == kAudioTrack) {
+      return mAudioSource;
+    }
+
+    return nullptr;
+  }
+
   // The actual MediaStream is a TrackUnionStream. But these resources need to be
   // explicitly destroyed too.
   nsRefPtr<SourceMediaStream> mSourceStream;
   nsRefPtr<MediaInputPort> mPort;
   nsRefPtr<GetUserMediaCallbackMediaStreamListener> mListener;
   nsRefPtr<MediaEngineSource> mAudioSource; // so we can turn on AEC
+  nsRefPtr<MediaEngineSource> mVideoSource;
   bool mEchoOn;
   bool mAgcOn;
   bool mNoiseOn;
diff --git a/dom/media/MediaManager.h b/dom/media/MediaManager.h
index c6022ba791e..f478a5fe487 100644
--- a/dom/media/MediaManager.h
+++ b/dom/media/MediaManager.h
@@ -546,6 +546,11 @@ public:
   // from MediaManager thread.
   static MediaManager* Get();
 
+  static bool Exists()
+  {
+    return !!sSingleton;
+  }
+
   static nsIThread* GetThread() {
     return Get()->mMediaThread;
   }
diff --git a/dom/media/PeerConnection.js b/dom/media/PeerConnection.js
index 9941ef0b486..4a3f67b2cf3 100644
--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@@ -679,16 +679,19 @@ RTCPeerConnection.prototype = {
     let idpComplete = false;
     let setRemoteComplete = false;
     let idpError = null;
+    let isDone = false;
 
     // we can run the IdP validation in parallel with setRemoteDescription this
     // complicates much more than would be ideal, but it ensures that the IdP
     // doesn't hold things up too much when it's not on the critical path
     let allDone = () => {
-      if (!setRemoteComplete || !idpComplete || !onSuccess) {
+      if (!setRemoteComplete || !idpComplete || isDone) {
         return;
       }
+      // May be null if the user didn't supply success/failure callbacks.
+      // Violation of spec, but we allow it for now
       this.callCB(onSuccess);
-      onSuccess = null;
+      isDone = true;
       this._executeNext();
     };
 
diff --git a/dom/mobileconnection/MobileCellInfo.h b/dom/mobileconnection/MobileCellInfo.h
index fcd21e8dcb9..a5a5933acd3 100644
--- a/dom/mobileconnection/MobileCellInfo.h
+++ b/dom/mobileconnection/MobileCellInfo.h
@@ -22,7 +22,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(MobileCellInfo)
 
-  MobileCellInfo(nsPIDOMWindow* aWindow);
+  explicit MobileCellInfo(nsPIDOMWindow* aWindow);
 
   MobileCellInfo(int32_t aGsmLocationAreaCode, int64_t aGsmCellId,
                  int32_t aCdmaBaseStationId, int32_t aCdmaBaseStationLatitude,
diff --git a/dom/mobileconnection/MobileConnection.cpp b/dom/mobileconnection/MobileConnection.cpp
index e27465712ec..b23c7ae5a29 100644
--- a/dom/mobileconnection/MobileConnection.cpp
+++ b/dom/mobileconnection/MobileConnection.cpp
@@ -51,7 +51,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_FORWARD_SAFE_NSIMOBILECONNECTIONLISTENER(mMobileConnection)
 
-  Listener(MobileConnection* aMobileConnection)
+  explicit Listener(MobileConnection* aMobileConnection)
     : mMobileConnection(aMobileConnection)
   {
     MOZ_ASSERT(mMobileConnection);
diff --git a/dom/mobileconnection/MobileConnectionArray.h b/dom/mobileconnection/MobileConnectionArray.h
index 9f800f362cd..34b743ca0f8 100644
--- a/dom/mobileconnection/MobileConnectionArray.h
+++ b/dom/mobileconnection/MobileConnectionArray.h
@@ -20,7 +20,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(MobileConnectionArray)
 
-  MobileConnectionArray(nsPIDOMWindow* aWindow);
+  explicit MobileConnectionArray(nsPIDOMWindow* aWindow);
 
   nsPIDOMWindow*
   GetParentObject() const;
diff --git a/dom/mobileconnection/MobileConnectionInfo.h b/dom/mobileconnection/MobileConnectionInfo.h
index 5f69c62758f..7d117ec2760 100644
--- a/dom/mobileconnection/MobileConnectionInfo.h
+++ b/dom/mobileconnection/MobileConnectionInfo.h
@@ -25,7 +25,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(MobileConnectionInfo)
 
-  MobileConnectionInfo(nsPIDOMWindow* aWindow);
+  explicit MobileConnectionInfo(nsPIDOMWindow* aWindow);
 
   MobileConnectionInfo(const nsAString& aState, bool aConnected,
                        bool aEmergencyCallsOnly, bool aRoaming,
diff --git a/dom/mobileconnection/MobileNetworkInfo.h b/dom/mobileconnection/MobileNetworkInfo.h
index 9fc742ce689..91a912cafcf 100644
--- a/dom/mobileconnection/MobileNetworkInfo.h
+++ b/dom/mobileconnection/MobileNetworkInfo.h
@@ -25,7 +25,7 @@ public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(MobileNetworkInfo)
 
-  MobileNetworkInfo(nsPIDOMWindow* aWindow);
+  explicit MobileNetworkInfo(nsPIDOMWindow* aWindow);
 
   MobileNetworkInfo(const nsAString& aShortName, const nsAString& aLongName,
                     const nsAString& aMcc, const nsAString& aMnc,
diff --git a/dom/mobileconnection/gonk/MobileConnectionGonkService.js b/dom/mobileconnection/gonk/MobileConnectionGonkService.js
index dcc54b046c4..7b59bdb8f34 100644
--- a/dom/mobileconnection/gonk/MobileConnectionGonkService.js
+++ b/dom/mobileconnection/gonk/MobileConnectionGonkService.js
@@ -174,6 +174,21 @@ MobileConnectionProvider.prototype = {
   _getSupportedNetworkTypes: function() {
     let key = "ro.moz.ril." + this._clientId + ".network_types";
     let supportedNetworkTypes = libcutils.property_get(key, "").split(",");
+
+    // If mozRIL system property is not available, fallback to AOSP system
+    // property for support network types.
+    if (supportedNetworkTypes.length === 1 && supportedNetworkTypes[0] === "") {
+      key = "ro.telephony.default_network";
+      let indexString = libcutils.property_get(key, "");
+      let index = parseInt(indexString, 10);
+      if (DEBUG) this._debug("Fallback to " + key + ": " + index)
+
+      let networkTypes = RIL.RIL_PREFERRED_NETWORK_TYPE_TO_GECKO[index];
+      supportedNetworkTypes = networkTypes ?
+        networkTypes.replace("-auto", "", "g").split("/") :
+        RIL.GECKO_SUPPORTED_NETWORK_TYPES_DEFAULT.split(",");
+    }
+
     for (let type of supportedNetworkTypes) {
       // If the value in system property is not valid, use the default one which
       // is defined in ril_consts.js.
@@ -1304,7 +1319,7 @@ MobileConnectionGonkService.prototype = {
   notifyUssdReceived: function(aClientId, aMessage, aSessionEnded) {
     if (DEBUG) {
       debug("notifyUssdReceived for " + aClientId + ": " +
-            JSON.stringify(ussd));
+            aMessage + " (sessionEnded : " + aSessionEnded + ")");
     }
 
     let provider = this._providers[aClientId];
diff --git a/dom/mobileconnection/ipc/MobileConnectionChild.h b/dom/mobileconnection/ipc/MobileConnectionChild.h
index ca254136aba..18c191a2d3c 100644
--- a/dom/mobileconnection/ipc/MobileConnectionChild.h
+++ b/dom/mobileconnection/ipc/MobileConnectionChild.h
@@ -160,7 +160,7 @@ private:
 class MobileConnectionRequestChild : public PMobileConnectionRequestChild
 {
 public:
-  MobileConnectionRequestChild(nsIMobileConnectionCallback* aRequestCallback)
+  explicit MobileConnectionRequestChild(nsIMobileConnectionCallback* aRequestCallback)
     : mRequestCallback(aRequestCallback)
   {
     MOZ_COUNT_CTOR(MobileConnectionRequestChild);
diff --git a/dom/mobileconnection/ipc/MobileConnectionParent.h b/dom/mobileconnection/ipc/MobileConnectionParent.h
index 0c491cd5a88..edf1e9f61ab 100644
--- a/dom/mobileconnection/ipc/MobileConnectionParent.h
+++ b/dom/mobileconnection/ipc/MobileConnectionParent.h
@@ -26,7 +26,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIMOBILECONNECTIONLISTENER
 
-  MobileConnectionParent(uint32_t aClientId);
+  explicit MobileConnectionParent(uint32_t aClientId);
 
 protected:
   virtual
@@ -78,7 +78,7 @@ public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIMOBILECONNECTIONCALLBACK
 
-  MobileConnectionRequestParent(uint32_t aClientId)
+  explicit MobileConnectionRequestParent(uint32_t aClientId)
     : mClientId(aClientId)
     , mLive(true)
   {
@@ -177,4 +177,4 @@ private:
 } // namespace dom
 } // namespace mozilla
 
-#endif // mozilla_dom_mobileconnection_MobileConnectionParent_h
\ No newline at end of file
+#endif // mozilla_dom_mobileconnection_MobileConnectionParent_h
diff --git a/dom/network/NetworkStatsService.jsm b/dom/network/NetworkStatsService.jsm
index ac078c0e660..da5787601be 100644
--- a/dom/network/NetworkStatsService.jsm
+++ b/dom/network/NetworkStatsService.jsm
@@ -24,8 +24,7 @@ const NET_NETWORKSTATSSERVICE_CID = Components.ID("{18725604-e9ac-488a-8aa0-2471
 
 const TOPIC_BANDWIDTH_CONTROL = "netd-bandwidth-control"
 
-const TOPIC_INTERFACE_REGISTERED   = "network-interface-registered";
-const TOPIC_INTERFACE_UNREGISTERED = "network-interface-unregistered";
+const TOPIC_CONNECTION_STATE_CHANGED = "network-connection-state-changed";
 const NET_TYPE_WIFI = Ci.nsINetworkInterface.NETWORK_TYPE_WIFI;
 const NET_TYPE_MOBILE = Ci.nsINetworkInterface.NETWORK_TYPE_MOBILE;
 
@@ -74,8 +73,7 @@ this.NetworkStatsService = {
     debug("Service started");
 
     Services.obs.addObserver(this, "xpcom-shutdown", false);
-    Services.obs.addObserver(this, TOPIC_INTERFACE_REGISTERED, false);
-    Services.obs.addObserver(this, TOPIC_INTERFACE_UNREGISTERED, false);
+    Services.obs.addObserver(this, TOPIC_CONNECTION_STATE_CHANGED, false);
     Services.obs.addObserver(this, TOPIC_BANDWIDTH_CONTROL, false);
     Services.obs.addObserver(this, "profile-after-change", false);
 
@@ -183,8 +181,7 @@ this.NetworkStatsService = {
 
   observe: function observe(aSubject, aTopic, aData) {
     switch (aTopic) {
-      case TOPIC_INTERFACE_REGISTERED:
-      case TOPIC_INTERFACE_UNREGISTERED:
+      case TOPIC_CONNECTION_STATE_CHANGED:
 
         // If new interface is registered (notified from NetworkService),
         // the stats are updated for the new interface without waiting to
@@ -228,8 +225,7 @@ this.NetworkStatsService = {
 
         Services.obs.removeObserver(this, "xpcom-shutdown");
         Services.obs.removeObserver(this, "profile-after-change");
-        Services.obs.removeObserver(this, TOPIC_INTERFACE_REGISTERED);
-        Services.obs.removeObserver(this, TOPIC_INTERFACE_UNREGISTERED);
+        Services.obs.removeObserver(this, TOPIC_CONNECTION_STATE_CHANGED);
         Services.obs.removeObserver(this, TOPIC_BANDWIDTH_CONTROL);
 
         this.timer.cancel();
diff --git a/dom/nfc/MozNDEFRecord.cpp b/dom/nfc/MozNDEFRecord.cpp
index 46da47b8875..913032f286c 100644
--- a/dom/nfc/MozNDEFRecord.cpp
+++ b/dom/nfc/MozNDEFRecord.cpp
@@ -67,10 +67,7 @@ MozNDEFRecord::DropData()
 /* static */
 already_AddRefed<MozNDEFRecord>
 MozNDEFRecord::Constructor(const GlobalObject& aGlobal,
-                           uint8_t aTnf,
-                           const Optional<Uint8Array>& aType,
-                           const Optional<Uint8Array>& aId,
-                           const Optional<Uint8Array>& aPayload,
+                           const MozNDEFRecordOptions& aOptions,
                            ErrorResult& aRv)
 {
   nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(aGlobal.GetAsSupports());
@@ -80,8 +77,7 @@ MozNDEFRecord::Constructor(const GlobalObject& aGlobal,
   }
 
   nsRefPtr<MozNDEFRecord> ndefrecord = new MozNDEFRecord(aGlobal.Context(),
-                                                         win, aTnf, aType, aId,
-                                                         aPayload);
+                                                         win, aOptions);
   if (!ndefrecord) {
     aRv.Throw(NS_ERROR_FAILURE);
     return nullptr;
@@ -90,27 +86,28 @@ MozNDEFRecord::Constructor(const GlobalObject& aGlobal,
 }
 
 MozNDEFRecord::MozNDEFRecord(JSContext* aCx, nsPIDOMWindow* aWindow,
-                             uint8_t aTnf,
-                             const Optional<Uint8Array>& aType,
-                             const Optional<Uint8Array>& aId,
-                             const Optional<Uint8Array>& aPayload)
-  : mTnf(aTnf)
+                             const MozNDEFRecordOptions& aOptions)
 {
   mWindow = aWindow; // For GetParentObject()
 
-  if (aType.WasPassed()) {
-    aType.Value().ComputeLengthAndData();
-    mType = Uint8Array::Create(aCx, this, aType.Value().Length(), aType.Value().Data());
+  mTnf = aOptions.mTnf;
+
+  if (aOptions.mType.WasPassed()) {
+    const Uint8Array& type = aOptions.mType.Value();
+    type.ComputeLengthAndData();
+    mType = Uint8Array::Create(aCx, this, type.Length(), type.Data());
   }
 
-  if (aId.WasPassed()) {
-    aId.Value().ComputeLengthAndData();
-    mId = Uint8Array::Create(aCx, this, aId.Value().Length(), aId.Value().Data());
+  if (aOptions.mId.WasPassed()) {
+    const Uint8Array& id = aOptions.mId.Value();
+    id.ComputeLengthAndData();
+    mId = Uint8Array::Create(aCx, this, id.Length(), id.Data());
   }
 
-  if (aPayload.WasPassed()) {
-    aPayload.Value().ComputeLengthAndData();
-    mPayload = Uint8Array::Create(aCx, this, aPayload.Value().Length(), aPayload.Value().Data());
+  if (aOptions.mPayload.WasPassed()) {
+    const Uint8Array& payload = aOptions.mPayload.Value();
+    payload.ComputeLengthAndData();
+    mPayload = Uint8Array::Create(aCx, this, payload.Length(), payload.Data());
   }
 
   SetIsDOMBinding();
diff --git a/dom/nfc/MozNDEFRecord.h b/dom/nfc/MozNDEFRecord.h
index bf186418886..ee0591505f3 100644
--- a/dom/nfc/MozNDEFRecord.h
+++ b/dom/nfc/MozNDEFRecord.h
@@ -25,6 +25,8 @@ struct JSContext;
 namespace mozilla {
 namespace dom {
 
+class MozNDEFRecordOptions;
+
 class MozNDEFRecord MOZ_FINAL : public nsISupports,
                                 public nsWrapperCache
 {
@@ -34,10 +36,8 @@ public:
 
 public:
 
-  MozNDEFRecord(JSContext* aCx, nsPIDOMWindow* aWindow, uint8_t aTnf,
-                const Optional<Uint8Array>& aType,
-                const Optional<Uint8Array>& aId,
-                const Optional<Uint8Array>& aPlayload);
+  MozNDEFRecord(JSContext* aCx, nsPIDOMWindow* aWindow,
+                const MozNDEFRecordOptions& aOptions);
 
   ~MozNDEFRecord();
 
@@ -49,10 +49,9 @@ public:
   virtual JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
 
   static already_AddRefed<MozNDEFRecord>
-  Constructor(const GlobalObject& aGlobal, uint8_t aTnf,
-              const Optional<Uint8Array>& aType,
-              const Optional<Uint8Array>& aId,
-              const Optional<Uint8Array>& aPayload, ErrorResult& aRv);
+  Constructor(const GlobalObject& aGlobal,
+              const MozNDEFRecordOptions& aOptions,
+              ErrorResult& aRv);
 
   uint8_t Tnf() const
   {
diff --git a/dom/nfc/NfcContentHelper.js b/dom/nfc/NfcContentHelper.js
index f3827a1abc6..bacec7ecaf3 100644
--- a/dom/nfc/NfcContentHelper.js
+++ b/dom/nfc/NfcContentHelper.js
@@ -104,9 +104,9 @@ NfcContentHelper.prototype = {
       let record = records[i];
       encodedRecords.push({
         tnf: record.tnf,
-        type: record.type,
-        id: record.id,
-        payload: record.payload,
+        type: record.type || undefined,
+        id: record.id || undefined,
+        payload: record.payload || undefined,
       });
     }
     return encodedRecords;
@@ -365,13 +365,11 @@ NfcContentHelper.prototype = {
   fireRequestSuccess: function fireRequestSuccess(requestId, result) {
     let request = this.takeRequest(requestId);
     if (!request) {
-      debug("not firing success for id: " + requestId +
-            ", result: " + JSON.stringify(result));
+      debug("not firing success for id: " + requestId);
       return;
     }
 
-    debug("fire request success, id: " + requestId +
-          ", result: " + JSON.stringify(result));
+    debug("fire request success, id: " + requestId);
     Services.DOMRequest.fireSuccess(request, result);
   },
 
@@ -389,7 +387,7 @@ NfcContentHelper.prototype = {
   },
 
   receiveMessage: function receiveMessage(message) {
-    debug("Message received: " + JSON.stringify(message));
+    DEBUG && debug("Message received: " + JSON.stringify(message));
     let result = message.json;
 
     switch (message.name) {
@@ -445,10 +443,10 @@ NfcContentHelper.prototype = {
     let records = result.records;
     for (let i = 0; i < records.length; i++) {
       let record = records[i];
-      ndefMsg.push(new requester.MozNDEFRecord(record.tnf,
-                                               record.type,
-                                               record.id,
-                                               record.payload));
+      ndefMsg.push(new requester.MozNDEFRecord({tnf: record.tnf,
+                                                type: record.type,
+                                                id: record.id,
+                                                payload: record.payload}));
     }
     this.fireRequestSuccess(requestId, ndefMsg);
   },
diff --git a/dom/nfc/gonk/Nfc.js b/dom/nfc/gonk/Nfc.js
index 658610b0273..ed954e01b21 100644
--- a/dom/nfc/gonk/Nfc.js
+++ b/dom/nfc/gonk/Nfc.js
@@ -232,7 +232,8 @@ XPCOMUtils.defineLazyGetter(this, "gMessageManager", function () {
      */
 
     receiveMessage: function receiveMessage(message) {
-      debug("Received '" + JSON.stringify(message) + "' message from content process");
+      DEBUG && debug("Received message from content process: " + JSON.stringify(message));
+
       if (message.name == "child-process-shutdown") {
         this.removePeerTarget(message.target);
         this.nfc.removeTarget(message.target);
@@ -398,7 +399,7 @@ Nfc.prototype = {
    */
   onEvent: function onEvent(event) {
     let message = Cu.cloneInto(event, this);
-    debug("Received message from NFC Service: " + JSON.stringify(message));
+    DEBUG && debug("Received message from NFC Service: " + JSON.stringify(message));
 
     // mapping error code to error message
     if (message.status !== undefined && message.status !== NFC.NFC_SUCCESS) {
diff --git a/dom/nfc/gonk/NfcOptions.h b/dom/nfc/gonk/NfcOptions.h
index ddf6f964717..b32213b8d6e 100644
--- a/dom/nfc/gonk/NfcOptions.h
+++ b/dom/nfc/gonk/NfcOptions.h
@@ -40,28 +40,28 @@ struct CommandOptions
       return;
     }
 
-    mozilla::dom::Sequence<mozilla::dom::NDEFRecord> const & currentValue = aOther.mRecords.InternalValue();
+    mozilla::dom::Sequence<mozilla::dom::MozNDEFRecordOptions> const & currentValue = aOther.mRecords.InternalValue();
     int count = currentValue.Length();
-    for (uint32_t i = 0; i < count; i++) {
+    for (int32_t i = 0; i < count; i++) {
       NDEFRecordStruct record;
-      record.mTnf = currentValue[i].mTnf.Value();
+      record.mTnf = currentValue[i].mTnf;
 
       if (currentValue[i].mType.WasPassed()) {
-        currentValue[i].mType.Value().ComputeLengthAndData();
-        record.mType.AppendElements(currentValue[i].mType.Value().Data(),
-                                    currentValue[i].mType.Value().Length());
+        const dom::Uint8Array& type = currentValue[i].mType.Value();
+        type.ComputeLengthAndData();
+        record.mType.AppendElements(type.Data(), type.Length());
       }
 
       if (currentValue[i].mId.WasPassed()) {
-        currentValue[i].mId.Value().ComputeLengthAndData();
-        record.mId.AppendElements(currentValue[i].mId.Value().Data(),
-                                  currentValue[i].mId.Value().Length());
+        const dom::Uint8Array& id = currentValue[i].mId.Value();
+        id.ComputeLengthAndData();
+        record.mId.AppendElements(id.Data(), id.Length());
       }
 
       if (currentValue[i].mPayload.WasPassed()) {
-        currentValue[i].mPayload.Value().ComputeLengthAndData();
-        record.mPayload.AppendElements(currentValue[i].mPayload.Value().Data(),
-                                       currentValue[i].mPayload.Value().Length());
+        const dom::Uint8Array& payload = currentValue[i].mPayload.Value();
+        payload.ComputeLengthAndData();
+        record.mPayload.AppendElements(payload.Data(), payload.Length());
       }
 
       mRecords.AppendElement(record);
diff --git a/dom/nfc/gonk/NfcService.cpp b/dom/nfc/gonk/NfcService.cpp
index 9fe09dc986b..c2bd6336516 100644
--- a/dom/nfc/gonk/NfcService.cpp
+++ b/dom/nfc/gonk/NfcService.cpp
@@ -130,10 +130,9 @@ public:
 
       for (int i = 0; i < length; i++) {
         NDEFRecordStruct& recordStruct = mEvent.mRecords[i];
-        NDEFRecord& record = *event.mRecords.Value().AppendElement();
+        MozNDEFRecordOptions& record = *event.mRecords.Value().AppendElement();
 
-        record.mTnf.Construct();
-        record.mTnf.Value() = recordStruct.mTnf;
+        record.mTnf = recordStruct.mTnf;
 
         if (recordStruct.mType.Length() > 0) {
           record.mType.Construct();
@@ -200,26 +199,22 @@ public:
   {
     assertIsNfcServiceThread();
 
-    size_t size = mData->mSize;
-    size_t offset = 0;
-
-    while (size > 0) {
+    while (mData->GetSize()) {
       EventOptions event;
-      const uint8_t* data = mData->mData.get();
-      uint32_t parcelSize = ((data[offset + 0] & 0xff) << 24) |
-                            ((data[offset + 1] & 0xff) << 16) |
-                            ((data[offset + 2] & 0xff) <<  8) |
-                             (data[offset + 3] & 0xff);
-      MOZ_ASSERT(parcelSize <= (mData->mSize - offset));
+      const uint8_t* data = mData->GetData();
+      uint32_t parcelSize = ((data[0] & 0xff) << 24) |
+                            ((data[1] & 0xff) << 16) |
+                            ((data[2] & 0xff) <<  8) |
+                             (data[3] & 0xff);
+      MOZ_ASSERT(parcelSize <= mData->GetSize());
 
       Parcel parcel;
-      parcel.setData(&data[offset], parcelSize + sizeof(int));
+      parcel.setData(mData->GetData(), parcelSize + sizeof(parcelSize));
       mHandler->Unmarshall(parcel, event);
       nsCOMPtr<nsIRunnable> runnable = new NfcEventDispatcher(event);
       NS_DispatchToMainThread(runnable);
 
-      size -= parcel.dataSize();
-      offset += parcel.dataSize();
+      mData->Consume(parcelSize + sizeof(parcelSize));
     }
 
     return NS_OK;
diff --git a/dom/nfc/tests/marionette/head.js b/dom/nfc/tests/marionette/head.js
index e4e3bf80eb9..5223e9d6c17 100644
--- a/dom/nfc/tests/marionette/head.js
+++ b/dom/nfc/tests/marionette/head.js
@@ -287,11 +287,10 @@ const NDEF = {
     }
     // and build NDEF array
     let ndef = arr.map(function(value) {
-        let type = new Uint8Array(NfcUtils.fromUTF8(this.atob(value.type)));
-        let id = new Uint8Array(NfcUtils.fromUTF8(this.atob(value.id)));
-        let payload =
-          new Uint8Array(NfcUtils.fromUTF8(this.atob(value.payload)));
-        return new MozNDEFRecord(value.tnf, type, id, payload);
+        let type = NfcUtils.fromUTF8(this.atob(value.type));
+        let id = NfcUtils.fromUTF8(this.atob(value.id));
+        let payload = NfcUtils.fromUTF8(this.atob(value.payload));
+        return new MozNDEFRecord({tnf: value.tnf, type: type, id: id, payload: payload});
       }, window);
     return ndef;
   }
diff --git a/dom/nfc/tests/marionette/test_ndef.js b/dom/nfc/tests/marionette/test_ndef.js
index 0d22734cc34..b17d11a45ca 100644
--- a/dom/nfc/tests/marionette/test_ndef.js
+++ b/dom/nfc/tests/marionette/test_ndef.js
@@ -7,19 +7,11 @@ MARIONETTE_HEAD_JS = 'head.js';
 function testConstructNDEF() {
   try {
     // omit type, id and payload.
-    let r = new MozNDEFRecord(0x0);
-    is(r.type, null, "r.type should be null")
-    is(r.id, null, "r.id should be null")
-    is(r.payload, null, "r.payload should be null")
-
-    // omit id and payload.
-    r = new MozNDEFRecord(0x0, new Uint8Array());
-    is(r.id, null, "r.id should be null")
-    is(r.payload, null, "r.payload should be null")
-
-    // omit payload.
-    r = new MozNDEFRecord(0x0, new Uint8Array(), new Uint8Array());
-    is(r.payload, null, "r.payload should be null")
+    let r = new MozNDEFRecord();
+    is(r.tnf, 0, "r.tnf should be 0");
+    is(r.type, null, "r.type should be null");
+    is(r.id, null, "r.id should be null");
+    is(r.payload, null, "r.payload should be null");
 
     ok(true);
   } catch (e) {
diff --git a/dom/nfc/tests/marionette/test_nfc_error_messages.js b/dom/nfc/tests/marionette/test_nfc_error_messages.js
index 7a329fc50ab..75ad583486d 100644
--- a/dom/nfc/tests/marionette/test_nfc_error_messages.js
+++ b/dom/nfc/tests/marionette/test_nfc_error_messages.js
@@ -10,10 +10,9 @@ const MARIONETTE_TIMEOUT = 60000;
 const MARIONETTE_HEAD_JS = 'head.js';
 
 const MANIFEST_URL = 'app://system.gaiamobile.org/manifest.webapp';
-const NDEF_MESSAGE = [new MozNDEFRecord(0x01,
-                                        new Uint8Array(0x84),
-                                        new Uint8Array(0),
-                                        new Uint8Array(0x20))];
+const NDEF_MESSAGE = [new MozNDEFRecord({tnf: 0x01,
+                                         type: new Uint8Array(0x84),
+                                         payload: new Uint8Array(0x20)})];
 
 let nfcPeers = [];
 
diff --git a/dom/nfc/tests/marionette/test_nfc_manager_tech_discovered_ndef.js b/dom/nfc/tests/marionette/test_nfc_manager_tech_discovered_ndef.js
index fa17dbc3488..4dffaacaad9 100644
--- a/dom/nfc/tests/marionette/test_nfc_manager_tech_discovered_ndef.js
+++ b/dom/nfc/tests/marionette/test_nfc_manager_tech_discovered_ndef.js
@@ -15,10 +15,9 @@ function handleSnep(msg) {
   ok(msg.records != null, "msg.records should have values");
   isnot(msg.techList.indexOf("NDEF"), -1, "check for correct tech type");
   // validate received NDEF message against reference
-  let ndef = [new MozNDEFRecord(tnf,
-                                new Uint8Array(NfcUtils.fromUTF8(type)),
-                                new Uint8Array(NfcUtils.fromUTF8(id)),
-                                new Uint8Array(NfcUtils.fromUTF8(payload)))];
+  let ndef = [new MozNDEFRecord({tnf: tnf,
+                                 type: NfcUtils.fromUTF8(type),
+                                 payload: NfcUtils.fromUTF8(payload)})];
   NDEF.compare(ndef, msg.records);
   toggleNFC(false).then(runNextTest);
 }
diff --git a/dom/nfc/tests/marionette/test_nfc_peer.js b/dom/nfc/tests/marionette/test_nfc_peer.js
index f22e9fa164f..2f92031f42e 100644
--- a/dom/nfc/tests/marionette/test_nfc_peer.js
+++ b/dom/nfc/tests/marionette/test_nfc_peer.js
@@ -144,9 +144,8 @@ function testPeerShouldThrow() {
   let peer;
   let tnf = NDEF.TNF_WELL_KNOWN;
   let type = new Uint8Array(NfcUtils.fromUTF8("U"));
-  let id = new Uint8Array(NfcUtils.fromUTF8(""));
   let payload = new Uint8Array(NfcUtils.fromUTF8("http://www.hi.com"));
-  let ndef = [new MozNDEFRecord(tnf, type, id, payload)];
+  let ndef = [new MozNDEFRecord({tnf: tnf, type: type, payload: payload})];
 
   nfc.onpeerready = function (evt) {
     log("testPeerShouldThrow peerready");
diff --git a/dom/nfc/tests/marionette/test_nfc_peer_sendndef.js b/dom/nfc/tests/marionette/test_nfc_peer_sendndef.js
index 252d7f314a7..97d6d0531ef 100644
--- a/dom/nfc/tests/marionette/test_nfc_peer_sendndef.js
+++ b/dom/nfc/tests/marionette/test_nfc_peer_sendndef.js
@@ -9,9 +9,8 @@ let url = "https://www.example.com";
 function sendNDEF(techType, sessionToken) {
   let tnf = NDEF.TNF_WELL_KNOWN;
   let type = new Uint8Array(NfcUtils.fromUTF8("U"));
-  let id = new Uint8Array(NfcUtils.fromUTF8(""));
   let payload = new Uint8Array(NfcUtils.fromUTF8(url));
-  let ndef = [new MozNDEFRecord(tnf, type, id, payload)];
+  let ndef = [new MozNDEFRecord({tnf: tnf, type: type, payload: payload})];
 
   let peer = window.navigator.mozNfc.getNFCPeer(sessionToken);
   let req = peer.sendNDEF(ndef);
diff --git a/dom/plugins/test/mochitest/dialog_watcher.js b/dom/plugins/test/mochitest/dialog_watcher.js
index a45e5113e49..8a8c829974c 100644
--- a/dom/plugins/test/mochitest/dialog_watcher.js
+++ b/dom/plugins/test/mochitest/dialog_watcher.js
@@ -23,8 +23,8 @@ DialogWatcher.prototype.init = function() {
     this.findWindow = user32.declare("FindWindowW",
                                      ctypes.winapi_abi,
                                      ctypes.uintptr_t,
-                                     ctypes.jschar.ptr,
-                                     ctypes.jschar.ptr);
+                                     ctypes.char16_t.ptr,
+                                     ctypes.char16_t.ptr);
   }
   if (!this.winEventProcType) {
     this.winEventProcType = ctypes.FunctionType(ctypes.stdcall_abi,
@@ -94,7 +94,7 @@ DialogWatcher.prototype.init = function() {
                                          ctypes.winapi_abi,
                                          ctypes.int,
                                          ctypes.uintptr_t,
-                                         ctypes.jschar.ptr,
+                                         ctypes.char16_t.ptr,
                                          ctypes.int);
   }
   if (!this.messageBox) {
@@ -103,14 +103,14 @@ DialogWatcher.prototype.init = function() {
                                      ctypes.winapi_abi,
                                      ctypes.int,
                                      ctypes.uintptr_t,
-                                     ctypes.jschar.ptr,
-                                     ctypes.jschar.ptr,
+                                     ctypes.char16_t.ptr,
+                                     ctypes.char16_t.ptr,
                                      ctypes.uint32_t);
   }
 };
 
 DialogWatcher.prototype.getWindowText = function(hwnd) {
-  var bufType = ctypes.ArrayType(ctypes.jschar);
+  var bufType = ctypes.ArrayType(ctypes.char16_t);
   var buffer = new bufType(256);
 
   if (this.getWindowTextW(hwnd, buffer, buffer.length)) {
@@ -181,4 +181,3 @@ DialogWatcher.prototype.processWindowEvents = function(timeout) {
   // Returns true if the hook was successful, something was found, and we never timed out
   return this.hwnd !== undefined && waitStatus == WAIT_OBJECT_0;
 };
-
diff --git a/dom/plugins/test/mochitest/hangui_iface.js b/dom/plugins/test/mochitest/hangui_iface.js
index 4cd559c5452..853d136bb25 100644
--- a/dom/plugins/test/mochitest/hangui_iface.js
+++ b/dom/plugins/test/mochitest/hangui_iface.js
@@ -33,8 +33,8 @@ function initCTypes() {
                                 ctypes.winapi_abi,
                                 ctypes.int,
                                 ctypes.uintptr_t,
-                                ctypes.jschar.ptr,
-                                ctypes.jschar.ptr,
+                                ctypes.char16_t.ptr,
+                                ctypes.char16_t.ptr,
                                 ctypes.uint32_t);
   }
   if (!watcher) {
diff --git a/dom/plugins/test/mochitest/test_hang_submit.xul b/dom/plugins/test/mochitest/test_hang_submit.xul
index 6a44eda0b70..e7578ac662e 100644
--- a/dom/plugins/test/mochitest/test_hang_submit.xul
+++ b/dom/plugins/test/mochitest/test_hang_submit.xul
@@ -30,14 +30,7 @@ const Ci = Components.interfaces;
 const crashReporter = Cc["@mozilla.org/toolkit/crash-reporter;1"].getService(Ci.nsICrashReporter);
 const SERVER_URL = "http://example.com/browser/toolkit/crashreporter/test/browser/crashreport.sjs";
 
-const serverPrefName = "toolkit.crashreporter.pluginHangSubmitURL";
-
-var oldServerPref;
-try {
-  oldServerPref = Services.prefs.getCharPref(serverPrefName);
-}
-catch(e) {
-}
+var oldServerURL = crashReporter.serverURL;
 
 const oldTimeoutPref = Services.prefs.getIntPref("dom.ipc.plugins.timeoutSecs");
 
@@ -90,12 +83,7 @@ var testObserver = {
     env.set("MOZ_CRASHREPORTER_NO_REPORT", "1");
 
     // Finally re-set prefs
-    if (oldServerPref === undefined) {
-      Services.prefs.clearUserPref(serverPrefName);
-    }
-    else {
-      Services.prefs.setCharPref(serverPrefName, oldServerPref);
-    }
+    crashReporter.serverURL = oldServerURL;
     Services.prefs.setIntPref("dom.ipc.plugins.timeoutSecs", oldTimeoutPref);
 
     // Check and cleanup CrashManager.
@@ -159,7 +147,7 @@ function runTests() {
   env.set("MOZ_CRASHREPORTER_NO_REPORT", "");
 
   // Override the crash reporter URL to send to our fake server
-  Services.prefs.setCharPref("toolkit.crashreporter.pluginHangSubmitURL", SERVER_URL);
+  crashReporter.serverURL = NetUtil.newURI(SERVER_URL);
 
   // Hook into plugin crash events
   Services.obs.addObserver(testObserver, "crash-report-status", true);
diff --git a/dom/promise/Promise.cpp b/dom/promise/Promise.cpp
index b72a68bed66..4dc93cfc7b0 100644
--- a/dom/promise/Promise.cpp
+++ b/dom/promise/Promise.cpp
@@ -1005,19 +1005,13 @@ Promise::MaybeReportRejected()
     return;
   }
 
-  // Remains null in case of worker.
-  nsCOMPtr<nsPIDOMWindow> win;
-  bool isChromeError = false;
-
+  nsRefPtr<xpc::ErrorReport> xpcReport = new xpc::ErrorReport();
   if (MOZ_LIKELY(NS_IsMainThread())) {
-    nsIPrincipal* principal;
-    win = xpc::WindowGlobalOrNull(obj);
-    principal = nsContentUtils::ObjectPrincipal(obj);
-    isChromeError = nsContentUtils::IsSystemPrincipal(principal);
+    nsIGlobalObject* global = xpc::GetNativeForGlobal(js::GetGlobalForObjectCrossCompartment(obj));
+    xpcReport->Init(report.report(), report.message(), global);
   } else {
-    WorkerPrivate* worker = GetCurrentThreadWorkerPrivate();
-    MOZ_ASSERT(worker);
-    isChromeError = worker->IsChromeWorker();
+    xpcReport->InitOnWorkerThread(report.report(), report.message(),
+                                  GetCurrentThreadWorkerPrivate()->IsChromeWorker());
   }
 
   // Now post an event to do the real reporting async
@@ -1025,11 +1019,7 @@ Promise::MaybeReportRejected()
   // AsyncErrorReporter, otherwise if the call to DispatchToMainThread fails, it
   // will leak. See Bug 958684.
   nsRefPtr<AsyncErrorReporter> r =
-    new AsyncErrorReporter(CycleCollectedJSRuntime::Get()->Runtime(),
-                           report.report(),
-                           report.message(),
-                           isChromeError,
-                           win);
+    new AsyncErrorReporter(CycleCollectedJSRuntime::Get()->Runtime(), xpcReport);
   NS_DispatchToMainThread(r);
 }
 
diff --git a/dom/settings/SettingsManager.js b/dom/settings/SettingsManager.js
index 07bbdab4a82..b8fb3c08d59 100644
--- a/dom/settings/SettingsManager.js
+++ b/dom/settings/SettingsManager.js
@@ -55,7 +55,7 @@ function SettingsLock(aSettingsManager) {
                                                             "Settings:Clear:OK", "Settings:Clear:KO",
                                                             "Settings:Set:OK", "Settings:Set:KO",
                                                             "Settings:Finalize:OK", "Settings:Finalize:KO"]);
-  this.sendMessage("Settings:CreateLock", {lockID: this._id, isInternalLock: false});
+  this.sendMessage("Settings:CreateLock", {lockID: this._id, isServiceLock: false});
   Services.tm.currentThread.dispatch(this._closeHelper.bind(this), Ci.nsIThread.DISPATCH_NORMAL);
 }
 
diff --git a/dom/settings/SettingsRequestManager.jsm b/dom/settings/SettingsRequestManager.jsm
index eb5e778c2f9..415e50aee3a 100644
--- a/dom/settings/SettingsRequestManager.jsm
+++ b/dom/settings/SettingsRequestManager.jsm
@@ -601,7 +601,7 @@ let SettingsRequestManager = {
           p.reject("Invalid operation: " + currentTask.operation);
       }
       p.then(function(ret) {
-        ret.task.defer.resolve(ret.results);
+        ret.task.defer.resolve("results" in ret ? ret.results : null);
       }.bind(currentTask), function(ret) {
         ret.task.defer.reject(ret.error);
       });
diff --git a/dom/system/gonk/AutoMounter.cpp b/dom/system/gonk/AutoMounter.cpp
index ed3eee0fc86..0ab4fe43a4d 100644
--- a/dom/system/gonk/AutoMounter.cpp
+++ b/dom/system/gonk/AutoMounter.cpp
@@ -96,9 +96,10 @@ namespace system {
 #define SYS_USB_CONFIG          "sys.usb.config"
 #define PERSIST_SYS_USB_CONFIG  "persist.sys.usb.config"
 
-#define USB_FUNC_ADB  "adb"
-#define USB_FUNC_MTP  "mtp"
-#define USB_FUNC_UMS  "mass_storage"
+#define USB_FUNC_ADB    "adb"
+#define USB_FUNC_MTP    "mtp"
+#define USB_FUNC_RNDIS  "rndis"
+#define USB_FUNC_UMS    "mass_storage"
 
 class AutoMounter;
 
@@ -420,17 +421,21 @@ private:
     // mass_storage has been configured and we can start sharing once the user
     // enables it.
     STATE_UMS_CONFIGURED,
+
+    // USB Tethering is enabled
+    STATE_RNDIS_CONFIGURED,
   };
 
   const char *StateStr(STATE aState)
   {
     switch (aState) {
-      case STATE_IDLE:            return "IDLE";
-      case STATE_MTP_CONFIGURING: return "MTP_CONFIGURING";
-      case STATE_MTP_CONNECTED:   return "MTP_CONNECTED";
-      case STATE_MTP_STARTED:     return "MTP_STARTED";
-      case STATE_UMS_CONFIGURING: return "UMS_CONFIGURING";
-      case STATE_UMS_CONFIGURED:  return "UMS_CONFIGURED";
+      case STATE_IDLE:              return "IDLE";
+      case STATE_MTP_CONFIGURING:   return "MTP_CONFIGURING";
+      case STATE_MTP_CONNECTED:     return "MTP_CONNECTED";
+      case STATE_MTP_STARTED:       return "MTP_STARTED";
+      case STATE_UMS_CONFIGURING:   return "UMS_CONFIGURING";
+      case STATE_UMS_CONFIGURED:    return "UMS_CONFIGURED";
+      case STATE_RNDIS_CONFIGURED:  return "RNDIS_CONFIGURED";
     }
     return "STATE_???";
   }
@@ -660,6 +665,7 @@ AutoMounter::UpdateState()
   bool mtpAvail = false;
   bool mtpConfigured = false;
   bool mtpEnabled = false;
+  bool rndisConfigured = false;
   bool usbCablePluggedIn = IsUsbCablePluggedIn();
 
   if (access(ICS_SYS_USB_FUNCTIONS, F_OK) == 0) {
@@ -690,6 +696,8 @@ AutoMounter::UpdateState()
       mtpConfigured = false;
       mtpEnabled = false;
     }
+
+    rndisConfigured = strstr(functionsStr, USB_FUNC_RNDIS) != nullptr;
   }
 
   bool enabled = mtpEnabled || umsEnabled;
@@ -704,9 +712,9 @@ AutoMounter::UpdateState()
     }
   }
 
-  DBG("UpdateState: ums:A%dC%dE%d mtp:A%dC%dE%d mode:%d usb:%d mState:%s",
+  DBG("UpdateState: ums:A%dC%dE%d mtp:A%dC%dE%d rndis:%d mode:%d usb:%d mState:%s",
       umsAvail, umsConfigured, umsEnabled,
-      mtpAvail, mtpConfigured, mtpEnabled,
+      mtpAvail, mtpConfigured, mtpEnabled, rndisConfigured,
       mMode, usbCablePluggedIn, StateStr(mState));
 
   switch (mState) {
@@ -717,6 +725,11 @@ AutoMounter::UpdateState()
         // UEvent when the usb cable is plugged in.
         break;
       }
+      if (rndisConfigured) {
+        // USB Tethering uses RNDIS. We'll just wait until its turned off.
+        SetState(STATE_RNDIS_CONFIGURED);
+        break;
+      }
       if (mtpEnabled) {
         if (mtpConfigured) {
           // The USB layer has already been configured. Now we can go ahead
@@ -726,7 +739,7 @@ AutoMounter::UpdateState()
           StartMtpServer();
           SetState(STATE_MTP_STARTED);
         } else {
-          // The MTP USB layer is configuring. Wait for it to finish
+          // We need to configure USB to use mtp. Wait for it to be configured
           // before we start the MTP server.
           SetUsbFunction(USB_FUNC_MTP);
           SetState(STATE_MTP_CONFIGURING);
@@ -752,6 +765,11 @@ AutoMounter::UpdateState()
         // the MTP server.
         StartMtpServer();
         SetState(STATE_MTP_STARTED);
+        break;
+      }
+      if (rndisConfigured) {
+        SetState(STATE_RNDIS_CONFIGURED);
+        break;
       }
       break;
 
@@ -764,6 +782,10 @@ AutoMounter::UpdateState()
           "mtpConfigured = %d mtpEnabled = %d usbCablePluggedIn: %d",
           mtpConfigured, mtpEnabled, usbCablePluggedIn);
       StopMtpServer();
+      if (rndisConfigured) {
+        SetState(STATE_RNDIS_CONFIGURED);
+        break;
+      }
       if (umsAvail) {
         // Switch back to UMS
         SetUsbFunction(USB_FUNC_UMS);
@@ -790,6 +812,10 @@ AutoMounter::UpdateState()
         }
         SetState(STATE_UMS_CONFIGURED);
       }
+      if (rndisConfigured) {
+        SetState(STATE_RNDIS_CONFIGURED);
+        break;
+      }
       break;
 
     case STATE_UMS_CONFIGURED:
@@ -805,6 +831,18 @@ AutoMounter::UpdateState()
           break;
         }
       }
+      if (rndisConfigured) {
+        SetState(STATE_RNDIS_CONFIGURED);
+        break;
+      }
+      SetState(STATE_IDLE);
+      break;
+
+    case STATE_RNDIS_CONFIGURED:
+      if (usbCablePluggedIn && rndisConfigured) {
+        // Normal state when RNDIS is enabled.
+        break;
+      }
       SetState(STATE_IDLE);
       break;
 
diff --git a/dom/system/gonk/MozMtpDatabase.cpp b/dom/system/gonk/MozMtpDatabase.cpp
index d03d46d482f..56d40558639 100644
--- a/dom/system/gonk/MozMtpDatabase.cpp
+++ b/dom/system/gonk/MozMtpDatabase.cpp
@@ -363,13 +363,14 @@ MozMtpDatabase::CreateEntryForFile(const nsACString& aPath, DeviceStorageFile* a
     if (slash == kNotFound) {
       component.Rebind(aPath, 0, aPath.Length());
     } else {
-      component.Rebind(aPath, slash, aPath.Length() - slash);
+      component.Rebind(aPath, 0 , slash);
     }
     if (doFind) {
       MtpObjectHandle entryHandle = FindEntryByPath(component);
       if (entryHandle != 0) {
         // We found an entry.
         parent = entryHandle;
+        offset = slash + 1 ;
         continue;
       }
     }
@@ -408,6 +409,7 @@ MozMtpDatabase::CreateEntryForFile(const nsACString& aPath, DeviceStorageFile* a
 
     AddEntry(entry);
     parent = entry->mHandle;
+    offset = slash + 1;
   } while (slash != kNotFound);
 
   return parent; // parent will be entry->mHandle
diff --git a/dom/system/gonk/ril_worker.js b/dom/system/gonk/ril_worker.js
index 8baf8987410..43734a7685f 100644
--- a/dom/system/gonk/ril_worker.js
+++ b/dom/system/gonk/ril_worker.js
@@ -13605,10 +13605,12 @@ SimRecordHelperObject.prototype = {
 
       let numInstances = GsmPDUHelper.readHexOctet();
 
-      // Correct data length should be 9n+1 or 9n+2. See TS 31.102, sub-clause
-      // 4.6.1.1.
-      if (octetLen != (9 * numInstances + 1) ||
-          octetLen != (9 * numInstances + 2)) {
+      // Data length is defined as 9n+1 or 9n+2. See TS 31.102, sub-clause
+      // 4.6.1.1. However, it's likely to have padding appended so we have a
+      // rather loose check.
+      if (octetLen < (9 * numInstances + 1)) {
+        Buf.seekIncoming((octetLen - 1) * Buf.PDU_HEX_OCTET_SIZE);
+        Buf.readStringDelimiter(strLen);
         if (onerror) {
           onerror();
         }
@@ -13629,6 +13631,7 @@ SimRecordHelperObject.prototype = {
                    GsmPDUHelper.readHexOctet()
         };
       }
+      Buf.seekIncoming((octetLen - 9 * numInstances - 1) * Buf.PDU_HEX_OCTET_SIZE);
       Buf.readStringDelimiter(strLen);
 
       let instances = [];
@@ -13688,6 +13691,8 @@ SimRecordHelperObject.prototype = {
       if (octetLen < offset + dataLen) {
         // Data length is not enough. See TS 31.102, clause 4.6.1.1, the
         // paragraph "Bytes 8 and 9: Length of Image Instance Data."
+        Buf.seekIncoming(octetLen * Buf.PDU_HEX_OCTET_SIZE);
+        Buf.readStringDelimiter(strLen);
         if (onerror) {
           onerror();
         }
diff --git a/dom/system/gonk/tests/test_ril_worker_icc_SimRecordHelper.js b/dom/system/gonk/tests/test_ril_worker_icc_SimRecordHelper.js
index e79090b0e8a..13e5854006d 100644
--- a/dom/system/gonk/tests/test_ril_worker_icc_SimRecordHelper.js
+++ b/dom/system/gonk/tests/test_ril_worker_icc_SimRecordHelper.js
@@ -627,6 +627,19 @@ add_test(function test_reading_img_basic() {
         height: 0x05,
         codingScheme: ICC_IMG_CODING_SCHEME_BASIC,
         body: [0x11, 0x33, 0x55, 0xfe]}]},
+    {img: [0x01, 0x05, 0x05, 0x11, 0x4f, 0x00, 0x00, 0x00, 0x00, 0x06,
+           /* Padding */
+           0xff, 0xff],
+     iidf: [
+       [/* Header */
+        0x05, 0x05,
+        /* Image body */
+        0x11, 0x33, 0x55, 0xfe]],
+     expected: [
+       {width: 0x05,
+        height: 0x05,
+        codingScheme: ICC_IMG_CODING_SCHEME_BASIC,
+        body: [0x11, 0x33, 0x55, 0xfe]}]},
     {img: [0x02, 0x10, 0x01, 0x11, 0x4f, 0x04, 0x00, 0x05, 0x00, 0x04, 0x10,
            0x01, 0x11, 0x4f, 0x05, 0x00, 0x05, 0x00, 0x04],
      iidf: [
@@ -770,57 +783,66 @@ add_test(function test_reading_img_length_error() {
   let buf    = context.Buf;
   let io     = context.ICCIOHelper;
  
-  // Offset is 0x0004.
-  let img_test = [0x01, 0x05, 0x05, 0x11, 0x4f, 0x00, 0x00, 0x04, 0x00, 0x06];
-  let iidf_test = [0xff, 0xff, 0xff, // Offset length not enough.
-                   0x05, 0x05, 0x11, 0x22, 0x33, 0xfe];
+  let test_data = [
+    {/* Offset length not enough, should be 4. */
+     img: [0x01, 0x05, 0x05, 0x11, 0x4f, 0x00, 0x00, 0x04, 0x00, 0x06],
+     iidf: [0xff, 0xff, 0xff, // Offset.
+            0x05, 0x05, 0x11, 0x22, 0x33, 0xfe]},
+    {/* iidf data length not enough, should be 6. */
+     img: [0x01, 0x05, 0x05, 0x11, 0x4f, 0x00, 0x00, 0x00, 0x00, 0x06],
+     iidf: [0x05, 0x05, 0x11, 0x22, 0x33]}];
 
-  io.loadLinearFixedEF = function fakeLoadLinearFixedEF(options) {
-    // Write data size
-    buf.writeInt32(img_test.length * 2);
+  function do_test(img, iidf) {
+    io.loadLinearFixedEF = function fakeLoadLinearFixedEF(options) {
+      // Write data size
+      buf.writeInt32(img.length * 2);
 
-    // Write data
-    for (let i = 0; i < img_test.length; i++) {
-      helper.writeHexOctet(img_test[i]);
-    }
+      // Write data
+      for (let i = 0; i < img.length; i++) {
+        helper.writeHexOctet(img[i]);
+      }
 
-    // Write string delimiter
-    buf.writeStringDelimiter(img_test.length * 2);
+      // Write string delimiter
+      buf.writeStringDelimiter(img.length * 2);
 
-    if (options.callback) {
-      options.callback(options);
-    }
-  };
+      if (options.callback) {
+        options.callback(options);
+      }
+    };
 
-  io.loadTransparentEF = function fakeLoadTransparentEF(options) {
-    // Write data size
-    buf.writeInt32(iidf_test.length * 2);
+    io.loadTransparentEF = function fakeLoadTransparentEF(options) {
+      // Write data size
+      buf.writeInt32(iidf.length * 2);
 
-    // Write data
-    for (let i = 0; i < iidf_test.length; i++) {
-      helper.writeHexOctet(iidf_test[i]);
-    }
+      // Write data
+      for (let i = 0; i < iidf.length; i++) {
+        helper.writeHexOctet(iidf[i]);
+      }
 
-    // Write string delimiter
-    buf.writeStringDelimiter(iidf_test.length * 2);
+      // Write string delimiter
+      buf.writeStringDelimiter(iidf.length * 2);
 
-    if (options.callback) {
-      options.callback(options);
-    }
-  };
+      if (options.callback) {
+        options.callback(options);
+      }
+    };
 
-  let onsuccess = function() {
-    do_print("onsuccess shouldn't be called.");
-    do_check_true(false);
-  };
+    let onsuccess = function() {
+      do_print("onsuccess shouldn't be called.");
+      do_check_true(false);
+    };
 
-  let onerror = function() {
-    do_print("onerror called as expected.");
-    do_check_true(true);
-  };
+    let onerror = function() {
+      do_print("onerror called as expected.");
+      do_check_true(true);
+    };
 
-  record.readIMG(0, onsuccess, onerror);
+    record.readIMG(0, onsuccess, onerror);
+  }
 
+  for (let i = 0; i < test_data.length; i++) {
+    do_test(test_data[i].img, test_data[i].iidf);
+  }
   run_next_test();
 });
 
@@ -902,8 +924,7 @@ add_test(function test_reading_img_wrong_record_length() {
   let io     = context.ICCIOHelper;
 
   let test_data = [
-    [0x01, 0x05, 0x05, 0x11, 0x4f, 0x00, 0x00, 0x00, 0x00, 0x06,
-     0xff, 0xff],
+    [0x01, 0x05, 0x05, 0x11, 0x4f, 0x00, 0x00, 0x00],
     [0x02, 0x05, 0x05, 0x11, 0x4f, 0x00, 0x00, 0x00, 0x00, 0x06]];
 
   function do_test(img) {
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index aa420cefa8e..dc8850a1da3 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -643,8 +643,6 @@ var interfaceNamesInGlobalScope =
     "MimeType",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "MimeTypeArray",
-// IMPORTANT: Do not change this list without review from a DOM peer!
-    "ModalContentWindow",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "MouseEvent",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/webidl/HTMLImageElement.webidl b/dom/webidl/HTMLImageElement.webidl
index 8d918f724e2..70185675d45 100644
--- a/dom/webidl/HTMLImageElement.webidl
+++ b/dom/webidl/HTMLImageElement.webidl
@@ -26,7 +26,7 @@ interface HTMLImageElement : HTMLElement {
            [SetterThrows, Pref="dom.image.srcset.enabled"]
            attribute DOMString srcset;
            [SetterThrows]
-           attribute DOMString crossOrigin;
+           attribute DOMString? crossOrigin;
            [SetterThrows]
            attribute DOMString useMap;
            [SetterThrows]
diff --git a/dom/webidl/HTMLLinkElement.webidl b/dom/webidl/HTMLLinkElement.webidl
index c4d7fed5f56..32cfb518cb4 100644
--- a/dom/webidl/HTMLLinkElement.webidl
+++ b/dom/webidl/HTMLLinkElement.webidl
@@ -18,7 +18,7 @@ interface HTMLLinkElement : HTMLElement {
   [SetterThrows, Pure]
            attribute DOMString href;
   [SetterThrows, Pure]
-           attribute DOMString crossOrigin;
+           attribute DOMString? crossOrigin;
   [SetterThrows, Pure]
            attribute DOMString rel;
   readonly attribute DOMTokenList relList;
diff --git a/dom/webidl/HTMLMediaElement.webidl b/dom/webidl/HTMLMediaElement.webidl
index d4095ab0dec..46338efbc88 100644
--- a/dom/webidl/HTMLMediaElement.webidl
+++ b/dom/webidl/HTMLMediaElement.webidl
@@ -22,7 +22,7 @@ interface HTMLMediaElement : HTMLElement {
   readonly attribute DOMString currentSrc;
 
   [SetterThrows]
-           attribute DOMString crossOrigin;
+           attribute DOMString? crossOrigin;
   const unsigned short NETWORK_EMPTY = 0;
   const unsigned short NETWORK_IDLE = 1;
   const unsigned short NETWORK_LOADING = 2;
diff --git a/dom/webidl/HTMLScriptElement.webidl b/dom/webidl/HTMLScriptElement.webidl
index 979e38ca3ad..cbe3161c6c4 100644
--- a/dom/webidl/HTMLScriptElement.webidl
+++ b/dom/webidl/HTMLScriptElement.webidl
@@ -20,7 +20,7 @@ interface HTMLScriptElement : HTMLElement {
   [SetterThrows]
   attribute boolean defer;
   [SetterThrows]
-  attribute DOMString crossOrigin;
+  attribute DOMString? crossOrigin;
   [SetterThrows]
   attribute DOMString text;
 };
diff --git a/dom/webidl/MozNDEFRecord.webidl b/dom/webidl/MozNDEFRecord.webidl
index c158cf7a18e..2baf16ebd53 100644
--- a/dom/webidl/MozNDEFRecord.webidl
+++ b/dom/webidl/MozNDEFRecord.webidl
@@ -5,7 +5,7 @@
 
 /* Copyright © 2013 Deutsche Telekom, Inc. */
 
-[Constructor(octet tnf, optional Uint8Array type, optional Uint8Array id, optional Uint8Array payload)]
+[Constructor(optional MozNDEFRecordOptions options)]
 interface MozNDEFRecord
 {
   /**
@@ -41,3 +41,10 @@ interface MozNDEFRecord
   [Constant]
   readonly attribute Uint8Array? payload;
 };
+
+dictionary MozNDEFRecordOptions {
+  octet tnf = 0; // default to tnf_empty.
+  Uint8Array type;
+  Uint8Array id;
+  Uint8Array payload;
+};
diff --git a/dom/webidl/Navigator.webidl b/dom/webidl/Navigator.webidl
index 1014855adfb..0a4bd21cedf 100644
--- a/dom/webidl/Navigator.webidl
+++ b/dom/webidl/Navigator.webidl
@@ -50,7 +50,7 @@ interface NavigatorID {
   boolean taintEnabled(); // constant false
 };
 
-[NoInterfaceObject]
+[NoInterfaceObject, Exposed=(Window,Worker)]
 interface NavigatorLanguage {
   readonly attribute DOMString? language;
   [Pure, Cached, Frozen]
diff --git a/dom/webidl/NfcOptions.webidl b/dom/webidl/NfcOptions.webidl
index 5430acab61d..0ece5795c57 100644
--- a/dom/webidl/NfcOptions.webidl
+++ b/dom/webidl/NfcOptions.webidl
@@ -2,14 +2,6 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-dictionary NDEFRecord
-{
-  byte tnf;
-  Uint8Array type;
-  Uint8Array id;
-  Uint8Array payload;
-};
-
 dictionary NfcCommandOptions
 {
   DOMString type = "";
@@ -21,7 +13,7 @@ dictionary NfcCommandOptions
 
   long techType;
 
-  sequence<NDEFRecord> records;
+  sequence<MozNDEFRecordOptions> records;
 };
 
 dictionary NfcEventOptions
@@ -36,7 +28,7 @@ dictionary NfcEventOptions
   long minorVersion;
 
   sequence<NFCTechType> techList;
-  sequence<NDEFRecord> records;
+  sequence<MozNDEFRecordOptions> records;
 
   boolean isReadOnly;
   boolean canBeMadeReadOnly;
diff --git a/dom/webidl/SVGScriptElement.webidl b/dom/webidl/SVGScriptElement.webidl
index 5bd2273d183..41bbe065b67 100644
--- a/dom/webidl/SVGScriptElement.webidl
+++ b/dom/webidl/SVGScriptElement.webidl
@@ -16,7 +16,7 @@ interface SVGScriptElement : SVGElement {
 
   // CORS attribute
   [SetterThrows]
-  attribute DOMString crossOrigin;
+  attribute DOMString? crossOrigin;
 };
 
 SVGScriptElement implements SVGURIReference;
diff --git a/dom/webidl/Window.webidl b/dom/webidl/Window.webidl
index 059704ef053..6851d320856 100644
--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@@ -31,7 +31,7 @@ typedef any Transferable;
    CrossOriginReadable] readonly attribute WindowProxy window;
   [Replaceable, Throws,
    CrossOriginReadable] readonly attribute WindowProxy self;
-  [Unforgeable, StoreInSlot, Pure, Func="nsGlobalWindow::WindowOnWebIDL"] readonly attribute Document? document;
+  [Unforgeable, StoreInSlot, Pure] readonly attribute Document? document;
   [Throws] attribute DOMString name; 
   [PutForwards=href, Unforgeable, Throws,
    CrossOriginReadable, CrossOriginWritable] readonly attribute Location? location;
@@ -218,7 +218,7 @@ callback FrameRequestCallback = void (DOMHighResTimeStamp time);
 
 // https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/NavigationTiming/Overview.html
 partial interface Window {
-  [Replaceable, Throws] readonly attribute Performance? performance;
+  [Replaceable, Pure, StoreInSlot] readonly attribute Performance? performance;
 };
 
 // https://dvcs.w3.org/hg/webcrypto-api/raw-file/tip/spec/Overview.html
diff --git a/dom/webidl/WorkerNavigator.webidl b/dom/webidl/WorkerNavigator.webidl
index a0be8137fa0..1b5118eae96 100644
--- a/dom/webidl/WorkerNavigator.webidl
+++ b/dom/webidl/WorkerNavigator.webidl
@@ -8,5 +8,6 @@ interface WorkerNavigator {
 };
 
 WorkerNavigator implements NavigatorID;
+WorkerNavigator implements NavigatorLanguage;
 WorkerNavigator implements NavigatorOnLine;
 WorkerNavigator implements NavigatorDataStore;
diff --git a/dom/wifi/WifiUtils.cpp b/dom/wifi/WifiUtils.cpp
index b8bf8b6b2b3..e461bfa399c 100644
--- a/dom/wifi/WifiUtils.cpp
+++ b/dom/wifi/WifiUtils.cpp
@@ -163,7 +163,7 @@ void LossyConvertUTF8toUTF16(const char* aInput, uint32_t aLength, nsAString& aO
 
   char16_t dst[aLength]; // Allocating for worst case.
 
-  // First, count how many jschars need to be in the inflated string.
+  // Count how many char16_t characters are needed in the inflated string.
   // |i| is the index into |src|, and |j| is the the index into |dst|.
   size_t srclen = src.length();
   uint32_t j = 0;
@@ -214,20 +214,20 @@ void LossyConvertUTF8toUTF16(const char* aInput, uint32_t aLength, nsAString& aO
         if ((src[i + m] & 0xC0) != 0x80)
           INVALID(ReportInvalidCharacter, i, m);
 
-      // Determine the code unit's length in jschars and act accordingly.
+      // Determine the code unit's length in char16_t units and act accordingly.
       v = JS::Utf8ToOneUcs4Char((uint8_t *)&src[i], n);
       if (v < 0x10000) {
-        // The n-byte UTF8 code unit will fit in a single jschar.
-        dst[j] = jschar(v);
+        // The n-byte UTF8 code unit will fit in a single char16_t.
+        dst[j] = char16_t(v);
       } else {
         v -= 0x10000;
         if (v <= 0xFFFFF) {
-          // The n-byte UTF8 code unit will fit in two jschars.
-          dst[j] = jschar((v >> 10) + 0xD800);
+          // The n-byte UTF8 code unit will fit in two char16_t units.
+          dst[j] = char16_t((v >> 10) + 0xD800);
           j++;
-          dst[j] = jschar((v & 0x3FF) + 0xDC00);
+          dst[j] = char16_t((v & 0x3FF) + 0xDC00);
         } else {
-          // The n-byte UTF8 code unit won't fit in two jschars.
+          // The n-byte UTF8 code unit won't fit in two char16_t units.
           INVALID(ReportTooBigCharacter, v, 1);
         }
       }
diff --git a/dom/workers/ChromeWorkerScope.cpp b/dom/workers/ChromeWorkerScope.cpp
index 242aba87243..3b576985e06 100644
--- a/dom/workers/ChromeWorkerScope.cpp
+++ b/dom/workers/ChromeWorkerScope.cpp
@@ -21,7 +21,7 @@ namespace {
 #ifdef BUILD_CTYPES
 
 char*
-UnicodeToNative(JSContext* aCx, const jschar* aSource, size_t aSourceLen)
+UnicodeToNative(JSContext* aCx, const char16_t* aSource, size_t aSourceLen)
 {
   nsDependentString unicode(aSource, aSourceLen);
 
diff --git a/dom/workers/Navigator.cpp b/dom/workers/Navigator.cpp
index 70729aa8334..bf1f05c44ef 100644
--- a/dom/workers/Navigator.cpp
+++ b/dom/workers/Navigator.cpp
@@ -38,7 +38,7 @@ WorkerNavigator::Create(bool aOnLine)
   nsRefPtr<WorkerNavigator> navigator =
     new WorkerNavigator(properties.mAppName, properties.mAppVersion,
                         properties.mPlatform, properties.mUserAgent,
-                        aOnLine);
+                        properties.mLanguages, aOnLine);
 
   return navigator.forget();
 }
@@ -278,4 +278,11 @@ WorkerNavigator::GetDataStores(JSContext* aCx,
   return promise.forget();
 }
 
+void
+WorkerNavigator::SetLanguages(const nsTArray<nsString>& aLanguages)
+{
+  WorkerNavigatorBinding_workers::ClearCachedLanguagesValue(this);
+  mLanguages = aLanguages;
+}
+
 END_WORKERS_NAMESPACE
diff --git a/dom/workers/Navigator.h b/dom/workers/Navigator.h
index 98cef4406f0..5aa90afd6be 100644
--- a/dom/workers/Navigator.h
+++ b/dom/workers/Navigator.h
@@ -28,17 +28,20 @@ class WorkerNavigator MOZ_FINAL : public nsWrapperCache
   nsString mAppVersion;
   nsString mPlatform;
   nsString mUserAgent;
+  nsTArray<nsString> mLanguages;
   bool mOnline;
 
   WorkerNavigator(const nsAString& aAppName,
                   const nsAString& aAppVersion,
                   const nsAString& aPlatform,
                   const nsAString& aUserAgent,
+                  const nsTArray<nsString>& aLanguages,
                   bool aOnline)
     : mAppName(aAppName)
     , mAppVersion(aAppVersion)
     , mPlatform(aPlatform)
     , mUserAgent(aUserAgent)
+    , mLanguages(aLanguages)
     , mOnline(aOnline)
   {
     MOZ_COUNT_CTOR(WorkerNavigator);
@@ -92,6 +95,20 @@ public:
     return false;
   }
 
+  void GetLanguage(nsString& aLanguage) const
+  {
+    if (mLanguages.Length() >= 1) {
+      aLanguage.Assign(mLanguages[0]);
+    } else {
+      aLanguage.Truncate();
+    }
+  }
+
+  void GetLanguages(nsTArray<nsString>& aLanguages) const
+  {
+    aLanguages = mLanguages;
+  }
+
   void GetUserAgent(nsString& aUserAgent) const
   {
     aUserAgent = mUserAgent;
@@ -108,6 +125,8 @@ public:
     mOnline = aOnline;
   }
 
+  void SetLanguages(const nsTArray<nsString>& aLanguages);
+
   already_AddRefed<Promise> GetDataStores(JSContext* aCx,
                                           const nsAString& aName,
                                           const nsAString& aOwner,
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index 712ae1ac9b3..2b01db8eba1 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -156,6 +156,7 @@ static_assert(MAX_WORKERS_PER_DOMAIN >= 1,
 
 #define PREF_DOM_FETCH_ENABLED         "dom.fetch.enabled"
 #define PREF_WORKERS_LATEST_JS_VERSION "dom.workers.latestJSVersion"
+#define PREF_INTL_ACCEPT_LANGUAGES     "intl.accept_languages"
 
 namespace {
 
@@ -736,8 +737,8 @@ GetPrincipalForAsmJSCacheOp()
 
 static bool
 AsmJSCacheOpenEntryForRead(JS::Handle<JSObject*> aGlobal,
-                           const jschar* aBegin,
-                           const jschar* aLimit,
+                           const char16_t* aBegin,
+                           const char16_t* aLimit,
                            size_t* aSize,
                            const uint8_t** aMemory,
                            intptr_t *aHandle)
@@ -754,8 +755,8 @@ AsmJSCacheOpenEntryForRead(JS::Handle<JSObject*> aGlobal,
 static bool
 AsmJSCacheOpenEntryForWrite(JS::Handle<JSObject*> aGlobal,
                             bool aInstalled,
-                            const jschar* aBegin,
-                            const jschar* aEnd,
+                            const char16_t* aBegin,
+                            const char16_t* aEnd,
                             size_t aSize,
                             uint8_t** aMemory,
                             intptr_t* aHandle)
@@ -1025,6 +1026,20 @@ private:
   }
 };
 
+void
+PrefLanguagesChanged(const char* /* aPrefName */, void* /* aClosure */)
+{
+  AssertIsOnMainThread();
+
+  nsTArray<nsString> languages;
+  Navigator::GetAcceptLanguages(languages);
+
+  RuntimeService* runtime = RuntimeService::GetService();
+  if (runtime) {
+    runtime->UpdateAllWorkerLanguages(languages);
+  }
+}
+
 } /* anonymous namespace */
 
 class RuntimeService::WorkerThread MOZ_FINAL : public nsThread
@@ -1456,6 +1471,7 @@ RuntimeService::RegisterWorker(JSContext* aCx, WorkerPrivate* aWorkerPrivate)
         return false;
       }
 
+      Navigator::GetAcceptLanguages(mNavigatorProperties.mLanguages);
       mNavigatorPropertiesLoaded = true;
     }
 
@@ -1795,6 +1811,9 @@ RuntimeService::Init()
                                                    LoadRuntimeOptions,
                                                    PREF_WORKERS_OPTIONS_PREFIX,
                                                    nullptr)) ||
+      NS_FAILED(Preferences::RegisterCallbackAndCall(PrefLanguagesChanged,
+                                                     PREF_INTL_ACCEPT_LANGUAGES,
+                                                     nullptr)) ||
       NS_FAILED(Preferences::RegisterCallbackAndCall(
                                                  JSVersionChanged,
                                                  PREF_WORKERS_LATEST_JS_VERSION,
@@ -1941,6 +1960,9 @@ RuntimeService::Cleanup()
     if (NS_FAILED(Preferences::UnregisterCallback(JSVersionChanged,
                                                   PREF_WORKERS_LATEST_JS_VERSION,
                                                   nullptr)) ||
+        NS_FAILED(Preferences::UnregisterCallback(PrefLanguagesChanged,
+                                                  PREF_INTL_ACCEPT_LANGUAGES,
+                                                  nullptr)) ||
         NS_FAILED(Preferences::UnregisterCallback(LoadRuntimeOptions,
                                                   PREF_JS_OPTIONS_PREFIX,
                                                   nullptr)) ||
@@ -2407,6 +2429,15 @@ RuntimeService::UpdateAllWorkerPreference(WorkerPreference aPref, bool aValue)
   BROADCAST_ALL_WORKERS(UpdatePreference, aPref, aValue);
 }
 
+void
+RuntimeService::UpdateAllWorkerLanguages(const nsTArray<nsString>& aLanguages)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  mNavigatorProperties.mLanguages = aLanguages;
+  BROADCAST_ALL_WORKERS(UpdateLanguages, aLanguages);
+}
+
 void
 RuntimeService::UpdateAllWorkerMemoryParameter(JSGCParamKey aKey,
                                                uint32_t aValue)
diff --git a/dom/workers/RuntimeService.h b/dom/workers/RuntimeService.h
index 205a744a24d..e4958dbb5e6 100644
--- a/dom/workers/RuntimeService.h
+++ b/dom/workers/RuntimeService.h
@@ -108,6 +108,7 @@ public:
     nsString mAppVersion;
     nsString mPlatform;
     nsString mUserAgent;
+    nsTArray<nsString> mLanguages;
   };
 
 private:
@@ -202,6 +203,9 @@ public:
   void
   UpdateAllWorkerRuntimeOptions();
 
+  void
+  UpdateAllWorkerLanguages(const nsTArray<nsString>& aLanguages);
+
   void
   UpdateAllWorkerPreference(WorkerPreference aPref, bool aValue);
 
diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp
index dee63087be4..67bf0297889 100644
--- a/dom/workers/ScriptLoader.cpp
+++ b/dom/workers/ScriptLoader.cpp
@@ -156,7 +156,7 @@ struct ScriptLoadInfo
 
   nsString mURL;
   nsCOMPtr<nsIChannel> mChannel;
-  jschar* mScriptTextBuf;
+  char16_t* mScriptTextBuf;
   size_t mScriptTextLength;
 
   nsresult mLoadResult;
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 7c4063d4d4b..43d392ce479 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -1564,6 +1564,25 @@ public:
   }
 };
 
+class UpdateLanguagesRunnable MOZ_FINAL : public WorkerRunnable
+{
+  nsTArray<nsString> mLanguages;
+
+public:
+  UpdateLanguagesRunnable(WorkerPrivate* aWorkerPrivate,
+                          const nsTArray<nsString>& aLanguages)
+    : WorkerRunnable(aWorkerPrivate, WorkerThreadModifyBusyCount),
+      mLanguages(aLanguages)
+  { }
+
+  virtual bool
+  WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate) MOZ_OVERRIDE
+  {
+    aWorkerPrivate->UpdateLanguagesInternal(aCx, mLanguages);
+    return true;
+  }
+};
+
 class UpdateJSWorkerMemoryParameterRunnable MOZ_FINAL :
   public WorkerControlRunnable
 {
@@ -2891,6 +2910,21 @@ WorkerPrivateParent<Derived>::UpdatePreference(JSContext* aCx, WorkerPreference
   }
 }
 
+template <class Derived>
+void
+WorkerPrivateParent<Derived>::UpdateLanguages(JSContext* aCx,
+                                              const nsTArray<nsString>& aLanguages)
+{
+  AssertIsOnParentThread();
+
+  nsRefPtr<UpdateLanguagesRunnable> runnable =
+    new UpdateLanguagesRunnable(ParentAsWorkerPrivate(), aLanguages);
+  if (!runnable->Dispatch(aCx)) {
+    NS_WARNING("Failed to update worker languages!");
+    JS_ClearPendingException(aCx);
+  }
+}
+
 template <class Derived>
 void
 WorkerPrivateParent<Derived>::UpdateJSWorkerMemoryParameter(JSContext* aCx,
@@ -5527,6 +5561,23 @@ WorkerPrivate::UpdateRuntimeOptionsInternal(
   }
 }
 
+void
+WorkerPrivate::UpdateLanguagesInternal(JSContext* aCx,
+                                       const nsTArray<nsString>& aLanguages)
+{
+  WorkerGlobalScope* globalScope = GlobalScope();
+  if (globalScope) {
+    nsRefPtr<WorkerNavigator> nav = globalScope->GetExistingNavigator();
+    if (nav) {
+      nav->SetLanguages(aLanguages);
+    }
+  }
+
+  for (uint32_t index = 0; index < mChildWorkers.Length(); index++) {
+    mChildWorkers[index]->UpdateLanguages(aCx, aLanguages);
+  }
+}
+
 void
 WorkerPrivate::UpdatePreferenceInternal(JSContext* aCx, WorkerPreference aPref, bool aValue)
 {
diff --git a/dom/workers/WorkerPrivate.h b/dom/workers/WorkerPrivate.h
index f014a7d912b..daa8185fc2b 100644
--- a/dom/workers/WorkerPrivate.h
+++ b/dom/workers/WorkerPrivate.h
@@ -397,6 +397,9 @@ public:
   UpdateRuntimeOptions(JSContext* aCx,
                        const JS::RuntimeOptions& aRuntimeOptions);
 
+  void
+  UpdateLanguages(JSContext* aCx, const nsTArray<nsString>& aLanguages);
+
   void
   UpdatePreference(JSContext* aCx, WorkerPreference aPref, bool aValue);
 
@@ -935,6 +938,9 @@ public:
   void
   UpdateRuntimeOptionsInternal(JSContext* aCx, const JS::RuntimeOptions& aRuntimeOptions);
 
+  void
+  UpdateLanguagesInternal(JSContext* aCx, const nsTArray<nsString>& aLanguages);
+
   void
   UpdatePreferenceInternal(JSContext* aCx, WorkerPreference aPref, bool aValue);
 
diff --git a/dom/workers/test/mochitest.ini b/dom/workers/test/mochitest.ini
index 5f97049d389..e28da6bc934 100644
--- a/dom/workers/test/mochitest.ini
+++ b/dom/workers/test/mochitest.ini
@@ -36,6 +36,7 @@ support-files =
   longThread_worker.js
   multi_sharedWorker_frame.html
   multi_sharedWorker_sharedWorker.js
+  navigator_languages_worker.js
   navigator_worker.js
   newError_worker.js
   onLine_worker.js
@@ -126,6 +127,7 @@ skip-if = (toolkit == 'gonk' && debug) #debug-only failure
 [test_multi_sharedWorker.html]
 [test_multi_sharedWorker_lifetimes.html]
 [test_navigator.html]
+[test_navigator_languages.html]
 skip-if = buildapp == 'mulet'
 [test_newError.html]
 [test_onLine.html]
diff --git a/dom/workers/test/navigator_languages_worker.js b/dom/workers/test/navigator_languages_worker.js
new file mode 100644
index 00000000000..53aa4d39ebc
--- /dev/null
+++ b/dom/workers/test/navigator_languages_worker.js
@@ -0,0 +1,11 @@
+var active = true;
+onmessage = function(e) {
+  if (e.data == 'finish') {
+    active = false;
+    return;
+  }
+
+  if (active) {
+    postMessage(navigator.languages);
+  }
+}
diff --git a/dom/workers/test/navigator_worker.js b/dom/workers/test/navigator_worker.js
index cb22a82fa6a..d10a1295e79 100644
--- a/dom/workers/test/navigator_worker.js
+++ b/dom/workers/test/navigator_worker.js
@@ -13,7 +13,9 @@ var supportedProps = [
   "product",
   "taintEnabled",
   "userAgent",
-  "onLine"
+  "onLine",
+  "language",
+  "languages",
 ];
 
 var isDesktop = !/Mobile|Tablet/.test(navigator.userAgent);
diff --git a/dom/workers/test/test_navigator.html b/dom/workers/test/test_navigator.html
index 680064e8d60..c1f056066c0 100644
--- a/dom/workers/test/test_navigator.html
+++ b/dom/workers/test/test_navigator.html
@@ -46,6 +46,11 @@ Tests of DOM Worker Navigator
       return;
     }
 
+    if (args.name === "languages") {
+      is(navigator.languages.toString(), args.value.toString(), "languages matches");
+      return;
+    }
+
     is(navigator[args.name], args.value,
        "Mismatched navigator string for " + args.name + "!");
   };
diff --git a/dom/workers/test/test_navigator_languages.html b/dom/workers/test/test_navigator_languages.html
new file mode 100644
index 00000000000..2111739d983
--- /dev/null
+++ b/dom/workers/test/test_navigator_languages.html
@@ -0,0 +1,53 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<!--
+Tests of DOM Worker Navigator
+-->
+<head>
+  <title>Test for DOM Worker Navigator.languages</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+<script class="testbody" language="javascript">
+
+  var tests = [ 'en,it', 'it,en,fr', '', 'en' ];
+  var expectedLanguages;
+  function runTests() {
+    if (!tests.length) {
+      worker.postMessage('finish');
+      SimpleTest.finish();
+      return;
+    }
+
+    expectedLanguages = tests.shift();
+    SpecialPowers.pushPrefEnv({"set": [["intl.accept_languages", expectedLanguages]]}, function() {
+      worker.postMessage(true);
+    });
+  }
+
+  SimpleTest.waitForExplicitFinish();
+
+  var worker = new Worker("navigator_languages_worker.js");
+
+  worker.onmessage = function(event) {
+    is(event.data.toString(), navigator.languages.toString(), "The languages mach.");
+    is(event.data.toString(), expectedLanguages, "This is the correct result.");
+    runTests();
+  }
+
+  runTests();
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/xbl/nsXBLProtoImpl.cpp b/dom/xbl/nsXBLProtoImpl.cpp
index 83ce7ca48ef..d8dd6611695 100644
--- a/dom/xbl/nsXBLProtoImpl.cpp
+++ b/dom/xbl/nsXBLProtoImpl.cpp
@@ -337,7 +337,7 @@ nsXBLProtoImpl::UndefineFields(JSContext *cx, JS::Handle<JSObject*> obj) const
   for (nsXBLProtoImplField* f = mFields; f; f = f->GetNext()) {
     nsDependentString name(f->GetName());
 
-    const jschar* s = name.get();
+    const char16_t* s = name.get();
     bool hasProp;
     if (::JS_AlreadyHasOwnUCProperty(cx, obj, s, name.Length(), &hasProp) &&
         hasProp) {
diff --git a/dom/xbl/nsXBLProtoImplField.cpp b/dom/xbl/nsXBLProtoImplField.cpp
index c5f9c69401c..a4b561ed1b3 100644
--- a/dom/xbl/nsXBLProtoImplField.cpp
+++ b/dom/xbl/nsXBLProtoImplField.cpp
@@ -445,7 +445,7 @@ nsXBLProtoImplField::InstallField(JS::Handle<JSObject*> aBoundNode,
   nsDependentString name(mName);
   if (!JS_WrapValue(cx, &result) ||
       !::JS_DefineUCProperty(cx, aBoundNode,
-                             reinterpret_cast<const jschar*>(mName),
+                             reinterpret_cast<const char16_t*>(mName),
                              name.Length(), result, mJSAttributes)) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
diff --git a/dom/xbl/nsXBLProtoImplMethod.cpp b/dom/xbl/nsXBLProtoImplMethod.cpp
index 798d07eeb6e..f75ec7de012 100644
--- a/dom/xbl/nsXBLProtoImplMethod.cpp
+++ b/dom/xbl/nsXBLProtoImplMethod.cpp
@@ -115,7 +115,7 @@ nsXBLProtoImplMethod::InstallMember(JSContext* aCx,
     NS_ENSURE_TRUE(method, NS_ERROR_OUT_OF_MEMORY);
 
     if (!::JS_DefineUCProperty(aCx, aTargetClassObject,
-                               static_cast<const jschar*>(mName),
+                               static_cast<const char16_t*>(mName),
                                name.Length(), method,
                                JSPROP_ENUMERATE)) {
       return NS_ERROR_OUT_OF_MEMORY;
diff --git a/dom/xbl/nsXBLProtoImplProperty.cpp b/dom/xbl/nsXBLProtoImplProperty.cpp
index 295f63db05c..3104b6bb2c9 100644
--- a/dom/xbl/nsXBLProtoImplProperty.cpp
+++ b/dom/xbl/nsXBLProtoImplProperty.cpp
@@ -147,7 +147,7 @@ nsXBLProtoImplProperty::InstallMember(JSContext *aCx,
 
     nsDependentString name(mName);
     if (!::JS_DefineUCProperty(aCx, aTargetClassObject,
-                               static_cast<const jschar*>(mName),
+                               static_cast<const char16_t*>(mName),
                                name.Length(), JS::UndefinedHandleValue, mJSAttributes,
                                JS_DATA_TO_FUNC_PTR(JSPropertyOp, getter.get()),
                                JS_DATA_TO_FUNC_PTR(JSStrictPropertyOp, setter.get())))
diff --git a/editor/libeditor/tests/test_bug502673.html b/editor/libeditor/tests/test_bug502673.html
index 18001ba7845..3bee4554a0d 100644
--- a/editor/libeditor/tests/test_bug502673.html
+++ b/editor/libeditor/tests/test_bug502673.html
@@ -49,12 +49,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=502673
           }
         },
 
-        QueryInterface: function(iid) {
+        QueryInterface: SpecialPowers.wrapCallback(function(iid) {
           if (iid.equals(SpecialPowers.Ci.nsIDocumentStateListener) ||
               iid.equals(SpecialPowers.Ci.nsISupports))
             return this;
           throw SpecialPowers.Cr.NS_ERROR_NO_INTERFACE;
-        },
+        }),
       };
 
       function doTest() {
diff --git a/editor/reftests/reftest.list b/editor/reftests/reftest.list
index 758e55a25b8..81619a8e9c7 100644
--- a/editor/reftests/reftest.list
+++ b/editor/reftests/reftest.list
@@ -100,13 +100,13 @@ needs-focus == spellcheck-superscript-1.html spellcheck-superscript-1-ref.html
 skip-if(B2G) fails-if(Android) needs-focus != spellcheck-superscript-2.html spellcheck-superscript-2-ref.html # bug 783658
 needs-focus == 824080-1.html 824080-1-ref.html
 needs-focus == 824080-2.html 824080-2-ref.html
-needs-focus == 824080-3.html 824080-3-ref.html
+needs-focus test-pref(selectioncaret.enabled,false) == 824080-3.html 824080-3-ref.html
 needs-focus != 824080-2.html 824080-3.html
 needs-focus == 824080-4.html 824080-4-ref.html
-needs-focus == 824080-5.html 824080-5-ref.html
+needs-focus test-pref(selectioncaret.enabled,false) == 824080-5.html 824080-5-ref.html
 needs-focus != 824080-4.html 824080-5.html
 needs-focus == 824080-6.html 824080-6-ref.html
-needs-focus == 824080-7.html 824080-7-ref.html
+needs-focus pref(selectioncaret.enabled,false) == 824080-7.html 824080-7-ref.html
 needs-focus != 824080-6.html 824080-7.html
 # Bug 674927: copy spellcheck-textarea tests to contenteditable
 == spellcheck-contenteditable-attr.html spellcheck-contenteditable-nofocus-ref.html
diff --git a/embedding/test/chrome.ini b/embedding/test/chrome.ini
new file mode 100644
index 00000000000..14dccff247a
--- /dev/null
+++ b/embedding/test/chrome.ini
@@ -0,0 +1,8 @@
+[DEFAULT]
+skip-if = buildapp == 'b2g'
+support-files =
+  320x240.ogv
+  bug449141_page.html
+
+[test_bug449141.html]
+skip-if = toolkit == 'android'
diff --git a/embedding/test/mochitest.ini b/embedding/test/mochitest.ini
index ca3da920b01..897fc6db196 100644
--- a/embedding/test/mochitest.ini
+++ b/embedding/test/mochitest.ini
@@ -1,13 +1,9 @@
 [DEFAULT]
 skip-if = buildapp == 'b2g'
 support-files =
-  320x240.ogv
   bug293834_form.html
-  bug449141_page.html
 
 [test_bug293834.html]
-[test_bug449141.html]
-skip-if = toolkit == 'android'
 [test_bug499115.html]
 [test_nsFind.html]
 [test_private_window_from_content.html]
diff --git a/embedding/test/moz.build b/embedding/test/moz.build
index 3cf16eb0cfe..846268289f1 100644
--- a/embedding/test/moz.build
+++ b/embedding/test/moz.build
@@ -5,4 +5,4 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 MOCHITEST_MANIFESTS += ['mochitest.ini']
-
+MOCHITEST_CHROME_MANIFESTS += ['chrome.ini']
diff --git a/embedding/test/test_bug449141.html b/embedding/test/test_bug449141.html
index 7f40f7ae617..0b75ff331cf 100644
--- a/embedding/test/test_bug449141.html
+++ b/embedding/test/test_bug449141.html
@@ -5,8 +5,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=449141
 -->
 <head>
   <title>Test for Bug 449141</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=449141">Mozilla Bug 449141</a>
diff --git a/gfx/2d/2D.h b/gfx/2d/2D.h
index b0b9f0e423d..18bbaccff46 100644
--- a/gfx/2d/2D.h
+++ b/gfx/2d/2D.h
@@ -985,6 +985,9 @@ public:
   void *GetUserData(UserDataKey *key) {
     return mUserData.Get(key);
   }
+  void *RemoveUserData(UserDataKey *key) {
+    return mUserData.Remove(key);
+  }
 
   /** Within this rectangle all pixels will be opaque by the time the result of
    * this DrawTarget is first used for drawing. Either by the underlying surface
diff --git a/gfx/2d/Factory.cpp b/gfx/2d/Factory.cpp
index 49bbfd05d9c..8b39b7d9f9c 100644
--- a/gfx/2d/Factory.cpp
+++ b/gfx/2d/Factory.cpp
@@ -178,7 +178,16 @@ Factory::HasSSE2()
   // cl.exe with -arch:SSE2 (default on x64 compiler)
   return true;
 #elif defined(HAVE_CPU_DETECTION)
-  return HasCPUIDBit(1u, edx, (1u<<26));
+  static enum {
+    UNINITIALIZED,
+    NO_SSE2,
+    HAS_SSE2
+  } sDetectionState = UNINITIALIZED;
+
+  if (sDetectionState == UNINITIALIZED) {
+    sDetectionState = HasCPUIDBit(1u, edx, (1u<<26)) ? HAS_SSE2 : NO_SSE2;
+  }
+  return sDetectionState == HAS_SSE2;
 #else
   return false;
 #endif
diff --git a/gfx/2d/MacIOSurface.cpp b/gfx/2d/MacIOSurface.cpp
index b21e9fef7a9..b31db7c853a 100644
--- a/gfx/2d/MacIOSurface.cpp
+++ b/gfx/2d/MacIOSurface.cpp
@@ -18,9 +18,11 @@ using namespace mozilla;
 #define OPENGL_FRAMEWORK_PATH \
   "/System/Library/Frameworks/OpenGL.framework/OpenGL"
 #define COREGRAPHICS_FRAMEWORK_PATH \
-  "/System/Library/Frameworks/ApplicationServices.framework/Frameworks/CoreGraphics.framework/CoreGraphics"
-
-
+  "/System/Library/Frameworks/ApplicationServices.framework/Frameworks/" \
+  "CoreGraphics.framework/CoreGraphics"
+#define COREVIDEO_FRAMEWORK_PATH \
+  "/System/Library/Frameworks/ApplicationServices.framework/Frameworks/" \
+  "CoreVideo.framework/CoreVideo"
 
 #define GET_CONST(const_name) \
   ((CFStringRef*) dlsym(sIOSurfaceFramework, const_name))
@@ -30,26 +32,34 @@ using namespace mozilla;
   (typeof(dest)) dlsym(sOpenGLFramework, sym_name)
 #define GET_CGSYM(dest,sym_name) \
   (typeof(dest)) dlsym(sCoreGraphicsFramework, sym_name)
+#define GET_CVSYM(dest, sym_name) \
+  (typeof(dest)) dlsym(sCoreVideoFramework, sym_name)
 
 MacIOSurfaceLib::LibraryUnloader MacIOSurfaceLib::sLibraryUnloader;
 bool                          MacIOSurfaceLib::isLoaded = false;
 void*                         MacIOSurfaceLib::sIOSurfaceFramework;
 void*                         MacIOSurfaceLib::sOpenGLFramework;
 void*                         MacIOSurfaceLib::sCoreGraphicsFramework;
+void*                         MacIOSurfaceLib::sCoreVideoFramework;
 IOSurfaceCreateFunc           MacIOSurfaceLib::sCreate;
 IOSurfaceGetIDFunc            MacIOSurfaceLib::sGetID;
 IOSurfaceLookupFunc           MacIOSurfaceLib::sLookup;
 IOSurfaceGetBaseAddressFunc   MacIOSurfaceLib::sGetBaseAddress;
-IOSurfaceGetWidthFunc         MacIOSurfaceLib::sWidth;
-IOSurfaceGetHeightFunc        MacIOSurfaceLib::sHeight;
-IOSurfaceGetBytesPerRowFunc   MacIOSurfaceLib::sBytesPerRow;
+IOSurfaceGetBaseAddressOfPlaneFunc  MacIOSurfaceLib::sGetBaseAddressOfPlane;
+IOSurfaceSizeTFunc            MacIOSurfaceLib::sWidth;
+IOSurfaceSizeTFunc            MacIOSurfaceLib::sHeight;
+IOSurfaceSizeTFunc            MacIOSurfaceLib::sPlaneCount;
+IOSurfaceSizeTFunc            MacIOSurfaceLib::sBytesPerRow;
 IOSurfaceGetPropertyMaximumFunc   MacIOSurfaceLib::sGetPropertyMaximum;
+IOSurfaceVoidFunc             MacIOSurfaceLib::sIncrementUseCount;
+IOSurfaceVoidFunc             MacIOSurfaceLib::sDecrementUseCount;
 IOSurfaceLockFunc             MacIOSurfaceLib::sLock;
 IOSurfaceUnlockFunc           MacIOSurfaceLib::sUnlock;
 CGLTexImageIOSurface2DFunc    MacIOSurfaceLib::sTexImage;
 IOSurfaceContextCreateFunc    MacIOSurfaceLib::sIOSurfaceContextCreate;
 IOSurfaceContextCreateImageFunc   MacIOSurfaceLib::sIOSurfaceContextCreateImage;
 IOSurfaceContextGetSurfaceFunc    MacIOSurfaceLib::sIOSurfaceContextGetSurface;
+CVPixelBufferGetIOSurfaceFunc MacIOSurfaceLib::sCVPixelBufferGetIOSurface;
 unsigned int                  (*MacIOSurfaceLib::sCGContextGetTypePtr) (CGContextRef) = nullptr;
 
 CFStringRef                   MacIOSurfaceLib::kPropWidth;
@@ -83,6 +93,15 @@ void* MacIOSurfaceLib::IOSurfaceGetBaseAddress(IOSurfacePtr aIOSurfacePtr) {
   return sGetBaseAddress(aIOSurfacePtr);
 }
 
+void* MacIOSurfaceLib::IOSurfaceGetBaseAddressOfPlane(IOSurfacePtr aIOSurfacePtr,
+                                                      size_t planeIndex) {
+  return sGetBaseAddressOfPlane(aIOSurfacePtr, planeIndex);
+}
+
+size_t MacIOSurfaceLib::IOSurfaceGetPlaneCount(IOSurfacePtr aIOSurfacePtr) {
+  return sPlaneCount(aIOSurfacePtr);
+}
+
 size_t MacIOSurfaceLib::IOSurfaceGetWidth(IOSurfacePtr aIOSurfacePtr) {
   return sWidth(aIOSurfacePtr);
 }
@@ -99,16 +118,24 @@ size_t MacIOSurfaceLib::IOSurfaceGetPropertyMaximum(CFStringRef property) {
   return sGetPropertyMaximum(property);
 }
 
-IOReturn MacIOSurfaceLib::IOSurfaceLock(IOSurfacePtr aIOSurfacePtr, 
-                                       uint32_t options, uint32_t *seed) {
+IOReturn MacIOSurfaceLib::IOSurfaceLock(IOSurfacePtr aIOSurfacePtr,
+                                       uint32_t options, uint32_t* seed) {
   return sLock(aIOSurfacePtr, options, seed);
 }
 
-IOReturn MacIOSurfaceLib::IOSurfaceUnlock(IOSurfacePtr aIOSurfacePtr, 
+IOReturn MacIOSurfaceLib::IOSurfaceUnlock(IOSurfacePtr aIOSurfacePtr,
                                          uint32_t options, uint32_t *seed) {
   return sUnlock(aIOSurfacePtr, options, seed);
 }
 
+void MacIOSurfaceLib::IOSurfaceIncrementUseCount(IOSurfacePtr aIOSurfacePtr) {
+  sIncrementUseCount(aIOSurfacePtr);
+}
+
+void MacIOSurfaceLib::IOSurfaceDecrementUseCount(IOSurfacePtr aIOSurfacePtr) {
+  sDecrementUseCount(aIOSurfacePtr);
+}
+
 CGLError MacIOSurfaceLib::CGLTexImageIOSurface2D(CGLContextObj ctxt,
                              GLenum target, GLenum internalFormat,
                              GLsizei width, GLsizei height,
@@ -118,6 +145,10 @@ CGLError MacIOSurfaceLib::CGLTexImageIOSurface2D(CGLContextObj ctxt,
                    format, type, ioSurface, plane);
 }
 
+IOSurfacePtr MacIOSurfaceLib::CVPixelBufferGetIOSurface(CVPixelBufferRef aPixelBuffer) {
+  return sCVPixelBufferGetIOSurface(aPixelBuffer);
+}
+
 CGContextRef MacIOSurfaceLib::IOSurfaceContextCreate(IOSurfacePtr aIOSurfacePtr,
                              unsigned aWidth, unsigned aHeight,
                              unsigned aBitsPerComponent, unsigned aBytes,
@@ -159,16 +190,24 @@ void MacIOSurfaceLib::LoadLibrary() {
 
   sCoreGraphicsFramework = dlopen(COREGRAPHICS_FRAMEWORK_PATH,
                             RTLD_LAZY | RTLD_LOCAL);
-  if (!sIOSurfaceFramework || !sOpenGLFramework || !sCoreGraphicsFramework) {
+
+  sCoreVideoFramework = dlopen(COREVIDEO_FRAMEWORK_PATH,
+                            RTLD_LAZY | RTLD_LOCAL);
+
+  if (!sIOSurfaceFramework || !sOpenGLFramework || !sCoreGraphicsFramework ||
+      !sCoreVideoFramework) {
     if (sIOSurfaceFramework)
       dlclose(sIOSurfaceFramework);
     if (sOpenGLFramework)
       dlclose(sOpenGLFramework);
     if (sCoreGraphicsFramework)
       dlclose(sCoreGraphicsFramework);
+    if (sCoreVideoFramework)
+      dlclose(sCoreVideoFramework);
     sIOSurfaceFramework = nullptr;
     sOpenGLFramework = nullptr;
     sCoreGraphicsFramework = nullptr;
+    sCoreVideoFramework = nullptr;
     return;
   }
 
@@ -186,19 +225,32 @@ void MacIOSurfaceLib::LoadLibrary() {
   sLookup = GET_IOSYM(sLookup, "IOSurfaceLookup");
   sLock = GET_IOSYM(sLock, "IOSurfaceLock");
   sUnlock = GET_IOSYM(sUnlock, "IOSurfaceUnlock");
+  sIncrementUseCount =
+    GET_IOSYM(sIncrementUseCount, "IOSurfaceIncrementUseCount");
+  sDecrementUseCount =
+    GET_IOSYM(sDecrementUseCount, "IOSurfaceDecrementUseCount");
   sGetBaseAddress = GET_IOSYM(sGetBaseAddress, "IOSurfaceGetBaseAddress");
+  sGetBaseAddressOfPlane =
+    GET_IOSYM(sGetBaseAddressOfPlane, "IOSurfaceGetBaseAddressOfPlane");
+  sPlaneCount = GET_IOSYM(sPlaneCount, "IOSurfaceGetPlaneCount");
+
   sTexImage = GET_CGLSYM(sTexImage, "CGLTexImageIOSurface2D");
   sCGContextGetTypePtr = (unsigned int (*)(CGContext*))dlsym(RTLD_DEFAULT, "CGContextGetType");
 
+  sCVPixelBufferGetIOSurface =
+    GET_CVSYM(sCVPixelBufferGetIOSurface, "CVPixelBufferGetIOSurface");
+
   // Optional symbols
   sIOSurfaceContextCreate = GET_CGSYM(sIOSurfaceContextCreate, "CGIOSurfaceContextCreate");
   sIOSurfaceContextCreateImage = GET_CGSYM(sIOSurfaceContextCreateImage, "CGIOSurfaceContextCreateImage");
   sIOSurfaceContextGetSurface = GET_CGSYM(sIOSurfaceContextGetSurface, "CGIOSurfaceContextGetSurface");
 
   if (!sCreate || !sGetID || !sLookup || !sTexImage || !sGetBaseAddress ||
+      !sGetBaseAddressOfPlane || !sPlaneCount ||
       !kPropWidth || !kPropHeight || !kPropBytesPerElem || !kPropIsGlobal ||
-      !sLock || !sUnlock || !sWidth || !sHeight || !kPropBytesPerRow ||
-      !sBytesPerRow || !sGetPropertyMaximum) {
+      !sLock || !sUnlock || !sIncrementUseCount || !sDecrementUseCount ||
+      !sWidth || !sHeight || !kPropBytesPerRow ||
+      !sBytesPerRow || !sGetPropertyMaximum || !sCVPixelBufferGetIOSurface) {
     CloseLibrary();
   }
 }
@@ -210,11 +262,26 @@ void MacIOSurfaceLib::CloseLibrary() {
   if (sOpenGLFramework) {
     dlclose(sOpenGLFramework);
   }
+  if (sCoreVideoFramework) {
+    dlclose(sCoreVideoFramework);
+  }
   sIOSurfaceFramework = nullptr;
   sOpenGLFramework = nullptr;
+  sCoreVideoFramework = nullptr;
+}
+
+MacIOSurface::MacIOSurface(const void* aIOSurfacePtr,
+                           double aContentsScaleFactor, bool aHasAlpha)
+  : mIOSurfacePtr(aIOSurfacePtr)
+  , mContentsScaleFactor(aContentsScaleFactor)
+  , mHasAlpha(aHasAlpha)
+{
+  CFRetain(mIOSurfacePtr);
+  IncrementUseCount();
 }
 
 MacIOSurface::~MacIOSurface() {
+  DecrementUseCount();
   CFRelease(mIOSurfacePtr);
 }
 
@@ -265,6 +332,9 @@ TemporaryRef<MacIOSurface> MacIOSurface::CreateIOSurface(int aWidth, int aHeight
     return nullptr;
   }
 
+  // Release the IOSurface because MacIOSurface retained it
+  CFRelease(surfaceRef);
+
   return ioSurface.forget();
 }
 
@@ -283,6 +353,10 @@ TemporaryRef<MacIOSurface> MacIOSurface::LookupSurface(IOSurfaceID aIOSurfaceID,
     ::CFRelease(surfaceRef);
     return nullptr;
   }
+
+  // Release the IOSurface because MacIOSurface retained it
+  CFRelease(surfaceRef);
+
   return ioSurface.forget();
 }
 
@@ -294,6 +368,12 @@ void* MacIOSurface::GetBaseAddress() {
   return MacIOSurfaceLib::IOSurfaceGetBaseAddress(mIOSurfacePtr);
 }
 
+void* MacIOSurface::GetBaseAddressOfPlane(size_t aPlaneIndex)
+{
+  return MacIOSurfaceLib::IOSurfaceGetBaseAddressOfPlane(mIOSurfacePtr,
+                                                         aPlaneIndex);
+}
+
 size_t MacIOSurface::GetWidth() {
   size_t intScaleFactor = ceil(mContentsScaleFactor);
   return GetDevicePixelWidth() / intScaleFactor;
@@ -304,6 +384,10 @@ size_t MacIOSurface::GetHeight() {
   return GetDevicePixelHeight() / intScaleFactor;
 }
 
+size_t MacIOSurface::GetPlaneCount() {
+  return MacIOSurfaceLib::IOSurfaceGetPlaneCount(mIOSurfacePtr);
+}
+
 /*static*/ size_t MacIOSurface::GetMaxWidth() {
   return MacIOSurfaceLib::IOSurfaceGetPropertyMaximum(MacIOSurfaceLib::kPropWidth);
 }
@@ -324,6 +408,14 @@ size_t MacIOSurface::GetBytesPerRow() {
   return MacIOSurfaceLib::IOSurfaceGetBytesPerRow(mIOSurfacePtr);
 }
 
+void MacIOSurface::IncrementUseCount() {
+  MacIOSurfaceLib::IOSurfaceIncrementUseCount(mIOSurfacePtr);
+}
+
+void MacIOSurface::DecrementUseCount() {
+  MacIOSurfaceLib::IOSurfaceDecrementUseCount(mIOSurfacePtr);
+}
+
 #define READ_ONLY 0x1
 void MacIOSurface::Lock() {
   MacIOSurfaceLib::IOSurfaceLock(mIOSurfacePtr, READ_ONLY, nullptr);
@@ -413,9 +505,6 @@ TemporaryRef<MacIOSurface> MacIOSurface::IOSurfaceContextGetSurface(CGContextRef
   if (!surfaceRef)
     return nullptr;
 
-  // Retain the IOSurface because MacIOSurface will release it
-  CFRetain(surfaceRef);
-
   RefPtr<MacIOSurface> ioSurface = new MacIOSurface(surfaceRef, aContentsScaleFactor, aHasAlpha);
   if (!ioSurface) {
     ::CFRelease(surfaceRef);
diff --git a/gfx/2d/MacIOSurface.h b/gfx/2d/MacIOSurface.h
index 098ebabe9d3..62ddcd73481 100644
--- a/gfx/2d/MacIOSurface.h
+++ b/gfx/2d/MacIOSurface.h
@@ -14,17 +14,16 @@
 typedef CFTypeRef IOSurfacePtr;
 typedef IOSurfacePtr (*IOSurfaceCreateFunc) (CFDictionaryRef properties);
 typedef IOSurfacePtr (*IOSurfaceLookupFunc) (uint32_t io_surface_id);
-typedef IOSurfaceID (*IOSurfaceGetIDFunc) (CFTypeRef io_surface);
-typedef IOReturn (*IOSurfaceLockFunc) (CFTypeRef io_surface, 
-                                       uint32_t options, 
-                                       uint32_t *seed);
-typedef IOReturn (*IOSurfaceUnlockFunc) (CFTypeRef io_surface, 
-                                         uint32_t options, 
-                                         uint32_t *seed);
-typedef void* (*IOSurfaceGetBaseAddressFunc) (CFTypeRef io_surface);
-typedef size_t (*IOSurfaceGetWidthFunc) (IOSurfacePtr io_surface);
-typedef size_t (*IOSurfaceGetHeightFunc) (IOSurfacePtr io_surface);
-typedef size_t (*IOSurfaceGetBytesPerRowFunc) (IOSurfacePtr io_surface);
+typedef IOSurfaceID (*IOSurfaceGetIDFunc)(IOSurfacePtr io_surface);
+typedef void (*IOSurfaceVoidFunc)(IOSurfacePtr io_surface);
+typedef IOReturn (*IOSurfaceLockFunc)(IOSurfacePtr io_surface, uint32_t options,
+                                      uint32_t *seed);
+typedef IOReturn (*IOSurfaceUnlockFunc)(IOSurfacePtr io_surface,
+                                        uint32_t options, uint32_t *seed);
+typedef void* (*IOSurfaceGetBaseAddressFunc)(IOSurfacePtr io_surface);
+typedef void* (*IOSurfaceGetBaseAddressOfPlaneFunc)(IOSurfacePtr io_surface,
+                                                    size_t planeIndex);
+typedef size_t (*IOSurfaceSizeTFunc)(IOSurfacePtr io_surface);
 typedef size_t (*IOSurfaceGetPropertyMaximumFunc) (CFStringRef property);
 typedef CGLError (*CGLTexImageIOSurface2DFunc) (CGLContextObj ctxt,
                              GLenum target, GLenum internalFormat,
@@ -38,6 +37,8 @@ typedef CGContextRef (*IOSurfaceContextCreateFunc)(CFTypeRef io_surface,
 typedef CGImageRef (*IOSurfaceContextCreateImageFunc)(CGContextRef ref);
 typedef IOSurfacePtr (*IOSurfaceContextGetSurfaceFunc)(CGContextRef ref);
 
+typedef IOSurfacePtr (*CVPixelBufferGetIOSurfaceFunc)(
+  CVPixelBufferRef pixelBuffer);
 
 #import <OpenGL/OpenGL.h>
 #include "2D.h"
@@ -64,6 +65,10 @@ public:
   MOZ_DECLARE_REFCOUNTED_VIRTUAL_TYPENAME(MacIOSurface)
   typedef mozilla::gfx::SourceSurface SourceSurface;
 
+  // The usage count of the IOSurface is increased by 1 during the lifetime
+  // of the MacIOSurface instance.
+  // MacIOSurface holds a reference to the corresponding IOSurface.
+
   static mozilla::TemporaryRef<MacIOSurface> CreateIOSurface(int aWidth, int aHeight,
                                                              double aContentsScaleFactor = 1.0,
                                                              bool aHasAlpha = true);
@@ -72,11 +77,14 @@ public:
                                                            double aContentsScaleFactor = 1.0,
                                                            bool aHasAlpha = true);
 
-  explicit MacIOSurface(const void *aIOSurfacePtr, double aContentsScaleFactor = 1.0, bool aHasAlpha = true)
-    : mIOSurfacePtr(aIOSurfacePtr), mContentsScaleFactor(aContentsScaleFactor), mHasAlpha(aHasAlpha) {}
+  explicit MacIOSurface(const void *aIOSurfacePtr,
+                        double aContentsScaleFactor = 1.0,
+                        bool aHasAlpha = true);
   virtual ~MacIOSurface();
   IOSurfaceID GetIOSurfaceID();
   void *GetBaseAddress();
+  void *GetBaseAddressOfPlane(size_t planeIndex);
+  size_t GetPlaneCount();
   // GetWidth() and GetHeight() return values in "display pixels".  A
   // "display pixel" is the smallest fully addressable part of a display.
   // But in HiDPI modes each "display pixel" corresponds to more than one
@@ -89,6 +97,8 @@ public:
   size_t GetBytesPerRow();
   void Lock();
   void Unlock();
+  void IncrementUseCount();
+  void DecrementUseCount();
   bool HasAlpha() { return mHasAlpha; }
   // We would like to forward declare NSOpenGLContext, but it is an @interface
   // and this file is also used from c++, so we use a void *.
@@ -117,21 +127,27 @@ public:
   static void                        *sIOSurfaceFramework;
   static void                        *sOpenGLFramework;
   static void                        *sCoreGraphicsFramework;
+  static void                        *sCoreVideoFramework;
   static bool                         isLoaded;
   static IOSurfaceCreateFunc          sCreate;
   static IOSurfaceGetIDFunc           sGetID;
   static IOSurfaceLookupFunc          sLookup;
   static IOSurfaceGetBaseAddressFunc  sGetBaseAddress;
+  static IOSurfaceGetBaseAddressOfPlaneFunc sGetBaseAddressOfPlane;
+  static IOSurfaceSizeTFunc           sPlaneCount;
   static IOSurfaceLockFunc            sLock;
   static IOSurfaceUnlockFunc          sUnlock;
-  static IOSurfaceGetWidthFunc        sWidth;
-  static IOSurfaceGetHeightFunc       sHeight;
-  static IOSurfaceGetBytesPerRowFunc  sBytesPerRow;
+  static IOSurfaceVoidFunc            sIncrementUseCount;
+  static IOSurfaceVoidFunc            sDecrementUseCount;
+  static IOSurfaceSizeTFunc           sWidth;
+  static IOSurfaceSizeTFunc           sHeight;
+  static IOSurfaceSizeTFunc           sBytesPerRow;
   static IOSurfaceGetPropertyMaximumFunc  sGetPropertyMaximum;
   static CGLTexImageIOSurface2DFunc   sTexImage;
   static IOSurfaceContextCreateFunc   sIOSurfaceContextCreate;
   static IOSurfaceContextCreateImageFunc  sIOSurfaceContextCreateImage;
   static IOSurfaceContextGetSurfaceFunc   sIOSurfaceContextGetSurface;
+  static CVPixelBufferGetIOSurfaceFunc    sCVPixelBufferGetIOSurface;
   static CFStringRef                  kPropWidth;
   static CFStringRef                  kPropHeight;
   static CFStringRef                  kPropBytesPerElem;
@@ -144,14 +160,19 @@ public:
   static IOSurfacePtr IOSurfaceLookup(IOSurfaceID aIOSurfaceID);
   static IOSurfaceID  IOSurfaceGetID(IOSurfacePtr aIOSurfacePtr);
   static void*        IOSurfaceGetBaseAddress(IOSurfacePtr aIOSurfacePtr);
+  static void*        IOSurfaceGetBaseAddressOfPlane(IOSurfacePtr aIOSurfacePtr,
+                                                     size_t aPlaneIndex);
+  static size_t       IOSurfaceGetPlaneCount(IOSurfacePtr aIOSurfacePtr);
   static size_t       IOSurfaceGetWidth(IOSurfacePtr aIOSurfacePtr);
   static size_t       IOSurfaceGetHeight(IOSurfacePtr aIOSurfacePtr);
   static size_t       IOSurfaceGetBytesPerRow(IOSurfacePtr aIOSurfacePtr);
   static size_t       IOSurfaceGetPropertyMaximum(CFStringRef property);
-  static IOReturn     IOSurfaceLock(IOSurfacePtr aIOSurfacePtr, 
+  static IOReturn     IOSurfaceLock(IOSurfacePtr aIOSurfacePtr,
                                     uint32_t options, uint32_t *seed);
-  static IOReturn     IOSurfaceUnlock(IOSurfacePtr aIOSurfacePtr, 
+  static IOReturn     IOSurfaceUnlock(IOSurfacePtr aIOSurfacePtr,
                                       uint32_t options, uint32_t *seed);
+  static void         IOSurfaceIncrementUseCount(IOSurfacePtr aIOSurfacePtr);
+  static void         IOSurfaceDecrementUseCount(IOSurfacePtr aIOSurfacePtr);
   static CGLError     CGLTexImageIOSurface2D(CGLContextObj ctxt,
                              GLenum target, GLenum internalFormat,
                              GLsizei width, GLsizei height,
@@ -163,6 +184,7 @@ public:
                              CGColorSpaceRef aColorSpace, CGBitmapInfo bitmapInfo);
   static CGImageRef   IOSurfaceContextCreateImage(CGContextRef ref);
   static IOSurfacePtr IOSurfaceContextGetSurface(CGContextRef ref);
+  static IOSurfacePtr CVPixelBufferGetIOSurface(CVPixelBufferRef apixelBuffer);
   static unsigned int (*sCGContextGetTypePtr) (CGContextRef);
   static void LoadLibrary();
   static void CloseLibrary();
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 590b69a5eaf..83a24b7c112 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -667,6 +667,8 @@ public:
     return SupportsMixBlendModes(modes);
   }
 
+  virtual float RequestProperty(const nsAString& property) { return -1; }
+
 protected:
   nsRefPtr<Layer> mRoot;
   gfx::UserData mUserData;
diff --git a/gfx/layers/apz/src/APZCTreeManager.cpp b/gfx/layers/apz/src/APZCTreeManager.cpp
index 606c3fb7236..b49e4abf39d 100644
--- a/gfx/layers/apz/src/APZCTreeManager.cpp
+++ b/gfx/layers/apz/src/APZCTreeManager.cpp
@@ -339,9 +339,6 @@ APZCTreeManager::PrepareAPZCForLayer(const LayerMetricsWrapper& aLayer,
           apzc->GetParent()->GetGuid().mScrollId);
     }
 
-    // Let this apzc be the parent of other controllers when we recurse downwards
-    aOutParent = apzc;
-
     if (newApzc) {
       if (apzc->IsRootForLayersId()) {
         // If we just created a new apzc that is the root for its layers ID, then
@@ -382,6 +379,9 @@ APZCTreeManager::PrepareAPZCForLayer(const LayerMetricsWrapper& aLayer,
     APZCTM_LOG("Adding region %s to visible region of APZC %p\n", Stringify(unobscured).c_str(), apzc);
   }
 
+  // Let this apzc be the parent of other controllers when we recurse downwards
+  aOutParent = apzc;
+
   return apzc;
 }
 
@@ -406,7 +406,7 @@ APZCTreeManager::UpdatePanZoomControllerTree(TreeBuildingState& aState,
   mApzcTreeLog << '\n';
 
   // Accumulate the CSS transform between layers that have an APZC.
-  // In the terminology of the big comment above APZCTreeManager::GetInputTransforms, if
+  // In the terminology of the big comment above APZCTreeManager::GetScreenToApzcTransform, if
   // we are at layer M, then aAncestorTransform is NC * OC * PC, and we left-multiply MC and
   // compute ancestorTransform to be MC * NC * OC * PC. This gets passed down as the ancestor
   // transform to layer L when we recurse into the children below. If we are at a layer
@@ -495,8 +495,8 @@ ApplyTransform(nsIntPoint* aPoint, const Matrix4x4& aMatrix)
 /*static*/ template<class T> void
 TransformScreenToGecko(T* aPoint, AsyncPanZoomController* aApzc, APZCTreeManager* aApzcTm)
 {
-  Matrix4x4 transformToApzc, transformToGecko;
-  aApzcTm->GetInputTransforms(aApzc, transformToApzc, transformToGecko);
+  Matrix4x4 transformToApzc = aApzcTm->GetScreenToApzcTransform(aApzc);
+  Matrix4x4 transformToGecko = aApzcTm->GetApzcToGeckoTransform(aApzc);
   ApplyTransform(aPoint, transformToApzc * transformToGecko);
 }
 
@@ -506,7 +506,6 @@ APZCTreeManager::ReceiveInputEvent(InputData& aEvent,
 {
   nsEventStatus result = nsEventStatus_eIgnore;
   Matrix4x4 transformToApzc;
-  Matrix4x4 transformToGecko;
   bool inOverscrolledApzc = false;
   switch (aEvent.mInputType) {
     case MULTITOUCH_INPUT: {
@@ -522,7 +521,7 @@ APZCTreeManager::ReceiveInputEvent(InputData& aEvent,
         // transform than the one in TransformScreenToGecko, so we need to
         // make a copy of the event.
         PanGestureInput inputForApzc(panInput);
-        GetInputTransforms(apzc, transformToApzc, transformToGecko);
+        transformToApzc = GetScreenToApzcTransform(apzc);
         ApplyTransform(&(inputForApzc.mPanStartPoint), transformToApzc);
         result = apzc->ReceiveInputEvent(inputForApzc);
 
@@ -540,7 +539,7 @@ APZCTreeManager::ReceiveInputEvent(InputData& aEvent,
         // transform than the one in TransformScreenToGecko, so we need to
         // make a copy of the event.
         PinchGestureInput inputForApzc(pinchInput);
-        GetInputTransforms(apzc, transformToApzc, transformToGecko);
+        transformToApzc = GetScreenToApzcTransform(apzc);
         ApplyTransform(&(inputForApzc.mFocusPoint), transformToApzc);
         result = apzc->ReceiveInputEvent(inputForApzc);
 
@@ -558,7 +557,7 @@ APZCTreeManager::ReceiveInputEvent(InputData& aEvent,
         // transform than the one in TransformScreenToGecko, so we need to
         // make a copy of the event.
         TapGestureInput inputForApzc(tapInput);
-        GetInputTransforms(apzc, transformToApzc, transformToGecko);
+        transformToApzc = GetScreenToApzcTransform(apzc);
         ApplyTransform(&(inputForApzc.mPoint), transformToApzc);
         result = apzc->ReceiveInputEvent(inputForApzc);
 
@@ -632,8 +631,7 @@ APZCTreeManager::ProcessTouchInput(MultiTouchInput& aInput,
 
     if (mApzcForInputBlock) {
       // Cache apz transform so it can be used for future events in this block.
-      Matrix4x4 transformToGecko;
-      GetInputTransforms(mApzcForInputBlock, mCachedTransformToApzcForInputBlock, transformToGecko);
+      mCachedTransformToApzcForInputBlock = GetScreenToApzcTransform(mApzcForInputBlock);
     } else {
       // Reset the cached apz transform
       mCachedTransformToApzcForInputBlock = Matrix4x4();
@@ -680,8 +678,8 @@ APZCTreeManager::ProcessTouchInput(MultiTouchInput& aInput,
     // For computing the event to pass back to Gecko, use the up-to-date transforms.
     // This ensures that transformToApzc and transformToGecko are in sync
     // (note that transformToGecko isn't cached).
-    Matrix4x4 transformToGecko;
-    GetInputTransforms(mApzcForInputBlock, transformToApzc, transformToGecko);
+    transformToApzc = GetScreenToApzcTransform(mApzcForInputBlock);
+    Matrix4x4 transformToGecko = GetApzcToGeckoTransform(mApzcForInputBlock);
     Matrix4x4 outTransform = transformToApzc * transformToGecko;
     for (size_t i = 0; i < aInput.mTouches.Length(); i++) {
       ApplyTransform(&(aInput.mTouches[i].mScreenPoint), outTransform);
@@ -721,9 +719,8 @@ APZCTreeManager::TransformCoordinateToGecko(const ScreenIntPoint& aPoint,
   MOZ_ASSERT(aOutTransformedPoint);
   nsRefPtr<AsyncPanZoomController> apzc = GetTargetAPZC(aPoint, nullptr);
   if (apzc && aOutTransformedPoint) {
-    Matrix4x4 transformToApzc;
-    Matrix4x4 transformToGecko;
-    GetInputTransforms(apzc, transformToApzc, transformToGecko);
+    Matrix4x4 transformToApzc = GetScreenToApzcTransform(apzc);
+    Matrix4x4 transformToGecko = GetApzcToGeckoTransform(apzc);
     Matrix4x4 outTransform = transformToApzc * transformToGecko;
     *aOutTransformedPoint = TransformTo<LayoutDevicePixel>(outTransform, aPoint);
   }
@@ -743,9 +740,8 @@ APZCTreeManager::ProcessEvent(WidgetInputEvent& aEvent,
                                                         &inOverscrolledApzc);
   if (apzc) {
     apzc->GetGuid(aOutTargetGuid);
-    Matrix4x4 transformToApzc;
-    Matrix4x4 transformToGecko;
-    GetInputTransforms(apzc, transformToApzc, transformToGecko);
+    Matrix4x4 transformToApzc = GetScreenToApzcTransform(apzc);
+    Matrix4x4 transformToGecko = GetApzcToGeckoTransform(apzc);
     Matrix4x4 outTransform = transformToApzc * transformToGecko;
     ApplyTransform(&(aEvent.refPoint), outTransform);
   }
@@ -877,17 +873,16 @@ TransformDisplacement(APZCTreeManager* aTreeManager,
                       ScreenPoint& aStartPoint,
                       ScreenPoint& aEndPoint) {
   Matrix4x4 transformToApzc;
-  Matrix4x4 transformToGecko;  // ignored
 
   // Convert start and end points to untransformed screen coordinates.
-  aTreeManager->GetInputTransforms(aSource, transformToApzc, transformToGecko);
+  transformToApzc = aTreeManager->GetScreenToApzcTransform(aSource);
   Matrix4x4 untransformToApzc = transformToApzc;
   untransformToApzc.Invert();
   ApplyTransform(&aStartPoint, untransformToApzc);
   ApplyTransform(&aEndPoint, untransformToApzc);
 
   // Convert start and end points to aTarget's transformed screen coordinates.
-  aTreeManager->GetInputTransforms(aTarget, transformToApzc, transformToGecko);
+  transformToApzc = aTreeManager->GetScreenToApzcTransform(aTarget);
   ApplyTransform(&aStartPoint, transformToApzc);
   ApplyTransform(&aEndPoint, transformToApzc);
 }
@@ -934,31 +929,10 @@ APZCTreeManager::DispatchFling(AsyncPanZoomController* aPrev,
                                nsRefPtr<const OverscrollHandoffChain> aOverscrollHandoffChain,
                                bool aHandoff)
 {
-  nsRefPtr<AsyncPanZoomController> next;
-
-  // If the fling is being handed off, give it to the next APZC in the
-  // handoff chain after |aPrev|.
-  if (aHandoff) {
-    // Find |aPrev| in the handoff chain.
-    uint32_t i = aOverscrollHandoffChain->IndexOf(aPrev);
-
-    // Get the next APZC in the handoff chain, if any.
-    if (i + 1 < aOverscrollHandoffChain->Length()) {
-      next = aOverscrollHandoffChain->GetApzcAtIndex(i + 1);
-    }
-  // If the fling is being started, give it to the first APZC in the
-  // handoff chain.
-  } else {
-    if (aOverscrollHandoffChain->Length() != 0) {
-      next = aOverscrollHandoffChain->GetApzcAtIndex(0);
-    }
-  }
-
-  // Nothing to hand off fling to.
-  if (next == nullptr || next->IsDestroyed()) {
-    return false;
-  }
-
+  nsRefPtr<AsyncPanZoomController> current;
+  uint32_t aOverscrollHandoffChainLength = aOverscrollHandoffChain->Length();
+  uint32_t startIndex;
+  
   // The fling's velocity needs to be transformed from the screen coordinates
   // of |aPrev| to the screen coordinates of |next|. To transform a velocity
   // correctly, we need to convert it to a displacement. For now, we do this
@@ -967,14 +941,51 @@ APZCTreeManager::DispatchFling(AsyncPanZoomController* aPrev,
   // use the end point of the touch that started the fling as the start point
   // rather than (0, 0).
   ScreenPoint startPoint;  // (0, 0)
-  ScreenPoint endPoint = startPoint + aVelocity;
-  if (aPrev != next) {
-    TransformDisplacement(this, aPrev, next, startPoint, endPoint);
+  ScreenPoint endPoint;
+  ScreenPoint transformedVelocity = aVelocity;
+  
+  if (aHandoff) {
+    startIndex = aOverscrollHandoffChain->IndexOf(aPrev) + 1;
+    
+    // IndexOf will return aOverscrollHandoffChain->Length() if
+    // |aPrev| is not found.
+    if (startIndex >= aOverscrollHandoffChainLength) {
+      return false;
+    }
+  } else {
+    startIndex = 0;
   }
-  ScreenPoint transformedVelocity = endPoint - startPoint;
-
-  // Tell |next| to start a fling with the transformed velocity.
-  return next->AttemptFling(transformedVelocity, aOverscrollHandoffChain, aHandoff);
+  
+  for (; startIndex < aOverscrollHandoffChainLength; startIndex++) {
+    current = aOverscrollHandoffChain->GetApzcAtIndex(startIndex);
+    
+    // Make sure the apcz about to be handled can be handled
+    if (current == nullptr || current->IsDestroyed()) {
+      return false;
+    }
+    
+    endPoint = startPoint + transformedVelocity;
+    
+    // Only transform when current apcz can be transformed with previous
+    if (startIndex > 0) {
+      TransformDisplacement(this,
+                            aOverscrollHandoffChain->GetApzcAtIndex(startIndex - 1),
+                            current,
+                            startPoint,
+                            endPoint);
+    }
+    
+    transformedVelocity = endPoint - startPoint;
+    
+    bool handoff = (startIndex < 1) ? aHandoff : true;
+    if (current->AttemptFling(transformedVelocity,
+                              aOverscrollHandoffChain,
+                              handoff)) {
+      return true;
+    }
+  }
+  
+  return false;
 }
 
 bool
@@ -1143,7 +1154,7 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
   mTreeLock.AssertCurrentThreadOwns();
 
   // The comments below assume there is a chain of layers L..R with L and P having APZC instances as
-  // explained in the comment on GetInputTransforms. This function will recurse with aApzc at L and P, and the
+  // explained in the comment above GetScreenToApzcTransform. This function will recurse with aApzc at L and P, and the
   // comments explain what values are stored in the variables at these two levels. All the comments
   // use standard matrix notation where the leftmost matrix in a multiplication is applied first.
 
@@ -1208,8 +1219,8 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
   return result;
 }
 
-/* This function sets the aTransformToApzcOut and aTransformToGeckoOut out-parameters
-   to some useful transformations that input events may need applied. This is best
+/* The methods GetScreenToApzcTransform() and GetApzcToGeckoTransform() return
+   some useful transformations that input events may need applied. This is best
    illustrated with an example. Consider a chain of layers, L, M, N, O, P, Q, R. Layer L
    is the layer that corresponds to the argument |aApzc|, and layer R is the root
    of the layer tree. Layer M is the parent of L, N is the parent of M, and so on.
@@ -1242,7 +1253,7 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
         MT.Inverse()
         MN.Inverse()
         MC.Inverse()
-   This combined transformation is returned in the aTransformToApzcOut out-parameter.
+   This combined transformation is returned by GetScreenToApzcTransform().
 
    Next, if we want user inputs sent to gecko for event-dispatching, we will need to strip
    out all of the async transforms that are involved in this chain. This is because async
@@ -1274,7 +1285,7 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
         RC
         RD
    This sequence can be simplified and refactored to the following:
-        aTransformToApzcOut
+        GetScreenToApzcTransform()
         LA.Inverse()
         LD
         MC
@@ -1282,9 +1293,9 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
         ...
         RC
         RD
-   Since aTransformToApzcOut is already one of the out-parameters, we set aTransformToGeckoOut
-   to the remaining transforms (LA.Inverse() * LD * ... * RD), so that the caller code can
-   combine it with aTransformToApzcOut to get the final transform required in this case.
+   Since GetScreenToApzcTransform() can be obtained by calling that function, GetApzcToGeckoTransform()
+   returns the remaining transforms (LA.Inverse() * LD * ... * RD), so that the caller code can
+   combine it with GetScreenToApzcTransform() to get the final transform required in this case.
 
    Note that for many of these layers, there will be no AsyncPanZoomController attached, and
    so the async transform will be the identity transform. So, in the example above, if layers
@@ -1298,10 +1309,14 @@ APZCTreeManager::GetAPZCAtPoint(AsyncPanZoomController* aApzc,
    The APZCs also obviously have LT, LN, PT, and PN, so all of the above transformation combinations
    required can be generated.
  */
-void
-APZCTreeManager::GetInputTransforms(AsyncPanZoomController *aApzc, Matrix4x4& aTransformToApzcOut,
-                                    Matrix4x4& aTransformToGeckoOut)
+
+/*
+ * See the long comment above for a detailed explanation of this function.
+ */
+Matrix4x4
+APZCTreeManager::GetScreenToApzcTransform(const AsyncPanZoomController *aApzc) const
 {
+  Matrix4x4 result;
   MonitorAutoLock lock(mTreeLock);
 
   // The comments below assume there is a chain of layers L..R with L and P having APZC instances as
@@ -1313,34 +1328,64 @@ APZCTreeManager::GetInputTransforms(AsyncPanZoomController *aApzc, Matrix4x4& aT
   // ancestorUntransform is PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
   Matrix4x4 ancestorUntransform = aApzc->GetAncestorTransform();
   ancestorUntransform.Invert();
-  // asyncUntransform is LA.Inverse()
-  Matrix4x4 asyncUntransform = aApzc->GetCurrentAsyncTransform();
-  asyncUntransform.Invert();
 
-  // aTransformToApzcOut is initialized to PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
-  aTransformToApzcOut = ancestorUntransform;
-  // aTransformToGeckoOut is initialized to LA.Inverse() * LD * MC * NC * OC * PC
-  aTransformToGeckoOut = asyncUntransform * aApzc->GetTransformToLastDispatchedPaint() * aApzc->GetAncestorTransform();
+  // result is initialized to PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
+  result = ancestorUntransform;
 
   for (AsyncPanZoomController* parent = aApzc->GetParent(); parent; parent = parent->GetParent()) {
     // ancestorUntransform is updated to RC.Inverse() * QC.Inverse() when parent == P
     ancestorUntransform = parent->GetAncestorTransform();
     ancestorUntransform.Invert();
     // asyncUntransform is updated to PA.Inverse() when parent == P
-    asyncUntransform = parent->GetCurrentAsyncTransform();
+    Matrix4x4 asyncUntransform = parent->GetCurrentAsyncTransform();
     asyncUntransform.Invert();
     // untransformSinceLastApzc is RC.Inverse() * QC.Inverse() * PA.Inverse()
     Matrix4x4 untransformSinceLastApzc = ancestorUntransform * asyncUntransform;
 
-    // aTransformToApzcOut is RC.Inverse() * QC.Inverse() * PA.Inverse() * PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
-    aTransformToApzcOut = untransformSinceLastApzc * aTransformToApzcOut;
-    // aTransformToGeckoOut is LA.Inverse() * LD * MC * NC * OC * PC * PD * QC * RC
-    aTransformToGeckoOut = aTransformToGeckoOut * parent->GetTransformToLastDispatchedPaint() * parent->GetAncestorTransform();
+    // result is RC.Inverse() * QC.Inverse() * PA.Inverse() * PC.Inverse() * OC.Inverse() * NC.Inverse() * MC.Inverse()
+    result = untransformSinceLastApzc * result;
 
-    // The above values for aTransformToApzcOut and aTransformToGeckoOut when parent == P match
-    // the required output as explained in the comment above this method. Note that any missing
+    // The above value for result when parent == P matches the required output
+    // as explained in the comment above this method. Note that any missing
     // terms are guaranteed to be identity transforms.
   }
+
+  return result;
+}
+
+/*
+ * See the long comment above GetScreenToApzcTransform() for a detailed
+ * explanation of this function.
+ */
+Matrix4x4
+APZCTreeManager::GetApzcToGeckoTransform(const AsyncPanZoomController *aApzc) const
+{
+  Matrix4x4 result;
+  MonitorAutoLock lock(mTreeLock);
+
+  // The comments below assume there is a chain of layers L..R with L and P having APZC instances as
+  // explained in the comment above. This function is called with aApzc at L, and the loop
+  // below performs one iteration, where parent is at P. The comments explain what values are stored
+  // in the variables at these two levels. All the comments use standard matrix notation where the
+  // leftmost matrix in a multiplication is applied first.
+
+  // asyncUntransform is LA.Inverse()
+  Matrix4x4 asyncUntransform = aApzc->GetCurrentAsyncTransform();
+  asyncUntransform.Invert();
+
+  // aTransformToGeckoOut is initialized to LA.Inverse() * LD * MC * NC * OC * PC
+  result = asyncUntransform * aApzc->GetTransformToLastDispatchedPaint() * aApzc->GetAncestorTransform();
+
+  for (AsyncPanZoomController* parent = aApzc->GetParent(); parent; parent = parent->GetParent()) {
+    // aTransformToGeckoOut is LA.Inverse() * LD * MC * NC * OC * PC * PD * QC * RC
+    result = result * parent->GetTransformToLastDispatchedPaint() * parent->GetAncestorTransform();
+
+    // The above value for result when parent == P matches the required output
+    // as explained in the comment above this method. Note that any missing
+    // terms are guaranteed to be identity transforms.
+  }
+
+  return result;
 }
 
 already_AddRefed<AsyncPanZoomController>
diff --git a/gfx/layers/apz/src/APZCTreeManager.h b/gfx/layers/apz/src/APZCTreeManager.h
index 9e3c0e5242c..c0f749609d9 100644
--- a/gfx/layers/apz/src/APZCTreeManager.h
+++ b/gfx/layers/apz/src/APZCTreeManager.h
@@ -361,8 +361,8 @@ public:
   already_AddRefed<AsyncPanZoomController> GetTargetAPZC(const ScrollableLayerGuid& aGuid);
   already_AddRefed<AsyncPanZoomController> GetTargetAPZC(const ScreenPoint& aPoint,
                                                          bool* aOutInOverscrolledApzc);
-  void GetInputTransforms(AsyncPanZoomController *aApzc, gfx::Matrix4x4& aTransformToApzcOut,
-                          gfx::Matrix4x4& aTransformToGeckoOut);
+  gfx::Matrix4x4 GetScreenToApzcTransform(const AsyncPanZoomController *aApzc) const;
+  gfx::Matrix4x4 GetApzcToGeckoTransform(const AsyncPanZoomController *aApzc) const;
 private:
   /* Helpers */
   AsyncPanZoomController* FindTargetAPZC(AsyncPanZoomController* aApzc, FrameMetrics::ViewID aScrollId);
@@ -417,7 +417,7 @@ private:
    * is considered part of the APZC tree management state.
    * Finally, the lock needs to be held when accessing mOverscrollHandoffChain.
    * IMPORTANT: See the note about lock ordering at the top of this file. */
-  mozilla::Monitor mTreeLock;
+  mutable mozilla::Monitor mTreeLock;
   nsRefPtr<AsyncPanZoomController> mRootApzc;
   /* This tracks the APZC that should receive all inputs for the current input event block.
    * This allows touch points to move outside the thing they started on, but still have the
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
index 9d474ca324d..4195c418683 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -151,9 +151,29 @@ typedef mozilla::gfx::Matrix4x4 Matrix4x4;
  * The timeout for mAsyncScrollTimeoutTask delay task.
  * Units: milliseconds
  *
- * "apz.axis_lock_mode"
+ * "apz.axis_lock.mode"
  * The preferred axis locking style. See AxisLockMode for possible values.
  *
+ * "apz.axis_lock.lock_angle"
+ * Angle from axis within which we stay axis-locked.
+ * Units: radians
+ *
+ * "apz.axis_lock.breakout_threshold"
+ * Distance in inches the user must pan before axis lock can be broken.
+ * Units: (real-world, i.e. screen) inches
+ *
+ * "apz.axis_lock.breakout_angle"
+ * Angle at which axis lock can be broken.
+ * Units: radians
+ *
+ * "apz.axis_lock.direct_pan_angle"
+ * If the angle from an axis to the line drawn by a pan move is less than
+ * this value, we can assume that panning can be done in the allowed direction
+ * (horizontal or vertical).
+ * Currently used only for touch-action css property stuff and was addded to
+ * keep behaviour consistent with IE.
+ * Units: radians
+ *
  * "apz.content_response_timeout"
  * Amount of time before we timeout response from content. For example, if
  * content is being unruly/slow and we don't get a response back within this
@@ -323,30 +343,6 @@ typedef mozilla::gfx::Matrix4x4 Matrix4x4;
  * Units: ms
  */
 
-/**
- * Angle from axis within which we stay axis-locked
- */
-static const double AXIS_LOCK_ANGLE = M_PI / 6.0; // 30 degrees
-
-/**
- * The distance in inches the user must pan before axis lock can be broken
- */
-static const float AXIS_BREAKOUT_THRESHOLD = 1.0f/32.0f;
-
-/**
- * The angle at which axis lock can be broken
- */
-static const double AXIS_BREAKOUT_ANGLE = M_PI / 8.0; // 22.5 degrees
-
-/**
- * Angle from axis to the line drawn by pan move.
- * If angle is less than this value we can assume that panning
- * can be done in allowed direction (horizontal or vertical).
- * Currently used only for touch-action css property stuff and was
- * added to keep behavior consistent with IE.
- */
-static const double ALLOWED_DIRECT_PAN_ANGLE = M_PI / 3.0; // 60 degrees
-
 /**
  * Computed time function used for sampling frames of a zoom to animation.
  */
@@ -931,7 +927,7 @@ AsyncPanZoomController::Destroy()
 }
 
 bool
-AsyncPanZoomController::IsDestroyed()
+AsyncPanZoomController::IsDestroyed() const
 {
   return mTreeManager == nullptr;
 }
@@ -1457,9 +1453,7 @@ AsyncPanZoomController::ConvertToGecko(const ScreenPoint& aPoint, CSSPoint* aOut
 {
   APZCTreeManager* treeManagerLocal = mTreeManager;
   if (treeManagerLocal) {
-    Matrix4x4 transformToApzc;
-    Matrix4x4 transformToGecko;
-    treeManagerLocal->GetInputTransforms(this, transformToApzc, transformToGecko);
+    Matrix4x4 transformToGecko = treeManagerLocal->GetApzcToGeckoTransform(this);
     Point result = transformToGecko * Point(aPoint.x, aPoint.y);
     // NOTE: This isn't *quite* LayoutDevicePoint, we just don't have a name
     // for this coordinate space and it maps the closest to LayoutDevicePoint.
@@ -1548,7 +1542,9 @@ nsEventStatus AsyncPanZoomController::OnPan(const PanGestureInput& aEvent, bool
   mX.UpdateWithTouchAtDevicePoint(aEvent.mPanStartPoint.x, aEvent.mTime);
   mY.UpdateWithTouchAtDevicePoint(aEvent.mPanStartPoint.y, aEvent.mTime);
 
-  HandlePanningUpdate(aEvent.mPanDisplacement.x, aEvent.mPanDisplacement.y);
+  ScreenPoint panDisplacement = aEvent.mPanDisplacement;
+  ToGlobalScreenCoordinates(&panDisplacement, aEvent.mPanStartPoint);
+  HandlePanningUpdate(panDisplacement);
 
   // TODO: Handle pan events sent without pan begin / pan end events properly.
   if (mPanGestureState) {
@@ -1698,9 +1694,49 @@ nsEventStatus AsyncPanZoomController::OnCancelTap(const TapGestureInput& aEvent)
   return nsEventStatus_eIgnore;
 }
 
-float AsyncPanZoomController::PanDistance() {
-  ReentrantMonitorAutoEnter lock(mMonitor);
-  return NS_hypot(mX.PanDistance(), mY.PanDistance());
+// Helper function for To[Global|Local]ScreenCoordinates().
+// TODO(botond): Generalize this into a template function in UnitTransforms.h.
+static void TransformVector(const Matrix4x4& aTransform,
+                            ScreenPoint* aVector,
+                            const ScreenPoint& aAnchor) {
+  ScreenPoint start = aAnchor;
+  ScreenPoint end = aAnchor + *aVector;
+  start = TransformTo<ScreenPixel>(aTransform, start);
+  end = TransformTo<ScreenPixel>(aTransform, end);
+  *aVector = end - start;
+}
+
+void AsyncPanZoomController::ToGlobalScreenCoordinates(ScreenPoint* aVector,
+                                                       const ScreenPoint& aAnchor) const {
+  if (APZCTreeManager* treeManagerLocal = mTreeManager) {
+    Matrix4x4 transform = treeManagerLocal->GetScreenToApzcTransform(this);
+    transform.Invert();
+    TransformVector(transform, aVector, aAnchor);
+  }
+}
+
+void AsyncPanZoomController::ToLocalScreenCoordinates(ScreenPoint* aVector,
+                                                      const ScreenPoint& aAnchor) const {
+  if (APZCTreeManager* treeManagerLocal = mTreeManager) {
+    Matrix4x4 transform = treeManagerLocal->GetScreenToApzcTransform(this);
+    TransformVector(transform, aVector, aAnchor);
+  }
+}
+
+float AsyncPanZoomController::PanDistance() const {
+  ScreenPoint panVector;
+  ScreenPoint panStart;
+  {
+    ReentrantMonitorAutoEnter lock(mMonitor);
+    panVector = ScreenPoint(mX.PanDistance(), mY.PanDistance());
+    panStart = PanStart();
+  }
+  ToGlobalScreenCoordinates(&panVector, panStart);
+  return NS_hypot(panVector.x, panVector.y);
+}
+
+ScreenPoint AsyncPanZoomController::PanStart() const {
+  return ScreenPoint(mX.PanStart(), mY.PanStart());
 }
 
 const ScreenPoint AsyncPanZoomController::GetVelocityVector() {
@@ -1712,10 +1748,10 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle) {
   // enabled by default.
   if (CurrentTouchBlock()->TouchActionAllowsPanningXY()) {
     if (mX.CanScrollNow() && mY.CanScrollNow()) {
-      if (IsCloseToHorizontal(aAngle, AXIS_LOCK_ANGLE)) {
+      if (IsCloseToHorizontal(aAngle, gfxPrefs::APZAxisLockAngle())) {
         mY.SetAxisLocked(true);
         SetState(PANNING_LOCKED_X);
-      } else if (IsCloseToVertical(aAngle, AXIS_LOCK_ANGLE)) {
+      } else if (IsCloseToVertical(aAngle, gfxPrefs::APZAxisLockAngle())) {
         mX.SetAxisLocked(true);
         SetState(PANNING_LOCKED_Y);
       } else {
@@ -1729,7 +1765,7 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle) {
   } else if (CurrentTouchBlock()->TouchActionAllowsPanningX()) {
     // Using bigger angle for panning to keep behavior consistent
     // with IE.
-    if (IsCloseToHorizontal(aAngle, ALLOWED_DIRECT_PAN_ANGLE)) {
+    if (IsCloseToHorizontal(aAngle, gfxPrefs::APZAllowedDirectPanAngle())) {
       mY.SetAxisLocked(true);
       SetState(PANNING_LOCKED_X);
       mPanDirRestricted = true;
@@ -1739,7 +1775,7 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle) {
       SetState(NOTHING);
     }
   } else if (CurrentTouchBlock()->TouchActionAllowsPanningY()) {
-    if (IsCloseToVertical(aAngle, ALLOWED_DIRECT_PAN_ANGLE)) {
+    if (IsCloseToVertical(aAngle, gfxPrefs::APZAllowedDirectPanAngle())) {
       mX.SetAxisLocked(true);
       SetState(PANNING_LOCKED_Y);
       mPanDirRestricted = true;
@@ -1755,7 +1791,7 @@ void AsyncPanZoomController::HandlePanning(double aAngle) {
   ReentrantMonitorAutoEnter lock(mMonitor);
   if (!gfxPrefs::APZCrossSlideEnabled() && (!mX.CanScrollNow() || !mY.CanScrollNow())) {
     SetState(PANNING);
-  } else if (IsCloseToHorizontal(aAngle, AXIS_LOCK_ANGLE)) {
+  } else if (IsCloseToHorizontal(aAngle, gfxPrefs::APZAxisLockAngle())) {
     mY.SetAxisLocked(true);
     if (mX.CanScrollNow()) {
       SetState(PANNING_LOCKED_X);
@@ -1763,7 +1799,7 @@ void AsyncPanZoomController::HandlePanning(double aAngle) {
       SetState(CROSS_SLIDING_X);
       mX.SetAxisLocked(true);
     }
-  } else if (IsCloseToVertical(aAngle, AXIS_LOCK_ANGLE)) {
+  } else if (IsCloseToVertical(aAngle, gfxPrefs::APZAxisLockAngle())) {
     mX.SetAxisLocked(true);
     if (mY.CanScrollNow()) {
       SetState(PANNING_LOCKED_Y);
@@ -1776,23 +1812,23 @@ void AsyncPanZoomController::HandlePanning(double aAngle) {
   }
 }
 
-void AsyncPanZoomController::HandlePanningUpdate(float aDX, float aDY) {
+void AsyncPanZoomController::HandlePanningUpdate(const ScreenPoint& aDelta) {
   // If we're axis-locked, check if the user is trying to break the lock
   if (GetAxisLockMode() == STICKY && !mPanDirRestricted) {
 
-    double angle = atan2(aDY, aDX); // range [-pi, pi]
+    double angle = atan2(aDelta.y, aDelta.x); // range [-pi, pi]
     angle = fabs(angle); // range [0, pi]
 
-    float breakThreshold = AXIS_BREAKOUT_THRESHOLD * APZCTreeManager::GetDPI();
+    float breakThreshold = gfxPrefs::APZAxisBreakoutThreshold() * APZCTreeManager::GetDPI();
 
-    if (fabs(aDX) > breakThreshold || fabs(aDY) > breakThreshold) {
+    if (fabs(aDelta.x) > breakThreshold || fabs(aDelta.y) > breakThreshold) {
       if (mState == PANNING_LOCKED_X || mState == CROSS_SLIDING_X) {
-        if (!IsCloseToHorizontal(angle, AXIS_BREAKOUT_ANGLE)) {
+        if (!IsCloseToHorizontal(angle, gfxPrefs::APZAxisBreakoutAngle())) {
           mY.SetAxisLocked(false);
           SetState(PANNING);
         }
       } else if (mState == PANNING_LOCKED_Y || mState == CROSS_SLIDING_Y) {
-        if (!IsCloseToVertical(angle, AXIS_BREAKOUT_ANGLE)) {
+        if (!IsCloseToVertical(angle, gfxPrefs::APZAxisLockAngle())) {
           mX.SetAxisLocked(false);
           SetState(PANNING);
         }
@@ -1964,18 +2000,8 @@ bool AsyncPanZoomController::AttemptFling(ScreenPoint aVelocity,
                 false /* do not allow overscroll */);
     return true;
   }
-
-  // Otherwise, hand the fling back to the tree manager to pass on to the
-  // next APZC in the handoff chain. Had we started a fling animation in this
-  // APZC, we would have done this hand-off on its first frame anyways, but
-  // doing it here allows the tree manager to tell the previous APZC to enter
-  // an overscroll fling if nothing further in the chain wants the fling.
-  APZCTreeManager* treeManagerLocal = mTreeManager;
-  return treeManagerLocal
-      && treeManagerLocal->DispatchFling(this,
-                                         aVelocity,
-                                         aOverscrollHandoffChain,
-                                         true /* handoff */);
+  
+  return false;
 }
 
 void AsyncPanZoomController::HandleFlingOverscroll(const ScreenPoint& aVelocity,
@@ -2040,9 +2066,11 @@ void AsyncPanZoomController::TrackTouch(const MultiTouchInput& aEvent) {
   ScreenPoint prevTouchPoint(mX.GetPos(), mY.GetPos());
   ScreenPoint touchPoint = GetFirstTouchScreenPoint(aEvent);
 
-  float dx = mX.PanDistance(touchPoint.x);
-  float dy = mY.PanDistance(touchPoint.y);
-  HandlePanningUpdate(dx, dy);
+  ScreenPoint delta(mX.PanDistance(touchPoint.x),
+                    mY.PanDistance(touchPoint.y));
+  const ScreenPoint panStart = PanStart();
+  ToGlobalScreenCoordinates(&delta, panStart);
+  HandlePanningUpdate(delta);
 
   UpdateWithTouchAtDevicePoint(aEvent);
 
@@ -2479,7 +2507,7 @@ void AsyncPanZoomController::SampleContentTransformForFrame(ViewTransform* aOutT
   }
 }
 
-ViewTransform AsyncPanZoomController::GetCurrentAsyncTransform() {
+ViewTransform AsyncPanZoomController::GetCurrentAsyncTransform() const {
   ReentrantMonitorAutoEnter lock(mMonitor);
 
   CSSPoint lastPaintScrollOffset;
@@ -2517,14 +2545,14 @@ ViewTransform AsyncPanZoomController::GetCurrentAsyncTransform() {
   return ViewTransform(scale, -translation);
 }
 
-Matrix4x4 AsyncPanZoomController::GetNontransientAsyncTransform() {
+Matrix4x4 AsyncPanZoomController::GetNontransientAsyncTransform() const {
   ReentrantMonitorAutoEnter lock(mMonitor);
   return Matrix4x4().Scale(mLastContentPaintMetrics.mResolution.scale,
                            mLastContentPaintMetrics.mResolution.scale,
                            1.0f);
 }
 
-Matrix4x4 AsyncPanZoomController::GetTransformToLastDispatchedPaint() {
+Matrix4x4 AsyncPanZoomController::GetTransformToLastDispatchedPaint() const {
   ReentrantMonitorAutoEnter lock(mMonitor);
 
   // Technically we should be taking the scroll delta in the coordinate space
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.h b/gfx/layers/apz/src/AsyncPanZoomController.h
index cb34c2941ed..d651c80e0a9 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.h
+++ b/gfx/layers/apz/src/AsyncPanZoomController.h
@@ -88,6 +88,7 @@ public:
    * device DPI, before we start panning the screen. This is to prevent us from
    * accidentally processing taps as touch moves, and from very short/accidental
    * touches moving the screen.
+   * Note: this distance is in global screen coordinates.
    */
   static float GetTouchStartTolerance();
 
@@ -212,7 +213,7 @@ public:
   /**
    * Returns true if Destroy() has already been called on this APZC instance.
    */
-  bool IsDestroyed();
+  bool IsDestroyed() const;
 
   /**
    * Returns the incremental transformation corresponding to the async pan/zoom
@@ -220,14 +221,14 @@ public:
    * existing transform, it will make the layer appear with the desired pan/zoom
    * amount.
    */
-  ViewTransform GetCurrentAsyncTransform();
+  ViewTransform GetCurrentAsyncTransform() const;
 
   /**
    * Returns the part of the async transform that will remain once Gecko does a
    * repaint at the desired metrics. That is, in the steady state:
    * Matrix4x4(GetCurrentAsyncTransform()) === GetNontransientAsyncTransform()
    */
-  Matrix4x4 GetNontransientAsyncTransform();
+  Matrix4x4 GetNontransientAsyncTransform() const;
 
   /**
    * Returns the transform to take something from the coordinate space of the
@@ -236,7 +237,7 @@ public:
    * processed, this is needed to transform input events properly into a space
    * gecko will understand.
    */
-  Matrix4x4 GetTransformToLastDispatchedPaint();
+  Matrix4x4 GetTransformToLastDispatchedPaint() const;
 
   /**
    * Recalculates the displayport. Ideally, this should paint an area bigger
@@ -326,6 +327,28 @@ public:
    */
   int32_t GetLastTouchIdentifier() const;
 
+  /**
+   * Convert the vector |aVector|, rooted at the point |aAnchor|, from
+   * this APZC's local screen coordinates into global screen coordinates.
+   * The anchor is necessary because with 3D tranforms, the location of the
+   * vector can affect the result of the transform.
+   * To respect the lock ordering, mMonitor must NOT be held when calling
+   * this function (since this function acquires the tree lock).
+   */
+  void ToGlobalScreenCoordinates(ScreenPoint* aVector,
+                                 const ScreenPoint& aAnchor) const;
+
+  /**
+   * Convert the vector |aVector|, rooted at the point |aAnchor|, from
+   * global screen coordinates into this APZC's local screen coordinates .
+   * The anchor is necessary because with 3D tranforms, the location of the
+   * vector can affect the result of the transform.
+   * To respect the lock ordering, mMonitor must NOT be held when calling
+   * this function (since this function acquires the tree lock).
+   */
+  void ToLocalScreenCoordinates(ScreenPoint* aVector,
+                                const ScreenPoint& aAnchor) const;
+
 protected:
   enum PanZoomState {
     NOTHING,                  /* no touch-start events received */
@@ -462,9 +485,21 @@ protected:
    * Gets the displacement of the current touch since it began. That is, it is
    * the distance between the current position and the initial position of the
    * current touch (this only makes sense if a touch is currently happening and
-   * OnTouchMove() is being invoked).
+   * OnTouchMove() or the equivalent for pan gestures is being invoked).
+   * Note: This function returns a distance in global screen coordinates,
+   *       not the local screen coordinates of this APZC.
    */
-  float PanDistance();
+  float PanDistance() const;
+
+  /**
+   * Gets the start point of the current touch.
+   * Like PanDistance(), this only makes sense if a touch is currently
+   * happening and OnTouchMove() or the equivalent for pan gestures is
+   * being invoked.
+   * Unlikely PanDistance(), this function returns a point in local screen
+   * coordinates.
+   */
+  ScreenPoint PanStart() const;
 
   /**
    * Gets a vector of the velocities of each axis.
@@ -489,8 +524,9 @@ protected:
 
   /**
    * Update the panning state and axis locks.
+   * Note: |aDelta| is expected to be in global screen coordinates.
    */
-  void HandlePanningUpdate(float aDX, float aDY);
+  void HandlePanningUpdate(const ScreenPoint& aDelta);
 
   /**
    * Sets up anything needed for panning. This takes us out of the "TOUCHING"
diff --git a/gfx/layers/apz/src/Axis.cpp b/gfx/layers/apz/src/Axis.cpp
index 4dd77f71994..84f66f3c8cd 100644
--- a/gfx/layers/apz/src/Axis.cpp
+++ b/gfx/layers/apz/src/Axis.cpp
@@ -16,6 +16,7 @@
 #include "mozilla/mozalloc.h"           // for operator new
 #include "mozilla/FloatingPoint.h"      // for FuzzyEqualsAdditive
 #include "nsMathUtils.h"                // for NS_lround
+#include "nsPrintfCString.h"            // for nsPrintfCString
 #include "nsThreadUtils.h"              // for NS_DispatchToMainThread, etc
 #include "nscore.h"                     // for NS_IMETHOD
 #include "gfxPrefs.h"                   // for the preferences
@@ -48,7 +49,9 @@ void Axis::UpdateWithTouchAtDevicePoint(ScreenCoord aPos, uint32_t aTimestampMs)
 
   float newVelocity = mAxisLocked ? 0.0f : (float)(mPos - aPos) / (float)(aTimestampMs - mPosTimeMs);
   if (gfxPrefs::APZMaxVelocity() > 0.0f) {
-    newVelocity = std::min(newVelocity, gfxPrefs::APZMaxVelocity() * APZCTreeManager::GetDPI());
+    ScreenPoint maxVelocity = MakePoint(gfxPrefs::APZMaxVelocity() * APZCTreeManager::GetDPI());
+    mAsyncPanZoomController->ToLocalScreenCoordinates(&maxVelocity, mAsyncPanZoomController->PanStart());
+    newVelocity = std::min(newVelocity, maxVelocity.Length());
   }
 
   mVelocity = newVelocity;
@@ -119,10 +122,24 @@ void Axis::OverscrollBy(CSSCoord aOverscroll) {
   MOZ_ASSERT(CanScroll());
   aOverscroll = ApplyResistance(aOverscroll);
   if (aOverscroll > 0) {
-    MOZ_ASSERT(FuzzyEqualsAdditive(GetCompositionEnd().value, GetPageEnd().value, COORDINATE_EPSILON));
+#ifdef DEBUG
+    if (!FuzzyEqualsAdditive(GetCompositionEnd().value, GetPageEnd().value, COORDINATE_EPSILON)) {
+      nsPrintfCString message("composition end (%f) is not within COORDINATE_EPISLON of page end (%f)\n",
+                              GetCompositionEnd().value, GetPageEnd().value);
+      NS_ASSERTION(false, message.get());
+      MOZ_CRASH();
+    }
+#endif
     MOZ_ASSERT(mOverscroll >= 0);
   } else if (aOverscroll < 0) {
-    MOZ_ASSERT(FuzzyEqualsAdditive(GetOrigin().value, GetPageStart().value, COORDINATE_EPSILON));
+#ifdef DEBUG
+    if (!FuzzyEqualsAdditive(GetOrigin().value, GetPageStart().value, COORDINATE_EPSILON)) {
+      nsPrintfCString message("composition origin (%f) is not within COORDINATE_EPISLON of page origin (%f)\n",
+                              GetOrigin().value, GetPageStart().value);
+      NS_ASSERTION(false, message.get());
+      MOZ_CRASH();
+    }
+#endif
     MOZ_ASSERT(mOverscroll <= 0);
   }
   mOverscroll += aOverscroll;
@@ -192,12 +209,16 @@ void Axis::ClearOverscroll() {
   mOverscroll = 0;
 }
 
-float Axis::PanDistance() {
-  return fabsf((mPos - mStartPos).value);
+ScreenCoord Axis::PanStart() const {
+  return mStartPos;
 }
 
-float Axis::PanDistance(ScreenCoord aPos) {
-  return fabsf((aPos - mStartPos).value);
+ScreenCoord Axis::PanDistance() const {
+  return fabs(mPos - mStartPos);
+}
+
+ScreenCoord Axis::PanDistance(ScreenCoord aPos) const {
+  return fabs(aPos - mStartPos);
 }
 
 void Axis::EndTouch(uint32_t aTimestampMs) {
@@ -372,6 +393,11 @@ CSSCoord AxisX::GetRectOffset(const CSSRect& aRect) const
   return aRect.x;
 }
 
+ScreenPoint AxisX::MakePoint(ScreenCoord aCoord) const
+{
+  return ScreenPoint(aCoord, 0);
+}
+
 AxisY::AxisY(AsyncPanZoomController* aAsyncPanZoomController)
   : Axis(aAsyncPanZoomController)
 {
@@ -393,5 +419,10 @@ CSSCoord AxisY::GetRectOffset(const CSSRect& aRect) const
   return aRect.y;
 }
 
+ScreenPoint AxisY::MakePoint(ScreenCoord aCoord) const
+{
+  return ScreenPoint(0, aCoord);
+}
+
 }
 }
diff --git a/gfx/layers/apz/src/Axis.h b/gfx/layers/apz/src/Axis.h
index 1068630413b..d4800cf4a20 100644
--- a/gfx/layers/apz/src/Axis.h
+++ b/gfx/layers/apz/src/Axis.h
@@ -119,17 +119,22 @@ public:
   void ClearOverscroll();
 
   /**
-   * Gets the distance between the starting position of the touch supplied in
-   * startTouch() and the current touch from the last
-   * updateWithTouchAtDevicePoint().
+   * Gets the starting position of the touch supplied in StartTouch().
    */
-  float PanDistance();
+  ScreenCoord PanStart() const;
 
   /**
    * Gets the distance between the starting position of the touch supplied in
-   * startTouch() and the supplied position.
+   * StartTouch() and the current touch from the last
+   * UpdateWithTouchAtDevicePoint().
    */
-  float PanDistance(ScreenCoord aPos);
+  ScreenCoord PanDistance() const;
+
+  /**
+   * Gets the distance between the starting position of the touch supplied in
+   * StartTouch() and the supplied position.
+   */
+  ScreenCoord PanDistance(ScreenCoord aPos) const;
 
   /**
    * Applies friction during a fling, or cancels the fling if the velocity is
@@ -217,6 +222,8 @@ public:
   virtual CSSCoord GetRectLength(const CSSRect& aRect) const = 0;
   virtual CSSCoord GetRectOffset(const CSSRect& aRect) const = 0;
 
+  virtual ScreenPoint MakePoint(ScreenCoord aCoord) const = 0;
+
 protected:
   ScreenCoord mPos;
   uint32_t mPosTimeMs;
@@ -250,6 +257,7 @@ public:
   virtual CSSCoord GetPointOffset(const CSSPoint& aPoint) const;
   virtual CSSCoord GetRectLength(const CSSRect& aRect) const;
   virtual CSSCoord GetRectOffset(const CSSRect& aRect) const;
+  virtual ScreenPoint MakePoint(ScreenCoord aCoord) const;
 };
 
 class AxisY : public Axis {
@@ -258,6 +266,7 @@ public:
   virtual CSSCoord GetPointOffset(const CSSPoint& aPoint) const;
   virtual CSSCoord GetRectLength(const CSSRect& aRect) const;
   virtual CSSCoord GetRectOffset(const CSSRect& aRect) const;
+  virtual ScreenPoint MakePoint(ScreenCoord aCoord) const;
 };
 
 }
diff --git a/gfx/layers/apz/src/GestureEventListener.cpp b/gfx/layers/apz/src/GestureEventListener.cpp
index 3796566fedd..3bde1fe5159 100644
--- a/gfx/layers/apz/src/GestureEventListener.cpp
+++ b/gfx/layers/apz/src/GestureEventListener.cpp
@@ -197,8 +197,10 @@ nsEventStatus GestureEventListener::HandleInputTouchMultiStart()
 
 bool GestureEventListener::MoveDistanceIsLarge()
 {
-  ScreenIntPoint delta = mLastTouchInput.mTouches[0].mScreenPoint - mTouchStartPosition;
-  return (NS_hypot(delta.x, delta.y) > AsyncPanZoomController::GetTouchStartTolerance());
+  const ScreenPoint start = mLastTouchInput.mTouches[0].mScreenPoint;
+  ScreenPoint delta = start - mTouchStartPosition;
+  mAsyncPanZoomController->ToGlobalScreenCoordinates(&delta, start);
+  return (delta.Length() > AsyncPanZoomController::GetTouchStartTolerance());
 }
 
 nsEventStatus GestureEventListener::HandleInputTouchMove()
diff --git a/gfx/layers/client/ClientLayerManager.cpp b/gfx/layers/client/ClientLayerManager.cpp
index e91510fa032..751d585642f 100644
--- a/gfx/layers/client/ClientLayerManager.cpp
+++ b/gfx/layers/client/ClientLayerManager.cpp
@@ -385,6 +385,19 @@ ClientLayerManager::GetCompositorSideAPZTestData(APZTestData* aData) const
   }
 }
 
+float
+ClientLayerManager::RequestProperty(const nsAString& aProperty)
+{
+  if (mForwarder->HasShadowManager()) {
+    float value;
+    if (!mForwarder->GetShadowManager()->SendRequestProperty(nsString(aProperty), &value)) {
+      NS_WARNING("Call to PLayerTransactionChild::SendGetAPZTestData() failed");
+    }
+    return value;
+  }
+  return -1;
+}
+
 void
 ClientLayerManager::StartNewRepaintRequest(SequenceNumber aSequenceNumber)
 {
diff --git a/gfx/layers/client/ClientLayerManager.h b/gfx/layers/client/ClientLayerManager.h
index f1f25ddb15e..6d2ede05300 100644
--- a/gfx/layers/client/ClientLayerManager.h
+++ b/gfx/layers/client/ClientLayerManager.h
@@ -237,6 +237,7 @@ public:
 
   void SetTransactionIdAllocator(TransactionIdAllocator* aAllocator) { mTransactionIdAllocator = aAllocator; }
 
+  float RequestProperty(const nsAString& aProperty) MOZ_OVERRIDE;
 protected:
   enum TransactionPhase {
     PHASE_NONE, PHASE_CONSTRUCTION, PHASE_DRAWING, PHASE_FORWARD
@@ -251,7 +252,7 @@ private:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIOBSERVER
 
-    MemoryPressureObserver(ClientLayerManager* aClientLayerManager)
+    explicit MemoryPressureObserver(ClientLayerManager* aClientLayerManager)
       : mClientLayerManager(aClientLayerManager)
     {
       RegisterMemoryPressureEvent();
diff --git a/gfx/layers/client/TextureClient.cpp b/gfx/layers/client/TextureClient.cpp
index 37edeb7ef59..138fd3fa642 100644
--- a/gfx/layers/client/TextureClient.cpp
+++ b/gfx/layers/client/TextureClient.cpp
@@ -291,7 +291,8 @@ TextureClient::CreateForDrawing(ISurfaceAllocator* aAllocator,
   }
 
   if (!texture && aFormat == SurfaceFormat::B8G8R8X8 &&
-      aAllocator->IsSameProcess()) {
+      aAllocator->IsSameProcess() &&
+      aMoz2DBackend == gfx::BackendType::CAIRO) {
     texture = new DIBTextureClient(aFormat, aTextureFlags);
   }
 
diff --git a/gfx/layers/composite/LayerManagerComposite.cpp b/gfx/layers/composite/LayerManagerComposite.cpp
index 8639ffc4a7d..9b03f3c698b 100644
--- a/gfx/layers/composite/LayerManagerComposite.cpp
+++ b/gfx/layers/composite/LayerManagerComposite.cpp
@@ -110,6 +110,7 @@ LayerManagerComposite::LayerManagerComposite(Compositor* aCompositor)
 , mIsCompositorReady(false)
 , mDebugOverlayWantsNextFrame(false)
 , mGeometryChanged(true)
+, mLastFrameMissedHWC(false)
 {
   mTextRenderer = new TextRenderer(aCompositor);
   MOZ_ASSERT(aCompositor);
@@ -610,7 +611,10 @@ LayerManagerComposite::Render()
     mCompositor->EndFrameForExternalComposition(mWorldMatrix);
     // Reset the invalid region as compositing is done
     mInvalidRegion.SetEmpty();
+    mLastFrameMissedHWC = false;
     return;
+  } else if (!mTarget) {
+    mLastFrameMissedHWC = !!composer2D;
   }
 
   {
diff --git a/gfx/layers/composite/LayerManagerComposite.h b/gfx/layers/composite/LayerManagerComposite.h
index b4f62b03fca..f0a122aeefa 100644
--- a/gfx/layers/composite/LayerManagerComposite.h
+++ b/gfx/layers/composite/LayerManagerComposite.h
@@ -261,6 +261,8 @@ public:
     mUnusedApzTransformWarning = true;
   }
 
+  bool LastFrameMissedHWC() { return mLastFrameMissedHWC; }
+
 private:
   /** Region we're clipping our current drawing to. */
   nsIntRegion mClippingRegion;
@@ -322,6 +324,10 @@ private:
   RefPtr<CompositingRenderTarget> mTwoPassTmpTarget;
   RefPtr<TextRenderer> mTextRenderer;
   bool mGeometryChanged;
+
+  // Testing property. If hardware composer is supported, this will return
+  // true if the last frame was deemed 'too complicated' to be rendered.
+  bool mLastFrameMissedHWC;
 };
 
 /**
@@ -362,9 +368,10 @@ public:
   virtual Layer* GetLayer() = 0;
 
   /**
-   * Perform a first pass over the layer tree to prepare intermediate surfaces.
-   * This allows us on to avoid framebuffer switches in the middle of our render
-   * which is inefficient. This must be called before RenderLayer.
+   * Perform a first pass over the layer tree to render all of the intermediate
+   * surfaces that we can. This allows us to avoid framebuffer switches in the
+   * middle of our render which is inefficient especially on mobile GPUs. This
+   * must be called before RenderLayer.
    */
   virtual void Prepare(const RenderTargetIntRect& aClipRect) {}
 
diff --git a/gfx/layers/ipc/LayerTransactionParent.cpp b/gfx/layers/ipc/LayerTransactionParent.cpp
index 73b8e152297..e6b3d0dfc89 100644
--- a/gfx/layers/ipc/LayerTransactionParent.cpp
+++ b/gfx/layers/ipc/LayerTransactionParent.cpp
@@ -731,6 +731,20 @@ LayerTransactionParent::RecvGetAPZTestData(APZTestData* aOutData)
   return true;
 }
 
+bool
+LayerTransactionParent::RecvRequestProperty(const nsString& aProperty, float* aValue)
+{
+  if (aProperty.Equals(NS_LITERAL_STRING("overdraw"))) {
+    *aValue = layer_manager()->GetCompositor()->GetFillRatio();
+  } else if (aProperty.Equals(NS_LITERAL_STRING("missed_hwc"))) {
+    *aValue = layer_manager()->LastFrameMissedHWC() ? 1 : 0;
+  } else {
+    *aValue = -1;
+  }
+  return true;
+}
+
+
 bool
 LayerTransactionParent::Attach(ShadowLayerParent* aLayerParent,
                                CompositableHost* aCompositable,
diff --git a/gfx/layers/ipc/LayerTransactionParent.h b/gfx/layers/ipc/LayerTransactionParent.h
index fef3c3b876f..af4bcf4fce9 100644
--- a/gfx/layers/ipc/LayerTransactionParent.h
+++ b/gfx/layers/ipc/LayerTransactionParent.h
@@ -128,7 +128,8 @@ protected:
                                          MOZ_OVERRIDE;
   virtual bool RecvSetAsyncScrollOffset(const FrameMetrics::ViewID& aId,
                                         const int32_t& aX, const int32_t& aY) MOZ_OVERRIDE;
-  virtual bool RecvGetAPZTestData(APZTestData* aOutData);
+  virtual bool RecvGetAPZTestData(APZTestData* aOutData) MOZ_OVERRIDE;
+  virtual bool RecvRequestProperty(const nsString& aProperty, float* aValue) MOZ_OVERRIDE;
 
   virtual PLayerParent* AllocPLayerParent() MOZ_OVERRIDE;
   virtual bool DeallocPLayerParent(PLayerParent* actor) MOZ_OVERRIDE;
diff --git a/gfx/layers/ipc/PLayerTransaction.ipdl b/gfx/layers/ipc/PLayerTransaction.ipdl
index e5e72ca6754..72ba922a427 100644
--- a/gfx/layers/ipc/PLayerTransaction.ipdl
+++ b/gfx/layers/ipc/PLayerTransaction.ipdl
@@ -97,6 +97,9 @@ parent:
   // layers id.
   sync GetAPZTestData() returns (APZTestData data);
 
+  // Query a named property from the last frame
+  sync RequestProperty(nsString property) returns (float value);
+
   async ChildAsyncMessages(AsyncChildMessageData[] aMessages);
 
   async __delete__();
diff --git a/gfx/layers/opengl/CompositingRenderTargetOGL.h b/gfx/layers/opengl/CompositingRenderTargetOGL.h
index 485ca39abb2..06d421e83dc 100644
--- a/gfx/layers/opengl/CompositingRenderTargetOGL.h
+++ b/gfx/layers/opengl/CompositingRenderTargetOGL.h
@@ -82,12 +82,11 @@ public:
    */
   static TemporaryRef<CompositingRenderTargetOGL>
   RenderTargetForWindow(CompositorOGL* aCompositor,
-                        const gfx::IntPoint& aOrigin,
                         const gfx::IntSize& aSize,
                         const gfx::Matrix& aTransform)
   {
     RefPtr<CompositingRenderTargetOGL> result
-      = new CompositingRenderTargetOGL(aCompositor, aOrigin, 0, 0);
+      = new CompositingRenderTargetOGL(aCompositor, gfx::IntPoint(0, 0), 0, 0);
     result->mTransform = aTransform;
     result->mInitParams = InitParams(aSize, 0, INIT_MODE_NONE);
     result->mInitParams.mStatus = InitParams::INITIALIZED;
diff --git a/gfx/layers/opengl/CompositorOGL.cpp b/gfx/layers/opengl/CompositorOGL.cpp
index 020d1bfa14e..1004e4fbbb7 100644
--- a/gfx/layers/opengl/CompositorOGL.cpp
+++ b/gfx/layers/opengl/CompositorOGL.cpp
@@ -596,6 +596,10 @@ CompositorOGL::PrepareViewport(const gfx::IntSize& aSize,
     viewMatrix.Scale(1.0f, -1.0f);
   }
 
+  if (!mTarget) {
+    viewMatrix.Translate(mRenderOffset.x, mRenderOffset.y);
+  }
+
   viewMatrix = aWorldTransform * viewMatrix;
 
   Matrix4x4 matrix3d = Matrix4x4::From2D(viewMatrix);
@@ -717,15 +721,6 @@ CompositorOGL::BeginFrame(const nsIntRegion& aInvalidRegion,
     rect = gfx::Rect(0, 0, mSurfaceSize.width, mSurfaceSize.height);
   } else {
     rect = gfx::Rect(aRenderBounds.x, aRenderBounds.y, aRenderBounds.width, aRenderBounds.height);
-    // If render bounds is not updated explicitly, try to infer it from widget
-    if (rect.width == 0 || rect.height == 0) {
-      // FIXME/bug XXXXXX this races with rotation changes on the main
-      // thread, and undoes all the care we take with layers txns being
-      // sent atomically with rotation changes
-      nsIntRect intRect;
-      mWidget->GetClientBounds(intRect);
-      rect = gfx::Rect(0, 0, intRect.width, intRect.height);
-    }
   }
 
   rect = aTransform.TransformBounds(rect);
@@ -761,17 +756,8 @@ CompositorOGL::BeginFrame(const nsIntRegion& aInvalidRegion,
   TexturePoolOGL::Fill(gl());
 #endif
 
-  // Make sure the render offset is respected. We ignore this when we have a
-  // target to stop tests failing - this is only used by the Android browser
-  // UI for its dynamic toolbar.
-  IntPoint origin;
-  if (!mTarget) {
-    origin = -TruncatedToInt(mRenderOffset.ToUnknownPoint());
-  }
-
   mCurrentRenderTarget =
     CompositingRenderTargetOGL::RenderTargetForWindow(this,
-                                                      origin,
                                                       IntSize(width, height),
                                                       aTransform);
   mCurrentRenderTarget->BindRenderTarget();
@@ -1030,11 +1016,12 @@ CompositorOGL::DrawQuad(const Rect& aRect,
 
   MOZ_ASSERT(mFrameInProgress, "frame not started");
 
-  IntRect intClipRect;
-  aClipRect.ToIntRect(&intClipRect);
+  Rect clipRect = aClipRect;
   if (!mTarget) {
-    intClipRect.MoveBy(mRenderOffset.x, mRenderOffset.y);
+    clipRect.MoveBy(mRenderOffset.x, mRenderOffset.y);
   }
+  IntRect intClipRect;
+  clipRect.ToIntRect(&intClipRect);
 
   gl()->fScissor(intClipRect.x, FlipY(intClipRect.y + intClipRect.height),
                  intClipRect.width, intClipRect.height);
diff --git a/gfx/src/nsRenderingContext.h b/gfx/src/nsRenderingContext.h
index 5b14abb80a9..af014b27dcf 100644
--- a/gfx/src/nsRenderingContext.h
+++ b/gfx/src/nsRenderingContext.h
@@ -11,7 +11,6 @@
 #include "gfxContext.h"                 // for gfxContext
 #include "mozilla/Assertions.h"         // for MOZ_ASSERT_HELPER2
 #include "mozilla/gfx/2D.h"
-#include "mozilla/gfx/UserData.h"       // for UserData, UserDataKey
 #include "nsAutoPtr.h"                  // for nsRefPtr
 #include "nsBoundingMetrics.h"          // for nsBoundingMetrics
 #include "nsColor.h"                    // for nscolor
@@ -35,8 +34,6 @@ typedef enum {
 
 class nsRenderingContext MOZ_FINAL
 {
-    typedef mozilla::gfx::UserData UserData;
-    typedef mozilla::gfx::UserDataKey UserDataKey;
     typedef mozilla::gfx::DrawTarget DrawTarget;
 
 public:
@@ -116,16 +113,6 @@ public:
     void DrawString(const char16_t *aString, uint32_t aLength,
                     nscoord aX, nscoord aY);
 
-    void AddUserData(UserDataKey *key, void *userData, void (*destroy)(void*)) {
-      mUserData.Add(key, userData, destroy);
-    }
-    void *GetUserData(UserDataKey *key) {
-      return mUserData.Get(key);
-    }
-    void *RemoveUserData(UserDataKey *key) {
-      return mUserData.Remove(key);
-    }
-
 private:
     // Private destructor, to discourage deletion outside of Release():
     ~nsRenderingContext()
@@ -139,8 +126,6 @@ private:
     nsRefPtr<nsFontMetrics> mFontMetrics;
 
     double mP2A; // cached app units per device pixel value
-
-    UserData mUserData;
 };
 
 #endif  // NSRENDERINGCONTEXT__H__
diff --git a/gfx/tests/gtest/TestAsyncPanZoomController.cpp b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
index 57625978d06..0f910e86f8c 100644
--- a/gfx/tests/gtest/TestAsyncPanZoomController.cpp
+++ b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
@@ -1481,7 +1481,7 @@ protected:
   }
 
   static TestAsyncPanZoomController* ApzcOf(Layer* aLayer) {
-    EXPECT_EQ(1, aLayer->GetFrameMetricsCount());
+    EXPECT_EQ(1u, aLayer->GetFrameMetricsCount());
     return (TestAsyncPanZoomController*)aLayer->GetAsyncPanZoomController(0);
   }
 
@@ -1505,7 +1505,8 @@ protected:
   already_AddRefed<AsyncPanZoomController> GetTargetAPZC(const ScreenPoint& aPoint) {
     nsRefPtr<AsyncPanZoomController> hit = manager->GetTargetAPZC(aPoint, nullptr);
     if (hit) {
-      manager->GetInputTransforms(hit.get(), transformToApzc, transformToGecko);
+      transformToApzc = manager->GetScreenToApzcTransform(hit.get());
+      transformToGecko = manager->GetApzcToGeckoTransform(hit.get());
     }
     return hit.forget();
   }
@@ -1547,8 +1548,8 @@ protected:
   }
 
   void CreateComplexMultiLayerTree() {
-    const char* layerTreeSyntax = "c(tc(t)tc(c(t)t))";
-    // LayerID                     0 12 3 45 6 7 8
+    const char* layerTreeSyntax = "c(tc(t)tc(c(t)tt))";
+    // LayerID                     0 12 3 45 6 7 89
     nsIntRegion layerVisibleRegion[] = {
       nsIntRegion(nsIntRect(0,0,300,400)),      // root(0)
       nsIntRegion(nsIntRect(0,0,100,100)),      // thebes(1) in top-left
@@ -1558,7 +1559,8 @@ protected:
       nsIntRegion(nsIntRect(200,0,100,400)),    // container(5) along the right 100px of root(0)
       nsIntRegion(nsIntRect(200,0,100,200)),    // container(6) taking up the top half of parent container(5)
       nsIntRegion(nsIntRect(200,0,100,200)),    // thebes(7) fully occupying parent container(6)
-      nsIntRegion(nsIntRect(200,200,100,200)),  // thebes(8) in bottom-right
+      nsIntRegion(nsIntRect(200,200,100,100)),  // thebes(8) in bottom-right (below (6))
+      nsIntRegion(nsIntRect(200,300,100,100)),  // thebes(9) in bottom-right (below (8))
     };
     root = CreateLayerTree(layerTreeSyntax, layerVisibleRegion, nullptr, lm, layers);
     SetScrollableFrameMetrics(layers[1], FrameMetrics::START_SCROLL_ID);
@@ -1566,7 +1568,8 @@ protected:
     SetScrollableFrameMetrics(layers[4], FrameMetrics::START_SCROLL_ID + 1);
     SetScrollableFrameMetrics(layers[6], FrameMetrics::START_SCROLL_ID + 1);
     SetScrollableFrameMetrics(layers[7], FrameMetrics::START_SCROLL_ID + 2);
-    SetScrollableFrameMetrics(layers[8], FrameMetrics::START_SCROLL_ID + 3);
+    SetScrollableFrameMetrics(layers[8], FrameMetrics::START_SCROLL_ID + 1);
+    SetScrollableFrameMetrics(layers[9], FrameMetrics::START_SCROLL_ID + 3);
   }
 };
 
@@ -1796,21 +1799,37 @@ TEST_F(APZHitTestingTester, ComplexMultiLayerTree) {
   EXPECT_NE(nullAPZC, ApzcOf(layers[6]));
   EXPECT_NE(nullAPZC, ApzcOf(layers[7]));
   EXPECT_NE(nullAPZC, ApzcOf(layers[8]));
+  EXPECT_NE(nullAPZC, ApzcOf(layers[9]));
   // Ensure those that scroll together have the same APZCs
   EXPECT_EQ(ApzcOf(layers[1]), ApzcOf(layers[2]));
   EXPECT_EQ(ApzcOf(layers[4]), ApzcOf(layers[6]));
+  EXPECT_EQ(ApzcOf(layers[8]), ApzcOf(layers[6]));
   // Ensure those that don't scroll together have different APZCs
   EXPECT_NE(ApzcOf(layers[1]), ApzcOf(layers[4]));
   EXPECT_NE(ApzcOf(layers[1]), ApzcOf(layers[7]));
-  EXPECT_NE(ApzcOf(layers[1]), ApzcOf(layers[8]));
+  EXPECT_NE(ApzcOf(layers[1]), ApzcOf(layers[9]));
   EXPECT_NE(ApzcOf(layers[4]), ApzcOf(layers[7]));
-  EXPECT_NE(ApzcOf(layers[4]), ApzcOf(layers[8]));
-  EXPECT_NE(ApzcOf(layers[7]), ApzcOf(layers[8]));
+  EXPECT_NE(ApzcOf(layers[4]), ApzcOf(layers[9]));
+  EXPECT_NE(ApzcOf(layers[7]), ApzcOf(layers[9]));
+
+  // Ensure the shape of the APZC tree is as expected
+  AsyncPanZoomController* layers1_2 = ApzcOf(layers[1]);
+  AsyncPanZoomController* layers4_6_8 = ApzcOf(layers[4]);
+  AsyncPanZoomController* layer7 = ApzcOf(layers[7]);
+  AsyncPanZoomController* layer9 = ApzcOf(layers[9]);
+  EXPECT_EQ(nullptr, layers1_2->GetParent());
+  EXPECT_EQ(nullptr, layers4_6_8->GetParent());
+  EXPECT_EQ(layers4_6_8, layer7->GetParent());
+  EXPECT_EQ(nullptr, layer9->GetParent());
+  EXPECT_EQ(nullptr, layers1_2->GetPrevSibling());
+  EXPECT_EQ(layers1_2, layers4_6_8->GetPrevSibling());
+  EXPECT_EQ(nullptr, layer7->GetPrevSibling());
+  EXPECT_EQ(layers4_6_8, layer9->GetPrevSibling());
 
   nsRefPtr<AsyncPanZoomController> hit = GetTargetAPZC(ScreenPoint(25, 25));
   EXPECT_EQ(ApzcOf(layers[1]), hit.get());
   hit = GetTargetAPZC(ScreenPoint(275, 375));
-  EXPECT_EQ(ApzcOf(layers[8]), hit.get());
+  EXPECT_EQ(ApzcOf(layers[9]), hit.get());
   hit = GetTargetAPZC(ScreenPoint(250, 100));
   EXPECT_EQ(ApzcOf(layers[7]), hit.get());
 }
diff --git a/gfx/tests/mochitest.ini b/gfx/tests/mochitest.ini
index f7d7af03836..a6963478c79 100644
--- a/gfx/tests/mochitest.ini
+++ b/gfx/tests/mochitest.ini
@@ -4,3 +4,5 @@ skip-if = buildapp == 'mulet' || buildapp == 'b2g'
 [mochitest/test_bug513439.html]
 skip-if = e10s
 [mochitest/test_acceleration.html]
+# Disable test until bug 1064136 is fixed
+# [mochitest/test_overdraw.html]
diff --git a/gfx/tests/mochitest/test_overdraw.html b/gfx/tests/mochitest/test_overdraw.html
new file mode 100644
index 00000000000..3ff9ec32efc
--- /dev/null
+++ b/gfx/tests/mochitest/test_overdraw.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test overdraw</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<script type="application/javascript">
+var domWindowUtils = SpecialPowers.getDOMWindowUtils(window);
+
+var overdraw = domWindowUtils.requestCompositorProperty("overdraw");
+
+if (overdraw == -1) {
+  // Overdraw queries are not supported on non OMTC builds.
+  ok(overdraw == -1, "Platform doesn't use a compositor.");
+} else {
+  // Overdraw may be lower than 100% like on OS X where we don't
+  // composite the window corners.
+  ok(overdraw > 0.95 && overdraw < 200, "Overdraw: " + overdraw);
+}
+</script>
+</body>
diff --git a/gfx/thebes/gfxAndroidPlatform.cpp b/gfx/thebes/gfxAndroidPlatform.cpp
index 8b2f2c00296..cc542f5f7e7 100644
--- a/gfx/thebes/gfxAndroidPlatform.cpp
+++ b/gfx/thebes/gfxAndroidPlatform.cpp
@@ -306,21 +306,32 @@ gfxAndroidPlatform::GetFTLibrary()
     return gPlatformFTLibrary;
 }
 
-gfxFontEntry* 
-gfxAndroidPlatform::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                     const uint8_t *aFontData, uint32_t aLength)
+gfxFontEntry*
+gfxAndroidPlatform::LookupLocalFont(const nsAString& aFontName,
+                                    uint16_t aWeight,
+                                    int16_t aStretch,
+                                    bool aItalic)
 {
-    return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aProxyEntry,
-                                                                     aFontData,
-                                                                     aLength);
+    return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aFontName,
+                                                                    aWeight,
+                                                                    aStretch,
+                                                                    aItalic);
 }
 
-gfxFontEntry*
-gfxAndroidPlatform::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                    const nsAString& aFontName)
+gfxFontEntry* 
+gfxAndroidPlatform::MakePlatformFont(const nsAString& aFontName,
+                                     uint16_t aWeight,
+                                     int16_t aStretch,
+                                     bool aItalic,
+                                     const uint8_t* aFontData,
+                                     uint32_t aLength)
 {
-    return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aProxyEntry,
-                                                                    aFontName);
+    return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aFontName,
+                                                                     aWeight,
+                                                                     aStretch,
+                                                                     aItalic,
+                                                                     aFontData,
+                                                                     aLength);
 }
 
 TemporaryRef<ScaledFont>
diff --git a/gfx/thebes/gfxAndroidPlatform.h b/gfx/thebes/gfxAndroidPlatform.h
index c1081ea6abc..d00170eedb8 100644
--- a/gfx/thebes/gfxAndroidPlatform.h
+++ b/gfx/thebes/gfxAndroidPlatform.h
@@ -47,10 +47,16 @@ public:
     // platform implementations of font functions
     virtual bool IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags);
     virtual gfxPlatformFontList* CreatePlatformFontList();
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData, uint32_t aLength);
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
+                                           uint32_t aLength);
 
     virtual void GetCommonFallbackFonts(const uint32_t aCh,
                                         int32_t aRunScript,
diff --git a/gfx/thebes/gfxDWriteFontList.cpp b/gfx/thebes/gfxDWriteFontList.cpp
index d9f5ce23b34..6b34b755f82 100644
--- a/gfx/thebes/gfxDWriteFontList.cpp
+++ b/gfx/thebes/gfxDWriteFontList.cpp
@@ -751,12 +751,14 @@ gfxDWriteFontList::GetDefaultFont(const gfxFontStyle *aStyle)
 }
 
 gfxFontEntry *
-gfxDWriteFontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                   const nsAString& aFullname)
+gfxDWriteFontList::LookupLocalFont(const nsAString& aFontName,
+                                   uint16_t aWeight,
+                                   int16_t aStretch,
+                                   bool aItalic)
 {
     gfxFontEntry *lookup;
 
-    lookup = LookupInFaceNameLists(aFullname);
+    lookup = LookupInFaceNameLists(aFontName);
     if (!lookup) {
         return nullptr;
     }
@@ -765,16 +767,19 @@ gfxDWriteFontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
     gfxDWriteFontEntry *fe =
         new gfxDWriteFontEntry(lookup->Name(),
                                dwriteLookup->mFont,
-                               aProxyEntry->Weight(),
-                               aProxyEntry->Stretch(),
-                               aProxyEntry->IsItalic());
+                               aWeight,
+                               aStretch,
+                               aItalic);
     fe->SetForceGDIClassic(dwriteLookup->GetForceGDIClassic());
     return fe;
 }
 
 gfxFontEntry *
-gfxDWriteFontList::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                    const uint8_t *aFontData,
+gfxDWriteFontList::MakePlatformFont(const nsAString& aFontName,
+                                    uint16_t aWeight,
+                                    int16_t aStretch,
+                                    bool aItalic,
+                                    const uint8_t* aFontData,
                                     uint32_t aLength)
 {
     nsresult rv;
@@ -836,9 +841,9 @@ gfxDWriteFontList::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
     gfxDWriteFontEntry *entry = 
         new gfxDWriteFontEntry(uniqueName, 
                                fontFile,
-                               aProxyEntry->Weight(),
-                               aProxyEntry->Stretch(),
-                               aProxyEntry->IsItalic());
+                               aWeight,
+                               aStretch,
+                               aItalic);
 
     fontFile->Analyze(&isSupported, &fileType, &entry->mFaceType, &numFaces);
     if (!isSupported || numFaces > 1) {
diff --git a/gfx/thebes/gfxDWriteFontList.h b/gfx/thebes/gfxDWriteFontList.h
index 46cde8211f1..0f7c5eb1b87 100644
--- a/gfx/thebes/gfxDWriteFontList.h
+++ b/gfx/thebes/gfxDWriteFontList.h
@@ -114,7 +114,6 @@ public:
         mWeight = aWeight;
         mStretch = aStretch;
         mItalic = aItalic;
-        mIsUserFont = true;
         mIsLocalUserFont = true;
         mIsCJK = UNINITIALIZED_VALUE;
     }
@@ -139,7 +138,7 @@ public:
         mWeight = aWeight;
         mStretch = aStretch;
         mItalic = aItalic;
-        mIsUserFont = true;
+        mIsDataUserFont = true;
         mIsCJK = UNINITIALIZED_VALUE;
     }
 
@@ -347,11 +346,16 @@ public:
 
     virtual gfxFontFamily* GetDefaultFont(const gfxFontStyle* aStyle);
 
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
 
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength);
     
     bool GetStandardFamilyName(const nsAString& aFontName,
diff --git a/gfx/thebes/gfxFT2FontList.cpp b/gfx/thebes/gfxFT2FontList.cpp
index 59f1622061c..538a4718549 100644
--- a/gfx/thebes/gfxFT2FontList.cpp
+++ b/gfx/thebes/gfxFT2FontList.cpp
@@ -253,8 +253,11 @@ FT2FontEntry::CreateFontInstance(const gfxFontStyle *aFontStyle, bool aNeedsBold
 
 /* static */
 FT2FontEntry*
-FT2FontEntry::CreateFontEntry(const gfxProxyFontEntry &aProxyEntry,
-                              const uint8_t *aFontData,
+FT2FontEntry::CreateFontEntry(const nsAString& aFontName,
+                              uint16_t aWeight,
+                              int16_t aStretch,
+                              bool aItalic,
+                              const uint8_t* aFontData,
                               uint32_t aLength)
 {
     // Ownership of aFontData is passed in here; the fontEntry must
@@ -273,16 +276,16 @@ FT2FontEntry::CreateFontEntry(const gfxProxyFontEntry &aProxyEntry,
         NS_Free((void*)aFontData);
         return nullptr;
     }
-    // Create our FT2FontEntry, which inherits the name of the proxy
+    // Create our FT2FontEntry, which inherits the name of the userfont entry
     // as it's not guaranteed that the face has valid names (bug 737315)
     FT2FontEntry* fe =
-        FT2FontEntry::CreateFontEntry(face, nullptr, 0, aProxyEntry.Name(),
+        FT2FontEntry::CreateFontEntry(face, nullptr, 0, aFontName,
                                       aFontData);
     if (fe) {
-        fe->mItalic = aProxyEntry.mItalic;
-        fe->mWeight = aProxyEntry.mWeight;
-        fe->mStretch = aProxyEntry.mStretch;
-        fe->mIsUserFont = true;
+        fe->mItalic = aItalic;
+        fe->mWeight = aWeight;
+        fe->mStretch = aStretch;
+        fe->mIsDataUserFont = true;
     }
     return fe;
 }
@@ -379,7 +382,7 @@ FT2FontEntry*
 FT2FontEntry::CreateFontEntry(FT_Face aFace,
                               const char* aFilename, uint8_t aIndex,
                               const nsAString& aName,
-                              const uint8_t *aFontData)
+                              const uint8_t* aFontData)
 {
     FT2FontEntry *fe = new FT2FontEntry(aName);
     fe->mItalic = FTFaceIsItalic(aFace);
@@ -1509,8 +1512,10 @@ FindFullName(nsStringHashKey::KeyType aKey,
 }
 
 gfxFontEntry* 
-gfxFT2FontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                const nsAString& aFontName)
+gfxFT2FontList::LookupLocalFont(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                bool aItalic)
 {
     // walk over list of names
     FullFontNameSearch data(aFontName);
@@ -1524,7 +1529,7 @@ gfxFT2FontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
     }
 
     // Clone the font entry so that we can then set its style descriptors
-    // from the proxy rather than the actual font.
+    // from the userfont entry rather than the actual font.
 
     // Ensure existence of mFTFace in the original entry
     data.mFontEntry->CairoFontFace();
@@ -1538,10 +1543,10 @@ gfxFT2FontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
                                       data.mFontEntry->mFTFontIndex,
                                       data.mFontEntry->Name(), nullptr);
     if (fe) {
-        fe->mItalic = aProxyEntry->mItalic;
-        fe->mWeight = aProxyEntry->mWeight;
-        fe->mStretch = aProxyEntry->mStretch;
-        fe->mIsUserFont = fe->mIsLocalUserFont = true;
+        fe->mItalic = aItalic;
+        fe->mWeight = aWeight;
+        fe->mStretch = aStretch;
+        fe->mIsLocalUserFont = true;
     }
 
     return fe;
@@ -1564,14 +1569,18 @@ gfxFT2FontList::GetDefaultFont(const gfxFontStyle* aStyle)
 }
 
 gfxFontEntry*
-gfxFT2FontList::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                 const uint8_t *aFontData,
+gfxFT2FontList::MakePlatformFont(const nsAString& aFontName,
+                                 uint16_t aWeight,
+                                 int16_t aStretch,
+                                 bool aItalic,
+                                 const uint8_t* aFontData,
                                  uint32_t aLength)
 {
     // The FT2 font needs the font data to persist, so we do NOT free it here
     // but instead pass ownership to the font entry.
     // Deallocation will happen later, when the font face is destroyed.
-    return FT2FontEntry::CreateFontEntry(*aProxyEntry, aFontData, aLength);
+    return FT2FontEntry::CreateFontEntry(aFontName, aWeight, aStretch,
+                                         aItalic, aFontData, aLength);
 }
 
 static PLDHashOperator
diff --git a/gfx/thebes/gfxFT2FontList.h b/gfx/thebes/gfxFT2FontList.h
index 99d8b13fd34..5c32fb09d93 100644
--- a/gfx/thebes/gfxFT2FontList.h
+++ b/gfx/thebes/gfxFT2FontList.h
@@ -39,8 +39,12 @@ public:
 
     // create a font entry for a downloaded font
     static FT2FontEntry* 
-    CreateFontEntry(const gfxProxyFontEntry &aProxyEntry,
-                    const uint8_t *aFontData, uint32_t aLength);
+    CreateFontEntry(const nsAString& aFontName,
+                    uint16_t aWeight,
+                    int16_t aStretch,
+                    bool aItalic,
+                    const uint8_t* aFontData,
+                    uint32_t aLength);
 
     // create a font entry representing an installed font, identified by
     // a FontListEntry; the freetype and cairo faces will not be instantiated
@@ -56,7 +60,7 @@ public:
     CreateFontEntry(FT_Face aFace,
                     const char *aFilename, uint8_t aIndex,
                     const nsAString& aName,
-                    const uint8_t *aFontData = nullptr);
+                    const uint8_t* aFontData = nullptr);
 
     virtual gfxFont *CreateFontInstance(const gfxFontStyle *aFontStyle,
                                         bool aNeedsBold);
@@ -118,11 +122,16 @@ public:
 
     virtual gfxFontFamily* GetDefaultFont(const gfxFontStyle* aStyle);
 
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
 
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength);
 
     void GetFontList(InfallibleTArray<FontListEntry>* retValue);
diff --git a/gfx/thebes/gfxFont.cpp b/gfx/thebes/gfxFont.cpp
index ed5a7687e6c..a15d1b430ea 100644
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@@ -111,9 +111,10 @@ gfxCharacterMap::NotifyReleased()
 
 gfxFontEntry::gfxFontEntry() :
     mItalic(false), mFixedPitch(false),
-    mIsProxy(false), mIsValid(true),
+    mIsValid(true),
     mIsBadUnderlineFont(false),
-    mIsUserFont(false),
+    mIsUserFontContainer(false),
+    mIsDataUserFont(false),
     mIsLocalUserFont(false),
     mStandardFace(false),
     mSymbolFont(false),
@@ -146,8 +147,10 @@ gfxFontEntry::gfxFontEntry() :
 
 gfxFontEntry::gfxFontEntry(const nsAString& aName, bool aIsStandardFace) :
     mName(aName), mItalic(false), mFixedPitch(false),
-    mIsProxy(false), mIsValid(true),
-    mIsBadUnderlineFont(false), mIsUserFont(false),
+    mIsValid(true),
+    mIsBadUnderlineFont(false),
+    mIsUserFontContainer(false),
+    mIsDataUserFont(false),
     mIsLocalUserFont(false), mStandardFace(aIsStandardFace),
     mSymbolFont(false),
     mIgnoreGDEF(false),
@@ -196,7 +199,7 @@ gfxFontEntry::~gfxFontEntry()
 
     // For downloaded fonts, we need to tell the user font cache that this
     // entry is being deleted.
-    if (!mIsProxy && IsUserFont() && !IsLocalUserFont()) {
+    if (mIsDataUserFont) {
         gfxUserFontSet::UserFontCache::ForgetFont(this);
     }
 
@@ -1330,6 +1333,27 @@ gfxFontFamily::CheckForSimpleFamily()
     mIsSimpleFamily = true;
 }
 
+#ifdef DEBUG
+bool
+gfxFontFamily::ContainsFace(gfxFontEntry* aFontEntry) {
+    uint32_t i, numFonts = mAvailableFonts.Length();
+    for (i = 0; i < numFonts; i++) {
+        if (mAvailableFonts[i] == aFontEntry) {
+            return true;
+        }
+        // userfonts contain the actual real font entry
+        if (mAvailableFonts[i]->mIsUserFontContainer) {
+            gfxUserFontEntry* ufe =
+                static_cast<gfxUserFontEntry*>(mAvailableFonts[i].get());
+            if (ufe->GetPlatformFontEntry() == aFontEntry) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+#endif
+
 static inline uint32_t
 StyleDistance(gfxFontEntry *aFontEntry,
               bool anItalic, int16_t aStretch)
@@ -1797,7 +1821,7 @@ gfxFontFamily::ReadAllCMAPs(FontInfoData *aFontInfoData)
     for (i = 0; i < numFonts; i++) {
         gfxFontEntry *fe = mAvailableFonts[i];
         // don't try to load cmaps for downloadable fonts not yet loaded
-        if (!fe || fe->mIsProxy) {
+        if (!fe || fe->mIsUserFontContainer) {
             continue;
         }
         fe->ReadCMAP(aFontInfoData);
@@ -5038,8 +5062,13 @@ gfxFontGroup::FindPlatformFont(const nsAString& aName,
             family = mUserFontSet->LookupFamily(aName);
             if (family) {
                 bool waitForUserFont = false;
-                fe = mUserFontSet->FindFontEntry(family, mStyle,
-                                                 needsBold, waitForUserFont);
+                gfxUserFontEntry* userFontEntry = nullptr;
+                userFontEntry = mUserFontSet->FindUserFontEntry(family, mStyle,
+                                                                needsBold,
+                                                                waitForUserFont);
+                if (userFontEntry) {
+                    fe = userFontEntry->GetPlatformFontEntry();
+                }
                 if (!fe && waitForUserFont) {
                     mSkipDrawing = true;
                 }
@@ -5049,7 +5078,7 @@ gfxFontGroup::FindPlatformFont(const nsAString& aName,
 
     // Not known in the user font set ==> check system fonts
     if (!family) {
-        gfxPlatformFontList *fontList = gfxPlatformFontList::PlatformFontList();
+        gfxPlatformFontList* fontList = gfxPlatformFontList::PlatformFontList();
         family = fontList->FindFamily(aName, mStyle.systemFont);
         if (family) {
             fe = family->FindFontForStyle(mStyle, needsBold);
diff --git a/gfx/thebes/gfxFont.h b/gfx/thebes/gfxFont.h
index f8e1f585b24..11cb7e46254 100644
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@@ -288,7 +288,7 @@ public:
     uint16_t Weight() const { return mWeight; }
     int16_t Stretch() const { return mStretch; }
 
-    bool IsUserFont() const { return mIsUserFont; }
+    bool IsUserFont() const { return mIsDataUserFont || mIsLocalUserFont; }
     bool IsLocalUserFont() const { return mIsLocalUserFont; }
     bool IsFixedPitch() const { return mFixedPitch; }
     bool IsItalic() const { return mItalic; }
@@ -337,7 +337,7 @@ public:
     nsresult InitializeUVSMap();
     uint16_t GetUVSGlyph(uint32_t aCh, uint32_t aVS);
 
-    // All concrete gfxFontEntry subclasses (except gfxProxyFontEntry) need
+    // All concrete gfxFontEntry subclasses (except gfxUserFontEntry) need
     // to override this, otherwise the font will never be used as it will
     // be considered to support no characters.
     // ReadCMAP() must *always* set the mCharacterMap pointer to a valid
@@ -555,11 +555,11 @@ public:
 
     bool             mItalic      : 1;
     bool             mFixedPitch  : 1;
-    bool             mIsProxy     : 1;
     bool             mIsValid     : 1;
     bool             mIsBadUnderlineFont : 1;
-    bool             mIsUserFont  : 1;
-    bool             mIsLocalUserFont  : 1;
+    bool             mIsUserFontContainer : 1; // userfont entry
+    bool             mIsDataUserFont : 1;      // platform font entry (data)
+    bool             mIsLocalUserFont : 1;     // platform font entry (local)
     bool             mStandardFace : 1;
     bool             mSymbolFont  : 1;
     bool             mIgnoreGDEF  : 1;
@@ -932,16 +932,10 @@ public:
     virtual void AddSizeOfIncludingThis(mozilla::MallocSizeOf aMallocSizeOf,
                                         FontListSizes* aSizes) const;
 
+#ifdef DEBUG
     // Only used for debugging checks - does a linear search
-    bool ContainsFace(gfxFontEntry* aFontEntry) {
-        uint32_t i, numFonts = mAvailableFonts.Length();
-        for (i = 0; i < numFonts; i++) {
-            if (mAvailableFonts[i] == aFontEntry) {
-                return true;
-            }
-        }
-        return false;
-    }
+    bool ContainsFace(gfxFontEntry* aFontEntry);
+#endif
 
     void SetSkipSpaceFeatureCheck(bool aSkipCheck) {
         mSkipDefaultFeatureSpaceCheck = aSkipCheck;
diff --git a/gfx/thebes/gfxGDIFontList.cpp b/gfx/thebes/gfxGDIFontList.cpp
index feb9eb460ed..0b3d8e89801 100644
--- a/gfx/thebes/gfxGDIFontList.cpp
+++ b/gfx/thebes/gfxGDIFontList.cpp
@@ -140,7 +140,7 @@ GDIFontEntry::GDIFontEntry(const nsAString& aFaceName,
     mStretch = aStretch;
     if (IsType1())
         mForceGDI = true;
-    mIsUserFont = aUserFontData != nullptr;
+    mIsDataUserFont = aUserFontData != nullptr;
 
     InitLogFont(aFaceName, aFontType);
 }
@@ -229,7 +229,7 @@ GDIFontEntry::CreateFontInstance(const gfxFontStyle* aFontStyle, bool aNeedsBold
 
     bool useClearType = isXP && !aFontStyle->systemFont &&
         (gfxWindowsPlatform::GetPlatform()->UseClearTypeAlways() ||
-         (mIsUserFont && !mIsLocalUserFont &&
+         (mIsDataUserFont &&
           gfxWindowsPlatform::GetPlatform()->UseClearTypeForDownloadableFonts()));
 
     return new gfxGDIFont(this, aFontStyle, aNeedsBold, 
@@ -291,7 +291,7 @@ GDIFontEntry::FillLogFont(LOGFONTW *aLogFont,
     // if the face is described as italic, we should use it as-is,
     // and if it's not, but then the element is styled italic, we'll use
     // a cairo transform to create fake italic (oblique)
-    if (IsUserFont() && !IsLocalUserFont()) {
+    if (mIsDataUserFont) {
         aLogFont->lfItalic = 0;
     }
 
@@ -724,12 +724,14 @@ gfxGDIFontList::EnumFontFamExProc(ENUMLOGFONTEXW *lpelfe,
 }
 
 gfxFontEntry* 
-gfxGDIFontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                const nsAString& aFullname)
+gfxGDIFontList::LookupLocalFont(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                bool aItalic)
 {
     gfxFontEntry *lookup;
 
-    lookup = LookupInFaceNameLists(aFullname);
+    lookup = LookupInFaceNameLists(aFontName);
     if (!lookup) {
         return nullptr;
     }
@@ -743,32 +745,34 @@ gfxGDIFontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
     GDIFontEntry *fe = GDIFontEntry::CreateFontEntry(lookup->Name(), 
         gfxWindowsFontType(isCFF ? GFX_FONT_TYPE_PS_OPENTYPE : GFX_FONT_TYPE_TRUETYPE) /*type*/, 
         lookup->mItalic ? NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL,
-        lookup->mWeight, aProxyEntry->mStretch, nullptr,
+        lookup->mWeight, aStretch, nullptr,
         static_cast<GDIFontEntry*>(lookup)->mFamilyHasItalicFace);
         
     if (!fe)
         return nullptr;
 
-    fe->mIsUserFont = true;
     fe->mIsLocalUserFont = true;
 
-    // make the new font entry match the proxy entry style characteristics
-    fe->mWeight = (aProxyEntry->mWeight == 0 ? 400 : aProxyEntry->mWeight);
-    fe->mItalic = aProxyEntry->mItalic;
+    // make the new font entry match the userfont entry style characteristics
+    fe->mWeight = (aWeight == 0 ? 400 : aWeight);
+    fe->mItalic = aItalic;
 
     return fe;
 }
 
-gfxFontEntry* 
-gfxGDIFontList::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry, 
-                                 const uint8_t *aFontData,
+gfxFontEntry*
+gfxGDIFontList::MakePlatformFont(const nsAString& aFontName,
+                                 uint16_t aWeight,
+                                 int16_t aStretch,
+                                 bool aItalic,
+                                 const uint8_t* aFontData,
                                  uint32_t aLength)
 {
     // MakePlatformFont is responsible for deleting the font data with NS_Free
     // so we set up a stack object to ensure it is freed even if we take an
     // early exit
     struct FontDataDeleter {
-        FontDataDeleter(const uint8_t *aFontData)
+        FontDataDeleter(const uint8_t* aFontData)
             : mFontData(aFontData) { }
         ~FontDataDeleter() { NS_Free((void*)mFontData); }
         const uint8_t *mFontData;
@@ -817,17 +821,17 @@ gfxGDIFontList::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
 
     // make a new font entry using the unique name
     WinUserFontData *winUserFontData = new WinUserFontData(fontRef);
-    uint16_t w = (aProxyEntry->mWeight == 0 ? 400 : aProxyEntry->mWeight);
+    uint16_t w = (aWeight == 0 ? 400 : aWeight);
 
     GDIFontEntry *fe = GDIFontEntry::CreateFontEntry(uniqueName, 
         gfxWindowsFontType(isCFF ? GFX_FONT_TYPE_PS_OPENTYPE : GFX_FONT_TYPE_TRUETYPE) /*type*/, 
-        uint32_t(aProxyEntry->mItalic ? NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL), 
-        w, aProxyEntry->mStretch, winUserFontData, false);
+        uint32_t(aItalic ? NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL),
+        w, aStretch, winUserFontData, false);
 
     if (!fe)
         return fe;
 
-    fe->mIsUserFont = true;
+    fe->mIsDataUserFont = true;
 
     // Uniscribe doesn't place CFF fonts loaded privately 
     // via AddFontMemResourceEx on XP/Vista
diff --git a/gfx/thebes/gfxGDIFontList.h b/gfx/thebes/gfxGDIFontList.h
index 9b1b8627996..741b760263f 100644
--- a/gfx/thebes/gfxGDIFontList.h
+++ b/gfx/thebes/gfxGDIFontList.h
@@ -246,8 +246,10 @@ public:
                                          bool aFamilyHasItalicFace);
 
     // create a font entry for a font referenced by its fullname
-    static GDIFontEntry* LoadLocalFont(const gfxProxyFontEntry &aProxyEntry,
-                                       const nsAString& aFullname);
+    static GDIFontEntry* LoadLocalFont(const nsAString& aFontName,
+                                       uint16_t aWeight,
+                                       int16_t aStretch,
+                                       bool aItalic);
 
     uint8_t mWindowsFamily;
     uint8_t mWindowsPitch;
@@ -310,11 +312,17 @@ public:
     virtual gfxFontFamily* FindFamily(const nsAString& aFamily,
                                       bool aUseSystemFonts = false);
 
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
 
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData, uint32_t aLength);
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
+                                           uint32_t aLength);
 
     virtual void AddSizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf,
                                         FontListSizes* aSizes) const;
diff --git a/gfx/thebes/gfxHarfBuzzShaper.cpp b/gfx/thebes/gfxHarfBuzzShaper.cpp
index 5facec04c38..2e5f17a678b 100644
--- a/gfx/thebes/gfxHarfBuzzShaper.cpp
+++ b/gfx/thebes/gfxHarfBuzzShaper.cpp
@@ -107,6 +107,10 @@ gfxHarfBuzzShaper::GetGlyph(hb_codepoint_t unicode,
                                                                       compat);
                         }
                         break;
+                    case 10:
+                        gid = gfxFontUtils::MapCharToGlyphFormat10(data + mSubtableOffset,
+                                                                   compat);
+                        break;
                     case 12:
                         gid = gfxFontUtils::MapCharToGlyphFormat12(data + mSubtableOffset,
                                                                    compat);
@@ -125,6 +129,10 @@ gfxHarfBuzzShaper::GetGlyph(hb_codepoint_t unicode,
                 gfxFontUtils::MapCharToGlyphFormat4(data + mSubtableOffset,
                                                     unicode) : 0;
             break;
+        case 10:
+            gid = gfxFontUtils::MapCharToGlyphFormat10(data + mSubtableOffset,
+                                                       unicode);
+            break;
         case 12:
             gid = gfxFontUtils::MapCharToGlyphFormat12(data + mSubtableOffset,
                                                        unicode);
diff --git a/gfx/thebes/gfxMacPlatformFontList.h b/gfx/thebes/gfxMacPlatformFontList.h
index 9e7533d9eb9..6a3e25f15a4 100644
--- a/gfx/thebes/gfxMacPlatformFontList.h
+++ b/gfx/thebes/gfxMacPlatformFontList.h
@@ -33,7 +33,7 @@ public:
     // for use with data fonts
     MacOSFontEntry(const nsAString& aPostscriptName, CGFontRef aFontRef,
                    uint16_t aWeight, uint16_t aStretch, uint32_t aItalicStyle,
-                   bool aIsUserFont, bool aIsLocal);
+                   bool aIsDataUserFont, bool aIsLocal);
 
     virtual ~MacOSFontEntry() {
         ::CGFontRelease(mFontRef);
@@ -81,11 +81,17 @@ public:
 
     virtual bool GetStandardFamilyName(const nsAString& aFontName, nsAString& aFamilyName);
 
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
     
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData, uint32_t aLength);
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
+                                           uint32_t aLength);
 
     void ClearPrefFonts() { mPrefFonts.Clear(); }
 
diff --git a/gfx/thebes/gfxMacPlatformFontList.mm b/gfx/thebes/gfxMacPlatformFontList.mm
index 06ca9e4cc91..6110727f864 100644
--- a/gfx/thebes/gfxMacPlatformFontList.mm
+++ b/gfx/thebes/gfxMacPlatformFontList.mm
@@ -291,7 +291,8 @@ MacOSFontEntry::MacOSFontEntry(const nsAString& aPostscriptName,
                                CGFontRef aFontRef,
                                uint16_t aWeight, uint16_t aStretch,
                                uint32_t aItalicStyle,
-                               bool aIsUserFont, bool aIsLocal)
+                               bool aIsDataUserFont,
+                               bool aIsLocalUserFont)
     : gfxFontEntry(aPostscriptName, false),
       mFontRef(NULL),
       mFontRefInitialized(false),
@@ -307,8 +308,11 @@ MacOSFontEntry::MacOSFontEntry(const nsAString& aPostscriptName,
     mStretch = aStretch;
     mFixedPitch = false; // xxx - do we need this for downloaded fonts?
     mItalic = (aItalicStyle & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) != 0;
-    mIsUserFont = aIsUserFont;
-    mIsLocalUserFont = aIsLocal;
+
+    NS_ASSERTION(!(aIsDataUserFont && aIsLocalUserFont),
+                 "userfont is either a data font or a local font");
+    mIsDataUserFont = aIsDataUserFont;
+    mIsLocalUserFont = aIsLocalUserFont;
 }
 
 CGFontRef
@@ -725,7 +729,9 @@ gfxMacPlatformFontList::InitSingleFaceList()
         LOG_FONTLIST(("(fontlist-singleface) face name: %s\n",
                       NS_ConvertUTF16toUTF8(singleFaceFonts[i]).get()));
 #endif
-        gfxFontEntry *fontEntry = LookupLocalFont(nullptr, singleFaceFonts[i]);
+        gfxFontEntry *fontEntry = LookupLocalFont(singleFaceFonts[i],
+                                                  400, 0,
+                                                  NS_FONT_STYLE_NORMAL);
         if (fontEntry) {
             nsAutoString familyName, key;
             familyName = singleFaceFonts[i];
@@ -740,6 +746,8 @@ gfxMacPlatformFontList::InitSingleFaceList()
             if (!mFontFamilies.GetWeak(key)) {
                 gfxFontFamily *familyEntry =
                     new gfxSingleFaceMacFontFamily(familyName);
+                // LookupLocalFont sets this, need to clear
+                fontEntry->mIsLocalUserFont = false;
                 familyEntry->AddFontEntry(fontEntry);
                 familyEntry->SetHasStyles(true);
                 mFontFamilies.Put(key, familyEntry);
@@ -904,8 +912,10 @@ gfxMacPlatformFontList::AppleWeightToCSSWeight(int32_t aAppleWeight)
 }
 
 gfxFontEntry*
-gfxMacPlatformFontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                        const nsAString& aFontName)
+gfxMacPlatformFontList::LookupLocalFont(const nsAString& aFontName,
+                                        uint16_t aWeight,
+                                        int16_t aStretch,
+                                        bool aItalic)
 {
     nsAutoreleasePool localPool;
 
@@ -918,22 +928,15 @@ gfxMacPlatformFontList::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
         return nullptr;
     }
 
-    if (aProxyEntry) {
-        uint16_t w = aProxyEntry->mWeight;
-        NS_ASSERTION(w >= 100 && w <= 900, "bogus font weight value!");
+    NS_ASSERTION(aWeight >= 100 && aWeight <= 900,
+                 "bogus font weight value!");
 
-        newFontEntry =
-            new MacOSFontEntry(aFontName, fontRef,
-                               w, aProxyEntry->mStretch,
-                               aProxyEntry->mItalic ?
-                                   NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL,
-                               true, true);
-    } else {
-        newFontEntry =
-            new MacOSFontEntry(aFontName, fontRef,
-                               400, 0, NS_FONT_STYLE_NORMAL,
-                               false, false);
-    }
+    newFontEntry =
+        new MacOSFontEntry(aFontName, fontRef,
+                           aWeight, aStretch,
+                           aItalic ?
+                               NS_FONT_STYLE_ITALIC : NS_FONT_STYLE_NORMAL,
+                           false, true);
     ::CFRelease(fontRef);
 
     return newFontEntry;
@@ -945,14 +948,16 @@ static void ReleaseData(void *info, const void *data, size_t size)
 }
 
 gfxFontEntry*
-gfxMacPlatformFontList::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                         const uint8_t *aFontData,
+gfxMacPlatformFontList::MakePlatformFont(const nsAString& aFontName,
+                                         uint16_t aWeight,
+                                         int16_t aStretch,
+                                         bool aItalic,
+                                         const uint8_t* aFontData,
                                          uint32_t aLength)
 {
     NS_ASSERTION(aFontData, "MakePlatformFont called with null data");
 
-    uint16_t w = aProxyEntry->mWeight;
-    NS_ASSERTION(w >= 100 && w <= 900, "bogus font weight value!");
+    NS_ASSERTION(aWeight >= 100 && aWeight <= 900, "bogus font weight value!");
 
     // create the font entry
     nsAutoString uniqueName;
@@ -973,9 +978,9 @@ gfxMacPlatformFontList::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
     }
 
     nsAutoPtr<MacOSFontEntry>
-        newFontEntry(new MacOSFontEntry(uniqueName, fontRef, w,
-                                        aProxyEntry->mStretch,
-                                        aProxyEntry->mItalic ?
+        newFontEntry(new MacOSFontEntry(uniqueName, fontRef, aWeight,
+                                        aStretch,
+                                        aItalic ?
                                             NS_FONT_STYLE_ITALIC :
                                             NS_FONT_STYLE_NORMAL,
                                         true, false));
diff --git a/gfx/thebes/gfxPangoFonts.cpp b/gfx/thebes/gfxPangoFonts.cpp
index 9bb70e5a70b..7f24b3bc316 100644
--- a/gfx/thebes/gfxPangoFonts.cpp
+++ b/gfx/thebes/gfxPangoFonts.cpp
@@ -326,13 +326,15 @@ gfxSystemFcFontEntry::ReleaseGrFace(gr_face* aFace)
 
 class gfxUserFcFontEntry : public gfxFcFontEntry {
 protected:
-    explicit gfxUserFcFontEntry(const gfxProxyFontEntry &aProxyEntry)
-        : gfxFcFontEntry(aProxyEntry.Name())
+    explicit gfxUserFcFontEntry(const nsAString& aFontName,
+                       uint16_t aWeight,
+                       int16_t aStretch,
+                       bool aItalic)
+        : gfxFcFontEntry(aFontName)
     {
-        mItalic = aProxyEntry.mItalic;
-        mWeight = aProxyEntry.mWeight;
-        mStretch = aProxyEntry.mStretch;
-        mIsUserFont = true;
+        mItalic = aItalic;
+        mWeight = aWeight;
+        mStretch = aStretch;
     }
 
     // Helper function to change a pattern so that it matches the CSS style
@@ -410,9 +412,12 @@ gfxUserFcFontEntry::AdjustPatternToCSS(FcPattern *aPattern)
 
 class gfxLocalFcFontEntry : public gfxUserFcFontEntry {
 public:
-    gfxLocalFcFontEntry(const gfxProxyFontEntry &aProxyEntry,
+    gfxLocalFcFontEntry(const nsAString& aFontName,
+                        uint16_t aWeight,
+                        int16_t aStretch,
+                        bool aItalic,
                         const nsTArray< nsCountedRef<FcPattern> >& aPatterns)
-        : gfxUserFcFontEntry(aProxyEntry)
+        : gfxUserFcFontEntry(aFontName, aWeight, aStretch, aItalic)
     {
         if (!mPatterns.SetCapacity(aPatterns.Length()))
             return; // OOM
@@ -443,11 +448,16 @@ public:
 class gfxDownloadedFcFontEntry : public gfxUserFcFontEntry {
 public:
     // This takes ownership of the face and its underlying data
-    gfxDownloadedFcFontEntry(const gfxProxyFontEntry &aProxyEntry,
+    gfxDownloadedFcFontEntry(const nsAString& aFontName,
+                             uint16_t aWeight,
+                             int16_t aStretch,
+                             bool aItalic,
                              const uint8_t *aData, FT_Face aFace)
-        : gfxUserFcFontEntry(aProxyEntry), mFontData(aData), mFace(aFace)
+        : gfxUserFcFontEntry(aFontName, aWeight, aStretch, aItalic),
+          mFontData(aData), mFace(aFace)
     {
         NS_PRECONDITION(aFace != nullptr, "aFace is NULL!");
+        mIsDataUserFont = true;
         InitPattern();
     }
 
@@ -802,16 +812,27 @@ FindFontPatterns(gfxUserFontSet *mUserFontSet,
     gfxUserFcFontEntry *fontEntry = nullptr;
     gfxFontFamily *family = mUserFontSet->LookupFamily(utf16Family);
     if (family) {
-        fontEntry = static_cast<gfxUserFcFontEntry*>
-            (mUserFontSet->FindFontEntry(family, style, needsBold,
-                                         aWaitForUserFont));
+        gfxUserFontEntry* userFontEntry =
+            mUserFontSet->FindUserFontEntry(family, style, needsBold,
+                                            aWaitForUserFont);
+        if (userFontEntry) {
+            fontEntry = static_cast<gfxUserFcFontEntry*>
+                (userFontEntry->GetPlatformFontEntry());
+        }
 
         // Accept synthetic oblique for italic and oblique.
+        // xxx - this isn't really ideal behavior, for docs that only use a
+        //       single italic face it will also pull down the normal face
+        //       and probably never use it
         if (!fontEntry && aStyle != NS_FONT_STYLE_NORMAL) {
             style.style = NS_FONT_STYLE_NORMAL;
-            fontEntry = static_cast<gfxUserFcFontEntry*>
-                (mUserFontSet->FindFontEntry(family, style, needsBold,
-                                             aWaitForUserFont));
+            userFontEntry = mUserFontSet->FindUserFontEntry(family, style,
+                                                            needsBold,
+                                                            aWaitForUserFont);
+            if (userFontEntry) {
+                fontEntry = static_cast<gfxUserFcFontEntry*>
+                    (userFontEntry->GetPlatformFontEntry());
+            }
         }
     }
 
@@ -999,7 +1020,7 @@ gfxFcFontSet::SortPreferredFonts(bool &aWaitForUserFont)
             }
 
             // User fonts are already filtered by slant (but not size) in
-            // mUserFontSet->FindFontEntry().
+            // mUserFontSet->FindUserFontEntry().
             if (requestedSize != -1.0 && !SizeIsAcceptable(font, requestedSize))
                 continue;
 
@@ -1582,8 +1603,10 @@ gfxPangoFontGroup::Shutdown()
 }
 
 /* static */ gfxFontEntry *
-gfxPangoFontGroup::NewFontEntry(const gfxProxyFontEntry &aProxyEntry,
-                                const nsAString& aFullname)
+gfxPangoFontGroup::NewFontEntry(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                bool aItalic)
 {
     gfxFontconfigUtils *utils = gfxFontconfigUtils::GetFontconfigUtils();
     if (!utils)
@@ -1610,7 +1633,7 @@ gfxPangoFontGroup::NewFontEntry(const gfxProxyFontEntry &aProxyEntry,
     if (!pattern)
         return nullptr;
 
-    NS_ConvertUTF16toUTF8 fullname(aFullname);
+    NS_ConvertUTF16toUTF8 fullname(aFontName);
     FcPatternAddString(pattern, FC_FULLNAME,
                        gfxFontconfigUtils::ToFcChar8(fullname));
     FcConfigSubstitute(nullptr, pattern, FcMatchPattern);
@@ -1623,7 +1646,11 @@ gfxPangoFontGroup::NewFontEntry(const gfxProxyFontEntry &aProxyEntry,
             utils->GetFontsForFullname(name);
 
         if (fonts.Length() != 0)
-            return new gfxLocalFcFontEntry(aProxyEntry, fonts);
+            return new gfxLocalFcFontEntry(aFontName,
+                                           aWeight,
+                                           aStretch,
+                                           aItalic,
+                                           fonts);
     }
 
     return nullptr;
@@ -1661,8 +1688,12 @@ gfxPangoFontGroup::GetFTLibrary()
 }
 
 /* static */ gfxFontEntry *
-gfxPangoFontGroup::NewFontEntry(const gfxProxyFontEntry &aProxyEntry,
-                                const uint8_t *aFontData, uint32_t aLength)
+gfxPangoFontGroup::NewFontEntry(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                bool aItalic,
+                                const uint8_t* aFontData,
+                                uint32_t aLength)
 {
     // Ownership of aFontData is passed in here, and transferred to the
     // new fontEntry, which will release it when no longer needed.
@@ -1677,7 +1708,9 @@ gfxPangoFontGroup::NewFontEntry(const gfxProxyFontEntry &aProxyEntry,
         return nullptr;
     }
 
-    return new gfxDownloadedFcFontEntry(aProxyEntry, aFontData, face);
+    return new gfxDownloadedFcFontEntry(aFontName, aWeight,
+                                        aStretch, aItalic,
+                                        aFontData, face);
 }
 
 
diff --git a/gfx/thebes/gfxPangoFonts.h b/gfx/thebes/gfxPangoFonts.h
index 8aacdbd1ac4..ace7da75b84 100644
--- a/gfx/thebes/gfxPangoFonts.h
+++ b/gfx/thebes/gfxPangoFonts.h
@@ -17,7 +17,6 @@
 
 class gfxFcFontSet;
 class gfxFcFont;
-class gfxProxyFontEntry;
 typedef struct _FcPattern FcPattern;
 typedef struct FT_FaceRec_* FT_Face;
 typedef struct FT_LibraryRec_  *FT_Library;
@@ -43,11 +42,16 @@ public:
     static void Shutdown();
 
     // Used for @font-face { src: local(); }
-    static gfxFontEntry *NewFontEntry(const gfxProxyFontEntry &aProxyEntry,
-                                      const nsAString &aFullname);
+    static gfxFontEntry *NewFontEntry(const nsAString& aFontName,
+                                      uint16_t aWeight,
+                                      int16_t aStretch,
+                                      bool aItalic);
     // Used for @font-face { src: url(); }
-    static gfxFontEntry *NewFontEntry(const gfxProxyFontEntry &aProxyEntry,
-                                      const uint8_t *aFontData,
+    static gfxFontEntry *NewFontEntry(const nsAString& aFontName,
+                                      uint16_t aWeight,
+                                      int16_t aStretch,
+                                      bool aItalic,
+                                      const uint8_t* aFontData,
                                       uint32_t aLength);
 
 private:
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index ac800edd523..143f803bf6e 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -1075,8 +1075,11 @@ gfxPlatform::UseGraphiteShaping()
 }
 
 gfxFontEntry*
-gfxPlatform::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                              const uint8_t *aFontData,
+gfxPlatform::MakePlatformFont(const nsAString& aFontName,
+                              uint16_t aWeight,
+                              int16_t aStretch,
+                              bool aItalic,
+                              const uint8_t* aFontData,
                               uint32_t aLength)
 {
     // Default implementation does not handle activating downloaded fonts;
diff --git a/gfx/thebes/gfxPlatform.h b/gfx/thebes/gfxPlatform.h
index 0c99e709c70..3e90a8bfb43 100644
--- a/gfx/thebes/gfxPlatform.h
+++ b/gfx/thebes/gfxPlatform.h
@@ -31,7 +31,6 @@ class gfxFontGroup;
 struct gfxFontStyle;
 class gfxUserFontSet;
 class gfxFontEntry;
-class gfxProxyFontEntry;
 class gfxPlatformFontList;
 class gfxTextRun;
 class nsIURI;
@@ -320,8 +319,10 @@ public:
      * Ownership of the returned gfxFontEntry is passed to the caller,
      * who must either AddRef() or delete.
      */
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName)
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic)
     { return nullptr; }
 
     /**
@@ -332,8 +333,11 @@ public:
      * Ownership of the returned gfxFontEntry is passed to the caller,
      * who must either AddRef() or delete.
      */
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength);
 
     /**
diff --git a/gfx/thebes/gfxPlatformFontList.h b/gfx/thebes/gfxPlatformFontList.h
index 50b48ac98b2..5a5cda7331a 100644
--- a/gfx/thebes/gfxPlatformFontList.h
+++ b/gfx/thebes/gfxPlatformFontList.h
@@ -149,13 +149,18 @@ public:
     virtual gfxFontFamily* GetDefaultFont(const gfxFontStyle* aStyle) = 0;
 
     // look up a font by name on the host platform
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName) = 0;
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic) = 0;
 
     // create a new platform font from downloaded data (@font-face)
     // this method is responsible to ensure aFontData is NS_Free()'d
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength) = 0;
 
     // get the standard family name on the platform for a given font name
diff --git a/gfx/thebes/gfxPlatformGtk.cpp b/gfx/thebes/gfxPlatformGtk.cpp
index d984036eb3a..f1c9182bea2 100644
--- a/gfx/thebes/gfxPlatformGtk.cpp
+++ b/gfx/thebes/gfxPlatformGtk.cpp
@@ -164,18 +164,26 @@ gfxPlatformGtk::CreateFontGroup(const FontFamilyList& aFontFamilyList,
 }
 
 gfxFontEntry*
-gfxPlatformGtk::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                const nsAString& aFontName)
+gfxPlatformGtk::LookupLocalFont(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                bool aItalic)
 {
-    return gfxPangoFontGroup::NewFontEntry(*aProxyEntry, aFontName);
+    return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
+                                           aStretch, aItalic);
 }
 
 gfxFontEntry* 
-gfxPlatformGtk::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry, 
-                                 const uint8_t *aFontData, uint32_t aLength)
+gfxPlatformGtk::MakePlatformFont(const nsAString& aFontName,
+                                 uint16_t aWeight,
+                                 int16_t aStretch,
+                                 bool aItalic,
+                                 const uint8_t* aFontData,
+                                 uint32_t aLength)
 {
     // passing ownership of the font data to the new font entry
-    return gfxPangoFontGroup::NewFontEntry(*aProxyEntry,
+    return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
+                                           aStretch, aItalic,
                                            aFontData, aLength);
 }
 
diff --git a/gfx/thebes/gfxPlatformGtk.h b/gfx/thebes/gfxPlatformGtk.h
index cc076d28e5b..71dbdfa8329 100644
--- a/gfx/thebes/gfxPlatformGtk.h
+++ b/gfx/thebes/gfxPlatformGtk.h
@@ -51,15 +51,20 @@ public:
      * Look up a local platform font using the full font face name (needed to
      * support @font-face src local() )
      */
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
 
     /**
      * Activate a platform font (needed to support @font-face src url() )
      *
      */
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength);
 
     /**
diff --git a/gfx/thebes/gfxPlatformMac.cpp b/gfx/thebes/gfxPlatformMac.cpp
index 52241c046ec..6c09958454d 100644
--- a/gfx/thebes/gfxPlatformMac.cpp
+++ b/gfx/thebes/gfxPlatformMac.cpp
@@ -129,21 +129,32 @@ gfxPlatformMac::CreateFontGroup(const FontFamilyList& aFontFamilyList,
 
 // these will move to gfxPlatform once all platforms support the fontlist
 gfxFontEntry* 
-gfxPlatformMac::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                const nsAString& aFontName)
+gfxPlatformMac::LookupLocalFont(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                bool aItalic)
 {
-    return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aProxyEntry, 
-                                                                    aFontName);
+    return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aFontName,
+                                                                    aWeight,
+                                                                    aStretch,
+                                                                    aItalic);
 }
 
 gfxFontEntry* 
-gfxPlatformMac::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                 const uint8_t *aFontData, uint32_t aLength)
+gfxPlatformMac::MakePlatformFont(const nsAString& aFontName,
+                                 uint16_t aWeight,
+                                 int16_t aStretch,
+                                 bool aItalic,
+                                 const uint8_t* aFontData,
+                                 uint32_t aLength)
 {
     // Ownership of aFontData is received here, and passed on to
     // gfxPlatformFontList::MakePlatformFont(), which must ensure the data
     // is released with NS_Free when no longer needed
-    return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aProxyEntry,
+    return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aFontName,
+                                                                     aWeight,
+                                                                     aStretch,
+                                                                     aItalic,
                                                                      aFontData,
                                                                      aLength);
 }
diff --git a/gfx/thebes/gfxPlatformMac.h b/gfx/thebes/gfxPlatformMac.h
index dafb1da6c0e..bf1344a7948 100644
--- a/gfx/thebes/gfxPlatformMac.h
+++ b/gfx/thebes/gfxPlatformMac.h
@@ -39,13 +39,18 @@ public:
                     const gfxFontStyle *aStyle,
                     gfxUserFontSet *aUserFontSet);
 
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
 
     virtual gfxPlatformFontList* CreatePlatformFontList();
 
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength);
 
     bool IsFontFormatSupported(nsIURI *aFontURI, uint32_t aFormatFlags);
diff --git a/gfx/thebes/gfxPrefs.h b/gfx/thebes/gfxPrefs.h
index 9f1ec41affc..1c158e32fc2 100644
--- a/gfx/thebes/gfxPrefs.h
+++ b/gfx/thebes/gfxPrefs.h
@@ -8,6 +8,7 @@
 
 #include <stdint.h>
 #include "mozilla/Assertions.h"
+#include "mozilla/Constants.h"   // for M_PI
 #include "mozilla/TypedEnum.h"
 
 // First time gfxPrefs::GetSingleton() needs to be called on the main thread,
@@ -132,7 +133,11 @@ private:
   DECL_GFX_PREF(Live, "apz.allow_checkerboarding",             APZAllowCheckerboarding, bool, true);
   DECL_GFX_PREF(Live, "apz.asyncscroll.throttle",              APZAsyncScrollThrottleTime, int32_t, 100);
   DECL_GFX_PREF(Live, "apz.asyncscroll.timeout",               APZAsyncScrollTimeout, int32_t, 300);
-  DECL_GFX_PREF(Live, "apz.axis_lock_mode",                    APZAxisLockMode, int32_t, 0);
+  DECL_GFX_PREF(Live, "apz.axis_lock.mode",                    APZAxisLockMode, int32_t, 0);
+  DECL_GFX_PREF(Live, "apz.axis_lock.lock_angle",              APZAxisLockAngle, float, float(M_PI / 6.0) /* 30 degrees */);
+  DECL_GFX_PREF(Live, "apz.axis_lock.breakout_threshold",      APZAxisBreakoutThreshold, float, 1.0f / 32.0f);
+  DECL_GFX_PREF(Live, "apz.axis_lock.breakout_angle",          APZAxisBreakoutAngle, float, float(M_PI / 8.0) /* 22.5 degrees */);
+  DECL_GFX_PREF(Live, "apz.axis_lock.direct_pan_angle",        APZAllowedDirectPanAngle, float, float(M_PI / 3.0) /* 60 degrees */);
   DECL_GFX_PREF(Live, "apz.content_response_timeout",          APZContentResponseTimeout, int32_t, 300);
   DECL_GFX_PREF(Live, "apz.cross_slide.enabled",               APZCrossSlideEnabled, bool, false);
   DECL_GFX_PREF(Live, "apz.danger_zone_x",                     APZDangerZoneX, int32_t, 50);
diff --git a/gfx/thebes/gfxQtPlatform.cpp b/gfx/thebes/gfxQtPlatform.cpp
index b4d0fba836d..bb0edf731e0 100644
--- a/gfx/thebes/gfxQtPlatform.cpp
+++ b/gfx/thebes/gfxQtPlatform.cpp
@@ -131,18 +131,26 @@ gfxQtPlatform::CreateFontGroup(const FontFamilyList& aFontFamilyList,
 }
 
 gfxFontEntry*
-gfxQtPlatform::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                const nsAString& aFontName)
+gfxQtPlatform::LookupLocalFont(const nsAString& aFontName,
+                               uint16_t aWeight,
+                               int16_t aStretch,
+                               bool aItalic)
 {
-    return gfxPangoFontGroup::NewFontEntry(*aProxyEntry, aFontName);
+    return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
+                                           aStretch, aItalic);
 }
 
 gfxFontEntry*
-gfxQtPlatform::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                 const uint8_t *aFontData, uint32_t aLength)
+gfxQtPlatform::MakePlatformFont(const nsAString& aFontName,
+                                uint16_t aWeight,
+                                int16_t aStretch,
+                                bool aItalic,
+                                const uint8_t* aFontData,
+                                uint32_t aLength)
 {
     // passing ownership of the font data to the new font entry
-    return gfxPangoFontGroup::NewFontEntry(*aProxyEntry,
+    return gfxPangoFontGroup::NewFontEntry(aFontName, aWeight,
+                                           aStretch, aItalic,
                                            aFontData, aLength);
 }
 
diff --git a/gfx/thebes/gfxQtPlatform.h b/gfx/thebes/gfxQtPlatform.h
index 9e09c54dd53..29b9216d953 100644
--- a/gfx/thebes/gfxQtPlatform.h
+++ b/gfx/thebes/gfxQtPlatform.h
@@ -49,15 +49,20 @@ public:
      * Look up a local platform font using the full font face name (needed to
      * support @font-face src local() )
      */
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName) MOZ_OVERRIDE;
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic) MOZ_OVERRIDE;
 
     /**
      * Activate a platform font (needed to support @font-face src url() )
      *
      */
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength) MOZ_OVERRIDE;
 
     /**
diff --git a/gfx/thebes/gfxUserFontSet.cpp b/gfx/thebes/gfxUserFontSet.cpp
index 2861081e9f1..4ea1053b5a7 100644
--- a/gfx/thebes/gfxUserFontSet.cpp
+++ b/gfx/thebes/gfxUserFontSet.cpp
@@ -27,10 +27,10 @@
 using namespace mozilla;
 
 #ifdef PR_LOGGING
-PRLogModuleInfo *
+PRLogModuleInfo*
 gfxUserFontSet::GetUserFontsLog()
 {
-    static PRLogModuleInfo *sLog;
+    static PRLogModuleInfo* sLog;
     if (!sLog)
         sLog = PR_NewLogModule("userfonts");
     return sLog;
@@ -65,7 +65,7 @@ public:
         return p;
     }
 
-    bool WriteRaw(const void *data, size_t length) {
+    bool WriteRaw(const void* data, size_t length) {
         if ((mOff + length > mLength) ||
             (mLength > std::numeric_limits<size_t>::max() - mOff)) {
             if (mLength == mLimit) {
@@ -111,21 +111,21 @@ private:
 
 // TODO: support for unicode ranges not yet implemented
 
-gfxProxyFontEntry::gfxProxyFontEntry(gfxUserFontSet *aFontSet,
+gfxUserFontEntry::gfxUserFontEntry(gfxUserFontSet* aFontSet,
              const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
              uint32_t aWeight,
              int32_t aStretch,
              uint32_t aItalicStyle,
              const nsTArray<gfxFontFeature>& aFeatureSettings,
              uint32_t aLanguageOverride,
-             gfxSparseBitSet *aUnicodeRanges)
-    : gfxFontEntry(NS_LITERAL_STRING("Proxy")),
+             gfxSparseBitSet* aUnicodeRanges)
+    : gfxFontEntry(NS_LITERAL_STRING("userfont")),
       mLoadingState(NOT_LOADING),
       mUnsupportedFormat(false),
       mLoader(nullptr),
       mFontSet(aFontSet)
 {
-    mIsProxy = true;
+    mIsUserFontContainer = true;
     mSrcList = aFontFaceSrcList;
     mSrcIndex = 0;
     mWeight = aWeight;
@@ -135,21 +135,20 @@ gfxProxyFontEntry::gfxProxyFontEntry(gfxUserFontSet *aFontSet,
     mItalic = (aItalicStyle & (NS_FONT_STYLE_ITALIC | NS_FONT_STYLE_OBLIQUE)) != 0;
     mFeatureSettings.AppendElements(aFeatureSettings);
     mLanguageOverride = aLanguageOverride;
-    mIsUserFont = true;
 }
 
-gfxProxyFontEntry::~gfxProxyFontEntry()
+gfxUserFontEntry::~gfxUserFontEntry()
 {
 }
 
 bool
-gfxProxyFontEntry::Matches(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
-                           uint32_t aWeight,
-                           int32_t aStretch,
-                           uint32_t aItalicStyle,
-                           const nsTArray<gfxFontFeature>& aFeatureSettings,
-                           uint32_t aLanguageOverride,
-                           gfxSparseBitSet *aUnicodeRanges)
+gfxUserFontEntry::Matches(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
+                          uint32_t aWeight,
+                          int32_t aStretch,
+                          uint32_t aItalicStyle,
+                          const nsTArray<gfxFontFeature>& aFeatureSettings,
+                          uint32_t aLanguageOverride,
+                          gfxSparseBitSet* aUnicodeRanges)
 {
     // XXX font entries don't distinguish italic from oblique (bug 543715)
     bool isItalic =
@@ -166,16 +165,19 @@ gfxProxyFontEntry::Matches(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
 }
 
 gfxFont*
-gfxProxyFontEntry::CreateFontInstance(const gfxFontStyle *aFontStyle, bool aNeedsBold)
+gfxUserFontEntry::CreateFontInstance(const gfxFontStyle* aFontStyle, bool aNeedsBold)
 {
-    // cannot create an actual font for a proxy entry
+    NS_NOTREACHED("should only be creating a gfxFont"
+                  " with an actual platform font entry");
+
+    // userfont entry is a container, can't create font from the container
     return nullptr;
 }
 
 class gfxOTSContext : public ots::OTSContext {
 public:
-    gfxOTSContext(gfxMixedFontFamily *aFamily, gfxProxyFontEntry  *aProxy)
-        : mFamily(aFamily), mProxy(aProxy) {}
+    explicit gfxOTSContext(gfxUserFontEntry* aUserFontEntry)
+        : mUserFontEntry(aUserFontEntry) {}
 
     virtual ots::TableAction GetTableAction(uint32_t aTag) MOZ_OVERRIDE {
         // preserve Graphite, color glyph and SVG tables
@@ -192,7 +194,7 @@ public:
         return ots::TABLE_ACTION_DEFAULT;
     }
 
-    virtual void Message(const char *format, ...) MSGFUNC_FMT_ATTR MOZ_OVERRIDE {
+    virtual void Message(const char* format, ...) MSGFUNC_FMT_ATTR MOZ_OVERRIDE {
         va_list va;
         va_start(va, format);
 
@@ -203,28 +205,26 @@ public:
 
         va_end(va);
 
-        mProxy->mFontSet->LogMessage(mFamily, mProxy, buf);
+        mUserFontEntry->mFontSet->LogMessage(mUserFontEntry, buf);
     }
 
 private:
-    gfxMixedFontFamily *mFamily;
-    gfxProxyFontEntry  *mProxy;
+    gfxUserFontEntry* mUserFontEntry;
 };
 
 // Call the OTS library to sanitize an sfnt before attempting to use it.
 // Returns a newly-allocated block, or nullptr in case of fatal errors.
 const uint8_t*
-gfxProxyFontEntry::SanitizeOpenTypeData(gfxMixedFontFamily *aFamily,
-                                        const uint8_t* aData,
-                                        uint32_t       aLength,
-                                        uint32_t&      aSaneLength,
-                                        bool           aIsCompressed)
+gfxUserFontEntry::SanitizeOpenTypeData(const uint8_t* aData,
+                                       uint32_t       aLength,
+                                       uint32_t&      aSaneLength,
+                                       bool           aIsCompressed)
 {
     // limit output/expansion to 256MB
     ExpandingMemoryStream output(aIsCompressed ? aLength * 2 : aLength,
                                  1024 * 1024 * 256);
 
-    gfxOTSContext otsContext(aFamily, this);
+    gfxOTSContext otsContext(this);
 
     if (otsContext.Process(&output, aData, aLength)) {
         aSaneLength = output.Tell();
@@ -236,11 +236,11 @@ gfxProxyFontEntry::SanitizeOpenTypeData(gfxMixedFontFamily *aFamily,
 }
 
 void
-gfxProxyFontEntry::StoreUserFontData(gfxFontEntry* aFontEntry,
-                                     bool aPrivate,
-                                     const nsAString& aOriginalName,
-                                     FallibleTArray<uint8_t>* aMetadata,
-                                     uint32_t aMetaOrigLen)
+gfxUserFontEntry::StoreUserFontData(gfxFontEntry* aFontEntry,
+                                    bool aPrivate,
+                                    const nsAString& aOriginalName,
+                                    FallibleTArray<uint8_t>* aMetadata,
+                                    uint32_t aMetaOrigLen)
 {
     if (!aFontEntry->mUserFontData) {
         aFontEntry->mUserFontData = new gfxUserFontData;
@@ -310,9 +310,8 @@ CopyWOFFMetadata(const uint8_t* aFontData,
     *aMetaOrigLen = woff->metaOrigLen;
 }
 
-gfxProxyFontEntry::LoadStatus
-gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
-                            bool& aLocalRulesUsed)
+gfxUserFontEntry::LoadStatus
+gfxUserFontEntry::LoadNext()
 {
     uint32_t numSrc = mSrcList.Length();
 
@@ -337,10 +336,12 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
         // src local ==> lookup and load immediately
 
         if (currSrc.mIsLocal) {
-            gfxFontEntry *fe =
-                gfxPlatform::GetPlatform()->LookupLocalFont(this,
-                                                            currSrc.mLocalName);
-            aLocalRulesUsed = true;
+            gfxFontEntry* fe =
+                gfxPlatform::GetPlatform()->LookupLocalFont(currSrc.mLocalName,
+                                                            mWeight,
+                                                            mStretch,
+                                                            mItalic);
+            mFontSet->SetLocalRulesUsed();
             if (fe) {
                 LOG(("fontset (%p) [src %d] loaded local: (%s) for (%s) gen: %8.8x\n",
                      mFontSet, mSrcIndex,
@@ -354,7 +355,7 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
                 // a private window as there's no issue of caching resources;
                 // local fonts are just available all the time.
                 StoreUserFontData(fe, false, nsString(), nullptr, 0);
-                mFontSet->ReplaceFontEntry(aFamily, this, fe);
+                mPlatformFontEntry = fe;
                 return STATUS_LOADED;
             } else {
                 LOG(("fontset (%p) [src %d] failed local: (%s) for (%s)\n",
@@ -369,7 +370,7 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
             if (gfxPlatform::GetPlatform()->IsFontFormatSupported(currSrc.mURI,
                     currSrc.mFormatFlags)) {
 
-                nsIPrincipal *principal = nullptr;
+                nsIPrincipal* principal = nullptr;
                 bool bypassCache;
                 nsresult rv = mFontSet->CheckFontLoad(&currSrc, &principal,
                                                       &bypassCache);
@@ -377,13 +378,13 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
                 if (NS_SUCCEEDED(rv) && principal != nullptr) {
                     if (!bypassCache) {
                         // see if we have an existing entry for this source
-                        gfxFontEntry *fe = gfxUserFontSet::
+                        gfxFontEntry* fe = gfxUserFontSet::
                             UserFontCache::GetFont(currSrc.mURI,
                                                    principal,
                                                    this,
                                                    mFontSet->GetPrivateBrowsing());
                         if (fe) {
-                            mFontSet->ReplaceFontEntry(aFamily, this, fe);
+                            mPlatformFontEntry = fe;
                             return STATUS_LOADED;
                         }
                     }
@@ -399,7 +400,7 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
                            &loadDoesntSpin);
 
                     if (NS_SUCCEEDED(rv) && loadDoesntSpin) {
-                        uint8_t *buffer = nullptr;
+                        uint8_t* buffer = nullptr;
                         uint32_t bufferLength = 0;
 
                         // sync load font immediately
@@ -407,10 +408,10 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
                                                         bufferLength);
 
                         if (NS_SUCCEEDED(rv) &&
-                            LoadFont(aFamily, buffer, bufferLength)) {
+                            LoadFont(buffer, bufferLength)) {
                             return STATUS_LOADED;
                         } else {
-                            mFontSet->LogMessage(aFamily, this,
+                            mFontSet->LogMessage(this,
                                                  "font load failed",
                                                  nsIScriptError::errorFlag,
                                                  rv);
@@ -418,7 +419,7 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
 
                     } else {
                         // otherwise load font async
-                        rv = mFontSet->StartLoad(aFamily, this, &currSrc);
+                        rv = mFontSet->StartLoad(this, &currSrc);
                         bool loadOK = NS_SUCCEEDED(rv);
 
                         if (loadOK) {
@@ -433,14 +434,14 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
 #endif
                             return STATUS_LOADING;
                         } else {
-                            mFontSet->LogMessage(aFamily, this,
+                            mFontSet->LogMessage(this,
                                                  "download failed",
                                                  nsIScriptError::errorFlag,
                                                  rv);
                         }
                     }
                 } else {
-                    mFontSet->LogMessage(aFamily, this, "download not allowed",
+                    mFontSet->LogMessage(this, "download not allowed",
                                          nsIScriptError::errorFlag, rv);
                 }
             } else {
@@ -454,7 +455,7 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
     }
 
     if (mUnsupportedFormat) {
-        mFontSet->LogMessage(aFamily, this, "no supported format found",
+        mFontSet->LogMessage(this, "no supported format found",
                              nsIScriptError::warningFlag);
     }
 
@@ -466,11 +467,10 @@ gfxProxyFontEntry::LoadNext(gfxMixedFontFamily *aFamily,
     return STATUS_END_OF_LIST;
 }
 
-gfxFontEntry*
-gfxProxyFontEntry::LoadFont(gfxMixedFontFamily *aFamily,
-                            const uint8_t *aFontData, uint32_t &aLength)
+bool
+gfxUserFontEntry::LoadFont(const uint8_t* aFontData, uint32_t &aLength)
 {
-    gfxFontEntry *fe = nullptr;
+    gfxFontEntry* fe = nullptr;
 
     gfxUserFontType fontType =
         gfxFontUtils::DetermineFontDataType(aFontData, aLength);
@@ -487,10 +487,10 @@ gfxProxyFontEntry::LoadFont(gfxMixedFontFamily *aFamily,
     // if necessary. The original data in aFontData is left unchanged.
     uint32_t saneLen;
     const uint8_t* saneData =
-        SanitizeOpenTypeData(aFamily, aFontData, aLength, saneLen,
+        SanitizeOpenTypeData(aFontData, aLength, saneLen,
                              fontType == GFX_USERFONT_WOFF);
     if (!saneData) {
-        mFontSet->LogMessage(aFamily, this, "rejected by sanitizer");
+        mFontSet->LogMessage(this, "rejected by sanitizer");
     }
     if (saneData) {
         // The sanitizer ensures that we have a valid sfnt and a usable
@@ -501,11 +501,15 @@ gfxProxyFontEntry::LoadFont(gfxMixedFontFamily *aFamily,
                                           originalFullName);
         // Here ownership of saneData is passed to the platform,
         // which will delete it when no longer required
-        fe = gfxPlatform::GetPlatform()->MakePlatformFont(this,
+
+        fe = gfxPlatform::GetPlatform()->MakePlatformFont(mName,
+                                                          mWeight,
+                                                          mStretch,
+                                                          mItalic,
                                                           saneData,
                                                           saneLen);
         if (!fe) {
-            mFontSet->LogMessage(aFamily, this, "not usable by platform");
+            mFontSet->LogMessage(this, "not usable by platform");
         }
     }
 
@@ -519,7 +523,7 @@ gfxProxyFontEntry::LoadFont(gfxMixedFontFamily *aFamily,
             CopyWOFFMetadata(aFontData, aLength, &metadata, &metaOrigLen);
         }
 
-        // copy OpenType feature/language settings from the proxy to the
+        // copy OpenType feature/language settings from the userfont entry to the
         // newly-created font entry
         fe->mFeatureSettings.AppendElements(mFeatureSettings);
         fe->mLanguageOverride = mLanguageOverride;
@@ -536,7 +540,7 @@ gfxProxyFontEntry::LoadFont(gfxMixedFontFamily *aFamily,
                  uint32_t(mFontSet->mGeneration)));
         }
 #endif
-        mFontSet->ReplaceFontEntry(aFamily, this, fe);
+        mPlatformFontEntry = fe;
         gfxUserFontSet::UserFontCache::CacheFont(fe);
     } else {
 #ifdef PR_LOGGING
@@ -555,14 +559,57 @@ gfxProxyFontEntry::LoadFont(gfxMixedFontFamily *aFamily,
     // sanitized copy
     NS_Free((void*)aFontData);
 
-    return fe;
+    return fe != nullptr;
+}
+
+// This is called when a font download finishes.
+// Ownership of aFontData passes in here, and the font set must
+// ensure that it is eventually deleted via NS_Free().
+bool
+gfxUserFontEntry::OnLoadComplete(const uint8_t* aFontData, uint32_t aLength,
+                                 nsresult aDownloadStatus)
+{
+    // forget about the loader, as we no longer potentially need to cancel it
+    // if the entry is obsoleted
+    mLoader = nullptr;
+
+    // download successful, make platform font using font data
+    if (NS_SUCCEEDED(aDownloadStatus)) {
+        bool loaded = LoadFont(aFontData, aLength);
+        aFontData = nullptr;
+
+        if (loaded) {
+            mFontSet->IncrementGeneration();
+            return true;
+        }
+
+    } else {
+        // download failed
+        mFontSet->LogMessage(this,
+                             "download failed", nsIScriptError::errorFlag,
+                             aDownloadStatus);
+    }
+
+    if (aFontData) {
+        moz_free((void*)aFontData);
+    }
+
+    // error occurred, load next src
+    LoadNext();
+
+    // We ignore the status returned by LoadNext();
+    // even if loading failed, we need to bump the font-set generation
+    // and return true in order to trigger reflow, so that fallback
+    // will be used where the text was "masked" by the pending download
+    mFontSet->IncrementGeneration();
+    return true;
 }
 
 gfxUserFontSet::gfxUserFontSet()
     : mFontFamilies(4), mLocalRulesUsed(false)
 {
     IncrementGeneration();
-    gfxPlatformFontList *fp = gfxPlatformFontList::PlatformFontList();
+    gfxPlatformFontList* fp = gfxPlatformFontList::PlatformFontList();
     if (fp) {
         fp->AddUserFontSet(this);
     }
@@ -570,13 +617,13 @@ gfxUserFontSet::gfxUserFontSet()
 
 gfxUserFontSet::~gfxUserFontSet()
 {
-    gfxPlatformFontList *fp = gfxPlatformFontList::PlatformFontList();
+    gfxPlatformFontList* fp = gfxPlatformFontList::PlatformFontList();
     if (fp) {
         fp->RemoveUserFontSet(this);
     }
 }
 
-already_AddRefed<gfxProxyFontEntry>
+already_AddRefed<gfxUserFontEntry>
 gfxUserFontSet::FindOrCreateFontFace(
                                const nsAString& aFamilyName,
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
@@ -587,19 +634,20 @@ gfxUserFontSet::FindOrCreateFontFace(
                                uint32_t aLanguageOverride,
                                gfxSparseBitSet* aUnicodeRanges)
 {
-    nsRefPtr<gfxProxyFontEntry> entry;
+    nsRefPtr<gfxUserFontEntry> entry;
 
-    // If there's already a proxy in the family whose descriptors all match,
+    // If there's already a userfont entry in the family whose descriptors all match,
     // we can just move it to the end of the list instead of adding a new
     // face that will always "shadow" the old one.
-    // Note that we can't do this for "real" (non-proxy) entries, even if the
+    // Note that we can't do this for platform font entries, even if the
     // style descriptors match, as they might have had a different source list,
     // but we no longer have the old source list available to check.
-    gfxMixedFontFamily* family = LookupFamily(aFamilyName);
+    gfxUserFontFamily* family = LookupFamily(aFamilyName);
     if (family) {
-        entry = FindExistingProxyEntry(family, aFontFaceSrcList, aWeight,
-                                       aStretch, aItalicStyle, aFeatureSettings,
-                                       aLanguageOverride, aUnicodeRanges);
+        entry = FindExistingUserFontEntry(family, aFontFaceSrcList, aWeight,
+                                          aStretch, aItalicStyle,
+                                          aFeatureSettings, aLanguageOverride,
+                                          aUnicodeRanges);
     }
 
     if (!entry) {
@@ -623,7 +671,7 @@ gfxUserFontSet::FindOrCreateFontFace(
     return entry.forget();
 }
 
-already_AddRefed<gfxProxyFontEntry>
+already_AddRefed<gfxUserFontEntry>
 gfxUserFontSet::CreateFontFace(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
                                int32_t aStretch,
@@ -635,16 +683,16 @@ gfxUserFontSet::CreateFontFace(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
     MOZ_ASSERT(aWeight != 0,
                "aWeight must not be 0; use NS_FONT_WEIGHT_NORMAL instead");
 
-    nsRefPtr<gfxProxyFontEntry> proxyEntry =
-        new gfxProxyFontEntry(this, aFontFaceSrcList, aWeight,
+    nsRefPtr<gfxUserFontEntry> userFontEntry =
+        new gfxUserFontEntry(this, aFontFaceSrcList, aWeight,
                               aStretch, aItalicStyle, aFeatureSettings,
                               aLanguageOverride, aUnicodeRanges);
-    return proxyEntry.forget();
+    return userFontEntry.forget();
 }
 
-gfxProxyFontEntry*
-gfxUserFontSet::FindExistingProxyEntry(
-                               gfxMixedFontFamily* aFamily,
+gfxUserFontEntry*
+gfxUserFontSet::FindExistingUserFontEntry(
+                               gfxUserFontFamily* aFamily,
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
                                int32_t aStretch,
@@ -659,20 +707,20 @@ gfxUserFontSet::FindExistingProxyEntry(
     nsTArray<nsRefPtr<gfxFontEntry>>& fontList = aFamily->GetFontList();
 
     for (size_t i = 0, count = fontList.Length(); i < count; i++) {
-        if (!fontList[i]->mIsProxy) {
+        if (!fontList[i]->mIsUserFontContainer) {
             continue;
         }
 
-        gfxProxyFontEntry* existingProxyEntry =
-            static_cast<gfxProxyFontEntry*>(fontList[i].get());
-        if (!existingProxyEntry->Matches(aFontFaceSrcList,
-                                         aWeight, aStretch, aItalicStyle,
-                                         aFeatureSettings, aLanguageOverride,
-                                         aUnicodeRanges)) {
+        gfxUserFontEntry* existingUserFontEntry =
+            static_cast<gfxUserFontEntry*>(fontList[i].get());
+        if (!existingUserFontEntry->Matches(aFontFaceSrcList,
+                                            aWeight, aStretch, aItalicStyle,
+                                            aFeatureSettings, aLanguageOverride,
+                                            aUnicodeRanges)) {
             continue;
         }
 
-        return existingProxyEntry;
+        return existingUserFontEntry;
     }
 
     return nullptr;
@@ -680,111 +728,72 @@ gfxUserFontSet::FindExistingProxyEntry(
 
 void
 gfxUserFontSet::AddFontFace(const nsAString& aFamilyName,
-                            gfxFontEntry     *aFontEntry)
+                            gfxUserFontEntry* aUserFontEntry)
 {
-    gfxMixedFontFamily* family = GetFamily(aFamilyName);
-    family->AddFontEntry(aFontEntry);
+    gfxUserFontFamily* family = GetFamily(aFamilyName);
+    family->AddFontEntry(aUserFontEntry);
 
 #ifdef PR_LOGGING
     if (LOG_ENABLED()) {
         LOG(("userfonts (%p) added \"%s\" (%p)",
-             this, NS_ConvertUTF16toUTF8(aFamilyName).get(), aFontEntry));
+             this, NS_ConvertUTF16toUTF8(aFamilyName).get(), aUserFontEntry));
     }
 #endif
 }
 
-gfxFontEntry*
-gfxUserFontSet::FindFontEntry(gfxFontFamily *aFamily,
-                              const gfxFontStyle& aFontStyle,
-                              bool& aNeedsBold,
-                              bool& aWaitForUserFont)
+gfxUserFontEntry*
+gfxUserFontSet::FindUserFontEntry(gfxFontFamily* aFamily,
+                                  const gfxFontStyle& aFontStyle,
+                                  bool& aNeedsBold,
+                                  bool& aWaitForUserFont)
 {
     aWaitForUserFont = false;
-    gfxMixedFontFamily *family = static_cast<gfxMixedFontFamily*>(aFamily);
+    gfxUserFontFamily* family = static_cast<gfxUserFontFamily*>(aFamily);
 
     gfxFontEntry* fe = family->FindFontForStyle(aFontStyle, aNeedsBold);
 
-    // if not a proxy, font has already been loaded
-    if (!fe->mIsProxy) {
-        return fe;
+    NS_ASSERTION(!fe || fe->mIsUserFontContainer,
+                 "should only have userfont entries in userfont families");
+
+    // if not a userfont entry, font has already been loaded
+    if (!fe || !fe->mIsUserFontContainer) {
+        return nullptr;
     }
 
-    gfxProxyFontEntry *proxyEntry = static_cast<gfxProxyFontEntry*> (fe);
+    gfxUserFontEntry* userFontEntry = static_cast<gfxUserFontEntry*> (fe);
+
+    if (userFontEntry->GetPlatformFontEntry()) {
+        return userFontEntry;
+    }
 
     // if currently loading, return null for now
-    if (proxyEntry->mLoadingState > gfxProxyFontEntry::NOT_LOADING) {
+    if (userFontEntry->mLoadingState > gfxUserFontEntry::NOT_LOADING) {
         aWaitForUserFont =
-            (proxyEntry->mLoadingState < gfxProxyFontEntry::LOADING_SLOWLY);
+            (userFontEntry->mLoadingState < gfxUserFontEntry::LOADING_SLOWLY);
         return nullptr;
     }
 
     // hasn't been loaded yet, start the load process
-    gfxProxyFontEntry::LoadStatus status;
+    gfxUserFontEntry::LoadStatus status;
 
-    // NOTE that if all sources in the entry fail, this will delete proxyEntry,
+    // NOTE that if all sources in the entry fail, this will delete userFontEntry,
     // so we cannot use it again if status==STATUS_END_OF_LIST
-    status = proxyEntry->LoadNext(family, mLocalRulesUsed);
+    status = userFontEntry->LoadNext();
 
-    // if the load succeeded immediately, the font entry was replaced so
-    // search again
-    if (status == gfxProxyFontEntry::STATUS_LOADED) {
-        return family->FindFontForStyle(aFontStyle, aNeedsBold);
+    // if the load succeeded immediately, return
+    if (status == gfxUserFontEntry::STATUS_LOADED) {
+        return userFontEntry;
     }
 
     // check whether we should wait for load to complete before painting
     // a fallback font -- but not if all sources failed (bug 633500)
-    aWaitForUserFont = (status != gfxProxyFontEntry::STATUS_END_OF_LIST) &&
-        (proxyEntry->mLoadingState < gfxProxyFontEntry::LOADING_SLOWLY);
+    aWaitForUserFont = (status != gfxUserFontEntry::STATUS_END_OF_LIST) &&
+        (userFontEntry->mLoadingState < gfxUserFontEntry::LOADING_SLOWLY);
 
     // if either loading or an error occurred, return null
     return nullptr;
 }
 
-// This is called when a font download finishes.
-// Ownership of aFontData passes in here, and the font set must
-// ensure that it is eventually deleted via NS_Free().
-bool
-gfxUserFontSet::OnLoadComplete(gfxMixedFontFamily *aFamily,
-                               gfxProxyFontEntry *aProxy,
-                               const uint8_t *aFontData, uint32_t aLength,
-                               nsresult aDownloadStatus)
-{
-    // forget about the loader, as we no longer potentially need to cancel it
-    // if the entry is obsoleted
-    aProxy->mLoader = nullptr;
-
-    // download successful, make platform font using font data
-    if (NS_SUCCEEDED(aDownloadStatus)) {
-        gfxFontEntry *fe = aProxy->LoadFont(aFamily, aFontData, aLength);
-        aFontData = nullptr;
-
-        if (fe) {
-            IncrementGeneration();
-            return true;
-        }
-
-    } else {
-        // download failed
-        LogMessage(aFamily, aProxy,
-                   "download failed", nsIScriptError::errorFlag,
-                   aDownloadStatus);
-    }
-
-    if (aFontData) {
-        moz_free((void*)aFontData);
-    }
-
-    // error occurred, load next src
-    (void)aProxy->LoadNext(aFamily, mLocalRulesUsed);
-
-    // We ignore the status returned by LoadNext();
-    // even if loading failed, we need to bump the font-set generation
-    // and return true in order to trigger reflow, so that fallback
-    // will be used where the text was "masked" by the pending download
-    IncrementGeneration();
-    return true;
-}
-
 void
 gfxUserFontSet::IncrementGeneration()
 {
@@ -803,7 +812,7 @@ gfxUserFontSet::RebuildLocalRules()
     }
 }
 
-gfxMixedFontFamily*
+gfxUserFontFamily*
 gfxUserFontSet::LookupFamily(const nsAString& aFamilyName) const
 {
     nsAutoString key(aFamilyName);
@@ -812,47 +821,20 @@ gfxUserFontSet::LookupFamily(const nsAString& aFamilyName) const
     return mFontFamilies.GetWeak(key);
 }
 
-gfxMixedFontFamily*
+gfxUserFontFamily*
 gfxUserFontSet::GetFamily(const nsAString& aFamilyName)
 {
     nsAutoString key(aFamilyName);
     ToLowerCase(key);
 
-    gfxMixedFontFamily* family = mFontFamilies.GetWeak(key);
+    gfxUserFontFamily* family = mFontFamilies.GetWeak(key);
     if (!family) {
-        family = new gfxMixedFontFamily(aFamilyName);
+        family = new gfxUserFontFamily(aFamilyName);
         mFontFamilies.Put(key, family);
     }
     return family;
 }
 
-struct FindFamilyCallbackData {
-    gfxFontEntry  *mFontEntry;
-    gfxFontFamily *mFamily;
-};
-
-static PLDHashOperator
-FindFamilyCallback(const nsAString&    aName,
-                   gfxMixedFontFamily* aFamily,
-                   void*               aUserArg)
-{
-    FindFamilyCallbackData *d = static_cast<FindFamilyCallbackData*>(aUserArg);
-    if (aFamily->ContainsFace(d->mFontEntry)) {
-        d->mFamily = aFamily;
-        return PL_DHASH_STOP;
-    }
-
-    return PL_DHASH_NEXT;
-}
-
-gfxFontFamily*
-gfxUserFontSet::FindFamilyFor(gfxFontEntry* aFontEntry) const
-{
-    FindFamilyCallbackData d = { aFontEntry, nullptr };
-    mFontFamilies.EnumerateRead(FindFamilyCallback, &d);
-    return d.mFamily;
-}
-
 ///////////////////////////////////////////////////////////////////////////////
 // gfxUserFontSet::UserFontCache - re-use platform font entries for user fonts
 // across pages/fontsets rather than instantiating new platform fonts.
@@ -926,7 +908,7 @@ gfxUserFontSet::UserFontCache::Flusher::Observe(nsISupports* aSubject,
 }
 
 static bool
-IgnorePrincipal(nsIURI *aURI)
+IgnorePrincipal(nsIURI* aURI)
 {
     nsresult rv;
     bool inherits = false;
@@ -939,7 +921,7 @@ IgnorePrincipal(nsIURI *aURI)
 bool
 gfxUserFontSet::UserFontCache::Entry::KeyEquals(const KeyTypePointer aKey) const
 {
-    const gfxFontEntry *fe = aKey->mFontEntry;
+    const gfxFontEntry* fe = aKey->mFontEntry;
     // CRC32 checking mode
     if (mLength || aKey->mLength) {
         if (aKey->mLength != mLength ||
@@ -980,7 +962,7 @@ gfxUserFontSet::UserFontCache::Entry::KeyEquals(const KeyTypePointer aKey) const
 }
 
 void
-gfxUserFontSet::UserFontCache::CacheFont(gfxFontEntry *aFontEntry,
+gfxUserFontSet::UserFontCache::CacheFont(gfxFontEntry* aFontEntry,
                                          EntryPersistence aPersistence)
 {
     NS_ASSERTION(aFontEntry->mFamilyName.Length() != 0,
@@ -991,7 +973,7 @@ gfxUserFontSet::UserFontCache::CacheFont(gfxFontEntry *aFontEntry,
         nsCOMPtr<nsIObserverService> obs =
             mozilla::services::GetObserverService();
         if (obs) {
-            Flusher *flusher = new Flusher;
+            Flusher* flusher = new Flusher;
             obs->AddObserver(flusher, "cacheservice:empty-cache",
                              false);
             obs->AddObserver(flusher, "last-pb-context-exited", false);
@@ -999,7 +981,7 @@ gfxUserFontSet::UserFontCache::CacheFont(gfxFontEntry *aFontEntry,
         }
     }
 
-    gfxUserFontData *data = aFontEntry->mUserFontData;
+    gfxUserFontData* data = aFontEntry->mUserFontData;
     if (data->mLength) {
         MOZ_ASSERT(aPersistence == kPersistent);
         MOZ_ASSERT(!data->mPrivate);
@@ -1010,7 +992,7 @@ gfxUserFontSet::UserFontCache::CacheFont(gfxFontEntry *aFontEntry,
         // For data: URIs, the principal is ignored; anyone who has the same
         // data: URI is able to load it and get an equivalent font.
         // Otherwise, the principal is used as part of the cache key.
-        nsIPrincipal *principal;
+        nsIPrincipal* principal;
         if (IgnorePrincipal(data->mURI)) {
             principal = nullptr;
         } else {
@@ -1027,7 +1009,7 @@ gfxUserFontSet::UserFontCache::CacheFont(gfxFontEntry *aFontEntry,
 }
 
 void
-gfxUserFontSet::UserFontCache::ForgetFont(gfxFontEntry *aFontEntry)
+gfxUserFontSet::UserFontCache::ForgetFont(gfxFontEntry* aFontEntry)
 {
     if (!sUserFonts) {
         // if we've already deleted the cache (i.e. during shutdown),
@@ -1048,24 +1030,24 @@ gfxUserFontSet::UserFontCache::ForgetFont(gfxFontEntry *aFontEntry)
 }
 
 gfxFontEntry*
-gfxUserFontSet::UserFontCache::GetFont(nsIURI            *aSrcURI,
-                                       nsIPrincipal      *aPrincipal,
-                                       gfxProxyFontEntry *aProxy,
-                                       bool               aPrivate)
+gfxUserFontSet::UserFontCache::GetFont(nsIURI* aSrcURI,
+                                       nsIPrincipal* aPrincipal,
+                                       gfxUserFontEntry* aUserFontEntry,
+                                       bool aPrivate)
 {
     if (!sUserFonts) {
         return nullptr;
     }
 
     // Ignore principal when looking up a data: URI.
-    nsIPrincipal *principal;
+    nsIPrincipal* principal;
     if (IgnorePrincipal(aSrcURI)) {
         principal = nullptr;
     } else {
         principal = aPrincipal;
     }
 
-    Entry* entry = sUserFonts->GetEntry(Key(aSrcURI, principal, aProxy,
+    Entry* entry = sUserFonts->GetEntry(Key(aSrcURI, principal, aUserFontEntry,
                                             aPrivate));
     if (entry) {
         return entry->GetFontEntry();
@@ -1090,7 +1072,7 @@ gfxUserFontSet::UserFontCache::GetFont(nsIURI            *aSrcURI,
     zipentry->GetCRC32(&crc32);
     zipentry->GetRealSize(&length);
 
-    entry = sUserFonts->GetEntry(Key(crc32, length, aProxy, aPrivate));
+    entry = sUserFonts->GetEntry(Key(crc32, length, aUserFontEntry, aPrivate));
     if (entry) {
         return entry->GetFontEntry();
     }
diff --git a/gfx/thebes/gfxUserFontSet.h b/gfx/thebes/gfxUserFontSet.h
index 47f3387750c..1076fc97c66 100644
--- a/gfx/thebes/gfxUserFontSet.h
+++ b/gfx/thebes/gfxUserFontSet.h
@@ -79,33 +79,26 @@ public:
     bool              mPrivate;   // whether font belongs to a private window
 };
 
-// initially contains a set of proxy font entry objects, replaced with
+// initially contains a set of userfont font entry objects, replaced with
 // platform/user fonts as downloaded
 
-class gfxMixedFontFamily : public gfxFontFamily {
+class gfxUserFontFamily : public gfxFontFamily {
 public:
     friend class gfxUserFontSet;
 
-    explicit gfxMixedFontFamily(const nsAString& aName)
+    explicit gfxUserFontFamily(const nsAString& aName)
         : gfxFontFamily(aName) { }
 
-    virtual ~gfxMixedFontFamily() { }
+    virtual ~gfxUserFontFamily() { }
 
-    // Add the given font entry to the end of the family's list.
-    // Any earlier occurrence is removed, so this has the effect of "advancing"
-    // the entry to the end of the list.
-    void AddFontEntry(gfxFontEntry *aFontEntry) {
-        // We append to mAvailableFonts -before- searching for and removing
-        // any existing reference to avoid the risk that we'll remove the last
-        // reference to the font entry, and thus delete it.
+    // add the given font entry to the end of the family's list
+    void AddFontEntry(gfxFontEntry* aFontEntry) {
+        // keep ref while removing existing entry
+        nsRefPtr<gfxFontEntry> fe = aFontEntry;
+        // remove existing entry, if already present
+        mAvailableFonts.RemoveElement(aFontEntry);
         mAvailableFonts.AppendElement(aFontEntry);
-        uint32_t i = mAvailableFonts.Length() - 1;
-        while (i > 0) {
-            if (mAvailableFonts[--i] == aFontEntry) {
-                mAvailableFonts.RemoveElementAt(i);
-                break;
-            }
-        }
+
         if (aFontEntry->mFamilyName.IsEmpty()) {
             aFontEntry->mFamilyName = Name();
         } else {
@@ -120,46 +113,17 @@ public:
         ResetCharacterMap();
     }
 
-    // Replace aProxyFontEntry in the family's list with aRealFontEntry.
-    void ReplaceFontEntry(gfxFontEntry *aProxyFontEntry,
-                          gfxFontEntry *aRealFontEntry) {
-        uint32_t numFonts = mAvailableFonts.Length();
-        uint32_t i;
-        for (i = 0; i < numFonts; i++) {
-            gfxFontEntry *fe = mAvailableFonts[i];
-            if (fe == aProxyFontEntry) {
-                // Note that this may delete aProxyFontEntry, if there's no
-                // other reference to it except from its family.
-                mAvailableFonts[i] = aRealFontEntry;
-                if (aRealFontEntry->mFamilyName.IsEmpty()) {
-                    aRealFontEntry->mFamilyName = Name();
-                } else {
-#ifdef DEBUG
-                  nsString thisName = Name();
-                  nsString entryName = aRealFontEntry->mFamilyName;
-                  ToLowerCase(thisName);
-                  ToLowerCase(entryName);
-                  MOZ_ASSERT(thisName.Equals(entryName));
-#endif
-                }
-                break;
-            }
-        }
-        NS_ASSERTION(i < numFonts, "font entry not found in family!");
-        ResetCharacterMap();
-    }
-
     // Remove all font entries from the family
     void DetachFontEntries() {
         mAvailableFonts.Clear();
     }
 };
 
-class gfxProxyFontEntry;
+class gfxUserFontEntry;
 class gfxOTSContext;
 
 class gfxUserFontSet {
-    friend class gfxProxyFontEntry;
+    friend class gfxUserFontEntry;
     friend class gfxOTSContext;
 
 public:
@@ -190,7 +154,7 @@ public:
     // italic style = constants in gfxFontConstants.h, e.g. NS_FONT_STYLE_NORMAL
     // language override = result of calling gfxFontStyle::ParseFontLanguageOverride
     // TODO: support for unicode ranges not yet implemented
-    already_AddRefed<gfxProxyFontEntry> CreateFontFace(
+    already_AddRefed<gfxUserFontEntry> CreateFontFace(
                               const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                               uint32_t aWeight,
                               int32_t aStretch,
@@ -201,7 +165,7 @@ public:
 
     // creates a font face for the specified family, or returns an existing
     // matching entry on the family if there is one
-    already_AddRefed<gfxProxyFontEntry> FindOrCreateFontFace(
+    already_AddRefed<gfxUserFontEntry> FindOrCreateFontFace(
                                const nsAString& aFamilyName,
                                const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                uint32_t aWeight,
@@ -211,8 +175,9 @@ public:
                                uint32_t aLanguageOverride,
                                gfxSparseBitSet* aUnicodeRanges);
 
-    // add in a font face for which we have the gfxFontEntry already
-    void AddFontFace(const nsAString& aFamilyName, gfxFontEntry* aFontEntry);
+    // add in a font face for which we have the gfxUserFontEntry already
+    void AddFontFace(const nsAString& aFamilyName,
+                     gfxUserFontEntry* aUserFontEntry);
 
     // Whether there is a face with this family name
     bool HasFamily(const nsAString& aFamilyName) const
@@ -220,53 +185,28 @@ public:
         return LookupFamily(aFamilyName) != nullptr;
     }
 
-    // Look up and return the gfxMixedFontFamily in mFontFamilies with
+    // Look up and return the gfxUserFontFamily in mFontFamilies with
     // the given name
-    gfxMixedFontFamily* LookupFamily(const nsAString& aName) const;
+    gfxUserFontFamily* LookupFamily(const nsAString& aName) const;
 
     // Lookup a font entry for a given style, returns null if not loaded.
     // aFamily must be a family returned by our LookupFamily method.
-    gfxFontEntry *FindFontEntry(gfxFontFamily *aFamily,
-                                const gfxFontStyle& aFontStyle,
-                                bool& aNeedsBold,
-                                bool& aWaitForUserFont);
-
-    // Find a family (possibly one of several!) that owns the given entry.
-    // This may be somewhat expensive, as it enumerates all the fonts in
-    // the set. Currently used only by the Linux (gfxPangoFontGroup) backend,
-    // which does not directly track families in the font group's list.
-    gfxFontFamily *FindFamilyFor(gfxFontEntry *aFontEntry) const;
+    gfxUserFontEntry* FindUserFontEntry(gfxFontFamily* aFamily,
+                                        const gfxFontStyle& aFontStyle,
+                                        bool& aNeedsBold,
+                                        bool& aWaitForUserFont);
 
     // check whether the given source is allowed to be loaded;
     // returns the Principal (for use in the key when caching the loaded font),
     // and whether the load should bypass the cache (force-reload).
-    virtual nsresult CheckFontLoad(const gfxFontFaceSrc *aFontFaceSrc,
-                                   nsIPrincipal **aPrincipal,
-                                   bool *aBypassCache) = 0;
+    virtual nsresult CheckFontLoad(const gfxFontFaceSrc* aFontFaceSrc,
+                                   nsIPrincipal** aPrincipal,
+                                   bool* aBypassCache) = 0;
 
     // initialize the process that loads external font data, which upon 
     // completion will call OnLoadComplete method
-    virtual nsresult StartLoad(gfxMixedFontFamily *aFamily,
-                               gfxProxyFontEntry *aProxy,
-                               const gfxFontFaceSrc *aFontFaceSrc) = 0;
-
-    // when download has been completed, pass back data here
-    // aDownloadStatus == NS_OK ==> download succeeded, error otherwise
-    // returns true if platform font creation sucessful (or local()
-    // reference was next in line)
-    // Ownership of aFontData is passed in here; the font set must
-    // ensure that it is eventually deleted with NS_Free().
-    bool OnLoadComplete(gfxMixedFontFamily *aFamily,
-                        gfxProxyFontEntry *aProxy,
-                        const uint8_t *aFontData, uint32_t aLength,
-                        nsresult aDownloadStatus);
-
-    // Replace a proxy with a real fontEntry; this is implemented in
-    // nsUserFontSet in order to keep track of the entry corresponding
-    // to each @font-face rule.
-    virtual void ReplaceFontEntry(gfxMixedFontFamily *aFamily,
-                                  gfxProxyFontEntry *aProxy,
-                                  gfxFontEntry *aFontEntry) = 0;
+    virtual nsresult StartLoad(gfxUserFontEntry* aUserFontEntry,
+                               const gfxFontFaceSrc* aFontFaceSrc) = 0;
 
     // generation - each time a face is loaded, generation is
     // incremented so that the change can be recognized 
@@ -293,22 +233,22 @@ public:
         // If aPersistence is Persistent, the entry will remain in the cache
         // across cacheservice:empty-cache notifications. This is used for
         // "preloaded hidden fonts" on FxOS.
-        static void CacheFont(gfxFontEntry *aFontEntry,
+        static void CacheFont(gfxFontEntry* aFontEntry,
                               EntryPersistence aPersistence = kDiscardable);
 
         // The given gfxFontEntry is being destroyed, so remove any record that
         // refers to it.
-        static void ForgetFont(gfxFontEntry *aFontEntry);
+        static void ForgetFont(gfxFontEntry* aFontEntry);
 
         // Return the gfxFontEntry corresponding to a given URI and principal,
-        // and the features of the given proxy, or nullptr if none is available.
+        // and the features of the given userfont entry, or nullptr if none is available.
         // The aPrivate flag is set for requests coming from private windows,
         // so we can avoid leaking fonts cached in private windows mode out to
         // normal windows.
-        static gfxFontEntry* GetFont(nsIURI            *aSrcURI,
-                                     nsIPrincipal      *aPrincipal,
-                                     gfxProxyFontEntry *aProxy,
-                                     bool               aPrivate);
+        static gfxFontEntry* GetFont(nsIURI* aSrcURI,
+                                     nsIPrincipal* aPrincipal,
+                                     gfxUserFontEntry* aUserFontEntry,
+                                     bool              aPrivate);
 
         // Clear everything so that we don't leak URIs and Principals.
         static void Shutdown();
@@ -334,12 +274,12 @@ public:
         // Note that key comparison does *not* use the mFontEntry field
         // as a whole; it only compares specific fields within the entry
         // (weight/width/style/features) that could affect font selection
-        // or rendering, and that must match between a font-set's proxy
+        // or rendering, and that must match between a font-set's userfont
         // entry and the corresponding "real" font entry.
         struct Key {
             nsCOMPtr<nsIURI>        mURI;
             nsCOMPtr<nsIPrincipal>  mPrincipal; // use nullptr with data: URLs
-            gfxFontEntry           *mFontEntry;
+            gfxFontEntry*           mFontEntry;
             uint32_t                mCRC32;
             uint32_t                mLength;
             bool                    mPrivate;
@@ -452,7 +392,7 @@ public:
             // The "real" font entry corresponding to this downloaded font.
             // The font entry MUST notify the cache when it is destroyed
             // (by calling Forget()).
-            gfxFontEntry          *mFontEntry;
+            gfxFontEntry*          mFontEntry;
 
             // Whether this font was loaded from a private window.
             bool                   mPrivate;
@@ -461,9 +401,13 @@ public:
             EntryPersistence       mPersistence;
         };
 
-        static nsTHashtable<Entry> *sUserFonts;
+        static nsTHashtable<Entry>* sUserFonts;
     };
 
+    void SetLocalRulesUsed() {
+        mLocalRulesUsed = true;
+    }
+
 protected:
     // Protected destructor, to discourage deletion outside of Release():
     virtual ~gfxUserFontSet();
@@ -472,15 +416,14 @@ protected:
     virtual bool GetPrivateBrowsing() = 0;
 
     // parse data for a data URL
-    virtual nsresult SyncLoadFontData(gfxProxyFontEntry *aFontToLoad,
-                                      const gfxFontFaceSrc *aFontFaceSrc,
+    virtual nsresult SyncLoadFontData(gfxUserFontEntry* aFontToLoad,
+                                      const gfxFontFaceSrc* aFontFaceSrc,
                                       uint8_t* &aBuffer,
                                       uint32_t &aBufferLength) = 0;
 
     // report a problem of some kind (implemented in nsUserFontSet)
-    virtual nsresult LogMessage(gfxMixedFontFamily *aFamily,
-                                gfxProxyFontEntry *aProxy,
-                                const char *aMessage,
+    virtual nsresult LogMessage(gfxUserFontEntry* aUserFontEntry,
+                                const char* aMessage,
                                 uint32_t aFlags = nsIScriptError::errorFlag,
                                 nsresult aStatus = NS_OK) = 0;
 
@@ -488,8 +431,8 @@ protected:
     virtual void DoRebuildUserFontSet() = 0;
 
     // helper method for FindOrCreateFontFace
-    gfxProxyFontEntry* FindExistingProxyEntry(
-                                   gfxMixedFontFamily* aFamily,
+    gfxUserFontEntry* FindExistingUserFontEntry(
+                                   gfxUserFontFamily* aFamily,
                                    const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
                                    uint32_t aWeight,
                                    int32_t aStretch,
@@ -498,12 +441,12 @@ protected:
                                    uint32_t aLanguageOverride,
                                    gfxSparseBitSet* aUnicodeRanges);
 
-    // creates a new gfxMixedFontFamily in mFontFamilies, or returns an existing
+    // creates a new gfxUserFontFamily in mFontFamilies, or returns an existing
     // family if there is one
-    gfxMixedFontFamily* GetFamily(const nsAString& aFamilyName);
+    gfxUserFontFamily* GetFamily(const nsAString& aFamilyName);
 
     // font families defined by @font-face rules
-    nsRefPtrHashtable<nsStringHashKey, gfxMixedFontFamily> mFontFamilies;
+    nsRefPtrHashtable<nsStringHashKey, gfxUserFontFamily> mFontFamilies;
 
     uint64_t        mGeneration;
 
@@ -515,7 +458,7 @@ protected:
 
 // acts a placeholder until the real font is downloaded
 
-class gfxProxyFontEntry : public gfxFontEntry {
+class gfxUserFontEntry : public gfxFontEntry {
     friend class gfxUserFontSet;
     friend class nsUserFontSet;
     friend class nsFontFaceLoader;
@@ -530,16 +473,16 @@ public:
         STATUS_END_OF_LIST
     };
 
-    gfxProxyFontEntry(gfxUserFontSet *aFontSet,
-                      const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
-                      uint32_t aWeight,
-                      int32_t aStretch,
-                      uint32_t aItalicStyle,
-                      const nsTArray<gfxFontFeature>& aFeatureSettings,
-                      uint32_t aLanguageOverride,
-                      gfxSparseBitSet *aUnicodeRanges);
+    gfxUserFontEntry(gfxUserFontSet* aFontSet,
+                     const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
+                     uint32_t aWeight,
+                     int32_t aStretch,
+                     uint32_t aItalicStyle,
+                     const nsTArray<gfxFontFeature>& aFeatureSettings,
+                     uint32_t aLanguageOverride,
+                     gfxSparseBitSet* aUnicodeRanges);
 
-    virtual ~gfxProxyFontEntry();
+    virtual ~gfxUserFontEntry();
 
     // Return whether the entry matches the given list of attributes
     bool Matches(const nsTArray<gfxFontFaceSrc>& aFontFaceSrcList,
@@ -548,29 +491,35 @@ public:
                  uint32_t aItalicStyle,
                  const nsTArray<gfxFontFeature>& aFeatureSettings,
                  uint32_t aLanguageOverride,
-                 gfxSparseBitSet *aUnicodeRanges);
+                 gfxSparseBitSet* aUnicodeRanges);
 
-    virtual gfxFont *CreateFontInstance(const gfxFontStyle *aFontStyle, bool aNeedsBold);
+    virtual gfxFont* CreateFontInstance(const gfxFontStyle* aFontStyle, bool aNeedsBold);
+
+    gfxFontEntry* GetPlatformFontEntry() { return mPlatformFontEntry; }
+
+    // when download has been completed, pass back data here
+    // aDownloadStatus == NS_OK ==> download succeeded, error otherwise
+    // returns true if platform font creation sucessful (or local()
+    // reference was next in line)
+    // Ownership of aFontData is passed in here; the font set must
+    // ensure that it is eventually deleted with NS_Free().
+    bool OnLoadComplete(const uint8_t* aFontData, uint32_t aLength,
+                        nsresult aDownloadStatus);
 
 protected:
-    const uint8_t* SanitizeOpenTypeData(gfxMixedFontFamily *aFamily,
-                                        const uint8_t* aData,
+    const uint8_t* SanitizeOpenTypeData(const uint8_t* aData,
                                         uint32_t aLength,
                                         uint32_t& aSaneLength,
                                         bool aIsCompressed);
 
     // Attempt to load the next resource in the src list.
-    // aLocalRules is set to true if an attempt was made to load a
-    // local() font was loaded, and left as it is otherwise.
-    LoadStatus LoadNext(gfxMixedFontFamily *aFamily,
-                        bool& aLocalRulesUsed);
+    LoadStatus LoadNext();
 
     // helper method for creating a platform font
-    // returns font entry if platform font creation successful
+    // returns true if platform font creation successful
     // Ownership of aFontData is passed in here; the font must
     // ensure that it is eventually deleted with NS_Free().
-    gfxFontEntry* LoadFont(gfxMixedFontFamily *aFamily,
-                           const uint8_t *aFontData, uint32_t &aLength);
+    bool LoadFont(const uint8_t* aFontData, uint32_t &aLength);
 
     // store metadata and src details for current src into aFontEntry
     void StoreUserFontData(gfxFontEntry*      aFontEntry,
@@ -592,10 +541,11 @@ protected:
     LoadingState             mLoadingState;
     bool                     mUnsupportedFormat;
 
+    nsRefPtr<gfxFontEntry>   mPlatformFontEntry;
     nsTArray<gfxFontFaceSrc> mSrcList;
     uint32_t                 mSrcIndex; // index of loading src item
-    nsFontFaceLoader        *mLoader; // current loader for this entry, if any
-    gfxUserFontSet          *mFontSet; // font-set to which the proxy belongs
+    nsFontFaceLoader*        mLoader; // current loader for this entry, if any
+    gfxUserFontSet*          mFontSet; // font-set to which the userfont entry belongs
     nsCOMPtr<nsIPrincipal>   mPrincipal;
 };
 
diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index c83882a3dd8..2c44930c979 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -910,18 +910,29 @@ gfxWindowsPlatform::CreateFontGroup(const FontFamilyList& aFontFamilyList,
 }
 
 gfxFontEntry* 
-gfxWindowsPlatform::LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                    const nsAString& aFontName)
+gfxWindowsPlatform::LookupLocalFont(const nsAString& aFontName,
+                                    uint16_t aWeight,
+                                    int16_t aStretch,
+                                    bool aItalic)
 {
-    return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aProxyEntry, 
-                                                                    aFontName);
+    return gfxPlatformFontList::PlatformFontList()->LookupLocalFont(aFontName,
+                                                                    aWeight,
+                                                                    aStretch,
+                                                                    aItalic);
 }
 
 gfxFontEntry* 
-gfxWindowsPlatform::MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                     const uint8_t *aFontData, uint32_t aLength)
+gfxWindowsPlatform::MakePlatformFont(const nsAString& aFontName,
+                                     uint16_t aWeight,
+                                     int16_t aStretch,
+                                     bool aItalic,
+                                     const uint8_t* aFontData,
+                                     uint32_t aLength)
 {
-    return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aProxyEntry,
+    return gfxPlatformFontList::PlatformFontList()->MakePlatformFont(aFontName,
+                                                                     aWeight,
+                                                                     aStretch,
+                                                                     aItalic,
                                                                      aFontData,
                                                                      aLength);
 }
diff --git a/gfx/thebes/gfxWindowsPlatform.h b/gfx/thebes/gfxWindowsPlatform.h
index 5d24ab6227c..bc3a8e2c360 100644
--- a/gfx/thebes/gfxWindowsPlatform.h
+++ b/gfx/thebes/gfxWindowsPlatform.h
@@ -199,14 +199,19 @@ public:
     /**
      * Look up a local platform font using the full font face name (needed to support @font-face src local() )
      */
-    virtual gfxFontEntry* LookupLocalFont(const gfxProxyFontEntry *aProxyEntry,
-                                          const nsAString& aFontName);
+    virtual gfxFontEntry* LookupLocalFont(const nsAString& aFontName,
+                                          uint16_t aWeight,
+                                          int16_t aStretch,
+                                          bool aItalic);
 
     /**
      * Activate a platform font (needed to support @font-face src url() )
      */
-    virtual gfxFontEntry* MakePlatformFont(const gfxProxyFontEntry *aProxyEntry,
-                                           const uint8_t *aFontData,
+    virtual gfxFontEntry* MakePlatformFont(const nsAString& aFontName,
+                                           uint16_t aWeight,
+                                           int16_t aStretch,
+                                           bool aItalic,
+                                           const uint8_t* aFontData,
                                            uint32_t aLength);
 
     /**
diff --git a/image/src/imgLoader.cpp b/image/src/imgLoader.cpp
index a8fc50dc20d..3ecbafd9b33 100644
--- a/image/src/imgLoader.cpp
+++ b/image/src/imgLoader.cpp
@@ -63,10 +63,13 @@ public:
     nsresult rv;
     ImageSizes chrome;
     ImageSizes content;
+    ImageSizes uncached;
 
     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
       mKnownLoaders[i]->mChromeCache.EnumerateRead(EntryImageSizes, &chrome);
       mKnownLoaders[i]->mCache.EnumerateRead(EntryImageSizes, &content);
+      MutexAutoLock lock(mKnownLoaders[i]->mUncachedImagesMutex);
+      mKnownLoaders[i]->mUncachedImages.EnumerateEntries(EntryUncachedImageSizes, &uncached);
     }
 
     // Note that we only need to anonymize content image URIs.
@@ -103,6 +106,23 @@ public:
                          "images/content/vector/unused/documents", aAnonymize);
     NS_ENSURE_SUCCESS(rv, rv);
 
+    // The uncached images can contain both content and chrome images, so anonymize it.
+    rv = ReportInfoArray(aHandleReport, aData, uncached.mRasterUsedImageInfo,
+                         "images/uncached/raster/used", aAnonymize);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = ReportInfoArray(aHandleReport, aData, uncached.mRasterUnusedImageInfo,
+                         "images/uncached/raster/unused", aAnonymize);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = ReportInfoArray(aHandleReport, aData, uncached.mVectorUsedImageDocInfo,
+                         "images/uncached/vector/used/documents", aAnonymize);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = ReportInfoArray(aHandleReport, aData, uncached.mVectorUnusedImageDocInfo,
+                         "images/uncached/vector/unused/documents", aAnonymize);
+    NS_ENSURE_SUCCESS(rv, rv);
+
     return NS_OK;
   }
 
@@ -299,6 +319,45 @@ private:
     return PL_DHASH_NEXT;
   }
 
+  static PLDHashOperator EntryUncachedImageSizes(nsPtrHashKey<imgRequest>* aEntry,
+                                                 void* aUserArg)
+  {
+    nsRefPtr<imgRequest> req = aEntry->GetKey();
+    Image *image = static_cast<Image*>(req->mImage.get());
+    if (image) {
+      ImageSizes *sizes = static_cast<ImageSizes*>(aUserArg);
+
+      nsRefPtr<ImageURL> imageURL(image->GetURI());
+      nsAutoCString spec;
+      imageURL->GetSpec(spec);
+      ImageInfo<RasterSizes> rasterInfo;
+      rasterInfo.mSizes.mRaw =
+          image->HeapSizeOfSourceWithComputedFallback(ImagesMallocSizeOf);
+      rasterInfo.mSizes.mUncompressedHeap =
+          image->HeapSizeOfDecodedWithComputedFallback(ImagesMallocSizeOf);
+      rasterInfo.mSizes.mUncompressedNonheap = image->NonHeapSizeOfDecoded();
+      rasterInfo.mURI = spec.get();
+      if (req->HasConsumers()) {
+        sizes->mRasterUsedImageInfo.AppendElement(rasterInfo);
+      } else {
+        sizes->mRasterUnusedImageInfo.AppendElement(rasterInfo);
+      }
+
+      ImageInfo<VectorDocSizes> vectorInfo;
+      vectorInfo.mSizes.mSize =
+        image->HeapSizeOfVectorImageDocument(&vectorInfo.mURI);
+      if (!vectorInfo.mURI.IsEmpty()) {
+        if (req->HasConsumers()) {
+          sizes->mVectorUsedImageDocInfo.AppendElement(vectorInfo);
+        } else {
+          sizes->mVectorUnusedImageDocInfo.AppendElement(vectorInfo);
+        }
+      }
+    }
+
+    return PL_DHASH_NEXT;
+  }
+
   static PLDHashOperator EntryUsedUncompressedSize(const nsACString&,
                                                    imgCacheEntry *aEntry,
                                                    void *aUserArg)
@@ -481,6 +540,7 @@ static void NewRequestAndEntry(bool aForcePrincipalCheckForCacheEntry, imgLoader
 {
   nsRefPtr<imgRequest> request = new imgRequest(aLoader);
   nsRefPtr<imgCacheEntry> entry = new imgCacheEntry(aLoader, request, aForcePrincipalCheckForCacheEntry);
+  aLoader->AddToUncachedImages(request);
   request.forget(aRequest);
   entry.forget(aEntry);
 }
@@ -935,7 +995,7 @@ imgLoader::PBSingleton()
 }
 
 imgLoader::imgLoader()
-: mRespectPrivacy(false)
+: mUncachedImagesMutex("imgLoader::UncachedImages"), mRespectPrivacy(false)
 {
   sMemReporter->AddRef();
   sMemReporter->RegisterLoader(this);
@@ -955,10 +1015,25 @@ imgLoader::GetInstance()
   return loader.forget();
 }
 
+static PLDHashOperator ClearLoaderPointer(nsPtrHashKey<imgRequest>* aEntry,
+                                          void *aUserArg)
+{
+  nsRefPtr<imgRequest> req = aEntry->GetKey();
+  req->ClearLoader();
+
+  return PL_DHASH_NEXT;
+}
+
 imgLoader::~imgLoader()
 {
   ClearChromeImageCache();
   ClearImageCache();
+  {
+    // If there are any of our imgRequest's left they are in the uncached
+    // images set, so clear their pointer to us.
+    MutexAutoLock lock(mUncachedImagesMutex);
+    mUncachedImages.EnumerateEntries(ClearLoaderPointer, nullptr);
+  }
   sMemReporter->UnregisterLoader(this);
   sMemReporter->Release();
 }
@@ -1239,6 +1314,7 @@ bool imgLoader::PutIntoCache(nsIURI *key, imgCacheEntry *entry)
 
   nsRefPtr<imgRequest> request = entry->GetRequest();
   request->SetIsInCache(true);
+  RemoveFromUncachedImages(request);
 
   return true;
 }
@@ -1635,6 +1711,7 @@ bool imgLoader::RemoveFromCache(nsCString& spec,
 
     nsRefPtr<imgRequest> request = entry->GetRequest();
     request->SetIsInCache(false);
+    AddToUncachedImages(request);
 
     return true;
   }
@@ -1668,6 +1745,7 @@ bool imgLoader::RemoveFromCache(imgCacheEntry *entry)
 
       entry->SetEvicted(true);
       request->SetIsInCache(false);
+      AddToUncachedImages(request);
 
       return true;
     }
@@ -1721,6 +1799,19 @@ nsresult imgLoader::EvictEntries(imgCacheQueue &aQueueToClear)
   return NS_OK;
 }
 
+void imgLoader::AddToUncachedImages(imgRequest* aRequest)
+{
+  MutexAutoLock lock(mUncachedImagesMutex);
+  mUncachedImages.PutEntry(aRequest);
+}
+
+void imgLoader::RemoveFromUncachedImages(imgRequest* aRequest)
+{
+  MutexAutoLock lock(mUncachedImagesMutex);
+  mUncachedImages.RemoveEntry(aRequest);
+}
+
+
 #define LOAD_FLAGS_CACHE_MASK    (nsIRequest::LOAD_BYPASS_CACHE | \
                                   nsIRequest::LOAD_FROM_CACHE)
 
diff --git a/image/src/imgLoader.h b/image/src/imgLoader.h
index 1b0a58933c9..13074d12280 100644
--- a/image/src/imgLoader.h
+++ b/image/src/imgLoader.h
@@ -8,6 +8,7 @@
 #define imgLoader_h__
 
 #include "mozilla/Attributes.h"
+#include "mozilla/Mutex.h"
 
 #include "imgILoader.h"
 #include "imgICache.h"
@@ -170,11 +171,11 @@ private: // data
 #include <vector>
 
 #define NS_IMGLOADER_CID \
-{ /* 9f6a0d2e-1dd1-11b2-a5b8-951f13c846f7 */         \
-     0x9f6a0d2e,                                     \
-     0x1dd1,                                         \
-     0x11b2,                                         \
-    {0xa5, 0xb8, 0x95, 0x1f, 0x13, 0xc8, 0x46, 0xf7} \
+{ /* c1354898-e3fe-4602-88a7-c4520c21cb4e */         \
+     0xc1354898,                                     \
+     0xe3fe,                                         \
+     0x4602,                                         \
+    {0x88, 0xa7, 0xc4, 0x52, 0x0c, 0x21, 0xcb, 0x4e} \
 }
 
 class imgCacheQueue
@@ -216,6 +217,8 @@ class imgLoader MOZ_FINAL : public imgILoader,
 public:
   typedef mozilla::image::ImageURL ImageURL;
   typedef nsRefPtrHashtable<nsCStringHashKey, imgCacheEntry> imgCacheTable;
+  typedef nsTHashtable<nsPtrHashKey<imgRequest>> imgSet;
+  typedef mozilla::Mutex Mutex;
 
   NS_DECL_ISUPPORTS
   NS_DECL_IMGILOADER
@@ -286,6 +289,9 @@ public:
 
   bool PutIntoCache(nsIURI *key, imgCacheEntry *entry);
 
+  void AddToUncachedImages(imgRequest* aRequest);
+  void RemoveFromUncachedImages(imgRequest* aRequest);
+
   // Returns true if we should prefer evicting cache entry |two| over cache
   // entry |one|.
   // This mixes units in the worst way, but provides reasonable results.
@@ -375,6 +381,16 @@ private: // data
   imgCacheTable mChromeCache;
   imgCacheQueue mChromeCacheQueue;
 
+  // Hash set of every imgRequest for this loader that isn't in mCache or
+  // mChromeCache. The union over all imgLoader's of mCache, mChromeCache, and
+  // mUncachedImages should be every imgRequest that is alive. These are weak
+  // pointers so we rely on the imgRequest destructor to remove itself.
+  imgSet mUncachedImages;
+  // The imgRequest can have refs to them held on non-main thread, so we need
+  // a mutex because we modify the uncached images set from the imgRequest
+  // destructor.
+  Mutex mUncachedImagesMutex;
+
   static double sCacheTimeWeight;
   static uint32_t sCacheMaxSize;
   static imgMemoryReporter* sMemReporter;
diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp
index fc984822cad..7123c695e1f 100644
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -73,6 +73,9 @@ imgRequest::imgRequest(imgLoader* aLoader)
 
 imgRequest::~imgRequest()
 {
+  if (mLoader) {
+    mLoader->RemoveFromUncachedImages(this);
+  }
   if (mURI) {
     nsAutoCString spec;
     mURI->GetSpec(spec);
@@ -126,6 +129,10 @@ nsresult imgRequest::Init(nsIURI *aURI,
   return NS_OK;
 }
 
+void imgRequest::ClearLoader() {
+  mLoader = nullptr;
+}
+
 already_AddRefed<imgStatusTracker>
 imgRequest::GetStatusTracker()
 {
@@ -169,7 +176,9 @@ void imgRequest::AddProxy(imgRequestProxy *proxy)
   nsRefPtr<imgStatusTracker> statusTracker = GetStatusTracker();
   if (statusTracker->ConsumerCount() == 0) {
     NS_ABORT_IF_FALSE(mURI, "Trying to SetHasProxies without key uri.");
-    mLoader->SetHasProxies(mURI);
+    if (mLoader) {
+      mLoader->SetHasProxies(mURI);
+    }
   }
 
   statusTracker->AddConsumer(proxy);
@@ -199,7 +208,9 @@ nsresult imgRequest::RemoveProxy(imgRequestProxy *proxy, nsresult aStatus)
     if (mCacheEntry) {
       NS_ABORT_IF_FALSE(mURI, "Removing last observer without key uri.");
 
-      mLoader->SetHasNoProxies(mURI, mCacheEntry);
+      if (mLoader) {
+        mLoader->SetHasNoProxies(mURI, mCacheEntry);
+      }
     }
 #if defined(PR_LOGGING)
     else {
@@ -375,17 +386,24 @@ void imgRequest::RemoveFromCache()
 {
   LOG_SCOPE(GetImgLog(), "imgRequest::RemoveFromCache");
 
-  if (mIsInCache) {
+  if (mIsInCache && mLoader) {
     // mCacheEntry is nulled out when we have no more observers.
-    if (mCacheEntry)
+    if (mCacheEntry) {
       mLoader->RemoveFromCache(mCacheEntry);
-    else
+    } else {
       mLoader->RemoveFromCache(mURI);
+    }
   }
 
   mCacheEntry = nullptr;
 }
 
+bool imgRequest::HasConsumers()
+{
+  nsRefPtr<imgStatusTracker> statusTracker = GetStatusTracker();
+  return statusTracker && statusTracker->ConsumerCount() > 0;
+}
+
 int32_t imgRequest::Priority() const
 {
   int32_t priority = nsISupportsPriority::PRIORITY_NORMAL;
diff --git a/image/src/imgRequest.h b/image/src/imgRequest.h
index 9d51fd2a7f6..895d6787402 100644
--- a/image/src/imgRequest.h
+++ b/image/src/imgRequest.h
@@ -63,6 +63,8 @@ public:
                 nsIPrincipal* aLoadingPrincipal,
                 int32_t aCORSMode);
 
+  void ClearLoader();
+
   // Callers must call imgRequestProxy::Notify later.
   void AddProxy(imgRequestProxy *proxy);
 
@@ -190,6 +192,8 @@ private:
   bool IsBlockingOnload() const;
   void SetBlockingOnload(bool block) const;
 
+  bool HasConsumers();
+
 public:
   NS_DECL_NSISTREAMLISTENER
   NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
diff --git a/ipc/app/moz.build b/ipc/app/moz.build
index e72c3f26258..1c6e03a3068 100644
--- a/ipc/app/moz.build
+++ b/ipc/app/moz.build
@@ -10,7 +10,6 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'android':
     SOURCES += [
         'MozillaRuntimeMainAndroid.cpp',
     ]
-    FINAL_TARGET = 'dist/bin/lib'
 else:
     SOURCES += [
         'MozillaRuntimeMain.cpp',
diff --git a/ipc/contentproc/plugin-container.cpp b/ipc/contentproc/plugin-container.cpp
index e60373aff21..1e9e7c00a16 100644
--- a/ipc/contentproc/plugin-container.cpp
+++ b/ipc/contentproc/plugin-container.cpp
@@ -26,6 +26,10 @@
 #include "sandbox/win/src/sandbox.h"
 #include "sandbox/win/src/sandbox_factory.h"
 #include "mozilla/sandboxTarget.h"
+
+#if defined(MOZ_CONTENT_SANDBOX)
+#include "mozilla/warnonlysandbox/wosCallbacks.h"
+#endif
 #endif
 
 #ifdef MOZ_WIDGET_GONK
@@ -143,6 +147,10 @@ content_process_main(int argc, char* argv[])
            return 2;
         }
         mozilla::SandboxTarget::Instance()->SetStartSandboxCallback(StartSandboxCallback);
+
+#if defined(MOZ_CONTENT_SANDBOX)
+        mozilla::warnonlysandbox::PrepareForInit();
+#endif
     }
 #endif
 #endif
diff --git a/ipc/glue/GeckoChildProcessHost.cpp b/ipc/glue/GeckoChildProcessHost.cpp
index edde04e88c6..43c8d1bbc9b 100644
--- a/ipc/glue/GeckoChildProcessHost.cpp
+++ b/ipc/glue/GeckoChildProcessHost.cpp
@@ -34,6 +34,11 @@
 #ifdef XP_WIN
 #include "nsIWinTaskbar.h"
 #define NS_TASKBAR_CONTRACTID "@mozilla.org/windows-taskbar;1"
+
+#if defined(MOZ_CONTENT_SANDBOX)
+#include "mozilla/Preferences.h"
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 #endif
 
 #include "nsTArray.h"
@@ -90,6 +95,10 @@ GeckoChildProcessHost::GeckoChildProcessHost(GeckoProcessType aProcessType,
     mMonitor("mozilla.ipc.GeckChildProcessHost.mMonitor"),
     mProcessState(CREATING_CHANNEL),
     mDelegate(nullptr),
+#if defined(MOZ_CONTENT_SANDBOX) && defined(XP_WIN)
+    mEnableContentSandbox(false),
+    mWarnOnlyContentSandbox(false),
+#endif
     mChildProcessHandle(0)
 #if defined(MOZ_WIDGET_COCOA)
   , mChildTask(MACH_PORT_NULL)
@@ -250,6 +259,20 @@ GeckoChildProcessHost::PrepareLaunch()
   if (mProcessType == GeckoProcessType_Plugin) {
     InitWindowsGroupID();
   }
+
+#if defined(MOZ_CONTENT_SANDBOX)
+  // We need to get the pref here as the process is launched off main thread.
+  if (mProcessType == GeckoProcessType_Content) {
+    nsAdoptingString contentSandboxPref =
+      Preferences::GetString("browser.tabs.remote.sandbox");
+    if (contentSandboxPref.EqualsLiteral("on")) {
+      mEnableContentSandbox = true;
+    } else if (contentSandboxPref.EqualsLiteral("warn")) {
+      mEnableContentSandbox = true;
+      mWarnOnlyContentSandbox = true;
+    }
+  }
+#endif
 #endif
 }
 
@@ -760,8 +783,11 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
   switch (mProcessType) {
     case GeckoProcessType_Content:
 #if defined(MOZ_CONTENT_SANDBOX)
+      if (!mEnableContentSandbox) {
+        break;
+      }
       if (!PR_GetEnv("MOZ_DISABLE_CONTENT_SANDBOX")) {
-        mSandboxBroker.SetSecurityLevelForContentProcess();
+        mSandboxBroker.SetSecurityLevelForContentProcess(mWarnOnlyContentSandbox);
         cmdLine.AppendLooseValue(UTF8ToWide("-sandbox"));
         shouldSandboxCurrentProcess = true;
       }
@@ -794,6 +820,7 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
       break;
   };
 
+#ifdef MOZ_SANDBOX
   if (shouldSandboxCurrentProcess) {
     for (auto it = mAllowedFilesRead.begin();
          it != mAllowedFilesRead.end();
@@ -801,6 +828,7 @@ GeckoChildProcessHost::PerformAsyncLaunchInternal(std::vector<std::string>& aExt
       mSandboxBroker.AllowReadFile(it->c_str());
     }
   }
+#endif
 
 #endif // XP_WIN
 
diff --git a/ipc/glue/GeckoChildProcessHost.h b/ipc/glue/GeckoChildProcessHost.h
index 3442320fa43..a62dca93df4 100644
--- a/ipc/glue/GeckoChildProcessHost.h
+++ b/ipc/glue/GeckoChildProcessHost.h
@@ -169,6 +169,11 @@ protected:
 #ifdef MOZ_SANDBOX
   SandboxBroker mSandboxBroker;
   std::vector<std::wstring> mAllowedFilesRead;
+
+#if defined(MOZ_CONTENT_SANDBOX)
+  bool mEnableContentSandbox;
+  bool mWarnOnlyContentSandbox;
+#endif
 #endif
 #endif // XP_WIN
 
diff --git a/ipc/keystore/KeyStore.cpp b/ipc/keystore/KeyStore.cpp
index c5f01d592d2..6cf10686d3e 100644
--- a/ipc/keystore/KeyStore.cpp
+++ b/ipc/keystore/KeyStore.cpp
@@ -400,8 +400,7 @@ KeyStore::ResetHandlerInfo()
 bool
 KeyStore::CheckSize(UnixSocketRawData *aMessage, size_t aExpectSize)
 {
-  return (aMessage->mSize - aMessage->mCurrentWriteOffset >= aExpectSize) ?
-         true : false;
+  return (aMessage->GetSize() >= aExpectSize);
 }
 
 ResponseCode
@@ -417,8 +416,8 @@ KeyStore::ReadCommand(UnixSocketRawData *aMessage)
     return PROTOCOL_ERROR;
   }
 
-  mHandlerInfo.command = aMessage->mData[aMessage->mCurrentWriteOffset];
-  aMessage->mCurrentWriteOffset++;
+  mHandlerInfo.command = *aMessage->GetData();
+  aMessage->Consume(1);
 
   // Find corrsponding command pattern
   const struct ProtocolCommand *command = commands;
@@ -457,9 +456,10 @@ KeyStore::ReadLength(UnixSocketRawData *aMessage)
   }
 
   // Read length of command parameter.
+  // FIXME: Depends on endianess and (sizeof(unsigned short) == 2)
   unsigned short dataLength;
-  memcpy(&dataLength, &aMessage->mData[aMessage->mCurrentWriteOffset], 2);
-  aMessage->mCurrentWriteOffset += 2;
+  memcpy(&dataLength, aMessage->GetData(), 2);
+  aMessage->Consume(2);
   mHandlerInfo.param[mHandlerInfo.paramCount].length = ntohs(dataLength);
 
   mHandlerInfo.state = STATE_READ_PARAM_DATA;
@@ -482,9 +482,9 @@ KeyStore::ReadData(UnixSocketRawData *aMessage)
 
   // Read command parameter.
   memcpy(mHandlerInfo.param[mHandlerInfo.paramCount].data,
-         &aMessage->mData[aMessage->mCurrentWriteOffset],
+         aMessage->GetData(),
          mHandlerInfo.param[mHandlerInfo.paramCount].length);
-  aMessage->mCurrentWriteOffset += mHandlerInfo.param[mHandlerInfo.paramCount].length;
+  aMessage->Consume(mHandlerInfo.param[mHandlerInfo.paramCount].length);
   mHandlerInfo.paramCount++;
 
   if (mHandlerInfo.paramCount == mHandlerInfo.commandPattern->paramNum) {
@@ -528,7 +528,7 @@ KeyStore::ReceiveSocketData(nsAutoPtr<UnixSocketRawData>& aMessage)
 
   // Handle request.
   ResponseCode result = SUCCESS;
-  while (aMessage->mCurrentWriteOffset < aMessage->mSize ||
+  while (aMessage->GetSize() ||
          mHandlerInfo.state == STATE_PROCESSING) {
     switch (mHandlerInfo.state) {
       case STATE_IDLE:
diff --git a/ipc/ril/Ril.cpp b/ipc/ril/Ril.cpp
index ce518a47494..473f160f751 100644
--- a/ipc/ril/Ril.cpp
+++ b/ipc/ril/Ril.cpp
@@ -184,11 +184,13 @@ DispatchRILEvent::RunTask(JSContext *aCx)
 {
     JS::Rooted<JSObject*> obj(aCx, JS::CurrentGlobalOrNull(aCx));
 
-    JS::Rooted<JSObject*> array(aCx, JS_NewUint8Array(aCx, mMessage->mSize));
+    JS::Rooted<JSObject*> array(aCx,
+                                JS_NewUint8Array(aCx, mMessage->GetSize()));
     if (!array) {
         return false;
     }
-    memcpy(JS_GetArrayBufferViewData(array), mMessage->mData, mMessage->mSize);
+    memcpy(JS_GetArrayBufferViewData(array),
+           mMessage->GetData(), mMessage->GetSize());
 
     JS::AutoValueArray<2> args(aCx);
     args[0].setNumber((uint32_t)mClientId);
diff --git a/ipc/unixsocket/SocketBase.cpp b/ipc/unixsocket/SocketBase.cpp
index 9f8bd48d09d..fe8a7018c38 100644
--- a/ipc/unixsocket/SocketBase.cpp
+++ b/ipc/unixsocket/SocketBase.cpp
@@ -7,8 +7,9 @@
  */
 
 #include "SocketBase.h"
+#include <errno.h>
 #include <string.h>
-#include "nsThreadUtils.h"
+#include <unistd.h>
 
 namespace mozilla {
 namespace ipc {
@@ -17,23 +18,81 @@ namespace ipc {
 // UnixSocketRawData
 //
 
-UnixSocketRawData::UnixSocketRawData(size_t aSize)
-: mSize(aSize)
-, mCurrentWriteOffset(0)
-{
-  mData = new uint8_t[mSize];
-}
-
 UnixSocketRawData::UnixSocketRawData(const void* aData, size_t aSize)
 : mSize(aSize)
-, mCurrentWriteOffset(0)
+, mOffset(0)
+, mAvailableSpace(aSize)
 {
   MOZ_ASSERT(aData || !mSize);
 
-  mData = new uint8_t[mSize];
+  mData = new uint8_t[mAvailableSpace];
   memcpy(mData, aData, mSize);
 }
 
+UnixSocketRawData::UnixSocketRawData(size_t aSize)
+: mSize(0)
+, mOffset(0)
+, mAvailableSpace(aSize)
+{
+  mData = new uint8_t[mAvailableSpace];
+}
+
+ssize_t
+UnixSocketRawData::Receive(int aFd)
+{
+  if (!GetTrailingSpace()) {
+    if (!GetLeadingSpace()) {
+      return -1; /* buffer is full */
+    }
+    /* free up space at the end of data buffer */
+    if (GetSize() <= GetLeadingSpace()) {
+      memcpy(mData, GetData(), GetSize());
+    } else {
+      memmove(mData, GetData(), GetSize());
+    }
+    mOffset = 0;
+  }
+
+  ssize_t res =
+    TEMP_FAILURE_RETRY(read(aFd, GetTrailingBytes(), GetTrailingSpace()));
+
+  if (res < 0) {
+    /* I/O error */
+    return -1;
+  } else if (!res) {
+    /* EOF or peer shutdown sending */
+    return 0;
+  }
+
+  mSize += res;
+
+  return res;
+}
+
+ssize_t
+UnixSocketRawData::Send(int aFd)
+{
+  if (!GetSize()) {
+    return 0;
+  }
+
+  ssize_t res = TEMP_FAILURE_RETRY(write(aFd, GetData(), GetSize()));
+
+  if (res < 0) {
+    if (errno == EAGAIN || errno == EWOULDBLOCK) {
+      return 0; /* socket is blocked; try again later */
+    }
+    return -1;
+  } else if (!res) {
+    /* nothing written */
+    return 0;
+  }
+
+  Consume(res);
+
+  return res;
+}
+
 //
 // SocketConsumerBase
 //
@@ -134,7 +193,7 @@ SocketIOBase::~SocketIOBase()
 void
 SocketIOBase::EnqueueData(UnixSocketRawData* aData)
 {
-  if (!aData->mSize) {
+  if (!aData->GetSize()) {
     delete aData; // delete empty data immediately
     return;
   }
diff --git a/ipc/unixsocket/SocketBase.h b/ipc/unixsocket/SocketBase.h
index 23f52748028..5bb41efdbdc 100644
--- a/ipc/unixsocket/SocketBase.h
+++ b/ipc/unixsocket/SocketBase.h
@@ -9,8 +9,6 @@
 #ifndef mozilla_ipc_SocketBase_h
 #define mozilla_ipc_SocketBase_h
 
-#include <errno.h>
-#include <unistd.h>
 #include "base/message_loop.h"
 #include "nsAutoPtr.h"
 #include "nsTArray.h"
@@ -31,22 +29,73 @@ namespace ipc {
 class UnixSocketRawData
 {
 public:
-  // Number of octets in mData.
-  size_t mSize;
-  size_t mCurrentWriteOffset;
-  nsAutoArrayPtr<uint8_t> mData;
+  /* This constructor copies aData of aSize bytes length into the
+   * new instance of |UnixSocketRawData|.
+   */
+  UnixSocketRawData(const void* aData, size_t aSize);
 
-  /**
-   * Constructor for situations where only size is known beforehand
-   * (for example, when being assigned strings)
+  /* This constructor reserves aSize bytes of space. Currently
+   * it's only possible to fill this buffer by calling |Receive|.
    */
   UnixSocketRawData(size_t aSize);
 
   /**
-   * Constructor for situations where size and data is known
-   * beforehand (for example, when being assigned strings)
+   * Receives data from aFd at the end of the buffer. The returned value
+   * is the number of newly received bytes, or 0 if the peer shut down
+   * its connection, or a negative value on errors.
    */
-  UnixSocketRawData(const void* aData, size_t aSize);
+  ssize_t Receive(int aFd);
+
+  /**
+   * Sends data to aFd from the beginning of the buffer. The returned value
+   * is the number of bytes written, or a negative value on error.
+   */
+  ssize_t Send(int aFd);
+
+  const uint8_t* GetData() const
+  {
+    return mData + mOffset;
+  }
+
+  size_t GetSize() const
+  {
+    return mSize;
+  }
+
+  void Consume(size_t aSize)
+  {
+    MOZ_ASSERT(aSize <= mSize);
+
+    mSize -= aSize;
+    mOffset += aSize;
+  }
+
+protected:
+  size_t GetLeadingSpace() const
+  {
+    return mOffset;
+  }
+
+  size_t GetTrailingSpace() const
+  {
+    return mAvailableSpace - (mOffset + mSize);
+  }
+
+  size_t GetAvailableSpace() const
+  {
+    return mAvailableSpace;
+  }
+
+  void* GetTrailingBytes()
+  {
+    return mData + mOffset + mSize;
+  }
+
+private:
+  size_t mSize;
+  size_t mOffset;
+  size_t mAvailableSpace;
+  nsAutoArrayPtr<uint8_t> mData;
 };
 
 enum SocketConnectionStatus {
@@ -311,7 +360,7 @@ private:
 //
 
 /* |SocketIOBase| is a base class for Socket I/O classes that
- * perform operations on the I/O thread. It provides methds
+ * perform operations on the I/O thread. It provides methods
  * for the most common read and write scenarios.
  */
 class SocketIOBase
@@ -323,46 +372,38 @@ public:
   bool HasPendingData() const;
 
   template <typename T>
-  nsresult ReceiveData(int aFd, T* aIO)
+  ssize_t ReceiveData(int aFd, T* aIO)
   {
     MOZ_ASSERT(aFd >= 0);
     MOZ_ASSERT(aIO);
 
-    do {
-      nsAutoPtr<UnixSocketRawData> incoming(
-        new UnixSocketRawData(mMaxReadSize));
+    nsAutoPtr<UnixSocketRawData> incoming(
+      new UnixSocketRawData(mMaxReadSize));
 
-      ssize_t res =
-        TEMP_FAILURE_RETRY(read(aFd, incoming->mData, incoming->mSize));
-
-      if (res < 0) {
-        if (errno == EAGAIN || errno == EWOULDBLOCK) {
-          return NS_OK; /* no more data available */
-        }
-        /* an error occored */
-        nsRefPtr<nsRunnable> r = new SocketIORequestClosingRunnable<T>(aIO);
-        NS_DispatchToMainThread(r);
-        return NS_ERROR_FAILURE;
-      } else if (!res) {
-        /* EOF or peer shut down sending */
-        nsRefPtr<nsRunnable> r = new SocketIORequestClosingRunnable<T>(aIO);
-        NS_DispatchToMainThread(r);
-        return NS_OK;
-      }
+    ssize_t res = incoming->Receive(aFd);
+    if (res < 0) {
+      /* an I/O error occured */
+      nsRefPtr<nsRunnable> r = new SocketIORequestClosingRunnable<T>(aIO);
+      NS_DispatchToMainThread(r);
+      return -1;
+    } else if (!res) {
+      /* EOF or peer shut down sending */
+      nsRefPtr<nsRunnable> r = new SocketIORequestClosingRunnable<T>(aIO);
+      NS_DispatchToMainThread(r);
+      return 0;
+    }
 
 #ifdef MOZ_TASK_TRACER
-      // Make unix socket creation events to be the source events of TaskTracer,
-      // and originate the rest correlation tasks from here.
-      AutoSourceEvent taskTracerEvent(SourceEventType::UNIXSOCKET);
+    // Make unix socket creation events to be the source events of TaskTracer,
+    // and originate the rest correlation tasks from here.
+    AutoSourceEvent taskTracerEvent(SourceEventType::UNIXSOCKET);
 #endif
 
-      incoming->mSize = res;
-      nsRefPtr<nsRunnable> r =
-        new SocketIOReceiveRunnable<T>(aIO, incoming.forget());
-      NS_DispatchToMainThread(r);
-    } while (true);
+    nsRefPtr<nsRunnable> r =
+      new SocketIOReceiveRunnable<T>(aIO, incoming.forget());
+    NS_DispatchToMainThread(r);
 
-    return NS_OK;
+    return res;
   }
 
   template <typename T>
@@ -371,38 +412,24 @@ public:
     MOZ_ASSERT(aFd >= 0);
     MOZ_ASSERT(aIO);
 
-    do {
-      if (!HasPendingData()) {
-        return NS_OK;
-      }
-
+    while (HasPendingData()) {
       UnixSocketRawData* outgoing = mOutgoingQ.ElementAt(0);
-      MOZ_ASSERT(outgoing->mSize);
-
-      const uint8_t* data = outgoing->mData + outgoing->mCurrentWriteOffset;
-      size_t size = outgoing->mSize - outgoing->mCurrentWriteOffset;
-
-      ssize_t res = TEMP_FAILURE_RETRY(write(aFd, data, size));
 
+      ssize_t res = outgoing->Send(aFd);
       if (res < 0) {
-        if (errno == EAGAIN || errno == EWOULDBLOCK) {
-          return NS_OK; /* no more data available */
-        }
-        /* an error occored */
+        /* an I/O error occured */
         nsRefPtr<nsRunnable> r = new SocketIORequestClosingRunnable<T>(aIO);
         NS_DispatchToMainThread(r);
         return NS_ERROR_FAILURE;
-      } else if (!res) {
-        return NS_OK; /* nothing written */
+      } else if (!res && outgoing->GetSize()) {
+        /* I/O is currently blocked; try again later */
+        return NS_OK;
       }
-
-      outgoing->mCurrentWriteOffset += res;
-
-      if (outgoing->mCurrentWriteOffset == outgoing->mSize) {
+      if (!outgoing->GetSize()) {
         mOutgoingQ.RemoveElementAt(0);
         delete outgoing;
       }
-    } while (true);
+    }
 
     return NS_OK;
   }
diff --git a/ipc/unixsocket/UnixSocket.cpp b/ipc/unixsocket/UnixSocket.cpp
index 31ac1b32ff6..38afd5bc30b 100644
--- a/ipc/unixsocket/UnixSocket.cpp
+++ b/ipc/unixsocket/UnixSocket.cpp
@@ -389,10 +389,13 @@ UnixSocketConsumerIO::OnSocketCanReceiveWithoutBlocking()
   MOZ_ASSERT(MessageLoopForIO::current() == GetIOLoop());
   MOZ_ASSERT(GetConnectionStatus() == SOCKET_IS_CONNECTED); // see bug 990984
 
-  nsresult rv = ReceiveData(GetFd(), this);
-  if (NS_FAILED(rv)) {
+  ssize_t res = ReceiveData(GetFd(), this);
+  if (res < 0) {
+    /* I/O error */
     RemoveWatchers(READ_WATCHER|WRITE_WATCHER);
-    return;
+  } else if (!res) {
+    /* EOF or peer shutdown */
+    RemoveWatchers(READ_WATCHER);
   }
 }
 
diff --git a/js/ipc/JavaScriptShared.cpp b/js/ipc/JavaScriptShared.cpp
index 54092cd4fab..e5a18afcd03 100644
--- a/js/ipc/JavaScriptShared.cpp
+++ b/js/ipc/JavaScriptShared.cpp
@@ -593,7 +593,6 @@ JavaScriptShared::Wrap(JSContext *cx, HandleObject aObj, InfallibleTArray<CpowEn
 
     return true;
 }
-
 void JavaScriptShared::fixupAfterMovingGC()
 {
     objects_.sweep();
diff --git a/js/public/Anchor.h b/js/public/Anchor.h
index d9ed3fd7500..dd42ccca148 100644
--- a/js/public/Anchor.h
+++ b/js/public/Anchor.h
@@ -27,12 +27,12 @@ namespace JS {
  * The scanner recognizes only a select set of types: pointers to JSObjects and
  * similar things (JSFunctions, and so on), pointers to JSStrings, and Values.
  * So while the scanner finds all live |JSString| pointers, it does not notice
- * |jschar| pointers.
+ * |char16_t| pointers.
  *
  * So suppose we have:
  *
  *   void f(JSString *str) {
- *     const jschar *ch = JS_GetStringCharsZ(str);
+ *     const char16_t *ch = JS_GetStringCharsZ(str);
  *     ... do stuff with ch, but no uses of str ...;
  *   }
  *
@@ -41,8 +41,8 @@ namespace JS {
  * it anywhere. But because the stack scanner will not notice |ch|, there
  * is no longer any live value in this frame that would keep the string
  * alive. If |str| is the last reference to that |JSString|, and the
- * collector runs while we are using |ch|, the string's array of |jschar|s
- * may be freed out from under us.
+ * collector runs while we are using |ch|, the string's array of |char16_t|
+ * characters may be freed out from under us.
  *
  * Note that there is only an issue when 1) we extract a thing X the scanner
  * doesn't recognize from 2) a thing Y the scanner does recognize, and 3) if Y
@@ -67,7 +67,7 @@ namespace JS {
  *
  *   void f(JSString *str) {
  *     JS::Anchor<JSString *> a_str(str);
- *     const jschar *ch = JS_GetStringCharsZ(str);
+ *     const char16_t *ch = JS_GetStringCharsZ(str);
  *     ... do stuff with ch, but no uses of str ...;
  *   }
  *
diff --git a/js/public/CharacterEncoding.h b/js/public/CharacterEncoding.h
index 45c77761b3f..da880fe5d67 100644
--- a/js/public/CharacterEncoding.h
+++ b/js/public/CharacterEncoding.h
@@ -118,27 +118,27 @@ class UTF8CharsZ : public mozilla::RangedPtr<unsigned char>
  * manually interpreting UTF-16 extension characters embedded in the JS
  * string.
  */
-class TwoByteChars : public mozilla::Range<jschar>
+class TwoByteChars : public mozilla::Range<char16_t>
 {
-    typedef mozilla::Range<jschar> Base;
+    typedef mozilla::Range<char16_t> Base;
 
   public:
     TwoByteChars() : Base() {}
-    TwoByteChars(jschar *aChars, size_t aLength) : Base(aChars, aLength) {}
-    TwoByteChars(const jschar *aChars, size_t aLength) : Base(const_cast<jschar *>(aChars), aLength) {}
+    TwoByteChars(char16_t *aChars, size_t aLength) : Base(aChars, aLength) {}
+    TwoByteChars(const char16_t *aChars, size_t aLength) : Base(const_cast<char16_t *>(aChars), aLength) {}
 };
 
 /*
  * A TwoByteChars, but \0 terminated for compatibility with JSFlatString.
  */
-class TwoByteCharsZ : public mozilla::RangedPtr<jschar>
+class TwoByteCharsZ : public mozilla::RangedPtr<char16_t>
 {
-    typedef mozilla::RangedPtr<jschar> Base;
+    typedef mozilla::RangedPtr<char16_t> Base;
 
   public:
     TwoByteCharsZ() : Base(nullptr, 0) {}
 
-    TwoByteCharsZ(jschar *chars, size_t length)
+    TwoByteCharsZ(char16_t *chars, size_t length)
       : Base(chars, length)
     {
         MOZ_ASSERT(chars[length] == '\0');
@@ -147,25 +147,24 @@ class TwoByteCharsZ : public mozilla::RangedPtr<jschar>
     using Base::operator=;
 };
 
-typedef mozilla::RangedPtr<const jschar> ConstCharPtr;
+typedef mozilla::RangedPtr<const char16_t> ConstCharPtr;
 
 /*
  * Like TwoByteChars, but the chars are const.
  */
-class ConstTwoByteChars : public mozilla::RangedPtr<const jschar>
+class ConstTwoByteChars : public mozilla::RangedPtr<const char16_t>
 {
   public:
     ConstTwoByteChars(const ConstTwoByteChars &s) : ConstCharPtr(s) {}
-    MOZ_IMPLICIT ConstTwoByteChars(const mozilla::RangedPtr<const jschar> &s) : ConstCharPtr(s) {}
-    ConstTwoByteChars(const jschar *s, size_t len) : ConstCharPtr(s, len) {}
-    ConstTwoByteChars(const jschar *pos, const jschar *start, size_t len)
+    MOZ_IMPLICIT ConstTwoByteChars(const mozilla::RangedPtr<const char16_t> &s) : ConstCharPtr(s) {}
+    ConstTwoByteChars(const char16_t *s, size_t len) : ConstCharPtr(s, len) {}
+    ConstTwoByteChars(const char16_t *pos, const char16_t *start, size_t len)
       : ConstCharPtr(pos, start, len)
     {}
 
     using ConstCharPtr::operator=;
 };
 
-
 /*
  * Convert a 2-byte character sequence to "ISO-Latin-1". This works by
  * truncating each 2-byte pair in the sequence to a 1-byte pair. If the source
@@ -178,7 +177,7 @@ class ConstTwoByteChars : public mozilla::RangedPtr<const jschar>
  */
 extern Latin1CharsZ
 LossyTwoByteCharsToNewLatin1CharsZ(js::ThreadSafeContext *cx,
-                                   const mozilla::Range<const jschar> tbchars);
+                                   const mozilla::Range<const char16_t> tbchars);
 
 template <typename CharT>
 extern UTF8CharsZ
@@ -188,7 +187,7 @@ uint32_t
 Utf8ToOneUcs4Char(const uint8_t *utf8Buffer, int utf8Length);
 
 /*
- * Inflate bytes in UTF-8 encoding to jschars.
+ * Inflate bytes in UTF-8 encoding to char16_t.
  * - On error, returns an empty TwoByteCharsZ.
  * - On success, returns a malloc'd TwoByteCharsZ, and updates |outlen| to hold
  *   its length;  the length value excludes the trailing null.
diff --git a/js/public/Class.h b/js/public/Class.h
index e2172598c4f..b55bd1b0754 100644
--- a/js/public/Class.h
+++ b/js/public/Class.h
@@ -152,7 +152,7 @@ typedef void
 
 // Finalizes external strings created by JS_NewExternalString.
 struct JSStringFinalizer {
-    void (*finalize)(const JSStringFinalizer *fin, jschar *chars);
+    void (*finalize)(const JSStringFinalizer *fin, char16_t *chars);
 };
 
 // Check whether v is an instance of obj.  Return false on error or exception,
diff --git a/js/public/DebugAPI.h b/js/public/Debug.h
similarity index 99%
rename from js/public/DebugAPI.h
rename to js/public/Debug.h
index 6cac090fcd6..e824706d6de 100644
--- a/js/public/DebugAPI.h
+++ b/js/public/Debug.h
@@ -6,8 +6,8 @@
 
 // Interfaces by which the embedding can interact with the Debugger API.
 
-#ifndef js_DebugAPI_h
-#define js_DebugAPI_h
+#ifndef js_Debug_h
+#define js_Debug_h
 
 #include "mozilla/Assertions.h"
 #include "mozilla/Attributes.h"
@@ -253,4 +253,4 @@ class BuilderOrigin : public Builder {
 } // namespace JS
 
 
-#endif /* js_DebugAPI_h */
+#endif /* js_Debug_h */
diff --git a/js/public/GCAPI.h b/js/public/GCAPI.h
index 8cdcfe99e38..db9fd8c2ce6 100644
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -250,8 +250,8 @@ struct JS_FRIEND_API(GCDescription) {
     explicit GCDescription(bool isCompartment)
       : isCompartment_(isCompartment) {}
 
-    jschar *formatMessage(JSRuntime *rt) const;
-    jschar *formatJSON(JSRuntime *rt, uint64_t timestamp) const;
+    char16_t *formatMessage(JSRuntime *rt) const;
+    char16_t *formatJSON(JSRuntime *rt, uint64_t timestamp) const;
 };
 
 typedef void
diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index 1e246fcaa2e..a0f77c397fb 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -540,7 +540,6 @@ struct CompartmentStats
     macro(Other,   NotLiveGCThing, compartmentTables) \
     macro(Other,   NotLiveGCThing, crossCompartmentWrappersTable) \
     macro(Other,   NotLiveGCThing, regexpCompartment) \
-    macro(Other,   NotLiveGCThing, debuggeesSet) \
     macro(Other,   NotLiveGCThing, savedStacksSet)
 
     CompartmentStats()
diff --git a/js/public/OldDebugAPI.h b/js/public/OldDebugAPI.h
index 79fdd249a55..dbb4c866e18 100644
--- a/js/public/OldDebugAPI.h
+++ b/js/public/OldDebugAPI.h
@@ -56,48 +56,6 @@ typedef enum JSTrapStatus {
 extern JS_PUBLIC_API(JSString *)
 JS_DecompileScript(JSContext *cx, JS::HandleScript script, const char *name, unsigned indent);
 
-/*
- * Currently, we only support runtime-wide debugging. In the future, we should
- * be able to support compartment-wide debugging.
- */
-extern JS_PUBLIC_API(void)
-JS_SetRuntimeDebugMode(JSRuntime *rt, bool debug);
-
-/*
- * Debug mode is a compartment-wide mode that enables a debugger to attach
- * to and interact with running methodjit-ed frames. In particular, it causes
- * every function to be compiled as if an eval was present (so eval-in-frame)
- * can work, and it ensures that functions can be re-JITed for other debug
- * features. In general, it is not safe to interact with frames that were live
- * before debug mode was enabled. For this reason, it is also not safe to
- * enable debug mode while frames are live.
- */
-
-/* Get current state of debugging mode. */
-extern JS_PUBLIC_API(bool)
-JS_GetDebugMode(JSContext *cx);
-
-/*
- * Turn on/off debugging mode for all compartments. This returns false if any code
- * from any of the runtime's compartments is running or on the stack.
- */
-JS_FRIEND_API(bool)
-JS_SetDebugModeForAllCompartments(JSContext *cx, bool debug);
-
-/*
- * Turn on/off debugging mode for a single compartment. This should only be
- * used when no code from this compartment is running or on the stack in any
- * thread.
- */
-JS_FRIEND_API(bool)
-JS_SetDebugModeForCompartment(JSContext *cx, JSCompartment *comp, bool debug);
-
-/*
- * Turn on/off debugging mode for a context's compartment.
- */
-JS_FRIEND_API(bool)
-JS_SetDebugMode(JSContext *cx, bool debug);
-
 
 /************************************************************************/
 
@@ -117,7 +75,7 @@ JS_GetFunctionScript(JSContext *cx, JS::HandleFunction fun);
 extern JS_PUBLIC_API(const char *)
 JS_GetScriptFilename(JSScript *script);
 
-extern JS_PUBLIC_API(const jschar *)
+extern JS_PUBLIC_API(const char16_t *)
 JS_GetScriptSourceMap(JSContext *cx, JSScript *script);
 
 extern JS_PUBLIC_API(unsigned)
diff --git a/js/public/TypeDecls.h b/js/public/TypeDecls.h
index 3e1e8afc668..acb93f9737b 100644
--- a/js/public/TypeDecls.h
+++ b/js/public/TypeDecls.h
@@ -31,8 +31,6 @@ class JSAddonId;
 
 struct jsid;
 
-typedef char16_t jschar;
-
 namespace JS {
 
 typedef unsigned char Latin1Char;
diff --git a/js/public/UbiNode.h b/js/public/UbiNode.h
index 6c369938b05..b6e606af832 100644
--- a/js/public/UbiNode.h
+++ b/js/public/UbiNode.h
@@ -188,7 +188,7 @@ class Base {
     //
     // This must always return Concrete<T>::concreteTypeName; we use that
     // pointer as a tag for this particular referent type.
-    virtual const jschar *typeName() const = 0;
+    virtual const char16_t *typeName() const = 0;
 
     // Return the size of this node, in bytes. Include any structures that this
     // node owns exclusively that are not exposed as their own ubi::Nodes.
@@ -224,8 +224,8 @@ class Base {
 // include the members described here.
 template<typename Referent>
 struct Concrete {
-    // The specific jschar array returned by Concrete<T>::typeName.
-    static const jschar concreteTypeName[];
+    // The specific char16_t array returned by Concrete<T>::typeName.
+    static const char16_t concreteTypeName[];
 
     // Construct an instance of this concrete class in |storage| referring
     // to |referent|. Implementations typically use a placement 'new'.
@@ -334,7 +334,7 @@ class Node {
     // not all!) JSObjects can be exposed.
     JS::Value exposeToJS() const;
 
-    const jschar *typeName()        const { return base()->typeName(); }
+    const char16_t *typeName()      const { return base()->typeName(); }
     size_t size()                   const { return base()->size(); }
     JS::Zone *zone()                const { return base()->zone(); }
     JSCompartment *compartment()    const { return base()->compartment(); }
@@ -379,7 +379,7 @@ class Edge {
     // (In real life we'll want a better representation for names, to avoid
     // creating tons of strings when the names follow a pattern; and we'll need
     // to think about lifetimes carefully to ensure traversal stays cheap.)
-    const jschar *name;
+    const char16_t *name;
 
     // This edge's referent.
     Node referent;
@@ -432,7 +432,7 @@ class EdgeRange {
 // JS_TraceChildren.
 template<typename Referent>
 class TracerConcrete : public Base {
-    const jschar *typeName() const MOZ_OVERRIDE { return concreteTypeName; }
+    const char16_t *typeName() const MOZ_OVERRIDE { return concreteTypeName; }
     size_t size() const MOZ_OVERRIDE { return 0; } // not implemented yet; bug 1011300
     EdgeRange *edges(JSContext *, bool wantNames) const MOZ_OVERRIDE;
     JS::Zone *zone() const MOZ_OVERRIDE { return get().zone(); }
@@ -443,7 +443,7 @@ class TracerConcrete : public Base {
     Referent &get() const { return *static_cast<Referent *>(ptr); }
 
   public:
-    static const jschar concreteTypeName[];
+    static const char16_t concreteTypeName[];
     static void construct(void *storage, Referent *ptr) { new (storage) TracerConcrete(ptr); }
 };
 
@@ -455,7 +455,7 @@ class TracerConcreteWithCompartment : public TracerConcrete<Referent> {
         return TracerBase::get().compartment();
     }
 
-    TracerConcreteWithCompartment(Referent *ptr) : TracerBase(ptr) { }
+    explicit TracerConcreteWithCompartment(Referent *ptr) : TracerBase(ptr) { }
 
   public:
     static void construct(void *storage, Referent *ptr) {
@@ -476,7 +476,7 @@ template<> struct Concrete<js::types::TypeObject> : TracerConcrete<js::types::Ty
 // The ubi::Node null pointer. Any attempt to operate on a null ubi::Node asserts.
 template<>
 class Concrete<void> : public Base {
-    const jschar *typeName() const MOZ_OVERRIDE;
+    const char16_t *typeName() const MOZ_OVERRIDE;
     size_t size() const MOZ_OVERRIDE;
     EdgeRange *edges(JSContext *cx, bool wantNames) const MOZ_OVERRIDE;
     JS::Zone *zone() const MOZ_OVERRIDE;
@@ -486,7 +486,7 @@ class Concrete<void> : public Base {
 
   public:
     static void construct(void *storage, void *ptr) { new (storage) Concrete(ptr); }
-    static const jschar concreteTypeName[];
+    static const char16_t concreteTypeName[];
 };
 
 
diff --git a/js/src/asmjs/AsmJSLink.cpp b/js/src/asmjs/AsmJSLink.cpp
index 073807faa0f..d86fce7e13c 100644
--- a/js/src/asmjs/AsmJSLink.cpp
+++ b/js/src/asmjs/AsmJSLink.cpp
@@ -755,7 +755,7 @@ HandleDynamicLinkFailure(JSContext *cx, CallArgs args, AsmJSModule &module, Hand
     if (!stableChars.initTwoByte(cx, src))
         return false;
 
-    const jschar *chars = stableChars.twoByteRange().start().get();
+    const char16_t *chars = stableChars.twoByteRange().start().get();
     SourceBufferHolder::Ownership ownership = stableChars.maybeGiveOwnershipToCaller()
                                               ? SourceBufferHolder::GiveOwnership
                                               : SourceBufferHolder::NoOwnership;
diff --git a/js/src/asmjs/AsmJSModule.cpp b/js/src/asmjs/AsmJSModule.cpp
index 81d56f776d7..97e958475d9 100644
--- a/js/src/asmjs/AsmJSModule.cpp
+++ b/js/src/asmjs/AsmJSModule.cpp
@@ -913,7 +913,7 @@ SerializedNameSize(PropertyName *name)
 {
     size_t s = sizeof(uint32_t);
     if (name)
-        s += name->length() * (name->hasLatin1Chars() ? sizeof(Latin1Char) : sizeof(jschar));
+        s += name->length() * (name->hasLatin1Chars() ? sizeof(Latin1Char) : sizeof(char16_t));
     return s;
 }
 
@@ -936,7 +936,7 @@ SerializeName(uint8_t *cursor, PropertyName *name)
         if (name->hasLatin1Chars())
             cursor = WriteBytes(cursor, name->latin1Chars(nogc), length * sizeof(Latin1Char));
         else
-            cursor = WriteBytes(cursor, name->twoByteChars(nogc), length * sizeof(jschar));
+            cursor = WriteBytes(cursor, name->twoByteChars(nogc), length * sizeof(char16_t));
     } else {
         cursor = WriteScalar<uint32_t>(cursor, 0);
     }
@@ -988,7 +988,7 @@ DeserializeName(ExclusiveContext *cx, const uint8_t *cursor, PropertyName **name
     bool latin1 = lengthAndEncoding & 0x1;
     return latin1
            ? DeserializeChars<Latin1Char>(cx, cursor, length, name)
-           : DeserializeChars<jschar>(cx, cursor, length, name);
+           : DeserializeChars<char16_t>(cx, cursor, length, name);
 }
 
 const uint8_t *
@@ -1910,7 +1910,7 @@ class ModuleCharsForStore : ModuleChars
     bool init(AsmJSParser &parser) {
         JS_ASSERT(beginOffset(parser) < endOffset(parser));
 
-        uncompressedSize_ = (endOffset(parser) - beginOffset(parser)) * sizeof(jschar);
+        uncompressedSize_ = (endOffset(parser) - beginOffset(parser)) * sizeof(char16_t);
         size_t maxCompressedSize = LZ4::maxCompressedSize(uncompressedSize_);
         if (maxCompressedSize < uncompressedSize_)
             return false;
@@ -1918,7 +1918,7 @@ class ModuleCharsForStore : ModuleChars
         if (!compressedBuffer_.resize(maxCompressedSize))
             return false;
 
-        const jschar *chars = parser.tokenStream.rawBase() + beginOffset(parser);
+        const char16_t *chars = parser.tokenStream.rawBase() + beginOffset(parser);
         const char *source = reinterpret_cast<const char*>(chars);
         size_t compressedSize = LZ4::compress(source, uncompressedSize_, compressedBuffer_.begin());
         if (!compressedSize || compressedSize > UINT32_MAX)
@@ -1972,7 +1972,7 @@ class ModuleCharsForStore : ModuleChars
 
 class ModuleCharsForLookup : ModuleChars
 {
-    Vector<jschar, 0, SystemAllocPolicy> chars_;
+    Vector<char16_t, 0, SystemAllocPolicy> chars_;
 
   public:
     const uint8_t *deserialize(ExclusiveContext *cx, const uint8_t *cursor) {
@@ -1982,7 +1982,7 @@ class ModuleCharsForLookup : ModuleChars
         uint32_t compressedSize;
         cursor = ReadScalar<uint32_t>(cursor, &compressedSize);
 
-        if (!chars_.resize(uncompressedSize / sizeof(jschar)))
+        if (!chars_.resize(uncompressedSize / sizeof(char16_t)))
             return nullptr;
 
         const char *source = reinterpret_cast<const char*>(cursor);
@@ -2000,8 +2000,8 @@ class ModuleCharsForLookup : ModuleChars
     }
 
     bool match(AsmJSParser &parser) const {
-        const jschar *parseBegin = parser.tokenStream.rawBase() + beginOffset(parser);
-        const jschar *parseLimit = parser.tokenStream.rawLimit();
+        const char16_t *parseBegin = parser.tokenStream.rawBase() + beginOffset(parser);
+        const char16_t *parseLimit = parser.tokenStream.rawLimit();
         JS_ASSERT(parseLimit >= parseBegin);
         if (uint32_t(parseLimit - parseBegin) < chars_.length())
             return false;
@@ -2077,8 +2077,8 @@ js::StoreAsmJSModuleInCache(AsmJSParser &parser,
     if (!open)
         return false;
 
-    const jschar *begin = parser.tokenStream.rawBase() + ModuleChars::beginOffset(parser);
-    const jschar *end = parser.tokenStream.rawBase() + ModuleChars::endOffset(parser);
+    const char16_t *begin = parser.tokenStream.rawBase() + ModuleChars::beginOffset(parser);
+    const char16_t *end = parser.tokenStream.rawBase() + ModuleChars::endOffset(parser);
     bool installed = parser.options().installedFile;
 
     ScopedCacheEntryOpenedForWrite entry(cx, serializedSize);
@@ -2129,8 +2129,8 @@ js::LookupAsmJSModuleInCache(ExclusiveContext *cx,
     if (!open)
         return true;
 
-    const jschar *begin = parser.tokenStream.rawBase() + ModuleChars::beginOffset(parser);
-    const jschar *limit = parser.tokenStream.rawLimit();
+    const char16_t *begin = parser.tokenStream.rawBase() + ModuleChars::beginOffset(parser);
+    const char16_t *limit = parser.tokenStream.rawLimit();
 
     ScopedCacheEntryOpenedForRead entry(cx);
     if (!open(cx->global(), begin, limit, &entry.serializedSize, &entry.memory, &entry.handle))
diff --git a/js/src/builtin/Eval.cpp b/js/src/builtin/Eval.cpp
index 4838d3b7dd4..83ee176e19c 100644
--- a/js/src/builtin/Eval.cpp
+++ b/js/src/builtin/Eval.cpp
@@ -170,7 +170,7 @@ EvalStringMightBeJSON(const mozilla::Range<const CharT> chars)
                  cp < end;
                  cp++)
             {
-                jschar c = *cp;
+                char16_t c = *cp;
                 if (c == 0x2028 || c == 0x2029)
                     return false;
             }
@@ -336,7 +336,7 @@ EvalKernel(JSContext *cx, const CallArgs &args, EvalType evalType, AbstractFrame
         if (!flatChars.initTwoByte(cx, flatStr))
             return false;
 
-        const jschar *chars = flatChars.twoByteRange().start().get();
+        const char16_t *chars = flatChars.twoByteRange().start().get();
         SourceBufferHolder::Ownership ownership = flatChars.maybeGiveOwnershipToCaller()
                                                   ? SourceBufferHolder::GiveOwnership
                                                   : SourceBufferHolder::NoOwnership;
@@ -409,7 +409,7 @@ js::DirectEvalStringFromIon(JSContext *cx,
         if (!flatChars.initTwoByte(cx, flatStr))
             return false;
 
-        const jschar *chars = flatChars.twoByteRange().start().get();
+        const char16_t *chars = flatChars.twoByteRange().start().get();
         SourceBufferHolder::Ownership ownership = flatChars.maybeGiveOwnershipToCaller()
                                                   ? SourceBufferHolder::GiveOwnership
                                                   : SourceBufferHolder::NoOwnership;
diff --git a/js/src/builtin/Intl.cpp b/js/src/builtin/Intl.cpp
index d6ba37fb293..b0af5bc5f5d 100644
--- a/js/src/builtin/Intl.cpp
+++ b/js/src/builtin/Intl.cpp
@@ -546,7 +546,7 @@ class ScopedICUObject
     }
 };
 
-// The inline capacity we use for the jschar Vectors.
+// The inline capacity we use for the char16_t Vectors.
 static const size_t INITIAL_CHAR_BUFFER_SIZE = 32;
 
 /******************** Collator ********************/
@@ -973,12 +973,12 @@ intl_CompareStrings(JSContext *cx, UCollator *coll, HandleString str1, HandleStr
     if (!stableChars2.initTwoByte(cx, str2))
         return false;
 
-    mozilla::Range<const jschar> chars1 = stableChars1.twoByteRange();
-    mozilla::Range<const jschar> chars2 = stableChars2.twoByteRange();
+    mozilla::Range<const char16_t> chars1 = stableChars1.twoByteRange();
+    mozilla::Range<const char16_t> chars2 = stableChars2.twoByteRange();
 
     UCollationResult uresult = ucol_strcoll(coll,
-                                            JSCharToUChar(chars1.start().get()), chars1.length(),
-                                            JSCharToUChar(chars2.start().get()), chars2.length());
+                                            Char16ToUChar(chars1.start().get()), chars1.length(),
+                                            Char16ToUChar(chars2.start().get()), chars2.length());
     int32_t res;
     switch (uresult) {
         case UCOL_LESS: res = -1; break;
@@ -1323,7 +1323,7 @@ NewUNumberFormat(JSContext *cx, HandleObject numberFormat)
         if (!currency->ensureFlat(cx) || !stableChars.initTwoByte(cx, currency))
             return nullptr;
         // uCurrency remains owned by stableChars.
-        uCurrency = JSCharToUChar(stableChars.twoByteRange().start().get());
+        uCurrency = Char16ToUChar(stableChars.twoByteRange().start().get());
         if (!uCurrency)
             return nullptr;
 
@@ -1426,17 +1426,17 @@ intl_FormatNumber(JSContext *cx, UNumberFormat *nf, double x, MutableHandleValue
     if (IsNegativeZero(x))
         x = 0.0;
 
-    Vector<jschar, INITIAL_CHAR_BUFFER_SIZE> chars(cx);
+    Vector<char16_t, INITIAL_CHAR_BUFFER_SIZE> chars(cx);
     if (!chars.resize(INITIAL_CHAR_BUFFER_SIZE))
         return false;
     UErrorCode status = U_ZERO_ERROR;
-    int size = unum_formatDouble(nf, x, JSCharToUChar(chars.begin()), INITIAL_CHAR_BUFFER_SIZE,
+    int size = unum_formatDouble(nf, x, Char16ToUChar(chars.begin()), INITIAL_CHAR_BUFFER_SIZE,
                                  nullptr, &status);
     if (status == U_BUFFER_OVERFLOW_ERROR) {
         if (!chars.resize(size))
             return false;
         status = U_ZERO_ERROR;
-        unum_formatDouble(nf, x, JSCharToUChar(chars.begin()), size, nullptr, &status);
+        unum_formatDouble(nf, x, Char16ToUChar(chars.begin()), size, nullptr, &status);
     }
     if (U_FAILURE(status)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INTERNAL_INTL_ERROR);
@@ -1799,8 +1799,8 @@ js::intl_patternForSkeleton(JSContext *cx, unsigned argc, Value *vp)
     if (!stableChars.initTwoByte(cx, skeletonFlat))
         return false;
 
-    mozilla::Range<const jschar> skeletonChars = stableChars.twoByteRange();
-    uint32_t skeletonLen = u_strlen(JSCharToUChar(skeletonChars.start().get()));
+    mozilla::Range<const char16_t> skeletonChars = stableChars.twoByteRange();
+    uint32_t skeletonLen = u_strlen(Char16ToUChar(skeletonChars.start().get()));
 
     UErrorCode status = U_ZERO_ERROR;
     UDateTimePatternGenerator *gen = udatpg_open(icuLocale(locale.ptr()), &status);
@@ -1810,7 +1810,7 @@ js::intl_patternForSkeleton(JSContext *cx, unsigned argc, Value *vp)
     }
     ScopedICUObject<UDateTimePatternGenerator> toClose(gen, udatpg_close);
 
-    int32_t size = udatpg_getBestPattern(gen, JSCharToUChar(skeletonChars.start().get()),
+    int32_t size = udatpg_getBestPattern(gen, Char16ToUChar(skeletonChars.start().get()),
                                          skeletonLen, nullptr, 0, &status);
     if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INTERNAL_INTL_ERROR);
@@ -1821,14 +1821,14 @@ js::intl_patternForSkeleton(JSContext *cx, unsigned argc, Value *vp)
         return false;
     pattern[size] = '\0';
     status = U_ZERO_ERROR;
-    udatpg_getBestPattern(gen, JSCharToUChar(skeletonChars.start().get()),
+    udatpg_getBestPattern(gen, Char16ToUChar(skeletonChars.start().get()),
                           skeletonLen, pattern, size, &status);
     if (U_FAILURE(status)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INTERNAL_INTL_ERROR);
         return false;
     }
 
-    RootedString str(cx, JS_NewUCStringCopyZ(cx, reinterpret_cast<jschar*>(pattern.get())));
+    RootedString str(cx, JS_NewUCStringCopyZ(cx, reinterpret_cast<char16_t*>(pattern.get())));
     if (!str)
         return false;
     args.rval().setString(str);
@@ -1878,7 +1878,7 @@ NewUDateFormat(JSContext *cx, HandleObject dateTimeFormat)
             JSFlatString *flat = value.toString()->ensureFlat(cx);
             if (!flat || !timeZoneChars.initTwoByte(cx, flat))
                 return nullptr;
-            uTimeZone = JSCharToUChar(timeZoneChars.twoByteRange().start().get());
+            uTimeZone = Char16ToUChar(timeZoneChars.twoByteRange().start().get());
             if (!uTimeZone)
                 return nullptr;
             uTimeZoneLength = u_strlen(uTimeZone);
@@ -1892,7 +1892,7 @@ NewUDateFormat(JSContext *cx, HandleObject dateTimeFormat)
     if (!flat || !patternChars.initTwoByte(cx, flat))
         return nullptr;
 
-    uPattern = JSCharToUChar(patternChars.twoByteRange().start().get());
+    uPattern = Char16ToUChar(patternChars.twoByteRange().start().get());
     if (!uPattern)
         return nullptr;
     uPatternLength = u_strlen(uPattern);
@@ -1927,17 +1927,17 @@ intl_FormatDateTime(JSContext *cx, UDateFormat *df, double x, MutableHandleValue
         return false;
     }
 
-    Vector<jschar, INITIAL_CHAR_BUFFER_SIZE> chars(cx);
+    Vector<char16_t, INITIAL_CHAR_BUFFER_SIZE> chars(cx);
     if (!chars.resize(INITIAL_CHAR_BUFFER_SIZE))
         return false;
     UErrorCode status = U_ZERO_ERROR;
-    int size = udat_format(df, x, JSCharToUChar(chars.begin()), INITIAL_CHAR_BUFFER_SIZE,
+    int size = udat_format(df, x, Char16ToUChar(chars.begin()), INITIAL_CHAR_BUFFER_SIZE,
                            nullptr, &status);
     if (status == U_BUFFER_OVERFLOW_ERROR) {
         if (!chars.resize(size))
             return false;
         status = U_ZERO_ERROR;
-        udat_format(df, x, JSCharToUChar(chars.begin()), size, nullptr, &status);
+        udat_format(df, x, Char16ToUChar(chars.begin()), size, nullptr, &status);
     }
     if (U_FAILURE(status)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INTERNAL_INTL_ERROR);
diff --git a/js/src/builtin/Intl.h b/js/src/builtin/Intl.h
index d62819ca4bd..225142de9fc 100644
--- a/js/src/builtin/Intl.h
+++ b/js/src/builtin/Intl.h
@@ -180,16 +180,16 @@ extern bool
 intl_FormatDateTime(JSContext *cx, unsigned argc, Value *vp);
 
 /**
- * Cast jschar* strings to UChar* strings used by ICU.
+ * Cast char16_t* strings to UChar* strings used by ICU.
  */
 inline const UChar *
-JSCharToUChar(const jschar *chars)
+Char16ToUChar(const char16_t *chars)
 {
   return reinterpret_cast<const UChar *>(chars);
 }
 
 inline UChar *
-JSCharToUChar(jschar *chars)
+Char16ToUChar(char16_t *chars)
 {
   return reinterpret_cast<UChar *>(chars);
 }
diff --git a/js/src/builtin/Object.cpp b/js/src/builtin/Object.cpp
index 40401d4f9e4..748393dd8c7 100644
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -229,7 +229,7 @@ js::ObjectToSource(JSContext *cx, HandleObject obj)
                 ? !IsIdentifier(JSID_TO_ATOM(id))
                 : JSID_TO_INT(id) < 0)
             {
-                idstr = js_QuoteString(cx, idstr, jschar('\''));
+                idstr = js_QuoteString(cx, idstr, char16_t('\''));
                 if (!idstr)
                     return nullptr;
             }
diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index 3a83be61c86..b9e4760468a 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -45,7 +45,7 @@ js::CreateRegExpMatchResult(JSContext *cx, HandleString input, const MatchPairs
     size_t numPairs = matches.length();
     JS_ASSERT(numPairs > 0);
 
-    RootedObject arr(cx, NewDenseAllocatedArrayWithTemplate(cx, numPairs, templateObject));
+    RootedObject arr(cx, NewDenseFullyAllocatedArrayWithTemplate(cx, numPairs, templateObject));
     if (!arr)
         return false;
 
@@ -56,12 +56,15 @@ js::CreateRegExpMatchResult(JSContext *cx, HandleString input, const MatchPairs
         if (pair.isUndefined()) {
             JS_ASSERT(i != 0); /* Since we had a match, first pair must be present. */
             arr->setDenseInitializedLength(i + 1);
-            arr->initDenseElement(i, UndefinedValue());
+            arr->initDenseElementWithType(cx, i, UndefinedValue());
         } else {
             JSLinearString *str = NewDependentString(cx, input, pair.start, pair.length());
             if (!str)
                 return false;
             arr->setDenseInitializedLength(i + 1);
+
+            // We don't have to update type information here, since the match
+            // result template is already known to have string elements.
             arr->initDenseElement(i, StringValue(str));
         }
     }
@@ -141,7 +144,7 @@ EscapeNakedForwardSlashes(StringBuffer &sb, const CharT *oldChars, size_t oldLen
             /* There's a forward slash that needs escaping. */
             if (sb.empty()) {
                 /* This is the first one we've seen, copy everything up to this point. */
-                if (mozilla::IsSame<CharT, jschar>::value && !sb.ensureTwoByteChars())
+                if (mozilla::IsSame<CharT, char16_t>::value && !sb.ensureTwoByteChars())
                     return false;
 
                 if (!sb.reserve(oldLen + 1))
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index b68d4f24aad..ddfcabf9ded 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -1727,7 +1727,7 @@ ReportLargeAllocationFailure(JSContext *cx, unsigned argc, jsval *vp)
 
 namespace heaptools {
 
-typedef UniquePtr<jschar[], JS::FreePolicy> EdgeName;
+typedef UniquePtr<char16_t[], JS::FreePolicy> EdgeName;
 
 // An edge to a node from its predecessor in a path through the graph.
 class BackEdge {
@@ -1904,7 +1904,7 @@ FindPath(JSContext *cx, unsigned argc, jsval *vp)
     //
     //   { node: undefined, edge: <string> }
     size_t length = nodes.length();
-    RootedObject result(cx, NewDenseAllocatedArray(cx, length));
+    RootedObject result(cx, NewDenseFullyAllocatedArray(cx, length));
     if (!result)
         return false;
     result->ensureDenseInitializedLength(cx, 0, length);
@@ -1951,9 +1951,9 @@ EvalReturningScope(JSContext *cx, unsigned argc, jsval *vp)
     if (!strChars.initTwoByte(cx, str))
         return false;
 
-    mozilla::Range<const jschar> chars = strChars.twoByteRange();
+    mozilla::Range<const char16_t> chars = strChars.twoByteRange();
     size_t srclen = chars.length();
-    const jschar *src = chars.start().get();
+    const char16_t *src = chars.start().get();
 
     JS::AutoFilename filename;
     unsigned lineno;
diff --git a/js/src/ctypes/CTypes.cpp b/js/src/ctypes/CTypes.cpp
index 71bd1ed09ca..5ef9156198e 100644
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -100,7 +100,7 @@ GetDeflatedUTF8StringLength(JSContext *maybecx, const Latin1Char *chars,
                             size_t nchars);
 
 template size_t
-GetDeflatedUTF8StringLength(JSContext *maybecx, const jschar *chars,
+GetDeflatedUTF8StringLength(JSContext *maybecx, const char16_t *chars,
                             size_t nchars);
 
 static size_t
@@ -120,7 +120,7 @@ DeflateStringToUTF8Buffer(JSContext *maybecx, const CharT *src, size_t srclen,
                           char *dst, size_t *dstlenp)
 {
     size_t i, utf8Len;
-    jschar c, c2;
+    char16_t c, c2;
     uint32_t v;
     uint8_t utf8buf[6];
 
@@ -184,7 +184,7 @@ DeflateStringToUTF8Buffer(JSContext *maybecx, const Latin1Char *src, size_t srcl
                           char *dst, size_t *dstlenp);
 
 template bool
-DeflateStringToUTF8Buffer(JSContext *maybecx, const jschar *src, size_t srclen,
+DeflateStringToUTF8Buffer(JSContext *maybecx, const char16_t *src, size_t srclen,
                           char *dst, size_t *dstlenp);
 
 static bool
@@ -1687,7 +1687,7 @@ jsvalToInteger(JSContext* cx, jsval val, IntegerType* result)
       case TYPE_char:
       case TYPE_signed_char:
       case TYPE_unsigned_char:
-      case TYPE_jschar:
+      case TYPE_char16_t:
       case TYPE_pointer:
       case TYPE_function:
       case TYPE_array:
@@ -1773,7 +1773,7 @@ jsvalToFloat(JSContext *cx, jsval val, FloatType* result)
       case TYPE_char:
       case TYPE_signed_char:
       case TYPE_unsigned_char:
-      case TYPE_jschar:
+      case TYPE_char16_t:
       case TYPE_pointer:
       case TYPE_function:
       case TYPE_array:
@@ -1818,7 +1818,7 @@ StringToInteger(JSContext* cx, CharT* cp, size_t length, IntegerType* result)
   // checking for valid characters 0 - 9, a - f, A - F and overflow.
   IntegerType i = 0;
   while (cp != end) {
-    jschar c = *cp++;
+    char16_t c = *cp++;
     if (c >= '0' && c <= '9')
       c -= '0';
     else if (base == 16 && c >= 'a' && c <= 'f')
@@ -2182,9 +2182,9 @@ ConvertToJS(JSContext* cx,
     *result = INT_TO_JSVAL(*static_cast<type*>(data));                         \
     break;
 #include "ctypes/typedefs.h"
-  case TYPE_jschar: {
-    // Convert the jschar to a 1-character string.
-    JSString* str = JS_NewUCStringCopyN(cx, static_cast<jschar*>(data), 1);
+  case TYPE_char16_t: {
+    // Convert the char16_t to a 1-character string.
+    JSString* str = JS_NewUCStringCopyN(cx, static_cast<char16_t*>(data), 1);
     if (!str)
       return false;
 
@@ -2348,13 +2348,13 @@ ImplicitConvert(JSContext* cx,
     break;                                                                     \
   }
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#define DEFINE_JSCHAR_TYPE(name, type, ffiType)                                \
+#define DEFINE_CHAR16_TYPE(name, type, ffiType)                                \
   case TYPE_##name: {                                                          \
     /* Convert from a 1-character string, regardless of encoding, */           \
     /* or from an integer, provided the result fits in 'type'. */              \
     type result;                                                               \
-    if (val.isString()) {                                                \
-      JSString* str = val.toString();                                    \
+    if (val.isString()) {                                                      \
+      JSString* str = val.toString();                                          \
       if (str->length() != 1)                                                  \
         return TypeError(cx, #name, val);                                      \
       JSLinearString *linear = str->ensureLinear(cx);                          \
@@ -2428,13 +2428,13 @@ ImplicitConvert(JSContext* cx,
         *freePointer = true;
         break;
       }
-      case TYPE_jschar: {
-        // Copy the jschar string data. (We could provide direct access to the
+      case TYPE_char16_t: {
+        // Copy the char16_t string data. (We could provide direct access to the
         // JSString's buffer, but this approach is safer if the caller happens
         // to modify the string.)
-        jschar** jscharBuffer = static_cast<jschar**>(buffer);
-        *jscharBuffer = cx->pod_malloc<jschar>(sourceLength + 1);
-        if (!*jscharBuffer) {
+        char16_t** char16Buffer = static_cast<char16_t**>(buffer);
+        *char16Buffer = cx->pod_malloc<char16_t>(sourceLength + 1);
+        if (!*char16Buffer) {
           JS_ReportAllocationOverflow(cx);
           return false;
         }
@@ -2442,12 +2442,12 @@ ImplicitConvert(JSContext* cx,
         *freePointer = true;
         if (sourceLinear->hasLatin1Chars()) {
             AutoCheckCannotGC nogc;
-            CopyAndInflateChars(*jscharBuffer, sourceLinear->latin1Chars(nogc), sourceLength);
+            CopyAndInflateChars(*char16Buffer, sourceLinear->latin1Chars(nogc), sourceLength);
         } else {
             AutoCheckCannotGC nogc;
-            mozilla::PodCopy(*jscharBuffer, sourceLinear->twoByteChars(nogc), sourceLength);
+            mozilla::PodCopy(*char16Buffer, sourceLinear->twoByteChars(nogc), sourceLength);
         }
-        (*jscharBuffer)[sourceLength] = 0;
+        (*char16Buffer)[sourceLength] = 0;
         break;
       }
       default:
@@ -2511,15 +2511,15 @@ ImplicitConvert(JSContext* cx,
 
         break;
       }
-      case TYPE_jschar: {
-        // Copy the string data, jschar for jschar, including the terminator
+      case TYPE_char16_t: {
+        // Copy the string data, char16_t for char16_t, including the terminator
         // if there's space.
         if (targetLength < sourceLength) {
           JS_ReportError(cx, "ArrayType has insufficient length");
           return false;
         }
 
-        jschar *dest = static_cast<jschar*>(buffer);
+        char16_t *dest = static_cast<char16_t*>(buffer);
         if (sourceLinear->hasLatin1Chars()) {
             AutoCheckCannotGC nogc;
             CopyAndInflateChars(dest, sourceLinear->latin1Chars(nogc), sourceLength);
@@ -2702,15 +2702,15 @@ ExplicitConvert(JSContext* cx, HandleValue val, HandleObject targetType, void* b
     /* allow conversion from a base-10 or base-16 string. */                   \
     type result;                                                               \
     if (!jsvalToIntegerExplicit(val, &result) &&                               \
-        (!val.isString() ||                                              \
-         !StringToInteger(cx, val.toString(), &result)))                 \
+        (!val.isString() ||                                                    \
+         !StringToInteger(cx, val.toString(), &result)))                       \
       return TypeError(cx, #name, val);                                        \
     *static_cast<type*>(buffer) = result;                                      \
     break;                                                                     \
   }
 #define DEFINE_WRAPPED_INT_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_CHAR_TYPE(x, y, z)
+#define DEFINE_CHAR16_TYPE(x, y, z) DEFINE_CHAR_TYPE(x, y, z)
 #include "ctypes/typedefs.h"
   case TYPE_pointer: {
     // Convert a number, Int64 object, or UInt64 object to a pointer.
@@ -3051,9 +3051,9 @@ BuildDataSource(JSContext* cx,
     IntegerToString(*static_cast<type*>(data), 10, result);                    \
     break;
 #include "ctypes/typedefs.h"
-  case TYPE_jschar: {
+  case TYPE_char16_t: {
     // Serialize as a 1-character JS string.
-    JSString* str = JS_NewUCStringCopyN(cx, static_cast<jschar*>(data), 1);
+    JSString* str = JS_NewUCStringCopyN(cx, static_cast<char16_t*>(data), 1);
     if (!str)
       return false;
 
@@ -4375,7 +4375,7 @@ ArrayType::ConstructData(JSContext* cx,
         ++length;
         break;
       }
-      case TYPE_jschar:
+      case TYPE_char16_t:
         length = sourceLength + 1;
         break;
       default:
@@ -5472,7 +5472,7 @@ IsEllipsis(JSContext* cx, jsval v, bool* isEllipsis)
   JSLinearString *linear = str->ensureLinear(cx);
   if (!linear)
     return false;
-  jschar dot = '.';
+  char16_t dot = '.';
   *isEllipsis = (linear->latin1OrTwoByteChar(0) == dot &&
                  linear->latin1OrTwoByteChar(1) == dot &&
                  linear->latin1OrTwoByteChar(2) == dot);
@@ -5948,7 +5948,7 @@ FunctionType::Call(JSContext* cx,
 #define DEFINE_WRAPPED_INT_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_BOOL_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
+#define DEFINE_CHAR16_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #include "ctypes/typedefs.h"
   default:
     break;
@@ -6215,7 +6215,7 @@ CClosure::ClosureStub(ffi_cif* cif, void* result, void** args, void* userData)
 #define DEFINE_WRAPPED_INT_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_BOOL_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
+#define DEFINE_CHAR16_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #include "ctypes/typedefs.h"
       rvSize = Align(rvSize, sizeof(ffi_arg));
       break;
@@ -6301,7 +6301,7 @@ CClosure::ClosureStub(ffi_cif* cif, void* result, void** args, void* userData)
 #define DEFINE_WRAPPED_INT_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_BOOL_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
+#define DEFINE_CHAR16_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #include "ctypes/typedefs.h"
   default:
     break;
@@ -6646,7 +6646,7 @@ ReadStringCommon(JSContext* cx, InflateUTF8Method inflateUTF8, unsigned argc, js
     size_t length = strnlen(bytes, maxLength);
 
     // Determine the length.
-    jschar *dst = inflateUTF8(cx, JS::UTF8Chars(bytes, length), &length).get();
+    char16_t *dst = inflateUTF8(cx, JS::UTF8Chars(bytes, length), &length).get();
     if (!dst)
       return false;
 
@@ -6657,8 +6657,8 @@ ReadStringCommon(JSContext* cx, InflateUTF8Method inflateUTF8, unsigned argc, js
   case TYPE_uint16_t:
   case TYPE_short:
   case TYPE_unsigned_short:
-  case TYPE_jschar: {
-    jschar* chars = static_cast<jschar*>(data);
+  case TYPE_char16_t: {
+    char16_t* chars = static_cast<char16_t*>(data);
     size_t length = strnlen(chars, maxLength);
     result = JS_NewUCStringCopyN(cx, chars, length);
     break;
diff --git a/js/src/ctypes/CTypes.h b/js/src/ctypes/CTypes.h
index 4e57a7640a1..319a19a6b61 100644
--- a/js/src/ctypes/CTypes.h
+++ b/js/src/ctypes/CTypes.h
@@ -63,10 +63,10 @@ class Array : public Vector<T, N, SystemAllocPolicy>
 };
 
 // String and AutoString classes, based on Vector.
-typedef Vector<jschar,  0, SystemAllocPolicy> String;
-typedef Vector<jschar, 64, SystemAllocPolicy> AutoString;
-typedef Vector<char,    0, SystemAllocPolicy> CString;
-typedef Vector<char,   64, SystemAllocPolicy> AutoCString;
+typedef Vector<char16_t,  0, SystemAllocPolicy> String;
+typedef Vector<char16_t, 64, SystemAllocPolicy> AutoString;
+typedef Vector<char,      0, SystemAllocPolicy> CString;
+typedef Vector<char,     64, SystemAllocPolicy> AutoCString;
 
 // Convenience functions to append, insert, and compare Strings.
 template <class T, size_t N, class AP, size_t ArrayLength>
@@ -92,7 +92,7 @@ AppendString(Vector<T, N, AP> &v, Vector<T, M, AP> &w)
 
 template <size_t N, class AP>
 void
-AppendString(Vector<jschar, N, AP> &v, JSString* str)
+AppendString(Vector<char16_t, N, AP> &v, JSString* str)
 {
   JS_ASSERT(str);
   JSLinearString *linear = str->ensureLinear(nullptr);
@@ -125,7 +125,7 @@ AppendString(Vector<char, N, AP> &v, JSString* str)
     for (size_t i = 0; i < alen; ++i)
       v[i + vlen] = char(chars[i]);
   } else {
-    const jschar *chars = linear->twoByteChars(nogc);
+    const char16_t *chars = linear->twoByteChars(nogc);
     for (size_t i = 0; i < alen; ++i)
       v[i + vlen] = char(chars[i]);
   }
@@ -151,7 +151,7 @@ PrependString(Vector<T, N, AP> &v, const char (&array)[ArrayLength])
 
 template <size_t N, class AP>
 void
-PrependString(Vector<jschar, N, AP> &v, JSString* str)
+PrependString(Vector<char16_t, N, AP> &v, JSString* str)
 {
   JS_ASSERT(str);
   size_t vlen = v.length();
@@ -164,7 +164,7 @@ PrependString(Vector<jschar, N, AP> &v, JSString* str)
     return;
 
   // Move vector data forward. This is safe since we've already resized.
-  memmove(v.begin() + alen, v.begin(), vlen * sizeof(jschar));
+  memmove(v.begin() + alen, v.begin(), vlen * sizeof(char16_t));
 
   // Copy data to insert.
   JS::AutoCheckCannotGC nogc;
@@ -173,7 +173,7 @@ PrependString(Vector<jschar, N, AP> &v, JSString* str)
     for (size_t i = 0; i < alen; i++)
       v[i] = chars[i];
   } else {
-    memcpy(v.begin(), linear->twoByteChars(nogc), alen * sizeof(jschar));
+    memcpy(v.begin(), linear->twoByteChars(nogc), alen * sizeof(char16_t));
   }
 }
 
diff --git a/js/src/ctypes/typedefs.h b/js/src/ctypes/typedefs.h
index eebbaa10fb6..3a2709172f4 100644
--- a/js/src/ctypes/typedefs.h
+++ b/js/src/ctypes/typedefs.h
@@ -24,7 +24,7 @@
 // DEFINE_TYPE macro. Otherwise, turn off whichever ones we're not using.
 #if defined(DEFINE_TYPE)
 #  define DEFINE_CHAR_TYPE(x, y, z)         DEFINE_TYPE(x, y, z)
-#  define DEFINE_JSCHAR_TYPE(x, y, z)       DEFINE_TYPE(x, y, z)
+#  define DEFINE_CHAR16_TYPE(x, y, z)       DEFINE_TYPE(x, y, z)
 #  define DEFINE_BOOL_TYPE(x, y, z)         DEFINE_TYPE(x, y, z)
 #  define DEFINE_INT_TYPE(x, y, z)          DEFINE_TYPE(x, y, z)
 #  define DEFINE_WRAPPED_INT_TYPE(x, y, z)  DEFINE_TYPE(x, y, z)
@@ -36,8 +36,8 @@
 #  ifndef DEFINE_CHAR_TYPE
 #    define DEFINE_CHAR_TYPE(x, y, z)
 #  endif
-#  ifndef DEFINE_JSCHAR_TYPE
-#    define DEFINE_JSCHAR_TYPE(x, y, z)
+#  ifndef DEFINE_CHAR16_TYPE
+#    define DEFINE_CHAR16_TYPE(x, y, z)
 #  endif
 #  ifndef DEFINE_INT_TYPE
 #    define DEFINE_INT_TYPE(x, y, z)
@@ -101,7 +101,7 @@ DEFINE_FLOAT_TYPE      (double,             double,             ffi_type_double)
 DEFINE_CHAR_TYPE       (char,               char,               ffi_type_uint8)
 DEFINE_CHAR_TYPE       (signed_char,        signed char,        ffi_type_sint8)
 DEFINE_CHAR_TYPE       (unsigned_char,      unsigned char,      ffi_type_uint8)
-DEFINE_JSCHAR_TYPE     (jschar,             jschar,             ffi_type_uint16)
+DEFINE_CHAR16_TYPE     (char16_t,           char16_t,           ffi_type_uint16)
 
 #undef CTYPES_SSIZE_T
 #undef CTYPES_FFI_BOOL
@@ -114,7 +114,7 @@ DEFINE_JSCHAR_TYPE     (jschar,             jschar,             ffi_type_uint16)
 
 #undef DEFINE_TYPE
 #undef DEFINE_CHAR_TYPE
-#undef DEFINE_JSCHAR_TYPE
+#undef DEFINE_CHAR16_TYPE
 #undef DEFINE_BOOL_TYPE
 #undef DEFINE_INT_TYPE
 #undef DEFINE_WRAPPED_INT_TYPE
diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
index f6cd3f71800..642619a0b71 100644
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -458,7 +458,7 @@ frontend::CompileScript(ExclusiveContext *cx, LifoAlloc *alloc, HandleObject sco
 }
 
 bool
-frontend::CompileLazyFunction(JSContext *cx, Handle<LazyScript*> lazy, const jschar *chars, size_t length)
+frontend::CompileLazyFunction(JSContext *cx, Handle<LazyScript*> lazy, const char16_t *chars, size_t length)
 {
     JS_ASSERT(cx->compartment() == lazy->functionNonDelazifying()->compartment());
 
diff --git a/js/src/frontend/BytecodeCompiler.h b/js/src/frontend/BytecodeCompiler.h
index d1233390436..82f923de870 100644
--- a/js/src/frontend/BytecodeCompiler.h
+++ b/js/src/frontend/BytecodeCompiler.h
@@ -29,7 +29,7 @@ CompileScript(ExclusiveContext *cx, LifoAlloc *alloc,
               SourceCompressionTask *extraSct = nullptr);
 
 bool
-CompileLazyFunction(JSContext *cx, Handle<LazyScript*> lazy, const jschar *chars, size_t length);
+CompileLazyFunction(JSContext *cx, Handle<LazyScript*> lazy, const char16_t *chars, size_t length);
 
 bool
 CompileFunctionBody(JSContext *cx, MutableHandleFunction fun,
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index 73ae2d12c3c..39e39946f38 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -3041,7 +3041,11 @@ EmitDestructuringDecls(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp
 
     MOZ_ASSERT(pattern->isKind(PNK_OBJECT));
     for (ParseNode *member = pattern->pn_head; member; member = member->pn_next) {
-        ParseNode *target = member->pn_right;
+        MOZ_ASSERT(member->isKind(PNK_MUTATEPROTO) ||
+                   member->isKind(PNK_COLON) ||
+                   member->isKind(PNK_SHORTHAND));
+
+        ParseNode *target = member->isKind(PNK_MUTATEPROTO) ? member->pn_kid : member->pn_right;
         DestructuringDeclEmitter emitter =
             target->isKind(PNK_NAME) ? EmitDestructuringDecl : EmitDestructuringDecls;
         if (!emitter(cx, bce, prologOp, target))
@@ -3051,7 +3055,7 @@ EmitDestructuringDecls(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prologOp
 }
 
 static bool
-EmitDestructuringOpsHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn,
+EmitDestructuringOpsHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pattern,
                            VarEmitOption emitOption);
 
 /*
@@ -3216,6 +3220,252 @@ EmitIteratorNext(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn=nullp
     return true;
 }
 
+static bool
+EmitDestructuringOpsArrayHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pattern,
+                                VarEmitOption emitOption)
+{
+    MOZ_ASSERT(pattern->isKind(PNK_ARRAY));
+    MOZ_ASSERT(pattern->isArity(PN_LIST));
+    MOZ_ASSERT(bce->stackDepth != 0);
+
+    /*
+     * Use an iterator to destructure the RHS, instead of index lookup.
+     * InitializeVars expects us to leave the *original* value on the stack.
+     */
+    if (emitOption == InitializeVars) {
+        if (Emit1(cx, bce, JSOP_DUP) < 0)                              // ... OBJ OBJ
+            return false;
+    }
+    if (!EmitIterator(cx, bce))                                        // ... OBJ? ITER
+        return false;
+    bool needToPopIterator = true;
+
+    for (ParseNode *member = pattern->pn_head; member; member = member->pn_next) {
+        /*
+         * Now push the property name currently being matched, which is the
+         * current property name "label" on the left of a colon in the object
+         * initializer.
+         */
+        if (member->isKind(PNK_SPREAD)) {
+            /* Create a new array with the rest of the iterator */
+            ptrdiff_t off = EmitN(cx, bce, JSOP_NEWARRAY, 3);          // ... OBJ? ITER ARRAY
+            if (off < 0)
+                return false;
+            CheckTypeSet(cx, bce, JSOP_NEWARRAY);
+            jsbytecode *pc = bce->code(off);
+            SET_UINT24(pc, 0);
+
+            if (!EmitNumberOp(cx, 0, bce))                             // ... OBJ? ITER ARRAY INDEX
+                return false;
+            if (!EmitSpread(cx, bce))                                  // ... OBJ? ARRAY INDEX
+                return false;
+            if (Emit1(cx, bce, JSOP_POP) < 0)                          // ... OBJ? ARRAY
+                return false;
+            if (Emit1(cx, bce, JSOP_ENDINIT) < 0)
+                return false;
+            needToPopIterator = false;
+        } else {
+            if (Emit1(cx, bce, JSOP_DUP) < 0)                          // ... OBJ? ITER ITER
+                return false;
+            if (!EmitIteratorNext(cx, bce, pattern))                   // ... OBJ? ITER RESULT
+                return false;
+            if (Emit1(cx, bce, JSOP_DUP) < 0)                          // ... OBJ? ITER RESULT RESULT
+                return false;
+            if (!EmitAtomOp(cx, cx->names().done, JSOP_GETPROP, bce))  // ... OBJ? ITER RESULT DONE?
+                return false;
+
+            // Emit (result.done ? undefined : result.value)
+            // This is mostly copied from EmitConditionalExpression, except that this code
+            // does not push new values onto the stack.
+            ptrdiff_t noteIndex = NewSrcNote(cx, bce, SRC_COND);
+            if (noteIndex < 0)
+                return false;
+            ptrdiff_t beq = EmitJump(cx, bce, JSOP_IFEQ, 0);
+            if (beq < 0)
+                return false;
+
+            if (Emit1(cx, bce, JSOP_POP) < 0)                          // ... OBJ? ITER
+                return false;
+            if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)                    // ... OBJ? ITER UNDEFINED
+                return false;
+
+            /* Jump around else, fixup the branch, emit else, fixup jump. */
+            ptrdiff_t jmp = EmitJump(cx, bce, JSOP_GOTO, 0);
+            if (jmp < 0)
+                return false;
+            SetJumpOffsetAt(bce, beq);
+
+            if (!EmitAtomOp(cx, cx->names().value, JSOP_GETPROP, bce)) // ... OBJ? ITER VALUE
+                return false;
+
+            SetJumpOffsetAt(bce, jmp);
+            if (!SetSrcNoteOffset(cx, bce, noteIndex, 0, jmp - beq))
+                return false;
+        }
+
+        // Destructure into the pattern the element contains.
+        ParseNode *subpattern = member;
+        if (subpattern->isKind(PNK_ELISION)) {
+            // The value destructuring into an elision just gets ignored.
+            if (Emit1(cx, bce, JSOP_POP) < 0)                          // ... OBJ? ITER
+                return false;
+            continue;
+        }
+
+        int32_t depthBefore = bce->stackDepth;
+        if (!EmitDestructuringLHS(cx, bce, subpattern, emitOption))
+            return false;
+
+        if (emitOption == PushInitialValues && needToPopIterator) {
+            /*
+             * After '[x,y]' in 'let ([[x,y], z] = o)', the stack is
+             *   | to-be-destructured-value | x | y |
+             * The goal is:
+             *   | x | y | z |
+             * so emit a pick to produce the intermediate state
+             *   | x | y | to-be-destructured-value |
+             * before destructuring z. This gives the loop invariant that
+             * the to-be-destructured-value is always on top of the stack.
+             */
+            JS_ASSERT((bce->stackDepth - bce->stackDepth) >= -1);
+            uint32_t pickDistance = (uint32_t)((bce->stackDepth + 1) - depthBefore);
+            if (pickDistance > 0) {
+                if (pickDistance > UINT8_MAX) {
+                    bce->reportError(subpattern, JSMSG_TOO_MANY_LOCALS);
+                    return false;
+                }
+                if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)pickDistance) < 0)
+                    return false;
+            }
+        }
+    }
+
+    if (needToPopIterator && Emit1(cx, bce, JSOP_POP) < 0)
+        return false;
+
+    return true;
+}
+
+static bool
+EmitDestructuringOpsObjectHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pattern,
+                                 VarEmitOption emitOption)
+{
+    MOZ_ASSERT(pattern->isKind(PNK_OBJECT));
+    MOZ_ASSERT(pattern->isArity(PN_LIST));
+
+    MOZ_ASSERT(bce->stackDepth != 0);                                  // ... OBJ
+
+    for (ParseNode *member = pattern->pn_head; member; member = member->pn_next) {
+        // Duplicate the value being destructured to use as a reference base.
+        if (Emit1(cx, bce, JSOP_DUP) < 0)                              // ... OBJ OBJ
+            return false;
+
+        // Now push the property name currently being matched, which is the
+        // current property name "label" on the left of a colon in the object
+        // initialiser.
+        bool needsGetElem = true;
+
+        ParseNode *subpattern;
+        if (member->isKind(PNK_MUTATEPROTO)) {
+            if (!EmitAtomOp(cx, cx->names().proto, JSOP_GETPROP, bce)) // ... OBJ PROP
+                return false;
+            needsGetElem = false;
+            subpattern = member->pn_kid;
+        } else {
+            MOZ_ASSERT(member->isKind(PNK_COLON) || member->isKind(PNK_SHORTHAND));
+
+            ParseNode *key = member->pn_left;
+            if (key->isKind(PNK_NUMBER)) {
+                if (!EmitNumberOp(cx, key->pn_dval, bce))              // ... OBJ OBJ KEY
+                    return false;
+            } else if (key->isKind(PNK_NAME) || key->isKind(PNK_STRING)) {
+                PropertyName *name = key->pn_atom->asPropertyName();
+
+                // The parser already checked for atoms representing indexes and
+                // used PNK_NUMBER instead, but also watch for ids which TI treats
+                // as indexes for simplification of downstream analysis.
+                jsid id = NameToId(name);
+                if (id != types::IdToTypeId(id)) {
+                    if (!EmitTree(cx, bce, key))                       // ... OBJ OBJ KEY
+                        return false;
+                } else {
+                    if (!EmitAtomOp(cx, name, JSOP_GETPROP, bce))      // ...OBJ PROP
+                        return false;
+                    needsGetElem = false;
+                }
+            } else {
+                JS_ASSERT(key->isKind(PNK_COMPUTED_NAME));
+                if (!EmitTree(cx, bce, key->pn_kid))                   // ... OBJ OBJ KEY
+                    return false;
+            }
+
+            subpattern = member->pn_right;
+        }
+
+        // Get the property value if not done already.
+        if (needsGetElem && !EmitElemOpBase(cx, bce, JSOP_GETELEM))    // ... OBJ PROP
+            return false;
+
+        // Destructure PROP per this member's subpattern.
+        int32_t depthBefore = bce->stackDepth;
+        if (!EmitDestructuringLHS(cx, bce, subpattern, emitOption))
+            return false;
+
+        // If emitOption is InitializeVars, destructuring initialized each
+        // target in the subpattern's LHS as it went, then popped PROP.  We've
+        // correctly returned to the loop-entry stack, and we continue to the
+        // next member.
+        if (emitOption == InitializeVars)                              // ... OBJ
+            continue;
+
+        MOZ_ASSERT(emitOption == PushInitialValues);
+
+        // EmitDestructuringLHS removed PROP, and it pushed a value per target
+        // name in LHS (for |emitOption == PushInitialValues| only makes sense
+        // when multiple values need to be pushed onto the stack to initialize
+        // a single lexical scope). It also preserved OBJ deep in the stack as
+        // the original object to be destructed into remaining target names in
+        // the LHS object pattern. (We use PushInitialValues *only* as part of
+        // SpiderMonkey's proprietary let block statements, which assign their
+        // targets all in a single go [akin to Scheme's let, and distinct from
+        // let*/letrec].) Thus for:
+        //
+        //   let ({arr: [x, y], z} = obj) { ... }
+        //
+        // we have this stack after the above acts upon the [x, y] subpattern:
+        //
+        //     ... OBJ x y
+        //
+        // (where of course x = obj.arr[0] and y = obj.arr[1], and []-indexing
+        // is really iteration-indexing). We want to have:
+        //
+        //     ... x y OBJ
+        //
+        // so that we can continue, ready to destruct z from OBJ. Pick OBJ out
+        // of the stack, moving it to the top, to accomplish this.
+        JS_ASSERT((bce->stackDepth - bce->stackDepth) >= -1);
+        uint32_t pickDistance = (uint32_t)((bce->stackDepth + 1) - depthBefore);
+        if (pickDistance > 0) {
+            if (pickDistance > UINT8_MAX) {
+                bce->reportError(subpattern, JSMSG_TOO_MANY_LOCALS);
+                return false;
+            }
+            if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)pickDistance) < 0)
+                return false;
+        }
+    }
+
+    if (emitOption == PushInitialValues) {
+        // Per the above loop invariant, the value being destructured into this
+        // object pattern is atop the stack.  Pop it to achieve the
+        // post-condition.
+        if (Emit1(cx, bce, JSOP_POP) < 0)                              // ... <pattern's target name values, seriatim>
+            return false;
+    }
+
+    return true;
+}
+
 /*
  * Recursive helper for EmitDestructuringOps.
  * EmitDestructuringOpsHelper assumes the to-be-destructured value has been
@@ -3230,212 +3480,26 @@ EmitIteratorNext(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn=nullp
  * lhs expression. (Same post-condition as EmitDestructuringLHS)
  */
 static bool
-EmitDestructuringOpsHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn,
+EmitDestructuringOpsHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pattern,
                            VarEmitOption emitOption)
 {
-    JS_ASSERT(emitOption != DefineVars);
+    MOZ_ASSERT(emitOption != DefineVars);
 
-    ParseNode *pn2, *pn3;
-    bool doElemOp;
-    bool needToPopIterator = false;
-
-#ifdef DEBUG
-    int stackDepth = bce->stackDepth;
-    JS_ASSERT(stackDepth != 0);
-    JS_ASSERT(pn->isArity(PN_LIST));
-    JS_ASSERT(pn->isKind(PNK_ARRAY) || pn->isKind(PNK_OBJECT));
-#endif
-
-    /*
-     * When destructuring an array, use an iterator to walk it, instead of index lookup.
-     * InitializeVars expects us to leave the *original* value on the stack.
-     */
-    if (pn->isKind(PNK_ARRAY)) {
-        if (emitOption == InitializeVars) {
-            if (Emit1(cx, bce, JSOP_DUP) < 0)                      // OBJ OBJ
-                return false;
-        }
-        if (!EmitIterator(cx, bce))                                // OBJ? ITER
-            return false;
-        needToPopIterator = true;
-    }
-
-    for (pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-        /*
-         * Now push the property name currently being matched, which is the
-         * current property name "label" on the left of a colon in the object initialiser.
-         * Set pn3 to the lvalue node, which is in the value-initializing position.
-         */
-        if (pn->isKind(PNK_OBJECT)) {
-            doElemOp = true;
-            JS_ASSERT(pn2->isKind(PNK_COLON) || pn2->isKind(PNK_SHORTHAND));
-
-            /* Duplicate the value being destructured to use as a reference base. */
-            if (Emit1(cx, bce, JSOP_DUP) < 0)
-                return false;
-
-            ParseNode *key = pn2->pn_left;
-            if (key->isKind(PNK_NUMBER)) {
-                if (!EmitNumberOp(cx, key->pn_dval, bce))
-                    return false;
-            } else if (key->isKind(PNK_NAME) || key->isKind(PNK_STRING)) {
-                PropertyName *name = key->pn_atom->asPropertyName();
-
-                // The parser already checked for atoms representing indexes and
-                // used PNK_NUMBER instead, but also watch for ids which TI treats
-                // as indexes for simplification of downstream analysis.
-                jsid id = NameToId(name);
-                if (id != types::IdToTypeId(id)) {
-                    if (!EmitTree(cx, bce, key))
-                        return false;
-                } else {
-                    if (!EmitAtomOp(cx, name, JSOP_GETPROP, bce))
-                        return false;
-                    doElemOp = false;
-                }
-            } else {
-                JS_ASSERT(key->isKind(PNK_COMPUTED_NAME));
-                if (!EmitTree(cx, bce, key->pn_kid))
-                    return false;
-            }
-
-            if (doElemOp) {
-                /*
-                 * Ok, get the value of the matching property name.  This leaves
-                 * that value on top of the value being destructured, so the stack
-                 * is one deeper than when we started.
-                 */
-                if (!EmitElemOpBase(cx, bce, JSOP_GETELEM))
-                    return false;
-                JS_ASSERT(bce->stackDepth >= stackDepth + 1);
-            }
-
-            pn3 = pn2->pn_right;
-        } else {
-            JS_ASSERT(pn->isKind(PNK_ARRAY));
-
-            if (pn2->isKind(PNK_SPREAD)) {
-                /* Create a new array with the rest of the iterator */
-                ptrdiff_t off = EmitN(cx, bce, JSOP_NEWARRAY, 3);          // ITER ARRAY
-                if (off < 0)
-                    return false;
-                CheckTypeSet(cx, bce, JSOP_NEWARRAY);
-                jsbytecode *pc = bce->code(off);
-                SET_UINT24(pc, 0);
-
-                if (!EmitNumberOp(cx, 0, bce))                             // ITER ARRAY INDEX
-                    return false;
-                if (!EmitSpread(cx, bce))                                  // ARRAY INDEX
-                    return false;
-                if (Emit1(cx, bce, JSOP_POP) < 0)                          // ARRAY
-                    return false;
-                if (Emit1(cx, bce, JSOP_ENDINIT) < 0)
-                    return false;
-                needToPopIterator = false;
-            } else {
-                if (Emit1(cx, bce, JSOP_DUP) < 0)                          // ITER ITER
-                    return false;
-                if (!EmitIteratorNext(cx, bce, pn))                        // ITER RESULT
-                    return false;
-                if (Emit1(cx, bce, JSOP_DUP) < 0)                          // ITER RESULT RESULT
-                    return false;
-                if (!EmitAtomOp(cx, cx->names().done, JSOP_GETPROP, bce))  // ITER RESULT DONE?
-                    return false;
-
-                // Emit (result.done ? undefined : result.value)
-                // This is mostly copied from EmitConditionalExpression, except that this code
-                // does not push new values onto the stack.
-                ptrdiff_t noteIndex = NewSrcNote(cx, bce, SRC_COND);
-                if (noteIndex < 0)
-                    return false;
-                ptrdiff_t beq = EmitJump(cx, bce, JSOP_IFEQ, 0);
-                if (beq < 0)
-                    return false;
-
-                if (Emit1(cx, bce, JSOP_POP) < 0)                          // ITER
-                    return false;
-                if (Emit1(cx, bce, JSOP_UNDEFINED) < 0)                    // ITER UNDEFINED
-                    return false;
-
-                /* Jump around else, fixup the branch, emit else, fixup jump. */
-                ptrdiff_t jmp = EmitJump(cx, bce, JSOP_GOTO, 0);
-                if (jmp < 0)
-                    return false;
-                SetJumpOffsetAt(bce, beq);
-
-                if (!EmitAtomOp(cx, cx->names().value, JSOP_GETPROP, bce)) // ITER VALUE
-                    return false;
-
-                SetJumpOffsetAt(bce, jmp);
-                if (!SetSrcNoteOffset(cx, bce, noteIndex, 0, jmp - beq))
-                    return false;
-            }
-
-            pn3 = pn2;
-        }
-
-        /* Elision node makes a hole in the array destructurer. */
-        if (pn3->isKind(PNK_ELISION)) {
-            JS_ASSERT(pn->isKind(PNK_ARRAY));
-            JS_ASSERT(pn2 == pn3);
-            if (Emit1(cx, bce, JSOP_POP) < 0)
-                return false;
-        } else {
-            int32_t depthBefore = bce->stackDepth;
-            if (!EmitDestructuringLHS(cx, bce, pn3, emitOption))
-                return false;
-
-            if (emitOption == PushInitialValues &&
-                (pn->isKind(PNK_OBJECT) || needToPopIterator)) {
-                /*
-                 * After '[x,y]' in 'let ([[x,y], z] = o)', the stack is
-                 *   | to-be-destructured-value | x | y |
-                 * The goal is:
-                 *   | x | y | z |
-                 * so emit a pick to produce the intermediate state
-                 *   | x | y | to-be-destructured-value |
-                 * before destructuring z. This gives the loop invariant that
-                 * the to-be-destructured-value is always on top of the stack.
-                 */
-                JS_ASSERT((bce->stackDepth - bce->stackDepth) >= -1);
-                uint32_t pickDistance = (uint32_t)((bce->stackDepth + 1) - depthBefore);
-                if (pickDistance > 0) {
-                    if (pickDistance > UINT8_MAX) {
-                        bce->reportError(pn3, JSMSG_TOO_MANY_LOCALS);
-                        return false;
-                    }
-                    if (Emit2(cx, bce, JSOP_PICK, (jsbytecode)pickDistance) < 0)
-                        return false;
-                }
-            }
-        }
-    }
-
-    if (needToPopIterator && Emit1(cx, bce, JSOP_POP) < 0)
-        return false;
-
-    if (emitOption == PushInitialValues && pn->isKind(PNK_OBJECT)) {
-        /*
-         * Per the above loop invariant, to-be-destructured-value is at the top
-         * of the stack. To achieve the post-condition, pop it.
-         * In case of array destructuring, the above POP already took care of the iterator.
-         */
-        if (Emit1(cx, bce, JSOP_POP) < 0)
-            return false;
-    }
-
-    return true;
+    if (pattern->isKind(PNK_ARRAY))
+        return EmitDestructuringOpsArrayHelper(cx, bce, pattern, emitOption);
+    return EmitDestructuringOpsObjectHelper(cx, bce, pattern, emitOption);
 }
 
 static bool
-EmitDestructuringOps(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool isLet = false)
+EmitDestructuringOps(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pattern,
+                     bool isLet = false)
 {
     /*
      * Call our recursive helper to emit the destructuring assignments and
      * related stack manipulations.
      */
     VarEmitOption emitOption = isLet ? PushInitialValues : InitializeVars;
-    return EmitDestructuringOpsHelper(cx, bce, pn, emitOption);
+    return EmitDestructuringOpsHelper(cx, bce, pattern, emitOption);
 }
 
 static bool
@@ -3862,7 +3926,7 @@ ParseNode::getConstantValue(ExclusiveContext *cx, AllowConstantObjects allowObje
             pn = pn_head;
         }
 
-        RootedObject obj(cx, NewDenseAllocatedArray(cx, count, nullptr, MaybeSingletonObject));
+        RootedObject obj(cx, NewDenseFullyAllocatedArray(cx, count, nullptr, MaybeSingletonObject));
         if (!obj)
             return false;
 
@@ -6005,42 +6069,53 @@ EmitObject(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             return false;
     }
 
-    for (ParseNode *pn2 = pn->pn_head; pn2; pn2 = pn2->pn_next) {
-        if (!UpdateSourceCoordNotes(cx, bce, pn2->pn_pos.begin))
+    for (ParseNode *propdef = pn->pn_head; propdef; propdef = propdef->pn_next) {
+        if (!UpdateSourceCoordNotes(cx, bce, propdef->pn_pos.begin))
             return false;
 
+        // Handle __proto__: v specially because *only* this form, and no other
+        // involving "__proto__", performs [[Prototype]] mutation.
+        if (propdef->isKind(PNK_MUTATEPROTO)) {
+            if (!EmitTree(cx, bce, propdef->pn_kid))
+                return false;
+            obj = nullptr;
+            if (!Emit1(cx, bce, JSOP_MUTATEPROTO))
+                return false;
+            continue;
+        }
+
         /* Emit an index for t[2] for later consumption by JSOP_INITELEM. */
-        ParseNode *pn3 = pn2->pn_left;
+        ParseNode *key = propdef->pn_left;
         bool isIndex = false;
-        if (pn3->isKind(PNK_NUMBER)) {
-            if (!EmitNumberOp(cx, pn3->pn_dval, bce))
+        if (key->isKind(PNK_NUMBER)) {
+            if (!EmitNumberOp(cx, key->pn_dval, bce))
                 return false;
             isIndex = true;
-        } else if (pn3->isKind(PNK_NAME) || pn3->isKind(PNK_STRING)) {
+        } else if (key->isKind(PNK_NAME) || key->isKind(PNK_STRING)) {
             // The parser already checked for atoms representing indexes and
             // used PNK_NUMBER instead, but also watch for ids which TI treats
             // as indexes for simpliciation of downstream analysis.
-            jsid id = NameToId(pn3->pn_atom->asPropertyName());
+            jsid id = NameToId(key->pn_atom->asPropertyName());
             if (id != types::IdToTypeId(id)) {
-                if (!EmitTree(cx, bce, pn3))
+                if (!EmitTree(cx, bce, key))
                     return false;
                 isIndex = true;
             }
         } else {
-            JS_ASSERT(pn3->isKind(PNK_COMPUTED_NAME));
-            if (!EmitTree(cx, bce, pn3->pn_kid))
+            JS_ASSERT(key->isKind(PNK_COMPUTED_NAME));
+            if (!EmitTree(cx, bce, key->pn_kid))
                 return false;
             isIndex = true;
         }
 
         /* Emit code for the property initializer. */
-        if (!EmitTree(cx, bce, pn2->pn_right))
+        if (!EmitTree(cx, bce, propdef->pn_right))
             return false;
 
-        JSOp op = pn2->getOp();
-        JS_ASSERT(op == JSOP_INITPROP ||
-                  op == JSOP_INITPROP_GETTER ||
-                  op == JSOP_INITPROP_SETTER);
+        JSOp op = propdef->getOp();
+        MOZ_ASSERT(op == JSOP_INITPROP ||
+                   op == JSOP_INITPROP_GETTER ||
+                   op == JSOP_INITPROP_SETTER);
 
         if (op == JSOP_INITPROP_GETTER || op == JSOP_INITPROP_SETTER)
             obj = nullptr;
@@ -6056,27 +6131,15 @@ EmitObject(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             if (Emit1(cx, bce, op) < 0)
                 return false;
         } else {
-            JS_ASSERT(pn3->isKind(PNK_NAME) || pn3->isKind(PNK_STRING));
-
-            // If we have { __proto__: expr }, implement prototype mutation.
-            if (op == JSOP_INITPROP && pn3->pn_atom == cx->names().proto) {
-                obj = nullptr;
-                if (Emit1(cx, bce, JSOP_MUTATEPROTO) < 0)
-                    return false;
-                continue;
-            }
+            JS_ASSERT(key->isKind(PNK_NAME) || key->isKind(PNK_STRING));
 
             jsatomid index;
-            if (!bce->makeAtomIndex(pn3->pn_atom, &index))
+            if (!bce->makeAtomIndex(key->pn_atom, &index))
                 return false;
 
-            MOZ_ASSERT(op == JSOP_INITPROP ||
-                       op == JSOP_INITPROP_GETTER ||
-                       op == JSOP_INITPROP_SETTER);
-
             if (obj) {
                 JS_ASSERT(!obj->inDictionaryMode());
-                Rooted<jsid> id(cx, AtomToId(pn3->pn_atom));
+                Rooted<jsid> id(cx, AtomToId(key->pn_atom));
                 RootedValue undefinedValue(cx, UndefinedValue());
                 if (!DefineNativeProperty(cx, obj, id, undefinedValue, nullptr,
                                           nullptr, JSPROP_ENUMERATE))
diff --git a/js/src/frontend/FullParseHandler.h b/js/src/frontend/FullParseHandler.h
index a1e3d6169cc..f8579b4dea9 100644
--- a/js/src/frontend/FullParseHandler.h
+++ b/js/src/frontend/FullParseHandler.h
@@ -286,6 +286,18 @@ class FullParseHandler
         return literal;
     }
 
+    bool addPrototypeMutation(ParseNode *literal, uint32_t begin, ParseNode *expr) {
+        // Object literals with mutated [[Prototype]] are non-constant so that
+        // singleton objects will have Object.prototype as their [[Prototype]].
+        setListFlag(literal, PNX_NONCONST);
+
+        ParseNode *mutation = newUnary(PNK_MUTATEPROTO, JSOP_NOP, begin, expr);
+        if (!mutation)
+            return false;
+        literal->append(mutation);
+        return true;
+    }
+
     bool addPropertyDefinition(ParseNode *literal, ParseNode *name, ParseNode *expr,
                                bool isShorthand = false) {
         JS_ASSERT(literal->isArity(PN_LIST));
diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index f2052281696..8089bc2405b 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -459,17 +459,24 @@ Parser<FullParseHandler>::cloneLeftHandSide(ParseNode *opn)
         for (ParseNode *opn2 = opn->pn_head; opn2; opn2 = opn2->pn_next) {
             ParseNode *pn2;
             if (opn->isKind(PNK_OBJECT)) {
-                JS_ASSERT(opn2->isArity(PN_BINARY));
-                JS_ASSERT(opn2->isKind(PNK_COLON) || opn2->isKind(PNK_SHORTHAND));
+                if (opn2->isKind(PNK_MUTATEPROTO)) {
+                    ParseNode *target = cloneLeftHandSide(opn2->pn_kid);
+                    if (!target)
+                        return nullptr;
+                    pn2 = handler.new_<UnaryNode>(PNK_MUTATEPROTO, JSOP_NOP, opn2->pn_pos, target);
+                } else {
+                    JS_ASSERT(opn2->isArity(PN_BINARY));
+                    JS_ASSERT(opn2->isKind(PNK_COLON) || opn2->isKind(PNK_SHORTHAND));
 
-                ParseNode *tag = cloneParseTree(opn2->pn_left);
-                if (!tag)
-                    return nullptr;
-                ParseNode *target = cloneLeftHandSide(opn2->pn_right);
-                if (!target)
-                    return nullptr;
+                    ParseNode *tag = cloneParseTree(opn2->pn_left);
+                    if (!tag)
+                        return nullptr;
+                    ParseNode *target = cloneLeftHandSide(opn2->pn_right);
+                    if (!target)
+                        return nullptr;
 
-                pn2 = handler.new_<BinaryNode>(opn2->getKind(), JSOP_INITPROP, opn2->pn_pos, tag, target);
+                    pn2 = handler.new_<BinaryNode>(opn2->getKind(), JSOP_INITPROP, opn2->pn_pos, tag, target);
+                }
             } else if (opn2->isArity(PN_NULLARY)) {
                 JS_ASSERT(opn2->isKind(PNK_ELISION));
                 pn2 = cloneParseTree(opn2);
@@ -693,7 +700,7 @@ DumpName(const CharT *s, size_t len)
         fprintf(stderr, "#<zero-length name>");
 
     for (size_t i = 0; i < len; i++) {
-        jschar c = s[i];
+        char16_t c = s[i];
         if (c > 32 && c < 127)
             fputc(c, stderr);
         else if (c <= 255)
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index a5b5fb19df1..a3d21f43f59 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -145,6 +145,7 @@ class UpvarCookie
     F(FORHEAD) \
     F(ARGSBODY) \
     F(SPREAD) \
+    F(MUTATEPROTO) \
     \
     /* Unary operators. */ \
     F(TYPEOF) \
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 0a6eea87ed7..46bb0536c8c 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -415,7 +415,7 @@ Parser<SyntaxParseHandler>::abortIfSyntaxParser()
 template <typename ParseHandler>
 Parser<ParseHandler>::Parser(ExclusiveContext *cx, LifoAlloc *alloc,
                              const ReadOnlyCompileOptions &options,
-                             const jschar *chars, size_t length, bool foldConstants,
+                             const char16_t *chars, size_t length, bool foldConstants,
                              Parser<SyntaxParseHandler> *syntaxParser,
                              LazyScript *lazyOuterFunction)
   : AutoGCRooter(cx, PARSER),
@@ -3032,6 +3032,92 @@ Parser<FullParseHandler>::bindDestructuringVar(BindData<FullParseHandler> *data,
     return true;
 }
 
+template <>
+bool
+Parser<FullParseHandler>::checkDestructuring(BindData<FullParseHandler> *data, ParseNode *left);
+
+template <>
+bool
+Parser<FullParseHandler>::checkDestructuringObject(BindData<FullParseHandler> *data,
+                                                   ParseNode *objectPattern)
+{
+    MOZ_ASSERT(objectPattern->isKind(PNK_OBJECT));
+
+    for (ParseNode *member = objectPattern->pn_head; member; member = member->pn_next) {
+        ParseNode *expr;
+        if (member->isKind(PNK_MUTATEPROTO)) {
+            expr = member->pn_kid;
+        } else {
+            MOZ_ASSERT(member->isKind(PNK_COLON) || member->isKind(PNK_SHORTHAND));
+            expr = member->pn_right;
+        }
+
+        bool ok;
+        if (expr->isKind(PNK_ARRAY) || expr->isKind(PNK_OBJECT)) {
+            ok = checkDestructuring(data, expr);
+        } else if (data) {
+            if (!expr->isKind(PNK_NAME)) {
+                report(ParseError, false, expr, JSMSG_NO_VARIABLE_NAME);
+                return false;
+            }
+            ok = bindDestructuringVar(data, expr);
+        } else {
+            ok = checkAndMarkAsAssignmentLhs(expr, KeyedDestructuringAssignment);
+        }
+        if (!ok)
+            return false;
+    }
+
+    return true;
+}
+
+template <>
+bool
+Parser<FullParseHandler>::checkDestructuringArray(BindData<FullParseHandler> *data,
+                                                  ParseNode *arrayPattern)
+{
+    MOZ_ASSERT(arrayPattern->isKind(PNK_ARRAY));
+
+    for (ParseNode *element = arrayPattern->pn_head; element; element = element->pn_next) {
+        if (element->isKind(PNK_ELISION))
+            continue;
+
+        ParseNode *target = element;
+        if (target->isKind(PNK_SPREAD)) {
+            if (target->pn_next) {
+                report(ParseError, false, target->pn_next, JSMSG_PARAMETER_AFTER_REST);
+                return false;
+            }
+            target = target->pn_kid;
+
+            // The RestElement should not support nested patterns.
+            if (target->isKind(PNK_ARRAY) || target->isKind(PNK_OBJECT)) {
+                report(ParseError, false, target, JSMSG_BAD_DESTRUCT_TARGET);
+                return false;
+            }
+        }
+
+        bool ok;
+        if (target->isKind(PNK_ARRAY) || target->isKind(PNK_OBJECT)) {
+            ok = checkDestructuring(data, target);
+        } else {
+            if (data) {
+                if (!target->isKind(PNK_NAME)) {
+                    report(ParseError, false, target, JSMSG_NO_VARIABLE_NAME);
+                    return false;
+                }
+                ok = bindDestructuringVar(data, target);
+            } else {
+                ok = checkAndMarkAsAssignmentLhs(target, KeyedDestructuringAssignment);
+            }
+        }
+        if (!ok)
+            return false;
+    }
+
+    return true;
+}
+
 /*
  * Destructuring patterns can appear in two kinds of contexts:
  *
@@ -3072,84 +3158,14 @@ template <>
 bool
 Parser<FullParseHandler>::checkDestructuring(BindData<FullParseHandler> *data, ParseNode *left)
 {
-    bool ok;
-
     if (left->isKind(PNK_ARRAYCOMP)) {
         report(ParseError, false, left, JSMSG_ARRAY_COMP_LEFTSIDE);
         return false;
     }
 
-    Rooted<StaticBlockObject *> blockObj(context);
-    blockObj = data && data->binder == bindLet ? data->let.blockObj.get() : nullptr;
-
-    if (left->isKind(PNK_ARRAY)) {
-        for (ParseNode *element = left->pn_head; element; element = element->pn_next) {
-            if (!element->isKind(PNK_ELISION)) {
-                ParseNode *target = element;
-                if (target->isKind(PNK_SPREAD)) {
-                    if (target->pn_next) {
-                        report(ParseError, false, target->pn_next, JSMSG_PARAMETER_AFTER_REST);
-                        return false;
-                    }
-                    target = target->pn_kid;
-
-                    // The RestElement should not support nested patterns.
-                    if (target->isKind(PNK_ARRAY) || target->isKind(PNK_OBJECT)) {
-                        report(ParseError, false, target, JSMSG_BAD_DESTRUCT_TARGET);
-                        return false;
-                    }
-                }
-                if (target->isKind(PNK_ARRAY) || target->isKind(PNK_OBJECT)) {
-                    ok = checkDestructuring(data, target);
-                } else {
-                    if (data) {
-                        if (!target->isKind(PNK_NAME)) {
-                            report(ParseError, false, target, JSMSG_NO_VARIABLE_NAME);
-                            return false;
-                        }
-                        ok = bindDestructuringVar(data, target);
-                    } else {
-                        ok = checkAndMarkAsAssignmentLhs(target, KeyedDestructuringAssignment);
-                    }
-                }
-                if (!ok)
-                    return false;
-            }
-        }
-    } else {
-        JS_ASSERT(left->isKind(PNK_OBJECT));
-        for (ParseNode *member = left->pn_head; member; member = member->pn_next) {
-            MOZ_ASSERT(member->isKind(PNK_COLON) || member->isKind(PNK_SHORTHAND));
-            ParseNode *expr = member->pn_right;
-
-            if (expr->isKind(PNK_ARRAY) || expr->isKind(PNK_OBJECT)) {
-                ok = checkDestructuring(data, expr);
-            } else if (data) {
-                if (!expr->isKind(PNK_NAME)) {
-                    report(ParseError, false, expr, JSMSG_NO_VARIABLE_NAME);
-                    return false;
-                }
-                ok = bindDestructuringVar(data, expr);
-            } else {
-                /*
-                 * If this is a destructuring shorthand ({x} = ...), then
-                 * identifierName wasn't used to parse |x|.  As a result, |x|
-                 * hasn't been officially linked to its def or registered in
-                 * lexdeps.  Do that now.
-                 */
-                if (member->pn_right == member->pn_left) {
-                    RootedPropertyName name(context, expr->pn_atom->asPropertyName());
-                    if (!noteNameUse(name, expr))
-                        return false;
-                }
-                ok = checkAndMarkAsAssignmentLhs(expr, KeyedDestructuringAssignment);
-            }
-            if (!ok)
-                return false;
-        }
-    }
-
-    return true;
+    if (left->isKind(PNK_ARRAY))
+        return checkDestructuringArray(data, left);
+    return checkDestructuringObject(data, left);
 }
 
 template <>
@@ -6954,7 +6970,7 @@ typename ParseHandler::Node
 Parser<ParseHandler>::newRegExp()
 {
     // Create the regexp even when doing a syntax parse, to check the regexp's syntax.
-    const jschar *chars = tokenStream.getTokenbuf().begin();
+    const char16_t *chars = tokenStream.getTokenbuf().begin();
     size_t length = tokenStream.getTokenbuf().length();
     RegExpFlag flags = tokenStream.currentToken().regExpFlags();
 
@@ -7124,6 +7140,7 @@ Parser<ParseHandler>::objectLiteral()
     if (!literal)
         return null();
 
+    bool seenPrototypeMutation = false;
     RootedAtom atom(context);
     for (;;) {
         TokenKind ltok = tokenStream.getToken(TokenStream::KeywordIsName);
@@ -7136,6 +7153,8 @@ Parser<ParseHandler>::objectLiteral()
             ltok = tokenStream.getToken(TokenStream::KeywordIsName);
         }
 
+        atom = nullptr;
+
         JSOp op = JSOP_INITPROP;
         Node propname;
         switch (ltok) {
@@ -7247,29 +7266,43 @@ Parser<ParseHandler>::objectLiteral()
 
         if (op == JSOP_INITPROP) {
             TokenKind tt = tokenStream.getToken();
-            Node propexpr;
+            if (tt == TOK_ERROR)
+                return null();
+
             if (tt == TOK_COLON) {
                 if (isGenerator) {
                     report(ParseError, false, null(), JSMSG_BAD_PROP_ID);
                     return null();
                 }
-                propexpr = assignExpr();
+
+                Node propexpr = assignExpr();
                 if (!propexpr)
                     return null();
 
                 if (foldConstants && !FoldConstants(context, &propexpr, this))
                     return null();
 
-                /*
-                 * Treat initializers which mutate __proto__ as non-constant,
-                 * so that we can later assume singleton objects delegate to
-                 * the default Object.prototype.
-                 */
-                if (!handler.isConstant(propexpr) || atom == context->names().proto)
-                    handler.setListFlag(literal, PNX_NONCONST);
+                if (atom == context->names().proto) {
+                    if (seenPrototypeMutation) {
+                        report(ParseError, false, propname, JSMSG_DUPLICATE_PROPERTY, "__proto__");
+                        return null();
+                    }
+                    seenPrototypeMutation = true;
 
-                if (!handler.addPropertyDefinition(literal, propname, propexpr))
-                    return null();
+                    // Note: this occurs *only* if we observe TOK_COLON!  Only
+                    // __proto__: v mutates [[Prototype]].  Getters, setters,
+                    // method/generator definitions, computed property name
+                    // versions of all of these, and shorthands do not.
+                    uint32_t begin = handler.getPosition(propname).begin;
+                    if (!handler.addPrototypeMutation(literal, begin, propexpr))
+                        return null();
+                } else {
+                    if (!handler.isConstant(propexpr))
+                        handler.setListFlag(literal, PNX_NONCONST);
+
+                    if (!handler.addPropertyDefinition(literal, propname, propexpr))
+                        return null();
+                }
             } else if (ltok == TOK_NAME && (tt == TOK_COMMA || tt == TOK_RC)) {
                 /*
                  * Support, e.g., |var {x, y} = o| as destructuring shorthand
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index ed2a0c337f6..4cb51fa56c9 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -373,7 +373,7 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
                           ...);
 
     Parser(ExclusiveContext *cx, LifoAlloc *alloc, const ReadOnlyCompileOptions &options,
-           const jschar *chars, size_t length, bool foldConstants,
+           const char16_t *chars, size_t length, bool foldConstants,
            Parser<SyntaxParseHandler> *syntaxParser,
            LazyScript *lazyOuterFunction);
     ~Parser();
@@ -630,6 +630,8 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
 
     Node newBindingNode(PropertyName *name, bool functionScope, VarContext varContext = HoistVars);
     bool checkDestructuring(BindData<ParseHandler> *data, Node left);
+    bool checkDestructuringObject(BindData<ParseHandler> *data, Node objectPattern);
+    bool checkDestructuringArray(BindData<ParseHandler> *data, Node arrayPattern);
     bool bindDestructuringVar(BindData<ParseHandler> *data, Node pn);
     bool bindDestructuringLHS(Node pn);
     bool makeSetCall(Node pn, unsigned msg);
diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
index e475b59ebcf..40e8620c284 100644
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -285,7 +285,7 @@ TokenStream::SourceCoords::lineNumAndColumnIndex(uint32_t offset, uint32_t *line
 
 // Initialize members that aren't initialized in |init|.
 TokenStream::TokenStream(ExclusiveContext *cx, const ReadOnlyCompileOptions &options,
-                         const jschar *base, size_t length, StrictModeGetter *smg)
+                         const char16_t *base, size_t length, StrictModeGetter *smg)
   : srcCoords(cx, options.lineno),
     options_(options),
     tokens(),
@@ -389,7 +389,7 @@ TokenStream::getChar()
     if (MOZ_LIKELY(userbuf.hasRawChars())) {
         c = userbuf.getRawChar();
 
-        // Normalize the jschar if it was a newline.  We need to detect any of
+        // Normalize the char16_t if it was a newline.  We need to detect any of
         // these four characters:  '\n' (0x000a), '\r' (0x000d),
         // LINE_SEPARATOR (0x2028), PARA_SEPARATOR (0x2029).  Testing for each
         // one in turn is slow, so we use a single probabilistic check, and if
@@ -480,7 +480,7 @@ TokenStream::ungetCharIgnoreEOL(int32_t c)
 // are not consumed: use skipChars(n) to do so after checking that the consumed
 // characters had appropriate values.
 bool
-TokenStream::peekChars(int n, jschar *cp)
+TokenStream::peekChars(int n, char16_t *cp)
 {
     int i, j;
     int32_t c;
@@ -493,15 +493,15 @@ TokenStream::peekChars(int n, jschar *cp)
             ungetCharIgnoreEOL(c);
             break;
         }
-        cp[i] = jschar(c);
+        cp[i] = char16_t(c);
     }
     for (j = i - 1; j >= 0; j--)
         ungetCharIgnoreEOL(cp[j]);
     return i == n;
 }
 
-const jschar *
-TokenStream::TokenBuf::findEOLMax(const jschar *p, size_t max)
+const char16_t *
+TokenStream::TokenBuf::findEOLMax(const char16_t *p, size_t max)
 {
     JS_ASSERT(base_ <= p && p <= limit_);
 
@@ -521,7 +521,7 @@ TokenStream::TokenBuf::findEOLMax(const jschar *p, size_t max)
 void
 TokenStream::advance(size_t position)
 {
-    const jschar *end = userbuf.base() + position;
+    const char16_t *end = userbuf.base() + position;
     while (userbuf.addressOfNextRawChar() < end)
         getChar();
 
@@ -681,7 +681,7 @@ TokenStream::reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigne
     // means that any error involving a multi-line token (e.g. an unterminated
     // multi-line string literal) won't have a context printed.
     if (offset != NoOffset && err.report.lineno == lineno && !callerFilename) {
-        const jschar *tokenStart = userbuf.base() + offset;
+        const char16_t *tokenStart = userbuf.base() + offset;
 
         // We show only a portion (a "window") of the line around the erroneous
         // token -- the first char in the token, plus |windowRadius| chars
@@ -691,19 +691,19 @@ TokenStream::reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigne
         static const size_t windowRadius = 60;
 
         // Truncate at the front if necessary.
-        const jschar *windowBase = (linebase + windowRadius < tokenStart)
+        const char16_t *windowBase = (linebase + windowRadius < tokenStart)
                                  ? tokenStart - windowRadius
                                  : linebase;
         uint32_t windowOffset = tokenStart - windowBase;
 
         // Find EOL, or truncate at the back if necessary.
-        const jschar *windowLimit = userbuf.findEOLMax(tokenStart, windowRadius);
+        const char16_t *windowLimit = userbuf.findEOLMax(tokenStart, windowRadius);
         size_t windowLength = windowLimit - windowBase;
         JS_ASSERT(windowLength <= windowRadius * 2);
 
         // Create the windowed strings.
         StringBuffer windowBuf(cx);
-        if (!windowBuf.append(windowBase, windowLength) || !windowBuf.append((jschar)0))
+        if (!windowBuf.append(windowBase, windowLength) || !windowBuf.append((char16_t)0))
             return false;
 
         // Unicode and char versions of the window into the offending source
@@ -712,7 +712,7 @@ TokenStream::reportCompileErrorNumberVA(uint32_t offset, unsigned flags, unsigne
         if (!err.report.uclinebuf)
             return false;
 
-        mozilla::Range<const jschar> tbchars(err.report.uclinebuf, windowLength);
+        mozilla::Range<const char16_t> tbchars(err.report.uclinebuf, windowLength);
         err.report.linebuf = JS::LossyTwoByteCharsToNewLatin1CharsZ(cx, tbchars).c_str();
         if (!err.report.linebuf)
             return false;
@@ -785,7 +785,7 @@ TokenStream::reportAsmJSError(uint32_t offset, unsigned errorNumber, ...)
 bool
 TokenStream::peekUnicodeEscape(int *result)
 {
-    jschar cp[5];
+    char16_t cp[5];
 
     if (peekChars(5, cp) && cp[0] == 'u' &&
         JS7_ISHEX(cp[1]) && JS7_ISHEX(cp[2]) &&
@@ -823,7 +823,7 @@ TokenStream::matchUnicodeEscapeIdent(int32_t *cp)
 // Helper function which returns true if the first length(q) characters in p are
 // the same as the characters in q.
 static bool
-CharsMatch(const jschar *p, const char *q) {
+CharsMatch(const char16_t *p, const char *q) {
     while (*q) {
         if (*p++ != *q++)
             return false;
@@ -854,10 +854,10 @@ bool
 TokenStream::getDirective(bool isMultiline, bool shouldWarnDeprecated,
                           const char *directive, int directiveLength,
                           const char *errorMsgPragma,
-                          UniquePtr<jschar[], JS::FreePolicy> *destination)
+                          UniquePtr<char16_t[], JS::FreePolicy> *destination)
 {
     JS_ASSERT(directiveLength <= 18);
-    jschar peeked[18];
+    char16_t peeked[18];
     int32_t c;
 
     if (peekChars(directiveLength, peeked) && CharsMatch(peeked, directive)) {
@@ -887,7 +887,7 @@ TokenStream::getDirective(bool isMultiline, bool shouldWarnDeprecated,
 
         size_t length = tokenbuf.length();
 
-        *destination = cx->make_pod_array<jschar>(length + 1);
+        *destination = cx->make_pod_array<char16_t>(length + 1);
         if (!*destination)
             return false;
 
@@ -959,10 +959,10 @@ IsTokenSane(Token *tp)
 #endif
 
 bool
-TokenStream::putIdentInTokenbuf(const jschar *identStart)
+TokenStream::putIdentInTokenbuf(const char16_t *identStart)
 {
     int32_t c, qc;
-    const jschar *tmp = userbuf.addressOfNextRawChar();
+    const char16_t *tmp = userbuf.addressOfNextRawChar();
     userbuf.setAddressOfNextRawChar(identStart);
 
     tokenbuf.clear();
@@ -1010,7 +1010,7 @@ TokenStream::checkForKeyword(const KeywordInfo *kw, TokenKind *ttp)
 }
 
 bool
-TokenStream::checkForKeyword(const jschar *s, size_t length, TokenKind *ttp)
+TokenStream::checkForKeyword(const char16_t *s, size_t length, TokenKind *ttp)
 {
     const KeywordInfo *kw = FindKeyword(s, length);
     if (!kw)
@@ -1030,7 +1030,7 @@ TokenStream::checkForKeyword(JSAtom *atom, TokenKind *ttp)
 }
 
 enum FirstCharKind {
-    // A jschar has the 'OneChar' kind if it, by itself, constitutes a valid
+    // A char16_t has the 'OneChar' kind if it, by itself, constitutes a valid
     // token that cannot also be a prefix of a longer token.  E.g. ';' has the
     // OneChar kind, but '+' does not, because '++' and '+=' are valid longer tokens
     // that begin with '+'.
@@ -1040,7 +1040,7 @@ enum FirstCharKind {
     //
     // We represent the 'OneChar' kind with any positive value less than
     // TOK_LIMIT.  This representation lets us associate each one-char token
-    // jschar with a TokenKind and thus avoid a subsequent jschar-to-TokenKind
+    // char16_t with a TokenKind and thus avoid a subsequent char16_t-to-TokenKind
     // conversion.
     OneChar_Min = 0,
     OneChar_Max = TOK_LIMIT - 1,
@@ -1104,10 +1104,10 @@ TokenStream::getTokenInternal(Modifier modifier)
     int c, qc;
     Token *tp;
     FirstCharKind c1kind;
-    const jschar *numStart;
+    const char16_t *numStart;
     bool hasExp;
     DecimalPoint decimalPoint;
-    const jschar *identStart;
+    const char16_t *identStart;
     bool hadUnicodeEscape;
 
     // Check if in the middle of a template string. Have to get this out of
@@ -1212,7 +1212,7 @@ TokenStream::getTokenInternal(Modifier modifier)
         // Identifiers containing no Unicode escapes can be processed directly
         // from userbuf.  The rest must use the escapes converted via tokenbuf
         // before atomizing.
-        const jschar *chars;
+        const char16_t *chars;
         size_t length;
         if (hadUnicodeEscape) {
             if (!putIdentInTokenbuf(identStart))
@@ -1284,13 +1284,13 @@ TokenStream::getTokenInternal(Modifier modifier)
 
         // Unlike identifiers and strings, numbers cannot contain escaped
         // chars, so we don't need to use tokenbuf.  Instead we can just
-        // convert the jschars in userbuf directly to the numeric value.
+        // convert the char16_t characters in userbuf to the numeric value.
         double dval;
         if (!((decimalPoint == HasDecimal) || hasExp)) {
             if (!GetDecimalInteger(cx, numStart, userbuf.addressOfNextRawChar(), &dval))
                 goto error;
         } else {
-            const jschar *dummy;
+            const char16_t *dummy;
             if (!js_strtod(cx, numStart, userbuf.addressOfNextRawChar(), &dummy, &dval))
                 goto error;
         }
@@ -1390,7 +1390,7 @@ TokenStream::getTokenInternal(Modifier modifier)
         }
 
         double dval;
-        const jschar *dummy;
+        const char16_t *dummy;
         if (!GetPrefixInteger(cx, numStart, userbuf.addressOfNextRawChar(), radix, &dummy, &dval))
             goto error;
         tp->type = TOK_NUMBER;
@@ -1695,9 +1695,9 @@ bool TokenStream::getStringOrTemplateToken(int qc, Token **tp)
                             }
                         }
 
-                        c = jschar(val);
+                        c = char16_t(val);
                     } else if (c == 'u') {
-                        jschar cp[4];
+                        char16_t cp[4];
                         if (peekChars(4, cp) &&
                             JS7_ISHEX(cp[0]) && JS7_ISHEX(cp[1]) &&
                             JS7_ISHEX(cp[2]) && JS7_ISHEX(cp[3])) {
@@ -1711,7 +1711,7 @@ bool TokenStream::getStringOrTemplateToken(int qc, Token **tp)
                             return false;
                         }
                     } else if (c == 'x') {
-                        jschar cp[2];
+                        char16_t cp[2];
                         if (peekChars(2, cp) &&
                                 JS7_ISHEX(cp[0]) && JS7_ISHEX(cp[1])) {
                             c = (JS7_UNHEX(cp[0]) << 4) + JS7_UNHEX(cp[1]);
diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
index de4ccad5bb9..771e86d02f4 100644
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -202,7 +202,7 @@ class StrictModeGetter {
 
 // TokenStream is the lexical scanner for Javascript source text.
 //
-// It takes a buffer of jschars and linearly scans it into |Token|s.
+// It takes a buffer of char16_t characters and linearly scans it into |Token|s.
 // Internally the class uses a four element circular buffer |tokens| of
 // |Token|s. As an index for |tokens|, the member |cursor| points to the
 // current token.
@@ -254,10 +254,10 @@ class MOZ_STACK_CLASS TokenStream
     static const unsigned ntokensMask = ntokens - 1;
 
   public:
-    typedef Vector<jschar, 32> CharBuffer;
+    typedef Vector<char16_t, 32> CharBuffer;
 
     TokenStream(ExclusiveContext *cx, const ReadOnlyCompileOptions &options,
-                const jschar *base, size_t length, StrictModeGetter *smg);
+                const char16_t *base, size_t length, StrictModeGetter *smg);
 
     ~TokenStream();
 
@@ -312,8 +312,8 @@ class MOZ_STACK_CLASS TokenStream
     JSAtom *getRawTemplateStringAtom() {
         JS_ASSERT(currentToken().type == TOK_TEMPLATE_HEAD ||
                   currentToken().type == TOK_NO_SUBS_TEMPLATE);
-        const jschar *cur = userbuf.base() + currentToken().pos.begin + 1;
-        const jschar *end;
+        const char16_t *cur = userbuf.base() + currentToken().pos.begin + 1;
+        const char16_t *end;
         if (currentToken().type == TOK_TEMPLATE_HEAD) {
             // Of the form    |`...${|   or   |}...${|
             end = userbuf.base() + currentToken().pos.end - 2;
@@ -345,7 +345,7 @@ class MOZ_STACK_CLASS TokenStream
 
     void onError();
     static JSAtom *atomize(ExclusiveContext *cx, CharBuffer &cb);
-    bool putIdentInTokenbuf(const jschar *identStart);
+    bool putIdentInTokenbuf(const char16_t *identStart);
 
     struct Flags
     {
@@ -478,11 +478,11 @@ class MOZ_STACK_CLASS TokenStream
       private:
         Position(const Position&) MOZ_DELETE;
         friend class TokenStream;
-        const jschar *buf;
+        const char16_t *buf;
         Flags flags;
         unsigned lineno;
-        const jschar *linebase;
-        const jschar *prevLinebase;
+        const char16_t *linebase;
+        const char16_t *prevLinebase;
         Token currentToken;
         unsigned lookahead;
         Token lookaheadTokens[maxLookahead];
@@ -497,11 +497,11 @@ class MOZ_STACK_CLASS TokenStream
         return pos.buf - userbuf.base();
     }
 
-    const jschar *rawBase() const {
+    const char16_t *rawBase() const {
         return userbuf.base();
     }
 
-    const jschar *rawLimit() const {
+    const char16_t *rawLimit() const {
         return userbuf.limit();
     }
 
@@ -509,7 +509,7 @@ class MOZ_STACK_CLASS TokenStream
         return displayURL_ != nullptr;
     }
 
-    jschar *displayURL() {
+    char16_t *displayURL() {
         return displayURL_.get();
     }
 
@@ -517,7 +517,7 @@ class MOZ_STACK_CLASS TokenStream
         return sourceMapURL_ != nullptr;
     }
 
-    jschar *sourceMapURL() {
+    char16_t *sourceMapURL() {
         return sourceMapURL_.get();
     }
 
@@ -532,7 +532,7 @@ class MOZ_STACK_CLASS TokenStream
     // false. If ttp is non-null, return true with the keyword's TokenKind in
     // *ttp.
     bool checkForKeyword(const KeywordInfo *kw, TokenKind *ttp);
-    bool checkForKeyword(const jschar *s, size_t length, TokenKind *ttp);
+    bool checkForKeyword(const char16_t *s, size_t length, TokenKind *ttp);
     bool checkForKeyword(JSAtom *atom, TokenKind *ttp);
 
     // This class maps a userbuf offset (which is 0-indexed) to a line number
@@ -625,7 +625,7 @@ class MOZ_STACK_CLASS TokenStream
     // chars" refers to the lack of EOL sequence normalization.)
     class TokenBuf {
       public:
-        TokenBuf(ExclusiveContext *cx, const jschar *buf, size_t length)
+        TokenBuf(ExclusiveContext *cx, const char16_t *buf, size_t length)
           : base_(buf), limit_(buf + length), ptr(buf)
         { }
 
@@ -637,23 +637,23 @@ class MOZ_STACK_CLASS TokenStream
             return ptr == base_;
         }
 
-        const jschar *base() const {
+        const char16_t *base() const {
             return base_;
         }
 
-        const jschar *limit() const {
+        const char16_t *limit() const {
             return limit_;
         }
 
-        jschar getRawChar() {
+        char16_t getRawChar() {
             return *ptr++;      // this will nullptr-crash if poisoned
         }
 
-        jschar peekRawChar() const {
+        char16_t peekRawChar() const {
             return *ptr;        // this will nullptr-crash if poisoned
         }
 
-        bool matchRawChar(jschar c) {
+        bool matchRawChar(char16_t c) {
             if (*ptr == c) {    // this will nullptr-crash if poisoned
                 ptr++;
                 return true;
@@ -661,7 +661,7 @@ class MOZ_STACK_CLASS TokenStream
             return false;
         }
 
-        bool matchRawCharBackwards(jschar c) {
+        bool matchRawCharBackwards(char16_t c) {
             JS_ASSERT(ptr);     // make sure it hasn't been poisoned
             if (*(ptr - 1) == c) {
                 ptr--;
@@ -675,13 +675,13 @@ class MOZ_STACK_CLASS TokenStream
             ptr--;
         }
 
-        const jschar *addressOfNextRawChar(bool allowPoisoned = false) const {
+        const char16_t *addressOfNextRawChar(bool allowPoisoned = false) const {
             JS_ASSERT_IF(!allowPoisoned, ptr);     // make sure it hasn't been poisoned
             return ptr;
         }
 
         // Use this with caution!
-        void setAddressOfNextRawChar(const jschar *a, bool allowPoisoned = false) {
+        void setAddressOfNextRawChar(const char16_t *a, bool allowPoisoned = false) {
             JS_ASSERT_IF(!allowPoisoned, a);
             ptr = a;
         }
@@ -697,14 +697,14 @@ class MOZ_STACK_CLASS TokenStream
             return c == '\n' || c == '\r' || c == LINE_SEPARATOR || c == PARA_SEPARATOR;
         }
 
-        // Finds the next EOL, but stops once 'max' jschars have been scanned
-        // (*including* the starting jschar).
-        const jschar *findEOLMax(const jschar *p, size_t max);
+        // Finds the next EOL, but stops once 'max' characters have been scanned
+        // (*including* the starting char16_t).
+        const char16_t *findEOLMax(const char16_t *p, size_t max);
 
       private:
-        const jschar *base_;            // base of buffer
-        const jschar *limit_;           // limit for quick bounds check
-        const jschar *ptr;              // next char to get
+        const char16_t *base_;          // base of buffer
+        const char16_t *limit_;         // limit for quick bounds check
+        const char16_t *ptr;            // next char to get
     };
 
     TokenKind getTokenInternal(Modifier modifier);
@@ -719,13 +719,13 @@ class MOZ_STACK_CLASS TokenStream
     bool peekUnicodeEscape(int32_t *c);
     bool matchUnicodeEscapeIdStart(int32_t *c);
     bool matchUnicodeEscapeIdent(int32_t *c);
-    bool peekChars(int n, jschar *cp);
+    bool peekChars(int n, char16_t *cp);
 
     bool getDirectives(bool isMultiline, bool shouldWarnDeprecated);
     bool getDirective(bool isMultiline, bool shouldWarnDeprecated,
                       const char *directive, int directiveLength,
                       const char *errorMsgPragma,
-                      mozilla::UniquePtr<jschar[], JS::FreePolicy> *destination);
+                      mozilla::UniquePtr<char16_t[], JS::FreePolicy> *destination);
     bool getDisplayURL(bool isMultiline, bool shouldWarnDeprecated);
     bool getSourceMappingURL(bool isMultiline, bool shouldWarnDeprecated);
 
@@ -763,12 +763,12 @@ class MOZ_STACK_CLASS TokenStream
     unsigned            lookahead;          // count of lookahead tokens
     unsigned            lineno;             // current line number
     Flags               flags;              // flags -- see above
-    const jschar        *linebase;          // start of current line;  points into userbuf
-    const jschar        *prevLinebase;      // start of previous line;  nullptr if on the first line
+    const char16_t      *linebase;          // start of current line;  points into userbuf
+    const char16_t      *prevLinebase;      // start of previous line;  nullptr if on the first line
     TokenBuf            userbuf;            // user input buffer
     const char          *filename;          // input filename or null
-    mozilla::UniquePtr<jschar[], JS::FreePolicy> displayURL_; // the user's requested source URL or null
-    mozilla::UniquePtr<jschar[], JS::FreePolicy> sourceMapURL_; // source map's filename or null
+    mozilla::UniquePtr<char16_t[], JS::FreePolicy> displayURL_; // the user's requested source URL or null
+    mozilla::UniquePtr<char16_t[], JS::FreePolicy> sourceMapURL_; // source map's filename or null
     CharBuffer          tokenbuf;           // current token string buffer
     bool                maybeEOL[256];      // probabilistic EOL lookup table
     bool                maybeStrSpecial[256];   // speeds up string scanning
@@ -779,7 +779,7 @@ class MOZ_STACK_CLASS TokenStream
 };
 
 // Steal one JSREPORT_* bit (see jsapi.h) to tell that arguments to the error
-// message have const jschar* type, not const char*.
+// message have const char16_t* type, not const char*.
 #define JSREPORT_UC 0x100
 
 } // namespace frontend
diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 8bd0896a2db..fae6faa0a5f 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -124,13 +124,13 @@ class gcstats::StatisticsSerializer
         needComma_ = true;
     }
 
-    jschar *finishJSString() {
+    char16_t *finishJSString() {
         char *buf = finishCString();
         if (!buf)
             return nullptr;
 
         size_t nchars = strlen(buf);
-        jschar *out = js_pod_malloc<jschar>(nchars + 1);
+        char16_t *out = js_pod_malloc<char16_t>(nchars + 1);
         if (!out) {
             oom_ = true;
             js_free(buf);
@@ -424,7 +424,7 @@ Statistics::formatData(StatisticsSerializer &ss, uint64_t timestamp)
     return !ss.isOOM();
 }
 
-jschar *
+char16_t *
 Statistics::formatMessage()
 {
     StatisticsSerializer ss(StatisticsSerializer::AsText);
@@ -432,7 +432,7 @@ Statistics::formatMessage()
     return ss.finishJSString();
 }
 
-jschar *
+char16_t *
 Statistics::formatJSON(uint64_t timestamp)
 {
     StatisticsSerializer ss(StatisticsSerializer::AsJSON);
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 258119064d0..9002c9d061a 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -117,8 +117,8 @@ struct Statistics
     int64_t beginSCC();
     void endSCC(unsigned scc, int64_t start);
 
-    jschar *formatMessage();
-    jschar *formatJSON(uint64_t timestamp);
+    char16_t *formatMessage();
+    char16_t *formatJSON(uint64_t timestamp);
 
     JS::GCSliceCallback setSliceCallback(JS::GCSliceCallback callback);
 
diff --git a/js/src/gdb/README b/js/src/gdb/README
index 0fd959b47c3..80b671aa401 100644
--- a/js/src/gdb/README
+++ b/js/src/gdb/README
@@ -114,9 +114,9 @@ after importing our other SpiderMonkey support modules. For example:
     import gdb
     from mozilla.prettyprinters import ptr_pretty_printer
 
-    # Simple jschar * printer. Doesn't show address; chases null pointers.
-    @ptr_pretty_printer('jschar')
-    class jscharPtr(object):
+    # Simple char16_t * printer. Doesn't show address; chases null pointers.
+    @ptr_pretty_printer('char16_t')
+    class char16Ptr(object):
         def __init__(self, value, cache): self.value = value
         def display_hint(self): return 'string'
         def to_string(self):
@@ -128,7 +128,7 @@ after importing our other SpiderMonkey support modules. For example:
     $
     ...
     (gdb) whatis sample
-    type = jschar [4]
+    type = char16_t [4]
     (gdb) print &sample[0]
     $1 = "Hi!"
 
diff --git a/js/src/gdb/TODO b/js/src/gdb/TODO
index e82f610fee2..07186aa1085 100644
--- a/js/src/gdb/TODO
+++ b/js/src/gdb/TODO
@@ -1,5 +1,5 @@
 * Ideas:
-- jschar *
+- char16_t *
 - js::Shape, js::Baseshape
 - printers for structures with horrible unions (JSString, JSParseNode)
 - bring back parse_node.py
diff --git a/js/src/gdb/mozilla/JSString.py b/js/src/gdb/mozilla/JSString.py
index f79cd3c2782..2f4b3cfc602 100644
--- a/js/src/gdb/mozilla/JSString.py
+++ b/js/src/gdb/mozilla/JSString.py
@@ -34,15 +34,15 @@ class JSStringPtr(Common):
     def display_hint(self):
         return "string"
 
-    def jschars(self):
+    def chars(self):
         d = self.value['d']
         length = d['u1']['length']
         flags = d['u1']['flags']
         is_rope = ((flags & self.stc.TYPE_FLAGS_MASK) == self.stc.ROPE_FLAGS)
         if is_rope:
-            for c in JSStringPtr(d['s']['u2']['left'], self.cache).jschars():
+            for c in JSStringPtr(d['s']['u2']['left'], self.cache).chars():
                 yield c
-            for c in JSStringPtr(d['s']['u3']['right'], self.cache).jschars():
+            for c in JSStringPtr(d['s']['u3']['right'], self.cache).chars():
                 yield c
         else:
             is_inline = (flags & self.stc.INLINE_CHARS_BIT) != 0
@@ -62,7 +62,7 @@ class JSStringPtr(Common):
 
     def to_string(self):
         s = u''
-        for c in self.jschars():
+        for c in self.chars():
             s += chr(c)
         return s
 
diff --git a/js/src/irregexp/NativeRegExpMacroAssembler.cpp b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
index 45ca27d6279..636f2d205e2 100644
--- a/js/src/irregexp/NativeRegExpMacroAssembler.cpp
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.cpp
@@ -299,7 +299,7 @@ NativeRegExpMacroAssembler::GenerateCode(JSContext *cx)
                 masm.addPtr(inputByteLength, temp0);
 
                 // Convert byte index to character index.
-                if (mode_ == JSCHAR)
+                if (mode_ == CHAR16)
                     masm.rshiftPtrArithmetic(Imm32(1), temp0);
 
                 masm.store32(temp0, Address(outputRegisters, i * sizeof(int32_t)));
@@ -604,7 +604,7 @@ NativeRegExpMacroAssembler::CheckNotCharacterAfterAnd(unsigned c, unsigned and_w
 }
 
 void
-NativeRegExpMacroAssembler::CheckCharacterGT(jschar c, Label* on_greater)
+NativeRegExpMacroAssembler::CheckCharacterGT(char16_t c, Label* on_greater)
 {
     JitSpew(SPEW_PREFIX "CheckCharacterGT(%d)", (int) c);
     masm.branch32(Assembler::GreaterThan, current_character, Imm32(c),
@@ -612,7 +612,7 @@ NativeRegExpMacroAssembler::CheckCharacterGT(jschar c, Label* on_greater)
 }
 
 void
-NativeRegExpMacroAssembler::CheckCharacterLT(jschar c, Label* on_less)
+NativeRegExpMacroAssembler::CheckCharacterLT(char16_t c, Label* on_less)
 {
     JitSpew(SPEW_PREFIX "CheckCharacterLT(%d)", (int) c);
     masm.branch32(Assembler::LessThan, current_character, Imm32(c), BranchOrBacktrack(on_less));
@@ -671,7 +671,7 @@ NativeRegExpMacroAssembler::CheckNotBackReference(int start_reg, Label* on_no_ma
         masm.load8ZeroExtend(Address(current_character, 0), temp0);
         masm.load8ZeroExtend(Address(temp1, 0), temp2);
     } else {
-        JS_ASSERT(mode_ == JSCHAR);
+        JS_ASSERT(mode_ == CHAR16);
         masm.load16ZeroExtend(Address(current_character, 0), temp0);
         masm.load16ZeroExtend(Address(temp1, 0), temp2);
     }
@@ -793,7 +793,7 @@ NativeRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg, Label
         // Compute new value of character position after the matched part.
         masm.subPtr(input_end_pointer, current_position);
     } else {
-        JS_ASSERT(mode_ == JSCHAR);
+        JS_ASSERT(mode_ == CHAR16);
 
         // Note: temp1 needs to be saved/restored if it is volatile, as it is used after the call.
         GeneralRegisterSet volatileRegs = GeneralRegisterSet::Volatile();
@@ -818,7 +818,7 @@ NativeRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg, Label
         masm.passABIArg(current_character);
         masm.passABIArg(current_position);
         masm.passABIArg(temp1);
-        int (*fun)(const jschar*, const jschar*, size_t) = CaseInsensitiveCompareStrings;
+        int (*fun)(const char16_t*, const char16_t*, size_t) = CaseInsensitiveCompareStrings;
         masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, fun));
         masm.storeCallResult(temp0);
 
@@ -835,7 +835,7 @@ NativeRegExpMacroAssembler::CheckNotBackReferenceIgnoreCase(int start_reg, Label
 }
 
 void
-NativeRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(jschar c, jschar minus, jschar and_with,
+NativeRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
                                                            Label* on_not_equal)
 {
     JitSpew(SPEW_PREFIX "CheckNotCharacterAfterMinusAnd(%d, %d, %d)", (int) c,
@@ -852,7 +852,7 @@ NativeRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(jschar c, jschar minu
 }
 
 void
-NativeRegExpMacroAssembler::CheckCharacterInRange(jschar from, jschar to,
+NativeRegExpMacroAssembler::CheckCharacterInRange(char16_t from, char16_t to,
                                                   Label* on_in_range)
 {
     JitSpew(SPEW_PREFIX "CheckCharacterInRange(%d, %d)", (int) from, (int) to);
@@ -862,7 +862,7 @@ NativeRegExpMacroAssembler::CheckCharacterInRange(jschar from, jschar to,
 }
 
 void
-NativeRegExpMacroAssembler::CheckCharacterNotInRange(jschar from, jschar to,
+NativeRegExpMacroAssembler::CheckCharacterNotInRange(char16_t from, char16_t to,
                                                      Label* on_not_in_range)
 {
     JitSpew(SPEW_PREFIX "CheckCharacterNotInRange(%d, %d)", (int) from, (int) to);
@@ -952,9 +952,9 @@ NativeRegExpMacroAssembler::LoadCurrentCharacterUnchecked(int cp_offset, int cha
             masm.load8ZeroExtend(address, current_character);
         }
     } else {
-        JS_ASSERT(mode_ == JSCHAR);
+        JS_ASSERT(mode_ == CHAR16);
         JS_ASSERT(characters <= 2);
-        BaseIndex address(input_end_pointer, current_position, TimesOne, cp_offset * sizeof(jschar));
+        BaseIndex address(input_end_pointer, current_position, TimesOne, cp_offset * sizeof(char16_t));
         if (characters == 2)
             masm.load32(address, current_character);
         else
@@ -1199,7 +1199,7 @@ NativeRegExpMacroAssembler::JumpOrBacktrack(Label *to)
 }
 
 bool
-NativeRegExpMacroAssembler::CheckSpecialCharacterClass(jschar type, Label* on_no_match)
+NativeRegExpMacroAssembler::CheckSpecialCharacterClass(char16_t type, Label* on_no_match)
 {
     JitSpew(SPEW_PREFIX "CheckSpecialCharacterClass(%d)", (int) type);
 
@@ -1247,7 +1247,7 @@ NativeRegExpMacroAssembler::CheckSpecialCharacterClass(jschar type, Label* on_no
         // See if current character is '\n'^1 or '\r'^1, i.e., 0x0b or 0x0c
         masm.sub32(Imm32(0x0b), temp0);
         masm.branch32(Assembler::BelowOrEqual, temp0, Imm32(0x0c - 0x0b), branch);
-        if (mode_ == JSCHAR) {
+        if (mode_ == CHAR16) {
             // Compare original value to 0x2028 and 0x2029, using the already
             // computed (current_char ^ 0x01 - 0x0b). I.e., check for
             // 0x201d (0x2028 - 0x0b) or 0x201e.
@@ -1299,7 +1299,7 @@ NativeRegExpMacroAssembler::CheckSpecialCharacterClass(jschar type, Label* on_no
         } else {
             Label done;
             masm.branch32(Assembler::BelowOrEqual, temp0, Imm32(0x0c - 0x0b), &done);
-            JS_ASSERT(JSCHAR == mode_);
+            JS_ASSERT(CHAR16 == mode_);
 
             // Compare original value to 0x2028 and 0x2029, using the already
             // computed (current_char ^ 0x01 - 0x0b). I.e., check for
diff --git a/js/src/irregexp/NativeRegExpMacroAssembler.h b/js/src/irregexp/NativeRegExpMacroAssembler.h
index 50030c54cd5..d59d8bf2896 100644
--- a/js/src/irregexp/NativeRegExpMacroAssembler.h
+++ b/js/src/irregexp/NativeRegExpMacroAssembler.h
@@ -64,11 +64,11 @@ struct InputOutputData
 struct FrameData
 {
     // Copy of the input/output data's data.
-    jschar *inputStart;
+    char16_t *inputStart;
     size_t startIndex;
 
     // Pointer to the character before the input start.
-    jschar *inputStartMinusOne;
+    char16_t *inputStartMinusOne;
 
     // Copy of the input MatchPairs registers, may be modified by JIT code.
     int32_t *outputRegisters;
@@ -83,7 +83,7 @@ class MOZ_STACK_CLASS NativeRegExpMacroAssembler : public RegExpMacroAssembler
 {
   public:
     // Type of input string to generate code for.
-    enum Mode { ASCII = 1, JSCHAR = 2 };
+    enum Mode { ASCII = 1, CHAR16 = 2 };
 
     NativeRegExpMacroAssembler(LifoAlloc *alloc, RegExpShared *shared,
                                JSRuntime *rt, Mode mode, int registers_to_save);
@@ -99,24 +99,24 @@ class MOZ_STACK_CLASS NativeRegExpMacroAssembler : public RegExpMacroAssembler
     void CheckAtStart(jit::Label* on_at_start);
     void CheckCharacter(unsigned c, jit::Label* on_equal);
     void CheckCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_equal);
-    void CheckCharacterGT(jschar limit, jit::Label* on_greater);
-    void CheckCharacterLT(jschar limit, jit::Label* on_less);
+    void CheckCharacterGT(char16_t limit, jit::Label* on_greater);
+    void CheckCharacterLT(char16_t limit, jit::Label* on_less);
     void CheckGreedyLoop(jit::Label* on_tos_equals_current_position);
     void CheckNotAtStart(jit::Label* on_not_at_start);
     void CheckNotBackReference(int start_reg, jit::Label* on_no_match);
     void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match);
     void CheckNotCharacter(unsigned c, jit::Label* on_not_equal);
     void CheckNotCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_not_equal);
-    void CheckNotCharacterAfterMinusAnd(jschar c, jschar minus, jschar and_with,
+    void CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
                                         jit::Label* on_not_equal);
-    void CheckCharacterInRange(jschar from, jschar to,
+    void CheckCharacterInRange(char16_t from, char16_t to,
                                jit::Label* on_in_range);
-    void CheckCharacterNotInRange(jschar from, jschar to,
+    void CheckCharacterNotInRange(char16_t from, char16_t to,
                                   jit::Label* on_not_in_range);
     void CheckBitInTable(uint8_t *table, jit::Label* on_bit_set);
     void CheckPosition(int cp_offset, jit::Label* on_outside_input);
     void JumpOrBacktrack(jit::Label *to);
-    bool CheckSpecialCharacterClass(jschar type, jit::Label* on_no_match);
+    bool CheckSpecialCharacterClass(char16_t type, jit::Label* on_no_match);
     void Fail();
     void IfRegisterGE(int reg, int comparand, jit::Label* if_ge);
     void IfRegisterLT(int reg, int comparand, jit::Label* if_lt);
@@ -151,7 +151,7 @@ class MOZ_STACK_CLASS NativeRegExpMacroAssembler : public RegExpMacroAssembler
 
     // Byte size of chars in the string to match (decided by the Mode argument)
     inline int char_size() { return static_cast<int>(mode_); }
-    inline jit::Scale factor() { return mode_ == JSCHAR ? jit::TimesTwo : jit::TimesOne; }
+    inline jit::Scale factor() { return mode_ == CHAR16 ? jit::TimesTwo : jit::TimesOne; }
 
     jit::Label *BranchOrBacktrack(jit::Label *branch);
 
diff --git a/js/src/irregexp/RegExpAST.h b/js/src/irregexp/RegExpAST.h
index 02da1919de8..b219087760a 100644
--- a/js/src/irregexp/RegExpAST.h
+++ b/js/src/irregexp/RegExpAST.h
@@ -150,7 +150,7 @@ class RegExpAssertion : public RegExpTree {
 class CharacterSet
 {
   public:
-    explicit CharacterSet(jschar standard_set_type)
+    explicit CharacterSet(char16_t standard_set_type)
       : ranges_(nullptr),
         standard_set_type_(standard_set_type)
     {}
@@ -160,8 +160,8 @@ class CharacterSet
     {}
 
     CharacterRangeVector &ranges(LifoAlloc *alloc);
-    jschar standard_set_type() { return standard_set_type_; }
-    void set_standard_set_type(jschar special_set_type) {
+    char16_t standard_set_type() { return standard_set_type_; }
+    void set_standard_set_type(char16_t special_set_type) {
         standard_set_type_ = special_set_type;
     }
     bool is_standard() { return standard_set_type_ != 0; }
@@ -172,7 +172,7 @@ class CharacterSet
 
     // If non-zero, the value represents a standard set (e.g., all whitespace
     // characters) without having to expand the ranges.
-    jschar standard_set_type_;
+    char16_t standard_set_type_;
 };
 
 class RegExpCharacterClass : public RegExpTree
@@ -183,7 +183,7 @@ class RegExpCharacterClass : public RegExpTree
         is_negated_(is_negated)
     {}
 
-    explicit RegExpCharacterClass(jschar type)
+    explicit RegExpCharacterClass(char16_t type)
       : set_(type),
         is_negated_(false)
     {}
@@ -215,7 +215,7 @@ class RegExpCharacterClass : public RegExpTree
     // D : non-ASCII digit
     // . : non-unicode non-newline
     // * : All characters
-    jschar standard_type() { return set_.standard_set_type(); }
+    char16_t standard_type() { return set_.standard_set_type(); }
 
     CharacterRangeVector &ranges(LifoAlloc *alloc) { return set_.ranges(alloc); }
     bool is_negated() { return is_negated_; }
@@ -225,7 +225,7 @@ class RegExpCharacterClass : public RegExpTree
     bool is_negated_;
 };
 
-typedef Vector<jschar, 10, LifoAllocPolicy<Infallible> > CharacterVector;
+typedef Vector<char16_t, 10, LifoAllocPolicy<Infallible> > CharacterVector;
 
 class RegExpAtom : public RegExpTree
 {
diff --git a/js/src/irregexp/RegExpEngine.cpp b/js/src/irregexp/RegExpEngine.cpp
index d413439d964..7f9b21202f4 100644
--- a/js/src/irregexp/RegExpEngine.cpp
+++ b/js/src/irregexp/RegExpEngine.cpp
@@ -85,7 +85,7 @@ static const int kLineTerminatorRangeCount = ArrayLength(kLineTerminatorRanges);
 static const unsigned kMaxOneByteCharCode = 0xff;
 static const int kMaxUtf16CodeUnit = 0xffff;
 
-static jschar
+static char16_t
 MaximumCharacter(bool ascii)
 {
     return ascii ? kMaxOneByteCharCode : kMaxUtf16CodeUnit;
@@ -112,7 +112,7 @@ AddClassNegated(const int *elmv,
     JS_ASSERT(elmv[elmc] == 0x10000);
     JS_ASSERT(elmv[0] != 0x0000);
     JS_ASSERT(elmv[elmc-1] != kMaxUtf16CodeUnit);
-    jschar last = 0x0000;
+    char16_t last = 0x0000;
     for (int i = 0; i < elmc; i += 2) {
         JS_ASSERT(last <= elmv[i] - 1);
         JS_ASSERT(elmv[i] < elmv[i + 1]);
@@ -123,7 +123,7 @@ AddClassNegated(const int *elmv,
 }
 
 void
-CharacterRange::AddClassEscape(LifoAlloc *alloc, jschar type,
+CharacterRange::AddClassEscape(LifoAlloc *alloc, char16_t type,
 			       CharacterRangeVector *ranges)
 {
     switch (type) {
@@ -188,11 +188,11 @@ static const size_t kEcma262UnCanonicalizeMaxWidth = 4;
 // Returns the number of characters in the equivalence class, omitting those
 // that cannot occur in the source string if it is a one byte string.
 static int
-GetCaseIndependentLetters(jschar character,
+GetCaseIndependentLetters(char16_t character,
                           bool ascii_subject,
-                          jschar *letters)
+                          char16_t *letters)
 {
-    jschar choices[] = {
+    const char16_t choices[] = {
         character,
         unicode::ToLowerCase(character),
         unicode::ToUpperCase(character)
@@ -200,7 +200,7 @@ GetCaseIndependentLetters(jschar character,
 
     size_t count = 0;
     for (size_t i = 0; i < ArrayLength(choices); i++) {
-        jschar c = choices[i];
+        char16_t c = choices[i];
 
         // The standard requires that non-ASCII characters cannot have ASCII
         // character codes in their equivalence class, even though this
@@ -230,8 +230,8 @@ GetCaseIndependentLetters(jschar character,
     return count;
 }
 
-static jschar
-ConvertNonLatin1ToLatin1(jschar c)
+static char16_t
+ConvertNonLatin1ToLatin1(char16_t c)
 {
     JS_ASSERT(c > kMaxOneByteCharCode);
     switch (c) {
@@ -250,8 +250,8 @@ ConvertNonLatin1ToLatin1(jschar c)
 void
 CharacterRange::AddCaseEquivalents(bool is_ascii, CharacterRangeVector *ranges)
 {
-    jschar bottom = from();
-    jschar top = to();
+    char16_t bottom = from();
+    char16_t top = to();
 
     if (is_ascii && !RangeContainsLatin1Equivalents(*this)) {
         if (bottom > kMaxOneByteCharCode)
@@ -260,12 +260,12 @@ CharacterRange::AddCaseEquivalents(bool is_ascii, CharacterRangeVector *ranges)
             top = kMaxOneByteCharCode;
     }
 
-    for (jschar c = bottom;; c++) {
-        jschar chars[kEcma262UnCanonicalizeMaxWidth];
+    for (char16_t c = bottom;; c++) {
+        char16_t chars[kEcma262UnCanonicalizeMaxWidth];
         size_t length = GetCaseIndependentLetters(c, is_ascii, chars);
 
         for (size_t i = 0; i < length; i++) {
-            jschar other = chars[i];
+            char16_t other = chars[i];
             if (other == c)
                 continue;
 
@@ -418,8 +418,8 @@ InsertRangeInCanonicalList(CharacterRangeVector &list,
     // list[0..count] for the result. Returns the number of resulting
     // canonicalized ranges. Inserting a range may collapse existing ranges into
     // fewer ranges, so the return value can be anything in the range 1..count+1.
-    jschar from = insert.from();
-    jschar to = insert.to();
+    char16_t from = insert.from();
+    char16_t to = insert.to();
     int start_pos = 0;
     int end_pos = count;
     for (int i = count - 1; i >= 0; i--) {
@@ -725,7 +725,7 @@ TextNode::FilterASCII(int depth, bool ignore_case)
 
                 // Here, we need to check for characters whose upper and lower cases
                 // are outside the Latin-1 range.
-                jschar converted = ConvertNonLatin1ToLatin1(c);
+                char16_t converted = ConvertNonLatin1ToLatin1(c);
                 if (converted == 0) {
                     // Character is outside Latin-1 completely
                     return set_replacement(nullptr);
@@ -1726,7 +1726,7 @@ irregexp::CompilePattern(JSContext *cx, RegExpShared *shared, RegExpCompileData
     if (IsNativeRegExpEnabled(cx)) {
         NativeRegExpMacroAssembler::Mode mode =
             is_ascii ? NativeRegExpMacroAssembler::ASCII
-                     : NativeRegExpMacroAssembler::JSCHAR;
+                     : NativeRegExpMacroAssembler::CHAR16;
 
         ctx.emplace(cx, (jit::TempAllocator *) nullptr);
         native_assembler.emplace(&alloc, shared, cx->runtime(), mode, (data->capture_count + 1) * 2);
@@ -1778,7 +1778,7 @@ irregexp::ExecuteCode(JSContext *cx, jit::JitCode *codeBlock, const Latin1Char *
                       size_t length, MatchPairs *matches);
 
 template RegExpRunStatus
-irregexp::ExecuteCode(JSContext *cx, jit::JitCode *codeBlock, const jschar *chars, size_t start,
+irregexp::ExecuteCode(JSContext *cx, jit::JitCode *codeBlock, const char16_t *chars, size_t start,
                       size_t length, MatchPairs *matches);
 
 // -------------------------------------------------------------------
@@ -3217,8 +3217,8 @@ GenerateBranches(RegExpMacroAssembler* masm,
                  RangeBoundaryVector &ranges,
                  int start_index,
                  int end_index,
-                 jschar min_char,
-                 jschar max_char,
+                 char16_t min_char,
+                 char16_t max_char,
                  jit::Label* fall_through,
                  jit::Label* even_label,
                  jit::Label* odd_label)
@@ -3472,7 +3472,7 @@ EmitCharClass(LifoAlloc *alloc,
 }
 
 typedef bool EmitCharacterFunction(RegExpCompiler* compiler,
-                                   jschar c,
+                                   char16_t c,
                                    jit::Label* on_failure,
                                    int cp_offset,
                                    bool check,
@@ -3480,7 +3480,7 @@ typedef bool EmitCharacterFunction(RegExpCompiler* compiler,
 
 static inline bool
 EmitSimpleCharacter(RegExpCompiler* compiler,
-                    jschar c,
+                    char16_t c,
                     jit::Label* on_failure,
                     int cp_offset,
                     bool check,
@@ -3500,7 +3500,7 @@ EmitSimpleCharacter(RegExpCompiler* compiler,
 // independent matches.
 static inline bool
 EmitAtomNonLetter(RegExpCompiler* compiler,
-                  jschar c,
+                  char16_t c,
                   jit::Label* on_failure,
                   int cp_offset,
                   bool check,
@@ -3508,7 +3508,7 @@ EmitAtomNonLetter(RegExpCompiler* compiler,
 {
     RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
     bool ascii = compiler->ascii();
-    jschar chars[kEcma262UnCanonicalizeMaxWidth];
+    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
     int length = GetCaseIndependentLetters(c, ascii, chars);
     if (length < 1) {
         // This can't match.  Must be an ASCII subject and a non-ASCII character.
@@ -3534,35 +3534,35 @@ EmitAtomNonLetter(RegExpCompiler* compiler,
 static bool
 ShortCutEmitCharacterPair(RegExpMacroAssembler* macro_assembler,
                           bool ascii,
-                          jschar c1,
-                          jschar c2,
+                          char16_t c1,
+                          char16_t c2,
                           jit::Label* on_failure)
 {
-    jschar char_mask = MaximumCharacter(ascii);
+    char16_t char_mask = MaximumCharacter(ascii);
 
     JS_ASSERT(c1 != c2);
     if (c1 > c2) {
-        jschar tmp = c1;
+        char16_t tmp = c1;
         c1 = c2;
         c2 = tmp;
     }
 
-    jschar exor = c1 ^ c2;
+    char16_t exor = c1 ^ c2;
     // Check whether exor has only one bit set.
     if (((exor - 1) & exor) == 0) {
         // If c1 and c2 differ only by one bit.
-        jschar mask = char_mask ^ exor;
+        char16_t mask = char_mask ^ exor;
         macro_assembler->CheckNotCharacterAfterAnd(c1, mask, on_failure);
         return true;
     }
 
-    jschar diff = c2 - c1;
+    char16_t diff = c2 - c1;
     if (((diff - 1) & diff) == 0 && c1 >= diff) {
         // If the characters differ by 2^n but don't differ by one bit then
         // subtract the difference from the found character, then do the or
         // trick.  We avoid the theoretical case where negative numbers are
         // involved in order to simplify code generation.
-        jschar mask = char_mask ^ diff;
+        char16_t mask = char_mask ^ diff;
         macro_assembler->CheckNotCharacterAfterMinusAnd(c1 - diff,
                                                         diff,
                                                         mask,
@@ -3576,7 +3576,7 @@ ShortCutEmitCharacterPair(RegExpMacroAssembler* macro_assembler,
 // matches.
 static inline bool
 EmitAtomLetter(RegExpCompiler* compiler,
-               jschar c,
+               char16_t c,
                jit::Label* on_failure,
                int cp_offset,
                bool check,
@@ -3584,7 +3584,7 @@ EmitAtomLetter(RegExpCompiler* compiler,
 {
     RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
     bool ascii = compiler->ascii();
-    jschar chars[kEcma262UnCanonicalizeMaxWidth];
+    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
     int length = GetCaseIndependentLetters(c, ascii, chars);
     if (length <= 1) return false;
     // We may not need to check against the end of the input string
@@ -4591,9 +4591,9 @@ TextNode::FillInBMInfo(int initial_offset,
                         set_bm_info(not_at_start, bm);
                     return true;
                 }
-                jschar character = atom->data()[j];
+                char16_t character = atom->data()[j];
                 if (bm->compiler()->ignore_case()) {
-                    jschar chars[kEcma262UnCanonicalizeMaxWidth];
+                    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
                     int length = GetCaseIndependentLetters(character,
                                                            bm->max_char() == kMaxOneByteCharCode,
                                                            chars);
@@ -4675,7 +4675,7 @@ TextNode::GetQuickCheckDetails(QuickCheckDetails* details,
             for (size_t i = 0; i < (size_t) characters && i < quarks.length(); i++) {
                 QuickCheckDetails::Position* pos =
                     details->positions(characters_filled_in);
-                jschar c = quarks[i];
+                char16_t c = quarks[i];
                 if (c > char_mask) {
                     // If we expect a non-ASCII character from an ASCII string,
                     // there is no way we can match. Not even case independent
@@ -4686,7 +4686,7 @@ TextNode::GetQuickCheckDetails(QuickCheckDetails* details,
                     return;
                 }
                 if (compiler->ignore_case()) {
-                    jschar chars[kEcma262UnCanonicalizeMaxWidth];
+                    char16_t chars[kEcma262UnCanonicalizeMaxWidth];
                     size_t length = GetCaseIndependentLetters(c, compiler->ascii(), chars);
                     JS_ASSERT(length != 0);  // Can only happen if c > char_mask (see above).
                     if (length == 1) {
@@ -4752,8 +4752,8 @@ TextNode::GetQuickCheckDetails(QuickCheckDetails* details,
                     }
                 }
                 CharacterRange range = ranges[first_range];
-                jschar from = range.from();
-                jschar to = range.to();
+                char16_t from = range.from();
+                char16_t to = range.to();
                 if (to > char_mask) {
                     to = char_mask;
                 }
@@ -4768,8 +4768,8 @@ TextNode::GetQuickCheckDetails(QuickCheckDetails* details,
                 uint32_t bits = (from & common_bits);
                 for (size_t i = first_range + 1; i < ranges.length(); i++) {
                     CharacterRange range = ranges[i];
-                    jschar from = range.from();
-                    jschar to = range.to();
+                    char16_t from = range.from();
+                    char16_t to = range.to();
                     if (from > char_mask) continue;
                     if (to > char_mask) to = char_mask;
                     // Here we are combining more ranges into the mask and compare
@@ -4880,7 +4880,7 @@ void QuickCheckDetails::Merge(QuickCheckDetails* other, int from_index)
         pos->mask &= other_pos->mask;
         pos->value &= pos->mask;
         other_pos->value &= pos->mask;
-        jschar differing_bits = (pos->value ^ other_pos->value);
+        char16_t differing_bits = (pos->value ^ other_pos->value);
         pos->mask &= ~differing_bits;
         pos->value &= pos->mask;
     }
diff --git a/js/src/irregexp/RegExpEngine.h b/js/src/irregexp/RegExpEngine.h
index 1e41e3aa42c..334d801649c 100644
--- a/js/src/irregexp/RegExpEngine.h
+++ b/js/src/irregexp/RegExpEngine.h
@@ -139,29 +139,29 @@ class CharacterRange
       : from_(0), to_(0)
     {}
 
-    CharacterRange(jschar from, jschar to)
+    CharacterRange(char16_t from, char16_t to)
       : from_(from), to_(to)
     {}
 
-    static void AddClassEscape(LifoAlloc *alloc, jschar type, CharacterRangeVector *ranges);
+    static void AddClassEscape(LifoAlloc *alloc, char16_t type, CharacterRangeVector *ranges);
 
-    static inline CharacterRange Singleton(jschar value) {
+    static inline CharacterRange Singleton(char16_t value) {
         return CharacterRange(value, value);
     }
-    static inline CharacterRange Range(jschar from, jschar to) {
+    static inline CharacterRange Range(char16_t from, char16_t to) {
         JS_ASSERT(from <= to);
         return CharacterRange(from, to);
     }
     static inline CharacterRange Everything() {
         return CharacterRange(0, 0xFFFF);
     }
-    bool Contains(jschar i) { return from_ <= i && i <= to_; }
-    jschar from() const { return from_; }
-    void set_from(jschar value) { from_ = value; }
-    jschar to() const { return to_; }
-    void set_to(jschar value) { to_ = value; }
+    bool Contains(char16_t i) { return from_ <= i && i <= to_; }
+    char16_t from() const { return from_; }
+    void set_from(char16_t value) { from_ = value; }
+    char16_t to() const { return to_; }
+    void set_to(char16_t value) { to_ = value; }
     bool is_valid() { return from_ <= to_; }
-    bool IsEverything(jschar max) { return from_ == 0 && to_ >= max; }
+    bool IsEverything(char16_t max) { return from_ == 0 && to_ >= max; }
     bool IsSingleton() { return (from_ == to_); }
     void AddCaseEquivalents(bool is_ascii, CharacterRangeVector *ranges);
 
@@ -190,8 +190,8 @@ class CharacterRange
     static const int kPayloadMask = (1 << 24) - 1;
 
   private:
-    jschar from_;
-    jschar to_;
+    char16_t from_;
+    char16_t to_;
 };
 
 // A set of unsigned integers that behaves especially well on small
@@ -247,25 +247,25 @@ class DispatchTable
           : from_(0), to_(0), out_set_(nullptr)
         {}
 
-        Entry(jschar from, jschar to, OutSet* out_set)
+        Entry(char16_t from, char16_t to, OutSet* out_set)
           : from_(from), to_(to), out_set_(out_set)
         {}
 
-        jschar from() { return from_; }
-        jschar to() { return to_; }
-        void set_to(jschar value) { to_ = value; }
+        char16_t from() { return from_; }
+        char16_t to() { return to_; }
+        void set_to(char16_t value) { to_ = value; }
         void AddValue(LifoAlloc *alloc, int value) {
             out_set_ = out_set_->Extend(alloc, value);
         }
         OutSet* out_set() { return out_set_; }
       private:
-        jschar from_;
-        jschar to_;
+        char16_t from_;
+        char16_t to_;
         OutSet* out_set_;
     };
 
     void AddRange(LifoAlloc *alloc, CharacterRange range, int value);
-    OutSet* Get(jschar value);
+    OutSet* Get(char16_t value);
     void Dump();
 
   private:
@@ -422,8 +422,8 @@ class QuickCheckDetails
 
     struct Position {
         Position() : mask(0), value(0), determines_perfectly(false) { }
-        jschar mask;
-        jschar value;
+        char16_t mask;
+        char16_t value;
         bool determines_perfectly;
     };
 
diff --git a/js/src/irregexp/RegExpInterpreter.cpp b/js/src/irregexp/RegExpInterpreter.cpp
index ee36e00f7f4..fadc7669eee 100644
--- a/js/src/irregexp/RegExpInterpreter.cpp
+++ b/js/src/irregexp/RegExpInterpreter.cpp
@@ -234,8 +234,8 @@ irregexp::InterpretCode(JSContext *cx, const uint8_t *byteCode, const CharT *cha
           }
           BYTECODE(LOAD_2_CURRENT_CHARS_UNCHECKED) {
             int pos = current + (insn >> BYTECODE_SHIFT);
-            jschar next = chars[pos + 1];
-            current_char = (chars[pos] | (next << (kBitsPerByte * sizeof(jschar))));
+            char16_t next = chars[pos + 1];
+            current_char = (chars[pos] | (next << (kBitsPerByte * sizeof(char16_t))));
             pc += BC_LOAD_2_CURRENT_CHARS_UNCHECKED_LENGTH;
             break;
           }
@@ -460,5 +460,5 @@ irregexp::InterpretCode(JSContext *cx, const uint8_t *byteCode, const Latin1Char
                         size_t length, MatchPairs *matches);
 
 template RegExpRunStatus
-irregexp::InterpretCode(JSContext *cx, const uint8_t *byteCode, const jschar *chars, size_t current,
+irregexp::InterpretCode(JSContext *cx, const uint8_t *byteCode, const char16_t *chars, size_t current,
                         size_t length, MatchPairs *matches);
diff --git a/js/src/irregexp/RegExpMacroAssembler.cpp b/js/src/irregexp/RegExpMacroAssembler.cpp
index 32d6da9ffd8..37646e75fc2 100644
--- a/js/src/irregexp/RegExpMacroAssembler.cpp
+++ b/js/src/irregexp/RegExpMacroAssembler.cpp
@@ -44,8 +44,8 @@ irregexp::CaseInsensitiveCompareStrings(const CharT *substring1, const CharT *su
     size_t length = byteLength / sizeof(CharT);
 
     for (size_t i = 0; i < length; i++) {
-        jschar c1 = substring1[i];
-        jschar c2 = substring2[i];
+        char16_t c1 = substring1[i];
+        char16_t c2 = substring2[i];
         if (c1 != c2) {
             c1 = unicode::ToLowerCase(c1);
             c2 = unicode::ToLowerCase(c2);
@@ -62,7 +62,7 @@ irregexp::CaseInsensitiveCompareStrings(const Latin1Char *substring1, const Lati
 					size_t byteLength);
 
 template int
-irregexp::CaseInsensitiveCompareStrings(const jschar *substring1, const jschar *substring2,
+irregexp::CaseInsensitiveCompareStrings(const char16_t *substring1, const char16_t *substring2,
 					size_t byteLength);
 
 InterpretedRegExpMacroAssembler::InterpretedRegExpMacroAssembler(LifoAlloc *alloc, RegExpShared *shared,
@@ -173,14 +173,14 @@ InterpretedRegExpMacroAssembler::CheckCharacterAfterAnd(unsigned c, unsigned and
 }
 
 void
-InterpretedRegExpMacroAssembler::CheckCharacterGT(jschar limit, jit::Label* on_greater)
+InterpretedRegExpMacroAssembler::CheckCharacterGT(char16_t limit, jit::Label* on_greater)
 {
     Emit(BC_CHECK_GT, limit);
     EmitOrLink(on_greater);
 }
 
 void
-InterpretedRegExpMacroAssembler::CheckCharacterLT(jschar limit, jit::Label* on_less)
+InterpretedRegExpMacroAssembler::CheckCharacterLT(char16_t limit, jit::Label* on_less)
 {
     Emit(BC_CHECK_LT, limit);
     EmitOrLink(on_less);
@@ -245,7 +245,7 @@ InterpretedRegExpMacroAssembler::CheckNotCharacterAfterAnd(unsigned c, unsigned
 }
 
 void
-InterpretedRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(jschar c, jschar minus, jschar and_with,
+InterpretedRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
                                                                 jit::Label* on_not_equal)
 {
     Emit(BC_MINUS_AND_CHECK_NOT_CHAR, c);
@@ -255,7 +255,7 @@ InterpretedRegExpMacroAssembler::CheckNotCharacterAfterMinusAnd(jschar c, jschar
 }
 
 void
-InterpretedRegExpMacroAssembler::CheckCharacterInRange(jschar from, jschar to,
+InterpretedRegExpMacroAssembler::CheckCharacterInRange(char16_t from, char16_t to,
                                                        jit::Label* on_in_range)
 {
     Emit(BC_CHECK_CHAR_IN_RANGE, 0);
@@ -265,7 +265,7 @@ InterpretedRegExpMacroAssembler::CheckCharacterInRange(jschar from, jschar to,
 }
 
 void
-InterpretedRegExpMacroAssembler::CheckCharacterNotInRange(jschar from, jschar to,
+InterpretedRegExpMacroAssembler::CheckCharacterNotInRange(char16_t from, char16_t to,
                                                           jit::Label* on_not_in_range)
 {
     Emit(BC_CHECK_CHAR_NOT_IN_RANGE, 0);
diff --git a/js/src/irregexp/RegExpMacroAssembler.h b/js/src/irregexp/RegExpMacroAssembler.h
index bb4607083e0..09292b0348e 100644
--- a/js/src/irregexp/RegExpMacroAssembler.h
+++ b/js/src/irregexp/RegExpMacroAssembler.h
@@ -107,8 +107,8 @@ class MOZ_STACK_CLASS RegExpMacroAssembler
     // check for a match with c.
     virtual void CheckCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_equal) = 0;
 
-    virtual void CheckCharacterGT(jschar limit, jit::Label* on_greater) = 0;
-    virtual void CheckCharacterLT(jschar limit, jit::Label* on_less) = 0;
+    virtual void CheckCharacterGT(char16_t limit, jit::Label* on_greater) = 0;
+    virtual void CheckCharacterLT(char16_t limit, jit::Label* on_less) = 0;
     virtual void CheckGreedyLoop(jit::Label* on_tos_equals_current_position) = 0;
     virtual void CheckNotAtStart(jit::Label* on_not_at_start) = 0;
     virtual void CheckNotBackReference(int start_reg, jit::Label* on_no_match) = 0;
@@ -123,15 +123,15 @@ class MOZ_STACK_CLASS RegExpMacroAssembler
 
     // Subtract a constant from the current character, then and with the given
     // constant and then check for a match with c.
-    virtual void CheckNotCharacterAfterMinusAnd(jschar c,
-                                        jschar minus,
-                                        jschar and_with,
+    virtual void CheckNotCharacterAfterMinusAnd(char16_t c,
+                                        char16_t minus,
+                                        char16_t and_with,
                                         jit::Label* on_not_equal) = 0;
 
-    virtual void CheckCharacterInRange(jschar from, jschar to,  // Both inclusive.
+    virtual void CheckCharacterInRange(char16_t from, char16_t to,  // Both inclusive.
                                jit::Label* on_in_range) = 0;
 
-    virtual void CheckCharacterNotInRange(jschar from, jschar to,  // Both inclusive.
+    virtual void CheckCharacterNotInRange(char16_t from, char16_t to,  // Both inclusive.
                                   jit::Label* on_not_in_range) = 0;
 
     // The current character (modulus the kTableSize) is looked up in the byte
@@ -151,7 +151,7 @@ class MOZ_STACK_CLASS RegExpMacroAssembler
     // character. Returns false if the type of special character class does
     // not have custom support.
     // May clobber the current loaded character.
-    virtual bool CheckSpecialCharacterClass(jschar type, jit::Label* on_no_match) {
+    virtual bool CheckSpecialCharacterClass(char16_t type, jit::Label* on_no_match) {
         return false;
     }
 
@@ -236,19 +236,19 @@ class MOZ_STACK_CLASS InterpretedRegExpMacroAssembler : public RegExpMacroAssemb
     void CheckAtStart(jit::Label* on_at_start);
     void CheckCharacter(unsigned c, jit::Label* on_equal);
     void CheckCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_equal);
-    void CheckCharacterGT(jschar limit, jit::Label* on_greater);
-    void CheckCharacterLT(jschar limit, jit::Label* on_less);
+    void CheckCharacterGT(char16_t limit, jit::Label* on_greater);
+    void CheckCharacterLT(char16_t limit, jit::Label* on_less);
     void CheckGreedyLoop(jit::Label* on_tos_equals_current_position);
     void CheckNotAtStart(jit::Label* on_not_at_start);
     void CheckNotBackReference(int start_reg, jit::Label* on_no_match);
     void CheckNotBackReferenceIgnoreCase(int start_reg, jit::Label* on_no_match);
     void CheckNotCharacter(unsigned c, jit::Label* on_not_equal);
     void CheckNotCharacterAfterAnd(unsigned c, unsigned and_with, jit::Label* on_not_equal);
-    void CheckNotCharacterAfterMinusAnd(jschar c, jschar minus, jschar and_with,
+    void CheckNotCharacterAfterMinusAnd(char16_t c, char16_t minus, char16_t and_with,
                                         jit::Label* on_not_equal);
-    void CheckCharacterInRange(jschar from, jschar to,
+    void CheckCharacterInRange(char16_t from, char16_t to,
                                jit::Label* on_in_range);
-    void CheckCharacterNotInRange(jschar from, jschar to,
+    void CheckCharacterNotInRange(char16_t from, char16_t to,
                                   jit::Label* on_not_in_range);
     void CheckBitInTable(uint8_t *table, jit::Label* on_bit_set);
     void JumpOrBacktrack(jit::Label *to);
diff --git a/js/src/irregexp/RegExpParser.cpp b/js/src/irregexp/RegExpParser.cpp
index 00b59e9d897..bd5fff7b987 100644
--- a/js/src/irregexp/RegExpParser.cpp
+++ b/js/src/irregexp/RegExpParser.cpp
@@ -76,7 +76,7 @@ RegExpBuilder::FlushText()
 }
 
 void
-RegExpBuilder::AddCharacter(jschar c)
+RegExpBuilder::AddCharacter(char16_t c)
 {
     pending_empty_ = false;
     if (characters_ == nullptr)
@@ -397,7 +397,7 @@ RegExpParser<CharT>::ParseClassCharacterEscape()
     return 0;
 }
 
-static const jschar kNoCharClass = 0;
+static const char16_t kNoCharClass = 0;
 
 // Adds range or pre-defined character class to character ranges.
 // If char_class is not kInvalidClass, it's interpreted as a class
@@ -405,7 +405,7 @@ static const jschar kNoCharClass = 0;
 static inline void
 AddRangeOrEscape(LifoAlloc *alloc,
                  CharacterRangeVector *ranges,
-                 jschar char_class,
+                 char16_t char_class,
                  CharacterRange range)
 {
     if (char_class != kNoCharClass)
@@ -427,7 +427,7 @@ RegExpParser<CharT>::ParseCharacterClass()
     }
     CharacterRangeVector *ranges = alloc->newInfallible<CharacterRangeVector>(*alloc);
     while (has_more() && current() != ']') {
-        jschar char_class = kNoCharClass;
+        char16_t char_class = kNoCharClass;
         CharacterRange first;
         if (!ParseClassAtom(&char_class, &first))
             return nullptr;
@@ -442,7 +442,7 @@ RegExpParser<CharT>::ParseCharacterClass()
                 ranges->append(CharacterRange::Singleton('-'));
                 break;
             }
-            jschar char_class_2 = kNoCharClass;
+            char16_t char_class_2 = kNoCharClass;
             CharacterRange next;
             if (!ParseClassAtom(&char_class_2, &next))
                 return nullptr;
@@ -472,7 +472,7 @@ RegExpParser<CharT>::ParseCharacterClass()
 
 template <typename CharT>
 bool
-RegExpParser<CharT>::ParseClassAtom(jschar* char_class, CharacterRange *char_range)
+RegExpParser<CharT>::ParseClassAtom(char16_t* char_class, CharacterRange *char_range)
 {
     JS_ASSERT(*char_class == kNoCharClass);
     widechar first = current();
@@ -997,7 +997,7 @@ RegExpParser<CharT>::ParseDisjunction()
 }
 
 template class irregexp::RegExpParser<Latin1Char>;
-template class irregexp::RegExpParser<jschar>;
+template class irregexp::RegExpParser<char16_t>;
 
 template <typename CharT>
 static bool
diff --git a/js/src/irregexp/RegExpParser.h b/js/src/irregexp/RegExpParser.h
index a38763dad1b..0069a84ee26 100644
--- a/js/src/irregexp/RegExpParser.h
+++ b/js/src/irregexp/RegExpParser.h
@@ -137,7 +137,7 @@ class RegExpBuilder
 {
   public:
     explicit RegExpBuilder(LifoAlloc *alloc);
-    void AddCharacter(jschar character);
+    void AddCharacter(char16_t character);
     // "Adds" an empty expression. Does nothing except consume a
     // following quantifier
     void AddEmpty();
@@ -165,7 +165,7 @@ class RegExpBuilder
     mozilla::DebugOnly<LastAdded> last_added_;
 };
 
-// Characters parsed by RegExpParser can be either jschars or kEndMarker.
+// Characters parsed by RegExpParser can be either char16_t or kEndMarker.
 typedef uint32_t widechar;
 
 template <typename CharT>
@@ -200,7 +200,7 @@ class RegExpParser
     // can be reparsed.
     bool ParseBackReferenceIndex(int* index_out);
 
-    bool ParseClassAtom(jschar* char_class, CharacterRange *char_range);
+    bool ParseClassAtom(char16_t* char_class, CharacterRange *char_range);
     RegExpTree* ReportError(unsigned errorNumber);
     void Advance();
     void Advance(int dist) {
diff --git a/js/src/jit-test/tests/asm.js/testDebugModeDisables.js b/js/src/jit-test/tests/asm.js/testDebugModeDisables.js
index 127decca4b3..56b1c4dde69 100644
--- a/js/src/jit-test/tests/asm.js/testDebugModeDisables.js
+++ b/js/src/jit-test/tests/asm.js/testDebugModeDisables.js
@@ -1,5 +1,9 @@
-// |jit-test| debug
+// |jit-test|
 
 load(libdir + "asm.js");
 
+// Turn on debugging for the current global.
+var g = newGlobal();
+var dbg = new g.Debugger(this);
+
 assertAsmTypeFail("'use asm'; function f() {} return f");
diff --git a/js/src/jit-test/tests/auto-regress/bug765483.js b/js/src/jit-test/tests/auto-regress/bug765483.js
index 8f1b6809845..9ab46750e9b 100644
--- a/js/src/jit-test/tests/auto-regress/bug765483.js
+++ b/js/src/jit-test/tests/auto-regress/bug765483.js
@@ -1,9 +1,12 @@
-// |jit-test| debug; error:ReferenceError;
+// |jit-test| error:ReferenceError;
 
 // Binary: cache/js-dbg-64-de23a9fc29db-linux
 // Flags: --ion-eager
 //
 
+var g = newGlobal();
+var dbg = new g.Debugger(this);
+
 var obj1 = {}, obj2 = {};
 obj2['b'+i] = 0;
 for (var k in obj2) {
diff --git a/js/src/jit-test/tests/baseline/bug836742.js b/js/src/jit-test/tests/baseline/bug836742.js
index 9132c29ef10..d2f1d68ac3e 100644
--- a/js/src/jit-test/tests/baseline/bug836742.js
+++ b/js/src/jit-test/tests/baseline/bug836742.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Ensure the correct frame is passed to exception unwind hooks.
 var g = newGlobal();
 g.debuggeeGlobal = this;
diff --git a/js/src/jit-test/tests/basic/__proto__-not-prototype-mutation.js b/js/src/jit-test/tests/basic/__proto__-not-prototype-mutation.js
new file mode 100644
index 00000000000..5754b263196
--- /dev/null
+++ b/js/src/jit-test/tests/basic/__proto__-not-prototype-mutation.js
@@ -0,0 +1,25 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var __proto__ = "string value";
+
+var propdefs =
+  [{ c: "['__proto__']: null", t: "object" },
+   { c: "__proto__() {}", t: "function" },
+   { c: "['__proto__']() {}", t: "function" },
+   { c: "*__proto__() {}", t: "function" },
+   { c: "*['__proto__']() {}", t: "function" },
+   { c: "__proto__", t: "string" },
+   { c: "get __proto__() { return 42; }", t: "number" },
+   { c: "get ['__proto__']() { return undefined; }", t: "undefined" },
+   { c: "set __proto__(v) { }", t: "undefined" },
+   { c: "set ['__proto__'](v) { }", t: "undefined" }];
+
+for (var propdef of propdefs)
+{
+  var f = new Function("return { " + propdef.c + " };");
+  for (var i = 0; i < 100; i++)
+    assertEq(typeof f().__proto__, propdef.t);
+}
diff --git a/js/src/jit-test/tests/basic/bug646968-7.js b/js/src/jit-test/tests/basic/bug646968-7.js
index f2451fa831d..e41d1c9f06b 100644
--- a/js/src/jit-test/tests/basic/bug646968-7.js
+++ b/js/src/jit-test/tests/basic/bug646968-7.js
@@ -1,4 +1,5 @@
-// |jit-test| debug
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 function test(s) {
     eval(s);
diff --git a/js/src/jit-test/tests/basic/bug646968-8.js b/js/src/jit-test/tests/basic/bug646968-8.js
index d242b845752..5297014d472 100644
--- a/js/src/jit-test/tests/basic/bug646968-8.js
+++ b/js/src/jit-test/tests/basic/bug646968-8.js
@@ -1,4 +1,5 @@
-// |jit-test| debug
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 var x = 5;
 let (x = eval("x++")) {
diff --git a/js/src/jit-test/tests/basic/bug674776.js b/js/src/jit-test/tests/basic/bug674776.js
index 539d0363eb1..816cfc5349a 100644
--- a/js/src/jit-test/tests/basic/bug674776.js
+++ b/js/src/jit-test/tests/basic/bug674776.js
@@ -1,4 +1,4 @@
-// |jit-test| slow; debug
+// |jit-test| slow
 
 /* Make a lot of functions of the form:
 function x1(){x1();}
@@ -7,6 +7,9 @@ function x3(){x3();}
 ...
 */
 
+var g = newGlobal();
+var dbg = new g.Debugger(this);
+
 var s = '';
 for (var i = 0; i < 70000; i++) {
     s += 'function x' + i + '() { x' + i + '(); }\n';
diff --git a/js/src/jit-test/tests/basic/bug745360.js b/js/src/jit-test/tests/basic/bug745360.js
index 91bdf97659b..7d17b722c62 100644
--- a/js/src/jit-test/tests/basic/bug745360.js
+++ b/js/src/jit-test/tests/basic/bug745360.js
@@ -1 +1,2 @@
+// |jit-test| error: TypeError
 newGlobal().eval("eval.arguments")
diff --git a/js/src/jit-test/tests/basic/eif-generator.js b/js/src/jit-test/tests/basic/eif-generator.js
index 0d3d3327cf7..6489019d40c 100644
--- a/js/src/jit-test/tests/basic/eif-generator.js
+++ b/js/src/jit-test/tests/basic/eif-generator.js
@@ -1,4 +1,6 @@
-// |jit-test| debug
+var global = newGlobal();
+var dbg = new global.Debugger(this);
+
 function f() {
     let (x = 1) {
         while (true) {
diff --git a/js/src/jit-test/tests/basic/regexp-undefined-match.js b/js/src/jit-test/tests/basic/regexp-undefined-match.js
new file mode 100644
index 00000000000..cf1d799833c
--- /dev/null
+++ b/js/src/jit-test/tests/basic/regexp-undefined-match.js
@@ -0,0 +1,9 @@
+
+function f(str) {
+    for (var i=0; i<10; i++) {
+	arr = /foo(ba(r))?/.exec(str);
+	var x = arr[0] + " " + arr[1] + " " + arr[2];
+    }
+}
+f("foobar");
+f("foo");
diff --git a/js/src/jit-test/tests/basic/testBug552248.js b/js/src/jit-test/tests/basic/testBug552248.js
index 94aef6a148a..391a3f2b18b 100644
--- a/js/src/jit-test/tests/basic/testBug552248.js
+++ b/js/src/jit-test/tests/basic/testBug552248.js
@@ -1,5 +1,6 @@
-// |jit-test| debug
-setDebug(true);
+var global = newGlobal();
+var dbg = new global.Debugger(this);
+
 var a = new Array();
 
 function i(save) {
diff --git a/js/src/jit-test/tests/basic/testBug663789-2.js b/js/src/jit-test/tests/basic/testBug663789-2.js
index 3f189e117ca..0a5d2a10d33 100644
--- a/js/src/jit-test/tests/basic/testBug663789-2.js
+++ b/js/src/jit-test/tests/basic/testBug663789-2.js
@@ -1,4 +1,5 @@
-// |jit-test| debug
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 o = { toString:function() { return evalInFrame(1, "x") } }
 var x = 'C';
diff --git a/js/src/jit-test/tests/basic/testEvalInFrameEdgeCase.js b/js/src/jit-test/tests/basic/testEvalInFrameEdgeCase.js
index c1731e37875..4f6d9a2aea1 100644
--- a/js/src/jit-test/tests/basic/testEvalInFrameEdgeCase.js
+++ b/js/src/jit-test/tests/basic/testEvalInFrameEdgeCase.js
@@ -1,4 +1,5 @@
-// |jit-test| debug
+var global = newGlobal();
+var dbg = new global.Debugger(this);
 
 function g() {
     var x = 100;
diff --git a/js/src/jit-test/tests/basic/testGCNewbornGenerator.js b/js/src/jit-test/tests/basic/testGCNewbornGenerator.js
index 3f883147ee9..ff1e1bfce1d 100644
--- a/js/src/jit-test/tests/basic/testGCNewbornGenerator.js
+++ b/js/src/jit-test/tests/basic/testGCNewbornGenerator.js
@@ -1,4 +1,6 @@
-// |jit-test| debug
+var g = newGlobal();
+var dbg = new g.Debugger(this);
+
 try {
     function f() {}
     (1 for (x in []))
diff --git a/js/src/jit-test/tests/debug/Debugger-ctor-02.js b/js/src/jit-test/tests/debug/Debugger-ctor-02.js
index d1cb48d49e7..2095f9beb9d 100644
--- a/js/src/jit-test/tests/debug/Debugger-ctor-02.js
+++ b/js/src/jit-test/tests/debug/Debugger-ctor-02.js
@@ -1,8 +1,4 @@
-// |jit-test| debug
 // Test creating a Debugger in a sandbox, debugging the initial global.
-//
-// This requires debug mode to already be on in the initial global, since it's
-// always on the stack in the shell. Hence the |jit-test| tag.
 
 load(libdir + 'asserts.js');
 
diff --git a/js/src/jit-test/tests/debug/Debugger-debuggees-09.js b/js/src/jit-test/tests/debug/Debugger-debuggees-09.js
index e7d1abbadcc..95b4b77b38b 100644
--- a/js/src/jit-test/tests/debug/Debugger-debuggees-09.js
+++ b/js/src/jit-test/tests/debug/Debugger-debuggees-09.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // If hasDebuggee(x) is false, removeDebuggee(x) does nothing.
 
 var dbg = new Debugger;
diff --git a/js/src/jit-test/tests/debug/Debugger-debuggees-11.js b/js/src/jit-test/tests/debug/Debugger-debuggees-11.js
index 6fa8453a1db..04035c59be5 100644
--- a/js/src/jit-test/tests/debug/Debugger-debuggees-11.js
+++ b/js/src/jit-test/tests/debug/Debugger-debuggees-11.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Don't allow cycles in the graph of the compartment "debugs" relation.
 
 load(libdir + "asserts.js");
diff --git a/js/src/jit-test/tests/debug/Frame-identity-01.js b/js/src/jit-test/tests/debug/Frame-identity-01.js
index fe04c460332..b06a33399f5 100644
--- a/js/src/jit-test/tests/debug/Frame-identity-01.js
+++ b/js/src/jit-test/tests/debug/Frame-identity-01.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Check that {return:} resumption kills the current stack frame.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/Frame-identity-02.js b/js/src/jit-test/tests/debug/Frame-identity-02.js
index bd5346c30a5..207e6879e8b 100644
--- a/js/src/jit-test/tests/debug/Frame-identity-02.js
+++ b/js/src/jit-test/tests/debug/Frame-identity-02.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Check that {throw:} resumption kills the current stack frame.
 
 load(libdir + "asserts.js");
diff --git a/js/src/jit-test/tests/debug/Frame-identity-03.js b/js/src/jit-test/tests/debug/Frame-identity-03.js
index bbc20cc76ce..19c62def859 100644
--- a/js/src/jit-test/tests/debug/Frame-identity-03.js
+++ b/js/src/jit-test/tests/debug/Frame-identity-03.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Test that we create new Debugger.Frames and reuse old ones correctly with recursion.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/Frame-live-01.js b/js/src/jit-test/tests/debug/Frame-live-01.js
index 1bb6c2a8c4f..192602e1b21 100644
--- a/js/src/jit-test/tests/debug/Frame-live-01.js
+++ b/js/src/jit-test/tests/debug/Frame-live-01.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Debugger.Frame.prototype.live is true for frames on the stack and false for
 // frames that have returned
 
diff --git a/js/src/jit-test/tests/debug/Frame-live-02.js b/js/src/jit-test/tests/debug/Frame-live-02.js
index a74b46c86db..f0961ad0069 100644
--- a/js/src/jit-test/tests/debug/Frame-live-02.js
+++ b/js/src/jit-test/tests/debug/Frame-live-02.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Debugger.Frame.prototype.live is false for frames that have thrown or been thrown through
 
 load(libdir + "asserts.js");
diff --git a/js/src/jit-test/tests/debug/Frame-live-03.js b/js/src/jit-test/tests/debug/Frame-live-03.js
index de08486b643..aa8283cbf95 100644
--- a/js/src/jit-test/tests/debug/Frame-live-03.js
+++ b/js/src/jit-test/tests/debug/Frame-live-03.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // frame properties throw if !frame.live
 
 load(libdir + "asserts.js");
diff --git a/js/src/jit-test/tests/debug/Frame-older-01.js b/js/src/jit-test/tests/debug/Frame-older-01.js
index 0a5e79454eb..1a21d1b448a 100644
--- a/js/src/jit-test/tests/debug/Frame-older-01.js
+++ b/js/src/jit-test/tests/debug/Frame-older-01.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Basic call chain.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/Frame-script-01.js b/js/src/jit-test/tests/debug/Frame-script-01.js
index d0230119b64..fbf1d0bd878 100644
--- a/js/src/jit-test/tests/debug/Frame-script-01.js
+++ b/js/src/jit-test/tests/debug/Frame-script-01.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Frame.prototype.script for eval frames.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/Frame-script-02.js b/js/src/jit-test/tests/debug/Frame-script-02.js
index a7b17255099..1ca139bb726 100644
--- a/js/src/jit-test/tests/debug/Frame-script-02.js
+++ b/js/src/jit-test/tests/debug/Frame-script-02.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Frame.prototype.script for call frames.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/Object-script.js b/js/src/jit-test/tests/debug/Object-script.js
index b3472ea7b14..a73032f938a 100644
--- a/js/src/jit-test/tests/debug/Object-script.js
+++ b/js/src/jit-test/tests/debug/Object-script.js
@@ -1,5 +1,3 @@
-// |jit-test| debug
-
 var g = newGlobal();
 var dbg = new Debugger(g);
 var hits = 0;
diff --git a/js/src/jit-test/tests/debug/Script-01.js b/js/src/jit-test/tests/debug/Script-01.js
index 0e01585cb3f..330ff8a5488 100644
--- a/js/src/jit-test/tests/debug/Script-01.js
+++ b/js/src/jit-test/tests/debug/Script-01.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // We get the same Debugger.Script object instance each time we ask.
 
 var global = newGlobal();
diff --git a/js/src/jit-test/tests/debug/Script-02.js b/js/src/jit-test/tests/debug/Script-02.js
index b64166c08a0..071dc465aec 100644
--- a/js/src/jit-test/tests/debug/Script-02.js
+++ b/js/src/jit-test/tests/debug/Script-02.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Debugger.Script throws when applied as a constructor.
 
 load(libdir + 'asserts.js');
diff --git a/js/src/jit-test/tests/debug/Script-gc-01.js b/js/src/jit-test/tests/debug/Script-gc-01.js
index ee7675d0656..5d71b1e3999 100644
--- a/js/src/jit-test/tests/debug/Script-gc-01.js
+++ b/js/src/jit-test/tests/debug/Script-gc-01.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Debugger.Script instances with live referents stay alive.
 
 var N = 4;
diff --git a/js/src/jit-test/tests/debug/Source-introductionScript-04.js b/js/src/jit-test/tests/debug/Source-introductionScript-04.js
new file mode 100644
index 00000000000..6f0721b6379
--- /dev/null
+++ b/js/src/jit-test/tests/debug/Source-introductionScript-04.js
@@ -0,0 +1,8 @@
+// Function.prototype's script source should be fully initialized.
+var g = newGlobal();
+var dbg = new Debugger;
+var gw = dbg.addDebuggee(g);
+
+var DOfp = gw.getOwnPropertyDescriptor('Function').value.proto;
+// This should not crash.
+print(DOfp.script.source.introductionScript);
diff --git a/js/src/jit-test/tests/debug/onExceptionUnwind-02.js b/js/src/jit-test/tests/debug/onExceptionUnwind-02.js
index 44dee24ead7..3907d5fc532 100644
--- a/js/src/jit-test/tests/debug/onExceptionUnwind-02.js
+++ b/js/src/jit-test/tests/debug/onExceptionUnwind-02.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // The onExceptionUnwind hook is called multiple times as the stack unwinds.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/onExceptionUnwind-03.js b/js/src/jit-test/tests/debug/onExceptionUnwind-03.js
index 555e9e78aba..913b1d2feb4 100644
--- a/js/src/jit-test/tests/debug/onExceptionUnwind-03.js
+++ b/js/src/jit-test/tests/debug/onExceptionUnwind-03.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // The onExceptionUnwind hook is called multiple times as the stack unwinds.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/onExceptionUnwind-05.js b/js/src/jit-test/tests/debug/onExceptionUnwind-05.js
index fe993ea5566..d2032dd45cf 100644
--- a/js/src/jit-test/tests/debug/onExceptionUnwind-05.js
+++ b/js/src/jit-test/tests/debug/onExceptionUnwind-05.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // onExceptionUnwind returning undefined does not affect the thrown exception.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/onExceptionUnwind-06.js b/js/src/jit-test/tests/debug/onExceptionUnwind-06.js
index d3549238ddf..bab342dd189 100644
--- a/js/src/jit-test/tests/debug/onExceptionUnwind-06.js
+++ b/js/src/jit-test/tests/debug/onExceptionUnwind-06.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // onExceptionUnwind assigning to argv[1] does not affect the thrown exception.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/resumption-03.js b/js/src/jit-test/tests/debug/resumption-03.js
index f3ca2ea5526..cca96a08067 100644
--- a/js/src/jit-test/tests/debug/resumption-03.js
+++ b/js/src/jit-test/tests/debug/resumption-03.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Returning and throwing objects.
 
 load(libdir + "asserts.js");
diff --git a/js/src/jit-test/tests/debug/resumption-04.js b/js/src/jit-test/tests/debug/resumption-04.js
index d05e8cd5894..d564a7a75ac 100644
--- a/js/src/jit-test/tests/debug/resumption-04.js
+++ b/js/src/jit-test/tests/debug/resumption-04.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Forced return from a generator frame.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/resumption-05.js b/js/src/jit-test/tests/debug/resumption-05.js
index 44c861bc306..3c790ad3228 100644
--- a/js/src/jit-test/tests/debug/resumption-05.js
+++ b/js/src/jit-test/tests/debug/resumption-05.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // null resumption value means terminate the debuggee
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/debug/resumption-06.js b/js/src/jit-test/tests/debug/resumption-06.js
index 658b9c33ea3..43010c28d83 100644
--- a/js/src/jit-test/tests/debug/resumption-06.js
+++ b/js/src/jit-test/tests/debug/resumption-06.js
@@ -1,4 +1,3 @@
-// |jit-test| debug
 // Forced return from a star generator frame.
 
 load(libdir + 'asserts.js')
diff --git a/js/src/jit-test/tests/debug/uncaughtExceptionHook-03.js b/js/src/jit-test/tests/debug/uncaughtExceptionHook-03.js
index a526bf4a713..d9dc5067644 100644
--- a/js/src/jit-test/tests/debug/uncaughtExceptionHook-03.js
+++ b/js/src/jit-test/tests/debug/uncaughtExceptionHook-03.js
@@ -1,4 +1,4 @@
-// |jit-test| debug; error: ReferenceError
+// |jit-test| error: ReferenceError
 // If uncaughtExceptionHook is absent, the debuggee is terminated.
 
 var g = newGlobal();
diff --git a/js/src/jit-test/tests/jaeger/bug563000/eif-call-newvar.js b/js/src/jit-test/tests/jaeger/bug563000/eif-call-newvar.js
index cf1086a9288..ee3decf3b95 100644
--- a/js/src/jit-test/tests/jaeger/bug563000/eif-call-newvar.js
+++ b/js/src/jit-test/tests/jaeger/bug563000/eif-call-newvar.js
@@ -1,5 +1,5 @@
-// |jit-test| debug
-setDebug(true);
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 function callee() {
   evalInFrame(1, "var x = 'success'");
diff --git a/js/src/jit-test/tests/jaeger/bug563000/eif-call-typechange.js b/js/src/jit-test/tests/jaeger/bug563000/eif-call-typechange.js
index a24ea0cfcd8..ff3cd5e7c4c 100644
--- a/js/src/jit-test/tests/jaeger/bug563000/eif-call-typechange.js
+++ b/js/src/jit-test/tests/jaeger/bug563000/eif-call-typechange.js
@@ -1,5 +1,5 @@
-// |jit-test| debug
-setDebug(true);
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 function callee() {
   evalInFrame(1, "x = 'success'");
diff --git a/js/src/jit-test/tests/jaeger/bug563000/eif-call.js b/js/src/jit-test/tests/jaeger/bug563000/eif-call.js
index a7d87a0012f..559ac235e73 100644
--- a/js/src/jit-test/tests/jaeger/bug563000/eif-call.js
+++ b/js/src/jit-test/tests/jaeger/bug563000/eif-call.js
@@ -1,5 +1,5 @@
-// |jit-test| debug
-setDebug(true);
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 function callee() {
   evalInFrame(1, "x = 'success'");
diff --git a/js/src/jit-test/tests/jaeger/bug563000/eif-getter-newvar.js b/js/src/jit-test/tests/jaeger/bug563000/eif-getter-newvar.js
index 23e6023fdd4..59dd854d6e9 100644
--- a/js/src/jit-test/tests/jaeger/bug563000/eif-getter-newvar.js
+++ b/js/src/jit-test/tests/jaeger/bug563000/eif-getter-newvar.js
@@ -1,5 +1,5 @@
-// |jit-test| debug
-setDebug(true);
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 this.__defineGetter__("someProperty", function () { evalInFrame(1, "var x = 'success'"); });
 function caller(obj) {
diff --git a/js/src/jit-test/tests/jaeger/bug563000/eif-getter-typechange.js b/js/src/jit-test/tests/jaeger/bug563000/eif-getter-typechange.js
index 66b029df456..e5884d04c09 100644
--- a/js/src/jit-test/tests/jaeger/bug563000/eif-getter-typechange.js
+++ b/js/src/jit-test/tests/jaeger/bug563000/eif-getter-typechange.js
@@ -1,5 +1,5 @@
-// |jit-test| debug
-setDebug(true);
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 this.__defineGetter__("someProperty", function () { evalInFrame(1, "var x = 'success'"); });
 function caller(obj) {
diff --git a/js/src/jit-test/tests/jaeger/bug563000/eif-getter.js b/js/src/jit-test/tests/jaeger/bug563000/eif-getter.js
index 703167f2d1a..e2c57bb94db 100644
--- a/js/src/jit-test/tests/jaeger/bug563000/eif-getter.js
+++ b/js/src/jit-test/tests/jaeger/bug563000/eif-getter.js
@@ -1,5 +1,5 @@
-// |jit-test| debug
-setDebug(true);
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 this.__defineGetter__("someProperty", function () { evalInFrame(1, "x = 'success'"); });
 function caller(obj) {
diff --git a/js/src/jit-test/tests/jaeger/bug563000/eif-global-newvar.js b/js/src/jit-test/tests/jaeger/bug563000/eif-global-newvar.js
index c7a9c78a56e..8e32ac556af 100644
--- a/js/src/jit-test/tests/jaeger/bug563000/eif-global-newvar.js
+++ b/js/src/jit-test/tests/jaeger/bug563000/eif-global-newvar.js
@@ -1,5 +1,5 @@
-// |jit-test| debug
-setDebug(true);
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 function callee() {
   evalInFrame(1, "var x = 'success'");
diff --git a/js/src/jit-test/tests/jaeger/invokeSessionGuard.js b/js/src/jit-test/tests/jaeger/invokeSessionGuard.js
index b0a85112f29..b131eb032db 100644
--- a/js/src/jit-test/tests/jaeger/invokeSessionGuard.js
+++ b/js/src/jit-test/tests/jaeger/invokeSessionGuard.js
@@ -1,4 +1,5 @@
-// |jit-test| debug
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 [1,2,3,4,5,6,7,8].forEach(
     function(x) {
diff --git a/js/src/jit-test/tests/jaeger/recompile/bug641269.js b/js/src/jit-test/tests/jaeger/recompile/bug641269.js
index e5e9ebce9b6..64a2429efdd 100644
--- a/js/src/jit-test/tests/jaeger/recompile/bug641269.js
+++ b/js/src/jit-test/tests/jaeger/recompile/bug641269.js
@@ -1,4 +1,5 @@
-// |jit-test| debug
+var g = newGlobal();
+var dbg = new g.Debugger(this);
 
 (function() {
   const x = [][x]
diff --git a/js/src/jit-test/tests/structured-clone/Map-Set-cross-compartment.js b/js/src/jit-test/tests/structured-clone/Map-Set-cross-compartment.js
new file mode 100644
index 00000000000..ec488875390
--- /dev/null
+++ b/js/src/jit-test/tests/structured-clone/Map-Set-cross-compartment.js
@@ -0,0 +1,8 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+// Don't crash
+serialize(evalcx("Set(['x', 'y'])"));
+serialize(evalcx("Map([['x', 1]])"));
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 83e2b79990d..49f4768cac3 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -7661,7 +7661,6 @@ DoSetPropFallback(JSContext *cx, BaselineFrame *frame, ICSetProp_Fallback *stub_
     uint32_t oldSlots = obj->numDynamicSlots();
 
     if (op == JSOP_INITPROP) {
-        MOZ_ASSERT(name != cx->names().proto, "should have used JSOP_MUTATEPROTO");
         MOZ_ASSERT(obj->is<JSObject>());
         if (!DefineNativeProperty(cx, obj, id, rhs, nullptr, nullptr, JSPROP_ENUMERATE))
             return false;
diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
index 42e1bde06c5..f256f6f89a8 100644
--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@@ -891,6 +891,10 @@ jit::FinishDiscardBaselineScript(FreeOp *fop, JSScript *script)
         // Reset |active| flag so that we don't need a separate script
         // iteration to unmark them.
         script->baselineScript()->resetActive();
+
+        // The baseline caches have been wiped out, so the script will need to
+        // warm back up before it can be inlined during Ion compilation.
+        script->baselineScript()->clearIonCompiledOrInlined();
         return;
     }
 
diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h
index 2eaff1a4a80..357afa148f0 100644
--- a/js/src/jit/BaselineJIT.h
+++ b/js/src/jit/BaselineJIT.h
@@ -151,7 +151,12 @@ struct BaselineScript
 
         // Flag set when compiled for use for debug mode. Handles various
         // Debugger hooks and compiles toggled calls for traps.
-        DEBUG_MODE = 1 << 3
+        DEBUG_MODE = 1 << 3,
+
+        // Flag set if this script has ever been Ion compiled, either directly
+        // or inlined into another script. This is cleared when the script's
+        // type information or caches are cleared.
+        ION_COMPILED_OR_INLINED = 1 << 4
     };
 
   private:
@@ -229,6 +234,16 @@ struct BaselineScript
         return flags_ & DEBUG_MODE;
     }
 
+    void setIonCompiledOrInlined() {
+        flags_ |= ION_COMPILED_OR_INLINED;
+    }
+    void clearIonCompiledOrInlined() {
+        flags_ &= ~ION_COMPILED_OR_INLINED;
+    }
+    bool ionCompiledOrInlined() const {
+        return flags_ & ION_COMPILED_OR_INLINED;
+    }
+
     uint32_t prologueOffset() const {
         return prologueOffset_;
     }
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 367f50021fe..47804dbd921 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1597,7 +1597,7 @@ CodeGenerator::visitMoveGroup(LMoveGroup *group)
           case LDefinition::DOUBLE:     moveType = MoveOp::DOUBLE;    break;
           case LDefinition::INT32X4:    moveType = MoveOp::INT32X4;   break;
           case LDefinition::FLOAT32X4:  moveType = MoveOp::FLOAT32X4; break;
-          default: MOZ_ASSUME_UNREACHABLE("Unexpected move type");
+          default: MOZ_CRASH("Unexpected move type");
         }
 
         if (!resolver.addMove(toMoveOperand(from), toMoveOperand(to), moveType))
@@ -2209,7 +2209,7 @@ CodeGenerator::visitCallNative(LCallNative *call)
         break;
 
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 
     // Test for failure.
@@ -2455,7 +2455,7 @@ CodeGenerator::visitCallGeneric(LCallGeneric *call)
         break;
 
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 
     masm.bind(&end);
@@ -2555,7 +2555,7 @@ CodeGenerator::visitCallKnown(LCallKnown *call)
         break;
 
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 
     masm.bind(&end);
@@ -3779,7 +3779,7 @@ ShouldInitFixedSlots(LInstruction *lir, JSObject *templateObj)
         iter = block->begin();
     }
 
-    MOZ_ASSUME_UNREACHABLE("Shouldn't get here");
+    MOZ_CRASH("Shouldn't get here");
 }
 
 bool
@@ -4664,7 +4664,7 @@ CodeGenerator::visitMathFunctionD(LMathFunctionD *ins)
         funptr = JS_FUNC_TO_DATA_PTR(void *, js::math_round_impl);
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("Unknown math function");
+        MOZ_CRASH("Unknown math function");
     }
 
 #   undef MAYBE_CACHED
@@ -4689,7 +4689,7 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
       case MMathFunction::Round: funptr = JS_FUNC_TO_DATA_PTR(void *, math_roundf_impl); break;
       case MMathFunction::Ceil:  funptr = JS_FUNC_TO_DATA_PTR(void *, ceilf);            break;
       default:
-        MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
+        MOZ_CRASH("Unknown or unsupported float32 math function");
     }
 
     masm.callWithABI(funptr, MoveOp::FLOAT32);
@@ -4754,7 +4754,7 @@ CodeGenerator::visitBinaryV(LBinaryV *lir)
         return callVM(UrshInfo, lir);
 
       default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected binary op");
+        MOZ_CRASH("Unexpected binary op");
     }
 }
 
@@ -4887,7 +4887,7 @@ CodeGenerator::visitCompareVM(LCompareVM *lir)
         return callVM(GeInfo, lir);
 
       default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected compare op");
+        MOZ_CRASH("Unexpected compare op");
     }
 }
 
@@ -5177,8 +5177,9 @@ static void
 CopyStringChars(MacroAssembler &masm, Register to, Register from, Register len, Register scratch,
                 size_t fromWidth, size_t toWidth)
 {
-    // Copy |len| jschars from |from| to |to|. Assumes len > 0 (checked below in
-    // debug builds), and when done |to| must point to the next available char.
+    // Copy |len| char16_t code units from |from| to |to|. Assumes len > 0
+    // (checked below in debug builds), and when done |to| must point to the
+    // next available char.
 
 #ifdef DEBUG
     Label ok;
@@ -5219,13 +5220,13 @@ CopyStringCharsMaybeInflate(MacroAssembler &masm, Register input, Register destC
                       Imm32(JSString::LATIN1_CHARS_BIT), &isLatin1);
     {
         masm.loadStringChars(input, input);
-        CopyStringChars(masm, destChars, input, temp1, temp2, sizeof(jschar), sizeof(jschar));
+        CopyStringChars(masm, destChars, input, temp1, temp2, sizeof(char16_t), sizeof(char16_t));
         masm.jump(&done);
     }
     masm.bind(&isLatin1);
     {
         masm.loadStringChars(input, input);
-        CopyStringChars(masm, destChars, input, temp1, temp2, sizeof(char), sizeof(jschar));
+        CopyStringChars(masm, destChars, input, temp1, temp2, sizeof(char), sizeof(char16_t));
     }
     masm.bind(&done);
 }
@@ -5254,7 +5255,7 @@ ConcatFatInlineString(MacroAssembler &masm, Register lhs, Register rhs, Register
         masm.pop(temp1);
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 
     // Store length and flags.
@@ -5375,7 +5376,7 @@ JitCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
         masm.pop(temp1);
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 
     // Store rope length and flags. temp1 still holds the result of AND'ing the
@@ -7020,7 +7021,7 @@ CodeGenerator::link(JSContext *cx, types::CompilerConstraintList *constraints)
         // turn on barriers.
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 
     // Attach any generated script counts to the script.
@@ -7301,7 +7302,7 @@ CodeGenerator::addGetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Regi
         return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad execution mode");
+        MOZ_CRASH("Bad execution mode");
     }
 }
 
@@ -7322,7 +7323,7 @@ CodeGenerator::addSetPropertyCache(LInstruction *ins, RegisterSet liveRegs, Regi
           return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad execution mode");
+        MOZ_CRASH("Bad execution mode");
     }
 }
 
@@ -7347,7 +7348,7 @@ CodeGenerator::addSetElementCache(LInstruction *ins, Register obj, Register unbo
         return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad execution mode");
+        MOZ_CRASH("Bad execution mode");
     }
 }
 
@@ -7445,7 +7446,7 @@ CodeGenerator::addGetElementCache(LInstruction *ins, Register obj, ConstantOrReg
         return addCache(ins, allocateCache(cache));
       }
       default:
-        MOZ_ASSUME_UNREACHABLE("No such execution mode");
+        MOZ_CRASH("No such execution mode");
     }
 }
 
@@ -7824,7 +7825,7 @@ CodeGenerator::visitBitOpV(LBitOpV *lir)
       default:
         break;
     }
-    MOZ_ASSUME_UNREACHABLE("unexpected bitop");
+    MOZ_CRASH("unexpected bitop");
 }
 
 class OutOfLineTypeOfV : public OutOfLineCodeBase<CodeGenerator>
@@ -8725,7 +8726,7 @@ CodeGenerator::visitProfilerStackOp(LProfilerStackOp *lir)
             return true;
 
         default:
-            MOZ_ASSUME_UNREACHABLE("invalid LProfilerStackOp type");
+            MOZ_CRASH("invalid LProfilerStackOp type");
     }
 }
 
diff --git a/js/src/jit/CompactBuffer.h b/js/src/jit/CompactBuffer.h
index b12fce286cf..a7f21e1819c 100644
--- a/js/src/jit/CompactBuffer.h
+++ b/js/src/jit/CompactBuffer.h
@@ -43,7 +43,6 @@ class CompactBufferReader
             if (!(byte & 1))
                 return val;
         }
-        MOZ_ASSUME_UNREACHABLE("unreachable");
     }
 
   public:
diff --git a/js/src/jit/ExecutionMode-inl.h b/js/src/jit/ExecutionMode-inl.h
index 697d478ad7d..9ef82452cad 100644
--- a/js/src/jit/ExecutionMode-inl.h
+++ b/js/src/jit/ExecutionMode-inl.h
@@ -22,7 +22,7 @@ HasIonScript(JSScript *script, ExecutionMode cmode)
       case ParallelExecution: return script->hasParallelIonScript();
       default:;
     }
-    MOZ_ASSUME_UNREACHABLE("No such execution mode");
+    MOZ_CRASH("No such execution mode");
 }
 
 static inline IonScript *
@@ -33,7 +33,7 @@ GetIonScript(JSScript *script, ExecutionMode cmode)
       case ParallelExecution: return script->maybeParallelIonScript();
       default:;
     }
-    MOZ_ASSUME_UNREACHABLE("No such execution mode");
+    MOZ_CRASH("No such execution mode");
 }
 
 static inline void
@@ -44,7 +44,7 @@ SetIonScript(JSScript *script, ExecutionMode cmode, IonScript *ionScript)
       case ParallelExecution: script->setParallelIonScript(ionScript); return;
       default:;
     }
-    MOZ_ASSUME_UNREACHABLE("No such execution mode");
+    MOZ_CRASH("No such execution mode");
 }
 
 static inline size_t
@@ -55,7 +55,7 @@ OffsetOfIonInJSScript(ExecutionMode cmode)
       case ParallelExecution: return JSScript::offsetOfParallelIonScript();
       default:;
     }
-    MOZ_ASSUME_UNREACHABLE("No such execution mode");
+    MOZ_CRASH("No such execution mode");
 }
 
 static inline bool
@@ -68,8 +68,7 @@ CanIonCompile(JSScript *script, ExecutionMode cmode)
       case ArgumentsUsageAnalysis: return true;
       default:;
     }
-    MOZ_ASSUME_UNREACHABLE("No such execution mode");
-    return false;
+    MOZ_CRASH("No such execution mode");
 }
 
 static inline bool
@@ -80,7 +79,7 @@ CompilingOffThread(JSScript *script, ExecutionMode cmode)
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
       default:;
     }
-    MOZ_ASSUME_UNREACHABLE("No such execution mode");
+    MOZ_CRASH("No such execution mode");
 }
 
 static inline bool
@@ -91,7 +90,7 @@ CompilingOffThread(HandleScript script, ExecutionMode cmode)
       case ParallelExecution: return script->isParallelIonCompilingOffThread();
       default:;
     }
-    MOZ_ASSUME_UNREACHABLE("No such execution mode");
+    MOZ_CRASH("No such execution mode");
 }
 
 } // namespace jit
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 1015a5cc6cd..bc97f9c2c48 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -148,6 +148,9 @@ IonBuilder::IonBuilder(JSContext *analysisContext, CompileCompartment *comp,
 
     JS_ASSERT(script()->hasBaselineScript() == (info->executionMode() != ArgumentsUsageAnalysis));
     JS_ASSERT(!!analysisContext == (info->executionMode() == DefinitePropertiesAnalysis));
+
+    if (!info->executionModeIsAnalysis())
+        script()->baselineScript()->setIonCompiledOrInlined();
 }
 
 void
@@ -4202,6 +4205,7 @@ IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
         // type information, except for definite properties analysis,
         // as the caller has not run yet.
         if (targetScript->getUseCount() < optimizationInfo().usesBeforeInlining() &&
+            !targetScript->baselineScript()->ionCompiledOrInlined() &&
             info().executionMode() != DefinitePropertiesAnalysis)
         {
             return DontInline(targetScript, "Vetoed: callee is insufficiently hot.");
@@ -4298,7 +4302,7 @@ class WrapMGetPropertyCache
     }
 
   public:
-    WrapMGetPropertyCache(MGetPropertyCache *cache)
+    explicit WrapMGetPropertyCache(MGetPropertyCache *cache)
       : cache_(cache)
     { }
 
@@ -5581,7 +5585,7 @@ IonBuilder::jsop_newarray(uint32_t count)
 
     MNewArray *ins = MNewArray::New(alloc(), constraints(), count, templateConst,
                                     templateObject->type()->initialHeap(constraints()),
-                                    MNewArray::NewArray_Allocating);
+                                    NewArray_FullyAllocating);
     current->add(ins);
     current->push(ins);
 
@@ -8313,7 +8317,7 @@ IonBuilder::jsop_rest()
 
     MNewArray *array = MNewArray::New(alloc(), constraints(), numRest, templateConst,
                                       templateObject->type()->initialHeap(constraints()),
-                                      MNewArray::NewArray_Allocating);
+                                      NewArray_FullyAllocating);
     current->add(array);
 
     if (numRest == 0) {
diff --git a/js/src/jit/JitCompartment.h b/js/src/jit/JitCompartment.h
index 45a01426d05..ac75a942f77 100644
--- a/js/src/jit/JitCompartment.h
+++ b/js/src/jit/JitCompartment.h
@@ -314,7 +314,7 @@ class JitRuntime
         switch (mode) {
           case SequentialExecution: return bailoutHandler_;
           case ParallelExecution:   return parallelBailoutHandler_;
-          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
+          default:                  MOZ_CRASH("No such execution mode");
         }
     }
 
@@ -332,7 +332,7 @@ class JitRuntime
         switch (mode) {
           case SequentialExecution: return argumentsRectifier_;
           case ParallelExecution:   return parallelArgumentsRectifier_;
-          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
+          default:                  MOZ_CRASH("No such execution mode");
         }
     }
 
@@ -510,7 +510,7 @@ class JitCompartment
         switch (mode) {
           case SequentialExecution: return stringConcatStub_;
           case ParallelExecution:   return parallelStringConcatStub_;
-          default:                  MOZ_ASSUME_UNREACHABLE("No such execution mode");
+          default:                  MOZ_CRASH("No such execution mode");
         }
     }
 };
diff --git a/js/src/jit/JitcodeMap.cpp b/js/src/jit/JitcodeMap.cpp
index a89b016a25c..c97d6d1988c 100644
--- a/js/src/jit/JitcodeMap.cpp
+++ b/js/src/jit/JitcodeMap.cpp
@@ -363,7 +363,7 @@ struct JitcodeMapBufferWriteSpewer
 
     static const uint32_t DumpMaxBytes = 50;
 
-    JitcodeMapBufferWriteSpewer(CompactBufferWriter &w)
+    explicit JitcodeMapBufferWriteSpewer(CompactBufferWriter &w)
       : writer(&w), startPos(writer->length())
     {}
 
diff --git a/js/src/jit/JitcodeMap.h b/js/src/jit/JitcodeMap.h
index fcdfd696c2b..e4aa521898d 100644
--- a/js/src/jit/JitcodeMap.h
+++ b/js/src/jit/JitcodeMap.h
@@ -314,19 +314,19 @@ class JitcodeGlobalEntry
         base_.init();
     }
 
-    JitcodeGlobalEntry(const IonEntry &ion) {
+    explicit JitcodeGlobalEntry(const IonEntry &ion) {
         ion_ = ion;
     }
 
-    JitcodeGlobalEntry(const BaselineEntry &baseline) {
+    explicit JitcodeGlobalEntry(const BaselineEntry &baseline) {
         baseline_ = baseline;
     }
 
-    JitcodeGlobalEntry(const IonCacheEntry &ionCache) {
+    explicit JitcodeGlobalEntry(const IonCacheEntry &ionCache) {
         ionCache_ = ionCache;
     }
 
-    JitcodeGlobalEntry(const QueryEntry &query) {
+    explicit JitcodeGlobalEntry(const QueryEntry &query) {
         query_ = query;
     }
 
@@ -351,7 +351,7 @@ class JitcodeGlobalEntry
             queryEntry().destroy();
             break;
           default:
-            MOZ_ASSUME_UNREACHABLE("Invalid JitcodeGlobalEntry kind.");
+            MOZ_CRASH("Invalid JitcodeGlobalEntry kind.");
         }
     }
 
@@ -451,7 +451,7 @@ class JitcodeGlobalEntry
           case IonCache:
             return ionCacheEntry().callStackAtAddr(rt, ptr, results, depth);
           default:
-            MOZ_ASSUME_UNREACHABLE("Invalid JitcodeGlobalEntry kind.");
+            MOZ_CRASH("Invalid JitcodeGlobalEntry kind.");
         }
         return false;
     }
@@ -804,7 +804,7 @@ class JitcodeIonTable
     }
 
   public:
-    JitcodeIonTable(uint32_t numRegions)
+    explicit JitcodeIonTable(uint32_t numRegions)
       : numRegions_(numRegions)
     {
         for (uint32_t i = 0; i < numRegions; i++)
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 68e105d3ff6..14241c7cef9 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -205,7 +205,7 @@ class LSimdSignMaskX4 : public LInstructionHelper<1, 1, 0>
   public:
     LIR_HEADER(SimdSignMaskX4);
 
-    LSimdSignMaskX4(const LAllocation &input) {
+    explicit LSimdSignMaskX4(const LAllocation &input) {
         setOperand(0, input);
     }
 };
@@ -2794,7 +2794,7 @@ class LClzI : public LInstructionHelper<1, 1, 0>
 {
   public:
     LIR_HEADER(ClzI)
-    LClzI(const LAllocation &num) {
+    explicit LClzI(const LAllocation &num) {
         setOperand(0, num);
     }
 
@@ -6022,19 +6022,19 @@ class LPhi MOZ_FINAL : public LInstruction
         return 0;
     }
     LDefinition *getTemp(size_t index) {
-        MOZ_ASSUME_UNREACHABLE("no temps");
+        MOZ_CRASH("no temps");
     }
     void setTemp(size_t index, const LDefinition &temp) {
-        MOZ_ASSUME_UNREACHABLE("no temps");
+        MOZ_CRASH("no temps");
     }
     size_t numSuccessors() const {
         return 0;
     }
     MBasicBlock *getSuccessor(size_t i) const {
-        MOZ_ASSUME_UNREACHABLE("no successors");
+        MOZ_CRASH("no successors");
     }
     void setSuccessor(size_t i, MBasicBlock *) {
-        MOZ_ASSUME_UNREACHABLE("no successors");
+        MOZ_CRASH("no successors");
     }
 
     virtual void printInfo(FILE *fp) {
@@ -6355,19 +6355,19 @@ class LAsmJSCall MOZ_FINAL : public LInstruction
         return 0;
     }
     LDefinition *getTemp(size_t index) {
-        MOZ_ASSUME_UNREACHABLE("no temps");
+        MOZ_CRASH("no temps");
     }
     void setTemp(size_t index, const LDefinition &a) {
-        MOZ_ASSUME_UNREACHABLE("no temps");
+        MOZ_CRASH("no temps");
     }
     size_t numSuccessors() const {
         return 0;
     }
     MBasicBlock *getSuccessor(size_t i) const {
-        MOZ_ASSUME_UNREACHABLE("no successors");
+        MOZ_CRASH("no successors");
     }
     void setSuccessor(size_t i, MBasicBlock *) {
-        MOZ_ASSUME_UNREACHABLE("no successors");
+        MOZ_CRASH("no successors");
     }
 };
 
diff --git a/js/src/jit/LIR.cpp b/js/src/jit/LIR.cpp
index c22adaf47cf..abe3d243753 100644
--- a/js/src/jit/LIR.cpp
+++ b/js/src/jit/LIR.cpp
@@ -408,7 +408,7 @@ PrintUse(char *buf, size_t size, const LUse *use)
         JS_snprintf(buf, size, "v%d:**", use->virtualRegister());
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("invalid use policy");
+        MOZ_CRASH("invalid use policy");
     }
 }
 
@@ -441,7 +441,7 @@ LAllocation::toString() const
         PrintUse(buf, sizeof(buf), toUse());
         return buf;
       default:
-        MOZ_ASSUME_UNREACHABLE("what?");
+        MOZ_CRASH("what?");
     }
 }
 #endif // DEBUG
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 40498f2bddf..bcff232feb8 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -574,7 +574,7 @@ class LDefinition
           case MIRType_Float32x4:
             return LDefinition::FLOAT32X4;
           default:
-            MOZ_ASSUME_UNREACHABLE("unexpected type");
+            MOZ_CRASH("unexpected type");
         }
     }
 
@@ -754,7 +754,7 @@ class LInstructionVisitor
     {}
 
   public:
-#define VISIT_INS(op) virtual bool visit##op(L##op *) { MOZ_ASSUME_UNREACHABLE("NYI: " #op); }
+#define VISIT_INS(op) virtual bool visit##op(L##op *) { MOZ_CRASH("NYI: " #op); }
     LIR_OPCODE_LIST(VISIT_INS)
 #undef VISIT_INS
 };
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index a9545d13482..278b4b32b20 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -1042,7 +1042,7 @@ LIRGenerator::visitCompare(MCompare *comp)
         return define(lir, comp);
     }
 
-    MOZ_ASSUME_UNREACHABLE("Unrecognized compare type.");
+    MOZ_CRASH("Unrecognized compare type.");
 }
 
 bool
@@ -1789,7 +1789,7 @@ LIRGenerator::visitToDouble(MToDouble *convert)
       default:
         // Objects might be effectful. Symbols will throw.
         // Strings are complicated - we don't handle them yet.
-        MOZ_ASSUME_UNREACHABLE("unexpected type");
+        MOZ_CRASH("unexpected type");
     }
 }
 
@@ -1839,7 +1839,7 @@ LIRGenerator::visitToFloat32(MToFloat32 *convert)
       default:
         // Objects might be effectful. Symbols will throw.
         // Strings are complicated - we don't handle them yet.
-        MOZ_ASSUME_UNREACHABLE("unexpected type");
+        MOZ_CRASH("unexpected type");
         return false;
     }
 }
@@ -1890,11 +1890,11 @@ LIRGenerator::visitToInt32(MToInt32 *convert)
       case MIRType_Object:
       case MIRType_Undefined:
         // Objects might be effectful. Symbols throw. Undefined coerces to NaN, not int32.
-        MOZ_ASSUME_UNREACHABLE("ToInt32 invalid input type");
+        MOZ_CRASH("ToInt32 invalid input type");
         return false;
 
       default:
-        MOZ_ASSUME_UNREACHABLE("unexpected type");
+        MOZ_CRASH("unexpected type");
     }
 }
 
@@ -1932,7 +1932,7 @@ LIRGenerator::visitTruncateToInt32(MTruncateToInt32 *truncate)
       default:
         // Objects might be effectful. Symbols throw.
         // Strings are complicated - we don't handle them yet.
-        MOZ_ASSUME_UNREACHABLE("unexpected type");
+        MOZ_CRASH("unexpected type");
     }
 }
 
@@ -1991,7 +1991,7 @@ LIRGenerator::visitToString(MToString *ins)
 
       default:
         // Float32, symbols, and objects are not supported.
-        MOZ_ASSUME_UNREACHABLE("unexpected type");
+        MOZ_CRASH("unexpected type");
     }
 }
 
@@ -2210,7 +2210,7 @@ LIRGenerator::visitLoadSlot(MLoadSlot *ins)
 
       case MIRType_Undefined:
       case MIRType_Null:
-        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
+        MOZ_CRASH("typed load must have a payload");
 
       default:
         return define(new(alloc()) LLoadSlotT(useRegister(ins->slots())), ins);
@@ -2316,7 +2316,7 @@ LIRGenerator::visitStoreSlot(MStoreSlot *ins)
         return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegister(ins->value())), ins);
 
       case MIRType_Float32:
-        MOZ_ASSUME_UNREACHABLE("Float32 shouldn't be stored in a slot.");
+        MOZ_CRASH("Float32 shouldn't be stored in a slot.");
 
       default:
         return add(new(alloc()) LStoreSlotT(useRegister(ins->slots()), useRegisterOrConstant(ins->value())),
@@ -2559,7 +2559,7 @@ LIRGenerator::visitNot(MNot *ins)
       }
 
       default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected MIRType.");
+        MOZ_CRASH("Unexpected MIRType.");
     }
 }
 
@@ -2635,7 +2635,7 @@ LIRGenerator::visitLoadElement(MLoadElement *ins)
       }
       case MIRType_Undefined:
       case MIRType_Null:
-        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
+        MOZ_CRASH("typed load must have a payload");
 
       default:
       {
@@ -2743,7 +2743,7 @@ LIRGenerator::visitArrayPopShift(MArrayPopShift *ins)
       }
       case MIRType_Undefined:
       case MIRType_Null:
-        MOZ_ASSUME_UNREACHABLE("typed load must have a payload");
+        MOZ_CRASH("typed load must have a payload");
 
       default:
       {
@@ -2864,7 +2864,7 @@ LIRGenerator::visitClampToUint8(MClampToUint8 *ins)
       }
 
       default:
-        MOZ_ASSUME_UNREACHABLE("unexpected type");
+        MOZ_CRASH("unexpected type");
     }
 }
 
@@ -3171,7 +3171,7 @@ LIRGenerator::visitAssertRange(MAssertRange *ins)
         break;
 
       default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected Range for MIRType");
+        MOZ_CRASH("Unexpected Range for MIRType");
         break;
     }
 
@@ -3577,7 +3577,7 @@ LIRGenerator::visitAsmJSReturn(MAsmJSReturn *ins)
     else if (rval->type() == MIRType_Int32)
         lir->setOperand(0, useFixed(rval, ReturnReg));
     else
-        MOZ_ASSUME_UNREACHABLE("Unexpected asm.js return type");
+        MOZ_CRASH("Unexpected asm.js return type");
     return add(lir);
 }
 
@@ -3707,8 +3707,7 @@ LIRGenerator::visitSimdConstant(MSimdConstant *ins)
     if (ins->type() == MIRType_Float32x4)
         return define(new(alloc()) LFloat32x4(), ins);
 
-    MOZ_ASSUME_UNREACHABLE("Unknown SIMD kind when generating constant");
-    return false;
+    MOZ_CRASH("Unknown SIMD kind when generating constant");
 }
 
 bool
@@ -3729,8 +3728,7 @@ LIRGenerator::visitSimdExtractElement(MSimdExtractElement *ins)
         return define(new(alloc()) LSimdExtractElementF(use, ins->lane()), ins);
     }
 
-    MOZ_ASSUME_UNREACHABLE("Unknown SIMD kind when extracting element");
-    return false;
+    MOZ_CRASH("Unknown SIMD kind when extracting element");
 }
 
 bool
@@ -3786,8 +3784,7 @@ LIRGenerator::visitSimdBinaryArith(MSimdBinaryArith *ins)
         return lowerForFPU(add, ins, ins->lhs(), ins->rhs());
     }
 
-    MOZ_ASSUME_UNREACHABLE("Unknown SIMD kind when adding values");
-    return false;
+    MOZ_CRASH("Unknown SIMD kind when adding values");
 }
 
 bool
@@ -3978,7 +3975,7 @@ bool
 LIRGenerator::visitPhi(MPhi *phi)
 {
     // Phi nodes are not lowered because they are only meaningful for the register allocator.
-    MOZ_ASSUME_UNREACHABLE("Unexpected Phi node during Lowering.");
+    MOZ_CRASH("Unexpected Phi node during Lowering.");
 }
 
 bool
@@ -3986,19 +3983,19 @@ LIRGenerator::visitBeta(MBeta *beta)
 {
     // Beta nodes are supposed to be removed before because they are
     // only used to carry the range information for Range analysis
-    MOZ_ASSUME_UNREACHABLE("Unexpected Beta node during Lowering.");
+    MOZ_CRASH("Unexpected Beta node during Lowering.");
 }
 
 bool
 LIRGenerator::visitObjectState(MObjectState *objState)
 {
     // ObjectState nodes are always recovered on bailouts
-    MOZ_ASSUME_UNREACHABLE("Unexpected ObjectState node during Lowering.");
+    MOZ_CRASH("Unexpected ObjectState node during Lowering.");
 }
 
 bool
 LIRGenerator::visitArrayState(MArrayState *objState)
 {
     // ArrayState nodes are always recovered on bailouts
-    MOZ_ASSUME_UNREACHABLE("Unexpected ArrayState node during Lowering.");
+    MOZ_CRASH("Unexpected ArrayState node during Lowering.");
 }
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 25feffb4399..f380f9b6845 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -283,7 +283,7 @@ IonBuilder::InliningStatus
 IonBuilder::inlineArray(CallInfo &callInfo)
 {
     uint32_t initLength = 0;
-    MNewArray::AllocatingBehaviour allocating = MNewArray::NewArray_Unallocating;
+    AllocatingBehaviour allocating = NewArray_Unallocating;
 
     JSObject *templateObject = inspector->getTemplateObjectForNative(pc, js_Array);
     if (!templateObject)
@@ -293,7 +293,7 @@ IonBuilder::inlineArray(CallInfo &callInfo)
     // Multiple arguments imply array initialization, not just construction.
     if (callInfo.argc() >= 2) {
         initLength = callInfo.argc();
-        allocating = MNewArray::NewArray_Allocating;
+        allocating = NewArray_FullyAllocating;
 
         types::TypeObjectKey *type = types::TypeObjectKey::get(templateObject);
         if (!type->unknownProperties()) {
@@ -328,8 +328,11 @@ IonBuilder::inlineArray(CallInfo &callInfo)
         if (initLength != templateObject->as<ArrayObject>().length())
             return InliningStatus_NotInlined;
 
-        if (initLength <= ArrayObject::EagerAllocationMaxLength)
-            allocating = MNewArray::NewArray_Allocating;
+        // Don't inline large allocations.
+        if (initLength > ArrayObject::EagerAllocationMaxLength)
+            return InliningStatus_NotInlined;
+
+        allocating = NewArray_FullyAllocating;
     }
 
     callInfo.setImplicitlyUsedUnchecked();
@@ -1288,7 +1291,7 @@ IonBuilder::inlineConstantCharCodeAt(CallInfo &callInfo)
     callInfo.setImplicitlyUsedUnchecked();
 
     JSLinearString &linstr = str->asLinear();
-    jschar ch = linstr.latin1OrTwoByteChar(idx);
+    char16_t ch = linstr.latin1OrTwoByteChar(idx);
     MConstant *result = MConstant::New(alloc(), Int32Value(ch));
     current->add(result);
     current->push(result);
diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
index a92c0f34923..1cf5e7997c9 100644
--- a/js/src/jit/MIR.cpp
+++ b/js/src/jit/MIR.cpp
@@ -3033,10 +3033,9 @@ MNewArray::shouldUseVM() const
     size_t arraySlots =
         gc::GetGCKindSlots(templateObject()->tenuredGetAllocKind()) - ObjectElements::VALUES_PER_HEADER;
 
-    // Allocate space using the VMCall
-    // when mir hints it needs to get allocated immediately,
-    // but only when data doesn't fit the available array slots.
-    bool allocating = isAllocating() && count() > arraySlots;
+    // Allocate space using the VMCall when mir hints it needs to get allocated
+    // immediately, but only when data doesn't fit the available array slots.
+    bool allocating = allocatingBehaviour() != NewArray_Unallocating && count() > arraySlots;
 
     return templateObject()->hasSingletonType() || allocating;
 }
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index eac2f47fccb..5afdb478c8b 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2115,12 +2115,6 @@ typedef AlwaysTenured<Shape*> AlwaysTenuredShape;
 
 class MNewArray : public MUnaryInstruction
 {
-  public:
-    enum AllocatingBehaviour {
-        NewArray_Allocating,
-        NewArray_Unallocating
-    };
-
   private:
     // Number of space to allocate for the array.
     uint32_t count_;
@@ -2165,8 +2159,8 @@ class MNewArray : public MUnaryInstruction
         return initialHeap_;
     }
 
-    bool isAllocating() const {
-        return allocating_ == NewArray_Allocating;
+    AllocatingBehaviour allocatingBehaviour() const {
+        return allocating_;
     }
 
     // Returns true if the code generator should call through to the
@@ -2495,7 +2489,7 @@ class MArrayState : public MVariadicInstruction
   private:
     uint32_t numElements_;
 
-    MArrayState(MDefinition *arr)
+    explicit MArrayState(MDefinition *arr)
     {
         // This instruction is only used as a summary for bailout paths.
         setRecoveredOnBailout();
@@ -4761,7 +4755,7 @@ class MClz
 {
     bool operandIsNeverZero_;
 
-    MClz(MDefinition *num)
+    explicit MClz(MDefinition *num)
       : MUnaryInstruction(num),
         operandIsNeverZero_(false)
     {
diff --git a/js/src/jit/RangeAnalysis.cpp b/js/src/jit/RangeAnalysis.cpp
index 712197441b8..3624ce013f1 100644
--- a/js/src/jit/RangeAnalysis.cpp
+++ b/js/src/jit/RangeAnalysis.cpp
@@ -498,7 +498,7 @@ Range::Range(const MDefinition *def)
             wrapAroundToBoolean();
             break;
           case MIRType_None:
-            MOZ_ASSUME_UNREACHABLE("Asking for the range of an instruction with no value");
+            MOZ_CRASH("Asking for the range of an instruction with no value");
           default:
             break;
         }
@@ -514,7 +514,7 @@ Range::Range(const MDefinition *def)
             setInt32(0, 1);
             break;
           case MIRType_None:
-            MOZ_ASSUME_UNREACHABLE("Asking for the range of an instruction with no value");
+            MOZ_CRASH("Asking for the range of an instruction with no value");
           default:
             setUnknown();
             break;
diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
index 6a78c5e8ce6..cea2af5acca 100644
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -29,8 +29,7 @@ using namespace js::jit;
 bool
 MNode::writeRecoverData(CompactBufferWriter &writer) const
 {
-    MOZ_ASSUME_UNREACHABLE("This instruction is not serializable");
-    return false;
+    MOZ_CRASH("This instruction is not serializable");
 }
 
 void
@@ -50,8 +49,7 @@ RInstruction::readRecoverData(CompactBufferReader &reader, RInstructionStorage *
 
       case Recover_Invalid:
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad decoding of the previous instruction?");
-        break;
+        MOZ_CRASH("Bad decoding of the previous instruction?");
     }
 }
 
@@ -138,7 +136,7 @@ RResumePoint::RResumePoint(CompactBufferReader &reader)
 bool
 RResumePoint::recover(JSContext *cx, SnapshotIterator &iter) const
 {
-    MOZ_ASSUME_UNREACHABLE("This instruction is not recoverable.");
+    MOZ_CRASH("This instruction is not recoverable.");
 }
 
 bool
@@ -852,8 +850,7 @@ MMathFunction::writeRecoverData(CompactBufferWriter &writer) const
         writer.writeUnsigned(uint32_t(RInstruction::Recover_Round));
         return true;
       default:
-        MOZ_ASSUME_UNREACHABLE("Unknown math function.");
-        return false;
+        MOZ_CRASH("Unknown math function.");
     }
 }
 
@@ -981,14 +978,14 @@ MNewArray::writeRecoverData(CompactBufferWriter &writer) const
     MOZ_ASSERT(canRecoverOnBailout());
     writer.writeUnsigned(uint32_t(RInstruction::Recover_NewArray));
     writer.writeUnsigned(count());
-    writer.writeByte(isAllocating());
+    writer.writeByte(uint8_t(allocatingBehaviour()));
     return true;
 }
 
 RNewArray::RNewArray(CompactBufferReader &reader)
 {
     count_ = reader.readUnsigned();
-    isAllocating_ = reader.readByte();
+    allocatingBehaviour_ = AllocatingBehaviour(reader.readByte());
 }
 
 bool
@@ -1006,7 +1003,7 @@ RNewArray::recover(JSContext *cx, SnapshotIterator &iter) const
     if (!templateObject->hasSingletonType())
         type = templateObject->type();
 
-    JSObject *resultObject = NewDenseArray(cx, count_, type, isAllocating_);
+    JSObject *resultObject = NewDenseArray(cx, count_, type, allocatingBehaviour_);
     if (!resultObject)
         return false;
 
diff --git a/js/src/jit/Recover.h b/js/src/jit/Recover.h
index bc31a576a2f..cd7aea7a5d0 100644
--- a/js/src/jit/Recover.h
+++ b/js/src/jit/Recover.h
@@ -9,6 +9,8 @@
 
 #include "mozilla/Attributes.h"
 
+#include "jsarray.h"
+
 #include "jit/Snapshots.h"
 
 struct JSContext;
@@ -505,7 +507,7 @@ class RNewArray MOZ_FINAL : public RInstruction
 {
   private:
     uint32_t count_;
-    bool isAllocating_;
+    AllocatingBehaviour allocatingBehaviour_;
 
   public:
     RINSTRUCTION_HEADER_(NewArray)
diff --git a/js/src/jit/ScalarReplacement.cpp b/js/src/jit/ScalarReplacement.cpp
index 49dda73cf52..a34bdd012cd 100644
--- a/js/src/jit/ScalarReplacement.cpp
+++ b/js/src/jit/ScalarReplacement.cpp
@@ -508,7 +508,7 @@ IsArrayEscaped(MInstruction *ins)
 
     // The array is probably too large to be represented efficiently with
     // MArrayState, and we do not want to make huge allocations during bailouts.
-    if (!ins->toNewArray()->isAllocating()) {
+    if (ins->toNewArray()->allocatingBehaviour() == NewArray_Unallocating) {
         JitSpewDef(JitSpew_Escape, "Array is not allocated\n", ins);
         return true;
     }
diff --git a/js/src/jit/Snapshots.cpp b/js/src/jit/Snapshots.cpp
index 0afefa712cd..cdb9b783ca0 100644
--- a/js/src/jit/Snapshots.cpp
+++ b/js/src/jit/Snapshots.cpp
@@ -251,7 +251,7 @@ RValueAllocation::layoutFromMode(Mode mode)
       }
     }
 
-    MOZ_ASSUME_UNREACHABLE("Wrong mode type?");
+    MOZ_CRASH("Wrong mode type?");
 }
 
 // Pad serialized RValueAllocations by a multiple of X bytes in the allocation
@@ -401,7 +401,7 @@ ValTypeToString(JSValueType type)
       case JSVAL_TYPE_MAGIC:
         return "magic";
       default:
-        MOZ_ASSUME_UNREACHABLE("no payload");
+        MOZ_CRASH("no payload");
     }
 }
 
diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index 9e0fbb5677f..dcadee8f2da 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -225,7 +225,7 @@ ComparePolicy::adjustInputs(TempAllocator &alloc, MInstruction *def)
             replace = MUnbox::New(alloc, in, MIRType_String, MUnbox::Infallible);
             break;
           default:
-            MOZ_ASSUME_UNREACHABLE("Unknown compare specialization");
+            MOZ_CRASH("Unknown compare specialization");
         }
 
         def->block()->insertBefore(def, replace);
@@ -726,7 +726,7 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
         value = boxAt(alloc, ins, value);
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("Unexpected type");
+        MOZ_CRASH("Unexpected type");
     }
 
     if (value != curValue) {
@@ -769,7 +769,7 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
         }
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("Invalid array type");
+        MOZ_CRASH("Invalid array type");
     }
 
     if (value != curValue)
diff --git a/js/src/jit/TypedObjectPrediction.cpp b/js/src/jit/TypedObjectPrediction.cpp
index 9ff15d29138..cd3dd7ac321 100644
--- a/js/src/jit/TypedObjectPrediction.cpp
+++ b/js/src/jit/TypedObjectPrediction.cpp
@@ -98,7 +98,7 @@ TypedObjectPrediction::addProto(const TypedProto &proto)
         return;
     }
 
-    MOZ_ASSUME_UNREACHABLE("Bad predictionKind");
+    MOZ_CRASH("Bad predictionKind");
 }
 
 type::Kind
@@ -119,7 +119,7 @@ TypedObjectPrediction::kind() const
         return prefix().descr->kind();
     }
 
-    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
+    MOZ_CRASH("Bad prediction kind");
 }
 
 bool
@@ -137,7 +137,7 @@ TypedObjectPrediction::ofArrayKind() const
         return true;
     }
 
-    MOZ_ASSUME_UNREACHABLE("Bad kind");
+    MOZ_CRASH("Bad kind");
 }
 
 static bool
@@ -172,7 +172,7 @@ TypedObjectPrediction::hasKnownSize(int32_t *out) const
             // The prototype does not track the precise dimensions of arrays.
             return false;
         }
-        MOZ_ASSUME_UNREACHABLE("Unknown kind");
+        MOZ_CRASH("Unknown kind");
 
       case TypedObjectPrediction::Descr:
         return DescrHasKnownSize(descr(), out);
@@ -183,7 +183,7 @@ TypedObjectPrediction::hasKnownSize(int32_t *out) const
         return false;
     }
 
-    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
+    MOZ_CRASH("Bad prediction kind");
 }
 
 const TypedProto *
@@ -206,7 +206,7 @@ TypedObjectPrediction::getKnownPrototype() const
           case type::UnsizedArray:
             return &proto();
         }
-        MOZ_ASSUME_UNREACHABLE("Invalid proto().kind()");
+        MOZ_CRASH("Invalid proto().kind()");
 
       case TypedObjectPrediction::Descr:
         if (descr().is<ComplexTypeDescr>())
@@ -219,7 +219,7 @@ TypedObjectPrediction::getKnownPrototype() const
         return nullptr;
     }
 
-    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
+    MOZ_CRASH("Bad prediction kind");
 }
 
 template<typename T>
@@ -242,7 +242,7 @@ TypedObjectPrediction::extractType() const
         break; // Prefixes are always structs, never scalars etc
     }
 
-    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
+    MOZ_CRASH("Bad prediction kind");
 }
 
 ScalarTypeDescr::Type
@@ -288,7 +288,7 @@ TypedObjectPrediction::hasKnownArrayLength(int32_t *length) const
       case TypedObjectPrediction::Prefix:
         break; // Prefixes are always structs, never arrays
     }
-    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
+    MOZ_CRASH("Bad prediction kind");
 }
 
 static TypeDescr &
@@ -316,7 +316,7 @@ TypedObjectPrediction::arrayElementType() const
       case TypedObjectPrediction::Prefix:
         break; // Prefixes are always structs, never arrays
     }
-    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
+    MOZ_CRASH("Bad prediction kind");
 }
 
 bool
@@ -369,5 +369,5 @@ TypedObjectPrediction::hasFieldNamed(jsid id,
             *prefix().descr, prefix().fields,
             id, fieldOffset, fieldType, fieldIndex);
     }
-    MOZ_ASSUME_UNREACHABLE("Bad prediction kind");
+    MOZ_CRASH("Bad prediction kind");
 }
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index a983415ed8a..a680890bab9 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -315,7 +315,7 @@ NewInitArray(JSContext *cx, uint32_t count, types::TypeObject *typeArg)
     NewObjectKind newKind = !type ? SingletonObject : GenericObject;
     if (type && type->shouldPreTenure())
         newKind = TenuredObject;
-    RootedObject obj(cx, NewDenseAllocatedArray(cx, count, nullptr, newKind));
+    RootedObject obj(cx, NewDenseFullyAllocatedArray(cx, count, nullptr, newKind));
     if (!obj)
         return nullptr;
 
@@ -513,7 +513,7 @@ ArrayJoin(JSContext *cx, HandleObject array, HandleString sep)
 bool
 CharCodeAt(JSContext *cx, HandleString str, int32_t index, uint32_t *code)
 {
-    jschar c;
+    char16_t c;
     if (!str->getChar(cx, index, &c))
         return false;
     *code = c;
@@ -523,7 +523,7 @@ CharCodeAt(JSContext *cx, HandleString str, int32_t index, uint32_t *code)
 JSFlatString *
 StringFromCharCode(JSContext *cx, int32_t code)
 {
-    jschar c = jschar(code);
+    char16_t c = char16_t(code);
 
     if (StaticStrings::hasUnit(c))
         return cx->staticStrings().getUnit(c);
@@ -747,8 +747,8 @@ FilterArgumentsOrEval(JSContext *cx, JSString *str)
     if (!linear)
         return false;
 
-    static const jschar arguments[] = {'a', 'r', 'g', 'u', 'm', 'e', 'n', 't', 's'};
-    static const jschar eval[] = {'e', 'v', 'a', 'l'};
+    static const char16_t arguments[] = {'a', 'r', 'g', 'u', 'm', 'e', 'n', 't', 's'};
+    static const char16_t eval[] = {'e', 'v', 'a', 'l'};
 
     return !StringHasPattern(linear, arguments, mozilla::ArrayLength(arguments)) &&
         !StringHasPattern(linear, eval, mozilla::ArrayLength(eval));
diff --git a/js/src/jit/mips/Assembler-mips.h b/js/src/jit/mips/Assembler-mips.h
index f8b22d98708..7f6d37e6eb1 100644
--- a/js/src/jit/mips/Assembler-mips.h
+++ b/js/src/jit/mips/Assembler-mips.h
@@ -114,8 +114,10 @@ static MOZ_CONSTEXPR_VAR Register FramePointer = InvalidReg;
 static MOZ_CONSTEXPR_VAR Register ReturnReg = v0;
 static MOZ_CONSTEXPR_VAR FloatRegister ReturnFloat32Reg = { FloatRegisters::f0, FloatRegister::Single };
 static MOZ_CONSTEXPR_VAR FloatRegister ReturnDoubleReg = { FloatRegisters::f0, FloatRegister::Double };
+static MOZ_CONSTEXPR_VAR FloatRegister ReturnSimdReg = InvalidFloatReg;
 static MOZ_CONSTEXPR_VAR FloatRegister ScratchFloat32Reg = { FloatRegisters::f18, FloatRegister::Single };
 static MOZ_CONSTEXPR_VAR FloatRegister ScratchDoubleReg = { FloatRegisters::f18, FloatRegister::Double };
+static MOZ_CONSTEXPR_VAR FloatRegister ScratchSimdReg = InvalidFloatReg;
 static MOZ_CONSTEXPR_VAR FloatRegister SecondScratchFloat32Reg = { FloatRegisters::f16, FloatRegister::Single };
 static MOZ_CONSTEXPR_VAR FloatRegister SecondScratchDoubleReg = { FloatRegisters::f16, FloatRegister::Double };
 
@@ -1015,6 +1017,9 @@ class Assembler : public AssemblerShared
         return false;
 #endif
     }
+    static bool SupportsSimd() {
+        return js::jit::SupportsSimd;
+    }
 
   protected:
     InstImm invertBranch(InstImm branch, BOffImm16 skipOffset);
diff --git a/js/src/jit/mips/CodeGenerator-mips.h b/js/src/jit/mips/CodeGenerator-mips.h
index b81a19b61a4..510f33398fb 100644
--- a/js/src/jit/mips/CodeGenerator-mips.h
+++ b/js/src/jit/mips/CodeGenerator-mips.h
@@ -265,6 +265,21 @@ class CodeGeneratorMIPS : public CodeGeneratorShared
     bool visitEffectiveAddress(LEffectiveAddress *ins);
     bool visitUDiv(LUDiv *ins);
     bool visitUMod(LUMod *ins);
+
+  public:
+    // Unimplemented SIMD instructions
+    bool visitSimdValueX4(LSimdValueX4 *lir) { MOZ_CRASH("NYI"); }
+    bool visitSimdSplatX4(LSimdSplatX4 *lir) { MOZ_CRASH("NYI"); }
+    bool visitInt32x4(LInt32x4 *ins) { MOZ_CRASH("NYI"); }
+    bool visitFloat32x4(LFloat32x4 *ins) { MOZ_CRASH("NYI"); }
+    bool visitSimdExtractElementI(LSimdExtractElementI *ins) { MOZ_CRASH("NYI"); }
+    bool visitSimdExtractElementF(LSimdExtractElementF *ins) { MOZ_CRASH("NYI"); }
+    bool visitSimdSignMaskX4(LSimdSignMaskX4 *ins) { MOZ_CRASH("NYI"); }
+    bool visitSimdBinaryCompIx4(LSimdBinaryCompIx4 *lir) { MOZ_CRASH("NYI"); }
+    bool visitSimdBinaryCompFx4(LSimdBinaryCompFx4 *lir) { MOZ_CRASH("NYI"); }
+    bool visitSimdBinaryArithIx4(LSimdBinaryArithIx4 *lir) { MOZ_CRASH("NYI"); }
+    bool visitSimdBinaryArithFx4(LSimdBinaryArithFx4 *lir) { MOZ_CRASH("NYI"); }
+    bool visitSimdBinaryBitwiseX4(LSimdBinaryBitwiseX4 *lir) { MOZ_CRASH("NYI"); }
 };
 
 typedef CodeGeneratorMIPS CodeGeneratorSpecific;
diff --git a/js/src/jit/mips/MacroAssembler-mips.cpp b/js/src/jit/mips/MacroAssembler-mips.cpp
index f7243ccd264..10356e331db 100644
--- a/js/src/jit/mips/MacroAssembler-mips.cpp
+++ b/js/src/jit/mips/MacroAssembler-mips.cpp
@@ -1560,7 +1560,7 @@ MacroAssemblerMIPSCompat::freeStack(Register amount)
 void
 MacroAssembler::PushRegsInMask(RegisterSet set, FloatRegisterSet simdSet)
 {
-    JS_ASSERT(!SupportsSimd && simdSet.size() == 0);
+    JS_ASSERT(!SupportsSimd() && simdSet.size() == 0);
     int32_t diffF = set.fpus().getPushSizeInBytes();
     int32_t diffG = set.gprs().size() * sizeof(intptr_t);
 
@@ -1588,7 +1588,7 @@ MacroAssembler::PushRegsInMask(RegisterSet set, FloatRegisterSet simdSet)
 void
 MacroAssembler::PopRegsInMaskIgnore(RegisterSet set, RegisterSet ignore, FloatRegisterSet simdSet)
 {
-    JS_ASSERT(!SupportsSimd && simdSet.size() == 0);
+    JS_ASSERT(!SupportsSimd() && simdSet.size() == 0);
     int32_t diffG = set.gprs().size() * sizeof(intptr_t);
     int32_t diffF = set.fpus().getPushSizeInBytes();
     const int32_t reservedG = diffG;
@@ -3285,7 +3285,7 @@ void
 MacroAssembler::alignFrameForICArguments(AfterICSaveLive &aic)
 {
     if (framePushed() % ABIStackAlignment != 0) {
-        aic.alignmentPadding = ABIStackAlignment - (framePushed() % StackAlignment);
+        aic.alignmentPadding = ABIStackAlignment - (framePushed() % ABIStackAlignment);
         reserveStack(aic.alignmentPadding);
     } else {
         aic.alignmentPadding = 0;
diff --git a/js/src/jit/mips/MacroAssembler-mips.h b/js/src/jit/mips/MacroAssembler-mips.h
index 726d5305b44..ee1ba973018 100644
--- a/js/src/jit/mips/MacroAssembler-mips.h
+++ b/js/src/jit/mips/MacroAssembler-mips.h
@@ -1067,6 +1067,16 @@ public:
 
     void loadPrivate(const Address &address, Register dest);
 
+    void loadAlignedInt32x4(const Address &addr, FloatRegister dest) { MOZ_CRASH("NYI"); }
+    void storeAlignedInt32x4(FloatRegister src, Address addr) { MOZ_CRASH("NYI"); }
+    void loadUnalignedInt32x4(const Address &addr, FloatRegister dest) { MOZ_CRASH("NYI"); }
+    void storeUnalignedInt32x4(FloatRegister src, Address addr) { MOZ_CRASH("NYI"); }
+
+    void loadAlignedFloat32x4(const Address &addr, FloatRegister dest) { MOZ_CRASH("NYI"); }
+    void storeAlignedFloat32x4(FloatRegister src, Address addr) { MOZ_CRASH("NYI"); }
+    void loadUnalignedFloat32x4(const Address &addr, FloatRegister dest) { MOZ_CRASH("NYI"); }
+    void storeUnalignedFloat32x4(FloatRegister src, Address addr) { MOZ_CRASH("NYI"); }
+
     void loadDouble(const Address &addr, FloatRegister dest);
     void loadDouble(const BaseIndex &src, FloatRegister dest);
 
diff --git a/js/src/jit/shared/Assembler-shared.h b/js/src/jit/shared/Assembler-shared.h
index 7df6f01900f..8f3d6449a38 100644
--- a/js/src/jit/shared/Assembler-shared.h
+++ b/js/src/jit/shared/Assembler-shared.h
@@ -71,7 +71,7 @@ ScaleFromElemWidth(int shift)
         return TimesEight;
     }
 
-    MOZ_ASSUME_UNREACHABLE("Invalid scale");
+    MOZ_CRASH("Invalid scale");
 }
 
 // Used for 32-bit immediates which do not require relocation.
@@ -93,7 +93,7 @@ struct Imm32
           case TimesEight:
             return Imm32(3);
         };
-        MOZ_ASSUME_UNREACHABLE("Invalid scale");
+        MOZ_CRASH("Invalid scale");
     }
 
     static inline Imm32 FactorOf(enum Scale s) {
diff --git a/js/src/jit/shared/CodeGenerator-shared-inl.h b/js/src/jit/shared/CodeGenerator-shared-inl.h
index bc816c7a2fb..95babe1faef 100644
--- a/js/src/jit/shared/CodeGenerator-shared-inl.h
+++ b/js/src/jit/shared/CodeGenerator-shared-inl.h
@@ -19,7 +19,7 @@ ToInt32(const LAllocation *a)
         return a->toConstant()->toInt32();
     if (a->isConstantIndex())
         return a->toConstantIndex()->index();
-    MOZ_ASSUME_UNREACHABLE("this is not a constant!");
+    MOZ_CRASH("this is not a constant!");
 }
 
 static inline double
diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
index e1a7bf1e6a2..9852657e08e 100644
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@@ -479,7 +479,7 @@ CodeGeneratorShared::assignBailoutId(LSnapshot *snapshot)
     switch (gen->info().executionMode()) {
       case SequentialExecution: break;
       case ParallelExecution: return false;
-      default: MOZ_ASSUME_UNREACHABLE("No such execution mode");
+      default: MOZ_CRASH("No such execution mode");
     }
 
     JS_ASSERT(frameClass_ != FrameSizeClass::None());
diff --git a/js/src/jit/shared/CodeGenerator-x86-shared.cpp b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
index e6c6d22dd60..5ea3a54d947 100644
--- a/js/src/jit/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-x86-shared.cpp
@@ -2265,7 +2265,7 @@ CodeGeneratorX86Shared::visitSimdBinaryCompIx4(LSimdBinaryCompIx4 *ins)
         // These operations are not part of the spec. so are not implemented.
         break;
     }
-    MOZ_ASSUME_UNREACHABLE("unexpected SIMD op");
+    MOZ_CRASH("unexpected SIMD op");
 }
 
 bool
@@ -2296,7 +2296,7 @@ CodeGeneratorX86Shared::visitSimdBinaryCompFx4(LSimdBinaryCompFx4 *ins)
         masm.cmpps(rhs, lhs, 0x6);
         return true;
     }
-    MOZ_ASSUME_UNREACHABLE("unexpected SIMD op");
+    MOZ_CRASH("unexpected SIMD op");
 }
 
 bool
diff --git a/js/src/jit/shared/IonAssemblerBuffer.h b/js/src/jit/shared/IonAssemblerBuffer.h
index 1ff94997aa6..aa85c9a6e0d 100644
--- a/js/src/jit/shared/IonAssemblerBuffer.h
+++ b/js/src/jit/shared/IonAssemblerBuffer.h
@@ -240,7 +240,7 @@ struct AssemblerBuffer
             return BufferOffset(bufferSize);
     }
     BufferOffset prevOffset() const {
-        MOZ_ASSUME_UNREACHABLE("Don't current record lastInstSize");
+        MOZ_CRASH("Don't current record lastInstSize");
     }
 
     // Break the instruction stream so we can go back and edit it at this point
diff --git a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
index 8ac8bb0bf09..1581b8a9cd9 100644
--- a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
+++ b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
@@ -859,7 +859,7 @@ struct AssemblerBufferWithConstantPools : public AssemblerBuffer<SliceSize, Inst
                 return pi->finalPos - pi->size + headerSize_ * InstSize + offset;
             offset -= size;
         }
-        MOZ_ASSUME_UNREACHABLE("Entry is not in a pool");
+        MOZ_CRASH("Entry is not in a pool");
     }
 };
 
diff --git a/js/src/jit/x64/CodeGenerator-x64.cpp b/js/src/jit/x64/CodeGenerator-x64.cpp
index bb68322c99d..dae7680ca0e 100644
--- a/js/src/jit/x64/CodeGenerator-x64.cpp
+++ b/js/src/jit/x64/CodeGenerator-x64.cpp
@@ -372,7 +372,7 @@ CodeGeneratorX64::visitAsmJSLoadGlobalVar(LAsmJSLoadGlobalVar *ins)
         label = masm.loadRipRelativeFloat32x4(ToFloatRegister(ins->output()));
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("unexpected type in visitAsmJSLoadGlobalVar");
+        MOZ_CRASH("unexpected type in visitAsmJSLoadGlobalVar");
     }
 
     masm.append(AsmJSGlobalAccess(label, mir->globalDataOffset()));
@@ -407,7 +407,7 @@ CodeGeneratorX64::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
         label = masm.storeRipRelativeFloat32x4(ToFloatRegister(ins->value()));
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("unexpected type in visitAsmJSStoreGlobalVar");
+        MOZ_CRASH("unexpected type in visitAsmJSStoreGlobalVar");
     }
 
     masm.append(AsmJSGlobalAccess(label, mir->globalDataOffset()));
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index 31351c3985b..7b7799150aa 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -70,7 +70,7 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
         SimdConstant value;
         NonAssertingLabel uses;
 
-        SimdData(const SimdConstant &v) : value(v) {}
+        explicit SimdData(const SimdConstant &v) : value(v) {}
         SimdConstant::Type type() { return value.type(); }
     };
     Vector<SimdData, 0, SystemAllocPolicy> simds_;
diff --git a/js/src/jit/x86/CodeGenerator-x86.cpp b/js/src/jit/x86/CodeGenerator-x86.cpp
index 8a5d303defe..fe6930adacc 100644
--- a/js/src/jit/x86/CodeGenerator-x86.cpp
+++ b/js/src/jit/x86/CodeGenerator-x86.cpp
@@ -484,7 +484,7 @@ CodeGeneratorX86::visitAsmJSLoadGlobalVar(LAsmJSLoadGlobalVar *ins)
         label = masm.movapsWithPatch(PatchedAbsoluteAddress(), ToFloatRegister(ins->output()));
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("unexpected type in visitAsmJSLoadGlobalVar");
+        MOZ_CRASH("unexpected type in visitAsmJSLoadGlobalVar");
     }
     masm.append(AsmJSGlobalAccess(label, mir->globalDataOffset()));
     return true;
@@ -518,7 +518,7 @@ CodeGeneratorX86::visitAsmJSStoreGlobalVar(LAsmJSStoreGlobalVar *ins)
         label = masm.movapsWithPatch(ToFloatRegister(ins->value()), PatchedAbsoluteAddress());
         break;
       default:
-        MOZ_ASSUME_UNREACHABLE("unexpected type in visitAsmJSStoreGlobalVar");
+        MOZ_CRASH("unexpected type in visitAsmJSStoreGlobalVar");
     }
     masm.append(AsmJSGlobalAccess(label, mir->globalDataOffset()));
     return true;
diff --git a/js/src/jsapi-tests/testDebugger.cpp b/js/src/jsapi-tests/testDebugger.cpp
index 799d4c64765..8cb4137e931 100644
--- a/js/src/jsapi-tests/testDebugger.cpp
+++ b/js/src/jsapi-tests/testDebugger.cpp
@@ -12,45 +12,6 @@
 
 using namespace js;
 
-BEGIN_TEST(testDebugger_debuggerObjectVsDebugMode)
-{
-    CHECK(JS_DefineDebuggerObject(cx, global));
-    JS::RootedObject debuggee(cx, JS_NewGlobalObject(cx, getGlobalClass(), nullptr, JS::FireOnNewGlobalHook));
-    CHECK(debuggee);
-
-    {
-        JSAutoCompartment ae(cx, debuggee);
-        CHECK(JS_SetDebugMode(cx, true));
-        CHECK(JS_InitStandardClasses(cx, debuggee));
-    }
-
-    JS::RootedObject debuggeeWrapper(cx, debuggee);
-    CHECK(JS_WrapObject(cx, &debuggeeWrapper));
-    JS::RootedValue v(cx, JS::ObjectValue(*debuggeeWrapper));
-    CHECK(JS_SetProperty(cx, global, "debuggee", v));
-
-    EVAL("var dbg = new Debugger(debuggee);\n"
-         "var hits = 0;\n"
-         "dbg.onDebuggerStatement = function () { hits++; };\n"
-         "debuggee.eval('debugger;');\n"
-         "hits;\n",
-         &v);
-    CHECK_SAME(v, JSVAL_ONE);
-
-    {
-        JSAutoCompartment ae(cx, debuggee);
-        CHECK(JS_SetDebugMode(cx, false));
-    }
-
-    EVAL("debuggee.eval('debugger; debugger; debugger;');\n"
-         "hits;\n",
-         &v);
-    CHECK_SAME(v, INT_TO_JSVAL(4));
-
-    return true;
-}
-END_TEST(testDebugger_debuggerObjectVsDebugMode)
-
 BEGIN_TEST(testDebugger_newScriptHook)
 {
     // Test that top-level indirect eval fires the newScript hook.
diff --git a/js/src/jsapi-tests/testExternalStrings.cpp b/js/src/jsapi-tests/testExternalStrings.cpp
index a6205abc13e..77a642c4ccd 100644
--- a/js/src/jsapi-tests/testExternalStrings.cpp
+++ b/js/src/jsapi-tests/testExternalStrings.cpp
@@ -10,7 +10,7 @@
 using mozilla::ArrayLength;
 using mozilla::PodEqual;
 
-static const jschar arr[] = {
+static const char16_t arr[] = {
     'h', 'i', ',', 'd', 'o', 'n', '\'', 't', ' ', 'd', 'e', 'l', 'e', 't', 'e', ' ', 'm', 'e', '\0'
 };
 static const size_t arrlen = ArrayLength(arr) - 1;
@@ -19,15 +19,15 @@ static int finalized1 = 0;
 static int finalized2 = 0;
 
 static void
-finalize_str(const JSStringFinalizer *fin, jschar *chars);
+finalize_str(const JSStringFinalizer *fin, char16_t *chars);
 
 static const JSStringFinalizer finalizer1 = { finalize_str };
 static const JSStringFinalizer finalizer2 = { finalize_str };
 
 static void
-finalize_str(const JSStringFinalizer *fin, jschar *chars)
+finalize_str(const JSStringFinalizer *fin, char16_t *chars)
 {
-    if (chars && PodEqual(const_cast<const jschar *>(chars), arr, arrlen)) {
+    if (chars && PodEqual(const_cast<const char16_t *>(chars), arr, arrlen)) {
         if (fin == &finalizer1) {
             ++finalized1;
         } else if (fin == &finalizer2) {
diff --git a/js/src/jsapi-tests/testIndexToString.cpp b/js/src/jsapi-tests/testIndexToString.cpp
index 8b8e33b1b63..43203fddd1b 100644
--- a/js/src/jsapi-tests/testIndexToString.cpp
+++ b/js/src/jsapi-tests/testIndexToString.cpp
@@ -87,19 +87,19 @@ BEGIN_TEST(testStringToPropertyName)
 {
     uint32_t index;
 
-    static const jschar hiChars[] = { 'h', 'i' };
+    static const char16_t hiChars[] = { 'h', 'i' };
     JSFlatString *hiStr = NewString(cx, hiChars);
     CHECK(hiStr);
     CHECK(!hiStr->isIndex(&index));
     CHECK(hiStr->toPropertyName(cx) != nullptr);
 
-    static const jschar maxChars[] = { '4', '2', '9', '4', '9', '6', '7', '2', '9', '5' };
+    static const char16_t maxChars[] = { '4', '2', '9', '4', '9', '6', '7', '2', '9', '5' };
     JSFlatString *maxStr = NewString(cx, maxChars);
     CHECK(maxStr);
     CHECK(maxStr->isIndex(&index));
     CHECK(index == UINT32_MAX);
 
-    static const jschar maxPlusOneChars[] = { '4', '2', '9', '4', '9', '6', '7', '2', '9', '6' };
+    static const char16_t maxPlusOneChars[] = { '4', '2', '9', '4', '9', '6', '7', '2', '9', '6' };
     JSFlatString *maxPlusOneStr = NewString(cx, maxPlusOneChars);
     CHECK(maxPlusOneStr);
     CHECK(!maxPlusOneStr->isIndex(&index));
@@ -109,7 +109,7 @@ BEGIN_TEST(testStringToPropertyName)
 }
 
 template<size_t N> static JSFlatString *
-NewString(JSContext *cx, const jschar (&chars)[N])
+NewString(JSContext *cx, const char16_t (&chars)[N])
 {
     return js::NewStringCopyN<js::CanGC>(cx, chars, N);
 }
diff --git a/js/src/jsapi-tests/testIntTypesABI.cpp b/js/src/jsapi-tests/testIntTypesABI.cpp
index b923b11dbf6..51d426ad217 100644
--- a/js/src/jsapi-tests/testIntTypesABI.cpp
+++ b/js/src/jsapi-tests/testIntTypesABI.cpp
@@ -19,7 +19,7 @@
 #include "js/CharacterEncoding.h"
 #include "js/Class.h"
 #include "js/Date.h"
-#include "js/DebugAPI.h"
+#include "js/Debug.h"
 #include "js/GCAPI.h"
 #include "js/HashTable.h"
 #include "js/HeapAPI.h"
diff --git a/js/src/jsapi-tests/testOOM.cpp b/js/src/jsapi-tests/testOOM.cpp
index bac4b926e2a..3fa6828a52b 100644
--- a/js/src/jsapi-tests/testOOM.cpp
+++ b/js/src/jsapi-tests/testOOM.cpp
@@ -10,7 +10,7 @@ BEGIN_TEST(testOOM)
 {
     JS::RootedValue v(cx, JS::Int32Value(9));
     JS::RootedString jsstr(cx, JS::ToString(cx, v));
-    jschar ch;
+    char16_t ch;
     if (!JS_GetStringCharAt(cx, jsstr, 0, &ch))
         return false;
     JS_ASSERT(ch == '9');
diff --git a/js/src/jsapi-tests/testOriginPrincipals.cpp b/js/src/jsapi-tests/testOriginPrincipals.cpp
index 28842255002..a46cfbd7fcd 100644
--- a/js/src/jsapi-tests/testOriginPrincipals.cpp
+++ b/js/src/jsapi-tests/testOriginPrincipals.cpp
@@ -55,7 +55,7 @@ bool
 eval(const char *asciiChars, JSPrincipals *principals, JSPrincipals *originPrincipals, JS::MutableHandleValue rval)
 {
     size_t len = strlen(asciiChars);
-    jschar *chars = new jschar[len+1];
+    char16_t *chars = new char16_t[len+1];
     for (size_t i = 0; i < len; ++i)
         chars[i] = asciiChars[i];
     chars[len] = 0;
diff --git a/js/src/jsapi-tests/testParseJSON.cpp b/js/src/jsapi-tests/testParseJSON.cpp
index 773320821e5..945220cc142 100644
--- a/js/src/jsapi-tests/testParseJSON.cpp
+++ b/js/src/jsapi-tests/testParseJSON.cpp
@@ -15,7 +15,7 @@ using namespace js;
 
 class AutoInflatedString {
     JSContext * const cx;
-    jschar *chars_;
+    char16_t *chars_;
     size_t length_;
 
   public:
@@ -31,7 +31,7 @@ class AutoInflatedString {
             abort();
     }
 
-    const jschar *chars() const { return chars_; }
+    const char16_t *chars() const { return chars_; }
     size_t length() const { return length_; }
 };
 
@@ -71,26 +71,26 @@ BEGIN_TEST(testParseJSON_success)
 
     JS::Rooted<JSFlatString*> str(cx);
 
-    const jschar emptystr[] = { '\0' };
+    const char16_t emptystr[] = { '\0' };
     str = js::NewStringCopyN<CanGC>(cx, emptystr, 0);
     CHECK(str);
     expected = STRING_TO_JSVAL(str);
     CHECK(TryParse(cx, "\"\"", expected));
 
-    const jschar nullstr[] = { '\0' };
+    const char16_t nullstr[] = { '\0' };
     str = NewString(cx, nullstr);
     CHECK(str);
     expected = STRING_TO_JSVAL(str);
     CHECK(TryParse(cx, "\"\\u0000\"", expected));
 
-    const jschar backstr[] = { '\b' };
+    const char16_t backstr[] = { '\b' };
     str = NewString(cx, backstr);
     CHECK(str);
     expected = STRING_TO_JSVAL(str);
     CHECK(TryParse(cx, "\"\\b\"", expected));
     CHECK(TryParse(cx, "\"\\u0008\"", expected));
 
-    const jschar newlinestr[] = { '\n', };
+    const char16_t newlinestr[] = { '\n', };
     str = NewString(cx, newlinestr);
     CHECK(str);
     expected = STRING_TO_JSVAL(str);
@@ -136,7 +136,7 @@ BEGIN_TEST(testParseJSON_success)
 }
 
 template<size_t N> static JSFlatString *
-NewString(JSContext *cx, const jschar (&chars)[N])
+NewString(JSContext *cx, const char16_t (&chars)[N])
 {
     return js::NewStringCopyN<CanGC>(cx, chars, N);
 }
@@ -306,15 +306,15 @@ struct ContextPrivate {
     static const size_t MaxSize = sizeof("4294967295");
     unsigned unexpectedErrorCount;
     unsigned expectedErrorCount;
-    jschar column[MaxSize];
-    jschar line[MaxSize];
+    char16_t column[MaxSize];
+    char16_t line[MaxSize];
 };
 
 static void
 ReportJSONError(JSContext *cx, const char *message, JSErrorReport *report)
 {
     ContextPrivate *p = static_cast<ContextPrivate *>(JS_GetContextPrivate(cx));
-    // Although messageArgs[1] and messageArgs[2] are jschar*, we cast them to char*
+    // Although messageArgs[1] and messageArgs[2] are char16_t*, we cast them to char*
     // here because JSONParser::error() stores char* strings in them.
     js_strncpy(p->line, report->messageArgs[1], js_strlen(report->messageArgs[1]));
     js_strncpy(p->column, report->messageArgs[2], js_strlen(report->messageArgs[2]));
diff --git a/js/src/jsapi-tests/testScriptInfo.cpp b/js/src/jsapi-tests/testScriptInfo.cpp
index a19b36d60a7..972c057214e 100644
--- a/js/src/jsapi-tests/testScriptInfo.cpp
+++ b/js/src/jsapi-tests/testScriptInfo.cpp
@@ -37,14 +37,14 @@ BEGIN_TEST(testScriptInfo)
     CHECK_EQUAL(JS_GetScriptBaseLineNumber(cx, script), startLine);
     CHECK_EQUAL(JS_PCToLineNumber(cx, script, start), startLine);
     CHECK(strcmp(JS_GetScriptFilename(script), __FILE__) == 0);
-    const jschar *sourceMap = JS_GetScriptSourceMap(cx, script);
+    const char16_t *sourceMap = JS_GetScriptSourceMap(cx, script);
     CHECK(sourceMap);
     CHECK(CharsMatch(sourceMap, "http://example.com/path/to/source-map.json"));
 
     return true;
 }
 static bool
-CharsMatch(const jschar *p, const char *q)
+CharsMatch(const char16_t *p, const char *q)
 {
     while (*q) {
         if (*p++ != *q++)
diff --git a/js/src/jsapi-tests/testScriptObject.cpp b/js/src/jsapi-tests/testScriptObject.cpp
index 8f9d4221ba4..376145cf5b7 100644
--- a/js/src/jsapi-tests/testScriptObject.cpp
+++ b/js/src/jsapi-tests/testScriptObject.cpp
@@ -10,7 +10,7 @@
 struct ScriptObjectFixture : public JSAPITest {
     static const int code_size;
     static const char code[];
-    static jschar uc_code[];
+    static char16_t uc_code[];
 
     ScriptObjectFixture()
     {
@@ -35,7 +35,7 @@ struct ScriptObjectFixture : public JSAPITest {
 const char ScriptObjectFixture::code[] =
     "(function(a, b){return a+' '+b;}('hello', 'world'))";
 const int ScriptObjectFixture::code_size = sizeof(ScriptObjectFixture::code) - 1;
-jschar ScriptObjectFixture::uc_code[ScriptObjectFixture::code_size];
+char16_t ScriptObjectFixture::uc_code[ScriptObjectFixture::code_size];
 
 BEGIN_FIXTURE_TEST(ScriptObjectFixture, bug438633_CompileScript)
 {
diff --git a/js/src/jsapi-tests/testUTF8.cpp b/js/src/jsapi-tests/testUTF8.cpp
index ad260d107a3..2950a7021c5 100644
--- a/js/src/jsapi-tests/testUTF8.cpp
+++ b/js/src/jsapi-tests/testUTF8.cpp
@@ -18,7 +18,7 @@ BEGIN_TEST(testUTF8_badUTF8)
     static const char badUTF8[] = "...\xC0...";
     JSString *str = JS_NewStringCopyZ(cx, badUTF8);
     CHECK(str);
-    jschar ch;
+    char16_t ch;
     if (!JS_GetStringCharAt(cx, str, 3, &ch))
         return false;
     CHECK(ch == 0x00C0);
@@ -31,7 +31,7 @@ BEGIN_TEST(testUTF8_bigUTF8)
     static const char bigUTF8[] = "...\xFB\xBF\xBF\xBF\xBF...";
     JSString *str = JS_NewStringCopyZ(cx, bigUTF8);
     CHECK(str);
-    jschar ch;
+    char16_t ch;
     if (!JS_GetStringCharAt(cx, str, 3, &ch))
         return false;
     CHECK(ch == 0x00FB);
@@ -41,8 +41,8 @@ END_TEST(testUTF8_bigUTF8)
 
 BEGIN_TEST(testUTF8_badSurrogate)
 {
-    static const jschar badSurrogate[] = { 'A', 'B', 'C', 0xDEEE, 'D', 'E', 0 };
-    mozilla::Range<const jschar> tbchars(badSurrogate, js_strlen(badSurrogate));
+    static const char16_t badSurrogate[] = { 'A', 'B', 'C', 0xDEEE, 'D', 'E', 0 };
+    mozilla::Range<const char16_t> tbchars(badSurrogate, js_strlen(badSurrogate));
     JS::Latin1CharsZ latin1 = JS::LossyTwoByteCharsToNewLatin1CharsZ(cx, tbchars);
     CHECK(latin1);
     CHECK(latin1[3] == 0x00EE);
diff --git a/js/src/jsapi-tests/testXDR.cpp b/js/src/jsapi-tests/testXDR.cpp
index d8e8073ed6b..67b93a90fbc 100644
--- a/js/src/jsapi-tests/testXDR.cpp
+++ b/js/src/jsapi-tests/testXDR.cpp
@@ -22,7 +22,7 @@ CompileScriptForPrincipalsVersionOrigin(JSContext *cx, JS::HandleObject obj,
     size_t nchars;
     if (!JS_DecodeBytes(cx, bytes, nbytes, nullptr, &nchars))
         return nullptr;
-    jschar *chars = static_cast<jschar *>(JS_malloc(cx, nchars * sizeof(jschar)));
+    char16_t *chars = static_cast<char16_t *>(JS_malloc(cx, nchars * sizeof(char16_t)));
     if (!chars)
         return nullptr;
     JS_ALWAYS_TRUE(JS_DecodeBytes(cx, bytes, nbytes, chars, &nchars));
@@ -244,7 +244,7 @@ BEGIN_TEST(testXDR_sourceMap)
         CHECK(script);
 
         size_t len = strlen(*sm);
-        jschar *expected = js::InflateString(cx, *sm, &len);
+        char16_t *expected = js::InflateString(cx, *sm, &len);
         CHECK(expected);
 
         // The script source takes responsibility of free'ing |expected|.
@@ -254,7 +254,7 @@ BEGIN_TEST(testXDR_sourceMap)
         CHECK(script->scriptSource());
         CHECK(script->scriptSource()->hasSourceMapURL());
 
-        const jschar *actual = script->scriptSource()->sourceMapURL();
+        const char16_t *actual = script->scriptSource()->sourceMapURL();
         CHECK(actual);
 
         while (*expected) {
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 13f78745573..b4ac62914b6 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -114,9 +114,9 @@ using js::frontend::Parser;
 #define JS_ADDRESSOF_VA_LIST(ap) (&(ap))
 #endif
 
-/* Make sure that jschar is two bytes unsigned integer */
-JS_STATIC_ASSERT((jschar)-1 > 0);
-JS_STATIC_ASSERT(sizeof(jschar) == 2);
+/* Make sure that char16_t is two bytes unsigned integer */
+JS_STATIC_ASSERT((char16_t)-1 > 0);
+JS_STATIC_ASSERT(sizeof(char16_t) == 2);
 
 bool
 JS::CallArgs::requireAtLeast(JSContext *cx, const char *fnname, unsigned required) {
@@ -1992,7 +1992,7 @@ JS_SetGCParametersBasedOnAvailableMemory(JSRuntime *rt, uint32_t availMem)
 
 
 JS_PUBLIC_API(JSString *)
-JS_NewExternalString(JSContext *cx, const jschar *chars, size_t length,
+JS_NewExternalString(JSContext *cx, const char16_t *chars, size_t length,
                      const JSStringFinalizer *fin)
 {
     AssertHeapIsIdle(cx);
@@ -2660,7 +2660,7 @@ JS_LookupProperty(JSContext *cx, HandleObject objArg, const char *name, MutableH
 }
 
 JS_PUBLIC_API(bool)
-JS_LookupUCProperty(JSContext *cx, HandleObject objArg, const jschar *name, size_t namelen,
+JS_LookupUCProperty(JSContext *cx, HandleObject objArg, const char16_t *name, size_t namelen,
                     MutableHandleValue vp)
 {
     RootedObject obj(cx, objArg);
@@ -2704,7 +2704,7 @@ JS_HasProperty(JSContext *cx, HandleObject obj, const char *name, bool *foundp)
 }
 
 JS_PUBLIC_API(bool)
-JS_HasUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen, bool *foundp)
+JS_HasUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen, bool *foundp)
 {
     JSAtom *atom = AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen));
     if (!atom)
@@ -2772,7 +2772,7 @@ JS_AlreadyHasOwnProperty(JSContext *cx, HandleObject obj, const char *name, bool
 }
 
 JS_PUBLIC_API(bool)
-JS_AlreadyHasOwnUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_AlreadyHasOwnUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                            bool *foundp)
 {
     JSAtom *atom = AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen));
@@ -3123,7 +3123,7 @@ JS_DefineProperty(JSContext *cx, HandleObject obj, const char *name, double valu
 }
 
 static bool
-DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+DefineUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                  const Value &value_, PropertyOp getter, StrictPropertyOp setter, unsigned attrs,
                  unsigned flags)
 {
@@ -3138,7 +3138,7 @@ DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t nam
 }
 
 JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                     HandleValue value, unsigned attrs,
                     JSPropertyOp getter, JSStrictPropertyOp setter)
 {
@@ -3146,7 +3146,7 @@ JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t
 }
 
 JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                     HandleObject valueArg, unsigned attrs,
                     JSPropertyOp getter, JSStrictPropertyOp setter)
 {
@@ -3155,7 +3155,7 @@ JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t
 }
 
 JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                     HandleString valueArg, unsigned attrs,
                     JSPropertyOp getter, JSStrictPropertyOp setter)
 {
@@ -3164,7 +3164,7 @@ JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t
 }
 
 JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                     int32_t valueArg, unsigned attrs,
                     JSPropertyOp getter, JSStrictPropertyOp setter)
 {
@@ -3174,7 +3174,7 @@ JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t
 }
 
 JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                     uint32_t valueArg, unsigned attrs,
                     JSPropertyOp getter, JSStrictPropertyOp setter)
 {
@@ -3184,7 +3184,7 @@ JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t
 }
 
 JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                     double valueArg, unsigned attrs,
                     JSPropertyOp getter, JSStrictPropertyOp setter)
 {
@@ -3419,7 +3419,7 @@ JS_GetProperty(JSContext *cx, HandleObject obj, const char *name, MutableHandleV
 }
 
 JS_PUBLIC_API(bool)
-JS_GetUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_GetUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                  MutableHandleValue vp)
 {
     JSAtom *atom = AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen));
@@ -3503,7 +3503,7 @@ JS_SetProperty(JSContext *cx, HandleObject obj, const char *name, HandleValue v)
 }
 
 JS_PUBLIC_API(bool)
-JS_SetUCProperty(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_SetUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                  HandleValue v)
 {
     JSAtom *atom = AtomizeChars(cx, name, AUTO_NAMELEN(name, namelen));
@@ -3547,7 +3547,7 @@ JS_DeleteProperty2(JSContext *cx, HandleObject obj, const char *name, bool *resu
 }
 
 JS_PUBLIC_API(bool)
-JS_DeleteUCProperty2(JSContext *cx, HandleObject obj, const jschar *name, size_t namelen,
+JS_DeleteUCProperty2(JSContext *cx, HandleObject obj, const char16_t *name, size_t namelen,
                      bool *result)
 {
     CHECK_REQUEST(cx);
@@ -3773,7 +3773,7 @@ JS_NewArrayObject(JSContext *cx, size_t length)
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
 
-    return NewDenseAllocatedArray(cx, length);
+    return NewDenseFullyAllocatedArray(cx, length);
 }
 
 JS_PUBLIC_API(bool)
@@ -4148,7 +4148,7 @@ JS_DefineFunction(JSContext *cx, HandleObject obj, const char *name, JSNative ca
 
 JS_PUBLIC_API(JSFunction *)
 JS_DefineUCFunction(JSContext *cx, HandleObject obj,
-                    const jschar *name, size_t namelen, JSNative call,
+                    const char16_t *name, size_t namelen, JSNative call,
                     unsigned nargs, unsigned attrs)
 {
     JS_ASSERT(!cx->runtime()->isAtomsCompartment(cx->compartment()));
@@ -4330,7 +4330,7 @@ JS::OwningCompileOptions::~OwningCompileOptions()
 
     // OwningCompileOptions always owns these, so these casts are okay.
     js_free(const_cast<char *>(filename_));
-    js_free(const_cast<jschar *>(sourceMapURL_));
+    js_free(const_cast<char16_t *>(sourceMapURL_));
     js_free(const_cast<char *>(introducerFilename_));
 }
 
@@ -4377,9 +4377,9 @@ JS::OwningCompileOptions::setFileAndLine(JSContext *cx, const char *f, unsigned
 }
 
 bool
-JS::OwningCompileOptions::setSourceMapURL(JSContext *cx, const jschar *s)
+JS::OwningCompileOptions::setSourceMapURL(JSContext *cx, const char16_t *s)
 {
-    UniquePtr<jschar[], JS::FreePolicy> copy;
+    UniquePtr<char16_t[], JS::FreePolicy> copy;
     if (s) {
         copy = DuplicateString(cx, s);
         if (!copy)
@@ -4387,7 +4387,7 @@ JS::OwningCompileOptions::setSourceMapURL(JSContext *cx, const jschar *s)
     }
 
     // OwningCompileOptions always owns sourceMapURL_, so this cast is okay.
-    js_free(const_cast<jschar *>(sourceMapURL_));
+    js_free(const_cast<char16_t *>(sourceMapURL_));
 
     sourceMapURL_ = copy.release();
     return true;
@@ -4439,7 +4439,7 @@ JS::Compile(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optio
 
 bool
 JS::Compile(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
-            const jschar *chars, size_t length, MutableHandleScript script)
+            const char16_t *chars, size_t length, MutableHandleScript script)
 {
     SourceBufferHolder srcBuf(chars, length, SourceBufferHolder::NoOwnership);
     return Compile(cx, obj, options, srcBuf, script);
@@ -4449,7 +4449,7 @@ bool
 JS::Compile(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
             const char *bytes, size_t length, MutableHandleScript script)
 {
-    mozilla::ScopedFreePtr<jschar> chars;
+    mozilla::ScopedFreePtr<char16_t> chars;
     if (options.utf8)
         chars = UTF8CharsToNewTwoByteCharsZ(cx, UTF8Chars(bytes, length), &length).get();
     else
@@ -4509,7 +4509,7 @@ JS::CanCompileOffThread(JSContext *cx, const ReadOnlyCompileOptions &options, si
 
 JS_PUBLIC_API(bool)
 JS::CompileOffThread(JSContext *cx, const ReadOnlyCompileOptions &options,
-                     const jschar *chars, size_t length,
+                     const char16_t *chars, size_t length,
                      OffThreadCompileCallback callback, void *callbackData)
 {
     JS_ASSERT(CanCompileOffThread(cx, options, length));
@@ -4541,7 +4541,7 @@ JS_CompileScript(JSContext *cx, JS::HandleObject obj, const char *ascii,
 }
 
 JS_PUBLIC_API(bool)
-JS_CompileUCScript(JSContext *cx, JS::HandleObject obj, const jschar *chars,
+JS_CompileUCScript(JSContext *cx, JS::HandleObject obj, const char16_t *chars,
                    size_t length, const JS::CompileOptions &options, MutableHandleScript script)
 {
     return Compile(cx, obj, options, chars, length, script);
@@ -4556,7 +4556,7 @@ JS_BufferIsCompilableUnit(JSContext *cx, HandleObject obj, const char *utf8, siz
 
     cx->clearPendingException();
 
-    jschar *chars = JS::UTF8CharsToNewTwoByteCharsZ(cx, JS::UTF8Chars(utf8, length), &length).get();
+    char16_t *chars = JS::UTF8CharsToNewTwoByteCharsZ(cx, JS::UTF8Chars(utf8, length), &length).get();
     if (!chars)
         return true;
 
@@ -4638,7 +4638,7 @@ JS::CompileFunction(JSContext *cx, HandleObject obj, const ReadOnlyCompileOption
 JS_PUBLIC_API(bool)
 JS::CompileFunction(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
                     const char *name, unsigned nargs, const char *const *argnames,
-                    const jschar *chars, size_t length, MutableHandleFunction fun)
+                    const char16_t *chars, size_t length, MutableHandleFunction fun)
 {
     SourceBufferHolder srcBuf(chars, length, SourceBufferHolder::NoOwnership);
     return JS::CompileFunction(cx, obj, options, name, nargs, argnames, srcBuf, fun);
@@ -4649,7 +4649,7 @@ JS::CompileFunction(JSContext *cx, HandleObject obj, const ReadOnlyCompileOption
                     const char *name, unsigned nargs, const char *const *argnames,
                     const char *bytes, size_t length, MutableHandleFunction fun)
 {
-    mozilla::ScopedFreePtr<jschar> chars;
+    mozilla::ScopedFreePtr<char16_t> chars;
     if (options.utf8)
         chars = UTF8CharsToNewTwoByteCharsZ(cx, UTF8Chars(bytes, length), &length).get();
     else
@@ -4663,7 +4663,7 @@ JS::CompileFunction(JSContext *cx, HandleObject obj, const ReadOnlyCompileOption
 JS_PUBLIC_API(bool)
 JS_CompileUCFunction(JSContext *cx, JS::HandleObject obj, const char *name,
                      unsigned nargs, const char *const *argnames,
-                     const jschar *chars, size_t length,
+                     const char16_t *chars, size_t length,
                      const CompileOptions &options, MutableHandleFunction fun)
 {
     return CompileFunction(cx, obj, options, name, nargs, argnames, chars, length, fun);
@@ -4812,7 +4812,7 @@ Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsA
 
 static bool
 Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-         const jschar *chars, size_t length, JS::Value *rval)
+         const char16_t *chars, size_t length, JS::Value *rval)
 {
   SourceBufferHolder srcBuf(chars, length, SourceBufferHolder::NoOwnership);
   return ::Evaluate(cx, obj, optionsArg, srcBuf, rval);
@@ -4822,7 +4822,7 @@ static bool
 Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &options,
          const char *bytes, size_t length, JS::Value *rval)
 {
-    jschar *chars;
+    char16_t *chars;
     if (options.utf8)
         chars = UTF8CharsToNewTwoByteCharsZ(cx, JS::UTF8Chars(bytes, length), &length).get();
     else
@@ -4860,7 +4860,7 @@ JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &opti
 
 extern JS_PUBLIC_API(bool)
 JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-             const jschar *chars, size_t length, MutableHandleValue rval)
+             const char16_t *chars, size_t length, MutableHandleValue rval)
 {
     return ::Evaluate(cx, obj, optionsArg, chars, length, rval.address());
 }
@@ -4888,7 +4888,7 @@ JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &opti
 
 extern JS_PUBLIC_API(bool)
 JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &optionsArg,
-             const jschar *chars, size_t length)
+             const char16_t *chars, size_t length)
 {
     return ::Evaluate(cx, obj, optionsArg, chars, length, nullptr);
 }
@@ -4908,7 +4908,7 @@ JS::Evaluate(JSContext *cx, HandleObject obj, const ReadOnlyCompileOptions &opti
 }
 
 JS_PUBLIC_API(bool)
-JS_EvaluateUCScript(JSContext *cx, HandleObject obj, const jschar *chars, unsigned length,
+JS_EvaluateUCScript(JSContext *cx, HandleObject obj, const char16_t *chars, unsigned length,
                     const char *filename, unsigned lineno, MutableHandleValue rval)
 {
     CompileOptions options(cx);
@@ -5193,7 +5193,7 @@ JS_InternStringN(JSContext *cx, const char *s, size_t length)
 }
 
 JS_PUBLIC_API(JSString *)
-JS_NewUCString(JSContext *cx, jschar *chars, size_t length)
+JS_NewUCString(JSContext *cx, char16_t *chars, size_t length)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -5201,7 +5201,7 @@ JS_NewUCString(JSContext *cx, jschar *chars, size_t length)
 }
 
 JS_PUBLIC_API(JSString *)
-JS_NewUCStringCopyN(JSContext *cx, const jschar *s, size_t n)
+JS_NewUCStringCopyN(JSContext *cx, const char16_t *s, size_t n)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -5211,7 +5211,7 @@ JS_NewUCStringCopyN(JSContext *cx, const jschar *s, size_t n)
 }
 
 JS_PUBLIC_API(JSString *)
-JS_NewUCStringCopyZ(JSContext *cx, const jschar *s)
+JS_NewUCStringCopyZ(JSContext *cx, const char16_t *s)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -5221,7 +5221,7 @@ JS_NewUCStringCopyZ(JSContext *cx, const jschar *s)
 }
 
 JS_PUBLIC_API(JSString *)
-JS_InternUCStringN(JSContext *cx, const jschar *s, size_t length)
+JS_InternUCStringN(JSContext *cx, const char16_t *s, size_t length)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -5231,7 +5231,7 @@ JS_InternUCStringN(JSContext *cx, const jschar *s, size_t length)
 }
 
 JS_PUBLIC_API(JSString *)
-JS_InternUCString(JSContext *cx, const jschar *s)
+JS_InternUCString(JSContext *cx, const char16_t *s)
 {
     return JS_InternUCStringN(cx, s, js_strlen(s));
 }
@@ -5269,7 +5269,7 @@ JS_GetLatin1StringCharsAndLength(JSContext *cx, const JS::AutoCheckCannotGC &nog
     return linear->latin1Chars(nogc);
 }
 
-JS_PUBLIC_API(const jschar *)
+JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteStringCharsAndLength(JSContext *cx, const JS::AutoCheckCannotGC &nogc, JSString *str,
                                   size_t *plength)
 {
@@ -5284,14 +5284,14 @@ JS_GetTwoByteStringCharsAndLength(JSContext *cx, const JS::AutoCheckCannotGC &no
     return linear->twoByteChars(nogc);
 }
 
-JS_PUBLIC_API(const jschar *)
+JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteExternalStringChars(JSString *str)
 {
     return str->asExternal().twoByteChars();
 }
 
 JS_PUBLIC_API(bool)
-JS_GetStringCharAt(JSContext *cx, JSString *str, size_t index, jschar *res)
+JS_GetStringCharAt(JSContext *cx, JSString *str, size_t index, char16_t *res)
 {
     AssertHeapIsIdleOrStringIsFlat(cx, str);
     CHECK_REQUEST(cx);
@@ -5305,14 +5305,14 @@ JS_GetStringCharAt(JSContext *cx, JSString *str, size_t index, jschar *res)
     return true;
 }
 
-JS_PUBLIC_API(jschar)
+JS_PUBLIC_API(char16_t)
 JS_GetFlatStringCharAt(JSFlatString *str, size_t index)
 {
     return str->latin1OrTwoByteChar(index);
 }
 
 JS_PUBLIC_API(bool)
-JS_CopyStringChars(JSContext *cx, mozilla::Range<jschar> dest, JSString *str)
+JS_CopyStringChars(JSContext *cx, mozilla::Range<char16_t> dest, JSString *str)
 {
     AssertHeapIsIdleOrStringIsFlat(cx, str);
     CHECK_REQUEST(cx);
@@ -5337,7 +5337,7 @@ JS_Latin1InternedStringChars(const JS::AutoCheckCannotGC &nogc, JSString *str)
     return flat->latin1Chars(nogc);
 }
 
-JS_PUBLIC_API(const jschar *)
+JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteInternedStringChars(const JS::AutoCheckCannotGC &nogc, JSString *str)
 {
     JS_ASSERT(str->isAtom());
@@ -5365,7 +5365,7 @@ JS_GetLatin1FlatStringChars(const JS::AutoCheckCannotGC &nogc, JSFlatString *str
     return str->latin1Chars(nogc);
 }
 
-extern JS_PUBLIC_API(const jschar *)
+extern JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteFlatStringChars(const JS::AutoCheckCannotGC &nogc, JSFlatString *str)
 {
     return str->twoByteChars(nogc);
@@ -5439,7 +5439,7 @@ JS_ConcatStrings(JSContext *cx, HandleString left, HandleString right)
 }
 
 JS_PUBLIC_API(bool)
-JS_DecodeBytes(JSContext *cx, const char *src, size_t srclen, jschar *dst, size_t *dstlenp)
+JS_DecodeBytes(JSContext *cx, const char *src, size_t srclen, char16_t *dst, size_t *dstlenp)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -5616,11 +5616,11 @@ JS_Stringify(JSContext *cx, MutableHandleValue vp, HandleObject replacer,
 }
 
 JS_PUBLIC_API(bool)
-JS_ParseJSON(JSContext *cx, const jschar *chars, uint32_t len, MutableHandleValue vp)
+JS_ParseJSON(JSContext *cx, const char16_t *chars, uint32_t len, MutableHandleValue vp)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
-    return ParseJSONWithReviver(cx, mozilla::Range<const jschar>(chars, len), NullHandleValue, vp);
+    return ParseJSONWithReviver(cx, mozilla::Range<const char16_t>(chars, len), NullHandleValue, vp);
 }
 
 JS_PUBLIC_API(bool)
@@ -5630,11 +5630,11 @@ JS_ParseJSON(JSContext *cx, HandleString str, MutableHandleValue vp)
 }
 
 JS_PUBLIC_API(bool)
-JS_ParseJSONWithReviver(JSContext *cx, const jschar *chars, uint32_t len, HandleValue reviver, MutableHandleValue vp)
+JS_ParseJSONWithReviver(JSContext *cx, const char16_t *chars, uint32_t len, HandleValue reviver, MutableHandleValue vp)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
-    return ParseJSONWithReviver(cx, mozilla::Range<const jschar>(chars, len), reviver, vp);
+    return ParseJSONWithReviver(cx, mozilla::Range<const char16_t>(chars, len), reviver, vp);
 }
 
 JS_PUBLIC_API(bool)
@@ -5702,7 +5702,7 @@ JS_ReportErrorNumberUC(JSContext *cx, JSErrorCallback errorCallback,
 JS_PUBLIC_API(void)
 JS_ReportErrorNumberUCArray(JSContext *cx, JSErrorCallback errorCallback,
                             void *userRef, const unsigned errorNumber,
-                            const jschar **args)
+                            const char16_t **args)
 {
     AssertHeapIsIdle(cx);
     js_ReportErrorNumberUCArray(cx, JSREPORT_ERROR, errorCallback, userRef,
@@ -5828,7 +5828,7 @@ JS_NewRegExpObject(JSContext *cx, HandleObject obj, char *bytes, size_t length,
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
-    ScopedJSFreePtr<jschar> chars(InflateString(cx, bytes, &length));
+    ScopedJSFreePtr<char16_t> chars(InflateString(cx, bytes, &length));
     if (!chars)
         return nullptr;
 
@@ -5842,7 +5842,7 @@ JS_NewRegExpObject(JSContext *cx, HandleObject obj, char *bytes, size_t length,
 }
 
 JS_PUBLIC_API(JSObject *)
-JS_NewUCRegExpObject(JSContext *cx, HandleObject obj, jschar *chars, size_t length,
+JS_NewUCRegExpObject(JSContext *cx, HandleObject obj, char16_t *chars, size_t length,
                      unsigned flags)
 {
     AssertHeapIsIdle(cx);
@@ -5886,7 +5886,7 @@ JS_ClearRegExpStatics(JSContext *cx, HandleObject obj)
 }
 
 JS_PUBLIC_API(bool)
-JS_ExecuteRegExp(JSContext *cx, HandleObject obj, HandleObject reobj, jschar *chars,
+JS_ExecuteRegExp(JSContext *cx, HandleObject obj, HandleObject reobj, char16_t *chars,
                  size_t length, size_t *indexp, bool test, MutableHandleValue rval)
 {
     AssertHeapIsIdle(cx);
@@ -5908,7 +5908,7 @@ JS_NewRegExpObjectNoStatics(JSContext *cx, char *bytes, size_t length, unsigned
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
-    jschar *chars = InflateString(cx, bytes, &length);
+    char16_t *chars = InflateString(cx, bytes, &length);
     if (!chars)
         return nullptr;
     RegExpObject *reobj = RegExpObject::createNoStatics(cx, chars, length,
@@ -5918,7 +5918,7 @@ JS_NewRegExpObjectNoStatics(JSContext *cx, char *bytes, size_t length, unsigned
 }
 
 JS_PUBLIC_API(JSObject *)
-JS_NewUCRegExpObjectNoStatics(JSContext *cx, jschar *chars, size_t length, unsigned flags)
+JS_NewUCRegExpObjectNoStatics(JSContext *cx, char16_t *chars, size_t length, unsigned flags)
 {
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
@@ -5927,7 +5927,7 @@ JS_NewUCRegExpObjectNoStatics(JSContext *cx, jschar *chars, size_t length, unsig
 }
 
 JS_PUBLIC_API(bool)
-JS_ExecuteRegExpNoStatics(JSContext *cx, HandleObject obj, jschar *chars, size_t length,
+JS_ExecuteRegExpNoStatics(JSContext *cx, HandleObject obj, char16_t *chars, size_t length,
                           size_t *indexp, bool test, MutableHandleValue rval)
 {
     AssertHeapIsIdle(cx);
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index d12fc78fa9a..7e628de84e2 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -824,7 +824,7 @@ namespace JS {
 // Example use:
 //
 //    size_t length = 512;
-//    jschar* chars = static_cast<jschar*>(js_malloc(sizeof(jschar) * length));
+//    char16_t* chars = static_cast<char16_t*>(js_malloc(sizeof(char16_t) * length));
 //    JS::SourceBufferHolder srcBuf(chars, length, JS::SourceBufferHolder::GiveOwnership);
 //    JS::Compile(cx, obj, options, srcBuf);
 //
@@ -836,14 +836,14 @@ class MOZ_STACK_CLASS SourceBufferHolder MOZ_FINAL
       GiveOwnership
     };
 
-    SourceBufferHolder(const jschar *data, size_t dataLength, Ownership ownership)
+    SourceBufferHolder(const char16_t *data, size_t dataLength, Ownership ownership)
       : data_(data),
         length_(dataLength),
         ownsChars_(ownership == GiveOwnership)
     {
         // Ensure that null buffers properly return an unowned, empty,
         // null-terminated string.
-        static const jschar NullChar_ = 0;
+        static const char16_t NullChar_ = 0;
         if (!get()) {
             data_ = &NullChar_;
             length_ = 0;
@@ -853,13 +853,13 @@ class MOZ_STACK_CLASS SourceBufferHolder MOZ_FINAL
 
     ~SourceBufferHolder() {
         if (ownsChars_)
-            js_free(const_cast<jschar *>(data_));
+            js_free(const_cast<char16_t *>(data_));
     }
 
     // Access the underlying source buffer without affecting ownership.
-    const jschar *get() const { return data_; }
+    const char16_t *get() const { return data_; }
 
-    // Length of the source buffer in jschars (not bytes)
+    // Length of the source buffer in char16_t code units (not bytes)
     size_t length() const { return length_; }
 
     // Returns true if the SourceBufferHolder owns the buffer and will free
@@ -878,17 +878,17 @@ class MOZ_STACK_CLASS SourceBufferHolder MOZ_FINAL
     // Note, it's the caller's responsibility to check ownsChars() before taking
     // the buffer.  Taking and then free'ing an unowned buffer will have dire
     // consequences.
-    jschar *take() {
+    char16_t *take() {
         JS_ASSERT(ownsChars_);
         ownsChars_ = false;
-        return const_cast<jschar *>(data_);
+        return const_cast<char16_t *>(data_);
     }
 
   private:
     SourceBufferHolder(SourceBufferHolder &) MOZ_DELETE;
     SourceBufferHolder &operator=(SourceBufferHolder &) MOZ_DELETE;
 
-    const jschar *data_;
+    const char16_t *data_;
     size_t length_;
     bool ownsChars_;
 };
@@ -989,14 +989,14 @@ JS_GetEmptyString(JSRuntime *rt);
  * specifying the tabulated type conversions:
  *
  *   b      bool            Boolean
- *   c      uint16_t/jschar ECMA uint16_t, Unicode char
+ *   c      char16_t        ECMA uint16_t, Unicode character
  *   i      int32_t         ECMA int32_t
  *   j      int32_t         ECMA int32_t (used to be different)
  *   u      uint32_t        ECMA uint32_t
  *   d      double          IEEE double
  *   I      double          Integral IEEE double
  *   S      JSString *      Unicode string, accessed by a JSString pointer
- *   W      jschar *        Unicode character vector, 0-terminated (W for wide)
+ *   W      char16_t *      Unicode character vector, 0-terminated (W for wide)
  *   o      JSObject *      Object reference
  *   f      JSFunction *    Function private
  *   v      jsval           Argument value (no conversion)
@@ -1364,7 +1364,6 @@ class JSAutoCheckRequest
 #endif
     }
 
-
   private:
 #ifdef JS_DEBUG
     JSContext *mContext;
@@ -1829,7 +1828,7 @@ JS_InitCTypesClass(JSContext *cx, JS::HandleObject global);
  * failure, this function should report an error.
  */
 typedef char *
-(* JSCTypesUnicodeToNativeFun)(JSContext *cx, const jschar *source, size_t slen);
+(* JSCTypesUnicodeToNativeFun)(JSContext *cx, const char16_t *source, size_t slen);
 
 /*
  * Set of function pointers that ctypes can use for various internal functions.
@@ -2166,7 +2165,7 @@ JS_SetGCParametersBasedOnAvailableMemory(JSRuntime *rt, uint32_t availMem);
  * memory requiring application-specific finalization.
  */
 extern JS_PUBLIC_API(JSString *)
-JS_NewExternalString(JSContext *cx, const jschar *chars, size_t length,
+JS_NewExternalString(JSContext *cx, const char16_t *chars, size_t length,
                      const JSStringFinalizer *fin);
 
 /*
@@ -2600,7 +2599,6 @@ class JS_PUBLIC_API(CompartmentOptions)
         return *this;
     }
 
-
     bool cloneSingletons() const { return cloneSingletons_; }
     CompartmentOptions &setCloneSingletons(bool flag) {
         cloneSingletons_ = flag;
@@ -3077,61 +3075,61 @@ extern JS_PUBLIC_API(bool)
 JS_DeletePropertyById2(JSContext *cx, JS::HandleObject obj, JS::HandleId id, bool *succeeded);
 
 extern JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const char16_t *name, size_t namelen,
                     JS::HandleValue value, unsigned attrs,
                     JSPropertyOp getter = nullptr, JSStrictPropertyOp setter = nullptr);
 
 extern JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const char16_t *name, size_t namelen,
                     JS::HandleObject value, unsigned attrs,
                     JSPropertyOp getter = nullptr, JSStrictPropertyOp setter = nullptr);
 
 extern JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const char16_t *name, size_t namelen,
                     JS::HandleString value, unsigned attrs,
                     JSPropertyOp getter = nullptr, JSStrictPropertyOp setter = nullptr);
 
 extern JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const char16_t *name, size_t namelen,
                     int32_t value, unsigned attrs,
                     JSPropertyOp getter = nullptr, JSStrictPropertyOp setter = nullptr);
 
 extern JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const char16_t *name, size_t namelen,
                     uint32_t value, unsigned attrs,
                     JSPropertyOp getter = nullptr, JSStrictPropertyOp setter = nullptr);
 
 extern JS_PUBLIC_API(bool)
-JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const jschar *name, size_t namelen,
+JS_DefineUCProperty(JSContext *cx, JS::HandleObject obj, const char16_t *name, size_t namelen,
                     double value, unsigned attrs,
                     JSPropertyOp getter = nullptr, JSStrictPropertyOp setter = nullptr);
 
 extern JS_PUBLIC_API(bool)
-JS_AlreadyHasOwnUCProperty(JSContext *cx, JS::HandleObject obj, const jschar *name,
+JS_AlreadyHasOwnUCProperty(JSContext *cx, JS::HandleObject obj, const char16_t *name,
                            size_t namelen, bool *foundp);
 
 extern JS_PUBLIC_API(bool)
 JS_HasUCProperty(JSContext *cx, JS::HandleObject obj,
-                 const jschar *name, size_t namelen,
+                 const char16_t *name, size_t namelen,
                  bool *vp);
 
 extern JS_PUBLIC_API(bool)
 JS_LookupUCProperty(JSContext *cx, JS::HandleObject obj,
-                    const jschar *name, size_t namelen,
+                    const char16_t *name, size_t namelen,
                     JS::MutableHandleValue vp);
 
 extern JS_PUBLIC_API(bool)
 JS_GetUCProperty(JSContext *cx, JS::HandleObject obj,
-                 const jschar *name, size_t namelen,
+                 const char16_t *name, size_t namelen,
                  JS::MutableHandleValue vp);
 
 extern JS_PUBLIC_API(bool)
 JS_SetUCProperty(JSContext *cx, JS::HandleObject obj,
-                 const jschar *name, size_t namelen,
+                 const char16_t *name, size_t namelen,
                  JS::HandleValue v);
 
 extern JS_PUBLIC_API(bool)
-JS_DeleteUCProperty2(JSContext *cx, JS::HandleObject obj, const jschar *name, size_t namelen,
+JS_DeleteUCProperty2(JSContext *cx, JS::HandleObject obj, const char16_t *name, size_t namelen,
                      bool *succeeded);
 
 extern JS_PUBLIC_API(JSObject *)
@@ -3385,7 +3383,7 @@ JS_DefineFunction(JSContext *cx, JS::Handle<JSObject*> obj, const char *name, JS
 
 extern JS_PUBLIC_API(JSFunction *)
 JS_DefineUCFunction(JSContext *cx, JS::Handle<JSObject*> obj,
-                    const jschar *name, size_t namelen, JSNative call,
+                    const char16_t *name, size_t namelen, JSNative call,
                     unsigned nargs, unsigned attrs);
 
 extern JS_PUBLIC_API(JSFunction *)
@@ -3424,7 +3422,7 @@ JS_CompileScript(JSContext *cx, JS::HandleObject obj,
  */
 extern JS_PUBLIC_API(bool)
 JS_CompileUCScript(JSContext *cx, JS::HandleObject obj,
-                   const jschar *chars, size_t length,
+                   const char16_t *chars, size_t length,
                    const JS::CompileOptions &options,
                    JS::MutableHandleScript script);
 
@@ -3447,7 +3445,7 @@ JS_CompileFunction(JSContext *cx, JS::HandleObject obj, const char *name,
 extern JS_PUBLIC_API(bool)
 JS_CompileUCFunction(JSContext *cx, JS::HandleObject obj, const char *name,
                      unsigned nargs, const char *const *argnames,
-                     const jschar *chars, size_t length,
+                     const char16_t *chars, size_t length,
                      const JS::CompileOptions &options,
                      JS::MutableHandleFunction fun);
 
@@ -3505,7 +3503,7 @@ class JS_FRIEND_API(ReadOnlyCompileOptions)
     JSPrincipals *originPrincipals_;
     const char *filename_;
     const char *introducerFilename_;
-    const jschar *sourceMapURL_;
+    const char16_t *sourceMapURL_;
 
     // This constructor leaves 'version' set to JSVERSION_UNKNOWN. The structure
     // is unusable until that's set to something more specific; the derived
@@ -3550,7 +3548,7 @@ class JS_FRIEND_API(ReadOnlyCompileOptions)
     JSPrincipals *originPrincipals(js::ExclusiveContext *cx) const;
     const char *filename() const { return filename_; }
     const char *introducerFilename() const { return introducerFilename_; }
-    const jschar *sourceMapURL() const { return sourceMapURL_; }
+    const char16_t *sourceMapURL() const { return sourceMapURL_; }
     virtual JSObject *element() const = 0;
     virtual JSString *elementAttributeName() const = 0;
     virtual JSScript *introductionScript() const = 0;
@@ -3625,11 +3623,11 @@ class JS_FRIEND_API(OwningCompileOptions) : public ReadOnlyCompileOptions
     /* These setters make copies of their string arguments, and are fallible. */
     bool setFile(JSContext *cx, const char *f);
     bool setFileAndLine(JSContext *cx, const char *f, unsigned l);
-    bool setSourceMapURL(JSContext *cx, const jschar *s);
+    bool setSourceMapURL(JSContext *cx, const char16_t *s);
     bool setIntroducerFilename(JSContext *cx, const char *s);
 
     /* These setters are infallible, and can be chained. */
-    OwningCompileOptions &setLine(unsigned l)             { lineno = l;              return *this; }
+    OwningCompileOptions &setLine(unsigned l)             { lineno = l; return *this; }
     OwningCompileOptions &setElement(JSObject *e) {
         elementRoot = e;
         return *this;
@@ -3718,8 +3716,8 @@ class MOZ_STACK_CLASS JS_FRIEND_API(CompileOptions) : public ReadOnlyCompileOpti
     CompileOptions &setFileAndLine(const char *f, unsigned l) {
         filename_ = f; lineno = l; return *this;
     }
-    CompileOptions &setSourceMapURL(const jschar *s) { sourceMapURL_ = s;       return *this; }
-    CompileOptions &setElement(JSObject *e)          { elementRoot = e;         return *this; }
+    CompileOptions &setSourceMapURL(const char16_t *s) { sourceMapURL_ = s; return *this; }
+    CompileOptions &setElement(JSObject *e)          { elementRoot = e; return *this; }
     CompileOptions &setElementAttributeName(JSString *p) {
         elementAttributeNameRoot = p;
         return *this;
@@ -3776,7 +3774,7 @@ Compile(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &optio
 
 extern JS_PUBLIC_API(bool)
 Compile(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
-        const jschar *chars, size_t length, JS::MutableHandleScript script);
+        const char16_t *chars, size_t length, JS::MutableHandleScript script);
 
 extern JS_PUBLIC_API(bool)
 Compile(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options, FILE *file,
@@ -3807,7 +3805,7 @@ CanCompileOffThread(JSContext *cx, const ReadOnlyCompileOptions &options, size_t
 
 extern JS_PUBLIC_API(bool)
 CompileOffThread(JSContext *cx, const ReadOnlyCompileOptions &options,
-                 const jschar *chars, size_t length,
+                 const char16_t *chars, size_t length,
                  OffThreadCompileCallback callback, void *callbackData);
 
 extern JS_PUBLIC_API(JSScript *)
@@ -3826,7 +3824,7 @@ CompileFunction(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOption
 extern JS_PUBLIC_API(bool)
 CompileFunction(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
                 const char *name, unsigned nargs, const char *const *argnames,
-                const jschar *chars, size_t length, JS::MutableHandleFunction fun);
+                const char16_t *chars, size_t length, JS::MutableHandleFunction fun);
 
 } /* namespace JS */
 
@@ -3916,7 +3914,7 @@ JS_EvaluateScript(JSContext *cx, JS::HandleObject obj,
 
 extern JS_PUBLIC_API(bool)
 JS_EvaluateUCScript(JSContext *cx, JS::Handle<JSObject*> obj,
-                    const jschar *chars, unsigned length,
+                    const char16_t *chars, unsigned length,
                     const char *filename, unsigned lineno,
                     JS::MutableHandle<JS::Value> rval);
 
@@ -3928,7 +3926,7 @@ Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &opti
 
 extern JS_PUBLIC_API(bool)
 Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
-         const jschar *chars, size_t length, JS::MutableHandleValue rval);
+         const char16_t *chars, size_t length, JS::MutableHandleValue rval);
 
 extern JS_PUBLIC_API(bool)
 Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
@@ -3944,7 +3942,7 @@ Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &opti
 
 extern JS_PUBLIC_API(bool)
 Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
-         const jschar *chars, size_t length);
+         const char16_t *chars, size_t length);
 
 extern JS_PUBLIC_API(bool)
 Evaluate(JSContext *cx, JS::HandleObject obj, const ReadOnlyCompileOptions &options,
@@ -4097,19 +4095,19 @@ extern JS_PUBLIC_API(JSString *)
 JS_InternString(JSContext *cx, const char *s);
 
 extern JS_PUBLIC_API(JSString *)
-JS_NewUCString(JSContext *cx, jschar *chars, size_t length);
+JS_NewUCString(JSContext *cx, char16_t *chars, size_t length);
 
 extern JS_PUBLIC_API(JSString *)
-JS_NewUCStringCopyN(JSContext *cx, const jschar *s, size_t n);
+JS_NewUCStringCopyN(JSContext *cx, const char16_t *s, size_t n);
 
 extern JS_PUBLIC_API(JSString *)
-JS_NewUCStringCopyZ(JSContext *cx, const jschar *s);
+JS_NewUCStringCopyZ(JSContext *cx, const char16_t *s);
 
 extern JS_PUBLIC_API(JSString *)
-JS_InternUCStringN(JSContext *cx, const jschar *s, size_t length);
+JS_InternUCStringN(JSContext *cx, const char16_t *s, size_t length);
 
 extern JS_PUBLIC_API(JSString *)
-JS_InternUCString(JSContext *cx, const jschar *s);
+JS_InternUCString(JSContext *cx, const char16_t *s);
 
 extern JS_PUBLIC_API(bool)
 JS_CompareStrings(JSContext *cx, JSString *str1, JSString *str2, int32_t *result);
@@ -4150,14 +4148,14 @@ JS_FileEscapedString(FILE *fp, JSString *str, char quote);
  *
  *   // in an infallible context, for the same 'str'
  *   AutoCheckCannotGC nogc;
- *   const jschar *chars = JS_GetTwoByteFlatStringChars(nogc, fstr)
+ *   const char16_t *chars = JS_GetTwoByteFlatStringChars(nogc, fstr)
  *   JS_ASSERT(chars);
  *
  * Flat strings and interned strings are always null-terminated, so
  * JS_FlattenString can be used to get a null-terminated string.
  *
  * Additionally, string characters are stored as either Latin1Char (8-bit)
- * or jschar (16-bit). Clients can use JS_StringHasLatin1Chars and can then
+ * or char16_t (16-bit). Clients can use JS_StringHasLatin1Chars and can then
  * call either the Latin1* or TwoByte* functions. Some functions like
  * JS_CopyStringChars and JS_GetStringCharAt accept both Latin1 and TwoByte
  * strings.
@@ -4177,26 +4175,26 @@ extern JS_PUBLIC_API(const JS::Latin1Char *)
 JS_GetLatin1StringCharsAndLength(JSContext *cx, const JS::AutoCheckCannotGC &nogc, JSString *str,
                                  size_t *length);
 
-extern JS_PUBLIC_API(const jschar *)
+extern JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteStringCharsAndLength(JSContext *cx, const JS::AutoCheckCannotGC &nogc, JSString *str,
                                   size_t *length);
 
 extern JS_PUBLIC_API(bool)
-JS_GetStringCharAt(JSContext *cx, JSString *str, size_t index, jschar *res);
+JS_GetStringCharAt(JSContext *cx, JSString *str, size_t index, char16_t *res);
 
-extern JS_PUBLIC_API(jschar)
+extern JS_PUBLIC_API(char16_t)
 JS_GetFlatStringCharAt(JSFlatString *str, size_t index);
 
-extern JS_PUBLIC_API(const jschar *)
+extern JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteExternalStringChars(JSString *str);
 
 extern JS_PUBLIC_API(bool)
-JS_CopyStringChars(JSContext *cx, mozilla::Range<jschar> dest, JSString *str);
+JS_CopyStringChars(JSContext *cx, mozilla::Range<char16_t> dest, JSString *str);
 
 extern JS_PUBLIC_API(const JS::Latin1Char *)
 JS_GetLatin1InternedStringChars(const JS::AutoCheckCannotGC &nogc, JSString *str);
 
-extern JS_PUBLIC_API(const jschar *)
+extern JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteInternedStringChars(const JS::AutoCheckCannotGC &nogc, JSString *str);
 
 extern JS_PUBLIC_API(JSFlatString *)
@@ -4205,7 +4203,7 @@ JS_FlattenString(JSContext *cx, JSString *str);
 extern JS_PUBLIC_API(const JS::Latin1Char *)
 JS_GetLatin1FlatStringChars(const JS::AutoCheckCannotGC &nogc, JSFlatString *str);
 
-extern JS_PUBLIC_API(const jschar *)
+extern JS_PUBLIC_API(const char16_t *)
 JS_GetTwoByteFlatStringChars(const JS::AutoCheckCannotGC &nogc, JSFlatString *str);
 
 static MOZ_ALWAYS_INLINE JSFlatString *
@@ -4256,19 +4254,19 @@ JS_ConcatStrings(JSContext *cx, JS::HandleString left, JS::HandleString right);
 
 /*
  * For JS_DecodeBytes, set *dstlenp to the size of the destination buffer before
- * the call; on return, *dstlenp contains the number of jschars actually stored.
- * To determine the necessary destination buffer size, make a sizing call that
- * passes nullptr for dst.
+ * the call; on return, *dstlenp contains the number of characters actually
+ * stored. To determine the necessary destination buffer size, make a sizing
+ * call that passes nullptr for dst.
  *
  * On errors, the functions report the error. In that case, *dstlenp contains
  * the number of characters or bytes transferred so far.  If cx is nullptr, no
  * error is reported on failure, and the functions simply return false.
  *
- * NB: This function does not store an additional zero byte or jschar after the
+ * NB: This function does not store an additional zero byte or char16_t after the
  * transcoded string.
  */
 JS_PUBLIC_API(bool)
-JS_DecodeBytes(JSContext *cx, const char *src, size_t srclen, jschar *dst,
+JS_DecodeBytes(JSContext *cx, const char *src, size_t srclen, char16_t *dst,
                size_t *dstlenp);
 
 /*
@@ -4456,7 +4454,7 @@ GetWellKnownSymbol(JSContext *cx, SymbolCode which);
 /*
  * JSON functions
  */
-typedef bool (* JSONWriteCallback)(const jschar *buf, uint32_t len, void *data);
+typedef bool (* JSONWriteCallback)(const char16_t *buf, uint32_t len, void *data);
 
 /*
  * JSON.stringify as specified by ES5.
@@ -4469,13 +4467,13 @@ JS_Stringify(JSContext *cx, JS::MutableHandleValue value, JS::HandleObject repla
  * JSON.parse as specified by ES5.
  */
 JS_PUBLIC_API(bool)
-JS_ParseJSON(JSContext *cx, const jschar *chars, uint32_t len, JS::MutableHandleValue vp);
+JS_ParseJSON(JSContext *cx, const char16_t *chars, uint32_t len, JS::MutableHandleValue vp);
 
 JS_PUBLIC_API(bool)
 JS_ParseJSON(JSContext *cx, JS::HandleString str, JS::MutableHandleValue vp);
 
 JS_PUBLIC_API(bool)
-JS_ParseJSONWithReviver(JSContext *cx, const jschar *chars, uint32_t len, JS::HandleValue reviver,
+JS_ParseJSONWithReviver(JSContext *cx, const char16_t *chars, uint32_t len, JS::HandleValue reviver,
                         JS::MutableHandleValue vp);
 
 JS_PUBLIC_API(bool)
@@ -4552,7 +4550,7 @@ JS_ReportErrorNumberVA(JSContext *cx, JSErrorCallback errorCallback,
 #endif
 
 /*
- * Use an errorNumber to retrieve the format string, args are jschar *
+ * Use an errorNumber to retrieve the format string, args are char16_t *
  */
 extern JS_PUBLIC_API(void)
 JS_ReportErrorNumberUC(JSContext *cx, JSErrorCallback errorCallback,
@@ -4561,7 +4559,7 @@ JS_ReportErrorNumberUC(JSContext *cx, JSErrorCallback errorCallback,
 extern JS_PUBLIC_API(void)
 JS_ReportErrorNumberUCArray(JSContext *cx, JSErrorCallback errorCallback,
                             void *userRef, const unsigned errorNumber,
-                            const jschar **args);
+                            const char16_t **args);
 
 /*
  * As above, but report a warning instead (JSREPORT_IS_WARNING(report.flags)).
@@ -4600,12 +4598,12 @@ struct JSErrorReport {
     unsigned        lineno;         /* source line number */
     const char      *linebuf;       /* offending source line without final \n */
     const char      *tokenptr;      /* pointer to error token in linebuf */
-    const jschar    *uclinebuf;     /* unicode (original) line buffer */
-    const jschar    *uctokenptr;    /* unicode (original) token pointer */
+    const char16_t  *uclinebuf;     /* unicode (original) line buffer */
+    const char16_t  *uctokenptr;    /* unicode (original) token pointer */
     unsigned        flags;          /* error/warning, etc. */
     unsigned        errorNumber;    /* the error number, e.g. see js.msg */
-    const jschar    *ucmessage;     /* the (default) error message */
-    const jschar    **messageArgs;  /* arguments for the error message */
+    const char16_t  *ucmessage;     /* the (default) error message */
+    const char16_t  **messageArgs;  /* arguments for the error message */
     int16_t         exnType;        /* One of the JSExnType constants */
     unsigned        column;         /* zero-based column index in line */
 };
@@ -4712,7 +4710,7 @@ JS_NewRegExpObject(JSContext *cx, JS::HandleObject obj, char *bytes, size_t leng
                    unsigned flags);
 
 extern JS_PUBLIC_API(JSObject *)
-JS_NewUCRegExpObject(JSContext *cx, JS::HandleObject obj, jschar *chars, size_t length,
+JS_NewUCRegExpObject(JSContext *cx, JS::HandleObject obj, char16_t *chars, size_t length,
                      unsigned flags);
 
 extern JS_PUBLIC_API(bool)
@@ -4724,7 +4722,7 @@ JS_ClearRegExpStatics(JSContext *cx, JS::HandleObject obj);
 
 extern JS_PUBLIC_API(bool)
 JS_ExecuteRegExp(JSContext *cx, JS::HandleObject obj, JS::HandleObject reobj,
-                 jschar *chars, size_t length, size_t *indexp, bool test,
+                 char16_t *chars, size_t length, size_t *indexp, bool test,
                  JS::MutableHandleValue rval);
 
 /* RegExp interface for clients without a global object. */
@@ -4733,10 +4731,10 @@ extern JS_PUBLIC_API(JSObject *)
 JS_NewRegExpObjectNoStatics(JSContext *cx, char *bytes, size_t length, unsigned flags);
 
 extern JS_PUBLIC_API(JSObject *)
-JS_NewUCRegExpObjectNoStatics(JSContext *cx, jschar *chars, size_t length, unsigned flags);
+JS_NewUCRegExpObjectNoStatics(JSContext *cx, char16_t *chars, size_t length, unsigned flags);
 
 extern JS_PUBLIC_API(bool)
-JS_ExecuteRegExpNoStatics(JSContext *cx, JS::HandleObject reobj, jschar *chars, size_t length,
+JS_ExecuteRegExpNoStatics(JSContext *cx, JS::HandleObject reobj, char16_t *chars, size_t length,
                           size_t *indexp, bool test, JS::MutableHandleValue rval);
 
 extern JS_PUBLIC_API(bool)
@@ -5040,7 +5038,7 @@ namespace JS {
  * handle.
  */
 typedef bool
-(* OpenAsmJSCacheEntryForReadOp)(HandleObject global, const jschar *begin, const jschar *limit,
+(* OpenAsmJSCacheEntryForReadOp)(HandleObject global, const char16_t *begin, const char16_t *limit,
                                  size_t *size, const uint8_t **memory, intptr_t *handle);
 typedef void
 (* CloseAsmJSCacheEntryForReadOp)(size_t size, const uint8_t *memory, intptr_t handle);
@@ -5062,7 +5060,7 @@ typedef void
  */
 typedef bool
 (* OpenAsmJSCacheEntryForWriteOp)(HandleObject global, bool installed,
-                                  const jschar *begin, const jschar *end,
+                                  const char16_t *begin, const char16_t *end,
                                   size_t size, uint8_t **memory, intptr_t *handle);
 typedef void
 (* CloseAsmJSCacheEntryForWriteOp)(size_t size, uint8_t *memory, intptr_t handle);
diff --git a/js/src/jsarray.cpp b/js/src/jsarray.cpp
index a33cbb6fa19..9e5dbee5ec4 100644
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@@ -11,6 +11,8 @@
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/MathAlgorithms.h"
 
+#include <algorithm>
+
 #include "jsapi.h"
 #include "jsatom.h"
 #include "jscntxt.h"
@@ -165,7 +167,7 @@ ToId(JSContext *cx, uint32_t index, MutableHandleId id)
  * to JSVAL_VOID. This function assumes that the location pointed by vp is
  * properly rooted and can be used as GC-protected storage for temporaries.
  */
-template<typename IndexType>
+template <typename IndexType>
 static inline bool
 DoGetElement(JSContext *cx, HandleObject obj, HandleObject receiver,
              IndexType index, bool *hole, MutableHandleValue vp)
@@ -190,7 +192,7 @@ DoGetElement(JSContext *cx, HandleObject obj, HandleObject receiver,
     return true;
 }
 
-template<typename IndexType>
+template <typename IndexType>
 static void
 AssertGreaterThanZero(IndexType index)
 {
@@ -204,7 +206,7 @@ AssertGreaterThanZero(uint32_t index)
 {
 }
 
-template<typename IndexType>
+template <typename IndexType>
 static bool
 GetElement(JSContext *cx, HandleObject obj, HandleObject receiver,
            IndexType index, bool *hole, MutableHandleValue vp)
@@ -227,7 +229,7 @@ GetElement(JSContext *cx, HandleObject obj, HandleObject receiver,
     return DoGetElement(cx, obj, receiver, index, hole, vp);
 }
 
-template<typename IndexType>
+template <typename IndexType>
 static inline bool
 GetElement(JSContext *cx, HandleObject obj, IndexType index, bool *hole, MutableHandleValue vp)
 {
@@ -338,8 +340,12 @@ DeleteArrayElement(JSContext *cx, HandleObject obj, double index, bool *succeede
             if (idx < obj->getDenseInitializedLength()) {
                 if (!obj->maybeCopyElementsForWrite(cx))
                     return false;
-                obj->markDenseElementsNotPacked(cx);
-                obj->setDenseElement(idx, MagicValue(JS_ELEMENTS_HOLE));
+                if (idx+1 == obj->getDenseInitializedLength()) {
+                    obj->setDenseInitializedLength(idx);
+                } else {
+                    obj->markDenseElementsNotPacked(cx);
+                    obj->setDenseElement(idx, MagicValue(JS_ELEMENTS_HOLE));
+                }
                 if (!js_SuppressDeletedElement(cx, obj, idx))
                     return false;
             }
@@ -1088,13 +1094,13 @@ js::ArrayJoin(JSContext *cx, HandleObject obj, HandleLinearString sepstr, uint32
         if (!ArrayJoinKernel<Locale>(cx, op, obj, length, sb))
             return nullptr;
     } else if (seplen == 1) {
-        jschar c = sepstr->latin1OrTwoByteChar(0);
+        char16_t c = sepstr->latin1OrTwoByteChar(0);
         if (c <= JSString::MAX_LATIN1_CHAR) {
             CharSeparatorOp<Latin1Char> op(c);
             if (!ArrayJoinKernel<Locale>(cx, op, obj, length, sb))
                 return nullptr;
         } else {
-            CharSeparatorOp<jschar> op(c);
+            CharSeparatorOp<char16_t> op(c);
             if (!ArrayJoinKernel<Locale>(cx, op, obj, length, sb))
                 return nullptr;
         }
@@ -1738,7 +1744,7 @@ MatchNumericComparator(JSContext *cx, const Value &v)
     return Match_None;
 }
 
-template<typename K, typename C>
+template <typename K, typename C>
 static inline bool
 MergeSortByKey(K keys, size_t len, K scratch, C comparator, AutoValueVector *vec)
 {
@@ -2140,19 +2146,6 @@ js::array_pop(JSContext *cx, unsigned argc, Value *vp)
             return false;
     }
 
-    // If this was an array, then there are no elements above the one we just
-    // deleted (if we deleted an element).  Thus we can shrink the dense
-    // initialized length accordingly.  (This is fine even if the array length
-    // is non-writable: length-changing occurs after element-deletion effects.)
-    // Don't do anything if this isn't an array, as any deletion above has no
-    // effect on any elements after the "last" one indicated by the "length"
-    // property.
-    if (obj->is<ArrayObject>() && obj->getDenseInitializedLength() > index) {
-        if (!obj->maybeCopyElementsForWrite(cx))
-            return false;
-        obj->setDenseInitializedLength(index);
-    }
-
     /* Steps 4a, 5d. */
     return SetLengthProperty(cx, obj, index);
 }
@@ -2445,7 +2438,7 @@ js::array_splice_impl(JSContext *cx, unsigned argc, Value *vp, bool returnValueI
             TryReuseArrayType(obj, arr);
         }
     } else {
-        arr = NewDenseAllocatedArray(cx, actualDeleteCount);
+        arr = NewDenseFullyAllocatedArray(cx, actualDeleteCount);
         if (!arr)
             return false;
         TryReuseArrayType(obj, arr);
@@ -2754,7 +2747,7 @@ array_slice(JSContext *cx, unsigned argc, Value *vp)
         begin = end;
 
     Rooted<ArrayObject*> narr(cx);
-    narr = NewDenseAllocatedArray(cx, end - begin);
+    narr = NewDenseFullyAllocatedArray(cx, end - begin);
     if (!narr)
         return false;
     TryReuseArrayType(obj, narr);
@@ -2843,7 +2836,7 @@ array_filter(JSContext *cx, unsigned argc, Value *vp)
     RootedValue thisv(cx, args.length() >= 2 ? args[1] : UndefinedValue());
 
     /* Step 6. */
-    RootedObject arr(cx, NewDenseAllocatedArray(cx, 0));
+    RootedObject arr(cx, NewDenseFullyAllocatedArray(cx, 0));
     if (!arr)
         return false;
     TypeObject *newtype = GetTypeCallerInitObject(cx, JSProto_Array);
@@ -3084,11 +3077,13 @@ js_Array(JSContext *cx, unsigned argc, Value *vp)
     }
 
     /*
-     * Allocate dense elements eagerly for small arrays, to avoid reallocating
-     * elements when filling the array.
+     * Allocate up to |EagerAllocationMaxLength| dense elements eagerly, to
+     * avoid reallocating elements when filling the array.
      */
-    bool allocateArray = length <= ArrayObject::EagerAllocationMaxLength;
-    RootedObject obj(cx, NewDenseArray(cx, length, type, allocateArray));
+    AllocatingBehaviour allocating = (length <= ArrayObject::EagerAllocationMaxLength)
+                                   ? NewArray_FullyAllocating
+                                   : NewArray_PartlyAllocating;
+    RootedObject obj(cx, NewDenseArray(cx, length, type, allocating));
     if (!obj)
         return false;
 
@@ -3178,7 +3173,7 @@ EnsureNewArrayElements(ExclusiveContext *cx, JSObject *obj, uint32_t length)
     return true;
 }
 
-template<bool allocateCapacity>
+template <uint32_t maxLength>
 static MOZ_ALWAYS_INLINE ArrayObject *
 NewArray(ExclusiveContext *cxArg, uint32_t length,
          JSObject *protoArg, NewObjectKind newKind = GenericObject)
@@ -3201,8 +3196,11 @@ NewArray(ExclusiveContext *cxArg, uint32_t length,
                 ArrayObject *arr = &obj->as<ArrayObject>();
                 arr->setFixedElements();
                 arr->setLength(cx, length);
-                if (allocateCapacity && !EnsureNewArrayElements(cx, arr, length))
+                if (maxLength > 0 &&
+                    !EnsureNewArrayElements(cx, arr, std::min(maxLength, length)))
+                {
                     return nullptr;
+                }
                 return arr;
             } else {
                 RootedObject proto(cxArg, protoArg);
@@ -3259,7 +3257,7 @@ NewArray(ExclusiveContext *cxArg, uint32_t length,
                                                                    cxArg->global(), allocKind, arr);
     }
 
-    if (allocateCapacity && !EnsureNewArrayElements(cxArg, arr, length))
+    if (maxLength > 0 && !EnsureNewArrayElements(cxArg, arr, std::min(maxLength, length)))
         return nullptr;
 
     probes::CreateObject(cxArg, arr);
@@ -3270,36 +3268,49 @@ ArrayObject * JS_FASTCALL
 js::NewDenseEmptyArray(JSContext *cx, JSObject *proto /* = nullptr */,
                        NewObjectKind newKind /* = GenericObject */)
 {
-    return NewArray<false>(cx, 0, proto, newKind);
+    return NewArray<0>(cx, 0, proto, newKind);
 }
 
 ArrayObject * JS_FASTCALL
-js::NewDenseAllocatedArray(ExclusiveContext *cx, uint32_t length, JSObject *proto /* = nullptr */,
-                           NewObjectKind newKind /* = GenericObject */)
+js::NewDenseFullyAllocatedArray(ExclusiveContext *cx, uint32_t length,
+                                JSObject *proto /* = nullptr */,
+                                NewObjectKind newKind /* = GenericObject */)
 {
-    return NewArray<true>(cx, length, proto, newKind);
+    return NewArray<JSObject::NELEMENTS_LIMIT>(cx, length, proto, newKind);
+}
+
+ArrayObject * JS_FASTCALL
+js::NewDensePartlyAllocatedArray(ExclusiveContext *cx, uint32_t length,
+                                 JSObject *proto /* = nullptr */,
+                                 NewObjectKind newKind /* = GenericObject */)
+{
+    return NewArray<ArrayObject::EagerAllocationMaxLength>(cx, length, proto, newKind);
 }
 
 ArrayObject * JS_FASTCALL
 js::NewDenseUnallocatedArray(ExclusiveContext *cx, uint32_t length, JSObject *proto /* = nullptr */,
                              NewObjectKind newKind /* = GenericObject */)
 {
-    return NewArray<false>(cx, length, proto, newKind);
+    return NewArray<0>(cx, length, proto, newKind);
 }
 
 ArrayObject * JS_FASTCALL
-js::NewDenseArray(ExclusiveContext *cx, uint32_t length, HandleTypeObject type, bool allocateArray)
+js::NewDenseArray(ExclusiveContext *cx, uint32_t length, HandleTypeObject type,
+                  AllocatingBehaviour allocating)
 {
     NewObjectKind newKind = !type ? SingletonObject : GenericObject;
     if (type && type->shouldPreTenure())
         newKind = TenuredObject;
 
-    // Allocate dense elements eagerly for small arrays, to avoid reallocating
-    // elements when filling the array.
-    ArrayObject *arr = allocateArray
-                       ? NewDenseAllocatedArray(cx, length, nullptr, newKind)
-                       : NewDenseUnallocatedArray(cx, length, nullptr, newKind);
-
+    ArrayObject *arr;
+    if (allocating == NewArray_Unallocating) {
+        arr = NewDenseUnallocatedArray(cx, length, nullptr, newKind);
+    } else if (allocating == NewArray_PartlyAllocating) {
+        arr = NewDensePartlyAllocatedArray(cx, length, nullptr, newKind);
+    } else {
+        JS_ASSERT(allocating == NewArray_FullyAllocating);
+        arr = NewDenseFullyAllocatedArray(cx, length, nullptr, newKind);
+    }
     if (!arr)
         return nullptr;
 
@@ -3320,7 +3331,7 @@ js::NewDenseCopiedArray(JSContext *cx, uint32_t length, HandleObject src, uint32
 {
     JS_ASSERT(!src->isIndexed());
 
-    ArrayObject* arr = NewArray<true>(cx, length, proto);
+    ArrayObject* arr = NewArray<JSObject::NELEMENTS_LIMIT>(cx, length, proto);
     if (!arr)
         return nullptr;
 
@@ -3340,7 +3351,7 @@ ArrayObject *
 js::NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values,
                         JSObject *proto /* = nullptr */, NewObjectKind newKind /* = GenericObject */)
 {
-    ArrayObject* arr = NewArray<true>(cx, length, proto);
+    ArrayObject* arr = NewArray<JSObject::NELEMENTS_LIMIT>(cx, length, proto);
     if (!arr)
         return nullptr;
 
@@ -3355,7 +3366,7 @@ js::NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values,
 }
 
 ArrayObject *
-js::NewDenseAllocatedArrayWithTemplate(JSContext *cx, uint32_t length, JSObject *templateObject)
+js::NewDenseFullyAllocatedArrayWithTemplate(JSContext *cx, uint32_t length, JSObject *templateObject)
 {
     gc::AllocKind allocKind = GuessArrayGCKind(length);
     JS_ASSERT(CanBeFinalizedInBackground(allocKind, &ArrayObject::class_));
diff --git a/js/src/jsarray.h b/js/src/jsarray.h
index b46cec85357..6caf2dd3c20 100644
--- a/js/src/jsarray.h
+++ b/js/src/jsarray.h
@@ -48,11 +48,6 @@ extern ArrayObject * JS_FASTCALL
 NewDenseEmptyArray(JSContext *cx, JSObject *proto = nullptr,
                    NewObjectKind newKind = GenericObject);
 
-/* Create a dense array with length and capacity == 'length', initialized length set to 0. */
-extern ArrayObject * JS_FASTCALL
-NewDenseAllocatedArray(ExclusiveContext *cx, uint32_t length, JSObject *proto = nullptr,
-                       NewObjectKind newKind = GenericObject);
-
 /*
  * Create a dense array with a set length, but without allocating space for the
  * contents. This is useful, e.g., when accepting length from the user.
@@ -61,12 +56,32 @@ extern ArrayObject * JS_FASTCALL
 NewDenseUnallocatedArray(ExclusiveContext *cx, uint32_t length, JSObject *proto = nullptr,
                          NewObjectKind newKind = GenericObject);
 
+/*
+ * Create a dense array with length and capacity == |length|, initialized length set to 0,
+ * but with only |EagerAllocationMaxLength| elements allocated.
+ */
+extern ArrayObject * JS_FASTCALL
+NewDensePartlyAllocatedArray(ExclusiveContext *cx, uint32_t length, JSObject *proto = nullptr,
+                             NewObjectKind newKind = GenericObject);
+
+/* Create a dense array with length and capacity == 'length', initialized length set to 0. */
+extern ArrayObject * JS_FASTCALL
+NewDenseFullyAllocatedArray(ExclusiveContext *cx, uint32_t length, JSObject *proto = nullptr,
+                            NewObjectKind newKind = GenericObject);
+
+enum AllocatingBehaviour {
+    NewArray_Unallocating,
+    NewArray_PartlyAllocating,
+    NewArray_FullyAllocating
+};
+
 /*
  * Create a dense array with a set length, but only allocates space for the
  * contents if the length is not excessive.
  */
 extern ArrayObject * JS_FASTCALL
-NewDenseArray(ExclusiveContext *cx, uint32_t length, HandleTypeObject type, bool allocateArray);
+NewDenseArray(ExclusiveContext *cx, uint32_t length, HandleTypeObject type,
+              AllocatingBehaviour allocating);
 
 /* Create a dense array with a copy of the dense array elements in src. */
 extern ArrayObject *
@@ -79,7 +94,7 @@ NewDenseCopiedArray(JSContext *cx, uint32_t length, const Value *values, JSObjec
 
 /* Create a dense array based on templateObject with the given length. */
 extern ArrayObject *
-NewDenseAllocatedArrayWithTemplate(JSContext *cx, uint32_t length, JSObject *templateObject);
+NewDenseFullyAllocatedArrayWithTemplate(JSContext *cx, uint32_t length, JSObject *templateObject);
 
 /* Create a dense array with the same copy-on-write elements as another object. */
 extern JSObject *
diff --git a/js/src/jsast.tbl b/js/src/jsast.tbl
index 9d0bc588f54..e139ea19828 100644
--- a/js/src/jsast.tbl
+++ b/js/src/jsast.tbl
@@ -11,6 +11,7 @@ ASTDEF(AST_PROGRAM,               "Program",                        "program")
 ASTDEF(AST_IDENTIFIER,            "Identifier",                     "identifier")
 ASTDEF(AST_LITERAL,               "Literal",                        "literal")
 ASTDEF(AST_PROPERTY,              "Property",                       "property")
+ASTDEF(AST_PROTOTYPEMUTATION,     "PrototypeMutation",              "prototypeMutation")
 
 ASTDEF(AST_MODULE_DECL,           "ModuleDeclaration",              "moduleDeclaration")
 ASTDEF(AST_FUNC_DECL,             "FunctionDeclaration",            "functionDeclaration")
diff --git a/js/src/jsatom.cpp b/js/src/jsatom.cpp
index e764c2862ed..91dda9d04e4 100644
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -360,7 +360,7 @@ AtomizeAndCopyChars(ExclusiveContext *cx, const CharT *tbchars, size_t length, I
 }
 
 template JSAtom *
-AtomizeAndCopyChars(ExclusiveContext *cx, const jschar *tbchars, size_t length, InternBehavior ib);
+AtomizeAndCopyChars(ExclusiveContext *cx, const char16_t *tbchars, size_t length, InternBehavior ib);
 
 template JSAtom *
 AtomizeAndCopyChars(ExclusiveContext *cx, const Latin1Char *tbchars, size_t length, InternBehavior ib);
@@ -446,16 +446,16 @@ template JSAtom *
 js::AtomizeChars(ExclusiveContext *cx, const Latin1Char *chars, size_t length, InternBehavior ib);
 
 template JSAtom *
-js::AtomizeChars(ExclusiveContext *cx, const jschar *chars, size_t length, InternBehavior ib);
+js::AtomizeChars(ExclusiveContext *cx, const char16_t *chars, size_t length, InternBehavior ib);
 
 bool
 js::IndexToIdSlow(ExclusiveContext *cx, uint32_t index, MutableHandleId idp)
 {
     JS_ASSERT(index > JSID_INT_MAX);
 
-    jschar buf[UINT32_CHAR_BUFFER_LENGTH];
-    RangedPtr<jschar> end(ArrayEnd(buf), buf, ArrayEnd(buf));
-    RangedPtr<jschar> start = BackfillIndexInCharBuffer(index, end);
+    char16_t buf[UINT32_CHAR_BUFFER_LENGTH];
+    RangedPtr<char16_t> end(ArrayEnd(buf), buf, ArrayEnd(buf));
+    RangedPtr<char16_t> start = BackfillIndexInCharBuffer(index, end);
 
     JSAtom *atom = AtomizeChars(cx, start.get(), end - start);
     if (!atom)
@@ -528,7 +528,7 @@ js::XDRAtom(XDRState<mode> *xdr, MutableHandleAtom atomp)
         JS::AutoCheckCannotGC nogc;
         return atomp->hasLatin1Chars()
                ? xdr->codeChars(atomp->latin1Chars(nogc), length)
-               : xdr->codeChars(const_cast<jschar*>(atomp->twoByteChars(nogc)), length);
+               : xdr->codeChars(const_cast<char16_t*>(atomp->twoByteChars(nogc)), length);
     }
 
     /* Avoid JSString allocation for already existing atoms. See bug 321985. */
@@ -547,15 +547,15 @@ js::XDRAtom(XDRState<mode> *xdr, MutableHandleAtom atomp)
     } else {
 #if IS_LITTLE_ENDIAN
         /* Directly access the little endian chars in the XDR buffer. */
-        const jschar *chars = reinterpret_cast<const jschar *>(xdr->buf.read(length * sizeof(jschar)));
+        const char16_t *chars = reinterpret_cast<const char16_t *>(xdr->buf.read(length * sizeof(char16_t)));
         atom = AtomizeChars(cx, chars, length);
 #else
         /*
          * We must copy chars to a temporary buffer to convert between little and
          * big endian data.
          */
-        jschar *chars;
-        jschar stackChars[256];
+        char16_t *chars;
+        char16_t stackChars[256];
         if (length <= ArrayLength(stackChars)) {
             chars = stackChars;
         } else {
@@ -564,7 +564,7 @@ js::XDRAtom(XDRState<mode> *xdr, MutableHandleAtom atomp)
              * most allocations here will be bigger than tempLifoAlloc's default
              * chunk size.
              */
-            chars = cx->runtime()->pod_malloc<jschar>(length);
+            chars = cx->runtime()->pod_malloc<char16_t>(length);
             if (!chars)
                 return false;
         }
diff --git a/js/src/jsatom.h b/js/src/jsatom.h
index 7b6bb50969e..006379659e5 100644
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -88,7 +88,7 @@ struct AtomHasher
     {
         union {
             const JS::Latin1Char *latin1Chars;
-            const jschar *twoByteChars;
+            const char16_t *twoByteChars;
         };
         bool isLatin1;
         size_t length;
@@ -97,7 +97,7 @@ struct AtomHasher
 
         HashNumber hash;
 
-        Lookup(const jschar *chars, size_t length)
+        Lookup(const char16_t *chars, size_t length)
           : twoByteChars(chars), isLatin1(false), length(length), atom(nullptr)
         {
             hash = mozilla::HashString(chars, length);
diff --git a/js/src/jsatominlines.h b/js/src/jsatominlines.h
index 2786181e8cd..2b7b6da4972 100644
--- a/js/src/jsatominlines.h
+++ b/js/src/jsatominlines.h
@@ -174,7 +174,7 @@ AtomHasher::match(const AtomStateEntry &entry, const Lookup &lookup)
         return EqualChars(keyChars, lookup.twoByteChars, lookup.length);
     }
 
-    const jschar *keyChars = key->twoByteChars(lookup.nogc);
+    const char16_t *keyChars = key->twoByteChars(lookup.nogc);
     if (lookup.isLatin1)
         return EqualChars(lookup.latin1Chars, keyChars, lookup.length);
     return mozilla::PodEqual(keyChars, lookup.twoByteChars, lookup.length);
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 994f7a412dc..063b585b0b9 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -490,7 +490,7 @@ bool
 js_ReportErrorVA(JSContext *cx, unsigned flags, const char *format, va_list ap)
 {
     char *message;
-    jschar *ucmessage;
+    char16_t *ucmessage;
     size_t messagelen;
     JSErrorReport report;
     bool warning;
@@ -670,7 +670,7 @@ js_ExpandErrorArguments(ExclusiveContext *cx, JSErrorCallback callback,
             if (messageArgsPassed) {
                 JS_ASSERT(!reportp->messageArgs[argCount]);
             } else {
-                reportp->messageArgs = cx->pod_malloc<const jschar*>(argCount + 1);
+                reportp->messageArgs = cx->pod_malloc<const char16_t*>(argCount + 1);
                 if (!reportp->messageArgs)
                     return false;
                 /* nullptr-terminate for easy copying. */
@@ -686,7 +686,7 @@ js_ExpandErrorArguments(ExclusiveContext *cx, JSErrorCallback callback,
                     if (!reportp->messageArgs[i])
                         goto error;
                 } else {
-                    reportp->messageArgs[i] = va_arg(ap, jschar *);
+                    reportp->messageArgs[i] = va_arg(ap, char16_t *);
                 }
                 argLengths[i] = js_strlen(reportp->messageArgs[i]);
                 totalArgsLength += argLengths[i];
@@ -698,7 +698,7 @@ js_ExpandErrorArguments(ExclusiveContext *cx, JSErrorCallback callback,
          */
         if (argCount > 0) {
             if (efs->format) {
-                jschar *buffer, *fmt, *out;
+                char16_t *buffer, *fmt, *out;
                 int expandedArgs = 0;
                 size_t expandedLength;
                 size_t len = strlen(efs->format);
@@ -714,7 +714,7 @@ js_ExpandErrorArguments(ExclusiveContext *cx, JSErrorCallback callback,
                 * Note - the above calculation assumes that each argument
                 * is used once and only once in the expansion !!!
                 */
-                reportp->ucmessage = out = cx->pod_malloc<jschar>(expandedLength + 1);
+                reportp->ucmessage = out = cx->pod_malloc<char16_t>(expandedLength + 1);
                 if (!out) {
                     js_free(buffer);
                     goto error;
@@ -737,9 +737,9 @@ js_ExpandErrorArguments(ExclusiveContext *cx, JSErrorCallback callback,
                 JS_ASSERT(expandedArgs == argCount);
                 *out = 0;
                 js_free(buffer);
-                size_t msgLen = PointerRangeSize(static_cast<const jschar *>(reportp->ucmessage),
-                                                 static_cast<const jschar *>(out));
-                mozilla::Range<const jschar> ucmsg(reportp->ucmessage, msgLen);
+                size_t msgLen = PointerRangeSize(static_cast<const char16_t *>(reportp->ucmessage),
+                                                 static_cast<const char16_t *>(out));
+                mozilla::Range<const char16_t> ucmsg(reportp->ucmessage, msgLen);
                 *messagep = JS::LossyTwoByteCharsToNewLatin1CharsZ(cx, ucmsg).c_str();
                 if (!*messagep)
                     goto error;
@@ -843,7 +843,7 @@ js_ReportErrorNumberVA(JSContext *cx, unsigned flags, JSErrorCallback callback,
 bool
 js_ReportErrorNumberUCArray(JSContext *cx, unsigned flags, JSErrorCallback callback,
                             void *userRef, const unsigned errorNumber,
-                            const jschar **args)
+                            const char16_t **args)
 {
     if (checkReportFlags(cx, &flags))
         return true;
@@ -1042,7 +1042,7 @@ js::InvokeInterruptCallback(JSContext *cx)
     JSString *stack = ComputeStackString(cx);
     JSFlatString *flat = stack ? stack->ensureFlat(cx) : nullptr;
 
-    const jschar *chars;
+    const char16_t *chars;
     AutoStableStringChars stableChars(cx);
     if (flat && stableChars.initTwoByte(cx, flat))
         chars = stableChars.twoByteRange().start().get();
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 5bf16a5f707..4c496fce733 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -722,7 +722,7 @@ js_ReportErrorNumberVA(JSContext *cx, unsigned flags, JSErrorCallback callback,
 extern bool
 js_ReportErrorNumberUCArray(JSContext *cx, unsigned flags, JSErrorCallback callback,
                             void *userRef, const unsigned errorNumber,
-                            const jschar **args);
+                            const char16_t **args);
 #endif
 
 extern bool
@@ -816,7 +816,7 @@ HandleExecutionInterrupt(JSContext *cx);
  * break out of its loop. This happens if, for example, the user clicks "Stop
  * script" on the slow script dialog; treat it as an uncatchable error.
  */
-inline bool
+MOZ_ALWAYS_INLINE bool
 CheckForInterrupt(JSContext *cx)
 {
     MOZ_ASSERT(cx->runtime()->requestDepth >= 1);
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index a1c0d850b5a..02ea14eeb7b 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -58,7 +58,7 @@ JSCompartment::JSCompartment(Zone *zone, const JS::CompartmentOptions &options =
     selfHostingScriptSource(nullptr),
     gcIncomingGrayPointers(nullptr),
     gcWeakMapList(nullptr),
-    debugModeBits(runtime_->debugMode ? DebugFromC : 0),
+    debugModeBits(0),
     rngState(0),
     watchpointMap(nullptr),
     scriptCountsMap(nullptr),
@@ -113,7 +113,7 @@ JSCompartment::init(JSContext *cx)
     if (!savedStacks_.init())
         return false;
 
-    return debuggees.init(0);
+    return true;
 }
 
 jit::JitRuntime *
@@ -298,7 +298,7 @@ CopyStringPure(JSContext *cx, JSString *str)
         return NewString<CanGC>(cx, copiedChars.forget(), len);
     }
 
-    ScopedJSFreePtr<jschar> copiedChars;
+    ScopedJSFreePtr<char16_t> copiedChars;
     if (!str->asRope().copyTwoByteCharsZ(cx, copiedChars))
         return nullptr;
 
@@ -594,8 +594,11 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
     sweepCallsiteClones();
     savedStacks_.sweep(rt);
 
-    if (global_ && IsObjectAboutToBeFinalized(global_.unsafeGet()))
+    if (global_ && IsObjectAboutToBeFinalized(global_.unsafeGet())) {
+        if (debugMode())
+            Debugger::detachAllDebuggersFromGlobal(fop, global_);
         global_.set(nullptr);
+    }
 
     if (selfHostingScriptSource &&
         IsObjectAboutToBeFinalized((JSObject **) selfHostingScriptSource.unsafeGet()))
@@ -628,17 +631,6 @@ JSCompartment::sweep(FreeOp *fop, bool releaseTypes)
             ni->unlink();
         ni = next;
     }
-
-    /* For each debuggee being GC'd, detach it from all its debuggers. */
-    for (GlobalObjectSet::Enum e(debuggees); !e.empty(); e.popFront()) {
-        GlobalObject *global = e.front();
-        if (IsObjectAboutToBeFinalized(&global)) {
-            // See infallibility note above.
-            Debugger::detachAllDebuggersFromGlobal(fop, global, &e);
-        } else if (global != e.front()) {
-            e.rekeyFront(global);
-        }
-    }
 }
 
 /*
@@ -847,41 +839,6 @@ JSCompartment::ensureDelazifyScriptsForDebugMode(JSContext *cx)
     return true;
 }
 
-bool
-JSCompartment::setDebugModeFromC(JSContext *cx, bool b, AutoDebugModeInvalidation &invalidate)
-{
-    bool enabledBefore = debugMode();
-    bool enabledAfter = (debugModeBits & DebugModeFromMask & ~DebugFromC) || b;
-
-    // Enabling debug mode from C (vs of from JS) can only be done when no
-    // scripts from the target compartment are on the stack.
-    //
-    // We do allow disabling debug mode while scripts are on the stack.  In
-    // that case the debug-mode code for those scripts remains, so subsequently
-    // hooks may be called erroneously, even though debug mode is supposedly
-    // off, and we have to live with it.
-    bool onStack = false;
-    if (enabledBefore != enabledAfter) {
-        onStack = hasScriptsOnStack();
-        if (b && onStack) {
-            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_DEBUG_NOT_IDLE);
-            return false;
-        }
-    }
-
-    debugModeBits = (debugModeBits & ~DebugFromC) | (b ? DebugFromC : 0);
-    JS_ASSERT(debugMode() == enabledAfter);
-    if (enabledBefore != enabledAfter) {
-        // Pass in a nullptr cx to not bother recompiling for JSD1, since
-        // we're still enforcing the idle-stack invariant here.
-        if (!updateJITForDebugMode(nullptr, invalidate))
-            return false;
-        if (!enabledAfter)
-            DebugScopes::onCompartmentLeaveDebugMode(this);
-    }
-    return true;
-}
-
 bool
 JSCompartment::updateJITForDebugMode(JSContext *maybecx, AutoDebugModeInvalidation &invalidate)
 {
@@ -893,76 +850,47 @@ JSCompartment::updateJITForDebugMode(JSContext *maybecx, AutoDebugModeInvalidati
 }
 
 bool
-JSCompartment::addDebuggee(JSContext *cx, JS::Handle<js::GlobalObject *> global)
+JSCompartment::enterDebugMode(JSContext *cx)
 {
     AutoDebugModeInvalidation invalidate(this);
-    return addDebuggee(cx, global, invalidate);
+    return enterDebugMode(cx, invalidate);
 }
 
 bool
-JSCompartment::addDebuggee(JSContext *cx,
-                           JS::Handle<GlobalObject *> global,
-                           AutoDebugModeInvalidation &invalidate)
+JSCompartment::enterDebugMode(JSContext *cx, AutoDebugModeInvalidation &invalidate)
 {
-    bool wasEnabled = debugMode();
-    if (!debuggees.put(global)) {
-        js_ReportOutOfMemory(cx);
-        return false;
+    if (!debugMode()) {
+        debugModeBits |= DebugMode;
+        if (!updateJITForDebugMode(cx, invalidate))
+            return false;
     }
-    debugModeBits |= DebugFromJS;
-    if (!wasEnabled && !updateJITForDebugMode(cx, invalidate))
-        return false;
     return true;
 }
 
 bool
-JSCompartment::removeDebuggee(JSContext *cx,
-                              js::GlobalObject *global,
-                              js::GlobalObjectSet::Enum *debuggeesEnum)
+JSCompartment::leaveDebugMode(JSContext *cx)
 {
     AutoDebugModeInvalidation invalidate(this);
-    return removeDebuggee(cx, global, invalidate, debuggeesEnum);
+    return leaveDebugMode(cx, invalidate);
 }
 
 bool
-JSCompartment::removeDebuggee(JSContext *cx,
-                              js::GlobalObject *global,
-                              AutoDebugModeInvalidation &invalidate,
-                              js::GlobalObjectSet::Enum *debuggeesEnum)
+JSCompartment::leaveDebugMode(JSContext *cx, AutoDebugModeInvalidation &invalidate)
 {
-    bool wasEnabled = debugMode();
-    removeDebuggeeUnderGC(cx->runtime()->defaultFreeOp(), global, invalidate, debuggeesEnum);
-    if (wasEnabled && !debugMode() && !updateJITForDebugMode(cx, invalidate))
-        return false;
+    if (debugMode()) {
+        leaveDebugModeUnderGC();
+        if (!updateJITForDebugMode(cx, invalidate))
+            return false;
+    }
     return true;
 }
 
 void
-JSCompartment::removeDebuggeeUnderGC(FreeOp *fop,
-                                     js::GlobalObject *global,
-                                     js::GlobalObjectSet::Enum *debuggeesEnum)
+JSCompartment::leaveDebugModeUnderGC()
 {
-    AutoDebugModeInvalidation invalidate(this);
-    removeDebuggeeUnderGC(fop, global, invalidate, debuggeesEnum);
-}
-
-void
-JSCompartment::removeDebuggeeUnderGC(FreeOp *fop,
-                                     js::GlobalObject *global,
-                                     AutoDebugModeInvalidation &invalidate,
-                                     js::GlobalObjectSet::Enum *debuggeesEnum)
-{
-    bool wasEnabled = debugMode();
-    JS_ASSERT(debuggees.has(global));
-    if (debuggeesEnum)
-        debuggeesEnum->removeFront();
-    else
-        debuggees.remove(global);
-
-    if (debuggees.empty()) {
-        debugModeBits &= ~DebugFromJS;
-        if (wasEnabled && !debugMode())
-            DebugScopes::onCompartmentLeaveDebugMode(this);
+    if (debugMode()) {
+        debugModeBits &= ~DebugMode;
+        DebugScopes::onCompartmentLeaveDebugMode(this);
     }
 }
 
@@ -985,7 +913,6 @@ JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                       size_t *compartmentTables,
                                       size_t *crossCompartmentWrappersArg,
                                       size_t *regexpCompartment,
-                                      size_t *debuggeesSet,
                                       size_t *savedStacksSet)
 {
     *compartmentObject += mallocSizeOf(this);
@@ -997,7 +924,6 @@ JSCompartment::addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                         + lazyTypeObjects.sizeOfExcludingThis(mallocSizeOf);
     *crossCompartmentWrappersArg += crossCompartmentWrappers.sizeOfExcludingThis(mallocSizeOf);
     *regexpCompartment += regExps.sizeOfExcludingThis(mallocSizeOf);
-    *debuggeesSet += debuggees.sizeOfExcludingThis(mallocSizeOf);
     *savedStacksSet += savedStacks_.sizeOfExcludingThis(mallocSizeOf);
 }
 
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index ffaabceb3ab..3bdab70774c 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -234,7 +234,6 @@ struct JSCompartment
                                 size_t *compartmentTables,
                                 size_t *crossCompartmentWrappers,
                                 size_t *regexpCompartment,
-                                size_t *debuggeesSet,
                                 size_t *savedStacksSet);
 
     /*
@@ -295,14 +294,11 @@ struct JSCompartment
 
   private:
     enum {
-        DebugFromC = 1 << 0,
-        DebugFromJS = 1 << 1,
-        DebugNeedDelazification = 1 << 2
+        DebugMode = 1 << 0,
+        DebugNeedDelazification = 1 << 1
     };
 
-    static const unsigned DebugModeFromMask = DebugFromC | DebugFromJS;
-
-    unsigned                     debugModeBits;  // see debugMode() below
+    unsigned                     debugModeBits;
 
   public:
     JSCompartment(JS::Zone *zone, const JS::CompartmentOptions &options);
@@ -381,32 +377,25 @@ struct JSCompartment
     /* Random number generator state, used by jsmath.cpp. */
     uint64_t rngState;
 
-  private:
-    /*
-     * Weak reference to each global in this compartment that is a debuggee.
-     * Each global has its own list of debuggers.
-     */
-    js::GlobalObjectSet              debuggees;
-
   private:
     JSCompartment *thisForCtor() { return this; }
 
+    // Only called from {enter,leave}DebugMode.
+    bool updateJITForDebugMode(JSContext *maybecx, js::AutoDebugModeInvalidation &invalidate);
+
   public:
-    /*
-     * There are dueling APIs for debug mode. It can be enabled or disabled via
-     * JS_SetDebugModeForCompartment. It is automatically enabled and disabled
-     * by Debugger objects. Therefore debugModeBits has the DebugFromC bit set
-     * if the C API wants debug mode and the DebugFromJS bit set if debuggees
-     * is non-empty.
-     *
-     * When toggling on, DebugNeedDelazification is set to signal that
-     * Debugger methods which depend on seeing all scripts (like findScripts)
-     * need to delazify the scripts in the compartment first.
-     */
+    // True if this compartment's global is a debuggee of some Debugger
+    // object.
     bool debugMode() const {
-        return !!(debugModeBits & DebugModeFromMask);
+        return !!(debugModeBits & DebugMode);
     }
 
+    bool enterDebugMode(JSContext *cx);
+    bool enterDebugMode(JSContext *cx, js::AutoDebugModeInvalidation &invalidate);
+    bool leaveDebugMode(JSContext *cx);
+    bool leaveDebugMode(JSContext *cx, js::AutoDebugModeInvalidation &invalidate);
+    void leaveDebugModeUnderGC();
+
     /* True if any scripts from this compartment are on the JS stack. */
     bool hasScriptsOnStack();
 
@@ -424,29 +413,6 @@ struct JSCompartment
      */
     bool ensureDelazifyScriptsForDebugMode(JSContext *cx);
 
-  private:
-
-    /* This is called only when debugMode() has just toggled. */
-    bool updateJITForDebugMode(JSContext *maybecx, js::AutoDebugModeInvalidation &invalidate);
-
-  public:
-    js::GlobalObjectSet &getDebuggees() { return debuggees; }
-    bool addDebuggee(JSContext *cx, JS::Handle<js::GlobalObject *> global);
-    bool addDebuggee(JSContext *cx, JS::Handle<js::GlobalObject *> global,
-                     js::AutoDebugModeInvalidation &invalidate);
-    bool removeDebuggee(JSContext *cx, js::GlobalObject *global,
-                        js::GlobalObjectSet::Enum *debuggeesEnum = nullptr);
-    bool removeDebuggee(JSContext *cx, js::GlobalObject *global,
-                        js::AutoDebugModeInvalidation &invalidate,
-                        js::GlobalObjectSet::Enum *debuggeesEnum = nullptr);
-    void removeDebuggeeUnderGC(js::FreeOp *fop, js::GlobalObject *global,
-                               js::GlobalObjectSet::Enum *debuggeesEnum = nullptr);
-    void removeDebuggeeUnderGC(js::FreeOp *fop, js::GlobalObject *global,
-                               js::AutoDebugModeInvalidation &invalidate,
-                               js::GlobalObjectSet::Enum *debuggeesEnum = nullptr);
-    bool setDebugModeFromC(JSContext *cx, bool b,
-                           js::AutoDebugModeInvalidation &invalidate);
-
     void clearBreakpointsIn(js::FreeOp *fop, js::Debugger *dbg, JS::HandleObject handler);
 
   private:
diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
index 3d55a2f7102..b5accdf4c69 100644
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -2556,7 +2556,7 @@ date_format(JSContext *cx, double date, formatspec format, MutableHandleValue rv
                 usetz = false;
             } else {
                 for (i = 0; i < tzlen; i++) {
-                    jschar c = tzbuf[i];
+                    char16_t c = tzbuf[i];
                     if (c > 127 ||
                         !(isalpha(c) || isdigit(c) ||
                           c == ' ' || c == '(' || c == ')')) {
diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
index d83121eda3b..79ac1a0aa91 100644
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@@ -93,16 +93,16 @@ js::CopyErrorReport(JSContext *cx, JSErrorReport *report)
      * the following layout:
      *   JSErrorReport
      *   array of copies of report->messageArgs
-     *   jschar array with characters for all messageArgs
-     *   jschar array with characters for ucmessage
-     *   jschar array with characters for uclinebuf and uctokenptr
+     *   char16_t array with characters for all messageArgs
+     *   char16_t array with characters for ucmessage
+     *   char16_t array with characters for uclinebuf and uctokenptr
      *   char array with characters for linebuf and tokenptr
      *   char array with characters for filename
      * Such layout together with the properties enforced by the following
      * asserts does not need any extra alignment padding.
      */
     JS_STATIC_ASSERT(sizeof(JSErrorReport) % sizeof(const char *) == 0);
-    JS_STATIC_ASSERT(sizeof(const char *) % sizeof(jschar) == 0);
+    JS_STATIC_ASSERT(sizeof(const char *) % sizeof(char16_t) == 0);
 
     size_t filenameSize;
     size_t linebufSize;
@@ -113,7 +113,7 @@ js::CopyErrorReport(JSContext *cx, JSErrorReport *report)
     JSErrorReport *copy;
     uint8_t *cursor;
 
-#define JS_CHARS_SIZE(jschars) ((js_strlen(jschars) + 1) * sizeof(jschar))
+#define JS_CHARS_SIZE(chars) ((js_strlen(chars) + 1) * sizeof(char16_t))
 
     filenameSize = report->filename ? strlen(report->filename) + 1 : 0;
     linebufSize = report->linebuf ? strlen(report->linebuf) + 1 : 0;
@@ -129,7 +129,7 @@ js::CopyErrorReport(JSContext *cx, JSErrorReport *report)
 
             /* Non-null messageArgs should have at least one non-null arg. */
             JS_ASSERT(i != 0);
-            argsArraySize = (i + 1) * sizeof(const jschar *);
+            argsArraySize = (i + 1) * sizeof(const char16_t *);
         }
     }
 
@@ -148,10 +148,10 @@ js::CopyErrorReport(JSContext *cx, JSErrorReport *report)
     cursor += sizeof(JSErrorReport);
 
     if (argsArraySize != 0) {
-        copy->messageArgs = (const jschar **)cursor;
+        copy->messageArgs = (const char16_t **)cursor;
         cursor += argsArraySize;
         for (i = 0; report->messageArgs[i]; ++i) {
-            copy->messageArgs[i] = (const jschar *)cursor;
+            copy->messageArgs[i] = (const char16_t *)cursor;
             argSize = JS_CHARS_SIZE(report->messageArgs[i]);
             js_memcpy(cursor, report->messageArgs[i], argSize);
             cursor += argSize;
@@ -161,13 +161,13 @@ js::CopyErrorReport(JSContext *cx, JSErrorReport *report)
     }
 
     if (report->ucmessage) {
-        copy->ucmessage = (const jschar *)cursor;
+        copy->ucmessage = (const char16_t *)cursor;
         js_memcpy(cursor, report->ucmessage, ucmessageSize);
         cursor += ucmessageSize;
     }
 
     if (report->uclinebuf) {
-        copy->uclinebuf = (const jschar *)cursor;
+        copy->uclinebuf = (const char16_t *)cursor;
         js_memcpy(cursor, report->uclinebuf, uclinebufSize);
         cursor += uclinebufSize;
         if (report->uctokenptr) {
@@ -667,10 +667,10 @@ ErrorReport::~ErrorReport()
          */
         size_t i = 0;
         while (ownedReport.messageArgs[i])
-            js_free(const_cast<jschar*>(ownedReport.messageArgs[i++]));
+            js_free(const_cast<char16_t*>(ownedReport.messageArgs[i++]));
         js_free(ownedReport.messageArgs);
     }
-    js_free(const_cast<jschar*>(ownedReport.ucmessage));
+    js_free(const_cast<char16_t*>(ownedReport.ucmessage));
 }
 
 bool
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 9ea44eef814..97a8074b163 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -688,9 +688,9 @@ js_DumpAtom(JSAtom *atom)
 }
 
 JS_FRIEND_API(void)
-js_DumpChars(const jschar *s, size_t n)
+js_DumpChars(const char16_t *s, size_t n)
 {
-    fprintf(stderr, "jschar * (%p) = ", (void *) s);
+    fprintf(stderr, "char16_t * (%p) = ", (void *) s);
     JSString::dumpChars(s, n);
     fputc('\n', stderr);
 }
@@ -851,13 +851,13 @@ JS::WasIncrementalGC(JSRuntime *rt)
     return rt->gc.isIncrementalGc();
 }
 
-jschar *
+char16_t *
 GCDescription::formatMessage(JSRuntime *rt) const
 {
     return rt->gc.stats.formatMessage();
 }
 
-jschar *
+char16_t *
 GCDescription::formatJSON(JSRuntime *rt, uint64_t timestamp) const
 {
     return rt->gc.stats.formatJSON(timestamp);
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index bb50ce6d803..c1eec8ea372 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -197,7 +197,7 @@ extern JS_FRIEND_API(void)
 js_DumpObject(JSObject *obj);
 
 extern JS_FRIEND_API(void)
-js_DumpChars(const jschar *s, size_t n);
+js_DumpChars(const char16_t *s, size_t n);
 #endif
 
 /*
@@ -416,7 +416,7 @@ class SourceHook {
      * On success, the caller owns the buffer to which |*src| points, and
      * should use JS_free to free it.
      */
-    virtual bool load(JSContext *cx, const char *filename, jschar **src, size_t *length) = 0;
+    virtual bool load(JSContext *cx, const char *filename, char16_t **src, size_t *length) = 0;
 };
 
 /*
@@ -608,9 +608,9 @@ struct String
     uint32_t length;
     union {
         const JS::Latin1Char *nonInlineCharsLatin1;
-        const jschar *nonInlineCharsTwoByte;
+        const char16_t *nonInlineCharsTwoByte;
         JS::Latin1Char inlineStorageLatin1[1];
-        jschar inlineStorageTwoByte[1];
+        char16_t inlineStorageTwoByte[1];
     };
 };
 
@@ -870,7 +870,7 @@ GetLatin1LinearStringChars(const JS::AutoCheckCannotGC &nogc, JSLinearString *li
     return s->nonInlineCharsLatin1;
 }
 
-MOZ_ALWAYS_INLINE const jschar *
+MOZ_ALWAYS_INLINE const char16_t *
 GetTwoByteLinearStringChars(const JS::AutoCheckCannotGC &nogc, JSLinearString *linear)
 {
     MOZ_ASSERT(!LinearStringHasLatin1Chars(linear));
@@ -900,7 +900,7 @@ GetLatin1AtomChars(const JS::AutoCheckCannotGC &nogc, JSAtom *atom)
     return GetLatin1LinearStringChars(nogc, AtomToLinearString(atom));
 }
 
-MOZ_ALWAYS_INLINE const jschar *
+MOZ_ALWAYS_INLINE const char16_t *
 GetTwoByteAtomChars(const JS::AutoCheckCannotGC &nogc, JSAtom *atom)
 {
     return GetTwoByteLinearStringChars(nogc, AtomToLinearString(atom));
@@ -920,7 +920,7 @@ StringToLinearString(JSContext *cx, JSString *str)
 }
 
 MOZ_ALWAYS_INLINE void
-CopyLinearStringChars(jschar *dest, JSLinearString *s, size_t len)
+CopyLinearStringChars(char16_t *dest, JSLinearString *s, size_t len)
 {
     JS::AutoCheckCannotGC nogc;
     if (LinearStringHasLatin1Chars(s)) {
@@ -928,13 +928,13 @@ CopyLinearStringChars(jschar *dest, JSLinearString *s, size_t len)
         for (size_t i = 0; i < len; i++)
             dest[i] = src[i];
     } else {
-        const jschar *src = GetTwoByteLinearStringChars(nogc, s);
+        const char16_t *src = GetTwoByteLinearStringChars(nogc, s);
         mozilla::PodCopy(dest, src, len);
     }
 }
 
 inline bool
-CopyStringChars(JSContext *cx, jschar *dest, JSString *s, size_t len)
+CopyStringChars(JSContext *cx, char16_t *dest, JSString *s, size_t len)
 {
     JSLinearString *linear = StringToLinearString(cx, s);
     if (!linear)
@@ -945,7 +945,7 @@ CopyStringChars(JSContext *cx, jschar *dest, JSString *s, size_t len)
 }
 
 inline void
-CopyFlatStringChars(jschar *dest, JSFlatString *s, size_t len)
+CopyFlatStringChars(char16_t *dest, JSFlatString *s, size_t len)
 {
     CopyLinearStringChars(dest, FlatStringToLinearString(s), len);
 }
@@ -1295,7 +1295,7 @@ class MOZ_STACK_CLASS AutoStableStringChars
     /* Ensure the string is kept alive while we're using its chars. */
     JS::RootedString s_;
     union {
-        const jschar *twoByteChars_;
+        const char16_t *twoByteChars_;
         const JS::Latin1Char *latin1Chars_;
     };
     enum State { Uninitialized, Latin1, TwoByte };
@@ -1316,7 +1316,7 @@ class MOZ_STACK_CLASS AutoStableStringChars
     bool isLatin1() const { return state_ == Latin1; }
     bool isTwoByte() const { return state_ == TwoByte; }
 
-    const jschar *twoByteChars() const {
+    const char16_t *twoByteChars() const {
         MOZ_ASSERT(state_ == TwoByte);
         return twoByteChars_;
     }
@@ -1327,9 +1327,9 @@ class MOZ_STACK_CLASS AutoStableStringChars
                                                     GetStringLength(s_));
     }
 
-    mozilla::Range<const jschar> twoByteRange() const {
+    mozilla::Range<const char16_t> twoByteRange() const {
         MOZ_ASSERT(state_ == TwoByte);
-        return mozilla::Range<const jschar>(twoByteChars_,
+        return mozilla::Range<const char16_t>(twoByteChars_,
                                             GetStringLength(s_));
     }
 
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index f84d73ee26f..79fac874391 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -118,8 +118,11 @@ ThrowTypeErrorBehavior(JSContext *cx)
 static bool
 ArgumentsRestrictions(JSContext *cx, HandleFunction fun)
 {
-    // Throw if the function is a strict mode function or a bound function.
-    if ((!fun->isBuiltin() && fun->isInterpreted() && fun->strict()) ||
+    // Throw if the function is a builtin (note: this doesn't include asm.js),
+    // a strict mode function (FIXME: needs work handle strict asm.js functions
+    // correctly, should fall out of bug 1057208), or a bound function.
+    if (fun->isBuiltin() ||
+        (fun->isInterpreted() && fun->strict()) ||
         fun->isBoundFunction())
     {
         ThrowTypeErrorBehavior(cx);
@@ -154,14 +157,6 @@ ArgumentsGetterImpl(JSContext *cx, CallArgs args)
     if (!ArgumentsRestrictions(cx, fun))
         return false;
 
-    // FIXME: Bug 929642 will break "arguments" and "caller" properties on
-    //        builtin functions, at which point this condition should be added
-    //        to the early exit at the start of ArgumentsGuts.
-    if (fun->isBuiltin()) {
-        args.rval().setNull();
-        return true;
-    }
-
     // Return null if this function wasn't found on the stack.
     NonBuiltinScriptFrameIter iter(cx);
     if (!AdvanceToActiveCallLinear(iter, fun)) {
@@ -199,13 +194,6 @@ ArgumentsSetterImpl(JSContext *cx, CallArgs args)
     if (!ArgumentsRestrictions(cx, fun))
         return false;
 
-    // FIXME: Bug 929642 will break "arguments" and "caller" properties on
-    //        builtin functions, at which point this bit should be removed.
-    if (fun->isBuiltin()) {
-        args.rval().setUndefined();
-        return true;
-    }
-
     // If the function passes the gauntlet, return |undefined|.
     args.rval().setUndefined();
     return true;
@@ -227,8 +215,11 @@ ArgumentsSetter(JSContext *cx, unsigned argc, Value *vp)
 static bool
 CallerRestrictions(JSContext *cx, HandleFunction fun)
 {
-    // Throw if the function is a strict mode function or a bound function.
-    if ((!fun->isBuiltin() && fun->isInterpreted() && fun->strict()) ||
+    // Throw if the function is a builtin (note: this doesn't include asm.js),
+    // a strict mode function (FIXME: needs work handle strict asm.js functions
+    // correctly, should fall out of bug 1057208), or a bound function.
+    if (fun->isBuiltin() ||
+        (fun->isInterpreted() && fun->strict()) ||
         fun->isBoundFunction())
     {
         ThrowTypeErrorBehavior(cx);
@@ -259,14 +250,6 @@ CallerGetterImpl(JSContext *cx, CallArgs args)
     if (!CallerRestrictions(cx, fun))
         return false;
 
-    // FIXME: Bug 929642 will break "arguments" and "caller" properties on
-    //        builtin functions, at which point this condition should be added
-    //        to the early exit at the start of CallerRestrictions.
-    if (fun->isBuiltin()) {
-        args.rval().setNull();
-        return true;
-    }
-
     // Also return null if this function wasn't found on the stack.
     NonBuiltinScriptFrameIter iter(cx);
     if (!AdvanceToActiveCallLinear(iter, fun)) {
@@ -340,11 +323,6 @@ CallerSetterImpl(JSContext *cx, CallArgs args)
     // Return |undefined| unless an error must be thrown.
     args.rval().setUndefined();
 
-    // FIXME: Bug 929642 will break "arguments" and "caller" properties on
-    //        builtin functions, at which point this bit should be removed.
-    if (fun->isBuiltin())
-        return true;
-
     // We can almost just return |undefined| here -- but if the caller function
     // was strict mode code, we still have to throw a TypeError.  This requires
     // computing the caller, checking that no security boundaries are crossed,
@@ -835,7 +813,7 @@ CreateFunctionPrototype(JSContext *cx, JSProtoKey key)
 
     const char *rawSource = "() {\n}";
     size_t sourceLen = strlen(rawSource);
-    jschar *source = InflateString(cx, rawSource, &sourceLen);
+    char16_t *source = InflateString(cx, rawSource, &sourceLen);
     if (!source)
         return nullptr;
 
@@ -851,7 +829,7 @@ CreateFunctionPrototype(JSContext *cx, JSProtoKey key)
     options.setNoScriptRval(true)
            .setVersion(JSVERSION_DEFAULT);
     RootedScriptSource sourceObject(cx, ScriptSourceObject::create(cx, ss));
-    if (!sourceObject)
+    if (!sourceObject || !ScriptSourceObject::initFromOptions(cx, sourceObject, options))
         return nullptr;
 
     RootedScript script(cx, JSScript::Create(cx,
@@ -945,7 +923,7 @@ js::FindBody(JSContext *cx, HandleFunction fun, HandleLinearString src, size_t *
     if (!stableChars.initTwoByte(cx, src))
         return false;
 
-    const mozilla::Range<const jschar> srcChars = stableChars.twoByteRange();
+    const mozilla::Range<const char16_t> srcChars = stableChars.twoByteRange();
     TokenStream ts(cx, options, srcChars.start().get(), srcChars.length(), nullptr);
     int nest = 0;
     bool onward = true;
@@ -981,7 +959,7 @@ js::FindBody(JSContext *cx, HandleFunction fun, HandleLinearString src, size_t *
     *bodyStart = ts.currentToken().pos.begin;
     if (braced)
         *bodyStart += 1;
-    mozilla::RangedPtr<const jschar> end = srcChars.end();
+    mozilla::RangedPtr<const char16_t> end = srcChars.end();
     if (end[-1] == '}') {
         end--;
     } else {
@@ -1461,11 +1439,11 @@ JSFunction::createScriptForLazilyInterpretedFunction(JSContext *cx, HandleFuncti
 
         // Parse and compile the script from source.
         UncompressedSourceCache::AutoHoldEntry holder;
-        const jschar *chars = lazy->source()->chars(cx, holder);
+        const char16_t *chars = lazy->source()->chars(cx, holder);
         if (!chars)
             return false;
 
-        const jschar *lazyStart = chars + lazy->begin();
+        const char16_t *lazyStart = chars + lazy->begin();
         size_t lazyLength = lazy->end() - lazy->begin();
 
         if (!frontend::CompileLazyFunction(cx, lazy, lazyStart, lazyLength))
@@ -1776,7 +1754,7 @@ FunctionConstructor(JSContext *cx, unsigned argc, Value *vp, GeneratorKind gener
         size_t old_args_length = args_length;
         args_length = old_args_length + n - 1;
         if (args_length < old_args_length ||
-            args_length >= ~(size_t)0 / sizeof(jschar)) {
+            args_length >= ~(size_t)0 / sizeof(char16_t)) {
             js_ReportAllocationOverflow(cx);
             return false;
         }
@@ -1787,7 +1765,7 @@ FunctionConstructor(JSContext *cx, unsigned argc, Value *vp, GeneratorKind gener
          * free collected_args and its tokenstream in one swoop.
          */
         LifoAllocScope las(&cx->tempLifoAlloc());
-        jschar *cp = cx->tempLifoAlloc().newArray<jschar>(args_length + 1);
+        char16_t *cp = cx->tempLifoAlloc().newArray<char16_t>(args_length + 1);
         if (!cp) {
             js_ReportOutOfMemory(cx);
             return false;
@@ -1916,7 +1894,7 @@ FunctionConstructor(JSContext *cx, unsigned argc, Value *vp, GeneratorKind gener
     if (!stableChars.initTwoByte(cx, str))
         return false;
 
-    mozilla::Range<const jschar> chars = stableChars.twoByteRange();
+    mozilla::Range<const char16_t> chars = stableChars.twoByteRange();
     SourceBufferHolder::Ownership ownership = stableChars.maybeGiveOwnershipToCaller()
                                               ? SourceBufferHolder::GiveOwnership
                                               : SourceBufferHolder::NoOwnership;
diff --git a/js/src/jsgc.h b/js/src/jsgc.h
index 9a154e29b2f..e9c816d6984 100644
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@@ -291,7 +291,7 @@ GetGCKindSlots(AllocKind thingKind)
       case FINALIZE_OBJECT16_BACKGROUND:
         return 16;
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad object finalize kind");
+        MOZ_CRASH("Bad object finalize kind");
     }
 }
 
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index 76b82b3e47d..1f6b5bbb2c9 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -183,7 +183,7 @@ types::TypeString(Type type)
           case JSVAL_TYPE_MAGIC:
             return "lazyargs";
           default:
-            MOZ_ASSUME_UNREACHABLE("Bad type");
+            MOZ_CRASH("Bad type");
         }
     }
     if (type.isUnknown())
@@ -357,7 +357,7 @@ TypeSet::mightBeMIRType(jit::MIRType type)
         // same join point in GuessPhiType.
         return false;
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad MIR type");
+        MOZ_CRASH("Bad MIR type");
     }
 }
 
@@ -1752,20 +1752,20 @@ HeapTypeSetKey::constant(CompilerConstraintList *constraints, Value *valOut)
     if (nonData(constraints))
         return false;
 
-    if (!maybeTypes())
-        return false;
-
-    if (maybeTypes()->nonConstantProperty())
-        return false;
-
     // Only singleton object properties can be marked as constants.
-    JS_ASSERT(object()->singleton());
+    JSObject *obj = object()->singleton();
+    if (!obj || !obj->isNative())
+        return false;
+
+    if (maybeTypes() && maybeTypes()->nonConstantProperty())
+        return false;
 
     // Get the current value of the property.
-    Shape *shape = object()->singleton()->nativeLookupPure(id());
-    if (!shape)
+    Shape *shape = obj->nativeLookupPure(id());
+    if (!shape || !shape->hasDefaultGetter() || !shape->hasSlot() || shape->hadOverwrite())
         return false;
-    Value val = object()->singleton()->nativeGetSlot(shape->slot());
+
+    Value val = obj->nativeGetSlot(shape->slot());
 
     // If the value is a pointer to an object in the nursery, don't optimize.
     if (val.isGCThing() && IsInsideNursery(val.toGCThing()))
@@ -3887,7 +3887,7 @@ TypeNewScript::maybeAnalyze(JSContext *cx, TypeObject *type, bool *regenerate, b
     if (!jit::AnalyzeNewScriptDefiniteProperties(cx, fun, type, templateRoot, &initializerVector))
         return false;
 
-    if (type->unknownProperties())
+    if (!type->newScript())
         return true;
 
     JS_ASSERT(OnlyHasDataProperties(templateObject()->lastProperty()));
diff --git a/js/src/jsinferinlines.h b/js/src/jsinferinlines.h
index 76ab1ec0700..ba6ee73d7a0 100644
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@@ -165,7 +165,7 @@ PrimitiveTypeFlag(JSValueType type)
       case JSVAL_TYPE_MAGIC:
         return TYPE_FLAG_LAZYARGS;
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad type");
+        MOZ_CRASH("Bad JSValueType");
     }
 }
 
@@ -190,7 +190,7 @@ TypeFlagPrimitive(TypeFlags flags)
       case TYPE_FLAG_LAZYARGS:
         return JSVAL_TYPE_MAGIC;
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad type");
+        MOZ_CRASH("Bad TypeFlags");
     }
 }
 
@@ -359,7 +359,7 @@ GetClassForProtoKey(JSProtoKey key)
         return &DataViewObject::class_;
 
       default:
-        MOZ_ASSUME_UNREACHABLE("Bad proto key");
+        MOZ_CRASH("Bad proto key");
     }
 }
 
diff --git a/js/src/jsnum.cpp b/js/src/jsnum.cpp
index 0ed1ed09af1..5f29e51c59c 100644
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -199,7 +199,7 @@ template double
 js::ParseDecimalNumber(const mozilla::Range<const Latin1Char> chars);
 
 template double
-js::ParseDecimalNumber(const mozilla::Range<const jschar> chars);
+js::ParseDecimalNumber(const mozilla::Range<const char16_t> chars);
 
 template <typename CharT>
 bool
@@ -249,22 +249,22 @@ js::GetPrefixInteger(ThreadSafeContext *cx, const CharT *start, const CharT *end
 }
 
 template bool
-js::GetPrefixInteger(ThreadSafeContext *cx, const jschar *start, const jschar *end, int base,
-                     const jschar **endp, double *dp);
+js::GetPrefixInteger(ThreadSafeContext *cx, const char16_t *start, const char16_t *end, int base,
+                     const char16_t **endp, double *dp);
 
 template bool
 js::GetPrefixInteger(ThreadSafeContext *cx, const Latin1Char *start, const Latin1Char *end,
                      int base, const Latin1Char **endp, double *dp);
 
 bool
-js::GetDecimalInteger(ExclusiveContext *cx, const jschar *start, const jschar *end, double *dp)
+js::GetDecimalInteger(ExclusiveContext *cx, const char16_t *start, const char16_t *end, double *dp)
 {
     JS_ASSERT(start <= end);
 
-    const jschar *s = start;
+    const char16_t *s = start;
     double d = 0.0;
     for (; s < end; s++) {
-        jschar c = *s;
+        char16_t c = *s;
         JS_ASSERT('0' <= c && c <= '9');
         int digit = c - '0';
         d = d * 10 + digit;
@@ -308,8 +308,8 @@ num_parseFloat(JSContext *cx, unsigned argc, Value *vp)
         if (end == begin)
             d = GenericNaN();
     } else {
-        const jschar *begin = linear->twoByteChars(nogc);
-        const jschar *end;
+        const char16_t *begin = linear->twoByteChars(nogc);
+        const char16_t *end;
         if (!js_strtod(cx, begin, begin + linear->length(), &end, &d))
             return false;
         if (end == begin)
@@ -1294,7 +1294,7 @@ js_NumberToStringWithBase(ThreadSafeContext *cx, double d, int base)
         if (unsigned(i) < unsigned(base)) {
             if (i < 10)
                 return cx->staticStrings().getInt(i);
-            jschar c = 'a' + i - 10;
+            char16_t c = 'a' + i - 10;
             JS_ASSERT(StaticStrings::hasUnit(c));
             return cx->staticStrings().getUnit(c);
         }
@@ -1426,8 +1426,8 @@ js::NumberValueToStringBuffer(JSContext *cx, const Value &v, StringBuffer &sb)
     }
 
     /*
-     * Inflate to jschar string.  The input C-string characters are < 127, so
-     * even if jschars are UTF-8, all chars should map to one jschar.
+     * Inflate to char16_t string.  The input C-string characters are < 127, so
+     * even if char16_t units are UTF-8, all chars should map to one char16_t.
      */
     JS_ASSERT(!cbuf.dbuf && cstrlen < cbuf.sbufSize);
     return sb.append(cstr, cstrlen);
@@ -1713,7 +1713,7 @@ js_strtod(ThreadSafeContext *cx, const CharT *begin, const CharT *end, const Cha
 
     size_t i = 0;
     for (; i < length; i++) {
-        jschar c = s[i];
+        char16_t c = s[i];
         if (c >> 8)
             break;
         chars[i] = char(c);
@@ -1750,7 +1750,7 @@ js_strtod(ThreadSafeContext *cx, const CharT *begin, const CharT *end, const Cha
 }
 
 template bool
-js_strtod(ThreadSafeContext *cx, const jschar *begin, const jschar *end, const jschar **dEnd,
+js_strtod(ThreadSafeContext *cx, const char16_t *begin, const char16_t *end, const char16_t **dEnd,
           double *d);
 
 template bool
diff --git a/js/src/jsnum.h b/js/src/jsnum.h
index 01951c3a958..f1e03f92fe4 100644
--- a/js/src/jsnum.h
+++ b/js/src/jsnum.h
@@ -141,11 +141,11 @@ GetPrefixInteger(ThreadSafeContext *cx, const CharT *start, const CharT *end, in
 
 /*
  * This is like GetPrefixInteger, but only deals with base 10, and doesn't have
- * and |endp| outparam.  It should only be used when the jschars are known to
+ * and |endp| outparam.  It should only be used when the characters are known to
  * only contain digits.
  */
 extern bool
-GetDecimalInteger(ExclusiveContext *cx, const jschar *start, const jschar *end, double *dp);
+GetDecimalInteger(ExclusiveContext *cx, const char16_t *start, const char16_t *end, double *dp);
 
 extern bool
 StringToNumber(ThreadSafeContext *cx, JSString *str, double *result);
diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index f1b7c8cf28d..85ab9925956 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -2372,7 +2372,7 @@ js::CloneObjectLiteral(JSContext *cx, HandleObject parent, HandleObject srcObj)
     JS_ASSERT(srcObj->getElementsHeader()->ownerObject() == srcObj);
 
     size_t length = srcObj->as<ArrayObject>().length();
-    RootedObject res(cx, NewDenseAllocatedArray(cx, length, nullptr, MaybeSingletonObject));
+    RootedObject res(cx, NewDenseFullyAllocatedArray(cx, length, nullptr, MaybeSingletonObject));
     if (!res)
         return nullptr;
 
@@ -6141,6 +6141,8 @@ dumpValue(const Value &v)
         fprintf(stderr, "%g", v.toDouble());
     else if (v.isString())
         v.toString()->dump();
+    else if (v.isSymbol())
+        v.toSymbol()->dump();
     else if (v.isObject() && v.toObject().is<JSFunction>()) {
         JSFunction *fun = &v.toObject().as<JSFunction>();
         if (fun->displayAtom()) {
diff --git a/js/src/json.cpp b/js/src/json.cpp
index c3e03cbf0e9..e1454a7f739 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -46,7 +46,7 @@ const Class js::JSONClass = {
     JS_ConvertStub
 };
 
-static inline bool IsQuoteSpecialCharacter(jschar c)
+static inline bool IsQuoteSpecialCharacter(char16_t c)
 {
     JS_STATIC_ASSERT('\b' < ' ');
     JS_STATIC_ASSERT('\f' < ' ');
@@ -84,12 +84,12 @@ Quote(StringBuffer &sb, JSLinearString *str)
                 break;
         }
 
-        jschar c = buf[i];
+        char16_t c = buf[i];
         if (c == '"' || c == '\\') {
             if (!sb.append('\\') || !sb.append(c))
                 return false;
         } else if (c == '\b' || c == '\f' || c == '\n' || c == '\r' || c == '\t') {
-           jschar abbrev = (c == '\b')
+           char16_t abbrev = (c == '\b')
                          ? 'b'
                          : (c == '\f')
                          ? 'f'
@@ -128,7 +128,7 @@ Quote(JSContext *cx, StringBuffer &sb, JSString *str)
 
     return linear->hasLatin1Chars()
            ? Quote<Latin1Char>(sb, linear)
-           : Quote<jschar>(sb, linear);
+           : Quote<char16_t>(sb, linear);
 }
 
 namespace {
@@ -817,7 +817,7 @@ js::ParseJSONWithReviver(JSContext *cx, const mozilla::Range<const Latin1Char> c
                          HandleValue reviver, MutableHandleValue vp);
 
 template bool
-js::ParseJSONWithReviver(JSContext *cx, const mozilla::Range<const jschar> chars, HandleValue reviver,
+js::ParseJSONWithReviver(JSContext *cx, const mozilla::Range<const char16_t> chars, HandleValue reviver,
                          MutableHandleValue vp);
 
 #if JS_HAS_TOSOURCE
diff --git a/js/src/jsonparser.cpp b/js/src/jsonparser.cpp
index 67ce7a53fca..1fcc25f7f9f 100644
--- a/js/src/jsonparser.cpp
+++ b/js/src/jsonparser.cpp
@@ -162,7 +162,7 @@ JSONParser<CharT>::readString()
         if (current >= end)
             break;
 
-        jschar c = *current++;
+        char16_t c = *current++;
         if (c == '"') {
             JSFlatString *str = (ST == JSONParser::PropertyName)
                                 ? buffer.finishAtom()
@@ -341,7 +341,7 @@ JSONParser<CharT>::readNumber()
 }
 
 static inline bool
-IsJSONWhitespace(jschar c)
+IsJSONWhitespace(char16_t c)
 {
     return c == '\t' || c == '\r' || c == '\n' || c == ' ';
 }
@@ -830,4 +830,4 @@ JSONParser<CharT>::parse(MutableHandleValue vp)
 }
 
 template class js::JSONParser<Latin1Char>;
-template class js::JSONParser<jschar>;
+template class js::JSONParser<char16_t>;
diff --git a/js/src/jsopcode.cpp b/js/src/jsopcode.cpp
index 38a04d2f0ad..9c41e16ef2a 100644
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@@ -792,7 +792,7 @@ js_DumpScriptDepth(JSContext *cx, JSScript *scriptArg, jsbytecode *pc)
 }
 
 static char *
-QuoteString(Sprinter *sp, JSString *str, jschar quote);
+QuoteString(Sprinter *sp, JSString *str, char16_t quote);
 
 static bool
 ToDisassemblySource(JSContext *cx, HandleValue v, JSAutoByteString *bytes)
@@ -1290,7 +1290,7 @@ const char js_EscapeMap[] = {
 
 template <typename CharT>
 static char *
-QuoteString(Sprinter *sp, const CharT *s, size_t length, jschar quote)
+QuoteString(Sprinter *sp, const CharT *s, size_t length, char16_t quote)
 {
     /* Sample off first for later return value pointer computation. */
     ptrdiff_t offset = sp->getOffset();
@@ -1303,7 +1303,7 @@ QuoteString(Sprinter *sp, const CharT *s, size_t length, jschar quote)
     /* Loop control variables: end points at end of string sentinel. */
     for (const CharT *t = s; t < end; s = ++t) {
         /* Move t forward from s past un-quote-worthy characters. */
-        jschar c = *t;
+        char16_t c = *t;
         while (c < 127 && isprint(c) && c != quote && c != '\\' && c != '\t') {
             c = *++t;
             if (t == end)
@@ -1355,7 +1355,7 @@ QuoteString(Sprinter *sp, const CharT *s, size_t length, jschar quote)
 }
 
 static char *
-QuoteString(Sprinter *sp, JSString *str, jschar quote)
+QuoteString(Sprinter *sp, JSString *str, char16_t quote)
 {
     JSLinearString *linear = str->ensureLinear(sp->context);
     if (!linear)
@@ -1368,7 +1368,7 @@ QuoteString(Sprinter *sp, JSString *str, jschar quote)
 }
 
 JSString *
-js_QuoteString(ExclusiveContext *cx, JSString *str, jschar quote)
+js_QuoteString(ExclusiveContext *cx, JSString *str, char16_t quote)
 {
     Sprinter sprinter(cx);
     if (!sprinter.init())
diff --git a/js/src/jsopcode.h b/js/src/jsopcode.h
index 18814dbbece..9db49180809 100644
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@@ -274,7 +274,7 @@ extern const char       js_EscapeMap[];
  * with the quote character at the beginning and end of the result string.
  */
 extern JSString *
-js_QuoteString(js::ExclusiveContext *cx, JSString *str, jschar quote);
+js_QuoteString(js::ExclusiveContext *cx, JSString *str, char16_t quote);
 
 namespace js {
 
diff --git a/js/src/jsprf.cpp b/js/src/jsprf.cpp
index 98947b777b4..1b69bc0c7d9 100644
--- a/js/src/jsprf.cpp
+++ b/js/src/jsprf.cpp
@@ -12,11 +12,14 @@
 
 #include "jsprf.h"
 
+#include "mozilla/Vector.h"
+
 #include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
+#include "jsalloc.h"
 #include "jspubtd.h"
 #include "jsstr.h"
 #include "jsutil.h"
@@ -56,7 +59,7 @@ struct NumArgState
     va_list ap;     // point to the corresponding position on ap
 };
 
-const size_t NAS_DEFAULT_NUM = 20;  // default number of NumberedArgumentState array
+typedef mozilla::Vector<NumArgState, 20, js::SystemAllocPolicy> NumArgStateVector;
 
 
 #define TYPE_INT16      0
@@ -86,7 +89,7 @@ generic_write(SprintfState *ss, const char *src, size_t srclen)
 }
 
 inline int
-generic_write(SprintfState *ss, const jschar *src, size_t srclen)
+generic_write(SprintfState *ss, const char16_t *src, size_t srclen)
 {
     const size_t CHUNK_SIZE = 64;
     char chunk[CHUNK_SIZE];
@@ -341,10 +344,10 @@ static int cvt_f(SprintfState *ss, double d, const char *fmt0, const char *fmt1)
 }
 
 static inline const char *generic_null_str(const char *) { return "(null)"; }
-static inline const jschar *generic_null_str(const jschar *) { return MOZ_UTF16("(null)"); }
+static inline const char16_t *generic_null_str(const char16_t *) { return MOZ_UTF16("(null)"); }
 
 static inline size_t generic_strlen(const char *s) { return strlen(s); }
-static inline size_t generic_strlen(const jschar *s) { return js_strlen(s); }
+static inline size_t generic_strlen(const char16_t *s) { return js_strlen(s); }
 
 /*
  * Convert a string into its printable form.  "width" is the output
@@ -375,20 +378,18 @@ cvt_s(SprintfState *ss, const Char *s, int width, int prec, int flags)
  *      fmp = "%4$i, %2$d, %3s, %1d";
  * the number must start from 1, and no gap among them
  */
-static NumArgState *
-BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
+static bool
+BuildArgArray(const char *fmt, va_list ap, NumArgStateVector& nas)
 {
     size_t number = 0, cn = 0, i;
     const char *p;
     char c;
-    NumArgState *nas;
 
 
     // First pass:
     // Detemine how many legal % I have got, then allocate space.
 
     p = fmt;
-    *rv = 0;
     i = 0;
     while ((c = *p++) != 0) {
         if (c != '%')
@@ -399,16 +400,12 @@ BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
         while (c != 0) {
             if (c > '9' || c < '0') {
                 if (c == '$') {         // numbered argument case
-                    if (i > 0) {
-                        *rv = -1;
-                        return nullptr;
-                    }
+                    if (i > 0)
+                        return false;
                     number++;
                 } else {                // non-numbered argument case
-                    if (number > 0) {
-                        *rv = -1;
-                        return nullptr;
-                    }
+                    if (number > 0)
+                        return false;
                     i = 1;
                 }
                 break;
@@ -419,17 +416,10 @@ BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
     }
 
     if (number == 0)
-        return nullptr;
+        return true;
 
-    if (number > NAS_DEFAULT_NUM) {
-        nas = (NumArgState *) js_malloc(number * sizeof(NumArgState));
-        if (!nas) {
-            *rv = -1;
-            return nullptr;
-        }
-    } else {
-        nas = nasArray;
-    }
+    if (!nas.growByUninitialized(number))
+        return false;
 
     for (i = 0; i < number; i++)
         nas[i].type = TYPE_UNKNOWN;
@@ -452,10 +442,8 @@ BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
             c = *p++;
         }
 
-        if (!c || cn < 1 || cn > number) {
-            *rv = -1;
-            break;
-        }
+        if (!c || cn < 1 || cn > number)
+            return false;
 
         // nas[cn] starts from 0, and make sure nas[cn].type is not assigned.
         cn--;
@@ -467,8 +455,7 @@ BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
         // width
         if (c == '*') {
             // not supported feature, for the argument is not numbered
-            *rv = -1;
-            break;
+            return false;
         }
 
         while ((c >= '0') && (c <= '9')) {
@@ -480,8 +467,7 @@ BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
             c = *p++;
             if (c == '*') {
                 // not supported feature, for the argument is not numbered
-                *rv = -1;
-                break;
+                return false;
             }
 
             while ((c >= '0') && (c <= '9')) {
@@ -561,22 +547,14 @@ BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
         }
 
         // get a legal para.
-        if (nas[cn].type == TYPE_UNKNOWN) {
-            *rv = -1;
-            break;
-        }
+        if (nas[cn].type == TYPE_UNKNOWN)
+            return false;
     }
 
 
     // Third pass:
     // Fill nas[].ap.
 
-    if (*rv < 0) {
-        if (nas != nasArray)
-            js_free(nas);
-        return nullptr;
-    }
-
     cn = 0;
     while (cn < number) {
         if (nas[cn].type == TYPE_UNKNOWN) {
@@ -596,22 +574,17 @@ BuildArgArray(const char *fmt, va_list ap, int *rv, NumArgState *nasArray)
         case TYPE_INT64:        (void) va_arg(ap, int64_t);     break;
         case TYPE_UINT64:       (void) va_arg(ap, uint64_t);    break;
         case TYPE_STRING:       (void) va_arg(ap, char*);       break;
-        case TYPE_WSTRING:      (void) va_arg(ap, jschar*);     break;
+        case TYPE_WSTRING:      (void) va_arg(ap, char16_t*);   break;
         case TYPE_INTSTR:       (void) va_arg(ap, int*);        break;
         case TYPE_DOUBLE:       (void) va_arg(ap, double);      break;
 
-        default:
-            if (nas != nasArray)
-                js_free(nas);
-            *rv = -1;
-            return nullptr;
+        default: return false;
         }
 
         cn++;
     }
 
-
-    return nas;
+    return true;
 }
 
 /*
@@ -624,13 +597,13 @@ dosprintf(SprintfState *ss, const char *fmt, va_list ap)
     int flags, width, prec, radix, type;
     union {
         char ch;
-        jschar wch;
+        char16_t wch;
         int i;
         long l;
         int64_t ll;
         double d;
         const char *s;
-        const jschar* ws;
+        const char16_t* ws;
         int *ip;
     } u;
     const char *fmt0;
@@ -638,16 +611,14 @@ dosprintf(SprintfState *ss, const char *fmt, va_list ap)
     static const char HEX[] = "0123456789ABCDEF";
     const char *hexp;
     int rv, i;
-    NumArgState *nas = nullptr;
-    NumArgState nasArray[NAS_DEFAULT_NUM];
     char pattern[20];
     const char *dolPt = nullptr;  // in "%4$.2f", dolPt will point to '.'
 
     // Build an argument array, IF the fmt is numbered argument
     // list style, to contain the Numbered Argument list pointers.
 
-    nas = BuildArgArray(fmt, ap, &rv, nasArray);
-    if (rv < 0) {
+    NumArgStateVector nas;
+    if (!BuildArgArray(fmt, ap, nas)) {
         // the fmt contains error Numbered Argument format, jliu@netscape.com
         JS_ASSERT(0);
         return rv;
@@ -676,7 +647,7 @@ dosprintf(SprintfState *ss, const char *fmt, va_list ap)
             continue;
         }
 
-        if (nas != nullptr) {
+        if (!nas.empty()) {
             // the fmt contains the Numbered Arguments feature
             i = 0;
             while (c && c != '$') {         // should improve error check later
@@ -684,13 +655,10 @@ dosprintf(SprintfState *ss, const char *fmt, va_list ap)
                 c = *fmt++;
             }
 
-            if (nas[i-1].type == TYPE_UNKNOWN) {
-                if (nas && nas != nasArray)
-                    js_free(nas);
+            if (nas[i - 1].type == TYPE_UNKNOWN)
                 return -1;
-            }
 
-            ap = nas[i-1].ap;
+            ap = nas[i - 1].ap;
             dolPt = fmt;
             c = *fmt++;
         }
@@ -846,7 +814,7 @@ dosprintf(SprintfState *ss, const char *fmt, va_list ap)
           case 'f':
           case 'g':
             u.d = va_arg(ap, double);
-            if (nas != nullptr) {
+            if (!nas.empty()) {
                 i = fmt - dolPt;
                 if (i < int(sizeof(pattern))) {
                     pattern[0] = '%';
@@ -916,7 +884,7 @@ dosprintf(SprintfState *ss, const char *fmt, va_list ap)
 
           case 's':
             if(type == TYPE_INT16) {
-                u.ws = va_arg(ap, const jschar*);
+                u.ws = va_arg(ap, const char16_t*);
                 rv = cvt_s(ss, u.ws, width, prec, flags);
             } else {
                 u.s = va_arg(ap, const char*);
@@ -953,9 +921,6 @@ dosprintf(SprintfState *ss, const char *fmt, va_list ap)
     // Stuff trailing NUL
     rv = (*ss->stuff)(ss, "\0", 1);
 
-    if (nas && nas != nasArray)
-        js_free(nas);
-
     return rv;
 }
 
diff --git a/js/src/jsproxy.cpp b/js/src/jsproxy.cpp
index b29c046d8fa..cc5ea35db8a 100644
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@@ -39,7 +39,7 @@ js::AutoEnterPolicy::reportErrorIfExceptionIsNotPending(JSContext *cx, jsid id)
     } else {
         JSString *str = IdToString(cx, id);
         AutoStableStringChars chars(cx);
-        const jschar *prop = nullptr;
+        const char16_t *prop = nullptr;
         if (str->ensureFlat(cx) && chars.initTwoByte(cx, str))
             prop = chars.twoByteChars();
 
diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index 9c38ad1458d..89a845ac3c5 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -551,6 +551,7 @@ class NodeBuilder
     bool catchClause(HandleValue var, HandleValue guard, HandleValue body, TokenPos *pos,
                      MutableHandleValue dst);
 
+    bool prototypeMutation(HandleValue val, TokenPos *pos, MutableHandleValue dst);
     bool propertyInitializer(HandleValue key, HandleValue val, PropKind kind, bool isShorthand,
                              bool isMethod, TokenPos *pos, MutableHandleValue dst);
 
@@ -723,7 +724,7 @@ NodeBuilder::newArray(NodeVector &elts, MutableHandleValue dst)
         js_ReportAllocationOverflow(cx);
         return false;
     }
-    RootedObject array(cx, NewDenseAllocatedArray(cx, uint32_t(len)));
+    RootedObject array(cx, NewDenseFullyAllocatedArray(cx, uint32_t(len)));
     if (!array)
         return false;
 
@@ -1312,6 +1313,18 @@ NodeBuilder::propertyPattern(HandleValue key, HandleValue patt, bool isShorthand
                    dst);
 }
 
+bool
+NodeBuilder::prototypeMutation(HandleValue val, TokenPos *pos, MutableHandleValue dst)
+{
+    RootedValue cb(cx, callbacks[AST_PROTOTYPEMUTATION]);
+    if (!cb.isNull())
+        return callback(cb, val, pos, dst);
+
+    return newNode(AST_PROTOTYPEMUTATION, pos,
+                   "value", val,
+                   dst);
+}
+
 bool
 NodeBuilder::propertyInitializer(HandleValue key, HandleValue val, PropKind kind, bool isShorthand,
                                  bool isMethod, TokenPos *pos, MutableHandleValue dst)
@@ -3013,6 +3026,12 @@ ASTSerializer::propertyName(ParseNode *pn, MutableHandleValue dst)
 bool
 ASTSerializer::property(ParseNode *pn, MutableHandleValue dst)
 {
+    if (pn->isKind(PNK_MUTATEPROTO)) {
+        RootedValue val(cx);
+        return expression(pn->pn_kid, &val) &&
+               builder.prototypeMutation(val, &pn->pn_pos, dst);
+    }
+
     PropKind kind;
     switch (pn->getOp()) {
       case JSOP_INITPROP:
@@ -3119,20 +3138,33 @@ ASTSerializer::arrayPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValu
 bool
 ASTSerializer::objectPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst)
 {
-    JS_ASSERT(pn->isKind(PNK_OBJECT));
+    MOZ_ASSERT(pn->isKind(PNK_OBJECT));
 
     NodeVector elts(cx);
     if (!elts.reserve(pn->pn_count))
         return false;
 
-    for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
-        LOCAL_ASSERT(next->isOp(JSOP_INITPROP));
+    for (ParseNode *propdef = pn->pn_head; propdef; propdef = propdef->pn_next) {
+        LOCAL_ASSERT(propdef->isKind(PNK_MUTATEPROTO) != propdef->isOp(JSOP_INITPROP));
 
-        RootedValue key(cx), patt(cx), prop(cx);
-        if (!propertyName(next->pn_left, &key) ||
-            !pattern(next->pn_right, pkind, &patt) ||
-            !builder.propertyPattern(key, patt, next->isKind(PNK_SHORTHAND), &next->pn_pos,
-                                     &prop)) {
+        RootedValue key(cx);
+        ParseNode *target;
+        if (propdef->isKind(PNK_MUTATEPROTO)) {
+            RootedValue pname(cx, StringValue(cx->names().proto));
+            if (!builder.literal(pname, &propdef->pn_pos, &key))
+                return false;
+            target = propdef->pn_kid;
+        } else {
+            if (!propertyName(propdef->pn_left, &key))
+                return false;
+            target = propdef->pn_right;
+        }
+
+        RootedValue patt(cx), prop(cx);
+        if (!pattern(target, pkind, &patt) ||
+            !builder.propertyPattern(key, patt, propdef->isKind(PNK_SHORTHAND), &propdef->pn_pos,
+                                     &prop))
+        {
             return false;
         }
 
@@ -3450,7 +3482,7 @@ reflect_parse(JSContext *cx, uint32_t argc, jsval *vp)
     CompileOptions options(cx);
     options.setFileAndLine(filename, lineno);
     options.setCanLazilyParse(false);
-    mozilla::Range<const jschar> chars = flatChars.twoByteRange();
+    mozilla::Range<const char16_t> chars = flatChars.twoByteRange();
     Parser<FullParseHandler> parser(cx, &cx->tempLifoAlloc(), options, chars.start().get(),
                                     chars.length(), /* foldConstants = */ false, nullptr, nullptr);
 
diff --git a/js/src/jsreflect.h b/js/src/jsreflect.h
index eeb9937959c..aed8b12408e 100644
--- a/js/src/jsreflect.h
+++ b/js/src/jsreflect.h
@@ -82,6 +82,7 @@ enum PropKind {
     PROP_INIT = 0,
     PROP_GETTER,
     PROP_SETTER,
+    PROP_MUTATEPROTO,
     PROP_LIMIT
 };
 
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index a8397466aa1..2058f4050f5 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -701,7 +701,8 @@ js::XDRScript(XDRState<mode> *xdr, HandleObject enclosingScope, HandleScript enc
             options.setOriginPrincipals(xdr->originPrincipals());
             ss->initFromOptions(cx, options);
             sourceObject = ScriptSourceObject::create(cx, ss);
-            if (!sourceObject)
+            if (!sourceObject ||
+                !ScriptSourceObject::initFromOptions(cx, sourceObject, options))
                 return false;
         } else {
             JS_ASSERT(enclosingScript);
@@ -1305,6 +1306,9 @@ ScriptSourceObject::initFromOptions(JSContext *cx, HandleScriptSource source,
                                     const ReadOnlyCompileOptions &options)
 {
     assertSameCompartment(cx, source);
+    MOZ_ASSERT(source->getReservedSlot(ELEMENT_SLOT).isMagic(JS_GENERIC_MAGIC));
+    MOZ_ASSERT(source->getReservedSlot(ELEMENT_PROPERTY_SLOT).isMagic(JS_GENERIC_MAGIC));
+    MOZ_ASSERT(source->getReservedSlot(INTRODUCTION_SCRIPT_SLOT).isMagic(JS_GENERIC_MAGIC));
 
     RootedValue element(cx, ObjectOrNullValue(options.element()));
     if (!cx->compartment()->wrap(cx, &element))
@@ -1343,7 +1347,7 @@ JSScript::loadSource(JSContext *cx, ScriptSource *ss, bool *worked)
     *worked = false;
     if (!cx->runtime()->sourceHook || !ss->sourceRetrievable())
         return true;
-    jschar *src = nullptr;
+    char16_t *src = nullptr;
     size_t length;
     if (!cx->runtime()->sourceHook->load(cx, ss->filename(), &src, &length))
         return false;
@@ -1377,7 +1381,7 @@ UncompressedSourceCache::AutoHoldEntry::holdEntry(UncompressedSourceCache *cache
 }
 
 void
-UncompressedSourceCache::AutoHoldEntry::deferDelete(const jschar *chars)
+UncompressedSourceCache::AutoHoldEntry::deferDelete(const char16_t *chars)
 {
     // Take ownership of source chars now the cache is being purged. Remove our
     // reference to the ScriptSource which might soon be destroyed.
@@ -1393,7 +1397,7 @@ UncompressedSourceCache::AutoHoldEntry::~AutoHoldEntry()
     // chars then delete them, otherwise unregister ourself with the cache.
     if (charsToFree_) {
         JS_ASSERT(!cache_ && !source_);
-        js_free(const_cast<jschar *>(charsToFree_));
+        js_free(const_cast<char16_t *>(charsToFree_));
     } else if (cache_) {
         JS_ASSERT(source_);
         cache_->releaseEntry(*this);
@@ -1415,7 +1419,7 @@ UncompressedSourceCache::releaseEntry(AutoHoldEntry &holder)
     holder_ = nullptr;
 }
 
-const jschar *
+const char16_t *
 UncompressedSourceCache::lookup(ScriptSource *ss, AutoHoldEntry &holder)
 {
     JS_ASSERT(!holder_);
@@ -1429,7 +1433,7 @@ UncompressedSourceCache::lookup(ScriptSource *ss, AutoHoldEntry &holder)
 }
 
 bool
-UncompressedSourceCache::put(ScriptSource *ss, const jschar *str, AutoHoldEntry &holder)
+UncompressedSourceCache::put(ScriptSource *ss, const char16_t *str, AutoHoldEntry &holder)
 {
     JS_ASSERT(!holder_);
 
@@ -1459,12 +1463,12 @@ UncompressedSourceCache::purge()
         return;
 
     for (Map::Range r = map_->all(); !r.empty(); r.popFront()) {
-        const jschar *chars = r.front().value();
+        const char16_t *chars = r.front().value();
         if (holder_ && r.front().key() == holder_->source()) {
             holder_->deferDelete(chars);
             holder_ = nullptr;
         } else {
-            js_free(const_cast<jschar*>(chars));
+            js_free(const_cast<char16_t*>(chars));
         }
     }
 
@@ -1479,14 +1483,14 @@ UncompressedSourceCache::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf)
     if (map_ && !map_->empty()) {
         n += map_->sizeOfIncludingThis(mallocSizeOf);
         for (Map::Range r = map_->all(); !r.empty(); r.popFront()) {
-            const jschar *v = r.front().value();
+            const char16_t *v = r.front().value();
             n += mallocSizeOf(v);
         }
     }
     return n;
 }
 
-const jschar *
+const char16_t *
 ScriptSource::chars(JSContext *cx, UncompressedSourceCache::AutoHoldEntry &holder)
 {
     switch (dataType) {
@@ -1494,11 +1498,11 @@ ScriptSource::chars(JSContext *cx, UncompressedSourceCache::AutoHoldEntry &holde
         return uncompressedChars();
 
       case DataCompressed: {
-        if (const jschar *decompressed = cx->runtime()->uncompressedSourceCache.lookup(this, holder))
+        if (const char16_t *decompressed = cx->runtime()->uncompressedSourceCache.lookup(this, holder))
             return decompressed;
 
-        const size_t nbytes = sizeof(jschar) * (length_ + 1);
-        jschar *decompressed = static_cast<jschar *>(js_malloc(nbytes));
+        const size_t nbytes = sizeof(char16_t) * (length_ + 1);
+        char16_t *decompressed = static_cast<char16_t *>(js_malloc(nbytes));
         if (!decompressed)
             return nullptr;
 
@@ -1533,7 +1537,7 @@ ScriptSource::substring(JSContext *cx, uint32_t start, uint32_t stop)
 {
     JS_ASSERT(start <= stop);
     UncompressedSourceCache::AutoHoldEntry holder;
-    const jschar *chars = this->chars(cx, holder);
+    const char16_t *chars = this->chars(cx, holder);
     if (!chars)
         return nullptr;
     return NewStringCopyN<CanGC>(cx, chars + start, stop - start);
@@ -1544,14 +1548,14 @@ ScriptSource::substringDontDeflate(JSContext *cx, uint32_t start, uint32_t stop)
 {
     JS_ASSERT(start <= stop);
     UncompressedSourceCache::AutoHoldEntry holder;
-    const jschar *chars = this->chars(cx, holder);
+    const char16_t *chars = this->chars(cx, holder);
     if (!chars)
         return nullptr;
     return NewStringCopyNDontDeflate<CanGC>(cx, chars + start, stop - start);
 }
 
 void
-ScriptSource::setSource(const jschar *chars, size_t length, bool ownsChars /* = true */)
+ScriptSource::setSource(const char16_t *chars, size_t length, bool ownsChars /* = true */)
 {
     JS_ASSERT(dataType == DataMissing);
 
@@ -1567,7 +1571,7 @@ ScriptSource::setCompressedSource(JSRuntime *maybert, void *raw, size_t nbytes,
 {
     JS_ASSERT(dataType == DataMissing || dataType == DataUncompressed);
     if (dataType == DataUncompressed && ownsUncompressedChars())
-        js_free(const_cast<jschar *>(uncompressedChars()));
+        js_free(const_cast<char16_t *>(uncompressedChars()));
 
     dataType = DataCompressed;
     data.compressed.raw = raw;
@@ -1608,7 +1612,7 @@ ScriptSource::ensureOwnsSource(ExclusiveContext *cx)
     if (ownsUncompressedChars())
         return true;
 
-    jschar *uncompressed = cx->zone()->pod_malloc<jschar>(Max<size_t>(length_, 1));
+    char16_t *uncompressed = cx->zone()->pod_malloc<char16_t>(Max<size_t>(length_, 1));
     if (!uncompressed)
         return false;
     PodCopy(uncompressed, uncompressedChars(), length_);
@@ -1671,7 +1675,7 @@ SourceCompressionTask::work()
 {
     // Try to keep the maximum memory usage down by only allocating half the
     // size of the string, first.
-    size_t inputBytes = ss->length() * sizeof(jschar);
+    size_t inputBytes = ss->length() * sizeof(char16_t);
     size_t firstSize = inputBytes / 2;
     compressed = js_malloc(firstSize);
     if (!compressed)
@@ -1729,7 +1733,7 @@ ScriptSource::~ScriptSource()
     switch (dataType) {
       case DataUncompressed:
         if (ownsUncompressedChars())
-            js_free(const_cast<jschar *>(uncompressedChars()));
+            js_free(const_cast<char16_t *>(uncompressedChars()));
         break;
 
       case DataCompressed:
@@ -1816,7 +1820,7 @@ ScriptSource::performXDR(XDRState<mode> *xdr)
                 argumentsNotIncluded_ = argumentsNotIncluded;
         }
 
-        size_t byteLen = compressedLength ? compressedLength : (length_ * sizeof(jschar));
+        size_t byteLen = compressedLength ? compressedLength : (length_ * sizeof(char16_t));
         if (mode == XDR_DECODE) {
             uint8_t *p = xdr->cx()->template pod_malloc<uint8_t>(Max<size_t>(byteLen, 1));
             if (!p || !xdr->codeBytes(p, byteLen)) {
@@ -1828,7 +1832,7 @@ ScriptSource::performXDR(XDRState<mode> *xdr)
                 setCompressedSource(xdr->cx()->runtime(), p, compressedLength,
                                     CompressedSourceHasher::computeHash(p, compressedLength));
             else
-                setSource((const jschar *) p, length_);
+                setSource((const char16_t *) p, length_);
         } else {
             void *p;
             switch (dataType) {
@@ -1859,7 +1863,7 @@ ScriptSource::performXDR(XDRState<mode> *xdr)
             return false;
 
         if (mode == XDR_DECODE) {
-            sourceMapURL_ = xdr->cx()->template make_pod_array<jschar>(sourceMapURLLen + 1);
+            sourceMapURL_ = xdr->cx()->template make_pod_array<char16_t>(sourceMapURLLen + 1);
             if (!sourceMapURL_)
                 return false;
         }
@@ -1881,7 +1885,7 @@ ScriptSource::performXDR(XDRState<mode> *xdr)
             return false;
 
         if (mode == XDR_DECODE) {
-            displayURL_ = xdr->cx()->template make_pod_array<jschar>(displayURLLen + 1);
+            displayURL_ = xdr->cx()->template make_pod_array<char16_t>(displayURLLen + 1);
             if (!displayURL_)
                 return false;
         }
@@ -1987,7 +1991,7 @@ ScriptSource::setFilename(ExclusiveContext *cx, const char *filename)
 }
 
 bool
-ScriptSource::setDisplayURL(ExclusiveContext *cx, const jschar *displayURL)
+ScriptSource::setDisplayURL(ExclusiveContext *cx, const char16_t *displayURL)
 {
     JS_ASSERT(displayURL);
     if (hasDisplayURL()) {
@@ -2009,7 +2013,7 @@ ScriptSource::setDisplayURL(ExclusiveContext *cx, const jschar *displayURL)
 }
 
 bool
-ScriptSource::setSourceMapURL(ExclusiveContext *cx, const jschar *sourceMapURL)
+ScriptSource::setSourceMapURL(ExclusiveContext *cx, const char16_t *sourceMapURL)
 {
     JS_ASSERT(sourceMapURL);
     if (hasSourceMapURL()) {
@@ -2036,7 +2040,7 @@ size_t
 ScriptSource::computedSizeOfData() const
 {
     if (dataType == DataUncompressed && ownsUncompressedChars())
-        return sizeof(jschar) * length_;
+        return sizeof(char16_t) * length_;
     if (dataType == DataCompressed)
         return compressedBytes();
     return 0;
@@ -3833,11 +3837,11 @@ LazyScriptHashPolicy::match(JSScript *script, const Lookup &lookup)
 
     UncompressedSourceCache::AutoHoldEntry holder;
 
-    const jschar *scriptChars = script->scriptSource()->chars(cx, holder);
+    const char16_t *scriptChars = script->scriptSource()->chars(cx, holder);
     if (!scriptChars)
         return false;
 
-    const jschar *lazyChars = lazy->source()->chars(cx, holder);
+    const char16_t *lazyChars = lazy->source()->chars(cx, holder);
     if (!lazyChars)
         return false;
 
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index f258346f6a8..2af8f421f76 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -341,7 +341,7 @@ class ScriptSource;
 class UncompressedSourceCache
 {
     typedef HashMap<ScriptSource *,
-                    const jschar *,
+                    const char16_t *,
                     DefaultHasher<ScriptSource *>,
                     SystemAllocPolicy> Map;
 
@@ -351,13 +351,13 @@ class UncompressedSourceCache
     {
         UncompressedSourceCache *cache_;
         ScriptSource *source_;
-        const jschar *charsToFree_;
+        const char16_t *charsToFree_;
       public:
         explicit AutoHoldEntry();
         ~AutoHoldEntry();
       private:
         void holdEntry(UncompressedSourceCache *cache, ScriptSource *source);
-        void deferDelete(const jschar *chars);
+        void deferDelete(const char16_t *chars);
         ScriptSource *source() const { return source_; }
         friend class UncompressedSourceCache;
     };
@@ -369,8 +369,8 @@ class UncompressedSourceCache
   public:
     UncompressedSourceCache() : map_(nullptr), holder_(nullptr) {}
 
-    const jschar *lookup(ScriptSource *ss, AutoHoldEntry &asp);
-    bool put(ScriptSource *ss, const jschar *chars, AutoHoldEntry &asp);
+    const char16_t *lookup(ScriptSource *ss, AutoHoldEntry &asp);
+    bool put(ScriptSource *ss, const char16_t *chars, AutoHoldEntry &asp);
 
     void purge();
 
@@ -401,7 +401,7 @@ class ScriptSource
 
     union {
         struct {
-            const jschar *chars;
+            const char16_t *chars;
             bool ownsChars;
         } uncompressed;
 
@@ -419,8 +419,8 @@ class ScriptSource
     // The filename of this script.
     mozilla::UniquePtr<char[], JS::FreePolicy> filename_;
 
-    mozilla::UniquePtr<jschar[], JS::FreePolicy> displayURL_;
-    mozilla::UniquePtr<jschar[], JS::FreePolicy> sourceMapURL_;
+    mozilla::UniquePtr<char16_t[], JS::FreePolicy> displayURL_;
+    mozilla::UniquePtr<char16_t[], JS::FreePolicy> sourceMapURL_;
     JSPrincipals *originPrincipals_;
 
     // bytecode offset in caller script that generated this code.
@@ -505,13 +505,13 @@ class ScriptSource
         JS_ASSERT(hasSourceData());
         return argumentsNotIncluded_;
     }
-    const jschar *chars(JSContext *cx, UncompressedSourceCache::AutoHoldEntry &asp);
+    const char16_t *chars(JSContext *cx, UncompressedSourceCache::AutoHoldEntry &asp);
     JSFlatString *substring(JSContext *cx, uint32_t start, uint32_t stop);
     JSFlatString *substringDontDeflate(JSContext *cx, uint32_t start, uint32_t stop);
     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
                                 JS::ScriptSourceInfo *info) const;
 
-    const jschar *uncompressedChars() const {
+    const char16_t *uncompressedChars() const {
         JS_ASSERT(dataType == DataUncompressed);
         return data.uncompressed.chars;
     }
@@ -541,7 +541,7 @@ class ScriptSource
         return data.parent;
     }
 
-    void setSource(const jschar *chars, size_t length, bool ownsChars = true);
+    void setSource(const char16_t *chars, size_t length, bool ownsChars = true);
     void setCompressedSource(JSRuntime *maybert, void *raw, size_t nbytes, HashNumber hash);
     void updateCompressedSourceSet(JSRuntime *rt);
     bool ensureOwnsSource(ExclusiveContext *cx);
@@ -566,17 +566,17 @@ class ScriptSource
     }
 
     // Display URLs
-    bool setDisplayURL(ExclusiveContext *cx, const jschar *displayURL);
+    bool setDisplayURL(ExclusiveContext *cx, const char16_t *displayURL);
     bool hasDisplayURL() const { return displayURL_ != nullptr; }
-    const jschar * displayURL() {
+    const char16_t * displayURL() {
         MOZ_ASSERT(hasDisplayURL());
         return displayURL_.get();
     }
 
     // Source maps
-    bool setSourceMapURL(ExclusiveContext *cx, const jschar *sourceMapURL);
+    bool setSourceMapURL(ExclusiveContext *cx, const char16_t *sourceMapURL);
     bool hasSourceMapURL() const { return sourceMapURL_ != nullptr; }
-    const jschar * sourceMapURL() {
+    const char16_t * sourceMapURL() {
         MOZ_ASSERT(hasSourceMapURL());
         return sourceMapURL_.get();
     }
@@ -656,6 +656,7 @@ class ScriptSourceObject : public JSObject
         return getReservedSlot(ELEMENT_SLOT).toObjectOrNull();
     }
     const Value &elementAttributeName() const {
+        MOZ_ASSERT(!getReservedSlot(ELEMENT_PROPERTY_SLOT).isMagic());
         return getReservedSlot(ELEMENT_PROPERTY_SLOT);
     }
     JSScript *introductionScript() const {
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 6c38dc05061..ccd745edec0 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -124,7 +124,7 @@ Escape(JSContext *cx, const CharT *chars, uint32_t length, uint32_t *newLengthOu
     /* Take a first pass and see how big the result string will need to be. */
     uint32_t newLength = length;
     for (size_t i = 0; i < length; i++) {
-        jschar ch = chars[i];
+        char16_t ch = chars[i];
         if (ch < 128 && shouldPassThrough[ch])
             continue;
 
@@ -147,7 +147,7 @@ Escape(JSContext *cx, const CharT *chars, uint32_t length, uint32_t *newLengthOu
 
     size_t i, ni;
     for (i = 0, ni = 0; i < length; i++) {
-        jschar ch = chars[i];
+        char16_t ch = chars[i];
         if (ch < 128 && shouldPassThrough[ch]) {
             newChars[ni++] = ch;
         } else if (ch < 256) {
@@ -203,12 +203,12 @@ str_escape(JSContext *cx, unsigned argc, Value *vp)
 
 template <typename CharT>
 static inline bool
-Unhex4(const RangedPtr<const CharT> chars, jschar *result)
+Unhex4(const RangedPtr<const CharT> chars, char16_t *result)
 {
-    jschar a = chars[0],
-           b = chars[1],
-           c = chars[2],
-           d = chars[3];
+    char16_t a = chars[0],
+             b = chars[1],
+             c = chars[2],
+             d = chars[3];
 
     if (!(JS7_ISHEX(a) && JS7_ISHEX(b) && JS7_ISHEX(c) && JS7_ISHEX(d)))
         return false;
@@ -219,10 +219,10 @@ Unhex4(const RangedPtr<const CharT> chars, jschar *result)
 
 template <typename CharT>
 static inline bool
-Unhex2(const RangedPtr<const CharT> chars, jschar *result)
+Unhex2(const RangedPtr<const CharT> chars, char16_t *result)
 {
-    jschar a = chars[0],
-           b = chars[1];
+    char16_t a = chars[0],
+             b = chars[1];
 
     if (!(JS7_ISHEX(a) && JS7_ISHEX(b)))
         return false;
@@ -254,7 +254,7 @@ Unescape(StringBuffer &sb, const mozilla::Range<const CharT> chars)
     /* Step 5. */
     while (k < length) {
         /* Step 6. */
-        jschar c = chars[k];
+        char16_t c = chars[k];
 
         /* Step 7. */
         if (c != '%')
@@ -701,7 +701,7 @@ ToLowerCase(JSContext *cx, JSLinearString *str)
         // Look for the first upper case character.
         size_t i = 0;
         for (; i < length; i++) {
-            jschar c = chars[i];
+            char16_t c = chars[i];
             if (unicode::ToLowerCase(c) != c)
                 break;
         }
@@ -717,7 +717,7 @@ ToLowerCase(JSContext *cx, JSLinearString *str)
         PodCopy(newChars.get(), chars, i);
 
         for (; i < length; i++) {
-            jschar c = unicode::ToLowerCase(chars[i]);
+            char16_t c = unicode::ToLowerCase(chars[i]);
             MOZ_ASSERT_IF((IsSame<CharT, Latin1Char>::value), c <= JSString::MAX_LATIN1_CHAR);
             newChars[i] = c;
         }
@@ -747,7 +747,7 @@ ToLowerCaseHelper(JSContext *cx, CallReceiver call)
     if (linear->hasLatin1Chars())
         str = ToLowerCase<Latin1Char>(cx, linear);
     else
-        str = ToLowerCase<jschar>(cx, linear);
+        str = ToLowerCase<char16_t>(cx, linear);
     if (!str)
         return false;
 
@@ -796,7 +796,7 @@ ToUpperCaseImpl(DestChar *destChars, const SrcChar *srcChars, size_t firstLowerC
         destChars[i] = srcChars[i];
 
     for (size_t i = firstLowerCase; i < length; i++) {
-        jschar c = unicode::ToUpperCase(srcChars[i]);
+        char16_t c = unicode::ToUpperCase(srcChars[i]);
         MOZ_ASSERT_IF((IsSame<DestChar, Latin1Char>::value), c <= JSString::MAX_LATIN1_CHAR);
         destChars[i] = c;
     }
@@ -809,7 +809,7 @@ static JSString *
 ToUpperCase(JSContext *cx, JSLinearString *str)
 {
     typedef UniquePtr<Latin1Char[], JS::FreePolicy> Latin1CharPtr;
-    typedef UniquePtr<jschar[], JS::FreePolicy> TwoByteCharPtr;
+    typedef UniquePtr<char16_t[], JS::FreePolicy> TwoByteCharPtr;
 
     mozilla::MaybeOneOf<Latin1CharPtr, TwoByteCharPtr> newChars;
     size_t length = str->length();
@@ -820,7 +820,7 @@ ToUpperCase(JSContext *cx, JSLinearString *str)
         // Look for the first lower case character.
         size_t i = 0;
         for (; i < length; i++) {
-            jschar c = chars[i];
+            char16_t c = chars[i];
             if (unicode::ToUpperCase(c) != c)
                 break;
         }
@@ -857,7 +857,7 @@ ToUpperCase(JSContext *cx, JSLinearString *str)
             ToUpperCaseImpl(buf.get(), chars, i, length);
             newChars.construct<Latin1CharPtr>(buf);
         } else {
-            TwoByteCharPtr buf = cx->make_pod_array<jschar>(length + 1);
+            TwoByteCharPtr buf = cx->make_pod_array<char16_t>(length + 1);
             if (!buf)
                 return nullptr;
 
@@ -898,7 +898,7 @@ ToUpperCaseHelper(JSContext *cx, CallReceiver call)
     if (linear->hasLatin1Chars())
         str = ToUpperCase<Latin1Char>(cx, linear);
     else
-        str = ToUpperCase<jschar>(cx, linear);
+        str = ToUpperCase<char16_t>(cx, linear);
     if (!str)
         return false;
 
@@ -1013,15 +1013,15 @@ str_normalize(JSContext *cx, unsigned argc, Value *vp)
 
     static const size_t INLINE_CAPACITY = 32;
 
-    const UChar *srcChars = JSCharToUChar(stableChars.twoByteRange().start().get());
+    const UChar *srcChars = Char16ToUChar(stableChars.twoByteRange().start().get());
     int32_t srcLen = AssertedCast<int32_t>(str->length());
-    Vector<jschar, INLINE_CAPACITY> chars(cx);
+    Vector<char16_t, INLINE_CAPACITY> chars(cx);
     if (!chars.resize(INLINE_CAPACITY))
         return false;
 
     UErrorCode status = U_ZERO_ERROR;
     int32_t size = unorm_normalize(srcChars, srcLen, form, 0,
-                                   JSCharToUChar(chars.begin()), INLINE_CAPACITY,
+                                   Char16ToUChar(chars.begin()), INLINE_CAPACITY,
                                    &status);
     if (status == U_BUFFER_OVERFLOW_ERROR) {
         if (!chars.resize(size))
@@ -1031,7 +1031,7 @@ str_normalize(JSContext *cx, unsigned argc, Value *vp)
         int32_t finalSize =
 #endif
         unorm_normalize(srcChars, srcLen, form, 0,
-                        JSCharToUChar(chars.begin()), size,
+                        Char16ToUChar(chars.begin()), size,
                         &status);
         MOZ_ASSERT(size == finalSize || U_FAILURE(status), "unorm_normalize behaved inconsistently");
     }
@@ -1103,7 +1103,7 @@ js::str_charCodeAt_impl(JSContext *cx, HandleString string, HandleValue index, M
             goto out_of_range;
         i = size_t(d);
     }
-    jschar c;
+    char16_t c;
     if (!string->getChar(cx, i , &c))
         return false;
     res.setInt32(c);
@@ -1157,7 +1157,7 @@ BoyerMooreHorspool(const TextChar *text, uint32_t textLen, const PatChar *pat, u
 
     uint32_t patLast = patLen - 1;
     for (uint32_t i = 0; i < patLast; i++) {
-        jschar c = pat[i];
+        char16_t c = pat[i];
         if (c >= sBMHCharSetSize)
             return sBMHBadPattern;
         skip[c] = uint8_t(patLast - i);
@@ -1171,7 +1171,7 @@ BoyerMooreHorspool(const TextChar *text, uint32_t textLen, const PatChar *pat, u
                 return static_cast<int>(i);  /* safe: max string size */
         }
 
-        jschar c = text[k];
+        char16_t c = text[k];
         k += (c >= sBMHCharSetSize) ? patLen : skip[c];
     }
     return -1;
@@ -1245,19 +1245,19 @@ FirstCharMatcher8bit(const char *text, uint32_t n, const char pat)
 #endif
 }
 
-static const jschar *
-FirstCharMatcher16bit(const jschar *text, uint32_t n, const jschar pat)
+static const char16_t *
+FirstCharMatcher16bit(const char16_t *text, uint32_t n, const char16_t pat)
 {
 #if defined(XP_MACOSX) || defined(XP_WIN)
     /*
      * Performance of memchr is horrible in OSX. Windows is better,
      * but it is still better to use UnrolledMatcher.
      */
-    return FirstCharMatcherUnrolled<jschar, jschar>(text, n, pat);
+    return FirstCharMatcherUnrolled<char16_t, char16_t>(text, n, pat);
 #else
     /*
      * For linux the best performance is obtained by slightly hacking memchr.
-     * memchr works only on 8bit char but jschar is 16bit. So we treat jschar
+     * memchr works only on 8bit char but char16_t is 16bit. So we treat char16_t
      * in blocks of 8bit and use memchr.
      */
 
@@ -1303,7 +1303,7 @@ Matcher(const TextChar *text, uint32_t textlen, const PatChar *pat, uint32_t pat
         const TextChar *pos;
 
         if (sizeof(TextChar) == 2 && sizeof(PatChar) == 2)
-            pos = (TextChar *) FirstCharMatcher16bit((jschar *)text + i, n - i, pat[0]);
+            pos = (TextChar *) FirstCharMatcher16bit((char16_t *)text + i, n - i, pat[0]);
         else if (sizeof(TextChar) == 1 && sizeof(PatChar) == 1)
             pos = (TextChar *) FirstCharMatcher8bit((char *) text + i, n - i, pat[0]);
         else
@@ -1397,7 +1397,7 @@ StringMatch(JSLinearString *text, JSLinearString *pat, uint32_t start = 0)
         else
             match = StringMatch(textChars, textLen, pat->twoByteChars(nogc), patLen);
     } else {
-        const jschar *textChars = text->twoByteChars(nogc) + start;
+        const char16_t *textChars = text->twoByteChars(nogc) + start;
         if (pat->hasLatin1Chars())
             match = StringMatch(textChars, textLen, pat->latin1Chars(nogc), patLen);
         else
@@ -1410,7 +1410,7 @@ StringMatch(JSLinearString *text, JSLinearString *pat, uint32_t start = 0)
 static const size_t sRopeMatchThresholdRatioLog2 = 5;
 
 bool
-js::StringHasPattern(JSLinearString *text, const jschar *pat, uint32_t patLen)
+js::StringHasPattern(JSLinearString *text, const char16_t *pat, uint32_t patLen)
 {
     AutoCheckCannotGC nogc;
     return text->hasLatin1Chars()
@@ -1599,9 +1599,9 @@ RopeMatch(JSContext *cx, JSRope *text, JSLinearString *pat, int *match)
             *match = RopeMatchImpl<Latin1Char>(nogc, strings, pat->twoByteChars(nogc), patLen);
     } else {
         if (pat->hasLatin1Chars())
-            *match = RopeMatchImpl<jschar>(nogc, strings, pat->latin1Chars(nogc), patLen);
+            *match = RopeMatchImpl<char16_t>(nogc, strings, pat->latin1Chars(nogc), patLen);
         else
-            *match = RopeMatchImpl<jschar>(nogc, strings, pat->twoByteChars(nogc), patLen);
+            *match = RopeMatchImpl<char16_t>(nogc, strings, pat->twoByteChars(nogc), patLen);
     }
 
     return true;
@@ -1785,7 +1785,7 @@ str_lastIndexOf(JSContext *cx, unsigned argc, Value *vp)
         else
             res = LastIndexOfImpl(textChars, textLen, pat->twoByteChars(nogc), patLen, start);
     } else {
-        const jschar *textChars = text->twoByteChars(nogc);
+        const char16_t *textChars = text->twoByteChars(nogc);
         if (pat->hasLatin1Chars())
             res = LastIndexOfImpl(textChars, textLen, pat->latin1Chars(nogc), patLen, start);
         else
@@ -1812,7 +1812,7 @@ HasSubstringAt(JSLinearString *text, JSLinearString *pat, size_t start)
         return EqualChars(textChars, pat->twoByteChars(nogc), patLen);
     }
 
-    const jschar *textChars = text->twoByteChars(nogc) + start;
+    const char16_t *textChars = text->twoByteChars(nogc) + start;
     if (pat->hasTwoByteChars())
         return PodEqual(textChars, pat->twoByteChars(nogc), patLen);
 
@@ -2042,7 +2042,7 @@ class FlatMatch
 } /* anonymous namespace */
 
 static inline bool
-IsRegExpMetaChar(jschar c)
+IsRegExpMetaChar(char16_t c)
 {
     switch (c) {
       /* Taken from the PatternCharacter production in 15.10.1. */
@@ -2664,7 +2664,7 @@ InterpretDollar(RegExpStatics *res, const CharT *bp, const CharT *dp, const Char
         return false;
 
     /* Interpret all Perl match-induced dollar variables. */
-    jschar dc = dp[1];
+    char16_t dc = dp[1];
     if (JS7_ISDEC(dc)) {
         /* ECMA-262 Edition 3: 1-9 or 01-99 */
         unsigned num = JS7_UNDEC(dc);
@@ -2845,7 +2845,7 @@ FindReplaceLength(JSContext *cx, RegExpStatics *res, ReplaceData &rdata, size_t
 
     return rdata.repstr->hasLatin1Chars()
            ? FindReplaceLengthString<Latin1Char>(cx, res, rdata, sizep)
-           : FindReplaceLengthString<jschar>(cx, res, rdata, sizep);
+           : FindReplaceLengthString<char16_t>(cx, res, rdata, sizep);
 }
 
 /*
@@ -2932,7 +2932,7 @@ ReplaceRegExp(JSContext *cx, RegExpStatics *res, ReplaceData &rdata)
     if (rdata.repstr->hasLatin1Chars())
         DoReplace<Latin1Char>(res, rdata);
     else
-        DoReplace<jschar>(res, rdata);
+        DoReplace<char16_t>(res, rdata);
     return true;
 }
 
@@ -4239,7 +4239,7 @@ js::str_fromCharCode(JSContext *cx, unsigned argc, Value *vp)
     if (args.length() == 1)
         return str_fromCharCode_one_arg(cx, args[0], args.rval());
 
-    jschar *chars = cx->pod_malloc<jschar>(args.length() + 1);
+    char16_t *chars = cx->pod_malloc<char16_t>(args.length() + 1);
     if (!chars)
         return false;
     for (unsigned i = 0; i < args.length(); i++) {
@@ -4248,7 +4248,7 @@ js::str_fromCharCode(JSContext *cx, unsigned argc, Value *vp)
             js_free(chars);
             return false;
         }
-        chars[i] = jschar(code);
+        chars[i] = char16_t(code);
     }
     chars[args.length()] = 0;
     JSString *str = NewString<CanGC>(cx, chars, args.length());
@@ -4274,7 +4274,7 @@ js::str_fromCharCode_one_arg(JSContext *cx, HandleValue code, MutableHandleValue
         return true;
     }
 
-    jschar c = jschar(ucode);
+    char16_t c = char16_t(ucode);
     JSString *str = NewStringCopyN<CanGC>(cx, &c, 1);
     if (!str)
         return false;
@@ -4455,7 +4455,7 @@ js::ValueToSource(JSContext *cx, HandleValue v)
         /* Special case to preserve negative zero, _contra_ toString. */
         if (v.isDouble() && IsNegativeZero(v.toDouble())) {
             /* NB: _ucNstr rather than _ucstr to indicate non-terminated. */
-            static const jschar js_negzero_ucNstr[] = {'-', '0'};
+            static const char16_t js_negzero_ucNstr[] = {'-', '0'};
 
             return NewStringCopyN<CanGC>(cx, js_negzero_ucNstr, 2);
         }
@@ -4555,14 +4555,14 @@ CompareStringsImpl(JSLinearString *str1, JSLinearString *str2)
                : CompareChars(chars1, len1, str2->twoByteChars(nogc), len2);
     }
 
-    const jschar *chars1 = str1->twoByteChars(nogc);
+    const char16_t *chars1 = str1->twoByteChars(nogc);
     return str2->hasLatin1Chars()
            ? CompareChars(chars1, len1, str2->latin1Chars(nogc), len2)
            : CompareChars(chars1, len1, str2->twoByteChars(nogc), len2);
 }
 
 int32_t
-js::CompareChars(const jschar *s1, size_t len1, JSLinearString *s2)
+js::CompareChars(const char16_t *s1, size_t len1, JSLinearString *s2)
 {
     AutoCheckCannotGC nogc;
     return s2->hasLatin1Chars()
@@ -4619,9 +4619,9 @@ js::StringEqualsAscii(JSLinearString *str, const char *asciiBytes)
 }
 
 size_t
-js_strlen(const jschar *s)
+js_strlen(const char16_t *s)
 {
-    const jschar *t;
+    const char16_t *t;
 
     for (t = s; *t != 0; t++)
         continue;
@@ -4629,7 +4629,7 @@ js_strlen(const jschar *s)
 }
 
 int32_t
-js_strcmp(const jschar *lhs, const jschar *rhs)
+js_strcmp(const char16_t *lhs, const char16_t *rhs)
 {
     while (true) {
         if (*lhs != *rhs)
@@ -4651,11 +4651,11 @@ js::DuplicateString(js::ThreadSafeContext *cx, const char *s)
     return ret;
 }
 
-UniquePtr<jschar[], JS::FreePolicy>
-js::DuplicateString(js::ThreadSafeContext *cx, const jschar *s)
+UniquePtr<char16_t[], JS::FreePolicy>
+js::DuplicateString(js::ThreadSafeContext *cx, const char16_t *s)
 {
     size_t n = js_strlen(s) + 1;
-    auto ret = cx->make_pod_array<jschar>(n);
+    auto ret = cx->make_pod_array<char16_t>(n);
     if (!ret)
         return ret;
     PodCopy(ret.get(), s, n);
@@ -4664,7 +4664,7 @@ js::DuplicateString(js::ThreadSafeContext *cx, const jschar *s)
 
 template <typename CharT>
 const CharT *
-js_strchr_limit(const CharT *s, jschar c, const CharT *limit)
+js_strchr_limit(const CharT *s, char16_t c, const CharT *limit)
 {
     while (s < limit) {
         if (*s == c)
@@ -4675,20 +4675,20 @@ js_strchr_limit(const CharT *s, jschar c, const CharT *limit)
 }
 
 template const Latin1Char *
-js_strchr_limit(const Latin1Char *s, jschar c, const Latin1Char *limit);
+js_strchr_limit(const Latin1Char *s, char16_t c, const Latin1Char *limit);
 
-template const jschar *
-js_strchr_limit(const jschar *s, jschar c, const jschar *limit);
+template const char16_t *
+js_strchr_limit(const char16_t *s, char16_t c, const char16_t *limit);
 
-jschar *
+char16_t *
 js::InflateString(ThreadSafeContext *cx, const char *bytes, size_t *lengthp)
 {
     size_t nchars;
-    jschar *chars;
+    char16_t *chars;
     size_t nbytes = *lengthp;
 
     nchars = nbytes;
-    chars = cx->pod_malloc<jschar>(nchars + 1);
+    chars = cx->pod_malloc<char16_t>(nchars + 1);
     if (!chars)
         goto bad;
     for (size_t i = 0; i < nchars; i++)
@@ -4731,7 +4731,7 @@ js::DeflateStringToBuffer(JSContext *maybecx, const Latin1Char *src, size_t srcl
                           char *dst, size_t *dstlenp);
 
 template bool
-js::DeflateStringToBuffer(JSContext *maybecx, const jschar *src, size_t srclen,
+js::DeflateStringToBuffer(JSContext *maybecx, const char16_t *src, size_t srclen,
                           char *dst, size_t *dstlenp);
 
 #define ____ false
@@ -4896,12 +4896,12 @@ Encode(StringBuffer &sb, const CharT *chars, size_t length,
 {
     static const char HexDigits[] = "0123456789ABCDEF"; /* NB: uppercase */
 
-    jschar hexBuf[4];
+    char16_t hexBuf[4];
     hexBuf[0] = '%';
     hexBuf[3] = 0;
 
     for (size_t k = 0; k < length; k++) {
-        jschar c = chars[k];
+        char16_t c = chars[k];
         if (c < 128 && (unescapedSet[c] || (unescapedSet2 && unescapedSet2[c]))) {
             if (!sb.append(c))
                 return Encode_Failure;
@@ -4917,7 +4917,7 @@ Encode(StringBuffer &sb, const CharT *chars, size_t length,
                 if (k == length)
                     return Encode_BadUri;
 
-                jschar c2 = chars[k];
+                char16_t c2 = chars[k];
                 if (c2 < 0xDC00 || c2 > 0xDFFF)
                     return Encode_BadUri;
 
@@ -4979,7 +4979,7 @@ static DecodeResult
 Decode(StringBuffer &sb, const CharT *chars, size_t length, const bool *reservedSet)
 {
     for (size_t k = 0; k < length; k++) {
-        jschar c = chars[k];
+        char16_t c = chars[k];
         if (c == '%') {
             size_t start = k;
             if ((k + 2) >= length)
@@ -4991,7 +4991,7 @@ Decode(StringBuffer &sb, const CharT *chars, size_t length, const bool *reserved
             uint32_t B = JS7_UNHEX(chars[k+1]) * 16 + JS7_UNHEX(chars[k+2]);
             k += 2;
             if (!(B & 0x80)) {
-                c = jschar(B);
+                c = char16_t(B);
             } else {
                 int n = 1;
                 while (B & (0x80 >> n))
@@ -5026,12 +5026,12 @@ Decode(StringBuffer &sb, const CharT *chars, size_t length, const bool *reserved
                     if (v > 0xFFFFF)
                         return Decode_BadUri;
 
-                    c = jschar((v & 0x3FF) + 0xDC00);
-                    jschar H = jschar((v >> 10) + 0xD800);
+                    c = char16_t((v & 0x3FF) + 0xDC00);
+                    char16_t H = char16_t((v >> 10) + 0xD800);
                     if (!sb.append(H))
                         return Decode_Failure;
                 } else {
-                    c = jschar(v);
+                    c = char16_t(v);
                 }
             }
             if (c < 128 && reservedSet && reservedSet[c]) {
@@ -5284,7 +5284,7 @@ js::PutEscapedStringImpl(char *buffer, size_t bufferSize, FILE *fp, const Latin1
                          size_t length, uint32_t quote);
 
 template size_t
-js::PutEscapedStringImpl(char *buffer, size_t bufferSize, FILE *fp, const jschar *chars,
+js::PutEscapedStringImpl(char *buffer, size_t bufferSize, FILE *fp, const char16_t *chars,
                          size_t length, uint32_t quote);
 
 template size_t
@@ -5292,5 +5292,5 @@ js::PutEscapedString(char *buffer, size_t bufferSize, const Latin1Char *chars, s
                      uint32_t quote);
 
 template size_t
-js::PutEscapedString(char *buffer, size_t bufferSize, const jschar *chars, size_t length,
+js::PutEscapedString(char *buffer, size_t bufferSize, const char16_t *chars, size_t length,
                      uint32_t quote);
diff --git a/js/src/jsstr.h b/js/src/jsstr.h
index beec911faa6..ee0b064bd14 100644
--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -63,7 +63,7 @@ CompareChars(const Char1 *s1, size_t len1, const Char2 *s2, size_t len2)
 }
 
 extern int32_t
-CompareChars(const jschar *s1, size_t len1, JSLinearString *s2);
+CompareChars(const char16_t *s1, size_t len1, JSLinearString *s2);
 
 }  /* namespace js */
 
@@ -107,17 +107,17 @@ js_ValueToPrintable(JSContext *cx, const js::Value &,
                     JSAutoByteString *bytes, bool asSource = false);
 
 extern size_t
-js_strlen(const jschar *s);
+js_strlen(const char16_t *s);
 
 extern int32_t
-js_strcmp(const jschar *lhs, const jschar *rhs);
+js_strcmp(const char16_t *lhs, const char16_t *rhs);
 
 template <typename CharT>
 extern const CharT *
-js_strchr_limit(const CharT *s, jschar c, const CharT *limit);
+js_strchr_limit(const CharT *s, char16_t c, const CharT *limit);
 
 static MOZ_ALWAYS_INLINE void
-js_strncpy(jschar *dst, const jschar *src, size_t nelem)
+js_strncpy(char16_t *dst, const char16_t *src, size_t nelem)
 {
     return mozilla::PodCopy(dst, src, nelem);
 }
@@ -127,8 +127,8 @@ namespace js {
 extern mozilla::UniquePtr<char[], JS::FreePolicy>
 DuplicateString(ThreadSafeContext *cx, const char *s);
 
-extern mozilla::UniquePtr<jschar[], JS::FreePolicy>
-DuplicateString(ThreadSafeContext *cx, const jschar *s);
+extern mozilla::UniquePtr<char16_t[], JS::FreePolicy>
+DuplicateString(ThreadSafeContext *cx, const char16_t *s);
 
 /*
  * Convert a non-string value to a string, returning null after reporting an
@@ -154,7 +154,7 @@ ToString(JSContext *cx, JS::HandleValue v)
 
 /*
  * This function implements E-262-3 section 9.8, toString. Convert the given
- * value to a string of jschars appended to the given buffer. On error, the
+ * value to a string of characters appended to the given buffer. On error, the
  * passed buffer may have partial results appended.
  */
 inline bool
@@ -215,7 +215,7 @@ StringEqualsAscii(JSLinearString *str, const char *asciiBytes);
 
 /* Return true if the string contains a pattern anywhere inside it. */
 extern bool
-StringHasPattern(JSLinearString *text, const jschar *pat, uint32_t patlen);
+StringHasPattern(JSLinearString *text, const char16_t *pat, uint32_t patlen);
 
 extern int
 StringFindPattern(JSLinearString *text, JSLinearString *pat, size_t start);
@@ -248,27 +248,27 @@ EqualChars(const Char1 *s1, const Char2 *s2, size_t len)
 }
 
 /*
- * Inflate bytes in ASCII encoding to jschars. Return null on error, otherwise
- * return the jschar that was malloc'ed. length is updated to the length of the
- * new string (in jschars). A null char is appended, but it is not included in
- * the length.
+ * Inflate bytes in ASCII encoding to char16_t code units. Return null on error,
+ * otherwise return the char16_t buffer that was malloc'ed. length is updated to
+ * the length of the new string (in char16_t code units). A null char is
+ * appended, but it is not included in the length.
  */
-extern jschar *
+extern char16_t *
 InflateString(ThreadSafeContext *cx, const char *bytes, size_t *length);
 
 /*
  * Inflate bytes to JS chars in an existing buffer. 'dst' must be large
- * enough for 'srclen' jschars. The buffer is NOT null-terminated.
+ * enough for 'srclen' char16_t code units. The buffer is NOT null-terminated.
  */
 inline void
-CopyAndInflateChars(jschar *dst, const char *src, size_t srclen)
+CopyAndInflateChars(char16_t *dst, const char *src, size_t srclen)
 {
     for (size_t i = 0; i < srclen; i++)
         dst[i] = (unsigned char) src[i];
 }
 
 inline void
-CopyAndInflateChars(jschar *dst, const JS::Latin1Char *src, size_t srclen)
+CopyAndInflateChars(char16_t *dst, const JS::Latin1Char *src, size_t srclen)
 {
     for (size_t i = 0; i < srclen; i++)
         dst[i] = src[i];
diff --git a/js/src/jstypes.h b/js/src/jstypes.h
index e9927bca0d0..456501257ff 100644
--- a/js/src/jstypes.h
+++ b/js/src/jstypes.h
@@ -168,7 +168,7 @@
 **      Macros to get the number of elements and the pointer to one past the
 **      last element of a C array. Use them like this:
 **
-**      jschar buf[10], *s;
+**      char16_t buf[10], *s;
 **      JSString *str;
 **      ...
 **      for (s = buf; s != JS_ARRAY_END(buf); ++s) *s = ...;
diff --git a/js/src/jswrapper.cpp b/js/src/jswrapper.cpp
index 2560c675359..eb2cc78958d 100644
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@@ -687,7 +687,7 @@ SecurityWrapper<Base>::defineProperty(JSContext *cx, HandleObject wrapper,
     if (desc.getter() || desc.setter()) {
         JSString *str = IdToString(cx, id);
         AutoStableStringChars chars(cx);
-        const jschar *prop = nullptr;
+        const char16_t *prop = nullptr;
         if (str->ensureFlat(cx) && chars.initTwoByte(cx, str))
             prop = chars.twoByteChars();
         JS_ReportErrorNumberUC(cx, js_GetErrorMessage, nullptr,
diff --git a/js/src/moz.build b/js/src/moz.build
index 9a3fb6c2222..a812b5c8c3d 100644
--- a/js/src/moz.build
+++ b/js/src/moz.build
@@ -71,7 +71,7 @@ EXPORTS.js += [
     '../public/CharacterEncoding.h',
     '../public/Class.h',
     '../public/Date.h',
-    '../public/DebugAPI.h',
+    '../public/Debug.h',
     '../public/GCAPI.h',
     '../public/HashTable.h',
     '../public/HeapAPI.h',
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 2728923cfaa..cf67294ddc9 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1258,7 +1258,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             if (loadBytecode) {
                 script = JS_DecodeScript(cx, loadBuffer, loadLength, options.originPrincipals(cx));
             } else {
-                mozilla::Range<const jschar> chars = codeChars.twoByteRange();
+                mozilla::Range<const char16_t> chars = codeChars.twoByteRange();
                 (void) JS::Compile(cx, global, options, chars.start().get(), chars.length(), &script);
             }
 
@@ -1275,7 +1275,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             if (!chars.initTwoByte(cx, flat))
                 return false;
 
-            const jschar *durl = chars.twoByteRange().start().get();
+            const char16_t *durl = chars.twoByteRange().start().get();
             if (!script->scriptSource()->setDisplayURL(cx, durl))
                 return false;
         }
@@ -1288,7 +1288,7 @@ Evaluate(JSContext *cx, unsigned argc, jsval *vp)
             if (!chars.initTwoByte(cx, flat))
                 return false;
 
-            const jschar *smurl = chars.twoByteRange().start().get();
+            const char16_t *smurl = chars.twoByteRange().start().get();
             if (!script->scriptSource()->setSourceMapURL(cx, smurl))
                 return false;
         }
@@ -1362,7 +1362,7 @@ FileAsString(JSContext *cx, const char *pathname)
                     JS_ReportError(cx, "can't read %s: %s", pathname,
                                    (ptrdiff_t(cc) < 0) ? strerror(errno) : "short read");
                 } else {
-                    jschar *ucbuf =
+                    char16_t *ucbuf =
                         JS::UTF8CharsToNewTwoByteCharsZ(cx, JS::UTF8Chars(buf, len), &len).get();
                     if (!ucbuf) {
                         JS_ReportError(cx, "Invalid UTF-8 in file '%s'", pathname);
@@ -1447,7 +1447,7 @@ Run(JSContext *cx, unsigned argc, jsval *vp)
     if (!chars.initTwoByte(cx, str))
         return false;
 
-    const jschar *ucbuf = chars.twoByteRange().start().get();
+    const char16_t *ucbuf = chars.twoByteRange().start().get();
     size_t buflen = str->length();
 
     JS::Anchor<JSString *> a_str(str);
@@ -1718,29 +1718,6 @@ ValueToScript(JSContext *cx, jsval vArg, JSFunction **funp = nullptr)
     return script;
 }
 
-static bool
-SetDebug(JSContext *cx, unsigned argc, jsval *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    if (args.length() == 0 || !args[0].isBoolean()) {
-        JS_ReportErrorNumber(cx, my_GetErrorMessage, nullptr,
-                             JSSMSG_NOT_ENOUGH_ARGS, "setDebug");
-        return false;
-    }
-
-    /*
-     * Debug mode can only be set when there is no JS code executing on the
-     * stack. Unfortunately, that currently means that this call will fail
-     * unless debug mode is already set to what you're trying to set it to.
-     * In the future, this restriction may be lifted.
-     */
-
-    bool ok = !!JS_SetDebugMode(cx, args[0].toBoolean());
-    if (ok)
-        args.rval().setBoolean(true);
-    return ok;
-}
-
 static JSScript *
 GetTopScript(JSContext *cx)
 {
@@ -2400,7 +2377,7 @@ Intern(JSContext *cx, unsigned argc, jsval *vp)
     if (!strChars.initTwoByte(cx, str))
         return false;
 
-    mozilla::Range<const jschar> chars = strChars.twoByteRange();
+    mozilla::Range<const char16_t> chars = strChars.twoByteRange();
 
     if (!JS_InternUCStringN(cx, chars.start().get(), chars.length()))
         return false;
@@ -2576,9 +2553,9 @@ EvalInContext(JSContext *cx, unsigned argc, jsval *vp)
     if (!strChars.initTwoByte(cx, str))
         return false;
 
-    mozilla::Range<const jschar> chars = strChars.twoByteRange();
+    mozilla::Range<const char16_t> chars = strChars.twoByteRange();
     size_t srclen = chars.length();
-    const jschar *src = chars.start().get();
+    const char16_t *src = chars.start().get();
 
     bool lazy = false;
     if (srclen == 4) {
@@ -2646,8 +2623,7 @@ EvalInFrame(JSContext *cx, unsigned argc, jsval *vp)
     RootedString str(cx, args[1].toString());
     bool saveCurrent = args.get(2).isBoolean() ? args[2].toBoolean() : false;
 
-    /* This is a copy of CheckDebugMode. */
-    if (!JS_GetDebugMode(cx)) {
+    if (!cx->compartment()->debugMode()) {
         JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, js_GetErrorMessage,
                                      nullptr, JSMSG_NEED_DEBUG_MODE);
         return false;
@@ -2701,10 +2677,10 @@ EvalInFrame(JSContext *cx, unsigned argc, jsval *vp)
 struct WorkerInput
 {
     JSRuntime *runtime;
-    jschar *chars;
+    char16_t *chars;
     size_t length;
 
-    WorkerInput(JSRuntime *runtime, jschar *chars, size_t length)
+    WorkerInput(JSRuntime *runtime, char16_t *chars, size_t length)
       : runtime(runtime), chars(chars), length(length)
     {}
 
@@ -2780,7 +2756,7 @@ EvalInWorker(JSContext *cx, unsigned argc, jsval *vp)
 
     JSLinearString *str = &args[0].toString()->asLinear();
 
-    jschar *chars = (jschar *) js_malloc(str->length() * sizeof(jschar));
+    char16_t *chars = (char16_t *) js_malloc(str->length() * sizeof(char16_t));
     if (!chars)
         return false;
     CopyChars(chars, *str);
@@ -3329,7 +3305,7 @@ Compile(JSContext *cx, unsigned argc, jsval *vp)
            .setCompileAndGo(true)
            .setNoScriptRval(true);
     RootedScript script(cx);
-    const jschar *chars = stableChars.twoByteRange().start().get();
+    const char16_t *chars = stableChars.twoByteRange().start().get();
     bool ok = JS_CompileUCScript(cx, global, chars,
                                  scriptContents->length(), options, &script);
     args.rval().setUndefined();
@@ -3363,7 +3339,7 @@ Parse(JSContext *cx, unsigned argc, jsval *vp)
         return false;
 
     size_t length = scriptContents->length();
-    const jschar *chars = stableChars.twoByteRange().start().get();
+    const char16_t *chars = stableChars.twoByteRange().start().get();
 
     CompileOptions options(cx);
     options.setIntroductionType("js shell parse")
@@ -3413,7 +3389,7 @@ SyntaxParse(JSContext *cx, unsigned argc, jsval *vp)
     if (!stableChars.initTwoByte(cx, scriptContents))
         return false;
 
-    const jschar *chars = stableChars.twoByteRange().start().get();
+    const char16_t *chars = stableChars.twoByteRange().start().get();
     size_t length = scriptContents->length();
     Parser<frontend::SyntaxParseHandler> parser(cx, &cx->tempLifoAlloc(),
                                                 options, chars, length, false, nullptr, nullptr);
@@ -3444,7 +3420,7 @@ class OffThreadState {
     OffThreadState() : monitor(), state(IDLE), token(), source(nullptr) { }
     bool init() { return monitor.init(); }
 
-    bool startIfIdle(JSContext *cx, ScopedJSFreePtr<jschar> &newSource) {
+    bool startIfIdle(JSContext *cx, ScopedJSFreePtr<char16_t> &newSource) {
         AutoLockMonitor alm(monitor);
         if (state != IDLE)
             return false;
@@ -3506,7 +3482,7 @@ class OffThreadState {
     Monitor monitor;
     State state;
     void *token;
-    jschar *source;
+    char16_t *source;
 };
 
 static OffThreadState offThreadState;
@@ -3568,15 +3544,15 @@ OffThreadCompileScript(JSContext *cx, unsigned argc, jsval *vp)
         return false;
 
     size_t length = scriptContents->length();
-    const jschar *chars = stableChars.twoByteRange().start().get();
+    const char16_t *chars = stableChars.twoByteRange().start().get();
 
     // Make sure we own the string's chars, so that they are not freed before
     // the compilation is finished.
-    ScopedJSFreePtr<jschar> ownedChars;
+    ScopedJSFreePtr<char16_t> ownedChars;
     if (stableChars.maybeGiveOwnershipToCaller()) {
-        ownedChars = const_cast<jschar*>(chars);
+        ownedChars = const_cast<char16_t*>(chars);
     } else {
-        jschar *copy = cx->pod_malloc<jschar>(length);
+        char16_t *copy = cx->pod_malloc<char16_t>(length);
         if (!copy)
             return false;
 
@@ -4169,7 +4145,7 @@ class ShellSourceHook: public SourceHook {
   public:
     ShellSourceHook(JSContext *cx, JSFunction &fun) : fun(cx, &fun) {}
 
-    bool load(JSContext *cx, const char *filename, jschar **src, size_t *length) {
+    bool load(JSContext *cx, const char *filename, char16_t **src, size_t *length) {
         RootedString str(cx, JS_NewStringCopyZ(cx, filename));
         if (!str)
             return false;
@@ -4184,7 +4160,7 @@ class ShellSourceHook: public SourceHook {
             return false;
 
         *length = JS_GetStringLength(str);
-        *src = cx->pod_malloc<jschar>(*length);
+        *src = cx->pod_malloc<char16_t>(*length);
         if (!*src)
             return false;
 
@@ -4262,7 +4238,7 @@ PrintProfilerEvents(JSContext *cx, unsigned argc, Value *vp)
 }
 
 #if defined(JS_ARM_SIMULATOR)
-typedef Vector<jschar, 0, SystemAllocPolicy> StackChars;
+typedef Vector<char16_t, 0, SystemAllocPolicy> StackChars;
 Vector<StackChars, 0, SystemAllocPolicy> stacks;
 
 static void
@@ -4449,10 +4425,6 @@ static const JSFunctionSpecWithHelp shell_functions[] = {
 "  Throw if the first two arguments are not the same (both +0 or both -0,\n"
 "  both NaN, or non-zero and ===)."),
 
-    JS_FN_HELP("setDebug", SetDebug, 1, 0,
-"setDebug(debug)",
-"  Set debug mode."),
-
     JS_FN_HELP("throwError", ThrowError, 0, 0,
 "throwError()",
 "  Throw an error from JS_ReportError."),
@@ -4834,7 +4806,7 @@ PrintHelpString(JSContext *cx, jsval v)
         for (const Latin1Char *p = linear->latin1Chars(nogc); *p; p++)
             fprintf(gOutFile, "%c", char(*p));
     } else {
-        for (const jschar *p = linear->twoByteChars(nogc); *p; p++)
+        for (const char16_t *p = linear->twoByteChars(nogc); *p; p++)
             fprintf(gOutFile, "%c", char(*p));
     }
     fprintf(gOutFile, "\n");
@@ -5365,7 +5337,7 @@ class ScopedFileDesc
 static const uint32_t asmJSCacheCookie = 0xabbadaba;
 
 static bool
-ShellOpenAsmJSCacheEntryForRead(HandleObject global, const jschar *begin, const jschar *limit,
+ShellOpenAsmJSCacheEntryForRead(HandleObject global, const char16_t *begin, const char16_t *limit,
                                 size_t *serializedSizeOut, const uint8_t **memoryOut,
                                 intptr_t *handleOut)
 {
@@ -5438,7 +5410,7 @@ ShellCloseAsmJSCacheEntryForRead(size_t serializedSize, const uint8_t *memory, i
 
 static bool
 ShellOpenAsmJSCacheEntryForWrite(HandleObject global, bool installed,
-                                 const jschar *begin, const jschar *end,
+                                 const char16_t *begin, const char16_t *end,
                                  size_t serializedSize, uint8_t **memoryOut, intptr_t *handleOut)
 {
     if (!jsCachingEnabled || !jsCacheAsmJSPath)
@@ -5689,11 +5661,6 @@ ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
     if (op->getBoolOption('s'))
         JS::RuntimeOptionsRef(cx).toggleExtraWarnings();
 
-    if (op->getBoolOption('d')) {
-        JS_SetRuntimeDebugMode(JS_GetRuntime(cx), true);
-        JS_SetDebugMode(cx, true);
-    }
-
     /* |scriptArgs| gets bound on the global before any code is run. */
     if (!BindScriptArgs(cx, obj, op))
         return EXIT_FAILURE;
@@ -6039,7 +6006,6 @@ main(int argc, char **argv, char **envp)
         || !op.addBoolOption('w', "warnings", "Emit warnings")
         || !op.addBoolOption('W', "nowarnings", "Don't emit warnings")
         || !op.addBoolOption('s', "strict", "Check strictness")
-        || !op.addBoolOption('d', "debugjit", "Enable runtime debug mode for method JIT code")
         || !op.addBoolOption('D', "dump-bytecode", "Dump bytecode with exec count for all scripts")
         || !op.addBoolOption('b', "print-timing", "Print sub-ms runtime for each file that's run")
         || !op.addStringOption('\0', "js-cache", "[path]",
diff --git a/js/src/tests/ecma_6/Expressions/object-literal-__proto__.js b/js/src/tests/ecma_6/Expressions/object-literal-__proto__.js
new file mode 100644
index 00000000000..531ef7fc5cc
--- /dev/null
+++ b/js/src/tests/ecma_6/Expressions/object-literal-__proto__.js
@@ -0,0 +1,267 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 1061853;
+var summary =
+  "__proto__ in object literals in non-__proto__:v contexts doesn't modify " +
+  "[[Prototype]]";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+function hasOwn(obj, prop)
+{
+  return Object.getOwnPropertyDescriptor(obj, prop) !== undefined;
+}
+
+var objectStart = "{ ";
+var objectEnd = " }";
+
+var members =
+  {
+    nullProto: "__proto__: null",
+    functionProtoProto: "__proto__: Function.prototype",
+    computedNull:  "['__proto__']: null",
+    method: "__proto__() {}",
+    computedMethod: "['__proto__']() {}",
+    generatorMethod: "*__proto__() {}",
+    computedGenerator: "*['__proto__']() {}",
+    shorthand: "__proto__",
+    getter: "get __proto__() { return 42; }",
+    getterComputed: "get ['__proto__']() { return 42; }",
+    setter: "set __proto__(v) { }",
+    setterComputed: "set ['__proto__'](v) { }",
+  };
+
+function isProtoMutation(key)
+{
+  return key === "nullProto" || key === "functionProtoProto";
+}
+
+function isGetter(key)
+{
+  return key === "getter" || key === "getterComputed";
+}
+
+function isSetter(key)
+{
+  return key === "setter" || key === "setterComputed";
+}
+
+function isData(key)
+{
+  return !isProtoMutation(key) && !isGetter(key) && !isSetter(key);
+}
+
+var __proto__ = "string value";
+
+function typeOfProto(key)
+{
+  if (key === "computedNull")
+    return "object";
+  if (key === "method" || key === "computedMethod" ||
+      key === "computedGenerator" || key === "generatorMethod")
+  {
+    return "function";
+  }
+  if (key === "getter" || key === "getterComputed")
+    return "number";
+  assertEq(key, "shorthand", "bug in test!");
+  return "string";
+}
+
+for (var first in members)
+{
+  var fcode = "return " + objectStart + members[first] + objectEnd;
+  var f = Function(fcode);
+  var oneProp = f();
+
+  if (first === "nullProto")
+  {
+    assertEq(Object.getPrototypeOf(oneProp), null);
+    assertEq(hasOwn(oneProp, "__proto__"), false);
+  }
+  else if (first === "functionProtoProto")
+  {
+    assertEq(Object.getPrototypeOf(oneProp), Function.prototype);
+    assertEq(hasOwn(oneProp, "__proto__"), false);
+  }
+  else if (isSetter(first))
+  {
+    assertEq(Object.getPrototypeOf(oneProp), Object.prototype);
+    assertEq(hasOwn(oneProp, "__proto__"), true);
+    assertEq(typeof Object.getOwnPropertyDescriptor(oneProp, "__proto__").set,
+             "function");
+  }
+  else
+  {
+    assertEq(Object.getPrototypeOf(oneProp), Object.prototype);
+    assertEq(hasOwn(oneProp, "__proto__"), true);
+    assertEq(typeof oneProp.__proto__, typeOfProto(first));
+  }
+
+  for (var second in members)
+  {
+    try
+    {
+      var gcode = "return " + objectStart + members[first] + ", " +
+                                            members[second] + objectEnd;
+      var g = Function(gcode);
+    }
+    catch (e)
+    {
+      assertEq(e instanceof SyntaxError, true,
+               "__proto__ member conflicts should be syntax errors, got " + e);
+      assertEq(+(first === "nullProto" || first === "functionProtoProto") +
+               +(second === "nullProto" || second === "functionProtoProto") > 1,
+               true,
+               "unexpected conflict between members: " + first + ", " + second);
+      continue;
+    }
+
+    var twoProps = g();
+
+    if (first === "nullProto" || second === "nullProto")
+      assertEq(Object.getPrototypeOf(twoProps), null);
+    else if (first === "functionProtoProto" || second === "functionProtoProto")
+      assertEq(Object.getPrototypeOf(twoProps), Function.prototype);
+    else
+      assertEq(Object.getPrototypeOf(twoProps), Object.prototype);
+
+    if (isSetter(second))
+    {
+      assertEq(hasOwn(twoProps, "__proto__"), true);
+      assertEq(typeof Object.getOwnPropertyDescriptor(twoProps, "__proto__").get,
+               isGetter(first) ? "function" : "undefined");
+    }
+    else if (!isProtoMutation(second))
+    {
+      assertEq(hasOwn(twoProps, "__proto__"), true);
+      assertEq(typeof twoProps.__proto__, typeOfProto(second));
+      if (isGetter(second))
+      {
+        assertEq(typeof Object.getOwnPropertyDescriptor(twoProps, "__proto__").get,
+                 "function");
+        assertEq(typeof Object.getOwnPropertyDescriptor(twoProps, "__proto__").set,
+                 isSetter(first) ? "function" : "undefined");
+      }
+    }
+    else if (isSetter(first))
+    {
+      assertEq(hasOwn(twoProps, "__proto__"), true);
+      assertEq(typeof Object.getOwnPropertyDescriptor(twoProps, "__proto__").set,
+               "function");
+      assertEq(typeof Object.getOwnPropertyDescriptor(twoProps, "__proto__").get,
+               "undefined");
+    }
+    else if (!isProtoMutation(first))
+    {
+      assertEq(hasOwn(twoProps, "__proto__"), true);
+      assertEq(typeof twoProps.__proto__, typeOfProto(first));
+    }
+    else
+    {
+      assertEq(true, false, "should be unreachable: " + first + ", " + second);
+    }
+
+    for (var third in members)
+    {
+      try
+      {
+        var hcode = "return " + objectStart + members[first] + ", " +
+                                              members[second] + ", " +
+                                              members[third] + objectEnd;
+        var h = Function(hcode);
+      }
+      catch (e)
+      {
+        assertEq(e instanceof SyntaxError, true,
+                 "__proto__ member conflicts should be syntax errors, got " + e);
+        assertEq(+(first === "nullProto" || first === "functionProtoProto") +
+                 +(second === "nullProto" || second === "functionProtoProto") +
+                 +(third === "nullProto" || third === "functionProtoProto") > 1,
+                 true,
+                 "unexpected conflict among members: " +
+                 first + ", " + second + ", " + third);
+        continue;
+      }
+
+      var threeProps = h();
+
+      if (first === "nullProto" || second === "nullProto" ||
+          third === "nullProto")
+      {
+        assertEq(Object.getPrototypeOf(threeProps), null);
+      }
+      else if (first === "functionProtoProto" ||
+               second === "functionProtoProto" ||
+               third === "functionProtoProto")
+      {
+        assertEq(Object.getPrototypeOf(threeProps), Function.prototype);
+      }
+      else
+      {
+        assertEq(Object.getPrototypeOf(threeProps), Object.prototype);
+      }
+
+      if (isSetter(third))
+      {
+        assertEq(hasOwn(threeProps, "__proto__"), true);
+        assertEq(typeof Object.getOwnPropertyDescriptor(threeProps, "__proto__").get,
+                 isGetter(second) || (!isData(second) && isGetter(first))
+                 ? "function"
+                 : "undefined",
+                 "\n" + hcode);
+      }
+      else if (!isProtoMutation(third))
+      {
+        assertEq(hasOwn(threeProps, "__proto__"), true);
+        assertEq(typeof threeProps.__proto__, typeOfProto(third), first + ", " + second + ", " +  third);
+        if (isGetter(third))
+        {
+          var desc = Object.getOwnPropertyDescriptor(threeProps, "__proto__");
+          assertEq(typeof desc.get, "function");
+          assertEq(typeof desc.set,
+                   isSetter(second) || (!isData(second) && isSetter(first))
+                   ? "function"
+                   : "undefined");
+        }
+      }
+      else if (isSetter(second))
+      {
+        assertEq(hasOwn(threeProps, "__proto__"), true);
+        assertEq(typeof Object.getOwnPropertyDescriptor(threeProps, "__proto__").get,
+                 isGetter(first) ? "function" : "undefined");
+      }
+      else if (!isProtoMutation(second))
+      {
+        assertEq(hasOwn(threeProps, "__proto__"), true);
+        assertEq(typeof threeProps.__proto__, typeOfProto(second));
+        if (isGetter(second))
+        {
+          var desc = Object.getOwnPropertyDescriptor(threeProps, "__proto__");
+          assertEq(typeof desc.get, "function");
+          assertEq(typeof desc.set,
+                   isSetter(first) ? "function" : "undefined");
+        }
+      }
+      else
+      {
+        assertEq(true, false,
+                 "should be unreachable: " +
+                 first + ", " + second + ", " + third);
+      }
+    }
+  }
+}
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");
diff --git a/js/src/tests/js1_5/extensions/regress-328556.js b/js/src/tests/js1_5/extensions/regress-328556.js
index 8876e259af5..7a5b21041d5 100644
--- a/js/src/tests/js1_5/extensions/regress-328556.js
+++ b/js/src/tests/js1_5/extensions/regress-328556.js
@@ -5,7 +5,7 @@
 
 //-----------------------------------------------------------------------------
 var BUGNUMBER = 328556;
-var summary = 'Do not Assert: growth == (size_t)-1 || (nchars + 1) * sizeof(jschar) == growth, in jsarray.c';
+var summary = 'Do not Assert: growth == (size_t)-1 || (nchars + 1) * sizeof(char16_t) == growth, in jsarray.c';
 var actual = 'No Crash';
 var expect = 'No Crash';
 
diff --git a/js/src/tests/js1_8_5/extensions/reflect-parse-destructuring-__proto__.js b/js/src/tests/js1_8_5/extensions/reflect-parse-destructuring-__proto__.js
index c4e1e50d916..4e2a6a06e7b 100644
--- a/js/src/tests/js1_8_5/extensions/reflect-parse-destructuring-__proto__.js
+++ b/js/src/tests/js1_8_5/extensions/reflect-parse-destructuring-__proto__.js
@@ -2,6 +2,10 @@
 // bug 963641
 
 Reflect.parse("({ __proto__: null });");
+Reflect.parse("var { __proto__: x } = obj;");
+Reflect.parse("var [{ __proto__: y }] = obj;");
+Reflect.parse("[{ __proto__: y }] = arr;");
+Reflect.parse("({ __proto__: y } = obj);");
 
 if (typeof reportCompare === "function")
   reportCompare(true, true);
diff --git a/js/src/tests/js1_8_5/extensions/reflect-parse.js b/js/src/tests/js1_8_5/extensions/reflect-parse.js
index 5bdf84a04e2..9f707c2edaf 100644
--- a/js/src/tests/js1_8_5/extensions/reflect-parse.js
+++ b/js/src/tests/js1_8_5/extensions/reflect-parse.js
@@ -24,6 +24,7 @@ function throwStmt(expr) Pattern({ type: "ThrowStatement", argument: expr })
 function returnStmt(expr) Pattern({ type: "ReturnStatement", argument: expr })
 function yieldExpr(expr) Pattern({ type: "YieldExpression", argument: expr })
 function lit(val) Pattern({ type: "Literal", value: val })
+function comp(name) Pattern({ type: "ComputedName", name: name })
 function spread(val) Pattern({ type: "SpreadExpression", expression: val})
 var thisExpr = Pattern({ type: "ThisExpression" });
 function funDecl(id, params, body, defaults=[], rest=null) Pattern(
@@ -364,6 +365,14 @@ assertExpr("({'x':1, 'y':2, z:3})", objExpr([{ key: lit("x"), value: lit(1) },
 assertExpr("({'x':1, 'y':2, 3:3})", objExpr([{ key: lit("x"), value: lit(1) },
                                              { key: lit("y"), value: lit(2) },
                                              { key: lit(3), value: lit(3) } ]));
+assertExpr("({__proto__:x})", objExpr([{ type: "PrototypeMutation", value: ident("x") }]));
+assertExpr("({'__proto__':x})", objExpr([{ type: "PrototypeMutation", value: ident("x") }]));
+assertExpr("({['__proto__']:x})", objExpr([{ type: "Property", key: comp(lit("__proto__")), value: ident("x") }]));
+assertExpr("({['__proto__']:q, __proto__() {}, __proto__: null })",
+           objExpr([{ type: "Property", key: comp(lit("__proto__")), value: ident("q") },
+                    { type: "Property", key: ident("__proto__"), method: true },
+                    { type: "PrototypeMutation", value: lit(null) }]));
+
 
 // Bug 571617: eliminate constant-folding
 assertExpr("2 + 3", binExpr("+", lit(2), lit(3)));
diff --git a/js/src/tests/lib/jittests.py b/js/src/tests/lib/jittests.py
index dcab51a90c3..674727138cc 100755
--- a/js/src/tests/lib/jittests.py
+++ b/js/src/tests/lib/jittests.py
@@ -137,7 +137,7 @@ class Test:
                         except ValueError:
                             print("warning: couldn't parse thread-count %s" % value)
                     else:
-                        print('warning: unrecognized |jit-test| attribute %s' % part)
+                        print('%s: warning: unrecognized |jit-test| attribute %s' % (path, part))
                 else:
                     if name == 'slow':
                         test.slow = True
@@ -151,8 +151,6 @@ class Test:
                         test.valgrind = options.valgrind
                     elif name == 'tz-pacific':
                         test.tz_pacific = True
-                    elif name == 'debug':
-                        test.jitflags.append('--debugjit')
                     elif name == 'ion-eager':
                         test.jitflags.append('--ion-eager')
                     elif name == 'no-ion':
@@ -160,7 +158,7 @@ class Test:
                     elif name == 'dump-bytecode':
                         test.jitflags.append('--dump-bytecode')
                     else:
-                        print('warning: unrecognized |jit-test| attribute %s' % part)
+                        print('%s: warning: unrecognized |jit-test| attribute %s' % (path, part))
 
         if options.valgrind_all:
             test.valgrind = True
diff --git a/js/src/vm/ArrayObject.h b/js/src/vm/ArrayObject.h
index b7055d2597e..ad4dd7dab44 100644
--- a/js/src/vm/ArrayObject.h
+++ b/js/src/vm/ArrayObject.h
@@ -14,8 +14,10 @@ namespace js {
 class ArrayObject : public JSObject
 {
   public:
-    // Array(x) eagerly allocates dense elements if x <= this value.
-    static const uint32_t EagerAllocationMaxLength = 2048;
+    // Array(x) eagerly allocates dense elements if x <= this value. Without
+    // the subtraction the max would roll over to the next power-of-two (4096)
+    // due to the way that growElements() and goodAllocated() work.
+    static const uint32_t EagerAllocationMaxLength = 2048 - ObjectElements::VALUES_PER_HEADER;
 
     static const Class class_;
 
diff --git a/js/src/vm/CharacterEncoding.cpp b/js/src/vm/CharacterEncoding.cpp
index 62921ee342d..4440e68675b 100644
--- a/js/src/vm/CharacterEncoding.cpp
+++ b/js/src/vm/CharacterEncoding.cpp
@@ -15,7 +15,7 @@ using namespace JS;
 
 Latin1CharsZ
 JS::LossyTwoByteCharsToNewLatin1CharsZ(js::ThreadSafeContext *cx,
-                                       const mozilla::Range<const jschar> tbchars)
+                                       const mozilla::Range<const char16_t> tbchars)
 {
     JS_ASSERT(cx);
     size_t len = tbchars.length();
@@ -34,7 +34,7 @@ GetDeflatedUTF8StringLength(const CharT *chars, size_t nchars)
 {
     size_t nbytes = nchars;
     for (const CharT *end = chars + nchars; chars < end; chars++) {
-        jschar c = *chars;
+        char16_t c = *chars;
         if (c < 0x80)
             continue;
         uint32_t v;
@@ -44,7 +44,7 @@ GetDeflatedUTF8StringLength(const CharT *chars, size_t nchars)
                 nbytes += 2; /* Bad Surrogate */
                 continue;
             }
-            jschar c2 = chars[1];
+            char16_t c2 = chars[1];
             if (c2 < 0xDC00 || c2 > 0xDFFF) {
                 nbytes += 2; /* Bad Surrogate */
                 continue;
@@ -88,7 +88,7 @@ DeflateStringToUTF8Buffer(const CharT *src, size_t srclen, mozilla::RangedPtr<ch
 {
     while (srclen) {
         uint32_t v;
-        jschar c = *src++;
+        char16_t c = *src++;
         srclen--;
         if (c >= 0xDC00 && c <= 0xDFFF) {
             PutUTF8ReplacementCharacter(dst);
@@ -100,7 +100,7 @@ DeflateStringToUTF8Buffer(const CharT *src, size_t srclen, mozilla::RangedPtr<ch
                 PutUTF8ReplacementCharacter(dst);
                 continue;
             }
-            jschar c2 = *src;
+            char16_t c2 = *src;
             if ((c2 < 0xDC00) || (c2 > 0xDFFF)) {
                 PutUTF8ReplacementCharacter(dst);
                 continue;
@@ -158,7 +158,7 @@ template UTF8CharsZ
 JS::CharsToNewUTF8CharsZ(js::ThreadSafeContext *cx, const mozilla::Range<const Latin1Char> chars);
 
 template UTF8CharsZ
-JS::CharsToNewUTF8CharsZ(js::ThreadSafeContext *cx, const mozilla::Range<const jschar> chars);
+JS::CharsToNewUTF8CharsZ(js::ThreadSafeContext *cx, const mozilla::Range<const char16_t> chars);
 
 static const uint32_t INVALID_UTF8 = UINT32_MAX;
 
@@ -231,12 +231,12 @@ static const uint32_t REPLACE_UTF8 = 0xFFFD;
 // LossyConvertUTF8toUTF16() in dom/wifi/WifiUtils.cpp
 template <InflateUTF8Action action>
 static bool
-InflateUTF8StringToBuffer(JSContext *cx, const UTF8Chars src, jschar *dst, size_t *dstlenp,
+InflateUTF8StringToBuffer(JSContext *cx, const UTF8Chars src, char16_t *dst, size_t *dstlenp,
                           bool *isAsciip)
 {
     *isAsciip = true;
 
-    // First, count how many jschars need to be in the inflated string.
+    // Count how many char16_t characters need to be in the inflated string.
     // |i| is the index into |src|, and |j| is the the index into |dst|.
     size_t srclen = src.length();
     uint32_t j = 0;
@@ -245,7 +245,7 @@ InflateUTF8StringToBuffer(JSContext *cx, const UTF8Chars src, jschar *dst, size_
         if (!(v & 0x80)) {
             // ASCII code unit.  Simple copy.
             if (action == Copy)
-                dst[j] = jschar(v);
+                dst[j] = char16_t(v);
 
         } else {
             // Non-ASCII code unit.  Determine its length in bytes (n).
@@ -261,7 +261,7 @@ InflateUTF8StringToBuffer(JSContext *cx, const UTF8Chars src, jschar *dst, size_
                     return false;                                       \
                 } else {                                                \
                     if (action == Copy)                                 \
-                        dst[j] = jschar(REPLACE_UTF8);                  \
+                        dst[j] = char16_t(REPLACE_UTF8);                \
                     else                                                \
                         JS_ASSERT(action == CountAndIgnoreInvalids);    \
                     n = n2;                                             \
@@ -292,25 +292,25 @@ InflateUTF8StringToBuffer(JSContext *cx, const UTF8Chars src, jschar *dst, size_
                 if ((src[i + m] & 0xC0) != 0x80)
                     INVALID(ReportInvalidCharacter, i, m);
 
-            // Determine the code unit's length in jschars and act accordingly.
+            // Determine the code unit's length in char16_t and act accordingly.
             v = Utf8ToOneUcs4Char((uint8_t *)&src[i], n);
             if (v < 0x10000) {
-                // The n-byte UTF8 code unit will fit in a single jschar.
+                // The n-byte UTF8 code unit will fit in a single char16_t.
                 if (action == Copy)
-                    dst[j] = jschar(v);
+                    dst[j] = char16_t(v);
 
             } else {
                 v -= 0x10000;
                 if (v <= 0xFFFFF) {
-                    // The n-byte UTF8 code unit will fit in two jschars.
+                    // The n-byte UTF8 code unit will fit in two char16_t units.
                     if (action == Copy)
-                        dst[j] = jschar((v >> 10) + 0xD800);
+                        dst[j] = char16_t((v >> 10) + 0xD800);
                     j++;
                     if (action == Copy)
-                        dst[j] = jschar((v & 0x3FF) + 0xDC00);
+                        dst[j] = char16_t((v & 0x3FF) + 0xDC00);
 
                 } else {
-                    // The n-byte UTF8 code unit won't fit in two jschars.
+                    // The n-byte UTF8 code unit won't fit in two char16_t units.
                     INVALID(ReportTooBigCharacter, v, 1);
                 }
             }
@@ -328,7 +328,7 @@ InflateUTF8StringToBuffer(JSContext *cx, const UTF8Chars src, jschar *dst, size_
     return true;
 }
 
-typedef bool (*CountAction)(JSContext *, const UTF8Chars, jschar *, size_t *, bool *isAsciip);
+typedef bool (*CountAction)(JSContext *, const UTF8Chars, char16_t *, size_t *, bool *isAsciip);
 
 static TwoByteCharsZ
 InflateUTF8StringHelper(JSContext *cx, const UTF8Chars src, CountAction countAction, size_t *outlen)
@@ -339,7 +339,7 @@ InflateUTF8StringHelper(JSContext *cx, const UTF8Chars src, CountAction countAct
     if (!countAction(cx, src, /* dst = */ nullptr, outlen, &isAscii))
         return TwoByteCharsZ();
 
-    jschar *dst = cx->pod_malloc<jschar>(*outlen + 1);  // +1 for NUL
+    char16_t *dst = cx->pod_malloc<char16_t>(*outlen + 1);  // +1 for NUL
     if (!dst)
         return TwoByteCharsZ();
 
@@ -347,7 +347,7 @@ InflateUTF8StringHelper(JSContext *cx, const UTF8Chars src, CountAction countAct
         size_t srclen = src.length();
         JS_ASSERT(*outlen == srclen);
         for (uint32_t i = 0; i < srclen; i++)
-            dst[i] = jschar(src[i]);
+            dst[i] = char16_t(src[i]);
 
     } else {
         JS_ALWAYS_TRUE(InflateUTF8StringToBuffer<Copy>(cx, src, dst, outlen, &isAscii));
diff --git a/js/src/vm/Debugger-inl.h b/js/src/vm/Debugger-inl.h
index 0a8eed81d14..48743f43bb2 100644
--- a/js/src/vm/Debugger-inl.h
+++ b/js/src/vm/Debugger-inl.h
@@ -17,7 +17,7 @@ js::Debugger::onLeaveFrame(JSContext *cx, AbstractFramePtr frame, bool ok)
     /* Traps must be cleared from eval frames, see slowPathOnLeaveFrame. */
     bool evalTraps = frame.isEvalFrame() &&
                      frame.script()->hasAnyBreakpointsOrStepMode();
-    if (!cx->compartment()->getDebuggees().empty() || evalTraps)
+    if (cx->compartment()->debugMode() || evalTraps)
         ok = slowPathOnLeaveFrame(cx, frame, ok);
     return ok;
 }
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 657f95ac9fd..a38d7641f7f 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -18,7 +18,7 @@
 #include "frontend/BytecodeCompiler.h"
 #include "gc/Marking.h"
 #include "jit/BaselineJIT.h"
-#include "js/DebugAPI.h"
+#include "js/Debug.h"
 #include "js/GCAPI.h"
 #include "js/Vector.h"
 #include "vm/ArgumentsObject.h"
@@ -1177,23 +1177,21 @@ Debugger::slowPathOnNewScript(JSContext *cx, HandleScript script, GlobalObject *
     JS_ASSERT(script->compileAndGo() == !!compileAndGoGlobal);
 
     /*
-     * Build the list of recipients. For compile-and-go scripts, this is the
-     * same as the generic Debugger::dispatchHook code, but non-compile-and-go
-     * scripts are not tied to particular globals. We deliver them to every
-     * debugger observing any global in the script's compartment.
+     * Build the list of recipients based on the debuggers observing the
+     * script's compartment.
+     *
+     * TODO bug 1064079 will simplify this logic. The meaning of
+     * compile-and-go has changed over the years and is no longer relevant to
+     * Debugger.
      */
     AutoValueVector triggered(cx);
-    if (script->compileAndGo()) {
-        if (GlobalObject::DebuggerVector *debuggers = compileAndGoGlobal->getDebuggers()) {
-            if (!AddNewScriptRecipients(debuggers, script, &triggered))
-                return;
-        }
-    } else {
-        GlobalObjectSet &debuggees = script->compartment()->getDebuggees();
-        for (GlobalObjectSet::Range r = debuggees.all(); !r.empty(); r.popFront()) {
-            if (!AddNewScriptRecipients(r.front()->getDebuggers(), script, &triggered))
-                return;
-        }
+    GlobalObject::DebuggerVector *debuggers =
+        (script->compileAndGo()
+         ? compileAndGoGlobal->getDebuggers()
+         : script->compartment()->maybeGlobal()->getDebuggers());
+    if (debuggers) {
+        if (!AddNewScriptRecipients(debuggers, script, &triggered))
+            return;
     }
 
     /*
@@ -1593,13 +1591,10 @@ Debugger::markAllIteratively(GCMarker *trc)
      */
     JSRuntime *rt = trc->runtime();
     for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
-        GlobalObjectSet &debuggees = c->getDebuggees();
-        for (GlobalObjectSet::Enum e(debuggees); !e.empty(); e.popFront()) {
-            GlobalObject *global = e.front();
+        if (c->debugMode()) {
+            GlobalObject *global = c->maybeGlobal();
             if (!IsObjectMarked(&global))
                 continue;
-            else if (global != e.front())
-                e.rekeyFront(global);
 
             /*
              * Every debuggee has at least one debugger, so in this case
@@ -1750,20 +1745,19 @@ Debugger::sweepAll(FreeOp *fop)
                 // We can't recompile on-stack scripts here, and we
                 // can only toggle debug mode to off, so we use an
                 // infallible variant of removeDebuggeeGlobal.
-                dbg->removeDebuggeeGlobalUnderGC(fop, e.front(), nullptr, &e);
+                dbg->removeDebuggeeGlobalUnderGC(fop, e.front(), &e);
             }
         }
     }
 }
 
 void
-Debugger::detachAllDebuggersFromGlobal(FreeOp *fop, GlobalObject *global,
-                                       GlobalObjectSet::Enum *compartmentEnum)
+Debugger::detachAllDebuggersFromGlobal(FreeOp *fop, GlobalObject *global)
 {
     const GlobalObject::DebuggerVector *debuggers = global->getDebuggers();
     JS_ASSERT(!debuggers->empty());
     while (!debuggers->empty())
-        debuggers->back()->removeDebuggeeGlobalUnderGC(fop, global, compartmentEnum, nullptr);
+        debuggers->back()->removeDebuggeeGlobalUnderGC(fop, global, nullptr);
 }
 
 /* static */ void
@@ -2144,7 +2138,7 @@ Debugger::removeDebuggee(JSContext *cx, unsigned argc, Value *vp)
     if (!global)
         return false;
     if (dbg->debuggees.has(global)) {
-        if (!dbg->removeDebuggeeGlobal(cx, global, nullptr, nullptr))
+        if (!dbg->removeDebuggeeGlobal(cx, global, nullptr))
             return false;
     }
     args.rval().setUndefined();
@@ -2158,7 +2152,7 @@ Debugger::removeAllDebuggees(JSContext *cx, unsigned argc, Value *vp)
 
     for (GlobalObjectSet::Enum e(dbg->debuggees); !e.empty(); e.popFront()) {
         Rooted<GlobalObject *> global(cx, e.front());
-        if (!dbg->removeDebuggeeGlobal(cx, global, nullptr, &e))
+        if (!dbg->removeDebuggeeGlobal(cx, global, &e))
             return false;
     }
 
@@ -2183,7 +2177,7 @@ bool
 Debugger::getDebuggees(JSContext *cx, unsigned argc, Value *vp)
 {
     THIS_DEBUGGER(cx, argc, vp, "getDebuggees", args, dbg);
-    RootedObject arrobj(cx, NewDenseAllocatedArray(cx, dbg->debuggees.count()));
+    RootedObject arrobj(cx, NewDenseFullyAllocatedArray(cx, dbg->debuggees.count()));
     if (!arrobj)
         return false;
     arrobj->ensureDenseInitializedLength(cx, 0, dbg->debuggees.count());
@@ -2332,11 +2326,11 @@ Debugger::addDebuggeeGlobal(JSContext *cx,
         }
 
         /*
-         * Find all compartments containing debuggers debugging global objects
-         * in c. Add those compartments to visited.
+         * Find all compartments containing debuggers debugging c's global
+         * object. Add those compartments to visited.
          */
-        for (GlobalObjectSet::Range r = c->getDebuggees().all(); !r.empty(); r.popFront()) {
-            GlobalObject::DebuggerVector *v = r.front()->getDebuggers();
+        if (c->debugMode()) {
+            GlobalObject::DebuggerVector *v = c->maybeGlobal()->getDebuggers();
             for (Debugger **p = v->begin(); p != v->end(); p++) {
                 JSCompartment *next = (*p)->object->compartment();
                 if (Find(visited, next) == visited.end() && !visited.append(next))
@@ -2375,7 +2369,7 @@ Debugger::addDebuggeeGlobal(JSContext *cx,
         } else {
             if (global->getDebuggers()->length() > 1)
                 return true;
-            if (debuggeeCompartment->addDebuggee(cx, global, invalidate))
+            if (debuggeeCompartment->enterDebugMode(cx, invalidate))
                 return true;
 
             /* Maintain consistency on error. */
@@ -2394,18 +2388,13 @@ Debugger::addDebuggeeGlobal(JSContext *cx,
 
 void
 Debugger::cleanupDebuggeeGlobalBeforeRemoval(FreeOp *fop, GlobalObject *global,
-                                             AutoDebugModeInvalidation &invalidate,
-                                             GlobalObjectSet::Enum *compartmentEnum,
                                              GlobalObjectSet::Enum *debugEnum)
 {
     /*
-     * Each debuggee is in two HashSets: one for its compartment and one for
-     * its debugger (this). The caller might be enumerating either set; if so,
-     * use HashSet::Enum::removeFront rather than HashSet::remove below, to
-     * avoid invalidating the live enumerator.
+     * The caller might have found global by enumerating this->debuggees; if
+     * so, use HashSet::Enum::removeFront rather than HashSet::remove below,
+     * to avoid invalidating the live enumerator.
      */
-    JS_ASSERT(global->compartment()->getDebuggees().has(global));
-    JS_ASSERT_IF(compartmentEnum, compartmentEnum->front() == global);
     JS_ASSERT(debuggees.has(global));
     JS_ASSERT_IF(debugEnum, debugEnum->front() == global);
 
@@ -2465,45 +2454,31 @@ Debugger::cleanupDebuggeeGlobalBeforeRemoval(FreeOp *fop, GlobalObject *global,
 
 bool
 Debugger::removeDebuggeeGlobal(JSContext *cx, Handle<GlobalObject *> global,
-                               GlobalObjectSet::Enum *compartmentEnum,
                                GlobalObjectSet::Enum *debugEnum)
 {
     AutoDebugModeInvalidation invalidate(global->compartment());
-    return removeDebuggeeGlobal(cx, global, invalidate, compartmentEnum, debugEnum);
+    return removeDebuggeeGlobal(cx, global, invalidate, debugEnum);
 }
 
 bool
 Debugger::removeDebuggeeGlobal(JSContext *cx, Handle<GlobalObject *> global,
                                AutoDebugModeInvalidation &invalidate,
-                               GlobalObjectSet::Enum *compartmentEnum,
                                GlobalObjectSet::Enum *debugEnum)
 {
-    cleanupDebuggeeGlobalBeforeRemoval(cx->runtime()->defaultFreeOp(), global,
-                                       invalidate, compartmentEnum, debugEnum);
+    cleanupDebuggeeGlobalBeforeRemoval(cx->runtime()->defaultFreeOp(), global, debugEnum);
 
     // The debuggee needs to be removed from the compartment last to save a root.
     if (global->getDebuggers()->empty())
-        return global->compartment()->removeDebuggee(cx, global, invalidate, compartmentEnum);
+        return global->compartment()->leaveDebugMode(cx, invalidate);
 
     return true;
 }
 
 void
 Debugger::removeDebuggeeGlobalUnderGC(FreeOp *fop, GlobalObject *global,
-                                      GlobalObjectSet::Enum *compartmentEnum,
                                       GlobalObjectSet::Enum *debugEnum)
 {
-    AutoDebugModeInvalidation invalidate(global->compartment());
-    removeDebuggeeGlobalUnderGC(fop, global, invalidate, compartmentEnum, debugEnum);
-}
-
-void
-Debugger::removeDebuggeeGlobalUnderGC(FreeOp *fop, GlobalObject *global,
-                                      AutoDebugModeInvalidation &invalidate,
-                                      GlobalObjectSet::Enum *compartmentEnum,
-                                      GlobalObjectSet::Enum *debugEnum)
-{
-    cleanupDebuggeeGlobalBeforeRemoval(fop, global, invalidate, compartmentEnum, debugEnum);
+    cleanupDebuggeeGlobalBeforeRemoval(fop, global, debugEnum);
 
     /*
      * The debuggee needs to be removed from the compartment last, as this can
@@ -2511,7 +2486,7 @@ Debugger::removeDebuggeeGlobalUnderGC(FreeOp *fop, GlobalObject *global,
      * global cannot be rooted on the stack without a cx.
      */
     if (global->getDebuggers()->empty())
-        global->compartment()->removeDebuggeeUnderGC(fop, global, invalidate, compartmentEnum);
+        global->compartment()->leaveDebugModeUnderGC();
 }
 
 static inline ScriptSourceObject *GetSourceReferent(JSObject *obj);
@@ -2862,7 +2837,7 @@ class MOZ_STACK_CLASS Debugger::ScriptQuery
             if (!script->scriptSource() || !script->scriptSource()->hasDisplayURL())
                 return;
 
-            const jschar *s = script->scriptSource()->displayURL();
+            const char16_t *s = script->scriptSource()->displayURL();
             if (CompareChars(s, js_strlen(s), displayURLString) != 0)
                 return;
         }
@@ -2938,7 +2913,7 @@ Debugger::findScripts(JSContext *cx, unsigned argc, Value *vp)
     if (!query.findScripts(&scripts))
         return false;
 
-    RootedObject result(cx, NewDenseAllocatedArray(cx, scripts.length()));
+    RootedObject result(cx, NewDenseFullyAllocatedArray(cx, scripts.length()));
     if (!result)
         return false;
 
@@ -3290,6 +3265,9 @@ DebuggerScript_getChildScripts(JSContext *cx, unsigned argc, Value *vp)
             obj = objects->vector[i];
             if (obj->is<JSFunction>()) {
                 fun = &obj->as<JSFunction>();
+                // The inner function could be an asm.js native.
+                if (fun->isNative())
+                    continue;
                 funScript = GetOrCreateFunctionScript(cx, fun);
                 if (!funScript)
                     return false;
@@ -4805,7 +4783,7 @@ DebuggerFrame_setOnPop(JSContext *cx, unsigned argc, Value *vp)
  */
 bool
 js::EvaluateInEnv(JSContext *cx, Handle<Env*> env, HandleValue thisv, AbstractFramePtr frame,
-                  mozilla::Range<const jschar> chars, const char *filename, unsigned lineno,
+                  mozilla::Range<const char16_t> chars, const char *filename, unsigned lineno,
                   MutableHandleValue rval)
 {
     assertSameCompartment(cx, env, frame);
@@ -4971,7 +4949,7 @@ DebuggerGenericEval(JSContext *cx, const char *fullMethodName, const Value &code
     if (!stableChars.initTwoByte(cx, flat))
         return false;
 
-    mozilla::Range<const jschar> chars = stableChars.twoByteRange();
+    mozilla::Range<const char16_t> chars = stableChars.twoByteRange();
     bool ok = EvaluateInEnv(cx, env, thisv, frame, chars, url ? url : "debugger eval code",
                             lineNumber, &rval);
     return dbg->receiveCompletionValue(ac, ok, rval, vp);
@@ -5217,7 +5195,7 @@ DebuggerObject_getParameterNames(JSContext *cx, unsigned argc, Value *vp)
         return true;
     }
 
-    RootedObject result(cx, NewDenseAllocatedArray(cx, fun->nargs()));
+    RootedObject result(cx, NewDenseFullyAllocatedArray(cx, fun->nargs()));
     if (!result)
         return false;
     result->ensureDenseInitializedLength(cx, 0, fun->nargs());
diff --git a/js/src/vm/Debugger.h b/js/src/vm/Debugger.h
index 5e131196eb3..b7fcba9e89c 100644
--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@@ -201,7 +201,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
 
     struct AllocationSite : public mozilla::LinkedListElement<AllocationSite>
     {
-        AllocationSite(HandleObject frame) : frame(frame) {
+        explicit AllocationSite(HandleObject frame) : frame(frame) {
             JS_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>());
         };
         RelocatablePtrObject frame;
@@ -265,22 +265,13 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
     bool addDebuggeeGlobal(JSContext *cx, Handle<GlobalObject*> obj,
                            AutoDebugModeInvalidation &invalidate);
     void cleanupDebuggeeGlobalBeforeRemoval(FreeOp *fop, GlobalObject *global,
-                                            AutoDebugModeInvalidation &invalidate,
-                                            GlobalObjectSet::Enum *compartmentEnum,
-                                            GlobalObjectSet::Enum *debugEnu);
+                                            GlobalObjectSet::Enum *debugEnum);
     bool removeDebuggeeGlobal(JSContext *cx, Handle<GlobalObject *> global,
-                              GlobalObjectSet::Enum *compartmentEnum,
                               GlobalObjectSet::Enum *debugEnum);
     bool removeDebuggeeGlobal(JSContext *cx, Handle<GlobalObject *> global,
                               AutoDebugModeInvalidation &invalidate,
-                              GlobalObjectSet::Enum *compartmentEnum,
                               GlobalObjectSet::Enum *debugEnum);
     void removeDebuggeeGlobalUnderGC(FreeOp *fop, GlobalObject *global,
-                                     GlobalObjectSet::Enum *compartmentEnum,
-                                     GlobalObjectSet::Enum *debugEnum);
-    void removeDebuggeeGlobalUnderGC(FreeOp *fop, GlobalObject *global,
-                                     AutoDebugModeInvalidation &invalidate,
-                                     GlobalObjectSet::Enum *compartmentEnum,
                                      GlobalObjectSet::Enum *debugEnum);
 
     /*
@@ -457,8 +448,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
     static bool markAllIteratively(GCMarker *trc);
     static void markAll(JSTracer *trc);
     static void sweepAll(FreeOp *fop);
-    static void detachAllDebuggersFromGlobal(FreeOp *fop, GlobalObject *global,
-                                             GlobalObjectSet::Enum *compartmentEnum);
+    static void detachAllDebuggersFromGlobal(FreeOp *fop, GlobalObject *global);
     static void findCompartmentEdges(JS::Zone *v, gc::ComponentFinder<JS::Zone> &finder);
 
     static inline JSTrapStatus onEnterFrame(JSContext *cx, AbstractFramePtr frame,
@@ -740,7 +730,7 @@ Debugger::observesGlobal(GlobalObject *global) const
 JSTrapStatus
 Debugger::onEnterFrame(JSContext *cx, AbstractFramePtr frame, MutableHandleValue vp)
 {
-    if (cx->compartment()->getDebuggees().empty())
+    if (!cx->compartment()->debugMode())
         return JSTRAP_CONTINUE;
     return slowPathOnEnterFrame(cx, frame, vp);
 }
@@ -748,17 +738,17 @@ Debugger::onEnterFrame(JSContext *cx, AbstractFramePtr frame, MutableHandleValue
 JSTrapStatus
 Debugger::onDebuggerStatement(JSContext *cx, MutableHandleValue vp)
 {
-    return cx->compartment()->getDebuggees().empty()
-           ? JSTRAP_CONTINUE
-           : dispatchHook(cx, vp, OnDebuggerStatement);
+    return cx->compartment()->debugMode()
+           ? dispatchHook(cx, vp, OnDebuggerStatement)
+           : JSTRAP_CONTINUE;
 }
 
 JSTrapStatus
 Debugger::onExceptionUnwind(JSContext *cx, MutableHandleValue vp)
 {
-    return cx->compartment()->getDebuggees().empty()
-           ? JSTRAP_CONTINUE
-           : dispatchHook(cx, vp, OnExceptionUnwind);
+    return cx->compartment()->debugMode()
+           ? dispatchHook(cx, vp, OnExceptionUnwind)
+           : JSTRAP_CONTINUE;
 }
 
 void
@@ -772,7 +762,7 @@ Debugger::onNewScript(JSContext *cx, HandleScript script, GlobalObject *compileA
                  !script->selfHosted(),
                  script->compartment()->firedOnNewGlobalObject);
     JS_ASSERT_IF(!script->compileAndGo(), !compileAndGoGlobal);
-    if (!script->compartment()->getDebuggees().empty())
+    if (script->compartment()->debugMode())
         slowPathOnNewScript(cx, script, compileAndGoGlobal);
 }
 
@@ -798,7 +788,7 @@ Debugger::onLogAllocationSite(JSContext *cx, HandleSavedFrame frame)
 
 extern bool
 EvaluateInEnv(JSContext *cx, Handle<Env*> env, HandleValue thisv, AbstractFramePtr frame,
-              mozilla::Range<const jschar> chars, const char *filename, unsigned lineno,
+              mozilla::Range<const char16_t> chars, const char *filename, unsigned lineno,
               MutableHandleValue rval);
 
 bool ReportObjectRequired(JSContext *cx);
diff --git a/js/src/vm/DebuggerMemory.cpp b/js/src/vm/DebuggerMemory.cpp
index 24c21721f1e..f6b4391cb5c 100644
--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@@ -191,7 +191,7 @@ DebuggerMemory::drainAllocationsLog(JSContext *cx, unsigned argc, Value *vp)
 
     size_t length = dbg->allocationsLogLength;
 
-    RootedObject result(cx, NewDenseAllocatedArray(cx, length));
+    RootedObject result(cx, NewDenseFullyAllocatedArray(cx, length));
     if (!result)
         return false;
     result->ensureDenseInitializedLength(cx, 0, length);
@@ -258,7 +258,7 @@ struct Census {
     Zone::ZoneSet debuggeeZones;
     Zone *atomsZone;
 
-    Census(JSContext *cx) : cx(cx), atomsZone(nullptr) { }
+    explicit Census(JSContext *cx) : cx(cx), atomsZone(nullptr) { }
 
     bool init() {
         AutoLockForExclusiveAccess lock(cx);
@@ -298,7 +298,7 @@ class Tally {
     size_t total_;
 
   public:
-    Tally(Census &census) : total_(0) { }
+    explicit Tally(Census &census) : total_(0) { }
     Tally(Tally &&rhs) : total_(rhs.total_) { }
     Tally &operator=(Tally &&rhs) { total_ = rhs.total_; return *this; }
 
@@ -342,7 +342,7 @@ class ByJSType {
     EachOther other;
 
   public:
-    ByJSType(Census &census)
+    explicit ByJSType(Census &census)
       : total_(0),
         objects(census),
         scripts(census),
@@ -456,7 +456,7 @@ class ByObjectClass {
     }
 
   public:
-    ByObjectClass(Census &census) : total_(0), other(census) { }
+    explicit ByObjectClass(Census &census) : total_(0), other(census) { }
     ByObjectClass(ByObjectClass &&rhs)
       : total_(rhs.total_), table(Move(rhs.table)), other(Move(rhs.other))
     { }
@@ -550,12 +550,13 @@ class ByUbinodeType {
     // Note that, because ubi::Node::typeName promises to return a specific
     // pointer, not just any string whose contents are correct, we can use their
     // addresses as hash table keys.
-    typedef HashMap<const jschar *, EachType, DefaultHasher<const jschar *>, SystemAllocPolicy> Table;
+    typedef HashMap<const char16_t *, EachType, DefaultHasher<const char16_t *>,
+                    SystemAllocPolicy> Table;
     typedef typename Table::Entry Entry;
     Table table;
 
   public:
-    ByUbinodeType(Census &census) : total_(0) { }
+    explicit ByUbinodeType(Census &census) : total_(0) { }
     ByUbinodeType(ByUbinodeType &&rhs) : total_(rhs.total_), table(Move(rhs.table)) { }
     ByUbinodeType &operator=(ByUbinodeType &&rhs) {
         MOZ_ASSERT(&rhs != this);
@@ -568,7 +569,7 @@ class ByUbinodeType {
 
     bool count(Census &census, const Node &node) {
         total_++;
-        const jschar *key = node.typeName();
+        const char16_t *key = node.typeName();
         typename Table::AddPtr p = table.lookupForAdd(key);
         if (!p) {
             if (!table.add(p, key, EachType(census)))
@@ -619,7 +620,7 @@ class ByUbinodeType {
             if (!assorter.report(census, &assorterReport))
                 return false;
 
-            const jschar *name = entry.key();
+            const char16_t *name = entry.key();
             MOZ_ASSERT(name);
             JSAtom *atom = AtomizeChars(cx, name, js_strlen(name));
             if (!atom)
@@ -644,7 +645,7 @@ class CensusHandler {
     Assorter assorter;
 
   public:
-    CensusHandler(Census &census) : census(census), assorter(census) { }
+    explicit CensusHandler(Census &census) : census(census), assorter(census) { }
 
     bool init(Census &census) { return assorter.init(census); }
     bool report(Census &census, MutableHandleValue report) {
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index 22222be6686..960201b7126 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -418,25 +418,6 @@ GlobalObject::getOrCreateDebuggers(JSContext *cx, Handle<GlobalObject*> global)
     return debuggers;
 }
 
-/* static */ bool
-GlobalObject::addDebugger(JSContext *cx, Handle<GlobalObject*> global, Debugger *dbg)
-{
-    DebuggerVector *debuggers = getOrCreateDebuggers(cx, global);
-    if (!debuggers)
-        return false;
-#ifdef DEBUG
-    for (Debugger **p = debuggers->begin(); p != debuggers->end(); p++)
-        JS_ASSERT(*p != dbg);
-#endif
-    if (debuggers->empty() && !global->compartment()->addDebuggee(cx, global))
-        return false;
-    if (!debuggers->append(dbg)) {
-        (void) global->compartment()->removeDebuggee(cx, global);
-        return false;
-    }
-    return true;
-}
-
 /* static */ JSObject *
 GlobalObject::getOrCreateForOfPICObject(JSContext *cx, Handle<GlobalObject *> global)
 {
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index 0596e035e21..6e2a1a57f8d 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -634,8 +634,6 @@ class GlobalObject : public JSObject
         return &forOfPIC.toObject();
     }
     static JSObject *getOrCreateForOfPICObject(JSContext *cx, Handle<GlobalObject*> global);
-
-    static bool addDebugger(JSContext *cx, Handle<GlobalObject*> global, Debugger *dbg);
 };
 
 template<>
diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
index 671e7c0b0d4..e41851ded91 100644
--- a/js/src/vm/HelperThreads.cpp
+++ b/js/src/vm/HelperThreads.cpp
@@ -174,7 +174,7 @@ static const JSClass parseTaskGlobalClass = {
 };
 
 ParseTask::ParseTask(ExclusiveContext *cx, JSObject *exclusiveContextGlobal, JSContext *initCx,
-                     const jschar *chars, size_t length,
+                     const char16_t *chars, size_t length,
                      JS::OffThreadCompileCallback callback, void *callbackData)
   : cx(cx), options(initCx), chars(chars), length(length),
     alloc(JSRuntime::TEMP_LIFO_ALLOC_PRIMARY_CHUNK_SIZE),
@@ -283,7 +283,7 @@ js::OffThreadParsingMustWaitForGC(JSRuntime *rt)
 
 bool
 js::StartOffThreadParseScript(JSContext *cx, const ReadOnlyCompileOptions &options,
-                              const jschar *chars, size_t length,
+                              const char16_t *chars, size_t length,
                               JS::OffThreadCompileCallback callback, void *callbackData)
 {
     // Suppress GC so that calls below do not trigger a new incremental GC
diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
index eb6c6b331c3..8c79b824f0c 100644
--- a/js/src/vm/HelperThreads.h
+++ b/js/src/vm/HelperThreads.h
@@ -350,7 +350,7 @@ CancelOffThreadParses(JSRuntime *runtime);
  */
 bool
 StartOffThreadParseScript(JSContext *cx, const ReadOnlyCompileOptions &options,
-                          const jschar *chars, size_t length,
+                          const char16_t *chars, size_t length,
                           JS::OffThreadCompileCallback callback, void *callbackData);
 
 /*
@@ -423,7 +423,7 @@ struct ParseTask
 {
     ExclusiveContext *cx;
     OwningCompileOptions options;
-    const jschar *chars;
+    const char16_t *chars;
     size_t length;
     LifoAlloc alloc;
 
@@ -453,7 +453,7 @@ struct ParseTask
     bool overRecursed;
 
     ParseTask(ExclusiveContext *cx, JSObject *exclusiveContextGlobal,
-              JSContext *initCx, const jschar *chars, size_t length,
+              JSContext *initCx, const char16_t *chars, size_t length,
               JS::OffThreadCompileCallback callback, void *callbackData);
     bool init(JSContext *cx, const ReadOnlyCompileOptions &options);
 
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index daafd2d14a6..9d963d5f78f 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -3071,7 +3071,7 @@ CASE(JSOP_NEWARRAY)
     unsigned count = GET_UINT24(REGS.pc);
     RootedObject &obj = rootObject0;
     NewObjectKind newKind = UseNewTypeForInitializer(script, REGS.pc, &ArrayObject::class_);
-    obj = NewDenseAllocatedArray(cx, count, nullptr, newKind);
+    obj = NewDenseFullyAllocatedArray(cx, count, nullptr, newKind);
     if (!obj || !SetInitializerObjectType(cx, script, REGS.pc, obj, newKind))
         goto error;
 
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index 93076c64880..03bd779d16f 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -68,7 +68,7 @@ InefficientNonFlatteningStringHashPolicy::hash(const Lookup &l)
 {
     return l->hasLatin1Chars()
            ? HashStringChars<Latin1Char>(l)
-           : HashStringChars<jschar>(l);
+           : HashStringChars<char16_t>(l);
 }
 
 template <typename Char1, typename Char2>
@@ -110,12 +110,12 @@ InefficientNonFlatteningStringHashPolicy::match(const JSString *const &k, const
     if (k->hasLatin1Chars()) {
         return l->hasLatin1Chars()
                ? EqualStringsPure<Latin1Char, Latin1Char>(s1, l)
-               : EqualStringsPure<Latin1Char, jschar>(s1, l);
+               : EqualStringsPure<Latin1Char, char16_t>(s1, l);
     }
 
     return l->hasLatin1Chars()
-           ? EqualStringsPure<jschar, Latin1Char>(s1, l)
-           : EqualStringsPure<jschar, jschar>(s1, l);
+           ? EqualStringsPure<char16_t, Latin1Char>(s1, l)
+           : EqualStringsPure<char16_t, char16_t>(s1, l);
 }
 
 /* static */ HashNumber
@@ -175,7 +175,7 @@ NotableStringInfo::NotableStringInfo(JSString *str, const StringInfo &info)
     if (str->hasLatin1Chars())
         StoreStringChars<Latin1Char>(buffer, bufferSize, str);
     else
-        StoreStringChars<jschar>(buffer, bufferSize, str);
+        StoreStringChars<char16_t>(buffer, bufferSize, str);
 }
 
 NotableStringInfo::NotableStringInfo(NotableStringInfo &&info)
@@ -338,7 +338,6 @@ StatsCompartmentCallback(JSRuntime *rt, void *data, JSCompartment *compartment)
                                         &cStats.compartmentTables,
                                         &cStats.crossCompartmentWrappersTable,
                                         &cStats.regexpCompartment,
-                                        &cStats.debuggeesSet,
                                         &cStats.savedStacksSet);
 }
 
diff --git a/js/src/vm/OldDebugAPI.cpp b/js/src/vm/OldDebugAPI.cpp
index 39fcd77ac8c..919bfe71429 100644
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@@ -40,24 +40,6 @@ using namespace js::gc;
 
 using mozilla::PodZero;
 
-JS_PUBLIC_API(bool)
-JS_GetDebugMode(JSContext *cx)
-{
-    return cx->compartment()->debugMode();
-}
-
-JS_PUBLIC_API(bool)
-JS_SetDebugMode(JSContext *cx, bool debug)
-{
-    return JS_SetDebugModeForCompartment(cx, cx->compartment(), debug);
-}
-
-JS_PUBLIC_API(void)
-JS_SetRuntimeDebugMode(JSRuntime *rt, bool debug)
-{
-    rt->debugMode = !!debug;
-}
-
 JSTrapStatus
 js::ScriptDebugPrologue(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
@@ -98,9 +80,6 @@ js::DebugExceptionUnwind(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
 {
     JS_ASSERT(cx->compartment()->debugMode());
 
-    if (cx->compartment()->getDebuggees().empty())
-        return JSTRAP_CONTINUE;
-
     /* Call debugger throw hook if set. */
     RootedValue rval(cx);
     JSTrapStatus status = Debugger::onExceptionUnwind(cx, &rval);
@@ -129,31 +108,6 @@ js::DebugExceptionUnwind(JSContext *cx, AbstractFramePtr frame, jsbytecode *pc)
     return status;
 }
 
-JS_FRIEND_API(bool)
-JS_SetDebugModeForAllCompartments(JSContext *cx, bool debug)
-{
-    for (ZonesIter zone(cx->runtime(), SkipAtoms); !zone.done(); zone.next()) {
-        // Invalidate a zone at a time to avoid doing a ZoneCellIter
-        // per compartment.
-        AutoDebugModeInvalidation invalidate(zone);
-        for (CompartmentsInZoneIter c(zone); !c.done(); c.next()) {
-            // Ignore special compartments (atoms, JSD compartments)
-            if (c->principals) {
-                if (!c->setDebugModeFromC(cx, !!debug, invalidate))
-                    return false;
-            }
-        }
-    }
-    return true;
-}
-
-JS_FRIEND_API(bool)
-JS_SetDebugModeForCompartment(JSContext *cx, JSCompartment *comp, bool debug)
-{
-    AutoDebugModeInvalidation invalidate(comp);
-    return comp->setDebugModeFromC(cx, !!debug, invalidate);
-}
-
 /************************************************************************/
 
 JS_PUBLIC_API(unsigned)
@@ -191,7 +145,7 @@ JS_GetScriptFilename(JSScript *script)
     return script->filename();
 }
 
-JS_PUBLIC_API(const jschar *)
+JS_PUBLIC_API(const char16_t *)
 JS_GetScriptSourceMap(JSContext *cx, JSScript *script)
 {
     ScriptSource *source = script->scriptSource();
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index d9fec7d7858..6b577b9cbf9 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -279,7 +279,7 @@ const Class RegExpObject::class_ = {
 };
 
 RegExpObject *
-RegExpObject::create(ExclusiveContext *cx, RegExpStatics *res, const jschar *chars, size_t length,
+RegExpObject::create(ExclusiveContext *cx, RegExpStatics *res, const char16_t *chars, size_t length,
                      RegExpFlag flags, TokenStream *tokenStream, LifoAlloc &alloc)
 {
     RegExpFlag staticsFlags = res->getFlags();
@@ -287,7 +287,7 @@ RegExpObject::create(ExclusiveContext *cx, RegExpStatics *res, const jschar *cha
 }
 
 RegExpObject *
-RegExpObject::createNoStatics(ExclusiveContext *cx, const jschar *chars, size_t length, RegExpFlag flags,
+RegExpObject::createNoStatics(ExclusiveContext *cx, const char16_t *chars, size_t length, RegExpFlag flags,
                               TokenStream *tokenStream, LifoAlloc &alloc)
 {
     RootedAtom source(cx, AtomizeChars(cx, chars, length));
@@ -306,7 +306,7 @@ RegExpObject::createNoStatics(ExclusiveContext *cx, HandleAtom source, RegExpFla
     if (!tokenStream) {
         dummyOptions.emplace(cx->asJSContext());
         dummyTokenStream.emplace(cx, *dummyOptions,
-                                   (const jschar *) nullptr, 0,
+                                   (const char16_t *) nullptr, 0,
                                    (frontend::StrictModeGetter *) nullptr);
         tokenStream = dummyTokenStream.ptr();
     }
@@ -603,7 +603,7 @@ RegExpShared::execute(JSContext *cx, HandleLinearString input, size_t *lastIndex
             const Latin1Char *chars = inputChars.latin1Range().start().get() + charsOffset;
             result = irregexp::InterpretCode(cx, byteCode, chars, start, length, &matches);
         } else {
-            const jschar *chars = inputChars.twoByteRange().start().get() + charsOffset;
+            const char16_t *chars = inputChars.twoByteRange().start().get() + charsOffset;
             result = irregexp::InterpretCode(cx, byteCode, chars, start, length, &matches);
         }
 
@@ -624,7 +624,7 @@ RegExpShared::execute(JSContext *cx, HandleLinearString input, size_t *lastIndex
                 const Latin1Char *chars = input->latin1Chars(nogc) + charsOffset;
                 result = irregexp::ExecuteCode(cx, jitCodeLatin1, chars, start, length, &matches);
             } else {
-                const jschar *chars = input->twoByteChars(nogc) + charsOffset;
+                const char16_t *chars = input->twoByteChars(nogc) + charsOffset;
                 result = irregexp::ExecuteCode(cx, jitCodeTwoByte, chars, start, length, &matches);
             }
         }
@@ -708,6 +708,12 @@ RegExpCompartment::createMatchResultTemplateObject(JSContext *cx)
     if (!templateObject)
         return matchResultTemplateObject_; // = nullptr
 
+    // Create a new type for the template.
+    Rooted<TaggedProto> proto(cx, templateObject->getTaggedProto());
+    types::TypeObject *type =
+        cx->compartment()->types.newTypeObject(cx, templateObject->getClass(), proto);
+    templateObject->setType(type);
+
     /* Set dummy index property */
     RootedValue index(cx, Int32Value(0));
     if (!baseops::DefineProperty(cx, templateObject, cx->names().index, index,
@@ -727,6 +733,10 @@ RegExpCompartment::createMatchResultTemplateObject(JSContext *cx)
     JS_ASSERT(shape->slot() == 1 &&
               shape->propidRef() == NameToId(cx->names().input));
 
+    // Make sure type information reflects the indexed properties which might
+    // be added.
+    types::AddTypePropertyId(cx, templateObject, JSID_VOID, types::Type::StringType());
+
     matchResultTemplateObject_.set(templateObject);
 
     return matchResultTemplateObject_;
@@ -854,7 +864,7 @@ HandleRegExpFlag(RegExpFlag flag, RegExpFlag *flags)
 
 template <typename CharT>
 static size_t
-ParseRegExpFlags(const CharT *chars, size_t length, RegExpFlag *flagsOut, jschar *lastParsedOut)
+ParseRegExpFlags(const CharT *chars, size_t length, RegExpFlag *flagsOut, char16_t *lastParsedOut)
 {
     *flagsOut = RegExpFlag(0);
 
@@ -895,7 +905,7 @@ js::ParseRegExpFlags(JSContext *cx, JSString *flagStr, RegExpFlag *flagsOut)
     size_t len = linear->length();
 
     bool ok;
-    jschar lastParsed;
+    char16_t lastParsed;
     if (linear->hasLatin1Chars()) {
         AutoCheckCannotGC nogc;
         ok = ::ParseRegExpFlags(linear->latin1Chars(nogc), len, flagsOut, &lastParsed);
diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
index 6241f0fc6fb..43f21ef8e3e 100644
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -319,11 +319,11 @@ class RegExpObject : public JSObject
      * execution, as opposed to during something like XDR.
      */
     static RegExpObject *
-    create(ExclusiveContext *cx, RegExpStatics *res, const jschar *chars, size_t length,
+    create(ExclusiveContext *cx, RegExpStatics *res, const char16_t *chars, size_t length,
            RegExpFlag flags, frontend::TokenStream *ts, LifoAlloc &alloc);
 
     static RegExpObject *
-    createNoStatics(ExclusiveContext *cx, const jschar *chars, size_t length, RegExpFlag flags,
+    createNoStatics(ExclusiveContext *cx, const char16_t *chars, size_t length, RegExpFlag flags,
                     frontend::TokenStream *ts, LifoAlloc &alloc);
 
     static RegExpObject *
diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
index 346e7c04c71..976dc2da4f0 100644
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@@ -175,7 +175,6 @@ JSRuntime::JSRuntime(JSRuntime *parentRuntime)
 #ifdef NIGHTLY_BUILD
     assertOnScriptEntryHook_(nullptr),
 #endif
-    debugMode(false),
     spsProfiler(thisFromCtor()),
     profilingScripts(false),
     suppressProfilerSampling(false),
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index 784e3b1d45c..0bfcdf6437b 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -388,7 +388,7 @@ class FreeOp : public JSFreeOp
         return static_cast<FreeOp *>(fop);
     }
 
-    FreeOp(JSRuntime *rt)
+    explicit FreeOp(JSRuntime *rt)
       : JSFreeOp(rt)
     {}
 
@@ -1014,9 +1014,6 @@ struct JSRuntime : public JS::shadow::Runtime,
     js::AssertOnScriptEntryHook assertOnScriptEntryHook_;
 #endif
 
-    /* If true, new compartments are initially in debug mode. */
-    bool                debugMode;
-
     /* SPS profiling metadata */
     js::SPSProfiler     spsProfiler;
 
diff --git a/js/src/vm/SavedStacks.cpp b/js/src/vm/SavedStacks.cpp
index 3ecaff67ba6..2a52b107c08 100644
--- a/js/src/vm/SavedStacks.cpp
+++ b/js/src/vm/SavedStacks.cpp
@@ -7,6 +7,8 @@
 
 #include "vm/SavedStacks.h"
 
+#include "mozilla/Attributes.h"
+
 #include "jsapi.h"
 #include "jscompartment.h"
 #include "jsfriendapi.h"
@@ -76,7 +78,7 @@ class SavedFrame::AutoLookupRooter : public JS::CustomAutoRooter
 class SavedFrame::HandleLookup
 {
   public:
-    HandleLookup(SavedFrame::AutoLookupRooter &lookup) : ref(lookup) { }
+    MOZ_IMPLICIT HandleLookup(SavedFrame::AutoLookupRooter &lookup) : ref(lookup) { }
     SavedFrame::Lookup *operator->() { return &ref.get(); }
     operator const SavedFrame::Lookup&() const { return ref; }
   private:
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index a6e497501a9..96874a38914 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -409,7 +409,7 @@ js::intrinsic_NewDenseArray(JSContext *cx, unsigned argc, Value *vp)
     uint32_t length = args[0].toInt32();
 
     // Make a new buffer and initialize it up to length.
-    RootedObject buffer(cx, NewDenseAllocatedArray(cx, length));
+    RootedObject buffer(cx, NewDenseFullyAllocatedArray(cx, length));
     if (!buffer)
         return false;
 
diff --git a/js/src/vm/String-inl.h b/js/src/vm/String-inl.h
index c137958c0de..0afa1cfcf19 100644
--- a/js/src/vm/String-inl.h
+++ b/js/src/vm/String-inl.h
@@ -181,7 +181,7 @@ JSDependentString::new_(js::ExclusiveContext *cx, JSLinearString *baseArg, size_
         js::RootedLinearString base(cx, baseArg);
         if (baseArg->hasLatin1Chars())
             return js::NewFatInlineString<JS::Latin1Char>(cx, base, start, length);
-        return js::NewFatInlineString<jschar>(cx, base, start, length);
+        return js::NewFatInlineString<char16_t>(cx, base, start, length);
     }
 
     JSDependentString *str = (JSDependentString *)js::NewGCString<js::NoGC>(cx);
@@ -207,7 +207,7 @@ JSString::markBase(JSTracer *trc)
 }
 
 MOZ_ALWAYS_INLINE void
-JSFlatString::init(const jschar *chars, size_t length)
+JSFlatString::init(const char16_t *chars, size_t length)
 {
     d.u1.length = length;
     d.u1.flags = FLAT_BIT;
@@ -261,7 +261,7 @@ JSInlineString::new_(js::ThreadSafeContext *cx)
     return (JSInlineString *)js::NewGCString<allowGC>(cx);
 }
 
-MOZ_ALWAYS_INLINE jschar *
+MOZ_ALWAYS_INLINE char16_t *
 JSInlineString::initTwoByte(size_t length)
 {
     JS_ASSERT(twoByteLengthFits(length));
@@ -279,7 +279,7 @@ JSInlineString::initLatin1(size_t length)
     return d.inlineStorageLatin1;
 }
 
-MOZ_ALWAYS_INLINE jschar *
+MOZ_ALWAYS_INLINE char16_t *
 JSFatInlineString::initTwoByte(size_t length)
 {
     JS_ASSERT(twoByteLengthFits(length));
@@ -305,8 +305,8 @@ JSInlineString::init<JS::Latin1Char>(size_t length)
 }
 
 template<>
-MOZ_ALWAYS_INLINE jschar *
-JSInlineString::init<jschar>(size_t length)
+MOZ_ALWAYS_INLINE char16_t *
+JSInlineString::init<char16_t>(size_t length)
 {
     return initTwoByte(length);
 }
@@ -319,8 +319,8 @@ JSFatInlineString::init<JS::Latin1Char>(size_t length)
 }
 
 template<>
-MOZ_ALWAYS_INLINE jschar *
-JSFatInlineString::init<jschar>(size_t length)
+MOZ_ALWAYS_INLINE char16_t *
+JSFatInlineString::init<char16_t>(size_t length)
 {
     return initTwoByte(length);
 }
@@ -333,7 +333,7 @@ JSFatInlineString::new_(js::ThreadSafeContext *cx)
 }
 
 MOZ_ALWAYS_INLINE void
-JSExternalString::init(const jschar *chars, size_t length, const JSStringFinalizer *fin)
+JSExternalString::init(const char16_t *chars, size_t length, const JSStringFinalizer *fin)
 {
     JS_ASSERT(fin);
     JS_ASSERT(fin->finalize);
@@ -344,7 +344,7 @@ JSExternalString::init(const jschar *chars, size_t length, const JSStringFinaliz
 }
 
 MOZ_ALWAYS_INLINE JSExternalString *
-JSExternalString::new_(JSContext *cx, const jschar *chars, size_t length,
+JSExternalString::new_(JSContext *cx, const char16_t *chars, size_t length,
                        const JSStringFinalizer *fin)
 {
     JS_ASSERT(chars[length] == 0);
@@ -355,7 +355,7 @@ JSExternalString::new_(JSContext *cx, const jschar *chars, size_t length,
     if (!str)
         return nullptr;
     str->init(chars, length, fin);
-    cx->runtime()->updateMallocCounter(cx->zone(), (length + 1) * sizeof(jschar));
+    cx->runtime()->updateMallocCounter(cx->zone(), (length + 1) * sizeof(char16_t));
     return str;
 }
 
@@ -364,7 +364,7 @@ js::StaticStrings::getUnitStringForElement(JSContext *cx, JSString *str, size_t
 {
     JS_ASSERT(index < str->length());
 
-    jschar c;
+    char16_t c;
     if (!str->getChar(cx, index, &c))
         return nullptr;
     if (c < UNIT_STATIC_LIMIT)
@@ -373,7 +373,7 @@ js::StaticStrings::getUnitStringForElement(JSContext *cx, JSString *str, size_t
 }
 
 inline JSAtom *
-js::StaticStrings::getLength2(jschar c1, jschar c2)
+js::StaticStrings::getLength2(char16_t c1, char16_t c2)
 {
     JS_ASSERT(fitsInSmallChar(c1));
     JS_ASSERT(fitsInSmallChar(c2));
@@ -425,7 +425,7 @@ inline void
 JSExternalString::finalize(js::FreeOp *fop)
 {
     const JSStringFinalizer *fin = externalFinalizer();
-    fin->finalize(fin, const_cast<jschar *>(rawTwoByteChars()));
+    fin->finalize(fin, const_cast<char16_t *>(rawTwoByteChars()));
 }
 
 #endif /* vm_String_inl_h */
diff --git a/js/src/vm/String.cpp b/js/src/vm/String.cpp
index 990c679c103..39b22412001 100644
--- a/js/src/vm/String.cpp
+++ b/js/src/vm/String.cpp
@@ -80,7 +80,7 @@ JSString::dumpChars(const CharT *s, size_t n, FILE *fp)
 
     fputc('"', fp);
     for (size_t i = 0; i < n; i++) {
-        jschar c = s[i];
+        char16_t c = s[i];
         if (c == '\n')
             fprintf(fp, "\\n");
         else if (c == '\t')
@@ -99,7 +99,7 @@ template void
 JSString::dumpChars(const Latin1Char *s, size_t n, FILE *fp);
 
 template void
-JSString::dumpChars(const jschar *s, size_t n, FILE *fp);
+JSString::dumpChars(const char16_t *s, size_t n, FILE *fp);
 
 void
 JSString::dumpCharsNoNewline(FILE *fp)
@@ -126,8 +126,8 @@ JSString::dump()
                     (void *) chars);
             dumpChars(chars, length(), stderr);
         } else {
-            const jschar *chars = linear->twoByteChars(nogc);
-            fprintf(stderr, "JSString* (%p) = jschar * (%p) = ", (void *) this,
+            const char16_t *chars = linear->twoByteChars(nogc);
+            fprintf(stderr, "JSString* (%p) = char16_t * (%p) = ", (void *) this,
                     (void *) chars);
             dumpChars(chars, length(), stderr);
         }
@@ -184,9 +184,9 @@ JSRope::copyLatin1CharsZ(ThreadSafeContext *cx, ScopedJSFreePtr<Latin1Char> &out
 }
 
 bool
-JSRope::copyTwoByteCharsZ(ThreadSafeContext *cx, ScopedJSFreePtr<jschar> &out) const
+JSRope::copyTwoByteCharsZ(ThreadSafeContext *cx, ScopedJSFreePtr<char16_t> &out) const
 {
-    return copyCharsInternal<jschar>(cx, out, true);
+    return copyCharsInternal<char16_t>(cx, out, true);
 }
 
 bool
@@ -196,9 +196,9 @@ JSRope::copyLatin1Chars(ThreadSafeContext *cx, ScopedJSFreePtr<Latin1Char> &out)
 }
 
 bool
-JSRope::copyTwoByteChars(ThreadSafeContext *cx, ScopedJSFreePtr<jschar> &out) const
+JSRope::copyTwoByteChars(ThreadSafeContext *cx, ScopedJSFreePtr<char16_t> &out) const
 {
-    return copyCharsInternal<jschar>(cx, out, false);
+    return copyCharsInternal<char16_t>(cx, out, false);
 }
 
 template <typename CharT>
@@ -249,7 +249,7 @@ namespace js {
 
 template <>
 void
-CopyChars(jschar *dest, const JSLinearString &str)
+CopyChars(char16_t *dest, const JSLinearString &str)
 {
     AutoCheckCannotGC nogc;
     if (str.hasTwoByteChars())
@@ -275,7 +275,7 @@ CopyChars(Latin1Char *dest, const JSLinearString &str)
          * range, so we can safely deflate here.
          */
         size_t len = str.length();
-        const jschar *chars = str.twoByteChars(nogc);
+        const char16_t *chars = str.twoByteChars(nogc);
         for (size_t i = 0; i < len; i++) {
             MOZ_ASSERT(chars[i] <= JSString::MAX_LATIN1_CHAR);
             dest[i] = chars[i];
@@ -344,7 +344,7 @@ JSRope::flattenInternal(ExclusiveContext *maybecx)
     if (leftMostRope->leftChild()->isExtensible()) {
         JSExtensibleString &left = leftMostRope->leftChild()->asExtensible();
         size_t capacity = left.capacity();
-        if (capacity >= wholeLength && left.hasTwoByteChars() == IsSame<CharT, jschar>::value) {
+        if (capacity >= wholeLength && left.hasTwoByteChars() == IsSame<CharT, char16_t>::value) {
             /*
              * Simulate a left-most traversal from the root to leftMost->leftChild()
              * via first_visit_node
@@ -416,7 +416,7 @@ JSRope::flattenInternal(ExclusiveContext *maybecx)
             JS_ASSERT(pos == wholeChars + wholeLength);
             *pos = '\0';
             str->d.u1.length = wholeLength;
-            if (IsSame<CharT, jschar>::value)
+            if (IsSame<CharT, char16_t>::value)
                 str->d.u1.flags = EXTENSIBLE_FLAGS;
             else
                 str->d.u1.flags = EXTENSIBLE_FLAGS | LATIN1_CHARS_BIT;
@@ -427,7 +427,7 @@ JSRope::flattenInternal(ExclusiveContext *maybecx)
             return &this->asFlat();
         }
         uintptr_t flattenData = str->d.u1.flattenData;
-        if (IsSame<CharT, jschar>::value)
+        if (IsSame<CharT, char16_t>::value)
             str->d.u1.flags = DEPENDENT_FLAGS;
         else
             str->d.u1.flags = DEPENDENT_FLAGS | LATIN1_CHARS_BIT;
@@ -447,7 +447,7 @@ JSFlatString *
 JSRope::flattenInternal(ExclusiveContext *maybecx)
 {
     if (hasTwoByteChars())
-        return flattenInternal<b, jschar>(maybecx);
+        return flattenInternal<b, char16_t>(maybecx);
     return flattenInternal<b, Latin1Char>(maybecx);
 }
 
@@ -503,7 +503,7 @@ js::ConcatStrings(ThreadSafeContext *cx,
             PodCopy(buf + leftLen, rightInspector.latin1Chars(), rightLen);
             buf[wholeLength] = 0;
         } else {
-            jschar *buf = str->initTwoByte(wholeLength);
+            char16_t *buf = str->initTwoByte(wholeLength);
             if (leftInspector.hasTwoByteChars())
                 PodCopy(buf, leftInspector.twoByteChars(), leftLen);
             else
@@ -566,7 +566,7 @@ JSDependentString::undepend(ExclusiveContext *cx)
     JS_ASSERT(JSString::isDependent());
     return hasLatin1Chars()
            ? undependInternal<Latin1Char>(cx)
-           : undependInternal<jschar>(cx);
+           : undependInternal<char16_t>(cx);
 }
 
 template <typename CharT>
@@ -621,7 +621,7 @@ template bool
 JSFlatString::isIndexSlow(const Latin1Char *s, size_t length, uint32_t *indexp);
 
 template bool
-JSFlatString::isIndexSlow(const jschar *s, size_t length, uint32_t *indexp);
+JSFlatString::isIndexSlow(const char16_t *s, size_t length, uint32_t *indexp);
 
 bool
 ScopedThreadSafeStringInspector::ensureChars(ThreadSafeContext *cx, const AutoCheckCannotGC &nogc)
@@ -658,7 +658,7 @@ ScopedThreadSafeStringInspector::ensureChars(ThreadSafeContext *cx, const AutoCh
                 latin1Chars_ = chars;
                 scopedChars_ = chars.forget();
             } else {
-                ScopedJSFreePtr<jschar> chars;
+                ScopedJSFreePtr<char16_t> chars;
                 if (!str_->asRope().copyTwoByteChars(cx, chars))
                     return false;
                 state_ = TwoByte;
@@ -810,7 +810,7 @@ AutoStableStringChars::~AutoStableStringChars()
         if (state_ == Latin1)
             js_free(const_cast<Latin1Char*>(latin1Chars_));
         else
-            js_free(const_cast<jschar*>(twoByteChars_));
+            js_free(const_cast<char16_t*>(twoByteChars_));
     }
 }
 
@@ -851,7 +851,7 @@ AutoStableStringChars::initTwoByte(JSContext *cx, JSString *s)
         return true;
     }
 
-    jschar *chars = cx->pod_malloc<jschar>(linearString->length() + 1);
+    char16_t *chars = cx->pod_malloc<char16_t>(linearString->length() + 1);
     if (!chars)
         return false;
 
@@ -890,7 +890,7 @@ js::NewDependentString(JSContext *cx, JSString *baseArg, size_t start, size_t le
 
     if (base->hasTwoByteChars()) {
         AutoCheckCannotGC nogc;
-        const jschar *chars = base->twoByteChars(nogc) + start;
+        const char16_t *chars = base->twoByteChars(nogc) + start;
         if (JSLinearString *staticStr = cx->staticStrings().lookup(chars, length))
             return staticStr;
     } else {
@@ -904,9 +904,9 @@ js::NewDependentString(JSContext *cx, JSString *baseArg, size_t start, size_t le
 }
 
 static bool
-CanStoreCharsAsLatin1(const jschar *s, size_t length)
+CanStoreCharsAsLatin1(const char16_t *s, size_t length)
 {
-    for (const jschar *end = s + length; s < end; ++s) {
+    for (const char16_t *end = s + length; s < end; ++s) {
         if (*s > JSString::MAX_LATIN1_CHAR)
             return false;
     }
@@ -922,7 +922,7 @@ CanStoreCharsAsLatin1(const Latin1Char *s, size_t length)
 
 template <AllowGC allowGC>
 static MOZ_ALWAYS_INLINE JSInlineString *
-NewFatInlineStringDeflated(ThreadSafeContext *cx, mozilla::Range<const jschar> chars)
+NewFatInlineStringDeflated(ThreadSafeContext *cx, mozilla::Range<const char16_t> chars)
 {
     size_t len = chars.length();
     Latin1Char *storage;
@@ -940,10 +940,10 @@ NewFatInlineStringDeflated(ThreadSafeContext *cx, mozilla::Range<const jschar> c
 
 template <AllowGC allowGC>
 static JSFlatString *
-NewStringDeflated(ThreadSafeContext *cx, const jschar *s, size_t n)
+NewStringDeflated(ThreadSafeContext *cx, const char16_t *s, size_t n)
 {
     if (JSFatInlineString::latin1LengthFits(n))
-        return NewFatInlineStringDeflated<allowGC>(cx, mozilla::Range<const jschar>(s, n));
+        return NewFatInlineStringDeflated<allowGC>(cx, mozilla::Range<const char16_t>(s, n));
 
     ScopedJSFreePtr<Latin1Char> news(cx->pod_malloc<Latin1Char>(n + 1));
     if (!news)
@@ -975,7 +975,7 @@ JSFlatString *
 js::NewStringDontDeflate(ThreadSafeContext *cx, CharT *chars, size_t length)
 {
     if (length == 1) {
-        jschar c = chars[0];
+        char16_t c = chars[0];
         if (StaticStrings::hasUnit(c)) {
             // Free |chars| because we're taking possession of it, but it's no
             // longer needed because we use the static string instead.
@@ -998,10 +998,10 @@ js::NewStringDontDeflate(ThreadSafeContext *cx, CharT *chars, size_t length)
 }
 
 template JSFlatString *
-js::NewStringDontDeflate<CanGC>(ThreadSafeContext *cx, jschar *chars, size_t length);
+js::NewStringDontDeflate<CanGC>(ThreadSafeContext *cx, char16_t *chars, size_t length);
 
 template JSFlatString *
-js::NewStringDontDeflate<NoGC>(ThreadSafeContext *cx, jschar *chars, size_t length);
+js::NewStringDontDeflate<NoGC>(ThreadSafeContext *cx, char16_t *chars, size_t length);
 
 template JSFlatString *
 js::NewStringDontDeflate<CanGC>(ThreadSafeContext *cx, Latin1Char *chars, size_t length);
@@ -1013,9 +1013,9 @@ template <AllowGC allowGC, typename CharT>
 JSFlatString *
 js::NewString(ThreadSafeContext *cx, CharT *chars, size_t length)
 {
-    if (IsSame<CharT, jschar>::value && CanStoreCharsAsLatin1(chars, length)) {
+    if (IsSame<CharT, char16_t>::value && CanStoreCharsAsLatin1(chars, length)) {
         if (length == 1) {
-            jschar c = chars[0];
+            char16_t c = chars[0];
             if (StaticStrings::hasUnit(c)) {
                 js_free(chars);
                 return cx->staticStrings().getUnit(c);
@@ -1035,10 +1035,10 @@ js::NewString(ThreadSafeContext *cx, CharT *chars, size_t length)
 }
 
 template JSFlatString *
-js::NewString<CanGC>(ThreadSafeContext *cx, jschar *chars, size_t length);
+js::NewString<CanGC>(ThreadSafeContext *cx, char16_t *chars, size_t length);
 
 template JSFlatString *
-js::NewString<NoGC>(ThreadSafeContext *cx, jschar *chars, size_t length);
+js::NewString<NoGC>(ThreadSafeContext *cx, char16_t *chars, size_t length);
 
 template JSFlatString *
 js::NewString<CanGC>(ThreadSafeContext *cx, Latin1Char *chars, size_t length);
@@ -1071,10 +1071,10 @@ NewStringCopyNDontDeflate(ThreadSafeContext *cx, const CharT *s, size_t n)
 }
 
 template JSFlatString *
-NewStringCopyNDontDeflate<CanGC>(ThreadSafeContext *cx, const jschar *s, size_t n);
+NewStringCopyNDontDeflate<CanGC>(ThreadSafeContext *cx, const char16_t *s, size_t n);
 
 template JSFlatString *
-NewStringCopyNDontDeflate<NoGC>(ThreadSafeContext *cx, const jschar *s, size_t n);
+NewStringCopyNDontDeflate<NoGC>(ThreadSafeContext *cx, const char16_t *s, size_t n);
 
 template JSFlatString *
 NewStringCopyNDontDeflate<CanGC>(ThreadSafeContext *cx, const Latin1Char *s, size_t n);
@@ -1086,17 +1086,17 @@ template <AllowGC allowGC, typename CharT>
 JSFlatString *
 NewStringCopyN(ThreadSafeContext *cx, const CharT *s, size_t n)
 {
-    if (IsSame<CharT, jschar>::value && CanStoreCharsAsLatin1(s, n))
+    if (IsSame<CharT, char16_t>::value && CanStoreCharsAsLatin1(s, n))
         return NewStringDeflated<allowGC>(cx, s, n);
 
     return NewStringCopyNDontDeflate<allowGC>(cx, s, n);
 }
 
 template JSFlatString *
-NewStringCopyN<CanGC>(ThreadSafeContext *cx, const jschar *s, size_t n);
+NewStringCopyN<CanGC>(ThreadSafeContext *cx, const char16_t *s, size_t n);
 
 template JSFlatString *
-NewStringCopyN<NoGC>(ThreadSafeContext *cx, const jschar *s, size_t n);
+NewStringCopyN<NoGC>(ThreadSafeContext *cx, const char16_t *s, size_t n);
 
 template JSFlatString *
 NewStringCopyN<CanGC>(ThreadSafeContext *cx, const Latin1Char *s, size_t n);
diff --git a/js/src/vm/String.h b/js/src/vm/String.h
index 73794cc25ee..71319b8f0cc 100644
--- a/js/src/vm/String.h
+++ b/js/src/vm/String.h
@@ -140,7 +140,7 @@ class JSString : public js::gc::BarrieredCell<JSString>
 {
   protected:
     static const size_t NUM_INLINE_CHARS_LATIN1 = 2 * sizeof(void *) / sizeof(char);
-    static const size_t NUM_INLINE_CHARS_TWO_BYTE = 2 * sizeof(void *) / sizeof(jschar);
+    static const size_t NUM_INLINE_CHARS_TWO_BYTE = 2 * sizeof(void *) / sizeof(char16_t);
 
     /* Fields only apply to string types commented on the right. */
     struct Data
@@ -156,12 +156,12 @@ class JSString : public js::gc::BarrieredCell<JSString>
             union {
                 /* JS(Fat)InlineString */
                 JS::Latin1Char     inlineStorageLatin1[NUM_INLINE_CHARS_LATIN1];
-                jschar             inlineStorageTwoByte[NUM_INLINE_CHARS_TWO_BYTE];
+                char16_t           inlineStorageTwoByte[NUM_INLINE_CHARS_TWO_BYTE];
             };
             struct {
                 union {
                     const JS::Latin1Char *nonInlineCharsLatin1; /* JSLinearString, except JS(Fat)InlineString */
-                    const jschar   *nonInlineCharsTwoByte;/* JSLinearString, except JS(Fat)InlineString */
+                    const char16_t *nonInlineCharsTwoByte;/* JSLinearString, except JS(Fat)InlineString */
                     JSString       *left;               /* JSRope */
                 } u2;
                 union {
@@ -275,7 +275,7 @@ class JSString : public js::gc::BarrieredCell<JSString>
                       "Inline chars must fit in a JSString");
         static_assert(sizeof(JSString) ==
                       (offsetof(JSString, d.inlineStorageTwoByte) +
-                       NUM_INLINE_CHARS_TWO_BYTE * sizeof(jschar)),
+                       NUM_INLINE_CHARS_TWO_BYTE * sizeof(char16_t)),
                       "Inline chars must fit in a JSString");
 
         /* Ensure js::shadow::String has the same layout. */
@@ -323,7 +323,7 @@ class JSString : public js::gc::BarrieredCell<JSString>
         return d.u1.length == 0;
     }
 
-    inline bool getChar(js::ExclusiveContext *cx, size_t index, jschar *code);
+    inline bool getChar(js::ExclusiveContext *cx, size_t index, char16_t *code);
 
     /* Strings have either Latin1 or TwoByte chars. */
     bool hasLatin1Chars() const {
@@ -544,11 +544,11 @@ class JSRope : public JSString
 
     bool copyLatin1Chars(js::ThreadSafeContext *cx,
                          js::ScopedJSFreePtr<JS::Latin1Char> &out) const;
-    bool copyTwoByteChars(js::ThreadSafeContext *cx, js::ScopedJSFreePtr<jschar> &out) const;
+    bool copyTwoByteChars(js::ThreadSafeContext *cx, js::ScopedJSFreePtr<char16_t> &out) const;
 
     bool copyLatin1CharsZ(js::ThreadSafeContext *cx,
                           js::ScopedJSFreePtr<JS::Latin1Char> &out) const;
-    bool copyTwoByteCharsZ(js::ThreadSafeContext *cx, js::ScopedJSFreePtr<jschar> &out) const;
+    bool copyTwoByteCharsZ(js::ThreadSafeContext *cx, js::ScopedJSFreePtr<char16_t> &out) const;
 
     template <typename CharT>
     bool copyChars(js::ThreadSafeContext *cx, js::ScopedJSFreePtr<CharT> &out) const;
@@ -597,7 +597,7 @@ class JSLinearString : public JSString
     }
 
     MOZ_ALWAYS_INLINE const JS::Latin1Char *rawLatin1Chars() const;
-    MOZ_ALWAYS_INLINE const jschar *rawTwoByteChars() const;
+    MOZ_ALWAYS_INLINE const char16_t *rawTwoByteChars() const;
 
   public:
     template<typename CharT>
@@ -612,7 +612,7 @@ class JSLinearString : public JSString
     }
 
     MOZ_ALWAYS_INLINE
-    const jschar *nonInlineTwoByteChars(const JS::AutoCheckCannotGC &nogc) const {
+    const char16_t *nonInlineTwoByteChars(const JS::AutoCheckCannotGC &nogc) const {
         JS_ASSERT(!isInline());
         JS_ASSERT(hasTwoByteChars());
         return d.s.u2.nonInlineCharsTwoByte;
@@ -628,7 +628,7 @@ class JSLinearString : public JSString
     }
 
     MOZ_ALWAYS_INLINE
-    const jschar *twoByteChars(const JS::AutoCheckCannotGC &nogc) const {
+    const char16_t *twoByteChars(const JS::AutoCheckCannotGC &nogc) const {
         return rawTwoByteChars();
     }
 
@@ -637,13 +637,13 @@ class JSLinearString : public JSString
         return mozilla::Range<const JS::Latin1Char>(latin1Chars(nogc), length());
     }
 
-    mozilla::Range<const jschar> twoByteRange(const JS::AutoCheckCannotGC &nogc) const {
+    mozilla::Range<const char16_t> twoByteRange(const JS::AutoCheckCannotGC &nogc) const {
         JS_ASSERT(JSString::isLinear());
-        return mozilla::Range<const jschar>(twoByteChars(nogc), length());
+        return mozilla::Range<const char16_t>(twoByteChars(nogc), length());
     }
 
     MOZ_ALWAYS_INLINE
-    jschar latin1OrTwoByteChar(size_t index) const {
+    char16_t latin1OrTwoByteChar(size_t index) const {
         MOZ_ASSERT(JSString::isLinear());
         MOZ_ASSERT(index < length());
         JS::AutoCheckCannotGC nogc;
@@ -698,7 +698,7 @@ class JSFlatString : public JSLinearString
     template <typename CharT>
     static bool isIndexSlow(const CharT *s, size_t length, uint32_t *indexp);
 
-    void init(const jschar *chars, size_t length);
+    void init(const char16_t *chars, size_t length);
     void init(const JS::Latin1Char *chars, size_t length);
 
   public:
@@ -719,7 +719,7 @@ class JSFlatString : public JSLinearString
             const JS::Latin1Char *s = latin1Chars(nogc);
             return JS7_ISDEC(*s) && isIndexSlow(s, length(), indexp);
         }
-        const jschar *s = twoByteChars(nogc);
+        const char16_t *s = twoByteChars(nogc);
         return JS7_ISDEC(*s) && isIndexSlow(s, length(), indexp);
     }
 
@@ -778,7 +778,7 @@ class JSInlineString : public JSFlatString
     template <js::AllowGC allowGC>
     static inline JSInlineString *new_(js::ThreadSafeContext *cx);
 
-    inline jschar *initTwoByte(size_t length);
+    inline char16_t *initTwoByte(size_t length);
     inline JS::Latin1Char *initLatin1(size_t length);
 
     template <typename CharT>
@@ -794,7 +794,7 @@ class JSInlineString : public JSFlatString
     }
 
     MOZ_ALWAYS_INLINE
-    const jschar *twoByteChars(const JS::AutoCheckCannotGC &nogc) const {
+    const char16_t *twoByteChars(const JS::AutoCheckCannotGC &nogc) const {
         JS_ASSERT(JSString::isInline());
         JS_ASSERT(hasTwoByteChars());
         return d.inlineStorageTwoByte;
@@ -836,10 +836,10 @@ class JSFatInlineString : public JSInlineString
 
     static void staticAsserts() {
         JS_STATIC_ASSERT((INLINE_EXTENSION_CHARS_LATIN1 * sizeof(char)) % js::gc::CellSize == 0);
-        JS_STATIC_ASSERT((INLINE_EXTENSION_CHARS_TWO_BYTE * sizeof(jschar)) % js::gc::CellSize == 0);
+        JS_STATIC_ASSERT((INLINE_EXTENSION_CHARS_TWO_BYTE * sizeof(char16_t)) % js::gc::CellSize == 0);
         JS_STATIC_ASSERT(MAX_LENGTH_TWO_BYTE + 1 ==
                          (sizeof(JSFatInlineString) -
-                          offsetof(JSFatInlineString, d.inlineStorageTwoByte)) / sizeof(jschar));
+                          offsetof(JSFatInlineString, d.inlineStorageTwoByte)) / sizeof(char16_t));
         JS_STATIC_ASSERT(MAX_LENGTH_LATIN1 + 1 ==
                          (sizeof(JSFatInlineString) -
                           offsetof(JSFatInlineString, d.inlineStorageLatin1)) / sizeof(char));
@@ -848,7 +848,7 @@ class JSFatInlineString : public JSInlineString
   protected: /* to fool clang into not warning this is unused */
     union {
         char   inlineStorageExtensionLatin1[INLINE_EXTENSION_CHARS_LATIN1];
-        jschar inlineStorageExtensionTwoByte[INLINE_EXTENSION_CHARS_TWO_BYTE];
+        char16_t inlineStorageExtensionTwoByte[INLINE_EXTENSION_CHARS_TWO_BYTE];
     };
 
   public:
@@ -863,7 +863,7 @@ class JSFatInlineString : public JSInlineString
                                               INLINE_EXTENSION_CHARS_TWO_BYTE
                                               -1 /* null terminator */;
 
-    inline jschar *initTwoByte(size_t length);
+    inline char16_t *initTwoByte(size_t length);
     inline JS::Latin1Char *initLatin1(size_t length);
 
     template <typename CharT>
@@ -888,14 +888,14 @@ JS_STATIC_ASSERT(sizeof(JSFatInlineString) % js::gc::CellSize == 0);
 
 class JSExternalString : public JSFlatString
 {
-    void init(const jschar *chars, size_t length, const JSStringFinalizer *fin);
+    void init(const char16_t *chars, size_t length, const JSStringFinalizer *fin);
 
     /* Vacuous and therefore unimplemented. */
     bool isExternal() const MOZ_DELETE;
     JSExternalString &asExternal() const MOZ_DELETE;
 
   public:
-    static inline JSExternalString *new_(JSContext *cx, const jschar *chars, size_t length,
+    static inline JSExternalString *new_(JSContext *cx, const char16_t *chars, size_t length,
                                          const JSStringFinalizer *fin);
 
     const JSStringFinalizer *externalFinalizer() const {
@@ -907,7 +907,7 @@ class JSExternalString : public JSFlatString
      * External chars are never allocated inline or in the nursery, so we can
      * safely expose this without requiring an AutoCheckCannotGC argument.
      */
-    const jschar *twoByteChars() const {
+    const char16_t *twoByteChars() const {
         return rawTwoByteChars();
     }
 
@@ -978,7 +978,7 @@ class ScopedThreadSafeStringInspector
     JSString *str_;
     ScopedJSFreePtr<void> scopedChars_;
     union {
-        const jschar *twoByteChars_;
+        const char16_t *twoByteChars_;
         const JS::Latin1Char *latin1Chars_;
     };
     enum State { Uninitialized, Latin1, TwoByte };
@@ -995,7 +995,7 @@ class ScopedThreadSafeStringInspector
     bool hasTwoByteChars() const { return state_ == TwoByte; }
     bool hasLatin1Chars() const { return state_ == Latin1; }
 
-    const jschar *twoByteChars() const {
+    const char16_t *twoByteChars() const {
         MOZ_ASSERT(state_ == TwoByte);
         return twoByteChars_;
     }
@@ -1008,9 +1008,9 @@ class ScopedThreadSafeStringInspector
         MOZ_ASSERT(state_ == Latin1);
         return mozilla::Range<const Latin1Char>(latin1Chars_, str_->length());
     }
-    mozilla::Range<const jschar> twoByteRange() const {
+    mozilla::Range<const char16_t> twoByteRange() const {
         MOZ_ASSERT(state_ == TwoByte);
-        return mozilla::Range<const jschar>(twoByteChars_, str_->length());
+        return mozilla::Range<const char16_t>(twoByteChars_, str_->length());
     }
 };
 
@@ -1054,9 +1054,9 @@ class StaticStrings
         return getUint(uint32_t(i));
     }
 
-    static bool hasUnit(jschar c) { return c < UNIT_STATIC_LIMIT; }
+    static bool hasUnit(char16_t c) { return c < UNIT_STATIC_LIMIT; }
 
-    JSAtom *getUnit(jschar c) {
+    JSAtom *getUnit(char16_t c) {
         JS_ASSERT(hasUnit(c));
         return unitStaticTable[c];
     }
@@ -1073,7 +1073,7 @@ class StaticStrings
     JSAtom *lookup(const CharT *chars, size_t length) {
         switch (length) {
           case 1: {
-            jschar c = chars[0];
+            char16_t c = chars[0];
             if (c < UNIT_STATIC_LIMIT)
                 return getUnit(c);
             return nullptr;
@@ -1110,13 +1110,13 @@ class StaticStrings
     typedef uint8_t SmallChar;
     static const SmallChar INVALID_SMALL_CHAR = -1;
 
-    static bool fitsInSmallChar(jschar c) {
+    static bool fitsInSmallChar(char16_t c) {
         return c < SMALL_CHAR_LIMIT && toSmallChar[c] != INVALID_SMALL_CHAR;
     }
 
     static const SmallChar toSmallChar[];
 
-    JSAtom *getLength2(jschar c1, jschar c2);
+    JSAtom *getLength2(char16_t c1, char16_t c2);
     JSAtom *getLength2(uint32_t u) {
         JS_ASSERT(u < 100);
         return getLength2('0' + u / 10, '0' + u % 10);
@@ -1204,7 +1204,7 @@ NewStringCopyNDontDeflate(js::ThreadSafeContext *cx, const CharT *s, size_t n);
 /* Copy a C string and GC-allocate a descriptor for it. */
 template <js::AllowGC allowGC>
 inline JSFlatString *
-NewStringCopyZ(js::ExclusiveContext *cx, const jschar *s)
+NewStringCopyZ(js::ExclusiveContext *cx, const char16_t *s)
 {
     return NewStringCopyN<allowGC>(cx, s, js_strlen(s));
 }
@@ -1224,7 +1224,7 @@ class JSAddonId : public JSAtom
 {};
 
 MOZ_ALWAYS_INLINE bool
-JSString::getChar(js::ExclusiveContext *cx, size_t index, jschar *code)
+JSString::getChar(js::ExclusiveContext *cx, size_t index, char16_t *code)
 {
     JS_ASSERT(index < length());
 
@@ -1284,7 +1284,7 @@ JSString::base() const
 }
 
 template<>
-MOZ_ALWAYS_INLINE const jschar *
+MOZ_ALWAYS_INLINE const char16_t *
 JSLinearString::nonInlineChars(const JS::AutoCheckCannotGC &nogc) const
 {
     return nonInlineTwoByteChars(nogc);
@@ -1298,7 +1298,7 @@ JSLinearString::nonInlineChars(const JS::AutoCheckCannotGC &nogc) const
 }
 
 template<>
-MOZ_ALWAYS_INLINE const jschar *
+MOZ_ALWAYS_INLINE const char16_t *
 JSLinearString::chars(const JS::AutoCheckCannotGC &nogc) const
 {
     return rawTwoByteChars();
@@ -1321,7 +1321,7 @@ JSRope::copyChars<JS::Latin1Char>(js::ThreadSafeContext *cx,
 
 template <>
 MOZ_ALWAYS_INLINE bool
-JSRope::copyChars<jschar>(js::ThreadSafeContext *cx, js::ScopedJSFreePtr<jschar> &out) const
+JSRope::copyChars<char16_t>(js::ThreadSafeContext *cx, js::ScopedJSFreePtr<char16_t> &out) const
 {
     return copyTwoByteChars(cx, out);
 }
@@ -1335,7 +1335,7 @@ JSInlineString::lengthFits<JS::Latin1Char>(size_t length)
 
 template<>
 MOZ_ALWAYS_INLINE bool
-JSInlineString::lengthFits<jschar>(size_t length)
+JSInlineString::lengthFits<char16_t>(size_t length)
 {
     return twoByteLengthFits(length);
 }
@@ -1349,14 +1349,14 @@ JSFatInlineString::lengthFits<JS::Latin1Char>(size_t length)
 
 template<>
 MOZ_ALWAYS_INLINE bool
-JSFatInlineString::lengthFits<jschar>(size_t length)
+JSFatInlineString::lengthFits<char16_t>(size_t length)
 {
     return twoByteLengthFits(length);
 }
 
 template<>
 MOZ_ALWAYS_INLINE void
-JSString::setNonInlineChars(const jschar *chars)
+JSString::setNonInlineChars(const char16_t *chars)
 {
     d.s.u2.nonInlineCharsTwoByte = chars;
 }
@@ -1376,7 +1376,7 @@ JSLinearString::rawLatin1Chars() const
     return isInline() ? d.inlineStorageLatin1 : d.s.u2.nonInlineCharsLatin1;
 }
 
-MOZ_ALWAYS_INLINE const jschar *
+MOZ_ALWAYS_INLINE const char16_t *
 JSLinearString::rawTwoByteChars() const
 {
     JS_ASSERT(JSString::isLinear());
diff --git a/js/src/vm/StringBuffer.cpp b/js/src/vm/StringBuffer.cpp
index a26278048d2..53821406ea8 100644
--- a/js/src/vm/StringBuffer.cpp
+++ b/js/src/vm/StringBuffer.cpp
@@ -39,13 +39,13 @@ ExtractWellSized(ExclusiveContext *cx, Buffer &cb)
     return buf;
 }
 
-jschar *
+char16_t *
 StringBuffer::stealChars()
 {
     if (isLatin1() && !inflateChars())
         return nullptr;
 
-    return ExtractWellSized<jschar>(cx, twoByteChars());
+    return ExtractWellSized<char16_t>(cx, twoByteChars());
 }
 
 bool
@@ -117,14 +117,14 @@ StringBuffer::finishString()
         }
     } else {
         if (JSFatInlineString::twoByteLengthFits(len)) {
-            mozilla::Range<const jschar> range(twoByteChars().begin(), len);
+            mozilla::Range<const char16_t> range(twoByteChars().begin(), len);
             return NewFatInlineString<CanGC>(cx, range);
         }
     }
 
     return isLatin1()
         ? FinishStringFlat<Latin1Char>(cx, *this, latin1Chars())
-        : FinishStringFlat<jschar>(cx, *this, twoByteChars());
+        : FinishStringFlat<char16_t>(cx, *this, twoByteChars());
 }
 
 JSAtom *
diff --git a/js/src/vm/StringBuffer.h b/js/src/vm/StringBuffer.h
index 81238092f36..7014c48d35d 100644
--- a/js/src/vm/StringBuffer.h
+++ b/js/src/vm/StringBuffer.h
@@ -34,7 +34,7 @@ class StringBuffer
      * TempAllocPolicy and account for the memory manually when stealing.
      */
     typedef Vector<Latin1Char, 64> Latin1CharBuffer;
-    typedef Vector<jschar, 32> TwoByteCharBuffer;
+    typedef Vector<char16_t, 32> TwoByteCharBuffer;
 
     ExclusiveContext *cx;
 
@@ -47,7 +47,7 @@ class StringBuffer
 
     /*
      * Make sure ensureTwoByteChars() is called before calling
-     * infallibleAppend(jschar).
+     * infallibleAppend(char16_t).
      */
     mozilla::DebugOnly<bool> hasEnsuredTwoByteChars_;
 
@@ -93,7 +93,7 @@ class StringBuffer
     inline size_t length() const {
         return isLatin1() ? latin1Chars().length() : twoByteChars().length();
     }
-    inline jschar getChar(size_t idx) const {
+    inline char16_t getChar(size_t idx) const {
         return isLatin1() ? latin1Chars()[idx] : twoByteChars()[idx];
     }
 
@@ -105,7 +105,7 @@ class StringBuffer
         return true;
     }
 
-    inline bool append(const jschar c) {
+    inline bool append(const char16_t c) {
         if (isLatin1()) {
             if (c <= JSString::MAX_LATIN1_CHAR)
                 return latin1Chars().append(Latin1Char(c));
@@ -121,8 +121,8 @@ class StringBuffer
         return append(Latin1Char(c));
     }
 
-    inline bool append(const jschar *begin, const jschar *end);
-    inline bool append(const jschar *chars, size_t len) {
+    inline bool append(const char16_t *begin, const char16_t *end);
+    inline bool append(const char16_t *chars, size_t len) {
         return append(chars, chars + len);
     }
 
@@ -180,21 +180,21 @@ class StringBuffer
      * Because inflation is fallible, these methods should only be used after
      * calling ensureTwoByteChars().
      */
-    void infallibleAppend(const jschar *chars, size_t len) {
+    void infallibleAppend(const char16_t *chars, size_t len) {
         MOZ_ASSERT(hasEnsuredTwoByteChars_);
         twoByteChars().infallibleAppend(chars, len);
     }
-    void infallibleAppend(jschar c) {
+    void infallibleAppend(char16_t c) {
         MOZ_ASSERT(hasEnsuredTwoByteChars_);
         twoByteChars().infallibleAppend(c);
     }
 
     bool isUnderlyingBufferLatin1() const { return isLatin1(); }
 
-    jschar *rawTwoByteBegin() { return twoByteChars().begin(); }
-    jschar *rawTwoByteEnd() { return twoByteChars().end(); }
-    const jschar *rawTwoByteBegin() const { return twoByteChars().begin(); }
-    const jschar *rawTwoByteEnd() const { return twoByteChars().end(); }
+    char16_t *rawTwoByteBegin() { return twoByteChars().begin(); }
+    char16_t *rawTwoByteEnd() { return twoByteChars().end(); }
+    const char16_t *rawTwoByteBegin() const { return twoByteChars().begin(); }
+    const char16_t *rawTwoByteEnd() const { return twoByteChars().end(); }
 
     Latin1Char *rawLatin1Begin() { return latin1Chars().begin(); }
     Latin1Char *rawLatin1End() { return latin1Chars().end(); }
@@ -215,11 +215,11 @@ class StringBuffer
      * exactly the characters in this buffer (inflated to TwoByte), it is *not*
      * null-terminated unless the last appended character was '\0'.
      */
-    jschar *stealChars();
+    char16_t *stealChars();
 };
 
 inline bool
-StringBuffer::append(const jschar *begin, const jschar *end)
+StringBuffer::append(const char16_t *begin, const char16_t *end)
 {
     MOZ_ASSERT(begin <= end);
     if (isLatin1()) {
diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
index 232dd352c96..1d19acecba1 100644
--- a/js/src/vm/StructuredClone.cpp
+++ b/js/src/vm/StructuredClone.cpp
@@ -141,7 +141,7 @@ struct SCOutput {
     bool writeDouble(double d);
     bool writeBytes(const void *p, size_t nbytes);
     bool writeChars(const Latin1Char *p, size_t nchars);
-    bool writeChars(const jschar *p, size_t nchars);
+    bool writeChars(const char16_t *p, size_t nchars);
     bool writePtr(const void *);
 
     template <class T>
@@ -172,7 +172,7 @@ class SCInput {
     bool readDouble(double *p);
     bool readBytes(void *p, size_t nbytes);
     bool readChars(Latin1Char *p, size_t nchars);
-    bool readChars(jschar *p, size_t nchars);
+    bool readChars(char16_t *p, size_t nchars);
     bool readPtr(void **);
 
     bool get(uint64_t *p);
@@ -192,7 +192,7 @@ class SCInput {
 
   private:
     void staticAssertions() {
-        JS_STATIC_ASSERT(sizeof(jschar) == 2);
+        JS_STATIC_ASSERT(sizeof(char16_t) == 2);
         JS_STATIC_ASSERT(sizeof(uint32_t) == 4);
         JS_STATIC_ASSERT(sizeof(double) == 8);
     }
@@ -574,9 +574,9 @@ SCInput::readChars(Latin1Char *p, size_t nchars)
 }
 
 bool
-SCInput::readChars(jschar *p, size_t nchars)
+SCInput::readChars(char16_t *p, size_t nchars)
 {
-    JS_ASSERT(sizeof(jschar) == sizeof(uint16_t));
+    JS_ASSERT(sizeof(char16_t) == sizeof(uint16_t));
     return readArray((uint16_t *) p, nchars);
 }
 
@@ -703,9 +703,9 @@ SCOutput::writeBytes(const void *p, size_t nbytes)
 }
 
 bool
-SCOutput::writeChars(const jschar *p, size_t nchars)
+SCOutput::writeChars(const char16_t *p, size_t nchars)
 {
-    JS_ASSERT(sizeof(jschar) == sizeof(uint16_t));
+    JS_ASSERT(sizeof(char16_t) == sizeof(uint16_t));
     return writeArray((const uint16_t *) p, nchars);
 }
 
@@ -966,7 +966,7 @@ JSStructuredCloneWriter::traverseSet(HandleObject obj)
         RootedObject unwrapped(context(), CheckedUnwrap(obj));
         MOZ_ASSERT(unwrapped);
         JSAutoCompartment ac(context(), unwrapped);
-        if (!SetObject::keys(context(), obj, &keys))
+        if (!SetObject::keys(context(), unwrapped, &keys))
             return false;
     }
     if (!context()->compartment()->wrap(context(), keys))
@@ -1293,7 +1293,7 @@ JSStructuredCloneReader::readString(uint32_t data)
 {
     uint32_t nchars = data & JS_BITMASK(31);
     bool latin1 = data & (1 << 31);
-    return latin1 ? readStringImpl<Latin1Char>(nchars) : readStringImpl<jschar>(nchars);
+    return latin1 ? readStringImpl<Latin1Char>(nchars) : readStringImpl<char16_t>(nchars);
 }
 
 static uint32_t
diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
index b4b7afd4c41..21092d4a337 100644
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@@ -2618,7 +2618,7 @@ js::StringIsTypedArrayIndex(const CharT *s, size_t length, uint64_t *indexp)
 }
 
 template bool
-js::StringIsTypedArrayIndex(const jschar *s, size_t length, uint64_t *indexp);
+js::StringIsTypedArrayIndex(const char16_t *s, size_t length, uint64_t *indexp);
 
 template bool
 js::StringIsTypedArrayIndex(const Latin1Char *s, size_t length, uint64_t *indexp);
diff --git a/js/src/vm/TypedArrayObject.h b/js/src/vm/TypedArrayObject.h
index 35393fee8a6..7ba869036e0 100644
--- a/js/src/vm/TypedArrayObject.h
+++ b/js/src/vm/TypedArrayObject.h
@@ -183,7 +183,7 @@ IsTypedArrayIndex(jsid id, uint64_t *indexp)
         return StringIsTypedArrayIndex(s, length, indexp);
     }
 
-    const jschar *s = atom->twoByteChars(nogc);
+    const char16_t *s = atom->twoByteChars(nogc);
     if (!JS7_ISDEC(*s) && *s != '-')
         return false;
     return StringIsTypedArrayIndex(s, length, indexp);
diff --git a/js/src/vm/UbiNode.cpp b/js/src/vm/UbiNode.cpp
index d4ca53c366f..b79d4c3d5b1 100644
--- a/js/src/vm/UbiNode.cpp
+++ b/js/src/vm/UbiNode.cpp
@@ -28,7 +28,7 @@ using JS::ubi::Node;
 using JS::ubi::TracerConcrete;
 
 // All operations on null ubi::Nodes crash.
-const jschar *Concrete<void>::typeName() const            { MOZ_CRASH("null ubi::Node"); }
+const char16_t *Concrete<void>::typeName() const          { MOZ_CRASH("null ubi::Node"); }
 size_t Concrete<void>::size() const                       { MOZ_CRASH("null ubi::Node"); }
 EdgeRange *Concrete<void>::edges(JSContext *, bool) const { MOZ_CRASH("null ubi::Node"); }
 JS::Zone *Concrete<void>::zone() const                    { MOZ_CRASH("null ubi::Node"); }
@@ -99,12 +99,12 @@ class SimpleEdge : public Edge {
     SimpleEdge() : Edge() { }
 
     // Construct an initialized SimpleEdge, taking ownership of |name|.
-    SimpleEdge(jschar *name, const Node &referent) {
+    SimpleEdge(char16_t *name, const Node &referent) {
         this->name = name;
         this->referent = referent;
     }
     ~SimpleEdge() {
-        js_free(const_cast<jschar *>(name));
+        js_free(const_cast<char16_t *>(name));
     }
 
     // Move construction and assignment.
@@ -143,30 +143,30 @@ class SimpleEdgeVectorTracer : public JSTracer {
         if (!okay)
             return;
 
-        jschar *jsname = nullptr;
+        char16_t *name16 = nullptr;
         if (wantNames) {
             // Ask the tracer to compute an edge name for us.
             char buffer[1024];
             const char *name = getTracingEdgeName(buffer, sizeof(buffer));
 
-            // Convert the name to jschars.
-            jsname = js_pod_malloc<jschar>(strlen(name) + 1);
-            if (!jsname) {
+            // Convert the name to char16_t characters.
+            name16 = js_pod_malloc<char16_t>(strlen(name) + 1);
+            if (!name16) {
                 okay = false;
                 return;
             }
 
             size_t i;
             for (i = 0; name[i]; i++)
-                jsname[i] = name[i];
-            jsname[i] = '\0';
+                name16[i] = name[i];
+            name16[i] = '\0';
         }
 
         // The simplest code is correct! The temporary SimpleEdge takes
         // ownership of name; if the append succeeds, the vector element
         // then takes ownership; if the append fails, then the temporary
         // retains it, and its destructor will free it.
-        if (!vec->append(mozilla::Move(SimpleEdge(jsname, Node(kind, *thingp))))) {
+        if (!vec->append(mozilla::Move(SimpleEdge(name16, Node(kind, *thingp))))) {
             okay = false;
             return;
         }
@@ -222,21 +222,21 @@ TracerConcrete<Referent>::edges(JSContext *cx, bool wantNames) const {
     return r.forget();
 }
 
-template<> const jschar TracerConcrete<JSObject>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<JSObject>::concreteTypeName[] =
     MOZ_UTF16("JSObject");
-template<> const jschar TracerConcrete<JSString>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<JSString>::concreteTypeName[] =
     MOZ_UTF16("JSString");
-template<> const jschar TracerConcrete<JS::Symbol>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<JS::Symbol>::concreteTypeName[] =
     MOZ_UTF16("JS::Symbol");
-template<> const jschar TracerConcrete<JSScript>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<JSScript>::concreteTypeName[] =
     MOZ_UTF16("JSScript");
-template<> const jschar TracerConcrete<js::LazyScript>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<js::LazyScript>::concreteTypeName[] =
     MOZ_UTF16("js::LazyScript");
-template<> const jschar TracerConcrete<js::jit::JitCode>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<js::jit::JitCode>::concreteTypeName[] =
     MOZ_UTF16("js::jit::JitCode");
-template<> const jschar TracerConcrete<js::Shape>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<js::Shape>::concreteTypeName[] =
     MOZ_UTF16("js::Shape");
-template<> const jschar TracerConcrete<js::BaseShape>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<js::BaseShape>::concreteTypeName[] =
     MOZ_UTF16("js::BaseShape");
-template<> const jschar TracerConcrete<js::types::TypeObject>::concreteTypeName[] =
+template<> const char16_t TracerConcrete<js::types::TypeObject>::concreteTypeName[] =
     MOZ_UTF16("js::types::TypeObject");
diff --git a/js/src/vm/Unicode.cpp b/js/src/vm/Unicode.cpp
index f6b03a18db4..b110fbc5db8 100644
--- a/js/src/vm/Unicode.cpp
+++ b/js/src/vm/Unicode.cpp
@@ -11,16 +11,16 @@ using namespace js::unicode;
 
 /*
  * So how does indexing work?
- * First let's have a look at a jschar, 16-bits:
+ * First let's have a look at a char16_t, 16-bits:
  *              [................]
  * Step 1:
- *  Extracting the upper 11 bits from the jschar.
+ *  Extracting the upper 11 bits from the char16_t.
  *   upper = char >>  5 ([***********.....])
  * Step 2:
  *  Using these bits to get an reduced index from index1.
  *   index = index1[upper]
  * Step 3:
- *  Combining the index and the bottom 5 bits of the original jschar.
+ *  Combining the index and the bottom 5 bits of the original char16_t.
  *   real_index = index2[(index << 5) + (char & ((1 << 5) - 1))] ([...********+++++])
  *
  * The advantage here is that the biggest number in index1 doesn't need 10 bits,
@@ -31,7 +31,7 @@ using namespace js::unicode;
  *
  * Pseudocode of generation:
  *
- * let table be the mapping of jschar => js_charinfo_index
+ * let table be the mapping of char16_t => js_charinfo_index
  * let index1 be an empty array
  * let index2 be an empty array
  * let cache be a hash map
diff --git a/js/src/vm/Unicode.h b/js/src/vm/Unicode.h
index c8e6b14f41b..a5f33060996 100644
--- a/js/src/vm/Unicode.h
+++ b/js/src/vm/Unicode.h
@@ -64,8 +64,8 @@ struct CharFlag {
     };
 };
 
-const jschar BYTE_ORDER_MARK2 = 0xFFFE;
-const jschar NO_BREAK_SPACE  = 0x00A0;
+const char16_t BYTE_ORDER_MARK2 = 0xFFFE;
+const char16_t NO_BREAK_SPACE  = 0x00A0;
 
 class CharacterInfo {
     /*
@@ -107,7 +107,7 @@ extern const uint8_t index2[];
 extern const CharacterInfo js_charinfo[];
 
 inline const CharacterInfo&
-CharInfo(jschar code)
+CharInfo(char16_t code)
 {
     const size_t shift = 5;
     size_t index = index1[code >> shift];
@@ -117,7 +117,7 @@ CharInfo(jschar code)
 }
 
 inline bool
-IsIdentifierStart(jschar ch)
+IsIdentifierStart(char16_t ch)
 {
     /*
      * ES5 7.6 IdentifierStart
@@ -135,7 +135,7 @@ IsIdentifierStart(jschar ch)
 }
 
 inline bool
-IsIdentifierPart(jschar ch)
+IsIdentifierPart(char16_t ch)
 {
     /* Matches ES5 7.6 IdentifierPart. */
 
@@ -146,13 +146,13 @@ IsIdentifierPart(jschar ch)
 }
 
 inline bool
-IsLetter(jschar ch)
+IsLetter(char16_t ch)
 {
     return CharInfo(ch).isLetter();
 }
 
 inline bool
-IsSpace(jschar ch)
+IsSpace(char16_t ch)
 {
     /*
      * IsSpace checks if some character is included in the merged set
@@ -176,7 +176,7 @@ IsSpace(jschar ch)
 }
 
 inline bool
-IsSpaceOrBOM2(jschar ch)
+IsSpaceOrBOM2(char16_t ch)
 {
     if (ch < 128)
         return js_isspace[ch];
@@ -188,16 +188,16 @@ IsSpaceOrBOM2(jschar ch)
     return CharInfo(ch).isSpace();
 }
 
-inline jschar
-ToUpperCase(jschar ch)
+inline char16_t
+ToUpperCase(char16_t ch)
 {
     const CharacterInfo &info = CharInfo(ch);
 
     return uint16_t(ch) + info.upperCase;
 }
 
-inline jschar
-ToLowerCase(jschar ch)
+inline char16_t
+ToLowerCase(char16_t ch)
 {
     const CharacterInfo &info = CharInfo(ch);
 
diff --git a/js/src/vm/Xdr.cpp b/js/src/vm/Xdr.cpp
index fbdb88b6957..e877eff4a8b 100644
--- a/js/src/vm/Xdr.cpp
+++ b/js/src/vm/Xdr.cpp
@@ -67,9 +67,9 @@ XDRState<mode>::codeChars(const Latin1Char *chars, size_t nchars)
 
 template<XDRMode mode>
 bool
-XDRState<mode>::codeChars(jschar *chars, size_t nchars)
+XDRState<mode>::codeChars(char16_t *chars, size_t nchars)
 {
-    size_t nbytes = nchars * sizeof(jschar);
+    size_t nbytes = nchars * sizeof(char16_t);
     if (mode == XDR_ENCODE) {
         uint8_t *ptr = buf.write(nbytes);
         if (!ptr)
diff --git a/js/src/vm/Xdr.h b/js/src/vm/Xdr.h
index 8309e1e64cf..16a5dfe3172 100644
--- a/js/src/vm/Xdr.h
+++ b/js/src/vm/Xdr.h
@@ -230,7 +230,7 @@ class XDRState {
     }
 
     bool codeChars(const JS::Latin1Char *chars, size_t nchars);
-    bool codeChars(jschar *chars, size_t nchars);
+    bool codeChars(char16_t *chars, size_t nchars);
 
     bool codeFunction(JS::MutableHandleObject objp);
     bool codeScript(MutableHandleScript scriptp);
diff --git a/js/src/vm/make_unicode.py b/js/src/vm/make_unicode.py
index 7862da66cd2..16e521da934 100644
--- a/js/src/vm/make_unicode.py
+++ b/js/src/vm/make_unicode.py
@@ -202,16 +202,16 @@ if (typeof reportCompare === "function")
     comment = """
 /*
  * So how does indexing work?
- * First let's have a look at a jschar, 16-bits:
+ * First let's have a look at a char16_t, 16-bits:
  *              [................]
  * Step 1:
- *  Extracting the upper 11 bits from the jschar.
+ *  Extracting the upper 11 bits from the char16_t.
  *   upper = char >>  5 ([***********.....])
  * Step 2:
  *  Using these bits to get an reduced index from index1.
  *   index = index1[upper]
  * Step 3:
- *  Combining the index and the bottom 5 bits of the original jschar.
+ *  Combining the index and the bottom 5 bits of the original char16_t.
  *   real_index = index2[(index << 5) + (char & ((1 << 5) - 1))] ([...********+++++])
  *
  * The advantage here is that the biggest number in index1 doesn't need 10 bits,
@@ -222,7 +222,7 @@ if (typeof reportCompare === "function")
  *
  * Pseudocode of generation:
  *
- * let table be the mapping of jschar => js_charinfo_index
+ * let table be the mapping of char16_t => js_charinfo_index
  * let index1 be an empty array
  * let index2 be an empty array
  * let cache be a hash map
diff --git a/js/xpconnect/idl/nsIXPCScriptable.idl b/js/xpconnect/idl/nsIXPCScriptable.idl
index 9c7aa2cabab..601006df584 100644
--- a/js/xpconnect/idl/nsIXPCScriptable.idl
+++ b/js/xpconnect/idl/nsIXPCScriptable.idl
@@ -31,7 +31,7 @@ interface nsIXPConnectWrappedNative;
  * boolean to PR_TRUE before making the call.  Implementations may skip writing
  * to *_retval unless they want to return PR_FALSE.
  */
-[uuid(9bae4ff5-5618-4ccd-b106-8e21e3fb64d3)]
+[uuid(d945a647-a60e-462d-9635-c79d5fa694ce)]
 interface nsIXPCScriptable : nsISupports
 {
     /* bitflags used for 'flags' (only 32 bits available!) */
@@ -64,8 +64,6 @@ interface nsIXPCScriptable : nsISupports
     const uint32_t ALLOW_PROP_MODS_TO_PROTOTYPE     = 1 << 25;
     const uint32_t IS_GLOBAL_OBJECT                 = 1 << 26;
     const uint32_t DONT_REFLECT_INTERFACE_NAMES     = 1 << 27;
-    // Unused bit here!
-    const uint32_t WANT_OUTER_OBJECT                = 1 << 29;
 
     // The high order bit is RESERVED for consumers of these flags. 
     // No implementor of this interface should ever return flags 
@@ -140,9 +138,6 @@ interface nsIXPCScriptable : nsISupports
                        in JSContextPtr cx, in JSObjectPtr obj,
                        in jsval val, out boolean bp);
 
-    JSObjectPtr outerObject(in nsIXPConnectWrappedNative wrapper,
-                            in JSContextPtr cx, in JSObjectPtr obj);
-
     void postCreatePrototype(in JSContextPtr cx, in JSObjectPtr proto);
 };
 
diff --git a/js/xpconnect/idl/nsIXPConnect.idl b/js/xpconnect/idl/nsIXPConnect.idl
index 202c965fa23..dfb858d0412 100644
--- a/js/xpconnect/idl/nsIXPConnect.idl
+++ b/js/xpconnect/idl/nsIXPConnect.idl
@@ -274,7 +274,7 @@ interface nsIXPCFunctionThisTranslator : nsISupports
     { 0xbd, 0xd6, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74 } }
 %}
 
-[noscript, uuid(89b8525d-5c22-48bd-8a79-66aac9cd705e)]
+[noscript, uuid(a632b020-331f-11e4-8c21-0800200c9a66)]
 interface nsIXPConnect : nsISupports
 {
 %{ C++
@@ -572,11 +572,4 @@ interface nsIXPConnect : nsISupports
 
     [noscript] JSObjectPtr readFunction(in nsIObjectInputStream aStream,
                                         in JSContextPtr aJSContext);
-
-    /**
-     * This function should be called in JavaScript error reporters
-     * to signal that they are ignoring the error. In this case,
-     * XPConnect can print a warning to the console.
-     */
-    [noscript] void markErrorUnreported(in JSContextPtr aJSContext);
 };
diff --git a/js/xpconnect/loader/mozJSSubScriptLoader.cpp b/js/xpconnect/loader/mozJSSubScriptLoader.cpp
index 01d6fbe92fe..8f25de6b29d 100644
--- a/js/xpconnect/loader/mozJSSubScriptLoader.cpp
+++ b/js/xpconnect/loader/mozJSSubScriptLoader.cpp
@@ -23,7 +23,6 @@
 #include "jsfriendapi.h"
 #include "js/OldDebugAPI.h"
 #include "nsJSPrincipals.h"
-#include "xpcpublic.h" // For xpc::SystemErrorReporter
 #include "xpcprivate.h" // For xpc::OptionsBase
 #include "jswrapper.h"
 
@@ -134,14 +133,10 @@ mozJSSubScriptLoader::ReadScript(nsIURI *uri, JSContext *cx, JSObject *targetObj
     if (NS_FAILED(rv))
         return rv;
 
-    /* set our own error reporter so we can report any bad things as catchable
-     * exceptions, including the source/line number */
-    JSErrorReporter er = JS_SetErrorReporter(cx, xpc::SystemErrorReporter);
-
     JS::CompileOptions options(cx);
     options.setFileAndLine(uriStr, 1);
     if (!charset.IsVoid()) {
-        jschar *scriptBuf = nullptr;
+        char16_t *scriptBuf = nullptr;
         size_t scriptLength = 0;
 
         rv = nsScriptLoader::ConvertToUTF16(nullptr, reinterpret_cast<const uint8_t*>(buf.get()), len,
@@ -175,9 +170,6 @@ mozJSSubScriptLoader::ReadScript(nsIURI *uri, JSContext *cx, JSObject *targetObj
         }
     }
 
-    /* repent for our evil deeds */
-    JS_SetErrorReporter(cx, er);
-
     return NS_OK;
 }
 
@@ -402,7 +394,7 @@ private:
     nsRefPtr<nsIObserver> mObserver;
     nsRefPtr<nsIPrincipal> mPrincipal;
     nsRefPtr<nsIChannel> mChannel;
-    jschar* mScriptBuf;
+    char16_t* mScriptBuf;
     size_t mScriptLength;
 };
 
@@ -478,7 +470,7 @@ ScriptPrecompiler::OnStreamComplete(nsIStreamLoader* aLoader,
     // Just notify that we are done with this load.
     NS_ENSURE_SUCCESS(aStatus, NS_OK);
 
-    // Convert data to jschar* and prepare to call CompileOffThread.
+    // Convert data to char16_t* and prepare to call CompileOffThread.
     nsAutoString hintCharset;
     nsresult rv =
         nsScriptLoader::ConvertToUTF16(mChannel, aString, aLength,
diff --git a/js/xpconnect/public/xpc_map_end.h b/js/xpconnect/public/xpc_map_end.h
index 4288e3eba0d..05de032a63d 100644
--- a/js/xpconnect/public/xpc_map_end.h
+++ b/js/xpconnect/public/xpc_map_end.h
@@ -76,9 +76,6 @@ XPC_MAP_CLASSNAME::GetScriptableFlags()
 #ifdef XPC_MAP_WANT_HASINSTANCE
     nsIXPCScriptable::WANT_HASINSTANCE |
 #endif
-#ifdef XPC_MAP_WANT_OUTER_OBJECT
-    nsIXPCScriptable::WANT_OUTER_OBJECT |
-#endif
 #ifdef XPC_MAP_FLAGS
     XPC_MAP_FLAGS |
 #endif
@@ -166,11 +163,6 @@ NS_IMETHODIMP XPC_MAP_CLASSNAME::HasInstance(nsIXPConnectWrappedNative *wrapper,
     {NS_ERROR("never called"); return NS_ERROR_NOT_IMPLEMENTED;}
 #endif
 
-#ifndef XPC_MAP_WANT_OUTER_OBJECT
-NS_IMETHODIMP XPC_MAP_CLASSNAME::OuterObject(nsIXPConnectWrappedNative *wrapper, JSContext * cx, JSObject * obj, JSObject * *_retval)
-    {NS_ERROR("never called"); return NS_ERROR_NOT_IMPLEMENTED;}
-#endif
-
 #ifndef XPC_MAP_WANT_POST_CREATE_PROTOTYPE
 NS_IMETHODIMP XPC_MAP_CLASSNAME::PostCreatePrototype(JSContext *cx, JSObject *proto)
     {return NS_OK;}
@@ -241,10 +233,6 @@ NS_IMETHODIMP XPC_MAP_CLASSNAME::PostCreatePrototype(JSContext *cx, JSObject *pr
 #undef XPC_MAP_WANT_HASINSTANCE
 #endif
 
-#ifdef XPC_MAP_WANT_OUTER_OBJECT
-#undef XPC_MAP_WANT_OUTER_OBJECT
-#endif
-
 #ifdef XPC_MAP_WANT_POST_CREATE_PROTOTYPE
 #undef XPC_MAP_WANT_POST_CREATE_PROTOTYPE
 #endif
diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
index 7bb29222e32..d06c2f954ae 100644
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -156,7 +156,7 @@ XPCConvert::NativeData2JS(MutableHandleValue d, const void* s,
     }
     case nsXPTType::T_WCHAR :
     {
-        jschar p = *static_cast<const jschar*>(s);
+        char16_t p = *static_cast<const char16_t*>(s);
 
         JSString* str = JS_NewUCStringCopyN(cx, &p, 1);
         if (!str)
@@ -239,7 +239,7 @@ XPCConvert::NativeData2JS(MutableHandleValue d, const void* s,
 
     case nsXPTType::T_WCHAR_STR:
     {
-        const jschar* p = *static_cast<const jschar* const *>(s);
+        const char16_t* p = *static_cast<const char16_t* const *>(s);
         if (!p) {
             d.setNull();
             return true;
@@ -353,13 +353,13 @@ XPCConvert::NativeData2JS(MutableHandleValue d, const void* s,
 
 #ifdef DEBUG
 static bool
-CheckJSCharInCharRange(jschar c)
+CheckChar16InCharRange(char16_t c)
 {
     if (ILLEGAL_RANGE(c)) {
         /* U+0080/U+0100 - U+FFFF data lost. */
         static const size_t MSG_BUF_SIZE = 64;
         char msg[MSG_BUF_SIZE];
-        JS_snprintf(msg, MSG_BUF_SIZE, "jschar out of char range; high bits of data lost: 0x%x", c);
+        JS_snprintf(msg, MSG_BUF_SIZE, "char16_t out of char range; high bits of data lost: 0x%x", c);
         NS_WARNING(msg);
         return false;
     }
@@ -372,7 +372,7 @@ static void
 CheckCharsInCharRange(const CharT *chars, size_t len)
 {
     for (size_t i = 0; i < len; i++) {
-        if (!CheckJSCharInCharRange(chars[i]))
+        if (!CheckChar16InCharRange(chars[i]))
             break;
     }
 }
@@ -427,7 +427,7 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
             return false;
         }
 
-        jschar ch;
+        char16_t ch;
         if (JS_GetStringLength(str) == 0) {
             ch = 0;
         } else {
@@ -435,7 +435,7 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
                 return false;
         }
 #ifdef DEBUG
-        CheckJSCharInCharRange(ch);
+        CheckChar16InCharRange(ch);
 #endif
         *((char*)d) = char(ch);
         break;
@@ -452,7 +452,7 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
             break;
         }
 
-        jschar ch;
+        char16_t ch;
         if (!JS_GetStringCharAt(cx, str, 0, &ch))
             return false;
 
@@ -521,12 +521,12 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
         } else if (XPCStringConvert::IsDOMString(str)) {
             // The characters represent an existing nsStringBuffer that
             // was shared by XPCStringConvert::ReadableToJSVal.
-            const jschar *chars = JS_GetTwoByteExternalStringChars(str);
+            const char16_t *chars = JS_GetTwoByteExternalStringChars(str);
             nsStringBuffer::FromData((void *)chars)->ToString(length, *ws);
         } else if (XPCStringConvert::IsLiteral(str)) {
             // The characters represent a literal char16_t string constant
             // compiled into libxul, such as the string "undefined" above.
-            const jschar *chars = JS_GetTwoByteExternalStringChars(str);
+            const char16_t *chars = JS_GetTwoByteExternalStringChars(str);
             ws->AssignLiteral(chars, length);
         } else {
             if (!AssignJSString(cx, *ws, str))
@@ -556,7 +556,7 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
         } else {
             size_t len;
             AutoCheckCannotGC nogc;
-            const jschar *chars = JS_GetTwoByteStringCharsAndLength(cx, nogc, str, &len);
+            const char16_t *chars = JS_GetTwoByteStringCharsAndLength(cx, nogc, str, &len);
             if (chars)
                 CheckCharsInCharRange(chars, len);
         }
@@ -580,7 +580,7 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
         JSString* str;
 
         if (s.isUndefined() || s.isNull()) {
-            *((jschar**)d) = nullptr;
+            *((char16_t**)d) = nullptr;
             return true;
         }
 
@@ -588,12 +588,12 @@ XPCConvert::JSData2Native(void* d, HandleValue s,
             return false;
         }
         int len = JS_GetStringLength(str);
-        int byte_len = (len+1)*sizeof(jschar);
+        int byte_len = (len+1)*sizeof(char16_t);
         if (!(*((void**)d) = nsMemory::Alloc(byte_len))) {
             // XXX should report error
             return false;
         }
-        mozilla::Range<jschar> destChars(*((jschar**)d), len + 1);
+        mozilla::Range<char16_t> destChars(*((char16_t**)d), len + 1);
         if (!JS_CopyStringChars(cx, destChars, str))
             return false;
         destChars[len] = 0;
@@ -1303,18 +1303,18 @@ XPCConvert::NativeArray2JS(MutableHandleValue d, const void** s,
     case nsXPTType::T_DOUBLE        : POPULATE(double);         break;
     case nsXPTType::T_BOOL          : POPULATE(bool);           break;
     case nsXPTType::T_CHAR          : POPULATE(char);           break;
-    case nsXPTType::T_WCHAR         : POPULATE(jschar);         break;
-    case nsXPTType::T_VOID          : NS_ERROR("bad type"); goto failure;
+    case nsXPTType::T_WCHAR         : POPULATE(char16_t);       break;
+    case nsXPTType::T_VOID          : NS_ERROR("bad type");     goto failure;
     case nsXPTType::T_IID           : POPULATE(nsID*);          break;
-    case nsXPTType::T_DOMSTRING     : NS_ERROR("bad type"); goto failure;
+    case nsXPTType::T_DOMSTRING     : NS_ERROR("bad type");     goto failure;
     case nsXPTType::T_CHAR_STR      : POPULATE(char*);          break;
-    case nsXPTType::T_WCHAR_STR     : POPULATE(jschar*);        break;
+    case nsXPTType::T_WCHAR_STR     : POPULATE(char16_t*);      break;
     case nsXPTType::T_INTERFACE     : POPULATE(nsISupports*);   break;
     case nsXPTType::T_INTERFACE_IS  : POPULATE(nsISupports*);   break;
-    case nsXPTType::T_UTF8STRING    : NS_ERROR("bad type"); goto failure;
-    case nsXPTType::T_CSTRING       : NS_ERROR("bad type"); goto failure;
-    case nsXPTType::T_ASTRING       : NS_ERROR("bad type"); goto failure;
-    default                         : NS_ERROR("bad type"); goto failure;
+    case nsXPTType::T_UTF8STRING    : NS_ERROR("bad type");     goto failure;
+    case nsXPTType::T_CSTRING       : NS_ERROR("bad type");     goto failure;
+    case nsXPTType::T_ASTRING       : NS_ERROR("bad type");     goto failure;
+    default                         : NS_ERROR("bad type");     goto failure;
     }
 
     if (pErr)
@@ -1581,18 +1581,18 @@ XPCConvert::JSArray2Native(void** d, HandleValue s,
     case nsXPTType::T_DOUBLE        : POPULATE(na, double);         break;
     case nsXPTType::T_BOOL          : POPULATE(na, bool);           break;
     case nsXPTType::T_CHAR          : POPULATE(na, char);           break;
-    case nsXPTType::T_WCHAR         : POPULATE(na, jschar);         break;
-    case nsXPTType::T_VOID          : NS_ERROR("bad type"); goto failure;
+    case nsXPTType::T_WCHAR         : POPULATE(na, char16_t);       break;
+    case nsXPTType::T_VOID          : NS_ERROR("bad type");         goto failure;
     case nsXPTType::T_IID           : POPULATE(fr, nsID*);          break;
-    case nsXPTType::T_DOMSTRING     : NS_ERROR("bad type"); goto failure;
+    case nsXPTType::T_DOMSTRING     : NS_ERROR("bad type");         goto failure;
     case nsXPTType::T_CHAR_STR      : POPULATE(fr, char*);          break;
-    case nsXPTType::T_WCHAR_STR     : POPULATE(fr, jschar*);        break;
+    case nsXPTType::T_WCHAR_STR     : POPULATE(fr, char16_t*);      break;
     case nsXPTType::T_INTERFACE     : POPULATE(re, nsISupports*);   break;
     case nsXPTType::T_INTERFACE_IS  : POPULATE(re, nsISupports*);   break;
-    case nsXPTType::T_UTF8STRING    : NS_ERROR("bad type"); goto failure;
-    case nsXPTType::T_CSTRING       : NS_ERROR("bad type"); goto failure;
-    case nsXPTType::T_ASTRING       : NS_ERROR("bad type"); goto failure;
-    default                         : NS_ERROR("bad type"); goto failure;
+    case nsXPTType::T_UTF8STRING    : NS_ERROR("bad type");         goto failure;
+    case nsXPTType::T_CSTRING       : NS_ERROR("bad type");         goto failure;
+    case nsXPTType::T_ASTRING       : NS_ERROR("bad type");         goto failure;
+    default                         : NS_ERROR("bad type");         goto failure;
     }
 
     *d = array;
@@ -1651,7 +1651,7 @@ XPCConvert::NativeStringWithSize2JS(MutableHandleValue d, const void* s,
         }
         case nsXPTType::T_PWSTRING_SIZE_IS:
         {
-            jschar* p = *((jschar**)s);
+            char16_t* p = *((char16_t**)s);
             if (!p)
                 break;
             JSString* str;
@@ -1746,14 +1746,14 @@ XPCConvert::JSStringWithSize2Native(void* d, HandleValue s,
                 }
 
                 if (0 != count) {
-                    len = (count + 1) * sizeof(jschar);
+                    len = (count + 1) * sizeof(char16_t);
                     if (!(*((void**)d) = nsMemory::Alloc(len)))
                         return false;
                     return true;
                 }
 
                 // else ...
-                *((const jschar**)d) = nullptr;
+                *((const char16_t**)d) = nullptr;
                 return true;
             }
 
@@ -1770,12 +1770,12 @@ XPCConvert::JSStringWithSize2Native(void* d, HandleValue s,
 
             len = count;
 
-            uint32_t alloc_len = (len + 1) * sizeof(jschar);
+            uint32_t alloc_len = (len + 1) * sizeof(char16_t);
             if (!(*((void**)d) = nsMemory::Alloc(alloc_len))) {
                 // XXX should report error
                 return false;
             }
-            mozilla::Range<jschar> destChars(*((jschar**)d), len + 1);
+            mozilla::Range<char16_t> destChars(*((char16_t**)d), len + 1);
             if (!JS_CopyStringChars(cx, destChars, str))
                 return false;
             destChars[count] = 0;
@@ -1787,4 +1787,3 @@ XPCConvert::JSStringWithSize2Native(void* d, HandleValue s,
             return false;
     }
 }
-
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 967a5fbc4c3..0b5c4c6324c 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -561,19 +561,9 @@ WindowOrNull(JSObject *aObj)
     MOZ_ASSERT(aObj);
     MOZ_ASSERT(!js::IsWrapper(aObj));
 
-    // This will always return null until we have Window on WebIDL bindings,
-    // at which point it will do the right thing.
-    if (!IS_WN_CLASS(js::GetObjectClass(aObj))) {
-        nsGlobalWindow* win = nullptr;
-        UNWRAP_OBJECT(Window, aObj, win);
-        return win;
-    }
-
-    nsISupports* supports = XPCWrappedNative::Get(aObj)->GetIdentityObject();
-    nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(supports);
-    if (!piWin)
-        return nullptr;
-    return static_cast<nsGlobalWindow*>(piWin.get());
+    nsGlobalWindow* win = nullptr;
+    UNWRAP_OBJECT(Window, aObj, win);
+    return win;
 }
 
 nsGlobalWindow*
@@ -2222,10 +2212,6 @@ ReportCompartmentStats(const JS::CompartmentStats &cStats,
         cStats.regexpCompartment,
         "The regexp compartment and regexp data.");
 
-    ZCREPORT_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("debuggees-set"),
-        cStats.debuggeesSet,
-        "The debuggees set.");
-
     if (sundriesGCHeap > 0) {
         // We deliberately don't use ZCREPORT_GC_BYTES here.
         REPORT_GC_BYTES(cJSPathPrefix + NS_LITERAL_CSTRING("sundries/gc-heap"),
@@ -2986,7 +2972,7 @@ PreserveWrapper(JSContext *cx, JSObject *obj)
 }
 
 static nsresult
-ReadSourceFromFilename(JSContext *cx, const char *filename, jschar **src, size_t *len)
+ReadSourceFromFilename(JSContext *cx, const char *filename, char16_t **src, size_t *len)
 {
     nsresult rv;
 
@@ -3065,7 +3051,7 @@ ReadSourceFromFilename(JSContext *cx, const char *filename, jschar **src, size_t
 // the source for a chrome JS function. See the comment in the XPCJSRuntime
 // constructor.
 class XPCJSSourceHook: public js::SourceHook {
-    bool load(JSContext *cx, const char *filename, jschar **src, size_t *length) {
+    bool load(JSContext *cx, const char *filename, char16_t **src, size_t *length) {
         *src = nullptr;
         *length = 0;
 
diff --git a/js/xpconnect/src/XPCLocale.cpp b/js/xpconnect/src/XPCLocale.cpp
index 039e5b1ff81..ca48629f547 100644
--- a/js/xpconnect/src/XPCLocale.cpp
+++ b/js/xpconnect/src/XPCLocale.cpp
@@ -219,7 +219,7 @@ private:
             if (shrunkUnichars)
               unichars = shrunkUnichars;
           }
-          JSString *str = JS_NewUCString(cx, reinterpret_cast<jschar*>(unichars), unicharLength);
+          JSString *str = JS_NewUCString(cx, reinterpret_cast<char16_t*>(unichars), unicharLength);
           if (str) {
             rval.setString(str);
             return true;
diff --git a/js/xpconnect/src/XPCString.cpp b/js/xpconnect/src/XPCString.cpp
index d8ed7eaabf1..10ab8a4e4d1 100644
--- a/js/xpconnect/src/XPCString.cpp
+++ b/js/xpconnect/src/XPCString.cpp
@@ -49,7 +49,7 @@ XPCStringConvert::ClearZoneCache(JS::Zone *zone)
 
 // static
 void
-XPCStringConvert::FinalizeLiteral(const JSStringFinalizer *fin, jschar *chars)
+XPCStringConvert::FinalizeLiteral(const JSStringFinalizer *fin, char16_t *chars)
 {
 }
 
@@ -58,7 +58,7 @@ const JSStringFinalizer XPCStringConvert::sLiteralFinalizer =
 
 // static
 void
-XPCStringConvert::FinalizeDOMString(const JSStringFinalizer *fin, jschar *chars)
+XPCStringConvert::FinalizeDOMString(const JSStringFinalizer *fin, char16_t *chars)
 {
     nsStringBuffer* buf = nsStringBuffer::FromData(chars);
     buf->Release();
@@ -81,7 +81,7 @@ XPCStringConvert::ReadableToJSVal(JSContext *cx,
 
     if (readable.IsLiteral()) {
         JSString *str = JS_NewExternalString(cx,
-                                             static_cast<const jschar*>(readable.BeginReading()),
+                                             static_cast<const char16_t*>(readable.BeginReading()),
                                              length, &sLiteralFinalizer);
         if (!str)
             return false;
diff --git a/js/xpconnect/src/XPCVariant.cpp b/js/xpconnect/src/XPCVariant.cpp
index 89e679f9740..15530d1d85d 100644
--- a/js/xpconnect/src/XPCVariant.cpp
+++ b/js/xpconnect/src/XPCVariant.cpp
@@ -289,7 +289,7 @@ bool XPCVariant::InitializeData(JSContext* cx)
         if (!NS_SUCCEEDED(nsVariant::AllocateWStringWithSize(&mData, length)))
             return false;
 
-        mozilla::Range<jschar> destChars(mData.u.wstr.mWStringValue, length);
+        mozilla::Range<char16_t> destChars(mData.u.wstr.mWStringValue, length);
         if (!JS_CopyStringChars(cx, destChars, str))
             return false;
 
@@ -811,5 +811,3 @@ NS_IMETHODIMP XPCVariant::GetAsWStringWithSize(uint32_t *size, char16_t **str)
 {
     return nsVariant::ConvertToWStringWithSize(mData, size, str);
 }
-
-
diff --git a/js/xpconnect/src/XPCWrappedJSClass.cpp b/js/xpconnect/src/XPCWrappedJSClass.cpp
index 20e427d9638..0f6a58304ee 100644
--- a/js/xpconnect/src/XPCWrappedJSClass.cpp
+++ b/js/xpconnect/src/XPCWrappedJSClass.cpp
@@ -32,7 +32,7 @@ NS_IMPL_ISUPPORTS(nsXPCWrappedJSClass, nsIXPCWrappedJSClass)
 // the value of this variable is never used - we use its address as a sentinel
 static uint32_t zero_methods_descriptor;
 
-bool AutoScriptEvaluate::StartEvaluating(HandleObject scope, JSErrorReporter errorReporter)
+bool AutoScriptEvaluate::StartEvaluating(HandleObject scope)
 {
     NS_PRECONDITION(!mEvaluated, "AutoScriptEvaluate::Evaluate should only be called once");
 
@@ -40,10 +40,6 @@ bool AutoScriptEvaluate::StartEvaluating(HandleObject scope, JSErrorReporter err
         return true;
 
     mEvaluated = true;
-    if (!JS_GetErrorReporter(mJSContext)) {
-        JS_SetErrorReporter(mJSContext, errorReporter);
-        mErrorReporterSet = true;
-    }
 
     JS_BeginRequest(mJSContext);
     mAutoCompartment.emplace(mJSContext, scope);
@@ -66,9 +62,6 @@ AutoScriptEvaluate::~AutoScriptEvaluate()
     mState->restore();
 
     JS_EndRequest(mJSContext);
-
-    if (mErrorReporterSet)
-        JS_SetErrorReporter(mJSContext, nullptr);
 }
 
 // It turns out that some errors may be not worth reporting. So, this
@@ -175,11 +168,16 @@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext* cx,
     bool success = false;
     RootedValue fun(cx);
 
-    // Don't call the actual function on a content object. We'll determine
-    // whether or not a content object is capable of implementing the
-    // interface (i.e. whether the interface is scriptable) and most content
-    // objects don't have QI implementations anyway. Also see bug 503926.
-    if (!xpc::AccessCheck::isChrome(js::GetObjectCompartment(jsobj))) {
+    // In bug 503926, we added a security check to make sure that we don't
+    // invoke content QI functions. In the modern world, this is probably
+    // unnecessary, because invoking QI involves passing an IID object to
+    // content, which will fail. But we do a belt-and-suspenders check to
+    // make sure that content can never trigger the rat's nest of code below.
+    // Once we completely turn off XPConnect for the web, this can definitely
+    // go away.
+    if (!AccessCheck::isChrome(jsobj) ||
+        !AccessCheck::isChrome(js::UncheckedUnwrap(jsobj)))
+    {
         return nullptr;
     }
 
@@ -576,69 +574,6 @@ nsXPCWrappedJSClass::GetRootJSObject(JSContext* cx, JSObject* aJSObjArg)
     return result;
 }
 
-void
-xpcWrappedJSErrorReporter(JSContext *cx, const char *message,
-                          JSErrorReport *report)
-{
-    if (report) {
-        // If it is an exception report, then we can just deal with the
-        // exception later (if not caught in the JS code).
-        if (JSREPORT_IS_EXCEPTION(report->flags)) {
-            // XXX We have a problem with error reports from uncaught exceptions.
-            //
-            // http://bugzilla.mozilla.org/show_bug.cgi?id=66453
-            //
-            // The issue is...
-            //
-            // We can't assume that the exception will *stay* uncaught. So, if
-            // we build an nsIXPCException here and the underlying exception
-            // really is caught before our script is done running then we blow
-            // it by returning failure to our caller when the script didn't
-            // really fail. However, This report contains error location info
-            // that is no longer available after the script is done. So, if the
-            // exception really is not caught (and is a non-engine exception)
-            // then we've lost the oportunity to capture the script location
-            // info that we *could* have captured here.
-            //
-            // This is expecially an issue with nested evaluations.
-            //
-            // Perhaps we could capture an expception here and store it as
-            // 'provisional' and then later if there is a pending exception
-            // when the script is done then we could maybe compare that in some
-            // way with the 'provisional' one in which we captured location info.
-            // We would not want to assume that the one discovered here is the
-            // same one that is later detected. This could cause us to lie.
-            //
-            // The thing is. we do not currently store the right stuff to compare
-            // these two nsIXPCExceptions (triggered by the same exception jsval
-            // in the engine). Maybe we should store the jsval and compare that?
-            // Maybe without even rooting it since we will not dereference it.
-            // This is inexact, but maybe the right thing to do?
-            //
-            // if (report->errorNumber == JSMSG_UNCAUGHT_EXCEPTION)) ...
-            //
-
-            return;
-        }
-
-        if (JSREPORT_IS_WARNING(report->flags)) {
-            // XXX printf the warning (#ifdef DEBUG only!).
-            // XXX send the warning to the console service.
-            return;
-        }
-    }
-
-    XPCCallContext ccx(NATIVE_CALLER, cx);
-    if (!ccx.IsValid())
-        return;
-
-    nsCOMPtr<nsIException> e;
-    XPCConvert::JSErrorToXPCException(message, nullptr, nullptr, report,
-                                      getter_AddRefs(e));
-    if (e)
-        ccx.GetXPCContext()->SetException(e);
-}
-
 bool
 nsXPCWrappedJSClass::GetArraySizeFromParam(JSContext* cx,
                                            const XPTMethodDescriptor* method,
@@ -836,15 +771,9 @@ nsXPCWrappedJSClass::CheckForException(XPCCallContext & ccx,
 
             // Try to use the error reporter set on the context to handle this
             // error if it came from a JS exception.
-            if (reportable && is_js_exception &&
-                JS_GetErrorReporter(cx) != xpcWrappedJSErrorReporter)
+            if (reportable && is_js_exception)
             {
-                // If the error reporter ignores the error, it will call
-                // xpc->MarkErrorUnreported().
-                xpcc->ClearUnreportedError();
                 reportable = !JS_ReportPendingException(cx);
-                if (!xpcc->WasErrorReported())
-                    reportable = true;
             }
 
             if (reportable) {
@@ -998,7 +927,7 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS* wrapper, uint16_t methodIndex,
     uint8_t argc = paramCount -
         (paramCount && XPT_PD_IS_RETVAL(info->params[paramCount-1].flags) ? 1 : 0);
 
-    if (!scriptEval.StartEvaluating(obj, xpcWrappedJSErrorReporter))
+    if (!scriptEval.StartEvaluating(obj))
         goto pre_call_clean_up;
 
     xpcc->SetPendingResult(pending_result);
diff --git a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
index b514d405bfb..f1640660a7b 100644
--- a/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeJSOps.cpp
@@ -629,42 +629,6 @@ XPC_WN_NoHelper_Resolve(JSContext *cx, HandleObject obj, HandleId id)
                                  JSPROP_PERMANENT, nullptr);
 }
 
-static JSObject *
-XPC_WN_OuterObject(JSContext *cx, HandleObject objArg)
-{
-    JSObject *obj = objArg;
-
-    XPCWrappedNative *wrapper = XPCWrappedNative::Get(obj);
-    if (!wrapper) {
-        Throw(NS_ERROR_XPC_BAD_OP_ON_WN_PROTO, cx);
-
-        return nullptr;
-    }
-
-    if (!wrapper->IsValid()) {
-        Throw(NS_ERROR_XPC_HAS_BEEN_SHUTDOWN, cx);
-
-        return nullptr;
-    }
-
-    XPCNativeScriptableInfo* si = wrapper->GetScriptableInfo();
-    if (si && si->GetFlags().WantOuterObject()) {
-        RootedObject newThis(cx);
-        nsresult rv =
-            si->GetCallback()->OuterObject(wrapper, cx, obj, newThis.address());
-
-        if (NS_FAILED(rv)) {
-            Throw(rv, cx);
-
-            return nullptr;
-        }
-
-        obj = newThis;
-    }
-
-    return obj;
-}
-
 const XPCWrappedNativeJSClass XPC_WN_NoHelper_JSClass = {
   { // base
     "XPCWrappedNative_NoHelper",    // name;
@@ -1172,24 +1136,8 @@ XPCNativeScriptableShared::PopulateJSClass()
     // We have to figure out resolve strategy at call time
     mJSClass.base.resolve = (JSResolveOp) XPC_WN_Helper_NewResolve;
 
-    // We need to respect content-defined toString() hooks on Window objects.
-    // In particular, js::DefaultValue checks for a convert stub, and the one
-    // we would install below ignores anything implemented in JS.
-    //
-    // We've always had this behavior for most XPCWrappedNative-implemented
-    // objects. However, Window was special, because the outer-window proxy
-    // had a null convert hook, which means that we'd end up with the default
-    // JS-engine behavior (which respects toString() overrides). We've fixed
-    // the convert hook on the outer-window proxy to invoke the defaultValue
-    // hook on the proxy, which in this case invokes js::DefaultValue on the
-    // target. So now we need to special-case this for Window to maintain
-    // consistent behavior. This can go away once Window is on WebIDL bindings.
-    //
-    // Note that WantOuterObject() is true if and only if this is a Window object.
     if (mFlags.WantConvert())
         mJSClass.base.convert = XPC_WN_Helper_Convert;
-    else if (mFlags.WantOuterObject())
-        mJSClass.base.convert = JS_ConvertStub;
     else
         mJSClass.base.convert = XPC_WN_Shared_Convert;
 
@@ -1216,9 +1164,6 @@ XPCNativeScriptableShared::PopulateJSClass()
     else
         mJSClass.base.trace = XPCWrappedNative::Trace;
 
-    if (mFlags.WantOuterObject())
-        mJSClass.base.ext.outerObject = XPC_WN_OuterObject;
-
     mJSClass.base.ext.isWrappedNative = true;
 }
 
diff --git a/js/xpconnect/src/XPCWrappedNativeScope.cpp b/js/xpconnect/src/XPCWrappedNativeScope.cpp
index 5df633c69fa..9b48a5318f6 100644
--- a/js/xpconnect/src/XPCWrappedNativeScope.cpp
+++ b/js/xpconnect/src/XPCWrappedNativeScope.cpp
@@ -120,9 +120,7 @@ XPCWrappedNativeScope::XPCWrappedNativeScope(JSContext *cx,
     mUseContentXBLScope = mAllowContentXBLScope;
     if (mUseContentXBLScope) {
       const js::Class *clasp = js::GetObjectClass(mGlobalJSObject);
-      mUseContentXBLScope = !strcmp(clasp->name, "Window") ||
-                            !strcmp(clasp->name, "ChromeWindow") ||
-                            !strcmp(clasp->name, "ModalContentWindow");
+      mUseContentXBLScope = !strcmp(clasp->name, "Window");
     }
     if (mUseContentXBLScope) {
       mUseContentXBLScope = principal && !nsContentUtils::IsSystemPrincipal(principal);
diff --git a/js/xpconnect/src/dom_quickstubs.qsconf b/js/xpconnect/src/dom_quickstubs.qsconf
index 68be77a1c23..706681dfa07 100644
--- a/js/xpconnect/src/dom_quickstubs.qsconf
+++ b/js/xpconnect/src/dom_quickstubs.qsconf
@@ -55,12 +55,10 @@ irregularFilenames = {
 customIncludes = [
     'mozilla/dom/BindingUtils.h',
     'mozilla/dom/EventTargetBinding.h',
-    'mozilla/dom/WindowBinding.h',
     ]
 
 newBindingProperties = {
     # Once the last entry here goes away, we can make the sNativePropertyHooks
     # of bindings static.
     'nsIDOMEventTarget': '&mozilla::dom::EventTargetBinding::sNativePropertyHooks->mNativeProperties',
-    'nsIDOMWindow': '&mozilla::dom::WindowBinding::sNativePropertyHooks->mNativeProperties',
     }
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index 7f1293764de..21901f961b0 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -187,56 +187,120 @@ nsXPConnect::IsISupportsDescendant(nsIInterfaceInfo* info)
 }
 
 void
-xpc::SystemErrorReporter(JSContext *cx, const char *message, JSErrorReport *rep)
+xpc::ErrorReport::Init(JSErrorReport *aReport,
+                       const char *aFallbackMessage,
+                       nsIGlobalObject *aGlobal)
 {
-    // It would be nice to assert !DescribeScriptedCaller here, to be sure
-    // that there isn't any script running that could catch the exception. But
-    // the JS engine invokes the error reporter directly if someone reports an
-    // ErrorReport that it doesn't know how to turn into an exception. Arguably
-    // it should just learn how to throw everything. But either way, if the
-    // exception is ending here, it's not going to get propagated to a caller,
-    // so it's up to us to make it known.
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(aGlobal);
 
-    nsresult rv;
+    mGlobal = aGlobal;
+    mWindow = do_QueryInterface(mGlobal);
+    MOZ_ASSERT_IF(mWindow, mWindow->IsInnerWindow());
 
-    /* Use the console service to register the error. */
-    nsCOMPtr<nsIConsoleService> consoleService =
-        do_GetService(NS_CONSOLESERVICE_CONTRACTID);
-
-    /*
-     * Make an nsIScriptError, populate it with information from this
-     * error, then log it with the console service.
-     */
-    nsCOMPtr<nsIScriptError> errorObject =
-        do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
-
-    if (consoleService && errorObject) {
-        uint32_t column = rep->uctokenptr - rep->uclinebuf;
-
-        const char16_t* ucmessage =
-            static_cast<const char16_t*>(rep->ucmessage);
-        const char16_t* uclinebuf =
-            static_cast<const char16_t*>(rep->uclinebuf);
-
-        rv = errorObject->Init(
-              ucmessage ? nsDependentString(ucmessage) : EmptyString(),
-              NS_ConvertASCIItoUTF16(rep->filename),
-              uclinebuf ? nsDependentString(uclinebuf) : EmptyString(),
-              rep->lineno, column, rep->flags,
-              "system javascript");
-        if (NS_SUCCEEDED(rv))
-            consoleService->LogMessage(errorObject);
-    }
-
-    if (nsContentUtils::DOMWindowDumpEnabled()) {
-        fprintf(stderr, "System JS : %s %s:%d - %s\n",
-                JSREPORT_IS_WARNING(rep->flags) ? "WARNING" : "ERROR",
-                rep->filename, rep->lineno,
-                message ? message : "<no message>");
-    }
+    nsIPrincipal *prin = mGlobal->PrincipalOrNull();
+    mIsChrome = nsContentUtils::IsSystemPrincipal(prin);
 
+    InitInternal(aReport, aFallbackMessage);
 }
 
+void
+xpc::ErrorReport::InitOnWorkerThread(JSErrorReport *aReport,
+                                     const char *aFallbackMessage,
+                                     bool aIsChrome)
+{
+    MOZ_ASSERT(!NS_IsMainThread());
+    mIsChrome = aIsChrome;
+
+    InitInternal(aReport, aFallbackMessage);
+}
+
+void
+xpc::ErrorReport::InitInternal(JSErrorReport *aReport,
+                               const char *aFallbackMessage)
+{
+    const char16_t* m = static_cast<const char16_t*>(aReport->ucmessage);
+    if (m) {
+        JSFlatString* name = js::GetErrorTypeName(CycleCollectedJSRuntime::Get()->Runtime(), aReport->exnType);
+        if (name) {
+            AssignJSFlatString(mErrorMsg, name);
+            mErrorMsg.AppendLiteral(": ");
+        }
+        mErrorMsg.Append(m);
+    }
+
+    if (mErrorMsg.IsEmpty() && aFallbackMessage) {
+        mErrorMsg.AssignWithConversion(aFallbackMessage);
+    }
+
+    if (!aReport->filename) {
+        mFileName.SetIsVoid(true);
+    } else {
+        mFileName.AssignWithConversion(aReport->filename);
+    }
+
+    mSourceLine = static_cast<const char16_t*>(aReport->uclinebuf);
+
+    mLineNumber = aReport->lineno;
+    mColumn = aReport->column;
+    mFlags = aReport->flags;
+}
+
+#ifdef PR_LOGGING
+static PRLogModuleInfo* gJSDiagnostics;
+#endif
+
+void
+xpc::ErrorReport::LogToConsole()
+{
+    // Log to stdout.
+    if (nsContentUtils::DOMWindowDumpEnabled()) {
+        nsAutoCString error;
+        error.AssignLiteral("JavaScript ");
+        if (JSREPORT_IS_STRICT(mFlags))
+            error.AppendLiteral("strict ");
+        if (JSREPORT_IS_WARNING(mFlags))
+            error.AppendLiteral("warning: ");
+        else
+            error.AppendLiteral("error: ");
+        error.Append(NS_LossyConvertUTF16toASCII(mFileName));
+        error.AppendLiteral(", line ");
+        error.AppendInt(mLineNumber, 10);
+        error.AppendLiteral(": ");
+        error.Append(NS_LossyConvertUTF16toASCII(mErrorMsg));
+
+        fprintf(stderr, "%s\n", error.get());
+        fflush(stderr);
+    }
+
+#ifdef PR_LOGGING
+    // Log to the PR Log Module.
+    if (!gJSDiagnostics)
+        gJSDiagnostics = PR_NewLogModule("JSDiagnostics");
+    if (gJSDiagnostics) {
+        PR_LOG(gJSDiagnostics,
+                JSREPORT_IS_WARNING(mFlags) ? PR_LOG_WARNING : PR_LOG_ERROR,
+                ("file %s, line %u\n%s", NS_LossyConvertUTF16toASCII(mFileName).get(),
+                 mLineNumber, NS_LossyConvertUTF16toASCII(mErrorMsg).get()));
+    }
+#endif
+
+    // Log to the console. We do this last so that we can simply return if
+    // there's no console service without affecting the other reporting
+    // mechanisms.
+    nsCOMPtr<nsIConsoleService> consoleService =
+      do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+    nsCOMPtr<nsIScriptError> errorObject =
+      do_CreateInstance("@mozilla.org/scripterror;1");
+    NS_ENSURE_TRUE_VOID(consoleService && errorObject);
+
+    nsresult rv = errorObject->InitWithWindowID(mErrorMsg, mFileName, mSourceLine,
+                                                mLineNumber, mColumn, mFlags, Category(),
+                                                mWindow ? mWindow->WindowID() : 0);
+    NS_ENSURE_SUCCESS_VOID(rv);
+    consoleService->LogMessage(errorObject);
+
+}
 
 /***************************************************************************/
 
@@ -1373,14 +1437,6 @@ nsXPConnect::ReadFunction(nsIObjectInputStream *stream, JSContext *cx, JSObject
     return ReadScriptOrFunction(stream, cx, nullptr, functionObjp);
 }
 
-NS_IMETHODIMP
-nsXPConnect::MarkErrorUnreported(JSContext *cx)
-{
-    XPCContext *xpcc = XPCContext::GetXPCContext(cx);
-    xpcc->MarkErrorUnreported();
-    return NS_OK;
-}
-
 /* These are here to be callable from a debugger */
 extern "C" {
 JS_EXPORT_API(void) DumpJSStack()
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index 53e2c4ac11c..0c5aea8568e 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -739,10 +739,6 @@ public:
 
     void DebugDump(int16_t depth);
 
-    void MarkErrorUnreported() { mErrorUnreported = true; }
-    void ClearUnreportedError() { mErrorUnreported = false; }
-    bool WasErrorReported() { return !mErrorUnreported; }
-
     ~XPCContext();
 
 private:
@@ -1623,7 +1619,6 @@ public:
     bool WantCall()                     GET_IT(WANT_CALL)
     bool WantConstruct()                GET_IT(WANT_CONSTRUCT)
     bool WantHasInstance()              GET_IT(WANT_HASINSTANCE)
-    bool WantOuterObject()              GET_IT(WANT_OUTER_OBJECT)
     bool UseJSStubForAddProperty()      GET_IT(USE_JSSTUB_FOR_ADDPROPERTY)
     bool UseJSStubForDelProperty()      GET_IT(USE_JSSTUB_FOR_DELPROPERTY)
     bool UseJSStubForSetProperty()      GET_IT(USE_JSSTUB_FOR_SETPROPERTY)
@@ -3009,8 +3004,7 @@ private:
 };
 
 /******************************************************************************
- * Handles pre/post script processing and the setting/resetting the error
- * reporter
+ * Handles pre/post script processing.
  */
 class MOZ_STACK_CLASS AutoScriptEvaluate
 {
@@ -3020,27 +3014,25 @@ public:
      * @param cx The JSContext, this can be null, we don't do anything then
      */
     explicit AutoScriptEvaluate(JSContext * cx MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-         : mJSContext(cx), mErrorReporterSet(false), mEvaluated(false) {
+         : mJSContext(cx), mEvaluated(false) {
         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
     /**
-     * Does the pre script evaluation and sets the error reporter if given
+     * Does the pre script evaluation.
      * This function should only be called once, and will assert if called
      * more than once
-     * @param errorReporter the error reporter callback function to set
      */
 
-    bool StartEvaluating(JS::HandleObject scope, JSErrorReporter errorReporter = nullptr);
+    bool StartEvaluating(JS::HandleObject scope);
 
     /**
-     * Does the post script evaluation and resets the error reporter
+     * Does the post script evaluation.
      */
     ~AutoScriptEvaluate();
 private:
     JSContext* mJSContext;
     mozilla::Maybe<JS::AutoSaveExceptionState> mState;
-    bool mErrorReporterSet;
     bool mEvaluated;
     mozilla::Maybe<JSAutoCompartment> mAutoCompartment;
     MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
diff --git a/js/xpconnect/src/xpcpublic.h b/js/xpconnect/src/xpcpublic.h
index 522777f9b22..297d323137a 100644
--- a/js/xpconnect/src/xpcpublic.h
+++ b/js/xpconnect/src/xpcpublic.h
@@ -15,6 +15,8 @@
 #include "nsISupports.h"
 #include "nsIURI.h"
 #include "nsIPrincipal.h"
+#include "nsIGlobalObject.h"
+#include "nsPIDOMWindow.h"
 #include "nsWrapperCache.h"
 #include "nsStringGlue.h"
 #include "nsTArray.h"
@@ -26,7 +28,6 @@
 class nsGlobalWindow;
 class nsIPrincipal;
 class nsScriptNameSpaceManager;
-class nsIGlobalObject;
 class nsIMemoryReporterCallback;
 
 #ifndef BAD_TLS_INDEX
@@ -249,7 +250,7 @@ public:
         }
 
         JSString *str = JS_NewExternalString(cx,
-                                             static_cast<jschar*>(buf->Data()),
+                                             static_cast<char16_t*>(buf->Data()),
                                              length, &sDOMStringFinalizer);
         if (!str) {
             return false;
@@ -283,9 +284,9 @@ public:
 private:
     static const JSStringFinalizer sLiteralFinalizer, sDOMStringFinalizer;
 
-    static void FinalizeLiteral(const JSStringFinalizer *fin, jschar *chars);
+    static void FinalizeLiteral(const JSStringFinalizer *fin, char16_t *chars);
 
-    static void FinalizeDOMString(const JSStringFinalizer *fin, jschar *chars);
+    static void FinalizeDOMString(const JSStringFinalizer *fin, char16_t *chars);
 
     XPCStringConvert();         // not implemented
 };
@@ -473,6 +474,8 @@ WindowGlobalOrNull(JSObject *aObj);
 
 // Error reporter used when there is no associated DOM window on to which to
 // report errors and warnings.
+//
+// Note - This is temporarily implemented in nsJSEnvironment.cpp.
 void
 SystemErrorReporter(JSContext *cx, const char *message, JSErrorReport *rep);
 
@@ -490,6 +493,48 @@ SetAddonInterposition(const nsACString &addonId, nsIAddonInterposition *interpos
 bool
 ExtraWarningsForSystemJS();
 
+class ErrorReport {
+  public:
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(ErrorReport);
+
+    ErrorReport() : mIsChrome(false)
+                  , mLineNumber(0)
+                  , mColumn(0)
+                  , mFlags(0)
+    {}
+
+    void Init(JSErrorReport *aReport, const char *aFallbackMessage,
+              nsIGlobalObject *aGlobal);
+    void InitOnWorkerThread(JSErrorReport *aReport, const char *aFallbackMessage,
+                            bool aIsChrome);
+
+    void LogToConsole();
+
+  private:
+    void InitInternal(JSErrorReport *aReport, const char *aFallbackMessage);
+    bool mIsChrome;
+
+  public:
+    const nsCString Category() {
+        return mIsChrome ? NS_LITERAL_CSTRING("chrome javascript")
+                         : NS_LITERAL_CSTRING("content javascript");
+    }
+
+    nsString mErrorMsg;
+    nsString mFileName;
+    nsString mSourceLine;
+    uint32_t mLineNumber;
+    uint32_t mColumn;
+    uint32_t mFlags;
+
+    // These are both null for ErrorReports initialized on a worker thread.
+    nsCOMPtr<nsIGlobalObject> mGlobal;
+    nsCOMPtr<nsPIDOMWindow> mWindow;
+
+  private:
+    ~ErrorReport() {}
+};
+
 } // namespace xpc
 
 namespace mozilla {
diff --git a/js/xpconnect/tests/chrome/bug503926.xul b/js/xpconnect/tests/chrome/bug503926.xul
index 85bb5117e77..ea5e02cbe16 100644
--- a/js/xpconnect/tests/chrome/bug503926.xul
+++ b/js/xpconnect/tests/chrome/bug503926.xul
@@ -21,7 +21,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=503926
       var obj = { QueryInterface: function() { passed = true; } }
       gWindowUtils.xpconnectArgument(obj);
       var isDialog = location.hash != '#iframe';
-      var outer = XPCNativeWrapper.unwrap(isDialog ? opener : top);
+      var outer = XPCNativeWrapper.unwrap(isDialog ? opener : parent);
       outer.ok(passed, "chrome/chrome test passed: " + (isDialog ? "dialog" : "iframe"));
       if (isDialog)
         close();
diff --git a/js/xpconnect/tests/chrome/test_bug503926.xul b/js/xpconnect/tests/chrome/test_bug503926.xul
index de17f498541..ab611e48985 100644
--- a/js/xpconnect/tests/chrome/test_bug503926.xul
+++ b/js/xpconnect/tests/chrome/test_bug503926.xul
@@ -14,7 +14,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=503926
   <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=503926"
      target="_blank">Mozilla Bug 503926</a>
 
-  <iframe id="ifr" type="content" onload="iframe_loaded()" src="bug503926.xul#iframe"/>
+  <iframe id="ifr" type="content" onload="loaded()" src="bug503926.xul#iframe"/>
+  <iframe id="ifrContent" type="content" onload="loaded()" src="http://example.org/tests/js/xpconnect/tests/mochitest/file_empty.html"/>
   </body>
 
   <!-- test code goes here -->
@@ -23,15 +24,31 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=503926
 
   SimpleTest.expectAssertions(0, 1);
 
+  var gLoadCount = 0;
+  function loaded() {
+    if (++gLoadCount == 2)
+      go();
+  }
+
   /** Test for Bug 503926 **/
-  function iframe_loaded() {
+  function go() {
     var gWindowUtils  = window.QueryInterface(Components.interfaces.nsIInterfaceRequestor).
                                getInterface(Components.interfaces.nsIDOMWindowUtils);
+
+    // Try with a chrome object.
     var passed = false;
     var obj = { QueryInterface: function() { passed = true; } };
     gWindowUtils.xpconnectArgument(obj);
     ok(passed, "trusted QIs should be called");
 
+    // Try with a content object.
+    var contentWin = $('ifrContent').contentWindow.wrappedJSObject;
+    contentWin.passed = false;
+    var contentObj = contentWin.eval('({ QueryInterface: function() { passed = true; } })');
+    gWindowUtils.xpconnectArgument(contentObj);
+    ok(!contentWin.passed, "untrusted QI should not be called");
+
+    // Try with a dialog.
     openDialog("bug503926.xul", "chromeDialog", "modal");
     SimpleTest.finish();
   }
diff --git a/js/xpconnect/tests/chrome/test_bug763343.xul b/js/xpconnect/tests/chrome/test_bug763343.xul
index cfda8722f84..1519e1fbe78 100644
--- a/js/xpconnect/tests/chrome/test_bug763343.xul
+++ b/js/xpconnect/tests/chrome/test_bug763343.xul
@@ -23,7 +23,11 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=763343
   const Ci = Components.interfaces;
   const Cu = Components.utils;
 
-  var singleton = window.QueryInterface(Ci.nsIClassInfo);
+  // We need an object here that has singleton classinfo.  For now, the console
+  // service works.
+  var singleton = Cc["@mozilla.org/consoleservice;1"].getService(Ci.nsIClassInfo);
+  ok(singleton.flags & Ci.nsIClassInfo.SINGLETON_CLASSINFO,
+     "Should have singleton classinfo");
   var sb = new Cu.Sandbox(window);
 
   // Don't crash.
diff --git a/js/xpconnect/tests/chrome/test_bug895340.xul b/js/xpconnect/tests/chrome/test_bug895340.xul
index bda90988914..370aa6ec6d9 100644
--- a/js/xpconnect/tests/chrome/test_bug895340.xul
+++ b/js/xpconnect/tests/chrome/test_bug895340.xul
@@ -20,6 +20,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=895340
   <script type="application/javascript"><![CDATA[
 
   SimpleTest.waitForExplicitFinish();
+  SimpleTest.expectUncaughtException();
 
   const Cu = Components.utils;
   Cu.import("resource://gre/modules/Services.jsm", this);
diff --git a/js/xpconnect/tests/mochitest/mochitest.ini b/js/xpconnect/tests/mochitest/mochitest.ini
index c2351ad32b9..79a012c439c 100644
--- a/js/xpconnect/tests/mochitest/mochitest.ini
+++ b/js/xpconnect/tests/mochitest/mochitest.ini
@@ -49,7 +49,6 @@ skip-if= buildapp == 'mulet'
 [test_bug462428.html]
 [test_bug478438.html]
 [test_bug500691.html]
-[test_bug503926.html]
 [test_bug504877.html]
 [test_bug505915.html]
 [test_bug560351.html]
diff --git a/js/xpconnect/tests/mochitest/test_bug503926.html b/js/xpconnect/tests/mochitest/test_bug503926.html
deleted file mode 100644
index ba542dc83e5..00000000000
--- a/js/xpconnect/tests/mochitest/test_bug503926.html
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=503926
--->
-<head>
-  <title>Test for Bug 503926</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=503926">Mozilla Bug 503926</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-  
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 503926 **/
-var passed = true;
-var obj = { QueryInterface: function() { passed = false; } };
-SpecialPowers.getDOMWindowUtils(window).xpconnectArgument(obj);
-ok(passed, "untrusted QI should not be called!");
-
-</script>
-</pre>
-</body>
-</html>
diff --git a/js/xpconnect/wrappers/AccessCheck.cpp b/js/xpconnect/wrappers/AccessCheck.cpp
index c3944246a4d..2c4b77b1c50 100644
--- a/js/xpconnect/wrappers/AccessCheck.cpp
+++ b/js/xpconnect/wrappers/AccessCheck.cpp
@@ -99,7 +99,7 @@ IsPermitted(const char *name, JSFlatString *prop, bool set)
     if (!propLength)
         return false;
 
-    jschar propChar0 = JS_GetFlatStringCharAt(prop, 0);
+    char16_t propChar0 = JS_GetFlatStringCharAt(prop, 0);
     if (name[0] == 'L' && !strcmp(name, "Location"))
         return dom::LocationBinding::IsPermitted(prop, propChar0, set);
     if (name[0] == 'W' && !strcmp(name, "Window"))
@@ -304,7 +304,7 @@ ExposedPropertiesOnly::check(JSContext *cx, HandleObject wrapper, HandleId id, W
     size_t length = JS_GetStringLength(JS_FORGET_STRING_FLATNESS(flat));
 
     for (size_t i = 0; i < length; ++i) {
-        jschar ch = JS_GetFlatStringCharAt(flat, i);
+        char16_t ch = JS_GetFlatStringCharAt(flat, i);
         switch (ch) {
         case 'r':
             if (access & READ) {
diff --git a/layout/base/RestyleManager.cpp b/layout/base/RestyleManager.cpp
index 2e0741da1cb..119e1d3a315 100644
--- a/layout/base/RestyleManager.cpp
+++ b/layout/base/RestyleManager.cpp
@@ -1421,7 +1421,9 @@ RestyleManager::RebuildAllStyleData(nsChangeHint aExtraHint)
   // hint passed in, and substantially improve the performance of things
   // like pref changes and the restyling that we do for downloadable
   // font loads.
-  DoRebuildAllStyleData(mPendingRestyles, aExtraHint, eRestyle_Subtree);
+  DoRebuildAllStyleData(mPendingRestyles, aExtraHint,
+                        nsRestyleHint(eRestyle_Subtree |
+                                      eRestyle_ForceDescendants));
 
   mPresContext->SetProcessingRestyles(false);
 
@@ -1444,7 +1446,8 @@ RestyleManager::DoRebuildAllStyleData(RestyleTracker& aRestyleTracker,
     return;
   }
 
-  if (aRestyleHint & ~eRestyle_Subtree) {
+  if ((aRestyleHint & (eRestyle_Subtree | eRestyle_ForceDescendants)) !=
+      (eRestyle_Subtree | eRestyle_ForceDescendants)) {
     // We want this hint to apply to the root node's primary frame
     // rather than the root frame, since it's the primary frame that has
     // the styles for the root element (rather than the ancestors of the
@@ -2134,8 +2137,10 @@ RestyleManager::ReparentStyleContext(nsIFrame* aFrame)
       // Make sure to call CalcStyleDifference so that the new context ends
       // up resolving all the structs the old context resolved.
       if (!copyFromContinuation) {
+        uint32_t equalStructs;
         DebugOnly<nsChangeHint> styleChange =
-          oldContext->CalcStyleDifference(newContext, nsChangeHint(0));
+          oldContext->CalcStyleDifference(newContext, nsChangeHint(0),
+                                          &equalStructs);
         // The style change is always 0 because we have the same rulenode and
         // CalcStyleDifference optimizes us away.  That's OK, though:
         // reparenting should never trigger a frame reconstruct, and whenever
@@ -2198,9 +2203,11 @@ RestyleManager::ReparentStyleContext(nsIFrame* aFrame)
             // Make sure to call CalcStyleDifference so that the new
             // context ends up resolving all the structs the old context
             // resolved.
+            uint32_t equalStructs;
             DebugOnly<nsChangeHint> styleChange =
               oldExtraContext->CalcStyleDifference(newExtraContext,
-                                                   nsChangeHint(0));
+                                                   nsChangeHint(0),
+                                                   &equalStructs);
             // The style change is always 0 because we have the same
             // rulenode and CalcStyleDifference optimizes us away.  That's
             // OK, though: reparenting should never trigger a frame
@@ -2324,16 +2331,22 @@ ElementRestyler::ElementRestyler(ParentContextFromChildFrame,
 void
 ElementRestyler::CaptureChange(nsStyleContext* aOldContext,
                                nsStyleContext* aNewContext,
-                               nsChangeHint aChangeToAssume)
+                               nsChangeHint aChangeToAssume,
+                               uint32_t* aEqualStructs)
 {
+  static_assert(nsStyleStructID_Length <= 32,
+                "aEqualStructs is not big enough");
+
   // Check some invariants about replacing one style context with another.
   NS_ASSERTION(aOldContext->GetPseudo() == aNewContext->GetPseudo(),
                "old and new style contexts should have the same pseudo");
   NS_ASSERTION(aOldContext->GetPseudoType() == aNewContext->GetPseudoType(),
                "old and new style contexts should have the same pseudo");
 
-  nsChangeHint ourChange = aOldContext->CalcStyleDifference(aNewContext,
-                             mParentFrameHintsNotHandledForDescendants);
+  nsChangeHint ourChange =
+    aOldContext->CalcStyleDifference(aNewContext,
+                                     mParentFrameHintsNotHandledForDescendants,
+                                     aEqualStructs);
   NS_ASSERTION(!(ourChange & nsChangeHint_AllReflowHints) ||
                (ourChange & nsChangeHint_NeedReflow),
                "Reflow hint bits set without actually asking for a reflow");
@@ -2389,6 +2402,12 @@ ElementRestyler::Restyle(nsRestyleHint aRestyleHint)
   MOZ_ASSERT(!(aRestyleHint & eRestyle_LaterSiblings),
              "eRestyle_LaterSiblings must not be part of aRestyleHint");
 
+  // List of descendant elements of mContent we know we will eventually need to
+  // restyle.  Before we return from this function, we call
+  // RestyleTracker::AddRestyleRootsIfAwaitingRestyle to ensure they get
+  // restyled in RestyleTracker::DoProcessRestyles.
+  nsTArray<nsRefPtr<Element>> descendants;
+
   nsRestyleHint hintToRestore = nsRestyleHint(0);
   if (mContent && mContent->IsElement() &&
       // If we're we're resolving from the root of the frame tree (which
@@ -2401,45 +2420,251 @@ ElementRestyler::Restyle(nsRestyleHint aRestyleHint)
       // we'll fail to do the restyling we need to do.
       (mContent->GetParent() || mContent->GetPrimaryFrame() == mFrame)) {
     mContent->OwnerDoc()->FlushPendingLinkUpdates();
-    RestyleTracker::RestyleData restyleData;
-    if (mRestyleTracker.GetRestyleData(mContent->AsElement(), &restyleData)) {
-      if (NS_UpdateHint(mHintsHandled, restyleData.mChangeHint)) {
-        mChangeList->AppendChange(mFrame, mContent, restyleData.mChangeHint);
+    nsAutoPtr<RestyleTracker::RestyleData> restyleData;
+    if (mRestyleTracker.GetRestyleData(mContent->AsElement(), restyleData)) {
+      if (NS_UpdateHint(mHintsHandled, restyleData->mChangeHint)) {
+        mChangeList->AppendChange(mFrame, mContent, restyleData->mChangeHint);
       }
-      hintToRestore = restyleData.mRestyleHint;
-      aRestyleHint = nsRestyleHint(aRestyleHint | restyleData.mRestyleHint);
+      hintToRestore = restyleData->mRestyleHint;
+      aRestyleHint = nsRestyleHint(aRestyleHint | restyleData->mRestyleHint);
+      descendants.SwapElements(restyleData->mDescendants);
     }
   }
 
-  nsRestyleHint childRestyleHint = nsRestyleHint(aRestyleHint & eRestyle_Subtree);
+  // If we are restyling this frame with eRestyle_Self, we restyle
+  // children with nsRestyleHint(0).  But we pass the eRestyle_ForceDescendants
+  // flag down too.
+  nsRestyleHint childRestyleHint =
+    nsRestyleHint(aRestyleHint & (eRestyle_Subtree |
+                                  eRestyle_ForceDescendants));
 
-  {
-    nsRefPtr<nsStyleContext> oldContext = mFrame->StyleContext();
+  nsRefPtr<nsStyleContext> oldContext = mFrame->StyleContext();
 
-    // TEMPORARY (until bug 918064):  Call RestyleSelf for each
-    // continuation or block-in-inline sibling.
+  // TEMPORARY (until bug 918064):  Call RestyleSelf for each
+  // continuation or block-in-inline sibling.
 
-    bool haveMoreContinuations = false;
-    for (nsIFrame* f = mFrame; f;
-         f = GetNextContinuationWithSameStyle(f, oldContext,
-                                              &haveMoreContinuations)) {
-      RestyleSelf(f, aRestyleHint);
+  // We must make a single decision on how to process this frame and
+  // its descendants, yet RestyleSelf might return different RestyleResult
+  // values for the different same-style continuations.  |result| is our
+  // overall decision.
+  RestyleResult result = RestyleResult(0);
+  uint32_t swappedStructs = 0;
+
+  nsRestyleHint thisRestyleHint = aRestyleHint;
+
+  bool haveMoreContinuations = false;
+  for (nsIFrame* f = mFrame; f; ) {
+    RestyleResult thisResult = RestyleSelf(f, thisRestyleHint, &swappedStructs);
+
+    if (thisResult != eRestyleResult_Stop) {
+      // Calls to RestyleSelf for later same-style continuations must not
+      // return eRestyleResult_Stop, so pass eRestyle_Force in to them.
+      thisRestyleHint = nsRestyleHint(thisRestyleHint | eRestyle_Force);
+
+      if (result == eRestyleResult_Stop) {
+        // We received eRestyleResult_Stop for earlier same-style
+        // continuations, and eRestyleResult_Continue(AndForceDescendants) for
+        // this one; go back and force-restyle the earlier continuations.
+        result = thisResult;
+        f = mFrame;
+        continue;
+      }
     }
 
-    if (haveMoreContinuations && hintToRestore) {
-      // If we have more continuations with different style (e.g., because
-      // we're inside a ::first-letter or ::first-line), put the restyle
-      // hint back.
-      mRestyleTracker.AddPendingRestyleToTable(mContent->AsElement(),
-                                               hintToRestore, nsChangeHint(0));
+    if (thisResult > result) {
+      // We take the highest RestyleResult value when working out what to do
+      // with this frame and its descendants.  Higher RestyleResult values
+      // represent a superset of the work done by lower values.
+      result = thisResult;
     }
+
+    f = GetNextContinuationWithSameStyle(f, oldContext, &haveMoreContinuations);
+  }
+
+  if (haveMoreContinuations && hintToRestore) {
+    // If we have more continuations with different style (e.g., because
+    // we're inside a ::first-letter or ::first-line), put the restyle
+    // hint back.
+    mRestyleTracker.AddPendingRestyleToTable(mContent->AsElement(),
+                                             hintToRestore, nsChangeHint(0));
+  }
+
+  if (result == eRestyleResult_Stop) {
+    MOZ_ASSERT(mFrame->StyleContext() == oldContext,
+               "frame should have been left with its old style context");
+
+    nsStyleContext* newParent =
+      mFrame->GetParentStyleContextFrame()->StyleContext();
+
+    if (oldContext->GetParent() != newParent) {
+      // If we received eRestyleResult_Stop, then the old style context was
+      // left on mFrame.  Since we ended up restyling our parent, change
+      // this old style context to point to its new parent.
+      oldContext->MoveTo(newParent);
+    }
+
+    // Send the accessibility notifications that RestyleChildren otherwise
+    // would have sent.
+    if (!(mHintsHandled & nsChangeHint_ReconstructFrame)) {
+      InitializeAccessibilityNotifications();
+      SendAccessibilityNotifications();
+    }
+
+    mRestyleTracker.AddRestyleRootsIfAwaitingRestyle(descendants);
+    return;
+  }
+
+  if (!swappedStructs) {
+    // If we swapped any structs from the old context, then we need to keep
+    // it alive until after the RestyleChildren call so that we can fix up
+    // its descendants' cached structs.
+    oldContext = nullptr;
+  }
+
+  if (result == eRestyleResult_ContinueAndForceDescendants) {
+    childRestyleHint =
+      nsRestyleHint(childRestyleHint | eRestyle_ForceDescendants);
   }
 
   RestyleChildren(childRestyleHint);
+
+  if (oldContext && !oldContext->HasSingleReference()) {
+    // If we swapped some structs out of oldContext in the RestyleSelf call
+    // and after the RestyleChildren call we still have other strong references
+    // to it, we need to make ensure its descendants don't cached any of the
+    // structs that were swapped out.
+    //
+    // Most of the time we will not get in here; we do for example when the
+    // style context is being held on to by an nsComputedDOMStyle object.
+    //
+    // Strictly we only have to do this if we have a child whose old or new
+    // style context is shared (as in that case we would not have swapped that
+    // child's structs and it would have kept its now out of date cached
+    // structs).  For now we don't bother tracking that.
+    oldContext->ClearCachedInheritedStyleDataOnDescendants(swappedStructs);
+  }
+
+  mRestyleTracker.AddRestyleRootsIfAwaitingRestyle(descendants);
 }
 
-void
-ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
+/**
+ * Depending on the details of the frame we are restyling or its old style
+ * context, we may or may not be able to stop restyling after this frame if
+ * we find we had no style changes.
+ *
+ * This function returns eRestyleResult_Stop if it does not find any
+ * conditions that would preclude stopping restyling, and
+ * eRestyleResult_Continue if it does.
+ */
+ElementRestyler::RestyleResult
+ElementRestyler::ComputeRestyleResultFromFrame(nsIFrame* aSelf)
+{
+  // We can't handle situations where the primary style context of a frame
+  // has not had any style data changes, but its additional style contexts
+  // have, so we don't considering stopping if this frame has any additional
+  // style contexts.
+  if (aSelf->GetAdditionalStyleContext(0)) {
+    return eRestyleResult_Continue;
+  }
+
+  // Style changes might have moved children between the two nsLetterFrames
+  // (the one matching ::first-letter and the one containing the rest of the
+  // content).  Continue restyling to the children of the nsLetterFrame so
+  // that they get the correct style context parent.  Similarly for
+  // nsLineFrames.
+  nsIAtom* type = aSelf->GetType();
+  if (type == nsGkAtoms::letterFrame || type == nsGkAtoms::lineFrame) {
+    return eRestyleResult_Continue;
+  }
+
+  // Some style computations depend not on the parent's style, but a grandparent
+  // or one the grandparent's ancestors.  An example is an explicit 'inherit'
+  // value for align-self, where if the parent frame's value for the property is
+  // 'auto' we end up inheriting the computed value from the grandparent.  We
+  // can't stop the restyling process on this frame (the one with 'auto', in
+  // this example), as the grandparent's computed value might have changed
+  // and we need to recompute the child's 'inherit' to that new value.
+  nsStyleContext* oldContext = aSelf->StyleContext();
+  if (oldContext->HasChildThatUsesGrandancestorStyle()) {
+    return eRestyleResult_Continue;
+  }
+
+  // We ignore all situations that involve :visited style.
+  if (oldContext->GetStyleIfVisited()) {
+    return eRestyleResult_Continue;
+  }
+
+  nsStyleContext* parentContext = oldContext->GetParent();
+  if (parentContext && parentContext->GetStyleIfVisited()) {
+    return eRestyleResult_Continue;
+  }
+
+  // We also ignore frames for pseudos, as their style contexts have
+  // inheritance structures that do not match the frame inheritance
+  // structure.  To avoid enumerating and checking all of the cases
+  // where we have this kind of inheritance, we keep restyling past
+  // pseudos.
+  nsIAtom* pseudoTag = oldContext->GetPseudo();
+  if (pseudoTag && pseudoTag != nsCSSAnonBoxes::mozNonElement) {
+    return eRestyleResult_Continue;
+  }
+
+  nsIFrame* parent = mFrame->GetParent();
+
+  if (parent) {
+    // Also if the parent has a pseudo, as this frame's style context will
+    // be inheriting from a grandparent frame's style context (or a further
+    // ancestor).
+    nsIAtom* parentPseudoTag = parent->StyleContext()->GetPseudo();
+    if (parentPseudoTag && parentPseudoTag != nsCSSAnonBoxes::mozNonElement) {
+      return eRestyleResult_Continue;
+    }
+  }
+
+  return eRestyleResult_Stop;
+}
+
+ElementRestyler::RestyleResult
+ElementRestyler::ComputeRestyleResultFromNewContext(nsIFrame* aSelf,
+                                                    nsStyleContext* aNewContext)
+{
+  // Keep restyling if the new style context has any style-if-visted style, so
+  // that we can avoid the style context tree surgery having to deal to deal
+  // with visited styles.
+  if (aNewContext->GetStyleIfVisited()) {
+    return eRestyleResult_Continue;
+  }
+
+  // If link-related information has changed, or the pseudo for the frame has
+  // changed, or the new style context points to a different rule node, we can't
+  // leave the old style context on the frame.
+  nsStyleContext* oldContext = aSelf->StyleContext();
+  if (oldContext->IsLinkContext() != aNewContext->IsLinkContext() ||
+      oldContext->RelevantLinkVisited() != aNewContext->RelevantLinkVisited() ||
+      oldContext->GetPseudo() != aNewContext->GetPseudo() ||
+      oldContext->GetPseudoType() != aNewContext->GetPseudoType() ||
+      oldContext->RuleNode() != aNewContext->RuleNode()) {
+    return eRestyleResult_Continue;
+  }
+
+  // If the old and new style contexts differ in their
+  // NS_STYLE_HAS_TEXT_DECORATION_LINES or NS_STYLE_HAS_PSEUDO_ELEMENT_DATA
+  // bits, then we must keep restyling so that those new bit values are
+  // propagated.
+  if (oldContext->HasTextDecorationLines() !=
+        aNewContext->HasTextDecorationLines() ||
+      oldContext->HasPseudoElementData() !=
+        aNewContext->HasPseudoElementData()) {
+    return eRestyleResult_Continue;
+  }
+
+  return eRestyleResult_Stop;
+}
+
+ElementRestyler::RestyleResult
+ElementRestyler::RestyleSelf(nsIFrame* aSelf,
+                             nsRestyleHint aRestyleHint,
+                             uint32_t* aSwappedStructs)
 {
   MOZ_ASSERT(!(aRestyleHint & eRestyle_LaterSiblings),
              "eRestyle_LaterSiblings must not be part of aRestyleHint");
@@ -2452,6 +2677,16 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
   // We do need a reference to oldContext for the lifetime of this function, and it's possible
   // that the frame has the last reference to it, so AddRef it here.
 
+  RestyleResult result;
+
+  if (aRestyleHint & eRestyle_ForceDescendants) {
+    result = eRestyleResult_ContinueAndForceDescendants;
+  } else if (aRestyleHint) {
+    result = eRestyleResult_Continue;
+  } else {
+    result = ComputeRestyleResultFromFrame(aSelf);
+  }
+
   nsChangeHint assumeDifferenceHint = NS_STYLE_HINT_NONE;
   nsRefPtr<nsStyleContext> oldContext = aSelf->StyleContext();
   nsStyleSet* styleSet = mPresContext->StyleSet();
@@ -2501,6 +2736,8 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
     // Set |mResolvedChild| so we don't bother resolving the
     // provider again.
     mResolvedChild = providerFrame;
+    // Continue restyling past the odd style context inheritance.
+    result = eRestyleResult_Continue;
   }
 
   if (providerFrame != aSelf->GetParent()) {
@@ -2532,7 +2769,7 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
   }
   else if (!(aRestyleHint & (eRestyle_Self | eRestyle_Subtree))) {
     Element* element = ElementForStyleContext(mParentContent, aSelf, pseudoType);
-    if (aRestyleHint == nsRestyleHint(0) &&
+    if (!(aRestyleHint & ~(eRestyle_Force | eRestyle_ForceDescendants)) &&
         !styleSet->IsInRuleTreeReconstruct()) {
       nsIContent* pseudoElementContent = aSelf->GetContent();
       Element* pseudoElement =
@@ -2572,6 +2809,16 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
                                     nsChangeHint_ReconstructFrame);
           // We're reframing anyway; just keep the same context
           newContext = oldContext;
+#ifdef DEBUG
+          // oldContext's parent might have had its style structs swapped out
+          // with parentContext, so to avoid any assertions that might
+          // otherwise trigger in oldContext's parent's destructor, we set a
+          // flag on oldContext to skip it and its descendants in
+          // nsStyleContext::AssertStructsNotUsedElsewhere.
+          if (oldContext->GetParent() != parentContext) {
+            oldContext->AddStyleBit(NS_STYLE_IS_GOING_AWAY);
+          }
+#endif
         }
       } else {
         // Don't expect XUL tree stuff here, since it needs a comparator and
@@ -2615,15 +2862,85 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
       // style contexts around.  However, we need to start from the
       // same root.
       newContext = oldContext;
+      // Never consider stopping restyling at the root.
+      result = eRestyleResult_Continue;
     }
   }
 
   if (newContext != oldContext) {
-    if (!copyFromContinuation) {
+    if (result == eRestyleResult_Stop) {
+      if (oldContext->IsShared()) {
+        // If the old style context was shared, then we can't return
+        // eRestyleResult_Stop and patch its parent to point to the
+        // new parent style context, as that change might not be valid
+        // for the other frames sharing the style context.
+        result = eRestyleResult_Continue;
+      } else {
+        // Look at some details of the new style context to see if it would
+        // be safe to stop restyling, if we discover it has the same style
+        // data as the old style context.
+        result = ComputeRestyleResultFromNewContext(aSelf, newContext);
+      }
+    }
+
+    uint32_t equalStructs = 0;
+
+    if (copyFromContinuation) {
+      // In theory we should know whether there was any style data difference,
+      // since we would have calculated that in the previous call to
+      // RestyleSelf, so until we perform only one restyling per chain-of-
+      // same-style continuations (bug 918064), we need to check again here to
+      // determine whether it is safe to stop restyling.
+      if (result == eRestyleResult_Stop) {
+        oldContext->CalcStyleDifference(newContext, nsChangeHint(0),
+                                        &equalStructs);
+        if (equalStructs != NS_STYLE_INHERIT_MASK) {
+          // At least one struct had different data in it, so we must
+          // continue restyling children.
+          result = eRestyleResult_Continue;
+        }
+      }
+    } else {
       RestyleManager::TryStartingTransition(mPresContext, aSelf->GetContent(),
                                             oldContext, &newContext);
 
-      CaptureChange(oldContext, newContext, assumeDifferenceHint);
+      CaptureChange(oldContext, newContext, assumeDifferenceHint,
+                    &equalStructs);
+      if (equalStructs != NS_STYLE_INHERIT_MASK) {
+        // At least one struct had different data in it, so we must
+        // continue restyling children.
+        result = eRestyleResult_Continue;
+      }
+    }
+
+    if (result == eRestyleResult_Stop) {
+      // Since we currently have eRestyleResult_Stop, we know at this
+      // point that all of our style structs are equal in terms of styles.
+      // However, some of them might be different pointers.  Since our
+      // descendants might share those pointers, we have to continue to
+      // restyling our descendants.
+      //
+      // However, because of the swapping of equal structs we've done on
+      // ancestors (later in this function), we've ensured that for structs
+      // that cannot be stored in the rule tree, we keep the old equal structs
+      // around rather than replacing them with new ones.  This means that we
+      // only time we hit this deoptimization is either
+      //
+      // (a) when at least one of the (old or new) equal structs could be stored
+      //     in the rule tree, and those structs are then inherited (by pointer
+      //     sharing) to descendant style contexts; or
+      //
+      // (b) when we were unable to swap the structs on the parent because
+      //     either or both of the old parent and new parent are shared.
+      for (nsStyleStructID sid = nsStyleStructID(0);
+           sid < nsStyleStructID_Length;
+           sid = nsStyleStructID(sid + 1)) {
+        if (oldContext->HasCachedInheritedStyleData(sid) &&
+            !oldContext->HasSameCachedStyleData(newContext, sid)) {
+          result = eRestyleResult_Continue;
+          break;
+        }
+      }
     }
 
     if (!(mHintsHandled & nsChangeHint_ReconstructFrame)) {
@@ -2634,7 +2951,14 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
       // CaptureChange because of copyFromContinuation being true,
       // since we'll have copied the existing context from the
       // previous continuation, so newContext == oldContext.
-      aSelf->SetStyleContext(newContext);
+
+      if (result != eRestyleResult_Stop) {
+        if (!oldContext->IsShared() && !newContext->IsShared()) {
+          oldContext->SwapStyleData(newContext, equalStructs);
+          *aSwappedStructs |= equalStructs;
+        }
+        aSelf->SetStyleContext(newContext);
+      }
     }
   }
   oldContext = nullptr;
@@ -2692,12 +3016,16 @@ ElementRestyler::RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint)
     MOZ_ASSERT(newExtraContext);
 
     if (oldExtraContext != newExtraContext) {
-      CaptureChange(oldExtraContext, newExtraContext, assumeDifferenceHint);
+      uint32_t equalStructs;
+      CaptureChange(oldExtraContext, newExtraContext, assumeDifferenceHint,
+                    &equalStructs);
       if (!(mHintsHandled & nsChangeHint_ReconstructFrame)) {
         aSelf->SetAdditionalStyleContext(contextIndex, newExtraContext);
       }
     }
   }
+
+  return result;
 }
 
 void
@@ -2810,12 +3138,12 @@ ElementRestyler::RestyleUndisplayedChildren(nsRestyleHint aChildRestyleHint)
       }
 
       nsRestyleHint thisChildHint = aChildRestyleHint;
-      RestyleTracker::RestyleData undisplayedRestyleData;
+      nsAutoPtr<RestyleTracker::RestyleData> undisplayedRestyleData;
       Element* element = undisplayed->mContent->AsElement();
       if (mRestyleTracker.GetRestyleData(element,
-                                         &undisplayedRestyleData)) {
+                                         undisplayedRestyleData)) {
         thisChildHint =
-          nsRestyleHint(thisChildHint | undisplayedRestyleData.mRestyleHint);
+          nsRestyleHint(thisChildHint | undisplayedRestyleData->mRestyleHint);
       }
       nsRefPtr<nsStyleContext> undisplayedContext;
       nsStyleSet* styleSet = mPresContext->StyleSet();
diff --git a/layout/base/RestyleManager.h b/layout/base/RestyleManager.h
index 3f8a8995af9..f77fd15fe20 100644
--- a/layout/base/RestyleManager.h
+++ b/layout/base/RestyleManager.h
@@ -452,10 +452,29 @@ public:
   nsChangeHint HintsHandledForFrame() { return mHintsHandled; }
 
 private:
+  // Enum for the result of RestyleSelf, which indicates whether the
+  // restyle procedure should continue to the children, and how.
+  //
+  // These values must be ordered so that later values imply that all
+  // the work of the earlier values is also done.
+  enum RestyleResult {
+
+    // do not restyle children
+    eRestyleResult_Stop = 1,
+
+    // continue restyling children
+    eRestyleResult_Continue,
+
+    // continue restyling children with eRestyle_ForceDescendants set
+    eRestyleResult_ContinueAndForceDescendants
+  };
+
   /**
    * First half of Restyle().
    */
-  void RestyleSelf(nsIFrame* aSelf, nsRestyleHint aRestyleHint);
+  RestyleResult RestyleSelf(nsIFrame* aSelf,
+                            nsRestyleHint aRestyleHint,
+                            uint32_t* aSwappedStructs);
 
   /**
    * Restyle the children of this frame (and, in turn, their children).
@@ -465,11 +484,15 @@ private:
   void RestyleChildren(nsRestyleHint aChildRestyleHint);
 
   /**
-   * Helper for RestyleSelf().
+   * Helpers for RestyleSelf().
    */
   void CaptureChange(nsStyleContext* aOldContext,
                      nsStyleContext* aNewContext,
-                     nsChangeHint aChangeToAssume);
+                     nsChangeHint aChangeToAssume,
+                     uint32_t* aEqualStructs);
+  RestyleResult ComputeRestyleResultFromFrame(nsIFrame* aSelf);
+  RestyleResult ComputeRestyleResultFromNewContext(nsIFrame* aSelf,
+                                                   nsStyleContext* aNewContext);
 
   /**
    * Helpers for RestyleChildren().
diff --git a/layout/base/RestyleTracker.cpp b/layout/base/RestyleTracker.cpp
index 3189859da0b..ddb47984cb3 100644
--- a/layout/base/RestyleTracker.cpp
+++ b/layout/base/RestyleTracker.cpp
@@ -29,7 +29,7 @@ struct LaterSiblingCollector {
 
 static PLDHashOperator
 CollectLaterSiblings(nsISupports* aElement,
-                     RestyleTracker::RestyleData& aData,
+                     nsAutoPtr<RestyleTracker::RestyleData>& aData,
                      void* aSiblingCollector)
 {
   dom::Element* element =
@@ -42,7 +42,7 @@ CollectLaterSiblings(nsISupports* aElement,
   // document.
   if (element->GetCrossShadowCurrentDoc() == collector->tracker->Document() &&
       element->HasFlag(collector->tracker->RestyleBit()) &&
-      (aData.mRestyleHint & eRestyle_LaterSiblings)) {
+      (aData->mRestyleHint & eRestyle_LaterSiblings)) {
     collector->elements->AppendElement(element);
   }
 
@@ -56,7 +56,7 @@ struct RestyleCollector {
 
 static PLDHashOperator
 CollectRestyles(nsISupports* aElement,
-                RestyleTracker::RestyleData& aData,
+                nsAutoPtr<RestyleTracker::RestyleData>& aData,
                 void* aRestyleCollector)
 {
   dom::Element* element =
@@ -83,7 +83,7 @@ CollectRestyles(nsISupports* aElement,
                // the bit, since any descendants that didn't get added
                // to the roots list because we had the bits will be
                // completely restyled in a moment.
-               (aData.mChangeHint & nsChangeHint_ReconstructFrame),
+               (aData->mChangeHint & nsChangeHint_ReconstructFrame),
                "Why did this not get handled while processing mRestyleRoots?");
 
   // Unset the restyle bits now, so if they get readded later as we
@@ -96,8 +96,8 @@ CollectRestyles(nsISupports* aElement,
   RestyleTracker::RestyleEnumerateData* currentRestyle =
     *restyleArrayPtr;
   currentRestyle->mElement = element;
-  currentRestyle->mRestyleHint = aData.mRestyleHint;
-  currentRestyle->mChangeHint = aData.mChangeHint;
+  currentRestyle->mRestyleHint = aData->mRestyleHint;
+  currentRestyle->mChangeHint = aData->mChangeHint;
 
   // Increment to the next slot in the array
   *restyleArrayPtr = currentRestyle + 1;
@@ -164,16 +164,14 @@ RestyleTracker::DoProcessRestyles()
       for (uint32_t i = 0; i < laterSiblingArr.Length(); ++i) {
         Element* element = laterSiblingArr[i];
         NS_ASSERTION(element->HasFlag(RestyleBit()), "How did that happen?");
-        RestyleData data;
+        RestyleData* data;
 #ifdef DEBUG
         bool found =
 #endif
           mPendingRestyles.Get(element, &data);
         NS_ASSERTION(found, "Where did our entry go?");
-        data.mRestyleHint =
-          nsRestyleHint(data.mRestyleHint & ~eRestyle_LaterSiblings);
-
-        mPendingRestyles.Put(element, data);
+        data->mRestyleHint =
+          nsRestyleHint(data->mRestyleHint & ~eRestyle_LaterSiblings);
       }
 
       mHaveLaterSiblingRestyles = false;
@@ -197,12 +195,13 @@ RestyleTracker::DoProcessRestyles()
         continue;
       }
 
-      RestyleData data;
-      if (!GetRestyleData(element, &data)) {
+      nsAutoPtr<RestyleData> data;
+      if (!GetRestyleData(element, data)) {
         continue;
       }
 
-      ProcessOneRestyle(element, data.mRestyleHint, data.mChangeHint);
+      ProcessOneRestyle(element, data->mRestyleHint, data->mChangeHint);
+      AddRestyleRootsIfAwaitingRestyle(data->mDescendants);
     }
 
     if (mHaveLaterSiblingRestyles) {
@@ -232,6 +231,8 @@ RestyleTracker::DoProcessRestyles()
         ProcessOneRestyle(currentRestyle->mElement,
                           currentRestyle->mRestyleHint,
                           currentRestyle->mChangeHint);
+
+        MOZ_ASSERT(currentRestyle->mDescendants.IsEmpty());
       }
     }
   }
@@ -240,7 +241,7 @@ RestyleTracker::DoProcessRestyles()
 }
 
 bool
-RestyleTracker::GetRestyleData(Element* aElement, RestyleData* aData)
+RestyleTracker::GetRestyleData(Element* aElement, nsAutoPtr<RestyleData>& aData)
 {
   NS_PRECONDITION(aElement->GetCrossShadowCurrentDoc() == Document(),
                   "Unexpected document; this will lead to incorrect behavior!");
@@ -250,31 +251,55 @@ RestyleTracker::GetRestyleData(Element* aElement, RestyleData* aData)
     return false;
   }
 
-#ifdef DEBUG
-  bool gotData =
-#endif
-  mPendingRestyles.Get(aElement, aData);
-  NS_ASSERTION(gotData, "Must have data if restyle bit is set");
+  mPendingRestyles.RemoveAndForget(aElement, aData);
+  NS_ASSERTION(aData.get(), "Must have data if restyle bit is set");
 
   if (aData->mRestyleHint & eRestyle_LaterSiblings) {
     // Someone readded the eRestyle_LaterSiblings hint for this
     // element.  Leave it around for now, but remove the other restyle
     // hints and the change hint for it.  Also unset its root bit,
     // since it's no longer a root with the new restyle data.
-    RestyleData newData;
-    newData.mChangeHint = nsChangeHint(0);
-    newData.mRestyleHint = eRestyle_LaterSiblings;
+    NS_ASSERTION(aData->mDescendants.IsEmpty(),
+                 "expected descendants to be handled by now");
+    RestyleData* newData = new RestyleData;
+    newData->mChangeHint = nsChangeHint(0);
+    newData->mRestyleHint = eRestyle_LaterSiblings;
     mPendingRestyles.Put(aElement, newData);
     aElement->UnsetFlags(RootBit());
     aData->mRestyleHint =
       nsRestyleHint(aData->mRestyleHint & ~eRestyle_LaterSiblings);
   } else {
-    mPendingRestyles.Remove(aElement);
     aElement->UnsetFlags(mRestyleBits);
   }
 
   return true;
 }
 
-} // namespace mozilla
+void
+RestyleTracker::AddRestyleRootsIfAwaitingRestyle(
+                                   const nsTArray<nsRefPtr<Element>>& aElements)
+{
+  // The RestyleData for a given element has stored in mDescendants
+  // the list of descendants we need to end up restyling.  Since we
+  // won't necessarily end up restyling them, due to the restyle
+  // process finishing early (see how eRestyleResult_Stop is handled
+  // in ElementRestyler::Restyle), we add them to the list of restyle
+  // roots to handle the next time around the
+  // RestyleTracker::DoProcessRestyles loop.
+  //
+  // Note that aElements must maintain the same invariant
+  // that mRestyleRoots does, i.e. that ancestors appear after descendants.
+  // Since we call AddRestyleRootsIfAwaitingRestyle only after we have
+  // removed the restyle root we are currently processing from the end of
+  // mRestyleRoots, and the only elements we get here in aElements are
+  // descendants of that restyle root, we are safe to simply append to the
+  // end of mRestyleRoots to maintain its invariant.
+  for (size_t i = 0; i < aElements.Length(); i++) {
+    Element* element = aElements[i];
+    if (element->HasFlag(RestyleBit())) {
+      mRestyleRoots.AppendElement(element);
+    }
+  }
+}
 
+} // namespace mozilla
diff --git a/layout/base/RestyleTracker.h b/layout/base/RestyleTracker.h
index 8ba9741830a..4e32b21c07a 100644
--- a/layout/base/RestyleTracker.h
+++ b/layout/base/RestyleTracker.h
@@ -12,7 +12,7 @@
 #define mozilla_RestyleTracker_h
 
 #include "mozilla/dom/Element.h"
-#include "nsDataHashtable.h"
+#include "nsClassHashtable.h"
 #include "nsContainerFrame.h"
 #include "mozilla/SplayTree.h"
 
@@ -286,10 +286,26 @@ public:
   Element::FlagsType RootBit() const {
     return mRestyleBits & ~ELEMENT_PENDING_RESTYLE_FLAGS;
   }
-  
+
   struct RestyleData {
-    nsRestyleHint mRestyleHint;  // What we want to restyle
-    nsChangeHint  mChangeHint;   // The minimal change hint for "self"
+    RestyleData() {
+      mRestyleHint = nsRestyleHint(0);
+      mChangeHint = NS_STYLE_HINT_NONE;
+    }
+
+    RestyleData(nsRestyleHint aRestyleHint, nsChangeHint aChangeHint) {
+      mRestyleHint = aRestyleHint;
+      mChangeHint = aChangeHint;
+    }
+
+    nsRestyleHint mRestyleHint;       // What we want to restyle
+    nsChangeHint mChangeHint;         // The minimal change hint for "self"
+
+    // Descendant elements we must check that we ended up restyling, ordered
+    // with the same invariant as mRestyleRoots.  The elements here are those
+    // that we called AddPendingRestyle for and found the element this is
+    // the RestyleData for as its nearest restyle root.
+    nsTArray<nsRefPtr<Element>> mDescendants;
   };
 
   /**
@@ -300,10 +316,24 @@ public:
    * eRestyle_LaterSiblings hint in it.
    *
    * The return value indicates whether any restyle data was found for
-   * the element.  If false is returned, then the state of *aData is
-   * undefined.
+   * the element.  aData is set to nullptr iff false is returned.
    */
-  bool GetRestyleData(Element* aElement, RestyleData* aData);
+  bool GetRestyleData(Element* aElement, nsAutoPtr<RestyleData>& aData);
+
+  /**
+   * For each element in aElements, appends it to mRestyleRoots if it
+   * has its restyle bit set.  This is used to ensure we restyle elements
+   * that we did not add as restyle roots initially (due to there being
+   * an ancestor with the restyle root bit set), but which we might
+   * not have got around to restyling due to the restyle process
+   * terminating early with eRestyleResult_Stop (see ElementRestyler::Restyle).
+   *
+   * This function must be called with elements in order such that
+   * appending them to mRestyleRoots maintains its ordering invariant that
+   * ancestors appear after descendants.
+   */
+  void AddRestyleRootsIfAwaitingRestyle(
+                                  const nsTArray<nsRefPtr<Element>>& aElements);
 
   /**
    * The document we're associated with.
@@ -332,14 +362,14 @@ private:
    */
   void DoProcessRestyles();
 
-  typedef nsDataHashtable<nsISupportsHashKey, RestyleData> PendingRestyleTable;
+  typedef nsClassHashtable<nsISupportsHashKey, RestyleData> PendingRestyleTable;
   typedef nsAutoTArray< nsRefPtr<Element>, 32> RestyleRootArray;
   // Our restyle bits.  These will be a subset of ELEMENT_ALL_RESTYLE_FLAGS, and
   // will include one flag from ELEMENT_PENDING_RESTYLE_FLAGS and one flag
   // that's not in ELEMENT_PENDING_RESTYLE_FLAGS.
   Element::FlagsType mRestyleBits;
   RestyleManager* mRestyleManager; // Owns us
-  // A hashtable that maps elements to RestyleData structs.  The
+  // A hashtable that maps elements to pointers to RestyleData structs.  The
   // values only make sense if the element's current document is our
   // document and it has our RestyleBit() flag set.  In particular,
   // said bit might not be set if the element had a restyle posted and
@@ -363,9 +393,7 @@ RestyleTracker::AddPendingRestyleToTable(Element* aElement,
                                          nsRestyleHint aRestyleHint,
                                          nsChangeHint aMinChangeHint)
 {
-  RestyleData existingData;
-  existingData.mRestyleHint = nsRestyleHint(0);
-  existingData.mChangeHint = NS_STYLE_HINT_NONE;
+  RestyleData* existingData;
 
   // Check the RestyleBit() flag before doing the hashtable Get, since
   // it's possible that the data in the hashtable isn't actually
@@ -374,15 +402,20 @@ RestyleTracker::AddPendingRestyleToTable(Element* aElement,
     mPendingRestyles.Get(aElement, &existingData);
   } else {
     aElement->SetFlags(RestyleBit());
+    existingData = nullptr;
+  }
+
+  if (!existingData) {
+    mPendingRestyles.Put(aElement,
+                         new RestyleData(aRestyleHint, aMinChangeHint));
+    return false;
   }
 
   bool hadRestyleLaterSiblings =
-    (existingData.mRestyleHint & eRestyle_LaterSiblings) != 0;
-  existingData.mRestyleHint =
-    nsRestyleHint(existingData.mRestyleHint | aRestyleHint);
-  NS_UpdateHint(existingData.mChangeHint, aMinChangeHint);
-
-  mPendingRestyles.Put(aElement, existingData);
+    (existingData->mRestyleHint & eRestyle_LaterSiblings) != 0;
+  existingData->mRestyleHint =
+    nsRestyleHint(existingData->mRestyleHint | aRestyleHint);
+  NS_UpdateHint(existingData->mChangeHint, aMinChangeHint);
 
   return hadRestyleLaterSiblings;
 }
@@ -400,7 +433,8 @@ RestyleTracker::AddPendingRestyle(Element* aElement,
   // ReResolveStyleContext on it or just reframe it).
   if ((aRestyleHint & ~eRestyle_LaterSiblings) ||
       (aMinChangeHint & nsChangeHint_ReconstructFrame)) {
-    for (const Element* cur = aElement; !cur->HasFlag(RootBit()); ) {
+    Element* cur = aElement;
+    while (!cur->HasFlag(RootBit())) {
       nsIContent* parent = cur->GetFlattenedTreeParent();
       // Stop if we have no parent or the parent is not an element or
       // we're part of the viewport scrollbars (because those are not
@@ -418,6 +452,7 @@ RestyleTracker::AddPendingRestyle(Element* aElement,
            cur->GetPrimaryFrame() &&
            cur->GetPrimaryFrame()->GetParent() != parent->GetPrimaryFrame())) {
         mRestyleRoots.AppendElement(aElement);
+        cur = aElement;
         break;
       }
       cur = parent->AsElement();
@@ -426,6 +461,21 @@ RestyleTracker::AddPendingRestyle(Element* aElement,
     // itself) is in mRestyleRoots.  Set the root bit on aElement, to
     // speed up searching for an existing root on its descendants.
     aElement->SetFlags(RootBit());
+    if (cur != aElement) {
+      // We are already going to restyle cur, one of aElement's ancestors,
+      // but we might not end up restyling all the way down to aElement.
+      // Record it in the RestyleData so we can ensure it does get restyled
+      // after we deal with cur.
+      //
+      // As with the mRestyleRoots array, mDescendants maintains the
+      // invariant that if two elements appear in the array and one
+      // is an ancestor of the other, that the ancestor appears after
+      // the descendant.
+      RestyleData* curData;
+      mPendingRestyles.Get(cur, &curData);
+      NS_ASSERTION(curData, "expected to find a RestyleData for cur");
+      curData->mDescendants.AppendElement(aElement);
+    }
   }
 
   mHaveLaterSiblingRestyles =
diff --git a/layout/base/nsCaret.cpp b/layout/base/nsCaret.cpp
index 6316c18c9d6..a67a2054564 100644
--- a/layout/base/nsCaret.cpp
+++ b/layout/base/nsCaret.cpp
@@ -548,7 +548,7 @@ void nsCaret::ResetBlinking()
 {
   mIsBlinkOn = true;
 
-  if (mReadOnly) {
+  if (mReadOnly || !mVisible) {
     StopBlinking();
     return;
   }
diff --git a/layout/base/nsChangeHint.h b/layout/base/nsChangeHint.h
index a77bdf53cea..1b195cd1e7c 100644
--- a/layout/base/nsChangeHint.h
+++ b/layout/base/nsChangeHint.h
@@ -133,7 +133,23 @@ enum nsChangeHint {
    * This will schedule an invalidating paint. This is useful if something
    * has changed which will be invalidated by DLBI.
    */
-  nsChangeHint_SchedulePaint = 0x80000
+  nsChangeHint_SchedulePaint = 0x80000,
+
+  /**
+   * A hint reflecting that style data changed with no change handling
+   * behavior.  We need to return this, rather than NS_STYLE_HINT_NONE,
+   * so that certain optimizations that manipulate the style context tree are
+   * correct.
+   *
+   * nsChangeHint_NeutralChange must be returned by CalcDifference on a given
+   * style struct if the data in the style structs are meaningfully different
+   * and if no other change hints are returned.  If any other change hints are
+   * set, then nsChangeHint_NeutralChange need not also be included, but it is
+   * safe to do so.  (An example of style structs having non-meaningfully
+   * different data would be cached information that would be re-calculated
+   * to the same values, such as nsStyleBorder::mSubImages.)
+   */
+  nsChangeHint_NeutralChange = 0x100000
 
   // IMPORTANT NOTE: When adding new hints, consider whether you need to
   // add them to NS_HintsNotHandledForDescendantsIn() below.
@@ -250,6 +266,16 @@ inline nsChangeHint NS_HintsNotHandledForDescendantsIn(nsChangeHint aChangeHint)
  * |nsRestyleHint| is a bitfield for the result of
  * |HasStateDependentStyle| and |HasAttributeDependentStyle|.  When no
  * restyling is necessary, use |nsRestyleHint(0)|.
+ *
+ * Without eRestyle_Force or eRestyle_ForceDescendants, the restyling process
+ * can stop processing at a frame when it detects no style changes and it is
+ * known that the styles of the subtree beneath it will not change, leaving
+ * the old style context on the frame.  eRestyle_Force can be used to skip this
+ * optimization on a frame, and to force its new style context to be used.
+ *
+ * Similarly, eRestyle_ForceDescendants will cause the frame and all of its
+ * descendants to be traversed and for the new style contexts that are created
+ * to be set on the frames.
  */
 enum nsRestyleHint {
   // Rerun selector matching on the element.  If a new style context
@@ -278,6 +304,15 @@ enum nsRestyleHint {
   // eRestyle_Subtree is also set, since those imply a superset of the
   // work.)
   eRestyle_CSSAnimations = (1<<4),
+
+  // Continue the restyling process to the current frame's children even
+  // if this frame's restyling resulted in no style changes.
+  eRestyle_Force = (1<<5),
+
+  // Continue the restyling process to all of the current frame's
+  // descendants, even if any frame's restyling resulted in no style
+  // changes.  (Implies eRestyle_Force.)
+  eRestyle_ForceDescendants = (1<<6),
 };
 
 
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 8f40ccf6a28..7d41a589464 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -2134,7 +2134,7 @@ PresShell::SetIgnoreFrameDestruction(bool aIgnore)
   if (mDocument) {
     // We need to tell the ImageLoader to drop all its references to frames
     // because they're about to go away and it won't get notifications of that.
-    mDocument->StyleImageLoader()->ClearFrames();
+    mDocument->StyleImageLoader()->ClearFrames(mPresContext);
   }
   mIgnoreFrameDestruction = aIgnore;
 }
@@ -6915,7 +6915,8 @@ PresShell::HandleEvent(nsIFrame* aFrame,
       // document that is being captured.
       retargetEventDoc = capturingContent->GetCrossShadowCurrentDoc();
 #ifdef ANDROID
-    } else if (aEvent->mClass == eTouchEventClass) {
+    } else if (aEvent->mClass == eTouchEventClass ||
+              (aEvent->AsMouseEvent() && aEvent->AsMouseEvent()->inputSource == nsIDOMMouseEvent::MOZ_SOURCE_TOUCH)) {
       retargetEventDoc = GetTouchEventTargetDocument();
 #endif
     }
diff --git a/layout/base/tests/bug558663.html b/layout/base/tests/bug558663.html
new file mode 100644
index 00000000000..ecf0fc6c63d
--- /dev/null
+++ b/layout/base/tests/bug558663.html
@@ -0,0 +1,101 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=558663
+-->
+<head>
+  <title>Test for Bug 558663</title>
+</head>
+<body>
+<p><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=558663">Mozilla Bug 558663</a></p>
+
+ <!-- 20x20 of red -->
+<iframe id="iframe" src="data:text/html,<img id='image' border='0' src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAIAAAAC64paAAAAG0lEQVR42mP8z0A%2BYKJA76jmUc2jmkc1U0EzACKcASfOgGoMAAAAAElFTkSuQmCC'>"></iframe>
+
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug 558663 **/
+var ok = parent.ok;
+var SimpleTest = parent.SimpleTest;
+var compareSnapshots = parent.compareSnapshots;
+var snapshotWindow = parent.snapshotWindow;
+var synthesizeMouse = parent.synthesizeMouse;
+
+window.addEventListener("load", runTest, false);
+
+function checkSnapshots(s1, s2, shouldBeEqual, testName) {
+  var res = compareSnapshots(s1, s2, shouldBeEqual);
+  if (res[0]) {
+    ok(true, testName + " snapshots compare correctly");
+  } else {
+    ok(false, testName + " snapshots compare incorrectly. snapshot 1: " +
+              res[1] + " snapshot 2: " + res[2]); 
+  }
+}
+
+function runTest() {
+  document.getElementById("iframe").contentWindow.document.designMode = "on";
+
+  // The editor requires the event loop to spin after you turn on design mode
+  // before it takes effect.
+  setTimeout(continueTest, 100);
+}
+
+function continueTest() {
+  var win = document.getElementById("iframe").contentWindow;
+  var doc = win.document;
+  var image = doc.getElementById("image");
+
+  // We want to test that clicking on the image and then clicking on one of the
+  // draggers doesn't make the draggers disappear.
+
+  // clean snapshot
+  var before = snapshotWindow(win);
+
+  // click to get the draggers
+  synthesizeMouse(image, 1, 1, {type: "mousedown"}, win);
+  synthesizeMouse(image, 1, 1, {type: "mouseup"}, win);
+
+  // mouse over a dragger will change its color, so move the mouse away
+  synthesizeMouse(doc.documentElement, 50, 50, {type: "mousemove"}, win);
+
+  // snapshot with hopefully draggers
+  var middle = snapshotWindow(win);
+
+  // clicking on the top left dragger shouldn't change anything
+  synthesizeMouse(image, 1, 1, {type: "mousedown"}, win);
+  synthesizeMouse(image, 1, 1, {type: "mouseup"}, win);
+
+  // mouse over a dragger will change its color, so move the mouse away
+  synthesizeMouse(doc.documentElement, 50, 50, {type: "mousemove"}, win);
+
+  // snapshot with hopefully draggers again
+  var middle2 = snapshotWindow(win);
+
+  // click outside the image (but inside the document) to unselect it
+  synthesizeMouse(doc.documentElement, 50, 50, {type: "mousedown"}, win);
+  synthesizeMouse(doc.documentElement, 50, 50, {type: "mouseup"}, win);
+
+  // and then click outside the document so we don't draw a caret
+  synthesizeMouse(document.documentElement, 1, 1, {type: "mousedown"}, window);
+  synthesizeMouse(document.documentElement, 1, 1, {type: "mouseup"}, window);
+
+  // hopefully clean snapshot
+  var end = snapshotWindow(win);
+
+  // before == end && middle == middle2 && before/end != middle/middle2
+  checkSnapshots(before, end, true, "before and after should be the same")
+  checkSnapshots(middle, middle2, true, "middle two should be the same");
+  checkSnapshots(before, middle, false, "before and middle should not be the same");
+  checkSnapshots(before, middle2, false, "before and middle2 should not be the same");
+  checkSnapshots(middle, end, false, "middle and end should not be the same");
+  checkSnapshots(middle2, end, false, "middle2 and end should not be the same");
+
+  SimpleTest.finish();
+}
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/base/tests/mochitest.ini b/layout/base/tests/mochitest.ini
index 860326e3743..bce8fc62fc1 100644
--- a/layout/base/tests/mochitest.ini
+++ b/layout/base/tests/mochitest.ini
@@ -30,6 +30,7 @@ support-files =
   bug467672-4-ref.html
   bug467672-5.html
   bug467672-5-ref.html
+  bug558663.html
   bug570378-arabic-1.html
   bug570378-arabic-1-ref.html
   bug570378-arabic-2.html
diff --git a/layout/base/tests/test_bug558663.html b/layout/base/tests/test_bug558663.html
index cd879deb4b8..16e28a72913 100644
--- a/layout/base/tests/test_bug558663.html
+++ b/layout/base/tests/test_bug558663.html
@@ -1,101 +1,33 @@
-<!DOCTYPE HTML>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!DOCTYPE html>
 <html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=558663
--->
-<head>
-  <title>Test for Bug 558663</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
-  <script type="application/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<p><a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=558663">Mozilla Bug 514127</a></p>
-
- <!-- 20x20 of red -->
-<iframe id="iframe" src="data:text/html,<img id='image' border='0' src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAIAAAAC64paAAAAG0lEQVR42mP8z0A%2BYKJA76jmUc2jmkc1U0EzACKcASfOgGoMAAAAAElFTkSuQmCC'>"></iframe>
-
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 558663 **/
-
-SimpleTest.waitForExplicitFinish();
-window.addEventListener("load", runTest, false);
-
-function checkSnapshots(s1, s2, shouldBeEqual, testName) {
-  var res = compareSnapshots(s1, s2, shouldBeEqual);
-  if (res[0]) {
-    ok(true, testName + " snapshots compare correctly");
-  } else {
-    ok(false, testName + " snapshots compare incorrectly. snapshot 1: " +
-              res[1] + " snapshot 2: " + res[2]); 
-  }
-}
-
-function runTest() {
-  document.getElementById("iframe").contentWindow.document.designMode = "on";
-
-  // The editor requires the event loop to spin after you turn on design mode
-  // before it takes effect.
-  setTimeout(continueTest, 100);
-}
-
-function continueTest() {
-  var win = document.getElementById("iframe").contentWindow;
-  var doc = win.document;
-  var image = doc.getElementById("image");
-
-  // We want to test that clicking on the image and then clicking on one of the
-  // draggers doesn't make the draggers disappear.
-
-  // clean snapshot
-  var before = snapshotWindow(win);
-
-  // click to get the draggers
-  synthesizeMouse(image, 1, 1, {type: "mousedown"}, win);
-  synthesizeMouse(image, 1, 1, {type: "mouseup"}, win);
-
-  // mouse over a dragger will change its color, so move the mouse away
-  synthesizeMouse(doc.documentElement, 50, 50, {type: "mousemove"}, win);
-
-  // snapshot with hopefully draggers
-  var middle = snapshotWindow(win);
-
-  // clicking on the top left dragger shouldn't change anything
-  synthesizeMouse(image, 1, 1, {type: "mousedown"}, win);
-  synthesizeMouse(image, 1, 1, {type: "mouseup"}, win);
-
-  // mouse over a dragger will change its color, so move the mouse away
-  synthesizeMouse(doc.documentElement, 50, 50, {type: "mousemove"}, win);
-
-  // snapshot with hopefully draggers again
-  var middle2 = snapshotWindow(win);
-
-  // click outside the image (but inside the document) to unselect it
-  synthesizeMouse(doc.documentElement, 50, 50, {type: "mousedown"}, win);
-  synthesizeMouse(doc.documentElement, 50, 50, {type: "mouseup"}, win);
-
-  // and then click outside the document so we don't draw a caret
-  synthesizeMouse(document.documentElement, 1, 1, {type: "mousedown"}, window);
-  synthesizeMouse(document.documentElement, 1, 1, {type: "mouseup"}, window);
-
-  // hopefully clean snapshot
-  var end = snapshotWindow(win);
-
-  // before == end && middle == middle2 && before/end != middle/middle2
-  checkSnapshots(before, end, true, "before and after should be the same")
-  checkSnapshots(middle, middle2, true, "middle two should be the same");
-  checkSnapshots(before, middle, false, "before and middle should not be the same");
-  checkSnapshots(before, middle2, false, "before and middle2 should not be the same");
-  checkSnapshots(middle, end, false, "middle and end should not be the same");
-  checkSnapshots(middle2, end, false, "middle2 and end should not be the same");
-
-  SimpleTest.finish();
-}
-
-</script>
-</pre>
-</body>
+  <head>
+    <title>Bug 558663 test</title>
+    <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+    <script type="application/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
+    <script type="application/javascript" src="/tests/SimpleTest/WindowSnapshot.js"></script>
+    <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+    <style>
+      iframe {
+        width: 600px;
+        height: 400px;
+      }
+    </style>
+  </head>
+  <body>
+    <div id="container"></div>
+  </body>
+  <script>
+  SimpleTest.waitForExplicitFinish();
+  // Selection caret's pref is checked only when PresShell is initialized. To turn
+  // off the pref, we test bug 558663 in an iframe.
+  SpecialPowers.pushPrefEnv({"set": [['selectioncaret.enabled', false]]}, function() {
+    var iframe = document.createElement("iframe");
+    iframe.src = "bug558663.html";
+    document.getElementById('container').appendChild(iframe);
+  });
+  </script>
 </html>
diff --git a/layout/forms/test/test_bug572649.html b/layout/forms/test/test_bug572649.html
index 22224561c55..c6f00f3bb60 100644
--- a/layout/forms/test/test_bug572649.html
+++ b/layout/forms/test/test_bug572649.html
@@ -35,6 +35,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=572649
 
 /** Test for Bug 572649 **/
 SimpleTest.waitForExplicitFinish();
+
+// We intermittently trigger two "Wrong parent style context" assertions
+// on B2G emulator builds (bug XXXXXXX).  The two frames that get incorrect
+// style context parents are scroll bar parts in the <textarea>.
+SimpleTest.expectAssertions(0, 2);
+
 addLoadEvent(function() {
   var area = document.getElementById("area");
 
@@ -52,7 +58,6 @@ addLoadEvent(function() {
     synthesizeMouse(area, rect.width - 5, 5, {});
   }, 0);
 });
-
 </script>
 </pre>
 </body>
diff --git a/layout/generic/crashtests/876074-1.html b/layout/generic/crashtests/876074-1.html
index fb394480dde..8a9c5f64afc 100644
--- a/layout/generic/crashtests/876074-1.html
+++ b/layout/generic/crashtests/876074-1.html
@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html>
+<html class="reftest-wait">
 <head>
 <meta charset="UTF-8">
 <script>
@@ -7,11 +7,14 @@
 function boom()
 {
     document.getElementById("c").style.content = "'x'";
+    document.documentElement.removeAttribute("class");
 }
 
+window.addEventListener("MozReftestInvalidate", boom, false);
+
 </script>
 </head>
 
-<body style="display: inline-flex;" onload="boom();"><div></div><div style="display: table-caption;"></div><canvas id="c"></canvas></body>
+<body style="display: inline-flex;"><div></div><div style="display: table-caption;"></div><canvas id="c"></canvas></body>
 
 </html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 34f67f1fd89..f3de846af9a 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -522,7 +522,7 @@ load 854263-1.html
 load 862947-1.html
 needs-focus pref(accessibility.browsewithcaret,true) load 868906.html
 load 866547-1.html
-asserts(1-4) load 876074-1.html # bug 876749
+asserts-if(Android,0-4) asserts-if(!Android,1-4) load 876074-1.html # bug 876749
 load 885009-1.html
 load 893496-1.html
 load 893523.html
diff --git a/layout/generic/nsInlineFrame.cpp b/layout/generic/nsInlineFrame.cpp
index b53f97e5c94..42526287743 100644
--- a/layout/generic/nsInlineFrame.cpp
+++ b/layout/generic/nsInlineFrame.cpp
@@ -18,6 +18,7 @@
 #include "RestyleManager.h"
 #include "nsDisplayList.h"
 #include "mozilla/Likely.h"
+#include "SVGTextFrame.h"
 
 #ifdef DEBUG
 #undef NOISY_PUSHING
@@ -426,6 +427,28 @@ nsInlineFrame::Reflow(nsPresContext*          aPresContext,
   NS_FRAME_SET_TRUNCATION(aStatus, aReflowState, aMetrics);
 }
 
+nsresult 
+nsInlineFrame::AttributeChanged(int32_t aNameSpaceID,
+                                nsIAtom* aAttribute,
+                                int32_t aModType)
+{
+  nsresult rv =
+    nsInlineFrameBase::AttributeChanged(aNameSpaceID, aAttribute, aModType);
+
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  if (IsSVGText()) {
+    SVGTextFrame* f = static_cast<SVGTextFrame*>(
+      nsLayoutUtils::GetClosestFrameOfType(this, nsGkAtoms::svgTextFrame));
+    f->HandleAttributeChangeInDescendant(mContent->AsElement(),
+                                         aNameSpaceID, aAttribute);
+  }
+
+  return NS_OK;
+}
+
 bool
 nsInlineFrame::DrainSelfOverflowListInternal(DrainFlags aFlags,
                                              nsIFrame* aLineContainer)
diff --git a/layout/generic/nsInlineFrame.h b/layout/generic/nsInlineFrame.h
index 6e2053170a7..5d19be72fd8 100644
--- a/layout/generic/nsInlineFrame.h
+++ b/layout/generic/nsInlineFrame.h
@@ -85,6 +85,10 @@ public:
                       const nsHTMLReflowState& aReflowState,
                       nsReflowStatus& aStatus) MOZ_OVERRIDE;
 
+  virtual nsresult AttributeChanged(int32_t aNameSpaceID,
+                                    nsIAtom* aAttribute,
+                                    int32_t aModType) MOZ_OVERRIDE;
+
   virtual bool CanContinueTextRun() const MOZ_OVERRIDE;
 
   virtual void PullOverflowsFromPrevInFlow() MOZ_OVERRIDE;
diff --git a/layout/generic/test/test_bug904810.html b/layout/generic/test/test_bug904810.html
index 96ad2d4e5c1..b2b4355e770 100644
--- a/layout/generic/test/test_bug904810.html
+++ b/layout/generic/test/test_bug904810.html
@@ -26,6 +26,12 @@ third line
 /** Test for Bug 904810 **/
 
 SimpleTest.waitForExplicitFinish();
+
+// We intermittently trigger two "Wrong parent style context" assertions
+// on B2G emulator builds (bug XXXXXXX).  The two frames that get incorrect
+// style context parents are scroll bar parts in the <textarea>.
+SimpleTest.expectAssertions(0, 2);
+
 SimpleTest.waitForFocus(function test() {
   function shiftLeft(i) {
     for ( ; i > 0; --i)
@@ -100,10 +106,6 @@ SimpleTest.waitForFocus(function test() {
 
   SimpleTest.finish();
 });
-
-
-
-
 </script>
 </pre>
 </body>
diff --git a/layout/reftests/svg/dynamic-text-attr-01-ref.svg b/layout/reftests/svg/dynamic-text-attr-01-ref.svg
new file mode 100644
index 00000000000..9f47f153d8e
--- /dev/null
+++ b/layout/reftests/svg/dynamic-text-attr-01-ref.svg
@@ -0,0 +1,31 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font: 16px sans-serif">
+
+  <title>Reference for modifying attributes on child text content elements</title>
+
+  <text x="200" y="20">Test 1</text>
+  <text x="20" y="60">Test 2</text>
+  <text x="20" y="80" rotate="10">Test 3</text>
+  <text>
+    <tspan x="200" y="100">Test 4</tspan>
+  </text>
+  <text>
+    <tspan x="20" y="140">Test 5</tspan>
+  </text>
+  <text>
+    <tspan x="20" y="160" rotate="30">Test 6</tspan>
+  </text>
+  <path id="p" d="M 20,180 h 400"/>
+  <text>
+    <textPath xlink:href="#p" startOffset="180">Test 7</textPath>
+  </text>
+  <text x="20" y="200" textLength="100" lengthAdjust="spacingAndGlyphs">Test 8</text>
+  <text>
+    <tspan x="20" y="220" textLength="100" lengthAdjust="spacingAndGlyphs">Test 9</tspan>
+  </text>
+</svg>
diff --git a/layout/reftests/svg/dynamic-text-attr-01.svg b/layout/reftests/svg/dynamic-text-attr-01.svg
new file mode 100644
index 00000000000..3a58b466711
--- /dev/null
+++ b/layout/reftests/svg/dynamic-text-attr-01.svg
@@ -0,0 +1,46 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait"
+     style="font: 16px sans-serif">
+
+  <title>Testcase for modifying attributes on child text content elements</title>
+
+  <text x="20" y="20" data-test="x=200">Test 1</text>
+  <text x="20" y="40" data-test="y=60">Test 2</text>
+  <text x="20" y="80" data-test="rotate=10">Test 3</text>
+  <text>
+    <tspan x="20" y="100" data-test="x=200">Test 4</tspan>
+  </text>
+  <text>
+    <tspan x="20" y="120" data-test="y=140">Test 5</tspan>
+  </text>
+  <text>
+    <tspan x="20" y="160" data-test="rotate=30">Test 6</tspan>
+  </text>
+  <path id="p" d="M 20,180 h 400"/>
+  <text>
+    <textPath xlink:href="#p" data-test="startOffset=180">Test 7</textPath>
+  </text>
+  <text x="20" y="200" textLength="100" lengthAdjust="spacing" data-test="lengthAdjust=spacingAndGlyphs">Test 8</text>
+  <!-- We don't support textLength/lengthAdjust on child text content
+       elements currently (bug 890692), so Test 9 doesn't really test
+       anything at the moment.  But it is the only animatable enumerated
+       attribute value on text content elements to test. -->
+  <text>
+    <tspan x="20" y="220" textLength="100" lengthAdjust="spacing" data-test="lengthAdjust=spacingAndGlyphs">Test 9</tspan>
+  </text>
+
+  <script>
+    window.addEventListener("MozReftestInvalidate", function() {
+      [...document.querySelectorAll("[data-test]")].forEach(function(e) {
+        var [name, value] = e.getAttribute("data-test").split("=");
+        e.setAttribute(name, value);
+      });
+      document.documentElement.removeAttribute("class");
+    }, false);
+  </script>
+</svg>
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 9a19cae8678..506479ce1f6 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -115,6 +115,7 @@ random-if(/^Windows\x20NT\x205\.1/.test(http.oscpu)) fuzzy-if(/^Windows\x20NT\x2
 == dynamic-text-06.svg pass.svg
 == dynamic-text-07.svg dynamic-text-07-ref.svg
 == dynamic-text-08.svg dynamic-text-08-ref.svg
+== dynamic-text-attr-01.svg dynamic-text-attr-01-ref.svg
 == dynamic-textPath-01.svg dynamic-textPath-01-ref.svg
 == dynamic-textPath-02.svg dynamic-textPath-02-ref.svg
 == dynamic-textPath-03.svg dynamic-textPath-03-ref.svg
diff --git a/layout/reftests/svg/smil/anim-text-attr-01-ref.svg b/layout/reftests/svg/smil/anim-text-attr-01-ref.svg
new file mode 100644
index 00000000000..6cd3dff4484
--- /dev/null
+++ b/layout/reftests/svg/smil/anim-text-attr-01-ref.svg
@@ -0,0 +1,31 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     style="font: 16px sans-serif">
+
+  <title>Reference for animating attributes on child text content elements</title>
+
+  <text x="200" y="20">Test 1</text>
+  <text x="20" y="60">Test 2</text>
+  <text x="20" y="80" rotate="10">Test 3</text>
+  <text>
+    <tspan x="200" y="100">Test 4</tspan>
+  </text>
+  <text>
+    <tspan x="20" y="140">Test 5</tspan>
+  </text>
+  <text>
+    <tspan x="20" y="160" rotate="30">Test 6</tspan>
+  </text>
+  <path id="p" d="M 20,180 h 400"/>
+  <text>
+    <textPath xlink:href="#p" startOffset="180">Test 7</textPath>
+  </text>
+  <text x="20" y="200" textLength="100" lengthAdjust="spacingAndGlyphs">Test 8</text>
+  <text>
+    <tspan x="20" y="220" textLength="100" lengthAdjust="spacingAndGlyphs">Test 9</tspan>
+  </text>
+</svg>
diff --git a/layout/reftests/svg/smil/anim-text-attr-01.svg b/layout/reftests/svg/smil/anim-text-attr-01.svg
new file mode 100644
index 00000000000..c61c612fb41
--- /dev/null
+++ b/layout/reftests/svg/smil/anim-text-attr-01.svg
@@ -0,0 +1,61 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait"
+     style="font: 16px sans-serif">
+
+  <title>Testcase for animating attributes on child text content elements</title>
+
+  <text x="20" y="20">Test 1
+    <set attributeName="x" to="200" begin="indefinite"/>
+  </text>
+  <text x="20" y="40">Test 2
+    <set attributeName="y" to="60" begin="indefinite"/>
+  </text>
+  <text x="20" y="80">Test 3
+    <set attributeName="rotate" to="10" begin="indefinite"/>
+  </text>
+  <text>
+    <tspan x="20" y="100">Test 4
+      <set attributeName="x" to="200" begin="indefinite"/>
+    </tspan>
+  </text>
+  <text>
+    <tspan x="20" y="120">Test 5
+      <set attributeName="y" to="140" begin="indefinite"/>
+    </tspan>
+  </text>
+  <text>
+    <tspan x="20" y="160">Test 6
+      <set attributeName="rotate" to="30" begin="indefinite"/>
+    </tspan>
+  </text>
+  <path id="p" d="M 20,180 h 400"/>
+  <text>
+    <textPath xlink:href="#p">Test 7
+      <set attributeName="startOffset" to="180" begin="indefinite"/>
+    </textPath>
+  </text>
+  <text x="20" y="200" textLength="100" lengthAdjust="spacing">Test 8
+    <set attributeName="lengthAdjust" to="spacingAndGlyphs" begin="indefinite"/>
+  </text>
+  <!-- We don't support textLength/lengthAdjust on child text content
+       elements currently (bug 890692), so Test 9 doesn't really test
+       anything at the moment.  But it is the only animatable enumerated
+       attribute value on text content elements to test. -->
+  <text>
+    <tspan x="20" y="220" textLength="100" lengthAdjust="spacing">Test 9
+      <set attributeName="lengthAdjust" to="spacingAndGlyphs" begin="indefinite"/>
+    </tspan>
+  </text>
+
+  <script>
+    window.addEventListener("MozReftestInvalidate", function() {
+      [...document.querySelectorAll("set")].forEach((e) => e.beginElement());
+      document.documentElement.removeAttribute("class");
+    }, false);
+  </script>
+</svg>
diff --git a/layout/reftests/svg/smil/reftest.list b/layout/reftests/svg/smil/reftest.list
index 6295d8d1961..df08bce5592 100644
--- a/layout/reftests/svg/smil/reftest.list
+++ b/layout/reftests/svg/smil/reftest.list
@@ -162,6 +162,9 @@ fuzzy-if(Android,4,1) == anim-svg-viewBox-01.svg lime.svg
 # animate with some paint server values
 == anim-paintserver-1.svg anim-paintserver-1-ref.svg
 
+# animate attributes on text content children
+== anim-text-attr-01.svg anim-text-attr-01-ref.svg 
+
 # animate where the base value is non-interpolatable but will be replaced anyway
 == anim-fill-overpaintserver-1.svg lime.svg
 == anim-fill-overpaintserver-2.svg lime.svg
diff --git a/layout/reftests/svg/svg-integration/reftest.list b/layout/reftests/svg/svg-integration/reftest.list
index dd20af22e6f..8a0ffb7b6d5 100644
--- a/layout/reftests/svg/svg-integration/reftest.list
+++ b/layout/reftests/svg/svg-integration/reftest.list
@@ -22,7 +22,7 @@ fuzzy-if(true,140,70) == clipPath-html-05-extref.xhtml clipPath-html-05-ref.xhtm
 == dynamic-conditions-outer-svg-03.xhtml ../pass.svg
 == dynamic-conditions-outer-svg-04.xhtml ../pass.svg
 == filter-html-01.xhtml filter-html-01-ref.svg
-== filter-html-01-extref.xhtml filter-html-01-ref.svg
+random-if(B2G) == filter-html-01-extref.xhtml filter-html-01-ref.svg # Bug 1063987
 == filter-html-zoomed-01.xhtml filter-html-01-ref.svg
 == mask-html-01.xhtml mask-html-01-ref.svg
 == mask-html-01-extref-01.xhtml mask-html-01-ref.svg
diff --git a/layout/style/ImageLoader.cpp b/layout/style/ImageLoader.cpp
index 9249d717842..f17bc2ce68d 100644
--- a/layout/style/ImageLoader.cpp
+++ b/layout/style/ImageLoader.cpp
@@ -64,7 +64,10 @@ ClearImageHashSet(nsPtrHashKey<ImageLoader::Image>* aKey, void* aClosure)
 void
 ImageLoader::DropDocumentReference()
 {
-  ClearFrames();
+  // It's okay if GetPresContext returns null here (due to the presshell pointer
+  // on the document being null) as that means the presshell has already
+  // been destroyed, and it also calls ClearFrames when it is destroyed.
+  ClearFrames(GetPresContext());
   mImages.EnumerateEntries(&ClearImageHashSet, mDocument);
   mDocument = nullptr;
 }
@@ -232,9 +235,33 @@ ImageLoader::SetAnimationMode(uint16_t aMode)
   mRequestToFrameMap.EnumerateRead(SetAnimationModeEnumerator, &aMode);
 }
 
-void
-ImageLoader::ClearFrames()
+/* static */ PLDHashOperator
+ImageLoader::DeregisterRequestEnumerator(nsISupports* aKey, FrameSet* aValue,
+                                         void* aClosure)
 {
+  imgIRequest* request = static_cast<imgIRequest*>(aKey);
+
+#ifdef DEBUG
+  {
+    nsCOMPtr<imgIRequest> debugRequest = do_QueryInterface(aKey);
+    NS_ASSERTION(debugRequest == request, "This is bad");
+  }
+#endif
+
+  nsPresContext* presContext = static_cast<nsPresContext*>(aClosure);
+  if (presContext) {
+    nsLayoutUtils::DeregisterImageRequest(presContext,
+                                          request,
+                                          nullptr);
+  }
+
+  return PL_DHASH_NEXT;
+}
+
+void
+ImageLoader::ClearFrames(nsPresContext* aPresContext)
+{
+  mRequestToFrameMap.EnumerateRead(DeregisterRequestEnumerator, aPresContext);
   mRequestToFrameMap.Clear();
   mFrameToRequestMap.Clear();
 }
diff --git a/layout/style/ImageLoader.h b/layout/style/ImageLoader.h
index 2f68851138c..a5cdb8ceff6 100644
--- a/layout/style/ImageLoader.h
+++ b/layout/style/ImageLoader.h
@@ -59,7 +59,10 @@ public:
 
   void SetAnimationMode(uint16_t aMode);
 
-  void ClearFrames();
+  // The prescontext for this ImageLoader's document. We need it to be passed
+  // in because this can be called during presentation destruction after the
+  // presshell pointer on the document has been cleared.
+  void ClearFrames(nsPresContext* aPresContext);
 
   void LoadImage(nsIURI* aURI, nsIPrincipal* aPrincipal, nsIURI* aReferrer,
                  Image* aCSSValue);
@@ -93,6 +96,10 @@ private:
   SetAnimationModeEnumerator(nsISupports* aKey, FrameSet* aValue,
                              void* aClosure);
 
+  static PLDHashOperator
+  DeregisterRequestEnumerator(nsISupports* aKey, FrameSet* aValue,
+                              void* aClosure);
+
   nsresult OnStartContainer(imgIRequest *aRequest, imgIContainer* aImage);
   nsresult OnStopFrame(imgIRequest *aRequest);
   nsresult OnImageIsAnimated(imgIRequest *aRequest);
diff --git a/layout/style/StyleAnimationValue.cpp b/layout/style/StyleAnimationValue.cpp
index d0f7d94ea2a..a08208b303b 100644
--- a/layout/style/StyleAnimationValue.cpp
+++ b/layout/style/StyleAnimationValue.cpp
@@ -2373,8 +2373,6 @@ StyleAnimationValue::AddWeighted(nsCSSProperty aProperty,
         nsCSSValue::Array* bgPosRes = nsCSSValue::Array::Create(4);
         item->mValue.SetArrayValue(bgPosRes, eCSSUnit_Array);
 
-        uint32_t restrictions = nsCSSProps::ValueRestrictions(aProperty);
-
         /* Only iterate over elements 1 and 3. The background position is
          * 'uncomputed' to only those elements.
          */
@@ -2382,16 +2380,8 @@ StyleAnimationValue::AddWeighted(nsCSSProperty aProperty,
           const nsCSSValue& v1 = bgPos1->Item(i);
           const nsCSSValue& v2 = bgPos2->Item(i);
           nsCSSValue& vr = bgPosRes->Item(i);
-
-          nsCSSUnit unit = GetCommonUnit(aProperty, v1.GetUnit(), v2.GetUnit());
-
-          if (!AddCSSValuePixelPercentCalc(restrictions, unit, aCoeff1, v1,
-                                           aCoeff2, v2, vr) ) {
-            if (v1 != v2) {
-              return false;
-            }
-            vr = v1;
-          }
+          AddCSSValueCanonicalCalc(aCoeff1, v1,
+                                   aCoeff2, v2, vr);
         }
 
         position1 = position1->mNext;
@@ -3167,29 +3157,10 @@ StyleAnimationValue::ExtractComputedValue(nsCSSProperty aProperty,
             item->mValue.SetArrayValue(bgArray.get(), eCSSUnit_Array);
 
             const nsStyleBackground::Position &pos = bg->mLayers[i].mPosition;
-            // XXXbz is there a good reason we can't just
-            // SetCalcValue(&pos.mXPosition, item->mXValue) here?
             nsCSSValue &xValue = bgArray->Item(1),
                        &yValue = bgArray->Item(3);
-            if (!pos.mXPosition.mHasPercent) {
-              NS_ABORT_IF_FALSE(pos.mXPosition.mPercent == 0.0f,
-                                "Shouldn't have mPercent!");
-              nscoordToCSSValue(pos.mXPosition.mLength, xValue);
-            } else if (pos.mXPosition.mLength == 0) {
-              xValue.SetPercentValue(pos.mXPosition.mPercent);
-            } else {
-              SetCalcValue(&pos.mXPosition, xValue);
-            }
-
-            if (!pos.mYPosition.mHasPercent) {
-              NS_ABORT_IF_FALSE(pos.mYPosition.mPercent == 0.0f,
-                                "Shouldn't have mPercent!");
-              nscoordToCSSValue(pos.mYPosition.mLength, yValue);
-            } else if (pos.mYPosition.mLength == 0) {
-              yValue.SetPercentValue(pos.mYPosition.mPercent);
-            } else {
-              SetCalcValue(&pos.mYPosition, yValue);
-            }
+            SetCalcValue(&pos.mXPosition, xValue);
+            SetCalcValue(&pos.mYPosition, yValue);
           }
 
           aComputedValue.SetAndAdoptCSSValueListValue(result.forget(),
diff --git a/layout/style/nsAnimationManager.cpp b/layout/style/nsAnimationManager.cpp
index 8c7178d4b50..27def311eae 100644
--- a/layout/style/nsAnimationManager.cpp
+++ b/layout/style/nsAnimationManager.cpp
@@ -457,7 +457,7 @@ nsAnimationManager::BuildAnimations(nsStyleContext* aStyleContext,
     dest->mStartTime = now;
     dest->mPlayState = src.GetPlayState();
     if (dest->IsPaused()) {
-      dest->mHoldTime = now;
+      dest->mHoldTime.SetValue(TimeDuration(0));
     }
 
     // While current drafts of css3-animations say that later keyframes
diff --git a/layout/style/nsFontFaceLoader.cpp b/layout/style/nsFontFaceLoader.cpp
index 94309cc04c1..018aa77c7de 100644
--- a/layout/style/nsFontFaceLoader.cpp
+++ b/layout/style/nsFontFaceLoader.cpp
@@ -55,13 +55,11 @@ GetFontDownloaderLog()
 #define LOG_ENABLED() PR_LOG_TEST(GetFontDownloaderLog(), PR_LOG_DEBUG)
 
 
-nsFontFaceLoader::nsFontFaceLoader(gfxMixedFontFamily* aFontFamily,
-                                   gfxProxyFontEntry* aProxy,
+nsFontFaceLoader::nsFontFaceLoader(gfxUserFontEntry* aUserFontEntry,
                                    nsIURI* aFontURI,
                                    nsUserFontSet* aFontSet,
                                    nsIChannel* aChannel)
-  : mFontFamily(aFontFamily),
-    mFontEntry(aProxy),
+  : mUserFontEntry(aUserFontEntry),
     mFontURI(aFontURI),
     mFontSet(aFontSet),
     mChannel(aChannel)
@@ -70,8 +68,8 @@ nsFontFaceLoader::nsFontFaceLoader(gfxMixedFontFamily* aFontFamily,
 
 nsFontFaceLoader::~nsFontFaceLoader()
 {
-  if (mFontEntry) {
-    mFontEntry->mLoader = nullptr;
+  if (mUserFontEntry) {
+    mUserFontEntry->mLoader = nullptr;
   }
   if (mLoadTimer) {
     mLoadTimer->Cancel();
@@ -96,7 +94,7 @@ nsFontFaceLoader::StartedLoading(nsIStreamLoader* aStreamLoader)
                                        nsITimer::TYPE_ONE_SHOT);
     }
   } else {
-    mFontEntry->mLoadingState = gfxProxyFontEntry::LOADING_SLOWLY;
+    mUserFontEntry->mLoadingState = gfxUserFontEntry::LOADING_SLOWLY;
   }
   mStreamLoader = aStreamLoader;
 }
@@ -111,12 +109,12 @@ nsFontFaceLoader::LoadTimerCallback(nsITimer* aTimer, void* aClosure)
     return;
   }
 
-  gfxProxyFontEntry* pe = loader->mFontEntry.get();
+  gfxUserFontEntry* ufe = loader->mUserFontEntry.get();
   bool updateUserFontSet = true;
 
   // If the entry is loading, check whether it's >75% done; if so,
   // we allow another timeout period before showing a fallback font.
-  if (pe->mLoadingState == gfxProxyFontEntry::LOADING_STARTED) {
+  if (ufe->mLoadingState == gfxUserFontEntry::LOADING_STARTED) {
     int64_t contentLength;
     uint32_t numBytesRead;
     if (NS_SUCCEEDED(loader->mChannel->GetContentLength(&contentLength)) &&
@@ -128,7 +126,7 @@ nsFontFaceLoader::LoadTimerCallback(nsITimer* aTimer, void* aClosure)
       // More than 3/4 the data has been downloaded, so allow 50% extra
       // time and hope the remainder will arrive before the additional
       // time expires.
-      pe->mLoadingState = gfxProxyFontEntry::LOADING_ALMOST_DONE;
+      ufe->mLoadingState = gfxUserFontEntry::LOADING_ALMOST_DONE;
       uint32_t delay;
       loader->mLoadTimer->GetDelay(&delay);
       loader->mLoadTimer->InitWithFuncCallback(LoadTimerCallback,
@@ -144,7 +142,7 @@ nsFontFaceLoader::LoadTimerCallback(nsITimer* aTimer, void* aClosure)
   // before, we mark this entry as "loading slowly", so the fallback
   // font will be used in the meantime, and tell the context to refresh.
   if (updateUserFontSet) {
-    pe->mLoadingState = gfxProxyFontEntry::LOADING_SLOWLY;
+    ufe->mLoadingState = gfxUserFontEntry::LOADING_SLOWLY;
     gfxUserFontSet* fontSet = loader->mFontSet;
     nsPresContext* ctx = loader->mFontSet->GetPresContext();
     NS_ASSERTION(ctx, "userfontset doesn't have a presContext?");
@@ -209,14 +207,14 @@ nsFontFaceLoader::OnStreamComplete(nsIStreamLoader* aLoader,
     }
   }
 
-  // The userFontSet is responsible for freeing the downloaded data
+  // The userFontEntry is responsible for freeing the downloaded data
   // (aString) when finished with it; the pointer is no longer valid
   // after OnLoadComplete returns.
   // This is called even in the case of a failed download (HTTP 404, etc),
   // as there may still be data to be freed (e.g. an error page),
   // and we need the fontSet to initiate loading the next source.
-  bool fontUpdate = mFontSet->OnLoadComplete(mFontFamily, mFontEntry, aString,
-                                             aStringLen, aStatus);
+  bool fontUpdate = mUserFontEntry->OnLoadComplete(aString,
+                                                   aStringLen, aStatus);
 
   // when new font loaded, need to reflow
   if (fontUpdate) {
@@ -239,8 +237,8 @@ nsFontFaceLoader::OnStreamComplete(nsIStreamLoader* aLoader,
 void
 nsFontFaceLoader::Cancel()
 {
-  mFontEntry->mLoadingState = gfxProxyFontEntry::NOT_LOADING;
-  mFontEntry->mLoader = nullptr;
+  mUserFontEntry->mLoadingState = gfxUserFontEntry::NOT_LOADING;
+  mUserFontEntry->mLoader = nullptr;
   mFontSet = nullptr;
   if (mLoadTimer) {
     mLoadTimer->Cancel();
@@ -319,8 +317,7 @@ nsUserFontSet::RemoveLoader(nsFontFaceLoader* aLoader)
 }
 
 nsresult
-nsUserFontSet::StartLoad(gfxMixedFontFamily* aFamily,
-                         gfxProxyFontEntry* aProxy,
+nsUserFontSet::StartLoad(gfxUserFontEntry* aUserFontEntry,
                          const gfxFontFaceSrc* aFontFaceSrc)
 {
   nsresult rv;
@@ -336,7 +333,7 @@ nsUserFontSet::StartLoad(gfxMixedFontFamily* aFamily,
   // get Content Security Policy from principal to pass into channel
   nsCOMPtr<nsIChannelPolicy> channelPolicy;
   nsCOMPtr<nsIContentSecurityPolicy> csp;
-  rv = aProxy->mPrincipal->GetCsp(getter_AddRefs(csp));
+  rv = aUserFontEntry->mPrincipal->GetCsp(getter_AddRefs(csp));
   NS_ENSURE_SUCCESS(rv, rv);
   if (csp) {
     channelPolicy = do_CreateInstance("@mozilla.org/nschannelpolicy;1");
@@ -354,7 +351,7 @@ nsUserFontSet::StartLoad(gfxMixedFontFamily* aFamily,
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsRefPtr<nsFontFaceLoader> fontLoader =
-    new nsFontFaceLoader(aFamily, aProxy, aFontFaceSrc->mURI, this, channel);
+    new nsFontFaceLoader(aUserFontEntry, aFontFaceSrc->mURI, this, channel);
 
   if (!fontLoader)
     return NS_ERROR_OUT_OF_MEMORY;
@@ -396,7 +393,7 @@ nsUserFontSet::StartLoad(gfxMixedFontFamily* aFamily,
     rv = channel->AsyncOpen(streamLoader, nullptr);
   } else {
     nsRefPtr<nsCORSListenerProxy> listener =
-      new nsCORSListenerProxy(streamLoader, aProxy->mPrincipal, false);
+      new nsCORSListenerProxy(streamLoader, aUserFontEntry->mPrincipal, false);
     rv = listener->Init(channel);
     if (NS_SUCCEEDED(rv)) {
       rv = channel->AsyncOpen(listener, nullptr);
@@ -409,15 +406,15 @@ nsUserFontSet::StartLoad(gfxMixedFontFamily* aFamily,
   if (NS_SUCCEEDED(rv)) {
     mLoaders.PutEntry(fontLoader);
     fontLoader->StartedLoading(streamLoader);
-    aProxy->mLoader = fontLoader; // let the font entry remember the loader,
-                                  // in case we need to cancel it
+    aUserFontEntry->mLoader = fontLoader; // let the font entry remember the
+                                          // loader, in case we need to cancel it
   }
 
   return rv;
 }
 
 static PLDHashOperator DetachFontEntries(const nsAString& aKey,
-                                         nsRefPtr<gfxMixedFontFamily>& aFamily,
+                                         nsRefPtr<gfxUserFontFamily>& aFamily,
                                          void* aUserArg)
 {
   aFamily->DetachFontEntries();
@@ -425,7 +422,7 @@ static PLDHashOperator DetachFontEntries(const nsAString& aKey,
 }
 
 static PLDHashOperator RemoveIfEmpty(const nsAString& aKey,
-                                     nsRefPtr<gfxMixedFontFamily>& aFamily,
+                                     nsRefPtr<gfxUserFontFamily>& aFamily,
                                      void* aUserArg)
 {
   return aFamily->GetFontList().Length() ? PL_DHASH_NEXT : PL_DHASH_REMOVE;
@@ -474,12 +471,8 @@ nsUserFontSet::UpdateRules(const nsTArray<nsFontFaceRuleContainer>& aRules)
     // even after the oldRules array is deleted.
     size_t count = oldRules.Length();
     for (size_t i = 0; i < count; ++i) {
-      gfxFontEntry* fe = oldRules[i].mFontEntry;
-      if (!fe->mIsProxy) {
-        continue;
-      }
-      gfxProxyFontEntry* proxy = static_cast<gfxProxyFontEntry*>(fe);
-      nsFontFaceLoader* loader = proxy->mLoader;
+      gfxUserFontEntry* userFontEntry = oldRules[i].mUserFontEntry;
+      nsFontFaceLoader* loader = userFontEntry->mLoader;
       if (loader) {
         loader->Cancel();
         RemoveLoader(loader);
@@ -554,7 +547,7 @@ nsUserFontSet::InsertRule(nsCSSFontFaceRule* aRule, uint8_t aSheetType,
         }
       }
 
-      AddFontFace(fontfamily, ruleRec.mFontEntry);
+      AddFontFace(fontfamily, ruleRec.mUserFontEntry);
       mRules.AppendElement(ruleRec);
       aOldRules.RemoveElementAt(i);
       // note the set has been modified if an old rule was skipped to find
@@ -568,21 +561,21 @@ nsUserFontSet::InsertRule(nsCSSFontFaceRule* aRule, uint8_t aSheetType,
 
   // this is a new rule:
   FontFaceRuleRecord ruleRec;
-  ruleRec.mFontEntry =
+  ruleRec.mUserFontEntry =
     FindOrCreateFontFaceFromRule(fontfamily, aRule, aSheetType);
 
-  if (!ruleRec.mFontEntry) {
+  if (!ruleRec.mUserFontEntry) {
     return;
   }
 
   ruleRec.mContainer.mRule = aRule;
   ruleRec.mContainer.mSheetType = aSheetType;
 
-  // Add the entry to the end of the list.  If an existing proxy entry was
+  // Add the entry to the end of the list.  If an existing userfont entry was
   // returned by FindOrCreateFontFaceFromRule that was already stored on the
-  // family, gfxMixedFontFamily::AddFontEntry(), which AddFontFace calls,
-  // will automatically remove the earlier occurrence of the same proxy.
-  AddFontFace(fontfamily, ruleRec.mFontEntry);
+  // family, gfxUserFontFamily::AddFontEntry(), which AddFontFace calls,
+  // will automatically remove the earlier occurrence of the same userfont entry.
+  AddFontFace(fontfamily, ruleRec.mUserFontEntry);
 
   mRules.AppendElement(ruleRec);
 
@@ -590,7 +583,7 @@ nsUserFontSet::InsertRule(nsCSSFontFaceRule* aRule, uint8_t aSheetType,
   aFontSetModified = true;
 }
 
-already_AddRefed<gfxFontEntry>
+already_AddRefed<gfxUserFontEntry>
 nsUserFontSet::FindOrCreateFontFaceFromRule(const nsAString& aFamilyName,
                                             nsCSSFontFaceRule* aRule,
                                             uint8_t aSheetType)
@@ -752,35 +745,30 @@ nsUserFontSet::FindOrCreateFontFaceFromRule(const nsAString& aFamilyName,
     return nullptr;
   }
 
-  nsRefPtr<gfxProxyFontEntry> entry =
+  nsRefPtr<gfxUserFontEntry> entry =
     FindOrCreateFontFace(aFamilyName, srcArray, weight, stretch, italicStyle,
                          featureSettings, languageOverride,
                          nullptr /* aUnicodeRanges */);
   return entry.forget();
 }
 
-void
-nsUserFontSet::ReplaceFontEntry(gfxMixedFontFamily* aFamily,
-                                gfxProxyFontEntry* aProxy,
-                                gfxFontEntry* aFontEntry)
-{
-  // aProxy is being supplanted by the "real" font aFontEntry, so we need to
-  // update any rules that refer to it. Note that there may be multiple rules
-  // that refer to the same proxy - e.g. if a stylesheet was loaded multiple
-  // times, so that several identical @font-face rules are present.
-  for (uint32_t i = 0; i < mRules.Length(); ++i) {
-    if (mRules[i].mFontEntry == aProxy) {
-      mRules[i].mFontEntry = aFontEntry;
-    }
-  }
-  aFamily->ReplaceFontEntry(aProxy, aFontEntry);
-}
-
 nsCSSFontFaceRule*
 nsUserFontSet::FindRuleForEntry(gfxFontEntry* aFontEntry)
 {
+  NS_ASSERTION(!aFontEntry->mIsUserFontContainer, "only platform font entries");
   for (uint32_t i = 0; i < mRules.Length(); ++i) {
-    if (mRules[i].mFontEntry == aFontEntry) {
+    if (mRules[i].mUserFontEntry->GetPlatformFontEntry() == aFontEntry) {
+      return mRules[i].mContainer.mRule;
+    }
+  }
+  return nullptr;
+}
+
+nsCSSFontFaceRule*
+nsUserFontSet::FindRuleForUserFontEntry(gfxUserFontEntry* aUserFontEntry)
+{
+  for (uint32_t i = 0; i < mRules.Length(); ++i) {
+    if (mRules[i].mUserFontEntry == aUserFontEntry) {
       return mRules[i].mContainer.mRule;
     }
   }
@@ -788,11 +776,10 @@ nsUserFontSet::FindRuleForEntry(gfxFontEntry* aFontEntry)
 }
 
 nsresult
-nsUserFontSet::LogMessage(gfxMixedFontFamily* aFamily,
-                          gfxProxyFontEntry* aProxy,
-                          const char*        aMessage,
-                          uint32_t          aFlags,
-                          nsresult          aStatus)
+nsUserFontSet::LogMessage(gfxUserFontEntry* aUserFontEntry,
+                          const char* aMessage,
+                          uint32_t aFlags,
+                          nsresult aStatus)
 {
   nsCOMPtr<nsIConsoleService>
     console(do_GetService(NS_CONSOLESERVICE_CONTRACTID));
@@ -800,13 +787,13 @@ nsUserFontSet::LogMessage(gfxMixedFontFamily* aFamily,
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  NS_ConvertUTF16toUTF8 familyName(aProxy->mFamilyName);
+  NS_ConvertUTF16toUTF8 familyName(aUserFontEntry->mFamilyName);
   nsAutoCString fontURI;
-  if (aProxy->mSrcIndex == aProxy->mSrcList.Length()) {
+  if (aUserFontEntry->mSrcIndex == aUserFontEntry->mSrcList.Length()) {
     fontURI.AppendLiteral("(end of source list)");
   } else {
-    if (aProxy->mSrcList[aProxy->mSrcIndex].mURI) {
-      aProxy->mSrcList[aProxy->mSrcIndex].mURI->GetSpec(fontURI);
+    if (aUserFontEntry->mSrcList[aUserFontEntry->mSrcIndex].mURI) {
+      aUserFontEntry->mSrcList[aUserFontEntry->mSrcIndex].mURI->GetSpec(fontURI);
     } else {
       fontURI.AppendLiteral("(invalid URI)");
     }
@@ -815,12 +802,12 @@ nsUserFontSet::LogMessage(gfxMixedFontFamily* aFamily,
   char weightKeywordBuf[8]; // plenty to sprintf() a uint16_t
   const char* weightKeyword;
   const nsAFlatCString& weightKeywordString =
-    nsCSSProps::ValueToKeyword(aProxy->Weight(),
+    nsCSSProps::ValueToKeyword(aUserFontEntry->Weight(),
                                nsCSSProps::kFontWeightKTable);
   if (weightKeywordString.Length() > 0) {
     weightKeyword = weightKeywordString.get();
   } else {
-    sprintf(weightKeywordBuf, "%u", aProxy->Weight());
+    sprintf(weightKeywordBuf, "%u", aUserFontEntry->Weight());
     weightKeyword = weightKeywordBuf;
   }
 
@@ -829,11 +816,11 @@ nsUserFontSet::LogMessage(gfxMixedFontFamily* aFamily,
         "(font-family: \"%s\" style:%s weight:%s stretch:%s src index:%d)",
         aMessage,
         familyName.get(),
-        aProxy->IsItalic() ? "italic" : "normal",
+        aUserFontEntry->IsItalic() ? "italic" : "normal",
         weightKeyword,
-        nsCSSProps::ValueToKeyword(aProxy->Stretch(),
+        nsCSSProps::ValueToKeyword(aUserFontEntry->Stretch(),
                                    nsCSSProps::kFontStretchKTable).get(),
-        aProxy->mSrcIndex);
+        aUserFontEntry->mSrcIndex);
 
   if (NS_FAILED(aStatus)) {
     message.AppendLiteral(": ");
@@ -861,7 +848,7 @@ nsUserFontSet::LogMessage(gfxMixedFontFamily* aFamily,
 #endif
 
   // try to give the user an indication of where the rule came from
-  nsCSSFontFaceRule* rule = FindRuleForEntry(aProxy);
+  nsCSSFontFaceRule* rule = FindRuleForUserFontEntry(aUserFontEntry);
   nsString href;
   nsString text;
   nsresult rv;
@@ -950,7 +937,7 @@ nsUserFontSet::CheckFontLoad(const gfxFontFaceSrc* aFontFaceSrc,
 }
 
 nsresult
-nsUserFontSet::SyncLoadFontData(gfxProxyFontEntry* aFontToLoad,
+nsUserFontSet::SyncLoadFontData(gfxUserFontEntry* aFontToLoad,
                                 const gfxFontFaceSrc* aFontFaceSrc,
                                 uint8_t*& aBuffer,
                                 uint32_t& aBufferLength)
diff --git a/layout/style/nsFontFaceLoader.h b/layout/style/nsFontFaceLoader.h
index bcc897fe518..9c0340fae06 100644
--- a/layout/style/nsFontFaceLoader.h
+++ b/layout/style/nsFontFaceLoader.h
@@ -34,8 +34,7 @@ public:
 
   // starts loading process, creating and initializing a nsFontFaceLoader obj
   // returns whether load process successfully started or not
-  nsresult StartLoad(gfxMixedFontFamily* aFamily,
-                     gfxProxyFontEntry* aFontToLoad,
+  nsresult StartLoad(gfxUserFontEntry* aFontToLoad,
                      const gfxFontFaceSrc* aFontFaceSrc) MOZ_OVERRIDE;
 
   // Called by nsFontFaceLoader when the loader has completed normally.
@@ -46,10 +45,7 @@ public:
 
   nsPresContext* GetPresContext() { return mPresContext; }
 
-  virtual void ReplaceFontEntry(gfxMixedFontFamily* aFamily,
-                                gfxProxyFontEntry* aProxy,
-                                gfxFontEntry* aFontEntry) MOZ_OVERRIDE;
-
+  // search for @font-face rule that matches a platform font entry
   nsCSSFontFaceRule* FindRuleForEntry(gfxFontEntry* aFontEntry);
 
 protected:
@@ -62,7 +58,7 @@ protected:
   // so that we can update the set without having to throw away
   // all the existing fonts.
   struct FontFaceRuleRecord {
-    nsRefPtr<gfxFontEntry>       mFontEntry;
+    nsRefPtr<gfxUserFontEntry>   mUserFontEntry;
     nsFontFaceRuleContainer      mContainer;
   };
 
@@ -70,13 +66,12 @@ protected:
                   nsTArray<FontFaceRuleRecord>& oldRules,
                   bool& aFontSetModified);
 
-  already_AddRefed<gfxFontEntry> FindOrCreateFontFaceFromRule(
+  already_AddRefed<gfxUserFontEntry> FindOrCreateFontFaceFromRule(
                                                    const nsAString& aFamilyName,
                                                    nsCSSFontFaceRule* aRule,
                                                    uint8_t aSheetType);
 
-  virtual nsresult LogMessage(gfxMixedFontFamily* aFamily,
-                              gfxProxyFontEntry* aProxy,
+  virtual nsresult LogMessage(gfxUserFontEntry* aUserFontEntry,
                               const char* aMessage,
                               uint32_t aFlags = nsIScriptError::errorFlag,
                               nsresult aStatus = NS_OK) MOZ_OVERRIDE;
@@ -85,7 +80,7 @@ protected:
                                  nsIPrincipal** aPrincipal,
                                  bool* aBypassCache) MOZ_OVERRIDE;
 
-  virtual nsresult SyncLoadFontData(gfxProxyFontEntry* aFontToLoad,
+  virtual nsresult SyncLoadFontData(gfxUserFontEntry* aFontToLoad,
                                     const gfxFontFaceSrc* aFontFaceSrc,
                                     uint8_t*& aBuffer,
                                     uint32_t& aBufferLength) MOZ_OVERRIDE;
@@ -94,6 +89,9 @@ protected:
 
   virtual void DoRebuildUserFontSet() MOZ_OVERRIDE;
 
+  // search for @font-face rule that matches a userfont font entry
+  nsCSSFontFaceRule* FindRuleForUserFontEntry(gfxUserFontEntry* aUserFontEntry);
+
   nsPresContext* mPresContext;  // weak reference
 
   // Set of all loaders pointing to us. These are not strong pointers,
@@ -107,8 +105,7 @@ protected:
 class nsFontFaceLoader : public nsIStreamLoaderObserver
 {
 public:
-  nsFontFaceLoader(gfxMixedFontFamily* aFontFamily,
-                   gfxProxyFontEntry* aFontToLoad, nsIURI* aFontURI, 
+  nsFontFaceLoader(gfxUserFontEntry* aFontToLoad, nsIURI* aFontURI,
                    nsUserFontSet* aFontSet, nsIChannel* aChannel);
 
   NS_DECL_ISUPPORTS
@@ -133,8 +130,7 @@ protected:
   virtual ~nsFontFaceLoader();
 
 private:
-  nsRefPtr<gfxMixedFontFamily> mFontFamily;
-  nsRefPtr<gfxProxyFontEntry>  mFontEntry;
+  nsRefPtr<gfxUserFontEntry>  mUserFontEntry;
   nsCOMPtr<nsIURI>        mFontURI;
   nsRefPtr<nsUserFontSet> mFontSet;
   nsCOMPtr<nsIChannel>    mChannel;
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index d12d5a05176..b1f445f047f 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -1630,6 +1630,38 @@ nsRuleNode::PropagateDependentBit(nsStyleStructID aSID, nsRuleNode* aHighestNode
   }
 }
 
+/* static */ void
+nsRuleNode::PropagateGrandancestorBit(nsStyleContext* aContext,
+                                      nsStyleContext* aContextInheritedFrom)
+{
+  MOZ_ASSERT(aContext);
+  MOZ_ASSERT(aContextInheritedFrom &&
+             aContextInheritedFrom != aContext &&
+             aContextInheritedFrom != aContext->GetParent(),
+             "aContextInheritedFrom must be an ancestor of aContext's parent");
+
+  aContext->AddStyleBit(NS_STYLE_USES_GRANDANCESTOR_STYLE);
+
+  nsStyleContext* context = aContext->GetParent();
+  if (!context) {
+    return;
+  }
+
+  for (;;) {
+    nsStyleContext* parent = context->GetParent();
+    if (!parent) {
+      MOZ_ASSERT(false, "aContextInheritedFrom must be an ancestor of "
+                        "aContext's parent");
+      break;
+    }
+    if (parent == aContextInheritedFrom) {
+      break;
+    }
+    context->AddStyleBit(NS_STYLE_USES_GRANDANCESTOR_STYLE);
+    context = parent;
+  }
+}
+
 /*
  * The following "Check" functions are used for determining what type of
  * sharing can be used for the data on this rule node.  MORE HERE...
@@ -2308,6 +2340,9 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
              parentContext->GetPseudo() == nsCSSPseudoElements::firstLine) {
         parentContext = parentContext->GetParent();
       }
+      if (parentContext && parentContext != aContext->GetParent()) {
+        PropagateGrandancestorBit(aContext, parentContext);
+      }
     }
     if (parentContext) {
       // We have a parent, and so we should just inherit from the parent.
@@ -3893,6 +3928,13 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
 
     parentFont = *aFont;
   }
+
+  if (higherContext && contextPath.Length() > 1) {
+    // contextPath is a list of all ancestor style contexts, so it must have
+    // at least two elements for it to result in a dependency on grandancestor
+    // styles.
+    PropagateGrandancestorBit(aContext, higherContext);
+  }
 }
 
 const void*
@@ -7535,6 +7577,7 @@ nsRuleNode::ComputePositionData(void* aStartStruct,
           const nsStylePosition* grandparentPos =
             grandparentContext->StylePosition();
           inheritedAlignSelf = grandparentPos->mAlignItems;
+          aContext->AddStyleBit(NS_STYLE_USES_GRANDANCESTOR_STYLE);
         }
       }
     }
diff --git a/layout/style/nsRuleNode.h b/layout/style/nsRuleNode.h
index 7ba6954c203..4b098ecc394 100644
--- a/layout/style/nsRuleNode.h
+++ b/layout/style/nsRuleNode.h
@@ -426,6 +426,8 @@ protected:
   void PropagateDependentBit(nsStyleStructID aSID, nsRuleNode* aHighestNode,
                              void* aStruct);
   void PropagateNoneBit(uint32_t aBit, nsRuleNode* aHighestNode);
+  static void PropagateGrandancestorBit(nsStyleContext* aContext,
+                                        nsStyleContext* aContextInheritedFrom);
 
   const void* SetDefaultOnRoot(const nsStyleStructID aSID,
                                nsStyleContext* aContext);
diff --git a/layout/style/nsStyleContext.cpp b/layout/style/nsStyleContext.cpp
index ee7c619eb68..279f755e448 100644
--- a/layout/style/nsStyleContext.cpp
+++ b/layout/style/nsStyleContext.cpp
@@ -21,6 +21,7 @@
 #include "nsStyleContext.h"
 #include "mozilla/StyleAnimationValue.h"
 #include "GeckoProfiler.h"
+#include "nsIDocument.h"
 
 #ifdef DEBUG
 // #define NOISY_DEBUG
@@ -84,6 +85,24 @@ nsStyleContext::~nsStyleContext()
 
   nsPresContext *presContext = mRuleNode->PresContext();
 
+#ifdef DEBUG
+#if 0
+  // Assert that the style structs we are about to destroy are not referenced
+  // anywhere else in the style context tree.  These checks are expensive,
+  // which is why they are not enabled even #ifdef DEBUG.
+  nsStyleContext* root = this;
+  while (root->mParent) {
+    root = root->mParent;
+  }
+  root->AssertStructsNotUsedElsewhere(this,
+                                      std::numeric_limits<int32_t>::max());
+#else
+  // In DEBUG builds we perform a more limited check just of the children
+  // of this style context.
+  AssertStructsNotUsedElsewhere(this, 2);
+#endif
+#endif
+
   mRuleNode->Release();
 
   presContext->PresShell()->StyleSet()->
@@ -101,6 +120,88 @@ nsStyleContext::~nsStyleContext()
   }
 }
 
+#ifdef DEBUG
+void
+nsStyleContext::AssertStructsNotUsedElsewhere(
+                                       nsStyleContext* aDestroyingContext,
+                                       int32_t aLevels) const
+{
+  if (aLevels == 0) {
+    return;
+  }
+
+  void* data;
+
+  if (mBits & NS_STYLE_IS_GOING_AWAY) {
+    return;
+  }
+
+  if (this != aDestroyingContext) {
+    nsInheritedStyleData& destroyingInheritedData =
+      aDestroyingContext->mCachedInheritedData;
+#define STYLE_STRUCT_INHERITED(name_, checkdata_cb)                            \
+    data = destroyingInheritedData.mStyleStructs[eStyleStruct_##name_];        \
+    if (data &&                                                                \
+        !(aDestroyingContext->mBits & NS_STYLE_INHERIT_BIT(name_)) &&          \
+         (mCachedInheritedData.mStyleStructs[eStyleStruct_##name_] == data)) { \
+      printf("style struct %p found on style context %p\n", data, this);       \
+      nsString url;                                                            \
+      PresContext()->Document()->GetURL(url);                                  \
+      printf("  in %s\n", NS_LossyConvertUTF16toASCII(url).get());             \
+      MOZ_ASSERT(false, "destroying " #name_ " style struct still present "    \
+                        "in style context tree");                              \
+    }
+#define STYLE_STRUCT_RESET(name_, checkdata_cb)
+
+#include "nsStyleStructList.h"
+
+#undef STYLE_STRUCT_INHERITED
+#undef STYLE_STRUCT_RESET
+
+    if (mCachedResetData) {
+      nsResetStyleData* destroyingResetData =
+        aDestroyingContext->mCachedResetData;
+      if (destroyingResetData) {
+#define STYLE_STRUCT_INHERITED(name_, checkdata_cb_)
+#define STYLE_STRUCT_RESET(name_, checkdata_cb)                                \
+        data = destroyingResetData->mStyleStructs[eStyleStruct_##name_];       \
+        if (data &&                                                            \
+            !(aDestroyingContext->mBits & NS_STYLE_INHERIT_BIT(name_)) &&      \
+            (mCachedResetData->mStyleStructs[eStyleStruct_##name_] == data)) { \
+          printf("style struct %p found on style context %p\n", data, this);   \
+          nsString url;                                                        \
+          PresContext()->Document()->GetURL(url);                              \
+          printf("  in %s\n", NS_LossyConvertUTF16toASCII(url).get());         \
+          MOZ_ASSERT(false, "destroying " #name_ " style struct still present "\
+                            "in style context tree");                          \
+        }
+
+#include "nsStyleStructList.h"
+
+#undef STYLE_STRUCT_INHERITED
+#undef STYLE_STRUCT_RESET
+      }
+    }
+  }
+
+  if (mChild) {
+    const nsStyleContext* child = mChild;
+    do {
+      child->AssertStructsNotUsedElsewhere(aDestroyingContext, aLevels - 1);
+      child = child->mNextSibling;
+    } while (child != mChild);
+  }
+
+  if (mEmptyChild) {
+    const nsStyleContext* child = mEmptyChild;
+    do {
+      child->AssertStructsNotUsedElsewhere(aDestroyingContext, aLevels - 1);
+      child = child->mNextSibling;
+    } while (child != mEmptyChild);
+  }
+}
+#endif
+
 void nsStyleContext::AddChild(nsStyleContext* aChild)
 {
   NS_ASSERTION(aChild->mPrevSibling == aChild &&
@@ -145,6 +246,28 @@ void nsStyleContext::RemoveChild(nsStyleContext* aChild)
   aChild->mPrevSibling = aChild;
 }
 
+void
+nsStyleContext::MoveTo(nsStyleContext* aNewParent)
+{
+  MOZ_ASSERT(aNewParent != mParent);
+
+  // Assertions checking for visited style are just to avoid some tricky
+  // cases we can't be bothered handling at the moment.
+  MOZ_ASSERT(!IsStyleIfVisited());
+  MOZ_ASSERT(!aNewParent->IsStyleIfVisited());
+
+  nsStyleContext* oldParent = mParent;
+
+  aNewParent->AddRef();
+
+  mParent->RemoveChild(this);
+
+  mParent = aNewParent;
+  mParent->AddChild(this);
+
+  oldParent->Release();
+}
+
 already_AddRefed<nsStyleContext>
 nsStyleContext::FindChildWithRules(const nsIAtom* aPseudoTag, 
                                    nsRuleNode* aRuleNode,
@@ -191,11 +314,35 @@ nsStyleContext::FindChildWithRules(const nsIAtom* aPseudoTag,
       RemoveChild(result);
       AddChild(result);
     }
+    result->mBits |= NS_STYLE_IS_SHARED;
   }
 
   return result.forget();
 }
 
+/* static */ bool
+nsStyleContext::ListContainsStyleContextThatUsesGrandancestorStyle(const nsStyleContext* aHead)
+{
+  if (aHead) {
+    const nsStyleContext* child = aHead;
+    do {
+      if (child->UsesGrandancestorStyle()) {
+        return true;
+      }
+      child = child->mNextSibling;
+    } while (child != aHead);
+  }
+
+  return false;
+}
+
+bool
+nsStyleContext::HasChildThatUsesGrandancestorStyle() const
+{
+  return ListContainsStyleContextThatUsesGrandancestorStyle(mEmptyChild) ||
+         ListContainsStyleContextThatUsesGrandancestorStyle(mChild);
+}
+
 const void* nsStyleContext::GetCachedStyleData(nsStyleStructID aSID)
 {
   const void* cachedData;
@@ -413,7 +560,8 @@ nsStyleContext::ApplyStyleFixups(bool aSkipParentDisplayBasedStyleFixup)
 
 nsChangeHint
 nsStyleContext::CalcStyleDifference(nsStyleContext* aOther,
-                                    nsChangeHint aParentHintsNotHandledForDescendants)
+                                    nsChangeHint aParentHintsNotHandledForDescendants,
+                                    uint32_t* aEqualStructs)
 {
   PROFILER_LABEL("nsStyleContext", "CalcStyleDifference",
     js::ProfileEntry::Category::CSS);
@@ -422,6 +570,11 @@ nsStyleContext::CalcStyleDifference(nsStyleContext* aOther,
                                     nsChangeHint_Hints_NotHandledForDescendants),
                     "caller is passing inherited hints, but shouldn't be");
 
+  static_assert(nsStyleStructID_Length <= 32,
+                "aEqualStructs is not big enough");
+
+  *aEqualStructs = 0;
+
   nsChangeHint hint = NS_STYLE_HINT_NONE;
   NS_ENSURE_TRUE(aOther, hint);
   // We must always ensure that we populate the structs on the new style
@@ -454,9 +607,13 @@ nsStyleContext::CalcStyleDifference(nsStyleContext* aOther,
   const nsStyleVariables* thisVariables = PeekStyleVariables();
   if (thisVariables) {
     const nsStyleVariables* otherVariables = aOther->StyleVariables();
-    if (thisVariables->mVariables != otherVariables->mVariables) {
+    if (thisVariables->mVariables == otherVariables->mVariables) {
+      *aEqualStructs |= nsCachedStyleData::GetBitForSID(eStyleStruct_Variables);
+    } else {
       compare = true;
     }
+  } else {
+    *aEqualStructs |= nsCachedStyleData::GetBitForSID(eStyleStruct_Variables);
   }
 
   DebugOnly<int> styleStructCount = 1;  // count Variables already
@@ -469,17 +626,37 @@ nsStyleContext::CalcStyleDifference(nsStyleContext* aOther,
       nsChangeHint maxDifference = nsStyle##struct_::MaxDifference();         \
       nsChangeHint maxDifferenceNeverInherited =                              \
         nsStyle##struct_::MaxDifferenceNeverInherited();                      \
-      if ((compare ||                                                         \
-           (NS_SubtractHint(maxDifference, maxDifferenceNeverInherited) &     \
-            aParentHintsNotHandledForDescendants)) &&                         \
-          !NS_IsHintSubset(maxDifference, hint) &&                            \
-          this##struct_ != other##struct_) {                                  \
-        NS_ASSERTION(NS_IsHintSubset(                                         \
-             this##struct_->CalcDifference(*other##struct_),                  \
-             nsStyle##struct_::MaxDifference()),                              \
-             "CalcDifference() returned bigger hint than MaxDifference()");   \
-        NS_UpdateHint(hint, this##struct_->CalcDifference(*other##struct_));  \
+      if (this##struct_ == other##struct_) {                                  \
+        /* The very same struct, so we know that there will be no */          \
+        /* differences.                                           */          \
+        *aEqualStructs |= NS_STYLE_INHERIT_BIT(struct_);                      \
+      } else if (compare ||                                                   \
+                 (NS_SubtractHint(maxDifference,                              \
+                                  maxDifferenceNeverInherited) &              \
+                  aParentHintsNotHandledForDescendants)) {                    \
+        nsChangeHint difference =                                             \
+            this##struct_->CalcDifference(*other##struct_);                   \
+        NS_ASSERTION(NS_IsHintSubset(difference, maxDifference),              \
+                     "CalcDifference() returned bigger hint than "            \
+                     "MaxDifference()");                                      \
+        NS_UpdateHint(hint, difference);                                      \
+        if (!difference) {                                                    \
+          *aEqualStructs |= NS_STYLE_INHERIT_BIT(struct_);                    \
+        }                                                                     \
+      } else {                                                                \
+        /* We still must call CalcDifference to see if there were any */      \
+        /* changes so that we can set *aEqualStructs appropriately.   */      \
+        nsChangeHint difference =                                             \
+            this##struct_->CalcDifference(*other##struct_);                   \
+        NS_ASSERTION(NS_IsHintSubset(difference, maxDifference),              \
+                     "CalcDifference() returned bigger hint than "            \
+                     "MaxDifference()");                                      \
+        if (!difference) {                                                    \
+          *aEqualStructs |= NS_STYLE_INHERIT_BIT(struct_);                    \
+        }                                                                     \
       }                                                                       \
+    } else {                                                                  \
+      *aEqualStructs |= NS_STYLE_INHERIT_BIT(struct_);                        \
     }                                                                         \
     styleStructCount++;                                                       \
   PR_END_MACRO
@@ -637,7 +814,7 @@ nsStyleContext::CalcStyleDifference(nsStyleContext* aOther,
     }
   }
 
-  return hint;
+  return NS_SubtractHint(hint, nsChangeHint_NeutralChange);
 }
 
 void
@@ -859,3 +1036,116 @@ nsStyleContext::AssertStyleStructMaxDifferenceValid()
 #undef STYLE_STRUCT
 }
 #endif
+
+bool
+nsStyleContext::HasSameCachedStyleData(nsStyleContext* aOther,
+                                       nsStyleStructID aSID)
+{
+  return GetCachedStyleData(aSID) == aOther->GetCachedStyleData(aSID);
+}
+
+void
+nsStyleContext::SwapStyleData(nsStyleContext* aNewContext, uint32_t aStructs)
+{
+  static_assert(nsStyleStructID_Length <= 32, "aStructs is not big enough");
+
+  for (nsStyleStructID i = nsStyleStructID_Inherited_Start;
+       i < nsStyleStructID_Inherited_Start + nsStyleStructID_Inherited_Count;
+       i = nsStyleStructID(i + 1)) {
+    uint32_t bit = nsCachedStyleData::GetBitForSID(i);
+    if (!(aStructs & bit)) {
+      continue;
+    }
+    void*& thisData = mCachedInheritedData.mStyleStructs[i];
+    void*& otherData = aNewContext->mCachedInheritedData.mStyleStructs[i];
+    if (mBits & bit) {
+      if (thisData == otherData) {
+        thisData = nullptr;
+      }
+    } else if (!(aNewContext->mBits & bit) && thisData && otherData) {
+      std::swap(thisData, otherData);
+    }
+  }
+
+  for (nsStyleStructID i = nsStyleStructID_Reset_Start;
+       i < nsStyleStructID_Reset_Start + nsStyleStructID_Reset_Count;
+       i = nsStyleStructID(i + 1)) {
+    uint32_t bit = nsCachedStyleData::GetBitForSID(i);
+    if (!(aStructs & bit)) {
+      continue;
+    }
+    if (!mCachedResetData) {
+      mCachedResetData = new (mRuleNode->PresContext()) nsResetStyleData;
+    }
+    if (!aNewContext->mCachedResetData) {
+      aNewContext->mCachedResetData =
+        new (mRuleNode->PresContext()) nsResetStyleData;
+    }
+    void*& thisData = mCachedResetData->mStyleStructs[i];
+    void*& otherData = aNewContext->mCachedResetData->mStyleStructs[i];
+    if (mBits & bit) {
+      if (thisData == otherData) {
+        thisData = nullptr;
+      }
+    } else if (!(aNewContext->mBits & bit) && thisData && otherData) {
+      std::swap(thisData, otherData);
+    }
+  }
+}
+
+void
+nsStyleContext::ClearCachedInheritedStyleDataOnDescendants(uint32_t aStructs)
+{
+  if (mChild) {
+    nsStyleContext* child = mChild;
+    do {
+      child->DoClearCachedInheritedStyleDataOnDescendants(aStructs);
+      child = child->mNextSibling;
+    } while (mChild != child);
+  }
+  if (mEmptyChild) {
+    nsStyleContext* child = mEmptyChild;
+    do {
+      child->DoClearCachedInheritedStyleDataOnDescendants(aStructs);
+      child = child->mNextSibling;
+    } while (mEmptyChild != child);
+  }
+}
+
+void
+nsStyleContext::DoClearCachedInheritedStyleDataOnDescendants(uint32_t aStructs)
+{
+  for (nsStyleStructID i = nsStyleStructID_Inherited_Start;
+       i < nsStyleStructID_Inherited_Start + nsStyleStructID_Inherited_Count;
+       i = nsStyleStructID(i + 1)) {
+    uint32_t bit = nsCachedStyleData::GetBitForSID(i);
+    if (aStructs & bit) {
+      if (!(mBits & bit) && mCachedInheritedData.mStyleStructs[i]) {
+        aStructs &= ~bit;
+      } else {
+        mCachedInheritedData.mStyleStructs[i] = nullptr;
+      }
+    }
+  }
+
+  if (mCachedResetData) {
+    for (nsStyleStructID i = nsStyleStructID_Reset_Start;
+         i < nsStyleStructID_Reset_Start + nsStyleStructID_Reset_Count;
+         i = nsStyleStructID(i + 1)) {
+      uint32_t bit = nsCachedStyleData::GetBitForSID(i);
+      if (aStructs & bit) {
+        if (!(mBits & bit) && mCachedResetData->mStyleStructs[i]) {
+          aStructs &= ~bit;
+        } else {
+          mCachedResetData->mStyleStructs[i] = nullptr;
+        }
+      }
+    }
+  }
+
+  if (aStructs == 0) {
+    return;
+  }
+
+  ClearCachedInheritedStyleDataOnDescendants(aStructs);
+}
diff --git a/layout/style/nsStyleContext.h b/layout/style/nsStyleContext.h
index 35a20563a62..50de463a6ae 100644
--- a/layout/style/nsStyleContext.h
+++ b/layout/style/nsStyleContext.h
@@ -95,6 +95,13 @@ public:
     return mRefCnt;
   }
 
+  bool HasSingleReference() const {
+    NS_ASSERTION(mRefCnt != 0,
+                 "do not call HasSingleReference on a newly created "
+                 "nsStyleContext with no references yet");
+    return mRefCnt == 1;
+  }
+
   nsPresContext* PresContext() const { return mRuleNode->PresContext(); }
 
   nsStyleContext* GetParent() const { return mParent; }
@@ -193,6 +200,21 @@ public:
     }
   }
 
+  // Does this style context, or any of its descendants, have any style values
+  // that were computed based on this style context's grandparent style context
+  // or any of the grandparent's ancestors?
+  bool UsesGrandancestorStyle() const
+    { return !!(mBits & NS_STYLE_USES_GRANDANCESTOR_STYLE); }
+
+  // Is this style context shared with a sibling or cousin?
+  // (See nsStyleSet::GetContext.)
+  bool IsShared() const
+    { return !!(mBits & NS_STYLE_IS_SHARED); }
+
+  // Does this style context have any children that return true for
+  // UsesGrandancestorStyle()?
+  bool HasChildThatUsesGrandancestorStyle() const;
+
   // Tell this style context to cache aStruct as the struct for aSID
   void SetStyle(nsStyleStructID aSID, void* aStruct);
 
@@ -212,6 +234,19 @@ public:
   #undef STYLE_STRUCT_RESET
   #undef STYLE_STRUCT_INHERITED
 
+  /**
+   * Returns whether this style context and aOther both have the same
+   * cached style struct pointer for a given style struct.
+   */
+  bool HasSameCachedStyleData(nsStyleContext* aOther, nsStyleStructID aSID);
+
+  /**
+   * Returns whether this style context has cached, inherited style data for a
+   * given style struct.
+   */
+  bool HasCachedInheritedStyleData(nsStyleStructID aSID)
+    { return mBits & nsCachedStyleData::GetBitForSID(aSID); }
+
   nsRuleNode* RuleNode() { return mRuleNode; }
   void AddStyleBit(const uint64_t& aBit) { mBits |= aBit; }
 
@@ -284,9 +319,13 @@ public:
    * must not pass less than needed; therefore if the caller doesn't
    * know, the caller should pass
    * nsChangeHint_Hints_NotHandledForDescendants.
+   *
+   * aEqualStructs must not be null.  Into it will be stored a bitfield
+   * representing which structs were compared to be non-equal.
    */
   nsChangeHint CalcStyleDifference(nsStyleContext* aOther,
-                                   nsChangeHint aParentHintsNotHandledForDescendants);
+                                   nsChangeHint aParentHintsNotHandledForDescendants,
+                                   uint32_t* aEqualStructs);
 
   /**
    * Get a color that depends on link-visitedness using this and
@@ -319,6 +358,41 @@ public:
     StyleBackground();
   }
 
+  /**
+   * Moves this style context to a new parent.
+   *
+   * This function violates style context tree immutability, and
+   * is a very low-level function and should only be used after verifying
+   * many conditions that make it safe to call.
+   */
+  void MoveTo(nsStyleContext* aNewParent);
+
+  /**
+   * Swaps owned style struct pointers between this and aNewContext, on
+   * the assumption that aNewContext is the new style context for a frame
+   * and this is the old one.  aStructs indicates which structs to consider
+   * swapping; only those which are owned in both this and aNewContext
+   * will be swapped.
+   *
+   * Additionally, if there are identical struct pointers for one of the
+   * structs indicated by aStructs, and it is not an owned struct on this,
+   * then the cached struct slot on this will be set to null.  If the struct
+   * has been swapped on an ancestor, this style context (being the old one)
+   * will be left caching the struct pointer on the new ancestor, despite
+   * inheriting from the old ancestor.  This is not normally a problem, as
+   * this style context will usually be destroyed by being released at the
+   * end of ElementRestyler::Restyle; but for style contexts held on to outside
+   * of the frame, we need to clear out the cached pointer so that if we need
+   * it again we'll re-fetch it from the new ancestor.
+   */
+  void SwapStyleData(nsStyleContext* aNewContext, uint32_t aStructs);
+
+  /**
+   * On each descendant of this style context, clears out any cached inherited
+   * structs indicated in aStructs.
+   */
+  void ClearCachedInheritedStyleDataOnDescendants(uint32_t aStructs);
+
 #ifdef DEBUG
   void List(FILE* out, int32_t aIndent);
   static void AssertStyleStructMaxDifferenceValid();
@@ -333,6 +407,10 @@ private:
 
   void ApplyStyleFixups(bool aSkipParentDisplayBasedStyleFixup);
 
+  // Helper function for HasChildThatUsesGrandancestorStyle.
+  static bool ListContainsStyleContextThatUsesGrandancestorStyle(
+                                                   const nsStyleContext* aHead);
+
   // Helper function that GetStyleData and GetUniqueStyleData use.  Only
   // returns the structs we cache ourselves; never consults the ruletree.
   inline const void* GetCachedStyleData(nsStyleStructID aSID);
@@ -363,7 +441,15 @@ private:
   #undef STYLE_STRUCT_RESET
   #undef STYLE_STRUCT_INHERITED
 
-  nsStyleContext* const mParent; // STRONG
+  // Helper for ClearCachedInheritedStyleDataOnDescendants.
+  void DoClearCachedInheritedStyleDataOnDescendants(uint32_t aStructs);
+
+#ifdef DEBUG
+  void AssertStructsNotUsedElsewhere(nsStyleContext* aDestroyingContext,
+                                     int32_t aLevels) const;
+#endif
+
+  nsStyleContext* mParent; // STRONG
 
   // Children are kept in two circularly-linked lists.  The list anchor
   // is not part of the list (null for empty), and we point to the first
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 05251525f58..e6fc4e05408 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -194,7 +194,22 @@ nsChangeHint nsStyleFont::CalcDifference(const nsStyleFont& aOther) const
       mMathDisplay != aOther.mMathDisplay) {
     return NS_STYLE_HINT_REFLOW;
   }
-  return CalcFontDifference(mFont, aOther.mFont);
+
+  nsChangeHint hint = CalcFontDifference(mFont, aOther.mFont);
+  if (hint) {
+    return hint;
+  }
+
+  // XXX Should any of these cause a non-nsChangeHint_NeutralChange change?
+  if (mGenericID != aOther.mGenericID ||
+      mScriptLevel != aOther.mScriptLevel ||
+      mScriptUnconstrainedSize != aOther.mScriptUnconstrainedSize ||
+      mScriptMinSize != aOther.mScriptMinSize ||
+      mScriptSizeMultiplier != aOther.mScriptSizeMultiplier) {
+    return nsChangeHint_NeutralChange;
+  }
+
+  return NS_STYLE_HINT_NONE;
 }
 
 /* static */ nscoord
@@ -502,8 +517,6 @@ nsChangeHint nsStyleBorder::CalcDifference(const nsStyleBorder& aOther) const
                     shadowDifference == unsigned(NS_STYLE_HINT_NONE),
                     "should do more with shadowDifference");
 
-  // Note that differences in mBorder don't affect rendering (which should only
-  // use mComputedBorder), so don't need to be tested for here.
   // XXXbz we should be able to return a more specific change hint for
   // at least GetComputedBorder() differences...
   if (mTwipsPerPixel != aOther.mTwipsPerPixel ||
@@ -562,7 +575,18 @@ nsChangeHint nsStyleBorder::CalcDifference(const nsStyleBorder& aOther) const
     }
   }
 
-  return shadowDifference;
+  if (shadowDifference) {
+    return shadowDifference;
+  }
+
+  // mBorder is the specified border value.  Changes to this don't
+  // need any change processing, since we operate on the computed
+  // border values instead.
+  if (mBorder != aOther.mBorder) {
+    return nsChangeHint_NeutralChange;
+  }
+
+  return NS_STYLE_HINT_NONE;
 }
 
 nsStyleOutline::nsStyleOutline(nsPresContext* aPresContext)
@@ -628,11 +652,23 @@ nsChangeHint nsStyleOutline::CalcDifference(const nsStyleOutline& aOther) const
     return NS_CombineHint(nsChangeHint_AllReflowHints,
                           nsChangeHint_RepaintFrame);
   }
+
   if ((mOutlineStyle != aOther.mOutlineStyle) ||
       (mOutlineColor != aOther.mOutlineColor) ||
       (mOutlineRadius != aOther.mOutlineRadius)) {
     return nsChangeHint_RepaintFrame;
   }
+
+  // XXX Not exactly sure if we need to check the cached outline values.
+  if (mOutlineWidth != aOther.mOutlineWidth ||
+      mOutlineOffset != aOther.mOutlineOffset ||
+      mTwipsPerPixel != aOther.mTwipsPerPixel ||
+      mHasCachedOutline != aOther.mHasCachedOutline ||
+      (mHasCachedOutline &&
+       (mCachedOutlineWidth != aOther.mCachedOutlineWidth))) {
+    return nsChangeHint_NeutralChange;
+  }
+
   return NS_STYLE_HINT_NONE;
 }
 
@@ -786,6 +822,13 @@ nsChangeHint nsStyleColumn::CalcDifference(const nsStyleColumn& aOther) const
       mColumnRuleColorIsForeground != aOther.mColumnRuleColorIsForeground)
     return NS_STYLE_HINT_VISUAL;
 
+  // XXX Is it right that we never check mTwipsPerPixel to return a
+  // non-nsChangeHint_NeutralChange hint?
+  if (mColumnRuleWidth != aOther.mColumnRuleWidth ||
+      mTwipsPerPixel != aOther.mTwipsPerPixel) {
+    return nsChangeHint_NeutralChange;
+  }
+
   return NS_STYLE_HINT_NONE;
 }
 
@@ -2061,6 +2104,15 @@ nsChangeHint nsStyleBackground::CalcDifference(const nsStyleBackground& aOther)
   if (hasVisualDifference || mBackgroundColor != aOther.mBackgroundColor)
     return NS_STYLE_HINT_VISUAL;
 
+  if (mAttachmentCount != aOther.mAttachmentCount ||
+      mClipCount != aOther.mClipCount ||
+      mOriginCount != aOther.mOriginCount ||
+      mRepeatCount != aOther.mRepeatCount ||
+      mPositionCount != aOther.mPositionCount ||
+      mSizeCount != aOther.mSizeCount) {
+    return nsChangeHint_NeutralChange;
+  }
+
   return NS_STYLE_HINT_NONE;
 }
 
@@ -2322,6 +2374,17 @@ mozilla::StyleTransition::SetUnknownProperty(const nsAString& aUnknownProperty)
   mUnknownProperty = do_GetAtom(aUnknownProperty);
 }
 
+bool
+mozilla::StyleTransition::operator==(const mozilla::StyleTransition& aOther) const
+{
+  return mTimingFunction == aOther.mTimingFunction &&
+         mDuration == aOther.mDuration &&
+         mDelay == aOther.mDelay &&
+         mProperty == aOther.mProperty &&
+         (mProperty != eCSSProperty_UNKNOWN ||
+          mUnknownProperty == aOther.mUnknownProperty);
+}
+
 mozilla::StyleAnimation::StyleAnimation(const mozilla::StyleAnimation& aCopy)
   : mTimingFunction(aCopy.mTimingFunction)
   , mDuration(aCopy.mDuration)
@@ -2347,6 +2410,19 @@ mozilla::StyleAnimation::SetInitialValues()
   mIterationCount = 1.0f;
 }
 
+bool
+mozilla::StyleAnimation::operator==(const mozilla::StyleAnimation& aOther) const
+{
+  return mTimingFunction == aOther.mTimingFunction &&
+         mDuration == aOther.mDuration &&
+         mDelay == aOther.mDelay &&
+         mName == aOther.mName &&
+         mDirection == aOther.mDirection &&
+         mFillMode == aOther.mFillMode &&
+         mPlayState == aOther.mPlayState &&
+         mIterationCount == aOther.mIterationCount;
+}
+
 nsStyleDisplay::nsStyleDisplay()
   : mWillChangeBitField(0)
 {
@@ -2533,24 +2609,29 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
     NS_UpdateHint(hint, NS_CombineHint(nsChangeHint_AddOrRemoveTransform,
                           NS_CombineHint(nsChangeHint_UpdateOverflow,
                                          nsChangeHint_RepaintFrame)));
-  }
-  else if (HasTransformStyle()) {
+  } else {
     /* Otherwise, if we've kept the property lying around and we already had a
      * transform, we need to see whether or not we've changed the transform.
      * If so, we need to recompute its overflow rect (which probably changed
      * if the transform changed) and to redraw within the bounds of that new
      * overflow rect.
+     *
+     * If the property isn't present in either style struct, we still do the
+     * comparisons but turn all the resulting change hints into
+     * nsChangeHint_NeutralChange.
      */
+    nsChangeHint transformHint = nsChangeHint(0);
+
     if (!mSpecifiedTransform != !aOther.mSpecifiedTransform ||
         (mSpecifiedTransform &&
          *mSpecifiedTransform != *aOther.mSpecifiedTransform)) {
-      NS_UpdateHint(hint, nsChangeHint_UpdateTransformLayer);
+      NS_UpdateHint(transformHint, nsChangeHint_UpdateTransformLayer);
 
       if (mSpecifiedTransform &&
           aOther.mSpecifiedTransform) {
-        NS_UpdateHint(hint, nsChangeHint_UpdatePostTransformOverflow);
+        NS_UpdateHint(transformHint, nsChangeHint_UpdatePostTransformOverflow);
       } else {
-        NS_UpdateHint(hint, nsChangeHint_UpdateOverflow);
+        NS_UpdateHint(transformHint, nsChangeHint_UpdateOverflow);
       }
     }
 
@@ -2558,22 +2639,30 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
       NS_CombineHint(nsChangeHint_UpdateOverflow, nsChangeHint_RepaintFrame);
     for (uint8_t index = 0; index < 3; ++index)
       if (mTransformOrigin[index] != aOther.mTransformOrigin[index]) {
-        NS_UpdateHint(hint, kUpdateOverflowAndRepaintHint);
+        NS_UpdateHint(transformHint, kUpdateOverflowAndRepaintHint);
         break;
       }
     
     for (uint8_t index = 0; index < 2; ++index)
       if (mPerspectiveOrigin[index] != aOther.mPerspectiveOrigin[index]) {
-        NS_UpdateHint(hint, kUpdateOverflowAndRepaintHint);
+        NS_UpdateHint(transformHint, kUpdateOverflowAndRepaintHint);
         break;
       }
 
     if (mChildPerspective != aOther.mChildPerspective ||
         mTransformStyle != aOther.mTransformStyle)
-      NS_UpdateHint(hint, kUpdateOverflowAndRepaintHint);
+      NS_UpdateHint(transformHint, kUpdateOverflowAndRepaintHint);
 
     if (mBackfaceVisibility != aOther.mBackfaceVisibility)
-      NS_UpdateHint(hint, nsChangeHint_RepaintFrame);
+      NS_UpdateHint(transformHint, nsChangeHint_RepaintFrame);
+
+    if (transformHint) {
+      if (HasTransformStyle()) {
+        NS_UpdateHint(hint, transformHint);
+      } else {
+        NS_UpdateHint(hint, nsChangeHint_NeutralChange);
+      }
+    }
   }
 
   uint8_t willChangeBitsChanged =
@@ -2600,6 +2689,32 @@ nsChangeHint nsStyleDisplay::CalcDifference(const nsStyleDisplay& aOther) const
   // notified about every new style context constructed, and it uses
   // that opportunity to handle dynamic changes appropriately.
 
+  // But we still need to return nsChangeHint_NeutralChange for these
+  // properties, since some data did change in the style struct.
+
+  if (!hint &&
+      (!mClip.IsEqualEdges(aOther.mClip) ||
+       mOriginalDisplay != aOther.mOriginalDisplay ||
+       mOriginalFloats != aOther.mOriginalFloats ||
+       mMixBlendMode != aOther.mMixBlendMode ||
+       mTransitions != aOther.mTransitions ||
+       mTransitionTimingFunctionCount !=
+         aOther.mTransitionTimingFunctionCount ||
+       mTransitionDurationCount != aOther.mTransitionDurationCount ||
+       mTransitionDelayCount != aOther.mTransitionDelayCount ||
+       mTransitionPropertyCount != aOther.mTransitionPropertyCount ||
+       mAnimations != aOther.mAnimations ||
+       mAnimationTimingFunctionCount != aOther.mAnimationTimingFunctionCount ||
+       mAnimationDurationCount != aOther.mAnimationDurationCount ||
+       mAnimationDelayCount != aOther.mAnimationDelayCount ||
+       mAnimationNameCount != aOther.mAnimationNameCount ||
+       mAnimationDirectionCount != aOther.mAnimationDirectionCount ||
+       mAnimationFillModeCount != aOther.mAnimationFillModeCount ||
+       mAnimationPlayStateCount != aOther.mAnimationPlayStateCount ||
+       mAnimationIterationCountCount != aOther.mAnimationIterationCountCount)) {
+    NS_UpdateHint(hint, nsChangeHint_NeutralChange);
+  }
+
   return hint;
 }
 
@@ -3235,13 +3350,18 @@ nsChangeHint nsStyleUserInterface::CalcDifference(const nsStyleUserInterface& aO
   if (mUserModify != aOther.mUserModify)
     NS_UpdateHint(hint, NS_STYLE_HINT_VISUAL);
   
-  if ((mUserInput != aOther.mUserInput) &&
-      ((NS_STYLE_USER_INPUT_NONE == mUserInput) || 
-       (NS_STYLE_USER_INPUT_NONE == aOther.mUserInput))) {
-    NS_UpdateHint(hint, NS_STYLE_HINT_FRAMECHANGE);
+  if (mUserInput != aOther.mUserInput) {
+    if (NS_STYLE_USER_INPUT_NONE == mUserInput ||
+        NS_STYLE_USER_INPUT_NONE == aOther.mUserInput) {
+      NS_UpdateHint(hint, NS_STYLE_HINT_FRAMECHANGE);
+    } else {
+      NS_UpdateHint(hint, nsChangeHint_NeutralChange);
+    }
   }
 
-  // ignore mUserFocus
+  if (mUserFocus != aOther.mUserFocus) {
+    NS_UpdateHint(hint, nsChangeHint_NeutralChange);
+  }
 
   return hint;
 }
diff --git a/layout/style/nsStyleStruct.h b/layout/style/nsStyleStruct.h
index 65c504def84..c949f2665d6 100644
--- a/layout/style/nsStyleStruct.h
+++ b/layout/style/nsStyleStruct.h
@@ -49,9 +49,16 @@ class imgIContainer;
 #define NS_STYLE_RELEVANT_LINK_VISITED     0x004000000
 // See nsStyleContext::IsStyleIfVisited
 #define NS_STYLE_IS_STYLE_IF_VISITED       0x008000000
+// See nsStyleContext::UsesGrandancestorStyle
+#define NS_STYLE_USES_GRANDANCESTOR_STYLE  0x010000000
+// See nsStyleContext::IsShared
+#define NS_STYLE_IS_SHARED                 0x020000000
+// See nsStyleContext::AssertStructsNotUsedElsewhere
+// (This bit is currently only used in #ifdef DEBUG code.)
+#define NS_STYLE_IS_GOING_AWAY             0x040000000
 // See nsStyleContext::GetPseudoEnum
-#define NS_STYLE_CONTEXT_TYPE_MASK         0x1f0000000
-#define NS_STYLE_CONTEXT_TYPE_SHIFT        28
+#define NS_STYLE_CONTEXT_TYPE_MASK         0xf80000000
+#define NS_STYLE_CONTEXT_TYPE_SHIFT        31
 
 // Additional bits for nsRuleNode's mDependentBits:
 #define NS_RULE_NODE_GC_MARK                0x02000000
@@ -75,7 +82,8 @@ public:
 
   nsChangeHint CalcDifference(const nsStyleFont& aOther) const;
   static nsChangeHint MaxDifference() {
-    return NS_STYLE_HINT_REFLOW;
+    return NS_CombineHint(NS_STYLE_HINT_REFLOW,
+                          nsChangeHint_NeutralChange);
   }
   static nsChangeHint MaxDifferenceNeverInherited() {
     // CalcDifference never returns nsChangeHint_NeedReflow or
@@ -353,7 +361,9 @@ struct nsStyleBackground {
 
   nsChangeHint CalcDifference(const nsStyleBackground& aOther) const;
   static nsChangeHint MaxDifference() {
-    return NS_CombineHint(nsChangeHint_UpdateEffects, NS_STYLE_HINT_VISUAL);
+    return NS_CombineHint(nsChangeHint_UpdateEffects,
+                          NS_CombineHint(NS_STYLE_HINT_VISUAL,
+                                         nsChangeHint_NeutralChange));
   }
   static nsChangeHint MaxDifferenceNeverInherited() {
     // CalcDifference never returns nsChangeHint_NeedReflow or
@@ -816,7 +826,8 @@ struct nsStyleBorder {
   nsChangeHint CalcDifference(const nsStyleBorder& aOther) const;
   static nsChangeHint MaxDifference() {
     return NS_CombineHint(NS_STYLE_HINT_REFLOW,
-                          nsChangeHint_BorderStyleNoneChange);
+                          NS_CombineHint(nsChangeHint_BorderStyleNoneChange,
+                                         nsChangeHint_NeutralChange));
   }
   static nsChangeHint MaxDifferenceNeverInherited() {
     // CalcDifference never returns nsChangeHint_NeedReflow or
@@ -1049,7 +1060,8 @@ struct nsStyleOutline {
   nsChangeHint CalcDifference(const nsStyleOutline& aOther) const;
   static nsChangeHint MaxDifference() {
     return NS_CombineHint(nsChangeHint_AllReflowHints,
-                          nsChangeHint_RepaintFrame);
+                          NS_CombineHint(nsChangeHint_RepaintFrame,
+                                         nsChangeHint_NeutralChange));
   }
   static nsChangeHint MaxDifferenceNeverInherited() {
     // CalcDifference never returns nsChangeHint_NeedReflow or
@@ -1885,6 +1897,10 @@ struct StyleTransition {
 
   nsTimingFunction& TimingFunctionSlot() { return mTimingFunction; }
 
+  bool operator==(const StyleTransition& aOther) const;
+  bool operator!=(const StyleTransition& aOther) const
+    { return !(*this == aOther); }
+
 private:
   nsTimingFunction mTimingFunction;
   float mDuration;
@@ -1924,6 +1940,10 @@ struct StyleAnimation {
 
   nsTimingFunction& TimingFunctionSlot() { return mTimingFunction; }
 
+  bool operator==(const StyleAnimation& aOther) const;
+  bool operator!=(const StyleAnimation& aOther) const
+    { return !(*this == aOther); }
+
 private:
   nsTimingFunction mTimingFunction;
   float mDuration;
@@ -1962,7 +1982,8 @@ struct nsStyleDisplay {
                         nsChangeHint_UpdateTransformLayer |
                         nsChangeHint_UpdateOverflow |
                         nsChangeHint_UpdatePostTransformOverflow |
-                        nsChangeHint_AddOrRemoveTransform);
+                        nsChangeHint_AddOrRemoveTransform |
+                        nsChangeHint_NeutralChange);
   }
   static nsChangeHint MaxDifferenceNeverInherited() {
     // CalcDifference can return both nsChangeHint_ClearAncestorIntrinsics and
@@ -2557,7 +2578,9 @@ struct nsStyleUserInterface {
 
   nsChangeHint CalcDifference(const nsStyleUserInterface& aOther) const;
   static nsChangeHint MaxDifference() {
-    return nsChangeHint(nsChangeHint_UpdateCursor | NS_STYLE_HINT_FRAMECHANGE);
+    return NS_CombineHint(NS_STYLE_HINT_FRAMECHANGE,
+                          NS_CombineHint(nsChangeHint_UpdateCursor,
+                                         nsChangeHint_NeutralChange));
   }
   static nsChangeHint MaxDifferenceNeverInherited() {
     // CalcDifference never returns nsChangeHint_NeedReflow or
@@ -2635,7 +2658,8 @@ struct nsStyleColumn {
 
   nsChangeHint CalcDifference(const nsStyleColumn& aOther) const;
   static nsChangeHint MaxDifference() {
-    return NS_STYLE_HINT_FRAMECHANGE;
+    return NS_CombineHint(NS_STYLE_HINT_FRAMECHANGE,
+                          nsChangeHint_NeutralChange);
   }
   static nsChangeHint MaxDifferenceNeverInherited() {
     // CalcDifference never returns nsChangeHint_NeedReflow or
diff --git a/layout/style/test/test_animations.html b/layout/style/test/test_animations.html
index cc6264a2373..5c22d2f4051 100644
--- a/layout/style/test/test_animations.html
+++ b/layout/style/test/test_animations.html
@@ -1131,6 +1131,19 @@ is_approx(px_to_num(cs.marginBottom), 100 * gTF.ease_in_out(0.8), 0.01,
           "animation-play-state test 4 at 10050ms");
 done_div();
 
+// an initially paused animation (bug 1063992)
+new_div("animation: anim1 1s paused both");
+is(cs.marginLeft, "0px", "animation-play-state test 5, at 0s");
+advance_clock(500);
+is(cs.marginLeft, "0px", "animation-play-state test 5, at 0.5s");
+div.style.animationPlayState = "running";
+is(cs.marginLeft, "0px",
+   "animation-play-state test 5, at 0.5s after unpausing");
+advance_clock(500);
+is(cs.marginLeft, "80px",
+   "animation-play-state test 5, at 1s after unpaused");
+done_div();
+
 /*
  * css3-animations:  3.8. The 'animation-delay' Property
  * http://dev.w3.org/csswg/css3-animations/#the-animation-delay-property-
diff --git a/layout/style/test/test_animations_omta.html b/layout/style/test/test_animations_omta.html
index e1e223b8dd6..fc34f560ae0 100644
--- a/layout/style/test/test_animations_omta.html
+++ b/layout/style/test/test_animations_omta.html
@@ -1549,13 +1549,6 @@ addAsyncAnimTest(function *() {
 // rules below it in the cascade; we're checking that the animation
 // isn't rebuilt when the restyles happen.
 addAsyncAnimTest(function *() {
-  // Bug 1012527 - ASSERTION: Why did this not get handled while processing
-  // mRestyleRoots? on B2G emulator builds
-  // (Note that we don't expect assertions anywhere else in this file so the
-  // following usage is safe)
-  if (navigator.platform === '') {
-    SimpleTest.expectAssertions(2);
-  }
   new_div("animation: kf3 1s linear forwards");
   yield waitForPaintsFlushed();
   omta_is("transform", { tx: 0 }, RunningOn.Compositor,
diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
index 1fd06959e52..d2b302430d7 100644
--- a/layout/svg/SVGTextFrame.cpp
+++ b/layout/svg/SVGTextFrame.cpp
@@ -3134,14 +3134,21 @@ nsDisplaySVGText::Paint(nsDisplayListBuilder* aBuilder,
   gfxContextAutoDisableSubpixelAntialiasing
     disable(aCtx->ThebesContext(), mDisableSubpixelAA);
 
+  uint32_t appUnitsPerDevPixel = mFrame->PresContext()->AppUnitsPerDevPixel();
+
   // ToReferenceFrame includes our mRect offset, but painting takes
   // account of that too. To avoid double counting, we subtract that
   // here.
   nsPoint offset = ToReferenceFrame() - mFrame->GetPosition();
 
+  gfxPoint devPixelOffset =
+    nsLayoutUtils::PointToGfxPoint(offset, appUnitsPerDevPixel);
+
+  gfxMatrix tm = nsSVGIntegrationUtils::GetCSSPxToDevPxMatrix(mFrame) *
+                   gfxMatrix::Translation(devPixelOffset);
+
   aCtx->PushState();
-  aCtx->Translate(offset);
-  static_cast<SVGTextFrame*>(mFrame)->PaintSVG(aCtx, nullptr);
+  static_cast<SVGTextFrame*>(mFrame)->PaintSVG(aCtx, tm);
   aCtx->PopState();
 }
 
@@ -3381,30 +3388,37 @@ SVGTextFrame::MutationObserver::AttributeChanged(
     return;
   }
 
-  // Attribute changes on this element are handled in
+  // Attribute changes on this element will be handled by
   // SVGTextFrame::AttributeChanged.
   if (aElement == mFrame->GetContent()) {
     return;
   }
 
-  // Attributes changes on descendent elements.
+  mFrame->HandleAttributeChangeInDescendant(aElement, aNameSpaceID, aAttribute);
+}
+
+void
+SVGTextFrame::HandleAttributeChangeInDescendant(Element* aElement,
+                                                int32_t aNameSpaceID,
+                                                nsIAtom* aAttribute)
+{
   if (aElement->Tag() == nsGkAtoms::textPath) {
     if (aNameSpaceID == kNameSpaceID_None &&
         aAttribute == nsGkAtoms::startOffset) {
-      mFrame->NotifyGlyphMetricsChange();
+      NotifyGlyphMetricsChange();
     } else if (aNameSpaceID == kNameSpaceID_XLink &&
                aAttribute == nsGkAtoms::href) {
       // Blow away our reference, if any
       nsIFrame* childElementFrame = aElement->GetPrimaryFrame();
       if (childElementFrame) {
         childElementFrame->Properties().Delete(nsSVGEffects::HrefProperty());
-        mFrame->NotifyGlyphMetricsChange();
+        NotifyGlyphMetricsChange();
       }
     }
   } else {
     if (aNameSpaceID == kNameSpaceID_None &&
         IsGlyphPositioningAttribute(aAttribute)) {
-      mFrame->NotifyGlyphMetricsChange();
+      NotifyGlyphMetricsChange();
     }
   }
 }
@@ -3565,8 +3579,8 @@ ShouldPaintCaret(const TextRenderedRun& aThisRun, nsCaret* aCaret)
 
 nsresult
 SVGTextFrame::PaintSVG(nsRenderingContext* aContext,
-                       const nsIntRect *aDirtyRect,
-                       nsIFrame* aTransformRoot)
+                       const gfxMatrix& aTransform,
+                       const nsIntRect *aDirtyRect)
 {
   nsIFrame* kid = GetFirstPrincipalChild();
   if (!kid)
@@ -3596,13 +3610,12 @@ SVGTextFrame::PaintSVG(nsRenderingContext* aContext,
     return NS_OK;
   }
 
-  gfxMatrix canvasTM = GetCanvasTM(FOR_PAINTING, aTransformRoot);
-  if (canvasTM.IsSingular()) {
+  if (aTransform.IsSingular()) {
     NS_WARNING("Can't render text element!");
     return NS_ERROR_FAILURE;
   }
 
-  gfxMatrix matrixForPaintServers = canvasTM * initialMatrix;
+  gfxMatrix matrixForPaintServers = aTransform * initialMatrix;
 
   // Check if we need to draw anything.
   if (aDirtyRect) {
@@ -3625,12 +3638,12 @@ SVGTextFrame::PaintSVG(nsRenderingContext* aContext,
     }
   }
 
-  // SVG paints in CSS px, but normally frames paint in dev pixels. Here we
-  // multiply a CSS-px-to-dev-pixel factor onto canvasTM so our children paint
-  // correctly.
+  // SVG frames' PaintSVG methods paint in CSS px, but normally frames paint in
+  // dev pixels. Here we multiply a CSS-px-to-dev-pixel factor onto aTransform
+  // so our non-SVG nsTextFrame children paint correctly.
   float cssPxPerDevPx = presContext->
     AppUnitsToFloatCSSPixels(presContext->AppUnitsPerDevPixel());
-  gfxMatrix canvasTMForChildren = canvasTM;
+  gfxMatrix canvasTMForChildren = aTransform;
   canvasTMForChildren.Scale(cssPxPerDevPx, cssPxPerDevPx);
   initialMatrix.Scale(1 / cssPxPerDevPx, 1 / cssPxPerDevPx);
 
@@ -3656,7 +3669,7 @@ SVGTextFrame::PaintSVG(nsRenderingContext* aContext,
     // when they use context-fill etc.
     gfx->SetMatrix(initialMatrix);
     gfxTextContextPaint *outerContextPaint =
-      (gfxTextContextPaint*)aContext->GetUserData(&gfxTextContextPaint::sUserDataKey);
+      (gfxTextContextPaint*)aContext->GetDrawTarget()->GetUserData(&gfxTextContextPaint::sUserDataKey);
 
     nsAutoPtr<gfxTextContextPaint> contextPaint;
     DrawMode drawMode =
diff --git a/layout/svg/SVGTextFrame.h b/layout/svg/SVGTextFrame.h
index e9a3f297b52..4b05ea66cab 100644
--- a/layout/svg/SVGTextFrame.h
+++ b/layout/svg/SVGTextFrame.h
@@ -318,8 +318,8 @@ public:
   // nsISVGChildFrame interface:
   virtual void NotifySVGChanged(uint32_t aFlags) MOZ_OVERRIDE;
   virtual nsresult PaintSVG(nsRenderingContext* aContext,
-                            const nsIntRect* aDirtyRect,
-                            nsIFrame* aTransformRoot = nullptr) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect* aDirtyRect = nullptr) MOZ_OVERRIDE;
   virtual nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) MOZ_OVERRIDE;
   virtual void ReflowSVG() MOZ_OVERRIDE;
   virtual nsRect GetCoveredRegion() MOZ_OVERRIDE;
@@ -349,6 +349,14 @@ public:
 
   // SVGTextFrame methods:
 
+  /**
+   * Handles a base or animated attribute value change to a descendant
+   * text content element.
+   */
+  void HandleAttributeChangeInDescendant(mozilla::dom::Element* aElement,
+                                         int32_t aNameSpaceID,
+                                         nsIAtom* aAttribute);
+
   /**
    * Schedules mPositions to be recomputed and the covered region to be
    * updated.
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
index 65bdaf92321..356a90d5e55 100644
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -61,7 +61,7 @@ load 385552-2.svg
 load 385840-1.svg
 load 385852-1.svg
 load 386475-1.xhtml
-asserts(1) load 386566-1.svg # Bug 713626
+load 386566-1.svg
 load 386690-1.svg
 load 387290-1.svg
 load 402408-1.svg
diff --git a/layout/svg/nsFilterInstance.cpp b/layout/svg/nsFilterInstance.cpp
index 4c9be7c7df7..8f7563e10d3 100644
--- a/layout/svg/nsFilterInstance.cpp
+++ b/layout/svg/nsFilterInstance.cpp
@@ -24,15 +24,14 @@ using namespace mozilla::dom;
 using namespace mozilla::gfx;
 
 nsresult
-nsFilterInstance::PaintFilteredFrame(nsRenderingContext *aContext,
-                                     nsIFrame *aFilteredFrame,
+nsFilterInstance::PaintFilteredFrame(nsIFrame *aFilteredFrame,
+                                     nsRenderingContext *aContext,
+                                     const gfxMatrix& aTransform,
                                      nsSVGFilterPaintCallback *aPaintCallback,
-                                     const nsRegion *aDirtyArea,
-                                     nsIFrame* aTransformRoot)
+                                     const nsRegion *aDirtyArea)
 {
-  nsFilterInstance instance(aFilteredFrame, aPaintCallback, aDirtyArea,
-                            nullptr, nullptr, nullptr,
-                            aTransformRoot);
+  nsFilterInstance instance(aFilteredFrame, aPaintCallback, aTransform,
+                            aDirtyArea, nullptr, nullptr, nullptr);
   if (!instance.IsInitialized()) {
     return NS_OK;
   }
@@ -47,7 +46,8 @@ nsFilterInstance::GetPostFilterDirtyArea(nsIFrame *aFilteredFrame,
     return nsRegion();
   }
 
-  nsFilterInstance instance(aFilteredFrame, nullptr, nullptr,
+  gfxMatrix unused; // aPaintTransform arg not used since we're not painting
+  nsFilterInstance instance(aFilteredFrame, nullptr, unused, nullptr,
                             &aPreFilterDirtyRegion);
   if (!instance.IsInitialized()) {
     return nsRegion();
@@ -63,7 +63,9 @@ nsRegion
 nsFilterInstance::GetPreFilterNeededArea(nsIFrame *aFilteredFrame,
                                          const nsRegion& aPostFilterDirtyRegion)
 {
-  nsFilterInstance instance(aFilteredFrame, nullptr, &aPostFilterDirtyRegion);
+  gfxMatrix unused; // aPaintTransform arg not used since we're not painting
+  nsFilterInstance instance(aFilteredFrame, nullptr, unused,
+                            &aPostFilterDirtyRegion);
   if (!instance.IsInitialized()) {
     return nsRect();
   }
@@ -89,7 +91,8 @@ nsFilterInstance::GetPostFilterBounds(nsIFrame *aFilteredFrame,
     preFilterRegionPtr = &preFilterRegion;
   }
 
-  nsFilterInstance instance(aFilteredFrame, nullptr, nullptr,
+  gfxMatrix unused; // aPaintTransform arg not used since we're not painting
+  nsFilterInstance instance(aFilteredFrame, nullptr, unused, nullptr,
                             preFilterRegionPtr, aPreFilterBounds,
                             aOverrideBBox);
   if (!instance.IsInitialized()) {
@@ -101,15 +104,16 @@ nsFilterInstance::GetPostFilterBounds(nsIFrame *aFilteredFrame,
 
 nsFilterInstance::nsFilterInstance(nsIFrame *aTargetFrame,
                                    nsSVGFilterPaintCallback *aPaintCallback,
+                                   const gfxMatrix& aPaintTransform,
                                    const nsRegion *aPostFilterDirtyRegion,
                                    const nsRegion *aPreFilterDirtyRegion,
                                    const nsRect *aPreFilterVisualOverflowRectOverride,
-                                   const gfxRect *aOverrideBBox,
-                                   nsIFrame* aTransformRoot) :
-  mTargetFrame(aTargetFrame),
-  mPaintCallback(aPaintCallback),
-  mTransformRoot(aTransformRoot),
-  mInitialized(false) {
+                                   const gfxRect *aOverrideBBox)
+  : mTargetFrame(aTargetFrame)
+  , mPaintCallback(aPaintCallback)
+  , mPaintTransform(aPaintTransform)
+  , mInitialized(false)
+{
 
   mTargetBBox = aOverrideBBox ?
     *aOverrideBBox : nsSVGUtils::GetBBox(mTargetFrame);
@@ -135,8 +139,7 @@ nsFilterInstance::nsFilterInstance(nsIFrame *aTargetFrame,
 
   // Only used (so only set) when we paint:
   if (mPaintCallback) {
-    mFilterSpaceToDeviceSpaceTransform = filterToUserSpace *
-              nsSVGUtils::GetCanvasTM(mTargetFrame, nsISVGChildFrame::FOR_PAINTING);
+    mFilterSpaceToDeviceSpaceTransform = filterToUserSpace * mPaintTransform;
   }
 
   mAppUnitsPerCSSPx = mTargetFrame->PresContext()->AppUnitsPerCSSPixel();
@@ -308,11 +311,8 @@ nsFilterInstance::BuildSourcePaint(SourceInfo *aSource,
 
   gfx->Save();
 
-  gfxMatrix matrix =
-    nsSVGUtils::GetCanvasTM(mTargetFrame, nsISVGChildFrame::FOR_PAINTING,
-                            mTransformRoot);
-  if (!matrix.IsSingular()) {
-    gfx->Multiply(matrix);
+  if (!mPaintTransform.IsSingular()) {
+    gfx->Multiply(mPaintTransform);
     gfx->Rectangle(FilterSpaceToUserSpace(neededRect));
     if ((aSource == &mFillPaint &&
          nsSVGUtils::SetupCairoFillPaint(mTargetFrame, gfx)) ||
@@ -390,7 +390,7 @@ nsFilterInstance::BuildSourceImage(DrawTarget* aTargetDT)
     return NS_ERROR_FAILURE;
   }
   tmpCtx->ThebesContext()->Multiply(deviceToFilterSpace);
-  mPaintCallback->Paint(tmpCtx, mTargetFrame, &dirty, mTransformRoot);
+  mPaintCallback->Paint(tmpCtx, mTargetFrame, mPaintTransform, &dirty);
 
   mSourceGraphic.mSourceSurface = offscreenDT->Snapshot();
   mSourceGraphic.mSurfaceRect = ToIntRect(neededRect);
diff --git a/layout/svg/nsFilterInstance.h b/layout/svg/nsFilterInstance.h
index 030afb55f19..6c781a5476c 100644
--- a/layout/svg/nsFilterInstance.h
+++ b/layout/svg/nsFilterInstance.h
@@ -55,11 +55,11 @@ public:
    *   frame space (i.e. relative to its origin, the top-left corner of its
    *   border box).
    */
-  static nsresult PaintFilteredFrame(nsRenderingContext *aContext,
-                                     nsIFrame *aFilteredFrame,
+  static nsresult PaintFilteredFrame(nsIFrame *aFilteredFrame,
+                                     nsRenderingContext *aContext,
+                                     const gfxMatrix& aTransform,
                                      nsSVGFilterPaintCallback *aPaintCallback,
-                                     const nsRegion* aDirtyArea,
-                                     nsIFrame* aTransformRoot = nullptr);
+                                     const nsRegion* aDirtyArea);
 
   /**
    * Returns the post-filter area that could be dirtied when the given
@@ -95,6 +95,8 @@ public:
    * @param aTargetFrame The frame of the filtered element under consideration.
    * @param aPaintCallback [optional] The callback that Render() should use to
    *   paint. Only required if you will call Render().
+   * @param aPaintTransform The transform to apply to convert to
+   *   aTargetFrame's SVG user space. Only used when painting.
    * @param aPostFilterDirtyRegion [optional] The post-filter area
    *   that has to be repainted, in app units. Only required if you will
    *   call ComputeSourceNeededRect() or Render().
@@ -105,15 +107,14 @@ public:
    *   visual overflow rect for the target element.
    * @param aOverrideBBox [optional] Use a different SVG bbox for the target
    *   element.
-   * @param aTransformRoot [optional] The transform root frame for painting.
    */
   nsFilterInstance(nsIFrame *aTargetFrame,
                    nsSVGFilterPaintCallback *aPaintCallback,
+                   const gfxMatrix& aPaintTransform,
                    const nsRegion *aPostFilterDirtyRegion = nullptr,
                    const nsRegion *aPreFilterDirtyRegion = nullptr,
                    const nsRect *aOverridePreFilterVisualOverflowRect = nullptr,
-                   const gfxRect *aOverrideBBox = nullptr,
-                   nsIFrame* aTransformRoot = nullptr);
+                   const gfxRect *aOverrideBBox = nullptr);
 
   /**
    * Returns true if the filter instance was created successfully.
@@ -313,7 +314,12 @@ private:
   SourceInfo mSourceGraphic;
   SourceInfo mFillPaint;
   SourceInfo mStrokePaint;
-  nsIFrame* mTransformRoot;
+
+  /**
+   * The transform to the SVG user space of mTargetFrame.
+   */
+  gfxMatrix               mPaintTransform;
+
   nsTArray<mozilla::RefPtr<SourceSurface>> mInputImages;
   nsTArray<FilterPrimitiveDescription> mPrimitiveDescriptions;
   int32_t mAppUnitsPerCSSPx;
diff --git a/layout/svg/nsISVGChildFrame.h b/layout/svg/nsISVGChildFrame.h
index 519ba4ad3fb..0392d8b6b0a 100644
--- a/layout/svg/nsISVGChildFrame.h
+++ b/layout/svg/nsISVGChildFrame.h
@@ -9,11 +9,12 @@
 #include "gfxRect.h"
 #include "nsQueryFrame.h"
 
+class gfxMatrix;
 class nsIFrame;
 class nsRenderingContext;
+class SVGBBox;
 
 struct nsPoint;
-class SVGBBox;
 struct nsRect;
 struct nsIntRect;
 
@@ -47,20 +48,36 @@ public:
 
   NS_DECL_QUERYFRAME_TARGET(nsISVGChildFrame)
 
-  // Paint this frame.
-  // aDirtyRect is the area being redrawn, in frame offset pixel coordinates.
-  // aTransformRoot (if non-null) is the frame at which we stop looking up
-  // transforms, when painting content that is part of an SVG glyph. (See
-  // bug 875329.)
-  // For normal SVG graphics using display-list rendering, any transforms on
-  // the element or its parents will have already been set up in the context
-  // before PaintSVG is called. When painting SVG glyphs, this is not the case,
-  // so the element's full transform needs to be applied; but we don't want to
-  // apply transforms from outside the actual glyph element, so we need to know
-  // how far up the ancestor chain to go.
+  /**
+   * Paint this frame.
+   *
+   * SVG is painted using a combination of display lists (trees of
+   * nsDisplayItem built by BuildDisplayList() implementations) and recursive
+   * PaintSVG calls.  SVG frames with the NS_FRAME_IS_NONDISPLAY bit set are
+   * always painted using recursive PaintSVG calls since display list painting
+   * would provide no advantages (they wouldn't be retained for invalidation).
+   * Displayed SVG is normally painted via a display list tree created under
+   * nsSVGOuterSVGFrame::BuildDisplayList, unless the
+   * svg.display-lists.painting.enabled pref has been set to false by the user
+   * in which case it is done via an nsSVGOuterSVGFrame::PaintSVG() call that
+   * recurses over the entire SVG frame tree.  In future we may use PaintSVG()
+   * calls on SVG container frames to avoid display list construction when it
+   * is expensive and unnecessary (see bug 934411).
+   *
+   * @param aTransform The transform that has to be multiplied onto the
+   *   DrawTarget in order for drawing to be in this frame's SVG user space.
+   *   Implementations of this method should avoid multiplying aTransform onto
+   *   the DrawTarget when possible and instead just pass a transform down to
+   *   their children.  This is preferable because changing the transform is
+   *   very expensive for certain DrawTarget backends so it is best to minimize
+   *   the number of transform changes.
+   *
+   * @param aDirtyRect The area being redrawn, in frame offset pixel
+   *   coordinates.
+   */
   virtual nsresult PaintSVG(nsRenderingContext* aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot = nullptr) = 0;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect* aDirtyRect = nullptr) = 0;
 
   /**
    * Returns the frame that should handle pointer events at aPoint.  aPoint is
diff --git a/layout/svg/nsSVGClipPathFrame.cpp b/layout/svg/nsSVGClipPathFrame.cpp
index 76df0c59af9..58857058260 100644
--- a/layout/svg/nsSVGClipPathFrame.cpp
+++ b/layout/svg/nsSVGClipPathFrame.cpp
@@ -56,9 +56,20 @@ nsSVGClipPathFrame::ApplyClipOrPaintClipMask(nsRenderingContext* aContext,
       // We have no children - the spec says clip away everything:
       gfx->Rectangle(gfxRect());
     } else {
-      singleClipPathChild->NotifySVGChanged(
-                             nsISVGChildFrame::TRANSFORM_CHANGED);
-      singleClipPathChild->PaintSVG(aContext, nullptr);
+      nsIFrame* child = do_QueryFrame(singleClipPathChild);
+      nsIContent* childContent = child->GetContent();
+      if (childContent->IsSVG()) {
+        singleClipPathChild->NotifySVGChanged(
+                               nsISVGChildFrame::TRANSFORM_CHANGED);
+        gfxMatrix toChildsUserSpace =
+          static_cast<const nsSVGElement*>(childContent)->
+            PrependLocalTransformsTo(mMatrixForChildren,
+                                     nsSVGElement::eUserSpaceToParent);
+        singleClipPathChild->PaintSVG(aContext, toChildsUserSpace);
+      } else {
+        // else, again, clip everything away
+        gfx->Rectangle(gfxRect());
+      }
     }
     gfx->Clip();
     gfx->NewPath();
@@ -110,7 +121,16 @@ nsSVGClipPathFrame::ApplyClipOrPaintClipMask(nsRenderingContext* aContext,
         }
       }
 
-      SVGFrame->PaintSVG(aContext, nullptr);
+      gfxMatrix toChildsUserSpace = mMatrixForChildren;
+      nsIFrame* child = do_QueryFrame(SVGFrame);
+      nsIContent* childContent = child->GetContent();
+      if (childContent->IsSVG()) {
+        toChildsUserSpace =
+          static_cast<const nsSVGElement*>(childContent)->
+            PrependLocalTransformsTo(mMatrixForChildren,
+                                     nsSVGElement::eUserSpaceToParent);
+      }
+      SVGFrame->PaintSVG(aContext, toChildsUserSpace);
 
       if (clipPathFrame) {
         if (!isTrivial) {
diff --git a/layout/svg/nsSVGContainerFrame.cpp b/layout/svg/nsSVGContainerFrame.cpp
index b9811d9320b..f9273bf1c79 100644
--- a/layout/svg/nsSVGContainerFrame.cpp
+++ b/layout/svg/nsSVGContainerFrame.cpp
@@ -249,8 +249,8 @@ nsSVGDisplayContainerFrame::IsSVGTransformed(gfx::Matrix *aOwnTransform,
 
 nsresult
 nsSVGDisplayContainerFrame::PaintSVG(nsRenderingContext* aContext,
-                                     const nsIntRect *aDirtyRect,
-                                     nsIFrame* aTransformRoot)
+                                     const gfxMatrix& aTransform,
+                                     const nsIntRect *aDirtyRect)
 {
   NS_ASSERTION(!NS_SVGDisplayListPaintingEnabled() ||
                (mState & NS_FRAME_IS_NONDISPLAY) ||
@@ -259,12 +259,38 @@ nsSVGDisplayContainerFrame::PaintSVG(nsRenderingContext* aContext,
                "SVG should take this code path");
 
   const nsStyleDisplay *display = StyleDisplay();
-  if (display->mOpacity == 0.0)
+  if (display->mOpacity == 0.0) {
     return NS_OK;
+  }
+
+  gfxMatrix matrix = aTransform;
+  if (GetContent()->IsSVG()) { // must check before cast
+    matrix = static_cast<const nsSVGElement*>(GetContent())->
+               PrependLocalTransformsTo(matrix,
+                                        nsSVGElement::eChildToUserSpace);
+    if (matrix.IsSingular()) {
+      return NS_OK;
+    }
+  }
 
   for (nsIFrame* kid = mFrames.FirstChild(); kid;
        kid = kid->GetNextSibling()) {
-    nsSVGUtils::PaintFrameWithEffects(aContext, aDirtyRect, kid, aTransformRoot);
+    gfxMatrix m = matrix;
+    // PaintFrameWithEffects() expects the transform that is passed to it to
+    // include the transform to the passed frame's user space, so add it:
+    const nsIContent* content = kid->GetContent();
+    if (content->IsSVG()) { // must check before cast
+      const nsSVGElement* element = static_cast<const nsSVGElement*>(content);
+      if (!element->HasValidDimensions()) {
+        continue; // nothing to paint for kid
+      }
+      m = element->
+            PrependLocalTransformsTo(m, nsSVGElement::eUserSpaceToParent);
+      if (m.IsSingular()) {
+        continue;
+      }
+    }
+    nsSVGUtils::PaintFrameWithEffects(kid, aContext, m, aDirtyRect);
   }
 
   return NS_OK;
diff --git a/layout/svg/nsSVGContainerFrame.h b/layout/svg/nsSVGContainerFrame.h
index 23cb50689b4..6a3c2306508 100644
--- a/layout/svg/nsSVGContainerFrame.h
+++ b/layout/svg/nsSVGContainerFrame.h
@@ -146,8 +146,8 @@ public:
 
   // nsISVGChildFrame interface:
   virtual nsresult PaintSVG(nsRenderingContext* aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot = nullptr) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect *aDirtyRect = nullptr) MOZ_OVERRIDE;
   virtual nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) MOZ_OVERRIDE;
   virtual nsRect GetCoveredRegion() MOZ_OVERRIDE;
   virtual void ReflowSVG() MOZ_OVERRIDE;
diff --git a/layout/svg/nsSVGFilterPaintCallback.h b/layout/svg/nsSVGFilterPaintCallback.h
index bacececcc54..b094ec7806b 100644
--- a/layout/svg/nsSVGFilterPaintCallback.h
+++ b/layout/svg/nsSVGFilterPaintCallback.h
@@ -26,8 +26,8 @@ public:
    *                       into account when painting an SVG glyph
    */
   virtual void Paint(nsRenderingContext *aContext, nsIFrame *aTarget,
-                     const nsIntRect *aDirtyRect,
-                     nsIFrame* aTransformRoot) = 0;
+                     const gfxMatrix& aTransform,
+                     const nsIntRect *aDirtyRect) = 0;
 };
 
 #endif
diff --git a/layout/svg/nsSVGForeignObjectFrame.cpp b/layout/svg/nsSVGForeignObjectFrame.cpp
index 2d55d5fe295..8574d0b4aa6 100644
--- a/layout/svg/nsSVGForeignObjectFrame.cpp
+++ b/layout/svg/nsSVGForeignObjectFrame.cpp
@@ -193,8 +193,8 @@ nsSVGForeignObjectFrame::IsSVGTransformed(Matrix *aOwnTransform,
 
 nsresult
 nsSVGForeignObjectFrame::PaintSVG(nsRenderingContext *aContext,
-                                  const nsIntRect *aDirtyRect,
-                                  nsIFrame* aTransformRoot)
+                                  const gfxMatrix& aTransform,
+                                  const nsIntRect* aDirtyRect)
 {
   NS_ASSERTION(!NS_SVGDisplayListPaintingEnabled() ||
                (mState & NS_FRAME_IS_NONDISPLAY),
@@ -208,9 +208,7 @@ nsSVGForeignObjectFrame::PaintSVG(nsRenderingContext *aContext,
   if (!kid)
     return NS_OK;
 
-  gfxMatrix canvasTM = GetCanvasTM(FOR_PAINTING, aTransformRoot);
-
-  if (canvasTM.IsSingular()) {
+  if (aTransform.IsSingular()) {
     NS_WARNING("Can't render foreignObject element!");
     return NS_ERROR_FAILURE;
   }
@@ -223,7 +221,7 @@ nsSVGForeignObjectFrame::PaintSVG(nsRenderingContext *aContext,
                  (mState & NS_FRAME_IS_NONDISPLAY),
                  "Display lists handle dirty rect intersection test");
     // Transform the dirty rect into app units in our userspace.
-    gfxMatrix invmatrix = canvasTM;
+    gfxMatrix invmatrix = aTransform;
     DebugOnly<bool> ok = invmatrix.Invert();
     NS_ASSERTION(ok, "inverse of non-singular matrix should be non-singular");
 
@@ -254,15 +252,15 @@ nsSVGForeignObjectFrame::PaintSVG(nsRenderingContext *aContext,
 
     gfxRect clipRect =
       nsSVGUtils::GetClipRectForFrame(this, 0.0f, 0.0f, width, height);
-    nsSVGUtils::SetClipRect(gfx, canvasTM, clipRect);
+    nsSVGUtils::SetClipRect(gfx, aTransform, clipRect);
   }
 
   // SVG paints in CSS px, but normally frames paint in dev pixels. Here we
-  // multiply a CSS-px-to-dev-pixel factor onto canvasTM so our children paint
-  // correctly.
+  // multiply a CSS-px-to-dev-pixel factor onto aTransform so our children
+  // paint correctly.
   float cssPxPerDevPx = PresContext()->
     AppUnitsToFloatCSSPixels(PresContext()->AppUnitsPerDevPixel());
-  gfxMatrix canvasTMForChildren = canvasTM;
+  gfxMatrix canvasTMForChildren = aTransform;
   canvasTMForChildren.Scale(cssPxPerDevPx, cssPxPerDevPx);
 
   gfx->Multiply(canvasTMForChildren);
diff --git a/layout/svg/nsSVGForeignObjectFrame.h b/layout/svg/nsSVGForeignObjectFrame.h
index dc0f6791066..91616f2c256 100644
--- a/layout/svg/nsSVGForeignObjectFrame.h
+++ b/layout/svg/nsSVGForeignObjectFrame.h
@@ -77,8 +77,8 @@ public:
 
   // nsISVGChildFrame interface:
   virtual nsresult PaintSVG(nsRenderingContext *aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot = nullptr) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect* aDirtyRect = nullptr) MOZ_OVERRIDE;
   virtual nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) MOZ_OVERRIDE;
   virtual nsRect GetCoveredRegion() MOZ_OVERRIDE;
   virtual void ReflowSVG() MOZ_OVERRIDE;
diff --git a/layout/svg/nsSVGImageFrame.cpp b/layout/svg/nsSVGImageFrame.cpp
index bfa08417770..4a4b5e0fd7d 100644
--- a/layout/svg/nsSVGImageFrame.cpp
+++ b/layout/svg/nsSVGImageFrame.cpp
@@ -63,8 +63,8 @@ public:
 
   // nsISVGChildFrame interface:
   virtual nsresult PaintSVG(nsRenderingContext *aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect* aDirtyRect = nullptr) MOZ_OVERRIDE;
   virtual nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) MOZ_OVERRIDE;
   virtual void ReflowSVG() MOZ_OVERRIDE;
 
@@ -100,13 +100,10 @@ public:
 
 private:
   gfx::Matrix GetRasterImageTransform(int32_t aNativeWidth,
-                                      int32_t aNativeHeight,
-                                      uint32_t aFor,
-                                      nsIFrame* aTransformRoot = nullptr);
-  gfx::Matrix GetVectorImageTransform(uint32_t aFor,
-                                      nsIFrame* aTransformRoot = nullptr);
+                                      int32_t aNativeHeight);
+  gfx::Matrix GetVectorImageTransform();
   bool TransformContextForPainting(gfxContext* aGfxContext,
-                                   nsIFrame* aTransformRoot);
+                                   const gfxMatrix& aTransform);
 
   nsCOMPtr<imgINotificationObserver> mListener;
 
@@ -230,9 +227,7 @@ nsSVGImageFrame::AttributeChanged(int32_t         aNameSpaceID,
 
 gfx::Matrix
 nsSVGImageFrame::GetRasterImageTransform(int32_t aNativeWidth,
-                                         int32_t aNativeHeight,
-                                         uint32_t aFor,
-                                         nsIFrame* aTransformRoot)
+                                         int32_t aNativeHeight)
 {
   float x, y, width, height;
   SVGImageElement *element = static_cast<SVGImageElement*>(mContent);
@@ -243,14 +238,11 @@ nsSVGImageFrame::GetRasterImageTransform(int32_t aNativeWidth,
                                          0, 0, aNativeWidth, aNativeHeight,
                                          element->mPreserveAspectRatio);
 
-  return viewBoxTM *
-         gfx::Matrix::Translation(x, y) *
-         gfx::ToMatrix(GetCanvasTM(aFor, aTransformRoot));
+  return viewBoxTM * gfx::Matrix::Translation(x, y);
 }
 
 gfx::Matrix
-nsSVGImageFrame::GetVectorImageTransform(uint32_t aFor,
-                                         nsIFrame* aTransformRoot)
+nsSVGImageFrame::GetVectorImageTransform()
 {
   float x, y, width, height;
   SVGImageElement *element = static_cast<SVGImageElement*>(mContent);
@@ -260,17 +252,16 @@ nsSVGImageFrame::GetVectorImageTransform(uint32_t aFor,
   // "native size" that the SVG image has, and it will handle viewBox and
   // preserveAspectRatio on its own once we give it a region to draw into.
 
-  return gfx::Matrix::Translation(x, y) *
-         gfx::ToMatrix(GetCanvasTM(aFor, aTransformRoot));
+  return gfx::Matrix::Translation(x, y);
 }
 
 bool
 nsSVGImageFrame::TransformContextForPainting(gfxContext* aGfxContext,
-                                             nsIFrame* aTransformRoot)
+                                             const gfxMatrix& aTransform)
 {
   gfx::Matrix imageTransform;
   if (mImageContainer->GetType() == imgIContainer::TYPE_VECTOR) {
-    imageTransform = GetVectorImageTransform(FOR_PAINTING, aTransformRoot);
+    imageTransform = GetVectorImageTransform() * ToMatrix(aTransform);
   } else {
     int32_t nativeWidth, nativeHeight;
     if (NS_FAILED(mImageContainer->GetWidth(&nativeWidth)) ||
@@ -279,8 +270,7 @@ nsSVGImageFrame::TransformContextForPainting(gfxContext* aGfxContext,
       return false;
     }
     imageTransform =
-      GetRasterImageTransform(nativeWidth, nativeHeight, FOR_PAINTING,
-                              aTransformRoot);
+      GetRasterImageTransform(nativeWidth, nativeHeight) * ToMatrix(aTransform);
 
     // NOTE: We need to cancel out the effects of Full-Page-Zoom, or else
     // it'll get applied an extra time by DrawSingleUnscaledImage.
@@ -302,8 +292,8 @@ nsSVGImageFrame::TransformContextForPainting(gfxContext* aGfxContext,
 // nsISVGChildFrame methods:
 nsresult
 nsSVGImageFrame::PaintSVG(nsRenderingContext *aContext,
-                          const nsIntRect *aDirtyRect,
-                          nsIFrame* aTransformRoot)
+                          const gfxMatrix& aTransform,
+                          const nsIntRect *aDirtyRect)
 {
   nsresult rv = NS_OK;
 
@@ -334,11 +324,10 @@ nsSVGImageFrame::PaintSVG(nsRenderingContext *aContext,
     if (StyleDisplay()->IsScrollableOverflow()) {
       gfxRect clipRect = nsSVGUtils::GetClipRectForFrame(this, x, y,
                                                          width, height);
-      nsSVGUtils::SetClipRect(ctx, GetCanvasTM(FOR_PAINTING, aTransformRoot),
-                              clipRect);
+      nsSVGUtils::SetClipRect(ctx, aTransform, clipRect);
     }
 
-    if (!TransformContextForPainting(ctx, aTransformRoot)) {
+    if (!TransformContextForPainting(ctx, aTransform)) {
       return NS_ERROR_FAILURE;
     }
 
@@ -363,8 +352,8 @@ nsSVGImageFrame::PaintSVG(nsRenderingContext *aContext,
       dirtyRect = aDirtyRect->ToAppUnits(appUnitsPerDevPx);
       // Adjust dirtyRect to match our local coordinate system.
       nsRect rootRect =
-        nsSVGUtils::TransformFrameRectToOuterSVG(mRect,
-                      GetCanvasTM(FOR_PAINTING), PresContext());
+        nsSVGUtils::TransformFrameRectToOuterSVG(mRect, aTransform,
+                                                 PresContext());
       dirtyRect.MoveBy(-rootRect.TopLeft());
     }
 
diff --git a/layout/svg/nsSVGInnerSVGFrame.cpp b/layout/svg/nsSVGInnerSVGFrame.cpp
index 51bcc83574f..dd690b16ab5 100644
--- a/layout/svg/nsSVGInnerSVGFrame.cpp
+++ b/layout/svg/nsSVGInnerSVGFrame.cpp
@@ -61,8 +61,8 @@ nsSVGInnerSVGFrame::GetType() const
 
 nsresult
 nsSVGInnerSVGFrame::PaintSVG(nsRenderingContext *aContext,
-                             const nsIntRect *aDirtyRect,
-                             nsIFrame* aTransformRoot)
+                             const gfxMatrix& aTransform,
+                             const nsIntRect *aDirtyRect)
 {
   NS_ASSERTION(!NS_SVGDisplayListPaintingEnabled() ||
                (mState & NS_FRAME_IS_NONDISPLAY),
@@ -80,17 +80,14 @@ nsSVGInnerSVGFrame::PaintSVG(nsRenderingContext *aContext,
       return NS_OK;
     }
 
-    nsSVGContainerFrame *parent = static_cast<nsSVGContainerFrame*>(GetParent());
-    gfxMatrix clipTransform = parent->GetCanvasTM(FOR_PAINTING, aTransformRoot);
-
     gfxContext *gfx = aContext->ThebesContext();
     autoSR.SetContext(gfx);
     gfxRect clipRect =
       nsSVGUtils::GetClipRectForFrame(this, x, y, width, height);
-    nsSVGUtils::SetClipRect(gfx, clipTransform, clipRect);
+    nsSVGUtils::SetClipRect(gfx, aTransform, clipRect);
   }
 
-  return nsSVGInnerSVGFrameBase::PaintSVG(aContext, aDirtyRect);
+  return nsSVGInnerSVGFrameBase::PaintSVG(aContext, aTransform, aDirtyRect);
 }
 
 nsRect
diff --git a/layout/svg/nsSVGInnerSVGFrame.h b/layout/svg/nsSVGInnerSVGFrame.h
index 0fa48a1891b..5d9743fb0e8 100644
--- a/layout/svg/nsSVGInnerSVGFrame.h
+++ b/layout/svg/nsSVGInnerSVGFrame.h
@@ -54,8 +54,8 @@ public:
 
   // nsISVGChildFrame interface:
   virtual nsresult PaintSVG(nsRenderingContext *aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot = nullptr) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect *aDirtyRect = nullptr) MOZ_OVERRIDE;
   virtual nsRect GetCoveredRegion() MOZ_OVERRIDE;
   virtual void ReflowSVG() MOZ_OVERRIDE;
   virtual void NotifySVGChanged(uint32_t aFlags) MOZ_OVERRIDE;
diff --git a/layout/svg/nsSVGIntegrationUtils.cpp b/layout/svg/nsSVGIntegrationUtils.cpp
index ae708b1c41b..83df818b2dc 100644
--- a/layout/svg/nsSVGIntegrationUtils.cpp
+++ b/layout/svg/nsSVGIntegrationUtils.cpp
@@ -381,8 +381,8 @@ public:
       mOffset(aOffset) {}
 
   virtual void Paint(nsRenderingContext *aContext, nsIFrame *aTarget,
-                     const nsIntRect* aDirtyRect,
-                     nsIFrame* aTransformRoot) MOZ_OVERRIDE
+                     const gfxMatrix& aTransform,
+                     const nsIntRect* aDirtyRect) MOZ_OVERRIDE
   {
     BasicLayerManager* basic = static_cast<BasicLayerManager*>(mLayerManager);
     basic->SetTarget(aContext->ThebesContext());
@@ -524,7 +524,8 @@ nsSVGIntegrationUtils::PaintFramesWithEffects(nsRenderingContext* aCtx,
                                        offsetToUserSpace);
 
     nsRegion dirtyRegion = aDirtyRect - offsetToBoundingBox;
-    nsFilterInstance::PaintFilteredFrame(aCtx, aFrame, &callback, &dirtyRegion);
+    gfxMatrix tm = nsSVGIntegrationUtils::GetCSSPxToDevPxMatrix(aFrame);
+    nsFilterInstance::PaintFilteredFrame(aFrame, aCtx, tm, &callback, &dirtyRegion);
   } else {
     gfx->SetMatrix(matrixAutoSaveRestore.Matrix());
     aLayerManager->EndTransaction(FrameLayerBuilder::DrawThebesLayer, aBuilder);
diff --git a/layout/svg/nsSVGMarkerFrame.cpp b/layout/svg/nsSVGMarkerFrame.cpp
index c880200bc64..43e5dd0aa6c 100644
--- a/layout/svg/nsSVGMarkerFrame.cpp
+++ b/layout/svg/nsSVGMarkerFrame.cpp
@@ -104,6 +104,7 @@ GetAnonymousChildFrame(nsIFrame* aFrame)
 
 nsresult
 nsSVGMarkerFrame::PaintMark(nsRenderingContext *aContext,
+                            const gfxMatrix& aToMarkedFrameUserSpace,
                             nsSVGPathGeometryFrame *aMarkedFrame,
                             nsSVGMark *aMark, float aStrokeWidth)
 {
@@ -133,6 +134,14 @@ nsSVGMarkerFrame::PaintMark(nsRenderingContext *aContext,
   mAutoAngle = aMark->angle;
   mIsStart = aMark->type == nsSVGMark::eStart;
 
+  Matrix viewBoxTM = marker->GetViewBoxTransform();
+
+  Matrix markerTM = marker->GetMarkerTransform(mStrokeWidth, mX, mY,
+                                               mAutoAngle, mIsStart);
+
+  gfxMatrix markTM = ThebesMatrix(viewBoxTM) * ThebesMatrix(markerTM) *
+                     aToMarkedFrameUserSpace;
+
   gfxContext *gfx = aContext->ThebesContext();
 
   if (StyleDisplay()->IsScrollableOverflow()) {
@@ -140,15 +149,15 @@ nsSVGMarkerFrame::PaintMark(nsRenderingContext *aContext,
     gfxRect clipRect =
       nsSVGUtils::GetClipRectForFrame(this, viewBox.x, viewBox.y,
                                       viewBox.width, viewBox.height);
-    nsSVGUtils::SetClipRect(gfx, GetCanvasTM(nsISVGChildFrame::FOR_PAINTING),
-                            clipRect);
+    nsSVGUtils::SetClipRect(gfx, markTM, clipRect);
   }
 
+
   nsIFrame* kid = GetAnonymousChildFrame(this);
   nsISVGChildFrame* SVGFrame = do_QueryFrame(kid);
   // The CTM of each frame referencing us may be different.
   SVGFrame->NotifySVGChanged(nsISVGChildFrame::TRANSFORM_CHANGED);
-  nsSVGUtils::PaintFrameWithEffects(aContext, nullptr, kid);
+  nsSVGUtils::PaintFrameWithEffects(kid, aContext, markTM);
 
   if (StyleDisplay()->IsScrollableOverflow())
     gfx->Restore();
diff --git a/layout/svg/nsSVGMarkerFrame.h b/layout/svg/nsSVGMarkerFrame.h
index d20b542c291..80bcd1bc0e5 100644
--- a/layout/svg/nsSVGMarkerFrame.h
+++ b/layout/svg/nsSVGMarkerFrame.h
@@ -85,6 +85,7 @@ public:
 
   // nsSVGMarkerFrame methods:
   nsresult PaintMark(nsRenderingContext *aContext,
+                     const gfxMatrix& aToMarkedFrameUserSpace,
                      nsSVGPathGeometryFrame *aMarkedFrame,
                      nsSVGMark *aMark,
                      float aStrokeWidth);
diff --git a/layout/svg/nsSVGMaskFrame.cpp b/layout/svg/nsSVGMaskFrame.cpp
index 332c4c08727..4e24ba55d48 100644
--- a/layout/svg/nsSVGMaskFrame.cpp
+++ b/layout/svg/nsSVGMaskFrame.cpp
@@ -238,7 +238,12 @@ nsSVGMaskFrame::GetMaskForMaskedFrame(gfxContext* aContext,
     if (SVGFrame) {
       SVGFrame->NotifySVGChanged(nsISVGChildFrame::TRANSFORM_CHANGED);
     }
-    nsSVGUtils::PaintFrameWithEffects(tmpCtx, nullptr, kid);
+    gfxMatrix m = mMatrixForChildren;
+    if (kid->GetContent()->IsSVG()) {
+      m = static_cast<nsSVGElement*>(kid->GetContent())->
+            PrependLocalTransformsTo(m);
+    }
+    nsSVGUtils::PaintFrameWithEffects(kid, tmpCtx, mMatrixForChildren);
   }
 
   RefPtr<SourceSurface> maskSnapshot = maskDT->Snapshot();
diff --git a/layout/svg/nsSVGOuterSVGFrame.cpp b/layout/svg/nsSVGOuterSVGFrame.cpp
index 158a25cab33..1815143b124 100644
--- a/layout/svg/nsSVGOuterSVGFrame.cpp
+++ b/layout/svg/nsSVGOuterSVGFrame.cpp
@@ -73,6 +73,21 @@ nsSVGOuterSVGFrame::nsSVGOuterSVGFrame(nsStyleContext* aContext)
   RemoveStateBits(NS_FRAME_SVG_LAYOUT);
 }
 
+// helper
+static inline bool
+DependsOnIntrinsicSize(const nsIFrame* aEmbeddingFrame)
+{
+  const nsStylePosition *pos = aEmbeddingFrame->StylePosition();
+  const nsStyleCoord &width = pos->mWidth;
+  const nsStyleCoord &height = pos->mHeight;
+
+  // XXX it would be nice to know if the size of aEmbeddingFrame's containing
+  // block depends on aEmbeddingFrame, then we'd know if we can return false
+  // for eStyleUnit_Percent too.
+  return !width.ConvertsToLength() ||
+         !height.ConvertsToLength();
+}
+
 void
 nsSVGOuterSVGFrame::Init(nsIContent*       aContent,
                          nsContainerFrame* aParent,
@@ -105,6 +120,19 @@ nsSVGOuterSVGFrame::Init(nsIContent*       aContent,
     // we only care about our content's zoom and pan values if it's the root element
     if (doc->GetRootElement() == mContent) {
       mIsRootContent = true;
+
+      nsIFrame* embeddingFrame;
+      if (IsRootOfReplacedElementSubDoc(&embeddingFrame) && embeddingFrame) {
+        if (MOZ_UNLIKELY(!embeddingFrame->HasAllStateBits(NS_FRAME_IS_DIRTY)) &&
+            DependsOnIntrinsicSize(embeddingFrame)) {
+          // Looks like this document is loading after the embedding element
+          // has had its first reflow, and that its size depends on our
+          // intrinsic size.  We need it to resize itself to use our (now
+          // available) intrinsic size:
+          embeddingFrame->PresContext()->PresShell()->
+            FrameNeedsReflow(embeddingFrame, nsIPresShell::eStyleChange, NS_FRAME_IS_DIRTY);
+        }
+      }
     }
   }
 }
@@ -573,13 +601,21 @@ nsDisplayOuterSVG::Paint(nsDisplayListBuilder* aBuilder,
 
   nsRect clipRect = mVisibleRect.Intersect(viewportRect);
 
+  uint32_t appUnitsPerDevPixel = mFrame->PresContext()->AppUnitsPerDevPixel();
+
   nsIntRect contentAreaDirtyRect =
     (clipRect - viewportRect.TopLeft()).
-      ToOutsidePixels(mFrame->PresContext()->AppUnitsPerDevPixel());
+      ToOutsidePixels(appUnitsPerDevPixel);
+
+  gfxPoint devPixelOffset =
+    nsLayoutUtils::PointToGfxPoint(viewportRect.TopLeft(), appUnitsPerDevPixel);
 
   aContext->PushState();
-  aContext->Translate(viewportRect.TopLeft());
-  nsSVGUtils::PaintFrameWithEffects(aContext, &contentAreaDirtyRect, mFrame);
+  // We include the offset of our frame and a scale from device pixels to user
+  // units (i.e. CSS px) in the matrix that we pass to our children):
+  gfxMatrix tm = nsSVGIntegrationUtils::GetCSSPxToDevPxMatrix(mFrame) *
+                   gfxMatrix::Translation(devPixelOffset);
+  nsSVGUtils::PaintFrameWithEffects(mFrame, aContext, tm, &contentAreaDirtyRect);
   aContext->PopState();
 
   NS_ASSERTION(!aContext->ThebesContext()->HasError(), "Cairo in error state");
@@ -623,21 +659,6 @@ nsDisplayOuterSVG::ComputeInvalidationRegion(nsDisplayListBuilder* aBuilder,
   aInvalidRegion->Or(*aInvalidRegion, result);
 }
 
-// helper
-static inline bool
-DependsOnIntrinsicSize(const nsIFrame* aEmbeddingFrame)
-{
-  const nsStylePosition *pos = aEmbeddingFrame->StylePosition();
-  const nsStyleCoord &width = pos->mWidth;
-  const nsStyleCoord &height = pos->mHeight;
-
-  // XXX it would be nice to know if the size of aEmbeddingFrame's containing
-  // block depends on aEmbeddingFrame, then we'd know if we can return false
-  // for eStyleUnit_Percent too.
-  return !width.ConvertsToLength() ||
-         !height.ConvertsToLength();
-}
-
 nsresult
 nsSVGOuterSVGFrame::AttributeChanged(int32_t  aNameSpaceID,
                                      nsIAtom* aAttribute,
@@ -802,8 +823,8 @@ nsSVGOuterSVGFrame::NotifyViewportOrTransformChanged(uint32_t aFlags)
 
 nsresult
 nsSVGOuterSVGFrame::PaintSVG(nsRenderingContext* aContext,
-                             const nsIntRect *aDirtyRect,
-                             nsIFrame* aTransformRoot)
+                             const gfxMatrix& aTransform,
+                             const nsIntRect* aDirtyRect)
 {
   NS_ASSERTION(GetFirstPrincipalChild()->GetType() ==
                  nsGkAtoms::svgOuterSVGAnonChildFrame &&
@@ -811,7 +832,7 @@ nsSVGOuterSVGFrame::PaintSVG(nsRenderingContext* aContext,
                "We should have a single, anonymous, child");
   nsSVGOuterSVGAnonChildFrame *anonKid =
     static_cast<nsSVGOuterSVGAnonChildFrame*>(GetFirstPrincipalChild());
-  return anonKid->PaintSVG(aContext, aDirtyRect, aTransformRoot);
+  return anonKid->PaintSVG(aContext, aTransform, aDirtyRect);
 }
 
 SVGBBox
diff --git a/layout/svg/nsSVGOuterSVGFrame.h b/layout/svg/nsSVGOuterSVGFrame.h
index 68168cb887a..6f2b16caa0c 100644
--- a/layout/svg/nsSVGOuterSVGFrame.h
+++ b/layout/svg/nsSVGOuterSVGFrame.h
@@ -115,8 +115,8 @@ public:
 
   // nsISVGChildFrame methods:
   virtual nsresult PaintSVG(nsRenderingContext* aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot = nullptr) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect* aDirtyRect = nullptr) MOZ_OVERRIDE;
   virtual SVGBBox GetBBoxContribution(const Matrix &aToBBoxUserspace,
                                       uint32_t aFlags) MOZ_OVERRIDE;
 
diff --git a/layout/svg/nsSVGPathGeometryFrame.cpp b/layout/svg/nsSVGPathGeometryFrame.cpp
index daed1d4c7ec..5025f7a0128 100644
--- a/layout/svg/nsSVGPathGeometryFrame.cpp
+++ b/layout/svg/nsSVGPathGeometryFrame.cpp
@@ -97,14 +97,20 @@ void
 nsDisplaySVGPathGeometry::Paint(nsDisplayListBuilder* aBuilder,
                                 nsRenderingContext* aCtx)
 {
+  uint32_t appUnitsPerDevPixel = mFrame->PresContext()->AppUnitsPerDevPixel();
+
   // ToReferenceFrame includes our mRect offset, but painting takes
   // account of that too. To avoid double counting, we subtract that
   // here.
   nsPoint offset = ToReferenceFrame() - mFrame->GetPosition();
 
+  gfxPoint devPixelOffset =
+    nsLayoutUtils::PointToGfxPoint(offset, appUnitsPerDevPixel);
+
   aCtx->PushState();
-  aCtx->Translate(offset);
-  static_cast<nsSVGPathGeometryFrame*>(mFrame)->PaintSVG(aCtx, nullptr);
+  gfxMatrix tm = nsSVGIntegrationUtils::GetCSSPxToDevPxMatrix(mFrame) *
+                   gfxMatrix::Translation(devPixelOffset);
+  static_cast<nsSVGPathGeometryFrame*>(mFrame)->PaintSVG(aCtx, tm);
   aCtx->PopState();
 }
 
@@ -207,29 +213,29 @@ nsSVGPathGeometryFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
 
 nsresult
 nsSVGPathGeometryFrame::PaintSVG(nsRenderingContext *aContext,
-                                 const nsIntRect *aDirtyRect,
-                                 nsIFrame* aTransformRoot)
+                                 const gfxMatrix& aTransform,
+                                 const nsIntRect* aDirtyRect)
 {
   if (!StyleVisibility()->IsVisible())
     return NS_OK;
 
   uint32_t paintOrder = StyleSVG()->mPaintOrder;
   if (paintOrder == NS_STYLE_PAINT_ORDER_NORMAL) {
-    Render(aContext, eRenderFill | eRenderStroke, aTransformRoot);
-    PaintMarkers(aContext);
+    Render(aContext, eRenderFill | eRenderStroke, aTransform);
+    PaintMarkers(aContext, aTransform);
   } else {
     while (paintOrder) {
       uint32_t component =
         paintOrder & ((1 << NS_STYLE_PAINT_ORDER_BITWIDTH) - 1);
       switch (component) {
         case NS_STYLE_PAINT_ORDER_FILL:
-          Render(aContext, eRenderFill, aTransformRoot);
+          Render(aContext, eRenderFill, aTransform);
           break;
         case NS_STYLE_PAINT_ORDER_STROKE:
-          Render(aContext, eRenderStroke, aTransformRoot);
+          Render(aContext, eRenderStroke, aTransform);
           break;
         case NS_STYLE_PAINT_ORDER_MARKERS:
-          PaintMarkers(aContext);
+          PaintMarkers(aContext, aTransform);
           break;
       }
       paintOrder >>= NS_STYLE_PAINT_ORDER_BITWIDTH;
@@ -613,7 +619,7 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerEndFrame()
 void
 nsSVGPathGeometryFrame::Render(nsRenderingContext *aContext,
                                uint32_t aRenderComponents,
-                               nsIFrame* aTransformRoot)
+                               const gfxMatrix& aTransform)
 {
   gfxContext *gfx = aContext->ThebesContext();
 
@@ -653,7 +659,7 @@ nsSVGPathGeometryFrame::Render(nsRenderingContext *aContext,
       autoSaveRestore.SetContext(gfx);
     //}
 
-    GeneratePath(gfx, ToMatrix(GetCanvasTM(FOR_PAINTING, aTransformRoot)));
+    GeneratePath(gfx, ToMatrix(aTransform));
 
     // We used to call gfx->Restore() here, since for the
     // SVGAutoRenderState::CLIP case it is important to leave the fill rule
@@ -682,10 +688,10 @@ nsSVGPathGeometryFrame::Render(nsRenderingContext *aContext,
 
   gfxContextAutoSaveRestore autoSaveRestore(gfx);
 
-  GeneratePath(gfx, ToMatrix(GetCanvasTM(FOR_PAINTING, aTransformRoot)));
+  GeneratePath(gfx, ToMatrix(aTransform));
 
   gfxTextContextPaint *contextPaint =
-    (gfxTextContextPaint*)aContext->GetUserData(&gfxTextContextPaint::sUserDataKey);
+    (gfxTextContextPaint*)aContext->GetDrawTarget()->GetUserData(&gfxTextContextPaint::sUserDataKey);
 
   if ((aRenderComponents & eRenderFill) &&
       nsSVGUtils::SetupCairoFillPaint(this, gfx, contextPaint)) {
@@ -723,10 +729,11 @@ nsSVGPathGeometryFrame::GeneratePath(gfxContext* aContext,
 }
 
 void
-nsSVGPathGeometryFrame::PaintMarkers(nsRenderingContext* aContext)
+nsSVGPathGeometryFrame::PaintMarkers(nsRenderingContext* aContext,
+                                     const gfxMatrix& aTransform)
 {
   gfxTextContextPaint *contextPaint =
-    (gfxTextContextPaint*)aContext->GetUserData(&gfxTextContextPaint::sUserDataKey);
+    (gfxTextContextPaint*)aContext->GetDrawTarget()->GetUserData(&gfxTextContextPaint::sUserDataKey);
 
   if (static_cast<nsSVGPathGeometryElement*>(mContent)->IsMarkable()) {
     MarkerProperties properties = GetMarkerProperties(this);
@@ -752,7 +759,7 @@ nsSVGPathGeometryFrame::PaintMarkers(nsRenderingContext* aContext)
           nsSVGMark& mark = marks[i];
           nsSVGMarkerFrame* frame = markerFrames[mark.type];
           if (frame) {
-            frame->PaintMark(aContext, this, &mark, strokeWidth);
+            frame->PaintMark(aContext, aTransform, this, &mark, strokeWidth);
           }
         }
       }
diff --git a/layout/svg/nsSVGPathGeometryFrame.h b/layout/svg/nsSVGPathGeometryFrame.h
index 5f37dda06e4..1aef28daada 100644
--- a/layout/svg/nsSVGPathGeometryFrame.h
+++ b/layout/svg/nsSVGPathGeometryFrame.h
@@ -94,8 +94,8 @@ public:
 protected:
   // nsISVGChildFrame interface:
   virtual nsresult PaintSVG(nsRenderingContext *aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot = nullptr) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect* aDirtyRect = nullptr) MOZ_OVERRIDE;
   virtual nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) MOZ_OVERRIDE;
   virtual nsRect GetCoveredRegion() MOZ_OVERRIDE;
   virtual void ReflowSVG() MOZ_OVERRIDE;
@@ -115,8 +115,13 @@ protected:
 private:
   enum { eRenderFill = 1, eRenderStroke = 2 };
   void Render(nsRenderingContext *aContext, uint32_t aRenderComponents,
-              nsIFrame* aTransformRoot);
-  void PaintMarkers(nsRenderingContext *aContext);
+              const gfxMatrix& aTransform);
+
+  /**
+   * @param aMatrix The transform that must be multiplied onto aContext to
+   *   establish this frame's SVG user space.
+   */
+  void PaintMarkers(nsRenderingContext *aContext, const gfxMatrix& aMatrix);
 
   struct MarkerProperties {
     nsSVGMarkerProperty* mMarkerStart;
diff --git a/layout/svg/nsSVGPatternFrame.cpp b/layout/svg/nsSVGPatternFrame.cpp
index 820128e15c8..0b58697b01e 100644
--- a/layout/svg/nsSVGPatternFrame.cpp
+++ b/layout/svg/nsSVGPatternFrame.cpp
@@ -413,7 +413,12 @@ nsSVGPatternFrame::PaintPattern(Matrix* patternMatrix,
       if (SVGFrame) {
         SVGFrame->NotifySVGChanged(nsISVGChildFrame::TRANSFORM_CHANGED);
       }
-      nsSVGUtils::PaintFrameWithEffects(context, nullptr, kid);
+      gfxMatrix tm = *(patternFrame->mCTM);
+      if (kid->GetContent()->IsSVG()) {
+        tm = static_cast<nsSVGElement*>(kid->GetContent())->
+              PrependLocalTransformsTo(tm, nsSVGElement::eUserSpaceToParent);
+      }
+      nsSVGUtils::PaintFrameWithEffects(kid, context, tm);
     }
     patternFrame->RemoveStateBits(NS_FRAME_DRAWING_AS_PAINTSERVER);
   }
diff --git a/layout/svg/nsSVGSwitchFrame.cpp b/layout/svg/nsSVGSwitchFrame.cpp
index 1b51cbb3e1f..ac7a4343378 100644
--- a/layout/svg/nsSVGSwitchFrame.cpp
+++ b/layout/svg/nsSVGSwitchFrame.cpp
@@ -53,8 +53,8 @@ public:
 
   // nsISVGChildFrame interface:
   virtual nsresult PaintSVG(nsRenderingContext* aContext,
-                            const nsIntRect *aDirtyRect,
-                            nsIFrame* aTransformRoot) MOZ_OVERRIDE;
+                            const gfxMatrix& aTransform,
+                            const nsIntRect* aDirtyRect = nullptr) MOZ_OVERRIDE;
   nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) MOZ_OVERRIDE;
   nsRect GetCoveredRegion() MOZ_OVERRIDE;
   virtual void ReflowSVG() MOZ_OVERRIDE;
@@ -108,8 +108,8 @@ nsSVGSwitchFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
 
 nsresult
 nsSVGSwitchFrame::PaintSVG(nsRenderingContext* aContext,
-                           const nsIntRect *aDirtyRect,
-                           nsIFrame* aTransformRoot)
+                           const gfxMatrix& aTransform,
+                           const nsIntRect* aDirtyRect)
 {
   NS_ASSERTION(!NS_SVGDisplayListPaintingEnabled() ||
                (mState & NS_FRAME_IS_NONDISPLAY),
@@ -121,7 +121,12 @@ nsSVGSwitchFrame::PaintSVG(nsRenderingContext* aContext,
 
   nsIFrame *kid = GetActiveChildFrame();
   if (kid) {
-    nsSVGUtils::PaintFrameWithEffects(aContext, aDirtyRect, kid, aTransformRoot);
+    gfxMatrix tm = aTransform;
+    if (kid->GetContent()->IsSVG()) {
+      tm = static_cast<nsSVGElement*>(kid->GetContent())->
+             PrependLocalTransformsTo(tm, nsSVGElement::eUserSpaceToParent);
+    }
+    nsSVGUtils::PaintFrameWithEffects(kid, aContext, tm, aDirtyRect);
   }
   return NS_OK;
 }
diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp
index 4c5f17c9216..b4113914be4 100644
--- a/layout/svg/nsSVGUtils.cpp
+++ b/layout/svg/nsSVGUtils.cpp
@@ -91,17 +91,19 @@ SVGAutoRenderState::SVGAutoRenderState(nsRenderingContext *aContext,
   , mPaintingToWindow(false)
 {
   MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-  mOriginalRenderState = aContext->RemoveUserData(&sSVGAutoRenderStateKey);
+  mOriginalRenderState =
+    aContext->GetDrawTarget()->RemoveUserData(&sSVGAutoRenderStateKey);
   // We always remove ourselves from aContext before it dies, so
   // passing nullptr as the destroy function is okay.
-  aContext->AddUserData(&sSVGAutoRenderStateKey, this, nullptr);
+  aContext->GetDrawTarget()->AddUserData(&sSVGAutoRenderStateKey, this, nullptr);
 }
 
 SVGAutoRenderState::~SVGAutoRenderState()
 {
-  mContext->RemoveUserData(&sSVGAutoRenderStateKey);
+  mContext->GetDrawTarget()->RemoveUserData(&sSVGAutoRenderStateKey);
   if (mOriginalRenderState) {
-    mContext->AddUserData(&sSVGAutoRenderStateKey, mOriginalRenderState, nullptr);
+    mContext->GetDrawTarget()->AddUserData(&sSVGAutoRenderStateKey,
+                                           mOriginalRenderState, nullptr);
   }
 }
 
@@ -114,7 +116,7 @@ SVGAutoRenderState::SetPaintingToWindow(bool aPaintingToWindow)
 /* static */ SVGAutoRenderState::RenderMode
 SVGAutoRenderState::GetRenderMode(nsRenderingContext *aContext)
 {
-  void *state = aContext->GetUserData(&sSVGAutoRenderStateKey);
+  void *state = aContext->GetDrawTarget()->GetUserData(&sSVGAutoRenderStateKey);
   if (state) {
     return static_cast<SVGAutoRenderState*>(state)->mMode;
   }
@@ -124,7 +126,7 @@ SVGAutoRenderState::GetRenderMode(nsRenderingContext *aContext)
 /* static */ bool
 SVGAutoRenderState::IsPaintingToWindow(nsRenderingContext *aContext)
 {
-  void *state = aContext->GetUserData(&sSVGAutoRenderStateKey);
+  void *state = aContext->GetDrawTarget()->GetUserData(&sSVGAutoRenderStateKey);
   if (state) {
     return static_cast<SVGAutoRenderState*>(state)->mPaintingToWindow;
   }
@@ -448,8 +450,8 @@ class SVGPaintCallback : public nsSVGFilterPaintCallback
 {
 public:
   virtual void Paint(nsRenderingContext *aContext, nsIFrame *aTarget,
-                     const nsIntRect* aDirtyRect,
-                     nsIFrame* aTransformRoot) MOZ_OVERRIDE
+                     const gfxMatrix& aTransform,
+                     const nsIntRect* aDirtyRect) MOZ_OVERRIDE
   {
     nsISVGChildFrame *svgChildFrame = do_QueryFrame(aTarget);
     NS_ASSERTION(svgChildFrame, "Expected SVG frame here");
@@ -460,8 +462,7 @@ public:
     // aDirtyRect is in user-space pixels, we need to convert to
     // outer-SVG-frame-relative device pixels.
     if (aDirtyRect) {
-      gfxMatrix userToDeviceSpace =
-        nsSVGUtils::GetCanvasTM(aTarget, nsISVGChildFrame::FOR_PAINTING, aTransformRoot);
+      gfxMatrix userToDeviceSpace = aTransform;
       if (userToDeviceSpace.IsSingular()) {
         return;
       }
@@ -473,15 +474,15 @@ public:
       }
     }
 
-    svgChildFrame->PaintSVG(aContext, dirtyRect, aTransformRoot);
+    svgChildFrame->PaintSVG(aContext, aTransform, dirtyRect);
   }
 };
 
 void
-nsSVGUtils::PaintFrameWithEffects(nsRenderingContext *aContext,
-                                  const nsIntRect *aDirtyRect,
-                                  nsIFrame *aFrame,
-                                  nsIFrame *aTransformRoot)
+nsSVGUtils::PaintFrameWithEffects(nsIFrame *aFrame,
+                                  nsRenderingContext *aContext,
+                                  const gfxMatrix& aTransform,
+                                  const nsIntRect *aDirtyRect)
 {
   NS_ASSERTION(!NS_SVGDisplayListPaintingEnabled() ||
                (aFrame->GetStateBits() & NS_FRAME_IS_NONDISPLAY) ||
@@ -525,7 +526,7 @@ nsSVGUtils::PaintFrameWithEffects(nsRenderingContext *aContext,
       overflowRect = overflowRect + aFrame->GetPosition();
     }
     int32_t appUnitsPerDevPx = aFrame->PresContext()->AppUnitsPerDevPixel();
-    gfxMatrix tm = GetCanvasTM(aFrame, nsISVGChildFrame::FOR_PAINTING, aTransformRoot);
+    gfxMatrix tm = aTransform;
     if (aFrame->IsFrameOfType(nsIFrame::eSVG | nsIFrame::eSVGContainer)) {
       gfx::Matrix childrenOnlyTM;
       if (static_cast<nsSVGContainerFrame*>(aFrame)->
@@ -576,10 +577,6 @@ nsSVGUtils::PaintFrameWithEffects(nsRenderingContext *aContext,
     // Some resource is invalid. We shouldn't paint anything.
     return;
   }
-  
-  gfxMatrix matrix;
-  if (clipPathFrame || maskFrame)
-    matrix = GetCanvasTM(aFrame, nsISVGChildFrame::FOR_PAINTING, aTransformRoot);
 
   /* Check if we need to do additional operations on this child's
    * rendering, which necessitates rendering into another surface. */
@@ -591,7 +588,7 @@ nsSVGUtils::PaintFrameWithEffects(nsRenderingContext *aContext,
       // aFrame has a valid visual overflow rect, so clip to it before calling
       // PushGroup() to minimize the size of the surfaces we'll composite:
       gfxContextMatrixAutoSaveRestore matrixAutoSaveRestore(gfx);
-      gfx->Multiply(GetCanvasTM(aFrame, nsISVGChildFrame::FOR_PAINTING, aTransformRoot));
+      gfx->Multiply(aTransform);
       nsRect overflowRect = aFrame->GetVisualOverflowRectRelativeToSelf();
       if (aFrame->IsFrameOfType(nsIFrame::eSVGGeometry) ||
           aFrame->IsSVGText()) {
@@ -609,7 +606,7 @@ nsSVGUtils::PaintFrameWithEffects(nsRenderingContext *aContext,
    */
   if (clipPathFrame && isTrivialClip) {
     gfx->Save();
-    clipPathFrame->ApplyClipOrPaintClipMask(aContext, aFrame, matrix);
+    clipPathFrame->ApplyClipOrPaintClipMask(aContext, aFrame, aTransform);
   }
 
   /* Paint the child */
@@ -636,10 +633,10 @@ nsSVGUtils::PaintFrameWithEffects(nsRenderingContext *aContext,
       dirtyRegion = &tmpDirtyRegion;
     }
     SVGPaintCallback paintCallback;
-    nsFilterInstance::PaintFilteredFrame(aContext, aFrame, &paintCallback,
-                                         dirtyRegion, aTransformRoot);
+    nsFilterInstance::PaintFilteredFrame(aFrame, aContext, aTransform,
+                                         &paintCallback, dirtyRegion);
   } else {
-    svgChildFrame->PaintSVG(aContext, aDirtyRect, aTransformRoot);
+    svgChildFrame->PaintSVG(aContext, aTransform, aDirtyRect);
   }
 
   if (clipPathFrame && isTrivialClip) {
@@ -654,14 +651,14 @@ nsSVGUtils::PaintFrameWithEffects(nsRenderingContext *aContext,
 
   nsRefPtr<gfxPattern> maskSurface =
     maskFrame ? maskFrame->GetMaskForMaskedFrame(aContext->ThebesContext(),
-                                                 aFrame, matrix, opacity)
+                                                 aFrame, aTransform, opacity)
               : nullptr;
 
   nsRefPtr<gfxPattern> clipMaskSurface;
   if (clipPathFrame && !isTrivialClip) {
     gfx->PushGroup(gfxContentType::COLOR_ALPHA);
 
-    nsresult rv = clipPathFrame->ApplyClipOrPaintClipMask(aContext, aFrame, matrix);
+    nsresult rv = clipPathFrame->ApplyClipOrPaintClipMask(aContext, aFrame, aTransform);
     clipMaskSurface = gfx->PopGroup();
 
     if (NS_SUCCEEDED(rv) && clipMaskSurface) {
@@ -1601,12 +1598,19 @@ nsSVGUtils::PaintSVGGlyph(Element* aElement, gfxContext* aContext,
   if (!svgFrame) {
     return false;
   }
+  aContext->GetDrawTarget()->AddUserData(&gfxTextContextPaint::sUserDataKey,
+                                         aContextPaint, nullptr);
   nsRefPtr<nsRenderingContext> context(new nsRenderingContext());
   context->Init(frame->PresContext()->DeviceContext(), aContext);
-  context->AddUserData(&gfxTextContextPaint::sUserDataKey, aContextPaint,
-                       nullptr);
   svgFrame->NotifySVGChanged(nsISVGChildFrame::TRANSFORM_CHANGED);
-  nsresult rv = svgFrame->PaintSVG(context, nullptr, frame);
+  gfxMatrix m;
+  if (frame->GetContent()->IsSVG()) {
+    // PaintSVG() expects the passed transform to be the transform to its own
+    // SVG user space, so we need to account for any 'transform' attribute:
+    m = static_cast<nsSVGElement*>(frame->GetContent())->
+          PrependLocalTransformsTo(gfxMatrix(), nsSVGElement::eUserSpaceToParent);
+  }
+  nsresult rv = svgFrame->PaintSVG(context, m);
   return NS_SUCCEEDED(rv);
 }
 
diff --git a/layout/svg/nsSVGUtils.h b/layout/svg/nsSVGUtils.h
index db81e4d5883..9d813e9ab7b 100644
--- a/layout/svg/nsSVGUtils.h
+++ b/layout/svg/nsSVGUtils.h
@@ -296,10 +296,10 @@ public:
   /* Paint SVG frame with SVG effects - aDirtyRect is the area being
    * redrawn, in device pixel coordinates relative to the outer svg */
   static void
-  PaintFrameWithEffects(nsRenderingContext *aContext,
-                        const nsIntRect *aDirtyRect,
-                        nsIFrame *aFrame,
-                        nsIFrame* aTransformRoot = nullptr);
+  PaintFrameWithEffects(nsIFrame *aFrame,
+                        nsRenderingContext *aContext,
+                        const gfxMatrix& aTransform,
+                        const nsIntRect *aDirtyRect = nullptr);
 
   /* Hit testing - check if point hits the clipPath of indicated
    * frame.  Returns true if no clipPath set. */
diff --git a/media/libpng/CHANGES b/media/libpng/CHANGES
index b3e09f8574b..880eca9789b 100644
--- a/media/libpng/CHANGES
+++ b/media/libpng/CHANGES
@@ -1,4 +1,4 @@
-#if 0
+
 CHANGES - changes for libpng
 
 Version 0.2
@@ -4345,8 +4345,9 @@ Version 1.6.0beta37 [January 10, 2013]
     programs to generate and test a PNG which should have the problem.
 
 Version 1.6.0beta39 [January 19, 2013]
-  Again corrected attempt at overflow detection in png_set_unknown_chunks().
-  Added overflow detection in png_set_sPLT() and png_set_text_2().
+  Again corrected attempt at overflow detection in png_set_unknown_chunks()
+  (CVE-2013-7353).  Added overflow detection in png_set_sPLT() and
+  png_set_text_2() (CVE-2013-7354).
 
 Version 1.6.0beta40 [January 20, 2013]
   Use consistent handling of overflows in text, sPLT and unknown png_set_* APIs
@@ -4873,6 +4874,109 @@ Version 1.6.10rc03 [March 4, 2014]
   Un-deprecated png_data_freer().
 
 Version 1.6.10 [March 6, 2014]
+  No changes.
+
+Version 1.6.11beta01 [March 17, 2014]
+  Use "if (value != 0)" instead of "if (value)" consistently.
+  Changed ZlibSrcDir from 1.2.5 to 1.2.8 in projects/vstudio.
+  Moved configuration information from the manual to the INSTALL file.
+
+Version 1.6.11beta02 [April 6, 2014]
+  Removed #if/#else/#endif from inside two pow() calls in pngvalid.c because
+    they were handled improperly by Portland Group's PGI-14.1 - PGI-14.3
+    when using its "__builtin_pow()" function.
+  Silence 'unused parameter' build warnings (Cosmin Truta).
+  $(CP) is now used alongside $(RM_F).  Also, use 'copy' instead of 'cp'
+    where applicable, and applied other minor makefile changes (Cosmin).
+  Don't warn about invalid dimensions exceeding user limits (Cosmin).
+  Allow an easy replacement of the default pre-built configuration
+    header with a custom header, via the make PNGLIBCONF_H_PREBUILT
+    macro (Cosmin).
+
+Version 1.6.11beta03 [April 6, 2014]
+  Fixed a typo in pngrutil.c, introduced in libpng-1.5.6, that interferes
+    with "blocky" expansion of sub-8-bit interlaced PNG files (Eric Huss).
+  Optionally use  __builtin_bswap16() in png_do_swap().
+
+Version 1.6.11beta04 [April 19, 2014]
+  Made progressive reading of interlaced images consistent with the
+    behavior of the sequential reader and consistent with the manual, by
+    moving some code out of the PNG_READ_INTERLACING_SUPPORTED blocks. The
+    row_callback now receives the proper pass number and unexpanded rows, when
+    png_combine_row() isn't built or used, and png_set_interlace_handling()
+    is not called.
+  Allow PNG_sRGB_PROFILE_CHECKING = (-1) to mean no sRGB profile checking.
+
+Version 1.6.11beta05 [April 26, 2014]
+  Do not reject ICC V2 profiles that lack padding (Kai-Uwe Behrmann).
+  Relocated closing bracket of the sRGB profile test loop to avoid getting
+    "Not recognizing known sRGB profile that has been edited" warning for
+    ICC V2 profiles that lack the MD5 signature in the profile header.
+
+Version 1.6.11beta06 [May 19, 2014]
+  Added PNG_SKIP_sRGB_CHECK_PROFILE choice for png_set_option().
+
+Version 1.6.11rc01 [May 27, 2014]
+  No changes.
+
+Version 1.6.11rc02 [June 3, 2014]
+  Test ZLIB_VERNUM instead of PNG_ZLIB_VERNUM in contrib/tools/pngfix.c
+
+Version 1.6.11 [June 5, 2014]
+  No changes.
+
+Version 1.6.12rc01 [June 6, 2014]
+  Relocated new code from 1.6.11beta06 in png.c to a point after the
+    declarations (Max Stepin).
+
+Version 1.6.12rc02 [June 7, 2014]
+  Changed file permissions of contrib/tools/intgamma.sh,
+    test-driver, and compile from 0644 to 0755 (Cosmin).
+
+Version 1.6.12rc03 [June 8, 2014]
+  Ensure "__has_attribute()" macro exists before trying to use it with
+    old clang compilers (MacPorts Ticket #43939).
+
+Version 1.6.12 [June 12, 2014]
+  No changes.
+
+Version 1.6.13beta01 [July 4, 2014]
+  Quieted -Wsign-compare and -Wclobber compiler warnings in
+    contrib/pngminus/*.c
+  Added "(void) png_ptr;" where needed in contrib/gregbook to quiet
+    compiler complaints about unused pointers.
+  Split a long output string in contrib/gregbook/rpng2-x.c.
+  Added "PNG_SET_OPTION" requirement for sRGB chunk support to pnglibconf.dfa,
+    Needed for write-only support (John Bowler).
+  Changed "if defined(__ARM_NEON__)" to
+    "if (defined(__ARM_NEON__) || defined(__ARM_NEON))" (James Wu).
+  Fixed clang no-warning builds: png_digit was defined but never used.
+    
+Version 1.6.13beta02 [July 21, 2014]
+  Fixed an incorrect separator ("/" should be "\") in scripts/makefile.vcwin32
+    (bug report from Wolfgang S. Kechel).  Bug was introduced in libpng-1.6.11.
+    Also fixed makefile.bc32, makefile.bor, makefile.msc, makefile.intel, and
+    makefile.tc3 similarly.
+
+Version 1.6.13beta03 [August 3, 2014]
+  Removed scripts/makefile.elf. It has not worked since libpng-1.5.0beta14
+    due to elimination of the PNG_FUNCTION_EXPORT and PNG_DATA_EXPORT
+    definitions from pngconf.h.
+  Ensure that CMakeLists.txt makes the target "lib" directory before making
+    symbolic link into it (SourceForge bug report #226 by Rolf Timmermans).
+
+Version 1.6.13beta04 [August 8, 2014]
+  Added opinion that the ECCN (Export Control Classification Number) for
+    libpng is EAR99 to the README file.
+  Eliminated use of "$<" in makefile explicit rules, when copying
+    $PNGLIBCONF_H_PREBUILT.  This does not work on some versions of make;
+    bug introduced in libpng version 1.6.11.
+
+Version 1.6.13rc01 [August 14, 2014]
+  Made "ccopts" agree with "CFLAGS" in scripts/makefile.hp* and makefile.*sunu
+
+Version 1.6.13 [August 21, 2014]
+  No changes.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
@@ -4881,4 +4985,3 @@ to subscribe)
 or to glennrp at users.sourceforge.net
 
 Glenn R-P
-#endif
diff --git a/media/libpng/LICENSE b/media/libpng/LICENSE
index 94f5e9500af..a38339e3193 100644
--- a/media/libpng/LICENSE
+++ b/media/libpng/LICENSE
@@ -10,7 +10,7 @@ this sentence.
 
 This code is released under the libpng license.
 
-libpng versions 1.2.6, August 15, 2004, through 1.6.10, March 6, 2014, are
+libpng versions 1.2.6, August 15, 2004, through 1.6.13, August 21, 2014, are
 Copyright (c) 2004, 2006-2014 Glenn Randers-Pehrson, and are
 distributed according to the same disclaimer and license as libpng-1.2.5
 with the following individual added to the list of Contributing Authors
@@ -108,4 +108,4 @@ certification mark of the Open Source Initiative.
 
 Glenn Randers-Pehrson
 glennrp at users.sourceforge.net
-March 6, 2014
+August 21, 2014
diff --git a/media/libpng/README b/media/libpng/README
index 57f287bf134..69bda874f87 100644
--- a/media/libpng/README
+++ b/media/libpng/README
@@ -1,4 +1,4 @@
-README for libpng version 1.6.10 - March 6, 2014 (shared library 16.0)
+README for libpng version 1.6.13 - August 21, 2014 (shared library 16.0)
 See the note about version numbers near the top of png.h
 
 See INSTALL for instructions on how to install libpng.
@@ -87,6 +87,12 @@ This code is currently being archived at libpng.sf.net in the
 [DOWNLOAD] area, and at ftp://ftp.simplesystems.org.  If you can't find it
 in any of those places, e-mail me, and I'll help you find it.
 
+I am not a lawyer, but I believe that the Export Control Classification
+Number (ECCN) for libpng is EAR99, which means not subject to export
+controls or International Traffic in Arms Regulations (ITAR) because it
+is open source, publicly available software, that does not contain any
+encryption software.  See the EAR, paragraphs 734.3(b)(3) and 734.7(b).
+
 If you have any code changes, requests, problems, etc., please e-mail
 them to me.  Also, I'd appreciate any make files or project files,
 and any modifications you needed to make to get libpng to compile,
diff --git a/media/libpng/libpng-manual.txt b/media/libpng/libpng-manual.txt
index c854b4c68b5..a394cc9c693 100644
--- a/media/libpng/libpng-manual.txt
+++ b/media/libpng/libpng-manual.txt
@@ -1,6 +1,6 @@
 libpng-manual.txt - A description on how to use and modify libpng
 
- libpng version 1.6.9 - February 6, 2014
+ libpng version 1.6.13 - August 21, 2014
  Updated and distributed by Glenn Randers-Pehrson
  <glennrp at users.sourceforge.net>
  Copyright (c) 1998-2014 Glenn Randers-Pehrson
@@ -11,15 +11,15 @@ libpng-manual.txt - A description on how to use and modify libpng
 
  Based on:
 
- libpng versions 0.97, January 1998, through 1.6.9 - February 6, 2014
+ libpng versions 0.97, January 1998, through 1.6.13 - August 21, 2014
  Updated and distributed by Glenn Randers-Pehrson
  Copyright (c) 1998-2014 Glenn Randers-Pehrson
 
- libpng 1.0 beta 6  version 0.96 May 28, 1997
+ libpng 1.0 beta 6 - version 0.96 - May 28, 1997
  Updated and distributed by Andreas Dilger
  Copyright (c) 1996, 1997 Andreas Dilger
 
- libpng 1.0 beta 2 - version 0.88  January 26, 1996
+ libpng 1.0 beta 2 - version 0.88 - January 26, 1996
  For conditions of distribution and use, see copyright
  notice in png.h. Copyright (c) 1995, 1996 Guy Eric
  Schalnat, Group 42, Inc.
@@ -54,7 +54,7 @@ This file describes how to use and modify the PNG reference library
 file, example.c is a good starting point for using the library, as
 it is heavily commented and should include everything most people
 will need.  We assume that libpng is already installed; see the
-INSTALL file for instructions on how to install libpng.
+INSTALL file for instructions on how to configure and install libpng.
 
 For examples of libpng usage, see the files "example.c", "pngtest.c",
 and the files in the "contrib" directory, all of which are included in
@@ -274,10 +274,10 @@ This method of building a customized pnglibconf.h is illustrated in
 contrib/pngminim/*.  See the "$(PNGCONF):" target in the makefile and
 pngusr.dfa in these directories.
 
-C. Configuration using PNG_USR_CONFIG
+C. Configuration using PNG_USER_CONFIG
 
-If -DPNG_USR_CONFIG is added to the CFLAGS when pnglibconf.h is built the file
-pngusr.h will automatically be included before the options in
+If -DPNG_USER_CONFIG is added to the CPPFLAGS when pnglibconf.h is built,
+the file pngusr.h will automatically be included before the options in
 scripts/pnglibconf.dfa are processed.  Your pngusr.h file should contain only
 macro definitions turning features on or off or setting settings.
 
@@ -712,12 +712,12 @@ value.  You can also specify a default encoding for the PNG file in
 case the required information is missing from the file.  By default libpng
 assumes that the PNG data matches your system, to keep this default call:
 
-   png_set_gamma(png_ptr, screen_gamma, 1/screen_gamma/*file gamma*/);
+   png_set_gamma(png_ptr, screen_gamma, output_gamma);
 
 or you can use the fixed point equivalent:
 
    png_set_gamma_fixed(png_ptr, PNG_FP_1*screen_gamma,
-      PNG_FP_1/screen_gamma);
+      PNG_FP_1*output_gamma);
 
 If you don't know the gamma for your system it is probably 2.2 - a good
 approximation to the IEC standard for display systems (sRGB).  If images are
@@ -745,6 +745,70 @@ component value whenever arithmetic is performed.  A lot of graphics software
 uses linear values for this reason, often with higher precision component values
 to preserve overall accuracy.
 
+
+The output_gamma value expresses how to decode the output values, not how
+they are encoded.  The values used correspond to the normal numbers used to
+describe the overall gamma of a computer display system; for example 2.2 for
+an sRGB conformant system.  The values are scaled by 100000 in the _fixed
+version of the API (so 220000 for sRGB.)
+
+The inverse of the value is always used to provide a default for the PNG file
+encoding if it has no gAMA chunk and if png_set_gamma() has not been called
+to override the PNG gamma information.
+
+When the ALPHA_OPTIMIZED mode is selected the output gamma is used to encode
+opaque pixels however pixels with lower alpha values are not encoded,
+regardless of the output gamma setting.
+
+When the standard Porter Duff handling is requested with mode 1 the output
+encoding is set to be linear and the output_gamma value is only relevant
+as a default for input data that has no gamma information.  The linear output
+encoding will be overridden if png_set_gamma() is called - the results may be
+highly unexpected!
+
+The following numbers are derived from the sRGB standard and the research
+behind it.  sRGB is defined to be approximated by a PNG gAMA chunk value of
+0.45455 (1/2.2) for PNG.  The value implicitly includes any viewing
+correction required to take account of any differences in the color
+environment of the original scene and the intended display environment; the
+value expresses how to *decode* the image for display, not how the original
+data was *encoded*.
+
+sRGB provides a peg for the PNG standard by defining a viewing environment.
+sRGB itself, and earlier TV standards, actually use a more complex transform
+(a linear portion then a gamma 2.4 power law) than PNG can express.  (PNG is
+limited to simple power laws.)  By saying that an image for direct display on
+an sRGB conformant system should be stored with a gAMA chunk value of 45455
+(11.3.3.2 and 11.3.3.5 of the ISO PNG specification) the PNG specification
+makes it possible to derive values for other display systems and
+environments.
+
+The Mac value is deduced from the sRGB based on an assumption that the actual
+extra viewing correction used in early Mac display systems was implemented as
+a power 1.45 lookup table.
+
+Any system where a programmable lookup table is used or where the behavior of
+the final display device characteristics can be changed requires system
+specific code to obtain the current characteristic.  However this can be
+difficult and most PNG gamma correction only requires an approximate value.
+
+By default, if png_set_alpha_mode() is not called, libpng assumes that all
+values are unencoded, linear, values and that the output device also has a
+linear characteristic.  This is only very rarely correct - it is invariably
+better to call png_set_alpha_mode() with PNG_DEFAULT_sRGB than rely on the
+default if you don't know what the right answer is!
+
+The special value PNG_GAMMA_MAC_18 indicates an older Mac system (pre Mac OS
+10.6) which used a correction table to implement a somewhat lower gamma on an
+otherwise sRGB system.
+
+Both these values are reserved (not simple gamma values) in order to allow
+more precise correction internally in the future.
+
+NOTE: the values can be passed to either the fixed or floating
+point APIs, but the floating point API will also accept floating point
+values.
+
 The second thing you may need to tell libpng about is how your system handles
 alpha channel information.  Some, but not all, PNG files contain an alpha
 channel.  To display these files correctly you need to compose the data onto a
@@ -769,11 +833,11 @@ by png_set_alpha_mode().
 
 The mode is as follows:
 
-    PNG_ALPHA_PNG: The data is encoded according to the PNG specification.  Red,
-green and blue, or gray, components are gamma encoded color
-values and are not premultiplied by the alpha value.  The
-alpha value is a linear measure of the contribution of the
-pixel to the corresponding final output pixel.
+    PNG_ALPHA_PNG: The data is encoded according to the PNG
+specification.  Red, green and blue, or gray, components are
+gamma encoded color values and are not premultiplied by the
+alpha value.  The alpha value is a linear measure of the
+contribution of the pixel to the corresponding final output pixel.
 
 You should normally use this format if you intend to perform
 color correction on the color values; most, maybe all, color
@@ -790,11 +854,35 @@ be used!
 
 The remaining modes assume you don't need to do any further color correction or
 that if you do, your color correction software knows all about alpha (it
-probably doesn't!)
+probably doesn't!).  They 'associate' the alpha with the color information by
+storing color channel values that have been scaled by the alpha.  The
+advantage is that the color channels can be resampled (the image can be
+scaled) in this form.  The disadvantage is that normal practice is to store
+linear, not (gamma) encoded, values and this requires 16-bit channels for
+still images rather than the 8-bit channels that are just about sufficient if
+gamma encoding is used.  In addition all non-transparent pixel values,
+including completely opaque ones, must be gamma encoded to produce the final
+image.  These are the 'STANDARD', 'ASSOCIATED' or 'PREMULTIPLIED' modes
+described below (the latter being the two common names for associated alpha
+color channels). Note that PNG files always contain non-associated color
+channels; png_set_alpha_mode() with one of the modes causes the decoder to
+convert the pixels to an associated form before returning them to your
+application. 
 
-    PNG_ALPHA_STANDARD:  The data libpng produces
-is encoded in the standard way
-assumed by most correctly written graphics software.
+Since it is not necessary to perform arithmetic on opaque color values so
+long as they are not to be resampled and are in the final color space it is
+possible to optimize the handling of alpha by storing the opaque pixels in
+the PNG format (adjusted for the output color space) while storing partially
+opaque pixels in the standard, linear, format.  The accuracy required for
+standard alpha composition is relatively low, because the pixels are
+isolated, therefore typically the accuracy loss in storing 8-bit linear
+values is acceptable.  (This is not true if the alpha channel is used to
+simulate transparency over large areas - use 16 bits or the PNG mode in
+this case!)  This is the 'OPTIMIZED' mode.  For this mode a pixel is
+treated as opaque only if the alpha value is equal to the maximum value.
+
+    PNG_ALPHA_STANDARD:  The data libpng produces is encoded in the
+standard way assumed by most correctly written graphics software.
 The gamma encoding will be removed by libpng and the
 linear component values will be pre-multiplied by the
 alpha channel.
@@ -823,9 +911,8 @@ dynamic range.  To avoid problems, and if your software
 supports it, use png_set_expand_16() to force all
 components to 16 bits.
 
-    PNG_ALPHA_OPTIMIZED: This mode is the same
-as PNG_ALPHA_STANDARD except that
-completely opaque pixels are gamma encoded according to
+    PNG_ALPHA_OPTIMIZED: This mode is the same as PNG_ALPHA_STANDARD
+except that completely opaque pixels are gamma encoded according to
 the screen_gamma value.  Pixels with alpha less than 1.0
 will still have linear components.
 
@@ -844,18 +931,16 @@ representation of non-opaque pixels are irrelevant.
 You can also try this format if your software is broken;
 it might look better.
 
-    PNG_ALPHA_BROKEN: This is PNG_ALPHA_STANDARD;
-however, all component values,
-including the alpha channel are gamma encoded.  This is
-an appropriate format to try if your software, or more
-likely hardware, is totally broken, i.e., if it performs
-linear arithmetic directly on gamma encoded values.
-
-In most cases of broken software or hardware the bug in the final display
-manifests as a subtle halo around composited parts of the image.  You may not
-even perceive this as a halo; the composited part of the image may simply appear
-separate from the background, as though it had been cut out of paper and pasted
-on afterward.
+    PNG_ALPHA_BROKEN: This is PNG_ALPHA_STANDARD; however, all component
+values, including the alpha channel are gamma encoded.  This is
+broken because, in practice, no implementation that uses this choice
+correctly undoes the encoding before handling alpha composition.  Use this
+choice only if other serious errors in the software or hardware you use
+mandate it.  In most cases of broken software or hardware the bug in the
+final display manifests as a subtle halo around composited parts of the
+image.  You may not even perceive this as a halo; the composited part of
+the image may simply appear separate from the background, as though it had
+been cut out of paper and pasted on afterward.
 
 If you don't have to deal with bugs in software or hardware, or if you can fix
 them, there are three recommended ways of using png_set_alpha_mode():
@@ -886,6 +971,89 @@ All you can do is compose the result onto a matching output.  Since this
 mode is libpng-specific you also need to write your own composition
 software.
 
+The following are examples of calls to png_set_alpha_mode to achieve the
+required overall gamma correction and, where necessary, alpha
+premultiplication.
+
+    png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_DEFAULT_sRGB);
+
+This is the default libpng handling of the alpha channel - it is not
+pre-multiplied into the color components.  In addition the call states
+that the output is for a sRGB system and causes all PNG files without gAMA
+chunks to be assumed to be encoded using sRGB.
+
+    png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_GAMMA_MAC);
+
+In this case the output is assumed to be something like an sRGB conformant
+display preceeded by a power-law lookup table of power 1.45.  This is how
+early Mac systems behaved.
+
+    png_set_alpha_mode(pp, PNG_ALPHA_STANDARD, PNG_GAMMA_LINEAR);
+
+This is the classic Jim Blinn approach and will work in academic
+environments where everything is done by the book.  It has the shortcoming
+of assuming that input PNG data with no gamma information is linear - this
+is unlikely to be correct unless the PNG files where generated locally.
+Most of the time the output precision will be so low as to show
+significant banding in dark areas of the image.
+
+    png_set_expand_16(pp);
+    png_set_alpha_mode(pp, PNG_ALPHA_STANDARD, PNG_DEFAULT_sRGB);
+
+This is a somewhat more realistic Jim Blinn inspired approach.  PNG files
+are assumed to have the sRGB encoding if not marked with a gamma value and
+the output is always 16 bits per component.  This permits accurate scaling
+and processing of the data.  If you know that your input PNG files were
+generated locally you might need to replace PNG_DEFAULT_sRGB with the
+correct value for your system.
+
+    png_set_alpha_mode(pp, PNG_ALPHA_OPTIMIZED, PNG_DEFAULT_sRGB);
+
+If you just need to composite the PNG image onto an existing background
+and if you control the code that does this you can use the optimization
+setting.  In this case you just copy completely opaque pixels to the
+output.  For pixels that are not completely transparent (you just skip
+those) you do the composition math using png_composite or png_composite_16
+below then encode the resultant 8-bit or 16-bit values to match the output
+encoding.
+
+    Other cases
+
+If neither the PNG nor the standard linear encoding work for you because
+of the software or hardware you use then you have a big problem.  The PNG
+case will probably result in halos around the image.  The linear encoding
+will probably result in a washed out, too bright, image (it's actually too
+contrasty.)  Try the ALPHA_OPTIMIZED mode above - this will probably
+substantially reduce the halos.  Alternatively try:
+
+    png_set_alpha_mode(pp, PNG_ALPHA_BROKEN, PNG_DEFAULT_sRGB);
+
+This option will also reduce the halos, but there will be slight dark
+halos round the opaque parts of the image where the background is light.
+In the OPTIMIZED mode the halos will be light halos where the background
+is dark.  Take your pick - the halos are unavoidable unless you can get
+your hardware/software fixed!  (The OPTIMIZED approach is slightly
+faster.)
+
+When the default gamma of PNG files doesn't match the output gamma.
+If you have PNG files with no gamma information png_set_alpha_mode allows
+you to provide a default gamma, but it also sets the ouput gamma to the
+matching value.  If you know your PNG files have a gamma that doesn't
+match the output you can take advantage of the fact that
+png_set_alpha_mode always sets the output gamma but only sets the PNG
+default if it is not already set:
+
+    png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_DEFAULT_sRGB);
+    png_set_alpha_mode(pp, PNG_ALPHA_PNG, PNG_GAMMA_MAC);
+
+The first call sets both the default and the output gamma values, the
+second call overrides the output gamma without changing the default.  This
+is easier than achieving the same effect with png_set_gamma.  You must use
+PNG_ALPHA_PNG for the first call - internal checking in png_set_alpha will
+fire if more than one call to png_set_alpha_mode and png_set_background is
+made in the same read operation, however multiple calls with PNG_ALPHA_PNG
+are ignored.
+
 If you don't need, or can't handle, the alpha channel you can call
 png_set_background() to remove it by compositing against a fixed color.  Don't
 call png_set_strip_alpha() to do this - it will leave spurious pixel values in
@@ -1216,7 +1384,7 @@ png_set_rgb_to_gray()).
 
     png_get_sRGB(png_ptr, info_ptr, &srgb_intent);
 
-    file_srgb_intent - the rendering intent (PNG_INFO_sRGB)
+    srgb_intent -    the rendering intent (PNG_INFO_sRGB)
                      The presence of the sRGB chunk
                      means that the pixel data is in the
                      sRGB color space.  This chunk also
@@ -2166,10 +2334,15 @@ how pngvalid.c does it.
 Finishing a sequential read
 
 After you are finished reading the image through the
-low-level interface, you can finish reading the file.  If you are
-interested in comments or time, which may be stored either before or
-after the image data, you should pass the separate png_info struct if
-you want to keep the comments from before and after the image
+low-level interface, you can finish reading the file.
+
+If you want to use a different crc action for handling CRC errors in
+chunks after the image data, you can call png_set_crc_action()
+again at this point.
+
+If you are interested in comments or time, which may be stored either
+before or after the image data, you should pass the separate png_info
+struct if you want to keep the comments from before and after the image
 separate.
 
     png_infop end_info = png_create_info_struct(png_ptr);
@@ -2185,6 +2358,9 @@ separate.
 
 If you are not interested, you should still call png_read_end()
 but you can pass NULL, avoiding the need to create an end_info structure.
+If you do this, libpng will not process any chunks after IDAT other than
+skipping over them and perhaps (depending on whether you have called
+png_set_crc_action) checking their CRCs while looking for the IEND chunk.
 
    png_read_end(png_ptr, (png_infop)NULL);
 
@@ -2460,7 +2636,7 @@ png_infop info_ptr;
         png_progressive_combine_row(png_ptr, old_row,
           new_row);
 
-    /* where old_row is what was displayed for
+    /* where old_row is what was displayed
        previously for the row.  Note that the first
        pass (pass == 0, really) will completely cover
        the old row, so the rows do not have to be
@@ -3617,8 +3793,9 @@ and matches the 8-bit format expected by typical display devices.
 The color/gray channels are not scaled (pre-multiplied) by the alpha
 channel and are suitable for passing to color management software.
 
-  b) As a value in the range 0..65535, contained in a 2-byte integer.  All
-channels can be converted to the original value by dividing by 65535; all
+  b) As a value in the range 0..65535, contained in a 2-byte integer, in
+the native byte order of the platform on which the application is running.
+All channels can be converted to the original value by dividing by 65535; all
 channels are linear.  Color channels use the RGB encoding (RGB end-points) of
 the sRGB specification.  This encoding is identified by the
 PNG_FORMAT_FLAG_LINEAR flag below.
@@ -3685,7 +3862,9 @@ First the single byte formats:
 Then the linear 2-byte formats.  When naming these "Y" is used to
 indicate a luminance (gray) channel.  The component order within the pixel
 is always the same - there is no provision for swapping the order of the
-components in the linear format.
+components in the linear format.  The components are 16-bit integers in
+the native byte order for your platform, and there is no provision for
+swapping the bytes to a different endian condition.
 
    PNG_FORMAT_LINEAR_Y PNG_FORMAT_FLAG_LINEAR
    PNG_FORMAT_LINEAR_Y_ALPHA
@@ -3750,7 +3929,7 @@ First the information about the samples.
     *
     * png_byte colormap[PNG_IMAGE_MAXIMUM_COLORMAP_COMPONENTS(sRGB_fmt)];
     *
-    * Alternatively use the PNG_IMAGE_COLORMAP_SIZE macro below to use the
+    * Alternatively, use the PNG_IMAGE_COLORMAP_SIZE macro below to use the
     * information from one of the png_image_begin_read_ APIs and dynamically
     * allocate the required memory.
     */
@@ -3779,9 +3958,16 @@ Information about the whole row, or whole image
    row.  For a color-mapped image this is the minimum number of bytes in a
    row.
 
+   If you need the stride measured in bytes, row_stride_bytes is
+   PNG_IMAGE_ROW_STRIDE(image) * PNG_IMAGE_PIXEL_COMPONENT_SIZE(fmt)
+   plus any padding bytes that your application might need, for example
+   to start the next row on a 4-byte boundary.
+
   PNG_IMAGE_BUFFER_SIZE(image, row_stride)
     Returns the size, in bytes, of an image buffer given a png_image and a row
-    stride - the number of components to leave space for in each row.
+    stride - the number of components to leave space for in each row.  This
+    macro takes care of multiplying row_stride by PNG_IMAGE_PIXEL_COMONENT_SIZE
+    when the image has 2-byte components.
 
   PNG_IMAGE_FLAG_COLORSPACE_NOT_sRGB == 0x01
     This indicates the the RGB values of the in-memory bitmap do not
@@ -3910,14 +4096,11 @@ clears the newly allocated memory to zero; note that png_calloc(png_ptr, size)
 is not the same as the calloc(number, size) function provided by stdlib.h.
 There is limited support for certain systems with segmented memory
 architectures and the types of pointers declared by png.h match this; you
-will have to use appropriate pointers in your application.  Since it is
-unlikely that the method of handling memory allocation on a platform
-will change between applications, these functions must be modified in
-the library at compile time.  If you prefer to use a different method
-of allocating and freeing data, you can use png_create_read_struct_2() or
-png_create_write_struct_2() to register your own functions as described
-above.  These functions also provide a void pointer that can be retrieved
-via
+will have to use appropriate pointers in your application.  If you prefer
+to use a different method of allocating and freeing data, you can use
+png_create_read_struct_2() or png_create_write_struct_2() to register your
+own functions as described above.  These functions also provide a void
+pointer that can be retrieved via
 
     mem_ptr=png_get_mem_ptr(png_ptr);
 
@@ -4060,29 +4243,6 @@ the simpler ones to get an idea of how they work.  Try to find a similar
 transformation to the one you want to add and copy off of it.  More details
 can be found in the comments inside the code itself.
 
-Configuring for 16-bit platforms
-
-You will want to look into zconf.h to tell zlib (and thus libpng) that
-it cannot allocate more then 64K at a time.  Even if you can, the memory
-won't be accessible.  So limit zlib and libpng to 64K by defining MAXSEG_64K.
-
-Configuring for DOS
-
-For DOS users who only have access to the lower 640K, you will
-have to limit zlib's memory usage via a png_set_compression_mem_level()
-call.  See zlib.h or zconf.h in the zlib library for more information.
-
-Configuring for Medium Model
-
-Libpng's support for medium model has been tested on most of the popular
-compilers.  Make sure MAXSEG_64K gets defined, USE_FAR_KEYWORD gets
-defined, and FAR gets defined to far in pngconf.h, and you should be
-all set.  Everything in the library (except for zlib's structure) is
-expecting far data.  You must use the typedefs with the p or pp on
-the end for pointers (or at least look at them and be careful).  Make
-note that the rows of data are defined as png_bytepp, which is
-an "unsigned char far * far *".
-
 Configuring for gui/windowing platforms:
 
 You will need to write new error and warning functions that use the GUI
@@ -4092,18 +4252,6 @@ in order to have them available during the structure initialization.
 They can be changed later via png_set_error_fn().  On some compilers,
 you may also have to change the memory allocators (png_malloc, etc.).
 
-Configuring for compiler xxx:
-
-All includes for libpng are in pngconf.h.  If you need to add, change
-or delete an include, this is the place to do it.
-The includes that are not needed outside libpng are placed in pngpriv.h,
-which is only used by the routines inside libpng itself.
-The files in libpng proper only include pngpriv.h and png.h, which
-in turn includes pngconf.h and, as of libpng-1.5.0, pnglibconf.h.
-As of libpng-1.5.0, pngpriv.h also includes three other private header
-files, pngstruct.h, pnginfo.h, and pngdebug.h, which contain material
-that previously appeared in the public headers.
-
 Configuring zlib:
 
 There are special functions to configure the compression.  Perhaps the
@@ -4145,6 +4293,8 @@ zlib.h for more information on what these mean.
 
     png_set_compression_method(png_ptr, method);
 
+This controls the size of the IDAT chunks (default 8192):
+
     png_set_compression_buffer_size(png_ptr, size);
 
 As of libpng version 1.5.4, additional APIs became
@@ -4243,46 +4393,6 @@ Note that the numbers above were invented purely for this example and
 are given only to help explain the function usage.  Little testing has
 been done to find optimum values for either the costs or the weights.
 
-Removing unwanted object code
-
-There are a bunch of #define's in pngconf.h that control what parts of
-libpng are compiled.  All the defines end in _SUPPORTED.  If you are
-never going to use a capability, you can change the #define to #undef
-before recompiling libpng and save yourself code and data space, or
-you can turn off individual capabilities with defines that begin with
-PNG_NO_.
-
-In libpng-1.5.0 and later, the #define's are in pnglibconf.h instead.
-
-You can also turn all of the transforms and ancillary chunk capabilities
-off en masse with compiler directives that define
-PNG_NO_READ[or WRITE]_TRANSFORMS, or PNG_NO_READ[or WRITE]_ANCILLARY_CHUNKS,
-or all four,
-along with directives to turn on any of the capabilities that you do
-want.  The PNG_NO_READ[or WRITE]_TRANSFORMS directives disable the extra
-transformations but still leave the library fully capable of reading
-and writing PNG files with all known public chunks. Use of the
-PNG_NO_READ[or WRITE]_ANCILLARY_CHUNKS directive produces a library
-that is incapable of reading or writing ancillary chunks.  If you are
-not using the progressive reading capability, you can turn that off
-with PNG_NO_PROGRESSIVE_READ (don't confuse this with the INTERLACING
-capability, which you'll still have).
-
-All the reading and writing specific code are in separate files, so the
-linker should only grab the files it needs.  However, if you want to
-make sure, or if you are building a stand alone library, all the
-reading files start with "pngr" and all the writing files start with "pngw".
-The files that don't match either (like png.c, pngtrans.c, etc.)
-are used for both reading and writing, and always need to be included.
-The progressive reader is in pngpread.c
-
-If you are creating or distributing a dynamically linked library (a .so
-or DLL file), you should not remove or disable any parts of the library,
-as this will cause applications linked with different versions of the
-library to fail if they call functions not available in your library.
-The size of the library itself should not be an issue, because only
-those sections that are actually used will be loaded into memory.
-
 Requesting debug printout
 
 The macro definition PNG_DEBUG can be used to request debugging
@@ -4320,17 +4430,6 @@ When PNG_DEBUG = 1, the macros are defined, but only png_debug statements
 having level = 0 will be printed.  There aren't any such statements in
 this version of libpng, but if you insert some they will be printed.
 
-Prepending a prefix to exported symbols
-
-Starting with libpng-1.6.0, you can configure libpng (when using the
-"configure" script) to prefix all exported symbols by means of the
-configuration option "--with-libpng-prefix=FOO_", where FOO_ can be any
-string beginning with a letter and containing only uppercase
-and lowercase letters, digits, and the underscore (i.e., a C language
-identifier).  This creates a set of macros in pnglibconf.h, so this is
-transparent to applications; their function calls get transformed by
-the macros to use the modified names.
-
 VII.  MNG support
 
 The MNG specification (available at http://www.libpng.org/pub/mng) allows
@@ -4657,8 +4756,6 @@ does not account for any palette index used by ancillary chunks such as the
 bKGD chunk; you must check those separately to determine the maximum
 palette index actually used.
 
-A. Changes that affect users of libpng
-
 There are no substantial API changes between the non-deprecated parts of
 the 1.4.5 API and the 1.5.0 API; however, the ability to directly access
 members of the main libpng control structures, png_struct and png_info,
@@ -4797,26 +4894,6 @@ limits are now
 The png_set_option() function (and the "options" member of the png struct) was
 added to libpng-1.5.15.
 
-B. Changes to the build and configuration of libpng
-
-Details of internal changes to the library code can be found in the CHANGES
-file and in the GIT repository logs.  These will be of no concern to the vast
-majority of library users or builders; however, the few who configure libpng
-to a non-default feature set may need to change how this is done.
-
-There should be no need for library builders to alter build scripts if
-these use the distributed build support - configure or the makefiles -
-however, users of the makefiles may care to update their build scripts
-to build pnglibconf.h where the corresponding makefile does not do so.
-
-Building libpng with a non-default configuration has changed completely.
-The old method using pngusr.h should still work correctly even though the
-way pngusr.h is used in the build has been changed; however, library
-builders will probably want to examine the changes to take advantage of
-new capabilities and to simplify their build system.
-
-B.1 Specific changes to library configuration capabilities
-
 The library now supports a complete fixed point implementation and can
 thus be used on systems that have no floating point support or very
 limited or slow support.  Previously gamma correction, an essential part
@@ -4827,27 +4904,7 @@ independent of the choice of fixed versus floating point APIs and all the
 missing fixed point APIs have been implemented.
 
 The exact mechanism used to control attributes of API functions has
-changed.  A single set of operating system independent macro definitions
-is used and operating system specific directives are defined in
-pnglibconf.h
-
-As part of this the mechanism used to choose procedure call standards on
-those systems that allow a choice has been changed.  At present this only
-affects certain Microsoft (DOS, Windows) and IBM (OS/2) operating systems
-running on Intel processors.  As before, PNGAPI is defined where required
-to control the exported API functions; however, two new macros, PNGCBAPI
-and PNGCAPI, are used instead for callback functions (PNGCBAPI) and
-(PNGCAPI) for functions that must match a C library prototype (currently
-only png_longjmp_ptr, which must match the C longjmp function.)  The new
-approach is documented in pngconf.h
-
-Despite these changes, libpng 1.5.0 only supports the native C function
-calling standard on those platforms tested so far (__cdecl on Microsoft
-Windows).  This is because the support requirements for alternative
-calling conventions seem to no longer exist.  Developers who find it
-necessary to set PNG_API_RULE to 1 should advise the mailing list
-(png-mng-implement) of this and library builders who use Openwatcom and
-therefore set PNG_API_RULE to 2 should also contact the mailing list.
+changed, as described in the INSTALL file.
 
 A new test program, pngvalid, is provided in addition to pngtest.
 pngvalid validates the arithmetic accuracy of the gamma correction
@@ -4923,46 +4980,6 @@ even though the default is to use the macros - this allows applications
 to choose at app buildtime whether or not to use macros (previously
 impossible because the functions weren't in the default build.)
 
-B.2 Changes to the configuration mechanism
-
-Prior to libpng-1.5.0 library builders who needed to configure libpng
-had either to modify the exported pngconf.h header file to add system
-specific configuration or had to write feature selection macros into
-pngusr.h and cause this to be included into pngconf.h by defining
-PNG_USER_CONFIG. The latter mechanism had the disadvantage that an
-application built without PNG_USER_CONFIG defined would see the
-unmodified, default, libpng API and thus would probably fail to link.
-
-These mechanisms still work in the configure build and in any makefile
-build that builds pnglibconf.h, although the feature selection macros
-have changed somewhat as described above.  In 1.5.0, however, pngusr.h is
-processed only once, when the exported header file pnglibconf.h is built.
-pngconf.h no longer includes pngusr.h, therefore pngusr.h is ignored after the
-build of pnglibconf.h and it is never included in an application build.
-
-The rarely used alternative of adding a list of feature macros to the
-CFLAGS setting in the build also still works; however, the macros will be
-copied to pnglibconf.h and this may produce macro redefinition warnings
-when the individual C files are compiled.
-
-All configuration now only works if pnglibconf.h is built from
-scripts/pnglibconf.dfa.  This requires the program awk.  Brian Kernighan
-(the original author of awk) maintains C source code of that awk and this
-and all known later implementations (often called by subtly different
-names - nawk and gawk for example) are adequate to build pnglibconf.h.
-The Sun Microsystems (now Oracle) program 'awk' is an earlier version
-and does not work; this may also apply to other systems that have a
-functioning awk called 'nawk'.
-
-Configuration options are now documented in scripts/pnglibconf.dfa.  This
-file also includes dependency information that ensures a configuration is
-consistent; that is, if a feature is switched off dependent features are
-also removed.  As a recommended alternative to using feature macros in
-pngusr.h a system builder may also define equivalent options in pngusr.dfa
-(or, indeed, any file) and add that to the configuration by setting
-DFA_XTRA to the file name.  The makefiles in contrib/pngminim illustrate
-how to do this, and a case where pngusr.h is still required.
-
 XII.  Changes to Libpng from version 1.5.x to 1.6.x
 
 A "simplified API" has been added (see documentation in png.h and a simple
@@ -4998,7 +5015,6 @@ The following API are now DEPRECATED:
    png_info_init_3()
    png_convert_to_rfc1123() which has been replaced
      with png_convert_to_rfc1123_buffer()
-   png_data_freer()
    png_malloc_default()
    png_free_default()
    png_reset_zstream()
@@ -5022,11 +5038,26 @@ Error detection in some chunks has improved; in particular the iCCP chunk
 reader now does pretty complete validation of the basic format.  Some bad
 profiles that were previously accepted are now accepted with a warning or
 rejected, depending upon the png_set_benign_errors() setting, in particular the
-very old broken Microsoft/HP 3144-byte sRGB profile.  The PNG spec requirement
-that only grayscale profiles may appear in images with color type 0 or 4 and
-that even if the image only contains gray pixels, only RGB profiles may appear
-in images with color type 2, 3, or 6, is now enforced.  The sRGB chunk
-is allowed to appear in images with any color type.
+very old broken Microsoft/HP 3144-byte sRGB profile.  Starting with
+libpng-1.6.11, recognizing and checking sRGB profiles can be avoided by
+means of
+
+    #if defined(PNG_SKIP_sRGB_CHECK_PROFILE) && \
+        defined(PNG_SET_OPTION_SUPPORTED)
+       png_set_option(png_ptr, PNG_SKIP_sRGB_CHECK_PROFILE,
+           PNG_OPTION_ON);
+    #endif
+
+It's not a good idea to do this if you are using the "simplified API",
+which needs to be able to recognize an sRGB profile conveyed via the iCCP
+chunk.
+
+The PNG spec requirement that only grayscale profiles may appear in images
+with color type 0 or 4 and that even if the image only contains gray pixels,
+only RGB profiles may appear in images with color type 2, 3, or 6, is now
+enforced.  The sRGB chunk is allowed to appear in images with any color type
+and is interpreted by libpng to convey a one-tracer-curve gray profile or a
+three-tracer-curve RGB profile as appropriate.
 
 Prior to libpng-1.6.0 a warning would be issued if the iTXt chunk contained
 an empty language field or an empty translated keyword.  Both of these
@@ -5060,16 +5091,16 @@ Libpng-1.6.0 through 1.6.2 used the CMF bytes at the beginning of the IDAT
 stream to set the size of the sliding window for reading instead of using the
 default 32-kbyte sliding window size.  It was discovered that there are
 hundreds of PNG files in the wild that have incorrect CMF bytes that caused
-libpng to issue a "too far back" error and reject the file.  Libpng-1.6.3 and
-later calculate their own safe CMF from the image dimensions, provide a way
-to revert to the libpng-1.5.x behavior (ignoring the CMF bytes and using a
-32-kbyte sliding window), by using
+zlib to issue the "invalid distance too far back" error and reject the file.
+Libpng-1.6.3 and later calculate their own safe CMF from the image dimensions,
+provide a way to revert to the libpng-1.5.x behavior (ignoring the CMF bytes
+and using a 32-kbyte sliding window), by using
 
     png_set_option(png_ptr, PNG_MAXIMUM_INFLATE_WINDOW,
         PNG_OPTION_ON);
 
-and provide a tool (contrib/tools/pngfix) for optimizing the CMF bytes
-correctly.
+and provide a tool (contrib/tools/pngfix) for rewriting a PNG file while
+optimizing the CMF bytes in its IDAT chunk correctly.
 
 Libpng-1.6.0 and libpng-1.6.1 wrote uncompressed iTXt chunks with the wrong
 length, which resulted in PNG files that cannot be read beyond the bad iTXt
@@ -5111,7 +5142,8 @@ mailing list, or directly to glennrp.
 
 XV. Coding style
 
-Our coding style is similar to the "Allman" style, with curly
+Our coding style is similar to the "Allman" style
+(See http://en.wikipedia.org/wiki/Indent_style#Allman_style), with curly
 braces on separate lines:
 
     if (condition)
@@ -5174,6 +5206,9 @@ exported functions are marked with PNGAPI:
     body;
  }
 
+The return type and decorations are placed on a separate line
+ahead of the function name, as illustrated above.
+
 The prototypes for all exported functions appear in png.h,
 above the comment that says
 
@@ -5230,6 +5265,9 @@ with an even number of lower-case hex digits (e.g., 0x00, 0xff, 0x0100).
 We prefer to use underscores in variable names rather than camelCase, except
 for a few type names that we inherit from zlib.h.
 
+We prefer "if (something != 0)" and "if (something == 0)"
+over "if (something)" and if "(!something)", respectively.
+
 We do not use the TAB character for indentation in the C sources.
 
 Lines do not exceed 80 characters.
@@ -5238,13 +5276,13 @@ Other rules can be inferred by inspecting the libpng source.
 
 XVI. Y2K Compliance in libpng
 
-February 6, 2014
+August 21, 2014
 
 Since the PNG Development group is an ad-hoc body, we can't make
 an official declaration.
 
 This is your unofficial assurance that libpng from version 0.71 and
-upward through 1.6.9 are Y2K compliant.  It is my belief that earlier
+upward through 1.6.13 are Y2K compliant.  It is my belief that earlier
 versions were also Y2K compliant.
 
 Libpng only has two year fields.  One is a 2-byte unsigned integer
diff --git a/media/mtransport/nr_socket_prsock.cpp b/media/mtransport/nr_socket_prsock.cpp
index e9e8b3d1bf0..116614aecef 100644
--- a/media/mtransport/nr_socket_prsock.cpp
+++ b/media/mtransport/nr_socket_prsock.cpp
@@ -839,6 +839,12 @@ int NrSocketIpc::create(nr_transport_addr *addr) {
     ABORT(R_INTERNAL);
   }
 
+  // Bug 950660: Remote TCP socket is not supported yet.
+  if (NS_WARN_IF(addr->protocol != IPPROTO_UDP)) {
+    MOZ_ASSERT(false, "NrSocket over TCP is not e10s ready, see Bug 950660");
+    ABORT(R_INTERNAL);
+  }
+
   sts_thread_ = do_GetService(NS_SOCKETTRANSPORTSERVICE_CONTRACTID, &rv);
   if (NS_FAILED(rv)) {
     MOZ_ASSERT(false, "Failed to get STS thread");
diff --git a/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp b/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp
index f104f5a8933..9b8af31f7b5 100644
--- a/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp
+++ b/media/webrtc/signaling/src/media-conduit/VideoConduit.cpp
@@ -597,6 +597,15 @@ WebrtcVideoConduit::ConfigureSendMediaCodec(const VideoCodecConfig* codecConfig)
     // width/height will be overridden on the first frame
     video_codec.width = 320;
     video_codec.height = 240;
+#ifdef MOZ_WEBRTC_OMX
+    if (codecConfig->mType == webrtc::kVideoCodecH264) {
+      video_codec.resolution_divisor = 16;
+    } else {
+      video_codec.resolution_divisor = 1; // We could try using it to handle odd resolutions
+    }
+#else
+    video_codec.resolution_divisor = 1; // We could try using it to handle odd resolutions
+#endif
     video_codec.qpMax = 56;
     video_codec.numberOfSimulcastStreams = 1;
     video_codec.mode = webrtc::kRealtimeVideo;
@@ -1303,6 +1312,9 @@ WebrtcVideoConduit::CodecConfigToWebRTCCodec(const VideoCodecConfig* codecInfo,
 
   if (cinst.codecType == webrtc::kVideoCodecH264)
   {
+#ifdef MOZ_WEBRTC_OMX
+    cinst.resolution_divisor = 16;
+#endif
     cinst.codecSpecific.H264.profile = codecInfo->mProfile;
     cinst.codecSpecific.H264.constraints = codecInfo->mConstraints;
     cinst.codecSpecific.H264.level = codecInfo->mLevel;
diff --git a/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp b/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
index b6b0682852b..1360cfcbfe0 100644
--- a/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
+++ b/media/webrtc/signaling/src/media-conduit/WebrtcOMXH264VideoCodec.cpp
@@ -220,6 +220,30 @@ private:
   bool mEnding;
 };
 
+// Assumption: SPS is first paramset or is not present
+static bool IsParamSets(uint8_t* aData, size_t aSize)
+{
+  MOZ_ASSERT(aData && aSize > sizeof(kNALStartCode));
+  return (aData[sizeof(kNALStartCode)] & 0x1f) == kNALTypeSPS;
+}
+
+// get the length of any pre-pended SPS/PPS's
+static size_t ParamSetLength(uint8_t* aData, size_t aSize)
+{
+  const uint8_t* data = aData;
+  size_t size = aSize;
+  const uint8_t* nalStart = nullptr;
+  size_t nalSize = 0;
+  while (getNextNALUnit(&data, &size, &nalStart, &nalSize, true) == OK) {
+    if ((*nalStart & 0x1f) != kNALTypeSPS &&
+        (*nalStart & 0x1f) != kNALTypePPS) {
+      MOZ_ASSERT(nalStart - sizeof(kNALStartCode) >= aData);
+      return (nalStart - sizeof(kNALStartCode)) - aData; // SPS/PPS/iframe
+    }
+  }
+  return aSize; // it's only SPS/PPS
+}
+
 // H.264 decoder using stagefright.
 // It implements gonk native window callback to receive buffers from
 // MediaCodec::RenderOutputBufferAndRelease().
@@ -619,12 +643,17 @@ protected:
 
     // Conversion to us rounds down, so we need to round up for us->90KHz
     uint32_t target_timestamp = (timeUs * 90ll + 999) / 1000; // us -> 90KHz
-    bool isParamSets = (flags & MediaCodec::BUFFER_FLAG_CODECCONFIG);
+    // 8x10 v2.0 encoder doesn't set this reliably:
+    //bool isParamSets = (flags & MediaCodec::BUFFER_FLAG_CODECCONFIG);
+    // Assume that SPS/PPS will be at the start of any buffer
+    // Assume PPS will not be in a separate buffer - SPS/PPS or SPS/PPS/iframe
+    bool isParamSets = IsParamSets(output.Elements(), output.Length());
     bool isIFrame = (flags & MediaCodec::BUFFER_FLAG_SYNCFRAME);
     CODEC_LOGD("OMX: encoded frame (%d): time %lld (%u), flags x%x",
                output.Length(), timeUs, target_timestamp, flags);
     // Should not be parameter sets and I-frame at the same time.
-    MOZ_ASSERT(!(isParamSets && isIFrame));
+    // Except that it is possible, apparently, after an encoder re-config (bug 1063883)
+    // MOZ_ASSERT(!(isParamSets && isIFrame));
 
     if (mCallback) {
       // Implementation here assumes encoder output to be a buffer containing
@@ -673,15 +702,18 @@ protected:
                  encoded._length, encoded._encodedWidth, encoded._encodedHeight,
                  isParamSets, isIFrame, encoded._timeStamp, encoded.capture_time_ms_);
       // Prepend SPS/PPS to I-frames unless they were sent last time.
-      SendEncodedDataToCallback(encoded, isIFrame && !mIsPrevFrameParamSets);
+      SendEncodedDataToCallback(encoded, isIFrame && !mIsPrevFrameParamSets && !isParamSets);
       // This will be true only for the frame following a paramset block!  So if we're
-      // working with a correct encoder that generates SPS/PPS/IDR always, we
-      // won't try to insert.
-      mIsPrevFrameParamSets = isParamSets;
+      // working with a correct encoder that generates SPS/PPS then iframe always, we
+      // won't try to insert.  (also, don't set if we get SPS/PPS/iframe in one buffer)
+      mIsPrevFrameParamSets = isParamSets && !isIFrame;
       if (isParamSets) {
         // copy off the param sets for inserting later
         mParamSets.Clear();
-        mParamSets.AppendElements(encoded._buffer, encoded._length);
+        // since we may have SPS/PPS or SPS/PPS/iframe
+        size_t length = ParamSetLength(encoded._buffer, encoded._length);
+        MOZ_ASSERT(length > 0);
+        mParamSets.AppendElements(encoded._buffer, length);
       }
     }
 
@@ -700,7 +732,7 @@ private:
 
     if (aPrependParamSets) {
       // Insert current parameter sets in front of the input encoded data.
-      MOZ_ASSERT(mParamSets.Length() > 4); // Start code + ...
+      MOZ_ASSERT(mParamSets.Length() > sizeof(kNALStartCode)); // Start code + ...
       nalu._length = mParamSets.Length();
       nalu._buffer = mParamSets.Elements();
       // Break into NALUs and send.
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp
index 59ee2be0da0..3966c87c597 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionCtx.cpp
@@ -386,9 +386,11 @@ nsresult PeerConnectionCtx::Initialize() {
   //codecMask |= VCM_CODEC_RESOURCE_H263;
 
 #ifdef MOZILLA_INTERNAL_API
+#ifdef MOZ_WEBRTC_OMX
   if (Preferences::GetBool("media.peerconnection.video.h264_enabled")) {
     codecMask |= VCM_CODEC_RESOURCE_H264;
   }
+#endif
 #else
   // Outside MOZILLA_INTERNAL_API ensures H.264 available in unit tests
   codecMask |= VCM_CODEC_RESOURCE_H264;
diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
index f1089e070d1..3630c1c6df1 100644
--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
@@ -727,10 +727,12 @@ PeerConnectionImpl::ConvertRTCConfiguration(const RTCConfiguration& aSrc,
       NS_ConvertUTF16toUTF8 credential(server.mCredential);
       NS_ConvertUTF16toUTF8 username(server.mUsername);
 
-#ifdef MOZ_WIDGET_GONK
-      if (transport == kNrIceTransportTcp)
-          continue;
-#endif
+      // Bug 1039655 - TURN TCP is not e10s ready
+      if ((transport == kNrIceTransportTcp) &&
+          (XRE_GetProcessType() != GeckoProcessType_Default)) {
+        continue;
+      }
+
       if (!aDst->addTurnServer(host.get(), port,
                                username.get(),
                                credential.get(),
diff --git a/media/webrtc/trunk/webrtc/common_types.h b/media/webrtc/trunk/webrtc/common_types.h
index fd03b188327..23a96a9b58d 100644
--- a/media/webrtc/trunk/webrtc/common_types.h
+++ b/media/webrtc/trunk/webrtc/common_types.h
@@ -671,6 +671,8 @@ struct VideoCodec
 
     unsigned short      width;
     unsigned short      height;
+    // width & height modulo resolution_divisor must be 0
+    unsigned char       resolution_divisor;
 
     unsigned int        startBitrate;  // kilobits/sec.
     unsigned int        maxBitrate;  // kilobits/sec.
diff --git a/media/webrtc/trunk/webrtc/modules/video_capture/android/java/src/org/webrtc/videoengine/VideoCaptureAndroid.java b/media/webrtc/trunk/webrtc/modules/video_capture/android/java/src/org/webrtc/videoengine/VideoCaptureAndroid.java
index 9745f2b19a7..38619d55b0f 100644
--- a/media/webrtc/trunk/webrtc/modules/video_capture/android/java/src/org/webrtc/videoengine/VideoCaptureAndroid.java
+++ b/media/webrtc/trunk/webrtc/modules/video_capture/android/java/src/org/webrtc/videoengine/VideoCaptureAndroid.java
@@ -42,7 +42,7 @@ public class VideoCaptureAndroid implements PreviewCallback, Callback, AppStateL
   private final static String TAG = "WEBRTC-JC";
 
   // Only non-null while capturing, accessed exclusively from synchronized methods.
-  /* inner-access */ Camera camera;
+  Camera camera;
   private Camera.CameraInfo info;
   private final int id;
   private final long native_capturer;  // |VideoCaptureAndroid*| in C++.
@@ -55,14 +55,14 @@ public class VideoCaptureAndroid implements PreviewCallback, Callback, AppStateL
   private final int numCaptureBuffers = 3;
 
   // Needed to start/stop/rotate camera.
-  /* inner-access */ volatile int mCaptureRotation;
-  /* inner-access */ int mCaptureWidth;
-  /* inner-access */ int mCaptureHeight;
-  /* inner-access */ int mCaptureMinFPS;
-  /* inner-access */ int mCaptureMaxFPS;
+  volatile int mCaptureRotation;
+  int mCaptureWidth;
+  int mCaptureHeight;
+  int mCaptureMinFPS;
+  int mCaptureMaxFPS;
   // Are we being told to start/stop the camera, or just suspending/resuming
   // due to the application being backgrounded.
-  /* inner-access */ boolean mResumeCapture;
+  boolean mResumeCapture;
 
   @WebRTCJNITarget
   public VideoCaptureAndroid(int id, long native_capturer) {
diff --git a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/codec_database.cc b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/codec_database.cc
index 01514d14c4c..d78d4cf3d4d 100644
--- a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/codec_database.cc
+++ b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/codec_database.cc
@@ -92,6 +92,8 @@ bool VCMCodecDataBase::Codec(int list_id,
       settings->maxFramerate = VCM_DEFAULT_FRAME_RATE;
       settings->width = VCM_DEFAULT_CODEC_WIDTH;
       settings->height = VCM_DEFAULT_CODEC_HEIGHT;
+      // consider using 2 to avoid deal with 'odd' downscales
+      settings->resolution_divisor = 1; // may not actually be needed
       settings->numberOfSimulcastStreams = 0;
       settings->qpMax = 56;
       settings->codecSpecific.VP8.resilience = kResilientStream;
@@ -118,6 +120,7 @@ bool VCMCodecDataBase::Codec(int list_id,
       settings->maxFramerate = VCM_DEFAULT_FRAME_RATE;
       settings->width = VCM_DEFAULT_CODEC_WIDTH;
       settings->height = VCM_DEFAULT_CODEC_HEIGHT;
+      settings->resolution_divisor = 1;
       settings->minBitrate = VCM_MIN_BITRATE;
       settings->numberOfSimulcastStreams = 0;
       return true;
@@ -318,6 +321,7 @@ bool VCMCodecDataBase::RequiresEncoderReset(const VideoCodec& new_send_codec) {
       new_send_codec.plType != send_codec_.plType ||
       new_send_codec.width != send_codec_.width ||
       new_send_codec.height != send_codec_.height ||
+      new_send_codec.resolution_divisor != send_codec_.resolution_divisor ||
       new_send_codec.maxBitrate != send_codec_.maxBitrate ||
       new_send_codec.minBitrate != send_codec_.minBitrate ||
       new_send_codec.qpMax != send_codec_.qpMax ||
diff --git a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.cc b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.cc
index 744374e76ab..57f437e79d8 100644
--- a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.cc
+++ b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.cc
@@ -114,7 +114,7 @@ MediaOptimization::~MediaOptimization(void) {
 }
 
 void MediaOptimization::Reset() {
-  SetEncodingData(kVideoCodecUnknown, 0, 0, 0, 0, 0, 0, max_payload_size_);
+  SetEncodingData(kVideoCodecUnknown, 0, 0, 0, 0, 0, 1, 0, max_payload_size_);
   memset(incoming_frame_times_, -1, sizeof(incoming_frame_times_));
   incoming_frame_rate_ = 0.0;
   frame_dropper_->Reset();
@@ -128,6 +128,8 @@ void MediaOptimization::Reset() {
   target_bit_rate_ = 0;
   codec_width_ = 0;
   codec_height_ = 0;
+  min_width_ = 0;
+  min_height_ = 0;
   user_frame_rate_ = 0;
   key_frame_cnt_ = 0;
   delta_frame_cnt_ = 0;
@@ -138,12 +140,24 @@ void MediaOptimization::Reset() {
   num_layers_ = 1;
 }
 
+// Euclid's algorithm
+// on arm, binary may be faster, but we do this rarely
+static int GreatestCommonDenominator(int a, int b) {
+  while (b != 0) {
+    int t = b;
+    b = a % b;
+    a = t;
+  }
+  return a;
+}
+
 void MediaOptimization::SetEncodingData(VideoCodecType send_codec_type,
                                         int32_t max_bit_rate,
                                         uint32_t frame_rate,
                                         uint32_t target_bitrate,
                                         uint16_t width,
                                         uint16_t height,
+                                        uint8_t  divisor,
                                         int num_layers,
                                         int32_t mtu) {
   // Everything codec specific should be reset here since this means the codec
@@ -167,6 +181,9 @@ void MediaOptimization::SetEncodingData(VideoCodecType send_codec_type,
   user_frame_rate_ = static_cast<float>(frame_rate);
   codec_width_ = width;
   codec_height_ = height;
+  int gcd = GreatestCommonDenominator(codec_width_, codec_height_);
+  min_width_ = gcd ? (codec_width_/gcd * divisor) : 0;
+  min_height_ = gcd ? (codec_height_/gcd * divisor) : 0;
   num_layers_ = (num_layers <= 1) ? 1 : num_layers;  // Can also be zero.
   max_payload_size_ = mtu;
   qm_resolution_->Initialize(target_bitrate_kbps,
@@ -555,13 +572,26 @@ bool MediaOptimization::QMUpdate(
     codec_width_ = qm->codec_width;
     codec_height_ = qm->codec_height;
   }
+  // handle codec limitations on input resolutions
+  if (codec_width_ % min_width_ != 0 || codec_height_ % min_height_ != 0) {
+    // XXX find a better algorithm for selecting sizes
+    // This uses the GCD to find options that meet alignment requirements
+    // (divisor) and at the same time retain the aspect ratio exactly.
+    codec_width_ = ((codec_width_ + min_width_-1)/min_width_)*min_width_;
+    codec_height_ = ((codec_height_ + min_height_-1)/min_height_)*min_height_;
+
+    // to avoid confusion later
+    qm->codec_width = codec_width_;
+    qm->codec_height = codec_height_;
+  }
+
 
   WEBRTC_TRACE(webrtc::kTraceDebug,
                webrtc::kTraceVideoCoding,
                id_,
-               "Resolution change from QM select: W = %d, H = %d, FR = %f",
-               qm->codec_width,
-               qm->codec_height,
+               "Resolution change from QM select: W = %d (%d), H = %d (%d), FR = %f",
+               qm->codec_width, codec_width_,
+               qm->codec_height, codec_height_,
                qm->frame_rate);
 
   // Update VPM with new target frame rate and frame size.
diff --git a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.h b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.h
index a8b14fb84d4..407bf60d6e9 100644
--- a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.h
+++ b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/media_optimization.h
@@ -46,6 +46,7 @@ class MediaOptimization {
                        uint32_t bit_rate,
                        uint16_t width,
                        uint16_t height,
+                       uint8_t divisor,
                        int num_temporal_layers,
                        int32_t mtu);
 
@@ -133,6 +134,8 @@ class MediaOptimization {
   VideoCodecType send_codec_type_;
   uint16_t codec_width_;
   uint16_t codec_height_;
+  uint16_t min_width_;
+  uint16_t min_height_;
   float user_frame_rate_;
   scoped_ptr<FrameDropper> frame_dropper_;
   scoped_ptr<VCMLossProtectionLogic> loss_prot_logic_;
diff --git a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.cc b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.cc
index cd36fc059b1..e0db3272fb3 100644
--- a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.cc
+++ b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.cc
@@ -328,6 +328,8 @@ void VCMQmResolution::UpdateRates(float target_bitrate,
 //    Initialize() state are kept in |down_action_history_|.
 // 4) The total amount of down-sampling (spatial and/or temporal) from the
 //    Initialize() state (native resolution) is limited by various factors.
+// 5) If the codec can't handle arbitrary input resolutions, limit to %16==0
+//    i.e. for h.264
 int VCMQmResolution::SelectResolution(VCMResolutionScale** qm) {
   if (!init_) {
     return VCM_UNINITIALIZED;
diff --git a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.h b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.h
index 6d4aedf69dd..b7266a0d529 100644
--- a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.h
+++ b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/qm_select.h
@@ -42,6 +42,11 @@ struct VCMResolutionScale {
   bool change_resolution_temporal;
 };
 
+// Other possibilities:
+// aspect 1.333*
+// kQQVGA = 160x120
+// k???     192x144
+// k???     256x192 (good step between 320x240 and 160x120)
 enum ImageType {
   kQCIF = 0,            // 176x144
   kHCIF,                // 264x216 = half(~3/4x3/4) CIF.
diff --git a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/video_sender.cc b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/video_sender.cc
index 1ac14c5e5b3..d25a38d1986 100644
--- a/media/webrtc/trunk/webrtc/modules/video_coding/main/source/video_sender.cc
+++ b/media/webrtc/trunk/webrtc/modules/video_coding/main/source/video_sender.cc
@@ -161,6 +161,7 @@ int32_t VideoSender::RegisterSendCodec(const VideoCodec* sendCodec,
                             sendCodec->startBitrate * 1000,
                             sendCodec->width,
                             sendCodec->height,
+                            sendCodec->resolution_divisor,
                             numLayers,
                             maxPayloadSize);
   return VCM_OK;
diff --git a/media/webrtc/trunk/webrtc/modules/video_render/android/java/src/org/webrtc/videoengine/ViEAndroidGLES20.java b/media/webrtc/trunk/webrtc/modules/video_render/android/java/src/org/webrtc/videoengine/ViEAndroidGLES20.java
index e81c91daabf..788c71016db 100644
--- a/media/webrtc/trunk/webrtc/modules/video_render/android/java/src/org/webrtc/videoengine/ViEAndroidGLES20.java
+++ b/media/webrtc/trunk/webrtc/modules/video_render/android/java/src/org/webrtc/videoengine/ViEAndroidGLES20.java
@@ -29,7 +29,7 @@ import org.mozilla.gecko.mozglue.WebRTCJNITarget;
 
 public class ViEAndroidGLES20 extends GLSurfaceView
         implements GLSurfaceView.Renderer {
-    /* inner-access */ static final String TAG = "WEBRTC-JR";
+    static final String TAG = "WEBRTC-JR";
     private static final boolean DEBUG = false;
 
     // True if onSurfaceCreated has been called.
@@ -106,7 +106,7 @@ public class ViEAndroidGLES20 extends GLSurfaceView
         }
     }
 
-    /* inner-access */ static void checkEglError(String prompt, EGL10 egl) {
+    static void checkEglError(String prompt, EGL10 egl) {
         int error;
         while ((error = egl.eglGetError()) != EGL10.EGL_SUCCESS) {
             Log.e(TAG, String.format("%s: EGL error: 0x%x", prompt, error));
diff --git a/memory/replace/dmd/DMD.cpp b/memory/replace/dmd/DMD.cpp
index 6135bc74e0e..909e5baaa12 100644
--- a/memory/replace/dmd/DMD.cpp
+++ b/memory/replace/dmd/DMD.cpp
@@ -195,7 +195,7 @@ MallocSizeOf(const void* aPtr)
   return gMallocTable->malloc_usable_size(const_cast<void*>(aPtr));
 }
 
-static void
+MOZ_EXPORT void
 StatusMsg(const char* aFmt, ...)
 {
   va_list ap;
diff --git a/memory/replace/dmd/DMD.h b/memory/replace/dmd/DMD.h
index 2e14f984b99..f542d352db0 100644
--- a/memory/replace/dmd/DMD.h
+++ b/memory/replace/dmd/DMD.h
@@ -84,6 +84,10 @@ struct Sizes
 MOZ_EXPORT void
 SizeOf(Sizes* aSizes);
 
+// Prints a status message prefixed with "DMD[<pid>]". Use sparingly.
+MOZ_EXPORT void
+StatusMsg(const char* aFmt, ...);
+
 // Indicates whether or not DMD is running.
 MOZ_EXPORT bool
 IsRunning();
diff --git a/mfbt/Assertions.h b/mfbt/Assertions.h
index a463b2768d6..a19a527e574 100644
--- a/mfbt/Assertions.h
+++ b/mfbt/Assertions.h
@@ -332,7 +332,7 @@ struct IsFunction<R(A...)>
 };
 
 template<typename T>
-void ValidateAssertConditionType()
+struct AssertionConditionType
 {
   typedef typename RemoveReference<T>::Type ValueT;
   static_assert(!IsArray<ValueT>::value,
@@ -347,12 +347,15 @@ void ValidateAssertConditionType()
                 "fail. Shouldn't your code gracefully handle this case instead "
                 "of asserting? Anyway, if you really want to do that, write an "
                 "explicit boolean condition, like !!x or x!=0.");
-}
+
+  static const bool isValid = true;
+};
 
 } // namespace detail
 } // namespace mozilla
 #  define MOZ_VALIDATE_ASSERT_CONDITION_TYPE(x) \
-     mozilla::detail::ValidateAssertConditionType<decltype(x)>()
+     static_assert(mozilla::detail::AssertionConditionType<decltype(x)>::isValid, \
+                   "invalid assertion condition")
 #else
 #  define MOZ_VALIDATE_ASSERT_CONDITION_TYPE(x)
 #endif
diff --git a/mfbt/moz.build b/mfbt/moz.build
index b51eac53c0f..8d34e8666a1 100644
--- a/mfbt/moz.build
+++ b/mfbt/moz.build
@@ -72,6 +72,7 @@ EXPORTS.mozilla = [
     'UniquePtr.h',
     'Vector.h',
     'WeakPtr.h',
+    'unused.h',
 ]
 
 if CONFIG['OS_ARCH'] == 'WINNT':
@@ -97,6 +98,7 @@ UNIFIED_SOURCES = [
     'Poison.cpp',
     'SHA1.cpp',
     'TaggedAnonymousMemory.cpp',
+    'unused.cpp',
 ]
 
 DEFINES['IMPL_MFBT'] = True
diff --git a/xpcom/glue/unused.cpp b/mfbt/unused.cpp
similarity index 100%
rename from xpcom/glue/unused.cpp
rename to mfbt/unused.cpp
diff --git a/xpcom/glue/unused.h b/mfbt/unused.h
similarity index 90%
rename from xpcom/glue/unused.h
rename to mfbt/unused.h
index 52ac4a37ee7..443b7024b44 100644
--- a/xpcom/glue/unused.h
+++ b/mfbt/unused.h
@@ -7,7 +7,7 @@
 #ifndef mozilla_unused_h
 #define mozilla_unused_h
 
-#include "nscore.h"
+#include "mozilla/Types.h"
 
 namespace mozilla {
 
@@ -19,7 +19,7 @@ struct unused_t
 {
 };
 
-extern const unused_t unused;
+extern MFBT_DATA const unused_t unused;
 
 template<typename T>
 inline void
diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index 3335e722732..74b7b7d4a9a 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -281,11 +281,7 @@ pref("browser.search.official", true);
 #endif
 
 // Control media casting feature
-#ifdef RELEASE_BUILD
-pref("browser.casting.enabled", false);
-#else
 pref("browser.casting.enabled", true);
-#endif
 
 // Enable sparse localization by setting a few package locale overrides
 pref("chrome.override_package.global", "browser");
@@ -483,7 +479,7 @@ pref("plugin.default.state", 1);
 pref("breakpad.reportURL", "https://crash-stats.mozilla.com/report/index/");
 pref("app.support.baseURL", "http://support.mozilla.org/1/mobile/%VERSION%/%OS%/%LOCALE%/");
 // Used to submit data to input from about:feedback
-pref("app.feedback.postURL", "https://input.mozilla.org/%LOCALE%/feedback");
+pref("app.feedback.postURL", "https://input.mozilla.org/api/v1/feedback/");
 pref("app.privacyURL", "https://www.mozilla.org/privacy/firefox/");
 pref("app.creditsURL", "http://www.mozilla.org/credits/");
 pref("app.channelURL", "http://www.mozilla.org/%LOCALE%/firefox/channel/");
@@ -556,7 +552,7 @@ pref("app.update.enabled", false);
 pref("app.update.channel", "@MOZ_UPDATE_CHANNEL@");
 
 // If you are looking for app.update.url, we no longer use it.
-// See mobile/android/base/UpdateServiceHelper.java.in
+// See mobile/android/base/updater/UpdateServiceHelper.java
 #endif
 
 // replace newlines with spaces on paste into single-line text boxes
diff --git a/mobile/android/base/AppConstants.java.in b/mobile/android/base/AppConstants.java.in
index 8ab98aadc20..ffea6474f67 100644
--- a/mobile/android/base/AppConstants.java.in
+++ b/mobile/android/base/AppConstants.java.in
@@ -137,6 +137,17 @@ public class AppConstants {
     null;
 #endif
 
+    /**
+     * Whether this APK was built with constrained resources --
+     * no xhdpi+ images, for example.
+     */
+    public static final boolean MOZ_ANDROID_RESOURCE_CONSTRAINED =
+#ifdef MOZ_ANDROID_RESOURCE_CONSTRAINED
+    true;
+#else
+    false;
+#endif
+
     public static final boolean MOZ_SERVICES_HEALTHREPORT =
 #ifdef MOZ_SERVICES_HEALTHREPORT
     true;
diff --git a/mobile/android/base/Assert.java b/mobile/android/base/Assert.java
index 6c14da1b24b..5c10eea77c2 100644
--- a/mobile/android/base/Assert.java
+++ b/mobile/android/base/Assert.java
@@ -1,41 +1,84 @@
 package org.mozilla.gecko;
 
-public class Assert
-{
+/**
+ * Static helper class to provide debug assertions for Java.
+ *
+ * Used in preference to JSR 41 assertions due to their difficulty of use on Android and their
+ * poor behaviour w.r.t bytecode bloat (and to a lesser extent, runtime performance when disabled)
+ *
+ * Calls to methods in this class will be stripped by Proguard for release builds, so may be used
+ * arbitrarily liberally at zero cost.
+ * Under no circumstances should the argument expressions to methods in this class have side effects
+ * relevant to the correctness of execution of the program. Such side effects shall not be checked
+ * for when stripping assertions.
+ */
+public class Assert {
+    // Static helper class.
     private Assert() {}
 
-    public static void equals(Object a, Object b)
-    {
-        equals(a, b, null);
+    /**
+     * Verify that two objects are equal according to their equals method.
+     */
+    public static void equal(Object a, Object b) {
+        equal(a, b, "Assertion failure: !" + a + ".equals(" + b + ')');
+    }
+    public static void equal(Object a, Object b, String message) {
+        isTrue(a.equals(b), message);
     }
 
-    public static void equals(Object a, Object b, String message)
-    {
-        Assert.isTrue(a.equals(b), message);
-    }
-
-    public static void isTrue(boolean a)
-    {
+    /**
+     * Verify that an arbitrary boolean expression is true.
+     */
+    public static void isTrue(boolean a) {
         isTrue(a, null);
     }
-
-    public static void isTrue(boolean a, String message)
-    {
-        if (!AppConstants.DEBUG_BUILD) {
-            return;
-        }
-
+    public static void isTrue(boolean a, String message)  {
         if (!a) {
-            throw new AssertException(message);
+            throw new AssertionError(message);
         }
     }
 
-    public static class AssertException extends RuntimeException
-    {
-        private static final long serialVersionUID = 0L;
-
-        public AssertException(String message) {
-            super(message);
+    /**
+     * Verify that an arbitrary boolean expression is false.
+     */
+    public static void isFalse(boolean a) {
+        isTrue(a, null);
+    }
+    public static void isFalse(boolean a, String message)  {
+        if (a) {
+            throw new AssertionError(message);
         }
     }
-}
\ No newline at end of file
+
+    /**
+     * Verify that a given object is null.
+     */
+    public static void isNull(Object o) {
+        isNull(o, "Assertion failure: " + o + " must be null!");
+    }
+    public static void isNull(Object o, String message) {
+        isTrue(o == null, message);
+    }
+
+    /**
+     * Verify that a given object is non-null.
+     */
+    public static void isNotNull(Object o) {
+        isNotNull(o, "Assertion failure: " + o + " cannot be null!");
+    }
+    public static void isNotNull(Object o, String message) {
+        isTrue(o != null, message);
+    }
+
+    /**
+     * Fail. Should be used whenever an impossible state is encountered (such as the default branch
+     * of a switch over all possible values of an enum: such an assertion may save future developers
+     * time when they try to add new states)
+     */
+    public static void fail() {
+        isTrue(false);
+    }
+    public static void fail(String message) {
+        isTrue(false, message);
+    }
+}
diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 89f503eebf1..7d22181ffd6 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -486,7 +486,7 @@ public class BrowserApp extends GeckoApp
         (new UIAsyncTask.WithoutParams<String>(ThreadUtils.getBackgroundHandler()) {
             @Override
             public String doInBackground() {
-                return Favicons.getFaviconURLForPageURL(url);
+                return Favicons.getFaviconURLForPageURL(getContext(), url);
             }
 
             @Override
@@ -958,11 +958,13 @@ public class BrowserApp extends GeckoApp
             }
 
             final OnFaviconLoadedListener listener = new GeckoAppShell.CreateShortcutFaviconLoadedListener(url, title);
-            Favicons.getSizedFavicon(url,
-                    tab.getFaviconURL(),
-                    Integer.MAX_VALUE,
-                    LoadFaviconTask.FLAG_PERSIST,
-                    listener);
+            Favicons.getSizedFavicon(getContext(),
+                                     url,
+                                     tab.getFaviconURL(),
+                                     Integer.MAX_VALUE,
+                                     LoadFaviconTask.FLAG_PERSIST,
+                                     listener);
+
             return true;
         }
 
@@ -1759,7 +1761,7 @@ public class BrowserApp extends GeckoApp
         final int tabFaviconSize = getResources().getDimensionPixelSize(R.dimen.browser_toolbar_favicon_size);
 
         int flags = (tab.isPrivate() || tab.getErrorType() != Tab.ErrorType.NONE) ? 0 : LoadFaviconTask.FLAG_PERSIST;
-        int id = Favicons.getSizedFavicon(tab.getURL(), tab.getFaviconURL(), tabFaviconSize, flags, sFaviconLoadedListener);
+        int id = Favicons.getSizedFavicon(getContext(), tab.getURL(), tab.getFaviconURL(), tabFaviconSize, flags, sFaviconLoadedListener);
 
         tab.setFaviconLoadId(id);
     }
@@ -2284,8 +2286,13 @@ public class BrowserApp extends GeckoApp
         if (info.parent == 0) {
             destination = menu;
         } else if (info.parent == GECKO_TOOLS_MENU) {
-            MenuItem tools = menu.findItem(R.id.tools);
-            destination = tools != null ? tools.getSubMenu() : menu;
+            // The tools menu only exists in our -v11 resources.
+            if (Versions.feature11Plus) {
+                MenuItem tools = menu.findItem(R.id.tools);
+                destination = tools != null ? tools.getSubMenu() : menu;
+            } else {
+                destination = menu;
+            }
         } else {
             MenuItem parent = menu.findItem(info.parent);
             if (parent == null) {
@@ -2533,8 +2540,11 @@ public class BrowserApp extends GeckoApp
             findInPage.setEnabled(false);
 
             // NOTE: Use MenuUtils.safeSetEnabled because some actions might
-            // be on the BrowserToolbar context menu
-            MenuUtils.safeSetEnabled(aMenu, R.id.page, false);
+            // be on the BrowserToolbar context menu.
+            if (Versions.feature11Plus) {
+                // There is no page menu prior to v11 resources.
+                MenuUtils.safeSetEnabled(aMenu, R.id.page, false);
+            }
             MenuUtils.safeSetEnabled(aMenu, R.id.subscribe, false);
             MenuUtils.safeSetEnabled(aMenu, R.id.add_search_engine, false);
             MenuUtils.safeSetEnabled(aMenu, R.id.site_settings, false);
@@ -2571,8 +2581,10 @@ public class BrowserApp extends GeckoApp
         MenuUtils.safeSetEnabled(aMenu, R.id.downloads, !inGuestMode);
 
         // NOTE: Use MenuUtils.safeSetEnabled because some actions might
-        // be on the BrowserToolbar context menu
-        MenuUtils.safeSetEnabled(aMenu, R.id.page, !isAboutHome(tab));
+        // be on the BrowserToolbar context menu.
+        if (Versions.feature11Plus) {
+            MenuUtils.safeSetEnabled(aMenu, R.id.page, !isAboutHome(tab));
+        }
         MenuUtils.safeSetEnabled(aMenu, R.id.subscribe, tab.hasFeeds());
         MenuUtils.safeSetEnabled(aMenu, R.id.add_search_engine, tab.hasOpenSearch());
         MenuUtils.safeSetEnabled(aMenu, R.id.site_settings, !isAboutHome(tab));
diff --git a/mobile/android/base/BrowserLocaleManager.java b/mobile/android/base/BrowserLocaleManager.java
index 23ac49ce2df..8194301508a 100644
--- a/mobile/android/base/BrowserLocaleManager.java
+++ b/mobile/android/base/BrowserLocaleManager.java
@@ -79,6 +79,32 @@ public class BrowserLocaleManager implements LocaleManager {
         return AppConstants.MOZ_LOCALE_SWITCHER;
     }
 
+    /**
+     * Sometimes we want just the language for a locale, not the entire
+     * language tag. But Java's .getLanguage method is wrong.
+     *
+     * This method is equivalent to the first part of {@link #getLanguageTag(Locale)}.
+     *
+     * @return a language string, such as "he" for the Hebrew locales.
+     */
+    public static String getLanguage(final Locale locale) {
+        final String language = locale.getLanguage();  // Can, but should never be, an empty string.
+        // Modernize certain language codes.
+        if (language.equals("iw")) {
+            return "he";
+        }
+
+        if (language.equals("in")) {
+            return "id";
+        }
+
+        if (language.equals("ji")) {
+            return "yi";
+        }
+
+        return language;
+    }
+
     /**
      * Gecko uses locale codes like "es-ES", whereas a Java {@link Locale}
      * stringifies as "es_ES".
@@ -91,17 +117,8 @@ public class BrowserLocaleManager implements LocaleManager {
         // If this were Java 7:
         // return locale.toLanguageTag();
 
-        String language = locale.getLanguage();  // Can, but should never be, an empty string.
-        // Modernize certain language codes.
-        if (language.equals("iw")) {
-            language = "he";
-        } else if (language.equals("in")) {
-            language = "id";
-        } else if (language.equals("ji")) {
-            language = "yi";
-        }
-
-        String country = locale.getCountry();    // Can be an empty string.
+        final String language = getLanguage(locale);
+        final String country = locale.getCountry();    // Can be an empty string.
         if (country.equals("")) {
             return language;
         }
diff --git a/mobile/android/base/FilePickerResultHandler.java b/mobile/android/base/FilePickerResultHandler.java
index 00b9db178fe..6d43bb234ed 100644
--- a/mobile/android/base/FilePickerResultHandler.java
+++ b/mobile/android/base/FilePickerResultHandler.java
@@ -173,7 +173,7 @@ class FilePickerResultHandler implements ActivityResultHandler {
         private final Uri uri;
         private final File cacheDir;
         private final int tabId;
-        /* inner-access */ String tempFile;
+        String tempFile;
 
         public FileLoaderCallbacks(Uri uri, File cacheDir, int tabId) {
             this.uri = uri;
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index 840dffd9861..36bdfc785ae 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -45,6 +45,7 @@ import org.mozilla.gecko.mozglue.GeckoLoader;
 import org.mozilla.gecko.preferences.ClearOnShutdownPref;
 import org.mozilla.gecko.preferences.GeckoPreferences;
 import org.mozilla.gecko.prompts.PromptService;
+import org.mozilla.gecko.SmsManager;
 import org.mozilla.gecko.updater.UpdateService;
 import org.mozilla.gecko.updater.UpdateServiceHelper;
 import org.mozilla.gecko.util.ActivityResultHandler;
@@ -1190,7 +1191,7 @@ public abstract class GeckoApp
 
         Tabs.getInstance().attachToContext(this);
         try {
-            Favicons.attachToContext(this);
+            Favicons.initializeWithContext(this);
         } catch (Exception e) {
             Log.e(LOGTAG, "Exception starting favicon cache. Corrupt resources?", e);
         }
@@ -1544,9 +1545,8 @@ public abstract class GeckoApp
             mWebappEventListener.registerEvents();
         }
 
-
-        if (SmsManager.getInstance() != null) {
-          SmsManager.getInstance().start();
+        if (SmsManager.isEnabled()) {
+            SmsManager.getInstance().start();
         }
 
         mContactService = new ContactService(EventDispatcher.getInstance(), this);
@@ -2079,10 +2079,11 @@ public abstract class GeckoApp
         IntentHelper.destroy();
         GeckoNetworkManager.destroy();
 
-        if (SmsManager.getInstance() != null) {
+        if (SmsManager.isEnabled()) {
             SmsManager.getInstance().stop();
-            if (isFinishing())
+            if (isFinishing()) {
                 SmsManager.getInstance().shutdown();
+            }
         }
 
         final HealthRecorder rec = mHealthRecorder;
diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index a7156e0d43b..a324fce751f 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -48,6 +48,7 @@ import org.mozilla.gecko.mozglue.RobocopTarget;
 import org.mozilla.gecko.mozglue.generatorannotations.OptionalGeneratedParameter;
 import org.mozilla.gecko.mozglue.generatorannotations.WrapElementForJNI;
 import org.mozilla.gecko.prompts.PromptService;
+import org.mozilla.gecko.SmsManager;
 import org.mozilla.gecko.util.EventCallback;
 import org.mozilla.gecko.util.GeckoRequest;
 import org.mozilla.gecko.util.HardwareUtils;
@@ -2352,7 +2353,7 @@ public class GeckoAppShell
      */
     @WrapElementForJNI(stubName = "SendMessageWrapper")
     public static void sendMessage(String aNumber, String aMessage, int aRequestId) {
-        if (SmsManager.getInstance() == null) {
+        if (!SmsManager.isEnabled()) {
             return;
         }
 
@@ -2361,7 +2362,7 @@ public class GeckoAppShell
 
     @WrapElementForJNI(stubName = "GetMessageWrapper")
     public static void getMessage(int aMessageId, int aRequestId) {
-        if (SmsManager.getInstance() == null) {
+        if (!SmsManager.isEnabled()) {
             return;
         }
 
@@ -2370,7 +2371,7 @@ public class GeckoAppShell
 
     @WrapElementForJNI(stubName = "DeleteMessageWrapper")
     public static void deleteMessage(int aMessageId, int aRequestId) {
-        if (SmsManager.getInstance() == null) {
+        if (!SmsManager.isEnabled()) {
             return;
         }
 
@@ -2379,7 +2380,7 @@ public class GeckoAppShell
 
     @WrapElementForJNI(stubName = "CreateMessageListWrapper")
     public static void createMessageList(long aStartDate, long aEndDate, String[] aNumbers, int aNumbersCount, String aDelivery, boolean aHasRead, boolean aRead, long aThreadId, boolean aReverse, int aRequestId) {
-        if (SmsManager.getInstance() == null) {
+        if (!SmsManager.isEnabled()) {
             return;
         }
 
@@ -2388,7 +2389,7 @@ public class GeckoAppShell
 
     @WrapElementForJNI(stubName = "GetNextMessageInListWrapper")
     public static void getNextMessageInList(int aListId, int aRequestId) {
-        if (SmsManager.getInstance() == null) {
+        if (!SmsManager.isEnabled()) {
             return;
         }
 
@@ -2397,7 +2398,7 @@ public class GeckoAppShell
 
     @WrapElementForJNI
     public static void clearMessageList(int aListId) {
-        if (SmsManager.getInstance() == null) {
+        if (!SmsManager.isEnabled()) {
             return;
         }
 
diff --git a/mobile/android/base/GeckoEditable.java b/mobile/android/base/GeckoEditable.java
index ff2cf20802d..43df5f1a582 100644
--- a/mobile/android/base/GeckoEditable.java
+++ b/mobile/android/base/GeckoEditable.java
@@ -5,6 +5,7 @@
 
 package org.mozilla.gecko;
 
+import java.lang.reflect.Array;
 import java.lang.reflect.Field;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.InvocationTargetException;
@@ -37,39 +38,6 @@ import android.util.Log;
 import android.view.KeyCharacterMap;
 import android.view.KeyEvent;
 
-// interface for the IC thread
-interface GeckoEditableClient {
-    void sendEvent(GeckoEvent event);
-    Editable getEditable();
-    void setUpdateGecko(boolean update);
-    void setSuppressKeyUp(boolean suppress);
-    Handler getInputConnectionHandler();
-    boolean setInputConnectionHandler(Handler handler);
-}
-
-/* interface for the Editable to listen to the Gecko thread
-   and also for the IC thread to listen to the Editable */
-interface GeckoEditableListener {
-    // IME notification type for notifyIME(), corresponding to NotificationToIME enum in Gecko
-    final int NOTIFY_IME_OPEN_VKB = -2;
-    final int NOTIFY_IME_REPLY_EVENT = -1;
-    final int NOTIFY_IME_OF_FOCUS = 1;
-    final int NOTIFY_IME_OF_BLUR = 2;
-    final int NOTIFY_IME_TO_COMMIT_COMPOSITION = 8;
-    final int NOTIFY_IME_TO_CANCEL_COMPOSITION = 9;
-    // IME enabled state for notifyIMEContext()
-    final int IME_STATE_DISABLED = 0;
-    final int IME_STATE_ENABLED = 1;
-    final int IME_STATE_PASSWORD = 2;
-    final int IME_STATE_PLUGIN = 3;
-
-    void notifyIME(int type);
-    void notifyIMEContext(int state, String typeHint,
-                          String modeHint, String actionHint);
-    void onSelectionChange(int start, int end);
-    void onTextChange(CharSequence text, int start, int oldEnd, int newEnd);
-}
-
 /*
    GeckoEditable implements only some functions of Editable
    The field mText contains the actual underlying
@@ -1004,12 +972,12 @@ final class GeckoEditable
         } else if (Proxy.isProxyClass(obj.getClass())) {
             debugAppend(sb, Proxy.getInvocationHandler(obj));
         } else if (obj instanceof CharSequence) {
-            sb.append("\"").append(obj.toString().replace('\n', '\u21b2')).append("\"");
+            sb.append('"').append(obj.toString().replace('\n', '\u21b2')).append('"');
         } else if (obj.getClass().isArray()) {
-            sb.append(obj.getClass().getComponentType().getSimpleName()).append("[")
-              .append(java.lang.reflect.Array.getLength(obj)).append("]");
+            sb.append(obj.getClass().getComponentType().getSimpleName()).append('[')
+              .append(Array.getLength(obj)).append(']');
         } else {
-            sb.append(obj.toString());
+            sb.append(obj);
         }
         return sb;
     }
diff --git a/mobile/android/base/GeckoEditableClient.java b/mobile/android/base/GeckoEditableClient.java
new file mode 100644
index 00000000000..2a770826222
--- /dev/null
+++ b/mobile/android/base/GeckoEditableClient.java
@@ -0,0 +1,21 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import android.os.Handler;
+import android.text.Editable;
+
+/**
+ * Interface for the IC thread.
+ */
+interface GeckoEditableClient {
+    void sendEvent(GeckoEvent event);
+    Editable getEditable();
+    void setUpdateGecko(boolean update);
+    void setSuppressKeyUp(boolean suppress);
+    Handler getInputConnectionHandler();
+    boolean setInputConnectionHandler(Handler handler);
+}
diff --git a/mobile/android/base/GeckoEditableListener.java b/mobile/android/base/GeckoEditableListener.java
new file mode 100644
index 00000000000..f8b9daa5b78
--- /dev/null
+++ b/mobile/android/base/GeckoEditableListener.java
@@ -0,0 +1,30 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+/**
+ * Interface for the Editable to listen on the Gecko thread, as well as for the IC thread to listen
+ * to the Editable.
+ */
+interface GeckoEditableListener {
+    // IME notification type for notifyIME(), corresponding to NotificationToIME enum in Gecko
+    int NOTIFY_IME_OPEN_VKB = -2;
+    int NOTIFY_IME_REPLY_EVENT = -1;
+    int NOTIFY_IME_OF_FOCUS = 1;
+    int NOTIFY_IME_OF_BLUR = 2;
+    int NOTIFY_IME_TO_COMMIT_COMPOSITION = 8;
+    int NOTIFY_IME_TO_CANCEL_COMPOSITION = 9;
+    // IME enabled state for notifyIMEContext()
+    int IME_STATE_DISABLED = 0;
+    int IME_STATE_ENABLED = 1;
+    int IME_STATE_PASSWORD = 2;
+    int IME_STATE_PLUGIN = 3;
+
+    void notifyIME(int type);
+    void notifyIMEContext(int state, String typeHint, String modeHint, String actionHint);
+    void onSelectionChange(int start, int end);
+    void onTextChange(CharSequence text, int start, int oldEnd, int newEnd);
+}
diff --git a/mobile/android/base/GeckoInputConnection.java b/mobile/android/base/GeckoInputConnection.java
index a6e56d4e854..7c9227d31aa 100644
--- a/mobile/android/base/GeckoInputConnection.java
+++ b/mobile/android/base/GeckoInputConnection.java
@@ -1007,7 +1007,7 @@ final class DebugGeckoInputConnection
 
     public static GeckoEditableListener create(View targetView,
                                                GeckoEditableClient editable) {
-        final Class[] PROXY_INTERFACES = { InputConnection.class,
+        final Class<?>[] PROXY_INTERFACES = { InputConnection.class,
                 InputConnectionHandler.class,
                 GeckoEditableListener.class };
         DebugGeckoInputConnection dgic =
diff --git a/mobile/android/base/GeckoMediaPlayer.java b/mobile/android/base/GeckoMediaPlayer.java
new file mode 100644
index 00000000000..48f9d7f7fca
--- /dev/null
+++ b/mobile/android/base/GeckoMediaPlayer.java
@@ -0,0 +1,22 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko;
+
+import org.json.JSONObject;
+import org.mozilla.gecko.util.EventCallback;
+
+/* Wrapper for MediaRouter types supported by Android, such as Chromecast, Miracast, etc. */
+interface GeckoMediaPlayer {
+    JSONObject toJSON();
+    void load(String title, String url, String type, EventCallback callback);
+    void play(EventCallback callback);
+    void pause(EventCallback callback);
+    void stop(EventCallback callback);
+    void start(EventCallback callback);
+    void end(EventCallback callback);
+    void mirror(EventCallback callback);
+    void message(String message, EventCallback callback);
+}
diff --git a/mobile/android/base/GeckoSmsManager.java b/mobile/android/base/GeckoSmsManager.java
index f48eb8592aa..d7715bb5845 100644
--- a/mobile/android/base/GeckoSmsManager.java
+++ b/mobile/android/base/GeckoSmsManager.java
@@ -24,20 +24,10 @@ import android.telephony.SmsMessage;
 import android.util.Log;
 
 import static android.telephony.SmsMessage.MessageClass;
+import static org.mozilla.gecko.SmsManager.ISmsManager;
 
 import java.util.ArrayList;
-
-/**
- * This class is returning unique ids for PendingIntent requestCode attribute.
- * There are only |Integer.MAX_VALUE - Integer.MIN_VALUE| unique IDs available,
- * and they wrap around.
- */
-class PendingIntentUID
-{
-  static private int sUID = Integer.MIN_VALUE;
-
-  static public int generate() { return sUID++; }
-}
+import java.util.concurrent.atomic.AtomicInteger;
 
 /**
  * The envelope class contains all information that are needed to keep track of
@@ -76,7 +66,7 @@ class Envelope
     mMessageId = -1;
     mError = GeckoSmsManager.kNoError;
 
-    int size = Envelope.SubParts.values().length;
+    int size = SubParts.values().length;
     mRemainingParts = new int[size];
     mFailing = new boolean[size];
 
@@ -86,7 +76,7 @@ class Envelope
     }
   }
 
-  public void decreaseRemainingParts(Envelope.SubParts aType) {
+  public void decreaseRemainingParts(SubParts aType) {
     --mRemainingParts[aType.ordinal()];
 
     if (mRemainingParts[SubParts.SENT_PART.ordinal()] >
@@ -95,15 +85,15 @@ class Envelope
     }
   }
 
-  public boolean arePartsRemaining(Envelope.SubParts aType) {
+  public boolean arePartsRemaining(SubParts aType) {
     return mRemainingParts[aType.ordinal()] != 0;
   }
 
-  public void markAsFailed(Envelope.SubParts aType) {
+  public void markAsFailed(SubParts aType) {
     mFailing[aType.ordinal()] = true;
   }
 
-  public boolean isFailing(Envelope.SubParts aType) {
+  public boolean isFailing(SubParts aType) {
     return mFailing[aType.ordinal()];
   }
 
@@ -141,7 +131,7 @@ class Postman
 
   private static final Postman sInstance = new Postman();
 
-  private ArrayList<Envelope> mEnvelopes = new ArrayList<Envelope>(1);
+  private final ArrayList<Envelope> mEnvelopes = new ArrayList<>(1);
 
   private Postman() {}
 
@@ -224,7 +214,7 @@ class MessagesListManager
     return sInstance;
   }
 
-  private ArrayList<Cursor> mCursors = new ArrayList<Cursor>(0);
+  private final ArrayList<Cursor> mCursors = new ArrayList<>();
 
   public int add(Cursor aCursor) {
     int size = mCursors.size();
@@ -355,7 +345,13 @@ public class GeckoSmsManager
   private final static int kMessageClassClass2  = 3;
   private final static int kMessageClassClass3  = 4;
 
-  private final static String[] kRequiredMessageRows = new String[] { "_id", "address", "body", "date", "type", "status" };
+  private final static String[] kRequiredMessageRows = { "_id", "address", "body", "date", "type", "status" };
+
+  // Used to generate monotonically increasing GUIDs.
+  private static final AtomicInteger pendingIntentGuid = new AtomicInteger(Integer.MIN_VALUE);
+
+  // The maximum value of a 32 bit signed integer. Used to enforce a limit on ids.
+  private static final long UNSIGNED_INTEGER_MAX_VALUE = Integer.MAX_VALUE * 2L + 1L;
 
   public GeckoSmsManager() {
     SmsIOThread.getInstance().start();
@@ -364,9 +360,9 @@ public class GeckoSmsManager
   @Override
   public void start() {
     IntentFilter smsFilter = new IntentFilter();
-    smsFilter.addAction(GeckoSmsManager.ACTION_SMS_RECEIVED);
-    smsFilter.addAction(GeckoSmsManager.ACTION_SMS_SENT);
-    smsFilter.addAction(GeckoSmsManager.ACTION_SMS_DELIVERED);
+    smsFilter.addAction(ACTION_SMS_RECEIVED);
+    smsFilter.addAction(ACTION_SMS_SENT);
+    smsFilter.addAction(ACTION_SMS_DELIVERED);
 
     GeckoAppShell.getContext().registerReceiver(this, smsFilter);
   }
@@ -490,8 +486,6 @@ public class GeckoSmsManager
           !envelope.arePartsRemaining(Envelope.SubParts.DELIVERED_PART)) {
         postman.destroyEnvelope(envelopeId);
       }
-
-      return;
     }
   }
 
@@ -530,12 +524,12 @@ public class GeckoSmsManager
          */
         PendingIntent sentPendingIntent =
           PendingIntent.getBroadcast(GeckoAppShell.getContext(),
-                                     PendingIntentUID.generate(), sentIntent,
+                                     pendingIntentGuid.incrementAndGet(), sentIntent,
                                      PendingIntent.FLAG_CANCEL_CURRENT);
 
         PendingIntent deliveredPendingIntent =
           PendingIntent.getBroadcast(GeckoAppShell.getContext(),
-                                     PendingIntentUID.generate(), deliveredIntent,
+                                     pendingIntentGuid.incrementAndGet(), deliveredIntent,
                                      PendingIntent.FLAG_CANCEL_CURRENT);
 
         sm.sendTextMessage(aNumber, "", aMessage,
@@ -556,13 +550,13 @@ public class GeckoSmsManager
         for (int i=0; i<parts.size(); ++i) {
           sentPendingIntents.add(
             PendingIntent.getBroadcast(GeckoAppShell.getContext(),
-                                       PendingIntentUID.generate(), sentIntent,
+                                       pendingIntentGuid.incrementAndGet(), sentIntent,
                                        PendingIntent.FLAG_CANCEL_CURRENT)
           );
 
           deliveredPendingIntents.add(
             PendingIntent.getBroadcast(GeckoAppShell.getContext(),
-                                       PendingIntentUID.generate(), deliveredIntent,
+                                       pendingIntentGuid.incrementAndGet(), deliveredIntent,
                                        PendingIntent.FLAG_CANCEL_CURRENT)
           );
         }
@@ -597,7 +591,7 @@ public class GeckoSmsManager
 
       // The DOM API takes a 32bits unsigned int for the id. It's unlikely that
       // we happen to need more than that but it doesn't cost to check.
-      if (id > Integer.MAX_VALUE) {
+      if (id > UNSIGNED_INTEGER_MAX_VALUE) {
         throw new IdTooHighException();
       }
 
@@ -614,8 +608,8 @@ public class GeckoSmsManager
   @Override
   public void getMessage(int aMessageId, int aRequestId) {
     class GetMessageRunnable implements Runnable {
-      private int mMessageId;
-      private int mRequestId;
+      private final int mMessageId;
+      private final int mRequestId;
 
       GetMessageRunnable(int aMessageId, int aRequestId) {
         mMessageId = aMessageId;
@@ -699,8 +693,8 @@ public class GeckoSmsManager
   @Override
   public void deleteMessage(int aMessageId, int aRequestId) {
     class DeleteMessageRunnable implements Runnable {
-      private int mMessageId;
-      private int mRequestId;
+      private final int mMessageId;
+      private final int mRequestId;
 
       DeleteMessageRunnable(int aMessageId, int aRequestId) {
         mMessageId = aMessageId;
@@ -739,13 +733,13 @@ public class GeckoSmsManager
   @Override
   public void createMessageList(long aStartDate, long aEndDate, String[] aNumbers, int aNumbersCount, String aDelivery, boolean aHasRead, boolean aRead, long aThreadId, boolean aReverse, int aRequestId) {
     class CreateMessageListRunnable implements Runnable {
-      private long     mStartDate;
-      private long     mEndDate;
-      private String[] mNumbers;
-      private int      mNumbersCount;
-      private String   mDelivery;
-      private boolean  mReverse;
-      private int      mRequestId;
+      private final long     mStartDate;
+      private final long     mEndDate;
+      private final String[] mNumbers;
+      private final int      mNumbersCount;
+      private final String   mDelivery;
+      private final boolean  mReverse;
+      private final int      mRequestId;
 
       CreateMessageListRunnable(long aStartDate, long aEndDate, String[] aNumbers, int aNumbersCount, String aDelivery, boolean aHasRead, boolean aRead, long aThreadId, boolean aReverse, int aRequestId) {
         mStartDate = aStartDate;
@@ -775,34 +769,38 @@ public class GeckoSmsManager
           }
 
           if (mNumbersCount > 0) {
-            String numberRestriction = "address IN ('" + mNumbers[0] + "'";
+            final StringBuilder numberRestriction = new StringBuilder("address IN ('");
+            numberRestriction.append(mNumbers[0]).append("'");
 
             for (int i=1; i<mNumbersCount; ++i) {
-              numberRestriction += ", '" + mNumbers[i] + "'";
+              numberRestriction.append(", '").append(mNumbers[i]).append("'");
             }
-            numberRestriction += ")";
+            numberRestriction.append(')');
 
-            restrictions.add(numberRestriction);
+            restrictions.add(numberRestriction.toString());
           }
 
           if (mDelivery == null) {
             restrictions.add("type IN ('" + kSmsTypeSentbox + "', '" + kSmsTypeInbox + "')");
-          } else if (mDelivery == "sent") {
+          } else if (mDelivery.equals("sent")) {
             restrictions.add("type = " + kSmsTypeSentbox);
-          } else if (mDelivery == "received") {
+          } else if (mDelivery.equals("received")) {
             restrictions.add("type = " + kSmsTypeInbox);
           } else {
             throw new UnexpectedDeliveryStateException();
           }
 
-          String restrictionText = restrictions.size() > 0 ? restrictions.get(0) : "";
+          final StringBuilder restrictionText = new StringBuilder();
+          if (!restrictions.isEmpty()) {
+            restrictionText.append(restrictions.get(0));
+          }
 
           for (int i=1; i<restrictions.size(); ++i) {
-            restrictionText += " AND " + restrictions.get(i);
+            restrictionText.append(" AND ").append(restrictions.get(i));
           }
 
           ContentResolver cr = GeckoAppShell.getContext().getContentResolver();
-          cursor = cr.query(kSmsContentUri, kRequiredMessageRows, restrictionText, null,
+          cursor = cr.query(kSmsContentUri, kRequiredMessageRows, restrictionText.toString(), null,
                             mReverse ? "date DESC" : "date ASC");
 
           if (cursor.getCount() == 0) {
@@ -862,8 +860,8 @@ public class GeckoSmsManager
   @Override
   public void getNextMessageInList(int aListId, int aRequestId) {
     class GetNextMessageInListRunnable implements Runnable {
-      private int mListId;
-      private int mRequestId;
+      private final int mListId;
+      private final int mRequestId;
 
       GetNextMessageInListRunnable(int aListId, int aRequestId) {
         mListId = aListId;
@@ -963,27 +961,27 @@ public class GeckoSmsManager
     }
   }
 
-  class IdTooHighException extends Exception {
+  static class IdTooHighException extends Exception {
     private static final long serialVersionUID = 29935575131092050L;
   }
 
-  class InvalidTypeException extends Exception {
+  static class InvalidTypeException extends Exception {
     private static final long serialVersionUID = 47436856832535912L;
   }
 
-  class NotFoundException extends Exception {
+  static class NotFoundException extends Exception {
     private static final long serialVersionUID = 1940676816633984L;
   }
 
-  class TooManyResultsException extends Exception {
+  static class TooManyResultsException extends Exception {
     private static final long serialVersionUID = 51883196784325305L;
   }
 
-  class UnexpectedDeliveryStateException extends Exception {
+  static class UnexpectedDeliveryStateException extends Exception {
     private static final long serialVersionUID = 494122763684005716L;
   }
 
-  class UnmatchingIdException extends Exception {
+  static class UnmatchingIdException extends Exception {
     private static final long serialVersionUID = 158467542575633280L;
   }
 
diff --git a/mobile/android/base/LightweightTheme.java b/mobile/android/base/LightweightTheme.java
index 13933a7150a..02bb7dd7680 100644
--- a/mobile/android/base/LightweightTheme.java
+++ b/mobile/android/base/LightweightTheme.java
@@ -35,7 +35,7 @@ public class LightweightTheme implements GeckoEventListener {
     private static final String LOGTAG = "GeckoLightweightTheme";
 
     private final Application mApplication;
-    /* inner-access */ final Handler mHandler;
+    final Handler mHandler;
 
     private Bitmap mBitmap;
     private int mColor;
diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index b9ffeabd4b6..d9807b389ff 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -353,12 +353,14 @@ extra_packages := $(subst $(NULL) ,:,$(strip $(extra_packages)))
 # are fresher than the target, preventing a subsequent invocation from
 # thinking aapt's outputs are stale.  This is safe because Make
 # removes the target file if any recipe command fails.
+
 define aapt_command
 $(1): $$(call mkdir_deps,$(filter-out ./,$(dir $(3) $(4) $(5)))) $(2)
 	@$$(TOUCH) $$@
 	$$(AAPT) package -f -m \
 		-M AndroidManifest.xml \
 		-I $(ANDROID_SDK)/android.jar \
+		$(if $(MOZ_ANDROID_MAX_SDK_VERSION),--max-res-version $(MOZ_ANDROID_MAX_SDK_VERSION),) \
 		--auto-add-overlay \
 		$$(addprefix -S ,$$(ANDROID_RES_DIRS)) \
 		$(if $(extra_res_dirs),$$(addprefix -S ,$$(extra_res_dirs)),) \
@@ -368,6 +370,7 @@ $(1): $$(call mkdir_deps,$(filter-out ./,$(dir $(3) $(4) $(5)))) $(2)
 		-F $(3) \
 		-J $(4) \
 		--output-text-symbols $(5) \
+		$(if $(MOZ_ANDROID_RESOURCE_CONSTRAINED),-c hdpi,) \
 		--ignore-assets "$$(ANDROID_AAPT_IGNORE)"
 endef
 
diff --git a/mobile/android/base/MediaPlayerManager.java b/mobile/android/base/MediaPlayerManager.java
index 5c7688ca03e..b4e0ac4a76f 100644
--- a/mobile/android/base/MediaPlayerManager.java
+++ b/mobile/android/base/MediaPlayerManager.java
@@ -27,19 +27,6 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.Iterator;
 
-/* Wraper for different MediaRouter types supproted by Android. i.e. Chromecast, Miracast, etc. */
-interface GeckoMediaPlayer {
-    public JSONObject toJSON();
-    public void load(String title, String url, String type, EventCallback callback);
-    public void play(EventCallback callback);
-    public void pause(EventCallback callback);
-    public void stop(EventCallback callback);
-    public void start(EventCallback callback);
-    public void end(EventCallback callback);
-    public void mirror(EventCallback callback);
-    public void message(String message, EventCallback callback);
-}
-
 /* Manages a list of GeckoMediaPlayers methods (i.e. Chromecast/Miracast). Routes messages
  * from Gecko to the correct caster based on the id of the display
  */
diff --git a/mobile/android/base/PrefsHelper.java b/mobile/android/base/PrefsHelper.java
index 5a901caa780..2318568de85 100644
--- a/mobile/android/base/PrefsHelper.java
+++ b/mobile/android/base/PrefsHelper.java
@@ -24,7 +24,7 @@ public final class PrefsHelper {
 
     private static boolean sRegistered;
     private static int sUniqueRequestId = 1;
-    /* inner-access */ static final SparseArray<PrefHandler> sCallbacks = new SparseArray<PrefHandler>();
+    static final SparseArray<PrefHandler> sCallbacks = new SparseArray<PrefHandler>();
 
     public static int getPref(String prefName, PrefHandler callback) {
         return getPrefsInternal(new String[] { prefName }, callback);
diff --git a/mobile/android/base/RemoteTabsExpandableListAdapter.java b/mobile/android/base/RemoteTabsExpandableListAdapter.java
index 94f25bd7488..799c4603762 100644
--- a/mobile/android/base/RemoteTabsExpandableListAdapter.java
+++ b/mobile/android/base/RemoteTabsExpandableListAdapter.java
@@ -9,6 +9,7 @@ import java.util.List;
 
 import org.mozilla.gecko.TabsAccessor.RemoteClient;
 import org.mozilla.gecko.TabsAccessor.RemoteTab;
+import org.mozilla.gecko.home.TwoLinePageRow;
 
 import android.content.Context;
 import android.text.TextUtils;
@@ -16,6 +17,7 @@ import android.view.LayoutInflater;
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.BaseExpandableListAdapter;
+import android.widget.ImageView;
 import android.widget.TextView;
 
 /**
@@ -106,6 +108,18 @@ public class RemoteTabsExpandableListAdapter extends BaseExpandableListAdapter {
         final long now = System.currentTimeMillis();
         lastModifiedView.setText(TabsAccessor.getLastSyncedString(context, now, client.lastModified));
 
+        // This view exists only in some of our group views: it's present
+        // for the home panel groups and not for the tabs tray groups.
+        // Therefore, we must handle null.
+        final ImageView deviceTypeView = (ImageView) view.findViewById(R.id.device_type);
+        if (deviceTypeView != null) {
+            if ("desktop".equals(client.deviceType)) {
+                deviceTypeView.setBackgroundResource(R.drawable.sync_desktop);
+            } else {
+                deviceTypeView.setBackgroundResource(R.drawable.sync_mobile);
+            }
+        }
+
         return view;
     }
 
@@ -138,11 +152,18 @@ public class RemoteTabsExpandableListAdapter extends BaseExpandableListAdapter {
         final RemoteClient client = clients.get(groupPosition);
         final RemoteTab tab = client.tabs.get(childPosition);
 
-        final TextView titleView = (TextView) view.findViewById(R.id.title);
-        titleView.setText(TextUtils.isEmpty(tab.title) ? tab.url : tab.title);
+        // The view is a TwoLinePageRow only for some of our child views: it's
+        // present for the home panel children and not for the tabs tray
+        // children. Therefore, we must handle one case manually.
+        if (view instanceof TwoLinePageRow) {
+            ((TwoLinePageRow) view).update(tab.title, tab.url);
+        } else {
+            final TextView titleView = (TextView) view.findViewById(R.id.title);
+            titleView.setText(TextUtils.isEmpty(tab.title) ? tab.url : tab.title);
 
-        final TextView urlView = (TextView) view.findViewById(R.id.url);
-        urlView.setText(tab.url);
+            final TextView urlView = (TextView) view.findViewById(R.id.url);
+            urlView.setText(tab.url);
+        }
 
         return view;
     }
diff --git a/mobile/android/base/SmsManager.java b/mobile/android/base/SmsManager.java
index 0bdf07244da..94a35c7b6dc 100644
--- a/mobile/android/base/SmsManager.java
+++ b/mobile/android/base/SmsManager.java
@@ -5,30 +5,35 @@
 
 package org.mozilla.gecko;
 
-class SmsManager
-{
-    static private ISmsManager sInstance;
-
-    static public ISmsManager getInstance() {
+public class SmsManager {
+    private static final ISmsManager sInstance;
+    static {
         if (AppConstants.MOZ_WEBSMS_BACKEND) {
-            if (sInstance == null) {
-                sInstance = new GeckoSmsManager();
-            }
+            sInstance = new GeckoSmsManager();
+        } else {
+            sInstance = null;
         }
+    }
+
+    public static ISmsManager getInstance() {
         return sInstance;
     }
+
+    public static boolean isEnabled() {
+        return AppConstants.MOZ_WEBSMS_BACKEND;
+    }
+
+    public interface ISmsManager {
+        void start();
+        void stop();
+        void shutdown();
+
+        void send(String aNumber, String aMessage, int aRequestId);
+        void getMessage(int aMessageId, int aRequestId);
+        void deleteMessage(int aMessageId, int aRequestId);
+        void createMessageList(long aStartDate, long aEndDate, String[] aNumbers, int aNumbersCount, String aDelivery, boolean aHasRead, boolean aRead, long aThreadId, boolean aReverse, int aRequestId);
+        void getNextMessageInList(int aListId, int aRequestId);
+        void clearMessageList(int aListId);
+    }
 }
 
-interface ISmsManager
-{
-  public void start();
-  public void stop();
-  public void shutdown();
-
-  public void send(String aNumber, String aMessage, int aRequestId);
-  public void getMessage(int aMessageId, int aRequestId);
-  public void deleteMessage(int aMessageId, int aRequestId);
-  public void createMessageList(long aStartDate, long aEndDate, String[] aNumbers, int aNumbersCount, String aDelivery, boolean aHasRead, boolean aRead, long aThreadId, boolean aReverse, int aRequestId);
-  public void getNextMessageInList(int aListId, int aRequestId);
-  public void clearMessageList(int aListId);
-}
diff --git a/mobile/android/base/animation/PropertyAnimator.java b/mobile/android/base/animation/PropertyAnimator.java
index 03d3b65bbb2..aab2c69a318 100644
--- a/mobile/android/base/animation/PropertyAnimator.java
+++ b/mobile/android/base/animation/PropertyAnimator.java
@@ -52,7 +52,7 @@ public class PropertyAnimator implements Runnable {
     private float mDurationReciprocal;
     private List<ElementHolder> mElementsList;
     private List<PropertyAnimationListener> mListeners;
-    /* inner-access */ FramePoster mFramePoster;
+    FramePoster mFramePoster;
     private boolean mUseHardwareLayer;
 
     public PropertyAnimator(long duration) {
@@ -159,22 +159,24 @@ public class PropertyAnimator implements Runnable {
             treeObserver = null;
         }
 
+        final ViewTreeObserver.OnPreDrawListener preDrawListener = new ViewTreeObserver.OnPreDrawListener() {
+            @Override
+            public boolean onPreDraw() {
+                if (treeObserver.isAlive()) {
+                    treeObserver.removeOnPreDrawListener(this);
+                }
+
+                mFramePoster.postFirstAnimationFrame();
+                return true;
+            }
+        };
+
         // Try to start animation after any on-going layout round
         // in the current view tree. OnPreDrawListener seems broken
         // on pre-Honeycomb devices, start animation immediatelly
         // in this case.
         if (Versions.feature11Plus && treeObserver != null && treeObserver.isAlive()) {
-            treeObserver.addOnPreDrawListener(new ViewTreeObserver.OnPreDrawListener() {
-                @Override
-                public boolean onPreDraw() {
-                    if (treeObserver.isAlive()) {
-                        treeObserver.removeOnPreDrawListener(this);
-                    }
-
-                    mFramePoster.postFirstAnimationFrame();
-                    return true;
-                }
-            });
+            treeObserver.addOnPreDrawListener(preDrawListener);
         } else {
             mFramePoster.postFirstAnimationFrame();
         }
diff --git a/mobile/android/base/background/db/Tab.java b/mobile/android/base/background/db/Tab.java
index 566a51b0e88..f38cfdf0ea1 100644
--- a/mobile/android/base/background/db/Tab.java
+++ b/mobile/android/base/background/db/Tab.java
@@ -61,6 +61,11 @@ public class Tab {
     return Utils.sameArrays(this.history, other.history);
   }
 
+  @Override
+  public int hashCode() {
+    return super.hashCode();
+  }
+
   /**
    * Extract a <code>Tab</code> from a cursor row.
    * <p>
diff --git a/mobile/android/base/db/BrowserDB.java b/mobile/android/base/db/BrowserDB.java
index 16253ddbcbd..86beea5d1db 100644
--- a/mobile/android/base/db/BrowserDB.java
+++ b/mobile/android/base/db/BrowserDB.java
@@ -237,14 +237,6 @@ public class BrowserDB {
         sDb.registerBookmarkObserver(cr, observer);
     }
 
-    public static void registerHistoryObserver(ContentResolver cr, ContentObserver observer) {
-        sDb.registerHistoryObserver(cr, observer);
-    }
-
-    public static void unregisterContentObserver(ContentResolver cr, ContentObserver observer) {
-        cr.unregisterContentObserver(observer);
-    }
-
     public static int getCount(ContentResolver cr, String database) {
         return sDb.getCount(cr, database);
     }
@@ -257,23 +249,11 @@ public class BrowserDB {
         sDb.unpinSite(cr, position);
     }
 
-    public static void unpinAllSites(ContentResolver cr) {
-        sDb.unpinAllSites(cr);
-    }
-
-    public static Cursor getPinnedSites(ContentResolver cr, int limit) {
-        return sDb.getPinnedSites(cr, limit);
-    }
-
     @RobocopTarget
     public static Cursor getBookmarkForUrl(ContentResolver cr, String url) {
         return sDb.getBookmarkForUrl(cr, url);
     }
 
-    public static boolean areContentProvidersDisabled() {
-        return sAreContentProvidersEnabled;
-    }
-
     public static void setEnableContentProviders(boolean enableContentProviders) {
         sAreContentProvidersEnabled = enableContentProviders;
     }
diff --git a/mobile/android/base/db/LocalBrowserDB.java b/mobile/android/base/db/LocalBrowserDB.java
index d5f7db17348..415426413de 100644
--- a/mobile/android/base/db/LocalBrowserDB.java
+++ b/mobile/android/base/db/LocalBrowserDB.java
@@ -58,7 +58,7 @@ public class LocalBrowserDB {
     // Calculate these once, at initialization. isLoggable is too expensive to
     // have in-line in each log call.
     private static final String LOGTAG = "GeckoLocalBrowserDB";
-    private static boolean logDebug = Log.isLoggable(LOGTAG, Log.DEBUG);
+    private static final boolean logDebug = Log.isLoggable(LOGTAG, Log.DEBUG);
     protected static void debug(String message) {
         if (logDebug) {
             Log.d(LOGTAG, message);
@@ -449,11 +449,6 @@ public class LocalBrowserDB {
         mDesktopBookmarksExist = null;
     }
 
-    private Uri historyUriWithLimit(int limit) {
-        return mHistoryUriWithProfile.buildUpon().appendQueryParameter(BrowserContract.PARAM_LIMIT,
-                                                                       String.valueOf(limit)).build();
-    }
-
     private Uri bookmarksUriWithLimit(int limit) {
         return mBookmarksUriWithProfile.buildUpon().appendQueryParameter(BrowserContract.PARAM_LIMIT,
                                                                          String.valueOf(limit)).build();
@@ -486,11 +481,6 @@ public class LocalBrowserDB {
         return uriBuilder.build();
     }
 
-    private Cursor filterAllSites(ContentResolver cr, String[] projection, CharSequence constraint,
-            int limit, CharSequence urlFilter) {
-        return filterAllSites(cr, projection, constraint, limit, urlFilter, "", null);
-    }
-
     private Cursor filterAllSites(ContentResolver cr, String[] projection, CharSequence constraint,
             int limit, CharSequence urlFilter, String selection, String[] selectionArgs) {
         // The combined history/bookmarks selection queries for sites with a url or title containing
@@ -551,14 +541,12 @@ public class LocalBrowserDB {
             columns = new String[] { Favicons._ID };
         }
         if (uri != null) {
-            Cursor cursor = null;
+            final Cursor cursor = cr.query(uri, columns, constraint, null, null);
 
             try {
-                cursor = cr.query(uri, columns, constraint, null, null);
                 count = cursor.getCount();
             } finally {
-                if (cursor != null)
-                    cursor.close();
+                cursor.close();
             }
         }
         debug("Got count " + count + " for " + database);
@@ -639,38 +627,6 @@ public class LocalBrowserDB {
                   new String[] { uri });
     }
 
-    public void updateHistoryEntry(ContentResolver cr, String uri, String title,
-                                   long date, int visits) {
-        int oldVisits = 0;
-        Cursor cursor = null;
-        try {
-            cursor = cr.query(mHistoryUriWithProfile,
-                              new String[] { History.VISITS },
-                              History.URL + " = ?",
-                              new String[] { uri },
-                              null);
-
-            if (cursor.moveToFirst()) {
-                oldVisits = cursor.getInt(0);
-            }
-        } finally {
-            if (cursor != null)
-                cursor.close();
-        }
-
-        ContentValues values = new ContentValues();
-        values.put(History.DATE_LAST_VISITED, date);
-        values.put(History.VISITS, oldVisits + visits);
-        if (title != null) {
-            values.put(History.TITLE, title);
-        }
-
-        cr.update(mHistoryUriWithProfile,
-                  values,
-                  History.URL + " = ?",
-                  new String[] { uri });
-    }
-
     @RobocopTarget
     public Cursor getAllVisitedHistory(ContentResolver cr) {
         return cr.query(mHistoryUriWithProfile,
@@ -700,12 +656,6 @@ public class LocalBrowserDB {
         cr.delete(url, null, null);
     }
 
-    public void removeHistoryEntry(ContentResolver cr, int id) {
-        cr.delete(mHistoryUriWithProfile,
-                  History._ID + " = ?",
-                  new String[] { String.valueOf(id) });
-    }
-
     @RobocopTarget
     public void removeHistoryEntry(ContentResolver cr, String url) {
         cr.delete(mHistoryUriWithProfile,
@@ -779,89 +729,68 @@ public class LocalBrowserDB {
     // Returns true if any desktop bookmarks exist, which will be true if the user
     // has set up sync at one point, or done a profile migration from XUL fennec.
     private boolean desktopBookmarksExist(ContentResolver cr) {
-        if (mDesktopBookmarksExist != null)
+        if (mDesktopBookmarksExist != null) {
             return mDesktopBookmarksExist;
-
-        Cursor c = null;
-        int count = 0;
-        try {
-            // Check to see if there are any bookmarks in one of our three
-            // fixed "Desktop Boomarks" folders.
-            c = cr.query(bookmarksUriWithLimit(1),
-                         new String[] { Bookmarks._ID },
-                         Bookmarks.PARENT + " = ? OR " +
-                         Bookmarks.PARENT + " = ? OR " +
-                         Bookmarks.PARENT + " = ?",
-                         new String[] { String.valueOf(getFolderIdFromGuid(cr, Bookmarks.TOOLBAR_FOLDER_GUID)),
-                                        String.valueOf(getFolderIdFromGuid(cr, Bookmarks.MENU_FOLDER_GUID)),
-                                        String.valueOf(getFolderIdFromGuid(cr, Bookmarks.UNFILED_FOLDER_GUID)) },
-                         null);
-            count = c.getCount();
-        } finally {
-            if (c != null)
-                c.close();
         }
 
-        // Cache result for future queries
-        mDesktopBookmarksExist = (count > 0);
+        // Check to see if there are any bookmarks in one of our three
+        // fixed "Desktop Bookmarks" folders.
+        final Cursor c = cr.query(bookmarksUriWithLimit(1),
+                                  new String[] { Bookmarks._ID },
+                                  Bookmarks.PARENT + " = ? OR " +
+                                  Bookmarks.PARENT + " = ? OR " +
+                                  Bookmarks.PARENT + " = ?",
+                                  new String[] { String.valueOf(getFolderIdFromGuid(cr, Bookmarks.TOOLBAR_FOLDER_GUID)),
+                                                 String.valueOf(getFolderIdFromGuid(cr, Bookmarks.MENU_FOLDER_GUID)),
+                                                 String.valueOf(getFolderIdFromGuid(cr, Bookmarks.UNFILED_FOLDER_GUID)) },
+                                  null);
+
+        try {
+            mDesktopBookmarksExist = c.getCount() > 0;
+        } finally {
+            c.close();
+        }
+
         return mDesktopBookmarksExist;
     }
 
-    public int getReadingListCount(ContentResolver cr) {
-        Cursor c = null;
-        try {
-            c = cr.query(mReadingListUriWithProfile,
-                         new String[] { ReadingListItems._ID },
-                         null,
-                         null,
-                         null);
-            return c.getCount();
-        } finally {
-            if (c != null) {
-                c.close();
-            }
-        }
-    }
-
     @RobocopTarget
     public boolean isBookmark(ContentResolver cr, String uri) {
-        Cursor c = null;
-        try {
-            c = cr.query(bookmarksUriWithLimit(1),
-                         new String[] { Bookmarks._ID },
-                         Bookmarks.URL + " = ? AND " +
-                                 Bookmarks.PARENT + " != ?",
-                         new String[] { uri,
-                                 String.valueOf(Bookmarks.FIXED_PINNED_LIST_ID) },
-                         Bookmarks.URL);
-            return c.getCount() > 0;
-        } catch (NullPointerException e) {
-            Log.e(LOGTAG, "NullPointerException in isBookmark");
-        } finally {
-            if (c != null)
-                c.close();
+        final Cursor c = cr.query(bookmarksUriWithLimit(1),
+                                  new String[] { Bookmarks._ID },
+                                  Bookmarks.URL + " = ? AND " + Bookmarks.PARENT + " != ?",
+                                  new String[] { uri, String.valueOf(Bookmarks.FIXED_PINNED_LIST_ID) },
+                                  Bookmarks.URL);
+
+        if (c == null) {
+            Log.e(LOGTAG, "Null cursor in isBookmark");
+            return false;
         }
 
-        return false;
+        try {
+            return c.getCount() > 0;
+        } finally {
+            c.close();
+        }
     }
 
     public boolean isReadingListItem(ContentResolver cr, String uri) {
-        Cursor c = null;
-        try {
-            c = cr.query(mReadingListUriWithProfile,
-                         new String[] { ReadingListItems._ID },
-                         ReadingListItems.URL + " = ? ",
-                         new String[] { uri },
-                         null);
-            return c.getCount() > 0;
-        } catch (NullPointerException e) {
-            Log.e(LOGTAG, "NullPointerException in isReadingListItem");
-        } finally {
-            if (c != null)
-                c.close();
+        final Cursor c = cr.query(mReadingListUriWithProfile,
+                                  new String[] { ReadingListItems._ID },
+                                  ReadingListItems.URL + " = ? ",
+                                  new String[] { uri },
+                                  null);
+
+        if (c == null) {
+            Log.e(LOGTAG, "Null cursor in isReadingListItem");
+            return false;
         }
 
-        return false;
+        try {
+            return c.getCount() > 0;
+        } finally {
+            c.close();
+        }
     }
 
     /**
@@ -892,22 +821,20 @@ public class LocalBrowserDB {
     }
 
     public String getUrlForKeyword(ContentResolver cr, String keyword) {
-        Cursor c = null;
+        final Cursor c = cr.query(mBookmarksUriWithProfile,
+                                  new String[] { Bookmarks.URL },
+                                  Bookmarks.KEYWORD + " = ?",
+                                  new String[] { keyword },
+                                  null);
         try {
-            c = cr.query(mBookmarksUriWithProfile,
-                         new String[] { Bookmarks.URL },
-                         Bookmarks.KEYWORD + " = ?",
-                         new String[] { keyword },
-                         null);
+            if (!c.moveToFirst()) {
+                return null;
+            }
 
-            if (c.moveToFirst())
-                return c.getString(c.getColumnIndexOrThrow(Bookmarks.URL));
+            return c.getString(c.getColumnIndexOrThrow(Bookmarks.URL));
         } finally {
-            if (c != null)
-                c.close();
+            c.close();
         }
-
-        return null;
     }
 
     private synchronized long getFolderIdFromGuid(final ContentResolver cr, final String guid) {
@@ -960,22 +887,20 @@ public class LocalBrowserDB {
         values.put(Bookmarks.DATE_MODIFIED, now);
 
         // Get the page's favicon ID from the history table
-        Cursor c = null;
+        final Cursor c = cr.query(mHistoryUriWithProfile,
+                                  new String[] { History.FAVICON_ID },
+                                  History.URL + " = ?",
+                                  new String[] { uri },
+                                  null);
         try {
-            c = cr.query(mHistoryUriWithProfile,
-                         new String[] { History.FAVICON_ID },
-                         History.URL + " = ?",
-                         new String[] { uri },
-                         null);
-
             if (c.moveToFirst()) {
                 int columnIndex = c.getColumnIndexOrThrow(History.FAVICON_ID);
-                if (!c.isNull(columnIndex))
+                if (!c.isNull(columnIndex)) {
                     values.put(Bookmarks.FAVICON_ID, c.getLong(columnIndex));
+                }
             }
         } finally {
-            if (c != null)
-                c.close();
+            c.close();
         }
 
         // Restore deleted record if possible
@@ -1008,18 +933,6 @@ public class LocalBrowserDB {
         addBookmarkItem(cr, title, uri, folderId);
     }
 
-    public void removeBookmark(ContentResolver cr, int id) {
-        Uri contentUri = mBookmarksUriWithProfile;
-
-        // Do this now so that the item still exists!
-        final String idString = String.valueOf(id);
-        bumpParents(cr, Bookmarks._ID, idString);
-
-        final String[] idArgs = new String[] { idString };
-        final String idEquals = Bookmarks._ID + " = ?";
-        cr.delete(contentUri, idEquals, idArgs);
-    }
-
     @RobocopTarget
     public void removeBookmarksWithURL(ContentResolver cr, String uri) {
         Uri contentUri = mBookmarksUriWithProfile;
@@ -1062,18 +975,10 @@ public class LocalBrowserDB {
         cr.delete(mReadingListUriWithProfile, ReadingListItems.URL + " = ? ", new String[] { uri });
     }
 
-    public void removeReadingListItem(ContentResolver cr, int id) {
-        cr.delete(mReadingListUriWithProfile, ReadingListItems._ID + " = ? ", new String[] { String.valueOf(id) });
-    }
-
     public void registerBookmarkObserver(ContentResolver cr, ContentObserver observer) {
         cr.registerContentObserver(mBookmarksUriWithProfile, false, observer);
     }
 
-    public void registerHistoryObserver(ContentResolver cr, ContentObserver observer) {
-        cr.registerContentObserver(mHistoryUriWithProfile, false, observer);
-    }
-
     @RobocopTarget
     public void updateBookmark(ContentResolver cr, int id, String uri, String title, String keyword) {
         ContentValues values = new ContentValues();
@@ -1096,16 +1001,14 @@ public class LocalBrowserDB {
      * @return The decoded Bitmap from the database, if any. null if none is stored.
      */
     public LoadFaviconResult getFaviconForUrl(ContentResolver cr, String faviconURL) {
-        Cursor c = null;
+        final Cursor c = cr.query(mFaviconsUriWithProfile,
+                                  new String[] { Favicons.DATA },
+                                  Favicons.URL + " = ? AND " + Favicons.DATA + " IS NOT NULL",
+                                  new String[] { faviconURL },
+                                  null);
+
         byte[] b = null;
-
         try {
-            c = cr.query(mFaviconsUriWithProfile,
-                         new String[] { Favicons.DATA },
-                         Favicons.URL + " = ? AND " + Favicons.DATA + " IS NOT NULL",
-                         new String[] { faviconURL },
-                         null);
-
             if (!c.moveToFirst()) {
                 return null;
             }
@@ -1113,9 +1016,7 @@ public class LocalBrowserDB {
             final int faviconIndex = c.getColumnIndexOrThrow(Favicons.DATA);
             b = c.getBlob(faviconIndex);
         } finally {
-            if (c != null) {
-                c.close();
-            }
+            c.close();
         }
 
         if (b == null) {
@@ -1126,23 +1027,21 @@ public class LocalBrowserDB {
     }
 
     public String getFaviconUrlForHistoryUrl(ContentResolver cr, String uri) {
-        Cursor c = null;
+        final Cursor c = cr.query(mHistoryUriWithProfile,
+                                  new String[] { History.FAVICON_URL },
+                                  Combined.URL + " = ?",
+                                  new String[] { uri },
+                                  null);
 
         try {
-            c = cr.query(mHistoryUriWithProfile,
-                         new String[] { History.FAVICON_URL },
-                         Combined.URL + " = ?",
-                         new String[] { uri },
-                         null);
+            if (!c.moveToFirst()) {
+                return null;
+            }
 
-            if (c.moveToFirst())
-                return c.getString(c.getColumnIndexOrThrow(History.FAVICON_URL));
+            return c.getString(c.getColumnIndexOrThrow(History.FAVICON_URL));
         } finally {
-            if (c != null)
-                c.close();
+            c.close();
         }
-
-        return null;
     }
 
     public void updateFaviconForUrl(ContentResolver cr, String pageUri,
@@ -1195,28 +1094,23 @@ public class LocalBrowserDB {
 
     @RobocopTarget
     public byte[] getThumbnailForUrl(ContentResolver cr, String uri) {
-        Cursor c = null;
-        byte[] b = null;
+        final Cursor c = cr.query(mThumbnailsUriWithProfile,
+                                  new String[]{ Thumbnails.DATA },
+                                  Thumbnails.URL + " = ? AND " + Thumbnails.DATA + " IS NOT NULL",
+                                  new String[]{ uri },
+                                  null);
         try {
-            c = cr.query(mThumbnailsUriWithProfile,
-                         new String[]{ Thumbnails.DATA },
-                         Thumbnails.URL + " = ? AND " + Thumbnails.DATA + " IS NOT NULL",
-                         new String[]{ uri },
-                         null);
-
             if (!c.moveToFirst()) {
                 return null;
             }
 
             int thumbnailIndex = c.getColumnIndexOrThrow(Thumbnails.DATA);
-            b = c.getBlob(thumbnailIndex);
+
+            return c.getBlob(thumbnailIndex);
         } finally {
-            if (c != null) {
-                c.close();
-            }
+            c.close();
         }
 
-        return b;
     }
 
     /**
@@ -1258,22 +1152,21 @@ public class LocalBrowserDB {
                                      Collection<ContentProviderOperation> operations,
                                      String url, String title,
                                      long date, int visits) {
-        Cursor cursor = null;
 
+        final String[] projection = {
+            History._ID,
+            History.VISITS,
+            History.DATE_LAST_VISITED
+        };
+
+
+        // We need to get the old visit count.
+        final Cursor cursor = cr.query(getAllHistoryUri(),
+                                       projection,
+                                       History.URL + " = ?",
+                                       new String[] { url },
+                                       null);
         try {
-            final String[] projection = new String[] {
-                History._ID,
-                History.VISITS,
-                History.DATE_LAST_VISITED
-            };
-
-            // We need to get the old visit count.
-            cursor = cr.query(getAllHistoryUri(),
-                              projection,
-                              History.URL + " = ?",
-                              new String[] { url },
-                              null);
-
             ContentValues values = new ContentValues();
 
             // Restore deleted record if possible
@@ -1310,8 +1203,7 @@ public class LocalBrowserDB {
             // Queue the operation
             operations.add(builder.build());
         } finally {
-            if (cursor != null)
-                cursor.close();
+            cursor.close();
         }
     }
 
@@ -1415,7 +1307,7 @@ public class LocalBrowserDB {
 
     // This wrapper adds a fake "Desktop Bookmarks" folder entry to the
     // beginning of the cursor's data set.
-    private class SpecialFoldersCursorWrapper extends CursorWrapper {
+    private static class SpecialFoldersCursorWrapper extends CursorWrapper {
         private int mIndexOffset;
 
         private int mDesktopBookmarksIndex = -1;
@@ -1431,22 +1323,27 @@ public class LocalBrowserDB {
             }
         }
 
+        @Override
         public int getCount() {
             return super.getCount() + mIndexOffset;
         }
 
+        @Override
         public boolean moveToPosition(int position) {
             mAtDesktopBookmarksPosition = (mDesktopBookmarksIndex == position);
 
-            if (mAtDesktopBookmarksPosition)
+            if (mAtDesktopBookmarksPosition) {
                 return true;
+            }
 
             return super.moveToPosition(position - mIndexOffset);
         }
 
+        @Override
         public long getLong(int columnIndex) {
-            if (!mAtDesktopBookmarksPosition)
+            if (!mAtDesktopBookmarksPosition) {
                 return super.getLong(columnIndex);
+            }
 
             if (columnIndex == getColumnIndex(Bookmarks.PARENT)) {
                 return Bookmarks.FIXED_ROOT_ID;
@@ -1455,25 +1352,32 @@ public class LocalBrowserDB {
             return -1;
         }
 
+        @Override
         public int getInt(int columnIndex) {
-            if (!mAtDesktopBookmarksPosition)
+            if (!mAtDesktopBookmarksPosition) {
                 return super.getInt(columnIndex);
+            }
 
-            if (columnIndex == getColumnIndex(Bookmarks._ID) && mAtDesktopBookmarksPosition)
-                    return Bookmarks.FAKE_DESKTOP_FOLDER_ID;
+            if (columnIndex == getColumnIndex(Bookmarks._ID) && mAtDesktopBookmarksPosition) {
+                return Bookmarks.FAKE_DESKTOP_FOLDER_ID;
+            }
 
-            if (columnIndex == getColumnIndex(Bookmarks.TYPE))
+            if (columnIndex == getColumnIndex(Bookmarks.TYPE)) {
                 return Bookmarks.TYPE_FOLDER;
+            }
 
             return -1;
         }
 
+        @Override
         public String getString(int columnIndex) {
-            if (!mAtDesktopBookmarksPosition)
+            if (!mAtDesktopBookmarksPosition) {
                 return super.getString(columnIndex);
+            }
 
-            if (columnIndex == getColumnIndex(Bookmarks.GUID) && mAtDesktopBookmarksPosition)
-                    return Bookmarks.FAKE_DESKTOP_FOLDER_GUID;
+            if (columnIndex == getColumnIndex(Bookmarks.GUID) && mAtDesktopBookmarksPosition) {
+                return Bookmarks.FAKE_DESKTOP_FOLDER_GUID;
+            }
 
             return "";
         }
@@ -1523,35 +1427,6 @@ public class LocalBrowserDB {
                   });
     }
 
-    public void unpinAllSites(ContentResolver cr) {
-        cr.delete(mBookmarksUriWithProfile,
-                  Bookmarks.PARENT + " == ?",
-                  new String[] {
-                      String.valueOf(Bookmarks.FIXED_PINNED_LIST_ID)
-                  });
-    }
-
-    public boolean isVisited(ContentResolver cr, String uri) {
-        int count = 0;
-        Cursor c = null;
-
-        try {
-            c = cr.query(historyUriWithLimit(1),
-                         new String[] { History._ID },
-                         History.URL + " = ?",
-                         new String[] { uri },
-                         History.URL);
-            count = c.getCount();
-        } catch (NullPointerException e) {
-            Log.e(LOGTAG, "NullPointerException in isVisited");
-        } finally {
-            if (c != null)
-                c.close();
-        }
-
-        return (count > 0);
-    }
-
     @RobocopTarget
     public Cursor getBookmarkForUrl(ContentResolver cr, String url) {
         Cursor c = cr.query(bookmarksUriWithLimit(1),
diff --git a/mobile/android/base/db/SuggestedSites.java b/mobile/android/base/db/SuggestedSites.java
index e815b1c9d2f..c421ee9cfdc 100644
--- a/mobile/android/base/db/SuggestedSites.java
+++ b/mobile/android/base/db/SuggestedSites.java
@@ -144,9 +144,9 @@ public class SuggestedSites {
         }
     }
 
-    /* inner-access */ final Context context;
-    /* inner-access */ final Distribution distribution;
-    /* inner-access */ final File file;
+    final Context context;
+    final Distribution distribution;
+    final File file;
     private Map<String, Site> cachedSites;
     private Set<String> cachedBlacklist;
 
@@ -235,7 +235,7 @@ public class SuggestedSites {
      * Saves suggested sites file to disk. Access to this method should
      * be synchronized on 'file'.
      */
-    /* inner-access */ static void saveSites(File f, Map<String, Site> sites) {
+    static void saveSites(File f, Map<String, Site> sites) {
         ThreadUtils.assertNotOnUiThread();
 
         if (sites == null || sites.isEmpty()) {
@@ -313,7 +313,7 @@ public class SuggestedSites {
      * It's assumed that the given distribution instance is ready to be
      * used and exists.
      */
-    /* inner-access */ static Map<String, Site> loadFromDistribution(Distribution dist) {
+    static Map<String, Site> loadFromDistribution(Distribution dist) {
         for (Locale locale : getAcceptableLocales()) {
             try {
                 final String languageTag = BrowserLocaleManager.getLanguageTag(locale);
@@ -350,7 +350,7 @@ public class SuggestedSites {
         return null;
     }
 
-    /* inner-access */ Map<String, Site> loadFromResource() {
+    Map<String, Site> loadFromResource() {
         try {
             return loadSites(RawResource.getAsString(context, R.raw.suggestedsites));
         } catch (IOException e) {
diff --git a/mobile/android/base/favicons/Favicons.java b/mobile/android/base/favicons/Favicons.java
index 95c301d1f76..b2cecca4022 100644
--- a/mobile/android/base/favicons/Favicons.java
+++ b/mobile/android/base/favicons/Favicons.java
@@ -29,10 +29,12 @@ import java.io.File;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.Iterator;
 import java.util.List;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 public class Favicons {
     private static final String LOGTAG = "GeckoFavicons";
@@ -54,8 +56,6 @@ public class Favicons {
     public static final int FLAG_PERSIST = 2;
     public static final int FLAG_SCALE   = 4;
 
-    protected static Context context;
-
     // The default Favicon to show if no other can be found.
     public static Bitmap defaultFavicon;
 
@@ -65,14 +65,17 @@ public class Favicons {
     // The density-adjusted maximum Favicon dimensions.
     public static int largestFaviconSize;
 
+    // Used to prevent multiple-initialisation.
+    public static final AtomicBoolean isInitialized = new AtomicBoolean(false);
+
     // Executor for long-running Favicon Tasks.
     public static final ExecutorService longRunningExecutor = Executors.newSingleThreadExecutor();
 
-    private static final SparseArray<LoadFaviconTask> loadTasks = new SparseArray<LoadFaviconTask>();
+    private static final SparseArray<LoadFaviconTask> loadTasks = new SparseArray<>();
 
     // Cache to hold mappings between page URLs and Favicon URLs. Used to avoid going to the DB when
     // doing so is not necessary.
-    private static final NonEvictingLruCache<String, String> pageURLMappings = new NonEvictingLruCache<String, String>(NUM_PAGE_URL_MAPPINGS_TO_STORE);
+    private static final NonEvictingLruCache<String, String> pageURLMappings = new NonEvictingLruCache<>(NUM_PAGE_URL_MAPPINGS_TO_STORE);
 
     public static String getFaviconURLForPageURLFromCache(String pageURL) {
         return pageURLMappings.get(pageURL);
@@ -143,7 +146,7 @@ public class Favicons {
      * @return The id of the asynchronous task created, NOT_LOADING if none is created, or
      *         LOADED if the value could be dispatched on the current thread.
      */
-    public static int getSizedFavicon(String pageURL, String faviconURL, int targetSize, int flags, OnFaviconLoadedListener listener) {
+    public static int getSizedFavicon(Context context, String pageURL, String faviconURL, int targetSize, int flags, OnFaviconLoadedListener listener) {
         // Do we know the favicon URL for this page already?
         String cacheURL = faviconURL;
         if (cacheURL == null) {
@@ -171,7 +174,7 @@ public class Favicons {
         }
 
         // Failing that, try and get one from the database or internet.
-        return loadUncachedFavicon(pageURL, faviconURL, flags, targetSize, listener);
+        return loadUncachedFavicon(context, pageURL, faviconURL, flags, targetSize, listener);
     }
 
     /**
@@ -202,7 +205,7 @@ public class Favicons {
      * @param callback Callback to fire with the result.
      * @return The job ID of the spawned async task, if any.
      */
-    public static int getSizedFaviconForPageFromLocal(final String pageURL, final int targetSize,
+    public static int getSizedFaviconForPageFromLocal(Context context, final String pageURL, final int targetSize,
                                                       final OnFaviconLoadedListener callback) {
         // Firstly, try extremely hard to cheat.
         // Have we cached this favicon URL? If we did, we can consult the memcache right away.
@@ -223,7 +226,7 @@ public class Favicons {
 
         // No joy using in-memory resources. Go to background thread and ask the database.
         final LoadFaviconTask task =
-            new LoadFaviconTask(pageURL, targetURL, 0, callback, targetSize, true);
+            new LoadFaviconTask(context, pageURL, targetURL, 0, callback, targetSize, true);
         final int taskId = task.getId();
         synchronized(loadTasks) {
             loadTasks.put(taskId, task);
@@ -233,8 +236,8 @@ public class Favicons {
         return taskId;
     }
 
-    public static int getSizedFaviconForPageFromLocal(final String pageURL, final OnFaviconLoadedListener callback) {
-        return getSizedFaviconForPageFromLocal(pageURL, defaultFaviconSize, callback);
+    public static int getSizedFaviconForPageFromLocal(Context context, final String pageURL, final OnFaviconLoadedListener callback) {
+        return getSizedFaviconForPageFromLocal(context, pageURL, defaultFaviconSize, callback);
     }
 
     /**
@@ -245,7 +248,7 @@ public class Favicons {
      * @return The URL of the Favicon used by that webpage, according to either the History database
      *         or a somewhat educated guess.
      */
-    public static String getFaviconURLForPageURL(String pageURL) {
+    public static String getFaviconURLForPageURL(Context context, String pageURL) {
         // Attempt to determine the Favicon URL from the Tabs datastructure. Can dodge having to use
         // the database sometimes by doing this.
         String targetURL;
@@ -283,7 +286,7 @@ public class Favicons {
      * @param listener The OnFaviconLoadedListener to invoke with the result of this Favicon load.
      * @return The id of the LoadFaviconTask handling this job.
      */
-    private static int loadUncachedFavicon(String pageURL, String faviconURL, int flags,
+    private static int loadUncachedFavicon(Context context, String pageURL, String faviconURL, int flags,
                                            int targetSize, OnFaviconLoadedListener listener) {
         // Handle the case where we have no page url.
         if (TextUtils.isEmpty(pageURL)) {
@@ -292,7 +295,7 @@ public class Favicons {
         }
 
         final LoadFaviconTask task =
-            new LoadFaviconTask(pageURL, faviconURL, flags, listener, targetSize, false);
+            new LoadFaviconTask(context, pageURL, faviconURL, flags, listener, targetSize, false);
         final int taskId = task.getId();
         synchronized(loadTasks) {
             loadTasks.put(taskId, task);
@@ -382,14 +385,18 @@ public class Favicons {
      *
      * @param context A reference to the GeckoApp instance.
      */
-    public static void attachToContext(Context context) throws Exception {
+    public static void initializeWithContext(Context context) throws IllegalStateException {
+        // Prevent multiple-initialisation.
+        if (!isInitialized.compareAndSet(false, true)) {
+            return;
+        }
+
         final Resources res = context.getResources();
-        Favicons.context = context;
 
         // Decode the default Favicon ready for use.
         defaultFavicon = BitmapFactory.decodeResource(res, R.drawable.favicon);
         if (defaultFavicon == null) {
-            throw new Exception("Null default favicon was returned from the resources system!");
+            throw new IllegalStateException("Null default favicon was returned from the resources system!");
         }
 
         defaultFaviconSize = res.getDimensionPixelSize(R.dimen.favicon_bg);
@@ -412,7 +419,7 @@ public class Favicons {
         putFaviconsInMemCache(BUILT_IN_FAVICON_URL, toInsert.iterator(), true);
 
         pageURLMappings.putWithoutEviction(AboutPages.HOME, BUILT_IN_SEARCH_URL);
-        List<Bitmap> searchIcons = Arrays.asList(BitmapFactory.decodeResource(res, R.drawable.favicon_search));
+        List<Bitmap> searchIcons = Collections.singletonList(BitmapFactory.decodeResource(res, R.drawable.favicon_search));
         putFaviconsInMemCache(BUILT_IN_SEARCH_URL, searchIcons.iterator(), true);
     }
 
@@ -491,8 +498,8 @@ public class Favicons {
      * @param url page URL to get a large favicon image for.
      * @param onFaviconLoadedListener listener to call back with the result.
      */
-    public static void getPreferredSizeFaviconForPage(String url, OnFaviconLoadedListener onFaviconLoadedListener) {
+    public static void getPreferredSizeFaviconForPage(Context context, String url, OnFaviconLoadedListener onFaviconLoadedListener) {
         int preferredSize = GeckoAppShell.getPreferredIconSize();
-        loadUncachedFavicon(url, null, 0, preferredSize, onFaviconLoadedListener);
+        loadUncachedFavicon(context, url, null, 0, preferredSize, onFaviconLoadedListener);
     }
 }
diff --git a/mobile/android/base/favicons/LoadFaviconTask.java b/mobile/android/base/favicons/LoadFaviconTask.java
index 1b3758708eb..f2470f397ff 100644
--- a/mobile/android/base/favicons/LoadFaviconTask.java
+++ b/mobile/android/base/favicons/LoadFaviconTask.java
@@ -6,6 +6,7 @@ package org.mozilla.gecko.favicons;
 
 
 import android.content.ContentResolver;
+import android.content.Context;
 import android.graphics.Bitmap;
 import android.net.http.AndroidHttpClient;
 import android.text.TextUtils;
@@ -21,8 +22,6 @@ import org.mozilla.gecko.favicons.decoders.LoadFaviconResult;
 import org.mozilla.gecko.util.GeckoJarReader;
 import org.mozilla.gecko.util.ThreadUtils;
 
-import static org.mozilla.gecko.favicons.Favicons.context;
-
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
@@ -44,7 +43,7 @@ public class LoadFaviconTask {
 
     // Access to this map needs to be synchronized prevent multiple jobs loading the same favicon
     // from executing concurrently.
-    private static final HashMap<String, LoadFaviconTask> loadsInFlight = new HashMap<String, LoadFaviconTask>();
+    private static final HashMap<String, LoadFaviconTask> loadsInFlight = new HashMap<>();
 
     public static final int FLAG_PERSIST = 1;
     public static final int FLAG_SCALE = 2;
@@ -53,15 +52,16 @@ public class LoadFaviconTask {
     // by the server.
     private static final int DEFAULT_FAVICON_BUFFER_SIZE = 25000;
 
-    private static AtomicInteger nextFaviconLoadId = new AtomicInteger(0);
-    private int id;
-    private String pageUrl;
+    private static final AtomicInteger nextFaviconLoadId = new AtomicInteger(0);
+    private final Context context;
+    private final int id;
+    private final String pageUrl;
     private String faviconURL;
-    private OnFaviconLoadedListener listener;
-    private int flags;
+    private final OnFaviconLoadedListener listener;
+    private final int flags;
 
     private final boolean onlyFromLocal;
-    /* inner-access */ volatile boolean mCancelled;
+    volatile boolean mCancelled;
 
     // Assuming square favicons, judging by width only is acceptable.
     protected int targetWidth;
@@ -70,14 +70,15 @@ public class LoadFaviconTask {
 
     static AndroidHttpClient httpClient = AndroidHttpClient.newInstance(GeckoAppShell.getGeckoInterface().getDefaultUAString());
 
-    public LoadFaviconTask(String pageURL, String faviconURL, int flags, OnFaviconLoadedListener listener) {
-        this(pageURL, faviconURL, flags, listener, -1, false);
+    public LoadFaviconTask(Context context, String pageURL, String faviconURL, int flags, OnFaviconLoadedListener listener) {
+        this(context, pageURL, faviconURL, flags, listener, -1, false);
     }
 
-    public LoadFaviconTask(String pageURL, String faviconURL, int flags, OnFaviconLoadedListener listener,
+    public LoadFaviconTask(Context context, String pageURL, String faviconURL, int flags, OnFaviconLoadedListener listener,
                            int targetWidth, boolean onlyFromLocal) {
         id = nextFaviconLoadId.incrementAndGet();
 
+        this.context = context;
         this.pageUrl = pageURL;
         this.faviconURL = faviconURL;
         this.listener = listener;
@@ -112,7 +113,7 @@ public class LoadFaviconTask {
      * @return The HttpResponse containing the downloaded Favicon if successful, null otherwise.
      */
     private HttpResponse tryDownload(URI faviconURI) throws URISyntaxException, IOException {
-        HashSet<String> visitedLinkSet = new HashSet<String>();
+        HashSet<String> visitedLinkSet = new HashSet<>();
         visitedLinkSet.add(faviconURI.toString());
         return tryDownloadRecurse(faviconURI, visitedLinkSet);
     }
@@ -183,7 +184,7 @@ public class LoadFaviconTask {
      * Retrieve the specified favicon from the JAR, returning null if it's not
      * a JAR URI.
      */
-    private static Bitmap fetchJARFavicon(String uri) {
+    private Bitmap fetchJARFavicon(String uri) {
         if (uri == null) {
             return null;
         }
@@ -354,7 +355,7 @@ public class LoadFaviconTask {
         return mCancelled;
     }
 
-    /* inner-access */ Bitmap doInBackground() {
+    Bitmap doInBackground() {
         if (isCancelled()) {
             return null;
         }
@@ -370,7 +371,7 @@ public class LoadFaviconTask {
 
             // If that failed, try to get the URL from the database.
             if (storedFaviconUrl == null) {
-                storedFaviconUrl = Favicons.getFaviconURLForPageURL(pageUrl);
+                storedFaviconUrl = Favicons.getFaviconURLForPageURL(context, pageUrl);
                 if (storedFaviconUrl != null) {
                     // If that succeeded, cache the URL loaded from the database in memory.
                     Favicons.putFaviconURLForPageURLInCache(pageUrl, storedFaviconUrl);
@@ -519,7 +520,7 @@ public class LoadFaviconTask {
                image.getHeight() > 0;
     }
 
-    /* inner-access */ void onPostExecute(Bitmap image) {
+    void onPostExecute(Bitmap image) {
         if (isChaining) {
             return;
         }
@@ -563,7 +564,7 @@ public class LoadFaviconTask {
         Favicons.dispatchResult(pageUrl, faviconURL, scaled, listener);
     }
 
-    /* inner-access */ void onCancelled() {
+    void onCancelled() {
         Favicons.removeLoadTask(id);
 
         synchronized(loadsInFlight) {
@@ -597,7 +598,7 @@ public class LoadFaviconTask {
      */
     private void chainTasks(LoadFaviconTask aChainee) {
         if (chainees == null) {
-            chainees = new LinkedList<LoadFaviconTask>();
+            chainees = new LinkedList<>();
         }
 
         chainees.add(aChainee);
diff --git a/mobile/android/base/favicons/decoders/ICODecoder.java b/mobile/android/base/favicons/decoders/ICODecoder.java
index 60dd092bb8f..18078b95439 100644
--- a/mobile/android/base/favicons/decoders/ICODecoder.java
+++ b/mobile/android/base/favicons/decoders/ICODecoder.java
@@ -84,7 +84,7 @@ public class ICODecoder implements Iterable<Bitmap> {
     private int offset;
     private int len;
 
-    /* inner-access */ IconDirectoryEntry[] iconDirectory;
+    IconDirectoryEntry[] iconDirectory;
     private boolean isValid;
     private boolean hasDecoded;
 
diff --git a/mobile/android/base/health/BrowserHealthRecorder.java b/mobile/android/base/health/BrowserHealthRecorder.java
index 1e02a5e836b..daded3b4bb3 100644
--- a/mobile/android/base/health/BrowserHealthRecorder.java
+++ b/mobile/android/base/health/BrowserHealthRecorder.java
@@ -88,8 +88,8 @@ public class BrowserHealthRecorder implements HealthRecorder, GeckoEventListener
     private final AtomicBoolean orphanChecked = new AtomicBoolean(false);
     private volatile int env = -1;
 
-    /* inner-access */ final EventDispatcher dispatcher;
-    /* inner-access */ final ProfileInformationCache profileCache;
+    final EventDispatcher dispatcher;
+    final ProfileInformationCache profileCache;
     private ContentProviderClient client;
     private volatile HealthReportDatabaseStorage storage;
     private final ConfigurationProvider configProvider;
@@ -649,7 +649,7 @@ public class BrowserHealthRecorder implements HealthRecorder, GeckoEventListener
         "bartext",
     })));
 
-    /* inner-access */ void initializeSearchProvider() {
+    void initializeSearchProvider() {
         this.storage.ensureMeasurementInitialized(
             MEASUREMENT_NAME_SEARCH_COUNTS,
             MEASUREMENT_VERSION_SEARCH_COUNTS,
@@ -784,7 +784,7 @@ public class BrowserHealthRecorder implements HealthRecorder, GeckoEventListener
     public static final String MEASUREMENT_NAME_SESSIONS = "org.mozilla.appSessions";
     public static final int MEASUREMENT_VERSION_SESSIONS = 4;
 
-    /* inner-access */ void initializeSessionsProvider() {
+    void initializeSessionsProvider() {
         this.storage.ensureMeasurementInitialized(
             MEASUREMENT_NAME_SESSIONS,
             MEASUREMENT_VERSION_SESSIONS,
diff --git a/mobile/android/base/home/HomeConfig.java b/mobile/android/base/home/HomeConfig.java
index 06319717ab4..77d4fddebf8 100644
--- a/mobile/android/base/home/HomeConfig.java
+++ b/mobile/android/base/home/HomeConfig.java
@@ -8,8 +8,8 @@ package org.mozilla.gecko.home;
 import org.mozilla.gecko.GeckoAppShell;
 import org.mozilla.gecko.GeckoEvent;
 import org.mozilla.gecko.R;
+import org.mozilla.gecko.home.RemoteTabsPanel;
 import org.mozilla.gecko.util.ThreadUtils;
-
 import org.json.JSONArray;
 import org.json.JSONException;
 import org.json.JSONObject;
@@ -39,6 +39,7 @@ public final class HomeConfig {
         TOP_SITES("top_sites", TopSitesPanel.class),
         BOOKMARKS("bookmarks", BookmarksPanel.class),
         HISTORY("history", HistoryPanel.class),
+        REMOTE_TABS("remote_tabs", RemoteTabsPanel.class),
         READING_LIST("reading_list", ReadingListPanel.class),
         RECENT_TABS("recent_tabs", RecentTabsPanel.class),
         DYNAMIC("dynamic", DynamicPanel.class);
@@ -369,6 +370,11 @@ public final class HomeConfig {
             return mId.equals(other.mId);
         }
 
+        @Override
+        public int hashCode() {
+            return super.hashCode();
+        }
+
         @Override
         public int describeContents() {
             return 0;
@@ -1495,6 +1501,7 @@ public final class HomeConfig {
     private static final String READING_LIST_PANEL_ID = "20f4549a-64ad-4c32-93e4-1dcef792733b";
     private static final String HISTORY_PANEL_ID = "f134bf20-11f7-4867-ab8b-e8e705d7fbe8";
     private static final String RECENT_TABS_PANEL_ID = "5c2601a5-eedc-4477-b297-ce4cef52adf8";
+    private static final String REMOTE_TABS_PANEL_ID = "72429afd-8d8b-43d8-9189-14b779c563d0";
 
     private final HomeConfigBackend mBackend;
 
@@ -1545,6 +1552,11 @@ public final class HomeConfig {
                 id = HISTORY_PANEL_ID;
                 break;
 
+            case REMOTE_TABS:
+                titleId = R.string.home_remote_tabs_title;
+                id = REMOTE_TABS_PANEL_ID;
+                break;
+
             case READING_LIST:
                 titleId = R.string.reading_list_title;
                 id = READING_LIST_PANEL_ID;
diff --git a/mobile/android/base/home/HomeConfigPrefsBackend.java b/mobile/android/base/home/HomeConfigPrefsBackend.java
index 9ef71337f0a..91143b93ae3 100644
--- a/mobile/android/base/home/HomeConfigPrefsBackend.java
+++ b/mobile/android/base/home/HomeConfigPrefsBackend.java
@@ -9,7 +9,6 @@ import static org.mozilla.gecko.home.HomeConfig.createBuiltinPanelConfig;
 
 import java.util.ArrayList;
 import java.util.EnumSet;
-import java.util.List;
 import java.util.Locale;
 
 import org.json.JSONArray;
@@ -28,7 +27,6 @@ import android.content.Context;
 import android.content.Intent;
 import android.content.IntentFilter;
 import android.content.SharedPreferences;
-import android.content.SharedPreferences.OnSharedPreferenceChangeListener;
 import android.support.v4.content.LocalBroadcastManager;
 import android.text.TextUtils;
 import android.util.Log;
@@ -37,7 +35,7 @@ class HomeConfigPrefsBackend implements HomeConfigBackend {
     private static final String LOGTAG = "GeckoHomeConfigBackend";
 
     // Increment this to trigger a migration.
-    private static final int VERSION = 1;
+    private static final int VERSION = 2;
 
     // This key was originally used to store only an array of panel configs.
     private static final String PREFS_CONFIG_KEY_OLD = "home_panels";
@@ -83,15 +81,18 @@ class HomeConfigPrefsBackend implements HomeConfigBackend {
 
         final PanelConfig historyEntry = createBuiltinPanelConfig(mContext, PanelType.HISTORY);
         final PanelConfig recentTabsEntry = createBuiltinPanelConfig(mContext, PanelType.RECENT_TABS);
+        final PanelConfig remoteTabsEntry = createBuiltinPanelConfig(mContext, PanelType.REMOTE_TABS);
 
-        // On tablets, the history panel is the last.
-        // On phones, the history panel is the first one.
+        // On tablets, we go [...|History|Recent Tabs|Synced Tabs].
+        // On phones, we go [Synced Tabs|Recent Tabs|History|...].
         if (HardwareUtils.isTablet()) {
             panelConfigs.add(historyEntry);
             panelConfigs.add(recentTabsEntry);
+            panelConfigs.add(remoteTabsEntry);
         } else {
             panelConfigs.add(0, historyEntry);
             panelConfigs.add(0, recentTabsEntry);
+            panelConfigs.add(0, remoteTabsEntry);
         }
 
         return new State(panelConfigs, true);
@@ -113,6 +114,53 @@ class HomeConfigPrefsBackend implements HomeConfigBackend {
         return true;
     }
 
+    protected enum Position {
+        NONE, // Not present.
+        FRONT, // At the front of the list of panels.
+        BACK, // At the back of the list of panels.
+    }
+
+    /**
+     * Create and insert a built-in panel configuration.
+     *
+     * @param context Android context.
+     * @param jsonPanels array of JSON panels to update in place.
+     * @param panelType to add.
+     * @param positionOnPhones where to place the new panel on phones.
+     * @param positionOnTablets where to place the new panel on tablets.
+     * @throws JSONException
+     */
+    protected static void addBuiltinPanelConfig(Context context, JSONArray jsonPanels,
+            PanelType panelType, Position positionOnPhones, Position positionOnTablets) throws JSONException {
+        // Add the new panel.
+        final JSONObject jsonPanelConfig =
+                createBuiltinPanelConfig(context, panelType).toJSON();
+
+        // If any panel is enabled, then we should make the new panel enabled.
+        jsonPanelConfig.put(PanelConfig.JSON_KEY_DISABLED,
+                                 allPanelsAreDisabled(jsonPanels));
+
+        final boolean isTablet = HardwareUtils.isTablet();
+        final boolean isPhone = !isTablet;
+
+        // Maybe add the new panel to the front of the array.
+        if ((isPhone && positionOnPhones == Position.FRONT) ||
+            (isTablet && positionOnTablets == Position.FRONT)) {
+            // This is an inefficient way to stretch [a, b, c] to [a, a, b, c].
+            for (int i = jsonPanels.length(); i >= 1; i--) {
+                jsonPanels.put(i, jsonPanels.get(i - 1));
+            }
+            // And this inserts [d, a, b, c].
+            jsonPanels.put(0, jsonPanelConfig);
+        }
+
+        // Maybe add the new panel to the back of the array.
+        if ((isPhone && positionOnPhones == Position.BACK) ||
+            (isTablet && positionOnTablets == Position.BACK)) {
+            jsonPanels.put(jsonPanelConfig);
+        }
+    }
+
     /**
      * Migrates JSON config data storage.
      *
@@ -131,27 +179,26 @@ class HomeConfigPrefsBackend implements HomeConfigBackend {
         // Make sure we only do this version check once.
         sMigrationDone = true;
 
-        final JSONArray originalJsonPanels;
+        final JSONArray jsonPanels;
         final int version;
 
         final SharedPreferences prefs = GeckoSharedPrefs.forProfile(context);
         if (prefs.contains(PREFS_CONFIG_KEY_OLD)) {
             // Our original implementation did not contain versioning, so this is implicitly version 0.
-            originalJsonPanels = new JSONArray(jsonString);
+            jsonPanels = new JSONArray(jsonString);
             version = 0;
         } else {
             final JSONObject json = new JSONObject(jsonString);
-            originalJsonPanels = json.getJSONArray(JSON_KEY_PANELS);
+            jsonPanels = json.getJSONArray(JSON_KEY_PANELS);
             version = json.getInt(JSON_KEY_VERSION);
         }
 
         if (version == VERSION) {
-            return originalJsonPanels;
+            return jsonPanels;
         }
 
         Log.d(LOGTAG, "Performing migration");
 
-        final JSONArray newJsonPanels = new JSONArray();
         final SharedPreferences.Editor prefsEditor = prefs.edit();
 
         for (int v = version + 1; v <= VERSION; v++) {
@@ -159,47 +206,31 @@ class HomeConfigPrefsBackend implements HomeConfigBackend {
 
             switch (v) {
                 case 1:
-                    // Add "Recent Tabs" panel
-                    final JSONObject jsonRecentTabsConfig =
-                            createBuiltinPanelConfig(context, PanelType.RECENT_TABS).toJSON();
-
-                    // If any panel is enabled, then we should make the recent tabs
-                    // panel enabled.
-                    jsonRecentTabsConfig.put(PanelConfig.JSON_KEY_DISABLED,
-                                             allPanelsAreDisabled(originalJsonPanels));
-
-                    // Add the new panel to the front of the array on phones.
-                    if (!HardwareUtils.isTablet()) {
-                        newJsonPanels.put(jsonRecentTabsConfig);
-                    }
-
-                    // Copy the original panel configs.
-                    final int count = originalJsonPanels.length();
-                    for (int i = 0; i < count; i++) {
-                        final JSONObject jsonPanelConfig = originalJsonPanels.getJSONObject(i);
-                        newJsonPanels.put(jsonPanelConfig);
-                    }
-
-                    // Add the new panel to the end of the array on tablets.
-                    if (HardwareUtils.isTablet()) {
-                        newJsonPanels.put(jsonRecentTabsConfig);
-                    }
+                    // Add "Recent Tabs" panel.
+                    addBuiltinPanelConfig(context, jsonPanels,
+                            PanelType.RECENT_TABS, Position.FRONT, Position.BACK);
 
                     // Remove the old pref key.
                     prefsEditor.remove(PREFS_CONFIG_KEY_OLD);
                     break;
+
+                case 2:
+                    // Add "Remote Tabs"/"Synced Tabs" panel.
+                    addBuiltinPanelConfig(context, jsonPanels,
+                            PanelType.REMOTE_TABS, Position.FRONT, Position.BACK);
+                    break;
             }
         }
 
         // Save the new panel config and the new version number.
         final JSONObject newJson = new JSONObject();
-        newJson.put(JSON_KEY_PANELS, newJsonPanels);
+        newJson.put(JSON_KEY_PANELS, jsonPanels);
         newJson.put(JSON_KEY_VERSION, VERSION);
 
         prefsEditor.putString(PREFS_CONFIG_KEY, newJson.toString());
         prefsEditor.apply();
 
-        return newJsonPanels;
+        return jsonPanels;
     }
 
     private State loadConfigFromString(String jsonString) {
diff --git a/mobile/android/base/home/HomeContextMenuInfo.java b/mobile/android/base/home/HomeContextMenuInfo.java
index 3fff52fa3af..09de3190a97 100644
--- a/mobile/android/base/home/HomeContextMenuInfo.java
+++ b/mobile/android/base/home/HomeContextMenuInfo.java
@@ -5,13 +5,13 @@
 
 package org.mozilla.gecko.home;
 
-import org.mozilla.gecko.db.BrowserContract.Combined;
 import org.mozilla.gecko.util.StringUtils;
 
 import android.database.Cursor;
 import android.text.TextUtils;
 import android.view.View;
 import android.widget.AdapterView.AdapterContextMenuInfo;
+import android.widget.ExpandableListAdapter;
 
 /**
  * A ContextMenuInfo for HomeListView
@@ -52,10 +52,17 @@ public class HomeContextMenuInfo extends AdapterContextMenuInfo {
         return StringUtils.stripCommonSubdomains(StringUtils.stripScheme(url, StringUtils.UrlFlags.STRIP_HTTPS));
     }
 
-    /*
-     * Interface for creating ContextMenuInfo from cursors
+    /**
+     * Interface for creating ContextMenuInfo instances from cursors.
      */
     public interface Factory {
         public HomeContextMenuInfo makeInfoForCursor(View view, int position, long id, Cursor cursor);
     }
+
+    /**
+     * Interface for creating ContextMenuInfo instances from ExpandableListAdapters.
+     */
+    public interface ExpandableFactory {
+        public HomeContextMenuInfo makeInfoForAdapter(View view, int position, long id, ExpandableListAdapter adapter);
+    }
 }
diff --git a/mobile/android/base/home/HomeExpandableListView.java b/mobile/android/base/home/HomeExpandableListView.java
new file mode 100644
index 00000000000..7badd692909
--- /dev/null
+++ b/mobile/android/base/home/HomeExpandableListView.java
@@ -0,0 +1,68 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import android.content.Context;
+import android.util.AttributeSet;
+import android.view.ContextMenu.ContextMenuInfo;
+import android.view.View;
+import android.widget.AdapterView;
+import android.widget.AdapterView.OnItemLongClickListener;
+import android.widget.ExpandableListView;
+
+/**
+ * <code>HomeExpandableListView</code> is a custom extension of
+ * <code>ExpandableListView<code>, that packs a <code>HomeContextMenuInfo</code>
+ * when any of its rows is long pressed.
+ * <p>
+ * This is the <code>ExpandableListView</code> equivalent of
+ * <code>HomeListView</code>.
+ */
+public class HomeExpandableListView extends ExpandableListView
+                                    implements OnItemLongClickListener {
+
+    // ContextMenuInfo associated with the currently long pressed list item.
+    private HomeContextMenuInfo mContextMenuInfo;
+
+    // ContextMenuInfo factory.
+    private HomeContextMenuInfo.ExpandableFactory mContextMenuInfoFactory;
+
+    public HomeExpandableListView(Context context) {
+        this(context, null);
+    }
+
+    public HomeExpandableListView(Context context, AttributeSet attrs) {
+        this(context, attrs, 0);
+    }
+
+    public HomeExpandableListView(Context context, AttributeSet attrs, int defStyle) {
+        super(context, attrs, defStyle);
+
+        setOnItemLongClickListener(this);
+    }
+
+    @Override
+    public boolean onItemLongClick(AdapterView<?> parent, View view, int position, long id) {
+        if (mContextMenuInfoFactory == null) {
+            return false;
+        }
+
+        // HomeExpandableListView items can correspond to groups and children.
+        // The factory can determine whether to add context menu for either,
+        // both, or none by unpacking the given position.
+        mContextMenuInfo = mContextMenuInfoFactory.makeInfoForAdapter(view, position, id, getExpandableListAdapter());
+        return showContextMenuForChild(HomeExpandableListView.this);
+    }
+
+    @Override
+    public ContextMenuInfo getContextMenuInfo() {
+        return mContextMenuInfo;
+    }
+
+    public void setContextMenuInfoFactory(final HomeContextMenuInfo.ExpandableFactory factory) {
+        mContextMenuInfoFactory = factory;
+    }
+}
diff --git a/mobile/android/base/home/HomeFragment.java b/mobile/android/base/home/HomeFragment.java
index bb668d68cbb..ffb224d46bb 100644
--- a/mobile/android/base/home/HomeFragment.java
+++ b/mobile/android/base/home/HomeFragment.java
@@ -50,7 +50,7 @@ import android.widget.Toast;
  * <p>
  * The containing activity <b>must</b> implement {@link OnUrlOpenListener}.
  */
-abstract class HomeFragment extends Fragment {
+public abstract class HomeFragment extends Fragment {
     // Log Tag.
     private static final String LOGTAG="GeckoHomeFragment";
 
@@ -194,7 +194,7 @@ abstract class HomeFragment extends Fragment {
             }
 
             // Fetch an icon big enough for use as a home screen icon.
-            Favicons.getPreferredSizeFaviconForPage(info.url, new GeckoAppShell.CreateShortcutFaviconLoadedListener(info.url, info.getDisplayTitle()));
+            Favicons.getPreferredSizeFaviconForPage(context, info.url, new GeckoAppShell.CreateShortcutFaviconLoadedListener(info.url, info.getDisplayTitle()));
             return true;
         }
 
diff --git a/mobile/android/base/home/HomePager.java b/mobile/android/base/home/HomePager.java
index 30835ec14d2..f08d6743678 100644
--- a/mobile/android/base/home/HomePager.java
+++ b/mobile/android/base/home/HomePager.java
@@ -70,6 +70,7 @@ public class HomePager extends ViewPager {
     public static final String LIST_TAG_TOP_SITES = "top_sites";
     public static final String LIST_TAG_RECENT_TABS = "recent_tabs";
     public static final String LIST_TAG_BROWSER_SEARCH = "browser_search";
+    public static final String LIST_TAG_REMOTE_TABS = "remote_tabs";
 
     public interface OnUrlOpenListener {
         public enum Flags {
@@ -120,8 +121,8 @@ public class HomePager extends ViewPager {
         LOADED
     }
 
-    static final String CAN_LOAD_ARG = "canLoad";
-    static final String PANEL_CONFIG_ARG = "panelConfig";
+    public static final String CAN_LOAD_ARG = "canLoad";
+    public static final String PANEL_CONFIG_ARG = "panelConfig";
 
     public HomePager(Context context) {
         this(context, null);
diff --git a/mobile/android/base/home/RemoteTabsExpandableListFragment.java b/mobile/android/base/home/RemoteTabsExpandableListFragment.java
new file mode 100644
index 00000000000..6681734aa39
--- /dev/null
+++ b/mobile/android/base/home/RemoteTabsExpandableListFragment.java
@@ -0,0 +1,267 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import java.util.EnumSet;
+import java.util.List;
+
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.RemoteTabsExpandableListAdapter;
+import org.mozilla.gecko.TabsAccessor;
+import org.mozilla.gecko.TabsAccessor.RemoteClient;
+import org.mozilla.gecko.TabsAccessor.RemoteTab;
+import org.mozilla.gecko.Telemetry;
+import org.mozilla.gecko.TelemetryContract;
+import org.mozilla.gecko.fxa.FirefoxAccounts;
+import org.mozilla.gecko.home.HomePager.OnUrlOpenListener;
+import org.mozilla.gecko.widget.GeckoSwipeRefreshLayout;
+import org.mozilla.gecko.widget.GeckoSwipeRefreshLayout.OnRefreshListener;
+
+import android.accounts.Account;
+import android.content.Context;
+import android.database.Cursor;
+import android.os.Bundle;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
+import android.support.v4.content.Loader;
+import android.util.Log;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.ViewGroup;
+import android.view.ViewStub;
+import android.widget.ExpandableListAdapter;
+import android.widget.ExpandableListView;
+import android.widget.ExpandableListView.OnChildClickListener;
+import android.widget.ExpandableListView.OnGroupClickListener;
+import android.widget.ImageView;
+import android.widget.TextView;
+
+/**
+ * Fragment that displays tabs from other devices in an <code>ExpandableListView<code>.
+ * <p>
+ * This is intended to be used on phones, and possibly in portrait mode on tablets.
+ */
+public class RemoteTabsExpandableListFragment extends HomeFragment {
+    // Logging tag name.
+    private static final String LOGTAG = "GeckoRemoteTabsExpList";
+
+    // Cursor loader ID.
+    private static final int LOADER_ID_REMOTE_TABS = 0;
+
+    private static final String[] STAGES_TO_SYNC_ON_REFRESH = new String[] { "clients", "tabs" };
+
+    // Adapter for the list of remote tabs.
+    private RemoteTabsExpandableListAdapter mAdapter;
+
+    // The view shown by the fragment.
+    private HomeExpandableListView mList;
+
+    // Reference to the View to display when there are no results.
+    private View mEmptyView;
+
+    // Callbacks used for the loader.
+    private CursorLoaderCallbacks mCursorLoaderCallbacks;
+
+    // Child refresh layout view.
+    private GeckoSwipeRefreshLayout mRefreshLayout;
+
+    // Sync listener that stops refreshing when a sync is completed.
+    private RemoteTabsSyncListener mSyncStatusListener;
+
+    public static RemoteTabsExpandableListFragment newInstance() {
+        return new RemoteTabsExpandableListFragment();
+    }
+
+    public RemoteTabsExpandableListFragment() {
+        super();
+    }
+
+    @Override
+    public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
+        return inflater.inflate(R.layout.home_remote_tabs_list_panel, container, false);
+    }
+
+    @Override
+    public void onViewCreated(View view, Bundle savedInstanceState) {
+        mRefreshLayout = (GeckoSwipeRefreshLayout) view.findViewById(R.id.remote_tabs_refresh_layout);
+        mRefreshLayout.setColorScheme(
+                R.color.swipe_refresh_orange, R.color.swipe_refresh_white,
+                R.color.swipe_refresh_orange, R.color.swipe_refresh_white);
+        mRefreshLayout.setOnRefreshListener(new RemoteTabsRefreshListener());
+
+        mSyncStatusListener = new RemoteTabsSyncListener();
+        FirefoxAccounts.addSyncStatusListener(mSyncStatusListener);
+
+        mList = (HomeExpandableListView) view.findViewById(R.id.list);
+        mList.setTag(HomePager.LIST_TAG_REMOTE_TABS);
+
+        mList.setOnChildClickListener(new OnChildClickListener() {
+            @Override
+            public boolean onChildClick(ExpandableListView parent, View v, int groupPosition, int childPosition, long id) {
+                final ExpandableListAdapter adapter = parent.getExpandableListAdapter();
+                final RemoteTab tab = (RemoteTab) adapter.getChild(groupPosition, childPosition);
+                if (tab == null) {
+                    return false;
+                }
+
+                Telemetry.sendUIEvent(TelemetryContract.Event.LOAD_URL, TelemetryContract.Method.LIST_ITEM);
+
+                // This item is a TwoLinePageRow, so we allow switch-to-tab.
+                mUrlOpenListener.onUrlOpen(tab.url, EnumSet.of(OnUrlOpenListener.Flags.ALLOW_SWITCH_TO_TAB));
+                return true;
+            }
+        });
+
+        mList.setOnGroupClickListener(new OnGroupClickListener() {
+            @Override
+            public boolean onGroupClick(ExpandableListView parent, View v, int groupPosition, long id) {
+                // Since we don't indicate the expansion state yet, don't allow
+                // collapsing groups at all.
+                return true;
+            }
+        });
+
+        // Show a context menu only for tabs (not for clients).
+        mList.setContextMenuInfoFactory(new HomeContextMenuInfo.ExpandableFactory() {
+            @Override
+            public HomeContextMenuInfo makeInfoForAdapter(View view, int position, long id, ExpandableListAdapter adapter) {
+                long packedPosition = mList.getExpandableListPosition(position);
+                if (ExpandableListView.getPackedPositionType(packedPosition) != ExpandableListView.PACKED_POSITION_TYPE_CHILD) {
+                    return null;
+                }
+                final int groupPosition = ExpandableListView.getPackedPositionGroup(packedPosition);
+                final int childPosition = ExpandableListView.getPackedPositionChild(packedPosition);
+                final Object child = adapter.getChild(groupPosition, childPosition);
+                if (child instanceof RemoteTab) {
+                    final RemoteTab tab = (RemoteTab) child;
+                    final HomeContextMenuInfo info = new HomeContextMenuInfo(view, position, id);
+                    info.url = tab.url;
+                    info.title = tab.title;
+                    return info;
+                } else {
+                    return null;
+                }
+            }
+        });
+
+        registerForContextMenu(mList);
+    }
+
+    @Override
+    public void onDestroyView() {
+        super.onDestroyView();
+        mList = null;
+        mEmptyView = null;
+
+        if (mSyncStatusListener != null) {
+            FirefoxAccounts.removeSyncStatusListener(mSyncStatusListener);
+            mSyncStatusListener = null;
+        }
+    }
+
+    @Override
+    public void onActivityCreated(Bundle savedInstanceState) {
+        super.onActivityCreated(savedInstanceState);
+
+        // Intialize adapter
+        mAdapter = new RemoteTabsExpandableListAdapter(R.layout.home_remote_tabs_group, R.layout.home_remote_tabs_child, null);
+        mList.setAdapter(mAdapter);
+
+        // Create callbacks before the initial loader is started
+        mCursorLoaderCallbacks = new CursorLoaderCallbacks();
+        loadIfVisible();
+    }
+
+    private void updateUiFromClients(List<RemoteClient> clients) {
+        if (clients != null && !clients.isEmpty()) {
+            for (int i = 0; i < mList.getExpandableListAdapter().getGroupCount(); i++) {
+                mList.expandGroup(i);
+            }
+            return;
+        }
+
+        // Cursor is empty, so set the empty view if it hasn't been set already.
+        if (mEmptyView == null) {
+            // Set empty panel view. We delay this so that the empty view won't flash.
+            final ViewStub emptyViewStub = (ViewStub) getView().findViewById(R.id.home_empty_view_stub);
+            mEmptyView = emptyViewStub.inflate();
+
+            final ImageView emptyIcon = (ImageView) mEmptyView.findViewById(R.id.home_empty_image);
+            emptyIcon.setImageResource(R.drawable.icon_remote_tabs_empty);
+
+            final TextView emptyText = (TextView) mEmptyView.findViewById(R.id.home_empty_text);
+            emptyText.setText(R.string.home_remote_tabs_empty);
+
+            mList.setEmptyView(mEmptyView);
+        }
+    }
+
+    @Override
+    protected void load() {
+        getLoaderManager().initLoader(LOADER_ID_REMOTE_TABS, null, mCursorLoaderCallbacks);
+    }
+
+    private static class RemoteTabsCursorLoader extends SimpleCursorLoader {
+        public RemoteTabsCursorLoader(Context context) {
+            super(context);
+        }
+
+        @Override
+        public Cursor loadCursor() {
+            return TabsAccessor.getRemoteTabsCursor(getContext());
+        }
+    }
+
+    private class CursorLoaderCallbacks implements LoaderCallbacks<Cursor> {
+        @Override
+        public Loader<Cursor> onCreateLoader(int id, Bundle args) {
+            return new RemoteTabsCursorLoader(getActivity());
+        }
+
+        @Override
+        public void onLoadFinished(Loader<Cursor> loader, Cursor c) {
+            final List<RemoteClient> clients = TabsAccessor.getClientsFromCursor(c);
+            mAdapter.replaceClients(clients);
+            updateUiFromClients(clients);
+        }
+
+        @Override
+        public void onLoaderReset(Loader<Cursor> loader) {
+            mAdapter.replaceClients(null);
+        }
+    }
+
+    private class RemoteTabsRefreshListener implements OnRefreshListener {
+        @Override
+        public void onRefresh() {
+            if (FirefoxAccounts.firefoxAccountsExist(getActivity())) {
+                final Account account = FirefoxAccounts.getFirefoxAccount(getActivity());
+                FirefoxAccounts.requestSync(account, FirefoxAccounts.FORCE, STAGES_TO_SYNC_ON_REFRESH, null);
+            } else {
+                Log.wtf(LOGTAG, "No Firefox Account found; this should never happen. Ignoring.");
+                mRefreshLayout.setRefreshing(false);
+            }
+        }
+    }
+
+    private class RemoteTabsSyncListener implements FirefoxAccounts.SyncStatusListener {
+        @Override
+        public Context getContext() {
+            return getActivity();
+        }
+
+        @Override
+        public Account getAccount() {
+            return FirefoxAccounts.getFirefoxAccount(getContext());
+        }
+
+        public void onSyncStarted() {
+        }
+
+        public void onSyncFinished() {
+            mRefreshLayout.setRefreshing(false);
+        }
+    }
+}
diff --git a/mobile/android/base/home/RemoteTabsPanel.java b/mobile/android/base/home/RemoteTabsPanel.java
new file mode 100644
index 00000000000..9cdea093d4f
--- /dev/null
+++ b/mobile/android/base/home/RemoteTabsPanel.java
@@ -0,0 +1,221 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import java.util.HashMap;
+
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.fxa.AccountLoader;
+import org.mozilla.gecko.fxa.FirefoxAccounts;
+import org.mozilla.gecko.fxa.FxAccountConstants;
+import org.mozilla.gecko.fxa.login.State;
+import org.mozilla.gecko.fxa.login.State.Action;
+import org.mozilla.gecko.sync.SyncConstants;
+
+import android.accounts.Account;
+import android.os.Bundle;
+import android.support.v4.app.Fragment;
+import android.support.v4.app.LoaderManager.LoaderCallbacks;
+import android.support.v4.content.Loader;
+import android.util.Log;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.ViewGroup;
+
+/**
+ * A <code>HomeFragment</code> that, depending on the state of accounts on the
+ * device:
+ * <ul>
+ * <li>displays remote tabs from other devices;</li>
+ * <li>offers to re-connect a Firefox Account;</li>
+ * <li>offers to create a new Firefox Account.</li>
+ * </ul>
+ */
+public class RemoteTabsPanel extends HomeFragment {
+    private static final String LOGTAG = "GeckoRemoteTabsPanel";
+
+    // Loader ID for Android Account loader.
+    private static final int LOADER_ID_ACCOUNT = 0;
+
+    // Callback for loaders.
+    private AccountLoaderCallbacks mAccountLoaderCallbacks;
+
+    // The current fragment being shown to reflect the system account state. We
+    // don't want to detach and re-attach panels unnecessarily, because that
+    // causes flickering.
+    private Fragment mCurrentFragment;
+
+    // A lazily-populated cache of fragments corresponding to the possible
+    // system account states. We don't want to re-create panels unnecessarily,
+    // because that can cause flickering. Be aware that null is a valid key; it
+    // corresponds to "no Account, neither Firefox nor Legacy Sync."
+    private final HashMap<Action, Fragment> mFragmentCache = new HashMap<Action, Fragment>();
+
+    @Override
+    public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
+        return inflater.inflate(R.layout.home_remote_tabs_panel, container, false);
+    }
+
+    @Override
+    public void onActivityCreated(Bundle savedInstanceState) {
+        super.onActivityCreated(savedInstanceState);
+
+        // Create callbacks before the initial loader is started.
+        mAccountLoaderCallbacks = new AccountLoaderCallbacks();
+        loadIfVisible();
+    }
+
+    @Override
+    public void load() {
+        getLoaderManager().initLoader(LOADER_ID_ACCOUNT, null, mAccountLoaderCallbacks);
+    }
+
+    private void showSubPanel(Fragment subPanel) {
+        if (mCurrentFragment == subPanel) {
+            return;
+        }
+        mCurrentFragment = subPanel;
+
+        Bundle args = subPanel.getArguments();
+        if (args == null) {
+            args = new Bundle();
+        }
+        args.putBoolean(HomePager.CAN_LOAD_ARG, getCanLoadHint());
+        subPanel.setArguments(args);
+
+        getChildFragmentManager()
+            .beginTransaction()
+            .addToBackStack(null)
+            .replace(R.id.remote_tabs_container, subPanel)
+            .commitAllowingStateLoss();
+    }
+
+    /**
+     * Get whatever <code>Action</code> is required to continue healthy syncing
+     * of Remote Tabs.
+     * <p>
+     * A Firefox Account can be in many states, from healthy to requiring a
+     * Fennec upgrade to continue use. If we have a Firefox Account, but the
+     * state seems corrupt, the best we can do is ask for a password, which
+     * resets most of the Account state. The health of a Sync account is
+     * essentially opaque in this respect.
+     * <p>
+     * A null Account means there is no Account (Sync or Firefox) on the device.
+     *
+     * @param account
+     *            Android Account (Sync or Firefox); may be null.
+     */
+    private Action getActionNeeded(Account account) {
+        if (account == null) {
+            return null;
+        }
+
+        if (SyncConstants.ACCOUNTTYPE_SYNC.equals(account.type)) {
+            return Action.None;
+        }
+
+        if (!FxAccountConstants.ACCOUNT_TYPE.equals(account.type)) {
+            Log.wtf(LOGTAG, "Non Sync, non Firefox Android Account returned by AccountLoader; returning null.");
+            return null;
+        }
+
+        final State state = FirefoxAccounts.getFirefoxAccountState(getActivity());
+        if (state == null) {
+            Log.wtf(LOGTAG, "Firefox Account with null state found; offering needs password.");
+            return Action.NeedsPassword;
+        }
+
+        final Action actionNeeded = state.getNeededAction();
+        if (actionNeeded == null) {
+            Log.wtf(LOGTAG, "Firefox Account with non-null state but null action needed; offering needs password.");
+            return Action.NeedsPassword;
+        }
+
+        return actionNeeded;
+    }
+
+    private Fragment makeFragmentForAction(Action action) {
+        if (action == null) {
+            // This corresponds to no Account: neither Sync nor Firefox.
+            return RemoteTabsStaticFragment.newInstance(R.layout.remote_tabs_setup);
+        }
+
+        switch (action) {
+        case None:
+            return new RemoteTabsExpandableListFragment();
+        case NeedsVerification:
+            return RemoteTabsStaticFragment.newInstance(R.layout.remote_tabs_needs_verification);
+        case NeedsPassword:
+            return RemoteTabsStaticFragment.newInstance(R.layout.remote_tabs_needs_password);
+        case NeedsUpgrade:
+            return RemoteTabsStaticFragment.newInstance(R.layout.remote_tabs_needs_upgrade);
+        default:
+            // This should never happen, but we're confident we have a Firefox
+            // Account at this point, so let's show the needs password screen.
+            // That's our best hope of righting the ship.
+            Log.wtf(LOGTAG, "Got unexpected action needed; offering needs password.");
+            return RemoteTabsStaticFragment.newInstance(R.layout.remote_tabs_needs_password);
+        }
+    }
+
+    /**
+     * Get the <code>Fragment</code> that reflects the given
+     * <code>Account</code> and its state.
+     * <p>
+     * A null Account means there is no Account (Sync or Firefox) on the device.
+     *
+     * @param account
+     *            Android Account (Sync or Firefox); may be null.
+     */
+    private Fragment getFragmentNeeded(Account account) {
+        final Action actionNeeded = getActionNeeded(account);
+
+        // We use containsKey rather than get because null is a valid key.
+        if (!mFragmentCache.containsKey(actionNeeded)) {
+            final Fragment fragment = makeFragmentForAction(actionNeeded);
+            mFragmentCache.put(actionNeeded, fragment);
+        }
+        return mFragmentCache.get(actionNeeded);
+    }
+
+    /**
+     * Update the UI to reflect the given <code>Account</code> and its state.
+     * <p>
+     * A null Account means there is no Account (Sync or Firefox) on the device.
+     *
+     * @param account
+     *            Android Account (Sync or Firefox); may be null.
+     */
+    protected void updateUiFromAccount(Account account) {
+        if (getView() == null) {
+            // Early abort. When the fragment is detached, we get a loader
+            // reset, which calls this with a null account parameter. A null
+            // account is valid (it means there is no account, either Sync or
+            // Firefox), and so we start to offer the setup flow. But this all
+            // happens after the view has been destroyed, which means inserting
+            // the setup flow fails. In this case, just abort.
+            return;
+        }
+        showSubPanel(getFragmentNeeded(account));
+    }
+
+    private class AccountLoaderCallbacks implements LoaderCallbacks<Account> {
+        @Override
+        public Loader<Account> onCreateLoader(int id, Bundle args) {
+            return new AccountLoader(getActivity());
+        }
+
+        @Override
+        public void onLoadFinished(Loader<Account> loader, Account account) {
+            updateUiFromAccount(account);
+        }
+
+        @Override
+        public void onLoaderReset(Loader<Account> loader) {
+            updateUiFromAccount(null);
+        }
+    }
+}
diff --git a/mobile/android/base/home/RemoteTabsStaticFragment.java b/mobile/android/base/home/RemoteTabsStaticFragment.java
new file mode 100644
index 00000000000..7ff5983371b
--- /dev/null
+++ b/mobile/android/base/home/RemoteTabsStaticFragment.java
@@ -0,0 +1,130 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.home;
+
+import java.util.EnumSet;
+import java.util.Locale;
+
+import org.mozilla.gecko.R;
+import org.mozilla.gecko.fxa.FirefoxAccounts;
+import org.mozilla.gecko.fxa.activities.FxAccountCreateAccountActivity;
+import org.mozilla.gecko.fxa.activities.FxAccountUpdateCredentialsActivity;
+import org.mozilla.gecko.home.HomePager.OnUrlOpenListener;
+
+import android.content.Intent;
+import android.os.Bundle;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.View.OnClickListener;
+import android.view.ViewGroup;
+
+/**
+ * A <code>HomeFragment</code> which displays one of a small set of static views
+ * in response to different Firefox Account states. When the Firefox Account is
+ * healthy and syncing normally, these views should not be shown.
+ * <p>
+ * This class exists to handle view-specific actions when buttons and links
+ * shown by the different static views are clicked. For example, a static view
+ * offers to set up a Firefox Account to a user who has no account (Firefox or
+ * Sync) on their device.
+ * <p>
+ * This could be a vanilla <code>Fragment</code>, except it needs to open URLs.
+ * To do so, it expects its containing <code>Activity</code> to implement
+ * <code>OnUrlOpenListener<code>; to suggest this invariant at compile time, we
+ * inherit from <code>HomeFragment</code>.
+ */
+public class RemoteTabsStaticFragment extends HomeFragment implements OnClickListener {
+    @SuppressWarnings("unused")
+    private static final String LOGTAG = "GeckoRemoteTabsStatic";
+
+    protected static final String RESOURCE_ID = "resource_id";
+    protected static final int DEFAULT_RESOURCE_ID = R.layout.remote_tabs_setup;
+
+    private static final String CONFIRM_ACCOUNT_SUPPORT_URL =
+            "https://support.mozilla.org/kb/im-having-problems-confirming-my-firefox-account";
+
+    protected int mLayoutId;
+
+    public static RemoteTabsStaticFragment newInstance(int resourceId) {
+        final RemoteTabsStaticFragment fragment = new RemoteTabsStaticFragment();
+
+        final Bundle args = new Bundle();
+        args.putInt(RESOURCE_ID, resourceId);
+        fragment.setArguments(args);
+
+        return fragment;
+    }
+
+    @Override
+    public void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+
+        final Bundle args = getArguments();
+        if (args != null) {
+            mLayoutId = args.getInt(RESOURCE_ID, DEFAULT_RESOURCE_ID);
+        } else {
+            mLayoutId = DEFAULT_RESOURCE_ID;
+        }
+    }
+
+    @Override
+    public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) {
+        return inflater.inflate(mLayoutId, container, false);
+    }
+
+    protected boolean maybeSetOnClickListener(View view, int resourceId) {
+        final View button = view.findViewById(resourceId);
+        if (button != null) {
+            button.setOnClickListener(this);
+            return true;
+        }
+        return false;
+    }
+
+    @Override
+    public void onViewCreated(View view, Bundle savedInstanceState) {
+        for (int resourceId : new int[] {
+                R.id.remote_tabs_setup_get_started,
+                R.id.remote_tabs_setup_old_sync_link,
+                R.id.remote_tabs_needs_verification_resend_email,
+                R.id.remote_tabs_needs_verification_help,
+                R.id.remote_tabs_needs_password_sign_in, }) {
+            maybeSetOnClickListener(view, resourceId);
+        }
+    }
+
+    @Override
+    public void onClick(final View v) {
+        final int id = v.getId();
+        if (id == R.id.remote_tabs_setup_get_started) {
+            // This Activity will redirect to the correct Activity as needed.
+            final Intent intent = new Intent(getActivity(), FxAccountCreateAccountActivity.class);
+            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            startActivity(intent);
+        } else if (id == R.id.remote_tabs_setup_old_sync_link) {
+            final String url = FirefoxAccounts.getOldSyncUpgradeURL(getResources(), Locale.getDefault());
+            // Don't allow switch-to-tab.
+            final EnumSet<OnUrlOpenListener.Flags> flags = EnumSet.noneOf(OnUrlOpenListener.Flags.class);
+            mUrlOpenListener.onUrlOpen(url, flags);
+        } else if (id == R.id.remote_tabs_needs_verification_resend_email) {
+            // Send a fresh email; this displays a toast, so the user gets feedback.
+            FirefoxAccounts.resendVerificationEmail(getActivity());
+        } else if (id == R.id.remote_tabs_needs_verification_help) {
+            // Don't allow switch-to-tab.
+            final EnumSet<OnUrlOpenListener.Flags> flags = EnumSet.noneOf(OnUrlOpenListener.Flags.class);
+            mUrlOpenListener.onUrlOpen(CONFIRM_ACCOUNT_SUPPORT_URL, flags);
+        } else if (id == R.id.remote_tabs_needs_password_sign_in) {
+            // This Activity will redirect to the correct Activity as needed.
+            final Intent intent = new Intent(getActivity(), FxAccountUpdateCredentialsActivity.class);
+            intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+            startActivity(intent);
+        }
+    }
+
+    @Override
+    protected void load() {
+        // We're static, so nothing to do here!
+    }
+}
diff --git a/mobile/android/base/home/TopSitesPanel.java b/mobile/android/base/home/TopSitesPanel.java
index 124f3dbd657..3073e26a765 100644
--- a/mobile/android/base/home/TopSitesPanel.java
+++ b/mobile/android/base/home/TopSitesPanel.java
@@ -544,7 +544,7 @@ public class TopSitesPanel extends HomeFragment {
 
             // If we have no thumbnail, attempt to show a Favicon instead.
             LoadIDAwareFaviconLoadedListener listener = new LoadIDAwareFaviconLoadedListener(view);
-            final int loadId = Favicons.getSizedFaviconForPageFromLocal(url, listener);
+            final int loadId = Favicons.getSizedFaviconForPageFromLocal(context, url, listener);
             if (loadId == Favicons.LOADED) {
                 // Great!
                 return;
diff --git a/mobile/android/base/home/TwoLinePageRow.java b/mobile/android/base/home/TwoLinePageRow.java
index 6ec8ac1360d..7434e5c75cb 100644
--- a/mobile/android/base/home/TwoLinePageRow.java
+++ b/mobile/android/base/home/TwoLinePageRow.java
@@ -50,6 +50,11 @@ public class TwoLinePageRow extends LinearLayout
             this.view = new WeakReference<FaviconView>(view);
         }
 
+        /**
+         * Update this row's favicon.
+         * <p>
+         * This method is always invoked on the UI thread.
+         */
         @Override
         public void onFaviconLoaded(String url, String faviconURL, Bitmap favicon) {
             FaviconView v = view.get();
@@ -96,24 +101,49 @@ public class TwoLinePageRow extends LinearLayout
 
     @Override
     protected void onAttachedToWindow() {
+        super.onAttachedToWindow();
+
         Tabs.registerOnTabsChangedListener(this);
     }
 
     @Override
     protected void onDetachedFromWindow() {
+        super.onDetachedFromWindow();
+
         // Tabs' listener array is safe to modify during use: its
         // iteration pattern is based on snapshots.
         Tabs.unregisterOnTabsChangedListener(this);
     }
 
+    /**
+     * Update the row in response to a tab change event.
+     * <p>
+     * This method is always invoked on the UI thread.
+     */
     @Override
     public void onTabChanged(final Tab tab, final Tabs.TabEvents msg, final Object data) {
-        switch(msg) {
+        // Carefully check if this tab event is relevant to this row.
+        final String pageUrl = mPageUrl;
+        if (pageUrl == null) {
+            return;
+        }
+        final String tabUrl;
+        if (tab == null) {
+            return;
+        }
+        tabUrl = tab.getURL();
+        if (!pageUrl.equals(tabUrl)) {
+            return;
+        }
+
+        switch (msg) {
             case ADDED:
             case CLOSED:
             case LOCATION_CHANGE:
                 updateDisplayedUrl();
                 break;
+            default:
+                break;
         }
     }
 
@@ -181,32 +211,29 @@ public class TwoLinePageRow extends LinearLayout
         mShowIcons = showIcons;
     }
 
-    public void updateFromCursor(Cursor cursor) {
-        if (cursor == null) {
-            return;
-        }
-
-        int titleIndex = cursor.getColumnIndexOrThrow(URLColumns.TITLE);
-        final String title = cursor.getString(titleIndex);
-
-        int urlIndex = cursor.getColumnIndexOrThrow(URLColumns.URL);
-        final String url = cursor.getString(urlIndex);
+    /**
+     * Update the data displayed by this row.
+     * <p>
+     * This method must be invoked on the UI thread.
+     *
+     * @param title to display.
+     * @param url to display.
+     */
+    public void update(String title, String url) {
+        update(title, url, 0);
+    }
 
+    protected void update(String title, String url, long bookmarkId) {
         if (mShowIcons) {
-            final int bookmarkIdIndex = cursor.getColumnIndex(Combined.BOOKMARK_ID);
-            if (bookmarkIdIndex != -1) {
-                final long bookmarkId = cursor.getLong(bookmarkIdIndex);
-
-                // The bookmark id will be 0 (null in database) when the url
-                // is not a bookmark.
-                if (bookmarkId == 0) {
-                    setPageTypeIcon(NO_ICON);
-                } else {
-                    setPageTypeIcon(R.drawable.ic_url_bar_star);
-                }
-            } else {
+            // The bookmark id will be 0 (null in database) when the url
+            // is not a bookmark.
+            if (bookmarkId == 0) {
                 setPageTypeIcon(NO_ICON);
+            } else {
+                setPageTypeIcon(R.drawable.ic_url_bar_star);
             }
+        } else {
+            setPageTypeIcon(NO_ICON);
         }
 
         // Use the URL instead of an empty title for consistency with the normal URL
@@ -220,8 +247,38 @@ public class TwoLinePageRow extends LinearLayout
 
         // Blank the Favicon, so we don't show the wrong Favicon if we scroll and miss DB.
         mFavicon.clearImage();
-        mLoadFaviconJobId = Favicons.getSizedFaviconForPageFromLocal(url, mFaviconListener);
+        Favicons.cancelFaviconLoad(mLoadFaviconJobId);
+        mLoadFaviconJobId = Favicons.getSizedFaviconForPageFromLocal(getContext(), url, mFaviconListener);
 
         updateDisplayedUrl(url);
     }
+
+    /**
+     * Update the data displayed by this row.
+     * <p>
+     * This method must be invoked on the UI thread.
+     *
+     * @param cursor to extract data from.
+     */
+    public void updateFromCursor(Cursor cursor) {
+        if (cursor == null) {
+            return;
+        }
+
+        int titleIndex = cursor.getColumnIndexOrThrow(URLColumns.TITLE);
+        final String title = cursor.getString(titleIndex);
+
+        int urlIndex = cursor.getColumnIndexOrThrow(URLColumns.URL);
+        final String url = cursor.getString(urlIndex);
+
+        final long bookmarkId;
+        final int bookmarkIdIndex = cursor.getColumnIndex(Combined.BOOKMARK_ID);
+        if (bookmarkIdIndex != -1) {
+            bookmarkId = cursor.getLong(bookmarkIdIndex);
+        } else {
+            bookmarkId = 0;
+        }
+
+        update(title, url, bookmarkId);
+    }
 }
diff --git a/mobile/android/base/locales/en-US/android_strings.dtd b/mobile/android/base/locales/en-US/android_strings.dtd
index 939ef1b2ec6..27d2e873aa5 100644
--- a/mobile/android/base/locales/en-US/android_strings.dtd
+++ b/mobile/android/base/locales/en-US/android_strings.dtd
@@ -403,6 +403,13 @@ size. -->
      previous location in the navigation, such as the previous folder -->
 <!ENTITY home_move_up_to_filter "Up to &formatS;">
 
+<!ENTITY home_remote_tabs_title "Synced Tabs">
+<!ENTITY home_remote_tabs_empty "Your tabs from other devices show up here.">
+<!ENTITY home_remote_tabs_unable_to_connect "Unable to connect">
+<!ENTITY home_remote_tabs_need_to_sign_in "Please sign in to reconnect your Firefox Account and continue syncing.">
+<!ENTITY home_remote_tabs_trouble_verifying "Trouble verifying your account?">
+<!ENTITY home_remote_tabs_need_to_verify "Please verify your Firefox Account to start syncing.">
+
 <!ENTITY private_browsing_title "Private Browsing">
 <!ENTITY private_tabs_panel_empty_desc "Your private tabs will show up here. While we don\'t keep any of your browsing history or cookies, bookmarks and files that you download will still be saved on your device.">
 <!ENTITY private_tabs_panel_learn_more "Want to learn more?">
diff --git a/mobile/android/base/menu/GeckoMenu.java b/mobile/android/base/menu/GeckoMenu.java
index cd2404b453d..3cfcbe4d72c 100644
--- a/mobile/android/base/menu/GeckoMenu.java
+++ b/mobile/android/base/menu/GeckoMenu.java
@@ -112,7 +112,7 @@ public class GeckoMenu extends ListView
     private MenuItemsAdapter mAdapter;
 
     // Show/hide icons in the list.
-    /* inner-access */ boolean mShowIcons;
+    boolean mShowIcons;
 
     public GeckoMenu(Context context) {
         this(context, null);
@@ -550,7 +550,7 @@ public class GeckoMenu extends ListView
         handleMenuItemClick(item);
     }
 
-    /* inner-access */ void handleMenuItemClick(GeckoMenuItem item) {
+    void handleMenuItemClick(GeckoMenuItem item) {
         if (!item.isEnabled())
             return;
 
@@ -575,7 +575,7 @@ public class GeckoMenu extends ListView
         }
     }
 
-    /* inner-access */ void handleMenuItemLongClick(GeckoMenuItem item) {
+    void handleMenuItemLongClick(GeckoMenuItem item) {
         if(!item.isEnabled()) {
             return;
         }
diff --git a/mobile/android/base/menu/GeckoMenuItem.java b/mobile/android/base/menu/GeckoMenuItem.java
index d7449e48df6..935b130b1fe 100644
--- a/mobile/android/base/menu/GeckoMenuItem.java
+++ b/mobile/android/base/menu/GeckoMenuItem.java
@@ -48,8 +48,8 @@ public class GeckoMenuItem implements MenuItem {
     private GeckoActionProvider mActionProvider;
     private GeckoSubMenu mSubMenu;
     private MenuItem.OnMenuItemClickListener mMenuItemClickListener;
-    /* inner-access */ final GeckoMenu mMenu;
-    /* inner-access */ OnShowAsActionChangedListener mShowAsActionChangedListener;
+    final GeckoMenu mMenu;
+    OnShowAsActionChangedListener mShowAsActionChangedListener;
 
     public GeckoMenuItem(GeckoMenu menu, int id, int order, int titleRes) {
         mMenu = menu;
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 413a59bf76e..de9ec5b136a 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -194,6 +194,8 @@ gbjar.sources += [
     'GeckoBatteryManager.java',
     'GeckoConnectivityReceiver.java',
     'GeckoEditable.java',
+    'GeckoEditableClient.java',
+    'GeckoEditableListener.java',
     'GeckoEvent.java',
     'GeckoHalDefines.java',
     'GeckoInputConnection.java',
@@ -275,6 +277,7 @@ gbjar.sources += [
     'home/HomeConfigLoader.java',
     'home/HomeConfigPrefsBackend.java',
     'home/HomeContextMenuInfo.java',
+    'home/HomeExpandableListView.java',
     'home/HomeFragment.java',
     'home/HomeListView.java',
     'home/HomePager.java',
@@ -297,6 +300,9 @@ gbjar.sources += [
     'home/ReadingListPanel.java',
     'home/ReadingListRow.java',
     'home/RecentTabsPanel.java',
+    'home/RemoteTabsExpandableListFragment.java',
+    'home/RemoteTabsPanel.java',
+    'home/RemoteTabsStaticFragment.java',
     'home/SearchEngine.java',
     'home/SearchEngineRow.java',
     'home/SearchLoader.java',
@@ -523,6 +529,7 @@ moz_native_devices_jars = [
 ]
 moz_native_devices_sources = [
     'ChromeCast.java',
+    'GeckoMediaPlayer.java',
     'MediaPlayerManager.java',
 ]
 if CONFIG['MOZ_NATIVE_DEVICES']:
@@ -696,7 +703,12 @@ main.recursive_make_targets += ['generated/' + f for f in gbjar.generated_source
 
 main.extra_jars += [CONFIG['ANDROID_COMPAT_LIB']]
 main.assets = TOPOBJDIR + '/dist/' + CONFIG['MOZ_APP_NAME'] + '/assets'
-main.libs = TOPOBJDIR + '/dist/' + CONFIG['MOZ_APP_NAME'] + '/lib'
+main.libs = [
+    (TOPOBJDIR + '/dist/' + CONFIG['MOZ_APP_NAME'] + '/lib/' + CONFIG['ANDROID_CPU_ARCH'] + '/libmozglue.so',
+     'libs/' + CONFIG['ANDROID_CPU_ARCH'] + '/libmozglue.so'),
+    (TOPOBJDIR + '/dist/' + CONFIG['MOZ_APP_NAME'] + '/lib/' + CONFIG['ANDROID_CPU_ARCH'] + '/libplugin-container.so',
+     'libs/' + CONFIG['ANDROID_CPU_ARCH'] + '/libplugin-container.so'),
+]
 main.res = None
 
 cpe = main.add_classpathentry('src', SRCDIR,
diff --git a/mobile/android/base/preferences/SyncPreference.java b/mobile/android/base/preferences/SyncPreference.java
index d26ff9eb761..2adfb369c8f 100644
--- a/mobile/android/base/preferences/SyncPreference.java
+++ b/mobile/android/base/preferences/SyncPreference.java
@@ -5,6 +5,9 @@
 
 package org.mozilla.gecko.preferences;
 
+import org.mozilla.gecko.Telemetry;
+import org.mozilla.gecko.TelemetryContract;
+import org.mozilla.gecko.TelemetryContract.Method;
 import org.mozilla.gecko.fxa.activities.FxAccountGetStartedActivity;
 import org.mozilla.gecko.sync.setup.SyncAccounts;
 import org.mozilla.gecko.sync.setup.activities.SetupSyncActivity;
@@ -60,6 +63,7 @@ class SyncPreference extends Preference {
         // open the settings page.
         if (SyncAccounts.syncAccountsExist(mContext)) {
             if (SyncAccounts.openSyncSettings(mContext) != null) {
+                Telemetry.sendUIEvent(TelemetryContract.Event.ACTION, Method.SETTINGS, "sync_settings");
                 return;
             }
         }
@@ -67,5 +71,6 @@ class SyncPreference extends Preference {
         // Otherwise, launch the FxA "Get started" activity, which will
         // dispatch to the right location.
         launchFxASetup();
+        Telemetry.sendUIEvent(TelemetryContract.Event.ACTION, Method.SETTINGS, "sync_setup");
     }
 }
diff --git a/mobile/android/base/resources/drawable-hdpi-v11/firefox_settings_alert.png b/mobile/android/base/resources/drawable-hdpi/firefox_settings_alert.png
similarity index 100%
rename from mobile/android/base/resources/drawable-hdpi-v11/firefox_settings_alert.png
rename to mobile/android/base/resources/drawable-hdpi/firefox_settings_alert.png
diff --git a/mobile/android/base/resources/drawable-hdpi/icon_remote_tabs_empty.png b/mobile/android/base/resources/drawable-hdpi/icon_remote_tabs_empty.png
new file mode 100644
index 00000000000..7f96aee70ef
Binary files /dev/null and b/mobile/android/base/resources/drawable-hdpi/icon_remote_tabs_empty.png differ
diff --git a/mobile/android/base/resources/drawable-mdpi-v11/firefox_settings_alert.png b/mobile/android/base/resources/drawable-mdpi/firefox_settings_alert.png
similarity index 100%
rename from mobile/android/base/resources/drawable-mdpi-v11/firefox_settings_alert.png
rename to mobile/android/base/resources/drawable-mdpi/firefox_settings_alert.png
diff --git a/mobile/android/base/resources/drawable-mdpi/icon_remote_tabs_empty.png b/mobile/android/base/resources/drawable-mdpi/icon_remote_tabs_empty.png
new file mode 100644
index 00000000000..9020e1e0874
Binary files /dev/null and b/mobile/android/base/resources/drawable-mdpi/icon_remote_tabs_empty.png differ
diff --git a/mobile/android/base/resources/drawable-xhdpi-v11/firefox_settings_alert.png b/mobile/android/base/resources/drawable-xhdpi/firefox_settings_alert.png
similarity index 100%
rename from mobile/android/base/resources/drawable-xhdpi-v11/firefox_settings_alert.png
rename to mobile/android/base/resources/drawable-xhdpi/firefox_settings_alert.png
diff --git a/mobile/android/base/resources/drawable-xhdpi/icon_remote_tabs_empty.png b/mobile/android/base/resources/drawable-xhdpi/icon_remote_tabs_empty.png
new file mode 100644
index 00000000000..2bdc3daea5d
Binary files /dev/null and b/mobile/android/base/resources/drawable-xhdpi/icon_remote_tabs_empty.png differ
diff --git a/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_child.xml b/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_child.xml
index 4930b5efdf0..5ed6286c7d6 100644
--- a/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_child.xml
+++ b/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_child.xml
@@ -12,7 +12,7 @@
               android:paddingLeft="2dp"
               android:paddingRight="2dp">
 
-    <TextView android:id="@+id/tab"
+    <TextView android:id="@+id/title"
               style="@style/TabRowTextAppearance"
               android:layout_width="match_parent"
               android:layout_height="wrap_content"
diff --git a/mobile/android/base/resources/layout/home_remote_tabs_child.xml b/mobile/android/base/resources/layout/home_remote_tabs_child.xml
new file mode 100644
index 00000000000..74fef7a1beb
--- /dev/null
+++ b/mobile/android/base/resources/layout/home_remote_tabs_child.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<org.mozilla.gecko.home.TwoLinePageRow xmlns:android="http://schemas.android.com/apk/res/android"
+                                       style="@style/Widget.RemoteTabsItemView"
+                                       android:layout_width="match_parent"
+                                       android:layout_height="@dimen/page_row_height"
+                                       android:minHeight="@dimen/page_row_height"/>
diff --git a/mobile/android/base/resources/layout/home_remote_tabs_group.xml b/mobile/android/base/resources/layout/home_remote_tabs_group.xml
new file mode 100644
index 00000000000..f3ce5d56777
--- /dev/null
+++ b/mobile/android/base/resources/layout/home_remote_tabs_group.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+   This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:gecko="http://schemas.android.com/apk/res-auto"
+    style="@style/Widget.RemoteTabsClientView"
+    android:layout_width="match_parent"
+    android:layout_height="@dimen/page_row_height"
+    android:gravity="center_vertical"
+    android:minHeight="@dimen/page_row_height" >
+
+    <ImageView
+        android:id="@+id/device_type"
+        android:layout_width="@dimen/favicon_bg"
+        android:layout_height="@dimen/favicon_bg"
+        android:layout_marginLeft="10dip"
+        android:layout_marginRight="10dip" />
+
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:layout_marginRight="10dip"
+        android:orientation="vertical" >
+
+        <org.mozilla.gecko.widget.FadedTextView
+            android:id="@+id/client"
+            style="@style/Widget.TwoLinePageRow.Title"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            gecko:fadeWidth="30dp" />
+
+        <TextView
+            android:id="@+id/last_synced"
+            style="@style/Widget.TwoLinePageRow.Url"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:drawablePadding="5dp"
+            android:maxLength="1024" />
+    </LinearLayout>
+
+</LinearLayout>
diff --git a/mobile/android/base/resources/layout/home_remote_tabs_list_panel.xml b/mobile/android/base/resources/layout/home_remote_tabs_list_panel.xml
new file mode 100644
index 00000000000..97abcec66fe
--- /dev/null
+++ b/mobile/android/base/resources/layout/home_remote_tabs_list_panel.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+              android:layout_width="match_parent"
+              android:layout_height="match_parent"
+              android:orientation="vertical">
+
+    <ViewStub android:id="@+id/home_empty_view_stub"
+              android:layout="@layout/home_empty_panel"
+              android:layout_width="match_parent"
+              android:layout_height="match_parent"/>
+
+    <org.mozilla.gecko.widget.GeckoSwipeRefreshLayout
+                 android:id="@+id/remote_tabs_refresh_layout"
+                 android:layout_width="match_parent"
+                 android:layout_height="match_parent">
+
+        <org.mozilla.gecko.home.HomeExpandableListView
+                android:id="@+id/list"
+                style="@style/Widget.RemoteTabsListView"
+                android:groupIndicator="@android:color/transparent"
+                android:layout_width="match_parent"
+                android:layout_height="match_parent" />
+
+    </org.mozilla.gecko.widget.GeckoSwipeRefreshLayout>
+
+</LinearLayout>
diff --git a/mobile/android/base/resources/layout/home_remote_tabs_panel.xml b/mobile/android/base/resources/layout/home_remote_tabs_panel.xml
new file mode 100644
index 00000000000..330a446eea8
--- /dev/null
+++ b/mobile/android/base/resources/layout/home_remote_tabs_panel.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+              android:layout_width="match_parent"
+              android:layout_height="match_parent"
+              android:orientation="vertical">
+
+    <FrameLayout android:id="@+id/remote_tabs_container"
+                 android:layout_width="match_parent"
+                 android:layout_height="0dp"
+                 android:layout_weight="1" />
+
+</LinearLayout>
diff --git a/mobile/android/base/resources/layout/remote_tabs_needs_password.xml b/mobile/android/base/resources/layout/remote_tabs_needs_password.xml
new file mode 100644
index 00000000000..8ac41ba7773
--- /dev/null
+++ b/mobile/android/base/resources/layout/remote_tabs_needs_password.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+   This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    style="@style/RemoteTabsPanelFrame"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent" >
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance.Header"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/home_remote_tabs_unable_to_connect" />
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/home_remote_tabs_need_to_sign_in" />
+
+    <Button
+        android:id="@+id/remote_tabs_needs_password_sign_in"
+        style="@style/RemoteTabsPanelItem.Button"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_sign_in_button_label" />
+
+</LinearLayout>
\ No newline at end of file
diff --git a/mobile/android/base/resources/layout/remote_tabs_needs_upgrade.xml b/mobile/android/base/resources/layout/remote_tabs_needs_upgrade.xml
new file mode 100644
index 00000000000..a5f272ac1a8
--- /dev/null
+++ b/mobile/android/base/resources/layout/remote_tabs_needs_upgrade.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+   This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    style="@style/RemoteTabsPanelFrame"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent" >
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance.Header"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/home_remote_tabs_unable_to_connect" />
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_status_needs_upgrade" />
+
+</LinearLayout>
diff --git a/mobile/android/base/resources/layout/remote_tabs_needs_verification.xml b/mobile/android/base/resources/layout/remote_tabs_needs_verification.xml
new file mode 100644
index 00000000000..fca6a906629
--- /dev/null
+++ b/mobile/android/base/resources/layout/remote_tabs_needs_verification.xml
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+   This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    style="@style/RemoteTabsPanelFrame"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent" >
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance.Header"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_confirm_account_header" />
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/home_remote_tabs_need_to_verify" />
+
+    <Button
+        android:id="@+id/remote_tabs_needs_verification_resend_email"
+        style="@style/RemoteTabsPanelItem.Button"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_confirm_account_resend_email" />
+
+    <TextView
+        android:id="@+id/remote_tabs_needs_verification_help"
+        style="@style/RemoteTabsPanelItem.TextAppearance.Linkified"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/home_remote_tabs_trouble_verifying" />
+
+</LinearLayout>
diff --git a/mobile/android/base/resources/layout/remote_tabs_setup.xml b/mobile/android/base/resources/layout/remote_tabs_setup.xml
new file mode 100644
index 00000000000..fe4ef128b58
--- /dev/null
+++ b/mobile/android/base/resources/layout/remote_tabs_setup.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+   This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    style="@style/RemoteTabsPanelFrame"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent" >
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance.Header"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_getting_started_welcome_to_sync" />
+
+    <TextView
+        style="@style/RemoteTabsPanelItem.TextAppearance"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_getting_started_description" />
+
+    <Button
+        android:id="@+id/remote_tabs_setup_get_started"
+        style="@style/RemoteTabsPanelItem.Button"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_getting_started_get_started" />
+
+    <TextView
+        android:id="@+id/remote_tabs_setup_old_sync_link"
+        style="@style/RemoteTabsPanelItem.TextAppearance.Linkified"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:text="@string/fxaccount_getting_started_old_firefox" />
+
+</LinearLayout>
\ No newline at end of file
diff --git a/mobile/android/base/resources/layout/tabs_panel.xml b/mobile/android/base/resources/layout/tabs_panel.xml
index 691c4e15a1d..400d4916327 100644
--- a/mobile/android/base/resources/layout/tabs_panel.xml
+++ b/mobile/android/base/resources/layout/tabs_panel.xml
@@ -54,4 +54,9 @@
 
     </view>
 
+    <!-- To preserve the ID, even when building for pre-11. -->
+    <RelativeLayout android:id="@+id/tabs_panel_footer"
+                    android:layout_height="0dp"
+                    android:layout_width="0dp"
+                    android:visibility="gone"/>
 </merge>
diff --git a/mobile/android/base/resources/menu/browser_app_menu.xml b/mobile/android/base/resources/menu/browser_app_menu.xml
index 18011d83585..e52f9d1401d 100644
--- a/mobile/android/base/resources/menu/browser_app_menu.xml
+++ b/mobile/android/base/resources/menu/browser_app_menu.xml
@@ -71,4 +71,20 @@
           android:icon="@drawable/ic_menu_guest"
           android:visible="false"
           android:title="@string/exit_guest_session"/>
+
+    <!-- Android will eliminate v11+ resource files from pre-11 builds.
+         Those files are the only place in which certain IDs are defined.
+         This causes compilation errors.
+         To avoid nasty code workarounds, we define stub IDs here, but
+         hide the menu entries. -->
+
+    <item android:id="@+id/page"
+          android:visible="false"
+          android:enabled="false"
+          android:title="@string/page" />
+
+    <item android:id="@+id/tools"
+          android:visible="false"
+          android:enabled="false"
+          android:title="@string/tools" />
 </menu>
diff --git a/mobile/android/base/resources/menu/preferences_search_menu.xml b/mobile/android/base/resources/menu/preferences_search_menu.xml
new file mode 100644
index 00000000000..f9328eb5dd2
--- /dev/null
+++ b/mobile/android/base/resources/menu/preferences_search_menu.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!-- Stub to preserve IDs. -->
+<menu xmlns:android="http://schemas.android.com/apk/res/android">
+    <item android:id="@+id/restore_defaults" />
+</menu>
diff --git a/mobile/android/base/resources/values-land/styles.xml b/mobile/android/base/resources/values-land/styles.xml
index c809113b4b7..8dcecccdc8e 100644
--- a/mobile/android/base/resources/values-land/styles.xml
+++ b/mobile/android/base/resources/values-land/styles.xml
@@ -71,4 +71,11 @@
         <item name="android:layout_gravity">center</item>
     </style>
 
+    <style name="Widget.Home.HistoryListView">
+        <item name="android:paddingLeft">50dp</item>
+        <item name="android:paddingRight">100dp</item>
+        <item name="android:paddingTop">0dp</item>
+        <item name="android:scrollbarStyle">outsideOverlay</item>
+    </style>
+
 </resources>
diff --git a/mobile/android/base/resources/values-large-land-v11/styles.xml b/mobile/android/base/resources/values-large-land-v11/styles.xml
index 342043d068c..304ec6ad913 100644
--- a/mobile/android/base/resources/values-large-land-v11/styles.xml
+++ b/mobile/android/base/resources/values-large-land-v11/styles.xml
@@ -39,14 +39,6 @@
         <item name="android:verticalSpacing">20dp</item>
     </style>
 
-    <style name="Widget.Home.HistoryListView">
-        <item name="android:paddingLeft">50dp</item>
-        <item name="android:paddingRight">100dp</item>
-        <item name="android:paddingTop">30dp</item>
-        <item name="android:scrollbarStyle">outsideOverlay</item>
-        <item name="topDivider">true</item>
-    </style>
-
     <!-- Tabs panel -->
     <style name="TabsPanelFrame" parent="TabsPanelFrameBase">
         <item name="android:paddingTop">32dp</item>
diff --git a/mobile/android/base/resources/values-large-v11/styles.xml b/mobile/android/base/resources/values-large-v11/styles.xml
index 6f0de76efe0..c3e01d73215 100644
--- a/mobile/android/base/resources/values-large-v11/styles.xml
+++ b/mobile/android/base/resources/values-large-v11/styles.xml
@@ -78,12 +78,6 @@
 
     <style name="Widget.ReadingListView" parent="Widget.BookmarksListView"/>
 
-    <style name="Widget.Home.HistoryListView">
-        <item name="android:paddingLeft">32dp</item>
-        <item name="android:paddingRight">32dp</item>
-        <item name="android:scrollbarStyle">outsideOverlay</item>
-    </style>
-
     <style name="Widget.HomeBanner">
         <item name="android:paddingLeft">32dp</item>
         <item name="android:paddingRight">32dp</item>
diff --git a/mobile/android/base/resources/values/styles.xml b/mobile/android/base/resources/values/styles.xml
index c2abb2f5d06..422689ec490 100644
--- a/mobile/android/base/resources/values/styles.xml
+++ b/mobile/android/base/resources/values/styles.xml
@@ -62,6 +62,12 @@
         <item name="android:listSelector">@drawable/action_bar_button</item>
     </style>
 
+    <style name="Widget.Home.HistoryListView">
+        <item name="android:paddingLeft">32dp</item>
+        <item name="android:paddingRight">32dp</item>
+        <item name="android:scrollbarStyle">outsideOverlay</item>
+    </style>
+
     <style name="Widget.ListItem">
         <item name="android:minHeight">?android:attr/listPreferredItemHeight</item>
         <item name="android:textAppearance">?android:attr/textAppearanceLargeInverse</item>
@@ -573,6 +579,16 @@
         <item name="android:layout_height">wrap_content</item>
     </style>
 
+    <style name="Widget.RemoteTabsItemView" parent="Widget.TwoLinePageRow"/>
+
+    <style name="Widget.RemoteTabsClientView" parent="Widget.TwoLinePageRow">
+        <item name="android:background">#fff5f7f9</item>
+    </style>
+
+    <style name="Widget.RemoteTabsListView" parent="Widget.HomeListView">
+        <item name="android:childDivider">#E7ECF0</item>
+    </style>
+
     <!-- TabsTray Row -->
     <style name="TabRowTextAppearance">
         <item name="android:textColor">#FFFFFFFF</item>
@@ -805,4 +821,46 @@
         <item name="android:textSize">18sp</item>
     </style>
 
+    <!-- Remote Tabs home panel -->
+    <style name="RemoteTabsPanelFrame">
+        <item name="android:paddingLeft">32dp</item>
+        <item name="android:paddingRight">32dp</item>
+        <item name="android:paddingTop">48dp</item>
+        <item name="android:orientation">vertical</item>
+    </style>
+
+    <style name="RemoteTabsPanelItem">
+        <item name="android:layout_gravity">center</item>
+        <item name="android:gravity">center</item>
+        <item name="android:layout_marginBottom">16dp</item>
+    </style>
+
+    <style name="RemoteTabsPanelItem.TextAppearance">
+        <item name="android:textColor">#777777</item>
+        <item name="android:textSize">16sp</item>
+        <item name="android:lineSpacingMultiplier">1.35</item>
+    </style>
+
+    <style name="RemoteTabsPanelItem.TextAppearance.Header">
+        <item name="android:textColor">#222222</item>
+        <item name="android:textSize">20sp</item>
+    </style>
+
+    <style name="RemoteTabsPanelItem.TextAppearance.Linkified">
+        <item name="android:clickable">true</item>
+        <item name="android:focusable">true</item>
+        <item name="android:textColor">#0092DB</item>
+    </style>
+
+    <style name="RemoteTabsPanelItem.Button">
+        <item name="android:background">@drawable/remote_tabs_setup_button_background</item>
+        <item name="android:textColor">#FFFFFF</item>
+        <item name="android:textSize">20sp</item>
+        <item name="android:gravity">center</item>
+        <item name="android:paddingTop">16dp</item>
+        <item name="android:paddingBottom">16dp</item>
+        <item name="android:paddingLeft">8dp</item>
+        <item name="android:paddingRight">8dp</item>
+    </style>
+
 </resources>
diff --git a/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml b/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml
index 838f4f22667..5cbb932a17e 100644
--- a/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml
+++ b/mobile/android/base/resources/xml-v11/preferences_customize_tablet.xml
@@ -5,7 +5,7 @@
 
 <!-- Tablet only: The contents under the "Customize" header for tablets,
      See xml-v11/preferences.xml for single-pane v11+ phone layout.
-     Changes to preferences shoudl be mirrored to preferences_customize.xml. -->
+     Changes to preferences should be mirrored to preferences_customize.xml. -->
 
 <PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android"
                   xmlns:gecko="http://schemas.android.com/apk/res-auto"
diff --git a/mobile/android/base/resources/xml/preference_headers.xml b/mobile/android/base/resources/xml/preference_headers.xml
new file mode 100644
index 00000000000..1fca86d8905
--- /dev/null
+++ b/mobile/android/base/resources/xml/preference_headers.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!-- This file is a stub to allow IDs to be used in code
+     even for a version-limited build. -->
+
+<preference-headers xmlns:android="http://schemas.android.com/apk/res/android">
+    <header android:fragment="org.mozilla.gecko.preferences.GeckoPreferenceFragment"
+            android:id="@+id/pref_header_language">
+    </header>
+</preference-headers>
diff --git a/mobile/android/base/resources/xml/preferences_customize_tablet.xml b/mobile/android/base/resources/xml/preferences_customize_tablet.xml
new file mode 100644
index 00000000000..bfe2f1473ff
--- /dev/null
+++ b/mobile/android/base/resources/xml/preferences_customize_tablet.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<!-- Stub to preserve IDs. -->
+
+<PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android"
+  android:enabled="false" />
+
diff --git a/mobile/android/base/resources/xml/preferences_devtools.xml b/mobile/android/base/resources/xml/preferences_devtools.xml
index d9308d997b4..c4db6dae8e3 100644
--- a/mobile/android/base/resources/xml/preferences_devtools.xml
+++ b/mobile/android/base/resources/xml/preferences_devtools.xml
@@ -15,7 +15,9 @@
        <CheckBoxPreference android:key="devtools.debugger.remote-enabled"
                            android:title="@string/pref_developer_remotedebugging" />
 
-       <org.mozilla.gecko.preferences.AlignRightLinkPreference android:title="@string/pref_learn_more"
+       <org.mozilla.gecko.preferences.AlignRightLinkPreference android:key="android.not_a_preference.remote_debugging.link"
+                                                               android:title="@string/pref_learn_more"
+                                                               android:persistent="false"
                                                                url="https://developer.mozilla.org/docs/Tools/Remote_Debugging" />
 
 </PreferenceScreen>
diff --git a/mobile/android/base/resources/xml/preferences_vendor.xml b/mobile/android/base/resources/xml/preferences_vendor.xml
index 6a73fdc1f8f..c200de3e3f3 100644
--- a/mobile/android/base/resources/xml/preferences_vendor.xml
+++ b/mobile/android/base/resources/xml/preferences_vendor.xml
@@ -8,13 +8,19 @@
                   android:title="@string/pref_category_vendor"
                   android:enabled="false">
 
-    <org.mozilla.gecko.preferences.LinkPreference android:title="@string/pref_about_firefox"
+    <org.mozilla.gecko.preferences.LinkPreference android:key="android.not_a_preference.about.link"
+                                                  android:title="@string/pref_about_firefox"
+                                                  android:persistent="false"
                                                   url="about:" />
 
-    <org.mozilla.gecko.preferences.LinkPreference android:title="@string/pref_vendor_faqs"
+    <org.mozilla.gecko.preferences.LinkPreference android:key="android.not_a_preference.faq.link"
+                                                  android:title="@string/pref_vendor_faqs"
+                                                  android:persistent="false"
                                                   url="https://support.mozilla.org/kb/firefox-android-faq"/>
 
-    <org.mozilla.gecko.preferences.LinkPreference android:title="@string/pref_vendor_feedback"
+    <org.mozilla.gecko.preferences.LinkPreference android:key="android.not_a_preference.feedback.link"
+                                                  android:title="@string/pref_vendor_feedback"
+                                                  android:persistent="false"
                                                   url="about:feedback" />
 
     <PreferenceCategory android:key="android.not_a_preference.datareporting.preferences"
@@ -35,6 +41,7 @@
 
         <org.mozilla.gecko.preferences.AlignRightLinkPreference android:key="android.not_a_preference.geo.learn_more"
                                                                 android:title="@string/pref_learn_more"
+                                                                android:persistent="false"
                                                                 url="https://location.services.mozilla.com/" />
 
         <CheckBoxPreference android:key="android.not_a_preference.healthreport.uploadEnabled"
@@ -44,6 +51,7 @@
 
         <org.mozilla.gecko.preferences.AlignRightLinkPreference android:key="android.not_a_preference.healthreport.link"
                                                                 android:title="@string/datareporting_abouthr_title"
+                                                                android:persistent="false"
                                                                 url="about:healthreport" />
 
     </PreferenceCategory>
diff --git a/mobile/android/base/sqlite/MatrixBlobCursor.java b/mobile/android/base/sqlite/MatrixBlobCursor.java
index 80b7b261786..f7f18341786 100644
--- a/mobile/android/base/sqlite/MatrixBlobCursor.java
+++ b/mobile/android/base/sqlite/MatrixBlobCursor.java
@@ -46,7 +46,7 @@ public class MatrixBlobCursor extends AbstractCursor {
 
     private int rowCount;
 
-    /* inner-access */ Object[] data;
+    Object[] data;
 
     /**
      * Constructs a new cursor with the given initial capacity.
diff --git a/mobile/android/base/strings.xml.in b/mobile/android/base/strings.xml.in
index 9743ebddab3..a977c44510b 100644
--- a/mobile/android/base/strings.xml.in
+++ b/mobile/android/base/strings.xml.in
@@ -351,6 +351,12 @@
   <string name="home_reading_list_hint_accessible">&home_reading_list_hint_accessible;</string>
   <string name="home_default_empty">&home_default_empty;</string>
   <string name="home_move_up_to_filter">&home_move_up_to_filter;</string>
+  <string name="home_remote_tabs_title">&home_remote_tabs_title;</string>
+  <string name="home_remote_tabs_empty">&home_remote_tabs_empty;</string>
+  <string name="home_remote_tabs_unable_to_connect">&home_remote_tabs_unable_to_connect;</string>
+  <string name="home_remote_tabs_need_to_sign_in">&home_remote_tabs_need_to_sign_in;</string>
+  <string name="home_remote_tabs_trouble_verifying">&home_remote_tabs_trouble_verifying;</string>
+  <string name="home_remote_tabs_need_to_verify">&home_remote_tabs_need_to_verify;</string>
   <string name="private_browsing_title">&private_browsing_title;</string>
   <string name="private_tabs_panel_empty_desc">&private_tabs_panel_empty_desc;</string>
   <string name="private_tabs_panel_learn_more">&private_tabs_panel_learn_more;</string>
diff --git a/mobile/android/base/sync/CollectionKeys.java b/mobile/android/base/sync/CollectionKeys.java
index ddb4eb35fa8..896649306b0 100644
--- a/mobile/android/base/sync/CollectionKeys.java
+++ b/mobile/android/base/sync/CollectionKeys.java
@@ -192,4 +192,9 @@ public class CollectionKeys {
       return false;
     }
   }
+
+  @Override
+  public int hashCode() {
+    return super.hashCode();
+  }
 }
diff --git a/mobile/android/base/sync/repositories/domain/ClientRecord.java b/mobile/android/base/sync/repositories/domain/ClientRecord.java
index a5c7ab65887..310c9d6038e 100644
--- a/mobile/android/base/sync/repositories/domain/ClientRecord.java
+++ b/mobile/android/base/sync/repositories/domain/ClientRecord.java
@@ -112,6 +112,11 @@ public class ClientRecord extends Record {
     return this.equalPayloads(o);
   }
 
+  @Override
+  public int hashCode() {
+    return super.hashCode();
+  }
+
   @Override
   public boolean equalPayloads(Object o) {
     if (!(o instanceof ClientRecord) || !super.equalPayloads(o)) {
diff --git a/mobile/android/base/tabs/TabsPanel.java b/mobile/android/base/tabs/TabsPanel.java
index ef16e27245d..7e09fbeb706 100644
--- a/mobile/android/base/tabs/TabsPanel.java
+++ b/mobile/android/base/tabs/TabsPanel.java
@@ -148,7 +148,12 @@ public class TabsPanel extends LinearLayout
         mPanelRemote = (PanelView) findViewById(R.id.remote_tabs);
         mPanelRemote.setTabsPanel(this);
 
-        mFooter = (RelativeLayout) findViewById(R.id.tabs_panel_footer);
+        // Only applies to v11+ in landscape.
+        // We ship a stub to avoid a compiler error when referencing the
+        // ID, so we conditionalize here.
+        if (Versions.feature11Plus) {
+            mFooter = (RelativeLayout) findViewById(R.id.tabs_panel_footer);
+        }
 
         mAddTab = (ImageButton) findViewById(R.id.add_tab);
         mAddTab.setOnClickListener(new Button.OnClickListener() {
@@ -433,8 +438,10 @@ public class TabsPanel extends LinearLayout
         mPanel.show();
 
         if (mCurrentPanel == Panel.REMOTE_TABS) {
-            if (mFooter != null)
+            // The footer is only defined in the sidebar, for landscape v11+ views.
+            if (mFooter != null) {
                 mFooter.setVisibility(View.GONE);
+            }
 
             mAddTab.setVisibility(View.INVISIBLE);
 
@@ -520,7 +527,8 @@ public class TabsPanel extends LinearLayout
             if (mVisible) {
                 ViewHelper.setTranslationX(mHeader, -tabsPanelWidth);
                 ViewHelper.setTranslationX(mTabsContainer, -tabsPanelWidth);
-                // The footer view is only present on the sidebar
+
+                // The footer view is only present on the sidebar, v11+.
                 ViewHelper.setTranslationX(mFooter, -tabsPanelWidth);
             }
             final int translationX = (mVisible ? 0 : -tabsPanelWidth);
diff --git a/mobile/android/base/util/Clipboard.java b/mobile/android/base/util/Clipboard.java
index ca154839854..f8fce482709 100644
--- a/mobile/android/base/util/Clipboard.java
+++ b/mobile/android/base/util/Clipboard.java
@@ -17,7 +17,7 @@ public final class Clipboard {
     // Volatile but not synchronized: we don't care about the race condition in
     // init, because both app contexts will be the same, but we do care about a
     // thread having a stale null value of mContext.
-    /* inner-access */ volatile static Context mContext;
+    volatile static Context mContext;
     private final static String LOGTAG = "GeckoClipboard";
     private final static SynchronousQueue<String> sClipboardQueue = new SynchronousQueue<String>();
 
@@ -116,7 +116,7 @@ public final class Clipboard {
      * present on the thread.
      */
     @SuppressWarnings("deprecation")
-    /* inner-access */ static String getClipboardTextImpl() {
+    static String getClipboardTextImpl() {
         if (Versions.feature11Plus) {
             android.content.ClipboardManager cm = (android.content.ClipboardManager) mContext.getSystemService(Context.CLIPBOARD_SERVICE);
             if (cm.hasPrimaryClip()) {
diff --git a/mobile/android/base/util/UIAsyncTask.java b/mobile/android/base/util/UIAsyncTask.java
index 34e7b9d9bff..3c44c1943bf 100644
--- a/mobile/android/base/util/UIAsyncTask.java
+++ b/mobile/android/base/util/UIAsyncTask.java
@@ -50,7 +50,7 @@ public abstract class UIAsyncTask<Param, Result> {
         protected abstract InnerResult doInBackground();
     }
 
-    /* inner-access */ final Handler mBackgroundThreadHandler;
+    final Handler mBackgroundThreadHandler;
     private volatile boolean mCancelled;
     private static Handler sHandler;
 
diff --git a/mobile/android/base/webapp/InstallHelper.java b/mobile/android/base/webapp/InstallHelper.java
index 597212d0f80..105139242dd 100644
--- a/mobile/android/base/webapp/InstallHelper.java
+++ b/mobile/android/base/webapp/InstallHelper.java
@@ -75,7 +75,7 @@ public class InstallHelper implements NativeEventListener {
         }
     }
 
-    /* inner-access */ void install(String profileName, JSONObject message) throws IOException {
+    void install(String profileName, JSONObject message) throws IOException {
         if (message == null) {
             message = new JSONObject();
         }
diff --git a/mobile/android/base/webapp/WebappImpl.java b/mobile/android/base/webapp/WebappImpl.java
index ff0e980354b..6154cae81ed 100644
--- a/mobile/android/base/webapp/WebappImpl.java
+++ b/mobile/android/base/webapp/WebappImpl.java
@@ -44,7 +44,7 @@ public class WebappImpl extends GeckoApp implements InstallCallback {
     private View mTitlebar;
 
     // Must only be accessed from the UI thread.
-    /* inner-access */ View mSplashscreen;
+    View mSplashscreen;
 
     private boolean mIsApk = true;
     private ApkResources mApkResources;
diff --git a/mobile/android/base/widget/ActivityChooserModel.java b/mobile/android/base/widget/ActivityChooserModel.java
index 7bb530c6dd0..dfbf79aa5da 100644
--- a/mobile/android/base/widget/ActivityChooserModel.java
+++ b/mobile/android/base/widget/ActivityChooserModel.java
@@ -173,7 +173,7 @@ public class ActivityChooserModel extends DataSetObservable {
     /**
      * Tag used for logging.
      */
-    /* inner-access */ static final String LOG_TAG = ActivityChooserModel.class.getSimpleName();
+    static final String LOG_TAG = ActivityChooserModel.class.getSimpleName();
 
     /**
      * The root tag in the history file.
@@ -268,12 +268,12 @@ public class ActivityChooserModel extends DataSetObservable {
     /**
      * Context for accessing resources.
      */
-    /* inner-access */ final Context mContext;
+    final Context mContext;
 
     /**
      * The name of the history file that backs this model.
      */
-    /* inner-access */ final String mHistoryFileName;
+    final String mHistoryFileName;
 
     /**
      * The intent for which a activity is being chosen.
@@ -298,7 +298,7 @@ public class ActivityChooserModel extends DataSetObservable {
      * only after a call to {@link #persistHistoricalDataIfNeeded()} followed by change
      * of the share records.
      */
-    /* inner-access */ boolean mCanReadHistoricalData = true;
+    boolean mCanReadHistoricalData = true;
 
     /**
      * Flag whether the choice history was read. This is used to enforce that
@@ -322,7 +322,7 @@ public class ActivityChooserModel extends DataSetObservable {
     /**
      * Flag whether to reload the activities for the current intent.
      */
-    /* inner-access */ boolean mReloadActivities;
+    boolean mReloadActivities;
 
     /**
      * Policy for controlling how the model handles chosen activities.
@@ -799,7 +799,7 @@ public class ActivityChooserModel extends DataSetObservable {
      * @param historicalRecord The pkg to delete records for.
      * @return True if the record was added.
      */
-    /* inner-access */ boolean removeHistoricalRecordsForPackage(final String pkg) {
+    boolean removeHistoricalRecordsForPackage(final String pkg) {
         boolean removed = false;
 
         for (Iterator<HistoricalRecord> i = mHistoricalRecords.iterator(); i.hasNext();) {
@@ -1088,7 +1088,7 @@ public class ActivityChooserModel extends DataSetObservable {
         }
     }
 
-    /* inner-access */ void readHistoricalDataFromStream(FileInputStream fis) {
+    void readHistoricalDataFromStream(FileInputStream fis) {
         try {
             XmlPullParser parser = Xml.newPullParser();
             parser.setInput(fis, null);
@@ -1228,7 +1228,7 @@ public class ActivityChooserModel extends DataSetObservable {
      */
     private static final String LOGTAG = "GeckoActivityChooserModel";
     private final class DataModelPackageMonitor extends BroadcastReceiver {
-        /* inner-access */ Context mContext;
+        Context mContext;
 
         public DataModelPackageMonitor() { }
 
diff --git a/mobile/android/base/widget/AnimatedHeightLayout.java b/mobile/android/base/widget/AnimatedHeightLayout.java
index f306985f63a..f1343b0fbff 100644
--- a/mobile/android/base/widget/AnimatedHeightLayout.java
+++ b/mobile/android/base/widget/AnimatedHeightLayout.java
@@ -68,7 +68,7 @@ public class AnimatedHeightLayout extends RelativeLayout {
         finishAnimation();
     }
 
-    /* inner-access */ void finishAnimation() {
+    void finishAnimation() {
         if (mAnimating) {
             getLayoutParams().height = LayoutParams.WRAP_CONTENT;
             mAnimating = false;
diff --git a/mobile/android/base/widget/ArrowPopup.java b/mobile/android/base/widget/ArrowPopup.java
index c305163be68..74893569287 100644
--- a/mobile/android/base/widget/ArrowPopup.java
+++ b/mobile/android/base/widget/ArrowPopup.java
@@ -24,10 +24,10 @@ import android.widget.PopupWindow;
 import android.widget.RelativeLayout;
 
 public abstract class ArrowPopup extends PopupWindow {
-    /* inner-access */ View mAnchor;
-    /* inner-access */ ImageView mArrow;
+    View mAnchor;
+    ImageView mArrow;
 
-    /* inner-access */ int mArrowWidth;
+    int mArrowWidth;
     private int mYOffset;
 
     protected LinearLayout mContent;
@@ -154,7 +154,7 @@ public abstract class ArrowPopup extends PopupWindow {
             public void onSizeChanged();
         }
 
-        /* inner-access */ OnSizeChangedListener mListener;
+        OnSizeChangedListener mListener;
 
         public ArrowPopupLayout(Context context, AttributeSet attrs, int defStyle) {
             super(context, attrs, defStyle);
diff --git a/mobile/android/base/widget/BasicColorPicker.java b/mobile/android/base/widget/BasicColorPicker.java
index 74fdbe07c88..75a86b354d9 100644
--- a/mobile/android/base/widget/BasicColorPicker.java
+++ b/mobile/android/base/widget/BasicColorPicker.java
@@ -42,8 +42,8 @@ public class BasicColorPicker extends ListView {
                                                                       Color.BLACK);
 
     private static Drawable mCheckDrawable;
-    /* inner-access */ int mSelected;
-    /* inner-access */ final ColorPickerListAdapter mAdapter;
+    int mSelected;
+    final ColorPickerListAdapter mAdapter;
 
     public BasicColorPicker(Context context) {
         this(context, null);
@@ -87,7 +87,7 @@ public class BasicColorPicker extends ListView {
         mAdapter.notifyDataSetChanged();
     }
 
-    /* inner-access */ Drawable getCheckDrawable() {
+    Drawable getCheckDrawable() {
         if (mCheckDrawable == null) {
             Resources res = getContext().getResources();
 
diff --git a/mobile/android/base/widget/ButtonToast.java b/mobile/android/base/widget/ButtonToast.java
index 76d6f684df1..5c5e1c2cbd1 100644
--- a/mobile/android/base/widget/ButtonToast.java
+++ b/mobile/android/base/widget/ButtonToast.java
@@ -35,8 +35,8 @@ public class ButtonToast {
     private final TextView mMessageView;
     private final Button mButton;
     private final Handler mHideHandler = new Handler();
-    /* inner-access */ final View mView;
-    /* inner-access */ Toast mCurrentToast;
+    final View mView;
+    Toast mCurrentToast;
 
     public enum ReasonHidden {
         CLICKED,
diff --git a/mobile/android/base/widget/DateTimePicker.java b/mobile/android/base/widget/DateTimePicker.java
index 132068ced46..125dfe304f0 100644
--- a/mobile/android/base/widget/DateTimePicker.java
+++ b/mobile/android/base/widget/DateTimePicker.java
@@ -48,13 +48,13 @@ public class DateTimePicker extends FrameLayout {
     // Minimal screen width (in inches) for which we can show the calendar;
     private static final int SCREEN_SIZE_THRESHOLD = 5;
 
-    /* inner-access */ boolean mYearEnabled = true;
-    /* inner-access */ boolean mMonthEnabled = true;
-    /* inner-access */ boolean mWeekEnabled;
-    /* inner-access */ boolean mDayEnabled = true;
-    /* inner-access */ boolean mHourEnabled = true;
-    /* inner-access */ boolean mMinuteEnabled = true;
-    /* inner-access */ boolean mIs12HourMode;
+    boolean mYearEnabled = true;
+    boolean mMonthEnabled = true;
+    boolean mWeekEnabled;
+    boolean mDayEnabled = true;
+    boolean mHourEnabled = true;
+    boolean mMinuteEnabled = true;
+    boolean mIs12HourMode;
     private boolean mCalendarEnabled;
 
     // Size of the screen in inches;
@@ -65,13 +65,13 @@ public class DateTimePicker extends FrameLayout {
     private final LinearLayout mDateSpinners;
     private final LinearLayout mTimeSpinners;
 
-    /* inner-access */ final NumberPicker mDaySpinner;
-    /* inner-access */ final NumberPicker mMonthSpinner;
-    /* inner-access */ final NumberPicker mWeekSpinner;
-    /* inner-access */ final NumberPicker mYearSpinner;
-    /* inner-access */ final NumberPicker mHourSpinner;
-    /* inner-access */ final NumberPicker mMinuteSpinner;
-    /* inner-access */ final NumberPicker mAMPMSpinner;
+    final NumberPicker mDaySpinner;
+    final NumberPicker mMonthSpinner;
+    final NumberPicker mWeekSpinner;
+    final NumberPicker mYearSpinner;
+    final NumberPicker mHourSpinner;
+    final NumberPicker mMinuteSpinner;
+    final NumberPicker mAMPMSpinner;
     private final CalendarView mCalendar;
     private final EditText mDaySpinnerInput;
     private final EditText mMonthSpinnerInput;
@@ -85,8 +85,8 @@ public class DateTimePicker extends FrameLayout {
     private String[] mShortAMPMs;
     private int mNumberOfMonths;
 
-    /* inner-access */ Calendar mTempDate;
-    /* inner-access */ Calendar mCurrentDate;
+    Calendar mTempDate;
+    Calendar mCurrentDate;
     private Calendar mMinDate;
     private Calendar mMaxDate;
     private PickersState mState;
@@ -410,7 +410,7 @@ public class DateTimePicker extends FrameLayout {
         mDateSpinners.addView(mWeekSpinner);
     }
 
-    /* inner-access */ void setDate(Calendar calendar){
+    void setDate(Calendar calendar){
         mCurrentDate = mTempDate;
         if (mCurrentDate.before(mMinDate)) {
             mCurrentDate.setTimeInMillis(mMinDate.getTimeInMillis());
@@ -419,7 +419,7 @@ public class DateTimePicker extends FrameLayout {
         }
     }
 
-    /* inner-access */ void updateInputState() {
+    void updateInputState() {
         InputMethodManager inputMethodManager = (InputMethodManager)
           getContext().getSystemService(Context.INPUT_METHOD_SERVICE);
         if (mYearEnabled && inputMethodManager.isActive(mYearSpinnerInput)) {
@@ -440,7 +440,7 @@ public class DateTimePicker extends FrameLayout {
         }
     }
 
-    /* inner-access */ void updateSpinners() {
+    void updateSpinners() {
         if (mDayEnabled) {
             if (mCurrentDate.equals(mMinDate)) {
                 mDaySpinner.setMinValue(mCurrentDate.get(Calendar.DAY_OF_MONTH));
@@ -500,13 +500,13 @@ public class DateTimePicker extends FrameLayout {
         }
     }
 
-    /* inner-access */ void updateCalendar() {
+    void updateCalendar() {
         if (mCalendarEnabled){
             mCalendar.setDate(mCurrentDate.getTimeInMillis(), false, false);
         }
     }
 
-    /* inner-access */ void notifyDateChanged() {
+    void notifyDateChanged() {
         sendAccessibilityEvent(AccessibilityEvent.TYPE_VIEW_SELECTED);
     }
 
diff --git a/mobile/android/base/widget/GeckoActionProvider.java b/mobile/android/base/widget/GeckoActionProvider.java
index 6361be4bdc0..436b1830ca0 100644
--- a/mobile/android/base/widget/GeckoActionProvider.java
+++ b/mobile/android/base/widget/GeckoActionProvider.java
@@ -38,16 +38,16 @@ public class GeckoActionProvider {
         public void onTargetSelected();
     }
 
-    /* inner-access */ final Context mContext;
+    final Context mContext;
 
     public final static String DEFAULT_MIME_TYPE = "text/plain";
 
     public static final String DEFAULT_HISTORY_FILE_NAME = "history.xml";
 
     //  History file.
-    /* inner-access */ String mHistoryFileName = DEFAULT_HISTORY_FILE_NAME;
+    String mHistoryFileName = DEFAULT_HISTORY_FILE_NAME;
 
-    /* inner-access */ OnTargetSelectedListener mOnTargetListener;
+    OnTargetSelectedListener mOnTargetListener;
 
     private final Callbacks mCallbacks = new Callbacks();
 
@@ -183,7 +183,7 @@ public class GeckoActionProvider {
      */
     private class Callbacks implements OnMenuItemClickListener,
                                        OnClickListener {
-        /* inner-access */ void chooseActivity(int index) {
+        void chooseActivity(int index) {
             final ActivityChooserModel dataModel = ActivityChooserModel.get(mContext, mHistoryFileName);
             final Intent launchIntent = dataModel.chooseActivity(index);
             if (launchIntent != null) {
diff --git a/mobile/android/base/widget/GeckoSwipeRefreshLayout.java b/mobile/android/base/widget/GeckoSwipeRefreshLayout.java
index 6a54c1455dc..cb2316c7b5d 100644
--- a/mobile/android/base/widget/GeckoSwipeRefreshLayout.java
+++ b/mobile/android/base/widget/GeckoSwipeRefreshLayout.java
@@ -63,14 +63,14 @@ public class GeckoSwipeRefreshLayout extends ViewGroup {
     private static final float MAX_SWIPE_DISTANCE_FACTOR = .6f;
     private static final int REFRESH_TRIGGER_DISTANCE = 120;
 
-    /* inner-access */ SwipeProgressBar mProgressBar; // shows progress is going
-    /* inner-access */ View mTarget; // content that gets pulled down
-    /* inner-access */ int mOriginalOffsetTop;
-    /* inner-access */ int mFrom;
-    /* inner-access */ int mMediumAnimationDuration;
-    /* inner-access */ float mFromPercentage;
-    /* inner-access */ float mCurrPercentage;
-    /* inner-access */ int mCurrentTargetOffsetTop;
+    SwipeProgressBar mProgressBar; // shows progress is going
+    View mTarget; // content that gets pulled down
+    int mOriginalOffsetTop;
+    int mFrom;
+    int mMediumAnimationDuration;
+    float mFromPercentage;
+    float mCurrPercentage;
+    int mCurrentTargetOffsetTop;
     private OnRefreshListener mListener;
     private MotionEvent mDownEvent;
     private boolean mRefreshing;
@@ -81,8 +81,8 @@ public class GeckoSwipeRefreshLayout extends ViewGroup {
 
     // Target is returning to its start offset because it was cancelled or a
     // refresh was triggered.
-    /* inner-access */ boolean mReturningToStart;
-    /* inner-access */ final DecelerateInterpolator mDecelerateInterpolator;
+    boolean mReturningToStart;
+    final DecelerateInterpolator mDecelerateInterpolator;
     private final AccelerateInterpolator mAccelerateInterpolator;
     private static final int[] LAYOUT_ATTRS = new int[] {
         android.R.attr.enabled
@@ -104,7 +104,7 @@ public class GeckoSwipeRefreshLayout extends ViewGroup {
         }
     };
 
-    /* inner-access */ Animation mShrinkTrigger = new Animation() {
+    Animation mShrinkTrigger = new Animation() {
         @Override
         public void applyTransformation(float interpolatedTime, Transformation t) {
             float percent = mFromPercentage + ((0 - mFromPercentage) * interpolatedTime);
@@ -112,7 +112,7 @@ public class GeckoSwipeRefreshLayout extends ViewGroup {
         }
     };
 
-    /* inner-access */ final AnimationListener mReturnToStartPositionListener = new BaseAnimationListener() {
+    final AnimationListener mReturnToStartPositionListener = new BaseAnimationListener() {
         @Override
         public void onAnimationEnd(Animation animation) {
             // Once the target content has returned to its start position, reset
@@ -121,7 +121,7 @@ public class GeckoSwipeRefreshLayout extends ViewGroup {
         }
     };
 
-    /* inner-access */ final AnimationListener mShrinkAnimationListener = new BaseAnimationListener() {
+    final AnimationListener mShrinkAnimationListener = new BaseAnimationListener() {
         @Override
         public void onAnimationEnd(Animation animation) {
             mCurrPercentage = 0;
@@ -214,7 +214,7 @@ public class GeckoSwipeRefreshLayout extends ViewGroup {
         removeCallbacks(mCancel);
     }
 
-    /* inner-access */ void animateOffsetToStartPosition(int from, AnimationListener listener) {
+    void animateOffsetToStartPosition(int from, AnimationListener listener) {
         mFrom = from;
         mAnimateToStartPosition.reset();
         mAnimateToStartPosition.setDuration(mMediumAnimationDuration);
@@ -459,7 +459,7 @@ public class GeckoSwipeRefreshLayout extends ViewGroup {
         setTargetOffsetTopAndBottom(targetTop - currentTop);
     }
 
-    /* inner-access */ void setTargetOffsetTopAndBottom(int offset) {
+    void setTargetOffsetTopAndBottom(int offset) {
         mTarget.offsetTopAndBottom(offset);
         mCurrentTargetOffsetTop = mTarget.getTop();
     }
diff --git a/mobile/android/base/widget/IconTabWidget.java b/mobile/android/base/widget/IconTabWidget.java
index 88c8c25a31f..0e8ff1ce976 100644
--- a/mobile/android/base/widget/IconTabWidget.java
+++ b/mobile/android/base/widget/IconTabWidget.java
@@ -17,7 +17,7 @@ import android.widget.TabWidget;
 import android.widget.TextView;
 
 public class IconTabWidget extends TabWidget {
-    /* inner-access */ OnTabChangedListener mListener;
+    OnTabChangedListener mListener;
     private final int mButtonLayoutId;
     private final boolean mIsIcon;
 
diff --git a/mobile/android/base/widget/TwoWayView.java b/mobile/android/base/widget/TwoWayView.java
index 033182814d8..06abb1792d6 100644
--- a/mobile/android/base/widget/TwoWayView.java
+++ b/mobile/android/base/widget/TwoWayView.java
@@ -141,7 +141,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         VERTICAL
     }
 
-    /* inner-access */ ListAdapter mAdapter;
+    ListAdapter mAdapter;
 
     private boolean mIsVertical;
 
@@ -159,13 +159,13 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
 
     final boolean[] mIsScrap = new boolean[1];
 
-    /* inner-access */ boolean mDataChanged;
-    /* inner-access */ int mItemCount;
-    /* inner-access */ int mOldItemCount;
-    /* inner-access */ boolean mHasStableIds;
+    boolean mDataChanged;
+    int mItemCount;
+    int mOldItemCount;
+    boolean mHasStableIds;
     private boolean mAreAllItemsSelectable;
 
-    /* inner-access */ int mFirstPosition;
+    int mFirstPosition;
     private int mSpecificStart;
 
     private SavedState mPendingSync;
@@ -181,8 +181,8 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
 
     private final ArrowScrollFocusResult mArrowScrollFocusResult;
 
-    /* inner-access */ int mMotionPosition;
-    /* inner-access */ Runnable mTouchModeReset;
+    int mMotionPosition;
+    Runnable mTouchModeReset;
     private Rect mTouchFrame;
     private CheckForTap mPendingCheckForTap;
     private CheckForLongPress mPendingCheckForLongPress;
@@ -192,7 +192,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
 
     private boolean mIsChildViewEnabled;
 
-    /* inner-access */ Drawable mSelector;
+    Drawable mSelector;
     private boolean mDrawSelectorOnTop;
     private int mSelectorPosition;
     private final Rect mSelectorRect;
@@ -205,17 +205,17 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
 
     private SelectionNotifier mSelectionNotifier;
 
-    /* inner-access */ boolean mNeedSync;
+    boolean mNeedSync;
     private int mSyncMode;
     private int mSyncPosition;
     private long mSyncRowId;
     private long mSyncHeight;
     private int mSelectedStart;
 
-    /* inner-access */ int mNextSelectedPosition;
-    /* inner-access */ long mNextSelectedRowId;
-    /* inner-access */ int mSelectedPosition;
-    /* inner-access */ long mSelectedRowId;
+    int mNextSelectedPosition;
+    long mNextSelectedRowId;
+    int mSelectedPosition;
+    long mSelectedRowId;
     private int mOldSelectedPosition;
     private long mOldSelectedRowId;
 
@@ -226,8 +226,8 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
 
     private ContextMenuInfo mContextMenuInfo;
 
-    /* inner-access */ int mLayoutMode;
-    /* inner-access */ int mTouchMode;
+    int mLayoutMode;
+    int mTouchMode;
     private int mLastTouchMode;
     private VelocityTracker mVelocityTracker;
     private final Scroller mScroller;
@@ -2959,7 +2959,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         removeCallbacks(mPendingCheckForTap);
     }
 
-    /* inner-access */ void triggerCheckForLongPress() {
+    void triggerCheckForLongPress() {
         if (mPendingCheckForLongPress == null) {
             mPendingCheckForLongPress = new CheckForLongPress();
         }
@@ -3232,7 +3232,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         return (hasFocus() && !isInTouchMode()) || touchModeDrawsInPressedState();
     }
 
-    /* inner-access */ void positionSelector(int position, View selected) {
+    void positionSelector(int position, View selected) {
         if (position != INVALID_POSITION) {
             mSelectorPosition = position;
         }
@@ -3402,7 +3402,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         }
     }
 
-    /* inner-access */ void fireOnSelected() {
+    void fireOnSelected() {
         OnItemSelectedListener listener = getOnItemSelectedListener();
         if (listener == null) {
             return;
@@ -3418,7 +3418,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         }
     }
 
-    /* inner-access */ void performAccessibilityActionsOnSelected() {
+    void performAccessibilityActionsOnSelected() {
         final int position = getSelectedItemPosition();
         if (position >= 0) {
             // We fire selection events here not in View
@@ -3771,7 +3771,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         }
     }
 
-    /* inner-access */ void layoutChildren() {
+    void layoutChildren() {
         if (getWidth() == 0 || getHeight() == 0) {
             return;
         }
@@ -5293,7 +5293,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         invalidate();
     }
 
-    /* inner-access */ void rememberSyncState() {
+    void rememberSyncState() {
         if (getChildCount() == 0) {
             return;
         }
@@ -5402,7 +5402,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         return super.performItemClick(view, position, id);
     }
 
-    /* inner-access */ boolean performLongPress(final View child,
+    boolean performLongPress(final View child,
             final int longPressPosition, final long longPressId) {
         // CHOICE_MODE_MULTIPLE_MODAL takes over long press.
         boolean handled = false;
@@ -5653,7 +5653,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
     }
 
     class RecycleBin {
-        /* inner-access */ RecyclerListener mRecyclerListener;
+        RecyclerListener mRecyclerListener;
         private int mFirstActivePosition;
         private View[] mActiveViews = new View[0];
         private ArrayList<View>[] mScrapViews;
@@ -5987,7 +5987,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
         super.setFocusableInTouchMode(focusable && !empty);
     }
 
-    /* inner-access */ void checkFocus() {
+    void checkFocus() {
         final ListAdapter adapter = getAdapter();
         final boolean focusable = (adapter != null && adapter.getCount() > 0);
 
@@ -6331,7 +6331,7 @@ public class TwoWayView extends AdapterView<ListAdapter> implements
     }
 
     private static class ArrowScrollFocusResult {
-        /* inner-access */ int mSelectedPosition;
+        int mSelectedPosition;
         private int mAmountToScroll;
 
         /**
diff --git a/mobile/android/branding/aurora/locales/en-US/brand.dtd b/mobile/android/branding/aurora/locales/en-US/brand.dtd
index b117666028f..9a85d511170 100644
--- a/mobile/android/branding/aurora/locales/en-US/brand.dtd
+++ b/mobile/android/branding/aurora/locales/en-US/brand.dtd
@@ -4,5 +4,4 @@
 
 <!ENTITY  brandShortName  "Aurora">
 <!ENTITY  brandFullName   "Mozilla Aurora">
-<!ENTITY  vendorShortName "Mozilla">
-<!ENTITY  logoTrademark   "">
+<!ENTITY  vendorShortName "Mozilla">
\ No newline at end of file
diff --git a/mobile/android/branding/beta/locales/en-US/brand.dtd b/mobile/android/branding/beta/locales/en-US/brand.dtd
index 9fcc9823111..4eb8febf0b9 100644
--- a/mobile/android/branding/beta/locales/en-US/brand.dtd
+++ b/mobile/android/branding/beta/locales/en-US/brand.dtd
@@ -4,5 +4,4 @@
 
 <!ENTITY  brandShortName  "Firefox Beta">
 <!ENTITY  brandFullName   "Mozilla Firefox Beta">
-<!ENTITY  vendorShortName "Mozilla">
-<!ENTITY  logoTrademark   "Firefox and the Firefox logos are trademarks of the Mozilla Foundation.">
+<!ENTITY  vendorShortName "Mozilla">
\ No newline at end of file
diff --git a/mobile/android/branding/nightly/locales/en-US/brand.dtd b/mobile/android/branding/nightly/locales/en-US/brand.dtd
index db56b2cfe94..3d3a3a10fb4 100644
--- a/mobile/android/branding/nightly/locales/en-US/brand.dtd
+++ b/mobile/android/branding/nightly/locales/en-US/brand.dtd
@@ -4,5 +4,4 @@
 
 <!ENTITY  brandShortName  "Nightly">
 <!ENTITY  brandFullName   "Mozilla Nightly">
-<!ENTITY  vendorShortName "Mozilla">
-<!ENTITY  logoTrademark   "">
+<!ENTITY  vendorShortName "Mozilla">
\ No newline at end of file
diff --git a/mobile/android/branding/official/locales/en-US/brand.dtd b/mobile/android/branding/official/locales/en-US/brand.dtd
index 1a6f391481e..b2b28a49aad 100644
--- a/mobile/android/branding/official/locales/en-US/brand.dtd
+++ b/mobile/android/branding/official/locales/en-US/brand.dtd
@@ -4,5 +4,4 @@
 
 <!ENTITY  brandShortName  "Firefox">
 <!ENTITY  brandFullName   "Mozilla Firefox">
-<!ENTITY  vendorShortName "Mozilla">
-<!ENTITY  logoTrademark   "Firefox and the Firefox logos are trademarks of the Mozilla Foundation.">
+<!ENTITY  vendorShortName "Mozilla">
\ No newline at end of file
diff --git a/mobile/android/branding/unofficial/locales/en-US/brand.dtd b/mobile/android/branding/unofficial/locales/en-US/brand.dtd
index d1f90b74433..3d998d15c64 100644
--- a/mobile/android/branding/unofficial/locales/en-US/brand.dtd
+++ b/mobile/android/branding/unofficial/locales/en-US/brand.dtd
@@ -4,5 +4,4 @@
 
 <!ENTITY  brandShortName  "Fennec">
 <!ENTITY  brandFullName   "Mozilla Fennec">
-<!ENTITY  vendorShortName "Mozilla">
-<!ENTITY  logoTrademark   "">
+<!ENTITY  vendorShortName "Mozilla">
\ No newline at end of file
diff --git a/mobile/android/chrome/content/SelectionHandler.js b/mobile/android/chrome/content/SelectionHandler.js
index 4361d84124c..3b380fd41b2 100644
--- a/mobile/android/chrome/content/SelectionHandler.js
+++ b/mobile/android/chrome/content/SelectionHandler.js
@@ -797,8 +797,8 @@ var SelectionHandler = {
   },
 
   isElementEditableText: function (aElement) {
-    return ((aElement instanceof HTMLInputElement && aElement.mozIsTextField(false)) ||
-            (aElement instanceof HTMLTextAreaElement));
+    return (((aElement instanceof HTMLInputElement && aElement.mozIsTextField(false)) ||
+            (aElement instanceof HTMLTextAreaElement)) && !aElement.readOnly);
   },
 
   /*
diff --git a/mobile/android/chrome/content/about.xhtml b/mobile/android/chrome/content/about.xhtml
index 89975eb9c7d..91b28a2555d 100644
--- a/mobile/android/chrome/content/about.xhtml
+++ b/mobile/android/chrome/content/about.xhtml
@@ -65,9 +65,11 @@
       <div class="bottom-border"></div>
     </ul>
 
+#ifdef RELEASE_BUILD
     <div id="aboutDetails">
-      <p>&logoTrademark;</p>
+      <p>&aboutPage.logoTrademark;</p>
     </div>
+#endif
 
     <script type="application/javascript;version=1.8"><![CDATA[
       let Ci = Components.interfaces, Cc = Components.classes, Cu = Components.utils, Cr = Components.results;
diff --git a/mobile/android/chrome/content/aboutFeedback.js b/mobile/android/chrome/content/aboutFeedback.js
index a333b3c7ac7..4ce4a00555f 100644
--- a/mobile/android/chrome/content/aboutFeedback.js
+++ b/mobile/android/chrome/content/aboutFeedback.js
@@ -4,6 +4,9 @@
 
 "use strict";
 
+// input.mozilla.org expects "Firefox for Android" as the product.
+const FEEDBACK_PRODUCT_STRING = "Firefox for Android";
+
 let Cc = Components.classes;
 let Ci = Components.interfaces;
 let Cu = Components.utils;
@@ -97,9 +100,10 @@ function sendFeedback(aEvent) {
   if (!descriptionElement.validity.valid)
 	return;
 
-  let data = new FormData();
-  data.append("description", descriptionElement.value);
-  data.append("_type", 2);
+  let data = {};
+  data["happy"] = false;
+  data["description"] = descriptionElement.value;
+  data["product"] = FEEDBACK_PRODUCT_STRING;
 
   let urlElement = document.getElementById("last-url");
   // Bail if the URL value isn't valid. HTML5 form validation will take care
@@ -109,13 +113,13 @@ function sendFeedback(aEvent) {
 
   // Only send a URL string if the user provided one.
   if (urlElement.value) {
-	data.append("add_url", true);
-	data.append("url", urlElement.value);
+    data["url"] = urlElement.value;
   }
 
   let sysInfo = Cc["@mozilla.org/system-info;1"].getService(Ci.nsIPropertyBag2);
-  data.append("device", sysInfo.get("device"));
-  data.append("manufacturer", sysInfo.get("manufacturer"));
+  data["device"] = sysInfo.get("device");
+  data["manufacturer"] = sysInfo.get("manufacturer");
+  data["source"] = "about:feedback";
 
   let req = new XMLHttpRequest();
   req.addEventListener("error", function() {
@@ -127,7 +131,8 @@ function sendFeedback(aEvent) {
 
   let postURL = Services.urlFormatter.formatURLPref("app.feedback.postURL");
   req.open("POST", postURL, true);
-  req.send(data);
+  req.setRequestHeader("Content-type", "application/json");
+  req.send(JSON.stringify(data));
 
   switchSection("thanks-" + section);
 }
diff --git a/mobile/android/components/LoginManagerPrompter.js b/mobile/android/components/LoginManagerPrompter.js
index 26623493ad1..b49c8bbab1b 100644
--- a/mobile/android/components/LoginManagerPrompter.js
+++ b/mobile/android/components/LoginManagerPrompter.js
@@ -108,6 +108,9 @@ LoginManagerPrompter.prototype = {
         this.log("===== initialized =====");
     },
 
+    setE10sData : function (aBrowser) {
+        throw new Error("This should be filled in when Android is multiprocess");
+    },
 
     /*
      * promptToSavePassword
diff --git a/mobile/android/confvars.sh b/mobile/android/confvars.sh
index 32421aa9270..0d4320eaaed 100644
--- a/mobile/android/confvars.sh
+++ b/mobile/android/confvars.sh
@@ -86,5 +86,9 @@ if test ! "$RELEASE_BUILD"; then
   MOZ_ANDROID_SHARE_OVERLAY=1
 fi
 
-# Don't enable the Mozilla Location Service stumbler.
-# MOZ_ANDROID_MLS_STUMBLER=1
+# Enable the Mozilla Location Service stumbler in Nightly.
+if test "$NIGHTLY_BUILD"; then
+  MOZ_ANDROID_MLS_STUMBLER=1
+else
+  MOZ_ANDROID_MLS_STUMBLER=
+fi
diff --git a/mobile/android/geckoview_library/Makefile.in b/mobile/android/geckoview_library/Makefile.in
index 1268fd2b2da..acdb71db766 100644
--- a/mobile/android/geckoview_library/Makefile.in
+++ b/mobile/android/geckoview_library/Makefile.in
@@ -47,8 +47,9 @@ package: local.properties project.properties AndroidManifest.xml FORCE
 	cp $(DEPTH)/mobile/android/base/*.jar libs/
 	$(RM) libs/gecko-R.jar
 
-	# Copy the SOs
-	cp $(_ABS_DIST)/bin/libmozglue.so $(_ABS_DIST)/bin/lib/libplugin-container.so libs/$(ANDROID_CPU_ARCH)/
+	# Copy the SOs. The latter should be $(MOZ_CHILD_PROCESS_NAME), but
+	# it includes a "lib/" prefix.
+	cp $(_ABS_DIST)/bin/libmozglue.so $(_ABS_DIST)/bin/libplugin-container.so libs/$(ANDROID_CPU_ARCH)/
 
 	# Copy the resources
 	$(RM) -rf res
diff --git a/mobile/android/installer/Makefile.in b/mobile/android/installer/Makefile.in
index fd1fb4d029e..c4e50168c2b 100644
--- a/mobile/android/installer/Makefile.in
+++ b/mobile/android/installer/Makefile.in
@@ -16,12 +16,12 @@ MOZ_PKG_REMOVALS = $(srcdir)/removed-files.in
 MOZ_PKG_MANIFEST_P = $(srcdir)/package-manifest.in
 
 DEFINES += \
-	-DMOZ_APP_NAME=$(MOZ_APP_NAME) \
-	-DPREF_DIR=$(PREF_DIR) \
-	$(NULL)
-
-DEFINES += -DJAREXT=
-DEFINES += -DMOZ_CHILD_PROCESS_NAME=$(MOZ_CHILD_PROCESS_NAME)
+  -DMOZ_APP_NAME=$(MOZ_APP_NAME) \
+  -DPREF_DIR=$(PREF_DIR) \
+  -DJAREXT= \
+  -DMOZ_CHILD_PROCESS_NAME=$(MOZ_CHILD_PROCESS_NAME) \
+  -DANDROID_CPU_ARCH=$(ANDROID_CPU_ARCH) \
+  $(NULL)
 
 ifdef MOZ_DEBUG
 DEFINES += -DMOZ_DEBUG=1
diff --git a/mobile/android/installer/package-manifest.in b/mobile/android/installer/package-manifest.in
index c527f6b01a8..021e24394de 100644
--- a/mobile/android/installer/package-manifest.in
+++ b/mobile/android/installer/package-manifest.in
@@ -75,10 +75,13 @@
 @BINPATH@/@DLL_PREFIX@mozsqlite3@DLL_SUFFIX@
 #endif
 
+[lib destdir="lib/@ANDROID_CPU_ARCH@"]
+@BINPATH@/@DLL_PREFIX@mozglue@DLL_SUFFIX@
+# This should be MOZ_CHILD_PROCESS_NAME, but that has a "lib/" prefix.
+@BINPATH@/@DLL_PREFIX@plugin-container@DLL_SUFFIX@
+
 [xpcom]
 @BINPATH@/dependentlibs.list
-@BINPATH@/@DLL_PREFIX@mozglue@DLL_SUFFIX@
-@BINPATH@/@MOZ_CHILD_PROCESS_NAME@
 
 @BINPATH@/AndroidManifest.xml
 @BINPATH@/resources.arsc
diff --git a/mobile/android/locales/en-US/chrome/about.dtd b/mobile/android/locales/en-US/chrome/about.dtd
index 6deed8c24ab..6c493e4b4df 100644
--- a/mobile/android/locales/en-US/chrome/about.dtd
+++ b/mobile/android/locales/en-US/chrome/about.dtd
@@ -19,3 +19,6 @@
 <!ENTITY aboutPage.relNotes.label               "Release Notes">
 <!ENTITY aboutPage.credits.label                "Credits">
 <!ENTITY aboutPage.license.label                "Licensing Information">
+
+<!-- LOCALIZATION NOTE (aboutPage.logoTrademark): The message is explicitly about the word "Firefox" being trademarked, that's why we use it, instead of brandShortName. -->
+<!ENTITY aboutPage.logoTrademark                "Firefox and the Firefox logos are trademarks of the Mozilla Foundation.">
diff --git a/mobile/android/modules/Sanitizer.jsm b/mobile/android/modules/Sanitizer.jsm
index f6668dd1e3f..277db62e5c3 100644
--- a/mobile/android/modules/Sanitizer.jsm
+++ b/mobile/android/modules/Sanitizer.jsm
@@ -120,6 +120,11 @@ Sanitizer.prototype = {
             Services.logins.setLoginSavingEnabled(host, true);
           }
 
+          // Clear site security settings
+          var sss = Cc["@mozilla.org/ssservice;1"]
+                      .getService(Ci.nsISiteSecurityService);
+          sss.clearAll();
+
           resolve();
         });
       },
diff --git a/mobile/android/search/java/org/mozilla/search/providers/SearchEngine.java b/mobile/android/search/java/org/mozilla/search/providers/SearchEngine.java
index ec223660c82..d9ea42f497e 100644
--- a/mobile/android/search/java/org/mozilla/search/providers/SearchEngine.java
+++ b/mobile/android/search/java/org/mozilla/search/providers/SearchEngine.java
@@ -49,6 +49,7 @@ public class SearchEngine {
 
     private String identifier;
     private String shortName;
+    private String iconURL;
 
     // TODO: Make something more robust (like EngineURL in nsSearchService.js)
     private Uri resultsUri;
@@ -79,8 +80,8 @@ public class SearchEngine {
                 readShortName(parser);
             } else if (tag.equals("Url")) {
                 readUrl(parser);
-            // TODO: Support for other tags
-            //} else if (tag.equals("Image")) {
+            } else if (tag.equals("Image")) {
+                readImage(parser);
             } else {
                 skip(parser);
             }
@@ -129,6 +130,19 @@ public class SearchEngine {
         }
     }
 
+    private void readImage(XmlPullParser parser) throws XmlPullParserException, IOException {
+        parser.require(XmlPullParser.START_TAG, null, "Image");
+
+        // TODO: Use width and height to get a preferred icon URL.
+        //final int width = Integer.parseInt(parser.getAttributeValue(null, "width"));
+        //final int height = Integer.parseInt(parser.getAttributeValue(null, "height"));
+
+        if (parser.next() == XmlPullParser.TEXT) {
+            iconURL = parser.getText();
+            parser.nextTag();
+        }
+    }
+
     private void skip(XmlPullParser parser) throws XmlPullParserException, IOException {
         if (parser.getEventType() != XmlPullParser.START_TAG) {
             throw new IllegalStateException();
@@ -176,6 +190,10 @@ public class SearchEngine {
         return shortName;
     }
 
+    public String getIconURL() {
+        return iconURL;
+    }
+
     /**
      * Determine whether a particular url belongs to this search engine. If not,
      * the url will be sent to Fennec.
diff --git a/mobile/android/search/java/org/mozilla/search/providers/SearchEngineManager.java b/mobile/android/search/java/org/mozilla/search/providers/SearchEngineManager.java
index 900bdc9a957..145f4c993fc 100644
--- a/mobile/android/search/java/org/mozilla/search/providers/SearchEngineManager.java
+++ b/mobile/android/search/java/org/mozilla/search/providers/SearchEngineManager.java
@@ -11,6 +11,7 @@ import android.text.TextUtils;
 import android.util.Log;
 
 import org.mozilla.gecko.AppConstants;
+import org.mozilla.gecko.BrowserLocaleManager;
 import org.mozilla.gecko.GeckoSharedPrefs;
 import org.mozilla.gecko.util.GeckoJarReader;
 import org.mozilla.search.R;
@@ -23,6 +24,7 @@ import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Locale;
 
 public class SearchEngineManager implements SharedPreferences.OnSharedPreferenceChangeListener {
     private static final String LOG_TAG = "SearchEngineManager";
@@ -118,8 +120,7 @@ public class SearchEngineManager implements SharedPreferences.OnSharedPreference
      */
     public List<SearchEngine> getAllEngines() {
         // First try to read the engine list from the jar.
-        final String url = getSearchPluginsJarUrl("list.txt");
-        InputStream in = GeckoJarReader.getStream(url);
+        InputStream in = getInputStreamFromJar("list.txt");
 
         // Fallback for standalone search activity.
         if (in == null) {
@@ -167,7 +168,7 @@ public class SearchEngineManager implements SharedPreferences.OnSharedPreference
      * @return SearchEngine instance for identifier
      */
     private SearchEngine createEngine(String identifier) {
-        InputStream in = getEngineFromJar(identifier);
+        InputStream in = getInputStreamFromJar(identifier + ".xml");
 
         // Fallback for standalone search activity.
         if (in == null) {
@@ -210,27 +211,43 @@ public class SearchEngineManager implements SharedPreferences.OnSharedPreference
     }
 
     /**
-     * Reads open search plugin XML file from the gecko jar. This will only work
+     * Reads a file from the searchplugins directory in the Gecko jar. This will only work
      * if the search activity is built as part of mozilla-central.
      *
-     * @param identifier search engine identifier (e.g. "google")
-     * @return InputStream for open search plugin XML
+     * @param fileName name of the file to read
+     * @return InputStream for file
      */
-    private InputStream getEngineFromJar(String identifier) {
-        final String url = getSearchPluginsJarUrl(identifier + ".xml");
+    private InputStream getInputStreamFromJar(String fileName) {
+        final Locale locale = Locale.getDefault();
+
+        // First, try a file path for the full locale.
+        final String languageTag = BrowserLocaleManager.getLanguageTag(locale);
+        String url = getSearchPluginsJarURL(languageTag, fileName);
+
+        final InputStream in = GeckoJarReader.getStream(url);
+        if (in != null) {
+            return in;
+        }
+
+        // If that doesn't work, try a file path for just the language.
+        final String language = BrowserLocaleManager.getLanguage(locale);
+        if (languageTag.equals(language)) {
+            // We already tried this, so just return null.
+            return null;
+        }
+
+        url = getSearchPluginsJarURL(language, fileName);
         return GeckoJarReader.getStream(url);
     }
 
     /**
      * Gets the jar URL for a file in the searchplugins directory
      *
-     * @param fileName
-     * @return
+     * @param locale String representing the Gecko locale (e.g. "en-US")
+     * @param fileName name of the file to read
+     * @return URL for jar file
      */
-    private String getSearchPluginsJarUrl(String fileName) {
-        // TODO: Get the real value for this
-        final String locale = "en-US";
-
+    private String getSearchPluginsJarURL(String locale, String fileName) {
         final String path = "!/chrome/" + locale + "/locale/" + locale + "/browser/searchplugins/" + fileName;
         return "jar:jar:file://" + context.getPackageResourcePath() + "!/" + AppConstants.OMNIJAR_NAME + path;
     }
diff --git a/mobile/android/search/java/org/mozilla/search/ui/FacetBar.java b/mobile/android/search/java/org/mozilla/search/ui/FacetBar.java
new file mode 100644
index 00000000000..8947fce6bdd
--- /dev/null
+++ b/mobile/android/search/java/org/mozilla/search/ui/FacetBar.java
@@ -0,0 +1,124 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.search.ui;
+
+import android.content.Context;
+import android.graphics.Canvas;
+import android.graphics.Color;
+import android.graphics.Paint;
+import android.util.AttributeSet;
+import android.widget.RadioButton;
+import android.widget.RadioGroup;
+
+import org.mozilla.search.R;
+
+public class FacetBar extends RadioGroup {
+
+    // Ensure facets have equal width and match the bar's height. Supplying these
+    // in styles.xml/FacetButtonStyle does not work. See:
+    //   http://stackoverflow.com/questions/24213193/android-ignores-layout-weight-parameter-from-styles-xml
+    private static final RadioGroup.LayoutParams FACET_LAYOUT_PARAMS =
+            new RadioGroup.LayoutParams(0, LayoutParams.MATCH_PARENT, 1.0f);
+
+    // A loud default color to make it obvious that setUnderlineColor should be called.
+    private int underlineColor = Color.RED;
+
+    // Used for assigning unique view ids when facet buttons are being created.
+    private int nextButtonId = 0;
+
+    public FacetBar(Context context, AttributeSet attrs) {
+        super(context, attrs);
+    }
+
+    /**
+     * Add a new button to the facet bar.
+     *
+     * @param facetName The text to be used in the button.
+     */
+    public void addFacet(String facetName) {
+        addFacet(facetName, false);
+    }
+
+    /**
+     * Add a new button to the facet bar.
+     *
+     * @param facetName The text to be used in the button.
+     * @param checked   Whether the button should be checked. If true, the
+     *                  onCheckChange listener *will* be fired.
+     */
+    public void addFacet(String facetName, boolean checked) {
+        final FacetButton button = new FacetButton(getContext(), facetName, underlineColor);
+
+        // The ids are used internally by RadioGroup to manage which button is
+        // currently checked. Since we are programmatically creating the buttons,
+        // we need to manually assign an id.
+        button.setId(nextButtonId++);
+
+        // Ensure the buttons are equally spaced.
+        button.setLayoutParams(FACET_LAYOUT_PARAMS);
+
+        // If true, this will fire the onCheckChange listener.
+        button.setChecked(checked);
+
+        addView(button);
+    }
+
+    /**
+     * Update the brand color for all of the buttons.
+     */
+    public void setUnderlineColor(int underlineColor) {
+        this.underlineColor = underlineColor;
+
+        if (getChildCount() > 0) {
+            for (int i = 0; i < getChildCount(); i++) {
+                ((FacetButton) getChildAt(i)).setUnderlineColor(underlineColor);
+            }
+        }
+    }
+
+    /**
+     * A custom TextView that includes a bottom border. The bottom border
+     * can have a custom color and thickness.
+     */
+    private static class FacetButton extends RadioButton {
+
+        private final Paint underlinePaint = new Paint();
+
+        public FacetButton(Context context, String text, int color) {
+            super(context, null, R.attr.facetButtonStyle);
+
+            setText(text);
+
+            underlinePaint.setStyle(Paint.Style.STROKE);
+            underlinePaint.setStrokeWidth(getResources().getDimension(R.dimen.facet_button_underline_thickness));
+            underlinePaint.setColor(color);
+        }
+
+        @Override
+        public void setChecked(boolean checked) {
+            super.setChecked(checked);
+
+            // Force the button to redraw to update the underline state.
+            invalidate();
+        }
+
+        @Override
+        protected void onDraw(Canvas canvas) {
+            super.onDraw(canvas);
+            if (isChecked()) {
+                // Translate the line upward so that it isn't clipped by the button's boundary.
+                // We divide by 2 since, without offset, the line would be drawn with its
+                // midpoint at the bottom of the button -- half of the stroke going up,
+                // and half of the stroke getting clipped.
+                final float yPos = getHeight() - underlinePaint.getStrokeWidth() / 2;
+                canvas.drawLine(0, yPos, getWidth(), yPos, underlinePaint);
+            }
+        }
+
+        public void setUnderlineColor(int color) {
+            underlinePaint.setColor(color);
+        }
+    }
+}
diff --git a/mobile/android/search/res/color/facet_button_text_color.xml b/mobile/android/search/res/color/facet_button_text_color.xml
new file mode 100644
index 00000000000..90da6e32478
--- /dev/null
+++ b/mobile/android/search/res/color/facet_button_text_color.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<selector xmlns:android="http://schemas.android.com/apk/res/android">
+    <!-- facet is selected -->
+    <item android:state_checked="true" android:color="@color/facet_button_text_color_selected" />
+
+    <!-- default -->
+    <item android:color="@color/facet_button_text_color_default" />
+</selector>
diff --git a/mobile/android/search/res/drawable/facet_button_background.xml b/mobile/android/search/res/drawable/facet_button_background.xml
new file mode 100644
index 00000000000..de1b6e996f6
--- /dev/null
+++ b/mobile/android/search/res/drawable/facet_button_background.xml
@@ -0,0 +1,15 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<selector xmlns:android="http://schemas.android.com/apk/res/android">
+    <!--facet button is pressed (omitting currently-selected facet)-->
+    <item
+        android:state_pressed="true"
+        android:state_checked="false"
+        android:drawable="@drawable/facet_button_background_pressed"/>
+
+    <!--default-->
+    <item
+        android:drawable="@drawable/facet_button_background_default"/>
+</selector>
diff --git a/mobile/android/search/res/drawable/facet_button_background_default.xml b/mobile/android/search/res/drawable/facet_button_background_default.xml
new file mode 100644
index 00000000000..b3358d2ede9
--- /dev/null
+++ b/mobile/android/search/res/drawable/facet_button_background_default.xml
@@ -0,0 +1,8 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<shape xmlns:android="http://schemas.android.com/apk/res/android"
+    android:shape="rectangle">
+    <solid android:color="@color/facet_button_background_color_default" />
+</shape>
diff --git a/mobile/android/search/res/drawable/facet_button_background_pressed.xml b/mobile/android/search/res/drawable/facet_button_background_pressed.xml
new file mode 100644
index 00000000000..0a46f60573b
--- /dev/null
+++ b/mobile/android/search/res/drawable/facet_button_background_pressed.xml
@@ -0,0 +1,8 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<shape xmlns:android="http://schemas.android.com/apk/res/android"
+    android:shape="rectangle">
+    <solid android:color="@color/facet_button_background_color_pressed" />
+</shape>
diff --git a/mobile/android/search/res/layout/search_suggestions_row.xml b/mobile/android/search/res/layout/search_suggestions_row.xml
index 10dbe7f1c8a..34d865ae0e0 100644
--- a/mobile/android/search/res/layout/search_suggestions_row.xml
+++ b/mobile/android/search/res/layout/search_suggestions_row.xml
@@ -2,7 +2,7 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<FrameLayout
+<LinearLayout
     xmlns:android="http://schemas.android.com/apk/res/android"
     android:layout_width="match_parent"
     android:layout_height="wrap_content"
@@ -14,8 +14,9 @@
 
     <TextView
         android:id="@+id/auto_complete_row_text"
-        android:layout_width="match_parent"
+        android:layout_width="wrap_content"
         android:layout_height="wrap_content"
+        android:layout_weight="1"
         android:paddingLeft="@dimen/suggestion_card_padding_x"
         android:paddingTop="@dimen/card_padding_y"
         android:paddingBottom="@dimen/card_padding_y"
@@ -24,7 +25,7 @@
     <ImageButton
         android:id="@+id/auto_complete_row_jump_button"
         android:layout_width="wrap_content"
-        android:layout_height="match_parent"
+        android:layout_height="wrap_content"
         android:layout_gravity="right|center_vertical"
         android:paddingLeft="@dimen/jump_button_padding_x"
         android:paddingRight="@dimen/jump_button_padding_x"
@@ -32,4 +33,4 @@
         android:contentDescription="@string/search_plus_content_description"
         android:background="@android:color/transparent" />
 
-</FrameLayout>
+</LinearLayout>
diff --git a/mobile/android/search/res/values-v13/search_styles.xml b/mobile/android/search/res/values-v13/search_styles.xml
index ef2d4ca465f..f124e33df4c 100644
--- a/mobile/android/search/res/values-v13/search_styles.xml
+++ b/mobile/android/search/res/values-v13/search_styles.xml
@@ -8,6 +8,11 @@
     <style name="AppTheme" parent="@android:style/Theme.Holo.Light.NoActionBar">
         <item name="android:windowBackground">@color/global_background_color</item>
         <item name="android:colorBackground">@color/global_background_color</item>
+
+        <!--This attribute is required so that we can create a facet button-->
+        <!--pragmatically. The defStyle param used in the View constructor-->
+        <!--must be an attr, see: https://code.google.com/p/android/issues/detail?id=12683-->
+        <item name="facetButtonStyle">@style/FacetButtonStyle</item>
     </style>
 
     <style name="SettingsTheme" parent="@android:style/Theme.Holo.Light"/>
diff --git a/mobile/android/search/res/values/search_attrs.xml b/mobile/android/search/res/values/search_attrs.xml
new file mode 100644
index 00000000000..d1b0ded5982
--- /dev/null
+++ b/mobile/android/search/res/values/search_attrs.xml
@@ -0,0 +1,12 @@
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<resources>
+    <declare-styleable name="FacetButton"/>
+
+    <!--This attribute is required so that we can create a facet button-->
+    <!--pragmatically. The defStyle param used in the View constructor-->
+    <!--must be an attr, see: https://code.google.com/p/android/issues/detail?id=12683-->
+    <attr name="facetButtonStyle" />
+</resources>
diff --git a/mobile/android/search/res/values/search_colors.xml b/mobile/android/search/res/values/search_colors.xml
index 9d8c6a5f57d..6b8139a1333 100644
--- a/mobile/android/search/res/values/search_colors.xml
+++ b/mobile/android/search/res/values/search_colors.xml
@@ -19,5 +19,10 @@
     <color name="widget_button_pressed">#33000000</color>
     <color name="widget_text_color">#5F6368</color>
 
-    <!-- Search suggestion highlight color is defined in SearchFragment.java -->
+    <!--Facet button colors-->
+    <color name="facet_button_background_color_default">@android:color/white</color>
+    <color name="facet_button_background_color_pressed">#FAFAFA</color>
+
+    <color name="facet_button_text_color_default">#ADB0B1</color>
+    <color name="facet_button_text_color_selected">#383E42</color>
 </resources>
diff --git a/mobile/android/search/res/values/search_dimens.xml b/mobile/android/search/res/values/search_dimens.xml
index f8e2fe632de..38dff1302f3 100644
--- a/mobile/android/search/res/values/search_dimens.xml
+++ b/mobile/android/search/res/values/search_dimens.xml
@@ -39,4 +39,6 @@
     <dimen name="widget_drawable_corner_radius">4dp</dimen>
     <dimen name="widget_bg_border_offset">3dp</dimen>
 
+    <dimen name="facet_bar_height">50dp</dimen>
+    <dimen name="facet_button_underline_thickness">5dp</dimen>
 </resources>
diff --git a/mobile/android/search/res/values/search_styles.xml b/mobile/android/search/res/values/search_styles.xml
index 6914bbaa11b..395d4038db3 100644
--- a/mobile/android/search/res/values/search_styles.xml
+++ b/mobile/android/search/res/values/search_styles.xml
@@ -8,8 +8,23 @@
     <style name="AppTheme" parent="@android:style/Theme.Light.NoTitleBar">
         <item name="android:windowBackground">@color/global_background_color</item>
         <item name="android:colorBackground">@color/global_background_color</item>
+
+        <!--This attribute is required so that we can create a facet button-->
+        <!--pragmatically. The defStyle param used in the View constructor-->
+        <!--must be an attr, see: https://code.google.com/p/android/issues/detail?id=12683-->
+        <item name="facetButtonStyle">@style/FacetButtonStyle</item>
     </style>
 
-    <style name="SettingsTheme" parent="@android:style/Theme.Light"/>
+    <style name="SettingsTheme" parent="@android:style/Theme.Light" />
+
+    <style name="FacetButtonStyle">
+        <!--Since we're not inflating xml, we have to apply the layout params -->
+        <!--after instantiation. See FacetBar.addFacet.-->
+        <item name="android:textSize">15sp</item>
+        <item name="android:textColor">@color/facet_button_text_color</item>
+        <item name="android:background">@drawable/facet_button_background</item>
+        <item name="android:gravity">center</item>
+        <item name="android:clickable">true</item>
+    </style>
 
 </resources>
diff --git a/mobile/android/search/search_activity_sources.mozbuild b/mobile/android/search/search_activity_sources.mozbuild
index bf350854e90..3968062d607 100644
--- a/mobile/android/search/search_activity_sources.mozbuild
+++ b/mobile/android/search/search_activity_sources.mozbuild
@@ -18,4 +18,5 @@ search_activity_sources = [
     'java/org/mozilla/search/SearchPreferenceActivity.java',
     'java/org/mozilla/search/SearchWidget.java',
     'java/org/mozilla/search/ui/BackCaptureEditText.java',
+    'java/org/mozilla/search/ui/FacetBar.java',
 ]
diff --git a/mobile/android/tests/browser/junit3/AndroidManifest.xml.in b/mobile/android/tests/browser/junit3/AndroidManifest.xml.in
index cf0918bc6c0..d3e8309d1fb 100644
--- a/mobile/android/tests/browser/junit3/AndroidManifest.xml.in
+++ b/mobile/android/tests/browser/junit3/AndroidManifest.xml.in
@@ -22,6 +22,6 @@
 
     <instrumentation
         android:label="@string/app_name"
-        android:name="org.mozilla.gecko.browser.harness.BrowserInstrumentationTestRunner"
+        android:name="org.mozilla.gecko.harness.BrowserInstrumentationTestRunner"
         android:targetPackage="@ANDROID_BROWSER_TARGET_PACKAGE_NAME@" />
 </manifest>
diff --git a/mobile/android/tests/browser/junit3/moz.build b/mobile/android/tests/browser/junit3/moz.build
index 631a58e13d4..2e1935031e9 100644
--- a/mobile/android/tests/browser/junit3/moz.build
+++ b/mobile/android/tests/browser/junit3/moz.build
@@ -8,16 +8,16 @@ DEFINES['ANDROID_PACKAGE_NAME'] = CONFIG['ANDROID_PACKAGE_NAME']
 
 jar = add_java_jar('browser-junit3')
 jar.sources += [
+    'src/BrowserTestCase.java',
     'src/harness/BrowserInstrumentationTestRunner.java',
     'src/harness/BrowserTestListener.java',
-    'src/tests/BrowserTestCase.java',
-    'src/tests/TestDistribution.java',
-    'src/tests/TestGeckoSharedPrefs.java',
-    'src/tests/TestImageDownloader.java',
-    'src/tests/TestJarReader.java',
-    'src/tests/TestRawResource.java',
-    'src/tests/TestSuggestedSites.java',
-    'src/tests/TestTopSitesCursorWrapper.java',
+    'src/TestDistribution.java',
+    'src/TestGeckoSharedPrefs.java',
+    'src/TestImageDownloader.java',
+    'src/TestJarReader.java',
+    'src/TestRawResource.java',
+    'src/TestSuggestedSites.java',
+    'src/TestTopSitesCursorWrapper.java',
 ]
 jar.generated_sources = [] # None yet -- try to keep it this way.
 jar.javac_flags += ['-Xlint:all,-unchecked']
@@ -36,4 +36,4 @@ main.recursive_make_targets += [OBJDIR + '/generated/' + f for f in jar.generate
 main.referenced_projects += ['Fennec']
 
 main.add_classpathentry('src', SRCDIR + '/src',
-    dstdir='src/org/mozilla/gecko/browser')
+    dstdir='src/org/mozilla/gecko')
diff --git a/mobile/android/tests/browser/junit3/src/tests/BrowserTestCase.java b/mobile/android/tests/browser/junit3/src/BrowserTestCase.java
similarity index 97%
rename from mobile/android/tests/browser/junit3/src/tests/BrowserTestCase.java
rename to mobile/android/tests/browser/junit3/src/BrowserTestCase.java
index 20b83eb314c..c92a6ed2bb2 100644
--- a/mobile/android/tests/browser/junit3/src/tests/BrowserTestCase.java
+++ b/mobile/android/tests/browser/junit3/src/BrowserTestCase.java
@@ -1,7 +1,7 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import org.mozilla.gecko.AppConstants;
 
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestDistribution.java b/mobile/android/tests/browser/junit3/src/TestDistribution.java
similarity index 97%
rename from mobile/android/tests/browser/junit3/src/tests/TestDistribution.java
rename to mobile/android/tests/browser/junit3/src/TestDistribution.java
index dcc2a9fafc7..914ff891faa 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestDistribution.java
+++ b/mobile/android/tests/browser/junit3/src/TestDistribution.java
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import org.mozilla.gecko.distribution.ReferrerDescriptor;
 
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestGeckoMenu.java b/mobile/android/tests/browser/junit3/src/TestGeckoMenu.java
similarity index 97%
rename from mobile/android/tests/browser/junit3/src/tests/TestGeckoMenu.java
rename to mobile/android/tests/browser/junit3/src/TestGeckoMenu.java
index 0033a1213d6..ee8426ae878 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestGeckoMenu.java
+++ b/mobile/android/tests/browser/junit3/src/TestGeckoMenu.java
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import org.mozilla.gecko.AppConstants;
 import org.mozilla.gecko.menu.GeckoMenu;
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestGeckoProfilesProvider.java b/mobile/android/tests/browser/junit3/src/TestGeckoProfilesProvider.java
similarity index 97%
rename from mobile/android/tests/browser/junit3/src/tests/TestGeckoProfilesProvider.java
rename to mobile/android/tests/browser/junit3/src/TestGeckoProfilesProvider.java
index dbc4fd38888..7343a5a2b5a 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestGeckoProfilesProvider.java
+++ b/mobile/android/tests/browser/junit3/src/TestGeckoProfilesProvider.java
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import java.io.File;
 import java.util.HashMap;
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestGeckoSharedPrefs.java b/mobile/android/tests/browser/junit3/src/TestGeckoSharedPrefs.java
similarity index 96%
rename from mobile/android/tests/browser/junit3/src/tests/TestGeckoSharedPrefs.java
rename to mobile/android/tests/browser/junit3/src/TestGeckoSharedPrefs.java
index 3b416a9ab33..76e86aff670 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestGeckoSharedPrefs.java
+++ b/mobile/android/tests/browser/junit3/src/TestGeckoSharedPrefs.java
@@ -1,23 +1,19 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.EnumSet;
-import java.util.Map;
 import java.util.HashSet;
 import java.util.Set;
 
-import org.mozilla.gecko.GeckoProfile;
-import org.mozilla.gecko.GeckoSharedPrefs;
 import org.mozilla.gecko.GeckoSharedPrefs.Flags;
 
 import android.content.Context;
 import android.content.SharedPreferences;
 import android.content.SharedPreferences.Editor;
-import android.os.Build;
 import android.preference.PreferenceManager;
 import android.test.RenamingDelegatingContext;
 
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestImageDownloader.java b/mobile/android/tests/browser/junit3/src/TestImageDownloader.java
similarity index 99%
rename from mobile/android/tests/browser/junit3/src/tests/TestImageDownloader.java
rename to mobile/android/tests/browser/junit3/src/TestImageDownloader.java
index dfa3162ec35..b2b8c8c6a71 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestImageDownloader.java
+++ b/mobile/android/tests/browser/junit3/src/TestImageDownloader.java
@@ -1,7 +1,7 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import android.content.Context;
 import android.content.res.Resources;
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestJarReader.java b/mobile/android/tests/browser/junit3/src/TestJarReader.java
similarity index 97%
rename from mobile/android/tests/browser/junit3/src/tests/TestJarReader.java
rename to mobile/android/tests/browser/junit3/src/TestJarReader.java
index e33345b7600..7626301cfab 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestJarReader.java
+++ b/mobile/android/tests/browser/junit3/src/TestJarReader.java
@@ -1,7 +1,7 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import java.io.InputStream;
 
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestRawResource.java b/mobile/android/tests/browser/junit3/src/TestRawResource.java
similarity index 96%
rename from mobile/android/tests/browser/junit3/src/tests/TestRawResource.java
rename to mobile/android/tests/browser/junit3/src/TestRawResource.java
index 96f41a327e6..c592371862a 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestRawResource.java
+++ b/mobile/android/tests/browser/junit3/src/TestRawResource.java
@@ -1,19 +1,18 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+import org.mozilla.gecko.util.RawResource;
 
 import android.content.Context;
 import android.content.res.Resources;
 import android.test.mock.MockContext;
 import android.test.mock.MockResources;
-import android.util.TypedValue;
-
-import java.io.ByteArrayInputStream;
-import java.io.InputStream;
-import java.io.IOException;
-
-import org.mozilla.gecko.util.RawResource;
 
 /**
  * Tests whether RawResource.getAsString() produces the right String
@@ -64,4 +63,4 @@ public class TestRawResource extends BrowserTestCase {
 
         assertEquals(RAW_CONTENTS, result);
     }
-}
\ No newline at end of file
+}
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestSuggestedSites.java b/mobile/android/tests/browser/junit3/src/TestSuggestedSites.java
similarity index 97%
rename from mobile/android/tests/browser/junit3/src/tests/TestSuggestedSites.java
rename to mobile/android/tests/browser/junit3/src/TestSuggestedSites.java
index 20fea7adb18..aa459795217 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestSuggestedSites.java
+++ b/mobile/android/tests/browser/junit3/src/TestSuggestedSites.java
@@ -1,48 +1,40 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.tests;
-
-import android.content.Context;
-import android.content.ContentResolver;
-import android.content.res.Resources;
-import android.content.SharedPreferences;
-import android.database.Cursor;
-import android.database.ContentObserver;
-import android.net.Uri;
-import android.os.Handler;
-import android.os.SystemClock;
-import android.test.mock.MockResources;
-import android.test.RenamingDelegatingContext;
+package org.mozilla.gecko;
 
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.FileOutputStream;
-import java.io.InputStream;
 import java.io.IOException;
-import java.net.HttpURLConnection;
-import java.net.URI;
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
-import java.util.jar.JarInputStream;
-import java.util.Map;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
 import java.util.Set;
 
 import org.json.JSONArray;
 import org.json.JSONObject;
-
-import org.mozilla.gecko.BrowserLocaleManager;
-import org.mozilla.gecko.R;
 import org.mozilla.gecko.db.BrowserContract;
 import org.mozilla.gecko.db.SuggestedSites;
 import org.mozilla.gecko.distribution.Distribution;
-import org.mozilla.gecko.GeckoSharedPrefs;
 import org.mozilla.gecko.preferences.GeckoPreferences;
 
+import android.content.ContentResolver;
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.content.res.Resources;
+import android.database.ContentObserver;
+import android.database.Cursor;
+import android.net.Uri;
+import android.os.SystemClock;
+import android.test.RenamingDelegatingContext;
+import android.test.mock.MockResources;
+
 public class TestSuggestedSites extends BrowserTestCase {
     private static class TestContext extends RenamingDelegatingContext {
         private static final String PREFIX = "TestSuggestedSites-";
@@ -94,12 +86,10 @@ public class TestSuggestedSites extends BrowserTestCase {
     }
 
     private static class TestDistribution extends Distribution {
-        private final Context context;
         private final Map<Locale, File> filesPerLocale;
 
         public TestDistribution(Context context) {
             super(context);
-            this.context = context;
             this.filesPerLocale = new HashMap<Locale, File>();
         }
 
diff --git a/mobile/android/tests/browser/junit3/src/tests/TestTopSitesCursorWrapper.java b/mobile/android/tests/browser/junit3/src/TestTopSitesCursorWrapper.java
similarity index 99%
rename from mobile/android/tests/browser/junit3/src/tests/TestTopSitesCursorWrapper.java
rename to mobile/android/tests/browser/junit3/src/TestTopSitesCursorWrapper.java
index 6fcc888cd65..355a12963c3 100644
--- a/mobile/android/tests/browser/junit3/src/tests/TestTopSitesCursorWrapper.java
+++ b/mobile/android/tests/browser/junit3/src/TestTopSitesCursorWrapper.java
@@ -1,7 +1,7 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.tests;
+package org.mozilla.gecko;
 
 import android.database.Cursor;
 import android.database.MatrixCursor;
@@ -385,4 +385,4 @@ public class TestTopSitesCursorWrapper extends BrowserTestCase {
 
         c.close();
     }
-}
\ No newline at end of file
+}
diff --git a/mobile/android/tests/browser/junit3/src/harness/BrowserInstrumentationTestRunner.java b/mobile/android/tests/browser/junit3/src/harness/BrowserInstrumentationTestRunner.java
index 94d90a0e8ff..7dc34cbe185 100644
--- a/mobile/android/tests/browser/junit3/src/harness/BrowserInstrumentationTestRunner.java
+++ b/mobile/android/tests/browser/junit3/src/harness/BrowserInstrumentationTestRunner.java
@@ -1,7 +1,7 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.harness;
+package org.mozilla.gecko.harness;
 
 import android.os.Bundle;
 import android.test.AndroidTestRunner;
diff --git a/mobile/android/tests/browser/junit3/src/harness/BrowserTestListener.java b/mobile/android/tests/browser/junit3/src/harness/BrowserTestListener.java
index a29acd915da..b46bdb34fa5 100644
--- a/mobile/android/tests/browser/junit3/src/harness/BrowserTestListener.java
+++ b/mobile/android/tests/browser/junit3/src/harness/BrowserTestListener.java
@@ -1,7 +1,7 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
-package org.mozilla.gecko.browser.harness;
+package org.mozilla.gecko.harness;
 
 import junit.framework.AssertionFailedError;
 import junit.framework.Test;
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index d3b989c4abb..e99dfbbea76 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -439,8 +439,11 @@ pref("apz.asyncscroll.timeout", 300);
 // 0 = FREE (No locking at all)
 // 1 = STANDARD (Once locked, remain locked until scrolling ends)
 // 2 = STICKY (Allow lock to be broken, with hysteresis)
-pref("apz.axis_lock_mode", 0);
-
+pref("apz.axis_lock.mode", 0);
+pref("apz.axis_lock.lock_angle", "0.5235987");        // PI / 6 (30 degrees)
+pref("apz.axis_lock.breakout_threshold", "0.03125");  // 1/32 inches
+pref("apz.axis_lock.breakout_angle", "0.3926991");    // PI / 8 (22.5 degrees)
+pref("apz.axis_lock.direct_pan_angle", "1.047197");   // PI / 3 (60 degrees)
 pref("apz.content_response_timeout", 300);
 pref("apz.cross_slide.enabled", false);
 pref("apz.danger_zone_x", 50);
@@ -909,8 +912,6 @@ pref("dom.webapps.useCurrentProfile", false);
 
 pref("dom.cycle_collector.incremental", true);
 
-pref("dom.window_experimental_bindings", true);
-
 // Parsing perf prefs. For now just mimic what the old code did.
 #ifndef XP_WIN
 pref("content.sink.pending_event_mode", 0);
diff --git a/netwerk/base/public/nsISiteSecurityService.idl b/netwerk/base/public/nsISiteSecurityService.idl
index caff3edd9bf..01c48fd0122 100644
--- a/netwerk/base/public/nsISiteSecurityService.idl
+++ b/netwerk/base/public/nsISiteSecurityService.idl
@@ -8,7 +8,7 @@ interface nsIURI;
 interface nsIObserver;
 interface nsIHttpChannel;
 
-[scriptable, uuid(b20a9242-5732-45bc-9fa0-a178154f2721)]
+[scriptable, uuid(e7da4bd1-7c38-4d73-843d-c1d6af9b3c85)]
 interface nsISiteSecurityService : nsISupports
 {
     const uint32_t HEADER_HSTS = 0;
@@ -90,11 +90,12 @@ interface nsISiteSecurityService : nsISupports
      */
     boolean isSecureURI(in uint32_t aType, in nsIURI aURI, in uint32_t aFlags);
 
+    /**
+     * Removes all security state by resetting to factory-original settings.
+     */
+    void clearAll();
 };
 
 %{C++
 #define NS_SSSERVICE_CONTRACTID "@mozilla.org/ssservice;1"
-
-#define STS_PERMISSION "sts/use"
-#define STS_SUBDOMAIN_PERMISSION "sts/subd"
 %}
diff --git a/netwerk/base/src/moz.build b/netwerk/base/src/moz.build
index cb4c1d02665..cfeadf57beb 100644
--- a/netwerk/base/src/moz.build
+++ b/netwerk/base/src/moz.build
@@ -9,6 +9,7 @@ EXPORTS += [
     'nsMIMEInputStream.h',
     'nsTemporaryFileInputStream.h',
     'nsURLHelper.h',
+    'nsURLParsers.h',
 ]
 
 EXPORTS.mozilla.net += [
diff --git a/netwerk/test/unit/test_standardurl.js b/netwerk/test/unit/test_standardurl.js
index ed7a7b15912..be227ecc559 100644
--- a/netwerk/test/unit/test_standardurl.js
+++ b/netwerk/test/unit/test_standardurl.js
@@ -220,6 +220,21 @@ function test_clearedSpec()
   symmetricEquality(true, url, ref);
 }
 
+function test_escapeQueryBrackets()
+{
+  var url = stringToURL("http://example.com/?a[x]=1");
+  do_check_eq(url.spec, "http://example.com/?a%5Bx%5D=1");
+
+  url = stringToURL("http://example.com/?a%5Bx%5D=1");
+  do_check_eq(url.spec, "http://example.com/?a%5Bx%5D=1");
+
+  url = stringToURL("http://[2001::1]/?a[x]=1");
+  do_check_eq(url.spec, "http://[2001::1]/?a%5Bx%5D=1");
+
+  url = stringToURL("http://[2001::1]/?a%5Bx%5D=1");
+  do_check_eq(url.spec, "http://[2001::1]/?a%5Bx%5D=1");
+}
+
 function run_test()
 {
   test_setEmptyPath();
@@ -228,4 +243,5 @@ function run_test()
   test_ipv6();
   test_ipv6_fail();
   test_clearedSpec();
+  test_escapeQueryBrackets();
 }
diff --git a/python/mozbuild/mozbuild/backend/android_eclipse.py b/python/mozbuild/mozbuild/backend/android_eclipse.py
index 43f76e35e64..3386266537e 100644
--- a/python/mozbuild/mozbuild/backend/android_eclipse.py
+++ b/python/mozbuild/mozbuild/backend/android_eclipse.py
@@ -176,17 +176,18 @@ class AndroidEclipseBackend(CommonBackend):
         for cpe in project._classpathentries:
             manifest.add_symlink(mozpath.join(srcdir, cpe.srcdir), cpe.dstdir)
 
-        # JARs and native libraries go in the same place. For now,
-        # we're adding class path entries with the full path to
-        # required JAR files (which makes sense for JARs in the source
-        # directory, but probably doesn't for JARs in the object
-        # directory). This could be a problem because we only know
-        # the contents of (a subdirectory of) libs/ after a successful
-        # build and package, which is after build-backend time. So we
-        # use a pattern symlink that is resolved at manifest install
-        # time.
-        if project.libs:
-            manifest.add_pattern_copy(mozpath.join(srcdir, project.libs), '**', 'libs')
+        # JARs and native libraries go in the same place. For now, we're adding
+        # class path entries with the full path to required JAR files (which
+        # makes sense for JARs in the source directory, but probably doesn't for
+        # JARs in the object directory). This could be a problem because we only
+        # know the contents of (a subdirectory of) libs/ after a successful
+        # build and package, which is after build-backend time. At the cost of
+        # some flexibility, we explicitly copy certain libraries here; if the
+        # libraries aren't present -- namely, when the tree hasn't been packaged
+        # -- this fails. That's by design, to avoid crashes on device caused by
+        # missing native libraries.
+        for src, dst in project.libs:
+            manifest.add_copy(mozpath.join(srcdir, src), dst)
 
         return manifest
 
@@ -239,6 +240,7 @@ class AndroidEclipseBackend(CommonBackend):
         else:
             defines['IDE_PROJECT_FILTERED_RESOURCES'] = ''
         defines['ANDROID_TARGET_SDK'] = self.environment.substs['ANDROID_TARGET_SDK']
+        defines['MOZ_ANDROID_MIN_SDK_VERSION'] = self.environment.defines['MOZ_ANDROID_MIN_SDK_VERSION']
 
         copier = FileCopier()
         finder = FileFinder(template_directory)
diff --git a/python/mozbuild/mozbuild/backend/recursivemake.py b/python/mozbuild/mozbuild/backend/recursivemake.py
index 7193c0e42e6..b616d55f294 100644
--- a/python/mozbuild/mozbuild/backend/recursivemake.py
+++ b/python/mozbuild/mozbuild/backend/recursivemake.py
@@ -404,12 +404,7 @@ class RecursiveMakeBackend(CommonBackend):
                     backend_file.write('%s := %s\n' % (k, v))
 
         elif isinstance(obj, Defines):
-            defines = obj.get_defines()
-            if defines:
-                backend_file.write('DEFINES +=')
-                for define in defines:
-                    backend_file.write(' %s' % define)
-                backend_file.write('\n')
+            self._process_defines(obj, backend_file)
 
         elif isinstance(obj, Exports):
             self._process_exports(obj, obj.exports, backend_file)
@@ -868,6 +863,15 @@ class RecursiveMakeBackend(CommonBackend):
 
         self._process_hierarchy_elements(obj, element, namespace, process_element)
 
+    def _process_defines(self, obj, backend_file):
+        """Output the DEFINES rules to the given backend file."""
+        defines = list(obj.get_defines())
+        if defines:
+            backend_file.write('DEFINES +=')
+            for define in defines:
+                backend_file.write(' %s' % define)
+            backend_file.write('\n')
+
     def _process_exports(self, obj, exports, backend_file):
         # This may not be needed, but is present for backwards compatibility
         # with the old make rules, just in case.
@@ -1231,6 +1235,9 @@ class RecursiveMakeBackend(CommonBackend):
             else:
                 backend_file.write_once('HOST_EXTRA_LIBS += %s\n' % lib)
 
+        # Process library-based defines
+        self._process_defines(obj.defines, backend_file)
+
     def _write_manifests(self, dest, manifests):
         man_dir = mozpath.join(self.environment.topobjdir, '_build_manifests',
             dest)
diff --git a/python/mozbuild/mozbuild/backend/templates/android_eclipse/.settings/org.eclipse.jdt.core.prefs b/python/mozbuild/mozbuild/backend/templates/android_eclipse/.settings/org.eclipse.jdt.core.prefs
index 270df58a650..57edfe23f41 100644
--- a/python/mozbuild/mozbuild/backend/templates/android_eclipse/.settings/org.eclipse.jdt.core.prefs
+++ b/python/mozbuild/mozbuild/backend/templates/android_eclipse/.settings/org.eclipse.jdt.core.prefs
@@ -1,15 +1,15 @@
 #filter substitution
 eclipse.preferences.version=1
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
-org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.6
+org.eclipse.jdt.core.compiler.codegen.targetPlatform=1.7
 org.eclipse.jdt.core.compiler.codegen.unusedLocal=preserve
-org.eclipse.jdt.core.compiler.compliance=1.6
+org.eclipse.jdt.core.compiler.compliance=1.7
 org.eclipse.jdt.core.compiler.debug.lineNumber=generate
 org.eclipse.jdt.core.compiler.debug.localVariable=generate
 org.eclipse.jdt.core.compiler.debug.sourceFile=generate
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
 org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
-org.eclipse.jdt.core.compiler.source=1.6
+org.eclipse.jdt.core.compiler.source=1.7
 org.eclipse.jdt.core.formatter.align_type_members_on_columns=false
 org.eclipse.jdt.core.formatter.alignment_for_arguments_in_allocation_expression=16
 org.eclipse.jdt.core.formatter.alignment_for_arguments_in_annotation=0
diff --git a/python/mozbuild/mozbuild/backend/templates/android_eclipse/AndroidManifest.xml b/python/mozbuild/mozbuild/backend/templates/android_eclipse/AndroidManifest.xml
index 7ffb3e188de..57d8aca8cb0 100644
--- a/python/mozbuild/mozbuild/backend/templates/android_eclipse/AndroidManifest.xml
+++ b/python/mozbuild/mozbuild/backend/templates/android_eclipse/AndroidManifest.xml
@@ -5,7 +5,7 @@
     android:versionName="1.0" >
 
     <uses-sdk
-        android:minSdkVersion="8"
-        android:targetSdkVersion="16" />
+        android:minSdkVersion="@MOZ_ANDROID_MIN_SDK_VERSION@"
+        android:targetSdkVersion="@ANDROID_TARGET_SDK@" />
 
 </manifest>
diff --git a/python/mozbuild/mozbuild/frontend/context.py b/python/mozbuild/mozbuild/frontend/context.py
index 7d1fdac124c..1d5fc173df1 100644
--- a/python/mozbuild/mozbuild/frontend/context.py
+++ b/python/mozbuild/mozbuild/frontend/context.py
@@ -449,6 +449,13 @@ VARIABLES = {
         populated by calling add_java_jar().
         """, 'libs'),
 
+    'LIBRARY_DEFINES': (OrderedDict, dict,
+        """Dictionary of compiler defines to declare for the entire library.
+
+        This variable works like DEFINES, except that declarations apply to all
+        libraries that link into this library via FINAL_LIBRARY.
+        """, None),
+
     'LIBRARY_NAME': (unicode, unicode,
         """The code name of the library generated for a directory.
 
diff --git a/python/mozbuild/mozbuild/frontend/data.py b/python/mozbuild/mozbuild/frontend/data.py
index b6ac777c746..00b55ee6055 100644
--- a/python/mozbuild/mozbuild/frontend/data.py
+++ b/python/mozbuild/mozbuild/frontend/data.py
@@ -187,6 +187,12 @@ class Defines(ContextDerived):
             else:
                 yield('-D%s=%s' % (define, shell_quote(value)))
 
+    def update(self, more_defines):
+        if isinstance(more_defines, Defines):
+            self.defines.update(more_defines.defines)
+        else:
+            self.defines.update(more_defines)
+
 class Exports(ContextDerived):
     """Context derived container object for EXPORTS, which is a
     HierarchicalStringList.
@@ -329,6 +335,7 @@ class LinkageWrongKindError(Exception):
 class Linkable(ContextDerived):
     """Generic context derived container object for programs and libraries"""
     __slots__ = (
+        'defines',
         'linked_libraries',
         'linked_system_libs',
     )
@@ -337,6 +344,7 @@ class Linkable(ContextDerived):
         ContextDerived.__init__(self, context)
         self.linked_libraries = []
         self.linked_system_libs = []
+        self.defines = Defines(context, {})
 
     def link_library(self, obj):
         assert isinstance(obj, BaseLibrary)
@@ -362,7 +370,6 @@ class Linkable(ContextDerived):
                 )
         self.linked_system_libs.append(lib)
 
-
 class BaseProgram(Linkable):
     """Context derived container object for programs, which is a unicode
     string.
diff --git a/python/mozbuild/mozbuild/frontend/emitter.py b/python/mozbuild/mozbuild/frontend/emitter.py
index 5e1ab2a3629..c26a2555e23 100644
--- a/python/mozbuild/mozbuild/frontend/emitter.py
+++ b/python/mozbuild/mozbuild/frontend/emitter.py
@@ -204,28 +204,19 @@ class TreeMetadataEmitter(LoggingMixin):
                     '\n    '.join(shared_libs), lib.basename),
                     contexts[lib.objdir])
 
-        def recurse_libs(lib):
-            for obj in lib.linked_libraries:
-                if not isinstance(obj, StaticLibrary) or not obj.link_into:
-                    continue
-                yield obj.objdir
-                for q in recurse_libs(obj):
-                    yield q
+        # Propagate LIBRARY_DEFINES to all child libraries recursively.
+        def propagate_defines(outerlib, defines):
+            outerlib.defines.update(defines)
+            for lib in outerlib.linked_libraries:
+                # Propagate defines only along FINAL_LIBRARY paths, not USE_LIBS
+                # paths.
+                if (isinstance(lib, StaticLibrary) and
+                        lib.link_into == outerlib.basename):
+                    propagate_defines(lib, defines)
 
-        sent_passthru = set()
         for lib in (l for libs in self._libs.values() for l in libs):
-            # For all root libraries (i.e. libraries that don't have a
-            # FINAL_LIBRARY), record, for each static library it links
-            # (recursively), that its FINAL_LIBRARY is that root library.
             if isinstance(lib, Library):
-                if isinstance(lib, SharedLibrary) or not lib.link_into:
-                    for p in recurse_libs(lib):
-                        if p in sent_passthru:
-                            continue
-                        sent_passthru.add(p)
-                        passthru = VariablePassthru(contexts[p])
-                        passthru.variables['FINAL_LIBRARY'] = lib.basename
-                        yield passthru
+                propagate_defines(lib, lib.defines)
             yield lib
 
         for obj in self._binaries.values():
@@ -603,6 +594,8 @@ class TreeMetadataEmitter(LoggingMixin):
 
         soname = context.get('SONAME')
 
+        lib_defines = context.get('LIBRARY_DEFINES')
+
         shared_args = {}
         static_args = {}
 
@@ -711,6 +704,12 @@ class TreeMetadataEmitter(LoggingMixin):
                 self._libs[libname].append(lib)
                 self._linkage.append((context, lib, 'USE_LIBS'))
 
+            if lib_defines:
+                if not libname:
+                    raise SandboxValidationError('LIBRARY_DEFINES needs a '
+                        'LIBRARY_NAME to take effect', context)
+                lib.defines.update(lib_defines)
+
         # While there are multiple test manifests, the behavior is very similar
         # across them. We enforce this by having common handling of all
         # manifests and outputting a single class type with the differences
diff --git a/python/mozbuild/mozbuild/mach_commands.py b/python/mozbuild/mozbuild/mach_commands.py
index 45fa2bbc763..7c528327e76 100644
--- a/python/mozbuild/mozbuild/mach_commands.py
+++ b/python/mozbuild/mozbuild/mach_commands.py
@@ -457,9 +457,9 @@ class Build(MachCommandBase):
         long_build = monitor.elapsed > 600
 
         if long_build:
-            print('We know it took a while, but your build finally finished successfully!')
+            output.on_line('We know it took a while, but your build finally finished successfully!')
         else:
-            print('Your build was successful!')
+            output.on_line('Your build was successful!')
 
         if monitor.have_resource_usage:
             excessive, swap_in, swap_out = monitor.have_excessive_swapping()
diff --git a/python/mozbuild/mozbuild/test/backend/common.py b/python/mozbuild/mozbuild/test/backend/common.py
index 8a8c816e5ed..9fd680dd948 100644
--- a/python/mozbuild/mozbuild/test/backend/common.py
+++ b/python/mozbuild/mozbuild/test/backend/common.py
@@ -34,7 +34,9 @@ CONFIGS = defaultdict(lambda: {
     'substs': [],
 }, {
     'android_eclipse': {
-        'defines': [],
+        'defines': [
+            ('MOZ_ANDROID_MIN_SDK_VERSION', '9'),
+        ],
         'non_global_defines': [],
         'substs': [
             ('ANDROID_TARGET_SDK', '16'),
diff --git a/python/mozbuild/mozbuild/test/common.py b/python/mozbuild/mozbuild/test/common.py
index c2095f72425..99154b64e34 100644
--- a/python/mozbuild/mozbuild/test/common.py
+++ b/python/mozbuild/mozbuild/test/common.py
@@ -35,3 +35,5 @@ class MockConfig(object):
         self.defines = self.substs
 
         self.external_source_dir = None
+        self.lib_prefix = 'lib'
+        self.lib_suffix = '.so'
diff --git a/python/mozbuild/mozbuild/test/frontend/data/library-defines/liba/moz.build b/python/mozbuild/mozbuild/test/frontend/data/library-defines/liba/moz.build
new file mode 100644
index 00000000000..5d5e78eed53
--- /dev/null
+++ b/python/mozbuild/mozbuild/test/frontend/data/library-defines/liba/moz.build
@@ -0,0 +1,5 @@
+# Any copyright is dedicated to the Public Domain.
+# http://creativecommons.org/publicdomain/zero/1.0/
+
+Library('liba')
+LIBRARY_DEFINES['IN_LIBA'] = True
diff --git a/python/mozbuild/mozbuild/test/frontend/data/library-defines/libb/moz.build b/python/mozbuild/mozbuild/test/frontend/data/library-defines/libb/moz.build
new file mode 100644
index 00000000000..add45f6c117
--- /dev/null
+++ b/python/mozbuild/mozbuild/test/frontend/data/library-defines/libb/moz.build
@@ -0,0 +1,7 @@
+# Any copyright is dedicated to the Public Domain.
+# http://creativecommons.org/publicdomain/zero/1.0/
+
+Library('libb')
+FINAL_LIBRARY = 'liba'
+LIBRARY_DEFINES['IN_LIBB'] = True
+USE_LIBS += ['libd']
diff --git a/python/mozbuild/mozbuild/test/frontend/data/library-defines/libc/moz.build b/python/mozbuild/mozbuild/test/frontend/data/library-defines/libc/moz.build
new file mode 100644
index 00000000000..cf25e2c44db
--- /dev/null
+++ b/python/mozbuild/mozbuild/test/frontend/data/library-defines/libc/moz.build
@@ -0,0 +1,5 @@
+# Any copyright is dedicated to the Public Domain.
+# http://creativecommons.org/publicdomain/zero/1.0/
+
+Library('libc')
+FINAL_LIBRARY = 'libb'
diff --git a/python/mozbuild/mozbuild/test/frontend/data/library-defines/libd/moz.build b/python/mozbuild/mozbuild/test/frontend/data/library-defines/libd/moz.build
new file mode 100644
index 00000000000..dd057c3d7e4
--- /dev/null
+++ b/python/mozbuild/mozbuild/test/frontend/data/library-defines/libd/moz.build
@@ -0,0 +1,5 @@
+# Any copyright is dedicated to the Public Domain.
+# http://creativecommons.org/publicdomain/zero/1.0/
+
+Library('libd')
+FORCE_STATIC_LIB = True
diff --git a/python/mozbuild/mozbuild/test/frontend/data/library-defines/moz.build b/python/mozbuild/mozbuild/test/frontend/data/library-defines/moz.build
new file mode 100644
index 00000000000..5f05fcef745
--- /dev/null
+++ b/python/mozbuild/mozbuild/test/frontend/data/library-defines/moz.build
@@ -0,0 +1,9 @@
+# Any copyright is dedicated to the Public Domain.
+# http://creativecommons.org/publicdomain/zero/1.0/
+
+@template
+def Library(name):
+    '''Template for libraries.'''
+    LIBRARY_NAME = name
+
+DIRS = ['liba', 'libb', 'libc', 'libd']
diff --git a/python/mozbuild/mozbuild/test/frontend/test_emitter.py b/python/mozbuild/mozbuild/test/frontend/test_emitter.py
index 39c29151f67..d47fd6b173f 100644
--- a/python/mozbuild/mozbuild/test/frontend/test_emitter.py
+++ b/python/mozbuild/mozbuild/test/frontend/test_emitter.py
@@ -22,6 +22,7 @@ from mozbuild.frontend.data import (
     ReaderSummary,
     Resources,
     SimpleProgram,
+    StaticLibrary,
     TestManifest,
     VariablePassthru,
 )
@@ -581,5 +582,22 @@ class TestEmitterBasic(unittest.TestCase):
             reader = self.reader('missing-local-includes')
             self.read_topsrcdir(reader)
 
+    def test_library_defines(self):
+        """Test that LIBRARY_DEFINES is propagated properly."""
+        reader = self.reader('library-defines')
+        objs = self.read_topsrcdir(reader)
+
+        libraries = [o for o in objs if isinstance(o,StaticLibrary)]
+        expected = {
+            'liba': '-DIN_LIBA',
+            'libb': '-DIN_LIBA -DIN_LIBB',
+            'libc': '-DIN_LIBA -DIN_LIBB',
+            'libd': ''
+        }
+        defines = {}
+        for lib in libraries:
+            defines[lib.basename] = ' '.join(lib.defines.get_defines())
+        self.assertEqual(expected, defines)
+
 if __name__ == '__main__':
     main()
diff --git a/security/manager/boot/src/DataStorage.cpp b/security/manager/boot/src/DataStorage.cpp
new file mode 100644
index 00000000000..f4d07f9b462
--- /dev/null
+++ b/security/manager/boot/src/DataStorage.cpp
@@ -0,0 +1,793 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "DataStorage.h"
+
+#include "mozilla/Preferences.h"
+#include "mozilla/Services.h"
+#include "mozilla/unused.h"
+#include "nsAppDirectoryServiceDefs.h"
+#include "nsDirectoryServiceUtils.h"
+#include "nsIObserverService.h"
+#include "nsITimer.h"
+#include "nsNetUtil.h"
+#include "nsStreamUtils.h"
+#include "nsThreadUtils.h"
+#include "prprf.h"
+
+// NB: Read DataStorage.h first.
+
+// The default time between data changing and a write, in milliseconds.
+static const uint32_t sDataStorageDefaultTimerDelay = 5u * 60u * 1000u;
+// The maximum score an entry can have (prevents overflow)
+static const uint32_t sMaxScore = UINT32_MAX;
+// The maximum number of entries per type of data (limits resource use)
+static const uint32_t sMaxDataEntries = 1024;
+static const int64_t sOneDayInMicroseconds = int64_t(24 * 60 * 60) *
+                                             PR_USEC_PER_SEC;
+
+namespace mozilla {
+
+NS_IMPL_ISUPPORTS(DataStorage,
+                  nsIObserver)
+
+DataStorage::DataStorage(const nsString& aFilename)
+  : mMutex("DataStorage::mMutex")
+  , mPendingWrite(false)
+  , mShuttingDown(false)
+  , mReadyMonitor("DataStorage::mReadyMonitor")
+  , mReady(false)
+  , mFilename(aFilename)
+{
+}
+
+DataStorage::~DataStorage()
+{
+}
+
+nsresult
+DataStorage::Init(bool& aDataWillPersist)
+{
+  // Don't access the observer service or preferences off the main thread.
+  if (!NS_IsMainThread()) {
+    NS_NOTREACHED("DataStorage::Init called off main thread");
+    return NS_ERROR_NOT_SAME_THREAD;
+  }
+
+  MutexAutoLock lock(mMutex);
+
+  nsresult rv;
+  rv = NS_NewThread(getter_AddRefs(mWorkerThread));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  rv = AsyncReadData(aDataWillPersist, lock);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  nsCOMPtr<nsIObserverService> os = services::GetObserverService();
+  if (NS_WARN_IF(!os)) {
+    return NS_ERROR_FAILURE;
+  }
+  // Clear private data as appropriate.
+  os->AddObserver(this, "last-pb-context-exited", false);
+  // Observe shutdown; save data and prevent any further writes.
+  os->AddObserver(this, "profile-before-change", false);
+
+  // For test purposes, we can set the write timer to be very fast.
+  mTimerDelay = Preferences::GetInt("test.datastorage.write_timer_ms",
+                                    sDataStorageDefaultTimerDelay);
+  rv = Preferences::AddStrongObserver(this, "test.datastorage.write_timer_ms");
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  return NS_OK;
+}
+
+class DataStorage::Reader : public nsRunnable
+{
+public:
+  explicit Reader(DataStorage* aDataStorage)
+    : mDataStorage(aDataStorage)
+  {
+  }
+  ~Reader();
+
+private:
+  NS_DECL_NSIRUNNABLE
+
+  static nsresult ParseLine(nsDependentCSubstring& aLine, nsCString& aKeyOut,
+                            Entry& aEntryOut);
+
+  nsRefPtr<DataStorage> mDataStorage;
+};
+
+DataStorage::Reader::~Reader()
+{
+  // Notify that calls to Get can proceed.
+  {
+    MonitorAutoLock readyLock(mDataStorage->mReadyMonitor);
+    mDataStorage->mReady = true;
+    nsresult rv = mDataStorage->mReadyMonitor.NotifyAll();
+    unused << NS_WARN_IF(NS_FAILED(rv));
+  }
+
+  // This is for tests.
+  nsCOMPtr<nsIRunnable> job =
+    NS_NewRunnableMethodWithArg<const char*>(mDataStorage,
+                                             &DataStorage::NotifyObservers,
+                                             "data-storage-ready");
+  nsresult rv = NS_DispatchToMainThread(job, NS_DISPATCH_NORMAL);
+  unused << NS_WARN_IF(NS_FAILED(rv));
+}
+
+NS_IMETHODIMP
+DataStorage::Reader::Run()
+{
+  nsresult rv;
+  // Concurrent operations on nsIFile objects are not guaranteed to be safe,
+  // so we clone the file while holding the lock and then release the lock.
+  // At that point, we can safely operate on the clone.
+  nsCOMPtr<nsIFile> file;
+  {
+    MutexAutoLock lock(mDataStorage->mMutex);
+    // If we don't have a profile, bail.
+    if (!mDataStorage->mBackingFile) {
+      return NS_OK;
+    }
+    rv = mDataStorage->mBackingFile->Clone(getter_AddRefs(file));
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+  }
+  nsCOMPtr<nsIInputStream> fileInputStream;
+  rv = NS_NewLocalFileInputStream(getter_AddRefs(fileInputStream), file);
+  // If we failed for some reason other than the file doesn't exist, bail.
+  if (NS_WARN_IF(NS_FAILED(rv) &&
+                 rv != NS_ERROR_FILE_TARGET_DOES_NOT_EXIST &&  // on Unix
+                 rv != NS_ERROR_FILE_NOT_FOUND)) {             // on Windows
+    return rv;
+  }
+
+  // If there is a file with data in it, read it. If there isn't,
+  // we'll essentially fall through to notifying that we're good to go.
+  nsCString data;
+  if (fileInputStream) {
+    // Limit to 2MB of data, but only store sMaxDataEntries entries.
+    rv = NS_ConsumeStream(fileInputStream, 1u << 21, data);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+  }
+
+  // Atomically parse the data and insert the entries read.
+  // Don't clear existing entries - they may have been inserted between when
+  // this read was kicked-off and when it was run.
+  {
+    MutexAutoLock lock(mDataStorage->mMutex);
+    // The backing file consists of a list of
+    //   <key>\t<score>\t<last accessed time>\t<value>\n
+    // The final \n is not optional; if it is not present the line is assumed
+    // to be corrupt.
+    int32_t currentIndex = 0;
+    int32_t newlineIndex = 0;
+    do {
+      newlineIndex = data.FindChar('\n', currentIndex);
+      // If there are no more newlines or the data table has too many
+      // entries, we are done.
+      if (newlineIndex < 0 ||
+          mDataStorage->mPersistentDataTable.Count() >= sMaxDataEntries) {
+        break;
+      }
+
+      nsDependentCSubstring line(data, currentIndex,
+                                 newlineIndex - currentIndex);
+      currentIndex = newlineIndex + 1;
+      nsCString key;
+      Entry entry;
+      nsresult parseRV = ParseLine(line, key, entry);
+      if (NS_SUCCEEDED(parseRV)) {
+        // It could be the case that a newer entry was added before
+        // we got around to reading the file. Don't overwrite new entries.
+        Entry newerEntry;
+        bool present = mDataStorage->mPersistentDataTable.Get(key, &newerEntry);
+        if (!present) {
+          mDataStorage->mPersistentDataTable.Put(key, entry);
+        }
+      }
+    } while (true);
+  }
+
+  return NS_OK;
+}
+
+// The key must be a non-empty string containing no instances of '\t' or '\n',
+// and must have a length no more than 256.
+// The value must not contain '\n' and must have a length no more than 1024.
+// The length limits are to prevent unbounded memory and disk usage.
+/* static */
+nsresult
+DataStorage::ValidateKeyAndValue(const nsCString& aKey, const nsCString& aValue)
+{
+  if (aKey.IsEmpty()) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  if (aKey.Length() > 256) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  int32_t delimiterIndex = aKey.FindChar('\t', 0);
+  if (delimiterIndex >= 0) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  delimiterIndex = aKey.FindChar('\n', 0);
+  if (delimiterIndex >= 0) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  delimiterIndex = aValue.FindChar('\n', 0);
+  if (delimiterIndex >= 0) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  if (aValue.Length() > 1024) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  return NS_OK;
+}
+
+// Each line is: <key>\t<score>\t<last accessed time>\t<value>
+// Where <score> is a uint32_t as a string, <last accessed time> is a
+// int32_t as a string, and the rest are strings.
+// <value> can contain anything but a newline.
+// Returns a successful status if the line can be decoded into a key and entry.
+// Otherwise, an error status is returned and the values assigned to the
+// output parameters are in an undefined state.
+/* static */
+nsresult
+DataStorage::Reader::ParseLine(nsDependentCSubstring& aLine, nsCString& aKeyOut,
+                               Entry& aEntryOut)
+{
+  // First find the indices to each part of the line.
+  int32_t scoreIndex;
+  scoreIndex = aLine.FindChar('\t', 0) + 1;
+  if (scoreIndex <= 0) {
+    return NS_ERROR_UNEXPECTED;
+  }
+  int32_t accessedIndex = aLine.FindChar('\t', scoreIndex) + 1;
+  if (accessedIndex <= 0) {
+    return NS_ERROR_UNEXPECTED;
+  }
+  int32_t valueIndex = aLine.FindChar('\t', accessedIndex) + 1;
+  if (valueIndex <= 0) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  // Now make substrings based on where each part is.
+  nsDependentCSubstring keyPart(aLine, 0, scoreIndex - 1);
+  nsDependentCSubstring scorePart(aLine, scoreIndex,
+                                  accessedIndex - scoreIndex - 1);
+  nsDependentCSubstring accessedPart(aLine, accessedIndex,
+                                     valueIndex - accessedIndex - 1);
+  nsDependentCSubstring valuePart(aLine, valueIndex);
+
+  nsresult rv;
+  rv = DataStorage::ValidateKeyAndValue(nsCString(keyPart),
+                                        nsCString(valuePart));
+  if (NS_FAILED(rv)) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  // Now attempt to decode the score part as a uint32_t.
+  // XXX nsDependentCSubstring doesn't support ToInteger
+  int32_t integer = nsCString(scorePart).ToInteger(&rv);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+  if (integer < 0) {
+    return NS_ERROR_UNEXPECTED;
+  }
+  aEntryOut.mScore = (uint32_t)integer;
+
+  integer = nsCString(accessedPart).ToInteger(&rv);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  if (integer < 0) {
+    return NS_ERROR_UNEXPECTED;
+  }
+  aEntryOut.mLastAccessed = integer;
+
+  // Now set the key and value.
+  aKeyOut.Assign(keyPart);
+  aEntryOut.mValue.Assign(valuePart);
+
+  return NS_OK;
+}
+
+nsresult
+DataStorage::AsyncReadData(bool& aHaveProfileDir,
+                           const MutexAutoLock& /*aProofOfLock*/)
+{
+  aHaveProfileDir = false;
+  // Allocate a Reader so that even if it isn't dispatched,
+  // the data-storage-ready notification will be fired and Get
+  // will be able to proceed (this happens in its destructor).
+  nsRefPtr<Reader> job(new Reader(this));
+  nsresult rv;
+  // If we don't have a profile directory, this will fail.
+  // That's okay - it just means there is no persistent state.
+  rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
+                              getter_AddRefs(mBackingFile));
+  if (NS_FAILED(rv)) {
+    mBackingFile = nullptr;
+    return NS_OK;
+  }
+
+  rv = mBackingFile->Append(mFilename);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  rv = mWorkerThread->Dispatch(job, NS_DISPATCH_NORMAL);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  aHaveProfileDir = true;
+  return NS_OK;
+}
+
+void
+DataStorage::WaitForReady()
+{
+  MonitorAutoLock readyLock(mReadyMonitor);
+  while (!mReady) {
+    nsresult rv = readyLock.Wait();
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      break;
+    }
+  }
+  MOZ_ASSERT(mReady);
+}
+
+nsCString
+DataStorage::Get(const nsCString& aKey, DataStorageType aType)
+{
+  WaitForReady();
+  MutexAutoLock lock(mMutex);
+
+  Entry entry;
+  bool foundValue = GetInternal(aKey, &entry, aType, lock);
+  if (!foundValue) {
+    return EmptyCString();
+  }
+
+  // If we're here, we found a value. Maybe update its score.
+  if (entry.UpdateScore()) {
+    PutInternal(aKey, entry, aType, lock);
+  }
+
+  return entry.mValue;
+}
+
+bool
+DataStorage::GetInternal(const nsCString& aKey, Entry* aEntry,
+                         DataStorageType aType,
+                         const MutexAutoLock& aProofOfLock)
+{
+  DataStorageTable& table = GetTableForType(aType, aProofOfLock);
+  bool foundValue = table.Get(aKey, aEntry);
+  return foundValue;
+}
+
+DataStorage::DataStorageTable&
+DataStorage::GetTableForType(DataStorageType aType,
+                             const MutexAutoLock& /*aProofOfLock*/)
+{
+  switch (aType) {
+    case DataStorage_Persistent:
+      return mPersistentDataTable;
+    case DataStorage_Temporary:
+      return mTemporaryDataTable;
+    case DataStorage_Private:
+      return mPrivateDataTable;
+  }
+
+  MOZ_CRASH("given bad DataStorage storage type");
+}
+
+// NB: The lock must be held when calling this function.
+/* static */
+PLDHashOperator
+DataStorage::EvictCallback(const nsACString& aKey, Entry aEntry, void* aArg)
+{
+  KeyAndEntry* toEvict = (KeyAndEntry*)aArg;
+  if (aEntry.mScore < toEvict->mEntry.mScore) {
+    toEvict->mKey = aKey;
+    toEvict->mEntry = aEntry;
+  }
+  return PLDHashOperator::PL_DHASH_NEXT;
+}
+
+// Limit the number of entries per table. This is to prevent unbounded
+// resource use. The eviction strategy is as follows:
+// - An entry's score is incremented once for every day it is accessed.
+// - Evict an entry with score no more than any other entry in the table
+//   (this is the same as saying evict the entry with the lowest score,
+//    except for when there are multiple entries with the lowest score,
+//    in which case one of them is evicted - which one is not specified).
+void
+DataStorage::MaybeEvictOneEntry(DataStorageType aType,
+                                const MutexAutoLock& aProofOfLock)
+{
+  DataStorageTable& table = GetTableForType(aType, aProofOfLock);
+  if (table.Count() >= sMaxDataEntries) {
+    KeyAndEntry toEvict;
+    // If all entries have score sMaxScore, this won't actually remove
+    // anything. This will never happen, however, because having that high
+    // a score either means someone tampered with the backing file or every
+    // entry has been accessed once a day for ~4 billion days.
+    // The worst that will happen is there will be 1025 entries in the
+    // persistent data table, with the 1025th entry being replaced every time
+    // data with a new key is inserted into the table. This is bad but
+    // ultimately not that concerning, considering that if an attacker can
+    // modify data in the profile, they can cause much worse harm.
+    toEvict.mEntry.mScore = sMaxScore;
+    table.EnumerateRead(EvictCallback, (void*)&toEvict);
+    table.Remove(toEvict.mKey);
+  }
+}
+
+nsresult
+DataStorage::Put(const nsCString& aKey, const nsCString& aValue,
+                 DataStorageType aType)
+{
+  WaitForReady();
+  MutexAutoLock lock(mMutex);
+
+  nsresult rv;
+  rv = ValidateKeyAndValue(aKey, aValue);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  Entry entry;
+  bool exists = GetInternal(aKey, &entry, aType, lock);
+  if (exists) {
+    entry.UpdateScore();
+  } else {
+    MaybeEvictOneEntry(aType, lock);
+  }
+  entry.mValue = aValue;
+  rv = PutInternal(aKey, entry, aType, lock);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+DataStorage::PutInternal(const nsCString& aKey, Entry& aEntry,
+                         DataStorageType aType,
+                         const MutexAutoLock& aProofOfLock)
+{
+  DataStorageTable& table = GetTableForType(aType, aProofOfLock);
+  table.Put(aKey, aEntry);
+
+  if (aType == DataStorage_Persistent && !mPendingWrite) {
+    return AsyncSetTimer(aProofOfLock);
+  }
+
+  return NS_OK;
+}
+
+void
+DataStorage::Remove(const nsCString& aKey, DataStorageType aType)
+{
+  WaitForReady();
+  MutexAutoLock lock(mMutex);
+
+  DataStorageTable& table = GetTableForType(aType, lock);
+  table.Remove(aKey);
+
+  if (aType == DataStorage_Persistent && !mPendingWrite) {
+    unused << AsyncSetTimer(lock);
+  }
+}
+
+class DataStorage::Writer : public nsRunnable
+{
+public:
+  Writer(nsCString& aData, DataStorage* aDataStorage)
+    : mData(aData)
+    , mDataStorage(aDataStorage)
+  {
+  }
+
+private:
+  NS_DECL_NSIRUNNABLE
+
+  nsCString mData;
+  nsRefPtr<DataStorage> mDataStorage;
+};
+
+NS_IMETHODIMP
+DataStorage::Writer::Run()
+{
+  nsresult rv;
+  // Concurrent operations on nsIFile objects are not guaranteed to be safe,
+  // so we clone the file while holding the lock and then release the lock.
+  // At that point, we can safely operate on the clone.
+  nsCOMPtr<nsIFile> file;
+  {
+    MutexAutoLock lock(mDataStorage->mMutex);
+    // If we don't have a profile, bail.
+    if (!mDataStorage->mBackingFile) {
+      return NS_OK;
+    }
+    rv = mDataStorage->mBackingFile->Clone(getter_AddRefs(file));
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+  }
+
+  nsCOMPtr<nsIOutputStream> outputStream;
+  rv = NS_NewLocalFileOutputStream(getter_AddRefs(outputStream), file,
+                                   PR_CREATE_FILE | PR_TRUNCATE | PR_WRONLY);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  const char* ptr = mData.get();
+  int32_t remaining = mData.Length();
+  uint32_t written = 0;
+  while (remaining > 0) {
+    rv = outputStream->Write(ptr, remaining, &written);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+    remaining -= written;
+    ptr += written;
+  }
+
+  // Observed by tests.
+  nsCOMPtr<nsIRunnable> job =
+    NS_NewRunnableMethodWithArg<const char*>(mDataStorage,
+                                             &DataStorage::NotifyObservers,
+                                             "data-storage-written");
+  rv = NS_DispatchToMainThread(job, NS_DISPATCH_NORMAL);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  return NS_OK;
+}
+
+// NB: The lock must be held when calling this function.
+/* static */
+PLDHashOperator
+DataStorage::WriteDataCallback(const nsACString& aKey, Entry aEntry, void* aArg)
+{
+  nsCString* output = (nsCString*)aArg;
+  output->Append(aKey);
+  output->Append('\t');
+  output->AppendInt(aEntry.mScore);
+  output->Append('\t');
+  output->AppendInt(aEntry.mLastAccessed);
+  output->Append('\t');
+  output->Append(aEntry.mValue);
+  output->Append('\n');
+  return PLDHashOperator::PL_DHASH_NEXT;
+}
+
+nsresult
+DataStorage::AsyncWriteData(const MutexAutoLock& /*aProofOfLock*/)
+{
+  if (mShuttingDown || !mBackingFile) {
+    return NS_OK;
+  }
+
+  nsCString output;
+  mPersistentDataTable.EnumerateRead(WriteDataCallback, (void*)&output);
+
+  nsRefPtr<Writer> job(new Writer(output, this));
+  nsresult rv = mWorkerThread->Dispatch(job, NS_DISPATCH_NORMAL);
+  mPendingWrite = false;
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  return NS_OK;
+}
+
+nsresult
+DataStorage::Clear()
+{
+  WaitForReady();
+  MutexAutoLock lock(mMutex);
+  mPersistentDataTable.Clear();
+  mTemporaryDataTable.Clear();
+  mPrivateDataTable.Clear();
+
+  // Asynchronously clear the file. This is similar to the permission manager
+  // in that it doesn't wait to synchronously remove the data from its backing
+  // storage either.
+  nsresult rv = AsyncWriteData(lock);
+  if (NS_FAILED(rv)) {
+    return rv;
+  }
+  return NS_OK;
+}
+
+/* static */
+void
+DataStorage::TimerCallback(nsITimer* aTimer, void* aClosure)
+{
+  nsRefPtr<DataStorage> aDataStorage = (DataStorage*)aClosure;
+  MutexAutoLock lock(aDataStorage->mMutex);
+  unused << aDataStorage->AsyncWriteData(lock);
+}
+
+// We only initialize the timer on the worker thread because it's not safe
+// to mix what threads are operating on the timer.
+nsresult
+DataStorage::AsyncSetTimer(const MutexAutoLock& /*aProofOfLock*/)
+{
+  if (mShuttingDown) {
+    return NS_OK;
+  }
+
+  mPendingWrite = true;
+  nsCOMPtr<nsIRunnable> job =
+    NS_NewRunnableMethod(this, &DataStorage::SetTimer);
+  nsresult rv = mWorkerThread->Dispatch(job, NS_DISPATCH_NORMAL);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+  return NS_OK;
+}
+
+void
+DataStorage::SetTimer()
+{
+  MOZ_ASSERT(!NS_IsMainThread());
+  MutexAutoLock lock(mMutex);
+
+  nsresult rv;
+  if (!mTimer) {
+    mTimer = do_CreateInstance("@mozilla.org/timer;1", &rv);
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return;
+    }
+  }
+
+  rv = mTimer->InitWithFuncCallback(TimerCallback, this,
+                                    mTimerDelay, nsITimer::TYPE_ONE_SHOT);
+  unused << NS_WARN_IF(NS_FAILED(rv));
+}
+
+void
+DataStorage::NotifyObservers(const char* aTopic)
+{
+  // Don't access the observer service off the main thread.
+  if (!NS_IsMainThread()) {
+    NS_NOTREACHED("DataStorage::NotifyObservers called off main thread");
+    return;
+  }
+
+  nsCOMPtr<nsIObserverService> os = services::GetObserverService();
+  if (os) {
+    os->NotifyObservers(nullptr, aTopic, mFilename.get());
+  }
+}
+
+nsresult
+DataStorage::DispatchShutdownTimer(const MutexAutoLock& /*aProofOfLock*/)
+{
+  nsCOMPtr<nsIRunnable> job =
+    NS_NewRunnableMethod(this, &DataStorage::ShutdownTimer);
+  nsresult rv = mWorkerThread->Dispatch(job, NS_DISPATCH_NORMAL);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+  return NS_OK;
+}
+
+void
+DataStorage::ShutdownTimer()
+{
+  MOZ_ASSERT(!NS_IsMainThread());
+  MutexAutoLock lock(mMutex);
+  nsresult rv = mTimer->Cancel();
+  unused << NS_WARN_IF(NS_FAILED(rv));
+  mTimer = nullptr;
+}
+
+//------------------------------------------------------------
+// DataStorage::nsIObserver
+//------------------------------------------------------------
+
+NS_IMETHODIMP
+DataStorage::Observe(nsISupports* aSubject, const char* aTopic,
+                     const char16_t* aData)
+{
+  // Don't access preferences off the main thread.
+  if (!NS_IsMainThread()) {
+    NS_NOTREACHED("DataStorage::Observe called off main thread");
+    return NS_ERROR_NOT_SAME_THREAD;
+  }
+
+  nsresult rv;
+  if (strcmp(aTopic, "last-pb-context-exited") == 0) {
+    MutexAutoLock lock(mMutex);
+    mPrivateDataTable.Clear();
+  } else if (strcmp(aTopic, "profile-before-change") == 0) {
+    {
+      MutexAutoLock lock(mMutex);
+      rv = AsyncWriteData(lock);
+      mShuttingDown = true;
+      unused << NS_WARN_IF(NS_FAILED(rv));
+      if (mTimer) {
+        rv = DispatchShutdownTimer(lock);
+        unused << NS_WARN_IF(NS_FAILED(rv));
+      }
+    }
+    // Run the thread to completion and prevent any further events
+    // being scheduled to it. The thread may need the lock, so we can't
+    // hold it here.
+    rv = mWorkerThread->Shutdown();
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+  } else if (strcmp(aTopic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID) == 0) {
+    MutexAutoLock lock(mMutex);
+    mTimerDelay = Preferences::GetInt("test.datastorage.write_timer_ms",
+                                      sDataStorageDefaultTimerDelay);
+  }
+
+  return NS_OK;
+}
+
+DataStorage::Entry::Entry()
+  : mScore(0)
+  , mLastAccessed((int32_t)(PR_Now() / sOneDayInMicroseconds))
+{
+}
+
+// Updates this entry's score. Returns true if the score has actually changed.
+// If it's been less than a day since this entry has been accessed, the score
+// does not change. Otherwise, the score increases by 1.
+// The default score is 0. The maximum score is the maximum value that can
+// be represented by an unsigned 32 bit integer.
+// This is to handle evictions from our tables, which in turn is to prevent
+// unbounded resource use.
+bool
+DataStorage::Entry::UpdateScore()
+{
+
+  int32_t nowInDays = (int32_t)(PR_Now() / sOneDayInMicroseconds);
+  int32_t daysSinceAccessed = (nowInDays - mLastAccessed);
+
+  // Update the last accessed time.
+  mLastAccessed = nowInDays;
+
+  // If it's been less than a day since we've been accessed,
+  // the score isn't updated.
+  if (daysSinceAccessed < 1) {
+    return false;
+  }
+
+  // Otherwise, increment the score (but don't overflow).
+  if (mScore < sMaxScore) {
+    mScore++;
+  }
+  return true;
+}
+
+} // namespace mozilla
diff --git a/security/manager/boot/src/DataStorage.h b/security/manager/boot/src/DataStorage.h
new file mode 100644
index 00000000000..11dea8c8824
--- /dev/null
+++ b/security/manager/boot/src/DataStorage.h
@@ -0,0 +1,185 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_DataStorage_h
+#define mozilla_DataStorage_h
+
+#include "mozilla/Monitor.h"
+#include "mozilla/Mutex.h"
+#include "nsCOMPtr.h"
+#include "nsDataHashtable.h"
+#include "nsIObserver.h"
+#include "nsIThread.h"
+#include "nsITimer.h"
+#include "nsString.h"
+
+namespace mozilla {
+
+/**
+ * DataStorage is a threadsafe, generic, narrow string-based hash map that
+ * persists data on disk and additionally handles temporary and private data.
+ * However, if used in a context where there is no profile directory, data
+ * will not be persisted.
+ *
+ * Its lifecycle is as follows:
+ * - Allocate with a filename (this is or will eventually be a file in the
+ *   profile directory, if the profile exists).
+ * - Call Init() from the main thread. This spins off an asynchronous read
+ *   of the backing file.
+ * - Eventually observers of the topic "data-storage-ready" will be notified
+ *   with the backing filename as the data in the notification when this
+ *   has completed.
+ * - Should the profile directory not be available, (e.g. in xpcshell),
+ *   DataStorage will not initially read any persistent data. The
+ *   "data-storage-ready" event will still be emitted. This follows semantics
+ *   similar to the permission manager and allows tests that test
+ *   unrelated components to proceed without a profile.
+ * - When any persistent data changes, a timer is initialized that will
+ *   eventually asynchronously write all persistent data to the backing file.
+ *   When this happens, observers will be notified with the topic
+ *   "data-storage-written" and the backing filename as the data.
+ *   It is possible to receive a "data-storage-written" event while there exist
+ *   pending persistent data changes. However, those changes will cause the
+ *   timer to be reinitialized and another "data-storage-written" event will
+ *   be sent.
+ * - When DataStorage observes the topic "profile-before-change" in
+ *   anticipation of shutdown, all persistent data is synchronously written to
+ *   the backing file. The worker thread responsible for these writes is then
+ *   disabled to prevent further writes to that file (the delayed-write timer
+ *   is cancelled when this happens).
+ * - For testing purposes, the preference "test.datastorage.write_timer_ms" can
+ *   be set to cause the asynchronous writing of data to happen more quickly.
+ * - To prevent unbounded memory and disk use, the number of entries in each
+ *   table is limited to 1024. Evictions are handled in by a modified LRU scheme
+ *   (see implementation comments).
+ * - NB: Instances of DataStorage have long lifetimes because they are strong
+ *   observers of events and won't go away until the observer service does.
+ *
+ * For each key/value:
+ * - The key must be a non-empty string containing no instances of '\t' or '\n'
+ *   (this is a limitation of how the data is stored and will be addressed in
+ *   the future).
+ * - The key must have a length no more than 256.
+ * - The value must not contain '\n' and must have a length no more than 1024.
+ *   (the length limits are to prevent unbounded disk and memory usage)
+ */
+
+/**
+ * Data that is DataStorage_Persistent is saved on disk. DataStorage_Temporary
+ * and DataStorage_Private are not saved. DataStorage_Private is meant to
+ * only be set and accessed from private contexts. It will be cleared upon
+ * observing the event "last-pb-context-exited".
+ */
+enum DataStorageType {
+  DataStorage_Persistent,
+  DataStorage_Temporary,
+  DataStorage_Private
+};
+
+class DataStorage : public nsIObserver
+{
+public:
+  NS_DECL_THREADSAFE_ISUPPORTS
+  NS_DECL_NSIOBSERVER
+
+  // If there is a profile directory, there is or will eventually be a file
+  // by the name specified by aFilename there.
+  explicit DataStorage(const nsString& aFilename);
+
+  // Initializes the DataStorage. Must be called before using.
+  // aDataWillPersist returns whether or not data can be persistently saved.
+  nsresult Init(/*out*/bool& aDataWillPersist);
+  // Given a key and a type of data, returns a value. Returns an empty string if
+  // the key is not present for that type of data. If Get is called before the
+  // "data-storage-ready" event is observed, it will block. NB: It is not
+  // currently possible to differentiate between missing data and data that is
+  // the empty string.
+  nsCString Get(const nsCString& aKey, DataStorageType aType);
+  // Give a key, value, and type of data, adds an entry as appropriate.
+  // Updates existing entries.
+  nsresult Put(const nsCString& aKey, const nsCString& aValue,
+               DataStorageType aType);
+  // Given a key and type of data, removes an entry if present.
+  void Remove(const nsCString& aKey, DataStorageType aType);
+  // Removes all entries of all types of data.
+  nsresult Clear();
+
+private:
+  virtual ~DataStorage();
+
+  class Writer;
+  class Reader;
+
+  class Entry
+  {
+  public:
+    Entry();
+    bool UpdateScore();
+
+    uint32_t mScore;
+    int32_t mLastAccessed; // the last accessed time in days since the epoch
+    nsCString mValue;
+  };
+
+  // Utility class for scanning tables for an entry to evict.
+  class KeyAndEntry
+  {
+  public:
+    nsCString mKey;
+    Entry mEntry;
+  };
+
+  typedef nsDataHashtable<nsCStringHashKey, Entry> DataStorageTable;
+
+  void WaitForReady();
+  nsresult AsyncWriteData(const MutexAutoLock& aProofOfLock);
+  nsresult AsyncReadData(bool& aHaveProfileDir,
+                         const MutexAutoLock& aProofOfLock);
+  nsresult AsyncSetTimer(const MutexAutoLock& aProofOfLock);
+  nsresult DispatchShutdownTimer(const MutexAutoLock& aProofOfLock);
+
+  static nsresult ValidateKeyAndValue(const nsCString& aKey,
+                                      const nsCString& aValue);
+  static void TimerCallback(nsITimer* aTimer, void* aClosure);
+  static PLDHashOperator WriteDataCallback(const nsACString& aKey, Entry aEntry,
+                                           void* aArg);
+  static PLDHashOperator EvictCallback(const nsACString& aKey, Entry aEntry,
+                                       void* aArg);
+  void SetTimer();
+  void ShutdownTimer();
+  void NotifyObservers(const char* aTopic);
+
+  bool GetInternal(const nsCString& aKey, Entry* aEntry, DataStorageType aType,
+                   const MutexAutoLock& aProofOfLock);
+  nsresult PutInternal(const nsCString& aKey, Entry& aEntry,
+                       DataStorageType aType,
+                       const MutexAutoLock& aProofOfLock);
+  void MaybeEvictOneEntry(DataStorageType aType,
+                          const MutexAutoLock& aProofOfLock);
+  DataStorageTable& GetTableForType(DataStorageType aType,
+                                    const MutexAutoLock& aProofOfLock);
+
+  Mutex mMutex; // This mutex protects access to the following members:
+  DataStorageTable  mPersistentDataTable;
+  DataStorageTable  mTemporaryDataTable;
+  DataStorageTable  mPrivateDataTable;
+  nsCOMPtr<nsIThread> mWorkerThread;
+  nsCOMPtr<nsIFile> mBackingFile;
+  nsCOMPtr<nsITimer> mTimer; // All uses after init must be on the worker thread
+  uint32_t mTimerDelay; // in milliseconds
+  bool mPendingWrite; // true if a write is needed but hasn't been dispatched
+  bool mShuttingDown;
+  // (End list of members protected by mMutex)
+
+  Monitor mReadyMonitor; // Do not acquire this at the same time as mMutex.
+  bool mReady; // Indicates that saved data has been read and Get can proceed.
+
+  const nsString mFilename;
+};
+
+}; // namespace mozilla
+
+#endif // mozilla_DataStorage_h
diff --git a/security/manager/boot/src/StaticHPKPins.h b/security/manager/boot/src/StaticHPKPins.h
index 07b6ed0c44f..658944dfd7d 100644
--- a/security/manager/boot/src/StaticHPKPins.h
+++ b/security/manager/boot/src/StaticHPKPins.h
@@ -79,6 +79,10 @@ static const char kCybertrust_Global_RootFingerprint[] =
 static const char kDigiCert_Assured_ID_Root_CAFingerprint[] =
   "I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o=";
 
+/* DigiCert ECC Secure Server CA */
+static const char kDigiCert_ECC_Secure_Server_CAFingerprint[] =
+  "PZXN3lRAy+8tBKk2Ox6F7jIlnzr2Yzmwqc3JnyfXoCw=";
+
 /* DigiCert Global Root CA */
 static const char kDigiCert_Global_Root_CAFingerprint[] =
   "r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=";
@@ -364,6 +368,7 @@ struct StaticPinset {
 
 /* PreloadedHPKPins.json pinsets */
 static const char* kPinset_facebook_sha256_Data[] = {
+  kDigiCert_ECC_Secure_Server_CAFingerprint,
   kVerisign_Class_3_Public_Primary_Certification_Authority___G3Fingerprint,
   kDigiCert_High_Assurance_EV_Root_CAFingerprint,
 };
@@ -486,17 +491,17 @@ static const StaticPinset kPinset_mozilla = {
   &kPinset_mozilla_sha256
 };
 
-static const char* kPinset_mozilla_fxa_sha256_Data[] = {
+static const char* kPinset_mozilla_services_sha256_Data[] = {
   kDigiCert_Global_Root_CAFingerprint,
 };
-static const StaticFingerprints kPinset_mozilla_fxa_sha256 = {
-  sizeof(kPinset_mozilla_fxa_sha256_Data) / sizeof(const char*),
-  kPinset_mozilla_fxa_sha256_Data
+static const StaticFingerprints kPinset_mozilla_services_sha256 = {
+  sizeof(kPinset_mozilla_services_sha256_Data) / sizeof(const char*),
+  kPinset_mozilla_services_sha256_Data
 };
 
-static const StaticPinset kPinset_mozilla_fxa = {
+static const StaticPinset kPinset_mozilla_services = {
   nullptr,
-  &kPinset_mozilla_fxa_sha256
+  &kPinset_mozilla_services_sha256
 };
 
 static const char* kPinset_mozilla_test_sha256_Data[] = {
@@ -751,13 +756,13 @@ struct TransportSecurityPreload {
 /* Sort hostnames for binary search. */
 static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
   { "2mdn.net", true, false, false, -1, &kPinset_google_root_pems },
-  { "accounts.firefox.com", true, false, false, 4, &kPinset_mozilla_fxa },
+  { "accounts.firefox.com", true, false, false, 4, &kPinset_mozilla_services },
   { "accounts.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "addons.mozilla.net", true, false, true, 2, &kPinset_mozilla },
   { "addons.mozilla.org", true, false, true, 1, &kPinset_mozilla },
   { "admin.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "android.com", true, false, false, -1, &kPinset_google_root_pems },
-  { "api.accounts.firefox.com", true, false, false, 5, &kPinset_mozilla_fxa },
+  { "api.accounts.firefox.com", true, false, false, 5, &kPinset_mozilla_services },
   { "api.twitter.com", true, false, false, -1, &kPinset_twitterCDN },
   { "apis.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "appengine.google.com", true, false, false, -1, &kPinset_google_root_pems },
@@ -1043,6 +1048,7 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
   { "profiles.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "script.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "security.google.com", true, false, false, -1, &kPinset_google_root_pems },
+  { "services.mozilla.com", true, true, false, -1, &kPinset_mozilla_services },
   { "sites.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "spreadsheets.google.com", true, false, false, -1, &kPinset_google_root_pems },
   { "ssl.google-analytics.com", true, false, false, -1, &kPinset_google_root_pems },
@@ -1082,8 +1088,8 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
   { "ytimg.com", true, false, false, -1, &kPinset_google_root_pems },
 };
 
-// Pinning Preload List Length = 330;
+// Pinning Preload List Length = 331;
 
 static const int32_t kUnknownId = -1;
 
-static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1417860919825000);
+static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1418659817121000);
diff --git a/security/manager/boot/src/moz.build b/security/manager/boot/src/moz.build
index 50a345b5666..6120eed6383 100644
--- a/security/manager/boot/src/moz.build
+++ b/security/manager/boot/src/moz.build
@@ -4,7 +4,12 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+EXPORTS.mozilla += [
+    'DataStorage.h',
+]
+
 UNIFIED_SOURCES += [
+    'DataStorage.cpp',
     'nsBOOTModule.cpp',
     'nsEntropyCollector.cpp',
     'nsSecurityHeaderParser.cpp',
diff --git a/security/manager/boot/src/nsSTSPreloadList.errors b/security/manager/boot/src/nsSTSPreloadList.errors
index 63ca8f0d688..51b226356e0 100644
--- a/security/manager/boot/src/nsSTSPreloadList.errors
+++ b/security/manager/boot/src/nsSTSPreloadList.errors
@@ -46,6 +46,7 @@ email.lookout.com: could not connect to host
 encrypted.google.com: did not receive HSTS header (error ignored - included regardless)
 epoxate.com: did not receive HSTS header
 espra.com: could not connect to host
+f-droid.org: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-periodicupdate-00000/getHSTSPreloadList.js :: processStsHeader :: line 124"  data: no]
 fatzebra.com.au: did not receive HSTS header
 gamesdepartment.co.uk: did not receive HSTS header
 get.zenpayroll.com: did not receive HSTS header
@@ -73,11 +74,11 @@ jitsi.org: did not receive HSTS header
 jottit.com: could not connect to host
 keymaster.lookout.com: did not receive HSTS header
 kiwiirc.com: max-age too low: 5256000
+klaxn.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-periodicupdate-00000/getHSTSPreloadList.js :: processStsHeader :: line 124"  data: no]
 ledgerscope.net: did not receive HSTS header
 liberty.lavabit.com: could not connect to host
 lifeguard.aecom.com: did not receive HSTS header
 lists.mayfirst.org: did not receive HSTS header
-loenshotel.de: could not connect to host
 login.corp.google.com: max-age too low: 7776000 (error ignored - included regardless)
 logotype.se: did not receive HSTS header
 ludwig.im: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-periodicupdate-00000/getHSTSPreloadList.js :: processStsHeader :: line 124"  data: no]
@@ -110,6 +111,7 @@ profiles.google.com: did not receive HSTS header (error ignored - included regar
 promecon-gmbh.de: did not receive HSTS header
 rapidresearch.me: could not connect to host
 riseup.net: did not receive HSTS header
+roddis.net: could not connect to host
 sah3.net: could not connect to host
 saturngames.co.uk: did not receive HSTS header
 script.google.com: did not receive HSTS header (error ignored - included regardless)
@@ -148,7 +150,6 @@ www.gmail.com: did not receive HSTS header (error ignored - included regardless)
 www.googlemail.com: did not receive HSTS header (error ignored - included regardless)
 www.greplin.com: did not receive HSTS header
 www.jitsi.org: did not receive HSTS header
-www.lastpass.com: did not receive HSTS header
 www.ledgerscope.net: did not receive HSTS header
 www.logentries.com: did not receive HSTS header
 www.moneybookers.com: did not receive HSTS header
@@ -156,7 +157,7 @@ www.neonisi.com: could not connect to host
 www.paycheckrecords.com: max-age too low: 86400
 www.paypal.com: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsISiteSecurityService.processHeader]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: /builds/slave/m-cen-l64-periodicupdate-00000/getHSTSPreloadList.js :: processStsHeader :: line 124"  data: no]
 www.rme.li: did not receive HSTS header
-www.roddis.net: did not receive HSTS header
+www.roddis.net: could not connect to host
 www.sandbox.mydigipass.com: could not connect to host
 www.surfeasy.com: did not receive HSTS header
 zoo24.de: max-age too low: 2592000
diff --git a/security/manager/boot/src/nsSTSPreloadList.inc b/security/manager/boot/src/nsSTSPreloadList.inc
index 0a5a4f4152e..2e2ad6b5150 100644
--- a/security/manager/boot/src/nsSTSPreloadList.inc
+++ b/security/manager/boot/src/nsSTSPreloadList.inc
@@ -8,7 +8,7 @@
 /*****************************************************************************/
 
 #include <stdint.h>
-const PRTime gPreloadListExpirationTime = INT64_C(1420280117245000);
+const PRTime gPreloadListExpirationTime = INT64_C(1420884435199000);
 
 class nsSTSPreload
 {
@@ -152,7 +152,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "fairbill.com", true },
   { "faq.lookout.com", false },
   { "feedbin.com", false },
-  { "ferienhaus-polchow-ruegen.de", true },
+  { "ferienhaus-polchow-ruegen.de", false },
   { "fiken.no", true },
   { "firemail.io", true },
   { "fischer-its.com", true },
@@ -497,6 +497,7 @@ static const nsSTSPreload kSTSPreloadList[] = {
   { "www.heliosnet.com", true },
   { "www.intercom.io", false },
   { "www.irccloud.com", false },
+  { "www.lastpass.com", false },
   { "www.linode.com", false },
   { "www.lookout.com", false },
   { "www.makeyourlaws.org", true },
diff --git a/security/manager/boot/src/nsSiteSecurityService.cpp b/security/manager/boot/src/nsSiteSecurityService.cpp
index 30cc0de889b..5b7d20cbd94 100644
--- a/security/manager/boot/src/nsSiteSecurityService.cpp
+++ b/security/manager/boot/src/nsSiteSecurityService.cpp
@@ -2,40 +2,34 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "plstr.h"
-#include "prlog.h"
-#include "prprf.h"
-#include "prnetdb.h"
+#include "nsSiteSecurityService.h"
+
+#include "mozilla/LinkedList.h"
+#include "mozilla/Preferences.h"
 #include "nsCRTGlue.h"
-#include "nsIPermissionManager.h"
 #include "nsISSLStatus.h"
 #include "nsISSLStatusProvider.h"
-#include "nsSiteSecurityService.h"
+#include "nsISocketProvider.h"
 #include "nsIURI.h"
 #include "nsNetUtil.h"
-#include "nsThreadUtils.h"
-#include "nsString.h"
-#include "nsIScriptSecurityManager.h"
-#include "nsISocketProvider.h"
-#include "mozilla/Preferences.h"
-#include "mozilla/LinkedList.h"
 #include "nsSecurityHeaderParser.h"
+#include "nsString.h"
+#include "nsThreadUtils.h"
+#include "plstr.h"
+#include "prlog.h"
+#include "prnetdb.h"
+#include "prprf.h"
 #include "nsXULAppAPI.h"
 
 // A note about the preload list:
-// When a site specifically disables sts by sending a header with
+// When a site specifically disables HSTS by sending a header with
 // 'max-age: 0', we keep a "knockout" value that means "we have no information
-// regarding the sts state of this host" (any ancestor of "this host" can still
-// influence its sts status via include subdomains, however).
+// regarding the HSTS state of this host" (any ancestor of "this host" can still
+// influence its HSTS status via include subdomains, however).
 // This prevents the preload list from overriding the site's current
-// desired sts status. Knockout values are indicated by permission values of
-// STS_KNOCKOUT.
+// desired HSTS status.
 #include "nsSTSPreloadList.inc"
 
-#define STS_SET (nsIPermissionManager::ALLOW_ACTION)
-#define STS_UNSET (nsIPermissionManager::UNKNOWN_ACTION)
-#define STS_KNOCKOUT (nsIPermissionManager::DENY_ACTION)
-
 #if defined(PR_LOGGING)
 static PRLogModuleInfo *
 GetSSSLog()
@@ -51,29 +45,58 @@ GetSSSLog()
 
 ////////////////////////////////////////////////////////////////////////////////
 
-nsSSSHostEntry::nsSSSHostEntry(const char* aHost)
-  : mHost(aHost)
-  , mExpireTime(0)
-  , mStsPermission(STS_UNSET)
-  , mExpired(false)
-  , mIncludeSubdomains(false)
+SiteSecurityState::SiteSecurityState(nsCString& aStateString)
+  : mHSTSExpireTime(0)
+  , mHSTSState(SecurityPropertyUnset)
+  , mHSTSIncludeSubdomains(false)
+{
+  uint32_t hstsState = 0;
+  uint32_t hstsIncludeSubdomains = 0; // PR_sscanf doesn't handle bools.
+  int32_t matches = PR_sscanf(aStateString.get(), "%lld,%lu,%lu",
+                              &mHSTSExpireTime, &hstsState,
+                              &hstsIncludeSubdomains);
+  bool valid = (matches == 3 &&
+                (hstsIncludeSubdomains == 0 || hstsIncludeSubdomains == 1) &&
+                ((SecurityPropertyState)hstsState == SecurityPropertyUnset ||
+                 (SecurityPropertyState)hstsState == SecurityPropertySet ||
+                 (SecurityPropertyState)hstsState == SecurityPropertyKnockout));
+  if (valid) {
+    mHSTSState = (SecurityPropertyState)hstsState;
+    mHSTSIncludeSubdomains = (hstsIncludeSubdomains == 1);
+  } else {
+    SSSLOG(("%s is not a valid SiteSecurityState", aStateString.get()));
+    mHSTSExpireTime = 0;
+    mHSTSState = SecurityPropertyUnset;
+    mHSTSIncludeSubdomains = false;
+  }
+}
+
+SiteSecurityState::SiteSecurityState(PRTime aHSTSExpireTime,
+                                     SecurityPropertyState aHSTSState,
+                                     bool aHSTSIncludeSubdomains)
+
+  : mHSTSExpireTime(aHSTSExpireTime)
+  , mHSTSState(aHSTSState)
+  , mHSTSIncludeSubdomains(aHSTSIncludeSubdomains)
 {
 }
 
-nsSSSHostEntry::nsSSSHostEntry(const nsSSSHostEntry& toCopy)
-  : mHost(toCopy.mHost)
-  , mExpireTime(toCopy.mExpireTime)
-  , mStsPermission(toCopy.mStsPermission)
-  , mExpired(toCopy.mExpired)
-  , mIncludeSubdomains(toCopy.mIncludeSubdomains)
+void
+SiteSecurityState::ToString(nsCString& aString)
 {
+  aString.Truncate();
+  aString.AppendInt(mHSTSExpireTime);
+  aString.Append(',');
+  aString.AppendInt(mHSTSState);
+  aString.Append(',');
+  aString.AppendInt(static_cast<uint32_t>(mHSTSIncludeSubdomains));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 
-
 nsSiteSecurityService::nsSiteSecurityService()
   : mUsePreloadList(true)
+  , mPreloadListTimeOffset(0)
 {
 }
 
@@ -93,18 +116,35 @@ nsSiteSecurityService::Init()
      MOZ_CRASH("Child process: no direct access to nsSiteSecurityService");
    }
 
-   nsresult rv;
+  // Don't access Preferences off the main thread.
+  if (!NS_IsMainThread()) {
+    NS_NOTREACHED("nsSiteSecurityService initialized off main thread");
+    return NS_ERROR_NOT_SAME_THREAD;
+  }
 
-   mPermMgr = do_GetService(NS_PERMISSIONMANAGER_CONTRACTID, &rv);
-   NS_ENSURE_SUCCESS(rv, rv);
+  mUsePreloadList = mozilla::Preferences::GetBool(
+    "network.stricttransportsecurity.preloadlist", true);
+  mozilla::Preferences::AddStrongObserver(this,
+    "network.stricttransportsecurity.preloadlist");
+  mPreloadListTimeOffset = mozilla::Preferences::GetInt(
+    "test.currentTimeOffsetSeconds", 0);
+  mozilla::Preferences::AddStrongObserver(this,
+    "test.currentTimeOffsetSeconds");
+  mSiteStateStorage =
+    new mozilla::DataStorage(NS_LITERAL_STRING("SiteSecurityServiceState.txt"));
+  bool storageWillPersist = false;
+  nsresult rv = mSiteStateStorage->Init(storageWillPersist);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+  // This is not fatal. There are some cases where there won't be a
+  // profile directory (e.g. running xpcshell). There isn't the
+  // expectation that site information will be presisted in those cases.
+  if (!storageWillPersist) {
+    NS_WARNING("site security information will not be persisted");
+  }
 
-   mUsePreloadList = mozilla::Preferences::GetBool("network.stricttransportsecurity.preloadlist", true);
-   mozilla::Preferences::AddStrongObserver(this, "network.stricttransportsecurity.preloadlist");
-   mObserverService = mozilla::services::GetObserverService();
-   if (mObserverService)
-     mObserverService->AddObserver(this, "last-pb-context-exited", false);
-
-   return NS_OK;
+  return NS_OK;
 }
 
 nsresult
@@ -121,29 +161,6 @@ nsSiteSecurityService::GetHost(nsIURI *aURI, nsACString &aResult)
   return NS_OK;
 }
 
-nsresult
-nsSiteSecurityService::GetPrincipalForURI(nsIURI* aURI,
-                                          nsIPrincipal** aPrincipal)
-{
-  nsresult rv;
-  nsCOMPtr<nsIScriptSecurityManager> securityManager =
-     do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // We have to normalize the scheme of the URIs we're using, so just use https.
-  // HSTS information is shared across all ports for a given host.
-  nsAutoCString host;
-  rv = GetHost(aURI, host);
-  NS_ENSURE_SUCCESS(rv, rv);
-  nsCOMPtr<nsIURI> uri;
-  rv = NS_NewURI(getter_AddRefs(uri), NS_LITERAL_CSTRING("https://") + host);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  // We want all apps to share HSTS state, so this is one of the few places
-  // where we do not silo persistent state by extended origin.
-  return securityManager->GetNoAppCodebasePrincipal(uri, aPrincipal);
-}
-
 nsresult
 nsSiteSecurityService::SetState(uint32_t aType,
                                 nsIURI* aSourceURI,
@@ -152,7 +169,7 @@ nsSiteSecurityService::SetState(uint32_t aType,
                                 uint32_t flags)
 {
   // If max-age is zero, that's an indication to immediately remove the
-  // permissions, so here's a shortcut.
+  // security state, so here's a shortcut.
   if (!maxage) {
     return RemoveState(aType, aSourceURI, flags);
   }
@@ -162,46 +179,28 @@ nsSiteSecurityService::SetState(uint32_t aType,
   int64_t expiretime = (PR_Now() / PR_USEC_PER_MSEC) +
                        (maxage * PR_MSEC_PER_SEC);
 
+  SiteSecurityState siteState(expiretime, SecurityPropertySet,
+                              includeSubdomains);
+  nsAutoCString stateString;
+  siteState.ToString(stateString);
+  nsAutoCString hostname;
+  nsresult rv = GetHost(aSourceURI, hostname);
+  NS_ENSURE_SUCCESS(rv, rv);
+  SSSLOG(("SSS: setting state for %s", hostname.get()));
   bool isPrivate = flags & nsISocketProvider::NO_PERMANENT_STORAGE;
-
-  // record entry for this host with max-age in the permissions manager
-  SSSLOG(("SSS: maxage permission SET, adding permission\n"));
-  nsresult rv = AddPermission(aSourceURI,
-                              STS_PERMISSION,
-                              (uint32_t) STS_SET,
-                              (uint32_t) nsIPermissionManager::EXPIRE_TIME,
-                              expiretime,
-                              isPrivate);
+  mozilla::DataStorageType storageType = isPrivate
+                                         ? mozilla::DataStorage_Private
+                                         : mozilla::DataStorage_Persistent;
+  rv = mSiteStateStorage->Put(hostname, stateString, storageType);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (includeSubdomains) {
-    // record entry for this host with include subdomains in the permissions manager
-    SSSLOG(("SSS: subdomains permission SET, adding permission\n"));
-    rv = AddPermission(aSourceURI,
-                       STS_SUBDOMAIN_PERMISSION,
-                       (uint32_t) STS_SET,
-                       (uint32_t) nsIPermissionManager::EXPIRE_TIME,
-                       expiretime,
-                       isPrivate);
-    NS_ENSURE_SUCCESS(rv, rv);
-  } else { // !includeSubdomains
-    nsAutoCString hostname;
-    rv = GetHost(aSourceURI, hostname);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    SSSLOG(("SSS: subdomains permission UNSET, removing any existing ones\n"));
-    rv = RemovePermission(hostname, STS_SUBDOMAIN_PERMISSION, isPrivate);
-    NS_ENSURE_SUCCESS(rv, rv);
-  }
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsSiteSecurityService::RemoveState(uint32_t aType, nsIURI* aURI, uint32_t aFlags)
+nsSiteSecurityService::RemoveState(uint32_t aType, nsIURI* aURI,
+                                   uint32_t aFlags)
 {
-  // Should be called on the main thread (or via proxy) since the permission
-  // manager is used and it's not threadsafe.
-  NS_ENSURE_TRUE(NS_IsMainThread(), NS_ERROR_UNEXPECTED);
   // Only HSTS is supported at the moment.
   NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
@@ -211,14 +210,21 @@ nsSiteSecurityService::RemoveState(uint32_t aType, nsIURI* aURI, uint32_t aFlags
   NS_ENSURE_SUCCESS(rv, rv);
 
   bool isPrivate = aFlags & nsISocketProvider::NO_PERMANENT_STORAGE;
-
-  rv = RemovePermission(hostname, STS_PERMISSION, isPrivate);
-  NS_ENSURE_SUCCESS(rv, rv);
-  SSSLOG(("SSS: deleted maxage permission\n"));
-
-  rv = RemovePermission(hostname, STS_SUBDOMAIN_PERMISSION, isPrivate);
-  NS_ENSURE_SUCCESS(rv, rv);
-  SSSLOG(("SSS: deleted subdomains permission\n"));
+  mozilla::DataStorageType storageType = isPrivate
+                                         ? mozilla::DataStorage_Private
+                                         : mozilla::DataStorage_Persistent;
+  // If this host is in the preload list, we have to store a knockout entry.
+  if (GetPreloadListEntry(hostname.get())) {
+    SSSLOG(("SSS: storing knockout entry for %s", hostname.get()));
+    SiteSecurityState siteState(0, SecurityPropertyKnockout, false);
+    nsAutoCString stateString;
+    siteState.ToString(stateString);
+    rv = mSiteStateStorage->Put(hostname, stateString, storageType);
+    NS_ENSURE_SUCCESS(rv, rv);
+  } else {
+    SSSLOG(("SSS: removing entry for %s", hostname.get()));
+    mSiteStateStorage->Remove(hostname, storageType);
+  }
 
   return NS_OK;
 }
@@ -238,9 +244,6 @@ nsSiteSecurityService::ProcessHeader(uint32_t aType,
                                      uint64_t *aMaxAge,
                                      bool *aIncludeSubdomains)
 {
-  // Should be called on the main thread (or via proxy) since the permission
-  // manager is used and it's not threadsafe.
-  NS_ENSURE_TRUE(NS_IsMainThread(), NS_ERROR_UNEXPECTED);
   // Only HSTS is supported at the moment.
   NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
@@ -354,11 +357,13 @@ nsSiteSecurityService::ProcessHeaderMutating(uint32_t aType,
       foundIncludeSubdomains = true;
 
       if (directive->mValue.Length() != 0) {
-        SSSLOG(("SSS: includeSubdomains directive unexpectedly had value '%s'", directive->mValue.get()));
+        SSSLOG(("SSS: includeSubdomains directive unexpectedly had value '%s'",
+                directive->mValue.get()));
         return NS_ERROR_FAILURE;
       }
     } else {
-      SSSLOG(("SSS: ignoring unrecognized directive '%s'", directive->mName.get()));
+      SSSLOG(("SSS: ignoring unrecognized directive '%s'",
+              directive->mName.get()));
       foundUnrecognizedDirective = true;
     }
   }
@@ -381,34 +386,28 @@ nsSiteSecurityService::ProcessHeaderMutating(uint32_t aType,
     *aIncludeSubdomains = foundIncludeSubdomains;
   }
 
-  return foundUnrecognizedDirective ?
-         NS_SUCCESS_LOSS_OF_INSIGNIFICANT_DATA :
-         NS_OK;
+  return foundUnrecognizedDirective ? NS_SUCCESS_LOSS_OF_INSIGNIFICANT_DATA
+                                    : NS_OK;
 }
 
 NS_IMETHODIMP
-nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
-                                    uint32_t aFlags, bool* aResult)
+nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
+                                   uint32_t aFlags, bool* aResult)
 {
-  // Should be called on the main thread (or via proxy) since the permission
-  // manager is used and it's not threadsafe.
-  NS_ENSURE_TRUE(NS_IsMainThread(), NS_ERROR_UNEXPECTED);
   // Only HSTS is supported at the moment.
   NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
 
+  nsAutoCString hostname;
+  nsresult rv = GetHost(aURI, hostname);
+  NS_ENSURE_SUCCESS(rv, rv);
   /* An IP address never qualifies as a secure URI. */
-  if (HostIsIPAddress(aHost)) {
+  if (HostIsIPAddress(hostname.get())) {
     *aResult = false;
     return NS_OK;
   }
 
-  nsCOMPtr<nsIURI> uri;
-  nsDependentCString hostString(aHost);
-  nsresult rv = NS_NewURI(getter_AddRefs(uri),
-                          NS_LITERAL_CSTRING("https://") + hostString);
-  NS_ENSURE_SUCCESS(rv, rv);
-  return IsSecureURI(aType, uri, aFlags, aResult);
+  return IsSecureHost(aType, hostname.get(), aFlags, aResult);
 }
 
 int STSPreloadCompare(const void *key, const void *entry)
@@ -424,14 +423,7 @@ int STSPreloadCompare(const void *key, const void *entry)
 const nsSTSPreload *
 nsSiteSecurityService::GetPreloadListEntry(const char *aHost)
 {
-  PRTime currentTime = PR_Now();
-  int32_t timeOffset = 0;
-  nsresult rv = mozilla::Preferences::GetInt("test.currentTimeOffsetSeconds",
-                                             &timeOffset);
-  if (NS_SUCCEEDED(rv)) {
-    currentTime += (PRTime(timeOffset) * PR_USEC_PER_SEC);
-  }
-
+  PRTime currentTime = PR_Now() + (mPreloadListTimeOffset * PR_USEC_PER_SEC);
   if (mUsePreloadList && currentTime < gPreloadListExpirationTime) {
     return (const nsSTSPreload *) bsearch(aHost,
                                           kSTSPreloadList,
@@ -444,12 +436,9 @@ nsSiteSecurityService::GetPreloadListEntry(const char *aHost)
 }
 
 NS_IMETHODIMP
-nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
-                                   uint32_t aFlags, bool* aResult)
+nsSiteSecurityService::IsSecureHost(uint32_t aType, const char* aHost,
+                                    uint32_t aFlags, bool* aResult)
 {
-  // Should be called on the main thread (or via proxy) since the permission
-  // manager is used and it's not threadsafe.
-  NS_ENSURE_TRUE(NS_IsMainThread(), NS_ERROR_UNEXPECTED);
   // Only HSTS is supported at the moment.
   NS_ENSURE_TRUE(aType == nsISiteSecurityService::HEADER_HSTS,
                  NS_ERROR_NOT_IMPLEMENTED);
@@ -457,75 +446,58 @@ nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
   // set default in case if we can't find any STS information
   *aResult = false;
 
-  nsAutoCString host;
-  nsresult rv = GetHost(aURI, host);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   /* An IP address never qualifies as a secure URI. */
-  if (HostIsIPAddress(host.BeginReading())) {
+  if (HostIsIPAddress(aHost)) {
     return NS_OK;
   }
 
   // Holepunch chart.apis.google.com and subdomains.
+  nsAutoCString host(aHost);
+  ToLowerCase(host);
   if (host.EqualsLiteral("chart.apis.google.com") ||
       StringEndsWith(host, NS_LITERAL_CSTRING(".chart.apis.google.com"))) {
     return NS_OK;
   }
 
   const nsSTSPreload *preload = nullptr;
-  nsSSSHostEntry *pbEntry = nullptr;
-
-  bool isPrivate = aFlags & nsISocketProvider::NO_PERMANENT_STORAGE;
-  if (isPrivate) {
-    pbEntry = mPrivateModeHostTable.GetEntry(host.get());
-  }
-
-  nsCOMPtr<nsIPrincipal> principal;
-  rv = GetPrincipalForURI(aURI, getter_AddRefs(principal));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  uint32_t permMgrPermission;
-  rv = mPermMgr->TestExactPermissionFromPrincipal(principal, STS_PERMISSION,
-                                                  &permMgrPermission);
-  NS_ENSURE_SUCCESS(rv, rv);
 
   // First check the exact host. This involves first checking for an entry in
-  // the private browsing table. If that entry exists, we don't want to check
-  // in either the permission manager or the preload list. We only want to use
-  // the stored permission if it is not a knockout entry, however.
+  // site security storage. If that entry exists, we don't want to check
+  // in the preload list. We only want to use the stored value if it is not a
+  // knockout entry, however.
   // Additionally, if it is a knockout entry, we want to stop looking for data
   // on the host, because the knockout entry indicates "we have no information
-  // regarding the sts status of this host".
-  if (pbEntry && pbEntry->mStsPermission != STS_UNSET) {
-    SSSLOG(("Found private browsing table entry for %s", host.get()));
-    if (!pbEntry->IsExpired() && pbEntry->mStsPermission == STS_SET) {
+  // regarding the security status of this host".
+  bool isPrivate = aFlags & nsISocketProvider::NO_PERMANENT_STORAGE;
+  mozilla::DataStorageType storageType = isPrivate
+                                         ? mozilla::DataStorage_Private
+                                         : mozilla::DataStorage_Persistent;
+  nsCString value = mSiteStateStorage->Get(host, storageType);
+  SiteSecurityState siteState(value);
+  if (siteState.mHSTSState != SecurityPropertyUnset) {
+    SSSLOG(("Found entry for %s", host.get()));
+    bool expired = siteState.IsExpired(aType);
+    if (!expired && siteState.mHSTSState == SecurityPropertySet) {
       *aResult = true;
       return NS_OK;
     }
-  }
-  // Next we look in the permission manager. Same story here regarding
-  // knockout entries.
-  else if (permMgrPermission != STS_UNSET) {
-    SSSLOG(("Found permission manager entry for %s", host.get()));
-    if (permMgrPermission == STS_SET) {
-      *aResult = true;
-      return NS_OK;
+
+    // If the entry is expired and not in the preload list, we can remove it.
+    if (expired && !GetPreloadListEntry(host.get())) {
+      mSiteStateStorage->Remove(host, storageType);
     }
   }
   // Finally look in the preloaded list. This is the exact host,
-  // so if an entry exists at all, this host is sts.
+  // so if an entry exists at all, this host is HSTS.
   else if (GetPreloadListEntry(host.get())) {
     SSSLOG(("%s is a preloaded STS host", host.get()));
     *aResult = true;
     return NS_OK;
   }
 
-  // Used for testing permissions as we walk up the domain tree.
-  nsCOMPtr<nsIURI> domainWalkURI;
-  nsCOMPtr<nsIPrincipal> domainWalkPrincipal;
+  SSSLOG(("no HSTS data for %s found, walking up domain", host.get()));
   const char *subdomain;
 
-  SSSLOG(("no HSTS data for %s found, walking up domain", host.get()));
   uint32_t offset = 0;
   for (offset = host.FindChar('.', offset) + 1;
        offset > 0;
@@ -538,46 +510,26 @@ nsSiteSecurityService::IsSecureURI(uint32_t aType, nsIURI* aURI,
       break;
     }
 
-    if (isPrivate) {
-      pbEntry = mPrivateModeHostTable.GetEntry(subdomain);
-    }
-
-    // normalize all URIs with https://
-    rv = NS_NewURI(getter_AddRefs(domainWalkURI),
-                   NS_LITERAL_CSTRING("https://") + Substring(host, offset));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = GetPrincipalForURI(domainWalkURI, getter_AddRefs(domainWalkPrincipal));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    rv = mPermMgr->TestExactPermissionFromPrincipal(domainWalkPrincipal,
-                                                    STS_PERMISSION,
-                                                    &permMgrPermission);
-    NS_ENSURE_SUCCESS(rv, rv);
-
     // Do the same thing as with the exact host, except now we're looking at
     // ancestor domains of the original host. So, we have to look at the
-    // include subdomains permissions (although we still have to check for the
-    // STS_PERMISSION first to check that this is an sts host and not a
-    // knockout entry - and again, if it is a knockout entry, we stop looking
-    // for data on it and skip to the next higher up ancestor domain).
-    if (pbEntry && pbEntry->mStsPermission != STS_UNSET) {
-      SSSLOG(("Found private browsing table entry for %s", subdomain));
-      if (!pbEntry->IsExpired() && pbEntry->mStsPermission == STS_SET) {
-        *aResult = pbEntry->mIncludeSubdomains;
+    // include subdomains flag (although we still have to check for a
+    // SecurityPropertySet flag first to check that this is a secure host and
+    // not a knockout entry - and again, if it is a knockout entry, we stop
+    // looking for data on it and skip to the next higher up ancestor domain).
+    nsCString subdomainString(subdomain);
+    value = mSiteStateStorage->Get(subdomainString, storageType);
+    SiteSecurityState siteState(value);
+    if (siteState.mHSTSState != SecurityPropertyUnset) {
+      SSSLOG(("Found entry for %s", subdomain));
+      bool expired = siteState.IsExpired(aType);
+      if (!expired && siteState.mHSTSState == SecurityPropertySet) {
+        *aResult = siteState.mHSTSIncludeSubdomains;
         break;
       }
-    }
-    else if (permMgrPermission != STS_UNSET) {
-      SSSLOG(("Found permission manager entry for %s", subdomain));
-      if (permMgrPermission == STS_SET) {
-        uint32_t subdomainPermission;
-        rv = mPermMgr->TestExactPermissionFromPrincipal(domainWalkPrincipal,
-                                                        STS_SUBDOMAIN_PERMISSION,
-                                                        &subdomainPermission);
-        NS_ENSURE_SUCCESS(rv, rv);
-        *aResult = (subdomainPermission == STS_SET);
-        break;
+
+      // If the entry is expired and not in the preload list, we can remove it.
+      if (expired && !GetPreloadListEntry(subdomain)) {
+        mSiteStateStorage->Remove(subdomainString, storageType);
       }
     }
     // This is an ancestor, so if we get a match, we have to check if the
@@ -630,6 +582,12 @@ nsSiteSecurityService::ShouldIgnoreHeaders(nsISupports* aSecurityInfo,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsSiteSecurityService::ClearAll()
+{
+  return mSiteStateStorage->Clear();
+}
+
 //------------------------------------------------------------
 // nsSiteSecurityService::nsIObserver
 //------------------------------------------------------------
@@ -639,123 +597,18 @@ nsSiteSecurityService::Observe(nsISupports *subject,
                                const char *topic,
                                const char16_t *data)
 {
-  if (strcmp(topic, "last-pb-context-exited") == 0) {
-    mPrivateModeHostTable.Clear();
+  // Don't access Preferences off the main thread.
+  if (!NS_IsMainThread()) {
+    NS_NOTREACHED("Preferences accessed off main thread");
+    return NS_ERROR_NOT_SAME_THREAD;
   }
-  else if (strcmp(topic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID) == 0) {
-    mUsePreloadList = mozilla::Preferences::GetBool("network.stricttransportsecurity.preloadlist", true);
+
+  if (strcmp(topic, NS_PREFBRANCH_PREFCHANGE_TOPIC_ID) == 0) {
+    mUsePreloadList = mozilla::Preferences::GetBool(
+      "network.stricttransportsecurity.preloadlist", true);
+    mPreloadListTimeOffset =
+      mozilla::Preferences::GetInt("test.currentTimeOffsetSeconds", 0);
   }
 
   return NS_OK;
 }
-
-//------------------------------------------------------------
-// Functions to overlay the permission manager calls in case
-// we're in private browsing mode.
-//------------------------------------------------------------
-nsresult
-nsSiteSecurityService::AddPermission(nsIURI     *aURI,
-                                     const char *aType,
-                                     uint32_t   aPermission,
-                                     uint32_t   aExpireType,
-                                     int64_t    aExpireTime,
-                                     bool       aIsPrivate)
-{
-    // Private mode doesn't address user-set (EXPIRE_NEVER) permissions: let
-    // those be stored persistently.
-    if (!aIsPrivate || aExpireType == nsIPermissionManager::EXPIRE_NEVER) {
-      // Not in private mode, or manually-set permission
-      nsCOMPtr<nsIPrincipal> principal;
-      nsresult rv = GetPrincipalForURI(aURI, getter_AddRefs(principal));
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      return mPermMgr->AddFromPrincipal(principal, aType, aPermission,
-                                        aExpireType, aExpireTime);
-    }
-
-    nsAutoCString host;
-    nsresult rv = GetHost(aURI, host);
-    NS_ENSURE_SUCCESS(rv, rv);
-    SSSLOG(("AddPermission for entry for %s", host.get()));
-
-    // Update in mPrivateModeHostTable only, so any changes will be rolled
-    // back when exiting private mode.
-
-    // Note: EXPIRE_NEVER permissions should trump anything that shows up in
-    // the HTTP header, so if there's an EXPIRE_NEVER permission already
-    // don't store anything new.
-    // Currently there's no way to get the type of expiry out of the
-    // permission manager, but that's okay since there's nothing that stores
-    // EXPIRE_NEVER permissions.
-
-    // PutEntry returns an existing entry if there already is one, or it
-    // creates a new one if there isn't.
-    nsSSSHostEntry* entry = mPrivateModeHostTable.PutEntry(host.get());
-    if (!entry) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-    SSSLOG(("Created private mode entry for %s", host.get()));
-
-    // AddPermission() will be called twice if the STS header encountered has
-    // includeSubdomains (first for the main permission and second for the
-    // subdomains permission). If AddPermission() gets called a second time
-    // with the STS_SUBDOMAIN_PERMISSION, we just have to flip that bit in
-    // the nsSSSHostEntry.
-    if (strcmp(aType, STS_SUBDOMAIN_PERMISSION) == 0) {
-      entry->mIncludeSubdomains = true;
-    }
-    else if (strcmp(aType, STS_PERMISSION) == 0) {
-      entry->mStsPermission = aPermission;
-    }
-
-    // Also refresh the expiration time.
-    entry->SetExpireTime(aExpireTime);
-    return NS_OK;
-}
-
-nsresult
-nsSiteSecurityService::RemovePermission(const nsCString  &aHost,
-                                        const char       *aType,
-                                        bool aIsPrivate)
-{
-    // Build up a principal for use with the permission manager.
-    // normalize all URIs with https://
-    nsCOMPtr<nsIURI> uri;
-    nsresult rv = NS_NewURI(getter_AddRefs(uri),
-                            NS_LITERAL_CSTRING("https://") + aHost);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsIPrincipal> principal;
-    rv = GetPrincipalForURI(uri, getter_AddRefs(principal));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (!aIsPrivate) {
-      // Not in private mode: remove permissions persistently.
-      // This means setting the permission to STS_KNOCKOUT in case
-      // this host is on the preload list (so we can override it).
-      return mPermMgr->AddFromPrincipal(principal, aType,
-                                        STS_KNOCKOUT,
-                                        nsIPermissionManager::EXPIRE_NEVER, 0);
-    }
-
-    // Make changes in mPrivateModeHostTable only, so any changes will be
-    // rolled back when exiting private mode.
-    nsSSSHostEntry* entry = mPrivateModeHostTable.GetEntry(aHost.get());
-
-    if (!entry) {
-      entry = mPrivateModeHostTable.PutEntry(aHost.get());
-      if (!entry) {
-        return NS_ERROR_OUT_OF_MEMORY;
-      }
-      SSSLOG(("Created private mode deleted mask for %s", aHost.get()));
-    }
-
-    if (strcmp(aType, STS_PERMISSION) == 0) {
-      entry->mStsPermission = STS_KNOCKOUT;
-    }
-    else if (strcmp(aType, STS_SUBDOMAIN_PERMISSION) == 0) {
-      entry->mIncludeSubdomains = false;
-    }
-
-    return NS_OK;
-}
diff --git a/security/manager/boot/src/nsSiteSecurityService.h b/security/manager/boot/src/nsSiteSecurityService.h
index 8d6d910d5a4..fa99f451ff0 100644
--- a/security/manager/boot/src/nsSiteSecurityService.h
+++ b/security/manager/boot/src/nsSiteSecurityService.h
@@ -2,122 +2,75 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-/**
- * This wraps nsSimpleURI so that all calls to it are done on the main thread.
- */
-
 #ifndef __nsSiteSecurityService_h__
 #define __nsSiteSecurityService_h__
 
-#include "nsISiteSecurityService.h"
-#include "nsIObserver.h"
-#include "nsIObserverService.h"
-#include "nsIPermissionManager.h"
+#include "mozilla/DataStorage.h"
 #include "nsCOMPtr.h"
-#include "nsIURI.h"
+#include "nsIObserver.h"
+#include "nsISiteSecurityService.h"
 #include "nsString.h"
-#include "nsTHashtable.h"
 #include "prtime.h"
 
+class nsIURI;
+
 // {16955eee-6c48-4152-9309-c42a465138a1}
 #define NS_SITE_SECURITY_SERVICE_CID \
   {0x16955eee, 0x6c48, 0x4152, \
     {0x93, 0x09, 0xc4, 0x2a, 0x46, 0x51, 0x38, 0xa1} }
 
-////////////////////////////////////////////////////////////////////////////////
-// nsSSSHostEntry - similar to the nsHostEntry class in
-// nsPermissionManager.cpp, but specific to private-mode caching of STS
-// permissions.
-//
-// Each nsSSSHostEntry contains:
-//  - Expiry time (PRTime, milliseconds)
-//  - Expired flag (bool, default false)
-//  - STS permission (uint32_t, default STS_UNSET)
-//  - Include subdomains flag (bool, default false)
-//
-// Note: the subdomains flag has no meaning if the STS permission is STS_UNSET.
-//
-// The existence of the nsSSSHostEntry implies STS state is set for the given
-// host -- unless the expired flag is set, in which case not only is the STS
-// state not set for the host, but any permission actually present in the
-// permission manager should be ignored.
-//
-// Note: Only one expiry time is stored since the subdomains and STS
-// permissions are both encountered at the same time in the HTTP header; if the
-// includeSubdomains directive isn't present in the header, it means to delete
-// the permission, so the subdomains flag in the nsSSSHostEntry means both that
-// the permission doesn't exist and any permission in the real permission
-// manager should be ignored since newer information about it has been
-// encountered in private browsing mode.
-//
-// Note: If there's a permission set by the user (EXPIRE_NEVER), STS is not set
-// for the host (including the subdomains permission) when the header is
-// encountered.  Furthermore, any user-set permissions are stored persistently
-// and can't be shadowed.
-
-class nsSSSHostEntry : public PLDHashEntryHdr
-{
-  public:
-    explicit nsSSSHostEntry(const char* aHost);
-    explicit nsSSSHostEntry(const nsSSSHostEntry& toCopy);
-
-    nsCString    mHost;
-    PRTime       mExpireTime;
-    uint32_t     mStsPermission;
-    bool         mExpired;
-    bool         mIncludeSubdomains;
-
-    // Hash methods
-    typedef const char* KeyType;
-    typedef const char* KeyTypePointer;
-
-    KeyType GetKey() const
-    {
-      return mHost.get();
-    }
-
-    bool KeyEquals(KeyTypePointer aKey) const
-    {
-      return !strcmp(mHost.get(), aKey);
-    }
-
-    static KeyTypePointer KeyToPointer(KeyType aKey)
-    {
-      return aKey;
-    }
-
-    static PLDHashNumber HashKey(KeyTypePointer aKey)
-    {
-      return PL_DHashStringKey(nullptr, aKey);
-    }
-
-    void SetExpireTime(PRTime aExpireTime)
-    {
-      mExpireTime = aExpireTime;
-      mExpired = false;
-    }
-
-    bool IsExpired()
-    {
-      // If mExpireTime is 0, this entry never expires (this is the case for
-      // knockout entries).
-      // If we've already expired or we never expire, return early.
-      if (mExpired || mExpireTime == 0) {
-        return mExpired;
-      }
-
-      PRTime now = PR_Now() / PR_USEC_PER_MSEC;
-      if (now > mExpireTime) {
-        mExpired = true;
-      }
-
-      return mExpired;
-    }
-
-    // force the hashtable to use the copy constructor.
-    enum { ALLOW_MEMMOVE = false };
+/**
+ * SecurityPropertyState: A utility enum for representing the different states
+ * a security property can be in.
+ * SecurityPropertySet and SecurityPropertyUnset correspond to indicating
+ * a site has or does not have the security property in question, respectively.
+ * SecurityPropertyKnockout indicates a value on a preloaded list is being
+ * overridden, and the associated site does not have the security property
+ * in question.
+ */
+enum SecurityPropertyState {
+  SecurityPropertyUnset = 0,
+  SecurityPropertySet = 1,
+  SecurityPropertyKnockout = 2
+};
+
+/**
+ * SiteSecurityState: A utility class that encodes/decodes a string describing
+ * the security state of a site. Currently only handles HSTS.
+ * HSTS state consists of:
+ *  - Expiry time (PRTime (aka int64_t) in milliseconds)
+ *  - A state flag (SecurityPropertyState, default SecurityPropertyUnset)
+ *  - An include subdomains flag (bool, default false)
+ */
+class SiteSecurityState
+{
+public:
+  explicit SiteSecurityState(nsCString& aStateString);
+  SiteSecurityState(PRTime aHSTSExpireTime, SecurityPropertyState aHSTSState,
+                    bool aHSTSIncludeSubdomains);
+
+  PRTime mHSTSExpireTime;
+  SecurityPropertyState mHSTSState;
+  bool mHSTSIncludeSubdomains;
+
+  bool IsExpired(uint32_t aType)
+  {
+    // If mHSTSExpireTime is 0, this entry never expires (this is the case for
+    // knockout entries).
+    if (mHSTSExpireTime == 0) {
+      return false;
+    }
+
+    PRTime now = PR_Now() / PR_USEC_PER_MSEC;
+    if (now > mHSTSExpireTime) {
+      return true;
+    }
+
+    return false;
+  }
+
+  void ToString(nsCString &aString);
 };
-////////////////////////////////////////////////////////////////////////////////
 
 class nsSTSPreload;
 
@@ -137,7 +90,6 @@ protected:
 
 private:
   nsresult GetHost(nsIURI *aURI, nsACString &aResult);
-  nsresult GetPrincipalForURI(nsIURI *aURI, nsIPrincipal **aPrincipal);
   nsresult SetState(uint32_t aType, nsIURI* aSourceURI, int64_t maxage,
                     bool includeSubdomains, uint32_t flags);
   nsresult ProcessHeaderMutating(uint32_t aType, nsIURI* aSourceURI,
@@ -145,23 +97,9 @@ private:
                                  uint64_t *aMaxAge, bool *aIncludeSubdomains);
   const nsSTSPreload *GetPreloadListEntry(const char *aHost);
 
-  // private-mode-preserving permission manager overlay functions
-  nsresult AddPermission(nsIURI     *aURI,
-                         const char *aType,
-                         uint32_t   aPermission,
-                         uint32_t   aExpireType,
-                         int64_t    aExpireTime,
-                         bool       aIsPrivate);
-  nsresult RemovePermission(const nsCString  &aHost,
-                            const char       *aType,
-                            bool              aIsPrivate);
-
-  // cached services
-  nsCOMPtr<nsIPermissionManager> mPermMgr;
-  nsCOMPtr<nsIObserverService> mObserverService;
-
-  nsTHashtable<nsSSSHostEntry> mPrivateModeHostTable;
   bool mUsePreloadList;
+  int64_t mPreloadListTimeOffset;
+  nsRefPtr<mozilla::DataStorage> mSiteStateStorage;
 };
 
 #endif // __nsSiteSecurityService_h__
diff --git a/security/manager/ssl/src/nsCryptoHash.cpp b/security/manager/ssl/src/nsCryptoHash.cpp
index b7a7124c777..e49abb9b6ca 100644
--- a/security/manager/ssl/src/nsCryptoHash.cpp
+++ b/security/manager/ssl/src/nsCryptoHash.cpp
@@ -43,12 +43,14 @@ nsCryptoHash::~nsCryptoHash()
   shutdown(calledFromObject);
 }
 
-void nsCryptoHash::virtualDestroyNSSReference()
+void
+nsCryptoHash::virtualDestroyNSSReference()
 {
   destructorSafeDestroyNSSReference();
 }
 
-void nsCryptoHash::destructorSafeDestroyNSSReference()
+void
+nsCryptoHash::destructorSafeDestroyNSSReference()
 {
   if (mHashContext)
     HASH_Destroy(mHashContext);
@@ -61,6 +63,9 @@ NS_IMETHODIMP
 nsCryptoHash::Init(uint32_t algorithm)
 {
   nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
 
   HASH_HashType hashType = (HASH_HashType)algorithm;
   if (mHashContext)
@@ -90,6 +95,11 @@ nsCryptoHash::Init(uint32_t algorithm)
 NS_IMETHODIMP
 nsCryptoHash::InitWithString(const nsACString & aAlgorithm)
 {
+  nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
   if (aAlgorithm.LowerCaseEqualsLiteral("md2"))
     return Init(nsICryptoHash::MD2);
 
@@ -115,6 +125,9 @@ NS_IMETHODIMP
 nsCryptoHash::Update(const uint8_t *data, uint32_t len)
 {
   nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
   
   if (!mInitialized)
     return NS_ERROR_NOT_INITIALIZED;
@@ -126,6 +139,11 @@ nsCryptoHash::Update(const uint8_t *data, uint32_t len)
 NS_IMETHODIMP
 nsCryptoHash::UpdateFromStream(nsIInputStream *data, uint32_t aLen)
 {
+  nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
   if (!mInitialized)
     return NS_ERROR_NOT_INITIALIZED;
 
@@ -176,6 +194,9 @@ NS_IMETHODIMP
 nsCryptoHash::Finish(bool ascii, nsACString & _retval)
 {
   nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
   
   if (!mInitialized)
     return NS_ERROR_NOT_INITIALIZED;
@@ -225,12 +246,14 @@ nsCryptoHMAC::~nsCryptoHMAC()
   shutdown(calledFromObject);
 }
 
-void nsCryptoHMAC::virtualDestroyNSSReference()
+void
+nsCryptoHMAC::virtualDestroyNSSReference()
 {
   destructorSafeDestroyNSSReference();
 }
 
-void nsCryptoHMAC::destructorSafeDestroyNSSReference()
+void
+nsCryptoHMAC::destructorSafeDestroyNSSReference()
 {
   if (mHMACContext)
     PK11_DestroyContext(mHMACContext, true);
@@ -238,9 +261,13 @@ void nsCryptoHMAC::destructorSafeDestroyNSSReference()
 }
 
 /* void init (in unsigned long aAlgorithm, in nsIKeyObject aKeyObject); */
-NS_IMETHODIMP nsCryptoHMAC::Init(uint32_t aAlgorithm, nsIKeyObject *aKeyObject)
+NS_IMETHODIMP
+nsCryptoHMAC::Init(uint32_t aAlgorithm, nsIKeyObject *aKeyObject)
 {
   nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
 
   if (mHMACContext)
   {
@@ -296,9 +323,13 @@ NS_IMETHODIMP nsCryptoHMAC::Init(uint32_t aAlgorithm, nsIKeyObject *aKeyObject)
 }
 
 /* void update ([array, size_is (aLen), const] in octet aData, in unsigned long aLen); */
-NS_IMETHODIMP nsCryptoHMAC::Update(const uint8_t *aData, uint32_t aLen)
+NS_IMETHODIMP
+nsCryptoHMAC::Update(const uint8_t *aData, uint32_t aLen)
 {
   nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
 
   if (!mHMACContext)
     return NS_ERROR_NOT_INITIALIZED;
@@ -313,8 +344,14 @@ NS_IMETHODIMP nsCryptoHMAC::Update(const uint8_t *aData, uint32_t aLen)
 }
 
 /* void updateFromStream (in nsIInputStream aStream, in unsigned long aLen); */
-NS_IMETHODIMP nsCryptoHMAC::UpdateFromStream(nsIInputStream *aStream, uint32_t aLen)
+NS_IMETHODIMP
+nsCryptoHMAC::UpdateFromStream(nsIInputStream *aStream, uint32_t aLen)
 {
+  nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
   if (!mHMACContext)
     return NS_ERROR_NOT_INITIALIZED;
 
@@ -364,9 +401,13 @@ NS_IMETHODIMP nsCryptoHMAC::UpdateFromStream(nsIInputStream *aStream, uint32_t a
 }
 
 /* ACString finish (in bool aASCII); */
-NS_IMETHODIMP nsCryptoHMAC::Finish(bool aASCII, nsACString & _retval)
+NS_IMETHODIMP
+nsCryptoHMAC::Finish(bool aASCII, nsACString & _retval)
 {
   nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
 
   if (!mHMACContext)
     return NS_ERROR_NOT_INITIALIZED;
@@ -393,9 +434,13 @@ NS_IMETHODIMP nsCryptoHMAC::Finish(bool aASCII, nsACString & _retval)
 }
 
 /* void reset (); */
-NS_IMETHODIMP nsCryptoHMAC::Reset()
+NS_IMETHODIMP
+nsCryptoHMAC::Reset()
 {
   nsNSSShutDownPreventionLock locker;
+  if (isAlreadyShutDown()) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
 
   SECStatus ss = PK11_DigestBegin(mHMACContext);
   NS_ENSURE_TRUE(ss == SECSuccess, NS_ERROR_FAILURE);
diff --git a/security/manager/ssl/tests/gtest/DataStorageTest.cpp b/security/manager/ssl/tests/gtest/DataStorageTest.cpp
new file mode 100644
index 00000000000..00969ddf354
--- /dev/null
+++ b/security/manager/ssl/tests/gtest/DataStorageTest.cpp
@@ -0,0 +1,224 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "gtest/gtest.h"
+
+#include "mozilla/DataStorage.h"
+#include "nsAppDirectoryServiceDefs.h"
+#include "nsDirectoryServiceUtils.h"
+#include "nsNetUtil.h"
+#include "nsPrintfCString.h"
+#include "nsStreamUtils.h"
+
+using namespace mozilla;
+
+class DataStorageTest : public ::testing::Test
+{
+protected:
+  virtual void SetUp()
+  {
+    const ::testing::TestInfo* const testInfo =
+      ::testing::UnitTest::GetInstance()->current_test_info();
+    NS_ConvertUTF8toUTF16 testName(testInfo->name());
+    storage = new DataStorage(testName);
+    storage->Init(dataWillPersist);
+  }
+
+  nsRefPtr<DataStorage> storage;
+  bool dataWillPersist;
+};
+
+NS_NAMED_LITERAL_CSTRING(testKey, "test");
+NS_NAMED_LITERAL_CSTRING(testValue, "value");
+NS_NAMED_LITERAL_CSTRING(privateTestValue, "private");
+
+TEST_F(DataStorageTest, GetPutRemove)
+{
+  EXPECT_TRUE(dataWillPersist);
+
+  // Test Put/Get on Persistent data
+  EXPECT_EQ(NS_OK, storage->Put(testKey, testValue, DataStorage_Persistent));
+  // Don't re-use testKey / testValue here, to make sure that this works as
+  // expected with objects that have the same semantic value but are not
+  // literally the same object.
+  nsCString result = storage->Get(NS_LITERAL_CSTRING("test"),
+                                  DataStorage_Persistent);
+  EXPECT_STREQ("value", result.get());
+
+  // Get on Temporary/Private data with the same key should give nothing
+  result = storage->Get(testKey, DataStorage_Temporary);
+  EXPECT_TRUE(result.IsEmpty());
+  result = storage->Get(testKey, DataStorage_Private);
+  EXPECT_TRUE(result.IsEmpty());
+
+  // Put with Temporary/Private data shouldn't affect Persistent data
+  NS_NAMED_LITERAL_CSTRING(temporaryTestValue, "temporary");
+  EXPECT_EQ(NS_OK, storage->Put(testKey, temporaryTestValue,
+                                DataStorage_Temporary));
+  EXPECT_EQ(NS_OK, storage->Put(testKey, privateTestValue,
+                                DataStorage_Private));
+  result = storage->Get(testKey, DataStorage_Temporary);
+  EXPECT_STREQ("temporary", result.get());
+  result = storage->Get(testKey, DataStorage_Private);
+  EXPECT_STREQ("private", result.get());
+  result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_STREQ("value", result.get());
+
+  // Put of a previously-present key overwrites it (if of the same type)
+  NS_NAMED_LITERAL_CSTRING(newValue, "new");
+  EXPECT_EQ(NS_OK, storage->Put(testKey, newValue, DataStorage_Persistent));
+  result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_STREQ("new", result.get());
+
+  // Removal should work
+  storage->Remove(testKey, DataStorage_Temporary);
+  result = storage->Get(testKey, DataStorage_Temporary);
+  EXPECT_TRUE(result.IsEmpty());
+  // But removing one type shouldn't affect the others
+  result = storage->Get(testKey, DataStorage_Private);
+  EXPECT_STREQ("private", result.get());
+  result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_STREQ("new", result.get());
+  // Test removing the other types as well
+  storage->Remove(testKey, DataStorage_Private);
+  result = storage->Get(testKey, DataStorage_Private);
+  EXPECT_TRUE(result.IsEmpty());
+  storage->Remove(testKey, DataStorage_Persistent);
+  result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_TRUE(result.IsEmpty());
+}
+
+TEST_F(DataStorageTest, InputValidation)
+{
+  EXPECT_TRUE(dataWillPersist);
+
+  // Keys may not have tabs or newlines
+  EXPECT_EQ(NS_ERROR_INVALID_ARG,
+            storage->Put(NS_LITERAL_CSTRING("key\thas tab"), testValue,
+                   DataStorage_Persistent));
+  nsCString result = storage->Get(NS_LITERAL_CSTRING("key\thas tab"),
+                            DataStorage_Persistent);
+  EXPECT_TRUE(result.IsEmpty());
+  EXPECT_EQ(NS_ERROR_INVALID_ARG,
+            storage->Put(NS_LITERAL_CSTRING("key has\nnewline"), testValue,
+                   DataStorage_Persistent));
+  result = storage->Get(NS_LITERAL_CSTRING("keyhas\nnewline"),
+                  DataStorage_Persistent);
+  EXPECT_TRUE(result.IsEmpty());
+  // Values may not have newlines
+  EXPECT_EQ(NS_ERROR_INVALID_ARG,
+            storage->Put(testKey, NS_LITERAL_CSTRING("value\nhas newline"),
+                   DataStorage_Persistent));
+  result = storage->Get(testKey, DataStorage_Persistent);
+  // Values may have tabs
+  EXPECT_TRUE(result.IsEmpty());
+  EXPECT_EQ(NS_OK, storage->Put(testKey,
+                                NS_LITERAL_CSTRING("val\thas tab; this is ok"),
+                                DataStorage_Persistent));
+  result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_STREQ("val\thas tab; this is ok", result.get());
+
+  nsCString longKey("a");
+  for (int i = 0; i < 8; i++) {
+    longKey.Append(longKey);
+  }
+  // A key of length 256 will work
+  EXPECT_EQ(NS_OK, storage->Put(longKey, testValue, DataStorage_Persistent));
+  result = storage->Get(longKey, DataStorage_Persistent);
+  EXPECT_STREQ("value", result.get());
+  longKey.Append("a");
+  // A key longer than that will not work
+  EXPECT_EQ(NS_ERROR_INVALID_ARG,
+            storage->Put(longKey, testValue, DataStorage_Persistent));
+  result = storage->Get(longKey, DataStorage_Persistent);
+  EXPECT_TRUE(result.IsEmpty());
+
+  nsCString longValue("a");
+  for (int i = 0; i < 10; i++) {
+    longValue.Append(longValue);
+  }
+  // A value of length 1024 will work
+  EXPECT_EQ(NS_OK, storage->Put(testKey, longValue, DataStorage_Persistent));
+  result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_STREQ(longValue.get(), result.get());
+  longValue.Append("a");
+  // A value longer than that will not work
+  storage->Remove(testKey, DataStorage_Persistent);
+  EXPECT_EQ(NS_ERROR_INVALID_ARG,
+            storage->Put(testKey, longValue, DataStorage_Persistent));
+  result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_TRUE(result.IsEmpty());
+}
+
+TEST_F(DataStorageTest, Eviction)
+{
+  EXPECT_TRUE(dataWillPersist);
+
+  // Eviction is on a per-table basis. Tables shouldn't affect each other.
+  EXPECT_EQ(NS_OK, storage->Put(testKey, testValue, DataStorage_Persistent));
+  for (int i = 0; i < 1025; i++) {
+    EXPECT_EQ(NS_OK, storage->Put(nsPrintfCString("%d", i),
+                                  nsPrintfCString("%d", i),
+                                  DataStorage_Temporary));
+    nsCString result = storage->Get(nsPrintfCString("%d", i),
+                                    DataStorage_Temporary);
+    EXPECT_STREQ(nsPrintfCString("%d", i).get(), result.get());
+  }
+  // We don't know which entry got evicted, but we can count them.
+  int entries = 0;
+  for (int i = 0; i < 1025; i++) {
+    nsCString result = storage->Get(nsPrintfCString("%d", i),
+                                    DataStorage_Temporary);
+    if (!result.IsEmpty()) {
+      entries++;
+    }
+  }
+  EXPECT_EQ(entries, 1024);
+  nsCString result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_STREQ("value", result.get());
+}
+
+TEST_F(DataStorageTest, ClearPrivateData)
+{
+  EXPECT_TRUE(dataWillPersist);
+
+  EXPECT_EQ(NS_OK, storage->Put(testKey, privateTestValue,
+                                DataStorage_Private));
+  nsCString result = storage->Get(testKey, DataStorage_Private);
+  EXPECT_STREQ("private", result.get());
+  storage->Observe(nullptr, "last-pb-context-exited", nullptr);
+  result = storage->Get(testKey, DataStorage_Private);
+  EXPECT_TRUE(result.IsEmpty());
+}
+
+TEST_F(DataStorageTest, Shutdown)
+{
+  EXPECT_TRUE(dataWillPersist);
+
+  EXPECT_EQ(NS_OK, storage->Put(testKey, testValue, DataStorage_Persistent));
+  nsCString result = storage->Get(testKey, DataStorage_Persistent);
+  EXPECT_STREQ("value", result.get());
+  // Get "now" (in days) close to when the data was last touched, so we won't
+  // get intermittent failures with the day not matching.
+  int64_t microsecondsPerDay = 24 * 60 * 60 * int64_t(PR_USEC_PER_SEC);
+  int32_t nowInDays = int32_t(PR_Now() / microsecondsPerDay);
+  storage->Observe(nullptr, "profile-before-change", nullptr);
+  nsCOMPtr<nsIFile> backingFile;
+  EXPECT_EQ(NS_OK, NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
+                                          getter_AddRefs(backingFile)));
+  const ::testing::TestInfo* const testInfo =
+    ::testing::UnitTest::GetInstance()->current_test_info();
+  NS_ConvertUTF8toUTF16 testName(testInfo->name());
+  EXPECT_EQ(NS_OK, backingFile->Append(testName));
+  nsCOMPtr<nsIInputStream> fileInputStream;
+  EXPECT_EQ(NS_OK, NS_NewLocalFileInputStream(getter_AddRefs(fileInputStream),
+                                              backingFile));
+  nsCString data;
+  EXPECT_EQ(NS_OK, NS_ConsumeStream(fileInputStream, UINT32_MAX, data));
+  // The data will be of the form 'test\t0\t<days since the epoch>\tvalue'
+  EXPECT_STREQ(nsPrintfCString("test\t0\t%d\tvalue\n", nowInDays).get(),
+               data.get());
+}
diff --git a/security/manager/ssl/tests/gtest/moz.build b/security/manager/ssl/tests/gtest/moz.build
index 5d26f5c4502..e6c8fc2d914 100644
--- a/security/manager/ssl/tests/gtest/moz.build
+++ b/security/manager/ssl/tests/gtest/moz.build
@@ -5,6 +5,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 SOURCES += [
+    'DataStorageTest.cpp',
     'OCSPCacheTest.cpp',
     'TLSIntoleranceTest.cpp',
 ]
diff --git a/security/manager/ssl/tests/unit/head_psm.js b/security/manager/ssl/tests/unit/head_psm.js
index bad05be4d7f..7305dc9d8a9 100644
--- a/security/manager/ssl/tests/unit/head_psm.js
+++ b/security/manager/ssl/tests/unit/head_psm.js
@@ -18,6 +18,8 @@ let gIsWindows = ("@mozilla.org/windows-registry-key;1" in Cc);
 const isDebugBuild = Cc["@mozilla.org/xpcom/debug;1"]
                        .getService(Ci.nsIDebug2).isDebugBuild;
 
+const SSS_STATE_FILE_NAME = "SiteSecurityServiceState.txt";
+
 const SEC_ERROR_BASE = Ci.nsINSSErrorsService.NSS_SEC_ERROR_BASE;
 const SSL_ERROR_BASE = Ci.nsINSSErrorsService.NSS_SSL_ERROR_BASE;
 const MOZILLA_PKIX_ERROR_BASE = Ci.nsINSSErrorsService.MOZILLA_PKIX_ERROR_BASE;
diff --git a/security/manager/ssl/tests/unit/test_sss_eviction.js b/security/manager/ssl/tests/unit/test_sss_eviction.js
new file mode 100644
index 00000000000..c47c474c6b0
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_sss_eviction.js
@@ -0,0 +1,75 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// The purpose of this test is to check that a frequently visited site
+// will not be evicted over an infrequently visited site.
+
+let gSSService = null;
+let gProfileDir = null;
+
+function do_state_written(aSubject, aTopic, aData) {
+  do_check_eq(aData, SSS_STATE_FILE_NAME);
+
+  let stateFile = gProfileDir.clone();
+  stateFile.append(SSS_STATE_FILE_NAME);
+  do_check_true(stateFile.exists());
+  let stateFileContents = readFile(stateFile);
+  // the last part is removed because it's the empty string after the final \n
+  let lines = stateFileContents.split('\n').slice(0, -1);
+  // We can receive multiple data-storage-written events. In particular, we
+  // may receive one where DataStorage wrote out data before we were done
+  // processing all of our headers. In this case, the data may not be
+  // as we expect. We only care about the final one being correct, however,
+  // so we return and wait for the next event if things aren't as we expect.
+  // There should be 1024 entries.
+  if (lines.length != 1024) {
+    return;
+  }
+
+  let foundLegitSite = false;
+  for (let line of lines) {
+    if (line.startsWith("frequentlyused.example.com")) {
+      foundLegitSite = true;
+      break;
+    }
+  }
+
+  do_check_true(foundLegitSite);
+  do_test_finished();
+}
+
+function do_state_read(aSubject, aTopic, aData) {
+  do_check_eq(aData, SSS_STATE_FILE_NAME);
+
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "frequentlyused.example.com", 0));
+  for (let i = 0; i < 2000; i++) {
+    let uri = Services.io.newURI("http://bad" + i + ".example.com", null, null);
+    gSSService.processHeader(Ci.nsISiteSecurityService.HEADER_HSTS, uri,
+                            "max-age=1000", 0);
+  }
+  do_test_pending();
+  Services.obs.addObserver(do_state_written, "data-storage-written", false);
+  do_test_finished();
+}
+
+function run_test() {
+  Services.prefs.setIntPref("test.datastorage.write_timer_ms", 100);
+  gProfileDir = do_get_profile();
+  let stateFile = gProfileDir.clone();
+  stateFile.append(SSS_STATE_FILE_NAME);
+  // Assuming we're working with a clean slate, the file shouldn't exist
+  // until we create it.
+  do_check_false(stateFile.exists());
+  let outputStream = FileUtils.openFileOutputStream(stateFile);
+  let now = (new Date()).getTime();
+  let line = "frequentlyused.example.com\t4\t0\t" + (now + 100000) + ",1,0\n";
+  outputStream.write(line, line.length);
+  outputStream.close();
+  Services.obs.addObserver(do_state_read, "data-storage-ready", false);
+  do_test_pending();
+  gSSService = Cc["@mozilla.org/ssservice;1"]
+                 .getService(Ci.nsISiteSecurityService);
+  do_check_true(gSSService != null);
+}
diff --git a/security/manager/ssl/tests/unit/test_sss_readstate.js b/security/manager/ssl/tests/unit/test_sss_readstate.js
new file mode 100644
index 00000000000..4e98901fd92
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_sss_readstate.js
@@ -0,0 +1,77 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// The purpose of this test is to create a site security service state file
+// and see that the site security service reads it properly.
+
+function writeLine(aLine, aOutputStream) {
+  aOutputStream.write(aLine, aLine.length);
+}
+
+let gSSService = null;
+
+function checkStateRead(aSubject, aTopic, aData) {
+  do_check_eq(aData, SSS_STATE_FILE_NAME);
+
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "expired.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "notexpired.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "bugzilla.mozilla.org", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "sub.bugzilla.mozilla.org", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "incsubdomain.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "sub.incsubdomain.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "login.persona.org", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "sub.login.persona.org", 0));
+
+  // Clearing the data should make everything go back to default.
+  gSSService.clearAll();
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "expired.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "notexpired.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "bugzilla.mozilla.org", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "sub.bugzilla.mozilla.org", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "incsubdomain.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "sub.incsubdomain.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "login.persona.org", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "sub.login.persona.org", 0));
+  do_test_finished();
+}
+
+function run_test() {
+  let profileDir = do_get_profile();
+  let stateFile = profileDir.clone();
+  stateFile.append(SSS_STATE_FILE_NAME);
+  // Assuming we're working with a clean slate, the file shouldn't exist
+  // until we create it.
+  do_check_false(stateFile.exists());
+  let outputStream = FileUtils.openFileOutputStream(stateFile);
+  let now = (new Date()).getTime();
+  writeLine("expired.example.com\t0\t0\t" + (now - 100000) + ",1,0\n", outputStream);
+  writeLine("notexpired.example.com\t0\t0\t" + (now + 100000) + ",1,0\n", outputStream);
+  // This overrides an entry on the preload list.
+  writeLine("bugzilla.mozilla.org\t0\t0\t" + (now + 100000) + ",1,0\n", outputStream);
+  writeLine("incsubdomain.example.com\t0\t0\t" + (now + 100000) + ",1,1\n", outputStream);
+  // This overrides an entry on the preload list.
+  writeLine("login.persona.org\t0\t0\t0,2,0\n", outputStream);
+  outputStream.close();
+  Services.obs.addObserver(checkStateRead, "data-storage-ready", false);
+  do_test_pending();
+  gSSService = Cc["@mozilla.org/ssservice;1"]
+                 .getService(Ci.nsISiteSecurityService);
+  do_check_true(gSSService != null);
+}
diff --git a/security/manager/ssl/tests/unit/test_sss_readstate_empty.js b/security/manager/ssl/tests/unit/test_sss_readstate_empty.js
new file mode 100644
index 00000000000..a626d286290
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_sss_readstate_empty.js
@@ -0,0 +1,40 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// The purpose of this test is to create an empty site security service state
+// file and see that the site security service doesn't fail when reading it.
+
+let gSSService = null;
+
+function checkStateRead(aSubject, aTopic, aData) {
+  // nonexistent.example.com should never be an HSTS host
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "nonexistent.example.com", 0));
+  // bugzilla.mozilla.org is preloaded
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                       "bugzilla.mozilla.org", 0));
+  // notexpired.example.com is an HSTS host in a different test - we
+  // want to make sure that test hasn't interfered with this one.
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "notexpired.example.com", 0));
+  do_test_finished();
+}
+
+function run_test() {
+  let profileDir = do_get_profile();
+  let stateFile = profileDir.clone();
+  stateFile.append(SSS_STATE_FILE_NAME);
+  // Assuming we're working with a clean slate, the file shouldn't exist
+  // until we create it.
+  do_check_false(stateFile.exists());
+  stateFile.create(Ci.nsIFile.NORMAL_FILE_TYPE, 0x1a4); // 0x1a4 == 0644
+  do_check_true(stateFile.exists());
+  // Initialize nsISiteSecurityService after do_get_profile() so it
+  // can read the state file.
+  Services.obs.addObserver(checkStateRead, "data-storage-ready", false);
+  do_test_pending();
+  gSSService = Cc["@mozilla.org/ssservice;1"]
+                 .getService(Ci.nsISiteSecurityService);
+  do_check_true(gSSService != null);
+}
diff --git a/security/manager/ssl/tests/unit/test_sss_readstate_garbage.js b/security/manager/ssl/tests/unit/test_sss_readstate_garbage.js
new file mode 100644
index 00000000000..c66434f1c5b
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_sss_readstate_garbage.js
@@ -0,0 +1,51 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// The purpose of this test is to create a mostly bogus site security service
+// state file and see that the site security service handles it properly.
+
+function writeLine(aLine, aOutputStream) {
+  aOutputStream.write(aLine, aLine.length);
+}
+
+let gSSService = null;
+
+function checkStateRead(aSubject, aTopic, aData) {
+  do_check_eq(aData, SSS_STATE_FILE_NAME);
+
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "example1.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "example2.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "example3.example.com", 0));
+  do_test_finished();
+}
+
+function run_test() {
+  let profileDir = do_get_profile();
+  let stateFile = profileDir.clone();
+  stateFile.append(SSS_STATE_FILE_NAME);
+  // Assuming we're working with a clean slate, the file shouldn't exist
+  // until we create it.
+  do_check_false(stateFile.exists());
+  let outputStream = FileUtils.openFileOutputStream(stateFile);
+  let now = (new Date()).getTime();
+  writeLine("example1.example.com\t0\t0\t" + (now + 100000) + ",1,0\n", outputStream);
+  writeLine("I'm a lumberjack and I'm okay; I work all night and I sleep all day!\n", outputStream);
+  writeLine("This is a totally bogus entry\t\n", outputStream);
+  writeLine("0\t0\t0\t0\t\n", outputStream);
+  writeLine("\t\t\t\t\t\t\t\n", outputStream);
+  writeLine("example.com\t\t\t\t\t\t\t\n", outputStream);
+  writeLine("example3.example.com\t0\t\t\t\t\t\t\n", outputStream);
+  writeLine("example2.example.com\t0\t0\t" + (now + 100000) + ",1,0\n", outputStream);
+  outputStream.close();
+  Services.obs.addObserver(checkStateRead, "data-storage-ready", false);
+  do_test_pending();
+  gSSService = Cc["@mozilla.org/ssservice;1"]
+                 .getService(Ci.nsISiteSecurityService);
+  do_check_true(gSSService != null);
+}
diff --git a/security/manager/ssl/tests/unit/test_sss_readstate_huge.js b/security/manager/ssl/tests/unit/test_sss_readstate_huge.js
new file mode 100644
index 00000000000..113587390c0
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_sss_readstate_huge.js
@@ -0,0 +1,55 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// The purpose of this test is to create a site security service state file
+// that is too large and see that the site security service reads it properly
+// (this means discarding all entries after the 1024th).
+
+function writeLine(aLine, aOutputStream) {
+  aOutputStream.write(aLine, aLine.length);
+}
+
+let gSSService = null;
+
+function checkStateRead(aSubject, aTopic, aData) {
+  do_check_eq(aData, SSS_STATE_FILE_NAME);
+
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "example0.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "example423.example.com", 0));
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "example1023.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "example1024.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "example1025.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "example9000.example.com", 0));
+  do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                         "example99999.example.com", 0));
+  do_test_finished();
+}
+
+function run_test() {
+  let profileDir = do_get_profile();
+  let stateFile = profileDir.clone();
+  stateFile.append(SSS_STATE_FILE_NAME);
+  // Assuming we're working with a clean slate, the file shouldn't exist
+  // until we create it.
+  do_check_false(stateFile.exists());
+  let outputStream = FileUtils.openFileOutputStream(stateFile);
+  let now = (new Date()).getTime();
+  for (let i = 0; i < 10000; i++) {
+    // The 0s will all get squashed down into one 0 when they are read.
+    // This is just to make the file size large (>2MB).
+    writeLine("example" + i + ".example.com\t0000000000000000000000000000000000000000000000000\t00000000000000000000000000000000000000\t" + (now + 100000) + ",1,0000000000000000000000000000000000000000000000000000000000000000000000000\n", outputStream);
+  }
+  outputStream.close();
+  Services.obs.addObserver(checkStateRead, "data-storage-ready", false);
+  do_test_pending();
+  gSSService = Cc["@mozilla.org/ssservice;1"]
+                 .getService(Ci.nsISiteSecurityService);
+  do_check_true(gSSService != null);
+}
diff --git a/security/manager/ssl/tests/unit/test_sss_savestate.js b/security/manager/ssl/tests/unit/test_sss_savestate.js
new file mode 100644
index 00000000000..493bd43f6b3
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_sss_savestate.js
@@ -0,0 +1,104 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// The purpose of this test is to see that the site security service properly
+// writes its state file.
+
+const EXPECTED_ENTRIES = 5;
+const EXPECTED_COLUMNS = 3;
+let gProfileDir = null;
+
+// For reference, the format of the state file is a list of:
+// <domain name> <expiration time in milliseconds>,<sts status>,<includeSubdomains>
+// separated by newlines ('\n')
+
+function checkStateWritten(aSubject, aTopic, aData) {
+  do_check_eq(aData, SSS_STATE_FILE_NAME);
+
+  let stateFile = gProfileDir.clone();
+  stateFile.append(SSS_STATE_FILE_NAME);
+  do_check_true(stateFile.exists());
+  let stateFileContents = readFile(stateFile);
+  // the last line is removed because it's just a trailing newline
+  let lines = stateFileContents.split('\n').slice(0, -1);
+  do_check_eq(lines.length, EXPECTED_ENTRIES);
+  let sites = {}; // a map of domain name -> [the entry in the state file]
+  for (let line of lines) {
+    let parts = line.split('\t');
+    let host = parts[0];
+    let score = parts[1];
+    let lastAccessed = parts[2];
+    let entry = parts[3].split(',');
+    do_check_eq(entry.length, EXPECTED_COLUMNS);
+    sites[host] = entry;
+  }
+
+  // We can receive multiple data-storage-written events. In particular, we
+  // may receive one where DataStorage wrote out data before we were done
+  // processing all of our headers. In this case, the data may not be
+  // as we expect. We only care about the final one being correct, however,
+  // so we return and wait for the next event if things aren't as we expect.
+  // sites[url][1] corresponds to SecurityPropertySet (if 1) and
+  //                              SecurityPropertyUnset (if 0)
+  // sites[url][2] corresponds to includeSubdomains
+  if (sites["bugzilla.mozilla.org"][1] != 1) {
+    return;
+  }
+  if (sites["bugzilla.mozilla.org"][2] != 0) {
+    return;
+  }
+  if (sites["a.example.com"][1] != 1) {
+    return;
+  }
+  if (sites["a.example.com"][2] != 1) {
+    return;
+  }
+  if (sites["b.example.com"][1] != 1) {
+    return;
+  }
+  if (sites["b.example.com"][2] != 0) {
+    return;
+  }
+  if (sites["c.c.example.com"][1] != 1) {
+    return;
+  }
+  if (sites["c.c.example.com"][2] != 1) {
+    return;
+  }
+  if (sites["d.example.com"][1] != 1) {
+    return;
+  }
+  if (sites["d.example.com"][2] != 0) {
+    return;
+  }
+
+  do_test_finished();
+}
+
+function run_test() {
+  Services.prefs.setIntPref("test.datastorage.write_timer_ms", 100);
+  gProfileDir = do_get_profile();
+  let SSService = Cc["@mozilla.org/ssservice;1"]
+                    .getService(Ci.nsISiteSecurityService);
+
+  let uris = [ Services.io.newURI("http://bugzilla.mozilla.org", null, null),
+               Services.io.newURI("http://a.example.com", null, null),
+               Services.io.newURI("http://b.example.com", null, null),
+               Services.io.newURI("http://c.c.example.com", null, null),
+               Services.io.newURI("http://d.example.com", null, null) ];
+
+  for (let i = 0; i < 1000; i++) {
+    let uriIndex = i % uris.length;
+    // vary max-age
+    let maxAge = "max-age=" + (i * 1000);
+     // alternate setting includeSubdomains
+    let includeSubdomains = (i % 2 == 0 ? "; includeSubdomains" : "");
+    SSService.processHeader(Ci.nsISiteSecurityService.HEADER_HSTS,
+                            uris[uriIndex], maxAge + includeSubdomains, 0);
+  }
+
+
+  do_test_pending();
+  Services.obs.addObserver(checkStateWritten, "data-storage-written", false);
+}
diff --git a/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js b/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js
index a365acf2942..f021e8f55ff 100644
--- a/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js
+++ b/security/manager/ssl/tests/unit/test_sts_preloadlist_perwindowpb.js
@@ -17,28 +17,9 @@ Observer.prototype = {
 
 var gObserver = new Observer();
 
-// nsISiteSecurityService.removeStsState removes a given domain's
-// HSTS status. This means that a domain on the preload list will be
-// considered not HSTS if this is called. So, to reset everything to its
-// original state, we have to reach into the permission manager and clear
-// any HSTS-related state manually.
-function clearStsState() {
-  var permissionManager = Cc["@mozilla.org/permissionmanager;1"]
-                            .getService(Ci.nsIPermissionManager);
-  // This is a list of every host we call processHeader with
-  // (so we can remove any state added to the sts service)
-  var hosts = ["bugzilla.mozilla.org", "login.persona.org",
-               "subdomain.www.torproject.org",
-               "subdomain.bugzilla.mozilla.org" ];
-  for (var host of hosts) {
-    permissionManager.remove(host, "sts/use");
-    permissionManager.remove(host, "sts/subd");
-  }
-}
-
 function cleanup() {
   Services.obs.removeObserver(gObserver, "last-pb-context-exited");
-  clearStsState();
+  gSSService.clearAll();
 }
 
 function run_test() {
@@ -103,7 +84,7 @@ function test_part1() {
   // but this time include subdomains was not set, so test for that
   do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
                                          "subdomain.bugzilla.mozilla.org", 0));
-  clearStsState();
+  gSSService.clearAll();
 
   // check that processing a header with max-age: 0 from a subdomain of a site
   // will not remove that (ancestor) site from the list
@@ -150,14 +131,28 @@ function test_part1() {
   do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
                                          "another.subdomain.bugzilla.mozilla.org", 0));
 
-  // Simulate leaving private browsing mode
-  Services.obs.notifyObservers(null, "last-pb-context-exited", null);
+  // Test that an expired non-private browsing entry results in correctly
+  // identifying a host that is on the preload list as no longer sts.
+  // (This happens when we're in regular browsing mode, we get a header from
+  // a site on the preload list, and that header later expires. We need to
+  // then treat that host as no longer an sts host.)
+  // (sanity check first - this should be in the preload list)
+  do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                        "login.persona.org", 0));
+  var uri = Services.io.newURI("http://login.persona.org", null, null);
+  gSSService.processHeader(Ci.nsISiteSecurityService.HEADER_HSTS, uri,
+                           "max-age=1", 0);
+  do_timeout(1250, function() {
+    do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
+                                           "login.persona.org", 0));
+    run_next_test();
+  });
 }
 
 const IS_PRIVATE = Ci.nsISocketProvider.NO_PERMANENT_STORAGE;
 
 function test_private_browsing1() {
-  clearStsState();
+  gSSService.clearAll();
   // sanity - bugzilla.mozilla.org is preloaded, includeSubdomains set
   do_check_true(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
                                         "bugzilla.mozilla.org", IS_PRIVATE));
@@ -189,9 +184,6 @@ function test_private_browsing1() {
   do_check_false(gSSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
                                          "subdomain.bugzilla.mozilla.org", IS_PRIVATE));
 
-  // TODO unfortunately we don't have a good way to know when an entry
-  // has expired in the permission manager, so we can't yet extend this test
-  // to that case.
   // Test that an expired private browsing entry results in correctly
   // identifying a host that is on the preload list as no longer sts.
   // (This happens when we're in private browsing mode, we get a header from
diff --git a/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.cpp b/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.cpp
index 999fe5d5b69..67db085f4ba 100644
--- a/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.cpp
+++ b/security/manager/ssl/tests/unit/tlsserver/lib/OCSPCommon.cpp
@@ -70,7 +70,7 @@ GetOCSPResponseForType(OCSPResponseType aORT, CERTCertificate *aCert,
     return nullptr;
   }
   CertID certID(issuer, issuerPublicKey, serialNumber);
-  OCSPResponseContext context(aArena, certID, now);
+  OCSPResponseContext context(certID, now);
 
   mozilla::ScopedCERTCertificate signerCert;
   if (aORT == ORTGoodOtherCA || aORT == ORTDelegatedIncluded ||
@@ -83,18 +83,18 @@ GetOCSPResponseForType(OCSPResponseType aORT, CERTCertificate *aCert,
     }
   }
 
-  const SECItem* certs[5] = { nullptr, nullptr, nullptr, nullptr, nullptr };
+  ByteString certs[5];
 
   if (aORT == ORTDelegatedIncluded) {
-    certs[0] = &signerCert->derCert;
+    certs[0].assign(signerCert->derCert.data, signerCert->derCert.len);
     context.certs = certs;
   }
   if (aORT == ORTDelegatedIncludedLast || aORT == ORTDelegatedMissingMultiple) {
-    certs[0] = &issuerCert->derCert;
-    certs[1] = &cert->derCert;
-    certs[2] = &issuerCert->derCert;
+    certs[0].assign(issuerCert->derCert.data, issuerCert->derCert.len);
+    certs[1].assign(cert->derCert.data, cert->derCert.len);
+    certs[2].assign(issuerCert->derCert.data, issuerCert->derCert.len);
     if (aORT != ORTDelegatedMissingMultiple) {
-      certs[3] = &signerCert->derCert;
+      certs[3].assign(signerCert->derCert.data, signerCert->derCert.len);
     }
     context.certs = certs;
   }
@@ -145,28 +145,17 @@ GetOCSPResponseForType(OCSPResponseType aORT, CERTCertificate *aCert,
   }
   OCSPResponseExtension extension;
   if (aORT == ORTCriticalExtension || aORT == ORTNoncriticalExtension) {
-    SECItem oidItem = {
-      siBuffer,
-      nullptr,
-      0
+    // python DottedOIDToCode.py --tlv some-Mozilla-OID \
+    //        1.3.6.1.4.1.13769.666.666.666.1.500.9.2
+    static const uint8_t tlv_some_Mozilla_OID[] = {
+      0x06, 0x12, 0x2b, 0x06, 0x01, 0x04, 0x01, 0xeb, 0x49, 0x85, 0x1a, 0x85,
+      0x1a, 0x85, 0x1a, 0x01, 0x83, 0x74, 0x09, 0x02
     };
-    // 1.3.6.1.4.1.13769.666.666.666 is the root of Mozilla's testing OID space
-    static const char* testExtensionOID = "1.3.6.1.4.1.13769.666.666.666.1.500.9.2";
-    if (SEC_StringToOID(aArena, &oidItem, testExtensionOID,
-                        PL_strlen(testExtensionOID)) != SECSuccess) {
-      return nullptr;
-    }
-    DERTemplate oidTemplate[2] = { { DER_OBJECT_ID, 0 }, { 0 } };
-    extension.id.data = nullptr;
-    extension.id.len = 0;
-    if (DER_Encode(aArena, &extension.id, oidTemplate, &oidItem)
-          != SECSuccess) {
-      return nullptr;
-    }
+
+    extension.id.assign(tlv_some_Mozilla_OID, sizeof(tlv_some_Mozilla_OID));
     extension.critical = (aORT == ORTCriticalExtension);
-    static const uint8_t value[2] = { 0x05, 0x00 };
-    extension.value.data = const_cast<uint8_t*>(value);
-    extension.value.len = PR_ARRAY_SIZE(value);
+    extension.value.push_back(0x05); // tag: NULL
+    extension.value.push_back(0x00); // length: 0
     extension.next = nullptr;
     context.extensions = &extension;
   }
@@ -183,19 +172,17 @@ GetOCSPResponseForType(OCSPResponseType aORT, CERTCertificate *aCert,
     return nullptr;
   }
 
-  SECItem* response = CreateEncodedOCSPResponse(context);
-  if (!response) {
+  ByteString response(CreateEncodedOCSPResponse(context));
+  if (response == ENCODING_FAILED) {
     PrintPRError("CreateEncodedOCSPResponse failed");
     return nullptr;
   }
 
-  SECItemArray* arr = SECITEM_AllocArray(aArena, nullptr, 1);
-  if (!arr) {
-    PrintPRError("SECITEM_AllocArray failed");
-    return nullptr;
-  }
-  arr->items[0].data = response->data;
-  arr->items[0].len = response->len;
-
-  return arr;
+  SECItem item = {
+    siBuffer,
+    const_cast<uint8_t*>(response.data()),
+    static_cast<unsigned int>(response.length())
+  };
+  SECItemArray arr = { &item, 1 };
+  return SECITEM_DupArray(aArena, &arr);
 }
diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini
index d996d3844be..89ef56309f8 100644
--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -30,6 +30,13 @@ skip-if = buildapp == "b2g" && processor = "arm"
 [test_sts_holepunch.js]
 [test_sts_ipv4_ipv6.js]
 
+[test_sss_eviction.js]
+[test_sss_readstate.js]
+[test_sss_readstate_empty.js]
+[test_sss_readstate_garbage.js]
+[test_sss_readstate_huge.js]
+[test_sss_savestate.js]
+
 [test_certificate_usages.js]
 [test_ocsp_stapling.js]
 run-sequentially = hardcoded ports
diff --git a/security/manager/tools/PreloadedHPKPins.json b/security/manager/tools/PreloadedHPKPins.json
index 05d1ebb4c4d..ed3b9b798d5 100644
--- a/security/manager/tools/PreloadedHPKPins.json
+++ b/security/manager/tools/PreloadedHPKPins.json
@@ -19,6 +19,10 @@
 //   name: (string) the DNS name of the host in question
 //   include_subdomains: (optional bool) whether subdomains of |name| are also covered
 //   pins: (string) the |name| member of an object in |pinsets|
+//
+// "extra_certs" is a list of base64-encoded certificates. These are used in
+// pinsets that reference certificates not in our root program (for example,
+// Facebook).
 
 // equifax -> aus3
 // Geotrust Primary -> www.mozilla.org
@@ -94,7 +98,7 @@
       ]
     },
     {
-      "name": "mozilla_fxa",
+      "name": "mozilla_services",
       "sha256_hashes": [
         "DigiCert Global Root CA"
       ]
@@ -186,13 +190,12 @@
         "XRamp Global CA Root"
       ]
     },
-    // For pinning tests on pinning.example.com, the certificate must be 'End
-    // Entity Test Cert'
     {
       "name": "facebook",
       "sha256_hashes": [
         "Verisign Class 3 Public Primary Certification Authority - G3",
-        "DigiCert High Assurance EV Root CA"
+        "DigiCert High Assurance EV Root CA",
+        "DigiCert ECC Secure Server CA"
       ]
     }
   ],
@@ -207,15 +210,17 @@
     { "name": "aus4.mozilla.org", "include_subdomains": true,
       "pins": "mozilla", "test_mode": true, "id": 3 },
     { "name": "accounts.firefox.com", "include_subdomains": true,
-      "pins": "mozilla_fxa", "test_mode": false, "id": 4 },
+      "pins": "mozilla_services", "test_mode": false, "id": 4 },
     { "name": "api.accounts.firefox.com", "include_subdomains": true,
-      "pins": "mozilla_fxa", "test_mode": false, "id": 5 },
+      "pins": "mozilla_services", "test_mode": false, "id": 5 },
     { "name": "cdn.mozilla.net", "include_subdomains": true,
       "pins": "mozilla", "test_mode": false },
     { "name": "cdn.mozilla.org", "include_subdomains": true,
       "pins": "mozilla", "test_mode": false },
     { "name": "media.mozilla.com", "include_subdomains": true,
       "pins": "mozilla", "test_mode": false },
+    { "name": "services.mozilla.com", "include_subdomains": true,
+      "pins": "mozilla_services", "test_mode": true },
     { "name": "include-subdomains.pinning.example.com",
       "include_subdomains": true, "pins": "mozilla_test",
       "test_mode": false },
@@ -233,5 +238,10 @@
     // Facebook (not pinned by Chrome)
     { "name": "facebook.com", "include_subdomains": true,
       "pins": "facebook", "test_mode": true }
+  ],
+
+  "extra_certificates": [
+     // DigiCert ECC Secure Server CA (for Facebook)
+     "MIIDrDCCApSgAwIBAgIQCssoukZe5TkIdnRw883GEjANBgkqhkiG9w0BAQwFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaMEwxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJjAkBgNVBAMTHURpZ2lDZXJ0IEVDQyBTZWN1cmUgU2VydmVyIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ghC6nfYJN6gLGSkE85AnCNyqQIKDjc/ITa4jVMU9tWRlUvzlgKNcR7E2Munn17voOZ/WpIRllNv68DLP679Wz9HJOeaBy6Wvqgvu1cYr3GkvXg6HuhbPGtkESvMNCuMo4IBITCCAR0wEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQgYDVR0fBDswOTA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAdBgNVHQ4EFgQUo53mH/naOU/AbuiRy5Wl2jHiCp8wHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDQYJKoZIhvcNAQEMBQADggEBAMeKoENL7HTJxavVHzA1Nm6YVntIrAVjrnuaVyRXzG/63qttnMe2uuzO58pzZNvfBDcKAEmzP58mrZGMIOgfiA4q+2Y3yDDo0sIkp0VILeoBUEoxlBPfjV/aKrtJPGHzecicZpIalir0ezZYoyxBEHQa0+1IttK7igZFcTMQMHp6mCHdJLnsnLWSB62DxsRq+HfmNb4TDydkskO/g+l3VtsIh5RHFPVfKK+jaEyDj2D3loB5hWp2Jp2VDCADjT7ueihlZGak2YPqmXTNbk19HOuNssWvFhtOyPNV6og4ETQdEa8/B6hPatJ0ES8q/HO3X8IVQwVs1n3aAr0im0/T+Xc="
   ]
 }
diff --git a/security/manager/tools/genHPKPStaticPins.js b/security/manager/tools/genHPKPStaticPins.js
index 9798c5abfc6..d16d017828c 100644
--- a/security/manager/tools/genHPKPStaticPins.js
+++ b/security/manager/tools/genHPKPStaticPins.js
@@ -336,7 +336,7 @@ function downloadAndParseChromePins(filename,
 
 // Returns a pair of maps [certNameToSKD, certSKDToName] between cert
 // nicknames and digests of the SPKInfo for the mozilla trust store
-function loadNSSCertinfo(derTestFile) {
+function loadNSSCertinfo(derTestFile, extraCertificates) {
   let allCerts = gCertDB.getCerts();
   let enumerator = allCerts.getEnumerator();
   let certNameToSKD = {};
@@ -351,6 +351,14 @@ function loadNSSCertinfo(derTestFile) {
     certNameToSKD[name] = SKD;
     certSKDToName[SKD] = name;
   }
+
+  for (let cert of extraCertificates) {
+    let name = cert.commonName;
+    let SKD = cert.sha256SubjectPublicKeyInfoDigest;
+    certNameToSKD[name] = SKD;
+    certSKDToName[SKD] = name;
+  }
+
   {
     // A certificate for *.example.com.
     let der = readFileToString(derTestFile);
@@ -545,7 +553,17 @@ function writeFile(certNameToSKD, certSKDToName,
   writeString(genExpirationTime());
 }
 
-let [ certNameToSKD, certSKDToName ] = loadNSSCertinfo(gTestCertFile);
+function loadExtraCertificates(certStringList) {
+  let constructedCerts = [];
+  for (let certString of certStringList) {
+    constructedCerts.push(gCertDB.constructX509FromBase64(certString));
+  }
+  return constructedCerts;
+}
+
+let extraCertificates = loadExtraCertificates(gStaticPins.extra_certificates);
+let [ certNameToSKD, certSKDToName ] = loadNSSCertinfo(gTestCertFile,
+                                                       extraCertificates);
 let [ chromeNameToHash, chromeNameToMozName ] = downloadAndParseChromeCerts(
   gStaticPins.chromium_data.cert_file_url, certSKDToName);
 let [ chromeImportedPinsets, chromeImportedEntries ] =
diff --git a/security/nss/TAG-INFO b/security/nss/TAG-INFO
index ed396fe3bea..d7e1cc8a1a7 100644
--- a/security/nss/TAG-INFO
+++ b/security/nss/TAG-INFO
@@ -1 +1 @@
-NSS_3_17_1_BETA1
+NSS_3_17_1_BETA2
diff --git a/security/nss/coreconf/Linux.mk b/security/nss/coreconf/Linux.mk
index 6567f25fd26..177a3c87411 100644
--- a/security/nss/coreconf/Linux.mk
+++ b/security/nss/coreconf/Linux.mk
@@ -42,7 +42,7 @@ ifndef INTERNAL_TOOLS
 	CROSS_COMPILE = 1
 endif
 endif
-ifeq ($(OS_TEST),ppc64)
+ifeq (,$(filter-out ppc64 ppc64le,$(OS_TEST)))
 	CPU_ARCH	= ppc
 ifeq ($(USE_64),1)
 	ARCHFLAG	= -m64
diff --git a/security/nss/coreconf/WIN32.mk b/security/nss/coreconf/WIN32.mk
index 570d409e8d2..da8c9bf8b26 100644
--- a/security/nss/coreconf/WIN32.mk
+++ b/security/nss/coreconf/WIN32.mk
@@ -30,9 +30,16 @@ else
 	BSDECHO      = echo
 	RC           = rc.exe
 	MT           = mt.exe
+	# Check for clang-cl
+	CLANG_CL    := $(shell expr `$(CC) -? 2>&1 | grep -w clang | wc -l` \> 0)
 	# Determine compiler version
-	CC_VERSION  := $(shell $(CC) 2>&1 | sed -ne \
+	ifeq ($(CLANG_CL),1)
+	    # clang-cl pretends to be MSVC 2012.
+	    CC_VERSION  := 17.00.00.00
+	else
+	    CC_VERSION  := $(shell $(CC) 2>&1 | sed -ne \
 		's|.* \([0-9]\+\.[0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?\).*|\1|p')
+	endif
 	# Change the dots to spaces.
 	_CC_VERSION_WORDS := $(subst ., ,$(CC_VERSION))
 	_CC_VMAJOR  := $(word 1,$(_CC_VERSION_WORDS))
@@ -203,12 +210,18 @@ endif
 ifeq (,$(filter-out x386 x86_64,$(CPU_ARCH)))
 ifdef USE_64
 	DEFINES += -D_AMD64_
+	# Use subsystem 5.02 to allow running on Windows XP.
+	ifeq ($(_MSC_VER_GE_11),1)
+		LDFLAGS += -SUBSYSTEM:CONSOLE,5.02
+	endif
 else
 	DEFINES += -D_X86_
 	# VS2012 defaults to -arch:SSE2. Use -arch:IA32 to avoid requiring
 	# SSE2.
+	# Use subsystem 5.01 to allow running on Windows XP.
 	ifeq ($(_MSC_VER_GE_11),1)
 		OS_CFLAGS += -arch:IA32
+		LDFLAGS += -SUBSYSTEM:CONSOLE,5.01
 	endif
 endif
 endif
diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep
index 5182f75552c..590d1bfaeee 100644
--- a/security/nss/coreconf/coreconf.dep
+++ b/security/nss/coreconf/coreconf.dep
@@ -10,3 +10,4 @@
  */
 
 #error "Do not include this header file."
+
diff --git a/security/nss/lib/cryptohi/secsign.c b/security/nss/lib/cryptohi/secsign.c
index 2ea337b38e4..f2bd229f8be 100644
--- a/security/nss/lib/cryptohi/secsign.c
+++ b/security/nss/lib/cryptohi/secsign.c
@@ -445,11 +445,11 @@ SEC_GetSignatureAlgorithmOidTag(KeyType keyType, SECOidTag hashAlgTag)
 	    sigTag = SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION;	break;
 	case SEC_OID_MD5:
 	    sigTag = SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION;	break;
-	case SEC_OID_UNKNOWN:	/* default for RSA if not specified */
 	case SEC_OID_SHA1:
 	    sigTag = SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION;	break;
 	case SEC_OID_SHA224:
 	    sigTag = SEC_OID_PKCS1_SHA224_WITH_RSA_ENCRYPTION;	break;
+	case SEC_OID_UNKNOWN:	/* default for RSA if not specified */
 	case SEC_OID_SHA256:
 	    sigTag = SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION;	break;
 	case SEC_OID_SHA384:
diff --git a/security/nss/lib/freebl/Makefile b/security/nss/lib/freebl/Makefile
index ec6a7698d0c..68fcddfe9a7 100644
--- a/security/nss/lib/freebl/Makefile
+++ b/security/nss/lib/freebl/Makefile
@@ -141,6 +141,9 @@ else
 	DEFINES += -DUSE_HW_AES -DINTEL_GCM
 	ASFILES += intel-aes-x86-masm.asm intel-gcm-x86-masm.asm
 	EXTRA_SRCS += intel-gcm-wrap.c
+	ifeq ($(CLANG_CL),1)
+	    INTEL_GCM_CLANG_CL = 1
+	endif
     endif
 endif
 else
@@ -668,3 +671,10 @@ ifneq (,$(findstring clang,$(shell $(AS) --version)))
 $(OBJDIR)/$(PROG_PREFIX)intel-gcm$(OBJ_SUFFIX): ASFLAGS += -no-integrated-as
 endif
 endif
+
+ifdef INTEL_GCM_CLANG_CL
+#
+# clang-cl needs -mssse3
+#
+$(OBJDIR)/$(PROG_PREFIX)intel-gcm-wrap$(OBJ_SUFFIX): CFLAGS += -mssse3
+endif
diff --git a/security/pkix/include/pkix/Input.h b/security/pkix/include/pkix/Input.h
index ccd4fc51879..8fb3b4b0ee4 100644
--- a/security/pkix/include/pkix/Input.h
+++ b/security/pkix/include/pkix/Input.h
@@ -155,6 +155,16 @@ public:
   {
   }
 
+  Result Init(Input input)
+  {
+    if (this->input) {
+      return Result::FATAL_ERROR_INVALID_ARGS;
+    }
+    this->input = input.UnsafeGetData();
+    this->end = input.UnsafeGetData() + input.GetLength();
+    return Success;
+  }
+
   bool Peek(uint8_t expectedByte) const
   {
     return input < end && *input == expectedByte;
diff --git a/security/pkix/lib/pkixder.cpp b/security/pkix/lib/pkixder.cpp
index 3fc3f1f9d6e..5fbe70c319a 100644
--- a/security/pkix/lib/pkixder.cpp
+++ b/security/pkix/lib/pkixder.cpp
@@ -29,25 +29,22 @@
 
 namespace mozilla { namespace pkix { namespace der {
 
-namespace internal {
-
 // Too complicated to be inline
 Result
-ExpectTagAndGetLength(Reader& input, uint8_t expectedTag, uint16_t& length)
+ReadTagAndGetValue(Reader& input, /*out*/ uint8_t& tag, /*out*/ Input& value)
 {
-  assert((expectedTag & 0x1F) != 0x1F); // high tag number form not allowed
-
-  uint8_t tag;
   Result rv;
+
   rv = input.Read(tag);
   if (rv != Success) {
     return rv;
   }
-
-  if (tag != expectedTag) {
-    return Result::ERROR_BAD_DER;
+  if ((tag & 0x1F) == 0x1F) {
+    return Result::ERROR_BAD_DER; // high tag number form not allowed
   }
 
+  uint16_t length;
+
   // The short form of length is a single byte with the high order bit set
   // to zero. The long form of length is one byte with the high order bit
   // set, followed by N bytes, where N is encoded in the lowest 7 bits of
@@ -84,12 +81,9 @@ ExpectTagAndGetLength(Reader& input, uint8_t expectedTag, uint16_t& length)
     return Result::ERROR_BAD_DER;
   }
 
-  // Ensure the input is long enough for the length it says it has.
-  return input.EnsureLength(length);
+  return input.Skip(length, value);
 }
 
-} // namespace internal
-
 static Result
 OptionalNull(Reader& input)
 {
diff --git a/security/pkix/lib/pkixder.h b/security/pkix/lib/pkixder.h
index 577edf68714..e6590d46d0d 100644
--- a/security/pkix/lib/pkixder.h
+++ b/security/pkix/lib/pkixder.h
@@ -64,73 +64,60 @@ enum Tag
   NULLTag = UNIVERSAL | 0x05,
   OIDTag = UNIVERSAL | 0x06,
   ENUMERATED = UNIVERSAL | 0x0a,
+  UTF8String = UNIVERSAL | 0x0c,
   SEQUENCE = UNIVERSAL | CONSTRUCTED | 0x10, // 0x30
+  SET = UNIVERSAL | CONSTRUCTED | 0x11, // 0x31
   UTCTime = UNIVERSAL | 0x17,
   GENERALIZED_TIME = UNIVERSAL | 0x18,
 };
 
 MOZILLA_PKIX_ENUM_CLASS EmptyAllowed { No = 0, Yes = 1 };
 
-inline Result
-ExpectTagAndLength(Reader& input, uint8_t expectedTag, uint8_t expectedLength)
-{
-  assert((expectedTag & 0x1F) != 0x1F); // high tag number form not allowed
-  assert(expectedLength < 128); // must be a single-byte length
-
-  uint16_t tagAndLength;
-  Result rv = input.Read(tagAndLength);
-  if (rv != Success) {
-    return rv;
-  }
-
-  uint16_t expectedTagAndLength = static_cast<uint16_t>(expectedTag << 8);
-  expectedTagAndLength |= expectedLength;
-
-  if (tagAndLength != expectedTagAndLength) {
-    return Result::ERROR_BAD_DER;
-  }
-
-  return Success;
-}
-
-namespace internal {
-
-Result
-ExpectTagAndGetLength(Reader& input, uint8_t expectedTag, uint16_t& length);
-
-} // namespace internal
-
-inline Result
-ExpectTagAndSkipValue(Reader& input, uint8_t tag)
-{
-  uint16_t length;
-  Result rv = internal::ExpectTagAndGetLength(input, tag, length);
-  if (rv != Success) {
-    return rv;
-  }
-  return input.Skip(length);
-}
+Result ReadTagAndGetValue(Reader& input, /*out*/ uint8_t& tag,
+                          /*out*/ Input& value);
+Result End(Reader& input);
 
 inline Result
 ExpectTagAndGetValue(Reader& input, uint8_t tag, /*out*/ Input& value)
 {
-  uint16_t length;
-  Result rv = internal::ExpectTagAndGetLength(input, tag, length);
+  uint8_t actualTag;
+  Result rv = ReadTagAndGetValue(input, actualTag, value);
   if (rv != Success) {
     return rv;
   }
-  return input.Skip(length, value);
+  if (tag != actualTag) {
+    return Result::ERROR_BAD_DER;
+  }
+  return Success;
 }
 
 inline Result
 ExpectTagAndGetValue(Reader& input, uint8_t tag, /*out*/ Reader& value)
 {
-  uint16_t length;
-  Result rv = internal::ExpectTagAndGetLength(input, tag, length);
+  Input valueInput;
+  Result rv = ExpectTagAndGetValue(input, tag, valueInput);
   if (rv != Success) {
     return rv;
   }
-  return input.Skip(length, value);
+  return value.Init(valueInput);
+}
+
+inline Result
+ExpectTagAndEmptyValue(Reader& input, uint8_t tag)
+{
+  Reader value;
+  Result rv = ExpectTagAndGetValue(input, tag, value);
+  if (rv != Success) {
+    return rv;
+  }
+  return End(value);
+}
+
+inline Result
+ExpectTagAndSkipValue(Reader& input, uint8_t tag)
+{
+  Input ignoredValue;
+  return ExpectTagAndGetValue(input, tag, ignoredValue);
 }
 
 // Like ExpectTagAndGetValue, except the output Input will contain the
@@ -139,12 +126,7 @@ inline Result
 ExpectTagAndGetTLV(Reader& input, uint8_t tag, /*out*/ Input& tlv)
 {
   Reader::Mark mark(input.GetMark());
-  uint16_t length;
-  Result rv = internal::ExpectTagAndGetLength(input, tag, length);
-  if (rv != Success) {
-    return rv;
-  }
-  rv = input.Skip(length);
+  Result rv = ExpectTagAndSkipValue(input, tag);
   if (rv != Success) {
     return rv;
   }
@@ -253,12 +235,13 @@ IntegralValue(Reader& input, uint8_t tag, T& value)
   // Conveniently, all the Integers that we actually have to be able to parse
   // are positive and very small. Consequently, this parser is *much* simpler
   // than a general Integer parser would need to be.
-  Result rv = ExpectTagAndLength(input, tag, 1);
+  Reader valueReader;
+  Result rv = ExpectTagAndGetValue(input, tag, valueReader);
   if (rv != Success) {
     return rv;
   }
   uint8_t valueByte;
-  rv = input.Read(valueByte);
+  rv = valueReader.Read(valueByte);
   if (rv != Success) {
     return rv;
   }
@@ -266,7 +249,7 @@ IntegralValue(Reader& input, uint8_t tag, T& value)
     return Result::ERROR_BAD_DER;
   }
   value = valueByte;
-  return Success;
+  return End(valueReader);
 }
 
 } // namespace internal
@@ -277,13 +260,18 @@ BitStringWithNoUnusedBits(Reader& input, /*out*/ Input& value);
 inline Result
 Boolean(Reader& input, /*out*/ bool& value)
 {
-  Result rv = ExpectTagAndLength(input, BOOLEAN, 1);
+  Reader valueReader;
+  Result rv = ExpectTagAndGetValue(input, BOOLEAN, valueReader);
   if (rv != Success) {
     return rv;
   }
 
   uint8_t intValue;
-  rv = input.Read(intValue);
+  rv = valueReader.Read(intValue);
+  if (rv != Success) {
+    return rv;
+  }
+  rv = End(valueReader);
   if (rv != Success) {
     return rv;
   }
@@ -393,7 +381,7 @@ OptionalInteger(Reader& input, long defaultValue, /*out*/ long& value)
 inline Result
 Null(Reader& input)
 {
-  return ExpectTagAndLength(input, NULLTag, 0);
+  return ExpectTagAndEmptyValue(input, NULLTag);
 }
 
 template <uint8_t Len>
diff --git a/security/pkix/lib/pkixocsp.cpp b/security/pkix/lib/pkixocsp.cpp
index aafb0ba07af..2a3772a5e1c 100644
--- a/security/pkix/lib/pkixocsp.cpp
+++ b/security/pkix/lib/pkixocsp.cpp
@@ -552,8 +552,8 @@ SingleResponse(Reader& input, Context& context)
   // * revoked overrides good and unknown
   // * good overrides unknown
   if (input.Peek(static_cast<uint8_t>(CertStatus::Good))) {
-    rv = der::ExpectTagAndLength(input, static_cast<uint8_t>(CertStatus::Good),
-                                 0);
+    rv = der::ExpectTagAndEmptyValue(input,
+                                     static_cast<uint8_t>(CertStatus::Good));
     if (rv != Success) {
       return rv;
     }
@@ -572,8 +572,8 @@ SingleResponse(Reader& input, Context& context)
     }
     context.certStatus = CertStatus::Revoked;
   } else {
-    rv = der::ExpectTagAndLength(input,
-                                 static_cast<uint8_t>(CertStatus::Unknown), 0);
+    rv = der::ExpectTagAndEmptyValue(input,
+                                     static_cast<uint8_t>(CertStatus::Unknown));
     if (rv != Success) {
       return rv;
     }
diff --git a/security/pkix/test/gtest/nssgtest.cpp b/security/pkix/test/gtest/nssgtest.cpp
index 1c708abe6b6..85bc796eef2 100644
--- a/security/pkix/test/gtest/nssgtest.cpp
+++ b/security/pkix/test/gtest/nssgtest.cpp
@@ -39,14 +39,6 @@ NSSTest::SetUpTestCase()
   }
 }
 
-NSSTest::NSSTest()
-  : arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE))
-{
-  if (!arena) {
-    abort();
-  }
-}
-
 // This assumes that time/time_t are POSIX-compliant in that time() returns
 // the number of seconds since the Unix epoch.
 const std::time_t now(time(nullptr));
diff --git a/security/pkix/test/gtest/nssgtest.h b/security/pkix/test/gtest/nssgtest.h
index 82e27d824a8..4c4a8ef62fa 100644
--- a/security/pkix/test/gtest/nssgtest.h
+++ b/security/pkix/test/gtest/nssgtest.h
@@ -35,25 +35,10 @@ extern const std::time_t now;
 extern const std::time_t oneDayBeforeNow;
 extern const std::time_t oneDayAfterNow;
 
-inline void
-PORT_FreeArena_false(PLArenaPool* arena)
-{
-  // PL_FreeArenaPool can't be used because it doesn't actually free the
-  // memory, which doesn't work well with memory analysis tools
-  return PORT_FreeArena(arena, PR_FALSE);
-}
-
-typedef ScopedPtr<PLArenaPool, PORT_FreeArena_false> ScopedPLArenaPool;
-
 class NSSTest : public ::testing::Test
 {
 public:
   static void SetUpTestCase();
-
-protected:
-  NSSTest();
-
-  ScopedPLArenaPool arena;
 };
 
 } } } // namespace mozilla::pkix::test
diff --git a/security/pkix/test/gtest/pkixbuild_tests.cpp b/security/pkix/test/gtest/pkixbuild_tests.cpp
index 1ece58a7a6c..c5c9e2e5bf4 100644
--- a/security/pkix/test/gtest/pkixbuild_tests.cpp
+++ b/security/pkix/test/gtest/pkixbuild_tests.cpp
@@ -38,46 +38,51 @@ typedef ScopedPtr<CERTCertificate, CERT_DestroyCertificate>
           ScopedCERTCertificate;
 typedef ScopedPtr<CERTCertList, CERT_DestroyCertList> ScopedCERTCertList;
 
-// The result is owned by the arena
-static Input
-CreateCert(PLArenaPool* arena, const char* issuerStr,
-           const char* subjectStr, EndEntityOrCA endEntityOrCA,
+static ByteString
+CreateCert(const char* issuerCN,
+           const char* subjectCN,
+           EndEntityOrCA endEntityOrCA,
            /*optional*/ SECKEYPrivateKey* issuerKey,
            /*out*/ ScopedSECKEYPrivateKey& subjectKey,
            /*out*/ ScopedCERTCertificate* subjectCert = nullptr)
 {
   static long serialNumberValue = 0;
   ++serialNumberValue;
-  const SECItem* serialNumber(CreateEncodedSerialNumber(arena,
-                                                        serialNumberValue));
-  EXPECT_TRUE(serialNumber);
-  const SECItem* issuerDER(ASCIIToDERName(arena, issuerStr));
-  EXPECT_TRUE(issuerDER);
-  const SECItem* subjectDER(ASCIIToDERName(arena, subjectStr));
-  EXPECT_TRUE(subjectDER);
+  ByteString serialNumber(CreateEncodedSerialNumber(serialNumberValue));
+  EXPECT_NE(ENCODING_FAILED, serialNumber);
 
-  const SECItem* extensions[2] = { nullptr, nullptr };
+  ByteString issuerDER(CNToDERName(issuerCN));
+  EXPECT_NE(ENCODING_FAILED, issuerDER);
+  ByteString subjectDER(CNToDERName(subjectCN));
+  EXPECT_NE(ENCODING_FAILED, subjectDER);
+
+  ByteString extensions[2];
   if (endEntityOrCA == EndEntityOrCA::MustBeCA) {
     extensions[0] =
-      CreateEncodedBasicConstraints(arena, true, nullptr,
+      CreateEncodedBasicConstraints(true, nullptr,
                                     ExtensionCriticality::Critical);
-    EXPECT_TRUE(extensions[0]);
+    EXPECT_NE(ENCODING_FAILED, extensions[0]);
   }
 
-  SECItem* certDER(CreateEncodedCertificate(
-                     arena, v3, SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION,
-                     serialNumber, issuerDER, oneDayBeforeNow, oneDayAfterNow,
-                     subjectDER, extensions, issuerKey, SEC_OID_SHA256,
-                     subjectKey));
-  EXPECT_TRUE(certDER);
+  ByteString certDER(CreateEncodedCertificate(
+                       v3, sha256WithRSAEncryption,
+                       serialNumber, issuerDER,
+                       oneDayBeforeNow, oneDayAfterNow,
+                       subjectDER, extensions, issuerKey,
+                       SignatureAlgorithm::rsa_pkcs1_with_sha256,
+                       subjectKey));
+  EXPECT_NE(ENCODING_FAILED, certDER);
   if (subjectCert) {
-    *subjectCert = CERT_NewTempCertificate(CERT_GetDefaultCertDB(), certDER,
-                                           nullptr, false, true);
+    SECItem certDERItem = {
+      siBuffer,
+      const_cast<uint8_t*>(certDER.data()),
+      static_cast<unsigned int>(certDER.length())
+    };
+    *subjectCert = CERT_NewTempCertificate(CERT_GetDefaultCertDB(),
+                                           &certDERItem, nullptr, false, true);
     EXPECT_TRUE(*subjectCert);
   }
-  Input result;
-  EXPECT_EQ(Success, result.Init(certDER->data, certDER->len));
-  return result;
+  return certDER;
 }
 
 class TestTrustDomain : public TrustDomain
@@ -89,25 +94,17 @@ public:
   bool SetUpCertChainTail()
   {
     static char const* const names[] = {
-        "CN=CA1 (Root)", "CN=CA2", "CN=CA3", "CN=CA4", "CN=CA5", "CN=CA6",
-        "CN=CA7"
+        "CA1 (Root)", "CA2", "CA3", "CA4", "CA5", "CA6", "CA7"
     };
 
     static_assert(MOZILLA_PKIX_ARRAY_LENGTH(names) ==
                     MOZILLA_PKIX_ARRAY_LENGTH(certChainTail),
                   "mismatch in sizes of names and certChainTail arrays");
 
-    ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
-    if (!arena) {
-      return false;
-    }
-
     for (size_t i = 0; i < MOZILLA_PKIX_ARRAY_LENGTH(names); ++i) {
-      const char* issuerName = i == 0 ? names[0]
-                                      : certChainTail[i - 1]->subjectName;
-      (void) CreateCert(arena.get(), issuerName, names[i],
-                 EndEntityOrCA::MustBeCA, leafCAKey.get(), leafCAKey,
-                 &certChainTail[i]);
+      const char* issuerName = i == 0 ? names[0] : names[i-1];
+      (void) CreateCert(issuerName, names[i], EndEntityOrCA::MustBeCA,
+                        leafCAKey.get(), leafCAKey, &certChainTail[i]);
     }
 
     return true;
@@ -243,13 +240,14 @@ TEST_F(pkixbuild, MaxAcceptableCertChainLength)
   {
     ScopedSECKEYPrivateKey privateKey;
     ScopedCERTCertificate cert;
-    Input certDER(CreateCert(arena.get(),
-                             trustDomain.GetLeafCACert()->subjectName,
-                             "CN=Direct End-Entity",
-                             EndEntityOrCA::MustBeEndEntity,
-                             trustDomain.leafCAKey.get(), privateKey));
+    ByteString certDER(CreateCert("CA7", "Direct End-Entity",
+                                  EndEntityOrCA::MustBeEndEntity,
+                                  trustDomain.leafCAKey.get(), privateKey));
+    ASSERT_NE(ENCODING_FAILED, certDER);
+    Input certDERInput;
+    ASSERT_EQ(Success, certDERInput.Init(certDER.data(), certDER.length()));
     ASSERT_EQ(Success,
-              BuildCertChain(trustDomain, certDER, Now(),
+              BuildCertChain(trustDomain, certDERInput, Now(),
                              EndEntityOrCA::MustBeEndEntity,
                              KeyUsage::noParticularKeyUsageRequired,
                              KeyPurposeId::id_kp_serverAuth,
@@ -260,7 +258,7 @@ TEST_F(pkixbuild, MaxAcceptableCertChainLength)
 
 TEST_F(pkixbuild, BeyondMaxAcceptableCertChainLength)
 {
-  static char const* const caCertName = "CN=CA Too Far";
+  static char const* const caCertName = "CA Too Far";
   ScopedSECKEYPrivateKey caPrivateKey;
 
   // We need a CERTCertificate for caCert so that the trustdomain's FindIssuer
@@ -268,13 +266,14 @@ TEST_F(pkixbuild, BeyondMaxAcceptableCertChainLength)
   ScopedCERTCertificate caCert;
 
   {
-    Input cert(CreateCert(arena.get(),
-                          trustDomain.GetLeafCACert()->subjectName,
-                          caCertName, EndEntityOrCA::MustBeCA,
-                          trustDomain.leafCAKey.get(), caPrivateKey,
-                          &caCert));
+    ByteString certDER(CreateCert("CA7", caCertName, EndEntityOrCA::MustBeCA,
+                                  trustDomain.leafCAKey.get(), caPrivateKey,
+                                  &caCert));
+    ASSERT_NE(ENCODING_FAILED, certDER);
+    Input certDERInput;
+    ASSERT_EQ(Success, certDERInput.Init(certDER.data(), certDER.length()));
     ASSERT_EQ(Result::ERROR_UNKNOWN_ISSUER,
-              BuildCertChain(trustDomain, cert, Now(),
+              BuildCertChain(trustDomain, certDERInput, Now(),
                              EndEntityOrCA::MustBeCA,
                              KeyUsage::noParticularKeyUsageRequired,
                              KeyPurposeId::id_kp_serverAuth,
@@ -284,12 +283,14 @@ TEST_F(pkixbuild, BeyondMaxAcceptableCertChainLength)
 
   {
     ScopedSECKEYPrivateKey privateKey;
-    Input cert(CreateCert(arena.get(), caCertName,
-                          "CN=End-Entity Too Far",
-                          EndEntityOrCA::MustBeEndEntity,
-                          caPrivateKey.get(), privateKey));
+    ByteString certDER(CreateCert(caCertName, "End-Entity Too Far",
+                                  EndEntityOrCA::MustBeEndEntity,
+                                  caPrivateKey.get(), privateKey));
+    ASSERT_NE(ENCODING_FAILED, certDER);
+    Input certDERInput;
+    ASSERT_EQ(Success, certDERInput.Init(certDER.data(), certDER.length()));
     ASSERT_EQ(Result::ERROR_UNKNOWN_ISSUER,
-              BuildCertChain(trustDomain, cert, Now(),
+              BuildCertChain(trustDomain, certDERInput, Now(),
                              EndEntityOrCA::MustBeEndEntity,
                              KeyUsage::noParticularKeyUsageRequired,
                              KeyPurposeId::id_kp_serverAuth,
diff --git a/security/pkix/test/gtest/pkixcert_extension_tests.cpp b/security/pkix/test/gtest/pkixcert_extension_tests.cpp
index 213ea038c25..fb7a80821aa 100644
--- a/security/pkix/test/gtest/pkixcert_extension_tests.cpp
+++ b/security/pkix/test/gtest/pkixcert_extension_tests.cpp
@@ -32,41 +32,36 @@ using namespace mozilla::pkix;
 using namespace mozilla::pkix::test;
 
 // Creates a self-signed certificate with the given extension.
-static Input
-CreateCert(PLArenaPool* arena, const char* subjectStr,
-           SECItem const* const* extensions, // null-terminated array
+static ByteString
+CreateCert(const char* subjectCN,
+           const ByteString* extensions, // empty-string-terminated array
            /*out*/ ScopedSECKEYPrivateKey& subjectKey)
 {
   static long serialNumberValue = 0;
   ++serialNumberValue;
-  const SECItem* serialNumber(CreateEncodedSerialNumber(arena,
-                                                        serialNumberValue));
-  EXPECT_TRUE(serialNumber);
-  const SECItem* issuerDER(ASCIIToDERName(arena, subjectStr));
-  EXPECT_TRUE(issuerDER);
-  const SECItem* subjectDER(ASCIIToDERName(arena, subjectStr));
-  EXPECT_TRUE(subjectDER);
-  SECItem* cert = CreateEncodedCertificate(
-                                  arena, v3,
-                                  SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION,
+  ByteString serialNumber(CreateEncodedSerialNumber(serialNumberValue));
+  EXPECT_NE(ENCODING_FAILED, serialNumber);
+  ByteString issuerDER(CNToDERName(subjectCN));
+  EXPECT_NE(ENCODING_FAILED, issuerDER);
+  ByteString subjectDER(CNToDERName(subjectCN));
+  EXPECT_NE(ENCODING_FAILED, subjectDER);
+  return CreateEncodedCertificate(v3, sha256WithRSAEncryption,
                                   serialNumber, issuerDER,
                                   oneDayBeforeNow, oneDayAfterNow,
                                   subjectDER, extensions,
-                                  nullptr, SEC_OID_SHA256, subjectKey);
-  EXPECT_TRUE(cert);
-  Input result;
-  EXPECT_EQ(Success, result.Init(cert->data, cert->len));
-  return result;
+                                  nullptr,
+                                  SignatureAlgorithm::rsa_pkcs1_with_sha256,
+                                  subjectKey);
 }
 
 // Creates a self-signed certificate with the given extension.
-static Input
-CreateCert(PLArenaPool* arena, const char* subjectStr,
-           const SECItem* extension,
+static ByteString
+CreateCert(const char* subjectStr,
+           const ByteString& extension,
            /*out*/ ScopedSECKEYPrivateKey& subjectKey)
 {
-  const SECItem * extensions[] = { extension, nullptr };
-  return CreateCert(arena, subjectStr, extensions, subjectKey);
+  const ByteString extensions[] = { extension, ByteString() };
+  return CreateCert(subjectStr, extensions, subjectKey);
 }
 
 class TrustEverythingTrustDomain : public TrustDomain
@@ -146,18 +141,17 @@ TEST_F(pkixcert_extension, UnknownCriticalExtension)
       0x01, 0x01, 0xff, // BOOLEAN (length = 1) TRUE
       0x04, 0x00 // OCTET STRING (length = 0)
   };
-  static const SECItem unknownCriticalExtension = {
-    siBuffer,
-    const_cast<unsigned char*>(unknownCriticalExtensionBytes),
-    sizeof(unknownCriticalExtensionBytes)
-  };
-  const char* certCN = "CN=Cert With Unknown Critical Extension";
+  static const ByteString
+    unknownCriticalExtension(unknownCriticalExtensionBytes,
+                             sizeof(unknownCriticalExtensionBytes));
+  const char* certCN = "Cert With Unknown Critical Extension";
   ScopedSECKEYPrivateKey key;
-  // cert is owned by the arena
-  Input cert(CreateCert(arena.get(), certCN,
-                              &unknownCriticalExtension, key));
+  ByteString cert(CreateCert(certCN, unknownCriticalExtension, key));
+  ASSERT_NE(ENCODING_FAILED, cert);
+  Input certInput;
+  ASSERT_EQ(Success, certInput.Init(cert.data(), cert.length()));
   ASSERT_EQ(Result::ERROR_UNKNOWN_CRITICAL_EXTENSION,
-            BuildCertChain(trustDomain, cert, Now(),
+            BuildCertChain(trustDomain, certInput, Now(),
                            EndEntityOrCA::MustBeEndEntity,
                            KeyUsage::noParticularKeyUsageRequired,
                            KeyPurposeId::anyExtendedKeyUsage,
@@ -177,18 +171,17 @@ TEST_F(pkixcert_extension, UnknownNonCriticalExtension)
         0x85, 0x1a, 0x85, 0x1a, 0x01, 0x83, 0x74, 0x09, 0x03,
       0x04, 0x00 // OCTET STRING (length = 0)
   };
-  static const SECItem unknownNonCriticalExtension = {
-    siBuffer,
-    const_cast<unsigned char*>(unknownNonCriticalExtensionBytes),
-    sizeof(unknownNonCriticalExtensionBytes)
-  };
-  const char* certCN = "CN=Cert With Unknown NonCritical Extension";
+  static const ByteString
+    unknownNonCriticalExtension(unknownNonCriticalExtensionBytes,
+                                sizeof(unknownNonCriticalExtensionBytes));
+  const char* certCN = "Cert With Unknown NonCritical Extension";
   ScopedSECKEYPrivateKey key;
-  // cert is owned by the arena
-  Input cert(CreateCert(arena.get(), certCN,
-                              &unknownNonCriticalExtension, key));
+  ByteString cert(CreateCert(certCN, unknownNonCriticalExtension, key));
+  ASSERT_NE(ENCODING_FAILED, cert);
+  Input certInput;
+  ASSERT_EQ(Success, certInput.Init(cert.data(), cert.length()));
   ASSERT_EQ(Success,
-            BuildCertChain(trustDomain, cert, Now(),
+            BuildCertChain(trustDomain, certInput, Now(),
                            EndEntityOrCA::MustBeEndEntity,
                            KeyUsage::noParticularKeyUsageRequired,
                            KeyPurposeId::anyExtendedKeyUsage,
@@ -209,18 +202,17 @@ TEST_F(pkixcert_extension, WrongOIDCriticalExtension)
       0x01, 0x01, 0xff, // BOOLEAN (length = 1) TRUE
       0x04, 0x00 // OCTET STRING (length = 0)
   };
-  static const SECItem wrongOIDCriticalExtension = {
-    siBuffer,
-    const_cast<unsigned char*>(wrongOIDCriticalExtensionBytes),
-    sizeof(wrongOIDCriticalExtensionBytes)
-  };
-  const char* certCN = "CN=Cert With Critical Wrong OID Extension";
+  static const ByteString
+    wrongOIDCriticalExtension(wrongOIDCriticalExtensionBytes,
+                              sizeof(wrongOIDCriticalExtensionBytes));
+  const char* certCN = "Cert With Critical Wrong OID Extension";
   ScopedSECKEYPrivateKey key;
-  // cert is owned by the arena
-  Input cert(CreateCert(arena.get(), certCN,
-                              &wrongOIDCriticalExtension, key));
+  ByteString cert(CreateCert(certCN, wrongOIDCriticalExtension, key));
+  ASSERT_NE(ENCODING_FAILED, cert);
+  Input certInput;
+  ASSERT_EQ(Success, certInput.Init(cert.data(), cert.length()));
   ASSERT_EQ(Result::ERROR_UNKNOWN_CRITICAL_EXTENSION,
-            BuildCertChain(trustDomain, cert, Now(),
+            BuildCertChain(trustDomain, certInput, Now(),
                            EndEntityOrCA::MustBeEndEntity,
                            KeyUsage::noParticularKeyUsageRequired,
                            KeyPurposeId::anyExtendedKeyUsage,
@@ -243,17 +235,17 @@ TEST_F(pkixcert_extension, CriticalAIAExtension)
       0x04, 0x02, // OCTET STRING (length = 2)
         0x30, 0x00, // SEQUENCE (length = 0)
   };
-  static const SECItem criticalAIAExtension = {
-    siBuffer,
-    const_cast<unsigned char*>(criticalAIAExtensionBytes),
-    sizeof(criticalAIAExtensionBytes)
-  };
-  const char* certCN = "CN=Cert With Critical AIA Extension";
+  static const ByteString
+    criticalAIAExtension(criticalAIAExtensionBytes,
+                         sizeof(criticalAIAExtensionBytes));
+  const char* certCN = "Cert With Critical AIA Extension";
   ScopedSECKEYPrivateKey key;
-  // cert is owned by the arena
-  Input cert(CreateCert(arena.get(), certCN, &criticalAIAExtension, key));
+  ByteString cert(CreateCert(certCN, criticalAIAExtension, key));
+  ASSERT_NE(ENCODING_FAILED, cert);
+  Input certInput;
+  ASSERT_EQ(Success, certInput.Init(cert.data(), cert.length()));
   ASSERT_EQ(Success,
-            BuildCertChain(trustDomain, cert, Now(),
+            BuildCertChain(trustDomain, certInput, Now(),
                            EndEntityOrCA::MustBeEndEntity,
                            KeyUsage::noParticularKeyUsageRequired,
                            KeyPurposeId::anyExtendedKeyUsage,
@@ -273,18 +265,17 @@ TEST_F(pkixcert_extension, UnknownCriticalCEExtension)
       0x01, 0x01, 0xff, // BOOLEAN (length = 1) TRUE
       0x04, 0x00 // OCTET STRING (length = 0)
   };
-  static const SECItem unknownCriticalCEExtension = {
-    siBuffer,
-    const_cast<unsigned char*>(unknownCriticalCEExtensionBytes),
-    sizeof(unknownCriticalCEExtensionBytes)
-  };
-  const char* certCN = "CN=Cert With Unknown Critical id-ce Extension";
+  static const ByteString
+    unknownCriticalCEExtension(unknownCriticalCEExtensionBytes,
+                               sizeof(unknownCriticalCEExtensionBytes));
+  const char* certCN = "Cert With Unknown Critical id-ce Extension";
   ScopedSECKEYPrivateKey key;
-  // cert is owned by the arena
-  Input cert(CreateCert(arena.get(), certCN,
-                              &unknownCriticalCEExtension, key));
+  ByteString cert(CreateCert(certCN, unknownCriticalCEExtension, key));
+  ASSERT_NE(ENCODING_FAILED, cert);
+  Input certInput;
+  ASSERT_EQ(Success, certInput.Init(cert.data(), cert.length()));
   ASSERT_EQ(Result::ERROR_UNKNOWN_CRITICAL_EXTENSION,
-            BuildCertChain(trustDomain, cert, Now(),
+            BuildCertChain(trustDomain, certInput, Now(),
                            EndEntityOrCA::MustBeEndEntity,
                            KeyUsage::noParticularKeyUsageRequired,
                            KeyPurposeId::anyExtendedKeyUsage,
@@ -304,17 +295,17 @@ TEST_F(pkixcert_extension, KnownCriticalCEExtension)
       0x04, 0x03, // OCTET STRING (length = 3)
         0x02, 0x01, 0x00, // INTEGER (length = 1, value = 0)
   };
-  static const SECItem criticalCEExtension = {
-    siBuffer,
-    const_cast<unsigned char*>(criticalCEExtensionBytes),
-    sizeof(criticalCEExtensionBytes)
-  };
-  const char* certCN = "CN=Cert With Known Critical id-ce Extension";
+  static const ByteString
+    criticalCEExtension(criticalCEExtensionBytes,
+                        sizeof(criticalCEExtensionBytes));
+  const char* certCN = "Cert With Known Critical id-ce Extension";
   ScopedSECKEYPrivateKey key;
-  // cert is owned by the arena
-  Input cert(CreateCert(arena.get(), certCN, &criticalCEExtension, key));
+  ByteString cert(CreateCert(certCN, criticalCEExtension, key));
+  ASSERT_NE(ENCODING_FAILED, cert);
+  Input certInput;
+  ASSERT_EQ(Success, certInput.Init(cert.data(), cert.length()));
   ASSERT_EQ(Success,
-            BuildCertChain(trustDomain, cert, Now(),
+            BuildCertChain(trustDomain, certInput, Now(),
                            EndEntityOrCA::MustBeEndEntity,
                            KeyUsage::noParticularKeyUsageRequired,
                            KeyPurposeId::anyExtendedKeyUsage,
@@ -334,18 +325,16 @@ TEST_F(pkixcert_extension, DuplicateSubjectAltName)
           0x82, 11, // [2] (dNSName) (length = 11)
             'e', 'x', 'a', 'm', 'p', 'l', 'e', '.', 'c', 'o', 'm'
   };
-  static const SECItem DER = {
-    siBuffer,
-    const_cast<unsigned char*>(DER_BYTES),
-    sizeof(DER_BYTES)
-  };
-  static SECItem const* const extensions[] = { &DER, &DER, nullptr };
-  static const char* certCN = "CN=Cert With Duplicate subjectAltName";
+  static const ByteString DER(DER_BYTES, sizeof(DER_BYTES));
+  static const ByteString extensions[] = { DER, DER, ByteString() };
+  static const char* certCN = "Cert With Duplicate subjectAltName";
   ScopedSECKEYPrivateKey key;
-  // cert is owned by the arena
-  Input cert(CreateCert(arena.get(), certCN, extensions, key));
+  ByteString cert(CreateCert(certCN, extensions, key));
+  ASSERT_NE(ENCODING_FAILED, cert);
+  Input certInput;
+  ASSERT_EQ(Success, certInput.Init(cert.data(), cert.length()));
   ASSERT_EQ(Result::ERROR_EXTENSION_VALUE_INVALID,
-            BuildCertChain(trustDomain, cert, Now(),
+            BuildCertChain(trustDomain, certInput, Now(),
                            EndEntityOrCA::MustBeEndEntity,
                            KeyUsage::noParticularKeyUsageRequired,
                            KeyPurposeId::anyExtendedKeyUsage,
diff --git a/security/pkix/test/gtest/pkixder_input_tests.cpp b/security/pkix/test/gtest/pkixder_input_tests.cpp
index 61e5c79d7d5..ff7b16c28e8 100644
--- a/security/pkix/test/gtest/pkixder_input_tests.cpp
+++ b/security/pkix/test/gtest/pkixder_input_tests.cpp
@@ -86,6 +86,8 @@ const uint8_t DER_INT16[] = {
   0x12, 0x34                  // 0x1234
 };
 
+static const Input EMPTY_INPUT;
+
 TEST_F(pkixder_input_tests, InputInit)
 {
   Input buf;
@@ -459,64 +461,67 @@ TEST_F(pkixder_input_tests, MarkAndGetInputDifferentInput)
 }
 #endif
 
-TEST_F(pkixder_input_tests, ExpectTagAndLength)
+TEST_F(pkixder_input_tests, ReadTagAndGetValue_Input_AtEnd)
 {
-  Input buf(DER_SEQUENCE_OF_INT8);
-  Reader input(buf);
-
-  ASSERT_EQ(Success, ExpectTagAndLength(input, SEQUENCE,
-                                        sizeof DER_SEQUENCE_OF_INT8 - 2));
+  Reader input(EMPTY_INPUT);
+  uint8_t tag;
+  Input value;
+  ASSERT_EQ(Result::ERROR_BAD_DER, ReadTagAndGetValue(input, tag, value));
 }
 
-TEST_F(pkixder_input_tests, ExpectTagAndLengthWithWrongLength)
+TEST_F(pkixder_input_tests, ReadTagAndGetValue_Input_TruncatedAfterTag)
 {
-  Input buf(DER_INT16);
+  static const uint8_t DER[] = { SEQUENCE };
+  Input buf(DER);
   Reader input(buf);
-
-  // Wrong length
-  ASSERT_EQ(Result::ERROR_BAD_DER, ExpectTagAndLength(input, INTEGER, 4));
+  uint8_t tag;
+  Input value;
+  ASSERT_EQ(Result::ERROR_BAD_DER, ReadTagAndGetValue(input, tag, value));
 }
 
-TEST_F(pkixder_input_tests, ExpectTagAndLengthWithWrongTag)
+TEST_F(pkixder_input_tests, ReadTagAndGetValue_Input_ValidEmpty)
 {
-  Input buf(DER_INT16);
+  Input buf(DER_SEQUENCE_EMPTY);
   Reader input(buf);
-
-  // Wrong type
-  ASSERT_EQ(Result::ERROR_BAD_DER, ExpectTagAndLength(input, OCTET_STRING, 2));
-}
-
-TEST_F(pkixder_input_tests, ExpectTagAndGetLength)
-{
-  Input buf(DER_SEQUENCE_OF_INT8);
-  Reader input(buf);
-
-  uint16_t length = 0;
-  ASSERT_EQ(Success,
-            der::internal::ExpectTagAndGetLength(input, SEQUENCE, length));
-  ASSERT_EQ(sizeof DER_SEQUENCE_OF_INT8 - 2, length);
-  ASSERT_EQ(Success, input.Skip(length));
+  uint8_t tag = 0;
+  Input value;
+  ASSERT_EQ(Success, ReadTagAndGetValue(input, tag, value));
+  ASSERT_EQ(SEQUENCE, tag);
+  ASSERT_EQ(0u, value.GetLength());
   ASSERT_TRUE(input.AtEnd());
 }
 
-TEST_F(pkixder_input_tests, ExpectTagAndGetLengthWithWrongTag)
+TEST_F(pkixder_input_tests, ReadTagAndGetValue_Input_ValidNotEmpty)
 {
-  Input buf(DER_SEQUENCE_OF_INT8);
+  Input buf(DER_SEQUENCE_NOT_EMPTY);
   Reader input(buf);
-
-  uint16_t length = 0;
-  ASSERT_EQ(Result::ERROR_BAD_DER,
-            der::internal::ExpectTagAndGetLength(input, INTEGER, length));
+  uint8_t tag = 0;
+  Input value;
+  ASSERT_EQ(Success, ReadTagAndGetValue(input, tag, value));
+  ASSERT_EQ(SEQUENCE, tag);
+  Input expected(DER_SEQUENCE_NOT_EMPTY_VALUE);
+  ASSERT_TRUE(InputsAreEqual(expected, value));
+  ASSERT_TRUE(input.AtEnd());
 }
 
-TEST_F(pkixder_input_tests, ExpectTagAndGetLengthWithWrongLength)
+TEST_F(pkixder_input_tests,
+       ReadTagAndGetValue_Input_InvalidNotEmptyValueTruncated)
+{
+  Input buf(DER_SEQUENCE_NOT_EMPTY_VALUE_TRUNCATED);
+  Reader input(buf);
+  uint8_t tag;
+  Input value;
+  ASSERT_EQ(Result::ERROR_BAD_DER, ReadTagAndGetValue(input, tag, value));
+}
+
+TEST_F(pkixder_input_tests, ReadTagAndGetValue_Input_InvalidWrongLength)
 {
   Input buf(DER_TRUNCATED_SEQUENCE_OF_INT8);
   Reader input(buf);
-
-  uint16_t length = 0;
+  uint8_t tag;
+  Input value;
   ASSERT_EQ(Result::ERROR_BAD_DER,
-            der::internal::ExpectTagAndGetLength(input, SEQUENCE, length));
+            ReadTagAndGetValue(input, tag, value));
 }
 
 TEST_F(pkixder_input_tests, ExpectTagAndGetValue_Reader_ValidEmpty)
@@ -558,7 +563,7 @@ TEST_F(pkixder_input_tests, ExpectTagAndGetValue_Reader_InvalidWrongLength)
             ExpectTagAndGetValue(input, SEQUENCE, value));
 }
 
-TEST_F(pkixder_input_tests, ExpectTagAndGetLength_Reader_InvalidWrongTag)
+TEST_F(pkixder_input_tests, ExpectTagAndGetValue_Reader_InvalidWrongTag)
 {
   Input buf(DER_SEQUENCE_NOT_EMPTY);
   Reader input(buf);
@@ -607,7 +612,7 @@ TEST_F(pkixder_input_tests, ExpectTagAndGetValue_Input_InvalidWrongLength)
             ExpectTagAndGetValue(input, SEQUENCE, value));
 }
 
-TEST_F(pkixder_input_tests, ExpectTagAndGetLength_Input_InvalidWrongTag)
+TEST_F(pkixder_input_tests, ExpectTagAndGetValue_Input_InvalidWrongTag)
 {
   Input buf(DER_SEQUENCE_NOT_EMPTY);
   Reader input(buf);
@@ -616,6 +621,43 @@ TEST_F(pkixder_input_tests, ExpectTagAndGetLength_Input_InvalidWrongTag)
             ExpectTagAndGetValue(input, INTEGER, value));
 }
 
+TEST_F(pkixder_input_tests, ExpectTagAndEmptyValue_ValidEmpty)
+{
+  Input buf(DER_SEQUENCE_EMPTY);
+  Reader input(buf);
+  ASSERT_EQ(Success, ExpectTagAndEmptyValue(input, SEQUENCE));
+  ASSERT_TRUE(input.AtEnd());
+}
+
+TEST_F(pkixder_input_tests, ExpectTagAndEmptyValue_InValidNotEmpty)
+{
+  Input buf(DER_SEQUENCE_NOT_EMPTY);
+  Reader input(buf);
+  ASSERT_EQ(Result::ERROR_BAD_DER, ExpectTagAndEmptyValue(input, SEQUENCE));
+}
+
+TEST_F(pkixder_input_tests,
+       ExpectTagAndEmptyValue_Input_InvalidNotEmptyValueTruncated)
+{
+  Input buf(DER_SEQUENCE_NOT_EMPTY_VALUE_TRUNCATED);
+  Reader input(buf);
+  ASSERT_EQ(Result::ERROR_BAD_DER, ExpectTagAndEmptyValue(input, SEQUENCE));
+}
+
+TEST_F(pkixder_input_tests, ExpectTagAndEmptyValue_InvalidWrongLength)
+{
+  Input buf(DER_TRUNCATED_SEQUENCE_OF_INT8);
+  Reader input(buf);
+  ASSERT_EQ(Result::ERROR_BAD_DER, ExpectTagAndEmptyValue(input, SEQUENCE));
+}
+
+TEST_F(pkixder_input_tests, ExpectTagAndEmptyValue_InvalidWrongTag)
+{
+  Input buf(DER_SEQUENCE_NOT_EMPTY);
+  Reader input(buf);
+  ASSERT_EQ(Result::ERROR_BAD_DER, ExpectTagAndEmptyValue(input, INTEGER));
+}
+
 TEST_F(pkixder_input_tests, ExpectTagAndGetTLV_Input_ValidEmpty)
 {
   Input buf(DER_SEQUENCE_EMPTY);
diff --git a/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp b/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp
index fa0de6da78d..c52eb897189 100644
--- a/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp
+++ b/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp
@@ -83,45 +83,12 @@ private:
 class pkixocsp_CreateEncodedOCSPRequest : public NSSTest
 {
 protected:
-  // These SECItems are allocated in arena, and so will be auto-cleaned.
-  SECItem* unsupportedLongSerialNumber;
-  SECItem* longestRequiredSerialNumber;
-
-  void SetUp()
-  {
-    static const uint8_t UNSUPPORTED_LEN = 128; // must be larger than 127
-    // tag + length + value is 1 + 2 + UNSUPPORTED_LEN
-    unsupportedLongSerialNumber = SECITEM_AllocItem(arena.get(), nullptr,
-                                                    1 + 2 + UNSUPPORTED_LEN);
-    memset(unsupportedLongSerialNumber->data, 0,
-           unsupportedLongSerialNumber->len);
-    unsupportedLongSerialNumber->data[0] = der::INTEGER;
-    // Encoding the length takes two bytes: one byte to indicate that a
-    // second byte follows, and the second byte to indicate the length.
-    unsupportedLongSerialNumber->data[1] = 0x80 + 1;
-    unsupportedLongSerialNumber->data[2] = UNSUPPORTED_LEN;
-    unsupportedLongSerialNumber->data[3] = 0x01; // value is 0x010000...00
-
-    static const uint8_t LONGEST_REQUIRED_LEN = 20;
-    // tag + length + value is 1 + 1 + LONGEST_REQUIRED_LEN
-    longestRequiredSerialNumber = SECITEM_AllocItem(arena.get(), nullptr,
-                                    1 + 1 + LONGEST_REQUIRED_LEN);
-    memset(longestRequiredSerialNumber->data, 0,
-           longestRequiredSerialNumber->len);
-    longestRequiredSerialNumber->data[0] = der::INTEGER;
-    longestRequiredSerialNumber->data[1] = LONGEST_REQUIRED_LEN;
-    longestRequiredSerialNumber->data[2] = 0x01; // value is 0x010000...00
-  }
-
-  // The resultant issuerDER and issuerSPKI are owned by the arena.
   void MakeIssuerCertIDComponents(const char* issuerASCII,
-                                  /*out*/ Input& issuerDER,
-                                  /*out*/ Input& issuerSPKI)
+                                  /*out*/ ByteString& issuerDER,
+                                  /*out*/ ByteString& issuerSPKI)
   {
-    const SECItem* issuerDERSECItem = ASCIIToDERName(arena.get(), issuerASCII);
-    ASSERT_TRUE(issuerDERSECItem);
-    ASSERT_EQ(Success,
-              issuerDER.Init(issuerDERSECItem->data, issuerDERSECItem->len));
+    issuerDER = CNToDERName(issuerASCII);
+    ASSERT_NE(ENCODING_FAILED, issuerDER);
 
     ScopedSECKEYPublicKey issuerPublicKey;
     ScopedSECKEYPrivateKey issuerPrivateKey;
@@ -131,12 +98,7 @@ protected:
       SECKEY_EncodeDERSubjectPublicKeyInfo(issuerPublicKey.get()));
     ASSERT_TRUE(issuerSPKIOriginal);
 
-    SECItem issuerSPKICopy;
-    ASSERT_EQ(SECSuccess,
-              SECITEM_CopyItem(arena.get(), &issuerSPKICopy,
-                               issuerSPKIOriginal.get()));
-    ASSERT_EQ(Success,
-              issuerSPKI.Init(issuerSPKICopy.data, issuerSPKICopy.len));
+    issuerSPKI.assign(issuerSPKIOriginal->data, issuerSPKIOriginal->len);
   }
 
   CreateEncodedOCSPRequestTrustDomain trustDomain;
@@ -146,18 +108,40 @@ protected:
 // CreateEncodedOCSPRequest to fail.
 TEST_F(pkixocsp_CreateEncodedOCSPRequest, ChildCertLongSerialNumberTest)
 {
-  Input issuerDER;
-  Input issuerSPKI;
-  MakeIssuerCertIDComponents("CN=CA", issuerDER, issuerSPKI);
+  static const uint8_t UNSUPPORTED_LEN = 128; // must be larger than 127
+
+  ByteString serialNumberString;
+  // tag + length + value is 1 + 2 + UNSUPPORTED_LEN
+  // Encoding the length takes two bytes: one byte to indicate that a
+  // second byte follows, and the second byte to indicate the length.
+  serialNumberString.push_back(0x80 + 1);
+  serialNumberString.push_back(UNSUPPORTED_LEN);
+  // value is 0x010000...00
+  serialNumberString.push_back(0x01);
+  for (size_t i = 1; i < UNSUPPORTED_LEN; ++i) {
+    serialNumberString.push_back(0x00);
+  }
+
+  ByteString issuerDER;
+  ByteString issuerSPKI;
+  ASSERT_NO_FATAL_FAILURE(MakeIssuerCertIDComponents("CA", issuerDER,
+                                                     issuerSPKI));
+
+  Input issuer;
+  ASSERT_EQ(Success, issuer.Init(issuerDER.data(), issuerDER.length()));
+
+  Input spki;
+  ASSERT_EQ(Success, spki.Init(issuerSPKI.data(), issuerSPKI.length()));
+
   Input serialNumber;
-  ASSERT_EQ(Success, serialNumber.Init(unsupportedLongSerialNumber->data,
-                                       unsupportedLongSerialNumber->len));
+  ASSERT_EQ(Success, serialNumber.Init(serialNumberString.data(),
+                                       serialNumberString.length()));
+
   uint8_t ocspRequest[OCSP_REQUEST_MAX_LENGTH];
   size_t ocspRequestLength;
   ASSERT_EQ(Result::ERROR_BAD_DER,
             CreateEncodedOCSPRequest(trustDomain,
-                                     CertID(issuerDER, issuerSPKI,
-                                            serialNumber),
+                                     CertID(issuer, spki, serialNumber),
                                      ocspRequest, ocspRequestLength));
 }
 
@@ -165,17 +149,37 @@ TEST_F(pkixocsp_CreateEncodedOCSPRequest, ChildCertLongSerialNumberTest)
 // it's required to support (i.e. 20 octets).
 TEST_F(pkixocsp_CreateEncodedOCSPRequest, LongestSupportedSerialNumberTest)
 {
-  Input issuerDER;
-  Input issuerSPKI;
-  MakeIssuerCertIDComponents("CN=CA", issuerDER, issuerSPKI);
+  static const uint8_t LONGEST_REQUIRED_LEN = 20;
+
+  ByteString serialNumberString;
+  // tag + length + value is 1 + 1 + LONGEST_REQUIRED_LEN
+  serialNumberString.push_back(der::INTEGER);
+  serialNumberString.push_back(LONGEST_REQUIRED_LEN);
+  serialNumberString.push_back(0x01);
+  // value is 0x010000...00
+  for (size_t i = 1; i < LONGEST_REQUIRED_LEN; ++i) {
+    serialNumberString.push_back(0x00);
+  }
+
+  ByteString issuerDER;
+  ByteString issuerSPKI;
+  ASSERT_NO_FATAL_FAILURE(MakeIssuerCertIDComponents("CA", issuerDER,
+                                                     issuerSPKI));
+
+  Input issuer;
+  ASSERT_EQ(Success, issuer.Init(issuerDER.data(), issuerDER.length()));
+
+  Input spki;
+  ASSERT_EQ(Success, spki.Init(issuerSPKI.data(), issuerSPKI.length()));
+
   Input serialNumber;
-  ASSERT_EQ(Success, serialNumber.Init(longestRequiredSerialNumber->data,
-                                       longestRequiredSerialNumber->len));
+  ASSERT_EQ(Success, serialNumber.Init(serialNumberString.data(),
+                                       serialNumberString.length()));
+
   uint8_t ocspRequest[OCSP_REQUEST_MAX_LENGTH];
   size_t ocspRequestLength;
   ASSERT_EQ(Success,
             CreateEncodedOCSPRequest(trustDomain,
-                                     CertID(issuerDER, issuerSPKI,
-                                            serialNumber),
+                                     CertID(issuer, spki, serialNumber),
                                      ocspRequest, ocspRequestLength));
 }
diff --git a/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp b/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
index c56e2f34292..362a11814ab 100644
--- a/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
+++ b/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
@@ -98,7 +98,7 @@ private:
 };
 
 namespace {
-char const* const rootName = "CN=Test CA 1";
+char const* const rootName = "Test CA 1";
 void deleteCertID(CertID* certID) { delete certID; }
 } // unnamed namespace
 
@@ -111,11 +111,12 @@ public:
     if (GenerateKeyPair(rootPublicKey, rootPrivateKey) != Success) {
       return false;
     }
-    rootSPKI = SECKEY_EncodeDERSubjectPublicKeyInfo(rootPublicKey.get());
-    if (!rootSPKI) {
+    ScopedSECItem rootSPKIItem(
+      SECKEY_EncodeDERSubjectPublicKeyInfo(rootPublicKey.get()));
+    if (!rootSPKIItem) {
       return false;
     }
-
+    rootSPKI.assign(rootSPKIItem->data, rootSPKIItem->len);
     return true;
   }
 
@@ -131,44 +132,51 @@ public:
   {
     NSSTest::SetUp();
 
-    Input rootNameDER;
-    // The result of ASCIIToDERName is owned by the arena
-    if (InitInputFromSECItem(ASCIIToDERName(arena.get(), rootName),
-                             rootNameDER) != Success) {
+    rootNameDER = CNToDERName(rootName);
+    if (rootNameDER == ENCODING_FAILED) {
+      abort();
+    }
+    Input rootNameDERInput;
+    if (rootNameDERInput.Init(rootNameDER.data(), rootNameDER.length())
+          != Success) {
       abort();
     }
 
-    Input serialNumberDER;
-    // The result of CreateEncodedSerialNumber is owned by the arena
-    if (InitInputFromSECItem(
-          CreateEncodedSerialNumber(arena.get(), ++rootIssuedCount),
-          serialNumberDER) != Success) {
+    serialNumberDER = CreateEncodedSerialNumber(++rootIssuedCount);
+    if (serialNumberDER == ENCODING_FAILED) {
+      abort();
+    }
+    Input serialNumberDERInput;
+    if (serialNumberDERInput.Init(serialNumberDER.data(),
+                                  serialNumberDER.length()) != Success) {
       abort();
     }
 
     Input rootSPKIDER;
-    if (InitInputFromSECItem(rootSPKI.get(), rootSPKIDER) != Success) {
+    if (rootSPKIDER.Init(rootSPKI.data(), rootSPKI.length()) != Success) {
       abort();
     }
-    endEntityCertID = new (std::nothrow) CertID(rootNameDER, rootSPKIDER,
-                                                serialNumberDER);
+    endEntityCertID = new (std::nothrow) CertID(rootNameDERInput, rootSPKIDER,
+                                                serialNumberDERInput);
     if (!endEntityCertID) {
       abort();
     }
   }
 
   static ScopedSECKEYPrivateKey rootPrivateKey;
-  static ScopedSECItem rootSPKI;
+  static ByteString rootSPKI;
   static long rootIssuedCount;
-
   OCSPTestTrustDomain trustDomain;
-  // endEntityCertID references items owned by arena and rootSPKI.
+
+  ByteString rootNameDER;
+  ByteString serialNumberDER;
+  // endEntityCertID references rootSPKI, rootNameDER, and serialNumberDER.
   ScopedPtr<CertID, deleteCertID> endEntityCertID;
 };
 
 /*static*/ ScopedSECKEYPrivateKey
               pkixocsp_VerifyEncodedResponse::rootPrivateKey;
-/*static*/ ScopedSECItem pkixocsp_VerifyEncodedResponse::rootSPKI;
+/*static*/ ByteString pkixocsp_VerifyEncodedResponse::rootSPKI;
 /*static*/ long pkixocsp_VerifyEncodedResponse::rootIssuedCount = 0;
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -198,30 +206,24 @@ class pkixocsp_VerifyEncodedResponse_WithoutResponseBytes
   , public ::testing::WithParamInterface<WithoutResponseBytes>
 {
 protected:
-  // The result is owned by the arena
-  Input CreateEncodedOCSPErrorResponse(uint8_t status)
+  ByteString CreateEncodedOCSPErrorResponse(uint8_t status)
   {
     static const Input EMPTY;
-    OCSPResponseContext context(arena.get(),
-                                CertID(EMPTY, EMPTY, EMPTY),
+    OCSPResponseContext context(CertID(EMPTY, EMPTY, EMPTY),
                                 oneDayBeforeNow);
     context.responseStatus = status;
     context.skipResponseBytes = true;
-    SECItem* response = CreateEncodedOCSPResponse(context);
-    EXPECT_TRUE(response);
-    // The result will be an empty Input on failure, but it doesn't
-    // matter because the test is going to fail anyway.
-    Input result;
-    EXPECT_EQ(Success, result.Init(response->data, response->len));
-    return result;
+    return CreateEncodedOCSPResponse(context);
   }
 };
 
 TEST_P(pkixocsp_VerifyEncodedResponse_WithoutResponseBytes, CorrectErrorCode)
 {
-  Input
-    response(CreateEncodedOCSPErrorResponse(GetParam().responseStatus));
-
+  ByteString
+    responseString(CreateEncodedOCSPErrorResponse(GetParam().responseStatus));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(GetParam().expectedError,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -257,20 +259,19 @@ public:
     pkixocsp_VerifyEncodedResponse::SetUpTestCase();
   }
 
-  // The result is owned by the arena
-  Input CreateEncodedOCSPSuccessfulResponse(
+  ByteString CreateEncodedOCSPSuccessfulResponse(
                     OCSPResponseContext::CertStatus certStatus,
                     const CertID& certID,
                     /*optional*/ const char* signerName,
                     const ScopedSECKEYPrivateKey& signerPrivateKey,
                     time_t producedAt, time_t thisUpdate,
                     /*optional*/ const time_t* nextUpdate,
-                    /*optional*/ SECItem const* const* certs = nullptr)
+                    /*optional*/ const ByteString* certs = nullptr)
   {
-    OCSPResponseContext context(arena.get(), certID, producedAt);
+    OCSPResponseContext context(certID, producedAt);
     if (signerName) {
-      context.signerNameDER = ASCIIToDERName(arena.get(), signerName);
-      EXPECT_TRUE(context.signerNameDER);
+      context.signerNameDER = CNToDERName(signerName);
+      EXPECT_NE(ENCODING_FAILED, context.signerNameDER);
     }
     context.signerPrivateKey = SECKEY_CopyPrivateKey(signerPrivateKey.get());
     EXPECT_TRUE(context.signerPrivateKey);
@@ -278,26 +279,25 @@ public:
     context.producedAt = producedAt;
     context.certs = certs;
 
-    context.certIDHashAlg = SEC_OID_SHA1;
     context.certStatus = certStatus;
     context.thisUpdate = thisUpdate;
     context.nextUpdate = nextUpdate ? *nextUpdate : 0;
     context.includeNextUpdate = nextUpdate != nullptr;
 
-    SECItem* response = CreateEncodedOCSPResponse(context);
-    EXPECT_TRUE(response);
-    Input result;
-    EXPECT_EQ(Success, result.Init(response->data, response->len));
-    return result;
+    return CreateEncodedOCSPResponse(context);
   }
 };
 
 TEST_F(pkixocsp_VerifyEncodedResponse_successful, good_byKey)
 {
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID, byKey,
                          rootPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Success,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID,
@@ -308,10 +308,14 @@ TEST_F(pkixocsp_VerifyEncodedResponse_successful, good_byKey)
 
 TEST_F(pkixocsp_VerifyEncodedResponse_successful, good_byName)
 {
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID, rootName,
                          rootPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Success,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -322,10 +326,14 @@ TEST_F(pkixocsp_VerifyEncodedResponse_successful, good_byName)
 
 TEST_F(pkixocsp_VerifyEncodedResponse_successful, good_byKey_without_nextUpdate)
 {
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID, byKey,
                          rootPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, nullptr));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Success,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -336,10 +344,14 @@ TEST_F(pkixocsp_VerifyEncodedResponse_successful, good_byKey_without_nextUpdate)
 
 TEST_F(pkixocsp_VerifyEncodedResponse_successful, revoked)
 {
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::revoked, *endEntityCertID, byKey,
                          rootPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_REVOKED_CERTIFICATE,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -350,10 +362,14 @@ TEST_F(pkixocsp_VerifyEncodedResponse_successful, revoked)
 
 TEST_F(pkixocsp_VerifyEncodedResponse_successful, unknown)
 {
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::unknown, *endEntityCertID, byKey,
                          rootPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_UNKNOWN_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -383,42 +399,39 @@ protected:
   // id-kp-OCSPSigning EKU. If signerEKU is SEC_OID_UNKNOWN then it will not
   // have any EKU extension. Otherwise, the certificate will have the given
   // EKU.
-  //
-  // signerDEROut is owned by the arena
-  Input CreateEncodedIndirectOCSPSuccessfulResponse(
-              const char* certSubjectName,
-              OCSPResponseContext::CertStatus certStatus,
-              const char* signerName,
-              SECOidTag signerEKU = SEC_OID_OCSP_RESPONDER,
-              /*optional, out*/ Input* signerDEROut = nullptr)
+  ByteString CreateEncodedIndirectOCSPSuccessfulResponse(
+               const char* certSubjectName,
+               OCSPResponseContext::CertStatus certStatus,
+               const char* signerName,
+               /*optional*/ const Input* signerEKUDER = &OCSPSigningEKUDER,
+               /*optional, out*/ ByteString* signerDEROut = nullptr)
   {
     assert(certSubjectName);
 
-    const SECItem* extensions[] = {
-      signerEKU != SEC_OID_UNKNOWN
-        ? CreateEncodedEKUExtension(arena.get(), &signerEKU, 1,
+    const ByteString extensions[] = {
+      signerEKUDER
+        ? CreateEncodedEKUExtension(*signerEKUDER,
                                     ExtensionCriticality::NotCritical)
-        : nullptr,
-      nullptr
+        : ByteString(),
+      ByteString()
     };
     ScopedSECKEYPrivateKey signerPrivateKey;
-    SECItem* signerDER(CreateEncodedCertificate(
-                          arena.get(), ++rootIssuedCount, rootName,
-                          oneDayBeforeNow, oneDayAfterNow, certSubjectName,
-                          signerEKU != SEC_OID_UNKNOWN ? extensions : nullptr,
-                          rootPrivateKey.get(), signerPrivateKey));
-    EXPECT_TRUE(signerDER);
+    ByteString signerDER(CreateEncodedCertificate(
+                           ++rootIssuedCount, rootName,
+                           oneDayBeforeNow, oneDayAfterNow, certSubjectName,
+                           signerEKUDER ? extensions : nullptr,
+                           rootPrivateKey.get(), signerPrivateKey));
+    EXPECT_NE(ENCODING_FAILED, signerDER);
     if (signerDEROut) {
-      EXPECT_EQ(Success,
-                signerDEROut->Init(signerDER->data, signerDER->len));
+      *signerDEROut = signerDER;
     }
 
-    const SECItem* signerNameDER = nullptr;
+    ByteString signerNameDER;
     if (signerName) {
-      signerNameDER = ASCIIToDERName(arena.get(), signerName);
-      EXPECT_TRUE(signerNameDER);
+      signerNameDER = CNToDERName(signerName);
+      EXPECT_NE(ENCODING_FAILED, signerNameDER);
     }
-    SECItem const* const certs[] = { signerDER, nullptr };
+    ByteString certs[] = { signerDER, ByteString() };
     return CreateEncodedOCSPSuccessfulResponse(certStatus, *endEntityCertID,
                                                signerName, signerPrivateKey,
                                                oneDayBeforeNow,
@@ -426,43 +439,52 @@ protected:
                                                &oneDayAfterNow, certs);
   }
 
-  static SECItem* CreateEncodedCertificate(PLArenaPool* arena,
-                                           uint32_t serialNumber,
-                                           const char* issuer,
-                                           time_t notBefore,
-                                           time_t notAfter,
-                                           const char* subject,
-                              /*optional*/ SECItem const* const* extensions,
-                              /*optional*/ SECKEYPrivateKey* signerKey,
-                                   /*out*/ ScopedSECKEYPrivateKey& privateKey)
+  static ByteString CreateEncodedCertificate(uint32_t serialNumber,
+                                             const char* issuer,
+                                             time_t notBefore,
+                                             time_t notAfter,
+                                             const char* subject,
+                                /*optional*/ const ByteString* extensions,
+                                /*optional*/ SECKEYPrivateKey* signerKey,
+                                     /*out*/ ScopedSECKEYPrivateKey& privateKey)
   {
-    const SECItem* serialNumberDER(CreateEncodedSerialNumber(arena,
-                                                             serialNumber));
-    if (!serialNumberDER) {
-      return nullptr;
+    ByteString serialNumberDER(CreateEncodedSerialNumber(serialNumber));
+    if (serialNumberDER == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    const SECItem* issuerDER(ASCIIToDERName(arena, issuer));
-    if (!issuerDER) {
-      return nullptr;
+    ByteString issuerDER(CNToDERName(issuer));
+    if (issuerDER == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    const SECItem* subjectDER(ASCIIToDERName(arena, subject));
-    if (!subjectDER) {
-      return nullptr;
+    ByteString subjectDER(CNToDERName(subject));
+    if (subjectDER == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
     return ::mozilla::pkix::test::CreateEncodedCertificate(
-                                    arena, v3,
-                                    SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION,
+                                    v3,
+                                    sha256WithRSAEncryption,
                                     serialNumberDER, issuerDER, notBefore,
                                     notAfter, subjectDER, extensions,
-                                    signerKey, SEC_OID_SHA256, privateKey);
+                                    signerKey,
+                                    SignatureAlgorithm::rsa_pkcs1_with_sha256,
+                                    privateKey);
   }
+
+  static const Input OCSPSigningEKUDER;
 };
 
+/*static*/ const Input pkixocsp_VerifyEncodedResponse_DelegatedResponder::
+  OCSPSigningEKUDER(tlv_id_kp_OCSPSigning);
+
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_byKey)
 {
-  Input response(CreateEncodedIndirectOCSPSuccessfulResponse(
-                         "CN=good_indirect_byKey", OCSPResponseContext::good,
+  ByteString responseString(
+               CreateEncodedIndirectOCSPSuccessfulResponse(
+                         "good_indirect_byKey", OCSPResponseContext::good,
                          byKey));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Success,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -473,9 +495,13 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_byKey)
 
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_byName)
 {
-  Input response(CreateEncodedIndirectOCSPSuccessfulResponse(
-                         "CN=good_indirect_byName", OCSPResponseContext::good,
-                         "CN=good_indirect_byName"));
+  ByteString responseString(
+               CreateEncodedIndirectOCSPSuccessfulResponse(
+                         "good_indirect_byName", OCSPResponseContext::good,
+                         "good_indirect_byName"));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Success,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -491,10 +517,14 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
   ScopedSECKEYPrivateKey missingSignerPrivateKey;
   ASSERT_EQ(Success, GenerateKeyPair(missingSignerPublicKey,
                                      missingSignerPrivateKey));
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID, byKey,
                          missingSignerPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, nullptr));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -510,10 +540,14 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
   ScopedSECKEYPrivateKey missingSignerPrivateKey;
   ASSERT_EQ(Success, GenerateKeyPair(missingSignerPublicKey,
                                      missingSignerPrivateKey));
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,
-                         "CN=missing", missingSignerPrivateKey,
+                         "missing", missingSignerPrivateKey,
                          oneDayBeforeNow, oneDayBeforeNow, nullptr));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -524,30 +558,32 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
 
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_expired)
 {
-  static const SECOidTag signerEKU = SEC_OID_OCSP_RESPONDER;
-  static const char* signerName = "CN=good_indirect_expired";
+  static const char* signerName = "good_indirect_expired";
 
-  const SECItem* extensions[] = {
-    CreateEncodedEKUExtension(arena.get(), &signerEKU, 1,
+  const ByteString extensions[] = {
+    CreateEncodedEKUExtension(OCSPSigningEKUDER,
                               ExtensionCriticality::NotCritical),
-    nullptr
+    ByteString()
   };
 
   ScopedSECKEYPrivateKey signerPrivateKey;
-  SECItem* signerDER(CreateEncodedCertificate(arena.get(), ++rootIssuedCount,
-                                              rootName,
-                                              now - (10 * Time::ONE_DAY_IN_SECONDS),
-                                              now - (2 * Time::ONE_DAY_IN_SECONDS),
-                                              signerName, extensions,
-                                              rootPrivateKey.get(),
-                                              signerPrivateKey));
-  ASSERT_TRUE(signerDER);
+  ByteString signerDER(CreateEncodedCertificate(
+                          ++rootIssuedCount, rootName,
+                          now - (10 * Time::ONE_DAY_IN_SECONDS),
+                          now - (2 * Time::ONE_DAY_IN_SECONDS),
+                          signerName, extensions, rootPrivateKey.get(),
+                          signerPrivateKey));
+  ASSERT_NE(ENCODING_FAILED, signerDER);
 
-  SECItem const* const certs[] = { signerDER, nullptr };
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString certs[] = { signerDER, ByteString() };
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,
                          signerName, signerPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow, certs));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -557,30 +593,32 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_expired)
 
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_future)
 {
-  static const SECOidTag signerEKU = SEC_OID_OCSP_RESPONDER;
-  static const char* signerName = "CN=good_indirect_future";
+  static const char* signerName = "good_indirect_future";
 
-  const SECItem* extensions[] = {
-    CreateEncodedEKUExtension(arena.get(), &signerEKU, 1,
+  const ByteString extensions[] = {
+    CreateEncodedEKUExtension(OCSPSigningEKUDER,
                               ExtensionCriticality::NotCritical),
-    nullptr
+    ByteString()
   };
 
   ScopedSECKEYPrivateKey signerPrivateKey;
-  SECItem* signerDER(CreateEncodedCertificate(arena.get(), ++rootIssuedCount,
-                                              rootName,
-                                              now + (2 * Time::ONE_DAY_IN_SECONDS),
-                                              now + (10 * Time::ONE_DAY_IN_SECONDS),
-                                              signerName, extensions,
-                                              rootPrivateKey.get(),
-                                              signerPrivateKey));
-  ASSERT_TRUE(signerDER);
+  ByteString signerDER(CreateEncodedCertificate(
+                         ++rootIssuedCount, rootName,
+                         now + (2 * Time::ONE_DAY_IN_SECONDS),
+                         now + (10 * Time::ONE_DAY_IN_SECONDS),
+                         signerName, extensions, rootPrivateKey.get(),
+                         signerPrivateKey));
+  ASSERT_NE(ENCODING_FAILED, signerDER);
 
-  SECItem const* const certs[] = { signerDER, nullptr };
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString certs[] = { signerDER, ByteString() };
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,
                          signerName, signerPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow, certs));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -591,9 +629,13 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_future)
 
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_no_eku)
 {
-  Input response(CreateEncodedIndirectOCSPSuccessfulResponse(
-                         "CN=good_indirect_wrong_eku",
-                         OCSPResponseContext::good, byKey, SEC_OID_UNKNOWN));
+  ByteString responseString(
+               CreateEncodedIndirectOCSPSuccessfulResponse(
+                         "good_indirect_wrong_eku",
+                         OCSPResponseContext::good, byKey, nullptr));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -602,13 +644,18 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_no_eku)
   ASSERT_FALSE(expired);
 }
 
+static const Input serverAuthEKUDER(tlv_id_kp_serverAuth);
+
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
        good_indirect_wrong_eku)
 {
-  Input response(CreateEncodedIndirectOCSPSuccessfulResponse(
-                        "CN=good_indirect_wrong_eku",
-                        OCSPResponseContext::good, byKey,
-                        SEC_OID_EXT_KEY_USAGE_SERVER_AUTH));
+  ByteString responseString(
+               CreateEncodedIndirectOCSPSuccessfulResponse(
+                        "good_indirect_wrong_eku",
+                        OCSPResponseContext::good, byKey, &serverAuthEKUDER));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -620,36 +667,31 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
 // Test that signature of OCSP response signer cert is verified
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_tampered_eku)
 {
-  Input response(CreateEncodedIndirectOCSPSuccessfulResponse(
-                         "CN=good_indirect_tampered_eku",
-                         OCSPResponseContext::good, byKey,
-                         SEC_OID_EXT_KEY_USAGE_SERVER_AUTH));
-
-#define EKU_PREFIX \
-  0x06, 8, /* OBJECT IDENTIFIER, 8 bytes */ \
-  0x2B, 6, 1, 5, 5, 7, /* id-pkix */ \
-  0x03 /* id-kp */
-  static const uint8_t EKU_SERVER_AUTH[] = { EKU_PREFIX, 0x01 }; // serverAuth
-  static const uint8_t EKU_OCSP_SIGNER[] = { EKU_PREFIX, 0x09 }; // OCSPSigning
-#undef EKU_PREFIX
-  SECItem responseSECItem = UnsafeMapInputToSECItem(response);
+  ByteString tamperedResponse(
+               CreateEncodedIndirectOCSPSuccessfulResponse(
+                         "good_indirect_tampered_eku",
+                         OCSPResponseContext::good, byKey, &serverAuthEKUDER));
   ASSERT_EQ(Success,
-            TamperOnce(responseSECItem,
-                       EKU_SERVER_AUTH, sizeof(EKU_SERVER_AUTH),
-                       EKU_OCSP_SIGNER, sizeof(EKU_OCSP_SIGNER)));
-
+            TamperOnce(tamperedResponse,
+                       ByteString(tlv_id_kp_serverAuth,
+                                  sizeof(tlv_id_kp_serverAuth)),
+                       ByteString(tlv_id_kp_OCSPSigning,
+                                  sizeof(tlv_id_kp_OCSPSigning))));
+  Input tamperedResponseInput;
+  ASSERT_EQ(Success, tamperedResponseInput.Init(tamperedResponse.data(),
+                                                tamperedResponse.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
                                       END_ENTITY_MAX_LIFETIME_IN_DAYS,
-                                      response, expired));
+                                      tamperedResponseInput, expired));
   ASSERT_FALSE(expired);
 }
 
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_unknown_issuer)
 {
-  static const char* subCAName = "CN=good_indirect_unknown_issuer sub-CA";
-  static const char* signerName = "CN=good_indirect_unknown_issuer OCSP signer";
+  static const char* subCAName = "good_indirect_unknown_issuer sub-CA";
+  static const char* signerName = "good_indirect_unknown_issuer OCSP signer";
 
   // unknown issuer
   ScopedSECKEYPublicKey unknownPublicKey;
@@ -657,25 +699,28 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_unknown_issuer)
   ASSERT_EQ(Success, GenerateKeyPair(unknownPublicKey, unknownPrivateKey));
 
   // Delegated responder cert signed by unknown issuer
-  static const SECOidTag signerEKU = SEC_OID_OCSP_RESPONDER;
-  const SECItem* extensions[] = {
-    CreateEncodedEKUExtension(arena.get(), &signerEKU, 1,
+  const ByteString extensions[] = {
+    CreateEncodedEKUExtension(OCSPSigningEKUDER,
                               ExtensionCriticality::NotCritical),
-    nullptr
+    ByteString()
   };
   ScopedSECKEYPrivateKey signerPrivateKey;
-  SECItem* signerDER(CreateEncodedCertificate(arena.get(), 1,
-                        subCAName, oneDayBeforeNow, oneDayAfterNow,
-                        signerName, extensions, unknownPrivateKey.get(),
-                        signerPrivateKey));
-  ASSERT_TRUE(signerDER);
+  ByteString signerDER(CreateEncodedCertificate(
+                         1, subCAName, oneDayBeforeNow, oneDayAfterNow,
+                         signerName, extensions, unknownPrivateKey.get(),
+                         signerPrivateKey));
+  ASSERT_NE(ENCODING_FAILED, signerDER);
 
   // OCSP response signed by that delegated responder
-  SECItem const* const certs[] = { signerDER, nullptr };
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString certs[] = { signerDER, ByteString() };
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,
                          signerName, signerPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow, certs));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -690,46 +735,46 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder, good_unknown_issuer)
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
        good_indirect_subca_1_first)
 {
-  static const char* subCAName = "CN=good_indirect_subca_1_first sub-CA";
-  static const char* signerName = "CN=good_indirect_subca_1_first OCSP signer";
+  static const char* subCAName = "good_indirect_subca_1_first sub-CA";
+  static const char* signerName = "good_indirect_subca_1_first OCSP signer";
 
   // sub-CA of root (root is the direct issuer of endEntity)
-  const SECItem* subCAExtensions[] = {
-    CreateEncodedBasicConstraints(arena.get(), true, 0,
-                                  ExtensionCriticality::NotCritical),
-    nullptr
+  const ByteString subCAExtensions[] = {
+    CreateEncodedBasicConstraints(true, 0, ExtensionCriticality::NotCritical),
+    ByteString()
   };
   ScopedSECKEYPrivateKey subCAPrivateKey;
-  SECItem* subCADER(CreateEncodedCertificate(arena.get(), ++rootIssuedCount,
-                                             rootName,
-                                             oneDayBeforeNow, oneDayAfterNow,
-                                             subCAName, subCAExtensions,
-                                             rootPrivateKey.get(),
-                                             subCAPrivateKey));
-  ASSERT_TRUE(subCADER);
+  ByteString subCADER(CreateEncodedCertificate(
+                        ++rootIssuedCount, rootName,
+                        oneDayBeforeNow, oneDayAfterNow,
+                        subCAName, subCAExtensions, rootPrivateKey.get(),
+                        subCAPrivateKey));
+  ASSERT_NE(ENCODING_FAILED, subCADER);
 
   // Delegated responder cert signed by that sub-CA
-  static const SECOidTag signerEKU = SEC_OID_OCSP_RESPONDER;
-  const SECItem* extensions[] = {
-    CreateEncodedEKUExtension(arena.get(), &signerEKU, 1,
+  const ByteString extensions[] = {
+    CreateEncodedEKUExtension(OCSPSigningEKUDER,
                               ExtensionCriticality::NotCritical),
-    nullptr
+    ByteString(),
   };
   ScopedSECKEYPrivateKey signerPrivateKey;
-  SECItem* signerDER(CreateEncodedCertificate(arena.get(), 1, subCAName,
-                                              oneDayBeforeNow, oneDayAfterNow,
-                                              signerName, extensions,
-                                              subCAPrivateKey.get(),
-                                              signerPrivateKey));
-  ASSERT_TRUE(signerDER);
+  ByteString signerDER(CreateEncodedCertificate(
+                         1, subCAName, oneDayBeforeNow, oneDayAfterNow,
+                         signerName, extensions, subCAPrivateKey.get(),
+                         signerPrivateKey));
+  ASSERT_NE(ENCODING_FAILED, signerDER);
 
   // OCSP response signed by the delegated responder issued by the sub-CA
   // that is trying to impersonate the root.
-  SECItem const* const certs[] = { subCADER, signerDER, nullptr };
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString certs[] = { subCADER, signerDER, ByteString() };
+  ByteString responseString(
+               CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,
                          signerName, signerPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow, certs));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -744,46 +789,46 @@ TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
        good_indirect_subca_1_second)
 {
-  static const char* subCAName = "CN=good_indirect_subca_1_second sub-CA";
-  static const char* signerName = "CN=good_indirect_subca_1_second OCSP signer";
+  static const char* subCAName = "good_indirect_subca_1_second sub-CA";
+  static const char* signerName = "good_indirect_subca_1_second OCSP signer";
 
   // sub-CA of root (root is the direct issuer of endEntity)
-  const SECItem* subCAExtensions[] = {
-    CreateEncodedBasicConstraints(arena.get(), true, 0,
-                                  ExtensionCriticality::NotCritical),
-    nullptr
+  const ByteString subCAExtensions[] = {
+    CreateEncodedBasicConstraints(true, 0, ExtensionCriticality::NotCritical),
+    ByteString()
   };
   ScopedSECKEYPrivateKey subCAPrivateKey;
-  SECItem* subCADER(CreateEncodedCertificate(arena.get(), ++rootIssuedCount,
-                                             rootName,
-                                             oneDayBeforeNow, oneDayAfterNow,
-                                             subCAName, subCAExtensions,
-                                             rootPrivateKey.get(),
-                                             subCAPrivateKey));
-  ASSERT_TRUE(subCADER);
+  ByteString subCADER(CreateEncodedCertificate(++rootIssuedCount, rootName,
+                                               oneDayBeforeNow, oneDayAfterNow,
+                                               subCAName, subCAExtensions,
+                                               rootPrivateKey.get(),
+                                               subCAPrivateKey));
+  ASSERT_NE(ENCODING_FAILED, subCADER);
 
   // Delegated responder cert signed by that sub-CA
-  static const SECOidTag signerEKU = SEC_OID_OCSP_RESPONDER;
-  const SECItem* extensions[] = {
-    CreateEncodedEKUExtension(arena.get(), &signerEKU, 1,
+  const ByteString extensions[] = {
+    CreateEncodedEKUExtension(OCSPSigningEKUDER,
                               ExtensionCriticality::NotCritical),
-    nullptr
+    ByteString()
   };
   ScopedSECKEYPrivateKey signerPrivateKey;
-  SECItem* signerDER(CreateEncodedCertificate(arena.get(), 1, subCAName,
-                                              oneDayBeforeNow, oneDayAfterNow,
-                                              signerName, extensions,
-                                              subCAPrivateKey.get(),
-                                              signerPrivateKey));
-  ASSERT_TRUE(signerDER);
+  ByteString signerDER(CreateEncodedCertificate(
+                         1, subCAName, oneDayBeforeNow, oneDayAfterNow,
+                         signerName, extensions, subCAPrivateKey.get(),
+                         signerPrivateKey));
+  ASSERT_NE(ENCODING_FAILED, signerDER);
 
   // OCSP response signed by the delegated responder issued by the sub-CA
   // that is trying to impersonate the root.
-  SECItem const* const certs[] = { signerDER, subCADER, nullptr };
-  Input response(CreateEncodedOCSPSuccessfulResponse(
+  ByteString certs[] = { signerDER, subCADER, ByteString() };
+  ByteString responseString(
+                 CreateEncodedOCSPSuccessfulResponse(
                          OCSPResponseContext::good, *endEntityCertID,
                          signerName, signerPrivateKey, oneDayBeforeNow,
                          oneDayBeforeNow, &oneDayAfterNow, certs));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
@@ -799,16 +844,18 @@ public:
   {
     pkixocsp_VerifyEncodedResponse_DelegatedResponder::SetUp();
 
-    Input
-      createdResponse(
+    responseString =
         CreateEncodedIndirectOCSPSuccessfulResponse(
-          "CN=OCSPGetCertTrustTest Signer", OCSPResponseContext::good,
-          byKey, SEC_OID_OCSP_RESPONDER, &signerCertDER));
-    if (response.Init(createdResponse) != Success) {
+          "OCSPGetCertTrustTest Signer", OCSPResponseContext::good,
+          byKey, &OCSPSigningEKUDER, &signerCertDER);
+    if (responseString == ENCODING_FAILED) {
       abort();
     }
-
-    if (response.GetLength() == 0 || signerCertDER.GetLength() == 0) {
+    if (response.Init(responseString.data(), responseString.length())
+          != Success) {
+      abort();
+    }
+    if (signerCertDER.length() == 0) {
       abort();
     }
   }
@@ -821,9 +868,9 @@ public:
     {
     }
 
-    bool SetCertTrust(Input certDER, TrustLevel certTrustLevel)
+    bool SetCertTrust(const ByteString& certDER, TrustLevel certTrustLevel)
     {
-      EXPECT_EQ(Success, this->certDER.Init(certDER));
+      this->certDER = certDER;
       this->certTrustLevel = certTrustLevel;
       return true;
     }
@@ -834,19 +881,22 @@ public:
                                 /*out*/ TrustLevel& trustLevel)
     {
       EXPECT_EQ(endEntityOrCA, EndEntityOrCA::MustBeEndEntity);
-      EXPECT_NE(0, certDER.GetLength());
-      EXPECT_TRUE(InputsAreEqual(certDER, candidateCert));
+      EXPECT_FALSE(certDER.empty());
+      Input certDERInput;
+      EXPECT_EQ(Success, certDERInput.Init(certDER.data(), certDER.length()));
+      EXPECT_TRUE(InputsAreEqual(certDERInput, candidateCert));
       trustLevel = certTrustLevel;
       return Success;
     }
 
-    Input certDER;
+    ByteString certDER;
     TrustLevel certTrustLevel;
   };
 
   TrustDomain trustDomain;
-  Input signerCertDER; // owned by arena
-  Input response; // owned by arena
+  ByteString signerCertDER;
+  ByteString responseString;
+  Input response; // references data in responseString
 };
 
 TEST_F(pkixocsp_VerifyEncodedResponse_GetCertTrust, InheritTrust)
@@ -877,6 +927,9 @@ TEST_F(pkixocsp_VerifyEncodedResponse_GetCertTrust, ActivelyDistrusted)
 {
   ASSERT_TRUE(trustDomain.SetCertTrust(signerCertDER,
                                        TrustLevel::ActivelyDistrusted));
+  Input response;
+  ASSERT_EQ(Success,
+            response.Init(responseString.data(), responseString.length()));
   bool expired;
   ASSERT_EQ(Result::ERROR_OCSP_INVALID_SIGNING_CERT,
             VerifyEncodedOCSPResponse(trustDomain, *endEntityCertID, Now(),
diff --git a/security/pkix/test/lib/pkixtestutil.cpp b/security/pkix/test/lib/pkixtestutil.cpp
index 6b6827b9875..e375aa38e0a 100644
--- a/security/pkix/test/lib/pkixtestutil.cpp
+++ b/security/pkix/test/lib/pkixtestutil.cpp
@@ -28,6 +28,7 @@
 #include <cstdio>
 #include <limits>
 #include <new>
+#include <sstream>
 
 #include "cert.h"
 #include "cryptohi.h"
@@ -37,21 +38,19 @@
 #include "pkixder.h"
 #include "pkixutil.h"
 #include "prinit.h"
-#include "prprf.h"
-#include "secder.h"
 #include "secerr.h"
 
 using namespace std;
 
 namespace mozilla { namespace pkix { namespace test {
 
-namespace {
+// python DottedOIDToCode.py --alg sha256WithRSAEncryption 1.2.840.113549.1.1.11
+static const uint8_t alg_sha256WithRSAEncryption[] = {
+  0x30, 0x0b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b
+};
+const Input sha256WithRSAEncryption(alg_sha256WithRSAEncryption);
 
-inline void
-deleteCharArray(char* chars)
-{
-  delete[] chars;
-}
+namespace {
 
 inline void
 fclose_void(FILE* file) {
@@ -61,27 +60,15 @@ fclose_void(FILE* file) {
 typedef mozilla::pkix::ScopedPtr<FILE, fclose_void> ScopedFILE;
 
 FILE*
-OpenFile(const char* dir, const char* filename, const char* mode)
+OpenFile(const string& dir, const string& filename, const string& mode)
 {
-  assert(dir);
-  assert(*dir);
-  assert(filename);
-  assert(*filename);
-
-  ScopedPtr<char, deleteCharArray>
-    path(new (nothrow) char[strlen(dir) + 1 + strlen(filename) + 1]);
-  if (!path) {
-    return nullptr;
-  }
-  strcpy(path.get(), dir);
-  strcat(path.get(), "/");
-  strcat(path.get(), filename);
+  string path = dir + '/' + filename;
 
   ScopedFILE file;
 #ifdef _MSC_VER
   {
     FILE* rawFile;
-    errno_t error = fopen_s(&rawFile, path.get(), mode);
+    errno_t error = fopen_s(&rawFile, path.c_str(), mode.c_str());
     if (error) {
       // TODO: map error to NSPR error code
       rawFile = nullptr;
@@ -89,7 +76,7 @@ OpenFile(const char* dir, const char* filename, const char* mode)
     file = rawFile;
   }
 #else
-  file = fopen(path.get(), mode);
+  file = fopen(path.c_str(), mode.c_str());
 #endif
   return file.release();
 }
@@ -97,158 +84,63 @@ OpenFile(const char* dir, const char* filename, const char* mode)
 } // unnamed namespace
 
 Result
-TamperOnce(SECItem& item,
-           const uint8_t* from, size_t fromLen,
-           const uint8_t* to, size_t toLen)
+TamperOnce(/*in/out*/ ByteString& item, const ByteString& from,
+           const ByteString& to)
 {
-  if (!item.data || !from || !to || fromLen != toLen) {
+  if (from.length() < 8) {
     return Result::FATAL_ERROR_INVALID_ARGS;
   }
-
-  if (fromLen < 8) {
+  if (from.length() != to.length()) {
     return Result::FATAL_ERROR_INVALID_ARGS;
   }
-
-  uint8_t* p = item.data;
-  size_t remaining = item.len;
-  bool alreadyFoundMatch = false;
-  for (;;) {
-    uint8_t* foundFirstByte = static_cast<uint8_t*>(memchr(p, from[0],
-                                                           remaining));
-    if (!foundFirstByte) {
-      if (alreadyFoundMatch) {
-        return Success;
-      }
-      return Result::FATAL_ERROR_INVALID_ARGS;
-    }
-    remaining -= (foundFirstByte - p);
-    if (remaining < fromLen) {
-      if (alreadyFoundMatch) {
-        return Success;
-      }
-      return Result::FATAL_ERROR_INVALID_ARGS;
-    }
-    if (!memcmp(foundFirstByte, from, fromLen)) {
-      if (alreadyFoundMatch) {
-        return Result::FATAL_ERROR_INVALID_ARGS;
-      }
-      alreadyFoundMatch = true;
-      memmove(foundFirstByte, to, toLen);
-      p = foundFirstByte + toLen;
-      remaining -= toLen;
-    } else {
-      p = foundFirstByte + 1;
-      --remaining;
-    }
+  size_t pos = item.find(from);
+  if (pos == string::npos) {
+    return Result::FATAL_ERROR_INVALID_ARGS; // No matches.
   }
+  if (item.find(from, pos + from.length()) != string::npos) {
+    return Result::FATAL_ERROR_INVALID_ARGS; // More than once match.
+  }
+  item.replace(pos, from.length(), to);
+  return Success;
 }
 
-Result
-InitInputFromSECItem(const SECItem* secItem, /*out*/ Input& input)
+// An empty string returned from an encoding function signifies failure.
+const ByteString ENCODING_FAILED;
+
+// Given a tag and a value, generates a DER-encoded tag-length-value item.
+static ByteString
+TLV(uint8_t tag, const ByteString& value)
 {
-  if (!secItem) {
-    return Result::FATAL_ERROR_INVALID_ARGS;
+  ByteString result;
+  result.push_back(tag);
+
+  if (value.length() < 128) {
+    result.push_back(value.length());
+  } else if (value.length() < 256) {
+    result.push_back(0x81u);
+    result.push_back(value.length());
+  } else if (value.length() < 65536) {
+    result.push_back(0x82u);
+    result.push_back(static_cast<uint8_t>(value.length() / 256));
+    result.push_back(static_cast<uint8_t>(value.length() % 256));
+  } else {
+    assert(false);
+    return ENCODING_FAILED;
   }
-  return input.Init(secItem->data, secItem->len);
+  result.append(value);
+  return result;
 }
 
-class Output
-{
-public:
-  Output()
-    : numItems(0)
-    , length(0)
-  {
-  }
-
-  // Makes a shallow copy of the input item. All input items must have a
-  // lifetime that extends at least to where Squash is called.
-  Result Add(const SECItem* item)
-  {
-    assert(item);
-    assert(item->data);
-
-    if (numItems >= MaxSequenceItems) {
-      return Result::FATAL_ERROR_INVALID_ARGS;
-    }
-    if (length + item->len > 65535) {
-      return Result::FATAL_ERROR_INVALID_ARGS;
-    }
-
-    contents[numItems] = item;
-    numItems++;
-    length += item->len;
-    return Success;
-  }
-
-  SECItem* Squash(PLArenaPool* arena, uint8_t tag)
-  {
-    assert(arena);
-
-    size_t lengthLength = length < 128 ? 1
-                        : length < 256 ? 2
-                                       : 3;
-    size_t totalLength = 1 + lengthLength + length;
-    SECItem* output = SECITEM_AllocItem(arena, nullptr, totalLength);
-    if (!output) {
-      return nullptr;
-    }
-    uint8_t* d = output->data;
-    *d++ = tag;
-    EncodeLength(d, length, lengthLength);
-    d += lengthLength;
-    for (size_t i = 0; i < numItems; i++) {
-      memcpy(d, contents[i]->data, contents[i]->len);
-      d += contents[i]->len;
-    }
-    return output;
-  }
-
-private:
-  void
-  EncodeLength(uint8_t* data, size_t length, size_t lengthLength)
-  {
-    switch (lengthLength) {
-      case 1:
-        data[0] = length;
-        break;
-      case 2:
-        data[0] = 0x81;
-        data[1] = length;
-        break;
-      case 3:
-        data[0] = 0x82;
-        data[1] = length / 256;
-        data[2] = length % 256;
-        break;
-      default:
-        abort();
-    }
-  }
-
-  static const size_t MaxSequenceItems = 10;
-  const SECItem* contents[MaxSequenceItems];
-  size_t numItems;
-  size_t length;
-
-  Output(const Output&) /* = delete */;
-  void operator=(const Output&) /* = delete */;
-};
-
-OCSPResponseContext::OCSPResponseContext(PLArenaPool* arena,
-                                         const CertID& certID, time_t time)
-  : arena(arena)
-  , certID(certID)
+OCSPResponseContext::OCSPResponseContext(const CertID& certID, time_t time)
+  : certID(certID)
   , responseStatus(successful)
   , skipResponseBytes(false)
-  , signerNameDER(nullptr)
   , producedAt(time)
   , extensions(nullptr)
   , includeEmptyExtensions(false)
   , badSignature(false)
   , certs(nullptr)
 
-  , certIDHashAlg(SEC_OID_SHA1)
   , certStatus(good)
   , revocationTime(0)
   , thisUpdate(time)
@@ -257,154 +149,73 @@ OCSPResponseContext::OCSPResponseContext(PLArenaPool* arena,
 {
 }
 
-static SECItem* ResponseBytes(OCSPResponseContext& context);
-static SECItem* BasicOCSPResponse(OCSPResponseContext& context);
-static SECItem* ResponseData(OCSPResponseContext& context);
-static SECItem* ResponderID(OCSPResponseContext& context);
-static SECItem* KeyHash(OCSPResponseContext& context);
-static SECItem* SingleResponse(OCSPResponseContext& context);
-static SECItem* CertID(OCSPResponseContext& context);
-static SECItem* CertStatus(OCSPResponseContext& context);
+static ByteString ResponseBytes(OCSPResponseContext& context);
+static ByteString BasicOCSPResponse(OCSPResponseContext& context);
+static ByteString ResponseData(OCSPResponseContext& context);
+static ByteString ResponderID(OCSPResponseContext& context);
+static ByteString KeyHash(OCSPResponseContext& context);
+static ByteString SingleResponse(OCSPResponseContext& context);
+static ByteString CertID(OCSPResponseContext& context);
+static ByteString CertStatus(OCSPResponseContext& context);
 
-static SECItem*
-EncodeNested(PLArenaPool* arena, uint8_t tag, const SECItem* inner)
+static ByteString
+HashedOctetString(const SECItem& bytes)
 {
-  Output output;
-  if (output.Add(inner) != Success) {
-    return nullptr;
+  uint8_t hashBuf[TrustDomain::DIGEST_LENGTH];
+  Input input;
+  if (input.Init(bytes.data, bytes.len) != Success) {
+    return ENCODING_FAILED;
   }
-  return output.Squash(arena, tag);
+  if (DigestBuf(input, hashBuf, sizeof(hashBuf)) != Success) {
+    return ENCODING_FAILED;
+  }
+  return TLV(der::OCTET_STRING, ByteString(hashBuf, sizeof(hashBuf)));
 }
 
-// A return value of 0 is an error, but this should never happen in practice
-// because this function aborts in that case.
-static size_t
-HashAlgorithmToLength(SECOidTag hashAlg)
-{
-  switch (hashAlg) {
-    case SEC_OID_SHA1:
-      return SHA1_LENGTH;
-    case SEC_OID_SHA256:
-      return SHA256_LENGTH;
-    case SEC_OID_SHA384:
-      return SHA384_LENGTH;
-    case SEC_OID_SHA512:
-      return SHA512_LENGTH;
-    default:
-      abort();
-  }
-  return 0;
-}
-
-static SECItem*
-HashedOctetString(PLArenaPool* arena, const SECItem& bytes, SECOidTag hashAlg)
-{
-  size_t hashLen = HashAlgorithmToLength(hashAlg);
-  if (hashLen == 0) {
-    return nullptr;
-  }
-  SECItem* hashBuf = SECITEM_AllocItem(arena, nullptr, hashLen);
-  if (!hashBuf) {
-    return nullptr;
-  }
-  if (PK11_HashBuf(hashAlg, hashBuf->data, bytes.data, bytes.len)
-        != SECSuccess) {
-    return nullptr;
-  }
-
-  return EncodeNested(arena, der::OCTET_STRING, hashBuf);
-}
-
-static SECItem*
-KeyHashHelper(PLArenaPool* arena, const CERTSubjectPublicKeyInfo* spki)
+static ByteString
+KeyHashHelper(const CERTSubjectPublicKeyInfo* spki)
 {
   // We only need a shallow copy here.
   SECItem spk = spki->subjectPublicKey;
   DER_ConvertBitString(&spk); // bits to bytes
-  return HashedOctetString(arena, spk, SEC_OID_SHA1);
+  return HashedOctetString(spk);
 }
 
-static SECItem*
-AlgorithmIdentifier(PLArenaPool* arena, SECOidTag algTag)
-{
-  SECAlgorithmIDStr aid;
-  aid.algorithm.data = nullptr;
-  aid.algorithm.len = 0;
-  aid.parameters.data = nullptr;
-  aid.parameters.len = 0;
-  if (SECOID_SetAlgorithmID(arena, &aid, algTag, nullptr) != SECSuccess) {
-    return nullptr;
-  }
-  static const SEC_ASN1Template algorithmIDTemplate[] = {
-    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(SECAlgorithmID) },
-    { SEC_ASN1_OBJECT_ID, offsetof(SECAlgorithmID, algorithm) },
-    { SEC_ASN1_OPTIONAL | SEC_ASN1_ANY, offsetof(SECAlgorithmID, parameters) },
-    { 0 }
-  };
-  SECItem* algorithmID = SEC_ASN1EncodeItem(arena, nullptr, &aid,
-                                            algorithmIDTemplate);
-  return algorithmID;
-}
-
-static SECItem*
-BitString(PLArenaPool* arena, const SECItem* rawBytes, bool corrupt)
+static ByteString
+BitString(const ByteString& rawBytes, bool corrupt)
 {
+  ByteString prefixed;
   // We have to add a byte at the beginning indicating no unused bits.
   // TODO: add ability to have bit strings of bit length not divisible by 8,
   // resulting in unused bits in the bitstring encoding
-  SECItem* prefixed = SECITEM_AllocItem(arena, nullptr, rawBytes->len + 1);
-  if (!prefixed) {
-    return nullptr;
-  }
-  prefixed->data[0] = 0;
-  memcpy(prefixed->data + 1, rawBytes->data, rawBytes->len);
+  prefixed.push_back(0);
+  prefixed.append(rawBytes);
   if (corrupt) {
-    assert(prefixed->len > 8);
-    prefixed->data[8]++;
+    assert(prefixed.length() > 8);
+    prefixed[8]++;
   }
-  return EncodeNested(arena, der::BIT_STRING, prefixed);
+  return TLV(der::BIT_STRING, prefixed);
 }
 
-static SECItem*
-Boolean(PLArenaPool* arena, bool value)
+static ByteString
+Boolean(bool value)
 {
-  assert(arena);
-  SECItem* result(SECITEM_AllocItem(arena, nullptr, 3));
-  if (!result) {
-    return nullptr;
-  }
-  result->data[0] = der::BOOLEAN;
-  result->data[1] = 1; // length
-  result->data[2] = value ? 0xff : 0x00;
-  return result;
+  ByteString encodedValue;
+  encodedValue.push_back(value ? 0xff : 0x00);
+  return TLV(der::BOOLEAN, encodedValue);
 }
 
-static SECItem*
-Integer(PLArenaPool* arena, long value)
+static ByteString
+Integer(long value)
 {
   if (value < 0 || value > 127) {
     // TODO: add encoding of larger values
-    return nullptr;
+    return ENCODING_FAILED;
   }
 
-  SECItem* encoded = SECITEM_AllocItem(arena, nullptr, 3);
-  if (!encoded) {
-    return nullptr;
-  }
-  encoded->data[0] = der::INTEGER;
-  encoded->data[1] = 1; // length
-  encoded->data[2] = value;
-  return encoded;
-}
-
-static SECItem*
-OID(PLArenaPool* arena, SECOidTag tag)
-{
-  const SECOidData* extnIDData(SECOID_FindOIDByTag(tag));
-  if (!extnIDData) {
-    return nullptr;
-  }
-  return EncodeNested(arena, der::OIDTag, &extnIDData->oid);
+  ByteString encodedValue;
+  encodedValue.push_back(static_cast<uint8_t>(value));
+  return TLV(der::INTEGER, encodedValue);
 }
 
 enum TimeEncoding { UTCTime = 0, GeneralizedTime = 1 };
@@ -427,14 +238,14 @@ gmtime_r(const time_t* t, /*out*/ tm* exploded)
 //
 // This assumes that time/time_t are POSIX-compliant in that time() returns
 // the number of seconds since the Unix epoch.
-static SECItem*
-TimeToEncodedTime(PLArenaPool* arena, time_t time, TimeEncoding encoding)
+static ByteString
+TimeToEncodedTime(time_t time, TimeEncoding encoding)
 {
   assert(encoding == UTCTime || encoding == GeneralizedTime);
 
   tm exploded;
   if (!gmtime_r(&time, &exploded)) {
-    return nullptr;
+    return ENCODING_FAILED;
   }
 
   if (exploded.tm_sec >= 60) {
@@ -446,46 +257,38 @@ TimeToEncodedTime(PLArenaPool* arena, time_t time, TimeEncoding encoding)
   int year = exploded.tm_year + 1900;
 
   if (encoding == UTCTime && (year < 1950 || year >= 2050)) {
-    return nullptr;
+    return ENCODING_FAILED;
   }
 
-  SECItem* derTime = SECITEM_AllocItem(arena, nullptr,
-                                       encoding == UTCTime ? 15 : 17);
-  if (!derTime) {
-    return nullptr;
-  }
-
-  size_t i = 0;
-
-  derTime->data[i++] = encoding == GeneralizedTime ? 0x18 : 0x17; // tag
-  derTime->data[i++] = static_cast<uint8_t>(derTime->len - 2); // length
+  ByteString value;
 
   if (encoding == GeneralizedTime) {
-    derTime->data[i++] = '0' + (year / 1000);
-    derTime->data[i++] = '0' + ((year % 1000) / 100);
+    value.push_back('0' + (year / 1000));
+    value.push_back('0' + ((year % 1000) / 100));
   }
 
-  derTime->data[i++] = '0' + ((year % 100) / 10);
-  derTime->data[i++] = '0' + (year % 10);
-  derTime->data[i++] = '0' + ((exploded.tm_mon + 1) / 10);
-  derTime->data[i++] = '0' + ((exploded.tm_mon + 1) % 10);
-  derTime->data[i++] = '0' + (exploded.tm_mday / 10);
-  derTime->data[i++] = '0' + (exploded.tm_mday % 10);
-  derTime->data[i++] = '0' + (exploded.tm_hour / 10);
-  derTime->data[i++] = '0' + (exploded.tm_hour % 10);
-  derTime->data[i++] = '0' + (exploded.tm_min / 10);
-  derTime->data[i++] = '0' + (exploded.tm_min % 10);
-  derTime->data[i++] = '0' + (exploded.tm_sec / 10);
-  derTime->data[i++] = '0' + (exploded.tm_sec % 10);
-  derTime->data[i++] = 'Z';
+  value.push_back('0' + ((year % 100) / 10));
+  value.push_back('0' + (year % 10));
+  value.push_back('0' + ((exploded.tm_mon + 1) / 10));
+  value.push_back('0' + ((exploded.tm_mon + 1) % 10));
+  value.push_back('0' + (exploded.tm_mday / 10));
+  value.push_back('0' + (exploded.tm_mday % 10));
+  value.push_back('0' + (exploded.tm_hour / 10));
+  value.push_back('0' + (exploded.tm_hour % 10));
+  value.push_back('0' + (exploded.tm_min / 10));
+  value.push_back('0' + (exploded.tm_min % 10));
+  value.push_back('0' + (exploded.tm_sec / 10));
+  value.push_back('0' + (exploded.tm_sec % 10));
+  value.push_back('Z');
 
-  return derTime;
+  return TLV(encoding == GeneralizedTime ? der::GENERALIZED_TIME : der::UTCTime,
+             value);
 }
 
-static SECItem*
-TimeToGeneralizedTime(PLArenaPool* arena, time_t time)
+static ByteString
+TimeToGeneralizedTime(time_t time)
 {
-  return TimeToEncodedTime(arena, time, GeneralizedTime);
+  return TimeToEncodedTime(time, GeneralizedTime);
 }
 
 // http://tools.ietf.org/html/rfc5280#section-4.1.2.5: "CAs conforming to this
@@ -493,19 +296,19 @@ TimeToGeneralizedTime(PLArenaPool* arena, time_t time)
 // as UTCTime; certificate validity dates in 2050 or later MUST be encoded as
 // GeneralizedTime." (This is a special case of the rule that we must always
 // use the shortest possible encoding.)
-static SECItem*
-TimeToTimeChoice(PLArenaPool* arena, time_t time)
+static ByteString
+TimeToTimeChoice(time_t time)
 {
   tm exploded;
   if (!gmtime_r(&time, &exploded)) {
-    return nullptr;
+    return ENCODING_FAILED;
   }
   TimeEncoding encoding = (exploded.tm_year + 1900 >= 1950 &&
                            exploded.tm_year + 1900 < 2050)
                         ? UTCTime
                         : GeneralizedTime;
 
-  return TimeToEncodedTime(arena, time, encoding);
+  return TimeToEncodedTime(time, encoding);
 }
 
 Time
@@ -556,79 +359,68 @@ YMDHMS(int16_t year, int16_t month, int16_t day,
   return TimeFromElapsedSecondsAD(totalSeconds);
 }
 
-static SECItem*
-SignedData(PLArenaPool* arena, const SECItem* tbsData,
-           SECKEYPrivateKey* privKey, SECOidTag hashAlg,
-           bool corrupt, /*optional*/ SECItem const* const* certs)
+static ByteString
+SignedData(const ByteString& tbsData,
+           SECKEYPrivateKey* privKey,
+           SignatureAlgorithm signatureAlgorithm,
+           bool corrupt, /*optional*/ const ByteString* certs)
 {
-  assert(arena);
-  assert(tbsData);
   assert(privKey);
-  if (!arena || !tbsData || !privKey) {
-    return nullptr;
+  if (!privKey) {
+    return ENCODING_FAILED;
   }
 
-  SECOidTag signatureAlgTag = SEC_GetSignatureAlgorithmOidTag(privKey->keyType,
-                                                              hashAlg);
-  if (signatureAlgTag == SEC_OID_UNKNOWN) {
-    return nullptr;
-  }
-  SECItem* signatureAlgorithm = AlgorithmIdentifier(arena, signatureAlgTag);
-  if (!signatureAlgorithm) {
-    return nullptr;
+  SECOidTag signatureAlgorithmOidTag;
+  ByteString signatureAlgorithmDER;
+  switch (signatureAlgorithm) {
+    case SignatureAlgorithm::rsa_pkcs1_with_sha256:
+      signatureAlgorithmOidTag = SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION;
+      signatureAlgorithmDER.assign(alg_sha256WithRSAEncryption,
+                                   sizeof(alg_sha256WithRSAEncryption));
+      break;
+    default:
+      return ENCODING_FAILED;
   }
 
-  // SEC_SignData doesn't take an arena parameter, so we have to manage
-  // the memory allocated in signature.
   SECItem signature;
-  if (SEC_SignData(&signature, tbsData->data, tbsData->len, privKey,
-                   signatureAlgTag) != SECSuccess)
+  if (SEC_SignData(&signature, tbsData.data(), tbsData.length(), privKey,
+                   signatureAlgorithmOidTag) != SECSuccess)
   {
-    return nullptr;
+    return ENCODING_FAILED;
   }
   // TODO: add ability to have signatures of bit length not divisible by 8,
   // resulting in unused bits in the bitstring encoding
-  SECItem* signatureNested = BitString(arena, &signature, corrupt);
+  ByteString signatureNested(BitString(ByteString(signature.data, signature.len),
+                                       corrupt));
   SECITEM_FreeItem(&signature, false);
-  if (!signatureNested) {
-    return nullptr;
+  if (signatureNested == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
 
-  SECItem* certsNested = nullptr;
+  ByteString certsNested;
   if (certs) {
-    Output certsOutput;
-    while (*certs) {
-      certsOutput.Add(*certs);
+    ByteString certsSequenceValue;
+    while (!(*certs).empty()) {
+      certsSequenceValue.append(*certs);
       ++certs;
     }
-    SECItem* certsSequence = certsOutput.Squash(arena, der::SEQUENCE);
-    if (!certsSequence) {
-      return nullptr;
+    ByteString certsSequence(TLV(der::SEQUENCE, certsSequenceValue));
+    if (certsSequence == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    certsNested = EncodeNested(arena,
-                               der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 0,
-                               certsSequence);
-    if (!certsNested) {
-      return nullptr;
+    certsNested = TLV(der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 0,
+                      certsSequence);
+    if (certsNested == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
   }
 
-  Output output;
-  if (output.Add(tbsData) != Success) {
-    return nullptr;
-  }
-  if (output.Add(signatureAlgorithm) != Success) {
-    return nullptr;
-  }
-  if (output.Add(signatureNested) != Success) {
-    return nullptr;
-  }
-  if (certsNested) {
-    if (output.Add(certsNested) != Success) {
-      return nullptr;
-    }
-  }
-  return output.Squash(arena, der::SEQUENCE);
+  ByteString value;
+  value.append(tbsData);
+  value.append(signatureAlgorithmDER);
+  value.append(signatureNested);
+  value.append(certsNested);
+  return TLV(der::SEQUENCE, value);
 }
 
 // Extension  ::=  SEQUENCE  {
@@ -639,74 +431,60 @@ SignedData(PLArenaPool* arena, const SECItem* tbsData,
 //                  -- corresponding to the extension type identified
 //                  -- by extnID
 //      }
-static SECItem*
-Extension(PLArenaPool* arena, SECOidTag extnIDTag,
-          ExtensionCriticality criticality, Output& value)
+static ByteString
+Extension(Input extnID, ExtensionCriticality criticality,
+          const ByteString& extnValueBytes)
 {
-  assert(arena);
-  if (!arena) {
-    return nullptr;
-  }
+  ByteString encoded;
 
-  Output output;
-
-  const SECItem* extnID(OID(arena, extnIDTag));
-  if (!extnID) {
-    return nullptr;
-  }
-  if (output.Add(extnID) != Success) {
-    return nullptr;
-  }
+  encoded.append(ByteString(extnID.UnsafeGetData(), extnID.GetLength()));
 
   if (criticality == ExtensionCriticality::Critical) {
-    SECItem* critical(Boolean(arena, true));
-    if (output.Add(critical) != Success) {
-      return nullptr;
+    ByteString critical(Boolean(true));
+    if (critical == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
+    encoded.append(critical);
   }
 
-  SECItem* extnValueBytes(value.Squash(arena, der::SEQUENCE));
-  if (!extnValueBytes) {
-    return nullptr;
+  ByteString extnValueSequence(TLV(der::SEQUENCE, extnValueBytes));
+  if (extnValueBytes == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* extnValue(EncodeNested(arena, der::OCTET_STRING, extnValueBytes));
-  if (!extnValue) {
-    return nullptr;
+  ByteString extnValue(TLV(der::OCTET_STRING, extnValueSequence));
+  if (extnValue == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  if (output.Add(extnValue) != Success) {
-    return nullptr;
-  }
-
-  return output.Squash(arena, der::SEQUENCE);
+  encoded.append(extnValue);
+  return TLV(der::SEQUENCE, encoded);
 }
 
-SECItem*
-MaybeLogOutput(SECItem* result, const char* suffix)
+void
+MaybeLogOutput(const ByteString& result, const char* suffix)
 {
   assert(suffix);
 
-  if (!result) {
-    return nullptr;
-  }
-
   // This allows us to more easily debug the generated output, by creating a
   // file in the directory given by MOZILLA_PKIX_TEST_LOG_DIR for each
   // NOT THREAD-SAFE!!!
   const char* logPath = getenv("MOZILLA_PKIX_TEST_LOG_DIR");
   if (logPath) {
     static int counter = 0;
-    ScopedPtr<char, PR_smprintf_free>
-      filename(PR_smprintf("%u-%s.der", counter, suffix));
+
+    std::ostringstream counterStream;
+    counterStream << counter;
+    if (!counterStream) {
+      assert(false);
+      return;
+    }
+    string filename = counterStream.str() + '-' + suffix + ".der";
+
     ++counter;
-    if (filename) {
-      ScopedFILE file(OpenFile(logPath, filename.get(), "wb"));
-      if (file) {
-        (void) fwrite(result->data, result->len, 1, file.get());
-      }
+    ScopedFILE file(OpenFile(logPath, filename, "wb"));
+    if (file) {
+      (void) fwrite(result.data(), result.length(), 1, file.get());
     }
   }
-
-  return result;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -761,61 +539,57 @@ GenerateKeyPair(/*out*/ ScopedSECKEYPublicKey& publicKey,
 ///////////////////////////////////////////////////////////////////////////////
 // Certificates
 
-static SECItem* TBSCertificate(PLArenaPool* arena, long version,
-                               const SECItem* serialNumber, SECOidTag signature,
-                               const SECItem* issuer, time_t notBefore,
-                               time_t notAfter, const SECItem* subject,
-                               const SECKEYPublicKey* subjectPublicKey,
-                               /*optional*/ SECItem const* const* extensions);
+static ByteString TBSCertificate(long version, const ByteString& serialNumber,
+                                 Input signature, const ByteString& issuer,
+                                 time_t notBefore, time_t notAfter,
+                                 const ByteString& subject,
+                                 const SECKEYPublicKey* subjectPublicKey,
+                                 /*optional*/ const ByteString* extensions);
 
 // Certificate  ::=  SEQUENCE  {
 //         tbsCertificate       TBSCertificate,
 //         signatureAlgorithm   AlgorithmIdentifier,
 //         signatureValue       BIT STRING  }
-SECItem*
-CreateEncodedCertificate(PLArenaPool* arena, long version,
-                         SECOidTag signature, const SECItem* serialNumber,
-                         const SECItem* issuerNameDER, time_t notBefore,
-                         time_t notAfter, const SECItem* subjectNameDER,
-                         /*optional*/ SECItem const* const* extensions,
+ByteString
+CreateEncodedCertificate(long version, Input signature,
+                         const ByteString& serialNumber,
+                         const ByteString& issuerNameDER,
+                         time_t notBefore, time_t notAfter,
+                         const ByteString& subjectNameDER,
+                         /*optional*/ const ByteString* extensions,
                          /*optional*/ SECKEYPrivateKey* issuerPrivateKey,
-                         SECOidTag signatureHashAlg,
+                         SignatureAlgorithm signatureAlgorithm,
                          /*out*/ ScopedSECKEYPrivateKey& privateKeyResult)
 {
-  assert(arena);
-  assert(issuerNameDER);
-  assert(subjectNameDER);
-  if (!arena || !issuerNameDER || !subjectNameDER) {
-    return nullptr;
-  }
-
   // It may be the case that privateKeyResult refers to the
   // ScopedSECKEYPrivateKey that owns issuerPrivateKey; thus, we can't set
   // privateKeyResult until after we're done with issuerPrivateKey.
   ScopedSECKEYPublicKey publicKey;
   ScopedSECKEYPrivateKey privateKeyTemp;
   if (GenerateKeyPair(publicKey, privateKeyTemp) != Success) {
-    return nullptr;
+    return ENCODING_FAILED;
   }
 
-  SECItem* tbsCertificate(TBSCertificate(arena, version, serialNumber,
-                                         signature, issuerNameDER, notBefore,
-                                         notAfter, subjectNameDER,
-                                         publicKey.get(), extensions));
-  if (!tbsCertificate) {
-    return nullptr;
+  ByteString tbsCertificate(TBSCertificate(version, serialNumber,
+                                           signature, issuerNameDER, notBefore,
+                                           notAfter, subjectNameDER,
+                                           publicKey.get(), extensions));
+  if (tbsCertificate == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
 
-  SECItem*
-    result(MaybeLogOutput(SignedData(arena, tbsCertificate,
-                                     issuerPrivateKey ? issuerPrivateKey
-                                                      : privateKeyTemp.get(),
-                                     signatureHashAlg, false, nullptr),
-                          "cert"));
-  if (!result) {
-    return nullptr;
+  ByteString result(SignedData(tbsCertificate,
+                               issuerPrivateKey ? issuerPrivateKey
+                                                : privateKeyTemp.get(),
+                               signatureAlgorithm, false, nullptr));
+  if (result == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
+
+  MaybeLogOutput(result, "cert");
+
   privateKeyResult = privateKeyTemp.release();
+
   return result;
 }
 
@@ -833,88 +607,62 @@ CreateEncodedCertificate(PLArenaPool* arena, long version,
 //                           -- If present, version MUST be v2 or v3
 //      extensions      [3]  Extensions OPTIONAL
 //                           -- If present, version MUST be v3 --  }
-static SECItem*
-TBSCertificate(PLArenaPool* arena, long versionValue,
-               const SECItem* serialNumber, SECOidTag signatureOidTag,
-               const SECItem* issuer, time_t notBeforeTime,
-               time_t notAfterTime, const SECItem* subject,
+static ByteString
+TBSCertificate(long versionValue,
+               const ByteString& serialNumber, Input signature,
+               const ByteString& issuer, time_t notBeforeTime,
+               time_t notAfterTime, const ByteString& subject,
                const SECKEYPublicKey* subjectPublicKey,
-               /*optional*/ SECItem const* const* extensions)
+               /*optional*/ const ByteString* extensions)
 {
-  assert(arena);
-  assert(issuer);
-  assert(subject);
   assert(subjectPublicKey);
-  if (!arena || !issuer || !subject || !subjectPublicKey) {
-    return nullptr;
+  if (!subjectPublicKey) {
+    return ENCODING_FAILED;
   }
 
-  Output output;
+  ByteString value;
 
   if (versionValue != static_cast<long>(der::Version::v1)) {
-    SECItem* versionInteger(Integer(arena, versionValue));
-    if (!versionInteger) {
-      return nullptr;
+    ByteString versionInteger(Integer(versionValue));
+    if (versionInteger == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    SECItem* version(EncodeNested(arena,
-                                  der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 0,
-                                  versionInteger));
-    if (!version) {
-      return nullptr;
-    }
-    if (output.Add(version) != Success) {
-      return nullptr;
+    ByteString version(TLV(der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 0,
+                           versionInteger));
+    if (version == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
+    value.append(version);
   }
 
-  if (output.Add(serialNumber) != Success) {
-    return nullptr;
-  }
-
-  SECItem* signature(AlgorithmIdentifier(arena, signatureOidTag));
-  if (!signature) {
-    return nullptr;
-  }
-  if (output.Add(signature) != Success) {
-    return nullptr;
-  }
-
-  if (output.Add(issuer) != Success) {
-    return nullptr;
-  }
+  value.append(serialNumber);
+  value.append(signature.UnsafeGetData(), signature.GetLength());
+  value.append(issuer);
 
   // Validity ::= SEQUENCE {
   //       notBefore      Time,
   //       notAfter       Time }
-  SECItem* validity;
+  ByteString validity;
   {
-    SECItem* notBefore(TimeToTimeChoice(arena, notBeforeTime));
-    if (!notBefore) {
-      return nullptr;
+    ByteString notBefore(TimeToTimeChoice(notBeforeTime));
+    if (notBefore == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    SECItem* notAfter(TimeToTimeChoice(arena, notAfterTime));
-    if (!notAfter) {
-      return nullptr;
+    ByteString notAfter(TimeToTimeChoice(notAfterTime));
+    if (notAfter == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    Output validityOutput;
-    if (validityOutput.Add(notBefore) != Success) {
-      return nullptr;
-    }
-    if (validityOutput.Add(notAfter) != Success) {
-      return nullptr;
-    }
-    validity = validityOutput.Squash(arena, der::SEQUENCE);
-    if (!validity) {
-      return nullptr;
+    ByteString validityValue;
+    validityValue.append(notBefore);
+    validityValue.append(notAfter);
+    validity = TLV(der::SEQUENCE, validityValue);
+    if (validity == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
   }
-  if (output.Add(validity) != Success) {
-    return nullptr;
-  }
+  value.append(validity);
 
-  if (output.Add(subject) != Success) {
-    return nullptr;
-  }
+  value.append(subject);
 
   // SubjectPublicKeyInfo  ::=  SEQUENCE  {
   //       algorithm            AlgorithmIdentifier,
@@ -922,128 +670,147 @@ TBSCertificate(PLArenaPool* arena, long versionValue,
   ScopedSECItem subjectPublicKeyInfo(
     SECKEY_EncodeDERSubjectPublicKeyInfo(subjectPublicKey));
   if (!subjectPublicKeyInfo) {
-    return nullptr;
-  }
-  if (output.Add(subjectPublicKeyInfo.get()) != Success) {
-    return nullptr;
+    return ENCODING_FAILED;
   }
+  value.append(subjectPublicKeyInfo->data, subjectPublicKeyInfo->len);
 
   if (extensions) {
-    Output extensionsOutput;
-    while (*extensions) {
-      if (extensionsOutput.Add(*extensions) != Success) {
-        return nullptr;
-      }
+    ByteString extensionsValue;
+    while (!(*extensions).empty()) {
+      extensionsValue.append(*extensions);
       ++extensions;
     }
-    SECItem* allExtensions(extensionsOutput.Squash(arena, der::SEQUENCE));
-    if (!allExtensions) {
-      return nullptr;
+    ByteString extensionsSequence(TLV(der::SEQUENCE, extensionsValue));
+    if (extensionsSequence == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    SECItem* extensionsWrapped(
-      EncodeNested(arena, der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 3,
-                   allExtensions));
-    if (!extensions) {
-      return nullptr;
-    }
-    if (output.Add(extensionsWrapped) != Success) {
-      return nullptr;
+    ByteString extensionsWrapped(
+      TLV(der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 3, extensionsSequence));
+    if (extensionsWrapped == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
+    value.append(extensionsWrapped);
   }
 
-  return output.Squash(arena, der::SEQUENCE);
+  return TLV(der::SEQUENCE, value);
 }
 
-const SECItem*
-ASCIIToDERName(PLArenaPool* arena, const char* cn)
+ByteString
+CNToDERName(const char* cn)
 {
-  ScopedPtr<CERTName, CERT_DestroyName> certName(CERT_AsciiToName(cn));
-  if (!certName) {
-    return nullptr;
+  // Name ::= CHOICE { -- only one possibility for now --
+  //   rdnSequence  RDNSequence }
+  //
+  // RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
+  //
+  // RelativeDistinguishedName ::=
+  //   SET SIZE (1..MAX) OF AttributeTypeAndValue
+  //
+  // AttributeTypeAndValue ::= SEQUENCE {
+  //   type     AttributeType,
+  //   value    AttributeValue }
+  //
+  // AttributeType ::= OBJECT IDENTIFIER
+  //
+  // AttributeValue ::= ANY -- DEFINED BY AttributeType
+  //
+  // DirectoryString ::= CHOICE {
+  //       teletexString           TeletexString (SIZE (1..MAX)),
+  //       printableString         PrintableString (SIZE (1..MAX)),
+  //       universalString         UniversalString (SIZE (1..MAX)),
+  //       utf8String              UTF8String (SIZE (1..MAX)),
+  //       bmpString               BMPString (SIZE (1..MAX)) }
+  //
+  // id-at OBJECT IDENTIFIER ::= { joint-iso-ccitt(2) ds(5) 4 }
+  // id-at-commonName        AttributeType ::= { id-at 3 }
+
+  // python DottedOIDToCode.py --tlv id-at-commonName 2.5.4.3
+  static const uint8_t tlv_id_at_commonName[] = {
+    0x06, 0x03, 0x55, 0x04, 0x03
+  };
+
+  ByteString value(reinterpret_cast<const ByteString::value_type*>(cn));
+  value = TLV(der::UTF8String, value);
+
+  ByteString ava;
+  ava.append(tlv_id_at_commonName, sizeof(tlv_id_at_commonName));
+  ava.append(value);
+  ava = TLV(der::SEQUENCE, ava);
+  if (ava == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  return SEC_ASN1EncodeItem(arena, nullptr, certName.get(),
-                            SEC_ASN1_GET(CERT_NameTemplate));
+
+  ByteString rdn(TLV(der::SET, ava));
+  if (rdn == ENCODING_FAILED) {
+    return ENCODING_FAILED;
+  }
+
+  return TLV(der::SEQUENCE, rdn);
 }
 
-SECItem*
-CreateEncodedSerialNumber(PLArenaPool* arena, long serialNumberValue)
+ByteString
+CreateEncodedSerialNumber(long serialNumberValue)
 {
-  return Integer(arena, serialNumberValue);
+  return Integer(serialNumberValue);
 }
 
 // BasicConstraints ::= SEQUENCE {
 //         cA                      BOOLEAN DEFAULT FALSE,
 //         pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
-SECItem*
-CreateEncodedBasicConstraints(PLArenaPool* arena, bool isCA,
+ByteString
+CreateEncodedBasicConstraints(bool isCA,
                               /*optional*/ long* pathLenConstraintValue,
                               ExtensionCriticality criticality)
 {
-  assert(arena);
-  if (!arena) {
-    return nullptr;
-  }
-
-  Output value;
+  ByteString value;
 
   if (isCA) {
-    if (value.Add(Boolean(arena, true)) != Success) {
-      return nullptr;
+    ByteString cA(Boolean(true));
+    if (cA == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
+    value.append(cA);
   }
 
   if (pathLenConstraintValue) {
-    SECItem* pathLenConstraint(Integer(arena, *pathLenConstraintValue));
-    if (!pathLenConstraint) {
-      return nullptr;
-    }
-    if (value.Add(pathLenConstraint) != Success) {
-      return nullptr;
+    ByteString pathLenConstraint(Integer(*pathLenConstraintValue));
+    if (pathLenConstraint == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
+    value.append(pathLenConstraint);
   }
 
-  return Extension(arena, SEC_OID_X509_BASIC_CONSTRAINTS, criticality, value);
+  // python DottedOIDToCode.py --tlv id-ce-basicConstraints 2.5.29.19
+  static const uint8_t tlv_id_ce_basicConstraints[] = {
+    0x06, 0x03, 0x55, 0x1d, 0x13
+  };
+  return Extension(Input(tlv_id_ce_basicConstraints), criticality, value);
 }
 
 // ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
 // KeyPurposeId ::= OBJECT IDENTIFIER
-SECItem*
-CreateEncodedEKUExtension(PLArenaPool* arena, SECOidTag const* ekus,
-                          size_t ekusCount, ExtensionCriticality criticality)
+ByteString
+CreateEncodedEKUExtension(Input ekuOID, ExtensionCriticality criticality)
 {
-  assert(arena);
-  assert(ekus);
-  if (!arena || (!ekus && ekusCount != 0)) {
-    return nullptr;
-  }
+  ByteString value(ekuOID.UnsafeGetData(), ekuOID.GetLength());
 
-  Output value;
-  for (size_t i = 0; i < ekusCount; ++i) {
-    SECItem* encodedEKUOID = OID(arena, ekus[i]);
-    if (!encodedEKUOID) {
-      return nullptr;
-    }
-    if (value.Add(encodedEKUOID) != Success) {
-      return nullptr;
-    }
-  }
+  // python DottedOIDToCode.py --tlv id-ce-extKeyUsage 2.5.29.37
+  static const uint8_t tlv_id_ce_extKeyUsage[] = {
+    0x06, 0x03, 0x55, 0x1d, 0x25
+  };
 
-  return Extension(arena, SEC_OID_X509_EXT_KEY_USAGE, criticality, value);
+  return Extension(Input(tlv_id_ce_extKeyUsage), criticality, value);
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 // OCSP responses
 
-SECItem*
+ByteString
 CreateEncodedOCSPResponse(OCSPResponseContext& context)
 {
-  if (!context.arena) {
-    return nullptr;
-  }
-
   if (!context.skipResponseBytes) {
     if (!context.signerPrivateKey) {
-      return nullptr;
+      return ENCODING_FAILED;
     }
   }
 
@@ -1060,75 +827,64 @@ CreateEncodedOCSPResponse(OCSPResponseContext& context)
   //    sigRequired         (5),  -- Must sign the request
   //    unauthorized        (6)   -- Request unauthorized
   // }
-  SECItem* responseStatus = SECITEM_AllocItem(context.arena, nullptr, 3);
-  if (!responseStatus) {
-    return nullptr;
+  ByteString reponseStatusValue;
+  reponseStatusValue.push_back(context.responseStatus);
+  ByteString responseStatus(TLV(der::ENUMERATED, reponseStatusValue));
+  if (responseStatus == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  responseStatus->data[0] = der::ENUMERATED;
-  responseStatus->data[1] = 1;
-  responseStatus->data[2] = context.responseStatus;
 
-  SECItem* responseBytesNested = nullptr;
+  ByteString responseBytesNested;
   if (!context.skipResponseBytes) {
-    SECItem* responseBytes = ResponseBytes(context);
-    if (!responseBytes) {
-      return nullptr;
+    ByteString responseBytes(ResponseBytes(context));
+    if (responseBytes == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
 
-    responseBytesNested = EncodeNested(context.arena,
-                                       der::CONSTRUCTED |
-                                       der::CONTEXT_SPECIFIC,
-                                       responseBytes);
-    if (!responseBytesNested) {
-      return nullptr;
+    responseBytesNested = TLV(der::CONSTRUCTED | der::CONTEXT_SPECIFIC,
+                              responseBytes);
+    if (responseBytesNested == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
   }
 
-  Output output;
-  if (output.Add(responseStatus) != Success) {
-    return nullptr;
+  ByteString value;
+  value.append(responseStatus);
+  value.append(responseBytesNested);
+  ByteString result(TLV(der::SEQUENCE, value));
+  if (result == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  if (responseBytesNested) {
-    if (output.Add(responseBytesNested) != Success) {
-      return nullptr;
-    }
-  }
-  return MaybeLogOutput(output.Squash(context.arena, der::SEQUENCE), "ocsp");
+
+  MaybeLogOutput(result, "ocsp");
+
+  return result;
 }
 
 // ResponseBytes ::= SEQUENCE {
 //    responseType            OBJECT IDENTIFIER,
 //    response                OCTET STRING }
-SECItem*
+ByteString
 ResponseBytes(OCSPResponseContext& context)
 {
   // Includes tag and length
   static const uint8_t id_pkix_ocsp_basic_encoded[] = {
     0x06, 0x09, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x01
   };
-  SECItem id_pkix_ocsp_basic = {
-    siBuffer,
-    const_cast<uint8_t*>(id_pkix_ocsp_basic_encoded),
-    sizeof(id_pkix_ocsp_basic_encoded)
-  };
-  SECItem* response = BasicOCSPResponse(context);
-  if (!response) {
-    return nullptr;
+  ByteString response(BasicOCSPResponse(context));
+  if (response == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* responseNested = EncodeNested(context.arena, der::OCTET_STRING,
-                                         response);
-  if (!responseNested) {
-    return nullptr;
+  ByteString responseNested = TLV(der::OCTET_STRING, response);
+  if (responseNested == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
 
-  Output output;
-  if (output.Add(&id_pkix_ocsp_basic) != Success) {
-    return nullptr;
-  }
-  if (output.Add(responseNested) != Success) {
-    return nullptr;
-  }
-  return output.Squash(context.arena, der::SEQUENCE);
+  ByteString value;
+  value.append(id_pkix_ocsp_basic_encoded,
+               sizeof(id_pkix_ocsp_basic_encoded));
+  value.append(responseNested);
+  return TLV(der::SEQUENCE, value);
 }
 
 // BasicOCSPResponse ::= SEQUENCE {
@@ -1136,17 +892,18 @@ ResponseBytes(OCSPResponseContext& context)
 //   signatureAlgorithm       AlgorithmIdentifier,
 //   signature                BIT STRING,
 //   certs                [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
-SECItem*
+ByteString
 BasicOCSPResponse(OCSPResponseContext& context)
 {
-  SECItem* tbsResponseData = ResponseData(context);
-  if (!tbsResponseData) {
-    return nullptr;
+  ByteString tbsResponseData(ResponseData(context));
+  if (tbsResponseData == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
 
   // TODO(bug 980538): certs
-  return SignedData(context.arena, tbsResponseData,
-                    context.signerPrivateKey.get(), SEC_OID_SHA1,
+  return SignedData(tbsResponseData,
+                    context.signerPrivateKey.get(),
+                    SignatureAlgorithm::rsa_pkcs1_with_sha256,
                     context.badSignature, context.certs);
 }
 
@@ -1155,61 +912,46 @@ BasicOCSPResponse(OCSPResponseContext& context)
 //   critical         BOOLEAN DEFAULT FALSE
 //   value            OCTET STRING
 // }
-static SECItem*
-OCSPExtension(OCSPResponseContext& context, OCSPResponseExtension* extension)
+static ByteString
+OCSPExtension(OCSPResponseContext& context, OCSPResponseExtension& extension)
 {
-  Output output;
-  if (output.Add(&extension->id) != Success) {
-    return nullptr;
-  }
-  if (extension->critical) {
-    static const uint8_t trueEncoded[3] = { 0x01, 0x01, 0xFF };
-    SECItem critical = {
-      siBuffer,
-      const_cast<uint8_t*>(trueEncoded),
-      sizeof(trueEncoded)
-    };
-    if (output.Add(&critical) != Success) {
-      return nullptr;
+  ByteString encoded;
+  encoded.append(extension.id);
+  if (extension.critical) {
+    ByteString critical(Boolean(true));
+    if (critical == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
+    encoded.append(critical);
   }
-  SECItem* value = EncodeNested(context.arena, der::OCTET_STRING,
-                                &extension->value);
-  if (!value) {
-    return nullptr;
+  ByteString value(TLV(der::OCTET_STRING, extension.value));
+  if (value == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  if (output.Add(value) != Success) {
-    return nullptr;
-  }
-  return output.Squash(context.arena, der::SEQUENCE);
+  encoded.append(value);
+  return TLV(der::SEQUENCE, encoded);
 }
 
 // Extensions ::= [1] {
 //   SEQUENCE OF Extension
 // }
-static SECItem*
+static ByteString
 Extensions(OCSPResponseContext& context)
 {
-  Output output;
+  ByteString value;
   for (OCSPResponseExtension* extension = context.extensions;
        extension; extension = extension->next) {
-    SECItem* extensionEncoded = OCSPExtension(context, extension);
-    if (!extensionEncoded) {
-      return nullptr;
-    }
-    if (output.Add(extensionEncoded) != Success) {
-      return nullptr;
+    ByteString extensionEncoded(OCSPExtension(context, *extension));
+    if (extensionEncoded == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
+    value.append(extensionEncoded);
   }
-  SECItem* extensionsEncoded = output.Squash(context.arena, der::SEQUENCE);
-  if (!extensionsEncoded) {
-    return nullptr;
+  ByteString sequence(TLV(der::SEQUENCE, value));
+  if (sequence == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  return EncodeNested(context.arena,
-                      der::CONSTRUCTED |
-                      der::CONTEXT_SPECIFIC |
-                      1,
-                      extensionsEncoded);
+  return TLV(der::CONSTRUCTED | der::CONTEXT_SPECIFIC | 1, sequence);
 }
 
 // ResponseData ::= SEQUENCE {
@@ -1218,75 +960,60 @@ Extensions(OCSPResponseContext& context)
 //    producedAt              GeneralizedTime,
 //    responses               SEQUENCE OF SingleResponse,
 //    responseExtensions  [1] EXPLICIT Extensions OPTIONAL }
-SECItem*
+ByteString
 ResponseData(OCSPResponseContext& context)
 {
-  SECItem* responderID = ResponderID(context);
-  if (!responderID) {
-    return nullptr;
+  ByteString responderID(ResponderID(context));
+  if (responderID == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* producedAtEncoded = TimeToGeneralizedTime(context.arena,
-                                                     context.producedAt);
-  if (!producedAtEncoded) {
-    return nullptr;
+  ByteString producedAtEncoded(TimeToGeneralizedTime(context.producedAt));
+  if (producedAtEncoded == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* responses = SingleResponse(context);
-  if (!responses) {
-    return nullptr;
+  ByteString response(SingleResponse(context));
+  if (response == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* responsesNested = EncodeNested(context.arena, der::SEQUENCE,
-                                          responses);
-  if (!responsesNested) {
-    return nullptr;
+  ByteString responses(TLV(der::SEQUENCE, response));
+  if (responses == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* responseExtensions = nullptr;
+  ByteString responseExtensions;
   if (context.extensions || context.includeEmptyExtensions) {
     responseExtensions = Extensions(context);
   }
 
-  Output output;
-  if (output.Add(responderID) != Success) {
-    return nullptr;
-  }
-  if (output.Add(producedAtEncoded) != Success) {
-    return nullptr;
-  }
-  if (output.Add(responsesNested) != Success) {
-    return nullptr;
-  }
-  if (responseExtensions) {
-    if (output.Add(responseExtensions) != Success) {
-      return nullptr;
-    }
-  }
-  return output.Squash(context.arena, der::SEQUENCE);
+  ByteString value;
+  value.append(responderID);
+  value.append(producedAtEncoded);
+  value.append(responses);
+  value.append(responseExtensions);
+  return TLV(der::SEQUENCE, value);
 }
 
 // ResponderID ::= CHOICE {
 //    byName              [1] Name,
 //    byKey               [2] KeyHash }
 // }
-SECItem*
+ByteString
 ResponderID(OCSPResponseContext& context)
 {
-  const SECItem* contents;
+  ByteString contents;
   uint8_t responderIDType;
-  if (context.signerNameDER) {
+  if (!context.signerNameDER.empty()) {
     contents = context.signerNameDER;
     responderIDType = 1; // byName
   } else {
     contents = KeyHash(context);
+    if (contents == ENCODING_FAILED) {
+      return ENCODING_FAILED;
+    }
     responderIDType = 2; // byKey
   }
-  if (!contents) {
-    return nullptr;
-  }
 
-  return EncodeNested(context.arena,
-                      der::CONSTRUCTED |
-                      der::CONTEXT_SPECIFIC |
-                      responderIDType,
-                      contents);
+  return TLV(der::CONSTRUCTED | der::CONTEXT_SPECIFIC | responderIDType,
+             contents);
 }
 
 // KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
@@ -1294,7 +1021,7 @@ ResponderID(OCSPResponseContext& context)
 //                          -- BIT STRING subjectPublicKey [excluding
 //                          -- the tag, length, and number of unused
 //                          -- bits] in the responder's certificate)
-SECItem*
+ByteString
 KeyHash(OCSPResponseContext& context)
 {
   ScopedSECKEYPublicKey
@@ -1307,7 +1034,7 @@ KeyHash(OCSPResponseContext& context)
   if (!signerSPKI) {
     return nullptr;
   }
-  return KeyHashHelper(context.arena, signerSPKI.get());
+  return KeyHashHelper(signerSPKI.get());
 }
 
 // SingleResponse ::= SEQUENCE {
@@ -1316,55 +1043,40 @@ KeyHash(OCSPResponseContext& context)
 //    thisUpdate              GeneralizedTime,
 //    nextUpdate          [0] EXPLICIT GeneralizedTime OPTIONAL,
 //    singleExtensions    [1] EXPLICIT Extensions OPTIONAL }
-SECItem*
+ByteString
 SingleResponse(OCSPResponseContext& context)
 {
-  SECItem* certID = CertID(context);
-  if (!certID) {
-    return nullptr;
+  ByteString certID(CertID(context));
+  if (certID == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* certStatus = CertStatus(context);
-  if (!certStatus) {
-    return nullptr;
+  ByteString certStatus(CertStatus(context));
+  if (certStatus == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* thisUpdateEncoded = TimeToGeneralizedTime(context.arena,
-                                                     context.thisUpdate);
-  if (!thisUpdateEncoded) {
-    return nullptr;
+  ByteString thisUpdateEncoded(TimeToGeneralizedTime(context.thisUpdate));
+  if (thisUpdateEncoded == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
-  SECItem* nextUpdateEncodedNested = nullptr;
+  ByteString nextUpdateEncodedNested;
   if (context.includeNextUpdate) {
-    SECItem* nextUpdateEncoded = TimeToGeneralizedTime(context.arena,
-                                                       context.nextUpdate);
-    if (!nextUpdateEncoded) {
-      return nullptr;
+    ByteString nextUpdateEncoded(TimeToGeneralizedTime(context.nextUpdate));
+    if (nextUpdateEncoded == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
-    nextUpdateEncodedNested = EncodeNested(context.arena,
-                                           der::CONSTRUCTED |
-                                           der::CONTEXT_SPECIFIC |
-                                           0,
-                                           nextUpdateEncoded);
-    if (!nextUpdateEncodedNested) {
-      return nullptr;
+    nextUpdateEncodedNested = TLV(der::CONSTRUCTED | der::CONTEXT_SPECIFIC | 0,
+                                  nextUpdateEncoded);
+    if (nextUpdateEncodedNested == ENCODING_FAILED) {
+      return ENCODING_FAILED;
     }
   }
 
-  Output output;
-  if (output.Add(certID) != Success) {
-    return nullptr;
-  }
-  if (output.Add(certStatus) != Success) {
-    return nullptr;
-  }
-  if (output.Add(thisUpdateEncoded) != Success) {
-    return nullptr;
-  }
-  if (nextUpdateEncodedNested) {
-    if (output.Add(nextUpdateEncodedNested) != Success) {
-      return nullptr;
-    }
-  }
-  return output.Squash(context.arena, der::SEQUENCE);
+  ByteString value;
+  value.append(certID);
+  value.append(certStatus);
+  value.append(thisUpdateEncoded);
+  value.append(nextUpdateEncodedNested);
+  return TLV(der::SEQUENCE, value);
 }
 
 // CertID          ::=     SEQUENCE {
@@ -1372,19 +1084,13 @@ SingleResponse(OCSPResponseContext& context)
 //        issuerNameHash      OCTET STRING, -- Hash of issuer's DN
 //        issuerKeyHash       OCTET STRING, -- Hash of issuer's public key
 //        serialNumber        CertificateSerialNumber }
-SECItem*
+ByteString
 CertID(OCSPResponseContext& context)
 {
-  SECItem* hashAlgorithm = AlgorithmIdentifier(context.arena,
-                                               context.certIDHashAlg);
-  if (!hashAlgorithm) {
-    return nullptr;
-  }
   SECItem issuerSECItem = UnsafeMapInputToSECItem(context.certID.issuer);
-  SECItem* issuerNameHash = HashedOctetString(context.arena, issuerSECItem,
-                                              context.certIDHashAlg);
-  if (!issuerNameHash) {
-    return nullptr;
+  ByteString issuerNameHash(HashedOctetString(issuerSECItem));
+  if (issuerNameHash == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
 
   SECItem issuerSubjectPublicKeyInfoSECItem =
@@ -1393,40 +1099,31 @@ CertID(OCSPResponseContext& context)
     spki(SECKEY_DecodeDERSubjectPublicKeyInfo(
            &issuerSubjectPublicKeyInfoSECItem));
   if (!spki) {
-    return nullptr;
+    return ENCODING_FAILED;
   }
-  SECItem* issuerKeyHash(KeyHashHelper(context.arena, spki.get()));
-  if (!issuerKeyHash) {
-    return nullptr;
+  ByteString issuerKeyHash(KeyHashHelper(spki.get()));
+  if (issuerKeyHash == ENCODING_FAILED) {
+    return ENCODING_FAILED;
   }
 
-  static const SEC_ASN1Template serialTemplate[] = {
-    { SEC_ASN1_INTEGER, 0 },
-    { 0 }
+  ByteString serialNumberValue(context.certID.serialNumber.UnsafeGetData(),
+                               context.certID.serialNumber.GetLength());
+  ByteString serialNumber(TLV(der::INTEGER, serialNumberValue));
+  if (serialNumber == ENCODING_FAILED) {
+    return ENCODING_FAILED;
+  }
+
+  // python DottedOIDToCode.py --alg id-sha1 1.3.14.3.2.26
+  static const uint8_t alg_id_sha1[] = {
+    0x30, 0x07, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a
   };
-  SECItem serialNumberSECItem =
-    UnsafeMapInputToSECItem(context.certID.serialNumber);
-  SECItem* serialNumber = SEC_ASN1EncodeItem(context.arena, nullptr,
-                                             &serialNumberSECItem,
-                                             serialTemplate);
-  if (!serialNumber) {
-    return nullptr;
-  }
 
-  Output output;
-  if (output.Add(hashAlgorithm) != Success) {
-    return nullptr;
-  }
-  if (output.Add(issuerNameHash) != Success) {
-    return nullptr;
-  }
-  if (output.Add(issuerKeyHash) != Success) {
-    return nullptr;
-  }
-  if (output.Add(serialNumber) != Success) {
-    return nullptr;
-  }
-  return output.Squash(context.arena, der::SEQUENCE);
+  ByteString value;
+  value.append(alg_id_sha1, sizeof(alg_id_sha1));
+  value.append(issuerNameHash);
+  value.append(issuerKeyHash);
+  value.append(serialNumber);
+  return TLV(der::SEQUENCE, value);
 }
 
 // CertStatus ::= CHOICE {
@@ -1440,7 +1137,7 @@ CertID(OCSPResponseContext& context)
 //
 // UnknownInfo ::= NULL
 //
-SECItem*
+ByteString
 CertStatus(OCSPResponseContext& context)
 {
   switch (context.certStatus) {
@@ -1449,31 +1146,22 @@ CertStatus(OCSPResponseContext& context)
     case 0:
     case 2:
     {
-      SECItem* status = SECITEM_AllocItem(context.arena, nullptr, 2);
-      if (!status) {
-        return nullptr;
-      }
-      status->data[0] = der::CONTEXT_SPECIFIC | context.certStatus;
-      status->data[1] = 0;
-      return status;
+      return TLV(der::CONTEXT_SPECIFIC | context.certStatus, ByteString());
     }
     case 1:
     {
-      SECItem* revocationTime = TimeToGeneralizedTime(context.arena,
-                                                      context.revocationTime);
-      if (!revocationTime) {
-        return nullptr;
+      ByteString revocationTime(TimeToGeneralizedTime(context.revocationTime));
+      if (revocationTime == ENCODING_FAILED) {
+        return ENCODING_FAILED;
       }
       // TODO(bug 980536): add support for revocationReason
-      return EncodeNested(context.arena,
-                          der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 1,
-                          revocationTime);
+      return TLV(der::CONTEXT_SPECIFIC | der::CONSTRUCTED | 1, revocationTime);
     }
     default:
       assert(false);
       // fall through
   }
-  return nullptr;
+  return ENCODING_FAILED;
 }
 
 } } } // namespace mozilla::pkix::test
diff --git a/security/pkix/test/lib/pkixtestutil.h b/security/pkix/test/lib/pkixtestutil.h
index c29363d909a..1869da0dd4e 100644
--- a/security/pkix/test/lib/pkixtestutil.h
+++ b/security/pkix/test/lib/pkixtestutil.h
@@ -26,7 +26,8 @@
 #define mozilla_pkix_test__pkixtestutils_h
 
 #include <ctime>
-#include <stdint.h>
+#include <stdint.h> // Some Mozilla-supported compilers lack <cstdint>
+#include <string>
 
 #include "keyhi.h"
 #include "pkix/enumclass.h"
@@ -36,6 +37,9 @@
 
 namespace mozilla { namespace pkix { namespace test {
 
+typedef std::basic_string<uint8_t> ByteString;
+extern const ByteString ENCODING_FAILED;
+
 // XXX: Ideally, we should define this instead:
 //
 //   template <typename T, std::size_t N>
@@ -77,6 +81,18 @@ typedef mozilla::pkix::ScopedPtr<SECKEYPublicKey, SECKEY_DestroyPublicKey>
 typedef mozilla::pkix::ScopedPtr<SECKEYPrivateKey, SECKEY_DestroyPrivateKey>
   ScopedSECKEYPrivateKey;
 
+// python DottedOIDToCode.py --tlv id-kp-OCSPSigning 1.3.6.1.5.5.7.3.9
+static const uint8_t tlv_id_kp_OCSPSigning[] = {
+  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x09
+};
+
+// python DottedOIDToCode.py --tlv id-kp-serverAuth 1.3.6.1.5.5.7.3.1
+static const uint8_t tlv_id_kp_serverAuth[] = {
+  0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01
+};
+
+extern const Input sha256WithRSAEncryption;
+
 // e.g. YMDHMS(2016, 12, 31, 1, 23, 45) => 2016-12-31:01:23:45 (GMT)
 mozilla::pkix::Time YMDHMS(int16_t year, int16_t month, int16_t day,
                            int16_t hour, int16_t minutes, int16_t seconds);
@@ -84,28 +100,25 @@ mozilla::pkix::Time YMDHMS(int16_t year, int16_t month, int16_t day,
 Result GenerateKeyPair(/*out*/ ScopedSECKEYPublicKey& publicKey,
                        /*out*/ ScopedSECKEYPrivateKey& privateKey);
 
-// The result will be owned by the arena
-const SECItem* ASCIIToDERName(PLArenaPool* arena, const char* cn);
+ByteString CNToDERName(const char* cn);
 
 // Replace one substring in item with another of the same length, but only if
-// the substring was found exactly once. The "only once" restriction is helpful
-// for avoiding making multiple changes at once.
+// the substring was found exactly once. The "same length" restriction is
+// useful for avoiding invalidating lengths encoded within the item. The
+// "only once" restriction is helpful for avoiding making accidental changes.
 //
 // The string to search for must be 8 or more bytes long so that it is
 // extremely unlikely that there will ever be any false positive matches
 // in digital signatures, keys, hashes, etc.
-//
-// Returns true on success, false on failure.
-Result TamperOnce(SECItem& item, const uint8_t* from, size_t fromLen,
-                  const uint8_t* to, size_t toLen);
-
-Result InitInputFromSECItem(const SECItem* secItem, /*out*/ Input& input);
+Result TamperOnce(/*in/out*/ ByteString& item, const ByteString& from,
+                  const ByteString& to);
 
 ///////////////////////////////////////////////////////////////////////////////
 // Encode Certificates
 
 enum Version { v1 = 0, v2 = 1, v3 = 2 };
 
+// signature is assumed to be the DER encoding of an AlgorithmIdentifer.
 // serialNumber is assumed to be the DER encoding of an INTEGER.
 //
 // If extensions is null, then no extensions will be encoded. Otherwise,
@@ -115,37 +128,28 @@ enum Version { v1 = 0, v2 = 1, v3 = 2 };
 // If issuerPrivateKey is null, then the certificate will be self-signed.
 // Parameter order is based on the order of the attributes of the certificate
 // in RFC 5280.
-//
-// The return value, if non-null, is owned by the arena in the context and
-// MUST NOT be freed.
-SECItem* CreateEncodedCertificate(PLArenaPool* arena, long version,
-                                  SECOidTag signature,
-                                  const SECItem* serialNumber,
-                                  const SECItem* issuerNameDER,
-                                  std::time_t notBefore, std::time_t notAfter,
-                                  const SECItem* subjectNameDER,
-                     /*optional*/ SECItem const* const* extensions,
-                     /*optional*/ SECKEYPrivateKey* issuerPrivateKey,
-                                  SECOidTag signatureHashAlg,
-                          /*out*/ ScopedSECKEYPrivateKey& privateKey);
+ByteString CreateEncodedCertificate(long version,
+                                    Input signature,
+                                    const ByteString& serialNumber,
+                                    const ByteString& issuerNameDER,
+                                    std::time_t notBefore, std::time_t notAfter,
+                                    const ByteString& subjectNameDER,
+                       /*optional*/ const ByteString* extensions,
+                       /*optional*/ SECKEYPrivateKey* issuerPrivateKey,
+                                    SignatureAlgorithm signatureAlgorithm,
+                            /*out*/ ScopedSECKEYPrivateKey& privateKey);
 
-SECItem* CreateEncodedSerialNumber(PLArenaPool* arena, long value);
+ByteString CreateEncodedSerialNumber(long value);
 
 MOZILLA_PKIX_ENUM_CLASS ExtensionCriticality { NotCritical = 0, Critical = 1 };
 
-// The return value, if non-null, is owned by the arena and MUST NOT be freed.
-SECItem* CreateEncodedBasicConstraints(PLArenaPool* arena, bool isCA,
-                                       /*optional*/ long* pathLenConstraint,
-                                       ExtensionCriticality criticality);
+ByteString CreateEncodedBasicConstraints(bool isCA,
+                                         /*optional*/ long* pathLenConstraint,
+                                         ExtensionCriticality criticality);
 
-// ekus must be non-null and must must point to a SEC_OID_UNKNOWN-terminated
-// array of SECOidTags. If the first item of the array is SEC_OID_UNKNOWN then
-// an empty EKU extension will be encoded.
-//
-// The return value, if non-null, is owned by the arena and MUST NOT be freed.
-SECItem* CreateEncodedEKUExtension(PLArenaPool* arena,
-                                   const SECOidTag* ekus, size_t ekusCount,
-                                   ExtensionCriticality criticality);
+// Creates a DER-encoded extKeyUsage extension with one EKU OID.
+ByteString CreateEncodedEKUExtension(Input eku,
+                                     ExtensionCriticality criticality);
 
 ///////////////////////////////////////////////////////////////////////////////
 // Encode OCSP responses
@@ -153,18 +157,17 @@ SECItem* CreateEncodedEKUExtension(PLArenaPool* arena,
 class OCSPResponseExtension
 {
 public:
-  SECItem id;
+  ByteString id;
   bool critical;
-  SECItem value;
+  ByteString value;
   OCSPResponseExtension* next;
 };
 
 class OCSPResponseContext
 {
 public:
-  OCSPResponseContext(PLArenaPool* arena, const CertID& certID, std::time_t time);
+  OCSPResponseContext(const CertID& certID, std::time_t time);
 
-  PLArenaPool* arena;
   const CertID& certID;
   // TODO(bug 980538): add a way to specify what certificates are included.
 
@@ -183,9 +186,9 @@ public:
   bool skipResponseBytes; // If true, don't include responseBytes
 
   // responderID
-  const SECItem* signerNameDER; // If set, responderID will use the byName
-                                // form; otherwise responderID will use the
-                                // byKeyHash form.
+  ByteString signerNameDER; // If set, responderID will use the byName
+                            // form; otherwise responderID will use the
+                            // byKeyHash form.
 
   std::time_t producedAt;
 
@@ -195,11 +198,10 @@ public:
                                // extensions.
   ScopedSECKEYPrivateKey signerPrivateKey;
   bool badSignature; // If true, alter the signature to fail verification
-  SECItem const* const* certs; // non-owning pointer to certs to embed
+  const ByteString* certs; // optional; array terminated by an empty string
 
   // The following fields are on a per-SingleResponse basis. In the future we
   // may support including multiple SingleResponses per response.
-  SECOidTag certIDHashAlg;
   enum CertStatus {
     good = 0,
     revoked = 1,
@@ -212,9 +214,7 @@ public:
   bool includeNextUpdate;
 };
 
-// The return value, if non-null, is owned by the arena in the context
-// and MUST NOT be freed. A null return value indicates an error occurred.
-SECItem* CreateEncodedOCSPResponse(OCSPResponseContext& context);
+ByteString CreateEncodedOCSPResponse(OCSPResponseContext& context);
 
 } } } // namespace mozilla::pkix::test
 
diff --git a/security/sandbox/linux/moz.build b/security/sandbox/linux/moz.build
index 2cbbccf3bf4..e08cc3617e8 100644
--- a/security/sandbox/linux/moz.build
+++ b/security/sandbox/linux/moz.build
@@ -13,8 +13,6 @@ EXPORTS.mozilla += [
 ]
 
 SOURCES += [
-    # Bug 1059038 workaround:
-    '../../../xpcom/glue/unused.cpp',
     '../chromium/base/shim/base/logging.cpp',
     '../chromium/sandbox/linux/seccomp-bpf/basicblock.cc',
     '../chromium/sandbox/linux/seccomp-bpf/codegen.cc',
diff --git a/security/sandbox/modifications-to-chromium-to-reapply-after-upstream-merge.txt b/security/sandbox/modifications-to-chromium-to-reapply-after-upstream-merge.txt
new file mode 100644
index 00000000000..aed840de534
--- /dev/null
+++ b/security/sandbox/modifications-to-chromium-to-reapply-after-upstream-merge.txt
@@ -0,0 +1,4 @@
+Please add a link to the bugzilla bug and patch name that should be re-applied.
+Also, please update any existing links to their actual mozilla-central changeset.
+
+https://bugzilla.mozilla.org/show_bug.cgi?id=1018966 wosChromiumChanges.patch
diff --git a/security/sandbox/moz.build b/security/sandbox/moz.build
index 113a143724a..7ef67bb63dc 100644
--- a/security/sandbox/moz.build
+++ b/security/sandbox/moz.build
@@ -18,6 +18,13 @@ elif CONFIG['OS_ARCH'] == 'WINNT':
         'win/src/sandboxtarget',
     ]
 
+    if CONFIG['MOZ_CONTENT_SANDBOX']:
+        EXPORTS.mozilla.warnonlysandbox += [
+            'win/src/warnonlysandbox/warnOnlySandbox.h',
+            'win/src/warnonlysandbox/wosCallbacks.h',
+            'win/src/warnonlysandbox/wosTypes.h',
+        ]
+
     include('objs.mozbuild')
     SOURCES += security_sandbox_cppsrcs
 
diff --git a/security/sandbox/objs.mozbuild b/security/sandbox/objs.mozbuild
index 576f825d16a..3089a44cf14 100644
--- a/security/sandbox/objs.mozbuild
+++ b/security/sandbox/objs.mozbuild
@@ -99,6 +99,11 @@ if CONFIG['OS_ARCH'] == 'WINNT':
         'win/src/window.cc',
     ]
 
+    if CONFIG['MOZ_CONTENT_SANDBOX']:
+        security_sandbox_lcppsrcs += [
+            'win/src/warnonlysandbox/warnOnlySandbox.cpp',
+        ]
+
     if CONFIG['CPU_ARCH'] == 'x86_64':
         security_sandbox_lcppsrcs += [
             'win/src/interceptors_64.cc',
diff --git a/security/sandbox/win/src/filesystem_interception.cc b/security/sandbox/win/src/filesystem_interception.cc
index 33688f0f649..b0607be8ba7 100644
--- a/security/sandbox/win/src/filesystem_interception.cc
+++ b/security/sandbox/win/src/filesystem_interception.cc
@@ -12,6 +12,9 @@
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/sharedmem_ipc_client.h"
 #include "sandbox/win/src/target_services.h"
+#ifdef MOZ_CONTENT_SANDBOX // For upstream merging, use patch in bug 1018966 to reapply warn only sandbox code
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 
 namespace sandbox {
 
@@ -31,6 +34,12 @@ NTSTATUS WINAPI TargetNtCreateFile(NtCreateFileFunction orig_CreateFile,
   if (STATUS_ACCESS_DENIED != status)
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtCreateFile",
+                                       object_attributes->ObjectName->Buffer,
+                                       object_attributes->ObjectName->Length);
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return status;
@@ -86,6 +95,11 @@ NTSTATUS WINAPI TargetNtCreateFile(NtCreateFileFunction orig_CreateFile,
     } __except(EXCEPTION_EXECUTE_HANDLER) {
       break;
     }
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtCreateFile",
+                                         object_attributes->ObjectName->Buffer,
+                                         object_attributes->ObjectName->Length);
+#endif
   } while (false);
 
   return status;
@@ -102,6 +116,12 @@ NTSTATUS WINAPI TargetNtOpenFile(NtOpenFileFunction orig_OpenFile, PHANDLE file,
   if (STATUS_ACCESS_DENIED != status)
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtOpenFile",
+                                       object_attributes->ObjectName->Buffer,
+                                       object_attributes->ObjectName->Length);
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return status;
@@ -154,6 +174,11 @@ NTSTATUS WINAPI TargetNtOpenFile(NtOpenFileFunction orig_OpenFile, PHANDLE file,
     } __except(EXCEPTION_EXECUTE_HANDLER) {
       break;
     }
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtOpenFile",
+                                        object_attributes->ObjectName->Buffer,
+                                        object_attributes->ObjectName->Length);
+#endif
   } while (false);
 
   return status;
@@ -168,6 +193,12 @@ NTSTATUS WINAPI TargetNtQueryAttributesFile(
   if (STATUS_ACCESS_DENIED != status)
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtQueryAttributesFile",
+                                       object_attributes->ObjectName->Buffer,
+                                       object_attributes->ObjectName->Length);
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return status;
@@ -208,6 +239,11 @@ NTSTATUS WINAPI TargetNtQueryAttributesFile(
     if (SBOX_ALL_OK != code)
       break;
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtQueryAttributesFile",
+                                         object_attributes->ObjectName->Buffer,
+                                         object_attributes->ObjectName->Length);
+#endif
     return answer.nt_status;
 
   } while (false);
@@ -225,6 +261,12 @@ NTSTATUS WINAPI TargetNtQueryFullAttributesFile(
   if (STATUS_ACCESS_DENIED != status)
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtQueryFullAttributesFile",
+                                       object_attributes->ObjectName->Buffer,
+                                       object_attributes->ObjectName->Length);
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return status;
@@ -266,6 +308,11 @@ NTSTATUS WINAPI TargetNtQueryFullAttributesFile(
     if (SBOX_ALL_OK != code)
       break;
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtQueryFullAttributesFile",
+                                         object_attributes->ObjectName->Buffer,
+                                         object_attributes->ObjectName->Length);
+#endif
     return answer.nt_status;
   } while (false);
 
@@ -282,6 +329,10 @@ NTSTATUS WINAPI TargetNtSetInformationFile(
   if (STATUS_ACCESS_DENIED != status)
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtSetInformationFile");
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return status;
@@ -343,6 +394,9 @@ NTSTATUS WINAPI TargetNtSetInformationFile(
       break;
 
     status = answer.nt_status;
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtSetInformationFile");
+#endif
   } while (false);
 
   return status;
diff --git a/security/sandbox/win/src/handle_interception.cc b/security/sandbox/win/src/handle_interception.cc
index af0bebca045..0989ffc49a8 100644
--- a/security/sandbox/win/src/handle_interception.cc
+++ b/security/sandbox/win/src/handle_interception.cc
@@ -10,6 +10,9 @@
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/sharedmem_ipc_client.h"
 #include "sandbox/win/src/target_services.h"
+#ifdef MOZ_CONTENT_SANDBOX // For upstream merging, use patch in bug 1018966 to reapply warn only sandbox code
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 
 namespace sandbox {
 
@@ -34,10 +37,16 @@ ResultCode DuplicateHandleProxy(HANDLE source_handle,
 
   if (answer.win32_result) {
     ::SetLastError(answer.nt_status);
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogBlocked("DuplicateHandle");
+#endif
     return SBOX_ERROR_GENERIC;
   }
 
   *target_handle = answer.handle;
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogAllowed("DuplicateHandle");
+#endif
   return SBOX_ALL_OK;
 }
 
diff --git a/security/sandbox/win/src/named_pipe_interception.cc b/security/sandbox/win/src/named_pipe_interception.cc
index f437b1c2e85..e9ce4eb37c0 100644
--- a/security/sandbox/win/src/named_pipe_interception.cc
+++ b/security/sandbox/win/src/named_pipe_interception.cc
@@ -12,6 +12,9 @@
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/sharedmem_ipc_client.h"
 #include "sandbox/win/src/target_services.h"
+#ifdef MOZ_CONTENT_SANDBOX // For upstream merging, use patch in bug 1018966 to reapply warn only sandbox code
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 
 namespace sandbox {
 
@@ -27,6 +30,9 @@ HANDLE WINAPI TargetCreateNamedPipeW(
   if (INVALID_HANDLE_VALUE != pipe)
     return pipe;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("CreateNamedPipeW", pipe_name);
+#endif
   DWORD original_error = ::GetLastError();
 
   // We don't trust that the IPC can work this early.
@@ -62,6 +68,9 @@ HANDLE WINAPI TargetCreateNamedPipeW(
     if (ERROR_SUCCESS != answer.win32_result)
       return INVALID_HANDLE_VALUE;
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("CreateNamedPipeW", pipe_name);
+#endif
     return answer.handle;
   } while (false);
 
diff --git a/security/sandbox/win/src/process_thread_interception.cc b/security/sandbox/win/src/process_thread_interception.cc
index cb1017b07b6..39f2f82716c 100644
--- a/security/sandbox/win/src/process_thread_interception.cc
+++ b/security/sandbox/win/src/process_thread_interception.cc
@@ -12,6 +12,9 @@
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/sharedmem_ipc_client.h"
 #include "sandbox/win/src/target_services.h"
+#ifdef MOZ_CONTENT_SANDBOX // For upstream merging, use patch in bug 1018966 to reapply warn only sandbox code
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 
 namespace sandbox {
 
@@ -28,6 +31,9 @@ NTSTATUS WINAPI TargetNtOpenThread(NtOpenThreadFunction orig_OpenThread,
   if (NT_SUCCESS(status))
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtOpenThread");
+#endif
   do {
     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
       break;
@@ -93,6 +99,9 @@ NTSTATUS WINAPI TargetNtOpenThread(NtOpenThreadFunction orig_OpenThread,
       break;
     }
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtOpenThread");
+#endif
     return answer.nt_status;
   } while (false);
 
@@ -110,6 +119,9 @@ NTSTATUS WINAPI TargetNtOpenProcess(NtOpenProcessFunction orig_OpenProcess,
   if (NT_SUCCESS(status))
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtOpenProcess");
+#endif
   do {
     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
       break;
@@ -163,6 +175,9 @@ NTSTATUS WINAPI TargetNtOpenProcess(NtOpenProcessFunction orig_OpenProcess,
       break;
     }
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtOpenProcess");
+#endif
     return answer.nt_status;
   } while (false);
 
@@ -177,6 +192,9 @@ NTSTATUS WINAPI TargetNtOpenProcessToken(
   if (NT_SUCCESS(status))
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtOpenProcessToken");
+#endif
   do {
     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
       break;
@@ -208,6 +226,9 @@ NTSTATUS WINAPI TargetNtOpenProcessToken(
       break;
     }
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtOpenProcessToken");
+#endif
     return answer.nt_status;
   } while (false);
 
@@ -222,6 +243,9 @@ NTSTATUS WINAPI TargetNtOpenProcessTokenEx(
   if (NT_SUCCESS(status))
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtOpenProcessTokenEx");
+#endif
   do {
     if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
       break;
@@ -253,6 +277,9 @@ NTSTATUS WINAPI TargetNtOpenProcessTokenEx(
       break;
     }
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtOpenProcessTokenEx");
+#endif
     return answer.nt_status;
   } while (false);
 
@@ -273,6 +300,10 @@ BOOL WINAPI TargetCreateProcessW(CreateProcessWFunction orig_CreateProcessW,
                           process_information)) {
     return TRUE;
   }
+
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("CreateProcessW", application_name);
+#endif
   DWORD original_error = ::GetLastError();
 
   // We don't trust that the IPC can work this early.
@@ -310,6 +341,9 @@ BOOL WINAPI TargetCreateProcessW(CreateProcessWFunction orig_CreateProcessW,
     if (ERROR_SUCCESS != answer.win32_result)
       return FALSE;
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("CreateProcessW", application_name);
+#endif
     return TRUE;
   } while (false);
 
@@ -331,6 +365,10 @@ BOOL WINAPI TargetCreateProcessA(CreateProcessAFunction orig_CreateProcessA,
                           process_information)) {
     return TRUE;
   }
+
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("CreateProcessA", application_name);
+#endif
   DWORD original_error = ::GetLastError();
 
   // We don't trust that the IPC can work this early.
@@ -391,6 +429,9 @@ BOOL WINAPI TargetCreateProcessA(CreateProcessAFunction orig_CreateProcessA,
     if (ERROR_SUCCESS != answer.win32_result)
       return FALSE;
 
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("CreateProcessA", application_name);
+#endif
     return TRUE;
   } while (false);
 
diff --git a/security/sandbox/win/src/registry_interception.cc b/security/sandbox/win/src/registry_interception.cc
index 936d4acc713..b1e26b657a3 100644
--- a/security/sandbox/win/src/registry_interception.cc
+++ b/security/sandbox/win/src/registry_interception.cc
@@ -10,6 +10,9 @@
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/sharedmem_ipc_client.h"
 #include "sandbox/win/src/target_services.h"
+#ifdef MOZ_CONTENT_SANDBOX // For upstream merging, use patch in bug 1018966 to reapply warn only sandbox code
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 
 namespace sandbox {
 
@@ -25,6 +28,12 @@ NTSTATUS WINAPI TargetNtCreateKey(NtCreateKeyFunction orig_CreateKey,
   if (NT_SUCCESS(status))
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtCreateKey",
+                                       object_attributes->ObjectName->Buffer,
+                                       object_attributes->ObjectName->Length);
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return status;
@@ -87,6 +96,11 @@ NTSTATUS WINAPI TargetNtCreateKey(NtCreateKeyFunction orig_CreateKey,
     } __except(EXCEPTION_EXECUTE_HANDLER) {
       break;
     }
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtCreateKey",
+                                         object_attributes->ObjectName->Buffer,
+                                         object_attributes->ObjectName->Length);
+#endif
   } while (false);
 
   return status;
@@ -140,6 +154,11 @@ NTSTATUS WINAPI CommonNtOpenKey(NTSTATUS status, PHANDLE key,
     } __except(EXCEPTION_EXECUTE_HANDLER) {
       break;
     }
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("NtOpenKey[Ex]",
+                                         object_attributes->ObjectName->Buffer,
+                                         object_attributes->ObjectName->Length);
+#endif
   } while (false);
 
   return status;
@@ -153,6 +172,12 @@ NTSTATUS WINAPI TargetNtOpenKey(NtOpenKeyFunction orig_OpenKey, PHANDLE key,
   if (NT_SUCCESS(status))
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtOpenKey",
+                                       object_attributes->ObjectName->Buffer,
+                                       object_attributes->ObjectName->Length);
+#endif
+
   return CommonNtOpenKey(status, key, desired_access, object_attributes);
 }
 
@@ -170,6 +195,12 @@ NTSTATUS WINAPI TargetNtOpenKeyEx(NtOpenKeyExFunction orig_OpenKeyEx,
   if (NT_SUCCESS(status) || open_options != 0)
     return status;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("NtOpenKeyEx",
+                                       object_attributes->ObjectName->Buffer,
+                                       object_attributes->ObjectName->Length);
+#endif
+
   return CommonNtOpenKey(status, key, desired_access, object_attributes);
 }
 
diff --git a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
index 7e45c077b67..39ee19b9e3a 100644
--- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
+++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.cpp
@@ -8,6 +8,9 @@
 #include "sandbox/win/src/sandbox.h"
 #include "sandbox/win/src/sandbox_factory.h"
 #include "sandbox/win/src/security_level.h"
+#if defined(MOZ_CONTENT_SANDBOX)
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 
 namespace mozilla
 {
@@ -60,8 +63,9 @@ SandboxBroker::LaunchApp(const wchar_t *aPath,
   return true;
 }
 
+#if defined(MOZ_CONTENT_SANDBOX)
 bool
-SandboxBroker::SetSecurityLevelForContentProcess()
+SandboxBroker::SetSecurityLevelForContentProcess(bool inWarnOnlyMode)
 {
   if (!mPolicy) {
     return false;
@@ -78,8 +82,13 @@ SandboxBroker::SetSecurityLevelForContentProcess()
   ret = ret && (sandbox::SBOX_ALL_OK == result);
   result = mPolicy->SetAlternateDesktop(true);
   ret = ret && (sandbox::SBOX_ALL_OK == result);
+
+  if (inWarnOnlyMode) {
+    mozilla::warnonlysandbox::ApplyWarnOnlyPolicy(*mPolicy);
+  }
   return ret;
 }
+#endif
 
 bool
 SandboxBroker::SetSecurityLevelForPluginProcess()
diff --git a/security/sandbox/win/src/sandboxbroker/sandboxBroker.h b/security/sandbox/win/src/sandboxbroker/sandboxBroker.h
index 29055040fec..5bacbfb9066 100644
--- a/security/sandbox/win/src/sandboxbroker/sandboxBroker.h
+++ b/security/sandbox/win/src/sandboxbroker/sandboxBroker.h
@@ -30,7 +30,9 @@ public:
   virtual ~SandboxBroker();
 
   // Security levels for different types of processes
-  bool SetSecurityLevelForContentProcess();
+#if defined(MOZ_CONTENT_SANDBOX)
+  bool SetSecurityLevelForContentProcess(bool inWarnOnlyMode);
+#endif
   bool SetSecurityLevelForPluginProcess();
   bool SetSecurityLevelForIPDLUnitTestProcess();
   bool SetSecurityLevelForGMPlugin();
diff --git a/security/sandbox/win/src/sync_interception.cc b/security/sandbox/win/src/sync_interception.cc
index d23572389e3..7b6f9db141f 100644
--- a/security/sandbox/win/src/sync_interception.cc
+++ b/security/sandbox/win/src/sync_interception.cc
@@ -12,6 +12,9 @@
 #include "sandbox/win/src/sandbox_nt_util.h"
 #include "sandbox/win/src/sharedmem_ipc_client.h"
 #include "sandbox/win/src/target_services.h"
+#ifdef MOZ_CONTENT_SANDBOX // For upstream merging, use patch in bug 1018966 to reapply warn only sandbox code
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+#endif
 
 namespace sandbox {
 
@@ -26,6 +29,10 @@ HANDLE WINAPI TargetCreateEventW(CreateEventWFunction orig_CreateEvent,
   if (NULL != handle)
     return handle;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("CreateEventW", name);
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return NULL;
@@ -53,6 +60,9 @@ HANDLE WINAPI TargetCreateEventW(CreateEventWFunction orig_CreateEvent,
       break;
 
     ::SetLastError(answer.win32_result);
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("CreateEventW", name);
+#endif
     return answer.handle;
   } while (false);
 
@@ -71,6 +81,10 @@ HANDLE WINAPI TargetOpenEventW(OpenEventWFunction orig_OpenEvent,
   if (NULL != handle)
     return handle;
 
+#ifdef MOZ_CONTENT_SANDBOX
+  mozilla::warnonlysandbox::LogBlocked("OpenEventW", name);
+#endif
+
   // We don't trust that the IPC can work this early.
   if (!SandboxFactory::GetTargetServices()->GetState()->InitCalled())
     return NULL;
@@ -97,6 +111,9 @@ HANDLE WINAPI TargetOpenEventW(OpenEventWFunction orig_OpenEvent,
       break;
 
     ::SetLastError(answer.win32_result);
+#ifdef MOZ_CONTENT_SANDBOX
+    mozilla::warnonlysandbox::LogAllowed("OpenEventW", name);
+#endif
     return answer.handle;
   } while (false);
 
diff --git a/security/sandbox/win/src/warnonlysandbox/warnOnlySandbox.cpp b/security/sandbox/win/src/warnonlysandbox/warnOnlySandbox.cpp
new file mode 100644
index 00000000000..3548d861caf
--- /dev/null
+++ b/security/sandbox/win/src/warnonlysandbox/warnOnlySandbox.cpp
@@ -0,0 +1,123 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "warnOnlySandbox.h"
+
+#include "base/strings/utf_string_conversions.h"
+#include "sandbox/win/src/sandbox_policy.h"
+
+namespace mozilla {
+namespace warnonlysandbox {
+
+void
+ApplyWarnOnlyPolicy(sandbox::TargetPolicy& aPolicy)
+{
+  // Add rules to allow everything that we can, so that we can add logging to
+  // warn when we would be blocked by the sandbox.
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_FILES,
+                  sandbox::TargetPolicy::FILES_ALLOW_ANY, L"*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_NAMED_PIPES,
+                  sandbox::TargetPolicy::NAMEDPIPES_ALLOW_ANY, L"*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_PROCESS,
+                  sandbox::TargetPolicy::PROCESS_ALL_EXEC, L"*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_CLASSES_ROOT\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_CURRENT_USER\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_LOCAL_MACHINE\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_USERS\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_PERFORMANCE_DATA\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_PERFORMANCE_TEXT\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_PERFORMANCE_NLSTEXT\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_CURRENT_CONFIG\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_REGISTRY,
+                  sandbox::TargetPolicy::REG_ALLOW_ANY,
+                  L"HKEY_DYN_DATA\\*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_SYNC,
+                  sandbox::TargetPolicy::EVENTS_ALLOW_ANY, L"*");
+  aPolicy.AddRule(sandbox::TargetPolicy::SUBSYS_HANDLES,
+                  sandbox::TargetPolicy::HANDLES_DUP_ANY, L"*");
+}
+
+static LogFunction sLogFunction = nullptr;
+
+void
+ProvideLogFunction(LogFunction aLogFunction)
+{
+  sLogFunction = aLogFunction;
+}
+
+void
+LogBlocked(const char* aFunctionName, const char* aContext, uint32_t aFramesToSkip)
+{
+  if (sLogFunction) {
+    sLogFunction("BLOCKED", aFunctionName, aContext,
+                 /* aShouldLogStackTrace */ true, aFramesToSkip);
+  }
+}
+
+void
+LogBlocked(const char* aFunctionName, const wchar_t* aContext)
+{
+  if (sLogFunction) {
+    // Skip an extra frame to allow for this function.
+    LogBlocked(aFunctionName,  WideToUTF8(aContext).c_str(), /* aFramesToSkip */ 3);
+  }
+}
+
+void
+LogBlocked(const char* aFunctionName, const wchar_t* aContext,
+           uint16_t aLength)
+{
+  if (sLogFunction) {
+    // Skip an extra frame to allow for this function.
+    LogBlocked(aFunctionName, WideToUTF8(std::wstring(aContext, aLength)).c_str(),
+               /* aFramesToSkip */ 3);
+  }
+}
+
+void
+LogAllowed(const char* aFunctionName, const char* aContext)
+{
+  if (sLogFunction) {
+    sLogFunction("Broker ALLOWED", aFunctionName, aContext,
+                 /* aShouldLogStackTrace */ false, /* aFramesToSkip */ 0);
+  }
+}
+
+void
+LogAllowed(const char* aFunctionName, const wchar_t* aContext)
+{
+  if (sLogFunction) {
+    LogAllowed(aFunctionName, WideToUTF8(aContext).c_str());
+  }
+}
+
+void
+LogAllowed(const char* aFunctionName, const wchar_t* aContext,
+           uint16_t aLength)
+{
+  if (sLogFunction) {
+    LogAllowed(aFunctionName, WideToUTF8(std::wstring(aContext, aLength)).c_str());
+  }
+}
+
+} // warnonlysandbox
+} // mozilla
diff --git a/security/sandbox/win/src/warnonlysandbox/warnOnlySandbox.h b/security/sandbox/win/src/warnonlysandbox/warnOnlySandbox.h
new file mode 100644
index 00000000000..d65bad0fe6d
--- /dev/null
+++ b/security/sandbox/win/src/warnonlysandbox/warnOnlySandbox.h
@@ -0,0 +1,62 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * Set of helper methods to implement a warn only sandbox.
+ * Only providing simple namespaced functions as this code will probably be
+ * removed once we are properly shipping the content sandbox.
+ */
+
+#ifndef security_sandbox_warnOnlySandbox_h__
+#define security_sandbox_warnOnlySandbox_h__
+
+#include "wosTypes.h"
+
+#ifdef SANDBOX_EXPORTS
+#define SANDBOX_EXPORT __declspec(dllexport)
+#else
+#define SANDBOX_EXPORT __declspec(dllimport)
+#endif
+
+namespace sandbox {
+class TargetPolicy;
+}
+
+namespace mozilla {
+namespace warnonlysandbox {
+
+// This is used to pass a LogCallback to the sandboxing code, as the logging
+// requires code to which we cannot link directly.
+void SANDBOX_EXPORT ProvideLogFunction(LogFunction aLogFunction);
+
+// Set up the sandbox to allow everything via the broker, so we can log calls.
+void ApplyWarnOnlyPolicy(sandbox::TargetPolicy& aPolicy);
+
+// Log a "BLOCKED" msg to the browser console and, if DEBUG build, stderr.
+// If the logging of a stack trace is enabled then the default aFramesToSkip
+// will start from our caller's caller, which should normally be the function
+// that triggered the interception.
+void LogBlocked(const char* aFunctionName, const char* aContext = nullptr,
+                uint32_t aFramesToSkip = 2);
+
+// Convenience functions to convert to char*.
+void LogBlocked(const char* aFunctionName, const wchar_t* aContext);
+void LogBlocked(const char* aFunctionName, const wchar_t* aContext,
+                uint16_t aLength);
+
+// Log a "ALLOWED" msg to the browser console and, if DEBUG build, stderr.
+void LogAllowed(const char* aFunctionName, const char* aContext = nullptr);
+
+// Convenience functions to convert to char*.
+void LogAllowed(const char* aFunctionName, const wchar_t* aContext);
+void LogAllowed(const char* aFunctionName, const wchar_t* aContext,
+                uint16_t aLength);
+
+
+} // warnonlysandbox
+} // mozilla
+
+#endif // security_sandbox_warnOnlySandbox_h__
diff --git a/security/sandbox/win/src/warnonlysandbox/wosCallbacks.h b/security/sandbox/win/src/warnonlysandbox/wosCallbacks.h
new file mode 100644
index 00000000000..09d4cf98afa
--- /dev/null
+++ b/security/sandbox/win/src/warnonlysandbox/wosCallbacks.h
@@ -0,0 +1,129 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef security_sandbox_wosEnableCallbacks_h__
+#define security_sandbox_wosEnableCallbacks_h__
+
+#include "mozilla/warnonlysandbox/wosTypes.h"
+#include "mozilla/warnonlysandbox/warnOnlySandbox.h"
+
+#ifdef TARGET_SANDBOX_EXPORTS
+#include <sstream>
+#include <iostream>
+
+#include "mozilla/Preferences.h"
+#include "nsContentUtils.h"
+
+// This is essentially the same logic that decides whether nsStackWalk.cpp gets
+// built. See xpcom/base/moz.build
+#if !defined(MOZ_OPTIMIZE) || defined(MOZ_PROFILING) || defined(DEBUG)
+#define MOZ_STACKWALKING
+#include "nsStackWalk.h"
+#endif
+#endif
+
+#ifdef TARGET_SANDBOX_EXPORTS
+#define TARGET_SANDBOX_EXPORT __declspec(dllexport)
+#else
+#define TARGET_SANDBOX_EXPORT __declspec(dllimport)
+#endif
+
+namespace mozilla {
+namespace warnonlysandbox {
+
+// We need to use a callback to work around the fact that sandbox_s lib is
+// linked into plugin-container.exe directly and also via xul.dll via
+// sandboxbroker.dll. This causes problems with holding the state required to
+// work the warn only sandbox.
+// So, we provide a callback from plugin-container.exe that the code in xul.dll
+// can call to make sure we hit the right version of the code.
+void TARGET_SANDBOX_EXPORT
+SetProvideLogFunctionCb(ProvideLogFunctionCb aProvideLogFunctionCb);
+
+// Initialize the warn only sandbox if required.
+static void
+PrepareForInit()
+{
+  SetProvideLogFunctionCb(ProvideLogFunction);
+}
+
+#ifdef TARGET_SANDBOX_EXPORTS
+static ProvideLogFunctionCb sProvideLogFunctionCb = nullptr;
+
+void
+SetProvideLogFunctionCb(ProvideLogFunctionCb aProvideLogFunctionCb)
+{
+  sProvideLogFunctionCb = aProvideLogFunctionCb;
+}
+
+#ifdef MOZ_STACKWALKING
+static uint32_t sStackTraceDepth = 0;
+
+// NS_WalkStackCallback to write a formatted stack frame to an ostringstream.
+static void
+StackFrameToOStringStream(void* aPC, void* aSP, void* aClosure)
+{
+  std::ostringstream* stream = static_cast<std::ostringstream*>(aClosure);
+  nsCodeAddressDetails details;
+  char buf[1024];
+  NS_DescribeCodeAddress(aPC, &details);
+  NS_FormatCodeAddressDetails(aPC, &details, buf, sizeof(buf));
+  *stream << "--" << buf;
+}
+#endif
+
+// Log to the browser console and, if DEBUG build, stderr.
+static void
+Log(const char* aMessageType,
+    const char* aFunctionName,
+    const char* aContext,
+    const bool aShouldLogStackTrace = false,
+    uint32_t aFramesToSkip = 0)
+{
+  std::ostringstream msgStream;
+  msgStream << "Process Sandbox " << aMessageType << ": " << aFunctionName;
+  if (aContext) {
+    msgStream << " for : " << aContext;
+  }
+  msgStream << std::endl;
+
+#ifdef MOZ_STACKWALKING
+  if (aShouldLogStackTrace) {
+    if (sStackTraceDepth) {
+      msgStream << "Stack Trace:" << std::endl;
+      NS_StackWalk(StackFrameToOStringStream, aFramesToSkip, sStackTraceDepth,
+                   &msgStream, 0, nullptr);
+    }
+  }
+#endif
+
+  std::string msg = msgStream.str();
+#ifdef DEBUG
+  std::cerr << msg;
+#endif
+
+  nsContentUtils::LogMessageToConsole(msg.c_str());
+}
+
+// Initialize the warn only sandbox if required.
+static void
+InitIfRequired()
+{
+  if (XRE_GetProcessType() == GeckoProcessType_Content
+      && Preferences::GetString("browser.tabs.remote.sandbox").EqualsLiteral("warn")
+      && sProvideLogFunctionCb) {
+#ifdef MOZ_STACKWALKING
+    Preferences::AddUintVarCache(&sStackTraceDepth,
+      "browser.tabs.remote.sandbox.warnOnlyStackTraceDepth");
+#endif
+    sProvideLogFunctionCb(Log);
+  }
+}
+#endif
+} // warnonlysandbox
+} // mozilla
+
+#endif // security_sandbox_wosEnableCallbacks_h__
diff --git a/security/sandbox/win/src/warnonlysandbox/wosTypes.h b/security/sandbox/win/src/warnonlysandbox/wosTypes.h
new file mode 100644
index 00000000000..738343cdd7b
--- /dev/null
+++ b/security/sandbox/win/src/warnonlysandbox/wosTypes.h
@@ -0,0 +1,27 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef security_sandbox_wosTypes_h__
+#define security_sandbox_wosTypes_h__
+
+#include <stdint.h>
+
+namespace mozilla {
+namespace warnonlysandbox {
+
+// We are using callbacks here that are passed in from the core code to prevent
+// a circular dependency in the linking during the build.
+typedef void (*LogFunction) (const char* aMessageType,
+                             const char* aFunctionName,
+                             const char* aContext,
+                             const bool aShouldLogStackTrace,
+                             uint32_t aFramesToSkip);
+typedef void (*ProvideLogFunctionCb) (LogFunction aLogFunction);
+
+} // warnonlysandbox
+} // mozilla
+
+#endif // security_sandbox_wosTypes_h__
diff --git a/services/cloudsync/CloudSync.jsm b/services/cloudsync/CloudSync.jsm
new file mode 100644
index 00000000000..b6c30044834
--- /dev/null
+++ b/services/cloudsync/CloudSync.jsm
@@ -0,0 +1,89 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["CloudSync"];
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "Adapters",
+                                  "resource://gre/modules/CloudSyncAdapters.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "Local",
+                                  "resource://gre/modules/CloudSyncLocal.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "Bookmarks",
+                                  "resource://gre/modules/CloudSyncBookmarks.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "Tabs",
+                                  "resource://gre/modules/CloudSyncTabs.jsm");
+
+let API_VERSION = 1;
+
+let _CloudSync = function () {
+};
+
+_CloudSync.prototype = {
+  _adapters: null,
+
+  get adapters () {
+    if (!this._adapters) {
+      this._adapters = new Adapters();
+    }
+    return this._adapters;
+  },
+
+  _bookmarks: null,
+
+  get bookmarks () {
+    if (!this._bookmarks) {
+      this._bookmarks = new Bookmarks();
+    }
+    return this._bookmarks;
+  },
+
+  _local: null,
+
+  get local () {
+    if (!this._local) {
+      this._local = new Local();
+    }
+    return this._local;
+  },
+
+  _tabs: null,
+
+  get tabs () {
+    if (!this._tabs) {
+      this._tabs = new Tabs();
+    }
+    return this._tabs;
+  },
+
+  get tabsReady () {
+    return this._tabs ? true: false;
+  },
+
+  get version () {
+    return API_VERSION;
+  },
+};
+
+this.CloudSync = function CloudSync () {
+  return _cloudSyncInternal.instance;
+};
+
+Object.defineProperty(CloudSync, "ready", {
+  get: function () {
+    return _cloudSyncInternal.ready;
+  }
+});
+
+let _cloudSyncInternal = {
+  instance: null,
+  ready: false,
+};
+
+XPCOMUtils.defineLazyGetter(_cloudSyncInternal, "instance", function () {
+  _cloudSyncInternal.ready = true;
+  return new _CloudSync();
+}.bind(this));
diff --git a/services/cloudsync/CloudSyncAdapters.jsm b/services/cloudsync/CloudSyncAdapters.jsm
new file mode 100644
index 00000000000..16264a4f760
--- /dev/null
+++ b/services/cloudsync/CloudSyncAdapters.jsm
@@ -0,0 +1,88 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["Adapters"];
+
+Components.utils.import("resource://gre/modules/Services.jsm");
+Components.utils.import("resource://gre/modules/CloudSyncEventSource.jsm");
+
+this.Adapters = function () {
+  let eventTypes = [
+    "sync",
+  ];
+
+  let suspended = true;
+
+  let suspend = function () {
+    if (!suspended) {
+      Services.obs.removeObserver(observer, "cloudsync:user-sync", false);
+      suspended = true;
+    }
+  }.bind(this);
+
+  let resume = function () {
+    if (suspended) {
+      Services.obs.addObserver(observer, "cloudsync:user-sync", false);
+      suspended = false;
+    }
+  }.bind(this);
+
+  let eventSource = new EventSource(eventTypes, suspend, resume);
+  let registeredAdapters = new Map();
+
+  function register (name, opts) {
+    opts = opts || {};
+    registeredAdapters.set(name, opts);
+  }
+
+  function unregister (name) {
+    if (!registeredAdapters.has(name)) {
+      throw new Error("adapter is not registered: " + name)
+    }
+    registeredAdapters.delete(name);
+  }
+
+  function getAdapterNames () {
+    let result = [];
+    for (let name of registeredAdapters.keys()) {
+      result.push(name);
+    }
+    return result;
+  }
+
+  function getAdapter (name) {
+    if (!registeredAdapters.has(name)) {
+      throw new Error("adapter is not registered: " + name)
+    }
+    return registeredAdapters.get(name);
+  }
+
+  function countAdapters () {
+    return registeredAdapters.size;
+  }
+
+  let observer = {
+    observe: function (subject, topic, data) {
+      switch (topic) {
+        case "cloudsync:user-sync":
+          eventSource.emit("sync");
+          break;
+      }
+    }
+  };
+
+  this.addEventListener = eventSource.addEventListener;
+  this.removeEventListener = eventSource.removeEventListener;
+  this.register = register.bind(this);
+  this.get = getAdapter.bind(this);
+  this.unregister = unregister.bind(this);
+  this.__defineGetter__("names", getAdapterNames);
+  this.__defineGetter__("count", countAdapters);
+};
+
+Adapters.prototype = {
+
+};
diff --git a/services/cloudsync/CloudSyncBookmarks.jsm b/services/cloudsync/CloudSyncBookmarks.jsm
new file mode 100644
index 00000000000..a204b59b5f7
--- /dev/null
+++ b/services/cloudsync/CloudSyncBookmarks.jsm
@@ -0,0 +1,787 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["Bookmarks"];
+
+const Cu = Components.utils;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://services-common/utils.js");
+Cu.import("resource://services-crypto/utils.js");
+Cu.import("resource://gre/modules/PlacesUtils.jsm");
+Cu.import("resource:///modules/PlacesUIUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this, "NetUtil",
+                                  "resource://gre/modules/NetUtil.jsm");
+
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/CloudSyncPlacesWrapper.jsm");
+Cu.import("resource://gre/modules/CloudSyncEventSource.jsm");
+Cu.import("resource://gre/modules/CloudSyncBookmarksFolderCache.jsm");
+
+const ITEM_TYPES = [
+  "NULL",
+  "BOOKMARK",
+  "FOLDER",
+  "SEPARATOR",
+  "DYNAMIC_CONTAINER", // no longer used by Places, but this ID should not be used for future item types
+];
+
+const CS_UNKNOWN = 0x1;
+const CS_FOLDER = 0x1 << 1;
+const CS_SEPARATOR = 0x1 << 2;
+const CS_QUERY = 0x1 << 3;
+const CS_LIVEMARK = 0x1 << 4;
+const CS_BOOKMARK = 0x1 << 5;
+
+const EXCLUDE_BACKUP_ANNO = "places/excludeFromBackup";
+
+const DATA_VERSION = 1;
+
+function asyncCallback(ctx, func, args) {
+  function invoke() {
+    func.apply(ctx, args);
+  }
+  CommonUtils.nextTick(invoke);
+}
+
+let Record = function (params) {
+  this.id = params.guid;
+  this.parent = params.parent || null;
+  this.index = params.position;
+  this.title = params.title;
+  this.dateAdded = Math.floor(params.dateAdded/1000);
+  this.lastModified = Math.floor(params.lastModified/1000);
+  this.uri = params.url;
+
+  let annos = params.annos || {};
+  Object.defineProperty(this, "annos", {
+    get: function () {
+      return annos;
+    },
+    enumerable: false
+  });
+
+  switch (params.type) {
+    case PlacesUtils.bookmarks.TYPE_FOLDER:
+      if (PlacesUtils.LMANNO_FEEDURI in annos) {
+        this.type = CS_LIVEMARK;
+        this.feed = annos[PlacesUtils.LMANNO_FEEDURI];
+        this.site = annos[PlacesUtils.LMANNO_SITEURI];
+      } else {
+        this.type = CS_FOLDER;
+      }
+      break;
+    case PlacesUtils.bookmarks.TYPE_BOOKMARK:
+      if (this.uri.startsWith("place:")) {
+        this.type = CS_QUERY;
+      } else {
+        this.type = CS_BOOKMARK;
+      }
+      break;
+    case PlacesUtils.bookmarks.TYPE_SEPARATOR:
+      this.type = CS_SEPARATOR;
+      break;
+    default:
+      this.type = CS_UNKNOWN;
+  }
+};
+
+Record.prototype = {
+  version: DATA_VERSION,
+};
+
+let Bookmarks = function () {
+  let createRootFolder = function (name) {
+    let ROOT_FOLDER_ANNO = "cloudsync/rootFolder/" + name;
+    let ROOT_SHORTCUT_ANNO = "cloudsync/rootShortcut/" + name;
+
+    let deferred = Promise.defer();
+    let placesRootId = PlacesUtils.placesRootId;
+    let rootFolderId;
+    let rootShortcutId;
+
+    function createAdapterShortcut(result) {
+      rootFolderId = result;
+      let uri = "place:folder=" + rootFolderId;
+      return PlacesWrapper.insertBookmark(PlacesUIUtils.allBookmarksFolderId, uri,
+                                          PlacesUtils.bookmarks.DEFAULT_INDEX, name);
+    }
+
+    function setRootFolderCloudSyncAnnotation(result) {
+      rootShortcutId = result;
+      return PlacesWrapper.setItemAnnotation(rootFolderId, ROOT_FOLDER_ANNO,
+                                             1, 0, PlacesUtils.annotations.EXPIRE_NEVER);
+    }
+
+    function setRootShortcutCloudSyncAnnotation() {
+      return PlacesWrapper.setItemAnnotation(rootShortcutId, ROOT_SHORTCUT_ANNO,
+                                             1, 0, PlacesUtils.annotations.EXPIRE_NEVER);
+    }
+
+    function setRootFolderExcludeFromBackupAnnotation() {
+      return PlacesWrapper.setItemAnnotation(rootFolderId, EXCLUDE_BACKUP_ANNO,
+                                             1, 0, PlacesUtils.annotations.EXPIRE_NEVER);
+    }
+
+    function finish() {
+      deferred.resolve(rootFolderId);
+    }
+
+    Promise.resolve(PlacesUtils.bookmarks.createFolder(placesRootId, name, PlacesUtils.bookmarks.DEFAULT_INDEX))
+      .then(createAdapterShortcut)
+      .then(setRootFolderCloudSyncAnnotation)
+      .then(setRootShortcutCloudSyncAnnotation)
+      .then(setRootFolderExcludeFromBackupAnnotation)
+      .then(finish, deferred.reject);
+
+    return deferred.promise;
+  };
+
+  let getRootFolder = function (name) {
+    let ROOT_FOLDER_ANNO = "cloudsync/rootFolder/" + name;
+    let ROOT_SHORTCUT_ANNO = "cloudsync/rootShortcut/" + name;
+    let deferred = Promise.defer();
+
+    function checkRootFolder(folderIds) {
+      if (!folderIds.length) {
+        return createRootFolder(name);
+      }
+      return Promise.resolve(folderIds[0]);
+    }
+
+    function createFolderObject(folderId) {
+      return new RootFolder(folderId, name);
+    }
+
+    PlacesWrapper.getLocalIdsWithAnnotation(ROOT_FOLDER_ANNO)
+      .then(checkRootFolder, deferred.reject)
+      .then(createFolderObject)
+      .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  };
+
+  let deleteRootFolder = function (name) {
+    let ROOT_FOLDER_ANNO = "cloudsync/rootFolder/" + name;
+    let ROOT_SHORTCUT_ANNO = "cloudsync/rootShortcut/" + name;
+
+    let deferred = Promise.defer();
+    let placesRootId = PlacesUtils.placesRootId;
+
+    function getRootShortcutId() {
+      return PlacesWrapper.getLocalIdsWithAnnotation(ROOT_SHORTCUT_ANNO);
+    }
+
+    function deleteShortcut(shortcutIds) {
+      if (!shortcutIds.length) {
+        return Promise.resolve();
+      }
+      return PlacesWrapper.removeItem(shortcutIds[0]);
+    }
+
+    function getRootFolderId() {
+      return PlacesWrapper.getLocalIdsWithAnnotation(ROOT_FOLDER_ANNO);
+    }
+
+    function deleteFolder(folderIds) {
+      let deleteFolderDeferred = Promise.defer();
+
+      if (!folderIds.length) {
+        return Promise.resolve();
+      }
+
+      let rootFolderId = folderIds[0];
+      PlacesWrapper.removeFolderChildren(rootFolderId).then(
+        function () {
+          return PlacesWrapper.removeItem(rootFolderId);
+        }
+      ).then(deleteFolderDeferred.resolve, deleteFolderDeferred.reject);
+
+      return deleteFolderDeferred.promise;
+    }
+
+    getRootShortcutId().then(deleteShortcut)
+                       .then(getRootFolderId)
+                       .then(deleteFolder)
+                       .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  };
+
+  /* PUBLIC API */
+  this.getRootFolder = getRootFolder.bind(this);
+  this.deleteRootFolder = deleteRootFolder.bind(this);
+
+};
+
+this.Bookmarks = Bookmarks;
+
+let RootFolder = function (rootId, rootName) {
+  let suspended = true;
+  let ignoreAll = false;
+
+  let suspend = function () {
+    if (!suspended) {
+      PlacesUtils.bookmarks.removeObserver(observer);
+      suspended = true;
+    }
+  }.bind(this);
+
+  let resume = function () {
+    if (suspended) {
+      PlacesUtils.bookmarks.addObserver(observer, false);
+      suspended = false;
+    }
+  }.bind(this);
+
+  let eventTypes = [
+    "add",
+    "remove",
+    "change",
+    "move",
+  ];
+
+  let eventSource = new EventSource(eventTypes, suspend, resume);
+
+  let folderCache = new FolderCache;
+  folderCache.insert(rootId, null);
+
+  let getCachedFolderIds = function (cache, roots) {
+    let nodes = [...roots];
+    let results = [];
+
+    while (nodes.length) {
+      let node = nodes.shift();
+      results.push(node);
+      let children = cache.getChildren(node);
+      nodes = nodes.concat([...children]);
+    }
+    return results;
+  };
+
+  let getLocalItems = function () {
+    let deferred = Promise.defer();
+
+    let folders = getCachedFolderIds(folderCache, folderCache.getChildren(rootId));
+
+    function getFolders(ids) {
+      let types = [
+        PlacesUtils.bookmarks.TYPE_FOLDER,
+      ];
+      return PlacesWrapper.getItemsById(ids, types);
+    }
+
+    function getContents(parents) {
+      parents.push(rootId);
+      let types = [
+        PlacesUtils.bookmarks.TYPE_BOOKMARK,
+        PlacesUtils.bookmarks.TYPE_SEPARATOR,
+      ];
+      return PlacesWrapper.getItemsByParentId(parents, types)
+    }
+
+    function getParentGuids(results) {
+      results = Array.prototype.concat.apply([], results);
+      let promises = [];
+      results.map(function (result) {
+        let promise = PlacesWrapper.localIdToGuid(result.parent).then(
+          function (guidResult) {
+            result.parent = guidResult;
+            return Promise.resolve(result);
+          },
+          Promise.reject
+        );
+        promises.push(promise);
+      });
+      return Promise.all(promises);
+    }
+
+    function getAnnos(results) {
+      results = Array.prototype.concat.apply([], results);
+      let promises = [];
+      results.map(function (result) {
+        let promise = PlacesWrapper.getItemAnnotationsForLocalId(result.id).then(
+          function (annos) {
+            result.annos = annos;
+            return Promise.resolve(result);
+          },
+          Promise.reject
+        );
+        promises.push(promise);
+      });
+      return Promise.all(promises);
+    }
+
+    let promises = [
+      getFolders(folders),
+      getContents(folders),
+    ];
+
+    Promise.all(promises)
+           .then(getParentGuids)
+           .then(getAnnos)
+           .then(function (results) {
+                   results = results.map((result) => new Record(result));
+                   deferred.resolve(results);
+                 },
+                 deferred.reject);
+
+    return deferred.promise;
+  };
+
+  let getLocalItemsById = function (guids) {
+    let deferred = Promise.defer();
+
+    let types = [
+      PlacesUtils.bookmarks.TYPE_BOOKMARK,
+      PlacesUtils.bookmarks.TYPE_FOLDER,
+      PlacesUtils.bookmarks.TYPE_SEPARATOR,
+      PlacesUtils.bookmarks.TYPE_DYNAMIC_CONTAINER,
+    ];
+
+    function getParentGuids(results) {
+      let promises = [];
+      results.map(function (result) {
+        let promise = PlacesWrapper.localIdToGuid(result.parent).then(
+          function (guidResult) {
+            result.parent = guidResult;
+            return Promise.resolve(result);
+          },
+          Promise.reject
+        );
+        promises.push(promise);
+      });
+      return Promise.all(promises);
+    }
+
+    PlacesWrapper.getItemsByGuid(guids, types)
+                 .then(getParentGuids)
+                 .then(function (results) {
+                         results = results.map((result) => new Record(result));
+                         deferred.resolve(results);
+                       },
+                       deferred.reject);
+
+    return deferred.promise;
+  };
+
+  let _createItem = function (item) {
+    let deferred = Promise.defer();
+
+    function getFolderId() {
+      if (item.parent) {
+        return PlacesWrapper.guidToLocalId(item.parent);
+      }
+      return Promise.resolve(rootId);
+    }
+
+    function create(folderId) {
+      let deferred = Promise.defer();
+
+      if (!folderId) {
+        folderId = rootId;
+      }
+      let index = item.hasOwnProperty("index") ? item.index : PlacesUtils.bookmarks.DEFAULT_INDEX;
+
+      function complete(localId) {
+        folderCache.insert(localId, folderId);
+        deferred.resolve(localId);
+      }
+
+      switch (item.type) {
+        case CS_BOOKMARK:
+        case CS_QUERY:
+          PlacesWrapper.insertBookmark(folderId, item.uri, index, item.title, item.id)
+                       .then(complete, deferred.reject);
+          break;
+        case CS_FOLDER:
+          PlacesWrapper.createFolder(folderId, item.title, index, item.id)
+                       .then(complete, deferred.reject);
+          break;
+        case CS_SEPARATOR:
+          PlacesWrapper.insertSeparator(folderId, index, item.id)
+                       .then(complete, deferred.reject);
+          break;
+        case CS_LIVEMARK:
+          let livemark = {
+            title: item.title,
+            parentId: folderId,
+            index: item.index,
+            feedURI: item.feed,
+            siteURI: item.site,
+            guid: item.id,
+          };
+          PlacesUtils.livemarks.addLivemark(livemark)
+                               .then(complete, deferred.reject);
+          break;
+        default:
+          deferred.reject("invalid item type: " + item.type);
+      }
+
+      return deferred.promise;
+    }
+
+    getFolderId().then(create)
+                 .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  };
+
+  let _deleteItem = function (item) {
+    let deferred = Promise.defer();
+
+    PlacesWrapper.guidToLocalId(item.id).then(
+      function (localId) {
+        folderCache.remove(localId);
+        return PlacesWrapper.removeItem(localId);
+      }
+    ).then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  };
+
+  let _updateItem = function (item) {
+    let deferred = Promise.defer();
+
+    PlacesWrapper.guidToLocalId(item.id).then(
+      function (localId) {
+        let promises = [];
+
+        if (item.hasOwnProperty("dateAdded")) {
+          promises.push(PlacesWrapper.setItemDateAdded(localId, item.dateAdded));
+        }
+
+        if (item.hasOwnProperty("lastModified")) {
+          promises.push(PlacesWrapper.setItemLastModified(localId, item.lastModified));
+        }
+
+        if ((CS_BOOKMARK | CS_FOLDER) & item.type && item.hasOwnProperty("title")) {
+          promises.push(PlacesWrapper.setItemTitle(localId, item.title));
+        }
+
+        if (CS_BOOKMARK & item.type && item.hasOwnProperty("uri")) {
+          promises.push(PlacesWrapper.changeBookmarkURI(localId, item.uri));
+        }
+
+        if (item.hasOwnProperty("parent")) {
+          let deferred = Promise.defer();
+          PlacesWrapper.guidToLocalId(item.parent)
+            .then(
+                function (parent) {
+                  let index = item.hasOwnProperty("index") ? item.index : PlacesUtils.bookmarks.DEFAULT_INDEX;
+                  if (CS_FOLDER & item.type) {
+                    folderCache.setParent(localId, parent);
+                  }
+                  return PlacesWrapper.moveItem(localId, parent, index);
+                }
+              )
+            .then(deferred.resolve, deferred.reject);
+          promises.push(deferred.promise);
+        }
+
+        if (item.hasOwnProperty("index") && !item.hasOwnProperty("parent")) {
+          promises.push(PlacesWrapper.bookmarks.setItemIndex(localId, item.index));
+        }
+
+        Promise.all(promises)
+               .then(deferred.resolve, deferred.reject);
+      }
+    );
+
+    return deferred.promise;
+  };
+
+  let mergeRemoteItems = function (items) {
+    ignoreAll = true;
+    let deferred = Promise.defer();
+
+    let newFolders = {};
+    let newItems = [];
+    let updatedItems = [];
+    let deletedItems = [];
+
+    let sortItems = function () {
+      let promises = [];
+
+      let exists = function (item) {
+        let existsDeferred = Promise.defer();
+        if (!item.id) {
+          Object.defineProperty(item, "__exists__", {
+            value: false,
+            enumerable: false
+          });
+          existsDeferred.resolve(item);
+        } else {
+          PlacesWrapper.guidToLocalId(item.id).then(
+            function (localId) {
+              Object.defineProperty(item, "__exists__", {
+                value: localId ? true : false,
+                enumerable: false
+              });
+              existsDeferred.resolve(item);
+            },
+            existsDeferred.reject
+          );
+        }
+        return existsDeferred.promise;
+      }
+
+      let handleSortedItem = function (item) {
+        if (!item.__exists__ && !item.deleted) {
+          if (CS_FOLDER == item.type) {
+            newFolders[item.id] = item;
+            item._children = [];
+          } else {
+            newItems.push(item);
+          }
+        } else if (item.__exists__ && item.deleted) {
+          deletedItems.push(item);
+        } else if (item.__exists__) {
+          updatedItems.push(item);
+        }
+      }
+
+      for each (let item in items) {
+        if (!item || 'object' !== typeof(item)) {
+          continue;
+        }
+
+        let promise = exists(item).then(handleSortedItem, Promise.reject);
+        promises.push(promise);
+      }
+
+      return Promise.all(promises);
+    }
+
+    let processNewFolders = function () {
+      let newFolderGuids = Object.keys(newFolders);
+      let newFolderRoots = [];
+      let promises = [];
+
+      for each (let guid in newFolderGuids) {
+        let item = newFolders[guid];
+        if (item.parent && newFolderGuids.indexOf(item.parent) >= 0) {
+          let parent = newFolders[item.parent];
+          parent._children.push(item.id);
+        } else {
+          newFolderRoots.push(guid);
+        }
+      };
+
+      let promises = [];
+      for each (let guid in newFolderRoots) {
+        let root = newFolders[guid];
+        let promise = Promise.resolve();
+        promise = promise.then(
+          function () {
+            return _createItem(root);
+          },
+          Promise.reject
+        );
+        let items = [].concat(root._children);
+
+        while (items.length) {
+          let item = newFolders[items.shift()];
+          items = items.concat(item._children);
+          promise = promise.then(
+            function () {
+              return _createItem(item);
+            },
+            Promise.reject
+          );
+        }
+        promises.push(promise);
+      }
+
+      return Promise.all(promises);
+    }
+
+    let processItems = function () {
+      let promises = [];
+
+      for each (let item in newItems) {
+        promises.push(_createItem(item));
+      }
+
+      for each (let item in updatedItems) {
+        promises.push(_updateItem(item));
+      }
+
+      for each (let item in deletedItems) {
+        _deleteItem(item);
+      }
+
+      return Promise.all(promises);
+    }
+
+    sortItems().then(processNewFolders)
+               .then(processItems)
+               .then(function () {
+                       ignoreAll = false;
+                       deferred.resolve(items);
+                     },
+                     function (err) {
+                       ignoreAll = false;
+                       deferred.reject(err);
+                     });
+
+    return deferred.promise;
+  };
+
+  let ignore = function (id, parent) {
+    if (ignoreAll) {
+      return true;
+    }
+
+    if (rootId == parent || folderCache.has(parent)) {
+      return false;
+    }
+
+    return true;
+  };
+
+  let handleItemAdded = function (id, parent, index, type, uri, title, dateAdded, guid, parentGuid) {
+    let deferred = Promise.defer();
+
+    if (PlacesUtils.bookmarks.TYPE_FOLDER == type) {
+      folderCache.insert(id, parent);
+    }
+
+    eventSource.emit("add", guid);
+    deferred.resolve();
+
+    return deferred.promise;
+  };
+
+  let handleItemRemoved = function (id, parent, index, type, uri, guid, parentGuid) {
+    let deferred = Promise.defer();
+
+    if (PlacesUtils.bookmarks.TYPE_FOLDER == type) {
+      folderCache.remove(id);
+    }
+
+    eventSource.emit("remove", guid);
+    deferred.resolve();
+
+    return deferred.promise;
+  };
+
+  let handleItemChanged = function (id, property, isAnnotation, newValue, lastModified, type, parent, guid, parentGuid) {
+    let deferred = Promise.defer();
+
+    eventSource.emit('change', guid);
+    deferred.resolve();
+
+    return deferred.promise;
+  };
+
+  let handleItemMoved = function (id, oldParent, oldIndex, newParent, newIndex, type, guid, oldParentGuid, newParentGuid) {
+    let deferred = Promise.defer();
+
+    function complete() {
+      eventSource.emit('move', guid);
+      deferred.resolve();
+    }
+
+    if (PlacesUtils.bookmarks.TYPE_FOLDER != type) {
+      complete();
+      return deferred.promise;
+    }
+
+    if (folderCache.has(oldParent) && folderCache.has(newParent)) {
+      // Folder move inside cloudSync root, so just update parents/children.
+      folderCache.setParent(id, newParent);
+      complete();
+    } else if (!folderCache.has(oldParent)) {
+      // Folder moved in from ouside cloudSync root.
+      PlacesWrapper.updateCachedFolderIds(folderCache, newParent)
+                   .then(complete, complete);
+    } else if (!folderCache.has(newParent)) {
+      // Folder moved out from inside cloudSync root.
+      PlacesWrapper.updateCachedFolderIds(folderCache, oldParent)
+                   .then(complete, complete);
+    }
+
+    return deferred.promise;
+  };
+
+  let observer = {
+    onBeginBatchUpdate: function () {
+    },
+
+    onEndBatchUpdate: function () {
+    },
+
+    onItemAdded: function (id, parent, index, type, uri, title, dateAdded, guid, parentGuid) {
+      if (ignore(id, parent)) {
+        return;
+      }
+
+      asyncCallback(this, handleItemAdded, Array.prototype.slice.call(arguments));
+    },
+
+    onItemRemoved: function (id, parent, index, type, uri, guid, parentGuid) {
+      if (ignore(id, parent)) {
+        return;
+      }
+
+      asyncCallback(this, handleItemRemoved, Array.prototype.slice.call(arguments));
+    },
+
+    onItemChanged: function (id, property, isAnnotation, newValue, lastModified, type, parent, guid, parentGuid) {
+      if (ignore(id, parent)) {
+        return;
+      }
+
+      asyncCallback(this, handleItemChanged, Array.prototype.slice.call(arguments));
+    },
+
+    onItemMoved: function (id, oldParent, oldIndex, newParent, newIndex, type, guid, oldParentGuid, newParentGuid) {
+      if (ignore(id, oldParent) && ignore(id, newParent)) {
+        return;
+      }
+
+      asyncCallback(this, handleItemMoved, Array.prototype.slice.call(arguments));
+    }
+  };
+
+  /* PUBLIC API */
+  this.addEventListener = eventSource.addEventListener;
+  this.removeEventListener = eventSource.removeEventListener;
+  this.getLocalItems = getLocalItems.bind(this);
+  this.getLocalItemsById = getLocalItemsById.bind(this);
+  this.mergeRemoteItems = mergeRemoteItems.bind(this);
+
+  let rootGuid = null; // resolved before becoming ready (below)
+  this.__defineGetter__("id", function () {
+    return rootGuid;
+  });
+  this.__defineGetter__("name", function () {
+    return rootName;
+  });
+
+  let deferred = Promise.defer();
+  let getGuidForRootFolder = function () {
+    return PlacesWrapper.localIdToGuid(rootId);
+  }
+  PlacesWrapper.updateCachedFolderIds(folderCache, rootId)
+               .then(getGuidForRootFolder, getGuidForRootFolder)
+               .then(function (guid) {
+                       rootGuid = guid;
+                       deferred.resolve(this);
+                     }.bind(this),
+                     deferred.reject);
+  return deferred.promise;
+};
+
+RootFolder.prototype = {
+  BOOKMARK: CS_BOOKMARK,
+  FOLDER: CS_FOLDER,
+  SEPARATOR: CS_SEPARATOR,
+  QUERY: CS_QUERY,
+  LIVEMARK: CS_LIVEMARK,
+};
diff --git a/services/cloudsync/CloudSyncBookmarksFolderCache.jsm b/services/cloudsync/CloudSyncBookmarksFolderCache.jsm
new file mode 100644
index 00000000000..c48b9804aef
--- /dev/null
+++ b/services/cloudsync/CloudSyncBookmarksFolderCache.jsm
@@ -0,0 +1,105 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["FolderCache"];
+
+// Cache for bookmarks folder heirarchy.
+let FolderCache = function () {
+  this.cache = new Map();
+}
+
+FolderCache.prototype = {
+  has: function (id) {
+    return this.cache.has(id);
+  },
+
+  insert: function (id, parentId) {
+    if (this.cache.has(id)) {
+      return;
+    }
+
+    if (parentId && !(this.cache.has(parentId))) {
+      throw new Error("insert :: parentId not found in cache: " + parentId);
+    }
+
+    this.cache.set(id, {
+      parent: parentId || null,
+      children: new Set(),
+    });
+
+    if (parentId) {
+      this.cache.get(parentId).children.add(id);
+    }
+  },
+
+  remove: function (id) {
+    if (!(this.cache.has(id))) {
+      throw new Error("remote :: id not found in cache: " + id);
+    }
+
+    let parentId = this.cache.get(id).parent;
+    if (parentId) {
+      this.cache.get(parentId).children.delete(id);
+    }
+
+    for (let child of this.cache.get(id).children) {
+      this.cache.get(child).parent = null;
+    }
+
+    this.cache.delete(id);
+  },
+
+  setParent: function (id, parentId) {
+    if (!(this.cache.has(id))) {
+      throw new Error("setParent :: id not found in cache: " + id);
+    }
+
+    if (parentId && !(this.cache.has(parentId))) {
+      throw new Error("setParent :: parentId not found in cache: " + parentId);
+    }
+
+    let oldParent = this.cache.get(id).parent;
+    if (oldParent) {
+      this.cache.get(oldParent).children.delete(id);
+    }
+    this.cache.get(id).parent = parentId;
+    this.cache.get(parentId).children.add(id);
+
+    return true;
+  },
+
+  getParent: function (id) {
+    if (this.cache.has(id)) {
+      return this.cache.get(id).parent;
+    }
+
+    throw new Error("getParent :: id not found in cache: " + id);
+  },
+
+  getChildren: function (id) {
+    if (this.cache.has(id)) {
+      return this.cache.get(id).children;
+    }
+
+    throw new Error("getChildren :: id not found in cache: " + id);
+  },
+
+  setChildren: function (id, children) {
+    for (let child of children) {
+      if (!this.cache.has(child)) {
+        this.insert(child, id);
+      } else {
+        this.setParent(child, id);
+      }
+    }
+  },
+
+  dump: function () {
+    dump("FolderCache: " + JSON.stringify(this.cache) + "\n");
+  },
+};
+
+this.FolderCache = FolderCache;
diff --git a/services/cloudsync/CloudSyncEventSource.jsm b/services/cloudsync/CloudSyncEventSource.jsm
new file mode 100644
index 00000000000..e5332826e63
--- /dev/null
+++ b/services/cloudsync/CloudSyncEventSource.jsm
@@ -0,0 +1,65 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+this.EXPORTED_SYMBOLS = ["EventSource"];
+
+Components.utils.import("resource://services-common/utils.js");
+
+let EventSource = function (types, suspendFunc, resumeFunc) {
+  this.listeners = new Map();
+  for each (let type in types) {
+    this.listeners.set(type, new Set());
+  }
+
+  this.suspend = suspendFunc || function () {};
+  this.resume = resumeFunc || function () {};
+
+  this.addEventListener = this.addEventListener.bind(this);
+  this.removeEventListener = this.removeEventListener.bind(this);
+};
+
+EventSource.prototype = {
+  addEventListener: function (type, listener) {
+    if (!this.listeners.has(type)) {
+      return;
+    }
+    this.listeners.get(type).add(listener);
+    this.resume();
+  },
+
+  removeEventListener: function (type, listener) {
+    if (!this.listeners.has(type)) {
+      return;
+    }
+    this.listeners.get(type).delete(listener);
+    if (!this.hasListeners()) {
+      this.suspend();
+    }
+  },
+
+  hasListeners: function () {
+    for (let l of this.listeners.values()) {
+      if (l.size > 0) {
+        return true;
+      }
+    }
+    return false;
+  },
+
+  emit: function (type, arg) {
+    if (!this.listeners.has(type)) {
+      return;
+    }
+    CommonUtils.nextTick(
+      function () {
+        for (let listener of this.listeners.get(type)) {
+          listener.call(undefined, arg);
+        }
+      },
+      this
+    );
+  },
+};
+
+this.EventSource = EventSource;
diff --git a/services/cloudsync/CloudSyncLocal.jsm b/services/cloudsync/CloudSyncLocal.jsm
new file mode 100644
index 00000000000..998c0c3c4d2
--- /dev/null
+++ b/services/cloudsync/CloudSyncLocal.jsm
@@ -0,0 +1,87 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["Local"];
+
+const Cu = Components.utils;
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://services-common/stringbundle.js");
+Cu.import("resource://services-common/utils.js");
+Cu.import("resource://services-crypto/utils.js");
+Cu.import("resource://gre/modules/Preferences.jsm");
+
+function lazyStrings(name) {
+  let bundle = "chrome://weave/locale/services/" + name + ".properties";
+  return () => new StringBundle(bundle);
+}
+
+this.Str = {};
+XPCOMUtils.defineLazyGetter(Str, "errors", lazyStrings("errors"));
+XPCOMUtils.defineLazyGetter(Str, "sync", lazyStrings("sync"));
+
+function makeGUID() {
+  return CommonUtils.encodeBase64URL(CryptoUtils.generateRandomBytes(9));
+}
+
+this.Local = function () {
+  let prefs = new Preferences("services.cloudsync.");
+  this.__defineGetter__("prefs", function () {
+    return prefs;
+  });
+};
+
+Local.prototype = {
+  get id() {
+    let clientId = this.prefs.get("client.GUID", "");
+    return clientId == "" ? this.id = makeGUID(): clientId;
+  },
+
+  set id(value) {
+    this.prefs.set("client.GUID", value);
+  },
+
+  get name() {
+    let clientName = this.prefs.get("client.name", "");
+
+    if (clientName != "") {
+      return clientName;
+    }
+
+    // Generate a client name if we don't have a useful one yet
+    let env = Cc["@mozilla.org/process/environment;1"]
+                .getService(Ci.nsIEnvironment);
+    let user = env.get("USER") || env.get("USERNAME");
+    let appName;
+    let brand = new StringBundle("chrome://branding/locale/brand.properties");
+    let brandName = brand.get("brandShortName");
+
+    try {
+      let syncStrings = new StringBundle("chrome://browser/locale/sync.properties");
+      appName = syncStrings.getFormattedString("sync.defaultAccountApplication", [brandName]);
+    } catch (ex) {
+    }
+
+    appName = appName || brandName;
+
+    let system =
+      // 'device' is defined on unix systems
+      Cc["@mozilla.org/system-info;1"].getService(Ci.nsIPropertyBag2).get("device") ||
+      // hostname of the system, usually assigned by the user or admin
+      Cc["@mozilla.org/system-info;1"].getService(Ci.nsIPropertyBag2).get("host") ||
+      // fall back on ua info string
+      Cc["@mozilla.org/network/protocol;1?name=http"].getService(Ci.nsIHttpProtocolHandler).oscpu;
+
+    return this.name = Str.sync.get("client.name2", [user, appName, system]);
+  },
+
+  set name(value) {
+    this.prefs.set("client.name", value);
+  },
+};
+
diff --git a/services/cloudsync/CloudSyncPlacesWrapper.jsm b/services/cloudsync/CloudSyncPlacesWrapper.jsm
new file mode 100644
index 00000000000..cdddb9a4b20
--- /dev/null
+++ b/services/cloudsync/CloudSyncPlacesWrapper.jsm
@@ -0,0 +1,392 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["PlacesWrapper"];
+
+const {interfaces: Ci, utils: Cu} = Components;
+const REASON_ERROR = Ci.mozIStorageStatementCallback.REASON_ERROR;
+
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://gre/modules/PlacesUtils.jsm");
+Cu.import("resource:///modules/PlacesUIUtils.jsm");
+Cu.import("resource://services-common/utils.js");
+
+let PlacesQueries = function () {
+}
+
+PlacesQueries.prototype = {
+  cachedStmts: {},
+
+  getQuery: function (queryString) {
+    if (queryString in this.cachedStmts) {
+      return this.cachedStmts[queryString];
+    }
+
+    let db = PlacesUtils.history.QueryInterface(Ci.nsPIPlacesDatabase).DBConnection;
+    return this.cachedStmts[queryString] = db.createAsyncStatement(queryString);
+  }
+};
+
+let PlacesWrapper = function () {
+}
+
+PlacesWrapper.prototype = {
+  placesQueries: new PlacesQueries(),
+
+  guidToLocalId: function (guid) {
+    let deferred = Promise.defer();
+
+    let stmt = "SELECT id AS item_id " +
+               "FROM moz_bookmarks " +
+               "WHERE guid = :guid";
+    let query = this.placesQueries.getQuery(stmt);
+
+    function getLocalId(results) {
+      let result = results[0] && results[0]["item_id"];
+      return Promise.resolve(result);
+    }
+
+    query.params.guid = guid.toString();
+
+    this.asyncQuery(query, ["item_id"])
+        .then(getLocalId, deferred.reject)
+        .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  },
+
+  localIdToGuid: function (id) {
+    let deferred = Promise.defer();
+
+    let stmt = "SELECT guid " +
+               "FROM moz_bookmarks " +
+               "WHERE id = :item_id";
+    let query = this.placesQueries.getQuery(stmt);
+
+    function getGuid(results) {
+      let result = results[0] && results[0]["guid"];
+      return Promise.resolve(result);
+    }
+
+    query.params.item_id = id;
+
+    this.asyncQuery(query, ["guid"])
+        .then(getGuid, deferred.reject)
+        .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  },
+
+  setGuidForLocalId: function (localId, guid) {
+    let deferred = Promise.defer();
+
+    let stmt = "UPDATE moz_bookmarks " +
+               "SET guid = :guid " +
+               "WHERE id = :item_id";
+    let query = this.placesQueries.getQuery(stmt);
+
+    query.params.guid = guid;
+    query.params.item_id = localId;
+
+    this.asyncQuery(query)
+        .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  },
+
+  getItemsById: function (ids, types) {
+    let deferred = Promise.defer();
+    let stmt = "SELECT b.id, b.type, b.parent, b.position, b.title, b.guid, b.dateAdded, b.lastModified, p.url " +
+               "FROM moz_bookmarks b " +
+               "LEFT JOIN moz_places p ON b.fk = p.id " +
+               "WHERE b.id in (" + ids.join(",") + ") AND b.type in (" + types.join(",") + ")";
+    let db = PlacesUtils.history.QueryInterface(Ci.nsPIPlacesDatabase).DBConnection;
+    let query = db.createAsyncStatement(stmt);
+
+    this.asyncQuery(query, ["id", "type", "parent", "position", "title", "guid", "dateAdded", "lastModified", "url"])
+        .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  },
+
+  getItemsByParentId: function (parents, types) {
+    let deferred = Promise.defer();
+    let stmt = "SELECT b.id, b.type, b.parent, b.position, b.title, b.guid, b.dateAdded, b.lastModified, p.url " +
+               "FROM moz_bookmarks b " +
+               "LEFT JOIN moz_places p ON b.fk = p.id " +
+               "WHERE b.parent in (" + parents.join(",") + ") AND b.type in (" + types.join(",") + ")";
+    let db = PlacesUtils.history.QueryInterface(Ci.nsPIPlacesDatabase).DBConnection;
+    let query = db.createAsyncStatement(stmt);
+
+    this.asyncQuery(query, ["id", "type", "parent", "position", "title", "guid", "dateAdded", "lastModified", "url"])
+        .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  },
+
+  getItemsByGuid: function (guids, types) {
+    let deferred = Promise.defer();
+    guids = guids.map(JSON.stringify);
+    let stmt = "SELECT b.id, b.type, b.parent, b.position, b.title, b.guid, b.dateAdded, b.lastModified, p.url " +
+               "FROM moz_bookmarks b " +
+               "LEFT JOIN moz_places p ON b.fk = p.id " +
+               "WHERE b.guid in (" + guids.join(",") + ") AND b.type in (" + types.join(",") + ")";
+    let db = PlacesUtils.history.QueryInterface(Ci.nsPIPlacesDatabase).DBConnection;
+    let query = db.createAsyncStatement(stmt);
+
+    this.asyncQuery(query, ["id", "type", "parent", "position", "title", "guid", "dateAdded", "lastModified", "url"])
+        .then(deferred.resolve, deferred.reject);
+
+    return deferred.promise;
+  },
+
+  updateCachedFolderIds: function (folderCache, folder) {
+    let deferred = Promise.defer();
+    let stmt = "SELECT id, guid " +
+               "FROM moz_bookmarks " +
+               "WHERE parent = :parent_id AND type = :item_type";
+    let query = this.placesQueries.getQuery(stmt);
+
+    query.params.parent_id = folder;
+    query.params.item_type = PlacesUtils.bookmarks.TYPE_FOLDER;
+
+    this.asyncQuery(query, ["id", "guid"]).then(
+      function (items) {
+        let previousIds = folderCache.getChildren(folder);
+        let currentIds = new Set();
+        for each (let item in items) {
+          currentIds.add(item.id);
+        }
+        let newIds = new Set();
+        let missingIds = new Set();
+
+        for (let currentId of currentIds) {
+          if (!previousIds.has(currentId)) {
+            newIds.add(currentId);
+          }
+        }
+        for (let previousId of previousIds) {
+          if (!currentIds.has(previousId)) {
+            missingIds.add(previousId);
+          }
+        }
+
+        folderCache.setChildren(folder, currentIds);
+
+        let promises = [];
+        for (let newId of newIds) {
+          promises.push(this.updateCachedFolderIds(folderCache, newId));
+        }
+        Promise.all(promises)
+               .then(deferred.resolve, deferred.reject);
+
+        for (let missingId of missingIds) {
+          folderCache.remove(missingId);
+        }
+      }.bind(this)
+    );
+
+    return deferred.promise;
+  },
+
+  getLocalIdsWithAnnotation: function (anno) {
+    let deferred = Promise.defer();
+    let stmt = "SELECT a.item_id " +
+               "FROM moz_anno_attributes n " +
+               "JOIN moz_items_annos a ON n.id = a.anno_attribute_id " +
+               "WHERE n.name = :anno_name";
+    let query = this.placesQueries.getQuery(stmt);
+
+    query.params.anno_name = anno.toString();
+
+    this.asyncQuery(query, ["item_id"])
+        .then(function (items) {
+                let results = [];
+                for each(let item in items) {
+                  results.push(item.item_id);
+                }
+                deferred.resolve(results);
+              },
+              deferred.reject);
+
+    return deferred.promise;
+  },
+
+  getItemAnnotationsForLocalId: function (id) {
+    let deferred = Promise.defer();
+    let stmt = "SELECT a.name, b.content " +
+               "FROM moz_anno_attributes a " +
+               "JOIN moz_items_annos b ON a.id = b.anno_attribute_id " +
+               "WHERE b.item_id = :item_id";
+    let query = this.placesQueries.getQuery(stmt);
+
+    query.params.item_id = id;
+
+    this.asyncQuery(query, ["name", "content"])
+        .then(function (results) {
+                let annos = {};
+                for each(let result in results) {
+                  annos[result.name] = result.content;
+                }
+                deferred.resolve(annos);
+              },
+              deferred.reject);
+
+    return deferred.promise;
+  },
+
+  insertBookmark: function (parent, uri, index, title, guid) {
+    let parsedURI;
+    try {
+      parsedURI = CommonUtils.makeURI(uri)
+    } catch (e) {
+      return Promise.reject("unable to parse URI '" + uri + "': " + e);
+    }
+
+    try {
+      let id = PlacesUtils.bookmarks.insertBookmark(parent, parsedURI, index, title, guid);
+      return Promise.resolve(id);
+    } catch (e) {
+      return Promise.reject("unable to insert bookmark " + JSON.stringify(arguments) + ": " + e);
+    }
+  },
+
+  setItemAnnotation: function (item, anno, value, flags, exp) {
+    try {
+      return Promise.resolve(PlacesUtils.annotations.setItemAnnotation(item, anno, value, flags, exp));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  itemHasAnnotation: function (item, anno) {
+    try {
+      return Promise.resolve(PlacesUtils.annotations.itemHasAnnotation(item, anno));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  createFolder: function (parent, name, index, guid) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.createFolder(parent, name, index, guid));
+    } catch (e) {
+      return Promise.reject("unable to create folder ['" + name + "']: " + e);
+    }
+  },
+
+  removeFolderChildren: function (folder) {
+    try {
+      PlacesUtils.bookmarks.removeFolderChildren(folder);
+      return Promise.resolve();
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  insertSeparator: function (parent, index, guid) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.insertSeparator(parent, index, guid));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  removeItem: function (item) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.removeItem(item));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  setItemDateAdded: function (item, dateAdded) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.setItemDateAdded(item, dateAdded));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  setItemLastModified: function (item, lastModified) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.setItemLastModified(item, lastModified));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  setItemTitle: function (item, title) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.setItemTitle(item, title));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  changeBookmarkURI: function (item, uri) {
+    try {
+      uri = CommonUtils.makeURI(uri);
+      return Promise.resolve(PlacesUtils.bookmarks.changeBookmarkURI(item, uri));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  moveItem: function (item, parent, index) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.moveItem(item, parent, index));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  setItemIndex: function (item, index) {
+    try {
+      return Promise.resolve(PlacesUtils.bookmarks.setItemIndex(item, index));
+    } catch (e) {
+      return Promise.reject(e);
+    }
+  },
+
+  asyncQuery: function (query, names) {
+    let deferred = Promise.defer();
+    let storageCallback = {
+      results: [],
+      handleResult: function (results) {
+        if (!names) {
+          return;
+        }
+
+        let row;
+        while ((row = results.getNextRow()) != null) {
+          let item = {};
+          for each (let name in names) {
+            item[name] = row.getResultByName(name);
+          }
+          this.results.push(item);
+        }
+      },
+
+      handleError: function (error) {
+        deferred.reject(error);
+      },
+
+      handleCompletion: function (reason) {
+        if (REASON_ERROR == reason) {
+          return;
+        }
+
+        deferred.resolve(this.results);
+      }
+    };
+
+    query.executeAsync(storageCallback);
+    return deferred.promise;
+  },
+};
+
+this.PlacesWrapper = new PlacesWrapper();
diff --git a/services/cloudsync/CloudSyncTabs.jsm b/services/cloudsync/CloudSyncTabs.jsm
new file mode 100644
index 00000000000..b0921b709bc
--- /dev/null
+++ b/services/cloudsync/CloudSyncTabs.jsm
@@ -0,0 +1,319 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+this.EXPORTED_SYMBOLS = ["Tabs"];
+
+const Cu = Components.utils;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/CloudSyncEventSource.jsm");
+Cu.import("resource://gre/modules/Promise.jsm");
+Cu.import("resource://services-common/observers.js");
+
+XPCOMUtils.defineLazyModuleGetter(this, "PrivateBrowsingUtils", "resource://gre/modules/PrivateBrowsingUtils.jsm");
+XPCOMUtils.defineLazyServiceGetter(this, "Session", "@mozilla.org/browser/sessionstore;1", "nsISessionStore");
+
+const DATA_VERSION = 1;
+
+let ClientRecord = function (params) {
+  this.id = params.id;
+  this.name = params.name || "?";
+  this.tabs = new Set();
+}
+
+ClientRecord.prototype = {
+  version: DATA_VERSION,
+
+  update: function (params) {
+    if (this.id !== params.id) {
+      throw new Error("expected " + this.id + " to equal " + params.id);
+    }
+
+    this.name = params.name;
+  }
+};
+
+let TabRecord = function (params) {
+  this.url = params.url || "";
+  this.update(params);
+};
+
+TabRecord.prototype = {
+  version: DATA_VERSION,
+
+  update: function (params) {
+    if (this.url && this.url !== params.url) {
+      throw new Error("expected " + this.url + " to equal " + params.url);
+    }
+
+    if (params.lastUsed && params.lastUsed < this.lastUsed) {
+      return;
+    }
+
+    this.title = params.title || "";
+    this.icon = params.icon || "";
+    this.lastUsed = params.lastUsed || 0;
+  },
+};
+
+let TabCache = function () {
+  this.tabs = new Map();
+  this.clients = new Map();
+};
+
+TabCache.prototype = {
+  merge: function (client, tabs) {
+    if (!client || !client.id) {
+      return;
+    }
+
+    if (!tabs) {
+      return;
+    }
+
+    let cRecord;
+    if (this.clients.has(client.id)) {
+      try {
+        cRecord = this.clients.get(client.id);
+      } catch (e) {
+        throw new Error("unable to update client: " + e);
+      }
+    } else {
+      cRecord = new ClientRecord(client);
+      this.clients.set(cRecord.id, cRecord);
+    }
+
+    for each (let tab in tabs) {
+      if (!tab || 'object' !== typeof(tab)) {
+        continue;
+      }
+
+      let tRecord;
+      if (this.tabs.has(tab.url)) {
+        tRecord = this.tabs.get(tab.url);
+        try {
+          tRecord.update(tab);
+        } catch (e) {
+          throw new Error("unable to update tab: " + e);
+        }
+      } else {
+        tRecord = new TabRecord(tab);
+        this.tabs.set(tRecord.url, tRecord);
+      }
+
+      if (tab.deleted) {
+        cRecord.tabs.delete(tRecord);
+      } else {
+        cRecord.tabs.add(tRecord);
+      }
+    }
+  },
+
+  clear: function (client) {
+    if (client) {
+      this.clients.delete(client.id);
+    } else {
+      this.clients = new Map();
+      this.tabs = new Map();
+    }
+  },
+
+  get: function () {
+    let results = [];
+    for (let client of this.clients.values()) {
+      results.push(client);
+    }
+    return results;
+  },
+
+  isEmpty: function () {
+    return 0 == this.clients.size;
+  },
+
+};
+
+this.Tabs = function () {
+  let suspended = true;
+
+  let topics = [
+    "pageshow",
+    "TabOpen",
+    "TabClose",
+    "TabSelect",
+  ];
+
+  let update = function (event) {
+    if (event.originalTarget.linkedBrowser) {
+      let win = event.originalTarget.linkedBrowser.contentWindow;
+      if (PrivateBrowsingUtils.isWindowPrivate(win) &&
+          !PrivateBrowsingUtils.permanentPrivateBrowsing) {
+        return;
+      }
+    }
+
+    eventSource.emit("change");
+  };
+
+  let registerListenersForWindow = function (window) {
+    for each (let topic in topics) {
+      window.addEventListener(topic, update, false);
+    }
+    window.addEventListener("unload", unregisterListeners, false);
+  };
+
+  let unregisterListenersForWindow = function (window) {
+    window.removeEventListener("unload", unregisterListeners, false);
+    for each (let topic in topics) {
+      window.removeEventListener(topic, update, false);
+    }
+  };
+
+  let unregisterListeners = function (event) {
+    unregisterListenersForWindow(event.target);
+  };
+
+  let observer = {
+    observe: function (subject, topic, data) {
+      switch (topic) {
+        case "domwindowopened":
+          let onLoad = () => {
+            subject.removeEventListener("load", onLoad, false);
+            // Only register after the window is done loading to avoid unloads.
+            registerListenersForWindow(subject);
+          };
+
+          // Add tab listeners now that a window has opened.
+          subject.addEventListener("load", onLoad, false);
+          break;
+      }
+    }
+  };
+
+  let resume = function () {
+    if (suspended) {
+      Observers.add("domwindowopened", observer);
+      let wins = Services.wm.getEnumerator("navigator:browser");
+      while (wins.hasMoreElements()) {
+        registerListenersForWindow(wins.getNext());
+      }
+    }
+  }.bind(this);
+
+  let suspend = function () {
+    if (!suspended) {
+      Observers.remove("domwindowopened", observer);
+      let wins = Services.wm.getEnumerator("navigator:browser");
+      while (wins.hasMoreElements()) {
+        unregisterListenersForWindow(wins.getNext());
+      }
+    }
+  }.bind(this);
+
+  let eventTypes = [
+    "change",
+  ];
+
+  let eventSource = new EventSource(eventTypes, suspend, resume);
+
+  let tabCache = new TabCache();
+
+  let getWindowEnumerator = function () {
+    return Services.wm.getEnumerator("navigator:browser");
+  };
+
+  let shouldSkipWindow = function (win) {
+    return win.closed ||
+           PrivateBrowsingUtils.isWindowPrivate(win);
+  };
+
+  let getTabState = function (tab) {
+    return JSON.parse(Session.getTabState(tab));
+  };
+
+  let getLocalTabs = function (filter) {
+    let deferred = Promise.defer();
+
+    filter = (undefined === filter) ? true : filter;
+    let filteredUrls = new RegExp("^(about:.*|chrome://weave/.*|wyciwyg:.*|file:.*)$"); // FIXME: should be a pref (B#1044304)
+
+    let allTabs = [];
+
+    let currentState = JSON.parse(Session.getBrowserState());
+    currentState.windows.forEach(function (window) {
+      if (window.isPrivate) {
+        return;
+      }
+      window.tabs.forEach(function (tab) {
+        if (!tab.entries.length) {
+          return;
+        }
+
+        // Get only the latest entry
+        // FIXME: support full history (B#1044306)
+        let entry = tab.entries[tab.index - 1];
+
+        if (!entry.url || filter && filteredUrls.test(entry.url)) {
+          return;
+        }
+
+        allTabs.push(new TabRecord({
+          title: entry.title,
+          url: entry.url,
+          icon: tab.attributes && tab.attributes.image || "",
+          lastUsed: tab.lastAccessed,
+        }));
+      });
+    });
+
+    deferred.resolve(allTabs);
+
+    return deferred.promise;
+  };
+
+  let mergeRemoteTabs = function (client, tabs) {
+    let deferred = Promise.defer();
+
+    deferred.resolve(tabCache.merge(client, tabs));
+    Observers.notify("cloudsync:tabs:update");
+
+    return deferred.promise;
+  };
+
+  let clearRemoteTabs = function (client) {
+    let deferred = Promise.defer();
+
+    deferred.resolve(tabCache.clear(client));
+    Observers.notify("cloudsync:tabs:update");
+
+    return deferred.promise;
+  };
+
+  let getRemoteTabs = function () {
+    let deferred = Promise.defer();
+
+    deferred.resolve(tabCache.get());
+
+    return deferred.promise;
+  };
+
+  let hasRemoteTabs = function () {
+    return !tabCache.isEmpty();
+  };
+
+  /* PUBLIC API */
+  this.addEventListener = eventSource.addEventListener;
+  this.removeEventListener = eventSource.removeEventListener;
+  this.getLocalTabs = getLocalTabs.bind(this);
+  this.mergeRemoteTabs = mergeRemoteTabs.bind(this);
+  this.clearRemoteTabs = clearRemoteTabs.bind(this);
+  this.getRemoteTabs = getRemoteTabs.bind(this);
+  this.hasRemoteTabs = hasRemoteTabs.bind(this);
+};
+
+Tabs.prototype = {
+};
+this.Tabs = Tabs;
diff --git a/services/cloudsync/docs/api.md b/services/cloudsync/docs/api.md
new file mode 100644
index 00000000000..bca3193a4de
--- /dev/null
+++ b/services/cloudsync/docs/api.md
@@ -0,0 +1,234 @@
+### Importing the JS module
+
+````
+Cu.import("resource://gre/modules/CloudSync.jsm");
+
+let cloudSync = CloudSync();
+console.log(cloudSync); // Module is imported
+````
+
+### cloudSync.local
+
+#### id
+
+Local device ID. Is unique.
+
+````
+let localId = cloudSync.local.id;
+````
+
+#### name
+
+Local device name.
+
+````
+let localName = cloudSync.local.name;
+````
+
+### CloudSync.tabs
+
+#### addEventListener(type, callback)
+
+Add an event handler for Tabs events. Valid type is `change`. The callback receives no arguments.
+
+````
+function handleTabChange() {
+  // Tabs have changed.
+}
+
+cloudSync.tabs.addEventListener("change", handleTabChange);
+````
+
+Change events are emitted when a tab is opened or closed, when a tab is selected, or when the page changes for an open tab.
+
+#### removeEventListener(type, callback)
+
+Remove an event handler. Pass the type and function that were passed to addEventListener.
+
+````
+cloudSync.tabs.removeEventListener("change", handleTabChange);
+````
+
+#### mergeRemoteTabs(client, tabs)
+
+Merge remote tabs from upstream by updating existing items, adding new tabs, and deleting existing tabs. Accepts a client and a list of tabs. Returns a promise.
+
+````
+let remoteClient = {
+  id: "fawe78",
+  name: "My Firefox client",
+};
+
+let remoteTabs = [
+    {title: "Google",
+     url: "https://www.google.com",
+     icon: "https://www.google.com/favicon.ico",
+     lastUsed: 1400799296192},
+    {title: "Reddit",
+     url: "http://www.reddit.com",
+     icon: "http://www.reddit.com/favicon.ico",
+     lastUsed: 1400799296192
+     deleted: true},
+];
+
+cloudSync.tabs.mergeRemoteTabs(client, tabs).then(
+  function() {
+    console.log("merge complete");
+  }
+);
+````
+
+#### getLocalTabs()
+
+Returns a promise. Passes a list of local tabs when complete.
+
+````
+cloudSync.tabs.getLocalTabs().then(
+  function(tabs) {
+    console.log(JSON.stringify(tabs));
+  }
+);
+````
+
+#### clearRemoteTabs(client)
+
+Clears all tabs for a remote client.
+
+````
+let remoteClient = {
+  id: "fawe78",
+  name: "My Firefox client",
+};
+
+cloudSync.tabs.clearRemoteTabs(client);
+````
+
+### cloudSync.bookmarks
+
+#### getRootFolder(name)
+
+Gets the named root folder, creating it if it doesn't exist. The root folder object has a number of methods (see the next section for details).
+
+````
+cloudSync.bookmarks.getRootFolder("My Bookmarks").then(
+  function(rootFolder) {
+    console.log(rootFolder);
+  }
+);
+````
+
+### cloudSync.bookmarks.RootFolder
+
+This is a root folder object for bookmarks, created by `cloudSync.bookmarks.getRootFolder`.
+
+#### BOOKMARK
+
+Bookmark type. Used in results objects.
+
+````
+let bookmarkType = rootFolder.BOOKMARK;
+````
+
+#### FOLDER
+
+Folder type. Used in results objects.
+
+````
+let folderType = rootFolder.FOLDER;
+````
+
+#### SEPARATOR
+
+Separator type. Used in results objects.
+
+````
+let separatorType = rootFolder.SEPARATOR;
+````
+
+#### addEventListener(type, callback)
+
+Add an event handler for Tabs events. Valid types are `add, remove, change, move`. The callback receives an ID corresponding to the target item.
+
+````
+function handleBoookmarkEvent(id) {
+  console.log("event for id:", id);
+}
+
+rootFolder.addEventListener("add", handleBookmarkEvent);
+rootFolder.addEventListener("remove", handleBookmarkEvent);
+rootFolder.addEventListener("change", handleBookmarkEvent);
+rootFolder.addEventListener("move", handleBookmarkEvent);
+````
+
+#### removeEventListener(type, callback)
+
+Remove an event handler. Pass the type and function that were passed to addEventListener.
+
+````
+rootFolder.removeEventListener("add", handleBookmarkEvent);
+rootFolder.removeEventListener("remove", handleBookmarkEvent);
+rootFolder.removeEventListener("change", handleBookmarkEvent);
+rootFolder.removeEventListener("move", handleBookmarkEvent);
+````
+
+#### getLocalItems()
+
+Callback receives a list of items on the local client. Results have the following form:
+
+````
+{
+  id: "faw8e7f", // item guid
+  parent: "f7sydf87y", // parent folder guid
+  dateAdded: 1400799296192, // timestamp
+  lastModified: 1400799296192, // timestamp
+  uri: "https://www.google.ca", // null for FOLDER and SEPARATOR
+  title: "Google"
+  type: rootFolder.BOOKMARK, // should be one of rootFolder.{BOOKMARK, FOLDER, SEPARATOR},
+  index: 0 // must be unique among folder items
+}
+````
+
+````
+rootFolder.getLocalItems().then(
+  function(items) {
+    console.log(JSON.stringify(items));
+  }
+);
+````
+
+#### getLocalItemsById([...])
+
+Callback receives a list of items, specified by ID, on the local client. Results have the same form as `getLocalItems()` above.
+
+````
+rootFolder.getLocalItemsById(["213r23f", "f22fy3f3"]).then(
+  function(items) {
+    console.log(JSON.stringify(items));
+  }
+);
+````
+
+#### mergeRemoteItems([...])
+
+Merge remote items from upstream by updating existing items, adding new items, and deleting existing items. Folders are created first so that subsequent operations will succeed. Items have the same form as `getLocalItems()` above. Items that do not have an ID will have an ID generated for them. The results structure will contain this generated ID.
+
+````
+rootFolder.mergeRemoteItems([
+        {
+          id: 'f2398f23',
+          type: rootFolder.FOLDER,
+          title: 'Folder 1',
+          parent: '9f8237f928'
+        },
+        {
+          id: '9f8237f928',
+          type: rootFolder.FOLDER,
+          title: 'Folder 0',
+        }
+      ]).then(
+  function(items) {
+    console.log(items); // any generated IDs are filled in now
+    console.log("merge completed");
+  }
+);
+````
\ No newline at end of file
diff --git a/services/cloudsync/docs/architecture.rst b/services/cloudsync/docs/architecture.rst
new file mode 100644
index 00000000000..a7a8aa7ba81
--- /dev/null
+++ b/services/cloudsync/docs/architecture.rst
@@ -0,0 +1,54 @@
+.. _cloudsync_architecture:
+
+============
+Architecture
+============
+
+CloudSync offers functionality similar to Firefox Sync for data sources. Third-party addons
+(sync adapters) consume local data, send and receive updates from the cloud, and merge remote data.
+
+
+Files
+=====
+
+CloudSync.jsm
+    Main module; Includes other modules and exposes them.
+
+CloudSyncAdapters.jsm
+    Provides an API for addons to register themselves. Will be used to
+    list available adapters and to notify adapters when sync operations
+    are requested manually by the user.
+
+CloudSyncBookmarks.jsm
+    Provides operations for interacting with bookmarks.
+
+CloudSyncBookmarksFolderCache.jsm
+    Implements a cache used to store folder hierarchy for filtering bookmark events.
+
+CloudSyncEventSource.jsm
+    Implements an event emitter. Used to provide addEventListener and removeEventListener
+    for tabs and bookmarks.
+
+CloudSyncLocal.jsm
+    Provides information about the local device, such as name and a unique id.
+
+CloudSyncPlacesWrapper.jsm
+    Wraps parts of the Places API in promises. Some methods are implemented to be asynchronous
+    where they are not in the places API.
+
+CloudSyncTabs.jsm
+    Provides operations for fetching local tabs and for populating the about:sync-tabs page.
+
+
+Data Sources
+============
+
+CloudSync provides data for tabs and bookmarks. For tabs, local open pages can be enumerated and
+remote tabs can be merged for displaying in about:sync-tabs. For bookmarks, updates are tracked
+for a named folder (given by each adapter) and handled by callbacks registered using addEventListener,
+and remote changes can be merged into the local database.
+
+Versioning
+==========
+
+The API carries an integer version number (clouySync.version). Data records are versioned separately and individually.
diff --git a/services/cloudsync/docs/dataformat.rst b/services/cloudsync/docs/dataformat.rst
new file mode 100644
index 00000000000..ac4341cce13
--- /dev/null
+++ b/services/cloudsync/docs/dataformat.rst
@@ -0,0 +1,77 @@
+.. _cloudsync_dataformat:
+
+=========
+Data Format
+=========
+
+All fields are required unless noted otherwise.
+
+Bookmarks
+=========
+
+Record
+------
+
+type:
+    record type; one of CloudSync.bookmarks.{BOOKMARK, FOLDER, SEPARATOR, QUERY, LIVEMARK}
+
+id:
+    GUID for this bookmark item
+
+parent:
+    id of parent folder
+
+index:
+    item index in parent folder; should be unique and contiguous, or they will be adjusted internally
+
+title:
+    bookmark or folder title; not meaningful for separators
+
+dateAdded:
+    timestamp (in milliseconds) for item added
+
+lastModified:
+    timestamp (in milliseconds) for last modification
+
+uri:
+    bookmark URI; not meaningful for folders or separators
+
+version:
+    data layout version
+
+Tabs
+====
+
+ClientRecord
+------------
+
+id:
+    GUID for this client
+
+name:
+    name for this client; not guaranteed to be unique
+
+tabs:
+    list of tabs open on this client; see TabRecord
+
+version:
+    data layout version
+
+
+TabRecord
+---------
+
+title:
+    name for this tab
+
+url:
+    URL for this tab; only one tab for each URL is stored
+
+icon:
+    favicon URL for this tab; optional
+
+lastUsed:
+    timetamp (in milliseconds) for last use
+
+version:
+    data layout version
diff --git a/services/cloudsync/docs/example.rst b/services/cloudsync/docs/example.rst
new file mode 100644
index 00000000000..33d0f05315c
--- /dev/null
+++ b/services/cloudsync/docs/example.rst
@@ -0,0 +1,132 @@
+.. _cloudsync_example:
+
+=======
+Example
+=======
+
+.. code-block:: javascript
+
+	Cu.import("resource://gre/modules/CloudSync.jsm");
+
+	let HelloWorld = {
+	  onLoad: function() {
+	    let cloudSync = CloudSync();
+	    console.log("CLOUDSYNC -- hello world", cloudSync.local.id, cloudSync.local.name, cloudSync.adapters);
+	    cloudSync.adapters.register('helloworld', {});
+	    console.log("CLOUDSYNC -- " + JSON.stringify(cloudSync.adapters.getAdapterNames()));
+
+
+	    cloudSync.tabs.addEventListener("change", function() {
+	      console.log("tab change");
+	      cloudSync.tabs.getLocalTabs().then(
+	        function(records) {
+	          console.log(JSON.stringify(records));
+	        }
+	      );
+	    });
+
+	    cloudSync.tabs.getLocalTabs().then(
+	      function(records) {
+	        console.log(JSON.stringify(records));
+	      }
+	    );
+
+	    let remoteClient = {
+	      id: "001",
+	      name: "FakeClient",
+	    };
+	    let remoteTabs1 = [
+	      {url:"https://www.google.ca",title:"Google",icon:"https://www.google.ca/favicon.ico",lastUsed:Date.now()},
+	    ];
+	    let remoteTabs2 = [
+	      {url:"https://www.google.ca",title:"Google Canada",icon:"https://www.google.ca/favicon.ico",lastUsed:Date.now()},
+	      {url:"http://www.reddit.com",title:"Reddit",icon:"http://www.reddit.com/favicon.ico",lastUsed:Date.now()},
+	    ];
+	    cloudSync.tabs.mergeRemoteTabs(remoteClient, remoteTabs1).then(
+	      function() {
+	        return cloudSync.tabs.mergeRemoteTabs(remoteClient, remoteTabs2);
+	      }
+	    ).then(
+	      function() {
+	        return cloudSync.tabs.getRemoteTabs();
+	      }
+	    ).then(
+	      function(tabs) {
+	        console.log("remote tabs:", tabs);
+	      }
+	    );
+
+	    cloudSync.bookmarks.getRootFolder("Hello World").then(
+	      function(rootFolder) {
+	        console.log(rootFolder.name, rootFolder.id);
+	        rootFolder.addEventListener("add", function(guid) {
+	          console.log("CLOUDSYNC -- bookmark item added: " + guid);
+	          rootFolder.getLocalItemsById([guid]).then(
+	            function(items) {
+	              console.log("CLOUDSYNC -- items: " + JSON.stringify(items));
+	            }
+	          );
+	        });
+	        rootFolder.addEventListener("remove", function(guid) {
+	          console.log("CLOUDSYNC -- bookmark item removed: " + guid);
+	          rootFolder.getLocalItemsById([guid]).then(
+	            function(items) {
+	              console.log("CLOUDSYNC -- items: " + JSON.stringify(items));
+	            }
+	          );
+	        });
+	        rootFolder.addEventListener("change", function(guid) {
+	          console.log("CLOUDSYNC -- bookmark item changed: " + guid);
+	          rootFolder.getLocalItemsById([guid]).then(
+	            function(items) {
+	              console.log("CLOUDSYNC -- items: " + JSON.stringify(items));
+	            }
+	          );
+	        });
+	        rootFolder.addEventListener("move", function(guid) {
+	          console.log("CLOUDSYNC -- bookmark item moved: " + guid);
+	          rootFolder.getLocalItemsById([guid]).then(
+	            function(items) {
+	              console.log("CLOUDSYNC -- items: " + JSON.stringify(items));
+	            }
+	          );
+	        });
+
+	        function logLocalItems() {
+	          return rootFolder.getLocalItems().then(
+	            function(items) {
+	              console.log("CLOUDSYNC -- local items: " + JSON.stringify(items));
+	            }
+	          );
+	        }
+
+	        let items = [
+	            {"id":"9fdoci2KOME6","type":rootFolder.FOLDER,"parent":rootFolder.id,"title":"My Bookmarks 1"},
+	            {"id":"1fdoci2KOME5","type":rootFolder.FOLDER,"parent":rootFolder.id,"title":"My Bookmarks 2"},
+	            {"id":"G_UL4ZhOyX8m","type":rootFolder.BOOKMARK,"parent":"1fdoci2KOME5","title":"reddit: the front page of the internet","uri":"http://www.reddit.com/"},
+	          ];
+	        function mergeSomeItems() {
+	          return rootFolder.mergeRemoteItems(items);
+	        }
+
+	        logLocalItems().then(
+	          mergeSomeItems
+	        ).then(
+	          function(processedItems) {
+	            console.log("!!!", processedItems);
+	            console.log("merge complete");
+	          },
+	          function(error) {
+	            console.log("merge failed:", error);
+	          }
+	        ).then(
+	          logLocalItems
+	        );
+	      }
+	    );
+
+
+	  },
+	};
+
+	window.addEventListener("load", function(e) { HelloWorld.onLoad(e); }, false);
diff --git a/services/cloudsync/docs/index.rst b/services/cloudsync/docs/index.rst
new file mode 100644
index 00000000000..d7951776d85
--- /dev/null
+++ b/services/cloudsync/docs/index.rst
@@ -0,0 +1,19 @@
+.. _cloudsync:
+
+=====================
+CloudSync
+=====================
+
+CloudSync is a service that provides access to tabs and bookmarks data
+for third-party sync addons. Addons can read local bookmarks and tabs.
+Bookmarks and tab data can be merged from remote devices.
+
+Addons are responsible for maintaining an upstream representation, as
+well as sending and receiving data over the network.
+
+.. toctree::
+   :maxdepth: 1
+
+   architecture
+   dataformat
+   example
diff --git a/services/cloudsync/moz.build b/services/cloudsync/moz.build
new file mode 100644
index 00000000000..851829d0576
--- /dev/null
+++ b/services/cloudsync/moz.build
@@ -0,0 +1,21 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+SPHINX_TREES['cloudsync'] = 'docs'
+
+EXTRA_JS_MODULES += [
+  'CloudSync.jsm',
+  'CloudSyncAdapters.jsm',
+  'CloudSyncBookmarks.jsm',
+  'CloudSyncBookmarksFolderCache.jsm',
+  'CloudSyncEventSource.jsm',
+  'CloudSyncLocal.jsm',
+  'CloudSyncPlacesWrapper.jsm',
+  'CloudSyncTabs.jsm',
+]
+
+XPCSHELL_TESTS_MANIFESTS += ['tests/xpcshell/xpcshell.ini']
+BROWSER_CHROME_MANIFESTS += ['tests/mochitest/browser.ini']
diff --git a/services/cloudsync/tests/mochitest/browser.ini b/services/cloudsync/tests/mochitest/browser.ini
new file mode 100644
index 00000000000..c9eddbf7160
--- /dev/null
+++ b/services/cloudsync/tests/mochitest/browser.ini
@@ -0,0 +1,5 @@
+[DEFAULT]
+support-files=
+  other_window.html
+
+[browser_tabEvents.js]
\ No newline at end of file
diff --git a/services/cloudsync/tests/mochitest/browser_tabEvents.js b/services/cloudsync/tests/mochitest/browser_tabEvents.js
new file mode 100644
index 00000000000..aedc02ea057
--- /dev/null
+++ b/services/cloudsync/tests/mochitest/browser_tabEvents.js
@@ -0,0 +1,72 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function test() {
+
+  let local = {};
+
+  Components.utils.import("resource://gre/modules/CloudSync.jsm", local);
+  Components.utils.import("resource:///modules/sessionstore/TabState.jsm", local);
+
+  let cloudSync = local.CloudSync();
+  let opentabs = [];
+
+  waitForExplicitFinish();
+
+  let testURL = "chrome://mochitests/content/browser/services/cloudsync/tests/mochitest/other_window.html";
+  let expected = [
+    testURL,
+    testURL+"?x=1",
+    testURL+"?x=%20a",
+    // testURL+"?x=å",
+  ];
+
+  let nevents = 0;
+  function handleTabChangeEvent () {
+    cloudSync.tabs.removeEventListener("change", handleTabChangeEvent);
+    ++ nevents;
+  }
+
+  function getLocalTabs() {
+    cloudSync.tabs.getLocalTabs().then(
+      function (tabs) {
+        for (let tab of tabs) {
+          ok(expected.indexOf(tab.url) >= 0, "found an expected tab");
+        }
+
+        is(tabs.length, expected.length, "found the right number of tabs");
+
+        opentabs.forEach(function (tab) {
+          gBrowser.removeTab(tab);
+        });
+
+        is(nevents, 1, "expected number of change events");
+
+        finish();
+      }
+    )
+  }
+
+  cloudSync.tabs.addEventListener("change", handleTabChangeEvent);
+
+  let nflushed = 0;
+  expected.forEach(function(url) {
+    let tab = gBrowser.addTab(url);
+
+    function flush() {
+      tab.linkedBrowser.removeEventListener("load", flush);
+      local.TabState.flush(tab.linkedBrowser);
+      ++ nflushed;
+
+      if (nflushed == expected.length) {
+        getLocalTabs();
+      }
+    }
+
+    tab.linkedBrowser.addEventListener("load", flush, true);
+
+    opentabs.push(tab);
+  });
+
+}
\ No newline at end of file
diff --git a/services/cloudsync/tests/mochitest/other_window.html b/services/cloudsync/tests/mochitest/other_window.html
new file mode 100644
index 00000000000..a9ded2bd66d
--- /dev/null
+++ b/services/cloudsync/tests/mochitest/other_window.html
@@ -0,0 +1,7 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+</html>
diff --git a/services/cloudsync/tests/xpcshell/head.js b/services/cloudsync/tests/xpcshell/head.js
new file mode 100644
index 00000000000..e5b2b9001a4
--- /dev/null
+++ b/services/cloudsync/tests/xpcshell/head.js
@@ -0,0 +1,10 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+const {classes: Cc, interfaces: Ci, results: Cr, utils: Cu} = Components;
+
+"use strict";
+
+(function initCloudSyncTestingInfrastructure () {
+  do_get_profile();
+}).call(this);
diff --git a/services/cloudsync/tests/xpcshell/test_bookmarks.js b/services/cloudsync/tests/xpcshell/test_bookmarks.js
new file mode 100644
index 00000000000..f97c1d43cd5
--- /dev/null
+++ b/services/cloudsync/tests/xpcshell/test_bookmarks.js
@@ -0,0 +1,15 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+Cu.import("resource://gre/modules/CloudSync.jsm");
+
+function run_test () {
+  run_next_test();
+}
+
+add_task(function test_get_remote_tabs () {
+  let rootFolder = yield CloudSync().bookmarks.getRootFolder("TEST");
+  ok(rootFolder.id);
+});
diff --git a/services/cloudsync/tests/xpcshell/test_lazyload.js b/services/cloudsync/tests/xpcshell/test_lazyload.js
new file mode 100644
index 00000000000..5928875d500
--- /dev/null
+++ b/services/cloudsync/tests/xpcshell/test_lazyload.js
@@ -0,0 +1,18 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+Cu.import("resource://gre/modules/CloudSync.jsm");
+
+function run_test() {
+  run_next_test();
+}
+
+add_task(function test_lazyload() {
+  ok(!CloudSync.ready, "CloudSync.ready is false before CloudSync() invoked");
+  let cs1 = CloudSync();
+  ok(CloudSync.ready, "CloudSync.ready is true after CloudSync() invoked");
+  let cs2 = CloudSync();
+  ok(cs1 === cs2, "CloudSync() returns the same instance on multiple invocations");
+});
diff --git a/services/cloudsync/tests/xpcshell/test_module.js b/services/cloudsync/tests/xpcshell/test_module.js
new file mode 100644
index 00000000000..6d31345ed68
--- /dev/null
+++ b/services/cloudsync/tests/xpcshell/test_module.js
@@ -0,0 +1,19 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+Cu.import("resource://gre/modules/CloudSync.jsm");
+
+function run_test () {
+  run_next_test();
+}
+
+add_task(function test_module_load () {
+  ok(CloudSync);
+  let cloudSync = CloudSync();
+  ok(cloudSync.adapters);
+  ok(cloudSync.bookmarks);
+  ok(cloudSync.local);
+  ok(cloudSync.tabs);
+});
diff --git a/services/cloudsync/tests/xpcshell/test_tabs.js b/services/cloudsync/tests/xpcshell/test_tabs.js
new file mode 100644
index 00000000000..989d24ee4f3
--- /dev/null
+++ b/services/cloudsync/tests/xpcshell/test_tabs.js
@@ -0,0 +1,29 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+Cu.import("resource://gre/modules/CloudSync.jsm");
+
+function run_test () {
+  run_next_test();
+}
+
+add_task(function test_get_remote_tabs () {
+  let cloudSync = CloudSync();
+  let clients = yield cloudSync.tabs.getRemoteTabs();
+  equal(clients.length, 0);
+
+  yield cloudSync.tabs.mergeRemoteTabs({
+      id: "001",
+      name: "FakeClient",
+    },[
+      {url:"https://www.google.ca?a=å%20ä%20ö",title:"Google Canada",icon:"https://www.google.ca/favicon.ico",lastUsed:0},
+      {url:"http://www.reddit.com",title:"Reddit",icon:"http://www.reddit.com/favicon.ico",lastUsed:1},
+    ]);
+  ok(cloudSync.tabs.hasRemoteTabs());
+
+  clients = yield cloudSync.tabs.getRemoteTabs();
+  equal(clients.length, 1);
+  equal(clients[0].tabs.size, 2);
+});
diff --git a/services/cloudsync/tests/xpcshell/xpcshell.ini b/services/cloudsync/tests/xpcshell/xpcshell.ini
new file mode 100644
index 00000000000..6b92016e39d
--- /dev/null
+++ b/services/cloudsync/tests/xpcshell/xpcshell.ini
@@ -0,0 +1,9 @@
+[DEFAULT]
+head = head.js
+tail =
+firefox-appdir = browser
+
+[test_module.js]
+[test_tabs.js]
+[test_bookmarks.js]
+[test_lazyload.js]
diff --git a/services/healthreport/providers.jsm b/services/healthreport/providers.jsm
index 4258c9405d9..8f00e96cfc2 100644
--- a/services/healthreport/providers.jsm
+++ b/services/healthreport/providers.jsm
@@ -758,6 +758,36 @@ ActivePluginsMeasurement.prototype = Object.freeze({
   },
 });
 
+function ActiveGMPluginsMeasurement() {
+  Metrics.Measurement.call(this);
+
+  this._serializers = {};
+  this._serializers[this.SERIALIZE_JSON] = {
+    singular: this._serializeJSONSingular.bind(this),
+  };
+}
+
+ActiveGMPluginsMeasurement.prototype = Object.freeze({
+  __proto__: Metrics.Measurement.prototype,
+
+  name: "gm-plugins",
+  version: 1,
+
+  fields: {
+    "gm-plugins": LAST_TEXT_FIELD,
+  },
+
+  _serializeJSONSingular: function (data) {
+    if (!data.has("gm-plugins")) {
+      this._log.warn("Don't have GM plugins info. Weird.");
+      return null;
+    }
+
+    let result = JSON.parse(data.get("gm-plugins")[1]);
+    result._v = this.version;
+    return result;
+  },
+});
 
 function AddonCountsMeasurement() {
   Metrics.Measurement.call(this);
@@ -834,6 +864,7 @@ AddonsProvider.prototype = Object.freeze({
   measurementTypes: [
     ActiveAddonsMeasurement,
     ActivePluginsMeasurement,
+    ActiveGMPluginsMeasurement,
     AddonCountsMeasurement1,
     AddonCountsMeasurement,
   ],
@@ -869,10 +900,12 @@ AddonsProvider.prototype = Object.freeze({
       let data;
       let addonsField;
       let pluginsField;
+      let gmPluginsField;
       try {
         data = this._createDataStructure(allAddons);
         addonsField = JSON.stringify(data.addons);
         pluginsField = JSON.stringify(data.plugins);
+        gmPluginsField = JSON.stringify(data.gmPlugins);
       } catch (ex) {
         this._log.warn("Exception when populating add-ons data structure: " +
                        CommonUtils.exceptionStr(ex));
@@ -883,6 +916,7 @@ AddonsProvider.prototype = Object.freeze({
       let now = new Date();
       let addons = this.getMeasurement("addons", 2);
       let plugins = this.getMeasurement("plugins", 1);
+      let gmPlugins = this.getMeasurement("gm-plugins", 1);
       let counts = this.getMeasurement(AddonCountsMeasurement.prototype.name,
                                        AddonCountsMeasurement.prototype.version);
 
@@ -901,7 +935,15 @@ AddonsProvider.prototype = Object.freeze({
         return addons.setLastText("addons", addonsField).then(
           function onSuccess() {
             return plugins.setLastText("plugins", pluginsField).then(
-              function onSuccess() { deferred.resolve(); },
+              function onSuccess() {
+                return gmPlugins.setLastText("gm-plugins", gmPluginsField).then(
+                  function onSuccess() {
+                    deferred.resolve();
+                  },
+                  function onError(error) {
+                    deferred.reject(error);
+                  });
+              },
               function onError(error) { deferred.reject(error); }
             );
           },
@@ -938,6 +980,7 @@ AddonsProvider.prototype = Object.freeze({
     let data = {
       addons: {},
       plugins: {},
+      gmPlugins: {},
       counts: {}
     };
 
@@ -945,8 +988,16 @@ AddonsProvider.prototype = Object.freeze({
       let type = addon.type;
 
       // We count plugins separately below.
-      if (addon.type == "plugin")
+      if (addon.type == "plugin") {
+        if (addon.gmPlugin) {
+          data.gmPlugins[addon.id] = {
+            version: addon.version,
+            userDisabled: addon.userDisabled,
+            applyBackgroundUpdates: addon.applyBackgroundUpdates,
+          };
+        }
         continue;
+      }
 
       data.counts[type] = (data.counts[type] || 0) + 1;
 
diff --git a/services/healthreport/tests/xpcshell/test_provider_addons.js b/services/healthreport/tests/xpcshell/test_provider_addons.js
index eb7509668e0..a3aa9752b2e 100644
--- a/services/healthreport/tests/xpcshell/test_provider_addons.js
+++ b/services/healthreport/tests/xpcshell/test_provider_addons.js
@@ -116,6 +116,21 @@ add_task(function test_collect() {
       updateDate: now,
       description: "addon3 description"
     },
+    {
+      // Should be excluded from the report completely
+      id: "pluginfake",
+      type: "plugin",
+      userDisabled: false,
+      appDisabled: false,
+    },
+    {
+      // Should be in gm-plugins
+      id: "gmp-testgmp",
+      type: "plugin",
+      userDisabled: false,
+      version: "7.2",
+      gmPlugin: true,
+    },
   ];
 
   monkeypatchAddons(provider, testAddons);
@@ -186,6 +201,8 @@ add_task(function test_collect() {
   do_check_true(!("addon1" in value));
   do_check_true(!("addon2" in value));
   do_check_true("addon3" in value);
+  do_check_true(!("pluginfake" in value));
+  do_check_true(!("gmp-testgmp" in value));
 
   let serializer = addons.serializer(addons.SERIALIZE_JSON);
   let serialized = serializer.singular(data.singular);
@@ -237,6 +254,30 @@ add_task(function test_collect() {
   }
   do_check_eq(serialized._v, 1);
 
+  // Test GMP plugins measurement.
+
+  let gmPlugins = provider.getMeasurement("gm-plugins", 1);
+  data = yield gmPlugins.getValues();
+
+  do_check_eq(data.days.size, 0);
+  do_check_eq(data.singular.size, 1);
+  do_check_true(data.singular.has("gm-plugins"));
+
+  json = data.singular.get("gm-plugins")[1];
+  value = JSON.parse(json);
+  do_print("value: " + json);
+  do_check_eq(typeof(value), "object");
+  do_check_eq(Object.keys(value).length, 1);
+
+  do_check_eq(value["gmp-testgmp"].version, "7.2");
+  do_check_eq(value["gmp-testgmp"].userDisabled, false);
+
+  serializer = gmPlugins.serializer(plugins.SERIALIZE_JSON);
+  serialized = serializer.singular(data.singular);
+  do_check_eq(typeof(serialized), "object");
+  do_check_eq(serialized["gmp-testgmp"].version, "7.2");
+  do_check_eq(serialized._v, 1);
+
   // Test counts measurement.
 
   let counts = provider.getMeasurement("counts", 2);
diff --git a/services/moz.build b/services/moz.build
index c394c0d9779..6114fcc9642 100644
--- a/services/moz.build
+++ b/services/moz.build
@@ -28,4 +28,7 @@ if CONFIG['MOZ_SERVICES_SYNC']:
 if CONFIG['MOZ_B2G']:
     DIRS += ['mobileid']
 
+if CONFIG['MOZ_SERVICES_CLOUDSYNC']:
+    DIRS += ['cloudsync']
+
 SPHINX_TREES['services'] = 'docs'
diff --git a/storage/src/mozStorageStatementRow.cpp b/storage/src/mozStorageStatementRow.cpp
index 935b9d26906..ef1ca4a97e6 100644
--- a/storage/src/mozStorageStatementRow.cpp
+++ b/storage/src/mozStorageStatementRow.cpp
@@ -71,7 +71,7 @@ StatementRow::GetProperty(nsIXPConnectWrappedNative *aWrapper,
     }
     else if (type == mozIStorageValueArray::VALUE_TYPE_TEXT) {
       uint32_t bytes;
-      const jschar *sval = reinterpret_cast<const jschar *>(
+      const char16_t *sval = reinterpret_cast<const char16_t *>(
         static_cast<mozIStorageStatement *>(mStatement)->
           AsSharedWString(idx, &bytes)
       );
diff --git a/testing/b2g_cppunittest_manifest.txt b/testing/b2g_cppunittest_manifest.txt
index 72a0394deb7..44b4c335c43 100644
--- a/testing/b2g_cppunittest_manifest.txt
+++ b/testing/b2g_cppunittest_manifest.txt
@@ -11,3 +11,4 @@ TestCSPParser                       # Bug 1054246
 TestDeadlockDetector                # Bug 1054249
 test_deadlock_detector              # Bug 1054249
 TestTArray                          # Bug 1054251
+TestAudioBuffers                    # Bug 1062937
diff --git a/testing/marionette/client/marionette/errors.py b/testing/marionette/client/marionette/errors.py
index de5806ef08d..aee6aa24c52 100644
--- a/testing/marionette/client/marionette/errors.py
+++ b/testing/marionette/client/marionette/errors.py
@@ -31,6 +31,7 @@ class ErrorCodes(object):
     INVALID_RESPONSE = 53
     FRAME_SEND_NOT_INITIALIZED_ERROR = 54
     FRAME_SEND_FAILURE_ERROR = 55
+    UNSUPPORTED_OPERATION = 405
     MARIONETTE_ERROR = 500
 
 class MarionetteException(Exception):
@@ -138,3 +139,6 @@ class FrameSendNotInitializedError(MarionetteException):
 
 class FrameSendFailureError(MarionetteException):
     pass
+
+class UnsupportedOperationException(MarionetteException):
+    pass
diff --git a/testing/marionette/client/marionette/marionette.py b/testing/marionette/client/marionette/marionette.py
index 9686308ae90..52b9e3c071a 100644
--- a/testing/marionette/client/marionette/marionette.py
+++ b/testing/marionette/client/marionette/marionette.py
@@ -708,6 +708,8 @@ class Marionette(object):
                 raise errors.FrameSendNotInitializedError(message=message, status=status, stacktrace=stacktrace)
             elif status == errors.ErrorCodes.FRAME_SEND_FAILURE_ERROR:
                 raise errors.FrameSendFailureError(message=message, status=status, stacktrace=stacktrace)
+            elif status == errors.ErrorCodes.UNSUPPORTED_OPERATION:
+                raise errors.UnsupportedOperationException(message=message, status=status, stacktrace=stacktrace)
             else:
                 raise errors.MarionetteException(message=message, status=status, stacktrace=stacktrace)
         raise errors.MarionetteException(message=response, status=500)
@@ -883,7 +885,6 @@ class Marionette(object):
         :rtype: string
 
         """
-
         self.window = self._send_message("getWindowHandle", "value")
         return self.window
 
@@ -1515,3 +1516,31 @@ class Marionette(object):
         self._send_message("setScreenOrientation", "ok", orientation=orientation)
         if self.emulator:
             self.emulator.screen.orientation = orientation.lower()
+
+    @property
+    def window_size(self):
+        """Get the current browser window size.
+
+        Will return the current browser window size in pixels. Refers to
+        window outerWidth and outerHeight values, which include scroll bars,
+        title bars, etc.
+
+        :returns: dictionary representation of current window width and height
+
+        """
+        return self._send_message("getWindowSize", "value")
+
+    def set_window_size(self, width, height):
+        """Resize the browser window currently in focus.
+
+        The supplied width and height values refer to the window outerWidth
+        and outerHeight values, which include scroll bars, title bars, etc.
+
+        An error will be returned if the requested window size would result
+        in the window being in the maximised state.
+
+        :param width: The width to resize the window to.
+        :param height: The height to resize the window to.
+
+        """
+        self._send_message("setWindowSize", "ok", width=width, height=height)
diff --git a/testing/marionette/client/marionette/tests/unit/test_getactiveframe_oop.py b/testing/marionette/client/marionette/tests/unit/test_getactiveframe_oop.py
index 3892428b177..cd9b2b10b9f 100644
--- a/testing/marionette/client/marionette/tests/unit/test_getactiveframe_oop.py
+++ b/testing/marionette/client/marionette/tests/unit/test_getactiveframe_oop.py
@@ -55,7 +55,7 @@ class TestGetActiveFrameOOP(MarionetteTestCase):
         # Switch to top-level then back to active frame, verify correct frame
         self.marionette.switch_to_frame()
         self.marionette.switch_to_frame(active_frame1)
-        self.assertTrue("test_oop_1.html" in self.marionette.get_url())
+        self.assertTrue("test_oop_1.html" in self.marionette.execute_script("return document.wrappedJSObject.location.href"))
 
         # Create another OOP frame
         self.marionette.switch_to_frame()
@@ -78,18 +78,18 @@ class TestGetActiveFrameOOP(MarionetteTestCase):
         # Switch to top-level then back to active frame 1, verify correct frame
         self.marionette.switch_to_frame()
         self.marionette.switch_to_frame(active_frame1)
-        self.assertTrue("test_oop_1.html" in self.marionette.get_url())
+        self.assertTrue("test_oop_1.html" in self.marionette.execute_script("return document.wrappedJSObject.location.href"))
 
         # Switch to top-level then back to active frame 2, verify correct frame
         self.marionette.switch_to_frame()
         self.marionette.switch_to_frame(active_frame2)
-        self.assertTrue("test_oop_2.html" in self.marionette.get_url())
+        self.assertTrue("test_oop_2.html" in self.marionette.execute_script("return document.wrappedJSObject.location.href"))
 
         # NOTE: For some reason the emulator, the contents of the OOP iframes are not
         # actually rendered, even though the page_source is correct. When this test runs
         # on a b2g device, the contents do appear
-        #print self.marionette.get_url()
-        #print self.marionette.page_source
+        # print self.marionette.get_url()
+        # print self.marionette.page_source
 
     def tearDown(self):
         if self.oop_by_default is None:
diff --git a/testing/marionette/client/marionette/tests/unit/test_navigation.py b/testing/marionette/client/marionette/tests/unit/test_navigation.py
index 300c392e698..8bb070e8ebb 100644
--- a/testing/marionette/client/marionette/tests/unit/test_navigation.py
+++ b/testing/marionette/client/marionette/tests/unit/test_navigation.py
@@ -60,6 +60,7 @@ class TestNavigate(MarionetteTestCase):
         self.assertEqual("Marionette Test", self.marionette.title)
         self.assertTrue(self.marionette.execute_script("return window.document.getElementById('someDiv') == undefined;"))
 
+    ''' Disabled due to Bug 977899
     def test_navigate_frame(self):
         self.marionette.navigate(self.marionette.absolute_url("test_iframe.html"))
         self.marionette.switch_to_frame(0)
@@ -67,6 +68,7 @@ class TestNavigate(MarionetteTestCase):
         self.assertTrue('empty.html' in self.marionette.get_url())
         self.marionette.switch_to_frame()
         self.assertTrue('test_iframe.html' in self.marionette.get_url())
+    '''
 
     def test_shouldnt_error_if_nonexistent_url_used(self):
         try:
@@ -95,12 +97,12 @@ class TestNavigate(MarionetteTestCase):
             self.marionette.navigate(test_html)
             self.assertTrue(self.marionette.find_element("id", "mozLink"))
             self.fail("Should have thrown a MarionetteException")
-        except MarionetteException as e:
+        except TimeoutException as e:
             self.assertTrue("Error loading page, timed out" in str(e))
         except Exception as inst:
             import traceback
             print traceback.format_exc()
-            self.fail("Should have thrown a MarionetteException instead of %s" % type(inst))
+            self.fail("Should have thrown a TimeoutException instead of %s" % type(inst))
 
     def test_navigate_iframe(self):
         test_iframe = self.marionette.absolute_url("test_iframe.html")
diff --git a/testing/marionette/client/marionette/tests/unit/test_set_window_size.py b/testing/marionette/client/marionette/tests/unit/test_set_window_size.py
new file mode 100644
index 00000000000..1f2d2114d0a
--- /dev/null
+++ b/testing/marionette/client/marionette/tests/unit/test_set_window_size.py
@@ -0,0 +1,50 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from errors import MarionetteException
+from marionette_test import MarionetteTestCase
+
+class TestSetWindowSize(MarionetteTestCase):
+    def setUp(self):
+        super(MarionetteTestCase, self).setUp()
+        self.start_size = self.marionette.window_size
+        self.max_width = self.marionette.execute_script("return window.screen.availWidth;")
+        self.max_height = self.marionette.execute_script("return window.screen.availHeight;")
+
+    def tearDown(self):
+        # WebDriver spec says a resize cannot result in window being maximized, an
+        # error is returned if that is the case; therefore if the window is maximized
+        # at the start of this test, returning to the original size via set_window_size
+        # size will result in error; so reset to original size minus 1 pixel width
+        if self.start_size['width'] == self.max_width and self.start_size['height'] == self.max_height:
+            self.start_size['width']-=1
+        self.marionette.set_window_size(self.start_size['width'], self.start_size['height'])
+        super(MarionetteTestCase, self).tearDown()
+
+    def test_set_window_size(self):
+        # event handler
+        self.marionette.execute_script("""
+        window.wrappedJSObject.rcvd_event = false;
+        window.onresize = function() {
+            window.wrappedJSObject.rcvd_event = true;
+        };
+        """)
+
+        # valid size
+        width = self.max_width - 100
+        height = self.max_height - 100
+        self.marionette.set_window_size(width, height)
+        self.wait_for_condition(lambda m: m.execute_script("return window.wrappedJSObject.rcvd_event;"))
+        size = self.marionette.window_size
+        self.assertEqual(size['width'], width,
+                         "Window width is %s but should be %s" % (size['width'], width))
+        self.assertEqual(size['height'], height,
+                         "Window height is %s but should be %s" % (size['height'], height))
+
+        # invalid size (cannot maximize)
+        with self.assertRaisesRegexp(MarionetteException, "Invalid requested size"):
+            self.marionette.set_window_size(self.max_width, self.max_height)
+        size = self.marionette.window_size
+        self.assertEqual(size['width'], width, "Window width should not have changed")
+        self.assertEqual(size['height'], height, "Window height should not have changed")
diff --git a/testing/marionette/client/marionette/tests/unit/test_switch_frame.py b/testing/marionette/client/marionette/tests/unit/test_switch_frame.py
index 0dceee717eb..139ac25b1d1 100644
--- a/testing/marionette/client/marionette/tests/unit/test_switch_frame.py
+++ b/testing/marionette/client/marionette/tests/unit/test_switch_frame.py
@@ -10,66 +10,61 @@ class TestSwitchFrame(MarionetteTestCase):
     def test_switch_simple(self):
         start_url = "test_iframe.html"
         verify_title = "Marionette IFrame Test"
-        verify_url = "test.html"
         test_html = self.marionette.absolute_url(start_url)
         self.marionette.navigate(test_html)
         self.assertEqual(self.marionette.get_active_frame(), None)
         frame = self.marionette.find_element("id", "test_iframe")
         self.marionette.switch_to_frame(frame)
-        self.assertTrue(verify_url in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
         inner_frame_element = self.marionette.get_active_frame()
         # test that we can switch back to main frame, then switch back to the
         # inner frame with the value we got from get_active_frame
         self.marionette.switch_to_frame()
         self.assertEqual(verify_title, self.marionette.title)
         self.marionette.switch_to_frame(inner_frame_element)
-        self.assertTrue(verify_url in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
 
     def test_switch_nested(self):
         start_url = "test_nested_iframe.html"
         verify_title = "Marionette IFrame Test"
-        verify_url = "test_inner_iframe.html"
         test_html = self.marionette.absolute_url(start_url)
         self.marionette.navigate(test_html)
         frame = self.marionette.find_element("id", "test_iframe")
         self.assertEqual(self.marionette.get_active_frame(), None)
         self.marionette.switch_to_frame(frame)
-        self.assertTrue(verify_url in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
         inner_frame_element = self.marionette.get_active_frame()
         # test that we can switch back to main frame, then switch back to the
         # inner frame with the value we got from get_active_frame
         self.marionette.switch_to_frame()
         self.assertEqual(verify_title, self.marionette.title)
         self.marionette.switch_to_frame(inner_frame_element)
-        self.assertTrue(verify_url in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
         inner_frame = self.marionette.find_element('id', 'inner_frame')
         self.marionette.switch_to_frame(inner_frame)
-        self.assertTrue("test.html" in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
         self.marionette.switch_to_frame() # go back to main frame
-        self.assertTrue("test_nested_iframe.html" in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
         #test that we're using the right window object server-side
         self.assertTrue("test_nested_iframe.html" in self.marionette.execute_script("return window.location.href;"))
 
     def test_stack_trace(self):
         start_url = "test_iframe.html"
         verify_title = "Marionette IFrame Test"
-        verify_url = "test.html"
         test_html = self.marionette.absolute_url(start_url)
         self.marionette.navigate(test_html)
         frame = self.marionette.find_element("id", "test_iframe")
         self.assertEqual(self.marionette.get_active_frame(), None)
         self.marionette.switch_to_frame(frame)
-        self.assertTrue(verify_url in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
         inner_frame_element = self.marionette.get_active_frame()
         # test that we can switch back to main frame, then switch back to the
         # inner frame with the value we got from get_active_frame
         self.marionette.switch_to_frame()
         self.assertEqual(verify_title, self.marionette.title)
         self.marionette.switch_to_frame(inner_frame_element)
-        self.assertTrue(verify_url in self.marionette.get_url())
+        self.assertTrue(start_url in self.marionette.get_url())
 
-        #can't use assertRaises in context manager with python2.6
-        self.assertRaises(JavascriptException, self.marionette.execute_async_script, "foo();")
         try:
             self.marionette.execute_async_script("foo();")
         except JavascriptException as e:
diff --git a/testing/marionette/client/marionette/tests/unit/unit-tests.ini b/testing/marionette/client/marionette/tests/unit/unit-tests.ini
index 777ed10f492..6e1226d17b9 100644
--- a/testing/marionette/client/marionette/tests/unit/unit-tests.ini
+++ b/testing/marionette/client/marionette/tests/unit/unit-tests.ini
@@ -85,6 +85,7 @@ browser = false
 [test_specialpowers.py]
 [test_switch_anonymous_content.py]
 [test_switch_frame.py]
+b2g = false
 [test_switch_frame_chrome.py]
 [test_switch_remote_frame.py]
 
@@ -119,5 +120,7 @@ browser = false
 [test_click_scrolling.py]
 [test_profile_management.py]
 b2g = false
+[test_set_window_size.py]
+b2g = false
 
 [include:oop/manifest.ini]
diff --git a/testing/marionette/marionette-server.js b/testing/marionette/marionette-server.js
index 533072b73f5..b6ff8480526 100644
--- a/testing/marionette/marionette-server.js
+++ b/testing/marionette/marionette-server.js
@@ -1127,12 +1127,21 @@ MarionetteServerConnection.prototype = {
    * of the current resource.
    */
   getCurrentUrl: function MDA_getCurrentUrl() {
+    let isB2G = appName == "B2G";
     this.command_id = this.getCommandId();
-    if (this.context == "chrome") {
+    if (this.context === "chrome") {
       this.sendResponse(this.getCurrentWindow().location.href, this.command_id);
     }
     else {
-      this.sendAsync("getCurrentUrl", {}, this.command_id);
+      if (isB2G) {
+        this.sendAsync("getCurrentUrl", {}, this.command_id);
+      }
+      else {
+        this.sendResponse(this.curBrowser
+                              .tab
+                              .linkedBrowser
+                              .contentWindow.location.href, this.command_id);
+      }
     }
   },
 
@@ -2344,6 +2353,59 @@ MarionetteServerConnection.prototype = {
     this.sendOk(this.command_id);
   },
 
+  /**
+   * Get the size of the browser window currently in focus.
+   *
+   * Will return the current browser window size in pixels. Refers to
+   * window outerWidth and outerHeight values, which include scroll bars,
+   * title bars, etc.
+   *
+   */
+  getWindowSize: function MDA_getWindowSize(aRequest) {
+    this.command_id = this.getCommandId();
+    let curWindow = this.getCurrentWindow();
+    let curWidth = curWindow.outerWidth;
+    let curHeight = curWindow.outerHeight;
+    this.sendResponse({width: curWidth, height: curHeight}, this.command_id);
+  },
+
+  /**
+   * Set the size of the browser window currently in focus.
+   *
+   * Not supported on B2G. The supplied width and height values refer to
+   * the window outerWidth and outerHeight values, which include scroll
+   * bars, title bars, etc.
+   *
+   * An error will be returned if the requested window size would result
+   * in the window being in the maximized state.
+   */
+  setWindowSize: function MDA_setWindowSize(aRequest) {
+    this.command_id = this.getCommandId();
+
+    if (appName == "B2G") {
+      this.sendError("Not supported on B2G", 405, null, this.command_id);
+      return;
+    }
+
+    try {
+      var width = parseInt(aRequest.parameters.width);
+      var height = parseInt(aRequest.parameters.height);
+    }
+    catch(e) {
+      this.sendError(e.message, e.code, e.stack, this.command_id);
+      return;
+    }
+
+    let curWindow = this.getCurrentWindow();
+    if (width >= curWindow.screen.availWidth && height >= curWindow.screen.availHeight) {
+      this.sendError("Invalid requested size, cannot maximize", 405, null, this.command_id);
+      return;
+    }
+
+    curWindow.resizeTo(width, height);
+    this.sendOk(this.command_id);
+  },
+
   /**
    * Helper function to convert an outerWindowID into a UID that Marionette
    * tracks.
@@ -2549,7 +2611,9 @@ MarionetteServerConnection.prototype.requestTypes = {
   "deleteCookie": MarionetteServerConnection.prototype.deleteCookie,
   "getActiveElement": MarionetteServerConnection.prototype.getActiveElement,
   "getScreenOrientation": MarionetteServerConnection.prototype.getScreenOrientation,
-  "setScreenOrientation": MarionetteServerConnection.prototype.setScreenOrientation
+  "setScreenOrientation": MarionetteServerConnection.prototype.setScreenOrientation,
+  "getWindowSize": MarionetteServerConnection.prototype.getWindowSize,
+  "setWindowSize": MarionetteServerConnection.prototype.setWindowSize
 };
 
 /**
diff --git a/testing/mochitest/browser-test.js b/testing/mochitest/browser-test.js
index 67b7426a0c4..59090fc2588 100644
--- a/testing/mochitest/browser-test.js
+++ b/testing/mochitest/browser-test.js
@@ -458,7 +458,6 @@ Tester.prototype = {
     // is invoked to start the tests.
     this.waitForWindowsState((function () {
       if (this.done) {
-        let promise = Promise.resolve();
 
         // Uninitialize a few things explicitly so that they can clean up
         // frames and browser intentionally kept alive until shutdown to
@@ -489,15 +488,8 @@ Tester.prototype = {
           SocialFlyout.unload();
           SocialShare.uninit();
           TabView.uninit();
-
-          // Destroying ContentSearch is asynchronous.
-          promise = ContentSearch.destroy();
         }
 
-        // Simulate memory pressure so that we're forced to free more resources
-        // and thus get rid of more false leaks like already terminated workers.
-        Services.obs.notifyObservers(null, "memory-pressure", "heap-minimize");
-
         // Schedule GC and CC runs before finishing in order to detect
         // DOM windows leaked by our tests or the tested code. Note that we
         // use a shrinking GC so that the JS engine will discard JIT code and
@@ -527,7 +519,19 @@ Tester.prototype = {
           }
         };
 
-        promise.then(() => {
+        let {AsyncShutdown} =
+          Cu.import("resource://gre/modules/AsyncShutdown.jsm", {});
+
+        let barrier = new AsyncShutdown.Barrier(
+          "ShutdownLeaks: Wait for cleanup to be finished before checking for leaks");
+        Services.obs.notifyObservers({wrappedJSObject: barrier},
+          "shutdown-leaks-before-check", null);
+
+        barrier.wait().then(() => {
+          // Simulate memory pressure so that we're forced to free more resources
+          // and thus get rid of more false leaks like already terminated workers.
+          Services.obs.notifyObservers(null, "memory-pressure", "heap-minimize");
+
           checkForLeakedGlobalWindows(aResults => {
             if (aResults.length == 0) {
               this.finish();
diff --git a/testing/mochitest/mach_commands.py b/testing/mochitest/mach_commands.py
index f6c6ae812a1..f3d52dc40ef 100644
--- a/testing/mochitest/mach_commands.py
+++ b/testing/mochitest/mach_commands.py
@@ -827,3 +827,39 @@ class B2GCommands(MachCommandBase):
 
         mochitest = self._spawn(MochitestRunner)
         return mochitest.run_b2g_test(test_paths=test_paths, **kwargs)
+
+
+@CommandProvider
+class AndroidCommands(MachCommandBase):
+    @Command('robocop', category='testing',
+        conditions=[conditions.is_android],
+        description='Run a Robocop test.')
+    @CommandArgument('test_path', default=None, nargs='?',
+        metavar='TEST',
+        help='Test to run. Can be specified as a Robocop test name (like "testLoad"), ' \
+             'or omitted. If omitted, the entire test suite is executed.')
+    def run_robocop(self, test_path):
+        self.tests_dir = os.path.join(self.topobjdir, '_tests')
+        self.mochitest_dir = os.path.join(self.tests_dir, 'testing', 'mochitest')
+        import imp
+        path = os.path.join(self.mochitest_dir, 'runtestsremote.py')
+        with open(path, 'r') as fh:
+            imp.load_module('runtestsremote', fh, path,
+                ('.py', 'r', imp.PY_SOURCE))
+        import runtestsremote
+
+        args = [
+            '--xre-path=' + os.environ.get('MOZ_HOST_BIN'),
+            '--dm_trans=adb',
+            '--deviceIP=',
+            '--console-level=INFO',
+            '--app=' + self.substs['ANDROID_PACKAGE_NAME'],
+            '--robocop-apk=' + os.path.join(self.topobjdir, 'build', 'mobile', 'robocop', 'robocop-debug.apk'),
+            '--robocop-ini=' + os.path.join(self.topobjdir, 'build', 'mobile', 'robocop', 'robocop.ini'),
+            '--log-mach=-',
+        ]
+
+        if test_path:
+            args.append('--test-path=%s' % test_path)
+
+        sys.exit(runtestsremote.main(args))
diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index d68bd1aff27..d0d8399711e 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -1908,6 +1908,12 @@ class Mochitest(MochitestUtilsMixin):
         stackFixerModule = import_stackFixerModule('fix_stack_using_bpsyms')
         stackFixerFunction = lambda line: stackFixerModule.fixSymbols(line, self.symbolsPath)
 
+      elif mozinfo.isMac:
+        # Run each line through fix_macosx_stack.py (uses atos).
+        # This method is preferred for developer machines, so we don't have to run "make buildsymbols".
+        stackFixerModule = import_stackFixerModule('fix_macosx_stack')
+        stackFixerFunction = lambda line: stackFixerModule.fixSymbols(line)
+
       elif mozinfo.isLinux:
         # Run each line through fix_linux_stack.py (uses addr2line).
         # This method is preferred for developer machines, so we don't have to run "make buildsymbols".
diff --git a/testing/mochitest/runtestsremote.py b/testing/mochitest/runtestsremote.py
index 1bcbcd75ae2..df725d3132f 100644
--- a/testing/mochitest/runtestsremote.py
+++ b/testing/mochitest/runtestsremote.py
@@ -252,6 +252,10 @@ class MochiRemote(Mochitest):
         else:
             self.log.warning("Unable to retrieve log file (%s) from remote device" % self.remoteLog)
         self._dm.removeDir(self.remoteProfile)
+        # Don't leave an old robotium.config hanging around; the
+        # profile it references was just deleted!
+        deviceRoot = self._dm.getDeviceRoot()
+        self._dm.removeFile(os.path.join(deviceRoot, "robotium.config"))
         blobberUploadDir = os.environ.get('MOZ_UPLOAD_DIR', None)
         if blobberUploadDir:
             self._dm.getDirectory(self.remoteNSPR, blobberUploadDir)
@@ -584,14 +588,14 @@ class MochiRemote(Mochitest):
 
         return self._automation.runApp(*args, **kwargs)
 
-def main():
+def main(args):
     message_logger = MessageLogger(logger=None)
     process_args = {'messageLogger': message_logger}
     auto = RemoteAutomation(None, "fennec", processArgs=process_args)
 
     parser = RemoteOptions(auto)
     structured.commandline.add_logging_group(parser)
-    options, args = parser.parse_args()
+    options, args = parser.parse_args(args)
 
     if (options.dm_trans == "adb"):
         if (options.deviceIP):
@@ -611,7 +615,7 @@ def main():
 
     if (options == None):
         log.error("Invalid options specified, use --help for a list of valid options")
-        sys.exit(1)
+        return 1
 
     productPieces = options.remoteProductName.split('.')
     if (productPieces != None):
@@ -622,7 +626,7 @@ def main():
 
     options = parser.verifyOptions(options, mochitest)
     if (options == None):
-        sys.exit(1)
+        return 1
 
     logParent = os.path.dirname(options.remoteLogFile)
     dm.mkDir(logParent);
@@ -674,11 +678,6 @@ def main():
             my_tests = tests[start:end]
             log.info("Running tests %d-%d/%d" % (start+1, end, len(tests)))
 
-        dm.removeFile(os.path.join(deviceRoot, "fennec_ids.txt"))
-        fennec_ids = os.path.abspath(os.path.join(SCRIPT_DIR, "fennec_ids.txt"))
-        if not os.path.exists(fennec_ids) and options.robocopIds:
-            fennec_ids = options.robocopIds
-        dm.pushFile(fennec_ids, os.path.join(deviceRoot, "fennec_ids.txt"))
         options.extraPrefs.append('browser.search.suggest.enabled=true')
         options.extraPrefs.append('browser.search.suggest.prompted=true')
         options.extraPrefs.append('layout.css.devPixelsPerPx=1.0')
@@ -805,10 +804,12 @@ def main():
                 pass
             retVal = 1
 
-    message_logger.finish()
-    mochitest.printDeviceInfo(printLogcat=True)
+        mochitest.printDeviceInfo(printLogcat=True)
+
+    message_logger.finish()
+
+    return retVal
 
-    sys.exit(retVal)
 
 if __name__ == "__main__":
-    main()
+    sys.exit(main(sys.argv[1:]))
diff --git a/testing/mozbase/manifestparser/manifestparser/manifestparser.py b/testing/mozbase/manifestparser/manifestparser/manifestparser.py
index 5987b6d7817..b6f5add4eaa 100755
--- a/testing/mozbase/manifestparser/manifestparser/manifestparser.py
+++ b/testing/mozbase/manifestparser/manifestparser/manifestparser.py
@@ -1105,10 +1105,34 @@ class TestManifest(ManifestParser):
         """
         - exists : return only existing tests
         - disabled : whether to return disabled tests
-        - tags : keys and values to filter on (e.g. `os = linux mac`)
+        - options: an optparse or argparse options object, used for subsuites
+        - values : keys and values to filter on (e.g. `os = linux mac`)
         """
         tests = [i.copy() for i in self.tests] # shallow copy
 
+        # Conditional subsuites are specified using:
+        #    subsuite = foo,condition
+        # where 'foo' is the subsuite name, and 'condition' is the same type of
+        # condition used for skip-if.  If the condition doesn't evaluate to true,
+        # the subsuite designation will be removed from the test.
+        #
+        # Look for conditional subsuites, and replace them with the subsuite itself
+        # (if the condition is true), or nothing.
+        for test in tests:
+            subsuite = test.get('subsuite')
+            if ',' in subsuite:
+                try:
+                    subsuite, condition = subsuite.split(',')
+                except ValueError:
+                    raise ParseError("subsuite condition can't contain commas")
+                # strip any comments from the condition
+                condition = condition.split('#')[0]
+                matched = parse(condition, **values)
+                if matched:
+                    test['subsuite'] = subsuite
+                else:
+                    test['subsuite'] = ''
+
         # Filter on current subsuite
         if options:
             if  options.subsuite:
diff --git a/testing/mozbase/manifestparser/tests/subsuite.ini b/testing/mozbase/manifestparser/tests/subsuite.ini
new file mode 100644
index 00000000000..c1a70bd44ef
--- /dev/null
+++ b/testing/mozbase/manifestparser/tests/subsuite.ini
@@ -0,0 +1,13 @@
+[test1]
+subsuite=bar,foo=="bar" # this has a comment
+
+[test2]
+subsuite=bar,foo=="bar"
+
+[test3]
+subsuite=baz
+
+[test4]
+[test5]
+[test6]
+subsuite=bar,foo=="szy" || foo=="bar"
\ No newline at end of file
diff --git a/testing/mozbase/manifestparser/tests/test_testmanifest.py b/testing/mozbase/manifestparser/tests/test_testmanifest.py
index ad8521a3d5e..434990f0fb6 100644
--- a/testing/mozbase/manifestparser/tests/test_testmanifest.py
+++ b/testing/mozbase/manifestparser/tests/test_testmanifest.py
@@ -4,7 +4,7 @@ import os
 import shutil
 import tempfile
 import unittest
-from manifestparser import TestManifest
+from manifestparser import TestManifest, ParseError
 
 here = os.path.dirname(os.path.abspath(__file__))
 
@@ -57,6 +57,51 @@ class TestTestManifest(unittest.TestCase):
         names = [i['name'] for i in manifest.tests]
         self.assertFalse('test_0202_app_launch_apply_update_dirlocked.js' in names)
 
+    def test_manifest_subsuites(self):
+        """
+        test subsuites and conditional subsuites
+        """
+        class AttributeDict(dict):
+            def __getattr__(self, attr):
+                return self[attr]
+            def __setattr__(self, attr, value):
+                self[attr] = value
+
+        relative_path = os.path.join(here, 'subsuite.ini')
+        manifest = TestManifest(manifests=(relative_path,))
+        info = {'foo': 'bar'}
+        options = {'subsuite': 'bar'}
+
+        # 6 tests total
+        self.assertEquals(len(manifest.active_tests(exists=False, **info)), 6)
+
+        # only 3 tests for subsuite bar when foo==bar
+        self.assertEquals(len(manifest.active_tests(exists=False,
+                                                    options=AttributeDict(options),
+                                                    **info)), 3)
+
+        options = {'subsuite': 'baz'}
+        other = {'something': 'else'}
+        # only 1 test for subsuite baz, regardless of conditions
+        self.assertEquals(len(manifest.active_tests(exists=False,
+                                                    options=AttributeDict(options),
+                                                    **info)), 1)
+        self.assertEquals(len(manifest.active_tests(exists=False,
+                                                    options=AttributeDict(options),
+                                                    **other)), 1)
+
+        # 4 tests match when the condition doesn't match (all tests except
+        # the unconditional subsuite)
+        info = {'foo': 'blah'}
+        options = {'subsuite': None}
+        self.assertEquals(len(manifest.active_tests(exists=False,
+                                                    options=AttributeDict(options),
+                                                    **info)), 5)
+
+        # test for illegal subsuite value
+        manifest.tests[0]['subsuite'] = 'subsuite=bar,foo=="bar",type="nothing"'
+        self.assertRaises(ParseError, manifest.active_tests, exists=False,
+                          options=AttributeDict(options), **info)
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/testing/web-platform/meta/XMLHttpRequest/data-uri-basic.htm.ini b/testing/web-platform/meta/XMLHttpRequest/data-uri-basic.htm.ini
index 1dd32e58729..ca0ac362b93 100644
--- a/testing/web-platform/meta/XMLHttpRequest/data-uri-basic.htm.ini
+++ b/testing/web-platform/meta/XMLHttpRequest/data-uri-basic.htm.ini
@@ -1,14 +1,12 @@
 [data-uri-basic.htm]
   type: testharness
-  [GET status]
-    expected: FAIL
-
-  [GET statusText]
-    expected: FAIL
 
   [GET getAllResponseHeaders]
     expected: FAIL
 
+  [POST status]
+    expected: FAIL
+
   [POST responseText]
     expected: FAIL
 
diff --git a/testing/web-platform/meta/XMLHttpRequest/data-uri.htm.ini b/testing/web-platform/meta/XMLHttpRequest/data-uri.htm.ini
index 3e57540eec4..ef0649f92c1 100644
--- a/testing/web-platform/meta/XMLHttpRequest/data-uri.htm.ini
+++ b/testing/web-platform/meta/XMLHttpRequest/data-uri.htm.ini
@@ -1,14 +1,5 @@
 [data-uri.htm]
   type: testharness
-  [XHR method GET with charset text/plain]
-    expected: FAIL
-
-  [XHR method GET with charset text/plain (base64)]
-    expected: FAIL
-
-  [XHR method GET with charset text/html]
-    expected: FAIL
-
   [XHR method GET with charset image/png]
     expected: FAIL
 
diff --git a/testing/web-platform/meta/XMLHttpRequest/send-entity-body-document.htm.ini b/testing/web-platform/meta/XMLHttpRequest/send-entity-body-document.htm.ini
index 1be7736b596..d844431e888 100644
--- a/testing/web-platform/meta/XMLHttpRequest/send-entity-body-document.htm.ini
+++ b/testing/web-platform/meta/XMLHttpRequest/send-entity-body-document.htm.ini
@@ -4,23 +4,7 @@
     expected: FAIL
 
   [XMLHttpRequest: send() - Document 1]
-    expected:
-      if version == "OS X 10.6.8": FAIL
-      if not debug and (os == "linux") and (version == "Ubuntu 12.04") and (processor == "x86_64") and (bits == 64): FAIL
-      if not debug and (os == "linux") and (version == "Ubuntu 12.04") and (processor == "x86") and (bits == 32): FAIL
-      if not debug and (os == "mac") and (version == "OS X 10.9") and (processor == "x86_64") and (bits == 64): FAIL
-      if not debug and (os == "mac") and (version == "OS X 10.8") and (processor == "x86_64") and (bits == 64): FAIL
-      if not debug and (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
-      if not debug and (os == "win") and (version == "6.1.7601") and (processor == "x86") and (bits == 32): FAIL
-      if not debug and (os == "win") and (version == "6.2.9200") and (processor == "x86_64") and (bits == 64): FAIL
-      if debug and (os == "win") and (version == "5.1.2600") and (processor == "x86") and (bits == 32): FAIL
-      if debug and (os == "linux") and (version == "Ubuntu 12.04") and (processor == "x86_64") and (bits == 64): FAIL
-      if debug and (os == "win") and (version == "6.2.9200") and (processor == "x86") and (bits == 32): FAIL
-      if debug and (os == "linux") and (version == "Ubuntu 12.04") and (processor == "x86") and (bits == 32): FAIL
-      if debug and (os == "mac") and (version == "OS X 10.8") and (processor == "x86_64") and (bits == 64): FAIL
-      if not debug and (os == "win") and (version == "6.2.9200") and (processor == "x86") and (bits == 32): FAIL
-      if debug and (os == "win") and (version == "6.1.7601") and (processor == "x86") and (bits == 32): FAIL
-      if debug and (os == "mac") and (version == "OS X 10.9") and (processor == "x86_64") and (bits == 64): FAIL
+    expected: FAIL
 
   [Send HTML Document]
     expected: FAIL
diff --git a/testing/web-platform/meta/XMLHttpRequest/send-redirect-bogus.htm.ini b/testing/web-platform/meta/XMLHttpRequest/send-redirect-bogus.htm.ini
deleted file mode 100644
index 4e6b3247d33..00000000000
--- a/testing/web-platform/meta/XMLHttpRequest/send-redirect-bogus.htm.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[send-redirect-bogus.htm]
-  type: testharness
-  [XMLHttpRequest: send() - Redirects (bogus Location header) (303: foobar:someone@example.org)]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/html/dom/reflection-embedded.html.ini b/testing/web-platform/meta/html/dom/reflection-embedded.html.ini
index 55aeb300ddc..7d8b3ed5c0e 100644
--- a/testing/web-platform/meta/html/dom/reflection-embedded.html.ini
+++ b/testing/web-platform/meta/html/dom/reflection-embedded.html.ini
@@ -141,6 +141,21 @@
   [img.srcset: IDL set to object "test-valueOf" followed by IDL get]
     expected: FAIL
 
+  [img.crossOrigin: typeof IDL attribute]
+    expected: FAIL
+
+  [img.crossOrigin: IDL get with DOM attribute unset]
+    expected: FAIL
+
+  [img.crossOrigin: setAttribute() to "" followed by IDL get]
+    expected: FAIL
+
+  [img.crossOrigin: IDL set to "" followed by IDL get]
+    expected: FAIL
+
+  [img.crossOrigin: IDL set to undefined followed by getAttribute()]
+    expected: FAIL
+
   [img.crossOrigin: setAttribute() to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
     expected: FAIL
 
@@ -195,9 +210,6 @@
   [img.crossOrigin: setAttribute() to "nonymous" followed by IDL get]
     expected: FAIL
 
-  [img.crossOrigin: setAttribute() to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
   [img.crossOrigin: setAttribute() to "xuse-credentials" followed by IDL get]
     expected: FAIL
 
@@ -207,9 +219,6 @@
   [img.crossOrigin: setAttribute() to "se-credentials" followed by IDL get]
     expected: FAIL
 
-  [img.crossOrigin: setAttribute() to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
   [img.crossOrigin: IDL set to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
     expected: FAIL
 
@@ -264,9 +273,6 @@
   [img.crossOrigin: IDL set to "nonymous" followed by IDL get]
     expected: FAIL
 
-  [img.crossOrigin: IDL set to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
   [img.crossOrigin: IDL set to "xuse-credentials" followed by IDL get]
     expected: FAIL
 
@@ -276,9 +282,6 @@
   [img.crossOrigin: IDL set to "se-credentials" followed by IDL get]
     expected: FAIL
 
-  [img.crossOrigin: IDL set to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
   [img.lowsrc: setAttribute() to "" followed by IDL get]
     expected: FAIL
 
@@ -663,144 +666,21 @@
   [video.tabIndex: IDL set to -2147483648 followed by IDL get]
     expected: FAIL
 
-  [video.crossOrigin: setAttribute() to "" followed by IDL get]
+  [video.crossOrigin: typeof IDL attribute]
     expected: FAIL
 
-  [video.crossOrigin: setAttribute() to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [video.crossOrigin: IDL get with DOM attribute unset]
     expected: FAIL
 
-  [video.crossOrigin: setAttribute() to undefined followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to 7 followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to true followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to false followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to NaN followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to Infinity followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "\\0" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to null followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: setAttribute() to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [video.crossOrigin: IDL set to undefined followed by getAttribute()]
     expected: FAIL
 
   [video.crossOrigin: IDL set to undefined followed by IDL get]
     expected: FAIL
 
-  [video.crossOrigin: IDL set to 7 followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to true followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to false followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to NaN followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to Infinity followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "\\0" followed by IDL get]
-    expected: FAIL
-
   [video.crossOrigin: IDL set to null followed by IDL get]
     expected: FAIL
 
-  [video.crossOrigin: IDL set to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [video.crossOrigin: IDL set to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
   [video.mediaGroup: typeof IDL attribute]
     expected: FAIL
 
@@ -954,144 +834,21 @@
   [audio.tabIndex: IDL set to -2147483648 followed by IDL get]
     expected: FAIL
 
-  [audio.crossOrigin: setAttribute() to "" followed by IDL get]
+  [audio.crossOrigin: typeof IDL attribute]
     expected: FAIL
 
-  [audio.crossOrigin: setAttribute() to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [audio.crossOrigin: IDL get with DOM attribute unset]
     expected: FAIL
 
-  [audio.crossOrigin: setAttribute() to undefined followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to 7 followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to true followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to false followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to NaN followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to Infinity followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "\\0" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to null followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: setAttribute() to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [audio.crossOrigin: IDL set to undefined followed by getAttribute()]
     expected: FAIL
 
   [audio.crossOrigin: IDL set to undefined followed by IDL get]
     expected: FAIL
 
-  [audio.crossOrigin: IDL set to 7 followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to true followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to false followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to NaN followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to Infinity followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "\\0" followed by IDL get]
-    expected: FAIL
-
   [audio.crossOrigin: IDL set to null followed by IDL get]
     expected: FAIL
 
-  [audio.crossOrigin: IDL set to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [audio.crossOrigin: IDL set to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
   [audio.mediaGroup: typeof IDL attribute]
     expected: FAIL
 
diff --git a/testing/web-platform/meta/html/dom/reflection-metadata.html.ini b/testing/web-platform/meta/html/dom/reflection-metadata.html.ini
index e7433f9af1c..b0209b2a000 100644
--- a/testing/web-platform/meta/html/dom/reflection-metadata.html.ini
+++ b/testing/web-platform/meta/html/dom/reflection-metadata.html.ini
@@ -48,144 +48,21 @@
   [link.tabIndex: IDL set to -2147483648 followed by IDL get]
     expected: FAIL
 
-  [link.crossOrigin: setAttribute() to "" followed by IDL get]
+  [link.crossOrigin: typeof IDL attribute]
     expected: FAIL
 
-  [link.crossOrigin: setAttribute() to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [link.crossOrigin: IDL get with DOM attribute unset]
     expected: FAIL
 
-  [link.crossOrigin: setAttribute() to undefined followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to 7 followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to true followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to false followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to NaN followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to Infinity followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "\\0" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to null followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: setAttribute() to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [link.crossOrigin: IDL set to undefined followed by getAttribute()]
     expected: FAIL
 
   [link.crossOrigin: IDL set to undefined followed by IDL get]
     expected: FAIL
 
-  [link.crossOrigin: IDL set to 7 followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to true followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to false followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to NaN followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to Infinity followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "\\0" followed by IDL get]
-    expected: FAIL
-
   [link.crossOrigin: IDL set to null followed by IDL get]
     expected: FAIL
 
-  [link.crossOrigin: IDL set to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [link.crossOrigin: IDL set to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
   [meta.tabIndex: setAttribute() to -2147483648 followed by IDL get]
     expected: FAIL
 
diff --git a/testing/web-platform/meta/html/dom/reflection-misc.html.ini b/testing/web-platform/meta/html/dom/reflection-misc.html.ini
index 0402dffd40e..2f1c01a3b1b 100644
--- a/testing/web-platform/meta/html/dom/reflection-misc.html.ini
+++ b/testing/web-platform/meta/html/dom/reflection-misc.html.ini
@@ -24,144 +24,21 @@
   [script.tabIndex: IDL set to -2147483648 followed by IDL get]
     expected: FAIL
 
-  [script.crossOrigin: setAttribute() to "" followed by IDL get]
+  [script.crossOrigin: typeof IDL attribute]
     expected: FAIL
 
-  [script.crossOrigin: setAttribute() to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [script.crossOrigin: IDL get with DOM attribute unset]
     expected: FAIL
 
-  [script.crossOrigin: setAttribute() to undefined followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to 7 followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to true followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to false followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to NaN followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to Infinity followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "\\0" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to null followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: setAttribute() to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to " \\0\\x01\\x02\\x03\\x04\\x05\\x06\\x07 \\b\\t\\n\\v\\f\\r\\x0e\\x0f \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17 \\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f  foo " followed by IDL get]
+  [script.crossOrigin: IDL set to undefined followed by getAttribute()]
     expected: FAIL
 
   [script.crossOrigin: IDL set to undefined followed by IDL get]
     expected: FAIL
 
-  [script.crossOrigin: IDL set to 7 followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to 1.5 followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to true followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to false followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to object "[object Object\]" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to NaN followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to Infinity followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to -Infinity followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "\\0" followed by IDL get]
-    expected: FAIL
-
   [script.crossOrigin: IDL set to null followed by IDL get]
     expected: FAIL
 
-  [script.crossOrigin: IDL set to object "test-toString" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to object "test-valueOf" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "xanonymous" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "anonymous\\0" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "nonymous" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "ANONYMOUS" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "xuse-credentials" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "use-credentials\\0" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "se-credentials" followed by IDL get]
-    expected: FAIL
-
-  [script.crossOrigin: IDL set to "USE-CREDENTIALS" followed by IDL get]
-    expected: FAIL
-
   [noscript.tabIndex: setAttribute() to -2147483648 followed by IDL get]
     expected: FAIL
 
diff --git a/testing/web-platform/meta/shadow-dom/shadow-trees/lower-boundary-encapsulation/test-005.html.ini b/testing/web-platform/meta/shadow-dom/shadow-trees/lower-boundary-encapsulation/test-005.html.ini
deleted file mode 100644
index 700138e5b88..00000000000
--- a/testing/web-platform/meta/shadow-dom/shadow-trees/lower-boundary-encapsulation/test-005.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[test-005.html]
-  type: testharness
-  expected: CRASH
-  [A_04_02_05_T01]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/shadow-dom/shadow-trees/nested-shadow-trees/test-001.html.ini b/testing/web-platform/meta/shadow-dom/shadow-trees/nested-shadow-trees/test-001.html.ini
deleted file mode 100644
index 21aa4ee3991..00000000000
--- a/testing/web-platform/meta/shadow-dom/shadow-trees/nested-shadow-trees/test-001.html.ini
+++ /dev/null
@@ -1,6 +0,0 @@
-[test-001.html]
-  type: testharness
-  expected: CRASH
-  [A_04_08_01_T01]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/workers/interfaces/WorkerUtils/navigator/001.html.ini b/testing/web-platform/meta/workers/interfaces/WorkerUtils/navigator/001.html.ini
deleted file mode 100644
index 32f872f77a0..00000000000
--- a/testing/web-platform/meta/workers/interfaces/WorkerUtils/navigator/001.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[001.html]
-  type: testharness
-  [navigator]
-    expected: FAIL
-
diff --git a/testing/web-platform/meta/workers/interfaces/WorkerUtils/navigator/language.html.ini b/testing/web-platform/meta/workers/interfaces/WorkerUtils/navigator/language.html.ini
deleted file mode 100644
index 0f8db7589ef..00000000000
--- a/testing/web-platform/meta/workers/interfaces/WorkerUtils/navigator/language.html.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-[language.html]
-  type: testharness
-  [navigator.language]
-    expected: FAIL
-
diff --git a/toolkit/components/aboutmemory/content/aboutMemory.js b/toolkit/components/aboutmemory/content/aboutMemory.js
index 9f0a84b1b61..ee1764b7aa5 100644
--- a/toolkit/components/aboutmemory/content/aboutMemory.js
+++ b/toolkit/components/aboutmemory/content/aboutMemory.js
@@ -528,12 +528,31 @@ function updateAboutMemoryFromReporters()
 //
 var gCurrentFileFormatVersion = 1;
 
+
+/**
+ * Parse a string as JSON and extract the |memory_report| property if it has
+ * one, which indicates the string is from a crash dump.
+ *
+ * @param aStr
+ *        The string.
+ * @return The extracted object.
+ */
+function parseAndUnwrapIfCrashDump(aStr) {
+  let obj = JSON.parse(aStr);
+  if (obj.memory_report !== undefined) {
+    // It looks like a crash dump. The memory reports should be in the
+    // |memory_report| property.
+    obj = obj.memory_report;
+  }
+  return obj;
+}
+
 /**
  * Populate about:memory using the data in the given JSON object.
  *
  * @param aObj
- *        An object containing JSON data that (hopefully!) conforms to the
- *        schema used by nsIMemoryInfoDumper.
+ *        An object that (hopefully!) conforms to the JSON schema used by
+ *        nsIMemoryInfoDumper.
  */
 function updateAboutMemoryFromJSONObject(aObj)
 {
@@ -582,7 +601,7 @@ function updateAboutMemoryFromJSONObject(aObj)
 function updateAboutMemoryFromJSONString(aStr)
 {
   try {
-    let obj = JSON.parse(aStr);
+    let obj = parseAndUnwrapIfCrashDump(aStr);
     updateAboutMemoryFromJSONObject(obj);
   } catch (ex) {
     handleException(ex);
@@ -672,10 +691,10 @@ function updateAboutMemoryFromFile(aFilename)
 function updateAboutMemoryFromTwoFiles(aFilename1, aFilename2)
 {
   loadMemoryReportsFromFile(aFilename1, function(aStr1) {
-    loadMemoryReportsFromFile(aFilename2, function f2(aStr2) {
+    loadMemoryReportsFromFile(aFilename2, function(aStr2) {
       try {
-        let obj1 = JSON.parse(aStr1);
-        let obj2 = JSON.parse(aStr2);
+        let obj1 = parseAndUnwrapIfCrashDump(aStr1);
+        let obj2 = parseAndUnwrapIfCrashDump(aStr2);
         gIsDiff = true;
         updateAboutMemoryFromJSONObject(diffJSONObjects(obj1, obj2));
         gIsDiff = false;
@@ -888,7 +907,6 @@ function makeJSONReports(aDReportMap)
   return reports;
 }
 
-
 // Diff two JSON objects holding memory reports.
 function diffJSONObjects(aJson1, aJson2)
 {
diff --git a/toolkit/components/aboutmemory/tests/chrome.ini b/toolkit/components/aboutmemory/tests/chrome.ini
index b236f0e966b..a0f089c7e71 100644
--- a/toolkit/components/aboutmemory/tests/chrome.ini
+++ b/toolkit/components/aboutmemory/tests/chrome.ini
@@ -1,6 +1,9 @@
 [DEFAULT]
 skip-if = buildapp == 'mulet'
 support-files =
+  crash-dump-diff1.json
+  crash-dump-diff2.json
+  crash-dump-good.json
   memory-reports-bad.json
   memory-reports-diff1.json
   memory-reports-diff2.json
diff --git a/toolkit/components/aboutmemory/tests/crash-dump-diff1.json b/toolkit/components/aboutmemory/tests/crash-dump-diff1.json
new file mode 100644
index 00000000000..d41bbcc61ed
--- /dev/null
+++ b/toolkit/components/aboutmemory/tests/crash-dump-diff1.json
@@ -0,0 +1,11 @@
+{
+  "foo": 1,
+  "blah": 2,
+  "memory_report": {
+    "version": 1,
+    "hasMozMallocUsableSize": true,
+    "reports": [
+      {"process": "Main Process (pid NNN)", "path": "heap-allocated", "kind": 2, "units": 0, "amount": 262144000, "description": "Heap allocated."}
+    ]
+  }
+}
diff --git a/toolkit/components/aboutmemory/tests/crash-dump-diff2.json b/toolkit/components/aboutmemory/tests/crash-dump-diff2.json
new file mode 100644
index 00000000000..8f9451f625a
--- /dev/null
+++ b/toolkit/components/aboutmemory/tests/crash-dump-diff2.json
@@ -0,0 +1,11 @@
+{
+  "foo": 3,
+  "blah": 4,
+  "memory_report": {
+    "version": 1,
+    "hasMozMallocUsableSize": true,
+    "reports": [
+      {"process": "Main Process (pid NNN)", "path": "heap-allocated", "kind": 2, "units": 0, "amount": 262144001, "description": "Heap allocated."}
+    ]
+  }
+}
diff --git a/toolkit/components/aboutmemory/tests/crash-dump-good.json b/toolkit/components/aboutmemory/tests/crash-dump-good.json
new file mode 100644
index 00000000000..6bee54d5919
--- /dev/null
+++ b/toolkit/components/aboutmemory/tests/crash-dump-good.json
@@ -0,0 +1,14 @@
+{
+  "foo": 1,
+  "blah": 2,
+  "memory_report": {
+    "version": 1,
+    "hasMozMallocUsableSize": true,
+    "reports": [
+      {"process": "Main Process (pid NNN)", "path": "heap-allocated", "kind": 2, "units": 0, "amount": 262144000, "description": "Heap allocated."},
+      {"process": "Main Process (pid NNN)", "path": "other/b", "kind": 2, "units": 0, "amount": 104857, "description": "Other b."},
+      {"process": "Main Process (pid NNN)", "path": "other/a", "kind": 2, "units": 0, "amount": 209715, "description": "Other a."},
+      {"process": "Main Process (pid NNN)", "path": "explicit/a/b", "kind": 1, "units": 0, "amount": 52428800, "description": "A b."}
+    ]
+  }
+}
diff --git a/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul b/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
index 523079811d0..eb500f06326 100644
--- a/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
+++ b/toolkit/components/aboutmemory/tests/test_aboutmemory3.xul
@@ -424,23 +424,41 @@ Other Measurements\n\
       └────2 B (-9.09%) ── (fake child) [!]\n\
 \n\
 End of P8\n\
+";
+
+  // This is the output for the crash reports diff.
+  let expectedDiff2 =
+"\
+Main Process (pid NNN)\n\
+Other Measurements\n\
+\n\
+1 B ── heap-allocated\n\
+\n\
+End of Main Process (pid NNN)\n\
 ";
 
   let frames = [
-    // This loads a pre-existing file that is valid.
+    // This loads a pre-existing memory reports file that is valid.
     { filename: "memory-reports-good.json", expected: expectedGood, dumpFirst: false, verbose: true },
 
-    // This dumps to a file and then reads it back in.
+    // This loads a pre-existing crash dump file that is valid.
+    { filename: "crash-dump-good.json", expected: expectedGood2, dumpFirst: false, verbose: true },
+
+    // This dumps to a file and then reads it back in. (The result is the same
+    // as the previous test.)
     { filename: "memory-reports-dumped.json.gz", expected: expectedGood2, dumpFirst: true, verbose: true },
 
     // This loads a pre-existing file that is invalid.
     { filename: "memory-reports-bad.json",  expected: expectedBad, dumpFirst: false, verbose: true },
 
-    // This loads a pre-existing diff file.
-    { filename: "memory-reports-diff1.json", filename2: "memory-reports-diff2.json",  expected: expectedDiffNonVerbose, dumpFirst: false, verbose: false },
+    // This diffs two pre-existing memory reports files.
+    { filename: "memory-reports-diff1.json", filename2: "memory-reports-diff2.json", expected: expectedDiffNonVerbose, dumpFirst: false, verbose: false },
 
-    // Ditto
-    { filename: "memory-reports-diff1.json", filename2: "memory-reports-diff2.json",  expected: expectedDiffVerbose, dumpFirst: false, verbose: true }
+    // Ditto.
+    { filename: "memory-reports-diff1.json", filename2: "memory-reports-diff2.json", expected: expectedDiffVerbose, dumpFirst: false, verbose: true },
+
+    // This diffs two pre-existing crash report files.
+    { filename: "crash-dump-diff1.json", filename2: "crash-dump-diff2.json", expected: expectedDiff2, dumpFirst: false, verbose: true }
   ];
 
   SimpleTest.waitForFocus(chain(frames));
diff --git a/toolkit/components/ctypes/ctypes.cpp b/toolkit/components/ctypes/ctypes.cpp
index ba050d61c48..cf7d3de5f64 100644
--- a/toolkit/components/ctypes/ctypes.cpp
+++ b/toolkit/components/ctypes/ctypes.cpp
@@ -24,7 +24,7 @@ namespace mozilla {
 namespace ctypes {
 
 static char*
-UnicodeToNative(JSContext *cx, const jschar *source, size_t slen)
+UnicodeToNative(JSContext *cx, const char16_t *source, size_t slen)
 {
   nsAutoCString native;
   nsDependentString unicode(reinterpret_cast<const char16_t*>(source), slen);
diff --git a/toolkit/components/ctypes/tests/unit/test_jsctypes.js b/toolkit/components/ctypes/tests/unit/test_jsctypes.js
index 80a1168f685..d89fa1ca73a 100644
--- a/toolkit/components/ctypes/tests/unit/test_jsctypes.js
+++ b/toolkit/components/ctypes/tests/unit/test_jsctypes.js
@@ -147,7 +147,7 @@ function run_test()
   run_char_tests(library, ctypes.char, "char", 1, true, [-0x80, 0x7f]);
   run_char_tests(library, ctypes.signed_char, "signed_char", 1, true, [-0x80, 0x7f]);
   run_char_tests(library, ctypes.unsigned_char, "unsigned_char", 1, false, [0, 0xff]);
-  run_jschar_tests(library, ctypes.jschar, "jschar", [0, 0xffff]);
+  run_char16_tests(library, ctypes.char16_t, "char16_t", [0, 0xffff]);
 
   // Test the special types.
   run_StructType_tests();
@@ -1188,7 +1188,7 @@ function run_char_tests(library, t, name, size, signed, limits) {
         18 ] ]);
 }
 
-function run_jschar_tests(library, t, name, limits) {
+function run_char16_tests(library, t, name, limits) {
   run_basic_class_tests(t);
 
   do_check_eq(t.name, name);
@@ -2133,7 +2133,7 @@ function run_type_toString_tests() {
   do_check_eq(c.bool.toString(),                "type bool");
   do_check_eq(c.void_t.toString(),              "type void");
   do_check_eq(c.voidptr_t.toString(),           "type void*");
-  do_check_eq(c.jschar.toString(),              "type jschar");
+  do_check_eq(c.char16_t.toString(),            "type char16_t");
 
   var simplestruct = c.StructType("simplestruct", [{"smitty":c.voidptr_t}]);
   do_check_eq(simplestruct.toString(),          "type simplestruct");
@@ -2252,13 +2252,13 @@ function run_string_tests(library) {
   for (let i = 0; i < vals.length; i++)
     do_check_throws(function() { test_ansi_len(vals[i]); }, TypeError);
 
-  let test_wide_len = library.declare("test_wide_len", ctypes.default_abi, ctypes.int32_t, ctypes.jschar.ptr);
+  let test_wide_len = library.declare("test_wide_len", ctypes.default_abi, ctypes.int32_t, ctypes.char16_t.ptr);
   do_check_eq(test_wide_len("hello world"), 11);
 
   let test_ansi_ret = library.declare("test_ansi_ret", ctypes.default_abi, ctypes.char.ptr);
   do_check_eq(test_ansi_ret().readString(), "success");
 
-  let test_wide_ret = library.declare("test_wide_ret", ctypes.default_abi, ctypes.jschar.ptr);
+  let test_wide_ret = library.declare("test_wide_ret", ctypes.default_abi, ctypes.char16_t.ptr);
   do_check_eq(test_wide_ret().readString(), "success");
 
   let test_ansi_echo = library.declare("test_ansi_echo", ctypes.default_abi, ctypes.char.ptr, ctypes.char.ptr);
diff --git a/toolkit/components/filewatcher/NativeFileWatcherWin.cpp b/toolkit/components/filewatcher/NativeFileWatcherWin.cpp
index b33b35d0abd..07c6f2f6ee5 100644
--- a/toolkit/components/filewatcher/NativeFileWatcherWin.cpp
+++ b/toolkit/components/filewatcher/NativeFileWatcherWin.cpp
@@ -262,7 +262,7 @@ WatchedPathsInfoHashtableTraverser(nsVoidPtrHashKey::KeyType key,
                                    void* userArg)
 {
   FILEWATCHERLOG("NativeFileWatcherIOTask::DeactivateRunnableMethod - "
-                 "%S is still being watched.", watchedResource->mPath);
+                 "%S is still being watched.", watchedResource->mPath.get());
 
   return PL_DHASH_NEXT;
 }
@@ -505,7 +505,7 @@ NativeFileWatcherIOTask::RunInternal()
       // Log that we also failed to dispatch the error callbacks.
       FILEWATCHERLOG(
         "NativeFileWatcherIOTask::Run - Failed to watch %s and"
-        " to dispatch the related error callbacks", changedRes->mPath);
+        " to dispatch the related error callbacks", changedRes->mPath.get());
       return rv;
     }
   }
@@ -616,7 +616,7 @@ NativeFileWatcherIOTask::AddPathRunnableMethod(
 
     FILEWATCHERLOG(
       "NativeFileWatcherIOTask::AddPathRunnableMethod - CreateFileW failed (error %x) for %S.",
-      dwError, wrappedParameters->mPath);
+      dwError, wrappedParameters->mPath.get());
 
     rv = ReportError(wrappedParameters->mErrorCallbackHandle, rv, dwError);
     if (NS_FAILED(rv)) {
@@ -642,7 +642,7 @@ NativeFileWatcherIOTask::AddPathRunnableMethod(
 
     FILEWATCHERLOG("NativeFileWatcherIOTask::AddPathRunnableMethod"
                    " - CreateIoCompletionPort failed (error %x) for %S.",
-                   dwError, wrappedParameters->mPath);
+                   dwError, wrappedParameters->mPath.get());
 
     // This could fail because passed parameters could be invalid |HANDLE|s
     // i.e. mIOCompletionPort was unexpectedly closed or failed.
@@ -705,7 +705,7 @@ NativeFileWatcherIOTask::AddPathRunnableMethod(
   // We failed to dispatch the error callbacks as well.
   FILEWATCHERLOG(
     "NativeFileWatcherIOTask::AddPathRunnableMethod - Failed to watch %s and"
-    " to dispatch the related error callbacks", resourceDesc->mPath);
+    " to dispatch the related error callbacks", resourceDesc->mPath.get());
 
   return rv;
 }
@@ -777,7 +777,7 @@ NativeFileWatcherIOTask::RemovePathRunnableMethod(
     FILEWATCHERLOG(
       "NativeFileWatcherIOTask::RemovePathRunnableMethod - Unable to remove the change "
       "callback from the change callback hash map for %S.",
-      wrappedParameters->mPath);
+      wrappedParameters->mPath.get());
     MOZ_CRASH();
   }
 
@@ -792,7 +792,7 @@ NativeFileWatcherIOTask::RemovePathRunnableMethod(
     FILEWATCHERLOG(
       "NativeFileWatcherIOTask::RemovePathRunnableMethod - Unable to remove the error "
       "callback from the error callback hash map for %S.",
-      wrappedParameters->mPath);
+      wrappedParameters->mPath.get());
     MOZ_CRASH();
   }
 
@@ -1080,7 +1080,7 @@ NativeFileWatcherIOTask::AddDirectoryToWatchList(
     FILEWATCHERLOG(
       "NativeFileWatcherIOTask::AddDirectoryToWatchList "
       " - ReadDirectoryChangesW failed (error %x) for %S.",
-      dwError, aDirectoryDescriptor->mPath);
+      dwError, aDirectoryDescriptor->mPath.get());
 
     nsresult rv =
       DispatchErrorCallbacks(aDirectoryDescriptor, NS_ERROR_FAILURE, dwError);
@@ -1207,15 +1207,15 @@ NativeFileWatcherIOTask::MakeResourcePath(
   if (NS_FAILED(rv)) {
     FILEWATCHERLOG(
       "NativeFileWatcherIOTask::MakeResourcePath - Failed to init nsILocalFile with %S (%x).",
-      changedDescriptor->mPath, rv);
+      changedDescriptor->mPath.get(), rv);
     return rv;
   }
 
   rv = localPath->AppendRelativePath(resourceName);
   if (NS_FAILED(rv)) {
     FILEWATCHERLOG(
-      "NativeFileWatcherIOTask::MakeResourcePath - Failed to append %S to %S (%x).",
-      resourceName, changedDescriptor->mPath, rv);
+      "NativeFileWatcherIOTask::MakeResourcePath - Failed to append to %S (%x).",
+      changedDescriptor->mPath.get(), rv);
     return rv;
   }
 
diff --git a/toolkit/components/finalizationwitness/FinalizationWitnessService.cpp b/toolkit/components/finalizationwitness/FinalizationWitnessService.cpp
index 225364b3ede..2c234b142b9 100644
--- a/toolkit/components/finalizationwitness/FinalizationWitnessService.cpp
+++ b/toolkit/components/finalizationwitness/FinalizationWitnessService.cpp
@@ -35,7 +35,7 @@ class FinalizationEvent MOZ_FINAL: public nsRunnable
 {
 public:
   FinalizationEvent(const char* aTopic,
-                  const jschar* aValue)
+                  const char16_t* aValue)
     : mTopic(aTopic)
     , mValue(aValue)
   { }
diff --git a/toolkit/components/maintenanceservice/workmonitor.cpp b/toolkit/components/maintenanceservice/workmonitor.cpp
index 50e4beddb11..dd74aa4047d 100644
--- a/toolkit/components/maintenanceservice/workmonitor.cpp
+++ b/toolkit/components/maintenanceservice/workmonitor.cpp
@@ -30,8 +30,6 @@
 static const int TIME_TO_WAIT_ON_UPDATER = 15 * 60 * 1000;
 char16_t* MakeCommandLine(int argc, char16_t **argv);
 BOOL WriteStatusFailure(LPCWSTR updateDirPath, int errorCode);
-BOOL PathGetSiblingFilePath(LPWSTR destinationBuffer,  LPCWSTR siblingFilePath, 
-                            LPCWSTR newFileName);
 
 /* 
  * Read the update.status file and sets isApplying to true if
diff --git a/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm b/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm
index f2f91fe8acd..1faa07b9f56 100644
--- a/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm
+++ b/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm
@@ -626,17 +626,17 @@ Type.char =
 /**
  * A C wide char (two bytes)
  */
-Type.jschar =
-  new Type("jschar",
-           ctypes.jschar);
+Type.char16_t =
+  new Type("char16_t",
+           ctypes.char16_t);
 
  /**
   * Base string types.
   */
 Type.cstring = Type.char.in_ptr.withName("[in] C string");
-Type.wstring = Type.jschar.in_ptr.withName("[in] wide string");
+Type.wstring = Type.char16_t.in_ptr.withName("[in] wide string");
 Type.out_cstring = Type.char.out_ptr.withName("[out] C string");
-Type.out_wstring = Type.jschar.out_ptr.withName("[out] wide string");
+Type.out_wstring = Type.char16_t.out_ptr.withName("[out] wide string");
 
 /**
  * A C integer (8-bits).
diff --git a/toolkit/components/osfile/modules/osfile_win_allthreads.jsm b/toolkit/components/osfile/modules/osfile_win_allthreads.jsm
index 0493ad00a15..58d3c3e0c38 100644
--- a/toolkit/components/osfile/modules/osfile_win_allthreads.jsm
+++ b/toolkit/components/osfile/modules/osfile_win_allthreads.jsm
@@ -56,7 +56,7 @@ libc.declareLazy(Scope, "FormatMessage",
                  /*source*/ ctypes.voidptr_t,
                  /*msgid*/  ctypes.uint32_t,
                  /*langid*/ ctypes.uint32_t,
-                 /*buf*/    ctypes.jschar.ptr,
+                 /*buf*/    ctypes.char16_t.ptr,
                  /*size*/   ctypes.uint32_t,
                  /*Arguments*/ctypes.voidptr_t);
 
@@ -93,7 +93,7 @@ let OSError = function OSError(operation = "unknown operation",
 };
 OSError.prototype = Object.create(SharedAll.OSError.prototype);
 OSError.prototype.toString = function toString() {
-  let buf = new (ctypes.ArrayType(ctypes.jschar, 1024))();
+  let buf = new (ctypes.ArrayType(ctypes.char16_t, 1024))();
   let result = Scope.FormatMessage(
     Const.FORMAT_MESSAGE_FROM_SYSTEM |
     Const.FORMAT_MESSAGE_IGNORE_INSERTS,
diff --git a/toolkit/components/osfile/modules/osfile_win_back.jsm b/toolkit/components/osfile/modules/osfile_win_back.jsm
index 9b7bf22a68c..e368dda68f3 100644
--- a/toolkit/components/osfile/modules/osfile_win_back.jsm
+++ b/toolkit/components/osfile/modules/osfile_win_back.jsm
@@ -166,8 +166,8 @@
                     { nFileSizeLow:     Type.DWORD.implementation },
                     { dwReserved0:      Type.DWORD.implementation },
                     { dwReserved1:      Type.DWORD.implementation },
-                    { cFileName:        ctypes.ArrayType(ctypes.jschar, Const.MAX_PATH) },
-                    { cAlternateFileName: ctypes.ArrayType(ctypes.jschar, 14) }
+                    { cFileName:        ctypes.ArrayType(ctypes.char16_t, Const.MAX_PATH) },
+                    { cAlternateFileName: ctypes.ArrayType(ctypes.char16_t, 14) }
                       ]));
 
        Type.FILE_INFORMATION =
@@ -237,7 +237,7 @@
        libc.declareLazyFFI(SysFile, "CreateDirectory",
          "CreateDirectoryW", ctypes.winapi_abi,
                     /*return*/ Type.zero_or_nothing,
-                    /*name*/   Type.jschar.in_ptr,
+                    /*name*/   Type.char16_t.in_ptr,
                     /*security*/Type.SECURITY_ATTRIBUTES.in_ptr);
 
        libc.declareLazyFFI(SysFile, "CreateFile",
diff --git a/toolkit/components/osfile/modules/osfile_win_front.jsm b/toolkit/components/osfile/modules/osfile_win_front.jsm
index 3917c56af4b..f66dd1ab14b 100644
--- a/toolkit/components/osfile/modules/osfile_win_front.jsm
+++ b/toolkit/components/osfile/modules/osfile_win_front.jsm
@@ -1070,7 +1070,7 @@
        //
        let buffer_size = 4096;
        while (true) {
-         let array = new (ctypes.ArrayType(ctypes.jschar, buffer_size))();
+         let array = new (ctypes.ArrayType(ctypes.char16_t, buffer_size))();
          let expected_size = throw_on_zero("getCurrentDirectory",
            WinFile.GetCurrentDirectory(buffer_size, array)
          );
diff --git a/toolkit/components/osfile/tests/mochi/worker_test_osfile_win.js b/toolkit/components/osfile/tests/mochi/worker_test_osfile_win.js
index 0efa64704b1..f41fdecfeac 100644
--- a/toolkit/components/osfile/tests/mochi/worker_test_osfile_win.js
+++ b/toolkit/components/osfile/tests/mochi/worker_test_osfile_win.js
@@ -73,7 +73,7 @@ function test_CreateFile()
 
 function test_GetCurrentDirectory()
 {
-  let array = new (ctypes.ArrayType(ctypes.jschar, 4096))();
+  let array = new (ctypes.ArrayType(ctypes.char16_t, 4096))();
   let result = OS.Win.File.GetCurrentDirectory(4096, array);
   ok(result < array.length, "test_GetCurrentDirectory: length sufficient");
   ok(result > 0, "test_GetCurrentDirectory: length != 0");
diff --git a/toolkit/components/passwordmgr/LoginManagerContent.jsm b/toolkit/components/passwordmgr/LoginManagerContent.jsm
index a2db10dfab6..c06731cb50e 100644
--- a/toolkit/components/passwordmgr/LoginManagerContent.jsm
+++ b/toolkit/components/passwordmgr/LoginManagerContent.jsm
@@ -541,13 +541,17 @@ var LoginManagerContent = {
                                   value: oldPasswordField.value } :
                                 null;
 
+        // Make sure to pass the opener's top in case it was in a frame.
+        let opener = win.opener ? win.opener.top : null;
+
         let messageManager = messageManagerFromWindow(win);
         messageManager.sendAsyncMessage("RemoteLogins:onFormSubmit",
                                         { hostname: hostname,
                                           formSubmitURL: formSubmitURL,
                                           usernameField: mockUsername,
                                           newPasswordField: mockPassword,
-                                          oldPasswordField: mockOldPassword });
+                                          oldPasswordField: mockOldPassword },
+                                        { openerWin: opener });
     },
 
     /*
diff --git a/toolkit/components/passwordmgr/LoginManagerParent.jsm b/toolkit/components/passwordmgr/LoginManagerParent.jsm
index 5aeb3020fea..4721c25450c 100644
--- a/toolkit/components/passwordmgr/LoginManagerParent.jsm
+++ b/toolkit/components/passwordmgr/LoginManagerParent.jsm
@@ -69,7 +69,6 @@ var LoginManagerParent = {
 
     receiveMessage: function (msg) {
         let data = msg.data;
-
         switch (msg.name) {
             case "RemoteLogins:findLogins": {
                 // TODO Verify msg.target's principals against the formOrigin?
@@ -88,6 +87,7 @@ var LoginManagerParent = {
                                   data.usernameField,
                                   data.newPasswordField,
                                   data.oldPasswordField,
+                                  msg.objects.openerWin,
                                   msg.target);
                 break;
             }
@@ -203,7 +203,7 @@ var LoginManagerParent = {
 
     onFormSubmit: function(hostname, formSubmitURL,
                            usernameField, newPasswordField,
-                           oldPasswordField,
+                           oldPasswordField, opener,
                            target) {
         function getPrompter() {
             var prompterSvc = Cc["@mozilla.org/login-manager/prompter;1"].
@@ -216,6 +216,8 @@ var LoginManagerParent = {
             prompterSvc.init(target.isRemoteBrowser ?
                                 target.ownerDocument.defaultView :
                                 target.contentWindow);
+            if (target.isRemoteBrowser)
+                prompterSvc.setE10sData({ browser: target, opener: opener });
             return prompterSvc;
         }
 
diff --git a/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl b/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl
index 1410fbbf62e..261791fec59 100644
--- a/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl
+++ b/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl
@@ -8,8 +8,7 @@
 interface nsILoginInfo;
 interface nsIDOMWindow;
 
-[scriptable, uuid(68b3cb59-51b8-4c57-bd7f-b2ce955a593d)]
-
+[scriptable, uuid(88b75787-a78c-43aa-bfe8-52c3248b8dfd)]
 interface nsILoginManagerPrompter : nsISupports {
     /**
      * Initialize the prompter. Must be called before using other interfaces.
@@ -22,6 +21,15 @@ interface nsILoginManagerPrompter : nsISupports {
      */
     void init(in nsIDOMWindow aWindow);
 
+    /**
+     * If the caller knows which browser this prompter is being created for,
+     * they can call this function to avoid having to calculate it from the
+     * window passed to init.
+     *
+     * @param aBrowser the <browser> to use for this prompter.
+     */
+    void setE10sData(in jsval aData);
+
     /**
      * Ask the user if they want to save a login (Yes, Never, Not Now)
      *
diff --git a/toolkit/components/passwordmgr/nsLoginManagerPrompter.js b/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
index 42b8c823a16..fff29fcaa70 100644
--- a/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
+++ b/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
@@ -1,3 +1,4 @@
+/* vim: set ts=4 sts=4 sw=4 et tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -199,6 +200,8 @@ LoginManagerPrompter.prototype = {
 
     _factory       : null,
     _window        : null,
+    _browser       : null,
+    _opener        : null,
     _debug         : false, // mirrors signon.debug
 
     __pwmgr : null, // Password Manager service
@@ -702,12 +705,21 @@ LoginManagerPrompter.prototype = {
     init : function (aWindow, aFactory) {
         this._window = aWindow;
         this._factory = aFactory || null;
+        this._browser = null;
+        this._opener = null;
 
         var prefBranch = Services.prefs.getBranch("signon.");
         this._debug = prefBranch.getBoolPref("debug");
         this.log("===== initialized =====");
     },
 
+    setE10sData : function (aData) {
+        if (!(this._window instanceof Ci.nsIDOMChromeWindow))
+            throw new Error("Unexpected call");
+        this._browser = aData.browser;
+        this._opener = aData.opener;
+    },
+
 
     /*
      * promptToSavePassword
@@ -823,10 +835,7 @@ LoginManagerPrompter.prototype = {
                 }
             ];
 
-            var notifyWin = this._getNotifyWindow();
-            var chromeWin = this._getChromeWindow(notifyWin).wrappedJSObject;
-            var browser = chromeWin.gBrowser.
-                                    getBrowserForDocument(notifyWin.top.document);
+            var { browser } = this._getNotifyWindow();
 
             aNotifyObj.show(browser, "password-save", notificationText,
                             "password-notification-icon", mainAction,
@@ -1021,10 +1030,7 @@ LoginManagerPrompter.prototype = {
                 }
             };
 
-            var notifyWin = this._getNotifyWindow();
-            var chromeWin = this._getChromeWindow(notifyWin).wrappedJSObject;
-            var browser = chromeWin.gBrowser.
-                                    getBrowserForDocument(notifyWin.top.document);
+            var { browser } = this._getNotifyWindow();
 
             aNotifyObj.show(browser, "password-change", notificationText,
                             "password-notification-icon", mainAction,
@@ -1165,6 +1171,9 @@ LoginManagerPrompter.prototype = {
      * Given a content DOM window, returns the chrome window it's in.
      */
     _getChromeWindow: function (aWindow) {
+        // In e10s, aWindow may already be a chrome window.
+        if (aWindow instanceof Ci.nsIDOMChromeWindow)
+            return aWindow;
         var chromeWin = aWindow.QueryInterface(Ci.nsIInterfaceRequestor)
                                .getInterface(Ci.nsIWebNavigation)
                                .QueryInterface(Ci.nsIDocShell)
@@ -1181,33 +1190,61 @@ LoginManagerPrompter.prototype = {
         try {
             // Get topmost window, in case we're in a frame.
             var notifyWin = this._window.top;
+            var isE10s = (notifyWin instanceof Ci.nsIDOMChromeWindow);
+            var useOpener = false;
 
-            // Some sites pop up a temporary login window, when disappears
+            // Some sites pop up a temporary login window, which disappears
             // upon submission of credentials. We want to put the notification
             // bar in the opener window if this seems to be happening.
             if (notifyWin.opener) {
                 var chromeDoc = this._getChromeWindow(notifyWin).
                                      document.documentElement;
-                var webnav = notifyWin.
-                             QueryInterface(Ci.nsIInterfaceRequestor).
-                             getInterface(Ci.nsIWebNavigation);
+
+                var hasHistory;
+                if (isE10s) {
+                    if (!this._browser)
+                        throw new Error("Expected a browser in e10s");
+                    hasHistory = this._browser.canGoBack;
+                } else {
+                    var webnav = notifyWin.
+                                 QueryInterface(Ci.nsIInterfaceRequestor).
+                                 getInterface(Ci.nsIWebNavigation);
+                    hasHistory = webnav.sessionHistory.count > 1;
+                }
 
                 // Check to see if the current window was opened with chrome
                 // disabled, and if so use the opener window. But if the window
                 // has been used to visit other pages (ie, has a history),
                 // assume it'll stick around and *don't* use the opener.
-                if (chromeDoc.getAttribute("chromehidden") &&
-                    webnav.sessionHistory.count == 1) {
+                if (chromeDoc.getAttribute("chromehidden") && !hasHistory) {
                     this.log("Using opener window for notification bar.");
                     notifyWin = notifyWin.opener;
+                    useOpener = true;
                 }
             }
 
-            return notifyWin;
+            let browser;
+            if (useOpener && isE10s) {
+                // In e10s, we have to reconstruct the opener browser from
+                // the CPOW passed in the message (and then passed to us in
+                // setE10sData).
+                // NB: notifyWin is now the chrome window for the opening
+                // window.
+
+                browser = notifyWin.gBrowser.getBrowserForContentWindow(this._opener);
+            } else if (isE10s) {
+                browser = this._browser;
+            } else {
+                var chromeWin = this._getChromeWindow(notifyWin).wrappedJSObject;
+                browser = chromeWin.gBrowser
+                                   .getBrowserForDocument(notifyWin.top.document);
+            }
+
+            return { notifyWin: notifyWin, browser: browser };
 
         } catch (e) {
             // If any errors happen, just assume no notification box.
-            this.log("Unable to get notify window");
+            this.log("Unable to get notify window: " + e.fileName + ":" + e.lineNumber + ": " + e.message);
             return null;
         }
     },
@@ -1223,7 +1260,7 @@ LoginManagerPrompter.prototype = {
         let popupNote = null;
 
         try {
-            let notifyWin = this._getNotifyWindow();
+            let { notifyWin } = this._getNotifyWindow();
 
             // Get the chrome window for the content window we're using.
             // .wrappedJSObject needed here -- see bug 422974 comment 5.
@@ -1248,7 +1285,7 @@ LoginManagerPrompter.prototype = {
         let notifyBox = null;
 
         try {
-            let notifyWin = this._getNotifyWindow();
+            let { notifyWin } = this._getNotifyWindow();
 
             // Get the chrome window for the content window we're using.
             // .wrappedJSObject needed here -- see bug 422974 comment 5.
diff --git a/toolkit/components/places/History.cpp b/toolkit/components/places/History.cpp
index f0aa0ebbee0..ee033310e75 100644
--- a/toolkit/components/places/History.cpp
+++ b/toolkit/components/places/History.cpp
@@ -185,33 +185,69 @@ struct RemoveVisitsFilter {
 
 class PlaceHashKey : public nsCStringHashKey
 {
-  public:
-    explicit PlaceHashKey(const nsACString& aSpec)
+public:
+  explicit PlaceHashKey(const nsACString& aSpec)
     : nsCStringHashKey(&aSpec)
-    , visitCount(-1)
-    , bookmarked(-1)
-    {
-    }
+    , mVisitCount(0)
+    , mBookmarked(false)
+#ifdef DEBUG
+    , mIsInitialized(false)
+#endif
+  {
+  }
 
-    explicit PlaceHashKey(const nsACString* aSpec)
+  explicit PlaceHashKey(const nsACString* aSpec)
     : nsCStringHashKey(aSpec)
-    , visitCount(-1)
-    , bookmarked(-1)
-    {
-    }
+    , mVisitCount(0)
+    , mBookmarked(false)
+#ifdef DEBUG
+    , mIsInitialized(false)
+#endif
+  {
+  }
 
-    PlaceHashKey(const PlaceHashKey& aOther)
+  PlaceHashKey(const PlaceHashKey& aOther)
     : nsCStringHashKey(&aOther.GetKey())
-    {
-      MOZ_ASSERT(false, "Do not call me!");
-    }
+  {
+    MOZ_ASSERT(false, "Do not call me!");
+  }
 
-    // Visit count for this place.
-    int32_t visitCount;
-    // Whether this place is bookmarked.
-    int32_t bookmarked;
-    // Array of VisitData objects.
-    nsTArray<VisitData> visits;
+  void SetProperties(uint32_t aVisitCount, bool aBookmarked)
+  {
+    mVisitCount = aVisitCount;
+    mBookmarked = aBookmarked;
+#ifdef DEBUG
+    mIsInitialized = true;
+#endif
+  }
+
+  uint32_t VisitCount() const
+  {
+#ifdef DEBUG
+    MOZ_ASSERT(mIsInitialized, "PlaceHashKey::mVisitCount not set");
+#endif
+    return mVisitCount;
+  }
+
+  bool IsBookmarked() const
+  {
+#ifdef DEBUG
+    MOZ_ASSERT(mIsInitialized, "PlaceHashKey::mBookmarked not set");
+#endif
+    return mBookmarked;
+  }
+
+  // Array of VisitData objects.
+  nsTArray<VisitData> mVisits;
+private:
+  // Visit count for this place.
+  uint32_t mVisitCount;
+  // Whether this place is bookmarked.
+  bool mBookmarked;
+#ifdef DEBUG
+  // Whether previous attributes are set.
+  bool mIsInitialized;
+#endif
 };
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -1568,9 +1604,8 @@ static PLDHashOperator TransferHashEntries(PlaceHashKey* aEntry,
   nsTHashtable<PlaceHashKey>* hash =
     static_cast<nsTHashtable<PlaceHashKey> *>(aHash);
   PlaceHashKey* copy = hash->PutEntry(aEntry->GetKey());
-  copy->visitCount = aEntry->visitCount;
-  copy->bookmarked = aEntry->bookmarked;
-  aEntry->visits.SwapElements(copy->visits);
+  copy->SetProperties(aEntry->VisitCount(), aEntry->IsBookmarked());
+  aEntry->mVisits.SwapElements(copy->mVisits);
   return PL_DHASH_NEXT;
 }
 
@@ -1581,13 +1616,12 @@ static PLDHashOperator NotifyVisitRemoval(PlaceHashKey* aEntry,
                                           void* aHistory)
 {
   nsNavHistory* history = static_cast<nsNavHistory *>(aHistory);
-  const nsTArray<VisitData>& visits = aEntry->visits;
+  const nsTArray<VisitData>& visits = aEntry->mVisits;
   nsCOMPtr<nsIURI> uri;
   (void)NS_NewURI(getter_AddRefs(uri), visits[0].spec);
-  // XXX visitCount should really just be unsigned (bug 1049812)
   bool removingPage =
-    visits.Length() == static_cast<size_t>(aEntry->visitCount) &&
-    !aEntry->bookmarked;
+    visits.Length() == aEntry->VisitCount() &&
+    !aEntry->IsBookmarked();
   // FindRemovableVisits only sets the transition type on the VisitData objects
   // it collects if the visits were filtered by transition type.
   // RemoveVisitsFilter currently only supports filtering by transition type, so
@@ -1662,11 +1696,10 @@ private:
 static PLDHashOperator ListToBeRemovedPlaceIds(PlaceHashKey* aEntry,
                                                void* aIdsList)
 {
-  const nsTArray<VisitData>& visits = aEntry->visits;
+  const nsTArray<VisitData>& visits = aEntry->mVisits;
   // Only orphan ids should be listed.
-  // XXX visitCount should really just be unsigned (bug 1049812)
-  if (visits.Length() == static_cast<size_t>(aEntry->visitCount) &&
-      !aEntry->bookmarked) {
+  if (visits.Length() == aEntry->VisitCount() &&
+      !aEntry->IsBookmarked()) {
     nsCString* list = static_cast<nsCString*>(aIdsList);
     if (!list->IsEmpty())
       list->Append(',');
@@ -1815,9 +1848,8 @@ private:
       if (!entry) {
         entry = aPlaces.PutEntry(visit.spec);
       }
-      entry->visitCount = visitCount;
-      entry->bookmarked = bookmarked;
-      entry->visits.AppendElement(visit);
+      entry->SetProperties(static_cast<uint32_t>(visitCount), static_cast<bool>(bookmarked));
+      entry->mVisits.AppendElement(visit);
     }
     NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/toolkit/components/places/UnifiedComplete.js b/toolkit/components/places/UnifiedComplete.js
index d46ad758305..1fc3b3a63b4 100644
--- a/toolkit/components/places/UnifiedComplete.js
+++ b/toolkit/components/places/UnifiedComplete.js
@@ -67,7 +67,7 @@ const TITLE_SEARCH_ENGINE_SEPARATOR = " \u00B7\u2013\u00B7 ";
 
 // Telemetry probes.
 const TELEMETRY_1ST_RESULT = "PLACES_AUTOCOMPLETE_1ST_RESULT_TIME_MS";
-
+const TELEMETRY_6_FIRST_RESULTS = "PLACES_AUTOCOMPLETE_6_FIRST_RESULTS_TIME_MS";
 // The default frecency value used when inserting search engine results.
 const FRECENCY_SEARCHENGINES_DEFAULT = 1000;
 
@@ -642,6 +642,8 @@ Search.prototype = {
       return;
 
     TelemetryStopwatch.start(TELEMETRY_1ST_RESULT);
+    if (this._searchString)
+      TelemetryStopwatch.start(TELEMETRY_6_FIRST_RESULTS);
 
     // Since we call the synchronous parseSubmissionURL function later, we must
     // wait for the initialization of PlacesSearchAutocompleteProvider first.
@@ -845,6 +847,9 @@ Search.prototype = {
       notifyResults = true;
     }
 
+    if (this._result.matchCount == 6)
+      TelemetryStopwatch.finish(TELEMETRY_6_FIRST_RESULTS);
+
     if (this._result.matchCount == Prefs.maxRichResults || !this.pending) {
       // We have enough results, so stop running our search.
       this.cancel();
@@ -1337,6 +1342,7 @@ UnifiedComplete.prototype = {
    */
   finishSearch: function (notify=false) {
     TelemetryStopwatch.cancel(TELEMETRY_1ST_RESULT);
+    TelemetryStopwatch.cancel(TELEMETRY_6_FIRST_RESULTS);
     // Clear state now to avoid race conditions, see below.
     let search = this._currentSearch;
     delete this._currentSearch;
diff --git a/toolkit/components/prompts/test/prompt_common.js b/toolkit/components/prompts/test/prompt_common.js
index 0618d7341ff..57a1d83dfef 100644
--- a/toolkit/components/prompts/test/prompt_common.js
+++ b/toolkit/components/prompts/test/prompt_common.js
@@ -23,14 +23,14 @@ function startCallbackTimer() {
 
 
 var observer = {
-    QueryInterface : function (iid) {
+    QueryInterface : SpecialPowers.wrapCallback(function (iid) {
         const interfaces = [Ci.nsIObserver,
                             Ci.nsISupports, Ci.nsISupportsWeakReference];
 
         if (!interfaces.some( function(v) { return iid.equals(v) } ))
             throw SpecialPowers.Cr.NS_ERROR_NO_INTERFACE;
         return this;
-    },
+    }),
 
     observe : SpecialPowers.wrapCallback(function (subject, topic, data) {
       try {
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 708dd3711d6..0165e286efa 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -3186,6 +3186,33 @@
     "extended_statistics_ok": true,
     "description": "PLACES: Time for first autocomplete result if > 50ms (ms)"
   },
+  "PLACES_AUTOCOMPLETE_6_FIRST_RESULTS_TIME_MS": {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "low": 50,
+    "high": "1000",
+    "n_buckets": 30,
+    "extended_statistics_ok": true,
+    "description": "PLACES: Time for the 6 first autocomplete results (ms)"
+  },
+  "HISTORY_LASTVISITED_TREE_QUERY_TIME_MS": {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "low": 50,
+    "high": "2000",
+    "n_buckets": 30,
+    "extended_statistics_ok": true,
+    "description": "PLACES: Time to load the sidebar history tree sorted by last visit (ms)"
+  },
+  "PLACES_HISTORY_LIBRARY_SEARCH_TIME_MS": {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "low": 50,
+    "high": "1000",
+    "n_buckets": 30,
+    "extended_statistics_ok": true,
+    "description": "PLACES: Time to search the history library (ms)"
+  },
   "PLACES_AUTOCOMPLETE_URLINLINE_DOMAIN_QUERY_TIME_MS": {
     "expires_in_version": "never",
     "kind": "exponential",
@@ -3294,11 +3321,17 @@
     "description": "Updater: The interval in days between the previous and the current background update check when the check was timer initiated"
   },
   "UPDATER_STATUS_CODES": {
-    "expires_in_version": "never",
+    "expires_in_version": "35",
     "kind": "enumerated",
     "n_values": 50,
     "description": "Updater: the status of the latest update performed"
   },
+  "UPDATER_ALL_STATUS_CODES": {
+    "expires_in_version": "never",
+    "kind": "enumerated",
+    "n_values": 200,
+    "description": "Updater: the status of the latest update performed"
+  },
   "UPDATER_UPDATES_ENABLED": {
     "expires_in_version": "never",
     "kind": "boolean",
diff --git a/toolkit/components/url-classifier/tests/mochitest/test_classifier.html b/toolkit/components/url-classifier/tests/mochitest/test_classifier.html
index 0d8d39be9f8..27b64075205 100644
--- a/toolkit/components/url-classifier/tests/mochitest/test_classifier.html
+++ b/toolkit/components/url-classifier/tests/mochitest/test_classifier.html
@@ -33,14 +33,14 @@ function loadTestFrame() {
 
 function doUpdate(update) {
   var listener = {
-    QueryInterface: function(iid)
+    QueryInterface: SpecialPowers.wrapCallback(function(iid)
     {
       if (iid.equals(Ci.nsISupports) ||
           iid.equals(Ci.nsIUrlClassifierUpdateObserver))
         return this;
 
       throw Cr.NS_ERROR_NO_INTERFACE;
-    },
+    }),
     updateUrlRequested: function(url) { },
     streamFinished: function(status) { },
     updateError: function(errorCode) {
diff --git a/toolkit/components/url-classifier/tests/mochitest/test_classifier_worker.html b/toolkit/components/url-classifier/tests/mochitest/test_classifier_worker.html
index 22fbc01fc74..f88084a83cc 100644
--- a/toolkit/components/url-classifier/tests/mochitest/test_classifier_worker.html
+++ b/toolkit/components/url-classifier/tests/mochitest/test_classifier_worker.html
@@ -28,14 +28,14 @@ var dbService = Cc["@mozilla.org/url-classifier/dbservice;1"]
 
 function doUpdate(update) {
   var listener = {
-    QueryInterface: function(iid)
+    QueryInterface: SpecialPowers.wrapCallback(function(iid)
     {
       if (iid.equals(Ci.nsISupports) ||
           iid.equals(Ci.nsIUrlClassifierUpdateObserver))
         return this;
 
       throw Cr.NS_ERROR_NO_INTERFACE;
-    },
+    }),
     updateUrlRequested: function(url) { },
     streamFinished: function(status) { },
     updateError: function(errorCode) {
diff --git a/toolkit/content/tests/browser/browser_findbar.js b/toolkit/content/tests/browser/browser_findbar.js
index c1b8548232f..8e21408be55 100644
--- a/toolkit/content/tests/browser/browser_findbar.js
+++ b/toolkit/content/tests/browser/browser_findbar.js
@@ -1,51 +1,65 @@
 XPCOMUtils.defineLazyModuleGetter(this, "Promise",
   "resource://gre/modules/Promise.jsm");
-XPCOMUtils.defineLazyModuleGetter(this, "Task",
-  "resource://gre/modules/Task.jsm");
 Components.utils.import("resource://gre/modules/Timer.jsm", this);
 
-let gTabs = [];
+add_task(function* test_not_found() {
+  info("Check correct 'Phrase not found' on new tab");
 
-registerCleanupFunction(function() {
-  for (let tab of gTabs) {
-    if (!tab)
-      continue;
-    gBrowser.removeTab(tab);
-  }
+  let tab = yield promiseTestPageLoad();
+
+  // Search for the first word.
+  yield promiseFindFinished("--- THIS SHOULD NEVER MATCH ---", false);
+  let findbar = gBrowser.getFindBar();
+  is(findbar._findStatusDesc.textContent, findbar._notFoundStr,
+     "Findbar status text should be 'Phrase not found'");
+
+  gBrowser.removeTab(tab);
 });
 
-function test() {
-  waitForExplicitFinish();
+add_task(function* test_found() {
+  let tab = yield promiseTestPageLoad();
 
-  Task.spawn(function() {
-    info("Check correct 'Phrase not found' on new tab");
+  // Search for a string that WILL be found, with 'Highlight All' on
+  yield promiseFindFinished("S", true);
+  ok(!gBrowser.getFindBar()._findStatusDesc.textContent,
+     "Findbar status should be empty");
 
-    // Create a tab to run the test.
-    yield promiseTestPageLoad();
+  gBrowser.removeTab(tab);
+});
 
-    // Search for the first word.
-    yield promiseFindFinished("--- THIS SHOULD NEVER MATCH ---", false);
-    let findbar = gBrowser.getFindBar();
-    is(findbar._findStatusDesc.textContent, findbar._notFoundStr,
-       "Findbar status text should be 'Phrase not found'");
+// Setting first findbar to case-sensitive mode should not affect
+// new tab find bar.
+add_task(function* test_tabwise_case_sensitive() {
+  let tab1 = yield promiseTestPageLoad();
+  let findbar1 = gBrowser.getFindBar();
 
-    // Create second tab.
-    yield promiseTestPageLoad();
+  let tab2 = yield promiseTestPageLoad();
+  let findbar2 = gBrowser.getFindBar();
 
-    // Search for a string that WILL be found, with 'Highlight All' on
-    yield promiseFindFinished("s", true);
-    ok(!gBrowser.getFindBar()._findStatusDesc.textContent,
-       "Findbar status should be empty");
+  // Toggle case sensitivity for first findbar
+  findbar1.getElement("find-case-sensitive").click();
 
-    finish();
-  });
-}
+  gBrowser.selectedTab = tab1;
+
+  // Not found for first tab.
+  yield promiseFindFinished("S", true);
+  is(findbar1._findStatusDesc.textContent, findbar1._notFoundStr,
+     "Findbar status text should be 'Phrase not found'");
+
+  gBrowser.selectedTab = tab2;
+
+  // But it didn't affect the second findbar.
+  yield promiseFindFinished("S", true);
+  ok(!findbar2._findStatusDesc.textContent, "Findbar status should be empty");
+
+  gBrowser.removeTab(tab1);
+  gBrowser.removeTab(tab2);
+});
 
 function promiseTestPageLoad() {
   let deferred = Promise.defer();
 
   let tab = gBrowser.selectedTab = gBrowser.addTab("data:text/html;charset=utf-8,The letter s.");
-  gTabs.push(tab);
   let browser = gBrowser.selectedBrowser;
   browser.addEventListener("load", function listener() {
     if (browser.currentURI.spec == "about:blank")
@@ -53,7 +67,7 @@ function promiseTestPageLoad() {
     info("Page loaded: " + browser.currentURI.spec);
     browser.removeEventListener("load", listener, true);
 
-    deferred.resolve();
+    deferred.resolve(tab);
   }, true);
 
   return deferred.promise;
diff --git a/toolkit/content/widgets/findbar.xml b/toolkit/content/widgets/findbar.xml
index 3f09ffd992c..a92db7398de 100644
--- a/toolkit/content/widgets/findbar.xml
+++ b/toolkit/content/widgets/findbar.xml
@@ -187,7 +187,7 @@
                          label="&caseSensitive.label;"
                          accesskey="&caseSensitive.accesskey;"
                          tooltiptext="&caseSensitive.tooltiptext;"
-                         oncommand="_setCaseSensitivity(this.checked);"
+                         oncommand="_setCaseSensitivity(this.checked ? 1 : 0);"
                          type="checkbox"
                          xbl:inherits="accesskey=matchcaseaccesskey"/>
       <xul:label anonid="match-case-status" class="findbar-find-fast"/>
@@ -305,10 +305,7 @@
               this._self._typeAheadLinksOnly = prefsvc.getBoolPref(aPrefName);
               break;
             case "accessibility.typeaheadfind.casesensitive":
-              this._self._typeAheadCaseSensitive = prefsvc.getIntPref(aPrefName);
-              this._self._updateCaseSensitivity();
-              if (this._self.getElement("highlight").checked)
-                this._self._setHighlightTimeout();
+              this._self._setCaseSensitivity(prefsvc.getIntPref(aPrefName));
               break;
           }
         }
@@ -546,19 +543,19 @@
 
       <!--
         - Sets the findbar case-sensitivity mode
-        - @param aCaseSensitive (boolean)
-        -        Whether or not case-sensitivity should be turned on.
+        - @param aCaseSensitivity (int)
+        -   0 - case insensitive
+        -   1 - case sensitive
+        -   2 - auto = case sensitive iff match string contains upper case letters
+        -   @see _shouldBeCaseSensitive
         -->
       <method name="_setCaseSensitivity">
-        <parameter name="aCaseSensitive"/>
+        <parameter name="aCaseSensitivity"/>
         <body><![CDATA[
-          let prefsvc =
-            Components.classes["@mozilla.org/preferences-service;1"]
-                      .getService(Components.interfaces.nsIPrefBranch);
-
-          // Just set the pref; our observer will change the find bar behavior
-          prefsvc.setIntPref("accessibility.typeaheadfind.casesensitive",
-                             aCaseSensitive ? 1 : 0);
+          this._typeAheadCaseSensitive = aCaseSensitivity;
+          this._updateCaseSensitivity();
+          if (this.getElement("highlight").checked)
+            this._setHighlightTimeout();
 
           this._dispatchFindEvent("casesensitivitychange");
         ]]></body>
diff --git a/toolkit/crashreporter/CrashSubmit.jsm b/toolkit/crashreporter/CrashSubmit.jsm
index 2742559f241..bab05a43d52 100644
--- a/toolkit/crashreporter/CrashSubmit.jsm
+++ b/toolkit/crashreporter/CrashSubmit.jsm
@@ -254,19 +254,13 @@ Submitter.prototype = {
     }
     let serverURL = this.extraKeyVals.ServerURL;
 
-    // Override the submission URL from the environment or prefs.
+    // Override the submission URL from the environment
 
     var envOverride = Cc['@mozilla.org/process/environment;1'].
       getService(Ci.nsIEnvironment).get("MOZ_CRASHREPORTER_URL");
     if (envOverride != '') {
       serverURL = envOverride;
     }
-    else if ('PluginHang' in this.extraKeyVals) {
-      try {
-        serverURL = Services.prefs.
-          getCharPref("toolkit.crashreporter.pluginHangSubmitURL");
-      } catch(e) { }
-    }
 
     let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
               .createInstance(Ci.nsIXMLHttpRequest);
diff --git a/toolkit/devtools/client/connection-manager.js b/toolkit/devtools/client/connection-manager.js
index 11acc40fa8f..d0513ee706c 100644
--- a/toolkit/devtools/client/connection-manager.js
+++ b/toolkit/devtools/client/connection-manager.js
@@ -23,12 +23,12 @@ Cu.import("resource://gre/modules/devtools/dbg-server.jsm");
  * # ConnectionManager
  *
  * Methods:
- *  ⬩ Connection createConnection(host, port)
- *  ⬩ void       destroyConnection(connection)
- *  ⬩ Number     getFreeTCPPort()
+ *  . Connection createConnection(host, port)
+ *  . void       destroyConnection(connection)
+ *  . Number     getFreeTCPPort()
  *
  * Properties:
- *  ⬩ Array      connections
+ *  . Array      connections
  *
  * # Connection
  *
@@ -38,33 +38,34 @@ Cu.import("resource://gre/modules/devtools/dbg-server.jsm");
  * will re-create a debugger client.
  *
  * Methods:
- *  ⬩ connect()         Connect to host:port. Expect a "connecting" event. If
- *                      host is not specified, a local pipe is used
- *  ⬩ disconnect()      Disconnect if connected. Expect a "disconnecting" event
+ *  . connect()             Connect to host:port. Expect a "connecting" event.
+ *                          If no host is not specified, a local pipe is used
+ *  . connect(transport)    Connect via transport. Expect a "connecting" event.
+ *  . disconnect()          Disconnect if connected. Expect a "disconnecting" event
  *
  * Properties:
- *  ⬩ host              IP address or hostname
- *  ⬩ port              Port
- *  ⬩ logs              Current logs. "newlog" event notifies new available logs
- *  ⬩ store             Reference to a local data store (see below)
- *  ⬩ keepConnecting    Should the connection keep trying connecting
- *  ⬩ status            Connection status:
- *                        Connection.Status.CONNECTED
- *                        Connection.Status.DISCONNECTED
- *                        Connection.Status.CONNECTING
- *                        Connection.Status.DISCONNECTING
- *                        Connection.Status.DESTROYED
+ *  . host                  IP address or hostname
+ *  . port                  Port
+ *  . logs                  Current logs. "newlog" event notifies new available logs
+ *  . store                 Reference to a local data store (see below)
+ *  . keepConnecting        Should the connection keep trying connecting
+ *  . status                Connection status:
+ *                            Connection.Status.CONNECTED
+ *                            Connection.Status.DISCONNECTED
+ *                            Connection.Status.CONNECTING
+ *                            Connection.Status.DISCONNECTING
+ *                            Connection.Status.DESTROYED
  *
  * Events (as in event-emitter.js):
- *  ⬩ Connection.Events.CONNECTING      Trying to connect to host:port
- *  ⬩ Connection.Events.CONNECTED       Connection is successful
- *  ⬩ Connection.Events.DISCONNECTING   Trying to disconnect from server
- *  ⬩ Connection.Events.DISCONNECTED    Disconnected (at client request, or because of a timeout or connection error)
- *  ⬩ Connection.Events.STATUS_CHANGED  The connection status (connection.status) has changed
- *  ⬩ Connection.Events.TIMEOUT         Connection timeout
- *  ⬩ Connection.Events.HOST_CHANGED    Host has changed
- *  ⬩ Connection.Events.PORT_CHANGED    Port has changed
- *  ⬩ Connection.Events.NEW_LOG         A new log line is available
+ *  . Connection.Events.CONNECTING      Trying to connect to host:port
+ *  . Connection.Events.CONNECTED       Connection is successful
+ *  . Connection.Events.DISCONNECTING   Trying to disconnect from server
+ *  . Connection.Events.DISCONNECTED    Disconnected (at client request, or because of a timeout or connection error)
+ *  . Connection.Events.STATUS_CHANGED  The connection status (connection.status) has changed
+ *  . Connection.Events.TIMEOUT         Connection timeout
+ *  . Connection.Events.HOST_CHANGED    Host has changed
+ *  . Connection.Events.PORT_CHANGED    Port has changed
+ *  . Connection.Events.NEW_LOG         A new log line is available
  *
  */
 
@@ -187,16 +188,21 @@ Connection.prototype = {
     }
   },
 
-  connect: function() {
+  connect: function(transport) {
     if (this.status == Connection.Status.DESTROYED) {
       return;
     }
     if (!this._client) {
-      this.log("connecting to " + this.host + ":" + this.port);
+      this._customTransport = transport;
+      if (this._customTransport) {
+        this.log("connecting (custom transport)");
+      } else {
+        this.log("connecting to " + this.host + ":" + this.port);
+      }
       this._setStatus(Connection.Status.CONNECTING);
+
       let delay = Services.prefs.getIntPref("devtools.debugger.remote-timeout");
       this._timeoutID = setTimeout(this._onTimeout, delay);
-
       this._clientConnect();
     } else {
       let msg = "Can't connect. Client is not fully disconnected";
@@ -218,19 +224,23 @@ Connection.prototype = {
 
   _clientConnect: function () {
     let transport;
-    if (!this.host) {
-      transport = DebuggerServer.connectPipe();
+    if (this._customTransport) {
+      transport = this._customTransport;
     } else {
-      try {
-        transport = debuggerSocketConnect(this.host, this.port);
-      } catch (e) {
-        // In some cases, especially on Mac, the openOutputStream call in
-        // debuggerSocketConnect may throw NS_ERROR_NOT_INITIALIZED.
-        // It occurs when we connect agressively to the simulator,
-        // and keep trying to open a socket to the server being started in
-        // the simulator.
-        this._onDisconnected();
-        return;
+      if (!this.host) {
+        transport = DebuggerServer.connectPipe();
+      } else {
+        try {
+          transport = debuggerSocketConnect(this.host, this.port);
+        } catch (e) {
+          // In some cases, especially on Mac, the openOutputStream call in
+          // debuggerSocketConnect may throw NS_ERROR_NOT_INITIALIZED.
+          // It occurs when we connect agressively to the simulator,
+          // and keep trying to open a socket to the server being started in
+          // the simulator.
+          this._onDisconnected();
+          return;
+        }
       }
     }
     this._client = new DebuggerClient(transport);
@@ -252,6 +262,7 @@ Connection.prototype = {
 
   _onDisconnected: function() {
     this._client = null;
+    this._customTransport = null;
 
     if (this._status == Connection.Status.CONNECTING && this.keepConnecting) {
       setTimeout(() => this._clientConnect(), 100);
diff --git a/toolkit/library/moz.build b/toolkit/library/moz.build
index 8ace917aa5a..e191f139484 100644
--- a/toolkit/library/moz.build
+++ b/toolkit/library/moz.build
@@ -52,6 +52,12 @@ def Libxul(name):
         # and config/version.mk would lift the $(srcdir)
         RCINCLUDE = '$(DEPTH)/toolkit/library/xulrunner.rc'
 
+    LIBRARY_DEFINES['MOZILLA_INTERNAL_API'] = True
+    LIBRARY_DEFINES['IMPL_LIBXUL'] = True
+    if not CONFIG['JS_SHARED_LIBRARY']:
+        LIBRARY_DEFINES['STATIC_EXPORTABLE_JS_API'] = True
+
+
 Libxul('xul')
 
 SDK_LIBRARY = True
diff --git a/toolkit/modules/Finder.jsm b/toolkit/modules/Finder.jsm
index 3abbf62fa2e..59286d47d1b 100644
--- a/toolkit/modules/Finder.jsm
+++ b/toolkit/modules/Finder.jsm
@@ -197,9 +197,12 @@ Finder.prototype = {
     // Allow Finder listeners to cancel focusing the content.
     for (let l of this._listeners) {
       try {
-        if (!l.shouldFocusContent())
+        if ("shouldFocusContent" in l &&
+            !l.shouldFocusContent())
           return;
-      } catch (ex) {}
+      } catch (ex) {
+        Cu.reportError(ex);
+      }
     }
 
     let fastFind = this._fastFind;
diff --git a/toolkit/modules/GMPInstallManager.jsm b/toolkit/modules/GMPInstallManager.jsm
index 470384b5ba3..87b280aa669 100644
--- a/toolkit/modules/GMPInstallManager.jsm
+++ b/toolkit/modules/GMPInstallManager.jsm
@@ -140,7 +140,7 @@ XPCOMUtils.defineLazyGetter(this, "gOSVersion", function aus_gOSVersion() {
     const BYTE = ctypes.uint8_t;
     const WORD = ctypes.uint16_t;
     const DWORD = ctypes.uint32_t;
-    const WCHAR = ctypes.jschar;
+    const WCHAR = ctypes.char16_t;
     const BOOL = ctypes.int;
 
     // This structure is described at:
diff --git a/toolkit/modules/RemoteFinder.jsm b/toolkit/modules/RemoteFinder.jsm
index 9899160e0df..768b120a6c4 100644
--- a/toolkit/modules/RemoteFinder.jsm
+++ b/toolkit/modules/RemoteFinder.jsm
@@ -83,6 +83,17 @@ RemoteFinder.prototype = {
   },
 
   focusContent: function () {
+    // Allow Finder listeners to cancel focusing the content.
+    for (let l of this._listeners) {
+      try {
+        if ("shouldFocusContent" in l &&
+            !l.shouldFocusContent())
+          return;
+      } catch (ex) {
+        Cu.reportError(ex);
+      }
+    }
+
     this._browser.messageManager.sendAsyncMessage("Finder:FocusContent");
   },
 
@@ -134,12 +145,6 @@ RemoteFinderListener.prototype = {
     this._global.sendAsyncMessage("Finder:MatchesResult", aData);
   },
 
-  //XXXmikedeboer-20131016: implement |shouldFocusContent| here to mitigate
-  //                        issues like bug 921338 and bug 921308.
-  shouldFocusContent: function () {
-    return true;
-  },
-
   receiveMessage: function (aMessage) {
     let data = aMessage.data;
 
diff --git a/toolkit/mozapps/extensions/internal/OpenH264Provider.jsm b/toolkit/mozapps/extensions/internal/OpenH264Provider.jsm
index 93517bec8da..cb6b56eb019 100644
--- a/toolkit/mozapps/extensions/internal/OpenH264Provider.jsm
+++ b/toolkit/mozapps/extensions/internal/OpenH264Provider.jsm
@@ -87,6 +87,7 @@ let OpenH264Wrapper = {
 
   get id() { return OPENH264_PLUGIN_ID; },
   get type() { return "plugin"; },
+  get isGMPlugin() { return true; },
   get name() { return pluginsBundle.GetStringFromName("openH264_name"); },
   get creator() { return null; },
   get homepageURL() { return OPENH264_HOMEPAGE_URL; },
diff --git a/toolkit/mozapps/installer/package-name.mk b/toolkit/mozapps/installer/package-name.mk
index 04f4a09a626..a88061b90be 100644
--- a/toolkit/mozapps/installer/package-name.mk
+++ b/toolkit/mozapps/installer/package-name.mk
@@ -154,6 +154,7 @@ endif
 
 MOZ_SOURCESTAMP_FILE = $(DIST)/$(PKG_PATH)/$(MOZ_INFO_BASENAME).txt
 MOZ_BUILDINFO_FILE = $(DIST)/$(PKG_PATH)/$(MOZ_INFO_BASENAME).json
+MOZ_MOZINFO_FILE = $(DIST)/$(PKG_PATH)/$(MOZ_INFO_BASENAME).mozinfo.json
 
 # JavaScript Shell
 PKG_JSSHELL = $(DIST)/jsshell-$(MOZ_PKG_PLATFORM).zip
diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
index da384c997ae..ce11dcb3e69 100644
--- a/toolkit/mozapps/installer/packager.mk
+++ b/toolkit/mozapps/installer/packager.mk
@@ -462,8 +462,6 @@ INNER_MAKE_PACKAGE	= \
     diff $(GECKO_APP_AP_PATH)/R.txt $(GECKO_APP_AP_PATH)/gecko-nodeps/R.txt >/dev/null || \
     (echo "*** Error: The R.txt that was built and the R.txt that is being packaged are not the same. Rebuild mobile/android/base and re-package." && exit 1)) && \
   ( cd $(STAGEPATH)$(MOZ_PKG_DIR)$(_BINPATH) && \
-    mkdir -p lib/$(ANDROID_CPU_ARCH) && \
-    mv libmozglue.so $(MOZ_CHILD_PROCESS_NAME) lib/$(ANDROID_CPU_ARCH) && \
     unzip -o $(_ABS_DIST)/gecko.ap_ && \
     rm $(_ABS_DIST)/gecko.ap_ && \
     $(ZIP) $(if $(MOZ_ENABLE_SZIP),-0 )$(_ABS_DIST)/gecko.ap_ $(ASSET_SO_LIBRARIES) && \
@@ -493,9 +491,6 @@ INNER_UNMAKE_PACKAGE	= \
   mkdir $(MOZ_PKG_DIR) && \
   ( cd $(MOZ_PKG_DIR) && \
     $(UNZIP) $(UNPACKAGE) && \
-    mv lib/$(ANDROID_CPU_ARCH)/libmozglue.so . && \
-    mv lib/$(ANDROID_CPU_ARCH)/*plugin-container* $(MOZ_CHILD_PROCESS_NAME) && \
-    rm -rf lib/$(ANDROID_CPU_ARCH) && \
     rm -rf res \
     $(if $(filter-out ./,$(OMNIJAR_DIR)), \
       && mv $(OMNIJAR_DIR)$(OMNIJAR_NAME) $(OMNIJAR_NAME)) )
@@ -758,7 +753,7 @@ endif # Darwin
 
 prepare-package: stage-package
 
-make-package-internal: prepare-package make-sourcestamp-file make-buildinfo-file
+make-package-internal: prepare-package make-sourcestamp-file make-buildinfo-file make-mozinfo-file
 	@echo 'Compressing...'
 	cd $(DIST) && $(MAKE_PACKAGE)
 
@@ -784,6 +779,10 @@ make-buildinfo-file:
 		MOZ_SOURCE_STAMP=$(MOZ_SOURCE_STAMP) \
 		MOZ_PKG_PLATFORM=$(MOZ_PKG_PLATFORM)
 
+.PHONY: make-mozinfo-file
+make-mozinfo-file:
+	cp $(DEPTH)/mozinfo.json $(MOZ_MOZINFO_FILE)
+
 # The install target will install the application to prefix/lib/appname-version
 # In addition if INSTALL_SDK is set, it will install the development headers,
 # libraries, and IDL files as follows:
@@ -897,6 +896,7 @@ UPLOAD_FILES= \
   $(call QUOTED_WILDCARD,$(DIST)/$(SDK)) \
   $(call QUOTED_WILDCARD,$(MOZ_SOURCESTAMP_FILE)) \
   $(call QUOTED_WILDCARD,$(MOZ_BUILDINFO_FILE)) \
+  $(call QUOTED_WILDCARD,$(MOZ_MOZINFO_FILE)) \
   $(call QUOTED_WILDCARD,$(PKG_JSSHELL)) \
   $(if $(UPLOAD_EXTRA_FILES), $(foreach f, $(UPLOAD_EXTRA_FILES), $(wildcard $(DIST)/$(f))))
 
diff --git a/toolkit/mozapps/update/common/errors.h b/toolkit/mozapps/update/common/errors.h
index 360f2e3f253..b7974016518 100644
--- a/toolkit/mozapps/update/common/errors.h
+++ b/toolkit/mozapps/update/common/errors.h
@@ -69,6 +69,11 @@
 #define WRITE_ERROR_SHARING_VIOLATION_NOPROCESSFORPID 47
 #define WRITE_ERROR_SHARING_VIOLATION_NOPID 48
 
+#define FOTA_FILE_OPERATION_ERROR 49
+#define FOTA_RECOVERY_ERROR 50
+
+#define SECURE_LOCATION_UPDATE_ERROR 51
+
 // The following error codes are only used by updater.exe
 // when a fallback key exists and XPCShell tests are being run.
 #define FALLBACKKEY_UNKNOWN_ERROR 100
diff --git a/toolkit/mozapps/update/common/readstrings.cpp b/toolkit/mozapps/update/common/readstrings.cpp
index c838cce67f5..428c91c0ba6 100644
--- a/toolkit/mozapps/update/common/readstrings.cpp
+++ b/toolkit/mozapps/update/common/readstrings.cpp
@@ -21,7 +21,7 @@
 // stack based FILE wrapper to ensure that fclose is called.
 class AutoFILE {
 public:
-  AutoFILE(FILE *fp) : fp_(fp) {}
+  explicit AutoFILE(FILE *fp) : fp_(fp) {}
   ~AutoFILE() { if (fp_) fclose(fp_); }
   operator FILE *() { return fp_; }
 private:
@@ -30,7 +30,7 @@ private:
 
 class AutoCharArray {
 public:
-  AutoCharArray(size_t len) { ptr_ = new char[len]; }
+  explicit AutoCharArray(size_t len) { ptr_ = new char[len]; }
   ~AutoCharArray() { delete[] ptr_; }
   operator char *() { return ptr_; }
 private:
@@ -129,7 +129,7 @@ ReadStrings(const NS_tchar *path,
             char results[][MAX_TEXT_LEN],
             const char *section)
 {
-  AutoFILE fp = NS_tfopen(path, OPEN_MODE);
+  AutoFILE fp(NS_tfopen(path, OPEN_MODE));
 
   if (!fp)
     return READ_ERROR;
diff --git a/toolkit/mozapps/update/common/uachelper.cpp b/toolkit/mozapps/update/common/uachelper.cpp
index 74ae4ca283f..7e29e05ce26 100644
--- a/toolkit/mozapps/update/common/uachelper.cpp
+++ b/toolkit/mozapps/update/common/uachelper.cpp
@@ -4,6 +4,7 @@
 
 #include <windows.h>
 #include <wtsapi32.h>
+#include <aclapi.h>
 #include "uachelper.h"
 #include "updatelogging.h"
 
@@ -161,11 +162,15 @@ UACHelper::DisableUnneededPrivileges(HANDLE token,
   BOOL result = TRUE;
   for (size_t i = 0; i < count; i++) {
     if (SetPrivilege(token, unneededPrivs[i], FALSE)) {
+#ifdef UPDATER_LOG_PRIVS
       LOG(("Disabled unneeded token privilege: %s.",
            unneededPrivs[i]));
+#endif
     } else {
+#ifdef UPDATER_LOG_PRIVS
       LOG(("Could not disable token privilege value: %s. (%d)",
            unneededPrivs[i], GetLastError()));
+#endif
       result = FALSE;
     }
   }
@@ -220,3 +225,93 @@ UACHelper::CanUserElevate()
 
   return canElevate;
 }
+
+/**
+ * Denies write access for everyone on the specified path.
+ *
+ * @param path The file path to modify the DACL on
+ * @param originalACL out parameter, set only if successful.
+ *                    caller must free.
+ * @return true on success
+ */
+bool
+UACHelper::DenyWriteACLOnPath(LPCWSTR path, PACL *originalACL,
+                              PSECURITY_DESCRIPTOR *sd)
+{
+  // Get the old security information on the path.
+  // Note that the actual buffer to be freed is contained in *sd.
+  // originalACL points within *sd's buffer.
+  *originalACL = nullptr;
+  *sd = nullptr;
+  DWORD result =
+    GetNamedSecurityInfoW(path, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
+                          nullptr, nullptr, originalACL, nullptr, sd);
+  if (result != ERROR_SUCCESS) {
+    *sd = nullptr;
+    *originalACL = nullptr;
+    return false;
+  }
+
+  // Adjust the security for everyone to deny write
+  EXPLICIT_ACCESSW ea;
+  ZeroMemory(&ea, sizeof(EXPLICIT_ACCESSW));
+  ea.grfAccessPermissions = FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES |
+                            FILE_WRITE_DATA | FILE_WRITE_EA;
+  ea.grfAccessMode = DENY_ACCESS;
+  ea.grfInheritance = NO_INHERITANCE;
+  ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;
+  ea.Trustee.TrusteeType = TRUSTEE_IS_GROUP;
+  ea.Trustee.ptstrName = L"EVERYONE";
+  PACL dacl = nullptr;
+  result = SetEntriesInAclW(1, &ea, *originalACL, &dacl);
+  if (result != ERROR_SUCCESS) {
+    LocalFree(*sd);
+    *originalACL = nullptr;
+    *sd = nullptr;
+    return false;
+  }
+
+  // Update the path to have a the new DACL
+  result = SetNamedSecurityInfoW(const_cast<LPWSTR>(path), SE_FILE_OBJECT,
+                                 DACL_SECURITY_INFORMATION, nullptr, nullptr,
+                                 dacl, nullptr);
+  LocalFree(dacl);
+  return result == ERROR_SUCCESS;
+}
+
+/**
+ * Determines if the specified directory only has updater.exe inside of it,
+ * and nothing else.
+ *
+ * @param inputPath the directory path to search
+ * @return true if updater.exe is the only file in the directory
+ */
+bool
+UACHelper::IsDirectorySafe(LPCWSTR inputPath)
+{
+  WIN32_FIND_DATAW findData;
+  HANDLE findHandle = nullptr;
+
+  WCHAR searchPath[MAX_PATH + 1] = { L'\0' };
+  wsprintfW(searchPath, L"%s\\*.*", inputPath);
+
+  findHandle = FindFirstFileW(searchPath, &findData);
+  if(findHandle == INVALID_HANDLE_VALUE) {
+    return false;
+  }
+
+  // Enumerate the files and if we find anything other than the current
+  // directory, the parent directory, or updater.exe. Then fail.
+  do {
+    if(wcscmp(findData.cFileName, L".") != 0 &&
+       wcscmp(findData.cFileName, L"..") != 0 &&
+       wcscmp(findData.cFileName, L"updater.exe") != 0) {
+         FindClose(findHandle);
+      return false;
+    }
+  } while(FindNextFileW(findHandle, &findData));
+  FindClose(findHandle);
+
+  return true;
+}
+
diff --git a/toolkit/mozapps/update/common/uachelper.h b/toolkit/mozapps/update/common/uachelper.h
index 6481ff5b5ee..cad7ebabd0e 100644
--- a/toolkit/mozapps/update/common/uachelper.h
+++ b/toolkit/mozapps/update/common/uachelper.h
@@ -12,12 +12,15 @@ public:
   static HANDLE OpenLinkedToken(HANDLE token);
   static BOOL DisablePrivileges(HANDLE token);
   static bool CanUserElevate();
+  static bool IsDirectorySafe(LPCWSTR inputPath);
+  static bool DenyWriteACLOnPath(LPCWSTR path, PACL *originalACL,
+                                 PSECURITY_DESCRIPTOR *sd);
 
 private:
   static BOOL SetPrivilege(HANDLE token, LPCTSTR privs, BOOL enable);
-  static BOOL DisableUnneededPrivileges(HANDLE token, 
+  static BOOL DisableUnneededPrivileges(HANDLE token,
                                         LPCTSTR *unneededPrivs, size_t count);
-  static LPCTSTR PrivsToDisable[];  
+  static LPCTSTR PrivsToDisable[];
 };
 
 #endif
diff --git a/toolkit/mozapps/update/common/updatehelper.cpp b/toolkit/mozapps/update/common/updatehelper.cpp
index 45ab0921213..ae3e177cb1b 100644
--- a/toolkit/mozapps/update/common/updatehelper.cpp
+++ b/toolkit/mozapps/update/common/updatehelper.cpp
@@ -33,7 +33,6 @@ using mozilla::MakeUnique;
 using mozilla::UniquePtr;
 
 WCHAR* MakeCommandLine(int argc, WCHAR **argv);
-BOOL PathAppendSafe(LPWSTR base, LPCWSTR extra);
 
 /**
  * Obtains the path of a file in the same directory as the specified file.
diff --git a/toolkit/mozapps/update/common/updatehelper.h b/toolkit/mozapps/update/common/updatehelper.h
index 9e21a9c646e..5ba2b0c0a58 100644
--- a/toolkit/mozapps/update/common/updatehelper.h
+++ b/toolkit/mozapps/update/common/updatehelper.h
@@ -17,6 +17,10 @@ BOOL DoesFallbackKeyExist();
 BOOL IsLocalFile(LPCWSTR file, BOOL &isLocal);
 DWORD StartServiceCommand(int argc, LPCWSTR* argv);
 BOOL IsUnpromptedElevation(BOOL &isUnpromptedElevation);
+BOOL PathGetSiblingFilePath(LPWSTR destinationBuffer,
+                            LPCWSTR siblingFilePath,
+                            LPCWSTR newFileName);
+BOOL PathAppendSafe(LPWSTR base, LPCWSTR extra);
 
 #define SVC_NAME L"MozillaMaintenance"
 
diff --git a/toolkit/mozapps/update/nsUpdateService.js b/toolkit/mozapps/update/nsUpdateService.js
index 4942982bdb7..fe3a3ff2de0 100644
--- a/toolkit/mozapps/update/nsUpdateService.js
+++ b/toolkit/mozapps/update/nsUpdateService.js
@@ -162,6 +162,7 @@ const WRITE_ERROR_SHARING_VIOLATION_NOPROCESSFORPID = 47;
 const WRITE_ERROR_SHARING_VIOLATION_NOPID           = 48;
 const FOTA_FILE_OPERATION_ERROR                     = 49;
 const FOTA_RECOVERY_ERROR                           = 50;
+const SECURE_LOCATION_UPDATE_ERROR                  = 51;
 
 const CERT_ATTR_CHECK_FAILED_NO_UPDATE  = 100;
 const CERT_ATTR_CHECK_FAILED_HAS_UPDATE = 101;
@@ -353,7 +354,7 @@ XPCOMUtils.defineLazyGetter(this, "gOSVersion", function aus_gOSVersion() {
     const BYTE = ctypes.uint8_t;
     const WORD = ctypes.uint16_t;
     const DWORD = ctypes.uint32_t;
-    const WCHAR = ctypes.jschar;
+    const WCHAR = ctypes.char16_t;
     const BOOL = ctypes.int;
 
     // This structure is described at:
@@ -523,7 +524,7 @@ function createMutex(aName, aAllowExisting) {
                                  ctypes.void_t.ptr, /* return handle */
                                  ctypes.void_t.ptr, /* security attributes */
                                  ctypes.int32_t, /* initial owner */
-                                 ctypes.jschar.ptr); /* name */
+                                 ctypes.char16_t.ptr); /* name */
 
   var handle = CreateMutexW(null, INITIAL_OWN, aName);
   var alreadyExists = ctypes.winLastError == ERROR_ALREADY_EXISTS;
@@ -1477,7 +1478,8 @@ function handleUpdateFailure(update, errorCode) {
     return true;
   }
 
-  if (update.errorCode == ELEVATION_CANCELED) {
+  if (update.errorCode == ELEVATION_CANCELED ||
+      update.errorCode == SECURE_LOCATION_UPDATE_ERROR) {
     writeStatusFile(getUpdatesDir(), update.state = STATE_PENDING);
     return true;
   }
@@ -2383,7 +2385,7 @@ UpdateService.prototype = {
       if (parts.length > 1) {
         result = parseInt(parts[1]) || INVALID_UPDATER_STATUS_CODE;
       }
-      Services.telemetry.getHistogramById("UPDATER_STATUS_CODES").add(result);
+      Services.telemetry.getHistogramById("UPDATER_ALL_STATUS_CODES").add(result);
     } catch(e) {
       // Don't allow any exception to be propagated.
       Cu.reportError(e);
diff --git a/toolkit/mozapps/update/tests/unit_aus_update/canCheckForAndCanApplyUpdates.js b/toolkit/mozapps/update/tests/unit_aus_update/canCheckForAndCanApplyUpdates.js
index e679fd6f854..e30c2487daf 100644
--- a/toolkit/mozapps/update/tests/unit_aus_update/canCheckForAndCanApplyUpdates.js
+++ b/toolkit/mozapps/update/tests/unit_aus_update/canCheckForAndCanApplyUpdates.js
@@ -115,7 +115,7 @@ if (IS_WIN) {
                                    ctypes.void_t.ptr, /* return handle */
                                    ctypes.void_t.ptr, /* security attributes */
                                    ctypes.int32_t, /* initial owner */
-                                   ctypes.jschar.ptr); /* name */
+                                   ctypes.char16_t.ptr); /* name */
 
     let handle = CreateMutexW(null, INITIAL_OWN, aName);
     lib.close();
diff --git a/toolkit/mozapps/update/tests/unit_aus_update/head_update.js b/toolkit/mozapps/update/tests/unit_aus_update/head_update.js
index a3ddfcc6a5f..d7e312828ea 100644
--- a/toolkit/mozapps/update/tests/unit_aus_update/head_update.js
+++ b/toolkit/mozapps/update/tests/unit_aus_update/head_update.js
@@ -1278,11 +1278,11 @@ XPCOMUtils.defineLazyGetter(this, "gLocalAppDataDir",
                                            ctypes.winapi_abi,
                                            ctypes.bool, /* bool(return) */
                                            ctypes.int32_t, /* HWND hwndOwner */
-                                           ctypes.jschar.ptr, /* LPTSTR lpszPath */
+                                           ctypes.char16_t.ptr, /* LPTSTR lpszPath */
                                            ctypes.int32_t, /* int csidl */
                                            ctypes.bool /* BOOL fCreate */);
 
-  let aryPathLocalAppData = ctypes.jschar.array()(260);
+  let aryPathLocalAppData = ctypes.char16_t.array()(260);
   let rv = SHGetSpecialFolderPath(0, aryPathLocalAppData, CSIDL_LOCAL_APPDATA, false);
   lib.close();
 
@@ -1303,11 +1303,11 @@ XPCOMUtils.defineLazyGetter(this, "gProgFilesDir",
                                            ctypes.winapi_abi,
                                            ctypes.bool, /* bool(return) */
                                            ctypes.int32_t, /* HWND hwndOwner */
-                                           ctypes.jschar.ptr, /* LPTSTR lpszPath */
+                                           ctypes.char16_t.ptr, /* LPTSTR lpszPath */
                                            ctypes.int32_t, /* int csidl */
                                            ctypes.bool /* BOOL fCreate */);
 
-  let aryPathProgFiles = ctypes.jschar.array()(260);
+  let aryPathProgFiles = ctypes.char16_t.array()(260);
   let rv = SHGetSpecialFolderPath(0, aryPathProgFiles, CSIDL_PROGRAM_FILES, false);
   lib.close();
 
@@ -1508,15 +1508,18 @@ function runUpdate(aExpectedExitValue, aExpectedStatus, aCallback) {
   if (gDisableReplaceFallback) {
     env.set("MOZ_NO_REPLACE_FALLBACK", "1");
   }
+  env.set("MOZ_EMULATE_ELEVATION_PATH", "1");
 
   let process = AUS_Cc["@mozilla.org/process/util;1"].
                 createInstance(AUS_Ci.nsIProcess);
   process.init(updateBin);
+
   process.run(true, args, args.length);
 
   if (gDisableReplaceFallback) {
     env.set("MOZ_NO_REPLACE_FALLBACK", "");
   }
+  env.set("MOZ_EMULATE_ELEVATION_PATH", "");
 
   let status = readStatusFile();
   if (process.exitValue != aExpectedExitValue || status != aExpectedStatus) {
diff --git a/toolkit/mozapps/update/tests/unit_aus_update/urlConstruction.js b/toolkit/mozapps/update/tests/unit_aus_update/urlConstruction.js
index 3670465ae76..10e475613d4 100644
--- a/toolkit/mozapps/update/tests/unit_aus_update/urlConstruction.js
+++ b/toolkit/mozapps/update/tests/unit_aus_update/urlConstruction.js
@@ -201,7 +201,7 @@ function getServicePack() {
   const BYTE = ctypes.uint8_t;
   const WORD = ctypes.uint16_t;
   const DWORD = ctypes.uint32_t;
-  const WCHAR = ctypes.jschar;
+  const WCHAR = ctypes.char16_t;
   const BOOL = ctypes.int;
 
   // This structure is described at:
diff --git a/toolkit/mozapps/update/tests/unit_base_updater/marAppApplyUpdateAppBinInUseStageSuccess_win.js b/toolkit/mozapps/update/tests/unit_base_updater/marAppApplyUpdateAppBinInUseStageSuccess_win.js
index 26f673a657f..63c9556db46 100644
--- a/toolkit/mozapps/update/tests/unit_base_updater/marAppApplyUpdateAppBinInUseStageSuccess_win.js
+++ b/toolkit/mozapps/update/tests/unit_base_updater/marAppApplyUpdateAppBinInUseStageSuccess_win.js
@@ -58,7 +58,7 @@ function setupAppFilesFinished() {
 
 function customLaunchAppToApplyUpdate() {
   logTestInfo("start - locking installation directory");
-  const LPCWSTR = ctypes.jschar.ptr;
+  const LPCWSTR = ctypes.char16_t.ptr;
   const DWORD = ctypes.uint32_t;
   const LPVOID = ctypes.voidptr_t;
   const GENERIC_READ = 0x80000000;
diff --git a/toolkit/mozapps/update/tests/unit_service_updater/marAppApplyUpdateAppBinInUseStageSuccessSvc_win.js b/toolkit/mozapps/update/tests/unit_service_updater/marAppApplyUpdateAppBinInUseStageSuccessSvc_win.js
index 7bfedd3dd0e..3a2d49d6ed3 100644
--- a/toolkit/mozapps/update/tests/unit_service_updater/marAppApplyUpdateAppBinInUseStageSuccessSvc_win.js
+++ b/toolkit/mozapps/update/tests/unit_service_updater/marAppApplyUpdateAppBinInUseStageSuccessSvc_win.js
@@ -62,7 +62,7 @@ function setupAppFilesFinished() {
 
 function customLaunchAppToApplyUpdate() {
   logTestInfo("start - locking installation directory");
-  const LPCWSTR = ctypes.jschar.ptr;
+  const LPCWSTR = ctypes.char16_t.ptr;
   const DWORD = ctypes.uint32_t;
   const LPVOID = ctypes.voidptr_t;
   const GENERIC_READ = 0x80000000;
diff --git a/toolkit/mozapps/update/updater/moz.build b/toolkit/mozapps/update/updater/moz.build
index 153217539d6..f1ee7649927 100644
--- a/toolkit/mozapps/update/updater/moz.build
+++ b/toolkit/mozapps/update/updater/moz.build
@@ -41,6 +41,8 @@ if CONFIG['OS_ARCH'] == 'WINNT':
         'shlwapi',
         'crypt32',
         'advapi32',
+        'ole32',
+        'rpcrt4',
     ]
 else:
     USE_LIBS += [
diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp
index de94704a0e3..01fd9f6c6f6 100644
--- a/toolkit/mozapps/update/updater/updater.cpp
+++ b/toolkit/mozapps/update/updater/updater.cpp
@@ -111,6 +111,7 @@ static bool sUseHardLinks = true;
 
 #ifdef XP_WIN
 #include "updatehelper.h"
+#include <aclapi.h>
 
 // Closes the handle if valid and if the updater is elevated returns with the
 // return code specified. This prevents multiple launches of the callback
@@ -166,7 +167,7 @@ crc32(const unsigned char *buf, unsigned int len)
 class AutoFile
 {
 public:
-  AutoFile(FILE* file = nullptr)
+  explicit AutoFile(FILE* file = nullptr)
     : mFile(file) {
   }
 
@@ -662,13 +663,13 @@ static int ensure_copy(const NS_tchar *path, const NS_tchar *dest)
   }
 #endif
 
-  AutoFile infile = ensure_open(path, NS_T("rb"), ss.st_mode);
+  AutoFile infile(ensure_open(path, NS_T("rb"), ss.st_mode));
   if (!infile) {
     LOG(("ensure_copy: failed to open the file for reading: " LOG_S ", err: %d",
          path, errno));
     return READ_ERROR;
   }
-  AutoFile outfile = ensure_open(dest, NS_T("wb"), ss.st_mode);
+  AutoFile outfile(ensure_open(dest, NS_T("wb"), ss.st_mode));
   if (!outfile) {
     LOG(("ensure_copy: failed to open the file for writing: " LOG_S ", err: %d",
          dest, errno));
@@ -1398,7 +1399,7 @@ PatchFile::Execute()
 {
   LOG(("EXECUTE PATCH " LOG_S, mFile));
 
-  AutoFile pfile = NS_tfopen(spath, NS_T("rb"));
+  AutoFile pfile(NS_tfopen(spath, NS_T("rb")));
   if (pfile == nullptr)
     return READ_ERROR;
 
@@ -1447,7 +1448,7 @@ PatchFile::Execute()
     return rv;
 
 #if defined(HAVE_POSIX_FALLOCATE)
-  AutoFile ofile = ensure_open(mFile, NS_T("wb+"), ss.st_mode);
+  AutoFile ofile(ensure_open(mFile, NS_T("wb+"), ss.st_mode));
   posix_fallocate(fileno((FILE *)ofile), 0, header.dlen);
 #elif defined(XP_WIN)
   bool shouldTruncate = true;
@@ -1475,9 +1476,9 @@ PatchFile::Execute()
     CloseHandle(hfile);
   }
 
-  AutoFile ofile = ensure_open(mFile, shouldTruncate ? NS_T("wb+") : NS_T("rb+"), ss.st_mode);
+  AutoFile ofile(ensure_open(mFile, shouldTruncate ? NS_T("wb+") : NS_T("rb+"), ss.st_mode));
 #elif defined(XP_MACOSX)
-  AutoFile ofile = ensure_open(mFile, NS_T("wb+"), ss.st_mode);
+  AutoFile ofile(ensure_open(mFile, NS_T("wb+"), ss.st_mode));
   // Modified code from FileUtils.cpp
   fstore_t store = {F_ALLOCATECONTIG, F_PEOFPOSMODE, 0, header.dlen};
   // Try to get a continous chunk of disk space
@@ -1492,7 +1493,7 @@ PatchFile::Execute()
     ftruncate(fileno((FILE *)ofile), header.dlen);
   }
 #else
-  AutoFile ofile = ensure_open(mFile, NS_T("wb+"), ss.st_mode);
+  AutoFile ofile(ensure_open(mFile, NS_T("wb+"), ss.st_mode));
 #endif
 
   if (ofile == nullptr) {
@@ -1787,7 +1788,7 @@ WriteStatusFile(const char* aStatus)
   if (ensure_parent_dir(filename))
     return false;
 
-  AutoFile file = NS_tfopen(filename, NS_T("wb+"));
+  AutoFile file(NS_tfopen(filename, NS_T("wb+")));
   if (file == nullptr)
     return false;
 
@@ -1834,7 +1835,7 @@ IsUpdateStatusPendingService()
   NS_tsnprintf(filename, sizeof(filename)/sizeof(filename[0]),
                NS_T("%s/update.status"), gSourcePath);
 
-  AutoFile file = NS_tfopen(filename, NS_T("rb"));
+  AutoFile file(NS_tfopen(filename, NS_T("rb")));
   if (file == nullptr)
     return false;
 
@@ -1868,7 +1869,7 @@ IsUpdateStatusSucceeded(bool &isSucceeded)
   NS_tsnprintf(filename, sizeof(filename)/sizeof(filename[0]),
                NS_T("%s/update.status"), gSourcePath);
 
-  AutoFile file = NS_tfopen(filename, NS_T("rb"));
+  AutoFile file(NS_tfopen(filename, NS_T("rb")));
   if (file == nullptr)
     return false;
 
@@ -2180,7 +2181,7 @@ GetUpdateFileName(NS_tchar *fileName, int maxChars)
   NS_tchar linkFileName[MAXPATHLEN];
   NS_tsnprintf(linkFileName, sizeof(linkFileName)/sizeof(linkFileName[0]),
                NS_T("%s/update.link"), gSourcePath);
-  AutoFile linkFile = NS_tfopen(linkFileName, NS_T("rb"));
+  AutoFile linkFile(NS_tfopen(linkFileName, NS_T("rb")));
   if (linkFile == nullptr) {
     NS_tsnprintf(fileName, maxChars,
                  NS_T("%s/update.mar"), gSourcePath);
@@ -2393,8 +2394,9 @@ int NS_main(int argc, NS_tchar **argv)
   bool useService = false;
   bool testOnlyFallbackKeyExists = false;
   bool noServiceFallback = getenv("MOZ_NO_SERVICE_FALLBACK") != nullptr;
+  bool emulateElevation = getenv("MOZ_EMULATE_ELEVATION_PATH") != nullptr;
   putenv(const_cast<char*>("MOZ_NO_SERVICE_FALLBACK="));
-
+  putenv(const_cast<char*>("MOZ_EMULATE_ELEVATION_PATH="));
   // We never want the service to be used unless we build with
   // the maintenance service.
 #ifdef MOZ_MAINTENANCE_SERVICE
@@ -2484,12 +2486,6 @@ int NS_main(int argc, NS_tchar **argv)
     return 1;
   }
 
-  if (sStagedUpdate) {
-    LOG(("Performing a staged update"));
-  } else if (sReplaceRequest) {
-    LOG(("Performing a replace request"));
-  }
-
 #ifdef MOZ_WIDGET_GONK
   const char *prioEnv = getenv("MOZ_UPDATER_PRIO");
   if (prioEnv) {
@@ -2618,13 +2614,15 @@ int NS_main(int argc, NS_tchar **argv)
       return 1;
     }
 
-    updateLockFileHandle = CreateFileW(updateLockFilePath,
-                                       GENERIC_READ | GENERIC_WRITE,
-                                       0,
-                                       nullptr,
-                                       OPEN_ALWAYS,
-                                       FILE_FLAG_DELETE_ON_CLOSE,
-                                       nullptr);
+    if (!emulateElevation) {
+      updateLockFileHandle = CreateFileW(updateLockFilePath,
+                                        GENERIC_READ | GENERIC_WRITE,
+                                        0,
+                                        nullptr,
+                                        OPEN_ALWAYS,
+                                        FILE_FLAG_DELETE_ON_CLOSE,
+                                        nullptr);
+    }
 
     NS_tsnprintf(elevatedLockFilePath,
                  sizeof(elevatedLockFilePath)/sizeof(elevatedLockFilePath[0]),
@@ -2775,7 +2773,8 @@ int NS_main(int argc, NS_tchar **argv)
       // If the service can't be used when staging and update, make sure that
       // the UAC prompt is not shown! In this case, just set the status to
       // pending and the update will be applied during the next startup.
-      if (!useService && sStagedUpdate) {
+      // When emulateElevation is true fall through to the elevation code path.
+      if (!useService && sStagedUpdate && !emulateElevation) {
         if (updateLockFileHandle != INVALID_HANDLE_VALUE) {
           CloseHandle(updateLockFileHandle);
         }
@@ -2801,35 +2800,145 @@ int NS_main(int argc, NS_tchar **argv)
         }
       }
 
-      // If we didn't want to use the service at all, or if an update was 
-      // already happening, or launching the service command failed, then 
+      DWORD returnCode = 0;
+
+      // If we didn't want to use the service at all, or if an update was
+      // already happening, or launching the service command failed, then
       // launch the elevated updater.exe as we do without the service.
       // We don't launch the elevated updater in the case that we did have
       // write access all along because in that case the only reason we're
-      // using the service is because we are testing. 
-      if (!useService && !noServiceFallback && 
+      // using the service is because we are testing.
+      if (!useService && !noServiceFallback &&
           updateLockFileHandle == INVALID_HANDLE_VALUE) {
-        SHELLEXECUTEINFO sinfo;
-        memset(&sinfo, 0, sizeof(SHELLEXECUTEINFO));
-        sinfo.cbSize       = sizeof(SHELLEXECUTEINFO);
-        sinfo.fMask        = SEE_MASK_FLAG_NO_UI |
-                             SEE_MASK_FLAG_DDEWAIT |
-                             SEE_MASK_NOCLOSEPROCESS;
-        sinfo.hwnd         = nullptr;
-        sinfo.lpFile       = argv[0];
-        sinfo.lpParameters = cmdLine;
-        sinfo.lpVerb       = L"runas";
-        sinfo.nShow        = SW_SHOWNORMAL;
 
-        bool result = ShellExecuteEx(&sinfo);
-        free(cmdLine);
-
-        if (result) {
-          WaitForSingleObject(sinfo.hProcess, INFINITE);
-          CloseHandle(sinfo.hProcess);
+        // Get a unique directory name to secure
+        RPC_WSTR guidString = RPC_WSTR(L"");
+        GUID guid;
+        HRESULT hr = CoCreateGuid(&guid);
+        BOOL result = TRUE;
+        bool safeToUpdate = true;
+        WCHAR secureUpdaterPath[MAX_PATH + 1] = { L'\0' };
+        WCHAR secureDirPath[MAX_PATH + 1] = { L'\0' };
+        if (SUCCEEDED(hr)) {
+          UuidToString(&guid, &guidString);
+          result = PathGetSiblingFilePath(secureDirPath, argv[0],
+                                          reinterpret_cast<LPCWSTR>(guidString));
+          RpcStringFree(&guidString);
         } else {
-          WriteStatusFile(ELEVATION_CANCELED);
+          // This should never happen, but just in case
+          result = PathGetSiblingFilePath(secureDirPath, argv[0], L"tmp_update");
         }
+
+        if (!result) {
+          fprintf(stderr, "Could not obtain secure update directory path");
+          safeToUpdate = false;
+        }
+
+        // If it's still safe to update, create the directory
+        if (safeToUpdate) {
+          result = CreateDirectoryW(secureDirPath, nullptr);
+          if (!result) {
+            fprintf(stderr, "Could not create secure update directory");
+            safeToUpdate = false;
+          }
+        }
+
+        // If it's still safe to update, get the new updater path
+        if (safeToUpdate) {
+          wcsncpy(secureUpdaterPath, secureDirPath, MAX_PATH);
+          result = PathAppendSafe(secureUpdaterPath, L"updater.exe");
+          if (!result) {
+            fprintf(stderr, "Could not obtain secure updater file name");
+            safeToUpdate = false;
+          }
+        }
+
+        // If it's still safe to update, copy the file in
+        if (safeToUpdate) {
+          result = CopyFileW(argv[0], secureUpdaterPath, TRUE);
+          if (!result) {
+            fprintf(stderr, "Could not copy updater to secure location");
+            safeToUpdate = false;
+          }
+        }
+
+        // If it's still safe to update, restrict access to the directory item
+        // itself so that the directory cannot be deleted and re-created,
+        // nor have its properties modified.  Note that this does not disallow
+        // adding items inside the directory.
+        HANDLE handle = INVALID_HANDLE_VALUE;
+        if (safeToUpdate) {
+          handle = CreateFileW(secureDirPath, GENERIC_READ, FILE_SHARE_READ,
+                               nullptr, OPEN_EXISTING,
+                               FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+          safeToUpdate = handle != INVALID_HANDLE_VALUE;
+        }
+
+        // If it's still safe to update, deny write access completely to the
+        // directory.
+        PACL originalACL = nullptr;
+        PSECURITY_DESCRIPTOR sd = nullptr;
+        if (safeToUpdate) {
+          safeToUpdate = UACHelper::DenyWriteACLOnPath(secureDirPath,
+                                                       &originalACL, &sd);
+        }
+
+        // If it's still safe to update, verify that there is only updater.exe
+        // in the directory and nothing else.
+        if (safeToUpdate) {
+          if (!UACHelper::IsDirectorySafe(secureDirPath)) {
+            safeToUpdate = false;
+          }
+        }
+
+        if (!safeToUpdate) {
+          fprintf(stderr, "Will not proceed to copy secure updater because it "
+                          "is not safe to do so.");
+          WriteStatusFile(SECURE_LOCATION_UPDATE_ERROR);
+        } else {
+          SHELLEXECUTEINFO sinfo;
+          memset(&sinfo, 0, sizeof(SHELLEXECUTEINFO));
+          sinfo.cbSize       = sizeof(SHELLEXECUTEINFO);
+          sinfo.fMask        = SEE_MASK_FLAG_NO_UI |
+                              SEE_MASK_FLAG_DDEWAIT |
+                              SEE_MASK_NOCLOSEPROCESS;
+          sinfo.hwnd         = nullptr;
+          sinfo.lpFile       = secureUpdaterPath;
+          sinfo.lpParameters = cmdLine;
+          sinfo.lpVerb       = emulateElevation ? L"open" : L"runas";
+          sinfo.nShow        = SW_SHOWNORMAL;
+
+          bool result = ShellExecuteEx(&sinfo);
+          free(cmdLine);
+
+          if (result) {
+            WaitForSingleObject(sinfo.hProcess, INFINITE);
+            // Bubble the elevated updater return code to this updater
+            GetExitCodeProcess(sinfo.hProcess, &returnCode);
+            CloseHandle(sinfo.hProcess);
+          } else {
+            WriteStatusFile(ELEVATION_CANCELED);
+          }
+        }
+
+        // All done, revert back the permissions.
+        if (originalACL) {
+          SetNamedSecurityInfoW(const_cast<LPWSTR>(secureDirPath), SE_FILE_OBJECT,
+                                DACL_SECURITY_INFORMATION, nullptr, nullptr,
+                                originalACL, nullptr);
+        }
+        if (sd) {
+          LocalFree(sd);
+        }
+
+        // Done with the directory, no need to lock it.
+        if (INVALID_HANDLE_VALUE != handle) {
+          CloseHandle(handle);
+        }
+
+        // We no longer need the secure updater and directory
+        DeleteFileW(secureUpdaterPath);
+        RemoveDirectoryW(secureDirPath);
       }
 
       if (argc > callbackIndex) {
@@ -2844,7 +2953,7 @@ int NS_main(int argc, NS_tchar **argv)
         // We didn't use the service and we did run the elevated updater.exe.
         // The elevated updater.exe is responsible for writing out the
         // update.status file.
-        return 0;
+        return returnCode;
       } else if(useService) {
         // The service command was launched.  The service is responsible for 
         // writing out the update.status file.
@@ -2866,6 +2975,13 @@ int NS_main(int argc, NS_tchar **argv)
   }
 #endif
 
+  if (sStagedUpdate) {
+    LOG(("Performing a staged update"));
+  }
+  else if (sReplaceRequest) {
+    LOG(("Performing a replace request"));
+  }
+
 #if defined(MOZ_WIDGET_GONK)
   // In gonk, the master b2g process sets its umask to 0027 because
   // there's no reason for it to ever create world-readable files.
@@ -3170,7 +3286,7 @@ int NS_main(int argc, NS_tchar **argv)
         }
       }
     }
-    EXIT_WHEN_ELEVATED(elevatedLockFilePath, updateLockFileHandle, 0);
+    EXIT_WHEN_ELEVATED(elevatedLockFilePath, updateLockFileHandle, gSucceeded ? 0 : 1);
 #endif /* XP_WIN */
 #ifdef XP_MACOSX
     if (gSucceeded) {
@@ -3580,7 +3696,7 @@ int add_dir_entries(const NS_tchar *dirpath, ActionList *list)
 static NS_tchar*
 GetManifestContents(const NS_tchar *manifest)
 {
-  AutoFile mfile = NS_tfopen(manifest, NS_T("rb"));
+  AutoFile mfile(NS_tfopen(manifest, NS_T("rb")));
   if (mfile == nullptr) {
     LOG(("GetManifestContents: error opening manifest file: " LOG_S, manifest));
     return nullptr;
diff --git a/toolkit/themes/osx/global/in-content/common.css b/toolkit/themes/osx/global/in-content/common.css
index ac0450afe17..1163e98d1f8 100644
--- a/toolkit/themes/osx/global/in-content/common.css
+++ b/toolkit/themes/osx/global/in-content/common.css
@@ -2,6 +2,7 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this file,
    - You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+%include ../shared.inc
 %include ../../../shared/in-content/common.inc.css
 
 xul|tabs {
diff --git a/toolkit/xre/moz.build b/toolkit/xre/moz.build
index 85e38b4c0da..ea1dd02f13c 100644
--- a/toolkit/xre/moz.build
+++ b/toolkit/xre/moz.build
@@ -168,3 +168,6 @@ CXXFLAGS += CONFIG['MOZ_DBUS_GLIB_CFLAGS']
 
 if CONFIG['MOZ_WIDGET_GTK']:
     CXXFLAGS += CONFIG['MOZ_PANGO_CFLAGS']
+
+if CONFIG['MOZ_OPTIMIZE']:
+    DEFINES['MOZ_OPTIMIZE'] = True
diff --git a/toolkit/xre/nsEmbedFunctions.cpp b/toolkit/xre/nsEmbedFunctions.cpp
index 85b1afcbbd0..f1a4a26f24b 100644
--- a/toolkit/xre/nsEmbedFunctions.cpp
+++ b/toolkit/xre/nsEmbedFunctions.cpp
@@ -74,6 +74,11 @@
 
 #include "GeckoProfiler.h"
 
+#if defined(MOZ_CONTENT_SANDBOX) && defined(XP_WIN)
+#define TARGET_SANDBOX_EXPORTS
+#include "mozilla/warnonlysandbox/wosCallbacks.h"
+#endif
+
 #ifdef MOZ_IPDL_TESTS
 #include "mozilla/_ipdltest/IPDLUnitTests.h"
 #include "mozilla/_ipdltest/IPDLUnitTestProcessChild.h"
@@ -535,6 +540,12 @@ XRE_InitChildProcess(int aArgc,
         return NS_ERROR_FAILURE;
       }
 
+#if defined(MOZ_CONTENT_SANDBOX) && defined(XP_WIN)
+      // We need to do this after the process has been initialised, as
+      // InitIfRequired needs access to prefs.
+      mozilla::warnonlysandbox::InitIfRequired();
+#endif
+
       // Run the UI event loop on the main thread.
       uiMessageLoop.MessageLoop::Run();
 
diff --git a/tools/profiler/ProfileEntry.cpp b/tools/profiler/ProfileEntry.cpp
index ffcb674a9fc..89c56d4577a 100644
--- a/tools/profiler/ProfileEntry.cpp
+++ b/tools/profiler/ProfileEntry.cpp
@@ -486,7 +486,8 @@ JSObject* ThreadProfile::ToJSObject(JSContext *aCx)
     JSStreamWriter b(ss);
     StreamJSObject(b);
     NS_ConvertUTF8toUTF16 js_string(nsDependentCString(ss.str().c_str()));
-    JS_ParseJSON(aCx, static_cast<const jschar*>(js_string.get()), js_string.Length(), &val);
+    JS_ParseJSON(aCx, static_cast<const char16_t*>(js_string.get()),
+                 js_string.Length(), &val);
   }
   return &val.toObject();
 }
diff --git a/tools/profiler/TableTicker.cpp b/tools/profiler/TableTicker.cpp
index 43b64a9cf87..ca1723a2e76 100644
--- a/tools/profiler/TableTicker.cpp
+++ b/tools/profiler/TableTicker.cpp
@@ -178,7 +178,8 @@ JSObject* TableTicker::ToJSObject(JSContext *aCx)
     JSStreamWriter b(ss);
     StreamJSObject(b);
     NS_ConvertUTF8toUTF16 js_string(nsDependentCString(ss.str().c_str()));
-    JS_ParseJSON(aCx, static_cast<const jschar*>(js_string.get()), js_string.Length(), &val);
+    JS_ParseJSON(aCx, static_cast<const char16_t*>(js_string.get()),
+                 js_string.Length(), &val);
   }
   return &val.toObject();
 }
diff --git a/tools/rb/fix_macosx_stack.py b/tools/rb/fix_macosx_stack.py
index 853eb6ab5de..74502f8ce8e 100755
--- a/tools/rb/fix_macosx_stack.py
+++ b/tools/rb/fix_macosx_stack.py
@@ -132,7 +132,8 @@ def fixSymbols(line):
             # throw away the bad symbol, but keep balance tree structure
             before = balance_tree_re.match(before).groups()[0]
 
-            return before + info + after + "\n"
+            nl = '\n' if line[-1] == '\n' else ''
+            return before + info + after + nl
         else:
             sys.stderr.write("Warning: File \"" + file + "\" does not exist.\n")
             return line
diff --git a/widget/android/NativeJSContainer.cpp b/widget/android/NativeJSContainer.cpp
index 21db9860bec..dc549290f52 100644
--- a/widget/android/NativeJSContainer.cpp
+++ b/widget/android/NativeJSContainer.cpp
@@ -361,7 +361,7 @@ public:
         : mEnv(env)
         , mJNIString(str)
         , mJSString(!str ? nullptr :
-            reinterpret_cast<const jschar*>(env->GetStringChars(str, nullptr)))
+            reinterpret_cast<const char16_t*>(env->GetStringChars(str, nullptr)))
     {
     }
     ~JSJNIString() {
@@ -370,7 +370,7 @@ public:
                 reinterpret_cast<const jchar*>(mJSString));
         }
     }
-    operator const jschar*() const {
+    operator const char16_t*() const {
         return mJSString;
     }
     size_t Length() const {
@@ -379,7 +379,7 @@ public:
 private:
     JNIEnv* const mEnv;
     const jstring mJNIString;
-    const jschar* const mJSString;
+    const char16_t* const mJSString;
 };
 
 bool
@@ -415,7 +415,7 @@ CheckProperty(JNIEnv* env, JSContext* cx, JS::HandleValue val) {
 }
 
 bool
-AppendJSON(const jschar* buf, uint32_t len, void* data)
+AppendJSON(const char16_t* buf, uint32_t len, void* data)
 {
     static_cast<nsAutoString*>(data)->Append(buf, len);
     return true;
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index a524a9b8eee..cf7f513b62d 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -1042,7 +1042,10 @@ nsWindow::OnContextmenuEvent(AndroidGeckoEvent *ae)
     WidgetMouseEvent contextMenuEvent(true, NS_CONTEXTMENU, this,
                                       WidgetMouseEvent::eReal, WidgetMouseEvent::eNormal);
     contextMenuEvent.refPoint =
-        LayoutDeviceIntPoint(RoundedToInt(pt * GetDefaultScale()));
+        LayoutDeviceIntPoint(RoundedToInt(pt * GetDefaultScale())) -
+        LayoutDeviceIntPoint::FromUntyped(WidgetToScreenOffset());
+    contextMenuEvent.ignoreRootScrollFrame = true;
+    contextMenuEvent.inputSource = nsIDOMMouseEvent::MOZ_SOURCE_TOUCH;
 
     nsEventStatus contextMenuStatus;
     DispatchEvent(&contextMenuEvent, contextMenuStatus);
diff --git a/widget/cocoa/nsToolkit.h b/widget/cocoa/nsToolkit.h
index 32bbb50c069..80c72e15219 100644
--- a/widget/cocoa/nsToolkit.h
+++ b/widget/cocoa/nsToolkit.h
@@ -37,8 +37,8 @@ public:
 
 protected:
 
-  nsresult           RegisterForSleepWakeNotifcations();
-  void               RemoveSleepWakeNotifcations();
+  nsresult           RegisterForSleepWakeNotifications();
+  void               RemoveSleepWakeNotifications();
 
 protected:
 
diff --git a/widget/cocoa/nsToolkit.mm b/widget/cocoa/nsToolkit.mm
index 6da8bd25a61..dab7bee3595 100644
--- a/widget/cocoa/nsToolkit.mm
+++ b/widget/cocoa/nsToolkit.mm
@@ -48,13 +48,13 @@ nsToolkit::nsToolkit()
 , mEventTapRLS(nullptr)
 {
   MOZ_COUNT_CTOR(nsToolkit);
-  RegisterForSleepWakeNotifcations();
+  RegisterForSleepWakeNotifications();
 }
 
 nsToolkit::~nsToolkit()
 {
   MOZ_COUNT_DTOR(nsToolkit);
-  RemoveSleepWakeNotifcations();
+  RemoveSleepWakeNotifications();
   UnregisterAllProcessMouseEventHandlers();
 }
 
@@ -98,7 +98,7 @@ static void ToolkitSleepWakeCallback(void *refCon, io_service_t service, natural
 }
 
 nsresult
-nsToolkit::RegisterForSleepWakeNotifcations()
+nsToolkit::RegisterForSleepWakeNotifications()
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NSRESULT;
 
@@ -123,7 +123,7 @@ nsToolkit::RegisterForSleepWakeNotifcations()
 }
 
 void
-nsToolkit::RemoveSleepWakeNotifcations()
+nsToolkit::RemoveSleepWakeNotifications()
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK;
 
diff --git a/widget/gtk/gtk2drawing.c b/widget/gtk/gtk2drawing.c
index 71e192901f4..290a17a0dab 100644
--- a/widget/gtk/gtk2drawing.c
+++ b/widget/gtk/gtk2drawing.c
@@ -3012,6 +3012,24 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
     return MOZ_GTK_SUCCESS;
 }
 
+gint
+moz_gtk_get_tab_border(gint* left, gint* top, gint* right, gint* bottom, 
+                       GtkTextDirection direction, GtkTabFlags flags)
+{
+    moz_gtk_get_widget_border(MOZ_GTK_TAB, left, top,
+                              right, bottom, direction,
+                              FALSE);
+
+    // Top tabs have no bottom border, bottom tabs have no top border
+    if (flags & MOZ_GTK_TAB_BOTTOM) {
+      *top = 0;
+    } else {
+      *bottom = 0;
+    }
+
+    return MOZ_GTK_SUCCESS;
+}
+
 gint
 moz_gtk_get_combo_box_entry_button_size(gint* width, gint* height)
 {
diff --git a/widget/gtk/gtk3drawing.c b/widget/gtk/gtk3drawing.c
index 684650d7e0b..e9e21b12c8c 100644
--- a/widget/gtk/gtk3drawing.c
+++ b/widget/gtk/gtk3drawing.c
@@ -2105,6 +2105,21 @@ moz_gtk_get_tab_thickness(void)
     return border.top;
 }
 
+static void
+moz_gtk_tab_prepare_style_context(GtkStyleContext *style,
+                                  GtkTabFlags flags)
+{  
+  gtk_style_context_set_state(style, ((flags & MOZ_GTK_TAB_SELECTED) == 0) ? 
+                                        GTK_STATE_FLAG_NORMAL : 
+                                        GTK_STATE_FLAG_ACTIVE);
+  gtk_style_context_add_region(style, GTK_STYLE_REGION_TAB, 
+                                      (flags & MOZ_GTK_TAB_FIRST) ? 
+                                        GTK_REGION_FIRST : 0);
+  gtk_style_context_add_class(style, (flags & MOZ_GTK_TAB_BOTTOM) ? 
+                                        GTK_STYLE_CLASS_BOTTOM : 
+                                        GTK_STYLE_CLASS_TOP);
+}
+
 /* actual small tabs */
 static gint
 moz_gtk_tab_paint(cairo_t *cr, GdkRectangle* rect,
@@ -2117,22 +2132,35 @@ moz_gtk_tab_paint(cairo_t *cr, GdkRectangle* rect,
      * tab appear physically attached to the tabpanel; see details below. */
 
     GtkStyleContext* style;
+    GdkRectangle tabRect;
     GdkRectangle focusRect;
     GdkRectangle backRect;
+    int initial_gap = 0;
 
     ensure_tab_widget();
     gtk_widget_set_direction(gTabWidget, direction);
 
     style = gtk_widget_get_style_context(gTabWidget);    
-    backRect = focusRect = *rect;
-
     gtk_style_context_save(style);
+    moz_gtk_tab_prepare_style_context(style, flags);
+
+    tabRect = *rect;
+
+    if (flags & MOZ_GTK_TAB_FIRST) {
+        gtk_widget_style_get (gTabWidget, "initial-gap", &initial_gap, NULL);
+        tabRect.width -= initial_gap;
+
+        if (direction != GTK_TEXT_DIR_RTL) {
+            tabRect.x += initial_gap;
+        }
+    }
+
+    focusRect = backRect = tabRect;
 
     if ((flags & MOZ_GTK_TAB_SELECTED) == 0) {
         /* Only draw the tab */
-        gtk_style_context_set_state(style, GTK_STATE_FLAG_NORMAL);
         gtk_render_extension(style, cr,
-                             rect->x, rect->y, rect->width, rect->height,
+                             tabRect.x, tabRect.y, tabRect.width, tabRect.height,
                             (flags & MOZ_GTK_TAB_BOTTOM) ?
                                 GTK_POS_TOP : GTK_POS_BOTTOM );
     } else {
@@ -2186,24 +2214,19 @@ moz_gtk_tab_paint(cairo_t *cr, GdkRectangle* rect,
         gap_loffset = gap_roffset = 20; /* should be enough */
         if (flags & MOZ_GTK_TAB_FIRST) {
             if (direction == GTK_TEXT_DIR_RTL)
-                gap_roffset = 0;
+                gap_roffset = initial_gap;
             else
-                gap_loffset = 0;
+                gap_loffset = initial_gap;
         }
 
-        gtk_style_context_set_state(style, GTK_STATE_FLAG_ACTIVE);
-
-        /* Adwaita theme engine crashes without it (rhbz#713764) */
-        gtk_style_context_add_region(style, GTK_STYLE_REGION_TAB, 0);      
-
         if (flags & MOZ_GTK_TAB_BOTTOM) {
             /* Draw the tab on bottom */
             focusRect.y += gap_voffset;
             focusRect.height -= gap_voffset;
 
             gtk_render_extension(style, cr,
-                                 rect->x, rect->y + gap_voffset, rect->width,
-                                 rect->height - gap_voffset, GTK_POS_TOP);
+                                 tabRect.x, tabRect.y + gap_voffset, tabRect.width,
+                                 tabRect.height - gap_voffset, GTK_POS_TOP);
 
             gtk_style_context_remove_region(style, GTK_STYLE_REGION_TAB);
 
@@ -2219,38 +2242,39 @@ moz_gtk_tab_paint(cairo_t *cr, GdkRectangle* rect,
             cairo_clip(cr);
 
             gtk_render_frame_gap(style, cr,
-                                 rect->x - gap_loffset,
-                                 rect->y + gap_voffset - 3 * gap_height,
-                                 rect->width + gap_loffset + gap_roffset,
+                                 tabRect.x - gap_loffset,
+                                 tabRect.y + gap_voffset - 3 * gap_height,
+                                 tabRect.width + gap_loffset + gap_roffset,
                                  3 * gap_height, GTK_POS_BOTTOM,
-                                 gap_loffset, gap_loffset + rect->width);
+                                 gap_loffset, gap_loffset + tabRect.width);
             cairo_restore(cr);
         } else {
             /* Draw the tab on top */
             focusRect.height -= gap_voffset;
             gtk_render_extension(style, cr,
-                                 rect->x, rect->y, rect->width,
-                                 rect->height - gap_voffset, GTK_POS_BOTTOM);
+                                 tabRect.x, tabRect.y, tabRect.width,
+                                 tabRect.height - gap_voffset, GTK_POS_BOTTOM);
 
             gtk_style_context_remove_region(style, GTK_STYLE_REGION_TAB);
 
-            backRect.y += (rect->height - gap_voffset);
+            backRect.y += (tabRect.height - gap_voffset);
             backRect.height = gap_height;
 
             /* Draw the gap; erase with background color before painting in
              * case theme does not */
             gtk_render_background(style, cr, backRect.x, backRect.y,
                                   backRect.width, backRect.height);
+
             cairo_save(cr);
             cairo_rectangle(cr, backRect.x, backRect.y, backRect.width, backRect.height);
             cairo_clip(cr);
 
             gtk_render_frame_gap(style, cr,
-                                 rect->x - gap_loffset,
-                                 rect->y + rect->height - gap_voffset,
-                                 rect->width + gap_loffset + gap_roffset,
+                                 tabRect.x - gap_loffset,
+                                 tabRect.y + tabRect.height - gap_voffset,
+                                 tabRect.width + gap_loffset + gap_roffset,
                                  3 * gap_height, GTK_POS_TOP,
-                                 gap_loffset, gap_loffset + rect->width);
+                                 gap_loffset, gap_loffset + tabRect.width);
             cairo_restore(cr);
         }
     }
@@ -2885,10 +2909,6 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                                       left, top, right, bottom);
             return MOZ_GTK_SUCCESS;
         }
-    case MOZ_GTK_TAB:
-        ensure_tab_widget();
-        w = gTabWidget;
-        break;
     /* These widgets have no borders, since they are not containers. */
     case MOZ_GTK_SPLITTER_HORIZONTAL:
     case MOZ_GTK_SPLITTER_VERTICAL:
@@ -2931,6 +2951,51 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
     return MOZ_GTK_SUCCESS;
 }
 
+gint
+moz_gtk_get_tab_border(gint* left, gint* top, gint* right, gint* bottom, 
+                       GtkTextDirection direction, GtkTabFlags flags)
+{
+    GtkStyleContext* style;    
+    int tab_curvature;
+
+    ensure_tab_widget();
+
+    style = gtk_widget_get_style_context(gTabWidget);
+    gtk_style_context_save(style);
+    moz_gtk_tab_prepare_style_context(style, flags);
+
+    // TODO add_style_border() should be replaced
+    // with focus-line-width and focus-padding
+    // see Bug 877605
+    *left = *top = *right = *bottom = 0;
+    moz_gtk_add_style_border(style, left, top, right, bottom);
+    moz_gtk_add_style_padding(style, left, top, right, bottom);
+
+    gtk_widget_style_get (gTabWidget, "tab-curvature", &tab_curvature, NULL);
+    *left += tab_curvature;
+    *right += tab_curvature;
+
+    if (flags & MOZ_GTK_TAB_FIRST) {
+      int initial_gap;
+      gtk_widget_style_get (gTabWidget, "initial-gap", &initial_gap, NULL);
+      if (direction == GTK_TEXT_DIR_RTL)
+      	*right += initial_gap;
+      else
+      	*left += initial_gap;
+    }
+
+    // Top tabs have no bottom border, bottom tabs have no top border
+    if (flags & MOZ_GTK_TAB_BOTTOM) {
+      *top = 0;
+    } else {
+      *bottom = 0;
+    }
+
+    gtk_style_context_restore(style);
+
+    return MOZ_GTK_SUCCESS;
+}
+
 gint
 moz_gtk_get_combo_box_entry_button_size(gint* width, gint* height)
 {
diff --git a/widget/gtk/gtkdrawing.h b/widget/gtk/gtkdrawing.h
index fb11105a5a6..1938e8fa960 100644
--- a/widget/gtk/gtkdrawing.h
+++ b/widget/gtk/gtkdrawing.h
@@ -258,6 +258,19 @@ gint moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                                gint* right, gint* bottom, GtkTextDirection direction,
                                gboolean inhtml);
 
+/**
+ * Get the border size of a notebook tab
+ * left/right:  [OUT] the tab's left/right border
+ * top/bottom:  [OUT] the tab's top/bottom border
+ * direction:   the text direction for the widget
+ * flags:       tab-dependant flags; see the GtkTabFlags definition.
+ *
+ * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
+ */
+gint
+moz_gtk_get_tab_border(gint* left, gint* top, gint* right, gint* bottom, 
+                       GtkTextDirection direction, GtkTabFlags flags);
+
 /**
  * Get the desired size of a GtkCheckButton
  * indicator_size:     [OUT] the indicator size
diff --git a/widget/gtk/nsNativeThemeGTK.cpp b/widget/gtk/nsNativeThemeGTK.cpp
index 969fb0a7623..62018e57b50 100644
--- a/widget/gtk/nsNativeThemeGTK.cpp
+++ b/widget/gtk/nsNativeThemeGTK.cpp
@@ -940,14 +940,18 @@ nsNativeThemeGTK::GetWidgetBorder(nsDeviceContext* aContext, nsIFrame* aFrame,
     // but don't reserve any space for it.
     break;
   case NS_THEME_TAB:
-    // Top tabs have no bottom border, bottom tabs have no top border
-    moz_gtk_get_widget_border(MOZ_GTK_TAB, &aResult->left, &aResult->top,
-                              &aResult->right, &aResult->bottom, direction,
-                              FALSE);
-    if (IsBottomTab(aFrame))
-        aResult->top = 0;
-    else
-        aResult->bottom = 0;
+    {
+      GtkThemeWidgetType gtkWidgetType;
+      gint flags;
+
+      if (!GetGtkWidgetAndState(aWidgetType, aFrame, gtkWidgetType, nullptr,
+                                &flags))
+        return NS_OK;
+
+      moz_gtk_get_tab_border(&aResult->left, &aResult->top,
+                             &aResult->right, &aResult->bottom, direction,
+                             (GtkTabFlags)flags);
+    }
     break;
   case NS_THEME_MENUITEM:
   case NS_THEME_CHECKMENUITEM:
diff --git a/widget/xpwidgets/GfxInfoCollector.cpp b/widget/xpwidgets/GfxInfoCollector.cpp
index 0f375b69e1d..added6d695c 100644
--- a/widget/xpwidgets/GfxInfoCollector.cpp
+++ b/widget/xpwidgets/GfxInfoCollector.cpp
@@ -28,7 +28,7 @@ InfoObject::DefineProperty(const char *name, nsAString &value)
     return;
 
   const nsString &flat = PromiseFlatString(value);
-  JS::Rooted<JSString*> string(mCx, JS_NewUCStringCopyN(mCx, static_cast<const jschar*>(flat.get()),
+  JS::Rooted<JSString*> string(mCx, JS_NewUCStringCopyN(mCx, static_cast<const char16_t*>(flat.get()),
                                                         flat.Length()));
   if (!string)
     mOk = false;
diff --git a/xpcom/base/nsMemoryInfoDumper.cpp b/xpcom/base/nsMemoryInfoDumper.cpp
index 8f45efd56b1..59b3c98d327 100644
--- a/xpcom/base/nsMemoryInfoDumper.cpp
+++ b/xpcom/base/nsMemoryInfoDumper.cpp
@@ -711,6 +711,15 @@ nsMemoryInfoDumper::OpenDMDFile(const nsAString& aIdentifier, int aPid,
   }
   rv = dmdFile->OpenANSIFileDesc("wb", aOutFile);
   NS_WARN_IF(NS_FAILED(rv));
+
+  // Print the path, because on some platforms (e.g. Mac) it's not obvious.
+  nsCString path;
+  rv = dmdFile->GetNativePath(path);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+  dmd::StatusMsg("opened %s for writing\n", path.get());
+
   return rv;
 }
 
diff --git a/xpcom/build/XPCOMModule.inc b/xpcom/build/XPCOMModule.inc
index fda51ea45d1..6386bafc595 100644
--- a/xpcom/build/XPCOMModule.inc
+++ b/xpcom/build/XPCOMModule.inc
@@ -63,7 +63,7 @@
     COMPONENT(VARIANT, nsVariantConstructor)
     COMPONENT(INTERFACEINFOMANAGER_SERVICE, nsXPTIInterfaceInfoManagerGetSingleton)
 
-    COMPONENT(HASH_PROPERTY_BAG, nsHashPropertyBagConstructor)
+    COMPONENT(HASH_PROPERTY_BAG, nsHashPropertyBagCCConstructor)
 
     COMPONENT(UUID_GENERATOR, nsUUIDGeneratorConstructor)
 
diff --git a/xpcom/build/nsXPComInit.cpp b/xpcom/build/nsXPComInit.cpp
index 823db5384d7..8845f7db429 100644
--- a/xpcom/build/nsXPComInit.cpp
+++ b/xpcom/build/nsXPComInit.cpp
@@ -215,7 +215,7 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(VisualEventTracer)
 
 NS_GENERIC_FACTORY_CONSTRUCTOR(nsVariant)
 
-NS_GENERIC_FACTORY_CONSTRUCTOR(nsHashPropertyBag)
+NS_GENERIC_FACTORY_CONSTRUCTOR(nsHashPropertyBagCC)
 
 NS_GENERIC_AGGREGATED_CONSTRUCTOR(nsProperties)
 
diff --git a/xpcom/ds/nsHashPropertyBag.cpp b/xpcom/ds/nsHashPropertyBag.cpp
index 54ad4bab133..f18119cb393 100644
--- a/xpcom/ds/nsHashPropertyBag.cpp
+++ b/xpcom/ds/nsHashPropertyBag.cpp
@@ -1,5 +1,5 @@
-/* -*- Mode: C++; tab-width: 50; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* vim:set ts=4 sw=4 sts=4: */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -12,37 +12,19 @@
 #include "nsVariant.h"
 #include "mozilla/Attributes.h"
 
-nsresult
-NS_NewHashPropertyBag(nsIWritablePropertyBag** aResult)
-{
-  nsRefPtr<nsHashPropertyBag> hpb = new nsHashPropertyBag();
-  hpb.forget(aResult);
-  return NS_OK;
-}
-
 /*
- * nsHashPropertyBag impl
+ * nsHashPropertyBagBase implementation.
  */
 
-NS_IMPL_ADDREF(nsHashPropertyBag)
-NS_IMPL_RELEASE(nsHashPropertyBag)
-NS_INTERFACE_MAP_BEGIN(nsHashPropertyBag)
-  NS_INTERFACE_MAP_ENTRY(nsIWritablePropertyBag)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsIPropertyBag, nsIWritablePropertyBag)
-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIWritablePropertyBag)
-  NS_INTERFACE_MAP_ENTRY(nsIPropertyBag2)
-  NS_INTERFACE_MAP_ENTRY(nsIWritablePropertyBag2)
-NS_INTERFACE_MAP_END
-
 NS_IMETHODIMP
-nsHashPropertyBag::HasKey(const nsAString& aName, bool* aResult)
+nsHashPropertyBagBase::HasKey(const nsAString& aName, bool* aResult)
 {
   *aResult = mPropertyHash.Get(aName, nullptr);
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::Get(const nsAString& aName, nsIVariant** aResult)
+nsHashPropertyBagBase::Get(const nsAString& aName, nsIVariant** aResult)
 {
   if (!mPropertyHash.Get(aName, aResult)) {
     *aResult = nullptr;
@@ -52,7 +34,7 @@ nsHashPropertyBag::Get(const nsAString& aName, nsIVariant** aResult)
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::GetProperty(const nsAString& aName, nsIVariant** aResult)
+nsHashPropertyBagBase::GetProperty(const nsAString& aName, nsIVariant** aResult)
 {
   bool isFound = mPropertyHash.Get(aName, aResult);
   if (!isFound) {
@@ -63,7 +45,7 @@ nsHashPropertyBag::GetProperty(const nsAString& aName, nsIVariant** aResult)
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::SetProperty(const nsAString& aName, nsIVariant* aValue)
+nsHashPropertyBagBase::SetProperty(const nsAString& aName, nsIVariant* aValue)
 {
   if (NS_WARN_IF(!aValue)) {
     return NS_ERROR_INVALID_ARG;
@@ -75,7 +57,7 @@ nsHashPropertyBag::SetProperty(const nsAString& aName, nsIVariant* aValue)
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::DeleteProperty(const nsAString& aName)
+nsHashPropertyBagBase::DeleteProperty(const nsAString& aName)
 {
   // is it too much to ask for ns*Hashtable to return
   // a boolean indicating whether RemoveEntry succeeded
@@ -145,7 +127,7 @@ PropertyHashToArrayFunc(const nsAString& aKey,
 
 
 NS_IMETHODIMP
-nsHashPropertyBag::GetEnumerator(nsISimpleEnumerator** aResult)
+nsHashPropertyBagBase::GetEnumerator(nsISimpleEnumerator** aResult)
 {
   nsCOMPtr<nsIMutableArray> propertyArray = nsArray::Create();
   if (!propertyArray) {
@@ -159,7 +141,7 @@ nsHashPropertyBag::GetEnumerator(nsISimpleEnumerator** aResult)
 
 #define IMPL_GETSETPROPERTY_AS(Name, Type) \
 NS_IMETHODIMP \
-nsHashPropertyBag::GetPropertyAs ## Name (const nsAString & prop, Type *_retval) \
+nsHashPropertyBagBase::GetPropertyAs ## Name (const nsAString & prop, Type *_retval) \
 { \
     nsIVariant* v = mPropertyHash.GetWeak(prop); \
     if (!v) \
@@ -168,7 +150,7 @@ nsHashPropertyBag::GetPropertyAs ## Name (const nsAString & prop, Type *_retval)
 } \
 \
 NS_IMETHODIMP \
-nsHashPropertyBag::SetPropertyAs ## Name (const nsAString & prop, Type value) \
+nsHashPropertyBagBase::SetPropertyAs ## Name (const nsAString & prop, Type value) \
 { \
     nsCOMPtr<nsIWritableVariant> var = new nsVariant(); \
     var->SetAs ## Name(value); \
@@ -184,7 +166,7 @@ IMPL_GETSETPROPERTY_AS(Bool, bool)
 
 
 NS_IMETHODIMP
-nsHashPropertyBag::GetPropertyAsAString(const nsAString& aProp,
+nsHashPropertyBagBase::GetPropertyAsAString(const nsAString& aProp,
                                         nsAString& aResult)
 {
   nsIVariant* v = mPropertyHash.GetWeak(aProp);
@@ -195,7 +177,7 @@ nsHashPropertyBag::GetPropertyAsAString(const nsAString& aProp,
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::GetPropertyAsACString(const nsAString& aProp,
+nsHashPropertyBagBase::GetPropertyAsACString(const nsAString& aProp,
                                          nsACString& aResult)
 {
   nsIVariant* v = mPropertyHash.GetWeak(aProp);
@@ -206,7 +188,7 @@ nsHashPropertyBag::GetPropertyAsACString(const nsAString& aProp,
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::GetPropertyAsAUTF8String(const nsAString& aProp,
+nsHashPropertyBagBase::GetPropertyAsAUTF8String(const nsAString& aProp,
                                             nsACString& aResult)
 {
   nsIVariant* v = mPropertyHash.GetWeak(aProp);
@@ -217,7 +199,7 @@ nsHashPropertyBag::GetPropertyAsAUTF8String(const nsAString& aProp,
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::GetPropertyAsInterface(const nsAString& aProp,
+nsHashPropertyBagBase::GetPropertyAsInterface(const nsAString& aProp,
                                           const nsIID& aIID,
                                           void** aResult)
 {
@@ -239,7 +221,7 @@ nsHashPropertyBag::GetPropertyAsInterface(const nsAString& aProp,
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::SetPropertyAsAString(const nsAString& aProp,
+nsHashPropertyBagBase::SetPropertyAsAString(const nsAString& aProp,
                                         const nsAString& aValue)
 {
   nsCOMPtr<nsIWritableVariant> var = new nsVariant();
@@ -248,7 +230,7 @@ nsHashPropertyBag::SetPropertyAsAString(const nsAString& aProp,
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::SetPropertyAsACString(const nsAString& aProp,
+nsHashPropertyBagBase::SetPropertyAsACString(const nsAString& aProp,
                                          const nsACString& aValue)
 {
   nsCOMPtr<nsIWritableVariant> var = new nsVariant();
@@ -257,7 +239,7 @@ nsHashPropertyBag::SetPropertyAsACString(const nsAString& aProp,
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::SetPropertyAsAUTF8String(const nsAString& aProp,
+nsHashPropertyBagBase::SetPropertyAsAUTF8String(const nsAString& aProp,
                                             const nsACString& aValue)
 {
   nsCOMPtr<nsIWritableVariant> var = new nsVariant();
@@ -266,7 +248,7 @@ nsHashPropertyBag::SetPropertyAsAUTF8String(const nsAString& aProp,
 }
 
 NS_IMETHODIMP
-nsHashPropertyBag::SetPropertyAsInterface(const nsAString& aProp,
+nsHashPropertyBagBase::SetPropertyAsInterface(const nsAString& aProp,
                                           nsISupports* aValue)
 {
   nsCOMPtr<nsIWritableVariant> var = new nsVariant();
@@ -274,3 +256,36 @@ nsHashPropertyBag::SetPropertyAsInterface(const nsAString& aProp,
   return SetProperty(aProp, var);
 }
 
+
+/*
+ * nsHashPropertyBag implementation.
+ */
+
+NS_IMPL_ADDREF(nsHashPropertyBag)
+NS_IMPL_RELEASE(nsHashPropertyBag)
+
+NS_INTERFACE_MAP_BEGIN(nsHashPropertyBag)
+  NS_INTERFACE_MAP_ENTRY(nsIWritablePropertyBag)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsIPropertyBag, nsIWritablePropertyBag)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIWritablePropertyBag)
+  NS_INTERFACE_MAP_ENTRY(nsIPropertyBag2)
+  NS_INTERFACE_MAP_ENTRY(nsIWritablePropertyBag2)
+NS_INTERFACE_MAP_END
+
+
+/*
+ * nsHashPropertyBagCC implementation.
+ */
+
+NS_IMPL_CYCLE_COLLECTION(nsHashPropertyBagCC, mPropertyHash)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsHashPropertyBagCC)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsHashPropertyBagCC)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsHashPropertyBagCC)
+  NS_INTERFACE_MAP_ENTRY(nsIWritablePropertyBag)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsIPropertyBag, nsIWritablePropertyBag)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIWritablePropertyBag)
+  NS_INTERFACE_MAP_ENTRY(nsIPropertyBag2)
+  NS_INTERFACE_MAP_ENTRY(nsIWritablePropertyBag2)
+NS_INTERFACE_MAP_END
diff --git a/xpcom/ds/nsHashPropertyBag.h b/xpcom/ds/nsHashPropertyBag.h
index 76b48d0b1f9..df322f0471a 100644
--- a/xpcom/ds/nsHashPropertyBag.h
+++ b/xpcom/ds/nsHashPropertyBag.h
@@ -1,4 +1,5 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -9,16 +10,16 @@
 #include "nsIVariant.h"
 #include "nsIWritablePropertyBag.h"
 #include "nsIWritablePropertyBag2.h"
+
+#include "nsCycleCollectionParticipant.h"
 #include "nsInterfaceHashtable.h"
 
-class nsHashPropertyBag
+class nsHashPropertyBagBase
   : public nsIWritablePropertyBag
   , public nsIWritablePropertyBag2
 {
 public:
-  nsHashPropertyBag() {}
-
-  NS_DECL_THREADSAFE_ISUPPORTS
+  nsHashPropertyBagBase() {}
 
   NS_DECL_NSIPROPERTYBAG
   NS_DECL_NSIPROPERTYBAG2
@@ -29,12 +30,28 @@ public:
 protected:
   // a hash table of string -> nsIVariant
   nsInterfaceHashtable<nsStringHashKey, nsIVariant> mPropertyHash;
+};
 
+class nsHashPropertyBag : public nsHashPropertyBagBase
+{
+public:
+  nsHashPropertyBag() {}
+  NS_DECL_THREADSAFE_ISUPPORTS
+
+protected:
   virtual ~nsHashPropertyBag() {}
 };
 
-// Note: NS_NewHashPropertyBag returns a HPB that
-// uses a non-thread-safe internal hash
-extern "C" nsresult NS_NewHashPropertyBag(nsIWritablePropertyBag** aResult);
+/* A cycle collected nsHashPropertyBag for main-thread-only use. */
+class nsHashPropertyBagCC MOZ_FINAL : public nsHashPropertyBagBase
+{
+public:
+  nsHashPropertyBagCC() {}
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsHashPropertyBagCC,
+                                           nsIWritablePropertyBag)
+protected:
+  virtual ~nsHashPropertyBagCC() {}
+};
 
 #endif /* nsHashPropertyBag_h___ */
diff --git a/xpcom/glue/moz.build b/xpcom/glue/moz.build
index 9a43c7436d1..b07fea4a893 100644
--- a/xpcom/glue/moz.build
+++ b/xpcom/glue/moz.build
@@ -78,7 +78,6 @@ EXPORTS.mozilla += [
     'Mutex.h',
     'Observer.h',
     'ReentrantMonitor.h',
-    'unused.h',
 ]
 
 EXPORTS.mozilla.threads += [
diff --git a/xpcom/glue/objs.mozbuild b/xpcom/glue/objs.mozbuild
index f71b2b87218..7af72494343 100644
--- a/xpcom/glue/objs.mozbuild
+++ b/xpcom/glue/objs.mozbuild
@@ -43,7 +43,6 @@ xpcom_gluens_src_lcppsrcs = [
     'GenericFactory.cpp',
     'nsProxyRelease.cpp',
     'nsTextFormatter.cpp',
-    'unused.cpp',
 ]
 
 xpcom_gluens_src_cppsrcs = [
diff --git a/xpcom/io/nsEscape.cpp b/xpcom/io/nsEscape.cpp
index c57191dbb99..8233ae1d498 100644
--- a/xpcom/io/nsEscape.cpp
+++ b/xpcom/io/nsEscape.cpp
@@ -319,7 +319,7 @@ const int EscapeChars[256] =
      0,1023,   0, 512,1023,   0,1023,   0,1023,1023,1023,1023,1023,1023, 953, 784,  /* 2x   !"#$%&'()*+,-./  */
   1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1008,1008,   0,1008,   0, 768,  /* 3x  0123456789:;<=>?  */
   1008,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,  /* 4x  @ABCDEFGHIJKLMNO  */
-  1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023, 896, 896, 896, 896,1023,  /* 5x  PQRSTUVWXYZ[\]^_  */
+  1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,   0, 896,   0, 896,1023,  /* 5x  PQRSTUVWXYZ[\]^_  */
      0,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,  /* 6x  `abcdefghijklmno  */
   1023,1023,1023,1023,1023,1023,1023,1023,1023,1023,1023, 896,1012, 896,1023,   0,  /* 7x  pqrstuvwxyz{|}~   */
      0    /* 8x  DEL               */
diff --git a/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp b/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp
index b4b68088070..b18e46e2985 100644
--- a/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp
+++ b/xpcom/reflect/xptinfo/ShimInterfaceInfo.cpp
@@ -129,7 +129,6 @@
 #include "nsIDOMText.h"
 #include "nsIDOMTimeEvent.h"
 #include "nsIDOMTimeRanges.h"
-#include "nsIDOMTouchEvent.h"
 #include "nsIDOMTransitionEvent.h"
 #include "nsIDOMTreeWalker.h"
 #include "nsIDOMUIEvent.h"
diff --git a/xpcom/tests/TestThreadUtils.cpp b/xpcom/tests/TestThreadUtils.cpp
index 98ad43ebcef..e358cade73f 100644
--- a/xpcom/tests/TestThreadUtils.cpp
+++ b/xpcom/tests/TestThreadUtils.cpp
@@ -31,17 +31,11 @@ class nsFoo : public nsISupports {
     *aBool = true;
     return NS_OK;
   }
+
+private:
   virtual ~nsFoo() {}
 };
 
-namespace mozilla {
-template<>
-struct HasDangerousPublicDestructor<nsFoo>
-{
-  static const bool value = true;
-};
-}
-
 NS_IMPL_ISUPPORTS0(nsFoo)
 
 class TestSuicide : public nsRunnable {
@@ -129,7 +123,7 @@ int main(int argc, char** argv)
 
     // This pointer will be freed at the end of the block
     // Do not dereference this pointer in the runnable method!
-    nsFoo * rawFoo = new nsFoo();
+    nsRefPtr<nsFoo> rawFoo = new nsFoo();
 
     // Read only string. Dereferencing in runnable method to check this works.
     char* message = (char*)"Test message";
@@ -152,8 +146,6 @@ int main(int argc, char** argv)
     NS_DispatchToMainThread(NS_NewRunnableMethodWithArg<nsFoo*>(bar, &nsBar::DoBar5std, rawFoo));
     NS_DispatchToMainThread(NS_NewRunnableMethodWithArg<char*>(bar, &nsBar::DoBar6std, message));
 #endif
-
-    delete rawFoo;
   }
 
   // Spin the event loop