diff --git a/accessible/src/jsat/AccessFu.jsm b/accessible/src/jsat/AccessFu.jsm
index 3b27e431417..263c85d097a 100644
--- a/accessible/src/jsat/AccessFu.jsm
+++ b/accessible/src/jsat/AccessFu.jsm
@@ -542,7 +542,7 @@ var Input = {
     switch (gestureName) {
       case 'dwell1':
       case 'explore1':
-        this.moveCursor('moveToPoint', 'Simple', 'gesture',
+        this.moveCursor('moveToPoint', 'SimpleTouch', 'gesture',
                         aGesture.x, aGesture.y);
         break;
       case 'doubletap1':
diff --git a/accessible/src/jsat/EventManager.jsm b/accessible/src/jsat/EventManager.jsm
index 1cee5f4681e..04357d84f58 100644
--- a/accessible/src/jsat/EventManager.jsm
+++ b/accessible/src/jsat/EventManager.jsm
@@ -57,8 +57,7 @@ this.EventManager.prototype = {
       this.present(Presentation.tabStateChanged(null, 'newtab'));
 
     } catch (x) {
-      Logger.error('Failed to start EventManager');
-      Logger.logException(x);
+      Logger.logException(x, 'Failed to start EventManager');
     }
   },
 
@@ -117,8 +116,7 @@ this.EventManager.prototype = {
       }
       }
     } catch (x) {
-      Logger.error('Error handling DOM event');
-      Logger.logException(x);
+      Logger.logException(x, 'Error handling DOM event');
     }
   },
 
@@ -140,7 +138,7 @@ this.EventManager.prototype = {
         let pivot = aEvent.accessible.
           QueryInterface(Ci.nsIAccessibleDocument).virtualCursor;
         let position = pivot.position;
-        if (position.role == Ci.nsIAccessibleRole.ROLE_INTERNAL_FRAME)
+        if (position && position.role == Ci.nsIAccessibleRole.ROLE_INTERNAL_FRAME)
           break;
         let event = aEvent.
           QueryInterface(Ci.nsIAccessibleVirtualCursorChangeEvent);
@@ -421,8 +419,7 @@ const AccessibilityEventObserver = {
     try {
       eventManager.handleAccEvent(event);
     } catch (x) {
-      Logger.error('Error handing accessible event');
-      Logger.logException(x);
+      Logger.logException(x, 'Error handing accessible event');
     } finally {
       return;
     }
diff --git a/accessible/src/jsat/OutputGenerator.jsm b/accessible/src/jsat/OutputGenerator.jsm
index a6af8561d65..de1ce6fd473 100644
--- a/accessible/src/jsat/OutputGenerator.jsm
+++ b/accessible/src/jsat/OutputGenerator.jsm
@@ -22,6 +22,11 @@ XPCOMUtils.defineLazyModuleGetter(this, 'Utils',
   'resource://gre/modules/accessibility/Utils.jsm');
 XPCOMUtils.defineLazyModuleGetter(this, 'PrefCache',
   'resource://gre/modules/accessibility/Utils.jsm');
+XPCOMUtils.defineLazyModuleGetter(this, 'Logger',
+  'resource://gre/modules/accessibility/Utils.jsm');
+XPCOMUtils.defineLazyModuleGetter(this, 'PluralForm',
+  'resource://gre/modules/PluralForm.jsm');
+
 
 let gUtteranceOrder = new PrefCache('accessibility.accessfu.utterance');
 
@@ -46,7 +51,7 @@ this.OutputGenerator = {
     let output = [];
     let self = this;
     let addOutput = function addOutput(aAccessible) {
-      output.push.apply(output, self.genForObject(aAccessible));
+      output.push.apply(output, self.genForObject(aAccessible, aContext));
     };
     let ignoreSubtree = function ignoreSubtree(aAccessible) {
       let roleString = Utils.AccRetrieval.getStringRole(aAccessible.role);
@@ -83,14 +88,18 @@ this.OutputGenerator = {
    * Generates output for an object.
    * @param {nsIAccessible} aAccessible accessible object to generate utterance
    *    for.
+   * @param {PivotContext} aContext object that generates and caches
+   *    context information for a given accessible and its relationship with
+   *    another accessible.
    * @return {Array} Two string array. The first string describes the object
    *    and its states. The second string is the object's name. Whether the
    *    object's description or it's role is included is determined by
    *    {@link roleRuleMap}.
    */
-  genForObject: function genForObject(aAccessible) {
+  genForObject: function genForObject(aAccessible, aContext) {
     let roleString = Utils.AccRetrieval.getStringRole(aAccessible.role);
-    let func = this.objectOutputFunctions[roleString.replace(' ', '')] ||
+    let func = this.objectOutputFunctions[
+      OutputGenerator._getOutputName(roleString)] ||
       this.objectOutputFunctions.defaultFunc;
 
     let flags = this.roleRuleMap[roleString] || 0;
@@ -103,7 +112,7 @@ this.OutputGenerator = {
     aAccessible.getState(state, extState);
     let states = {base: state.value, ext: extState.value};
 
-    return func.apply(this, [aAccessible, roleString, states, flags]);
+    return func.apply(this, [aAccessible, roleString, states, flags, aContext]);
   },
 
   /**
@@ -158,10 +167,20 @@ this.OutputGenerator = {
     }
   },
 
+  _getOutputName: function _getOutputName(aName) {
+    return aName.replace(' ', '');
+  },
+
   _getLocalizedRole: function _getLocalizedRole(aRoleStr) {},
 
   _getLocalizedStates: function _getLocalizedStates(aStates) {},
 
+  _getPluralFormString: function _getPluralFormString(aString, aCount) {
+    let str = gStringBundle.GetStringFromName(this._getOutputName(aString));
+    str = PluralForm.get(aCount, str);
+    return str.replace('#1', aCount);
+  },
+
   roleRuleMap: {
     'menubar': INCLUDE_DESC,
     'scrollbar': INCLUDE_DESC,
@@ -170,10 +189,11 @@ this.OutputGenerator = {
     'menupopup': INCLUDE_DESC,
     'menuitem': INCLUDE_DESC | NAME_FROM_SUBTREE_RULE,
     'tooltip': INCLUDE_DESC | NAME_FROM_SUBTREE_RULE,
-    'columnheader': NAME_FROM_SUBTREE_RULE,
-    'rowheader': NAME_FROM_SUBTREE_RULE,
+    'columnheader': INCLUDE_DESC | NAME_FROM_SUBTREE_RULE,
+    'rowheader': INCLUDE_DESC | NAME_FROM_SUBTREE_RULE,
     'column': NAME_FROM_SUBTREE_RULE,
     'row': NAME_FROM_SUBTREE_RULE,
+    'cell': INCLUDE_DESC | INCLUDE_NAME,
     'application': INCLUDE_NAME,
     'document': INCLUDE_NAME,
     'grouping': INCLUDE_DESC | INCLUDE_NAME,
@@ -263,6 +283,32 @@ this.OutputGenerator = {
       this._addName(output, aAccessible, aFlags);
 
       return output;
+    },
+
+    table: function table(aAccessible, aRoleStr, aStates, aFlags) {
+      let output = [];
+      let table;
+      try {
+        table = aAccessible.QueryInterface(Ci.nsIAccessibleTable);
+      } catch (x) {
+        Logger.logException(x);
+        return output;
+      } finally {
+        // Check if it's a layout table, and bail out if true.
+        // We don't want to speak any table information for layout tables.
+        if (table.isProbablyForLayout()) {
+          return output;
+        }
+        let tableColumnInfo = this._getPluralFormString('tableColumnInfo',
+          table.columnCount);
+        let tableRowInfo = this._getPluralFormString('tableRowInfo',
+          table.rowCount);
+        output.push(gStringBundle.formatStringFromName(
+          this._getOutputName('tableInfo'), [this._getLocalizedRole(aRoleStr),
+            tableColumnInfo, tableRowInfo], 3));
+        this._addName(output, aAccessible, aFlags);
+        return output;
+      }
     }
   }
 };
@@ -341,12 +387,11 @@ this.UtteranceGenerator = {
   },
 
   objectOutputFunctions: {
-    defaultFunc: function defaultFunc(aAccessible, aRoleStr, aStates, aFlags) {
-      return OutputGenerator.objectOutputFunctions._generateBaseOutput.apply(this, arguments);
-    },
 
-    entry: function entry(aAccessible, aRoleStr, aStates, aFlags) {
-      return OutputGenerator.objectOutputFunctions.entry.apply(this, arguments);
+    __proto__: OutputGenerator.objectOutputFunctions,
+
+    defaultFunc: function defaultFunc(aAccessible, aRoleStr, aStates, aFlags) {
+      return this.objectOutputFunctions._generateBaseOutput.apply(this, arguments);
     },
 
     heading: function heading(aAccessible, aRoleStr, aStates, aFlags) {
@@ -392,6 +437,53 @@ this.UtteranceGenerator = {
           [aAccessible, aRoleStr, aStates, aFlags]);
 
       return [];
+    },
+
+    cell: function cell(aAccessible, aRoleStr, aStates, aFlags, aContext) {
+      let utterance = [];
+      let cell = aContext.getCellInfo(aAccessible);
+      if (cell) {
+        let desc = [];
+        let addCellChanged = function addCellChanged(aDesc, aChanged, aString, aIndex) {
+          if (aChanged) {
+            aDesc.push(gStringBundle.formatStringFromName(aString,
+              [aIndex + 1], 1));
+          }
+        };
+        let addExtent = function addExtent(aDesc, aExtent, aString) {
+          if (aExtent > 1) {
+            aDesc.push(gStringBundle.formatStringFromName(aString,
+              [aExtent], 1));
+          }
+        };
+        let addHeaders = function addHeaders(aDesc, aHeaders) {
+          if (aHeaders.length > 0) {
+            aDesc.push.apply(aDesc, aHeaders);
+          }
+        };
+
+        addCellChanged(desc, cell.columnChanged, 'columnInfo', cell.columnIndex);
+        addCellChanged(desc, cell.rowChanged, 'rowInfo', cell.rowIndex);
+
+        addExtent(desc, cell.columnExtent, 'spansColumns');
+        addExtent(desc, cell.rowExtent, 'spansRows');
+
+        addHeaders(desc, cell.columnHeaders);
+        addHeaders(desc, cell.rowHeaders);
+
+        utterance.push(desc.join(' '));
+      }
+
+      this._addName(utterance, aAccessible, aFlags);
+      return utterance;
+    },
+
+    columnheader: function columnheader() {
+      return this.objectOutputFunctions.cell.apply(this, arguments);
+    },
+
+    rowheader: function rowheader() {
+      return this.objectOutputFunctions.cell.apply(this, arguments);
     }
   },
 
@@ -401,7 +493,7 @@ this.UtteranceGenerator = {
 
   _getLocalizedRole: function _getLocalizedRole(aRoleStr) {
     try {
-      return gStringBundle.GetStringFromName(aRoleStr.replace(' ', ''));
+      return gStringBundle.GetStringFromName(this._getOutputName(aRoleStr));
     } catch (x) {
       return '';
     }
@@ -467,8 +559,11 @@ this.BrailleGenerator = {
   defaultOutputOrder: OUTPUT_DESC_LAST,
 
   objectOutputFunctions: {
+
+    __proto__: OutputGenerator.objectOutputFunctions,
+
     defaultFunc: function defaultFunc(aAccessible, aRoleStr, aStates, aFlags) {
-      let braille = OutputGenerator.objectOutputFunctions._generateBaseOutput.apply(this, arguments);
+      let braille = this.objectOutputFunctions._generateBaseOutput.apply(this, arguments);
 
       if (aAccessible.indexInParent === 1 &&
           aAccessible.parent.role == Ci.nsIAccessibleRole.ROLE_LISTITEM &&
@@ -492,6 +587,38 @@ this.BrailleGenerator = {
       return braille;
     },
 
+    cell: function cell(aAccessible, aRoleStr, aStates, aFlags, aContext) {
+      let braille = [];
+      let cell = aContext.getCellInfo(aAccessible);
+      if (cell) {
+        let desc = [];
+        let addHeaders = function addHeaders(aDesc, aHeaders) {
+          if (aHeaders.length > 0) {
+            aDesc.push.apply(aDesc, aHeaders);
+          }
+        };
+
+        desc.push(gStringBundle.formatStringFromName(
+          this._getOutputName('cellInfo'), [cell.columnIndex + 1,
+            cell.rowIndex + 1], 2));
+
+        addHeaders(desc, cell.columnHeaders);
+        addHeaders(desc, cell.rowHeaders);
+        braille.push(desc.join(' '));
+      }
+
+      this._addName(braille, aAccessible, aFlags);
+      return braille;
+    },
+
+    columnheader: function columnheader() {
+      return this.objectOutputFunctions.cell.apply(this, arguments);
+    },
+
+    rowheader: function rowheader() {
+      return this.objectOutputFunctions.cell.apply(this, arguments);
+    },
+
     statictext: function statictext(aAccessible, aRoleStr, aStates, aFlags) {
       // Since we customize the list bullet's output, we add the static
       // text from the first node in each listitem, so skip it here.
@@ -523,10 +650,6 @@ this.BrailleGenerator = {
 
     togglebutton: function radiobutton(aAccessible, aRoleStr, aStates, aFlags) {
       return this.objectOutputFunctions._useStateNotRole.apply(this, arguments);
-    },
-
-    entry: function entry(aAccessible, aRoleStr, aStates, aFlags) {
-      return OutputGenerator.objectOutputFunctions.entry.apply(this, arguments);
     }
   },
 
@@ -538,12 +661,17 @@ this.BrailleGenerator = {
     return [];
   },
 
+  _getOutputName: function _getOutputName(aName) {
+    return OutputGenerator._getOutputName(aName) + 'Abbr';
+  },
+
   _getLocalizedRole: function _getLocalizedRole(aRoleStr) {
     try {
-      return gStringBundle.GetStringFromName(aRoleStr.replace(' ', '') + 'Abbr');
+      return gStringBundle.GetStringFromName(this._getOutputName(aRoleStr));
     } catch (x) {
       try {
-        return gStringBundle.GetStringFromName(aRoleStr.replace(' ', ''));
+        return gStringBundle.GetStringFromName(
+          OutputGenerator._getOutputName(aRoleStr));
       } catch (y) {
         return '';
       }
diff --git a/accessible/src/jsat/Presentation.jsm b/accessible/src/jsat/Presentation.jsm
index 7aa20884dbb..b88a934b201 100644
--- a/accessible/src/jsat/Presentation.jsm
+++ b/accessible/src/jsat/Presentation.jsm
@@ -155,7 +155,7 @@ VisualPresenter.prototype = {
         }
       };
     } catch (e) {
-      Logger.error('Failed to get bounds: ' + e);
+      Logger.logException(e, 'Failed to get bounds');
       return null;
     }
   },
@@ -398,6 +398,19 @@ SpeechPresenter.prototype = {
         ]
       }
     };
+  },
+
+  actionInvoked: function SpeechPresenter_actionInvoked(aObject, aActionName) {
+    return {
+      type: this.type,
+      details: {
+        actions: [
+          {method: 'speak',
+           data: UtteranceGenerator.genForAction(aObject, aActionName).join(' '),
+           options: {enqueue: false}}
+        ]
+      }
+    };
   }
 };
 
diff --git a/accessible/src/jsat/TraversalRules.jsm b/accessible/src/jsat/TraversalRules.jsm
index 4631d9ee3e5..5bb6fcb8ea9 100644
--- a/accessible/src/jsat/TraversalRules.jsm
+++ b/accessible/src/jsat/TraversalRules.jsm
@@ -9,6 +9,10 @@ const Ci = Components.interfaces;
 const Cu = Components.utils;
 const Cr = Components.results;
 
+const FILTER_IGNORE = Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+const FILTER_MATCH = Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+const FILTER_IGNORE_SUBTREE = Ci.nsIAccessibleTraversalRule.FILTER_IGNORE_SUBTREE;
+
 this.EXPORTED_SYMBOLS = ['TraversalRules'];
 
 Cu.import('resource://gre/modules/accessibility/Utils.jsm');
@@ -35,14 +39,13 @@ BaseTraversalRule.prototype = {
     {
       if (aAccessible.role == Ci.nsIAccessibleRole.ROLE_INTERNAL_FRAME) {
         return (Utils.getMessageManager(aAccessible.DOMNode)) ?
-          Ci.nsIAccessibleTraversalRule.FILTER_MATCH :
-          Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+          FILTER_MATCH  | FILTER_IGNORE_SUBTREE : FILTER_IGNORE;
       }
 
       if (this._matchFunc)
         return this._matchFunc(aAccessible);
 
-      return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+      return FILTER_MATCH;
     },
 
     QueryInterface: XPCOMUtils.generateQI([Ci.nsIAccessibleTraversalRule])
@@ -78,40 +81,40 @@ this.TraversalRules = {
       case Ci.nsIAccessibleRole.ROLE_COMBOBOX:
         // We don't want to ignore the subtree because this is often
         // where the list box hangs out.
-        return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+        return FILTER_MATCH;
       case Ci.nsIAccessibleRole.ROLE_TEXT_LEAF:
         {
           // Nameless text leaves are boring, skip them.
           let name = aAccessible.name;
           if (name && name.trim())
-            return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+            return FILTER_MATCH;
           else
-            return Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+            return FILTER_IGNORE;
         }
       case Ci.nsIAccessibleRole.ROLE_LINK:
         // If the link has children we should land on them instead.
         // Image map links don't have children so we need to match those.
         if (aAccessible.childCount == 0)
-          return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+          return FILTER_MATCH;
         else
-          return Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+          return FILTER_IGNORE;
       case Ci.nsIAccessibleRole.ROLE_STATICTEXT:
         {
           let parent = aAccessible.parent;
           // Ignore prefix static text in list items. They are typically bullets or numbers.
           if (parent.childCount > 1 && aAccessible.indexInParent == 0 &&
               parent.role == Ci.nsIAccessibleRole.ROLE_LISTITEM)
-            return Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+            return FILTER_IGNORE;
 
-          return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+          return FILTER_MATCH;
         }
       case Ci.nsIAccessibleRole.ROLE_GRAPHIC:
         return TraversalRules._shouldSkipImage(aAccessible);
       default:
         // Ignore the subtree, if there is one. So that we don't land on
         // the same content that was already presented by its parent.
-        return Ci.nsIAccessibleTraversalRule.FILTER_MATCH |
-          Ci.nsIAccessibleTraversalRule.FILTER_IGNORE_SUBTREE;
+        return FILTER_MATCH |
+          FILTER_IGNORE_SUBTREE;
       }
     }
   ),
@@ -119,8 +122,8 @@ this.TraversalRules = {
   SimpleTouch: new BaseTraversalRule(
     gSimpleTraversalRoles,
     function Simple_match(aAccessible) {
-      return Ci.nsIAccessibleTraversalRule.FILTER_MATCH |
-        Ci.nsIAccessibleTraversalRule.FILTER_IGNORE_SUBTREE;
+      return FILTER_MATCH |
+        FILTER_IGNORE_SUBTREE;
     }
   ),
 
@@ -133,9 +136,9 @@ this.TraversalRules = {
       let extraState = {};
       aAccessible.getState(state, extraState);
       if (state.value & Ci.nsIAccessibleStates.STATE_LINKED) {
-        return Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+        return FILTER_IGNORE;
       } else {
-        return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+        return FILTER_MATCH;
       }
     }),
 
@@ -193,9 +196,9 @@ this.TraversalRules = {
       let extraState = {};
       aAccessible.getState(state, extraState);
       if (state.value & Ci.nsIAccessibleStates.STATE_LINKED) {
-        return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+        return FILTER_MATCH;
       } else {
-        return Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+        return FILTER_IGNORE;
       }
     }),
 
@@ -222,8 +225,8 @@ this.TraversalRules = {
 
   _shouldSkipImage: function _shouldSkipImage(aAccessible) {
     if (gSkipEmptyImages.value && aAccessible.name === '') {
-      return Ci.nsIAccessibleTraversalRule.FILTER_IGNORE;
+      return FILTER_IGNORE;
     }
-    return Ci.nsIAccessibleTraversalRule.FILTER_MATCH;
+    return FILTER_MATCH;
   }
 };
diff --git a/accessible/src/jsat/Utils.jsm b/accessible/src/jsat/Utils.jsm
index cae5a133cb5..2ec09473771 100644
--- a/accessible/src/jsat/Utils.jsm
+++ b/accessible/src/jsat/Utils.jsm
@@ -191,15 +191,18 @@ this.Utils = {
   },
 
   getAttributes: function getAttributes(aAccessible) {
-    let attributesEnum = aAccessible.attributes.enumerate();
     let attributes = {};
 
-    // Populate |attributes| object with |aAccessible|'s attribute key-value
-    // pairs.
-    while (attributesEnum.hasMoreElements()) {
-      let attribute = attributesEnum.getNext().QueryInterface(
-        Ci.nsIPropertyElement);
-      attributes[attribute.key] = attribute.value;
+    if (aAccessible && aAccessible.attributes) {
+      let attributesEnum = aAccessible.attributes.enumerate();
+
+      // Populate |attributes| object with |aAccessible|'s attribute key-value
+      // pairs.
+      while (attributesEnum.hasMoreElements()) {
+        let attribute = attributesEnum.getNext().QueryInterface(
+          Ci.nsIPropertyElement);
+        attributes[attribute.key] = attribute.value;
+      }
     }
 
     return attributes;
@@ -268,12 +271,27 @@ this.Logger = {
       this, [this.ERROR].concat(Array.prototype.slice.call(arguments)));
   },
 
-  logException: function logException(aException) {
+  logException: function logException(
+    aException, aErrorMessage = 'An exception has occured') {
     try {
-      let args = [aException.message];
-      args.push.apply(args, aException.stack ? ['\n', aException.stack] :
-        ['(' + aException.fileName + ':' + aException.lineNumber + ')']);
-      this.error.apply(this, args);
+      let stackMessage = '';
+      if (aException.stack) {
+        stackMessage = '  ' + aException.stack.replace(/\n/g, '\n  ');
+      } else if (aException.location) {
+        let frame = aException.location;
+        let stackLines = [];
+        while (frame && frame.lineNumber) {
+          stackLines.push(
+            '  ' + frame.name + '@' + frame.filename + ':' + frame.lineNumber);
+          frame = frame.caller;
+        }
+        stackMessage = stackLines.join('\n');
+      } else {
+        stackMessage = '(' + aException.fileName + ':' + aException.lineNumber + ')';
+      }
+      this.error(aErrorMessage + ':\n ' +
+                 aException.message + '\n' +
+                 stackMessage);
     } catch (x) {
       this.error(x);
     }
@@ -350,6 +368,45 @@ PivotContext.prototype = {
     return this._oldAccessible;
   },
 
+  /**
+   * Get a list of |aAccessible|'s ancestry up to the root.
+   * @param  {nsIAccessible} aAccessible.
+   * @return {Array} Ancestry list.
+   */
+  _getAncestry: function _getAncestry(aAccessible) {
+    let ancestry = [];
+    let parent = aAccessible;
+    while (parent && (parent = parent.parent)) {
+      ancestry.push(parent);
+    }
+    return ancestry.reverse();
+  },
+
+  /**
+   * A list of the old accessible's ancestry.
+   */
+  get oldAncestry() {
+    if (!this._oldAncestry) {
+      if (!this._oldAccessible) {
+        this._oldAncestry = [];
+      } else {
+        this._oldAncestry = this._getAncestry(this._oldAccessible);
+        this._oldAncestry.push(this._oldAccessible);
+      }
+    }
+    return this._oldAncestry;
+  },
+
+  /**
+   * A list of the current accessible's ancestry.
+   */
+  get currentAncestry() {
+    if (!this._currentAncestry) {
+      this._currentAncestry = this._getAncestry(this._accessible);
+    }
+    return this._currentAncestry;
+  },
+
   /*
    * This is a list of the accessible's ancestry up to the common ancestor
    * of the accessible and the old accessible. It is useful for giving the
@@ -357,32 +414,10 @@ PivotContext.prototype = {
    */
   get newAncestry() {
     if (!this._newAncestry) {
-      let newLineage = [];
-      let oldLineage = [];
-
-      let parent = this._accessible;
-      while (parent && (parent = parent.parent))
-        newLineage.push(parent);
-
-      parent = this._oldAccessible;
-      while (parent && (parent = parent.parent))
-        oldLineage.push(parent);
-
-      this._newAncestry = [];
-
-      while (true) {
-        let newAncestor = newLineage.pop();
-        let oldAncestor = oldLineage.pop();
-
-        if (newAncestor == undefined)
-          break;
-
-        if (newAncestor != oldAncestor)
-          this._newAncestry.push(newAncestor);
-      }
-
+      this._newAncestry = [currentAncestor for (
+        [index, currentAncestor] of Iterator(this.currentAncestry)) if (
+          currentAncestor !== this.oldAncestry[index])];
     }
-
     return this._newAncestry;
   },
 
@@ -426,6 +461,99 @@ PivotContext.prototype = {
     return this._traverse(this._accessible, aPreorder, aStop);
   },
 
+  getCellInfo: function getCellInfo(aAccessible) {
+    if (!this._cells) {
+      this._cells = new WeakMap();
+    }
+
+    let domNode = aAccessible.DOMNode;
+    if (this._cells.has(domNode)) {
+      return this._cells.get(domNode);
+    }
+
+    let cellInfo = {};
+    let getAccessibleCell = function getAccessibleCell(aAccessible) {
+      if (!aAccessible) {
+        return null;
+      }
+      if ([Ci.nsIAccessibleRole.ROLE_CELL,
+           Ci.nsIAccessibleRole.ROLE_COLUMNHEADER,
+           Ci.nsIAccessibleRole.ROLE_ROWHEADER].indexOf(
+             aAccessible.role) < 0) {
+        return null;
+      }
+      try {
+        return aAccessible.QueryInterface(Ci.nsIAccessibleTableCell);
+      } catch (x) {
+        Logger.logException(x);
+        return null;
+      }
+    };
+    let getHeaders = function getHeaders(aHeaderCells) {
+      let enumerator = aHeaderCells.enumerate();
+      while (enumerator.hasMoreElements()) {
+        yield enumerator.getNext().QueryInterface(Ci.nsIAccessible).name;
+      }
+    };
+
+    cellInfo.current = getAccessibleCell(aAccessible);
+
+    if (!cellInfo.current) {
+      Logger.warning(aAccessible,
+        'does not support nsIAccessibleTableCell interface.');
+      this._cells.set(domNode, null);
+      return null;
+    }
+
+    let table = cellInfo.current.table;
+    if (table.isProbablyForLayout()) {
+      this._cells.set(domNode, null);
+      return null;
+    }
+
+    cellInfo.previous = null;
+    let oldAncestry = this.oldAncestry.reverse();
+    let ancestor = oldAncestry.shift();
+    while (!cellInfo.previous && ancestor) {
+      let cell = getAccessibleCell(ancestor);
+      if (cell && cell.table === table) {
+        cellInfo.previous = cell;
+      }
+      ancestor = oldAncestry.shift();
+    }
+
+    if (cellInfo.previous) {
+      cellInfo.rowChanged = cellInfo.current.rowIndex !==
+        cellInfo.previous.rowIndex;
+      cellInfo.columnChanged = cellInfo.current.columnIndex !==
+        cellInfo.previous.columnIndex;
+    } else {
+      cellInfo.rowChanged = true;
+      cellInfo.columnChanged = true;
+    }
+
+    cellInfo.rowExtent = cellInfo.current.rowExtent;
+    cellInfo.columnExtent = cellInfo.current.columnExtent;
+    cellInfo.columnIndex = cellInfo.current.columnIndex;
+    cellInfo.rowIndex = cellInfo.current.rowIndex;
+
+    cellInfo.columnHeaders = [];
+    if (cellInfo.columnChanged && cellInfo.current.role !==
+      Ci.nsIAccessibleRole.ROLE_COLUMNHEADER) {
+      cellInfo.columnHeaders = [headers for (headers of getHeaders(
+        cellInfo.current.columnHeaderCells))];
+    }
+    cellInfo.rowHeaders = [];
+    if (cellInfo.rowChanged && cellInfo.current.role ===
+      Ci.nsIAccessibleRole.ROLE_CELL) {
+      cellInfo.rowHeaders = [headers for (headers of getHeaders(
+        cellInfo.current.rowHeaderCells))];
+    }
+
+    this._cells.set(domNode, cellInfo);
+    return cellInfo;
+  },
+
   get bounds() {
     if (!this._bounds) {
       let objX = {}, objY = {}, objW = {}, objH = {};
diff --git a/accessible/src/jsat/content-script.js b/accessible/src/jsat/content-script.js
index 8507f8c96f4..be555ff8db8 100644
--- a/accessible/src/jsat/content-script.js
+++ b/accessible/src/jsat/content-script.js
@@ -93,7 +93,7 @@ function virtualCursorControl(aMessage) {
       sendAsyncMessage('AccessFu:VirtualCursor', aMessage.json);
     }
   } catch (x) {
-    Logger.error(x);
+    Logger.logException(x, 'Failed to move virtual cursor');
   }
 }
 
diff --git a/accessible/tests/mochitest/jsat/Makefile.in b/accessible/tests/mochitest/jsat/Makefile.in
index 27378d47f7e..5b3c15583d2 100644
--- a/accessible/tests/mochitest/jsat/Makefile.in
+++ b/accessible/tests/mochitest/jsat/Makefile.in
@@ -15,9 +15,10 @@ MOCHITEST_A11Y_FILES =\
 jsatcommon.js \
 output.js \
 test_alive.html \
-test_explicit_names.html \
-test_utterance_order.html \
 test_braille.html \
+test_explicit_names.html \
+test_tables.html \
+test_utterance_order.html \
 $(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/accessible/tests/mochitest/jsat/output.js b/accessible/tests/mochitest/jsat/output.js
index 7c899171459..5ab11dc7164 100644
--- a/accessible/tests/mochitest/jsat/output.js
+++ b/accessible/tests/mochitest/jsat/output.js
@@ -37,7 +37,8 @@ function testContextOutput(expected, aAccOrElmOrID, aOldAccOrElmOrID, aGenerator
  */
 function testObjectOutput(aAccOrElmOrID, aGenerator) {
   var accessible = getAccessible(aAccOrElmOrID);
-  var output = aGenerator.genForObject(accessible);
+  var context = new PivotContext(accessible);
+  var output = aGenerator.genForObject(accessible, context);
   var outputOrder;
   try {
     outputOrder = SpecialPowers.getIntPref(PREF_UTTERANCE_ORDER);
diff --git a/accessible/tests/mochitest/jsat/test_explicit_names.html b/accessible/tests/mochitest/jsat/test_explicit_names.html
index a0a234eef29..c82cd86f702 100644
--- a/accessible/tests/mochitest/jsat/test_explicit_names.html
+++ b/accessible/tests/mochitest/jsat/test_explicit_names.html
@@ -54,9 +54,10 @@
         expected: ["list 2 items", "Test List", "Last item", "2.", "list two"]
       }, {
         accOrElmOrID: "cell",
-        expected: ["table", "Fruits and vegetables", "List of Fruits",
-          "list 4 items","First item", "link", "Apples", "link", "Bananas",
-          "link", "Peaches", "Last item", "link", "Plums"]
+        expected: ["table with 1 column and 1 row", "Fruits and vegetables",
+          "Column 1 Row 1", "List of Fruits", "list 4 items", "First item",
+          "link", "Apples", "link", "Bananas", "link", "Peaches", "Last item",
+          "link", "Plums"]
       }, {
         accOrElmOrID: "app.net",
         expected: ["list 2 items", "First item", "link", "star", "Last item",
@@ -71,13 +72,12 @@
         // Test pivot to li_one from list.
         accOrElmOrID: "li_one",
         oldAccOrElmOrID: "list",
-        expected: ["list 2 items", "Test List", "First item", "Top of the list"]
+        expected: ["First item", "Top of the list"]
       }, {
         // Test pivot to "apples" link from the table cell.
         accOrElmOrID: "apples",
         oldAccOrElmOrID: "cell",
-        expected: ["List of Fruits", "list 4 items", "First item", "link",
-          "Apples"]
+        expected: ["list 4 items", "First item", "link", "Apples"]
       }, {
         // Test pivot to the table cell from the "apples" link.
         accOrElmOrID: "cell",
diff --git a/accessible/tests/mochitest/jsat/test_tables.html b/accessible/tests/mochitest/jsat/test_tables.html
new file mode 100644
index 00000000000..ee4c700fd3b
--- /dev/null
+++ b/accessible/tests/mochitest/jsat/test_tables.html
@@ -0,0 +1,297 @@
+<html>
+<head>
+  <title>[AccessFu] Improve reading of table semantics</title>
+
+  <link rel="stylesheet" type="text/css"
+        href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+  <script type="application/javascript"
+          src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript"
+          src="../common.js"></script>
+  <script type="application/javascript"
+          src="output.js"></script>
+  <script type="application/javascript">
+
+    function doTest() {
+      // Test the following accOrElmOrID.
+      var tests = [{
+        accOrElmOrID: "table1",
+        expectedUtterance: [["table with 2 columns and 2 rows",
+          "Column 1 Row 1", "col1", "Column 2 Row 1", "col2",
+          "Column 1 Row 2 col1", "cell1", "Column 2 Row 2 col2", "cell2"], [
+          "col1", "Column 1 Row 1", "col2", "Column 2 Row 1", "cell1",
+          "Column 1 Row 2 col1", "cell2", "Column 2 Row 2 col2",
+          "table with 2 columns and 2 rows"]],
+        expectedBraille: [["tbl 2c 2r", "c1r1", "col1", "c2r1", "col2",
+          "c1r2 col1", "cell1", "c2r2 col2", "cell2"], ["col1", "c1r1", "col2",
+          "c2r1", "cell1", "c1r2 col1", "cell2", "c2r2 col2", "tbl 2c 2r"]]
+      }, {
+        accOrElmOrID: "table2",
+        expectedUtterance: [["table with 2 columns and 2 rows",
+          "Column 1 Row 1 col1", "cell1", "Column 2 Row 1 col2",
+          "table with 1 column and 2 rows", "Column 1 Row 1", "colheader",
+          "Column 1 Row 2 colheader", "bla", "Column 1 Row 2", "col1",
+          "Column 2 Row 2", "col2"], ["cell1", "Column 1 Row 1 col1",
+          "colheader", "Column 1 Row 1", "bla", "Column 1 Row 2 colheader",
+          "table with 1 column and 2 rows", "Column 2 Row 1 col2", "col1",
+          "Column 1 Row 2", "col2", "Column 2 Row 2",
+          "table with 2 columns and 2 rows"]],
+        expectedBraille: [["tbl 2c 2r", "c1r1 col1", "cell1", "c2r1 col2",
+          "tbl 1c 2r", "c1r1", "colheader", "c1r2 colheader", "bla", "c1r2",
+          "col1", "c2r2", "col2"], ["cell1", "c1r1 col1", "colheader", "c1r1",
+          "bla", "c1r2 colheader", "tbl 1c 2r", "c2r1 col2", "col1", "c1r2",
+          "col2", "c2r2", "tbl 2c 2r"]]
+      }, {
+        accOrElmOrID: "table3",
+        expectedUtterance: [["table with 2 columns and 2 rows",
+          "Column 2 Row 1 col2", "table with 1 column and 2 rows",
+          "Column 1 Row 1", "colheader", "Column 1 Row 2 colheader", "bla"], [
+          "colheader", "Column 1 Row 1", "bla", "Column 1 Row 2 colheader",
+          "table with 1 column and 2 rows", "Column 2 Row 1 col2",
+          "table with 2 columns and 2 rows"]],
+        expectedBraille: [["tbl 1c 2r", "c1r1", "colheader", "c1r2 colheader",
+          "bla"], ["colheader", "c1r1", "bla", "c1r2 colheader", "tbl 1c 2r"]]
+      }, {
+        accOrElmOrID: "table4",
+        expectedUtterance: [["table with 4 columns and 3 rows",
+          "Column 1 Row 1", "col1", "Column 2 Row 1", "col2", "Column 3 Row 1",
+          "col3", "Column 1 Row 2 spans 2 columns col1", "row1",
+          "Column 3 Row 2 col3 row1", "cell1",
+          "Column 4 Row 2 spans 2 rows row1", "cell2", "Column 1 Row 3 col1",
+          "row2", "Column 2 Row 3 col2 row2", "cell3",
+          "Column 3 Row 3 col3 row2", "cell4"], ["col1", "Column 1 Row 1",
+          "col2", "Column 2 Row 1", "col3", "Column 3 Row 1", "row1",
+          "Column 1 Row 2 spans 2 columns col1", "cell1",
+          "Column 3 Row 2 col3 row1", "cell2",
+          "Column 4 Row 2 spans 2 rows row1", "row2", "Column 1 Row 3 col1",
+          "cell3", "Column 2 Row 3 col2 row2", "cell4",
+          "Column 3 Row 3 col3 row2", "table with 4 columns and 3 rows"]],
+        expectedBraille: [["tbl 4c 3r", "c1r1", "col1", "c2r1", "col2", "c3r1",
+          "col3", "c1r2 col1", "row1", "c3r2 col3 row1", "cell1", "c4r2 row1",
+          "cell2", "c1r3 col1", "row2", "c2r3 col2 row2", "cell3",
+          "c3r3 col3 row2", "cell4"], ["col1", "c1r1", "col2", "c2r1", "col3",
+          "c3r1", "row1", "c1r2 col1", "cell1", "c3r2 col3 row1", "cell2",
+          "c4r2 row1", "row2", "c1r3 col1", "cell3", "c2r3 col2 row2", "cell4",
+          "c3r3 col3 row2", "tbl 4c 3r"]]
+      }, {
+        accOrElmOrID: "table5",
+        expectedUtterance: [["Row1", "Row2"], ["Row1", "Row2"]],
+        expectedBraille: [["Row1", "Row2"], ["Row1", "Row2"]]
+      }, {
+        // Test pivot to table1_th1 from table1.
+        accOrElmOrID: "table1_th1",
+        oldAccOrElmOrID: "table1",
+        expectedUtterance: [["Column 1 Row 1", "col1"], ["col1",
+          "Column 1 Row 1"]],
+        expectedBraille: [["c1r1", "col1"], ["col1", "c1r1"]]
+      }, {
+        // Test pivot to table1_td2 from table1.
+        accOrElmOrID: "table1_td2",
+        oldAccOrElmOrID: "table1",
+        expectedUtterance: [["Column 2 Row 2 col2", "cell2"], ["cell2",
+          "Column 2 Row 2 col2"]],
+        expectedBraille: [["c2r2 col2", "cell2"], ["cell2", "c2r2 col2"]]
+      }, {
+        // Test pivot to table1_td2 from table1_th1.
+        accOrElmOrID: "table1_td2",
+        oldAccOrElmOrID: "table1_th1",
+        expectedUtterance: [["Column 2 Row 2 col2", "cell2"], ["cell2",
+          "Column 2 Row 2 col2"]],
+        expectedBraille: [["c2r2 col2", "cell2"], ["cell2", "c2r2 col2"]]
+      }, {
+        // Test pivot to table1_td2 from table1_td1.
+        accOrElmOrID: "table1_td2",
+        oldAccOrElmOrID: "table1_td1",
+        expectedUtterance: [["Column 2 col2", "cell2"], ["cell2",
+          "Column 2 col2"]],
+        expectedBraille: [["c2r2 col2", "cell2"], ["cell2", "c2r2 col2"]]
+      }, {
+        // Test pivot to table2_cell_1 from table2.
+        accOrElmOrID: "table2_cell_1",
+        oldAccOrElmOrID: "table2",
+        expectedUtterance: [["Column 1 Row 1 col1", "cell1"], ["cell1",
+          "Column 1 Row 1 col1"]],
+        expectedBraille: [["c1r1 col1", "cell1"], ["cell1", "c1r1 col1"]]
+      }, {
+        // Test pivot to table2_cell_2 from table2.
+        accOrElmOrID: "table2_cell_2",
+        oldAccOrElmOrID: "table2",
+        expectedUtterance: [["Column 2 Row 1 col2",
+          "table with 1 column and 2 rows", "Column 1 Row 1", "colheader",
+          "Column 1 Row 2 colheader", "bla"], ["colheader", "Column 1 Row 1",
+          "bla", "Column 1 Row 2 colheader", "table with 1 column and 2 rows",
+          "Column 2 Row 1 col2"]],
+        expectedBraille: [["c2r1 col2", "tbl 1c 2r", "c1r1", "colheader",
+          "c1r2 colheader", "bla"], ["colheader", "c1r1", "bla",
+          "c1r2 colheader", "tbl 1c 2r", "c2r1 col2"]]
+      }, {
+        // Test pivot to table2_cell_1 from table2_cell_2.
+        accOrElmOrID: "table2_cell_1",
+        oldAccOrElmOrID: "table2_cell_2",
+        expectedUtterance: [["Column 1 col1", "cell1"], ["cell1",
+          "Column 1 col1"]],
+        expectedBraille: [["c1r1 col1", "cell1"], ["cell1", "c1r1 col1"]]
+      }, {
+        // Test pivot to table3_cell from table2.
+        accOrElmOrID: "table3_cell",
+        oldAccOrElmOrID: "table2",
+        expectedUtterance: [["Column 2 Row 1 col2",
+          "table with 1 column and 2 rows", "Column 1 Row 2 colheader",
+          "bla"], ["bla", "Column 1 Row 2 colheader",
+          "table with 1 column and 2 rows", "Column 2 Row 1 col2"]],
+        expectedBraille: [["c1r2 colheader", "bla"], ["bla", "c1r2 colheader"]]
+      }, {
+        // Test pivot to table3_cell from table2_cell_1.
+        accOrElmOrID: "table3_cell",
+        oldAccOrElmOrID: "table2_cell_1",
+        expectedUtterance: [["Column 2 col2", "table with 1 column and 2 rows",
+          "Column 1 Row 2 colheader", "bla"], ["bla",
+          "Column 1 Row 2 colheader", "table with 1 column and 2 rows",
+          "Column 2 Row 1 col2"]],
+        expectedBraille: [["c1r2 colheader", "bla"], ["bla", "c1r2 colheader"]]
+      }, {
+        // Test pivot to table3_cell from table3_ch.
+        accOrElmOrID: "table3_cell",
+        oldAccOrElmOrID: "table3_ch",
+        expectedUtterance: [["Row 2", "bla"], ["bla", "Row 2"]],
+        expectedBraille: [["c1r2", "bla"], ["bla", "c1r2"]]
+      }, {
+        // Test pivot to table3_cell from table1_td1.
+        accOrElmOrID: "table3_cell",
+        oldAccOrElmOrID: "table1_td1",
+        expectedUtterance: [["table with 2 columns and 2 rows",
+          "Column 2 Row 1 col2", "table with 1 column and 2 rows",
+          "Column 1 Row 2 colheader", "bla"], ["bla",
+          "Column 1 Row 2 colheader", "table with 1 column and 2 rows",
+          "Column 2 Row 1 col2", "table with 2 columns and 2 rows"]],
+        expectedBraille: [["c1r2 colheader", "bla"], ["bla", "c1r2 colheader"]]
+      }, {
+        // Test pivot to table4_ch_3 from table4.
+        accOrElmOrID: "table4_ch_3",
+        oldAccOrElmOrID: "table4",
+        expectedUtterance: [["Column 3 Row 1", "col3"], ["col3",
+          "Column 3 Row 1"]],
+        expectedBraille: [["c3r1", "col3"], ["col3", "c3r1"]]
+      }, {
+        // Test pivot to table4_rh_1 from table4_ch_3.
+        accOrElmOrID: "table4_rh_1",
+        oldAccOrElmOrID: "table4_ch_3",
+        expectedUtterance: [["Column 1 Row 2 spans 2 columns col1", "row1"], [
+          "row1", "Column 1 Row 2 spans 2 columns col1"]],
+        expectedBraille: [["c1r2 col1", "row1"], ["row1", "c1r2 col1"]]
+      }, {
+        // Test pivot to table4_cell_3 from table4_rh_1.
+        accOrElmOrID: "table4_cell_3",
+        oldAccOrElmOrID: "table4_rh_1",
+        expectedUtterance: [["Column 4 spans 2 rows", "cell2"], ["cell2",
+          "Column 4 spans 2 rows"]],
+        expectedBraille: [["c4r2", "cell2"], ["cell2", "c4r2"]]
+      }, {
+        // Test pivot to table4_cell_5 from table4_cell_3.
+        accOrElmOrID: "table4_cell_5",
+        oldAccOrElmOrID: "table4_cell_3",
+        expectedUtterance: [["Column 2 Row 3 col2 row2", "cell3"], ["cell3",
+          "Column 2 Row 3 col2 row2"]],
+        expectedBraille: [["c2r3 col2 row2", "cell3"], ["cell3",
+          "c2r3 col2 row2"]]
+      }];
+
+      SpecialPowers.setIntPref(PREF_UTTERANCE_ORDER, 0);
+
+      // Test outputs (utterance and braille) for tables including their
+      // headers and cells.
+      tests.forEach(function run(test) {
+        var outputOrderValues = [0, 1];
+        outputOrderValues.forEach(function testOutputOrder(outputOrder) {
+          SpecialPowers.setIntPref(PREF_UTTERANCE_ORDER, outputOrder);
+          testOutput(test.expectedUtterance[outputOrder], test.accOrElmOrID,
+            test.oldAccOrElmOrID, 1);
+          testOutput(test.expectedBraille[outputOrder], test.accOrElmOrID,
+            test.oldAccOrElmOrID, 0);
+        });
+      });
+
+      // If there was an original utterance order preference, revert to it.
+      SpecialPowers.clearUserPref(PREF_UTTERANCE_ORDER);
+      SimpleTest.finish();
+    }
+
+    SimpleTest.waitForExplicitFinish();
+    addA11yLoadEvent(doTest);
+  </script>
+</head>
+<body>
+  <div id="root">
+    <a target="_blank"
+       href="https://bugzilla.mozilla.org/show_bug.cgi?id=830748"
+       title="[AccessFu] Improve reading of table semantics">
+       Mozilla Bug 830748
+       </a>
+    <p id="display"></p>
+    <div id="content" style="display: none"></div>
+    <pre id="test"></pre>
+    <table id="table1">
+      <thead>
+        <tr>
+          <th id="table1_th1">col1</th>
+          <th>col2</th>
+        </tr>
+      </thead>
+      <tbody>
+        <tr>
+          <td id="table1_td1">cell1</td>
+          <td id="table1_td2">cell2</td>
+        </tr>
+      </tbody>
+    </table>
+    <table id="table2" border="1">
+      <tr>
+        <td id="table2_cell_1" headers="table2_ch_1">cell1</td>
+        <td id="table2_cell_2" headers="table2_ch_2">
+          <table id="table3">
+            <thead>
+              <tr>
+                <th id="table3_ch">colheader</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr>
+                <td id="table3_cell">bla</td>
+              </tr>
+            </tbody>
+          </table>
+        </td>
+      </tr>
+      <tr>
+        <td id="table2_ch_1" scope="col">col1</td>
+        <td id="table2_ch_2" scope="col">col2</td>
+      </tr>
+    </table>
+    <table id="table4" border="1">
+      <thead>
+        <tr>
+          <th id="table4_ch_1">col1</th>
+          <th id="table4_ch_2">col2</th>
+          <td id="table4_ch_3" scope="col">col3</td>
+        </tr>
+      </thead>
+      <tbody>
+        <tr>
+          <th id="table4_rh_1" colspan="2">row1</th>
+          <td id="table4_cell_2">cell1</td>
+          <td id="table4_cell_3" rowspan="2">cell2</td>
+        </tr>
+        <tr>
+          <td id="table4_rh_2" scope="row">row2</td>
+          <td id="table4_cell_5">cell3</td>
+          <td id="table4_cell_6">cell4</td>
+        </tr>
+      </tbody>
+    </table>
+    <table id="table5">
+      <tr><td>Row1</td></tr>
+      <tr><td>Row2</td></tr>
+    </table>
+  </div>
+</body>
+</html>
\ No newline at end of file
diff --git a/accessible/tests/mochitest/jsat/test_utterance_order.html b/accessible/tests/mochitest/jsat/test_utterance_order.html
index b76bbbc7dd5..14ee1a57cbf 100644
--- a/accessible/tests/mochitest/jsat/test_utterance_order.html
+++ b/accessible/tests/mochitest/jsat/test_utterance_order.html
@@ -57,13 +57,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=753984
         }, {
           accOrElmOrID: "cell",
           expected: [[
-            "table", "Fruits and vegetables", "list 4 items", "First item",
-            "link", "Apples", "link", "Bananas", "link", "Peaches",
-            "Last item", "link", "Plums"
+            "table with 1 column and 1 row", "Fruits and vegetables",
+            "Column 1 Row 1", "list 4 items", "First item", "link", "Apples",
+            "link", "Bananas", "link", "Peaches", "Last item", "link", "Plums"
           ], [
             "Apples", "link", "First item", "Bananas", "link", "Peaches",
             "link", "Plums", "link", "Last item", "list 4 items",
-            "Fruits and vegetables", "table"
+            "Column 1 Row 1", "Fruits and vegetables",
+            "table with 1 column and 1 row"
           ]]
         }, {
           // Test pivot to list from li_one.
diff --git a/browser/base/content/browser-context.inc b/browser/base/content/browser-context.inc
index bd51fe28feb..beb220b432e 100644
--- a/browser/base/content/browser-context.inc
+++ b/browser/base/content/browser-context.inc
@@ -180,6 +180,11 @@
                 label="&viewImageInfoCmd.label;"
                 accesskey="&viewImageInfoCmd.accesskey;"
                 oncommand="gContextMenu.viewImageInfo();"/>
+      <menuitem id="context-viewimagedesc"
+                label="&viewImageDescCmd.label;"
+                accesskey="&viewImageDescCmd.accesskey;"
+                oncommand="gContextMenu.viewImageDesc(event);"
+                onclick="checkForMiddleClick(this, event);"/>
       <menuitem id="context-savevideo"
                 label="&saveVideoCmd.label;"
                 accesskey="&saveVideoCmd.accesskey;"
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 589f56998dc..ec7bf8a43dc 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -261,6 +261,7 @@ nsContextMenu.prototype = {
             .disabled = !this.hasBGImage;
 
     this.showItem("context-viewimageinfo", this.onImage);
+    this.showItem("context-viewimagedesc", this.onImage && this.imageDescURL !== "");
   },
 
   initMiscItems: function CM_initMiscItems() {
@@ -499,6 +500,7 @@ nsContextMenu.prototype = {
     this.onImage           = false;
     this.onLoadedImage     = false;
     this.onCompletedImage  = false;
+    this.imageDescURL      = "";
     this.onCanvas          = false;
     this.onVideo           = false;
     this.onAudio           = false;
@@ -548,6 +550,11 @@ nsContextMenu.prototype = {
           this.onCompletedImage = true;
 
         this.mediaURL = this.target.currentURI.spec;
+
+        var descURL = this.target.getAttribute("longdesc");
+        if (descURL) {
+          this.imageDescURL = makeURLAbsolute(this.target.ownerDocument.body.baseURI, descURL);
+        }
       }
       else if (this.target instanceof HTMLCanvasElement) {
         this.onCanvas = true;
@@ -874,6 +881,14 @@ nsContextMenu.prototype = {
                     "mediaTab", this.target);
   },
 
+  viewImageDesc: function(e) {
+    var doc = this.target.ownerDocument;
+    urlSecurityCheck(this.imageDescURL, this.browser.contentPrincipal,
+                     Ci.nsIScriptSecurityManager.DISALLOW_SCRIPT);
+    openUILink(this.imageDescURL, e, { disallowInheritPrincipal: true,
+                             referrerURI: doc.documentURIObject });
+  },
+
   viewFrameInfo: function() {
     BrowserPageInfo(this.target.ownerDocument);
   },
diff --git a/browser/base/content/test/subtst_contextmenu.html b/browser/base/content/test/subtst_contextmenu.html
index 69510aacae1..ece3cfe0265 100644
--- a/browser/base/content/test/subtst_contextmenu.html
+++ b/browser/base/content/test/subtst_contextmenu.html
@@ -66,5 +66,6 @@ Browser context menu subtest.
 <input id="test-select-input-text" type="text" value="input">
 <input id="test-select-input-text-type-password" type="password" value="password">
 <embed id="test-plugin" style="width: 200px; height: 200px;" type="application/x-test"></embed>
+<img id="test-longdesc" src="ctxmenu-image.png" longdesc="http://www.mozilla.org"></embed>
 </body>
 </html>
diff --git a/browser/base/content/test/test_contextmenu.html b/browser/base/content/test/test_contextmenu.html
index 875b39eff97..ad5e2b2d814 100644
--- a/browser/base/content/test/test_contextmenu.html
+++ b/browser/base/content/test/test_contextmenu.html
@@ -939,6 +939,22 @@ function runTest(testNum) {
             tag.enabledState = SpecialPowers.Ci.nsIPluginTag.STATE_ENABLED;
           }
         }
+        openContextMenuFor(longdesc);
+        return;
+
+    case 30:
+        // Context menu for an image with longdesc
+        checkContextMenu(["context-viewimage",            true,
+                          "context-copyimage-contents",   true,
+                          "context-copyimage",            true,
+                          "---",                          null,
+                          "context-saveimage",            true,
+                          "context-sendimage",            true,
+                          "context-setDesktopBackground", true,
+                          "context-viewimageinfo",        true,
+                          "context-viewimagedesc",        true
+                         ].concat(inspectItems));
+        closeContextMenu();
 
         // finish test
         subwindow.close();
@@ -968,7 +984,7 @@ var text, link, mailto, input, img, canvas, video_ok, video_bad, video_bad2,
     iframe, video_in_iframe, image_in_iframe, textarea, contenteditable,
     inputspell, pagemenu, dom_full_screen, plainTextItems, audio_in_video,
     selecttext, selecttextlink, imagelink, select_inputtext, select_inputtext_password,
-    plugin;
+    plugin, longdesc;
 
 function startTest() {
     chromeWin = SpecialPowers.wrap(subwindow)
@@ -1017,6 +1033,7 @@ function startTest() {
     select_inputtext = subwindow.document.getElementById("test-select-input-text");
     select_inputtext_password = subwindow.document.getElementById("test-select-input-text-type-password");
     plugin = subwindow.document.getElementById("test-plugin");
+    longdesc = subwindow.document.getElementById("test-longdesc");
 
     contextMenu.addEventListener("popupshown", function() { runTest(++testNum); }, false);
     runTest(1);
diff --git a/browser/components/downloads/content/downloads.css b/browser/components/downloads/content/downloads.css
index 7cb84560164..72f694f3b6f 100644
--- a/browser/components/downloads/content/downloads.css
+++ b/browser/components/downloads/content/downloads.css
@@ -63,7 +63,7 @@ richlistitem[type="download"]:not([selected]) button {
   display: none;
 }
 
-/*** Visibility of download buttons and indicator controls. ***/
+/*** Visibility of download buttons ***/
 
 .download-state:not(:-moz-any([state="-1"],/* Starting (initial) */
                               [state="5"], /* Starting (queued)  */
@@ -76,16 +76,7 @@ richlistitem[type="download"]:not([selected]) button {
                                            .downloadRetry,
 
 .download-state:not(          [state="1"]  /* Finished           */)
-                                           .downloadShow,
-
-#downloads-indicator:-moz-any([progress],
-                              [counter],
-                              [paused])    #downloads-indicator-icon,
-
-#downloads-indicator:not(:-moz-any([progress],
-                                   [counter],
-                                   [paused]))
-                                           #downloads-indicator-progress-area
+                                           .downloadShow
 
 {
   visibility: hidden;
@@ -103,21 +94,3 @@ richlistitem[type="download"]:not([selected]) button {
 {
   display: none;
 }
-
-/* Hacks for toolbar full and text modes, until bug 573329 removes them */
-
-toolbar[mode="text"] > #downloads-indicator {
-  display: -moz-box;
-  -moz-box-orient: vertical;
-  -moz-box-pack: center;
-}
-
-toolbar[mode="text"] > #downloads-indicator > .toolbarbutton-text {
-  -moz-box-ordinal-group: 1;
-}
-
-toolbar[mode="text"] > #downloads-indicator > .toolbarbutton-icon {
-  display: -moz-box;
-  -moz-box-ordinal-group: 2;
-  visibility: collapse;
-}
diff --git a/browser/components/downloads/content/indicator.css b/browser/components/downloads/content/indicator.css
new file mode 100644
index 00000000000..3fba3c085f7
--- /dev/null
+++ b/browser/components/downloads/content/indicator.css
@@ -0,0 +1,36 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*** Visibility of indicator controls ***/
+
+#downloads-indicator:-moz-any([progress],
+                              [counter],
+                              [paused])    #downloads-indicator-icon,
+
+#downloads-indicator:not(:-moz-any([progress],
+                                   [counter],
+                                   [paused]))
+                                           #downloads-indicator-progress-area
+
+{
+  visibility: hidden;
+}
+
+/* Hacks for toolbar full and text modes, until bug 573329 removes them */
+
+toolbar[mode="text"] > #downloads-indicator {
+  display: -moz-box;
+  -moz-box-orient: vertical;
+  -moz-box-pack: center;
+}
+
+toolbar[mode="text"] > #downloads-indicator > .toolbarbutton-text {
+  -moz-box-ordinal-group: 1;
+}
+
+toolbar[mode="text"] > #downloads-indicator > .toolbarbutton-icon {
+  display: -moz-box;
+  -moz-box-ordinal-group: 2;
+  visibility: collapse;
+}
diff --git a/browser/components/downloads/content/indicatorOverlay.xul b/browser/components/downloads/content/indicatorOverlay.xul
index efb6cab7573..735c4257b00 100644
--- a/browser/components/downloads/content/indicatorOverlay.xul
+++ b/browser/components/downloads/content/indicatorOverlay.xul
@@ -6,8 +6,8 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this file,
    - You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<?xml-stylesheet href="chrome://browser/content/downloads/downloads.css"?>
-<?xml-stylesheet href="chrome://browser/skin/downloads/downloads.css"?>
+<?xml-stylesheet href="chrome://browser/content/downloads/indicator.css"?>
+<?xml-stylesheet href="chrome://browser/skin/downloads/indicator.css"?>
 
 <!DOCTYPE overlay [
   <!ENTITY % browserDTD SYSTEM "chrome://browser/locale/browser.dtd" >
diff --git a/browser/components/downloads/jar.mn b/browser/components/downloads/jar.mn
index 8f8c66dd7f2..440b476a95c 100644
--- a/browser/components/downloads/jar.mn
+++ b/browser/components/downloads/jar.mn
@@ -8,6 +8,7 @@ browser.jar:
         content/browser/downloads/downloads.css          (content/downloads.css)
 *       content/browser/downloads/downloads.js           (content/downloads.js)
 *       content/browser/downloads/downloadsOverlay.xul   (content/downloadsOverlay.xul)
+        content/browser/downloads/indicator.css          (content/indicator.css)
         content/browser/downloads/indicator.js           (content/indicator.js)
         content/browser/downloads/indicatorOverlay.xul   (content/indicatorOverlay.xul)
 *       content/browser/downloads/allDownloadsViewOverlay.xul (content/allDownloadsViewOverlay.xul)
diff --git a/browser/locales/en-US/chrome/browser/browser.dtd b/browser/locales/en-US/chrome/browser/browser.dtd
index b87b54dd992..685be00a3cb 100644
--- a/browser/locales/en-US/chrome/browser/browser.dtd
+++ b/browser/locales/en-US/chrome/browser/browser.dtd
@@ -408,6 +408,8 @@ These should match what Safari and other Apple applications use on OS X Lion. --
 <!ENTITY viewImageCmd.accesskey       "I">
 <!ENTITY viewImageInfoCmd.label       "View Image Info">
 <!ENTITY viewImageInfoCmd.accesskey   "f">
+<!ENTITY viewImageDescCmd.label       "View Description">
+<!ENTITY viewImageDescCmd.accesskey   "D">
 <!ENTITY viewVideoCmd.label           "View Video">
 <!ENTITY viewVideoCmd.accesskey       "I">
 <!ENTITY viewBGImageCmd.label         "View Background Image">
diff --git a/browser/metro/base/content/ContextUI.js b/browser/metro/base/content/ContextUI.js
new file mode 100644
index 00000000000..65b77cd9f01
--- /dev/null
+++ b/browser/metro/base/content/ContextUI.js
@@ -0,0 +1,334 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// Fired when any context ui is displayed
+const kContextUIShowEvent = "MozContextUIShow";
+// Fired when any context ui is dismissed
+const kContextUIDismissEvent = "MozContextUIDismiss";
+// Fired when the tabtray is displayed
+const kContextUITabsShowEvent = "MozContextUITabsShow";
+// add more as needed...
+
+// delay for ContextUI's dismissWithDelay
+const kHideContextAndTrayDelayMsec = 3000;
+
+// delay when showing the tab bar briefly as a new tab opens
+const kNewTabAnimationDelayMsec = 1000;
+
+/*
+ * Manages context UI (navbar, tabbar, appbar) and track visibility. Also
+ * tracks events that summon and hide the context UI.
+ */
+var ContextUI = {
+  _expandable: true,
+  _hidingId: 0,
+
+  /*******************************************
+   * init
+   */
+
+  init: function init() {
+    Elements.browsers.addEventListener("mousedown", this, true);
+    Elements.browsers.addEventListener("touchstart", this, true);
+    Elements.browsers.addEventListener("AlertActive", this, true);
+
+    Elements.browsers.addEventListener('URLChanged', this, true);
+    Elements.tabList.addEventListener('TabSelect', this, true);
+    Elements.panelUI.addEventListener('ToolPanelShown', this, false);
+    Elements.panelUI.addEventListener('ToolPanelHidden', this, false);
+
+    window.addEventListener("MozEdgeUIStarted", this, true);
+    window.addEventListener("MozEdgeUICanceled", this, true);
+    window.addEventListener("MozEdgeUICompleted", this, true);
+    window.addEventListener("keypress", this, true);
+    window.addEventListener("KeyboardChanged", this, false);
+
+    Elements.tray.addEventListener("transitionend", this, true);
+
+    Appbar.init();
+  },
+
+  /*******************************************
+   * Context UI state getters & setters
+   */
+
+  // any visiblilty
+  get isVisible() {
+    return this.navbarVisible || this.tabbarVisible || this.contextAppbarVisible;
+  },
+
+  // navbar visiblilty
+  get navbarVisible() {
+    return (Elements.navbar.hasAttribute("visible") ||
+            Elements.navbar.hasAttribute("startpage"));
+  },
+
+  // tabbar visiblilty
+  get tabbarVisible() {
+    return Elements.tray.hasAttribute("expanded");
+  },
+
+  // appbar visiblilty
+  get contextAppbarVisible() {
+    return Elements.contextappbar.isShowing;
+  },
+
+  // currently not in use, for the always show tabs feature
+  get isExpandable() { return this._expandable; },
+  set isExpandable(aFlag) {
+    this._expandable = aFlag;
+    if (!this._expandable)
+      this.dismiss();
+  },
+
+  /*******************************************
+   * Public api
+   */
+
+  /*
+   * Toggle the current nav UI state. Fires context ui events.
+   */
+  toggleNavUI: function () {
+    // The navbar is forced open when the start page is visible. appbar.js
+    // controls the "visible" property, and browser-ui controls the "startpage"
+    // property. Hence we rely on the tabbar for current toggle state.
+    if (this.tabbarVisible) {
+      this.dismiss();
+    } else {
+      this.displayNavUI();
+    }
+  },
+
+  /*
+   * Show the nav and tabs bar. Returns true if any non-visible UI
+   * was shown. Fires context ui events.
+   */
+  displayNavUI: function () {
+    let shown = false;
+
+    if (!this.navbarVisible) {
+      this.displayNavbar();
+      shown = true;
+    }
+
+    if (!this.tabbarVisible) {
+      this.displayTabs();
+      shown = true;
+    }
+
+    if (shown) {
+      ContentAreaObserver.update(window.innerWidth, window.innerHeight);
+      this._fire(kContextUIShowEvent);
+    }
+
+    return shown;
+  },
+
+  /*
+   * Dismiss any context UI currently visible. Returns true if any
+   * visible UI was dismissed. Fires context ui events.
+   */
+  dismiss: function () {
+    let dismissed = false;
+
+    this._clearDelayedTimeout();
+
+    // No assurances this will hide the nav bar. It may have the
+    // 'startpage' property set. This removes the 'visible' property.
+    if (this.navbarVisible) {
+      this.dismissNavbar();
+      dismissed = true;
+    }
+    if (this.tabbarVisible) {
+      this.dismissTabs();
+      dismissed = true;
+    }
+    if (Elements.contextappbar.isShowing) {
+      this.dismissContextAppbar();
+      dismissed = true;
+    }
+
+    if (dismissed) {
+      ContentAreaObserver.update(window.innerWidth, window.innerHeight);
+      this._fire(kContextUIDismissEvent);
+    }
+
+    return dismissed;
+  },
+
+  /*
+   * Briefly show the tab bar and then hide it. Fires context ui events.
+   */
+  peekTabs: function peekTabs() {
+    if (this.tabbarVisible) {
+      setTimeout(function () {
+        ContextUI.dismissWithDelay(kNewTabAnimationDelayMsec);
+      }, 0);
+    } else {
+      BrowserUI.setOnTabAnimationEnd(function () {
+        ContextUI.dismissWithDelay(kNewTabAnimationDelayMsec);
+      });
+      this.displayTabs();
+    }
+  },
+
+
+  /*
+   * Dismiss all context ui after a delay. Fires context ui events.
+   */
+  dismissWithDelay: function dismissWithDelay(aDelay) {
+    aDelay = aDelay || kHideContextAndTrayDelayMsec;
+    this._clearDelayedTimeout();
+    this._hidingId = setTimeout(function () {
+        ContextUI.dismiss();
+      }, aDelay);
+  },
+
+  // Cancel any pending delayed dismiss
+  cancelDismiss: function cancelDismiss() {
+    this._clearDelayedTimeout();
+  },
+
+  // Display the nav bar
+  displayNavbar: function () {
+    this._clearDelayedTimeout();
+    Elements.navbar.show();
+  },
+
+  // Display the tab tray
+  displayTabs: function () {
+    this._clearDelayedTimeout();
+    this._setIsExpanded(true);
+  },
+
+  // Display the app bar
+  displayContextAppbar: function () {
+    this._clearDelayedTimeout();
+    Elements.contextappbar.show();
+  },
+
+  // Dismiss the navbar if visible.
+  dismissNavbar: function dismissNavbar() {
+    Elements.navbar.dismiss();
+  },
+
+  // Dismiss the tabstray if visible.
+  dismissTabs: function dimissTabs() {
+    this._clearDelayedTimeout();
+    this._setIsExpanded(false);
+  },
+
+  // Dismiss the appbar if visible.
+  dismissContextAppbar: function dismissContextAppbar() {
+    Elements.contextappbar.dismiss();
+  },
+
+  /*******************************************
+   * Internal utils
+   */
+
+  // tabtray state
+  _setIsExpanded: function _setIsExpanded(aFlag, setSilently) {
+    // if the tray can't be expanded, don't expand it.
+    if (!this.isExpandable || this.tabbarVisible == aFlag)
+      return;
+
+    if (aFlag)
+      Elements.tray.setAttribute("expanded", "true");
+    else
+      Elements.tray.removeAttribute("expanded");
+
+    if (!setSilently)
+      this._fire(kContextUITabsShowEvent);
+  },
+
+  _clearDelayedTimeout: function _clearDelayedTimeout() {
+    if (this._hidingId) {
+      clearTimeout(this._hidingId);
+      this._hidingId = 0;
+    }
+  },
+
+  /*******************************************
+   * Events
+   */
+
+  _onEdgeUIStarted: function(aEvent) {
+    this._hasEdgeSwipeStarted = true;
+    this._clearDelayedTimeout();
+
+    if (StartUI.hide()) {
+      this.dismiss();
+      return;
+    }
+    this.toggleNavUI();
+  },
+
+  _onEdgeUICanceled: function(aEvent) {
+    this._hasEdgeSwipeStarted = false;
+    StartUI.hide();
+    this.dismiss();
+  },
+
+  _onEdgeUICompleted: function(aEvent) {
+    if (this._hasEdgeSwipeStarted) {
+      this._hasEdgeSwipeStarted = false;
+      return;
+    }
+
+    this._clearDelayedTimeout();
+    if (StartUI.hide()) {
+      this.dismiss();
+      return;
+    }
+    this.toggleNavUI();
+  },
+
+  handleEvent: function handleEvent(aEvent) {
+    switch (aEvent.type) {
+      case "MozEdgeUIStarted":
+        this._onEdgeUIStarted(aEvent);
+        break;
+      case "MozEdgeUICanceled":
+        this._onEdgeUICanceled(aEvent);
+        break;
+      case "MozEdgeUICompleted":
+        this._onEdgeUICompleted(aEvent);
+        break;
+      case "keypress":
+        if (String.fromCharCode(aEvent.which) == "z" &&
+            aEvent.getModifierState("Win"))
+          this.toggleNavUI();
+        break;
+      case "transitionend":
+        setTimeout(function () {
+          ContentAreaObserver.updateContentArea();
+        }, 0);
+        break;
+      case "KeyboardChanged":
+        this.dismissTabs();
+        break;
+      case "mousedown":
+        if (aEvent.button == 0 && this.isVisible)
+          this.dismiss();
+        break;
+      case 'URLChanged':
+        this.dismissTabs();
+        break;
+      case 'TabSelect':
+      case 'ToolPanelShown':
+      case 'ToolPanelHidden':
+      case "touchstart":
+      case "AlertActive":
+        this.dismiss();
+        break;
+    }
+  },
+
+  _fire: function (name) {
+    let event = document.createEvent("Events");
+    event.initEvent(name, true, true);
+    window.dispatchEvent(event);
+  }
+};
diff --git a/browser/metro/base/content/appbar.js b/browser/metro/base/content/appbar.js
index 8cb68ef8323..2548e27a866 100644
--- a/browser/metro/base/content/appbar.js
+++ b/browser/metro/base/content/appbar.js
@@ -12,16 +12,16 @@ var Appbar = {
   activeTileset: null,
 
   init: function Appbar_init() {
-    window.addEventListener('MozContextUIShow', this);
-    window.addEventListener('MozContextUIDismiss', this);
-    window.addEventListener('MozAppbarDismiss', this);
+    // fired from appbar bindings
     Elements.contextappbar.addEventListener('MozAppbarShowing', this, false);
     Elements.contextappbar.addEventListener('MozAppbarDismissing', this, false);
+
+    // fired when a context sensitive item (bookmarks) changes state
     window.addEventListener('MozContextActionsChange', this, false);
+
+    // browser events we need to update button state on
     Elements.browsers.addEventListener('URLChanged', this, true);
     Elements.tabList.addEventListener('TabSelect', this, true);
-    Elements.panelUI.addEventListener('ToolPanelShown', this, false);
-    Elements.panelUI.addEventListener('ToolPanelHidden', this, false);
 
     // tilegroup selection events for all modules get bubbled up
     window.addEventListener("selectionchange", this, false);
@@ -31,22 +31,10 @@ var Appbar = {
     switch (aEvent.type) {
       case 'URLChanged':
       case 'TabSelect':
-        this.update();
-        Elements.navbar.dismiss();
-        Elements.contextappbar.dismiss();
-        break;
-      case 'MozContextUIShow':
-        Elements.navbar.show();
-        break;
-      case 'MozAppbarDismiss':
-      case 'MozContextUIDismiss':
-      case 'ToolPanelShown':
-      case 'ToolPanelHidden':
-        Elements.navbar.dismiss();
-        Elements.contextappbar.dismiss();
-        break;
       case 'MozAppbarShowing':
+        this.update();
         break;
+
       case 'MozAppbarDismissing':
         if (this.activeTileset) {
           this.activeTileset.clearSelection();
@@ -54,11 +42,13 @@ var Appbar = {
         this.clearContextualActions();
         this.activeTileset = null;
         break;
+
       case 'MozContextActionsChange':
         let actions = aEvent.actions;
         // could transition in old, new buttons?
         this.showContextualActions(actions);
         break;
+
       case "selectionchange":
         let nodeName = aEvent.target.nodeName;
         if ('richgrid' === nodeName) {
diff --git a/browser/metro/base/content/bindings/flyoutpanel.xml b/browser/metro/base/content/bindings/flyoutpanel.xml
index 2c4e7758699..71eb0ae5643 100644
--- a/browser/metro/base/content/bindings/flyoutpanel.xml
+++ b/browser/metro/base/content/bindings/flyoutpanel.xml
@@ -28,7 +28,7 @@
         <![CDATA[
           window.addEventListener('MozContextUIShow', this);
           window.addEventListener('MozContextUIDismiss', this);
-          window.addEventListener('MozAppbarDismiss', this);
+          window.addEventListener('MozAppbarDismissing', this);
         ]]>
       </constructor>
 
@@ -36,7 +36,7 @@
         <![CDATA[
           window.removeEventListener('MozContextUIShow', this);
           window.removeEventListener('MozContextUIDismiss', this);
-          window.removeEventListener('MozAppbarDismiss', this);
+          window.removeEventListener('MozAppbarDismissing', this);
         ]]>
       </destructor>
 
@@ -92,7 +92,7 @@
           <![CDATA[
             switch (aEvent.type) {
               case 'MozContextUIShow':
-              case 'MozAppbarDismiss':
+              case 'MozAppbarDismissing':
               case 'MozContextUIDismiss':
                 this.hide();
                 break;
diff --git a/browser/metro/base/content/bindings/tabs.xml b/browser/metro/base/content/bindings/tabs.xml
index 74f42cb995b..f4dcec2c579 100644
--- a/browser/metro/base/content/bindings/tabs.xml
+++ b/browser/metro/base/content/bindings/tabs.xml
@@ -114,13 +114,13 @@
     <implementation implements="nsIDOMEventListener">
       <constructor>
         <![CDATA[
-          window.addEventListener("MozContextUIExpand", this, true);
+          window.addEventListener("MozContextUITabsShow", this, true);
         ]]>
       </constructor>
 
       <destructor>
         <![CDATA[
-          window.removeEventListener("MozContextUIExpand", this, true);
+          window.removeEventListener("MozContextUITabsShow", this, true);
         ]]>
       </destructor>
 
@@ -129,7 +129,7 @@
         <body>
           <![CDATA[
             switch (event.type) {
-              case "MozContextUIExpand":
+              case "MozContextUITabsShow":
                 this.strip.ensureElementIsVisible(this.selectedTab, false);
                 break;
             }
diff --git a/browser/metro/base/content/browser-scripts.js b/browser/metro/base/content/browser-scripts.js
index 02a5eeb648f..9fcdf000f33 100644
--- a/browser/metro/base/content/browser-scripts.js
+++ b/browser/metro/base/content/browser-scripts.js
@@ -136,6 +136,7 @@ let ScriptContexts = {};
   ["SSLExceptions", "chrome://browser/content/exceptions.js"],
   ["ItemPinHelper", "chrome://browser/content/helperui/ItemPinHelper.js"],
   ["NavButtonSlider", "chrome://browser/content/NavButtonSlider.js"],
+  ["ContextUI", "chrome://browser/content/ContextUI.js"],
 #ifdef MOZ_SERVICES_SYNC
   ["Sync", "chrome://browser/content/sync.js"],
   ["SyncPairDevice", "chrome://browser/content/sync.js"],
diff --git a/browser/metro/base/content/browser-ui.js b/browser/metro/base/content/browser-ui.js
index c3a2f706a8b..bbd9dfa4b9a 100644
--- a/browser/metro/base/content/browser-ui.js
+++ b/browser/metro/base/content/browser-ui.js
@@ -4,6 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 Cu.import("resource://gre/modules/PageThumbs.jsm");
+Cu.import("resource://gre/modules/devtools/dbg-server.jsm")
 
 /**
  * Constants
@@ -14,13 +15,6 @@ Cu.import("resource://gre/modules/PageThumbs.jsm");
 const TOOLBARSTATE_LOADING  = 1;
 const TOOLBARSTATE_LOADED   = 2;
 
-// delay for ContextUI's dismissWithDelay
-const kHideContextAndTrayDelayMsec = 3000;
-
-// delay when showing the tab bar briefly as a new tab opens
-const kNewTabAnimationDelayMsec = 500;
-
-
 // Page for which the start UI is shown
 const kStartOverlayURI = "about:start";
 
@@ -448,7 +442,7 @@ var BrowserUI = {
   animateClosingTab: function animateClosingTab(tabToClose) {
     tabToClose.chromeTab.setAttribute("closing", "true");
 
-    let wasCollapsed = !ContextUI.isExpanded;
+    let wasCollapsed = !ContextUI.tabbarVisible;
     if (wasCollapsed) {
       ContextUI.displayTabs();
     }
@@ -1254,7 +1248,7 @@ var BrowserUI = {
         this._editURI(true);
         break;
       case "cmd_addBookmark":
-        Elements.navbar.show();
+        ContextUI.displayNavbar();
         Appbar.onStarButton(true);
         break;
       case "cmd_bookmarks":
@@ -1319,266 +1313,6 @@ var BrowserUI = {
   }
 };
 
-/**
- * Tracks whether context UI (app bar, tab bar, url bar) is shown or hidden.
- * Manages events to summon and hide the context UI.
- */
-var ContextUI = {
-  _expandable: true,
-  _hidingId: 0,
-
-  /*******************************************
-   * init
-   */
-
-  init: function init() {
-    Elements.browsers.addEventListener("mousedown", this, true);
-    Elements.browsers.addEventListener("touchstart", this, true);
-    Elements.browsers.addEventListener("AlertActive", this, true);
-    window.addEventListener("MozEdgeUIStarted", this, true);
-    window.addEventListener("MozEdgeUICanceled", this, true);
-    window.addEventListener("MozEdgeUICompleted", this, true);
-    window.addEventListener("keypress", this, true);
-    window.addEventListener("KeyboardChanged", this, false);
-
-    Elements.tray.addEventListener("transitionend", this, true);
-
-    Appbar.init();
-  },
-
-  /*******************************************
-   * Context UI state getters & setters
-   */
-
-  get isVisible() {
-    return (Elements.navbar.hasAttribute("visible") ||
-            Elements.navbar.hasAttribute("startpage"));
-  },
-  get isExpanded() { return Elements.tray.hasAttribute("expanded"); },
-  get isExpandable() { return this._expandable; },
-
-  set isExpandable(aFlag) {
-    this._expandable = aFlag;
-    if (!this._expandable)
-      this.dismiss();
-  },
-
-  /*******************************************
-   * Context UI state control
-   */
-
-  toggle: function toggle() {
-    if (!this._expandable) {
-      // exandable setter takes care of resetting state
-      // so if we're not expandable, there's nothing to do here
-      return;
-    }
-    // if we're not showing, show
-    if (!this.dismiss()) {
-      dump("* ContextUI is hidden, show it\n");
-      this.show();
-    }
-  },
-
-  // show all context UI
-  // returns true if any non-visible UI was shown
-  show: function() {
-    let shown = false;
-    if (!this.isExpanded) {
-      // show the tab tray
-      this._setIsExpanded(true);
-      shown = true;
-    }
-    if (!Elements.navbar.isShowing) {
-      // show the navbar
-      Elements.navbar.show();
-      shown = true;
-    }
-
-    this._clearDelayedTimeout();
-    if (shown) {
-      ContentAreaObserver.update(window.innerWidth, window.innerHeight);
-    }
-    return shown;
-  },
-
-  // Display the nav bar
-  displayNavbar: function displayNavbar() {
-    this._clearDelayedTimeout();
-    Elements.navbar.show();
-  },
-
-  // Display the toolbar and tabs
-  displayTabs: function displayTabs() {
-    this._clearDelayedTimeout();
-    this._setIsExpanded(true, true);
-  },
-
-  /** Briefly show the tab bar and then hide it */
-  peekTabs: function peekTabs() {
-    if (this.isExpanded) {
-      setTimeout(function () {
-        ContextUI.dismissWithDelay(kNewTabAnimationDelayMsec);
-      }, 0);
-    } else {
-      BrowserUI.setOnTabAnimationEnd(function () {
-        ContextUI.dismissWithDelay(kNewTabAnimationDelayMsec);
-      });
-
-      this.displayTabs();
-    }
-  },
-
-  // Dismiss all context UI.
-  // Returns true if any visible UI was dismissed.
-  dismiss: function dismiss() {
-    let dismissed = false;
-    if (this.isExpanded) {
-      this._setIsExpanded(false);
-      dismissed = true;
-    }
-    if (Elements.navbar.isShowing) {
-      this.dismissAppbar();
-      dismissed = true;
-    }
-    this._clearDelayedTimeout();
-    if (dismissed) {
-      ContentAreaObserver.update(window.innerWidth, window.innerHeight);
-    }
-    return dismissed;
-  },
-
-  // Dismiss all context ui after a delay
-  dismissWithDelay: function dismissWithDelay(aDelay) {
-    aDelay = aDelay || kHideContextAndTrayDelayMsec;
-    this._clearDelayedTimeout();
-    this._hidingId = setTimeout(function () {
-        ContextUI.dismiss();
-      }, aDelay);
-  },
-
-  // Cancel any pending delayed dismiss
-  cancelDismiss: function cancelDismiss() {
-    this._clearDelayedTimeout();
-  },
-
-  dismissTabs: function dimissTabs() {
-    this._clearDelayedTimeout();
-    this._setIsExpanded(false, true);
-  },
-
-  dismissAppbar: function dismissAppbar() {
-    this._fire("MozAppbarDismiss");
-  },
-
-  /*******************************************
-   * Internal tray state setters
-   */
-
-  // tab tray state
-  _setIsExpanded: function _setIsExpanded(aFlag, setSilently) {
-    // if the tray can't be expanded, don't expand it.
-    if (!this.isExpandable || this.isExpanded == aFlag)
-      return;
-
-    if (aFlag)
-      Elements.tray.setAttribute("expanded", "true");
-    else
-      Elements.tray.removeAttribute("expanded");
-
-    if (!setSilently)
-      this._fire("MozContextUIExpand");
-  },
-
-  /*******************************************
-   * Internal utils
-   */
-
-  _clearDelayedTimeout: function _clearDelayedTimeout() {
-    if (this._hidingId) {
-      clearTimeout(this._hidingId);
-      this._hidingId = 0;
-    }
-  },
-
-  /*******************************************
-   * Events
-   */
-
-  _onEdgeUIStarted: function(aEvent) {
-    this._hasEdgeSwipeStarted = true;
-    this._clearDelayedTimeout();
-
-    if (StartUI.hide()) {
-      this.dismiss();
-      return;
-    }
-    this.toggle();
-  },
-
-  _onEdgeUICanceled: function(aEvent) {
-    this._hasEdgeSwipeStarted = false;
-    StartUI.hide();
-    this.dismiss();
-  },
-
-  _onEdgeUICompleted: function(aEvent) {
-    if (this._hasEdgeSwipeStarted) {
-      this._hasEdgeSwipeStarted = false;
-      return;
-    }
-
-    this._clearDelayedTimeout();
-    if (StartUI.hide()) {
-      this.dismiss();
-      return;
-    }
-    this.toggle();
-  },
-
-  handleEvent: function handleEvent(aEvent) {
-    switch (aEvent.type) {
-      case "MozEdgeUIStarted":
-        this._onEdgeUIStarted(aEvent);
-        break;
-      case "MozEdgeUICanceled":
-        this._onEdgeUICanceled(aEvent);
-        break;
-      case "MozEdgeUICompleted":
-        this._onEdgeUICompleted(aEvent);
-        break;
-      case "mousedown":
-        if (aEvent.button == 0 && this.isVisible)
-          this.dismiss();
-        break;
-      case "touchstart":
-      // ContextUI can hide the notification bar. Workaround until bug 845348 is fixed.
-      case "AlertActive":
-        this.dismiss();
-        break;
-      case "keypress":
-        if (String.fromCharCode(aEvent.which) == "z" &&
-            aEvent.getModifierState("Win"))
-          this.toggle();
-        break;
-      case "transitionend":
-        setTimeout(function () {
-          ContentAreaObserver.updateContentArea();
-        }, 0);
-        break;
-      case "KeyboardChanged":
-        this.dismissTabs();
-        break;
-    }
-  },
-
-  _fire: function (name) {
-    let event = document.createEvent("Events");
-    event.initEvent(name, true, true);
-    window.dispatchEvent(event);
-  }
-};
-
 var StartUI = {
   get isVisible() { return this.isStartPageVisible || this.isFiltering; },
   get isStartPageVisible() { return Elements.windowState.hasAttribute("startpage"); },
@@ -1608,6 +1342,13 @@ var StartUI = {
       if (section.init)
         section.init();
     });
+
+    if (!DebuggerServer.initialized) {
+      DebuggerServer.init();
+      DebuggerServer.addBrowserActors();
+      DebuggerServer.addActors('chrome://browser/content/dbg-metro-actors.js');
+    }
+    DebuggerServer.openListener(6000);
   },
 
   uninit: function() {
diff --git a/browser/metro/base/content/browser.js b/browser/metro/base/content/browser.js
index 4ca9523a35c..bef8f7cfb77 100644
--- a/browser/metro/base/content/browser.js
+++ b/browser/metro/base/content/browser.js
@@ -974,8 +974,8 @@ var Browser = {
 
   onAboutPolicyClick: function() {
     FlyoutPanelsUI.hide();
-    BrowserUI.newTab(Services.prefs.getCharPref("app.privacyURL"),
-                     Browser.selectedTab);
+    let linkStr = Services.urlFormatter.formatURLPref("app.privacyURL");
+    BrowserUI.newTab(linkStr, Browser.selectedTab);
   }
 
 };
diff --git a/browser/metro/base/content/dbg-metro-actors.js b/browser/metro/base/content/dbg-metro-actors.js
new file mode 100644
index 00000000000..566f70d620e
--- /dev/null
+++ b/browser/metro/base/content/dbg-metro-actors.js
@@ -0,0 +1,66 @@
+/* -*- Mode: javascript; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+const error = Components.utils.reportError;
+
+/* Metrofx specific actors, modelled from the android fennec actors */
+
+/** aConnection DebuggerServerConnection, the conection to the client.
+ */
+function createRootActor(aConnection) {
+  let parameters = {
+    tabList: new MetroTabList(aConnection),
+    globalActorFactories: DebuggerServer.globalActorFactories,
+    onShutdown: sendShutdownEvent
+  };
+  return new RootActor(aConnection, parameters);
+}
+
+/** aConnection DebuggerServerConnection, the conection to the client.
+ */
+function MetroTabList(aConnection) {
+  BrowserTabList.call(this, aConnection);
+}
+
+MetroTabList.prototype = Object.create(BrowserTabList.prototype);
+MetroTabList.prototype.constructor = MetroTabList;
+/**
+ * We want to avoid mysterious behavior if tabs are closed or opened mid-iteration.
+ * We want at the end, a list of the actors that were live when we began the iteration.
+ * So, we update the map first, iterate over it again to yield the actors.
+ */
+MetroTabList.prototype.iterator = function() {
+
+  let initialMapSize = this._actorByBrowser.size;
+  let foundCount = 0;
+  for (let win of allAppShellDOMWindows("navigator:browser")) {
+    let selectedTab = win.Browser.selectedBrowser;
+
+    for (let browser of win.Browser.browsers) {
+      let actor = this._actorByBrowser.get(browser);
+      if (actor) {
+        foundCount++;
+      } else {
+        actor = new BrowserTabActor(this._connection, browser);
+        this._actorByBrowser.set(browser, actor);
+      }
+
+      // Set the 'selected' properties on all actors correctly.
+      actor.selected = (browser === selectedTab);
+    }
+  }
+
+  if (this._testing && initialMapSize !== foundCount) {
+    throw error("_actorByBrowser map contained actors for dead tabs");
+  }
+
+  this._mustNotify = true;
+  this._checkListening();
+
+  for (let [browser, actor] of this._actorByBrowser) {
+    yield actor;
+  }
+};
diff --git a/browser/metro/base/content/helperui/FindHelperUI.js b/browser/metro/base/content/helperui/FindHelperUI.js
index 447d4c45d4a..381a8805c2b 100644
--- a/browser/metro/base/content/helperui/FindHelperUI.js
+++ b/browser/metro/base/content/helperui/FindHelperUI.js
@@ -58,7 +58,6 @@ var FindHelperUI = {
     Elements.tabList.addEventListener("TabSelect", this, true);
     Elements.browsers.addEventListener("URLChanged", this, true);
     window.addEventListener("MozContextUIShow", this, true);
-    window.addEventListener("MozContextUIExpand", this, true);
   },
 
   receiveMessage: function findHelperReceiveMessage(aMessage) {
@@ -81,7 +80,6 @@ var FindHelperUI = {
   handleEvent: function findHelperHandleEvent(aEvent) {
     switch (aEvent.type) {
       case "MozContextUIShow":
-      case "MozContextUIExpand":
       case "TabSelect":
         this.hide();
         break;
diff --git a/browser/metro/base/jar.mn b/browser/metro/base/jar.mn
index 4e504011237..22a315d862c 100644
--- a/browser/metro/base/jar.mn
+++ b/browser/metro/base/jar.mn
@@ -88,11 +88,13 @@ chrome.jar:
   content/TopSites.js                          (content/TopSites.js)
   content/console.js                           (content/console.js)
   content/AnimatedZoom.js                      (content/AnimatedZoom.js)
+  content/dbg-metro-actors.js                  (content/dbg-metro-actors.js)
 #ifdef MOZ_SERVICES_SYNC
 * content/sync.js                              (content/sync.js)
   content/RemoteTabs.js                        (content/RemoteTabs.js)
 #endif
   content/NavButtonSlider.js                   (content/NavButtonSlider.js)
+  content/ContextUI.js                         (content/ContextUI.js)
 
 % override chrome://global/content/config.xul chrome://browser/content/config.xul
 % override chrome://global/content/netError.xhtml chrome://browser/content/netError.xhtml
diff --git a/browser/metro/base/tests/mochitest/browser_context_ui.js b/browser/metro/base/tests/mochitest/browser_context_ui.js
index 3651f810c57..f244e5ab9b2 100644
--- a/browser/metro/base/tests/mochitest/browser_context_ui.js
+++ b/browser/metro/base/tests/mochitest/browser_context_ui.js
@@ -19,27 +19,27 @@ gTests.push({
       });
 
     is(StartUI.isVisible, true, "Start UI is displayed on about:start");
-    is(ContextUI.isVisible, true, "Navbar is displayed on about:start");
-    is(ContextUI.isExpanded, false, "Tabbar is not displayed initially");
-    is(Elements.navbar.isShowing, false, "Appbar is not displayed initially");
+    is(ContextUI.navbarVisible, true, "Navbar is displayed on about:start");
+    is(ContextUI.tabbarVisible, false, "Tabbar is not displayed initially");
+    is(ContextUI.contextAppbarVisible, false, "Appbar is not displayed initially");
 
     // toggle on
     doEdgeUIGesture();
-    is(ContextUI.isVisible, true, "Navbar is still visible after one swipe");
-    is(ContextUI.isExpanded, true, "Tabbar is visible after one swipe");
-    is(Elements.navbar.isShowing, true, "Appbar is visible after one swipe");
+    is(ContextUI.navbarVisible, true, "Navbar is still visible after one swipe");
+    is(ContextUI.tabbarVisible, true, "Tabbar is visible after one swipe");
+    is(ContextUI.contextAppbarVisible, false, "Appbar is hidden after one swipe");
 
     // toggle off
     doEdgeUIGesture();
-    is(ContextUI.isVisible, true, "Navbar is still visible after second swipe");
-    is(ContextUI.isExpanded, false, "Tabbar is hidden after second swipe");
-    is(Elements.navbar.isShowing, false, "Appbar is hidden after second swipe");
+    is(ContextUI.navbarVisible, true, "Navbar is still visible after second swipe");
+    is(ContextUI.tabbarVisible, false, "Tabbar is hidden after second swipe");
+    is(ContextUI.contextAppbarVisible, false, "Appbar is hidden after second swipe");
 
     // sanity check - toggle on again
     doEdgeUIGesture();
-    is(ContextUI.isVisible, true, "Navbar is still visible after third swipe");
-    is(ContextUI.isExpanded, true, "Tabbar is visible after third swipe");
-    is(Elements.navbar.isShowing, true, "Appbar is visible after third swipe");
+    is(ContextUI.navbarVisible, true, "Navbar is still visible after third swipe");
+    is(ContextUI.tabbarVisible, true, "Tabbar is visible after third swipe");
+    is(ContextUI.contextAppbarVisible, false, "Appbar is hidden after third swipe");
 
     is(StartUI.isVisible, true, "Start UI is still visible");
   }
@@ -51,19 +51,16 @@ gTests.push({
     yield addTab("about:");
     ContextUI.dismiss();
     is(StartUI.isVisible, false, "Start UI is not visible on about:");
-    is(ContextUI.isVisible, false, "Navbar is not initially visible on about:");
-    is(ContextUI.isExpanded, false, "Tabbar is not initially visible on about:");
-    is(Elements.navbar.isShowing, false, "Appbar is not initially visible on about on about::");
+    is(ContextUI.navbarVisible, false, "Navbar is not initially visible on about:");
+    is(ContextUI.tabbarVisible, false, "Tabbar is not initially visible on about:");
 
     doEdgeUIGesture();
-    is(ContextUI.isVisible, true, "Navbar is visible after one swipe");
-    is(ContextUI.isExpanded, true, "Tabbar is visble after one swipe");
-    is(Elements.navbar.isShowing, true, "Appbar is visible after one swipe");
+    is(ContextUI.navbarVisible, true, "Navbar is visible after one swipe");
+    is(ContextUI.tabbarVisible, true, "Tabbar is visble after one swipe");
 
     doEdgeUIGesture();
-    is(ContextUI.isVisible, false, "Navbar is not visible after second swipe");
-    is(ContextUI.isExpanded, false, "Tabbar is not visible after second swipe");
-    is(Elements.navbar.isShowing, false, "Appbar is hidden after second swipe");
+    is(ContextUI.navbarVisible, false, "Navbar is not visible after second swipe");
+    is(ContextUI.tabbarVisible, false, "Tabbar is not visible after second swipe");
 
     is(StartUI.isVisible, false, "Start UI is still not visible");
   }
@@ -74,12 +71,12 @@ gTests.push({
   run: function testAbout() {
     let tab = yield addTab("about:");
     ContextUI.dismiss();
-    is(ContextUI.isVisible, false, "Navbar is not initially visible");
-    is(ContextUI.isExpanded, false, "Tab bar is not initially visible");
+    is(ContextUI.navbarVisible, false, "Navbar is not initially visible");
+    is(ContextUI.tabbarVisible, false, "Tab bar is not initially visible");
 
     EventUtils.synthesizeKey('l', { accelKey: true });
-    is(ContextUI.isVisible, true, "Navbar is visible");
-    is(ContextUI.isExpanded, false, "Tab bar is not visible");
+    is(ContextUI.navbarVisible, true, "Navbar is visible");
+    is(ContextUI.tabbarVisible, false, "Tab bar is not visible");
 
     let edit = document.getElementById("urlbar-edit");
     is(edit.value, "about:", "Location field contains the page URL");
diff --git a/browser/metro/base/tests/mochitest/head.js b/browser/metro/base/tests/mochitest/head.js
index 6867aebb1dd..49f37fee4bf 100644
--- a/browser/metro/base/tests/mochitest/head.js
+++ b/browser/metro/base/tests/mochitest/head.js
@@ -171,23 +171,22 @@ function clearSelection(aTarget) {
   Asynchronous Metro ui helpers
 =============================================================================*/
 
+// Hides the tab and context app bar if they are visible
 function hideContextUI()
 {
   purgeEventQueue();
 
   return Task.spawn(function() {
-    if (ContextUI.isExpanded) {
+    if (ContextUI.tabbarVisible) {
       let promise = waitForEvent(Elements.tray, "transitionend", null, Elements.tray);
-      if (ContextUI.dismiss())
-      {
-        info("ContextUI dismissed, waiting...");
+      if (ContextUI.dismiss()) {
         yield promise;
       }
     }
 
-    if (Elements.contextappbar.isShowing) {
+    if (ContextUI.contextAppbarVisible) {
       let promise = waitForEvent(Elements.contextappbar, "transitionend", null, Elements.contextappbar);
-      Elements.contextappbar.dismiss();
+      ContextUI.dismissContextAppbar();
       yield promise;
     }
   });
@@ -196,7 +195,7 @@ function hideContextUI()
 function showNavBar()
 {
   let promise = waitForEvent(Elements.navbar, "transitionend");
-  if (!ContextUI.isVisible) {
+  if (!ContextUI.navbarVisible) {
     ContextUI.displayNavbar();
     return promise;
   }
diff --git a/browser/metro/profile/metro.js b/browser/metro/profile/metro.js
index 2268f564178..cc4074b6eea 100644
--- a/browser/metro/profile/metro.js
+++ b/browser/metro/profile/metro.js
@@ -385,7 +385,7 @@ pref("breakpad.reportURL", "https://crash-stats.mozilla.com/report/index/");
 // TODO: This is not the correct article for metro!!!
 pref("app.sync.tutorialURL", "https://support.mozilla.org/kb/sync-firefox-between-desktop-and-mobile");
 pref("app.support.baseURL", "https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/");
-pref("app.privacyURL", "https://www.mozilla.org/legal/privacy/");
+pref("app.privacyURL", "http://www.mozilla.org/%LOCALE%/legal/privacy/firefox.html");
 pref("app.creditsURL", "http://www.mozilla.org/credits/");
 pref("app.channelURL", "http://www.mozilla.org/%LOCALE%/firefox/channel/");
 
diff --git a/browser/metro/theme/browser.css b/browser/metro/theme/browser.css
index 9b22895374a..399ed8e929f 100644
--- a/browser/metro/theme/browser.css
+++ b/browser/metro/theme/browser.css
@@ -402,7 +402,7 @@ appbar[visible] {
   -moz-image-region: rect(0 80px 40px 40px);
 }
 
-#toolbar > .appbar-primary:not([checked]):active {
+#toolbar > .appbar-primary[checked] {
   -moz-image-region: rect(0 120px 40px 80px);
 }
 
@@ -410,6 +410,10 @@ appbar[visible] {
   -moz-image-region: rect(0 160px 40px 120px);
 }
 
+#toolbar > .appbar-primary:active {
+  -moz-image-region: rect(0 120px 40px 80px);
+}
+
 @media (min-resolution: 130dpi) {
   #toolbar > .appbar-primary > .toolbarbutton-icon {
     width: 40px;
@@ -424,13 +428,17 @@ appbar[visible] {
     -moz-image-region: rect(0 112px 56px 56px);
   }
 
-  #toolbar > .appbar-primary:not([checked]):active {
-    -moz-image-region: rect(0 168px 56px 112px);
+  #toolbar > .appbar-primary[checked] {
+    -moz-image-region: rect(0 224px 56px 168px);
   }
 
   #toolbar > .appbar-primary[checked]:hover:not(:active) {
     -moz-image-region: rect(0 224px 56px 168px);
   }
+
+  #toolbar > .appbar-primary:active {
+    -moz-image-region: rect(0 168px 56px 112px);
+  }
 }
 
 /* Page-Specific */
diff --git a/browser/themes/linux/downloads/downloads.css b/browser/themes/linux/downloads/downloads.css
index 240e37d860d..1f2dfb9541b 100644
--- a/browser/themes/linux/downloads/downloads.css
+++ b/browser/themes/linux/downloads/downloads.css
@@ -205,158 +205,3 @@ richlistitem[type="download"]:hover > stack > .downloadButton.downloadRetry:hove
 richlistitem[type="download"]:hover > stack > .downloadButton.downloadRetry:active {
   -moz-image-region: rect(32px, 64px, 48px, 48px);
 }
-
-/*** Status and progress indicator ***/
-
-#downloads-indicator-anchor {
-  /* Makes the outermost stack element positioned, so that its contents are
-     rendered over the main browser window in the Z order.  This is required by
-     the animated event notification. */
-  position: relative;
-}
-
-toolbar[iconsize="small"] > #downloads-indicator > #downloads-indicator-anchor {
-  min-width: 16px;
-  min-height: 16px;
-}
-
-toolbar[iconsize="large"] > #downloads-indicator > #downloads-indicator-anchor {
-  min-width: 24px;
-  min-height: 24px;
-}
-
-/*** Main indicator icon ***/
-
-toolbar[iconsize="small"] > #downloads-indicator > #downloads-indicator-anchor > #downloads-indicator-icon {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar-small.png"),
-                              0, 16, 16, 0) center no-repeat;
-}
-
-toolbar[iconsize="large"] > #downloads-indicator > #downloads-indicator-anchor > #downloads-indicator-icon {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
-                              0, 24, 24, 0) center no-repeat;
-}
-
-toolbar[iconsize="small"] > #downloads-indicator[attention] > #downloads-indicator-anchor > #downloads-indicator-icon {
-  background-image: url("chrome://browser/skin/downloads/download-glow-small.png");
-}
-
-toolbar[iconsize="large"] > #downloads-indicator[attention] > #downloads-indicator-anchor > #downloads-indicator-icon {
-  background-image: url("chrome://browser/skin/downloads/download-glow.png");
-}
-
-/* In the next few rules, we use :not([counter]) as a shortcut that is
-   equivalent to -moz-any([progress], [paused]). */
-
-#downloads-indicator:not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar-small.png"),
-                              0, 16, 16, 0) center no-repeat;
-  background-size: 12px;
-}
-
-#downloads-indicator:not([counter])[attention] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
-  background-image: url("chrome://browser/skin/downloads/download-glow.png");
-}
-
-/*** Download notifications ***/
-
-#downloads-indicator-notification {
-  opacity: 0;
-  background-size: 16px;
-  background-position: center;
-  background-repeat: no-repeat;
-}
-
-@keyframes downloadsIndicatorNotificationStartRight {
-  from { opacity: 0; transform: translate(-128px, 128px) scale(8); }
-  20%  { opacity: .85; animation-timing-function: ease-out; }
-  to   { opacity: 0; transform: translate(0) scale(1); }
-}
-
-@keyframes downloadsIndicatorNotificationStartLeft {
-  from { opacity: 0; transform: translate(128px, 128px) scale(8); }
-  20%  { opacity: .85; animation-timing-function: ease-out; }
-  to   { opacity: 0; transform: translate(0) scale(1); }
-}
-
-#downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-  background-image: url("chrome://browser/skin/downloads/download-notification-start.png");
-  animation-name: downloadsIndicatorNotificationStartRight;
-  animation-duration: 1s;
-}
-
-#downloads-indicator[notification="start"]:-moz-locale-dir(rtl) > #downloads-indicator-anchor > #downloads-indicator-notification {
-  animation-name: downloadsIndicatorNotificationStartLeft;
-}
-
-@keyframes downloadsIndicatorNotificationFinish {
-  from { opacity: 0; transform: scale(1); }
-  20%  { opacity: .65; animation-timing-function: ease-in; }
-  to   { opacity: 0; transform: scale(8); }
-}
-
-#downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-  background-image: url("chrome://browser/skin/downloads/download-notification-finish.png");
-  animation-name: downloadsIndicatorNotificationFinish;
-  animation-duration: 1s;
-}
-
-/*** Progress bar and text ***/
-
-#downloads-indicator-counter {
-  height: 10px;
-  margin: 0;
-  color: hsl(0,0%,30%);
-  text-shadow: 0 1px 0 hsla(0,0%,100%,.5);
-  font-size: 10px;
-  line-height: 10px;
-  text-align: center;
-}
-
-#downloads-indicator-progress {
-  width: 16px;
-  height: 6px;
-  min-width: 0;
-  min-height: 0;
-  margin-top: 1px;
-  margin-bottom: 2px;
-  border-radius: 2px;
-  box-shadow: 0 1px 0 hsla(0,0%,100%,.4);
-}
-
-#downloads-indicator-progress > .progress-bar {
-  -moz-appearance: none;
-  min-width: 0;
-  min-height: 0;
-  /* The background-clip: border-box; and background-image: none; are there to expand the background-color behind the border */
-  background-clip: padding-box, border-box;
-  background-color: rgb(255, 135, 94);
-  background-image: linear-gradient(transparent 1px, rgba(255, 255, 255, 0.4) 1px, rgba(255, 255, 255, 0.4) 2px, transparent 2px), none;
-  border: 1px solid;
-  border-color: rgba(0,43,86,.6) rgba(0,43,86,.4) rgba(0,43,86,.4);
-  border-radius: 2px 0 0 2px;
-}
-
-#downloads-indicator-progress > .progress-remainder {
-  -moz-appearance: none;
-  min-width: 0;
-  min-height: 0;
-  background-image: linear-gradient(#505050, #575757);
-  border: 1px solid;
-  border-color: hsla(0,0%,0%,.6) hsla(0,0%,0%,.4) hsla(0,0%,0%,.4);
-  -moz-border-start: none;
-  border-radius: 0 2px 2px 0;
-}
-
-#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-bar {
-  background-color: rgb(220, 230, 81);
-}
-
-#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-remainder {
-  background-image: linear-gradient(#4b5000, #515700);
-}
-
-toolbar[mode="full"] > #downloads-indicator > .toolbarbutton-text {
-  margin: 0;
-  text-align: center;
-}
diff --git a/browser/themes/linux/downloads/indicator.css b/browser/themes/linux/downloads/indicator.css
new file mode 100644
index 00000000000..06274d8ef57
--- /dev/null
+++ b/browser/themes/linux/downloads/indicator.css
@@ -0,0 +1,158 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*** Status and progress indicator ***/
+
+#downloads-indicator-anchor {
+  /* Makes the outermost stack element positioned, so that its contents are
+     rendered over the main browser window in the Z order.  This is required by
+     the animated event notification. */
+  position: relative;
+}
+
+toolbar[iconsize="small"] > #downloads-indicator > #downloads-indicator-anchor {
+  min-width: 16px;
+  min-height: 16px;
+}
+
+toolbar[iconsize="large"] > #downloads-indicator > #downloads-indicator-anchor {
+  min-width: 24px;
+  min-height: 24px;
+}
+
+/*** Main indicator icon ***/
+
+toolbar[iconsize="small"] > #downloads-indicator > #downloads-indicator-anchor > #downloads-indicator-icon {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar-small.png"),
+                              0, 16, 16, 0) center no-repeat;
+}
+
+toolbar[iconsize="large"] > #downloads-indicator > #downloads-indicator-anchor > #downloads-indicator-icon {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
+                              0, 24, 24, 0) center no-repeat;
+}
+
+toolbar[iconsize="small"] > #downloads-indicator[attention] > #downloads-indicator-anchor > #downloads-indicator-icon {
+  background-image: url("chrome://browser/skin/downloads/download-glow-small.png");
+}
+
+toolbar[iconsize="large"] > #downloads-indicator[attention] > #downloads-indicator-anchor > #downloads-indicator-icon {
+  background-image: url("chrome://browser/skin/downloads/download-glow.png");
+}
+
+/* In the next few rules, we use :not([counter]) as a shortcut that is
+   equivalent to -moz-any([progress], [paused]). */
+
+#downloads-indicator:not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar-small.png"),
+                              0, 16, 16, 0) center no-repeat;
+  background-size: 12px;
+}
+
+#downloads-indicator:not([counter])[attention] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
+  background-image: url("chrome://browser/skin/downloads/download-glow.png");
+}
+
+/*** Download notifications ***/
+
+#downloads-indicator-notification {
+  opacity: 0;
+  background-size: 16px;
+  background-position: center;
+  background-repeat: no-repeat;
+}
+
+@keyframes downloadsIndicatorNotificationStartRight {
+  from { opacity: 0; transform: translate(-128px, 128px) scale(8); }
+  20%  { opacity: .85; animation-timing-function: ease-out; }
+  to   { opacity: 0; transform: translate(0) scale(1); }
+}
+
+@keyframes downloadsIndicatorNotificationStartLeft {
+  from { opacity: 0; transform: translate(128px, 128px) scale(8); }
+  20%  { opacity: .85; animation-timing-function: ease-out; }
+  to   { opacity: 0; transform: translate(0) scale(1); }
+}
+
+#downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+  background-image: url("chrome://browser/skin/downloads/download-notification-start.png");
+  animation-name: downloadsIndicatorNotificationStartRight;
+  animation-duration: 1s;
+}
+
+#downloads-indicator[notification="start"]:-moz-locale-dir(rtl) > #downloads-indicator-anchor > #downloads-indicator-notification {
+  animation-name: downloadsIndicatorNotificationStartLeft;
+}
+
+@keyframes downloadsIndicatorNotificationFinish {
+  from { opacity: 0; transform: scale(1); }
+  20%  { opacity: .65; animation-timing-function: ease-in; }
+  to   { opacity: 0; transform: scale(8); }
+}
+
+#downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+  background-image: url("chrome://browser/skin/downloads/download-notification-finish.png");
+  animation-name: downloadsIndicatorNotificationFinish;
+  animation-duration: 1s;
+}
+
+/*** Progress bar and text ***/
+
+#downloads-indicator-counter {
+  height: 10px;
+  margin: 0;
+  color: hsl(0,0%,30%);
+  text-shadow: 0 1px 0 hsla(0,0%,100%,.5);
+  font-size: 10px;
+  line-height: 10px;
+  text-align: center;
+}
+
+#downloads-indicator-progress {
+  width: 16px;
+  height: 6px;
+  min-width: 0;
+  min-height: 0;
+  margin-top: 1px;
+  margin-bottom: 2px;
+  border-radius: 2px;
+  box-shadow: 0 1px 0 hsla(0,0%,100%,.4);
+}
+
+#downloads-indicator-progress > .progress-bar {
+  -moz-appearance: none;
+  min-width: 0;
+  min-height: 0;
+  /* The background-clip: border-box; and background-image: none; are there to expand the background-color behind the border */
+  background-clip: padding-box, border-box;
+  background-color: rgb(255, 135, 94);
+  background-image: linear-gradient(transparent 1px, rgba(255, 255, 255, 0.4) 1px, rgba(255, 255, 255, 0.4) 2px, transparent 2px), none;
+  border: 1px solid;
+  border-color: rgba(0,43,86,.6) rgba(0,43,86,.4) rgba(0,43,86,.4);
+  border-radius: 2px 0 0 2px;
+}
+
+#downloads-indicator-progress > .progress-remainder {
+  -moz-appearance: none;
+  min-width: 0;
+  min-height: 0;
+  background-image: linear-gradient(#505050, #575757);
+  border: 1px solid;
+  border-color: hsla(0,0%,0%,.6) hsla(0,0%,0%,.4) hsla(0,0%,0%,.4);
+  -moz-border-start: none;
+  border-radius: 0 2px 2px 0;
+}
+
+#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-bar {
+  background-color: rgb(220, 230, 81);
+}
+
+#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-remainder {
+  background-image: linear-gradient(#4b5000, #515700);
+}
+
+toolbar[mode="full"] > #downloads-indicator > .toolbarbutton-text {
+  margin: 0;
+  text-align: center;
+}
diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn
index dc5a1af29b1..821a599f4c8 100644
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -57,15 +57,16 @@ browser.jar:
   skin/classic/browser/webRTC-shareDevice-16.png
   skin/classic/browser/webRTC-shareDevice-64.png
   skin/classic/browser/webRTC-sharingDevice-16.png
+  skin/classic/browser/downloads/allDownloadsViewOverlay.css   (downloads/allDownloadsViewOverlay.css)
   skin/classic/browser/downloads/buttons.png          (downloads/buttons.png)
+  skin/classic/browser/downloads/contentAreaDownloadsView.css  (downloads/contentAreaDownloadsView.css)
   skin/classic/browser/downloads/download-glow.png    (downloads/download-glow.png)
   skin/classic/browser/downloads/download-glow-small.png (downloads/download-glow-small.png)
   skin/classic/browser/downloads/download-notification-finish.png (downloads/download-notification-finish.png)
   skin/classic/browser/downloads/download-notification-start.png (downloads/download-notification-start.png)
   skin/classic/browser/downloads/download-summary.png (downloads/download-summary.png)
   skin/classic/browser/downloads/downloads.css        (downloads/downloads.css)
-  skin/classic/browser/downloads/allDownloadsViewOverlay.css   (downloads/allDownloadsViewOverlay.css)
-  skin/classic/browser/downloads/contentAreaDownloadsView.css  (downloads/contentAreaDownloadsView.css)
+  skin/classic/browser/downloads/indicator.css        (downloads/indicator.css)
   skin/classic/browser/feeds/feedIcon.png             (feeds/feedIcon.png)
   skin/classic/browser/feeds/feedIcon16.png           (feeds/feedIcon16.png)
   skin/classic/browser/feeds/videoFeedIcon.png        (feeds/feedIcon.png)
diff --git a/browser/themes/osx/downloads/downloads.css b/browser/themes/osx/downloads/downloads.css
index 59fb5eb573a..d317eb36d9e 100644
--- a/browser/themes/osx/downloads/downloads.css
+++ b/browser/themes/osx/downloads/downloads.css
@@ -356,182 +356,3 @@ richlistitem[type="download"]:hover > stack > .downloadButton.downloadRetry:acti
     -moz-image-region: rect(64px, 256px, 96px, 224px);
   }
 }
-
-/*** Status and progress indicator ***/
-
-#downloads-indicator-anchor {
-  min-width: 20px;
-  min-height: 20px;
-  /* Makes the outermost stack element positioned, so that its contents are
-     rendered over the main browser window in the Z order.  This is required by
-     the animated event notification. */
-  position: relative;
-  /* The selected tab may overlap #downloads-indicator-notification */
-  z-index: 1;
-}
-
-/*** Main indicator icon ***/
-
-#downloads-indicator-icon {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
-                              0, 140, 20, 120) center no-repeat;
-}
-
-#downloads-indicator[attention]
-#downloads-indicator-icon {
-  background-image: url("chrome://browser/skin/downloads/download-glow.png");
-}
-
-/* In the next few rules, we use :not([counter]) as a shortcut that is
-   equivalent to -moz-any([progress], [paused]). */
-
-#downloads-indicator:not([counter])
-#downloads-indicator-counter {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
-                              0, 140, 20, 120) center no-repeat;
-  background-size: 12px;
-}
-
-#downloads-indicator:not([counter])[attention]
-#downloads-indicator-counter {
-  background-image: url("chrome://browser/skin/downloads/download-glow.png");
-}
-
-@media (min-resolution: 2dppx) {
-  #downloads-indicator-icon:not(:-moz-lwtheme-brighttext) {
-    background-image: -moz-image-rect(url("chrome://browser/skin/Toolbar@2x.png"), 0, 280, 40, 240);
-    background-size: 20px;
-  }
-
-  #downloads-indicator:not([counter]) > #downloads-indicator-anchor >
-  #downloads-indicator-progress-area > #downloads-indicator-counter {
-    background-image: -moz-image-rect(url("chrome://browser/skin/Toolbar@2x.png"), 0, 280, 40, 240);
-  }
-
-  #downloads-indicator[attention] > #downloads-indicator-anchor >
-  #downloads-indicator-icon {
-    background-image: url("chrome://browser/skin/downloads/download-glow@2x.png");
-  }
-
-  #downloads-indicator:not([counter])[attention] > #downloads-indicator-anchor >
-  #downloads-indicator-progress-area > #downloads-indicator-counter {
-    background-image: url("chrome://browser/skin/downloads/download-glow@2x.png");
-  }
-}
-
-/*** Download notifications ***/
-
-#downloads-indicator-notification {
-  opacity: 0;
-  background-size: 16px;
-  background-position: center;
-  background-repeat: no-repeat;
-}
-
-@keyframes downloadsIndicatorNotificationStartRight {
-  from { opacity: 0; transform: translate(-128px, 128px) scale(8); }
-  20%  { opacity: .85; animation-timing-function: ease-out; }
-  to   { opacity: 0; transform: translate(0) scale(1); }
-}
-
-@keyframes downloadsIndicatorNotificationStartLeft {
-  from { opacity: 0; transform: translate(128px, 128px) scale(8); }
-  20%  { opacity: .85; animation-timing-function: ease-out; }
-  to   { opacity: 0; transform: translate(0) scale(1); }
-}
-
-#downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-  background-image: url("chrome://browser/skin/downloads/download-notification-start.png");
-  animation-name: downloadsIndicatorNotificationStartRight;
-  animation-duration: 1s;
-}
-
-@media (min-resolution: 2dppx) {
-  #downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-    background-image: url("chrome://browser/skin/downloads/download-notification-start@2x.png");
-  }
-}
-
-#downloads-indicator[notification="start"]:-moz-locale-dir(rtl) > #downloads-indicator-anchor > #downloads-indicator-notification {
-  animation-name: downloadsIndicatorNotificationStartLeft;
-}
-
-@keyframes downloadsIndicatorNotificationFinish {
-  from { opacity: 0; transform: scale(1); }
-  20%  { opacity: .65; animation-timing-function: ease-in; }
-  to   { opacity: 0; transform: scale(8); }
-}
-
-#downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-  background-image: url("chrome://browser/skin/downloads/download-notification-finish.png");
-  animation-name: downloadsIndicatorNotificationFinish;
-  animation-duration: 1s;
-}
-
-@media (min-resolution: 2dppx) {
-  #downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-    background-image: url("chrome://browser/skin/downloads/download-notification-finish@2x.png");
-  }
-}
-
-/*** Progress bar and text ***/
-
-#downloads-indicator-counter {
-  height: 9px;
-  margin: -3px 0 0;
-  color: hsl(0,0%,30%);
-  text-shadow: 0 1px 0 hsla(0,0%,100%,.5);
-  font-size: 9px;
-  line-height: 9px;
-  text-align: center;
-}
-
-#downloads-indicator-progress {
-  width: 16px;
-  height: 5px;
-  min-width: 0;
-  min-height: 0;
-  margin-top: 1px;
-  margin-bottom: 2px;
-  border-radius: 2px;
-  box-shadow: 0 1px 0 hsla(0,0%,100%,.4);
-}
-
-#downloads-indicator-progress > .progress-bar {
-  -moz-appearance: none;
-  min-width: 0;
-  min-height: 0;
-  /* The background-clip: border-box; and background-image: none; are there to expand the background-color behind the border */
-  background-clip: padding-box, border-box;
-  background-color: rgb(90, 185, 255);
-  background-image: linear-gradient(transparent 1px, rgba(255, 255, 255, 0.4) 1px, rgba(255, 255, 255, 0.4) 2px, transparent 2px), none;
-  border: 1px solid;
-  border-color: rgba(0,43,86,.6) rgba(0,43,86,.4) rgba(0,43,86,.4);
-  border-radius: 2px 0 0 2px;
-}
-
-#downloads-indicator-progress > .progress-remainder {
-  -moz-appearance: none;
-  min-width: 0;
-  min-height: 0;
-  background-image: linear-gradient(#505050, #575757);
-  border: 1px solid;
-  border-color: hsla(0,0%,0%,.6) hsla(0,0%,0%,.4) hsla(0,0%,0%,.4);
-  -moz-border-start: none;
-  border-radius: 0 2px 2px 0;
-}
-
-#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-bar {
-  background-color: rgb(220, 230, 81);
-}
-
-#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-remainder {
-  background-image: linear-gradient(#4b5000, #515700);
-}
-
-toolbar[mode="full"] > #downloads-indicator > .toolbarbutton-text {
-  margin: 2px 0 0;
-  padding: 0;
-  text-align: center;
-  vertical-align: middle;
-}
diff --git a/browser/themes/osx/downloads/indicator.css b/browser/themes/osx/downloads/indicator.css
new file mode 100644
index 00000000000..83661dfdd34
--- /dev/null
+++ b/browser/themes/osx/downloads/indicator.css
@@ -0,0 +1,182 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*** Status and progress indicator ***/
+
+#downloads-indicator-anchor {
+  min-width: 20px;
+  min-height: 20px;
+  /* Makes the outermost stack element positioned, so that its contents are
+     rendered over the main browser window in the Z order.  This is required by
+     the animated event notification. */
+  position: relative;
+  /* The selected tab may overlap #downloads-indicator-notification */
+  z-index: 1;
+}
+
+/*** Main indicator icon ***/
+
+#downloads-indicator-icon {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
+                              0, 140, 20, 120) center no-repeat;
+}
+
+#downloads-indicator[attention]
+#downloads-indicator-icon {
+  background-image: url("chrome://browser/skin/downloads/download-glow.png");
+}
+
+/* In the next few rules, we use :not([counter]) as a shortcut that is
+   equivalent to -moz-any([progress], [paused]). */
+
+#downloads-indicator:not([counter])
+#downloads-indicator-counter {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
+                              0, 140, 20, 120) center no-repeat;
+  background-size: 12px;
+}
+
+#downloads-indicator:not([counter])[attention]
+#downloads-indicator-counter {
+  background-image: url("chrome://browser/skin/downloads/download-glow.png");
+}
+
+@media (min-resolution: 2dppx) {
+  #downloads-indicator-icon:not(:-moz-lwtheme-brighttext) {
+    background-image: -moz-image-rect(url("chrome://browser/skin/Toolbar@2x.png"), 0, 280, 40, 240);
+    background-size: 20px;
+  }
+
+  #downloads-indicator:not([counter]) > #downloads-indicator-anchor >
+  #downloads-indicator-progress-area > #downloads-indicator-counter {
+    background-image: -moz-image-rect(url("chrome://browser/skin/Toolbar@2x.png"), 0, 280, 40, 240);
+  }
+
+  #downloads-indicator[attention] > #downloads-indicator-anchor >
+  #downloads-indicator-icon {
+    background-image: url("chrome://browser/skin/downloads/download-glow@2x.png");
+  }
+
+  #downloads-indicator:not([counter])[attention] > #downloads-indicator-anchor >
+  #downloads-indicator-progress-area > #downloads-indicator-counter {
+    background-image: url("chrome://browser/skin/downloads/download-glow@2x.png");
+  }
+}
+
+/*** Download notifications ***/
+
+#downloads-indicator-notification {
+  opacity: 0;
+  background-size: 16px;
+  background-position: center;
+  background-repeat: no-repeat;
+}
+
+@keyframes downloadsIndicatorNotificationStartRight {
+  from { opacity: 0; transform: translate(-128px, 128px) scale(8); }
+  20%  { opacity: .85; animation-timing-function: ease-out; }
+  to   { opacity: 0; transform: translate(0) scale(1); }
+}
+
+@keyframes downloadsIndicatorNotificationStartLeft {
+  from { opacity: 0; transform: translate(128px, 128px) scale(8); }
+  20%  { opacity: .85; animation-timing-function: ease-out; }
+  to   { opacity: 0; transform: translate(0) scale(1); }
+}
+
+#downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+  background-image: url("chrome://browser/skin/downloads/download-notification-start.png");
+  animation-name: downloadsIndicatorNotificationStartRight;
+  animation-duration: 1s;
+}
+
+@media (min-resolution: 2dppx) {
+  #downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+    background-image: url("chrome://browser/skin/downloads/download-notification-start@2x.png");
+  }
+}
+
+#downloads-indicator[notification="start"]:-moz-locale-dir(rtl) > #downloads-indicator-anchor > #downloads-indicator-notification {
+  animation-name: downloadsIndicatorNotificationStartLeft;
+}
+
+@keyframes downloadsIndicatorNotificationFinish {
+  from { opacity: 0; transform: scale(1); }
+  20%  { opacity: .65; animation-timing-function: ease-in; }
+  to   { opacity: 0; transform: scale(8); }
+}
+
+#downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+  background-image: url("chrome://browser/skin/downloads/download-notification-finish.png");
+  animation-name: downloadsIndicatorNotificationFinish;
+  animation-duration: 1s;
+}
+
+@media (min-resolution: 2dppx) {
+  #downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+    background-image: url("chrome://browser/skin/downloads/download-notification-finish@2x.png");
+  }
+}
+
+/*** Progress bar and text ***/
+
+#downloads-indicator-counter {
+  height: 9px;
+  margin: -3px 0 0;
+  color: hsl(0,0%,30%);
+  text-shadow: 0 1px 0 hsla(0,0%,100%,.5);
+  font-size: 9px;
+  line-height: 9px;
+  text-align: center;
+}
+
+#downloads-indicator-progress {
+  width: 16px;
+  height: 5px;
+  min-width: 0;
+  min-height: 0;
+  margin-top: 1px;
+  margin-bottom: 2px;
+  border-radius: 2px;
+  box-shadow: 0 1px 0 hsla(0,0%,100%,.4);
+}
+
+#downloads-indicator-progress > .progress-bar {
+  -moz-appearance: none;
+  min-width: 0;
+  min-height: 0;
+  /* The background-clip: border-box; and background-image: none; are there to expand the background-color behind the border */
+  background-clip: padding-box, border-box;
+  background-color: rgb(90, 185, 255);
+  background-image: linear-gradient(transparent 1px, rgba(255, 255, 255, 0.4) 1px, rgba(255, 255, 255, 0.4) 2px, transparent 2px), none;
+  border: 1px solid;
+  border-color: rgba(0,43,86,.6) rgba(0,43,86,.4) rgba(0,43,86,.4);
+  border-radius: 2px 0 0 2px;
+}
+
+#downloads-indicator-progress > .progress-remainder {
+  -moz-appearance: none;
+  min-width: 0;
+  min-height: 0;
+  background-image: linear-gradient(#505050, #575757);
+  border: 1px solid;
+  border-color: hsla(0,0%,0%,.6) hsla(0,0%,0%,.4) hsla(0,0%,0%,.4);
+  -moz-border-start: none;
+  border-radius: 0 2px 2px 0;
+}
+
+#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-bar {
+  background-color: rgb(220, 230, 81);
+}
+
+#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-remainder {
+  background-image: linear-gradient(#4b5000, #515700);
+}
+
+toolbar[mode="full"] > #downloads-indicator > .toolbarbutton-text {
+  margin: 2px 0 0;
+  padding: 0;
+  text-align: center;
+  vertical-align: middle;
+}
diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn
index 2313b18c4dd..0874e564443 100644
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -94,8 +94,10 @@ browser.jar:
   skin/classic/browser/webRTC-shareDevice-64@2x.png
   skin/classic/browser/webRTC-sharingDevice-16.png
   skin/classic/browser/webRTC-sharingDevice-16@2x.png
+  skin/classic/browser/downloads/allDownloadsViewOverlay.css (downloads/allDownloadsViewOverlay.css)
   skin/classic/browser/downloads/buttons.png                (downloads/buttons.png)
   skin/classic/browser/downloads/buttons@2x.png             (downloads/buttons@2x.png)
+  skin/classic/browser/downloads/contentAreaDownloadsView.css (downloads/contentAreaDownloadsView.css)
   skin/classic/browser/downloads/download-glow.png          (downloads/download-glow.png)
   skin/classic/browser/downloads/download-glow@2x.png       (downloads/download-glow@2x.png)
   skin/classic/browser/downloads/download-notification-finish.png  (downloads/download-notification-finish.png)
@@ -105,8 +107,7 @@ browser.jar:
   skin/classic/browser/downloads/download-summary.png       (downloads/download-summary.png)
   skin/classic/browser/downloads/download-summary@2x.png    (downloads/download-summary@2x.png)
   skin/classic/browser/downloads/downloads.css              (downloads/downloads.css)
-  skin/classic/browser/downloads/allDownloadsViewOverlay.css (downloads/allDownloadsViewOverlay.css)
-  skin/classic/browser/downloads/contentAreaDownloadsView.css (downloads/contentAreaDownloadsView.css)
+  skin/classic/browser/downloads/indicator.css              (downloads/indicator.css)
   skin/classic/browser/feeds/subscribe.css                  (feeds/subscribe.css)
   skin/classic/browser/feeds/subscribe-ui.css               (feeds/subscribe-ui.css)
   skin/classic/browser/feeds/feedIcon.png                   (feeds/feedIcon.png)
diff --git a/browser/themes/windows/downloads/downloads-aero.css b/browser/themes/windows/downloads/downloads-aero.css
index 68dbfc1117d..e663c6c9d2e 100644
--- a/browser/themes/windows/downloads/downloads-aero.css
+++ b/browser/themes/windows/downloads/downloads-aero.css
@@ -20,41 +20,3 @@
     color: black;
   }
 }
-
-@media (-moz-windows-compositor) {
-  /* The following rules are for the downloads indicator when in its normal,
-     non-downloading, non-paused state (ie, it's just showing the downloads
-     button icon). */
-  #toolbar-menubar #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
-  #TabsToolbar[tabsontop=true] #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
-  #navigator-toolbox[tabsontop=false] > #nav-bar #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
-  #nav-bar + #customToolbars + #PersonalToolbar[collapsed=true] + #TabsToolbar[tabsontop=false]:last-child #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
-
-  /* The following rules are for the downloads indicator when in its paused
-     or undetermined progress state. We use :not([counter]) as a shortcut for
-     :-moz-any([progress], [paused]). */
-
-  /* This is the case where the downloads indicator has been moved next to the menubar */
-  #toolbar-menubar #downloads-indicator:not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter,
-  /* This is the case where the downloads indicator is in the tabstrip toolbar with tabs on top. */
-  #TabsToolbar[tabsontop=true] #downloads-indicator:not(:-moz-lwtheme):not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter,
-  /* This is the case where the downloads indicator is anywhere in the nav-bar with tabs on bottom. */
-  #navigator-toolbox[tabsontop=false] > #nav-bar #downloads-indicator:not(:-moz-lwtheme):not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter,
-  /* This is the case where the downloads indicator is in the tabstrip when the tabstrip is the last item in the toolbox (and is therefore over glass) */
-  #nav-bar + #customToolbars + #PersonalToolbar[collapsed=true] + #TabsToolbar[tabsontop=false]:last-child #downloads-indicator:not(:-moz-lwtheme):not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
-    background-image: -moz-image-rect(url("chrome://browser/skin/Toolbar-inverted.png"), 0, 108, 18, 90);
-  }
-
-  #toolbar-menubar #downloads-indicator-counter:not(:-moz-lwtheme),
-  #TabsToolbar[tabsontop=true] #downloads-indicator-counter:not(:-moz-lwtheme),
-  #navigator-toolbox[tabsontop=false] > #nav-bar #downloads-indicator-counter:not(:-moz-lwtheme),
-  #nav-bar + #customToolbars + #PersonalToolbar[collapsed=true] + #TabsToolbar[tabsontop=false]:last-child #downloads-indicator-counter:not(:-moz-lwtheme) {
-    color: white;
-    text-shadow: 0 0 1px rgba(0,0,0,.7),
-                 0 1px 1.5px rgba(0,0,0,.5);
-  }
-}
-
-#downloads-indicator-counter {
-  margin-bottom: -1px;
-}
diff --git a/browser/themes/windows/downloads/downloads.css b/browser/themes/windows/downloads/downloads.css
index 071420c4d1f..53bb8261e58 100644
--- a/browser/themes/windows/downloads/downloads.css
+++ b/browser/themes/windows/downloads/downloads.css
@@ -235,152 +235,3 @@ richlistitem[type="download"]:hover > stack > .downloadButton.downloadRetry:hove
 richlistitem[type="download"]:hover > stack > .downloadButton.downloadRetry:active {
   -moz-image-region: rect(32px, 64px, 48px, 48px);
 }
-
-/*** Status and progress indicator ***/
-
-#downloads-indicator-anchor {
-  /* Makes the outermost stack element positioned, so that its contents are
-     rendered over the main browser window in the Z order.  This is required by
-     the animated event notification. */
-  position: relative;
-}
-
-/*** Main indicator icon ***/
-
-#downloads-indicator-icon {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
-                              0, 108, 18, 90) center no-repeat;
-  min-width: 18px;
-  min-height: 18px;
-}
-
-#downloads-indicator-icon:-moz-lwtheme-brighttext {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar-inverted.png"),
-                              0, 108, 18, 90) center no-repeat;
-}
-
-#downloads-indicator[attention] > #downloads-indicator-anchor > #downloads-indicator-icon {
-  background-image: url("chrome://browser/skin/downloads/download-glow.png");
-}
-
-/* In the next few rules, we use :not([counter]) as a shortcut that is
-   equivalent to -moz-any([progress], [paused]). */
-
-#downloads-indicator:not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
-  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
-                              0, 108, 18, 90) center no-repeat;
-  background-size: 12px;
-}
-
-#downloads-indicator:not([counter])[attention] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
-  background-image: url("chrome://browser/skin/downloads/download-glow.png");
-}
-
-/*** Download notifications ***/
-
-#downloads-indicator-notification {
-  opacity: 0;
-  background-size: 16px;
-  background-position: center;
-  background-repeat: no-repeat;
-}
-
-@keyframes downloadsIndicatorNotificationStartRight {
-  from { opacity: 0; transform: translate(-128px, 128px) scale(8); }
-  20%  { opacity: .85; animation-timing-function: ease-out; }
-  to   { opacity: 0; transform: translate(0) scale(1); }
-}
-
-@keyframes downloadsIndicatorNotificationStartLeft {
-  from { opacity: 0; transform: translate(128px, 128px) scale(8); }
-  20%  { opacity: .85; animation-timing-function: ease-out; }
-  to   { opacity: 0; transform: translate(0) scale(1); }
-}
-
-#downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-  background-image: url("chrome://browser/skin/downloads/download-notification-start.png");
-  animation-name: downloadsIndicatorNotificationStartRight;
-  animation-duration: 1s;
-}
-
-#downloads-indicator[notification="start"]:-moz-locale-dir(rtl) > #downloads-indicator-anchor > #downloads-indicator-notification {
-  animation-name: downloadsIndicatorNotificationStartLeft;
-}
-
-@keyframes downloadsIndicatorNotificationFinish {
-  from { opacity: 0; transform: scale(1); }
-  20%  { opacity: .65; animation-timing-function: ease-in; }
-  to   { opacity: 0; transform: scale(8); }
-}
-
-#downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
-  background-image: url("chrome://browser/skin/downloads/download-notification-finish.png");
-  animation-name: downloadsIndicatorNotificationFinish;
-  animation-duration: 1s;
-}
-
-/*** Progress bar and text ***/
-
-#downloads-indicator-counter {
-  height: 9px;
-  margin: -3px 0px 0px 0px;
-  color: hsl(0,0%,30%);
-  text-shadow: hsla(0,0%,100%,.5) 0 1px;
-  font-size: 9px;
-  line-height: 9px;
-  text-align: center;
-}
-
-#downloads-indicator-counter:-moz-lwtheme-brighttext {
-  color: white;
-  text-shadow: 0 0 1px rgba(0,0,0,.7),
-               0 1px 1.5px rgba(0,0,0,.5);
-}
-
-#downloads-indicator-progress {
-  width: 16px;
-  height: 5px;
-  min-width: 0;
-  min-height: 0;
-  margin-top: 1px;
-  margin-bottom: 2px;
-  border-radius: 2px;
-  box-shadow: 0 1px 0 hsla(0,0%,100%,.4);
-}
-
-#downloads-indicator-progress > .progress-bar {
-  -moz-appearance: none;
-  min-width: 0;
-  min-height: 0;
-  /* The background-clip: border-box; and background-image: none; are there to expand the background-color behind the border */
-  background-clip: padding-box, border-box;
-  background-color: rgb(90, 201, 66);
-  background-image: linear-gradient(transparent 1px, rgba(255, 255, 255, 0.4) 1px, rgba(255, 255, 255, 0.4) 2px, transparent 2px), none;
-  border: 1px solid;
-  border-color: rgba(0,43,86,.6) rgba(0,43,86,.4) rgba(0,43,86,.4);
-  border-radius: 2px 0 0 2px;
-}
-
-#downloads-indicator-progress > .progress-remainder {
-  -moz-appearance: none;
-  min-width: 0;
-  min-height: 0;
-  background-image: linear-gradient(#505050, #575757);
-  border: 1px solid;
-  border-color: hsla(0,0%,0%,.6) hsla(0,0%,0%,.4) hsla(0,0%,0%,.4);
-  -moz-border-start: none;
-  border-radius: 0 2px 2px 0;
-}
-
-#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-bar {
-  background-color: rgb(220, 230, 81);
-}
-
-#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-remainder {
-  background-image: linear-gradient(#4b5000, #515700);
-}
-
-toolbar[mode="full"] > #downloads-indicator > .toolbarbutton-text {
-  margin: 0;
-  text-align: center;
-}
diff --git a/browser/themes/windows/downloads/indicator-aero.css b/browser/themes/windows/downloads/indicator-aero.css
new file mode 100644
index 00000000000..a06282aea0c
--- /dev/null
+++ b/browser/themes/windows/downloads/indicator-aero.css
@@ -0,0 +1,45 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+%define WINDOWS_AERO
+%include indicator.css
+%undef WINDOWS_AERO
+
+@media (-moz-windows-compositor) {
+  /* The following rules are for the downloads indicator when in its normal,
+     non-downloading, non-paused state (ie, it's just showing the downloads
+     button icon). */
+  #toolbar-menubar #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
+  #TabsToolbar[tabsontop=true] #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
+  #navigator-toolbox[tabsontop=false] > #nav-bar #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
+  #nav-bar + #customToolbars + #PersonalToolbar[collapsed=true] + #TabsToolbar[tabsontop=false]:last-child #downloads-indicator:not([attention]) > #downloads-indicator-anchor > #downloads-indicator-icon:not(:-moz-lwtheme),
+
+  /* The following rules are for the downloads indicator when in its paused
+     or undetermined progress state. We use :not([counter]) as a shortcut for
+     :-moz-any([progress], [paused]). */
+
+  /* This is the case where the downloads indicator has been moved next to the menubar */
+  #toolbar-menubar #downloads-indicator:not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter,
+  /* This is the case where the downloads indicator is in the tabstrip toolbar with tabs on top. */
+  #TabsToolbar[tabsontop=true] #downloads-indicator:not(:-moz-lwtheme):not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter,
+  /* This is the case where the downloads indicator is anywhere in the nav-bar with tabs on bottom. */
+  #navigator-toolbox[tabsontop=false] > #nav-bar #downloads-indicator:not(:-moz-lwtheme):not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter,
+  /* This is the case where the downloads indicator is in the tabstrip when the tabstrip is the last item in the toolbox (and is therefore over glass) */
+  #nav-bar + #customToolbars + #PersonalToolbar[collapsed=true] + #TabsToolbar[tabsontop=false]:last-child #downloads-indicator:not(:-moz-lwtheme):not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
+    background-image: -moz-image-rect(url("chrome://browser/skin/Toolbar-inverted.png"), 0, 108, 18, 90);
+  }
+
+  #toolbar-menubar #downloads-indicator-counter:not(:-moz-lwtheme),
+  #TabsToolbar[tabsontop=true] #downloads-indicator-counter:not(:-moz-lwtheme),
+  #navigator-toolbox[tabsontop=false] > #nav-bar #downloads-indicator-counter:not(:-moz-lwtheme),
+  #nav-bar + #customToolbars + #PersonalToolbar[collapsed=true] + #TabsToolbar[tabsontop=false]:last-child #downloads-indicator-counter:not(:-moz-lwtheme) {
+    color: white;
+    text-shadow: 0 0 1px rgba(0,0,0,.7),
+                 0 1px 1.5px rgba(0,0,0,.5);
+  }
+}
+
+#downloads-indicator-counter {
+  margin-bottom: -1px;
+}
diff --git a/browser/themes/windows/downloads/indicator.css b/browser/themes/windows/downloads/indicator.css
new file mode 100644
index 00000000000..9cea0c52418
--- /dev/null
+++ b/browser/themes/windows/downloads/indicator.css
@@ -0,0 +1,152 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*** Status and progress indicator ***/
+
+#downloads-indicator-anchor {
+  /* Makes the outermost stack element positioned, so that its contents are
+     rendered over the main browser window in the Z order.  This is required by
+     the animated event notification. */
+  position: relative;
+}
+
+/*** Main indicator icon ***/
+
+#downloads-indicator-icon {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
+                              0, 108, 18, 90) center no-repeat;
+  min-width: 18px;
+  min-height: 18px;
+}
+
+#downloads-indicator-icon:-moz-lwtheme-brighttext {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar-inverted.png"),
+                              0, 108, 18, 90) center no-repeat;
+}
+
+#downloads-indicator[attention] > #downloads-indicator-anchor > #downloads-indicator-icon {
+  background-image: url("chrome://browser/skin/downloads/download-glow.png");
+}
+
+/* In the next few rules, we use :not([counter]) as a shortcut that is
+   equivalent to -moz-any([progress], [paused]). */
+
+#downloads-indicator:not([counter]) > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
+  background: -moz-image-rect(url("chrome://browser/skin/Toolbar.png"),
+                              0, 108, 18, 90) center no-repeat;
+  background-size: 12px;
+}
+
+#downloads-indicator:not([counter])[attention] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-counter {
+  background-image: url("chrome://browser/skin/downloads/download-glow.png");
+}
+
+/*** Download notifications ***/
+
+#downloads-indicator-notification {
+  opacity: 0;
+  background-size: 16px;
+  background-position: center;
+  background-repeat: no-repeat;
+}
+
+@keyframes downloadsIndicatorNotificationStartRight {
+  from { opacity: 0; transform: translate(-128px, 128px) scale(8); }
+  20%  { opacity: .85; animation-timing-function: ease-out; }
+  to   { opacity: 0; transform: translate(0) scale(1); }
+}
+
+@keyframes downloadsIndicatorNotificationStartLeft {
+  from { opacity: 0; transform: translate(128px, 128px) scale(8); }
+  20%  { opacity: .85; animation-timing-function: ease-out; }
+  to   { opacity: 0; transform: translate(0) scale(1); }
+}
+
+#downloads-indicator[notification="start"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+  background-image: url("chrome://browser/skin/downloads/download-notification-start.png");
+  animation-name: downloadsIndicatorNotificationStartRight;
+  animation-duration: 1s;
+}
+
+#downloads-indicator[notification="start"]:-moz-locale-dir(rtl) > #downloads-indicator-anchor > #downloads-indicator-notification {
+  animation-name: downloadsIndicatorNotificationStartLeft;
+}
+
+@keyframes downloadsIndicatorNotificationFinish {
+  from { opacity: 0; transform: scale(1); }
+  20%  { opacity: .65; animation-timing-function: ease-in; }
+  to   { opacity: 0; transform: scale(8); }
+}
+
+#downloads-indicator[notification="finish"] > #downloads-indicator-anchor > #downloads-indicator-notification {
+  background-image: url("chrome://browser/skin/downloads/download-notification-finish.png");
+  animation-name: downloadsIndicatorNotificationFinish;
+  animation-duration: 1s;
+}
+
+/*** Progress bar and text ***/
+
+#downloads-indicator-counter {
+  height: 9px;
+  margin: -3px 0px 0px 0px;
+  color: hsl(0,0%,30%);
+  text-shadow: hsla(0,0%,100%,.5) 0 1px;
+  font-size: 9px;
+  line-height: 9px;
+  text-align: center;
+}
+
+#downloads-indicator-counter:-moz-lwtheme-brighttext {
+  color: white;
+  text-shadow: 0 0 1px rgba(0,0,0,.7),
+               0 1px 1.5px rgba(0,0,0,.5);
+}
+
+#downloads-indicator-progress {
+  width: 16px;
+  height: 5px;
+  min-width: 0;
+  min-height: 0;
+  margin-top: 1px;
+  margin-bottom: 2px;
+  border-radius: 2px;
+  box-shadow: 0 1px 0 hsla(0,0%,100%,.4);
+}
+
+#downloads-indicator-progress > .progress-bar {
+  -moz-appearance: none;
+  min-width: 0;
+  min-height: 0;
+  /* The background-clip: border-box; and background-image: none; are there to expand the background-color behind the border */
+  background-clip: padding-box, border-box;
+  background-color: rgb(90, 201, 66);
+  background-image: linear-gradient(transparent 1px, rgba(255, 255, 255, 0.4) 1px, rgba(255, 255, 255, 0.4) 2px, transparent 2px), none;
+  border: 1px solid;
+  border-color: rgba(0,43,86,.6) rgba(0,43,86,.4) rgba(0,43,86,.4);
+  border-radius: 2px 0 0 2px;
+}
+
+#downloads-indicator-progress > .progress-remainder {
+  -moz-appearance: none;
+  min-width: 0;
+  min-height: 0;
+  background-image: linear-gradient(#505050, #575757);
+  border: 1px solid;
+  border-color: hsla(0,0%,0%,.6) hsla(0,0%,0%,.4) hsla(0,0%,0%,.4);
+  -moz-border-start: none;
+  border-radius: 0 2px 2px 0;
+}
+
+#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-bar {
+  background-color: rgb(220, 230, 81);
+}
+
+#downloads-indicator[paused] > #downloads-indicator-anchor > #downloads-indicator-progress-area > #downloads-indicator-progress > .progress-remainder {
+  background-image: linear-gradient(#4b5000, #515700);
+}
+
+toolbar[mode="full"] > #downloads-indicator > .toolbarbutton-text {
+  margin: 0;
+  text-align: center;
+}
diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn
index 1439a323b12..640be2dd57a 100644
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -74,14 +74,15 @@ browser.jar:
         skin/classic/browser/webRTC-shareDevice-16.png
         skin/classic/browser/webRTC-shareDevice-64.png
         skin/classic/browser/webRTC-sharingDevice-16.png
+*       skin/classic/browser/downloads/allDownloadsViewOverlay.css   (downloads/allDownloadsViewOverlay.css)
         skin/classic/browser/downloads/buttons.png                   (downloads/buttons.png)
+        skin/classic/browser/downloads/contentAreaDownloadsView.css  (downloads/contentAreaDownloadsView.css)
         skin/classic/browser/downloads/download-glow.png             (downloads/download-glow.png)
         skin/classic/browser/downloads/download-notification-finish.png (downloads/download-notification-finish.png)
         skin/classic/browser/downloads/download-notification-start.png (downloads/download-notification-start.png)
         skin/classic/browser/downloads/download-summary.png          (downloads/download-summary.png)
 *       skin/classic/browser/downloads/downloads.css                 (downloads/downloads.css)
-*       skin/classic/browser/downloads/allDownloadsViewOverlay.css   (downloads/allDownloadsViewOverlay.css)
-        skin/classic/browser/downloads/contentAreaDownloadsView.css  (downloads/contentAreaDownloadsView.css)
+*       skin/classic/browser/downloads/indicator.css                 (downloads/indicator.css)
         skin/classic/browser/feeds/feedIcon.png                      (feeds/feedIcon.png)
         skin/classic/browser/feeds/feedIcon16.png                    (feeds/feedIcon16.png)
         skin/classic/browser/feeds/audioFeedIcon.png                 (feeds/feedIcon.png)
@@ -327,14 +328,15 @@ browser.jar:
         skin/classic/aero/browser/webRTC-shareDevice-16.png
         skin/classic/aero/browser/webRTC-shareDevice-64.png
         skin/classic/aero/browser/webRTC-sharingDevice-16.png
+*       skin/classic/aero/browser/downloads/allDownloadsViewOverlay.css (downloads/allDownloadsViewOverlay-aero.css)
         skin/classic/aero/browser/downloads/buttons.png              (downloads/buttons-aero.png)
+        skin/classic/aero/browser/downloads/contentAreaDownloadsView.css (downloads/contentAreaDownloadsView.css)
         skin/classic/aero/browser/downloads/download-glow.png        (downloads/download-glow.png)
         skin/classic/aero/browser/downloads/download-notification-finish.png (downloads/download-notification-finish.png)
         skin/classic/aero/browser/downloads/download-notification-start.png (downloads/download-notification-start.png)
         skin/classic/aero/browser/downloads/download-summary.png     (downloads/download-summary.png)
 *       skin/classic/aero/browser/downloads/downloads.css            (downloads/downloads-aero.css)
-*       skin/classic/aero/browser/downloads/allDownloadsViewOverlay.css (downloads/allDownloadsViewOverlay-aero.css)
-        skin/classic/aero/browser/downloads/contentAreaDownloadsView.css (downloads/contentAreaDownloadsView.css)
+*       skin/classic/aero/browser/downloads/indicator.css            (downloads/indicator-aero.css)
         skin/classic/aero/browser/feeds/feedIcon.png                 (feeds/feedIcon-aero.png)
         skin/classic/aero/browser/feeds/feedIcon16.png               (feeds/feedIcon16-aero.png)
         skin/classic/aero/browser/feeds/audioFeedIcon.png            (feeds/feedIcon-aero.png)
diff --git a/content/base/public/nsIObjectLoadingContent.idl b/content/base/public/nsIObjectLoadingContent.idl
index f1799ae9abb..38a98580239 100644
--- a/content/base/public/nsIObjectLoadingContent.idl
+++ b/content/base/public/nsIObjectLoadingContent.idl
@@ -25,7 +25,7 @@ interface nsIURI;
  * interface to mirror this interface when changing it.
  */
 
-[scriptable, uuid(24a35de3-40e4-498e-9c1b-2fd0a2d4cae5)]
+[scriptable, uuid(070bfc7f-f8b8-4e84-aa31-a0bfaffa8e8e)]
 interface nsIObjectLoadingContent : nsISupports
 {
   /**
@@ -87,6 +87,13 @@ interface nsIObjectLoadingContent : nsISupports
    */
   unsigned long getContentTypeForMIMEType(in AUTF8String aMimeType);
 
+  /**
+   * Returns the base URI of the object as seen by plugins. This differs from
+   * the normal codebase in that it takes <param> tags and plugin-specific
+   * quirks into account.
+   */
+  [noscript] readonly attribute nsIURI baseURI;
+
   /**
    * Returns the plugin instance if it has already been instantiated. This
    * will never instantiate the plugin and so is safe to call even when
diff --git a/content/base/src/CSPUtils.jsm b/content/base/src/CSPUtils.jsm
index 17d830c43ff..c439ebd8971 100644
--- a/content/base/src/CSPUtils.jsm
+++ b/content/base/src/CSPUtils.jsm
@@ -548,7 +548,8 @@ CSPRep.fromStringSpecCompliant = function(aStr, self, docRequest, csp) {
             // Check for unsafe-inline and unsafe-eval in script-src
             if (dv._allowUnsafeInline) {
               aCSPR._allowInlineScripts = true;
-            } else if (dv._allowUnsafeEval) {
+            }
+            if (dv._allowUnsafeEval) {
               aCSPR._allowEval = true;
             }
           }
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 718dece765e..a47f13eacdf 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -22,6 +22,7 @@
 #include "plstr.h"
 #include "prprf.h"
 
+#include "mozilla/Telemetry.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsDocument.h"
@@ -1420,6 +1421,46 @@ nsDocument::~nsDocument()
 
   NS_ASSERTION(!mIsShowing, "Destroying a currently-showing document");
 
+  if (IsTopLevelContentDocument()) {
+    //don't report for about: pages
+    nsCOMPtr<nsIPrincipal> principal = GetPrincipal();
+    nsCOMPtr<nsIURI> uri;
+    principal->GetURI(getter_AddRefs(uri));
+    bool isAboutScheme = true;
+    if (uri) {
+      uri->SchemeIs("about", &isAboutScheme);
+    }
+
+    if (!isAboutScheme) {
+      // Record the mixed content status of the docshell in Telemetry
+      enum {
+        NO_MIXED_CONTENT = 0, // There is no Mixed Content on the page
+        MIXED_DISPLAY_CONTENT = 1, // The page attempted to load Mixed Display Content
+        MIXED_ACTIVE_CONTENT = 2, // The page attempted to load Mixed Active Content
+        MIXED_DISPLAY_AND_ACTIVE_CONTENT = 3 // The page attempted to load Mixed Display & Mixed Active Content
+      };
+
+      bool mixedActiveLoaded = GetHasMixedActiveContentLoaded();
+      bool mixedActiveBlocked = GetHasMixedActiveContentBlocked();
+
+      bool mixedDisplayLoaded = GetHasMixedDisplayContentLoaded();
+      bool mixedDisplayBlocked = GetHasMixedDisplayContentBlocked();
+
+      bool hasMixedDisplay = (mixedDisplayBlocked || mixedDisplayLoaded);
+      bool hasMixedActive = (mixedActiveBlocked || mixedActiveLoaded);
+
+      uint32_t mixedContentLevel = NO_MIXED_CONTENT;
+      if (hasMixedDisplay && hasMixedActive) {
+        mixedContentLevel = MIXED_DISPLAY_AND_ACTIVE_CONTENT;
+      } else if (hasMixedActive){
+        mixedContentLevel = MIXED_ACTIVE_CONTENT;
+      } else if (hasMixedDisplay) {
+        mixedContentLevel = MIXED_DISPLAY_CONTENT;
+      }
+      Accumulate(Telemetry::MIXED_CONTENT_PAGE_LOAD, mixedContentLevel);
+    }
+  }
+
   mInDestructor = true;
   mInUnlinkOrDeletion = true;
 
@@ -4113,6 +4154,23 @@ nsIDocument::SetContainer(nsISupports* aContainer)
 {
   mDocumentContainer = do_GetWeakReference(aContainer);
   EnumerateFreezableElements(NotifyActivityChanged, nullptr);
+  // Get the Docshell
+  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(aContainer);
+  if (docShell) {
+    int32_t itemType;
+    docShell->GetItemType(&itemType);
+    // check itemtype
+    if (itemType == nsIDocShellTreeItem::typeContent) {
+      // check if same type root
+      nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
+      docShell->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
+      NS_ASSERTION(sameTypeRoot, "No document shell root tree item from document shell tree item!");
+
+      if (sameTypeRoot == docShell) {
+        static_cast<nsDocument*>(this)->SetIsTopLevelContentDocument(true);
+      }
+    }
+  }
 }
 
 void
@@ -4243,6 +4301,18 @@ nsDocument::SetScriptHandlingObject(nsIScriptGlobalObject* aScriptObject)
   }
 }
 
+bool
+nsDocument::IsTopLevelContentDocument()
+{
+  return mIsTopLevelContentDocument;
+}
+
+void
+nsDocument::SetIsTopLevelContentDocument(bool aIsTopLevelContentDocument)
+{
+  mIsTopLevelContentDocument = aIsTopLevelContentDocument;
+}
+
 nsPIDOMWindow *
 nsDocument::GetWindowInternal() const
 {
diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index 94ce56a935d..3895244bb23 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -1121,6 +1121,12 @@ public:
 
   static void XPCOMShutdown();
 
+  bool mIsTopLevelContentDocument:1;
+
+  bool IsTopLevelContentDocument();
+
+  void SetIsTopLevelContentDocument(bool aIsTopLevelContentDocument);
+
   js::ExpandoAndGeneration mExpandoAndGeneration;
 
 protected:
diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
index 1cc5cede03e..6ed3bc2c768 100644
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -18,6 +18,8 @@
 #include "nsIDocument.h"
 #include "nsIDOMDataContainerEvent.h"
 #include "nsIDOMDocument.h"
+#include "nsIDOMHTMLObjectElement.h"
+#include "nsIDOMHTMLAppletElement.h"
 #include "nsIExternalProtocolHandler.h"
 #include "nsEventStates.h"
 #include "nsIObjectFrame.h"
@@ -1065,6 +1067,13 @@ nsObjectLoadingContent::GetContentTypeForMIMEType(const nsACString& aMIMEType,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsObjectLoadingContent::GetBaseURI(nsIURI **aResult)
+{
+  NS_IF_ADDREF(*aResult = mBaseURI);
+  return NS_OK;
+}
+
 // nsIInterfaceRequestor
 // We use a shim class to implement this so that JS consumers still
 // see an interface requestor even though WebIDL bindings don't expose
@@ -1271,7 +1280,7 @@ nsObjectLoadingContent::CheckProcessPolicy(int16_t *aContentPolicy)
 }
 
 nsObjectLoadingContent::ParameterUpdateFlags
-nsObjectLoadingContent::UpdateObjectParameters()
+nsObjectLoadingContent::UpdateObjectParameters(bool aJavaURI)
 {
   nsCOMPtr<nsIContent> thisContent =
     do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
@@ -1304,7 +1313,7 @@ nsObjectLoadingContent::UpdateObjectParameters()
   ///
   /// Initial MIME Type
   ///
-  if (thisContent->NodeInfo()->Equals(nsGkAtoms::applet)) {
+  if (aJavaURI || thisContent->NodeInfo()->Equals(nsGkAtoms::applet)) {
     newMime.AssignLiteral("application/x-java-vm");
     isJava = true;
   } else {
@@ -1345,17 +1354,76 @@ nsObjectLoadingContent::UpdateObjectParameters()
 
   nsAutoString codebaseStr;
   nsCOMPtr<nsIURI> docBaseURI = thisContent->GetBaseURI();
-  thisContent->GetAttr(kNameSpaceID_None, nsGkAtoms::codebase, codebaseStr);
-  if (codebaseStr.IsEmpty() && thisContent->NodeInfo()->Equals(nsGkAtoms::applet)) {
-    // bug 406541
-    // NOTE we send the full absolute URI resolved here to java in
-    //      pluginInstanceOwner to avoid disagreements between parsing of
-    //      relative URIs. We need to mimic java's quirks here to make that
-    //      not break things.
-    codebaseStr.AssignLiteral("/"); // Java resolves codebase="" as "/"
-    // XXX(johns) This doesn't catch the case of "file:" which java would
-    // interpret as "file:///" but we would interpret as this document's URI
-    // but with a changed scheme.
+  bool hasCodebase = thisContent->HasAttr(kNameSpaceID_None, nsGkAtoms::codebase);
+  if (hasCodebase)
+    thisContent->GetAttr(kNameSpaceID_None, nsGkAtoms::codebase, codebaseStr);
+
+
+  // Java wants the codebase attribute even if it occurs in <param> tags
+  // XXX(johns): This duplicates a chunk of code from nsInstanceOwner, see
+  //             bug 853995
+  if (isJava) {
+    // Find all <param> tags that are nested beneath us, but not beneath another
+    // object/applet tag.
+    nsCOMArray<nsIDOMElement> ourParams;
+    nsCOMPtr<nsIDOMElement> mydomElement = do_QueryInterface(thisContent);
+
+    nsCOMPtr<nsIDOMHTMLCollection> allParams;
+    NS_NAMED_LITERAL_STRING(xhtml_ns, "http://www.w3.org/1999/xhtml");
+    mydomElement->GetElementsByTagNameNS(xhtml_ns, NS_LITERAL_STRING("param"),
+                                         getter_AddRefs(allParams));
+    if (allParams) {
+      uint32_t numAllParams;
+      allParams->GetLength(&numAllParams);
+      for (uint32_t i = 0; i < numAllParams; i++) {
+        nsCOMPtr<nsIDOMNode> pnode;
+        allParams->Item(i, getter_AddRefs(pnode));
+        nsCOMPtr<nsIDOMElement> domelement = do_QueryInterface(pnode);
+        if (domelement) {
+          nsAutoString name;
+          domelement->GetAttribute(NS_LITERAL_STRING("name"), name);
+          name.Trim(" \n\r\t\b", true, true, false);
+          if (name.EqualsIgnoreCase("codebase")) {
+            // Find the first plugin element parent
+            nsCOMPtr<nsIDOMNode> parent;
+            nsCOMPtr<nsIDOMHTMLObjectElement> domobject;
+            nsCOMPtr<nsIDOMHTMLAppletElement> domapplet;
+            pnode->GetParentNode(getter_AddRefs(parent));
+            while (!(domobject || domapplet) && parent) {
+              domobject = do_QueryInterface(parent);
+              domapplet = do_QueryInterface(parent);
+              nsCOMPtr<nsIDOMNode> temp;
+              parent->GetParentNode(getter_AddRefs(temp));
+              parent = temp;
+            }
+            if (domapplet || domobject) {
+              if (domapplet) {
+                parent = domapplet;
+              }
+              else {
+                parent = domobject;
+              }
+              nsCOMPtr<nsIDOMNode> mydomNode = do_QueryInterface(mydomElement);
+              if (parent == mydomNode) {
+                hasCodebase = true;
+                domelement->GetAttribute(NS_LITERAL_STRING("value"),
+                                         codebaseStr);
+                codebaseStr.Trim(" \n\r\t\b", true, true, false);
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  if (isJava && hasCodebase && codebaseStr.IsEmpty()) {
+    // Java treats an empty codebase as the document codebase, but codebase=""
+    // as "/"
+    codebaseStr.AssignLiteral("/");
+    // XXX(johns): This doesn't cover the case of "https:" which java would
+    //             interpret as "https:///" but we interpret as this document's
+    //             URI but with a changed scheme.
   }
 
   if (!codebaseStr.IsEmpty()) {
@@ -1372,7 +1440,7 @@ nsObjectLoadingContent::UpdateObjectParameters()
     }
   }
 
-  // Otherwise, use normal document baseURI
+  // If we failed to build a valid URI, use the document's base URI
   if (!newBaseURI) {
     newBaseURI = docBaseURI;
   }
@@ -1384,9 +1452,11 @@ nsObjectLoadingContent::UpdateObjectParameters()
   nsAutoString uriStr;
   // Different elements keep this in various locations
   if (isJava) {
-    // Applet tags and embed/object with explicit java MIMEs have
-    // src/data attributes that are not parsed as URIs, so we will
-    // act as if URI is null
+    // Applet tags and embed/object with explicit java MIMEs have src/data
+    // attributes that are not meant to be parsed as URIs or opened by the
+    // browser -- act as if they are null. (Setting these attributes triggers a
+    // force-load, so tracking the old value to determine if they have changed
+    // is not necessary.)
   } else if (thisContent->NodeInfo()->Equals(nsGkAtoms::object)) {
     thisContent->GetAttr(kNameSpaceID_None, nsGkAtoms::data, uriStr);
   } else if (thisContent->NodeInfo()->Equals(nsGkAtoms::embed)) {
@@ -1416,6 +1486,9 @@ nsObjectLoadingContent::UpdateObjectParameters()
       (caps & eAllowPluginSkipChannel) &&
       IsPluginEnabledByExtension(newURI, newMime)) {
     LOG(("OBJLC [%p]: Using extension as type hint (%s)", this, newMime.get()));
+    if (!isJava && nsPluginHost::IsJavaMIMEType(newMime.get())) {
+      return UpdateObjectParameters(true);
+    }
   }
 
   ///
@@ -1795,10 +1868,20 @@ nsObjectLoadingContent::LoadObject(bool aNotify,
   //
 
   if (mType != eType_Null) {
-    int16_t contentPolicy = nsIContentPolicy::ACCEPT;
     bool allowLoad = true;
+    if (nsPluginHost::IsJavaMIMEType(mContentType.get())) {
+      nsCOMPtr<nsIScriptSecurityManager> secMan =
+        nsContentUtils::GetSecurityManager();
+      rv = secMan->CheckLoadURIWithPrincipal(thisContent->NodePrincipal(),
+                                             mBaseURI, 0);
+      if (NS_FAILED(rv)) {
+        LOG(("OBJLC [%p]: Java codebase check failed", this));
+        allowLoad = false;
+      }
+    }
+    int16_t contentPolicy = nsIContentPolicy::ACCEPT;
     // If mChannelLoaded is set we presumably already passed load policy
-    if (mURI && !mChannelLoaded) {
+    if (allowLoad && mURI && !mChannelLoaded) {
       allowLoad = CheckLoadPolicy(&contentPolicy);
     }
     // If we're loading a type now, check ProcessPolicy. Note that we may check
diff --git a/content/base/src/nsObjectLoadingContent.h b/content/base/src/nsObjectLoadingContent.h
index 490d7d4d782..5853f419038 100644
--- a/content/base/src/nsObjectLoadingContent.h
+++ b/content/base/src/nsObjectLoadingContent.h
@@ -344,10 +344,14 @@ class nsObjectLoadingContent : public nsImageLoadingContent
      * 
      * NOTE This function does not perform security checks, only determining the
      *      requested type and parameters of the object.
-     * 
+     *
+     * @param aJavaURI Specify that the URI will be consumed by java, which
+     *                 changes codebase parsing and URI construction. Used
+     *                 internally.
+     *
      * @return Returns a bitmask of ParameterUpdateFlags values
      */
-    ParameterUpdateFlags UpdateObjectParameters();
+    ParameterUpdateFlags UpdateObjectParameters(bool aJavaURI = false);
 
     /**
      * Queue a CheckPluginStopEvent and track it in mPendingCheckPluginStopEvent
diff --git a/content/canvas/src/WebGLContext.cpp b/content/canvas/src/WebGLContext.cpp
index 40831fb344d..e497c0ce2fc 100644
--- a/content/canvas/src/WebGLContext.cpp
+++ b/content/canvas/src/WebGLContext.cpp
@@ -11,6 +11,7 @@
 #include "WebGLVertexAttribData.h"
 #include "WebGLMemoryMultiReporterWrapper.h"
 #include "WebGLFramebuffer.h"
+#include "WebGLVertexArray.h"
 
 #include "AccessCheck.h"
 #include "nsIConsoleService.h"
@@ -253,15 +254,16 @@ WebGLContext::DestroyResourcesAndContext()
     mBound2DTextures.Clear();
     mBoundCubeMapTextures.Clear();
     mBoundArrayBuffer = nullptr;
-    mBoundElementArrayBuffer = nullptr;
     mCurrentProgram = nullptr;
     mBoundFramebuffer = nullptr;
     mBoundRenderbuffer = nullptr;
-
-    mAttribBuffers.Clear();
+    mBoundVertexArray = nullptr;
+    mDefaultVertexArray = nullptr;
 
     while (!mTextures.isEmpty())
         mTextures.getLast()->DeleteOnce();
+    while (!mVertexArrays.isEmpty())
+        mVertexArrays.getLast()->DeleteOnce();
     while (!mBuffers.isEmpty())
         mBuffers.getLast()->DeleteOnce();
     while (!mRenderbuffers.isEmpty())
@@ -984,6 +986,8 @@ bool WebGLContext::IsExtensionSupported(JSContext *cx, WebGLExtensionID ext) con
         case OES_texture_float_linear:
             return gl->IsExtensionSupported(gl->IsGLES2() ? GLContext::OES_texture_float_linear
                                                           : GLContext::ARB_texture_float);
+        case OES_vertex_array_object:
+            return WebGLExtensionVertexArray::IsSupported(this);
         case EXT_texture_filter_anisotropic:
             return gl->IsExtensionSupported(GLContext::EXT_texture_filter_anisotropic);
         case WEBGL_compressed_texture_s3tc:
@@ -1063,6 +1067,10 @@ WebGLContext::GetExtension(JSContext *cx, const nsAString& aName, ErrorResult& r
     {
         ext = OES_texture_float_linear;
     }
+    else if (CompareWebGLExtensionName(name, "OES_vertex_array_object"))
+    {
+        ext = OES_vertex_array_object;
+    }
     else if (CompareWebGLExtensionName(name, "OES_standard_derivatives"))
     {
         ext = OES_standard_derivatives;
@@ -1161,6 +1169,9 @@ WebGLContext::GetExtension(JSContext *cx, const nsAString& aName, ErrorResult& r
             case WEBGL_draw_buffers:
                 obj = new WebGLExtensionDrawBuffers(this);
                 break;
+            case OES_vertex_array_object:
+                obj = new WebGLExtensionVertexArray(this);
+                break;
             default:
                 MOZ_ASSERT(false, "should not get there.");
         }
@@ -1564,6 +1575,8 @@ WebGLContext::GetSupportedExtensions(JSContext *cx, Nullable< nsTArray<nsString>
         arr.AppendElement(NS_LITERAL_STRING("WEBGL_depth_texture"));
     if (IsExtensionSupported(cx, WEBGL_draw_buffers))
         arr.AppendElement(NS_LITERAL_STRING("WEBGL_draw_buffers"));
+    if (IsExtensionSupported(cx, OES_vertex_array_object))
+        arr.AppendElement(NS_LITERAL_STRING("OES_vertex_array_object"));
 }
 
 //
@@ -1573,17 +1586,16 @@ WebGLContext::GetSupportedExtensions(JSContext *cx, Nullable< nsTArray<nsString>
 NS_IMPL_CYCLE_COLLECTING_ADDREF(WebGLContext)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(WebGLContext)
 
-NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_10(WebGLContext,
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_9(WebGLContext,
   mCanvasElement,
   mExtensions,
   mBound2DTextures,
   mBoundCubeMapTextures,
   mBoundArrayBuffer,
-  mBoundElementArrayBuffer,
   mCurrentProgram,
   mBoundFramebuffer,
   mBoundRenderbuffer,
-  mAttribBuffers)
+  mBoundVertexArray)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(WebGLContext)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
diff --git a/content/canvas/src/WebGLContext.h b/content/canvas/src/WebGLContext.h
index 3c7054e733b..feed4f8b655 100644
--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@@ -76,6 +76,7 @@ class WebGLFramebuffer;
 class WebGLRenderbuffer;
 class WebGLShaderPrecisionFormat;
 class WebGLTexture;
+class WebGLVertexArray;
 
 namespace dom {
 struct WebGLContextAttributes;
@@ -128,6 +129,7 @@ class WebGLContext :
     friend class WebGLExtensionCompressedTexturePVRTC;
     friend class WebGLExtensionDepthTexture;
     friend class WebGLExtensionDrawBuffers;
+    friend class WebGLExtensionVertexArray;
 
     enum {
         UNPACK_FLIP_Y_WEBGL = 0x9240,
@@ -321,6 +323,7 @@ public:
     void BindFramebuffer(WebGLenum target, WebGLFramebuffer* wfb);
     void BindRenderbuffer(WebGLenum target, WebGLRenderbuffer* wrb);
     void BindTexture(WebGLenum target, WebGLTexture *tex);
+    void BindVertexArray(WebGLVertexArray *vao);
     void BlendColor(WebGLclampf r, WebGLclampf g, WebGLclampf b, WebGLclampf a) {
         if (!IsContextStable())
             return;
@@ -367,12 +370,14 @@ public:
     already_AddRefed<WebGLRenderbuffer> CreateRenderbuffer();
     already_AddRefed<WebGLTexture> CreateTexture();
     already_AddRefed<WebGLShader> CreateShader(WebGLenum type);
+    already_AddRefed<WebGLVertexArray> CreateVertexArray();
     void CullFace(WebGLenum face);
     void DeleteBuffer(WebGLBuffer *buf);
     void DeleteFramebuffer(WebGLFramebuffer *fbuf);
     void DeleteProgram(WebGLProgram *prog);
     void DeleteRenderbuffer(WebGLRenderbuffer *rbuf);
     void DeleteShader(WebGLShader *shader);
+    void DeleteVertexArray(WebGLVertexArray *vao);
     void DeleteTexture(WebGLTexture *tex);
     void DepthFunc(WebGLenum func);
     void DepthMask(WebGLboolean b);
@@ -465,6 +470,7 @@ public:
     bool IsRenderbuffer(WebGLRenderbuffer *rb);
     bool IsShader(WebGLShader *shader);
     bool IsTexture(WebGLTexture *tex);
+    bool IsVertexArray(WebGLVertexArray *vao);
     void LineWidth(WebGLfloat width) {
         if (!IsContextStable())
             return;
@@ -874,6 +880,7 @@ protected:
         OES_standard_derivatives,
         OES_texture_float,
         OES_texture_float_linear,
+        OES_vertex_array_object,
         WEBGL_compressed_texture_atc,
         WEBGL_compressed_texture_pvrtc,
         WEBGL_compressed_texture_s3tc,
@@ -1031,14 +1038,10 @@ protected:
     void ForceLoseContext();
     void ForceRestoreContext();
 
-    // the buffers bound to the current program's attribs
-    nsTArray<WebGLVertexAttribData> mAttribBuffers;
-
     nsTArray<WebGLRefPtr<WebGLTexture> > mBound2DTextures;
     nsTArray<WebGLRefPtr<WebGLTexture> > mBoundCubeMapTextures;
 
     WebGLRefPtr<WebGLBuffer> mBoundArrayBuffer;
-    WebGLRefPtr<WebGLBuffer> mBoundElementArrayBuffer;
 
     WebGLRefPtr<WebGLProgram> mCurrentProgram;
 
@@ -1046,6 +1049,7 @@ protected:
 
     WebGLRefPtr<WebGLFramebuffer> mBoundFramebuffer;
     WebGLRefPtr<WebGLRenderbuffer> mBoundRenderbuffer;
+    WebGLRefPtr<WebGLVertexArray> mBoundVertexArray;
 
     LinkedList<WebGLTexture> mTextures;
     LinkedList<WebGLBuffer> mBuffers;
@@ -1053,6 +1057,9 @@ protected:
     LinkedList<WebGLShader> mShaders;
     LinkedList<WebGLRenderbuffer> mRenderbuffers;
     LinkedList<WebGLFramebuffer> mFramebuffers;
+    LinkedList<WebGLVertexArray> mVertexArrays;
+
+    WebGLRefPtr<WebGLVertexArray> mDefaultVertexArray;
 
     // PixelStore parameters
     uint32_t mPixelStorePackAlignment, mPixelStoreUnpackAlignment, mPixelStoreColorspaceConversion;
@@ -1138,6 +1145,7 @@ public:
     friend class WebGLBuffer;
     friend class WebGLShader;
     friend class WebGLUniformLocation;
+    friend class WebGLVertexArray;
 };
 
 // used by DOM bindings in conjunction with GetParentObject
diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index bf5d9c0f2a3..7ad60c26ecf 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -15,6 +15,7 @@
 #include "WebGLShaderPrecisionFormat.h"
 #include "WebGLTexture.h"
 #include "WebGLExtensions.h"
+#include "WebGLVertexArray.h"
 
 #include "nsString.h"
 #include "nsDebug.h"
@@ -162,7 +163,7 @@ WebGLContext::BindBuffer(WebGLenum target, WebGLBuffer *buf)
     if (target == LOCAL_GL_ARRAY_BUFFER) {
         mBoundArrayBuffer = buf;
     } else if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
-        mBoundElementArrayBuffer = buf;
+        mBoundVertexArray->mBoundElementArrayBuffer = buf;
     }
 
     MakeContextCurrent();
@@ -226,6 +227,39 @@ WebGLContext::BindRenderbuffer(WebGLenum target, WebGLRenderbuffer *wrb)
     mBoundRenderbuffer = wrb;
 }
 
+void
+WebGLContext::BindVertexArray(WebGLVertexArray *array)
+{
+    if (!IsContextStable())
+        return;
+
+    if (!ValidateObjectAllowDeletedOrNull("bindVertexArrayObject", array))
+        return;
+
+    if (array && array->IsDeleted()) {
+        /* http://www.khronos.org/registry/gles/extensions/OES/OES_vertex_array_object.txt
+         * BindVertexArrayOES fails and an INVALID_OPERATION error is
+         * generated if array is not a name returned from a previous call to
+         * GenVertexArraysOES, or if such a name has since been deleted with
+         * DeleteVertexArraysOES
+         */
+        ErrorInvalidOperation("bindVertexArray: can't bind a deleted array!");
+        return;
+    }
+
+    MakeContextCurrent();
+
+    if (array) {
+        gl->fBindVertexArray(array->GLName());
+        array->SetHasEverBeenBound(true);
+        mBoundVertexArray = array;
+    }
+    else {
+        gl->fBindVertexArray(0);
+        mBoundVertexArray = mDefaultVertexArray;
+    }
+}
+
 void
 WebGLContext::BindTexture(WebGLenum target, WebGLTexture *tex)
 {
@@ -337,7 +371,7 @@ GLenum WebGLContext::CheckedBufferData(GLenum target,
     if (target == LOCAL_GL_ARRAY_BUFFER) {
         boundBuffer = mBoundArrayBuffer;
     } else if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
-        boundBuffer = mBoundElementArrayBuffer;
+        boundBuffer = mBoundVertexArray->mBoundElementArrayBuffer;
     }
     NS_ABORT_IF_FALSE(boundBuffer != nullptr, "no buffer bound for this target");
     
@@ -366,7 +400,7 @@ WebGLContext::BufferData(WebGLenum target, WebGLsizeiptr size,
     if (target == LOCAL_GL_ARRAY_BUFFER) {
         boundBuffer = mBoundArrayBuffer;
     } else if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
-        boundBuffer = mBoundElementArrayBuffer;
+        boundBuffer = mBoundVertexArray->mBoundElementArrayBuffer;
     } else {
         return ErrorInvalidEnumInfo("bufferData: target", target);
     }
@@ -411,7 +445,7 @@ WebGLContext::BufferData(WebGLenum target, ArrayBuffer *data, WebGLenum usage)
     if (target == LOCAL_GL_ARRAY_BUFFER) {
         boundBuffer = mBoundArrayBuffer;
     } else if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
-        boundBuffer = mBoundElementArrayBuffer;
+        boundBuffer = mBoundVertexArray->mBoundElementArrayBuffer;
     } else {
         return ErrorInvalidEnumInfo("bufferData: target", target);
     }
@@ -449,7 +483,7 @@ WebGLContext::BufferData(WebGLenum target, ArrayBufferView& data, WebGLenum usag
     if (target == LOCAL_GL_ARRAY_BUFFER) {
         boundBuffer = mBoundArrayBuffer;
     } else if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
-        boundBuffer = mBoundElementArrayBuffer;
+        boundBuffer = mBoundVertexArray->mBoundElementArrayBuffer;
     } else {
         return ErrorInvalidEnumInfo("bufferData: target", target);
     }
@@ -492,7 +526,7 @@ WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr byteOffset,
     if (target == LOCAL_GL_ARRAY_BUFFER) {
         boundBuffer = mBoundArrayBuffer;
     } else if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
-        boundBuffer = mBoundElementArrayBuffer;
+        boundBuffer = mBoundVertexArray->mBoundElementArrayBuffer;
     } else {
         return ErrorInvalidEnumInfo("bufferSubData: target", target);
     }
@@ -530,7 +564,7 @@ WebGLContext::BufferSubData(WebGLenum target, WebGLsizeiptr byteOffset,
     if (target == LOCAL_GL_ARRAY_BUFFER) {
         boundBuffer = mBoundArrayBuffer;
     } else if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER) {
-        boundBuffer = mBoundElementArrayBuffer;
+        boundBuffer = mBoundVertexArray->mBoundElementArrayBuffer;
     } else {
         return ErrorInvalidEnumInfo("bufferSubData: target", target);
     }
@@ -1071,13 +1105,14 @@ WebGLContext::DeleteBuffer(WebGLBuffer *buf)
     if (mBoundArrayBuffer == buf)
         BindBuffer(LOCAL_GL_ARRAY_BUFFER,
                    static_cast<WebGLBuffer*>(nullptr));
-    if (mBoundElementArrayBuffer == buf)
+
+    if (mBoundVertexArray->mBoundElementArrayBuffer == buf)
         BindBuffer(LOCAL_GL_ELEMENT_ARRAY_BUFFER,
                    static_cast<WebGLBuffer*>(nullptr));
 
     for (int32_t i = 0; i < mGLMaxVertexAttribs; i++) {
-        if (mAttribBuffers[i].buf == buf)
-            mAttribBuffers[i].buf = nullptr;
+        if (mBoundVertexArray->mAttribBuffers[i].buf == buf)
+            mBoundVertexArray->mAttribBuffers[i].buf = nullptr;
     }
 
     buf->RequestDelete();
@@ -1124,6 +1159,24 @@ WebGLContext::DeleteRenderbuffer(WebGLRenderbuffer *rbuf)
     rbuf->RequestDelete();
 }
 
+void
+WebGLContext::DeleteVertexArray(WebGLVertexArray *array)
+{
+    if (!IsContextStable())
+        return;
+
+    if (array == nullptr)
+        return;
+
+    if (array->IsDeleted())
+        return;
+
+    if (mBoundVertexArray == array)
+        BindVertexArray(static_cast<WebGLVertexArray*>(nullptr));
+
+    array->RequestDelete();
+}
+
 void
 WebGLContext::DeleteTexture(WebGLTexture *tex)
 {
@@ -1251,7 +1304,7 @@ WebGLContext::DisableVertexAttribArray(WebGLuint index)
     if (index || gl->IsGLES2())
         gl->fDisableVertexAttribArray(index);
 
-    mAttribBuffers[index].enabled = false;
+    mBoundVertexArray->mAttribBuffers[index].enabled = false;
 }
 
 int
@@ -1262,14 +1315,14 @@ WebGLContext::WhatDoesVertexAttrib0Need()
     // work around Mac OSX crash, see bug 631420
 #ifdef XP_MACOSX
     if (gl->WorkAroundDriverBugs() &&
-        mAttribBuffers[0].enabled &&
+        mBoundVertexArray->mAttribBuffers[0].enabled &&
         !mCurrentProgram->IsAttribInUse(0))
     {
         return VertexAttrib0Status::EmulatedUninitializedArray;
     }
 #endif
 
-    return (gl->IsGLES2() || mAttribBuffers[0].enabled) ? VertexAttrib0Status::Default
+    return (gl->IsGLES2() || mBoundVertexArray->mAttribBuffers[0].enabled) ? VertexAttrib0Status::Default
          : mCurrentProgram->IsAttribInUse(0)            ? VertexAttrib0Status::EmulatedInitializedArray
                                                         : VertexAttrib0Status::EmulatedUninitializedArray;
 }
@@ -1369,13 +1422,13 @@ WebGLContext::UndoFakeVertexAttrib0()
     if (whatDoesAttrib0Need == VertexAttrib0Status::Default)
         return;
 
-    gl->fBindBuffer(LOCAL_GL_ARRAY_BUFFER, mAttribBuffers[0].buf ? mAttribBuffers[0].buf->GLName() : 0);
+    gl->fBindBuffer(LOCAL_GL_ARRAY_BUFFER, mBoundVertexArray->mAttribBuffers[0].buf ? mBoundVertexArray->mAttribBuffers[0].buf->GLName() : 0);
     gl->fVertexAttribPointer(0,
-                             mAttribBuffers[0].size,
-                             mAttribBuffers[0].type,
-                             mAttribBuffers[0].normalized,
-                             mAttribBuffers[0].stride,
-                             reinterpret_cast<const GLvoid *>(mAttribBuffers[0].byteOffset));
+                             mBoundVertexArray->mAttribBuffers[0].size,
+                             mBoundVertexArray->mAttribBuffers[0].type,
+                             mBoundVertexArray->mAttribBuffers[0].normalized,
+                             mBoundVertexArray->mAttribBuffers[0].stride,
+                             reinterpret_cast<const GLvoid *>(mBoundVertexArray->mAttribBuffers[0].byteOffset));
 
     gl->fBindBuffer(LOCAL_GL_ARRAY_BUFFER, mBoundArrayBuffer ? mBoundArrayBuffer->GLName() : 0);
 }
@@ -1592,10 +1645,10 @@ WebGLContext::DrawElements(WebGLenum mode, WebGLsizei count, WebGLenum type,
     if (!mCurrentProgram)
         return;
 
-    if (!mBoundElementArrayBuffer)
+    if (!mBoundVertexArray->mBoundElementArrayBuffer)
         return ErrorInvalidOperation("drawElements: must have element array buffer binding");
 
-    if (!mBoundElementArrayBuffer->ByteLength())
+    if (!mBoundVertexArray->mBoundElementArrayBuffer->ByteLength())
         return ErrorInvalidOperation("drawElements: bound element array buffer doesn't have any data");
 
     CheckedUint32 checked_neededByteCount = checked_byteCount + byteOffset;
@@ -1603,7 +1656,7 @@ WebGLContext::DrawElements(WebGLenum mode, WebGLsizei count, WebGLenum type,
     if (!checked_neededByteCount.isValid())
         return ErrorInvalidOperation("drawElements: overflow in byteOffset+byteCount");
 
-    if (checked_neededByteCount.value() > mBoundElementArrayBuffer->ByteLength())
+    if (checked_neededByteCount.value() > mBoundVertexArray->mBoundElementArrayBuffer->ByteLength())
         return ErrorInvalidOperation("drawElements: bound element array buffer is too small for given count and offset");
 
     uint32_t maxAllowedCount = 0;
@@ -1611,7 +1664,7 @@ WebGLContext::DrawElements(WebGLenum mode, WebGLsizei count, WebGLenum type,
         return;
 
     if (!maxAllowedCount ||
-        !mBoundElementArrayBuffer->Validate(type, maxAllowedCount - 1, first, count))
+        !mBoundVertexArray->mBoundElementArrayBuffer->Validate(type, maxAllowedCount - 1, first, count))
     {
         return ErrorInvalidOperation(
             "DrawElements: bound vertex attribute buffers do not have sufficient "
@@ -1710,7 +1763,7 @@ WebGLContext::EnableVertexAttribArray(WebGLuint index)
     InvalidateCachedMinInUseAttribArrayLength();
 
     gl->fEnableVertexAttribArray(index);
-    mAttribBuffers[index].enabled = true;
+    mBoundVertexArray->mAttribBuffers[index].enabled = true;
 }
 
 void
@@ -2030,6 +2083,21 @@ WebGLContext::GetParameter(JSContext* cx, WebGLenum pname, ErrorResult& rv)
         }
     }
 
+    if (IsExtensionEnabled(OES_vertex_array_object)) {
+        switch (pname) {
+
+             case LOCAL_GL_VERTEX_ARRAY_BINDING:
+             {
+                 if (mBoundVertexArray == mDefaultVertexArray){
+                     return WebGLObjectAsJSValue(cx, (WebGLVertexArray *) nullptr, rv);
+                 }
+
+                 return WebGLObjectAsJSValue(cx, mBoundVertexArray.get(), rv);
+             }
+
+        }
+    }
+
     switch (pname) {
         //
         // String params
@@ -2291,7 +2359,7 @@ WebGLContext::GetParameter(JSContext* cx, WebGLenum pname, ErrorResult& rv)
 
         case LOCAL_GL_ELEMENT_ARRAY_BUFFER_BINDING:
         {
-            return WebGLObjectAsJSValue(cx, mBoundElementArrayBuffer.get(), rv);
+            return WebGLObjectAsJSValue(cx, mBoundVertexArray->mBoundElementArrayBuffer.get(), rv);
         }
 
         case LOCAL_GL_RENDERBUFFER_BINDING:
@@ -2955,7 +3023,7 @@ WebGLContext::GetVertexAttrib(JSContext* cx, WebGLuint index, WebGLenum pname,
     if (!IsContextStable())
         return JS::NullValue();
 
-    if (!ValidateAttribIndex(index, "getVertexAttrib"))
+    if (!mBoundVertexArray->EnsureAttribIndex(index, "getVertexAttrib"))
         return JS::NullValue();
 
     MakeContextCurrent();
@@ -2963,18 +3031,18 @@ WebGLContext::GetVertexAttrib(JSContext* cx, WebGLuint index, WebGLenum pname,
     switch (pname) {
         case LOCAL_GL_VERTEX_ATTRIB_ARRAY_BUFFER_BINDING:
         {
-            return WebGLObjectAsJSValue(cx, mAttribBuffers[index].buf.get(), rv);
+            return WebGLObjectAsJSValue(cx, mBoundVertexArray->mAttribBuffers[index].buf.get(), rv);
         }
 
         case LOCAL_GL_VERTEX_ATTRIB_ARRAY_STRIDE:
-            return JS::Int32Value(mAttribBuffers[index].stride);
+            return JS::Int32Value(mBoundVertexArray->mAttribBuffers[index].stride);
 
         case LOCAL_GL_VERTEX_ATTRIB_ARRAY_SIZE:
         {
             if (!ValidateAttribIndex(index, "enableVertexAttribArray"))
                 return JS::NullValue();
 
-            if (!mAttribBuffers[index].enabled)
+            if (!mBoundVertexArray->mAttribBuffers[index].enabled)
                 return JS::Int32Value(4);
 
             // Don't break; fall through.
@@ -3009,14 +3077,12 @@ WebGLContext::GetVertexAttrib(JSContext* cx, WebGLuint index, WebGLenum pname,
 
         case LOCAL_GL_VERTEX_ATTRIB_ARRAY_ENABLED:
         {
-            return JS::BooleanValue(mAttribBuffers[index].enabled);
+            return JS::BooleanValue(mBoundVertexArray->mAttribBuffers[index].enabled);
         }
 
         case LOCAL_GL_VERTEX_ATTRIB_ARRAY_NORMALIZED:
         {
-            GLint i = 0;
-            gl->fGetVertexAttribiv(index, pname, &i);
-            return JS::BooleanValue(bool(i));
+            return JS::BooleanValue(mBoundVertexArray->mAttribBuffers[index].normalized);
         }
 
         default:
@@ -3040,7 +3106,7 @@ WebGLContext::GetVertexAttribOffset(WebGLuint index, WebGLenum pname)
         return 0;
     }
 
-    return mAttribBuffers[index].byteOffset;
+    return mBoundVertexArray->mAttribBuffers[index].byteOffset;
 }
 
 void
@@ -3109,6 +3175,20 @@ WebGLContext::IsRenderbuffer(WebGLRenderbuffer *rb)
         rb->HasEverBeenBound();
 }
 
+bool
+WebGLContext::IsVertexArray(WebGLVertexArray *array)
+{
+    if (!IsContextStable())
+        return false;
+
+    if (!array)
+        return false;
+
+    return ValidateObjectAllowDeleted("isVertexArray", array) &&
+           !array->IsDeleted() &&
+           array->HasEverBeenBound();
+}
+
 bool
 WebGLContext::IsShader(WebGLShader *shader)
 {
@@ -4330,6 +4410,22 @@ WebGLContext::CreateRenderbuffer()
     return globj.forget();
 }
 
+already_AddRefed<WebGLVertexArray>
+WebGLContext::CreateVertexArray()
+{
+    if (!IsContextStable())
+        return nullptr;
+
+    nsRefPtr<WebGLVertexArray> globj = new WebGLVertexArray(this);
+
+    MakeContextCurrent();
+    gl->fGenVertexArrays(1, &globj->mGLName);
+
+    mVertexArrays.insertBack(globj);
+
+    return globj.forget();
+}
+
 void
 WebGLContext::Viewport(WebGLint x, WebGLint y, WebGLsizei width, WebGLsizei height)
 {
@@ -4889,8 +4985,9 @@ WebGLContext::VertexAttribPointer(WebGLuint index, WebGLint size, WebGLenum type
     // requiredAlignment should always be a power of two.
     WebGLsizei requiredAlignmentMask = requiredAlignment - 1;
 
-    if (!ValidateAttribIndex(index, "vertexAttribPointer"))
+    if ( !mBoundVertexArray->EnsureAttribIndex(index, "vertexAttribPointer") ) {
         return;
+    }
 
     if (size < 1 || size > 4)
         return ErrorInvalidValue("vertexAttribPointer: invalid element size");
@@ -4919,7 +5016,7 @@ WebGLContext::VertexAttribPointer(WebGLuint index, WebGLint size, WebGLenum type
         return ErrorInvalidOperation("vertexAttribPointer: type must match bound VBO type: %d != %d", type, mBoundArrayBuffer->GLType());
     */
 
-    WebGLVertexAttribData &vd = mAttribBuffers[index];
+    WebGLVertexAttribData &vd = mBoundVertexArray->mAttribBuffers[index];
 
     vd.buf = mBoundArrayBuffer;
     vd.stride = stride;
diff --git a/content/canvas/src/WebGLContextValidate.cpp b/content/canvas/src/WebGLContextValidate.cpp
index cc45386b4de..87ec8519fed 100644
--- a/content/canvas/src/WebGLContextValidate.cpp
+++ b/content/canvas/src/WebGLContextValidate.cpp
@@ -12,6 +12,7 @@
 #include "WebGLFramebuffer.h"
 #include "WebGLRenderbuffer.h"
 #include "WebGLTexture.h"
+#include "WebGLVertexArray.h"
 
 #include "mozilla/CheckedInt.h"
 #include "mozilla/Preferences.h"
@@ -112,9 +113,9 @@ WebGLContext::ValidateBuffers(uint32_t *maxAllowedCount, const char *info)
     }
 
     uint32_t maxAllowed = UINT32_MAX;
-    uint32_t attribs = mAttribBuffers.Length();
+    uint32_t attribs = mBoundVertexArray->mAttribBuffers.Length();
     for (uint32_t i = 0; i < attribs; ++i) {
-        const WebGLVertexAttribData& vd = mAttribBuffers[i];
+        const WebGLVertexAttribData& vd = mBoundVertexArray->mAttribBuffers[i];
 
         // If the attrib array isn't enabled, there's nothing to check;
         // it's a static value.
@@ -850,18 +851,7 @@ WebGLContext::ValidateUniformSetter(const char* name, WebGLUniformLocation *loca
 
 bool WebGLContext::ValidateAttribIndex(WebGLuint index, const char *info)
 {
-    if (index >= mAttribBuffers.Length()) {
-        if (index == WebGLuint(-1)) {
-             ErrorInvalidValue("%s: index -1 is invalid. That probably comes from a getAttribLocation() call, "
-                               "where this return value -1 means that the passed name didn't correspond to an active attribute in "
-                               "the specified program.", info);
-        } else {
-             ErrorInvalidValue("%s: index %d is out of range", info, index);
-        }
-        return false;
-    } else {
-        return true;
-    }
+    return mBoundVertexArray->EnsureAttribIndex(index, info);
 }
 
 bool WebGLContext::ValidateStencilParamsForDrawCall()
@@ -905,13 +895,10 @@ WebGLContext::InitAndValidateGL()
     mActiveTexture = 0;
     mWebGLError = LOCAL_GL_NO_ERROR;
 
-    mAttribBuffers.Clear();
-
     mBound2DTextures.Clear();
     mBoundCubeMapTextures.Clear();
 
     mBoundArrayBuffer = nullptr;
-    mBoundElementArrayBuffer = nullptr;
     mCurrentProgram = nullptr;
 
     mBoundFramebuffer = nullptr;
@@ -934,8 +921,6 @@ WebGLContext::InitAndValidateGL()
         return false;
     }
 
-    mAttribBuffers.SetLength(mGLMaxVertexAttribs);
-
     // Note: GL_MAX_TEXTURE_UNITS is fixed at 4 for most desktop hardware,
     // even though the hardware supports much more.  The
     // GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS value is the accurate value.
@@ -1084,5 +1069,9 @@ WebGLContext::InitAndValidateGL()
                                      false);
     }
 
+    mDefaultVertexArray = new WebGLVertexArray(this);
+    mDefaultVertexArray->mAttribBuffers.SetLength(mGLMaxVertexAttribs);
+    mBoundVertexArray = mDefaultVertexArray;
+
     return true;
 }
diff --git a/content/canvas/src/WebGLExtensionVertexArray.cpp b/content/canvas/src/WebGLExtensionVertexArray.cpp
new file mode 100644
index 00000000000..e4f4d0b2d3a
--- /dev/null
+++ b/content/canvas/src/WebGLExtensionVertexArray.cpp
@@ -0,0 +1,57 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WebGLContext.h"
+#include "WebGLBuffer.h"
+#include "WebGLVertexArray.h"
+#include "WebGLExtensions.h"
+#include "mozilla/dom/WebGLRenderingContextBinding.h"
+
+using namespace mozilla;
+
+WebGLExtensionVertexArray::WebGLExtensionVertexArray(WebGLContext* context)
+  : WebGLExtensionBase(context)
+{
+    MOZ_ASSERT(IsSupported(context), "should not construct WebGLExtensionVertexArray :"
+                                     "OES_vertex_array_object unsuported.");
+}
+
+WebGLExtensionVertexArray::~WebGLExtensionVertexArray()
+{
+}
+
+already_AddRefed<WebGLVertexArray> WebGLExtensionVertexArray::CreateVertexArrayOES()
+{
+    return mContext->CreateVertexArray();
+}
+
+void WebGLExtensionVertexArray::DeleteVertexArrayOES(WebGLVertexArray* array)
+{
+    mContext->DeleteVertexArray(array);
+}
+
+bool WebGLExtensionVertexArray::IsVertexArrayOES(WebGLVertexArray* array)
+{
+    return mContext->IsVertexArray(array);
+}
+
+void WebGLExtensionVertexArray::BindVertexArrayOES(WebGLVertexArray* array)
+{
+    mContext->BindVertexArray(array);
+}
+
+bool WebGLExtensionVertexArray::IsSupported(const WebGLContext* context)
+{
+    gl::GLContext* gl = context->GL();
+
+    if (gl->IsGLES2()) {
+        return gl->IsExtensionSupported(gl::GLContext::OES_vertex_array_object);
+    }
+
+    return gl->IsExtensionSupported(gl::GLContext::ARB_vertex_array_object) ||
+           gl->IsExtensionSupported(gl::GLContext::APPLE_vertex_array_object);
+}
+
+IMPL_WEBGL_EXTENSION_GOOP(WebGLExtensionVertexArray)
diff --git a/content/canvas/src/WebGLExtensions.h b/content/canvas/src/WebGLExtensions.h
index 79242deb2a5..c7d2fdbd5a1 100644
--- a/content/canvas/src/WebGLExtensions.h
+++ b/content/canvas/src/WebGLExtensions.h
@@ -172,6 +172,23 @@ public:
     DECL_WEBGL_EXTENSION_GOOP
 };
 
+class WebGLExtensionVertexArray
+    : public WebGLExtensionBase
+{
+public:
+    WebGLExtensionVertexArray(WebGLContext*);
+    virtual ~WebGLExtensionVertexArray();
+
+    already_AddRefed<WebGLVertexArray> CreateVertexArrayOES();
+    void DeleteVertexArrayOES(WebGLVertexArray* array);
+    bool IsVertexArrayOES(WebGLVertexArray* array);
+    void BindVertexArrayOES(WebGLVertexArray* array);
+
+    static bool IsSupported(const WebGLContext* context);
+
+    DECL_WEBGL_EXTENSION_GOOP
+};
+
 } // namespace mozilla
 
 #endif // WEBGLEXTENSIONS_H_
diff --git a/content/canvas/src/WebGLVertexArray.cpp b/content/canvas/src/WebGLVertexArray.cpp
new file mode 100644
index 00000000000..632a964645a
--- /dev/null
+++ b/content/canvas/src/WebGLVertexArray.cpp
@@ -0,0 +1,69 @@
+/* -*- Mode: C++; tab-width: 20; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "WebGLContext.h"
+#include "WebGLBuffer.h"
+#include "WebGLVertexArray.h"
+#include "mozilla/dom/WebGLRenderingContextBinding.h"
+#include "nsContentUtils.h"
+
+using namespace mozilla;
+
+JSObject*
+WebGLVertexArray::WrapObject(JSContext *cx, JS::Handle<JSObject*> scope) {
+    return dom::WebGLVertexArrayBinding::Wrap(cx, scope, this);
+}
+
+WebGLVertexArray::WebGLVertexArray(WebGLContext* context)
+    : WebGLContextBoundObject(context)
+    , mGLName(0)
+    , mHasEverBeenBound(false)
+{
+    SetIsDOMBinding();
+}
+
+void WebGLVertexArray::Delete() {
+    if (mGLName != 0) {
+        mBoundElementArrayBuffer = nullptr;
+
+        mContext->MakeContextCurrent();
+        mContext->gl->fDeleteVertexArrays(1, &mGLName);
+        LinkedListElement<WebGLVertexArray>::removeFrom(mContext->mVertexArrays);
+    }
+
+    mBoundElementArrayBuffer = nullptr;
+    mAttribBuffers.Clear();
+}
+
+bool WebGLVertexArray::EnsureAttribIndex(WebGLuint index, const char *info)
+{
+    if (index >= WebGLuint(mContext->mGLMaxVertexAttribs)) {
+        if (index == WebGLuint(-1)) {
+            mContext->ErrorInvalidValue("%s: index -1 is invalid. That probably comes from a getAttribLocation() call, "
+                                        "where this return value -1 means that the passed name didn't correspond to an active attribute in "
+                                        "the specified program.", info);
+        } else {
+            mContext->ErrorInvalidValue("%s: index %d is out of range", info, index);
+        }
+        return false;
+    }
+    else if (index >= mAttribBuffers.Length()) {
+        mAttribBuffers.SetLength(index + 1);
+    }
+
+    return true;
+}
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_2(WebGLVertexArray,
+  mAttribBuffers,
+  mBoundElementArrayBuffer)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(WebGLVertexArray)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(WebGLVertexArray)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(WebGLVertexArray)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
diff --git a/content/canvas/src/WebGLVertexArray.h b/content/canvas/src/WebGLVertexArray.h
new file mode 100644
index 00000000000..f08887b959e
--- /dev/null
+++ b/content/canvas/src/WebGLVertexArray.h
@@ -0,0 +1,62 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef WEBGLVERTEXARRAY_H_
+#define WEBGLVERTEXARRAY_H_
+
+#include "WebGLObjectModel.h"
+#include "WebGLVertexAttribData.h"
+
+#include "nsWrapperCache.h"
+
+#include "mozilla/LinkedList.h"
+
+namespace mozilla {
+
+class WebGLVertexArray MOZ_FINAL
+    : public nsISupports
+    , public WebGLRefCountedObject<WebGLVertexArray>
+    , public LinkedListElement<WebGLVertexArray>
+    , public WebGLContextBoundObject
+    , public nsWrapperCache
+{
+public:
+    WebGLVertexArray(WebGLContext *context);
+
+    ~WebGLVertexArray() {
+        DeleteOnce();
+    };
+
+    void Delete();
+
+    bool HasEverBeenBound() { return mHasEverBeenBound; }
+    void SetHasEverBeenBound(bool x) { mHasEverBeenBound = x; }
+    WebGLuint GLName() const { return mGLName; }
+
+    WebGLContext* GetParentObject() const {
+        return Context();
+    }
+
+    bool EnsureAttribIndex(WebGLuint index, const char *info);
+
+    virtual JSObject* WrapObject(JSContext *cx,
+                                 JS::Handle<JSObject*> scope) MOZ_OVERRIDE;
+
+    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+    NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(WebGLVertexArray)
+
+    WebGLuint mGLName;
+    bool mHasEverBeenBound;
+
+    nsTArray<WebGLVertexAttribData> mAttribBuffers;
+    WebGLRefPtr<WebGLBuffer> mBoundElementArrayBuffer;
+
+    friend class WebGLContext;
+    friend class WebGLExtensionVertexArray;
+};
+
+} // namespace mozilla
+
+#endif
diff --git a/content/canvas/src/moz.build b/content/canvas/src/moz.build
index dfcfc539e52..40afa85e116 100644
--- a/content/canvas/src/moz.build
+++ b/content/canvas/src/moz.build
@@ -47,6 +47,7 @@ if CONFIG['MOZ_WEBGL']:
         'WebGLExtensionTextureFilterAnisotropic.cpp',
         'WebGLExtensionTextureFloat.cpp',
         'WebGLExtensionTextureFloatLinear.cpp',
+        'WebGLExtensionVertexArray.cpp',
         'WebGLFramebuffer.cpp',
         'WebGLObjectModel.cpp',
         'WebGLProgram.cpp',
@@ -56,6 +57,7 @@ if CONFIG['MOZ_WEBGL']:
         'WebGLTexelConversions.cpp',
         'WebGLTexture.cpp',
         'WebGLUniformLocation.cpp',
+        'WebGLVertexArray.cpp',
     ]
 else:
     CPP_SOURCES += [
diff --git a/content/canvas/test/webgl/conformance/extensions/oes-vertex-array-object.html b/content/canvas/test/webgl/conformance/extensions/oes-vertex-array-object.html
index 82bba73e274..3aca5200b5f 100644
--- a/content/canvas/test/webgl/conformance/extensions/oes-vertex-array-object.html
+++ b/content/canvas/test/webgl/conformance/extensions/oes-vertex-array-object.html
@@ -148,7 +148,11 @@ function runObjectTest() {
     ext.bindVertexArrayOES(null);
     shouldBeTrue("ext.isVertexArrayOES(vao)");
     
-    shouldBeFalse("ext.isVertexArrayOES()");
+    /*
+     * Issue found in the conformance test. The public webgl mailing list has been notified about it.
+     * The tests have already been fixed upstream.
+     */
+    //shouldBeFalse("ext.isVertexArrayOES()");
     shouldBeFalse("ext.isVertexArrayOES(null)");
     
     ext.deleteVertexArrayOES(vao);
diff --git a/content/canvas/test/webgl/failing_tests_android.txt b/content/canvas/test/webgl/failing_tests_android.txt
index edb20075d2b..c50b73159fb 100644
--- a/content/canvas/test/webgl/failing_tests_android.txt
+++ b/content/canvas/test/webgl/failing_tests_android.txt
@@ -1,4 +1,5 @@
 conformance/extensions/oes-texture-float.html
+conformance/extensions/oes-vertex-array-object.html
 conformance/glsl/functions/glsl-function-abs.html
 conformance/glsl/functions/glsl-function-ceil.html
 conformance/glsl/functions/glsl-function-clamp-float.html
diff --git a/content/media/test/Makefile.in b/content/media/test/Makefile.in
index 545d3360b09..63767c568c5 100644
--- a/content/media/test/Makefile.in
+++ b/content/media/test/Makefile.in
@@ -138,6 +138,7 @@ MOCHITEST_FILES = \
 		test_paused_after_removed.html \
 		$(filter disabled-for-intermittent-failures--bug-608634, test_error_in_video_document.html) \
 		test_texttrack.html \
+		test_texttrackcue.html \
 		test_timeupdate_small_files.html \
 		test_unseekable.html \
 		test_webvtt_disabled.html \
@@ -259,6 +260,7 @@ MOCHITEST_FILES += \
 		detodos.opus \
 		notags.mp3 \
 		id3tags.mp3 \
+		basic.vtt \
 		$(NULL)
 
 # Wave sample files
diff --git a/content/media/test/basic.vtt b/content/media/test/basic.vtt
new file mode 100644
index 00000000000..89e5f327128
--- /dev/null
+++ b/content/media/test/basic.vtt
@@ -0,0 +1,17 @@
+WEBVTT
+
+1
+00:00.500 --> 00:00.700
+This
+
+2
+00:01.200 --> 00:02.400
+Is
+
+3
+00:02.710 --> 00:02.910
+A
+
+3
+00:03.217 --> 00:03.989
+Test
\ No newline at end of file
diff --git a/content/media/test/test_texttrackcue.html b/content/media/test/test_texttrackcue.html
new file mode 100644
index 00000000000..a8a4a2d9314
--- /dev/null
+++ b/content/media/test/test_texttrackcue.html
@@ -0,0 +1,126 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=833386
+-->
+<head>
+  <meta charset='utf-8'>
+  <title>Test for Bug 833386 - HTMLTrackElement</title>
+  <script type="text/javascript" src="/MochiKit/MochiKit.js"></script>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content">
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+SimpleTest.waitForExplicitFinish();
+SpecialPowers.pushPrefEnv({"set": [["media.webvtt.enabled", true]]},
+  function() {
+    var video = document.createElement("video");
+    video.src = "seek.webm";
+    var trackElement = document.createElement("track");
+    trackElement.src = "basic.vtt";
+    trackElement.kind = "subtitles";
+    document.getElementById("content").appendChild(video);
+    video.appendChild(trackElement);
+    run_tests();
+    function run_tests() {
+      // Re-que run_tests() at the end of the event loop until the track
+      // element has loaded its data.
+      if (trackElement.readyState == 1) {
+        setTimeout(run_tests, 0);
+        return;
+      }
+      is(trackElement.readyState, 2, "Track::ReadyState should be set to LOADED.");
+
+      var cueList = trackElement.track.cues;
+      is(cueList.length, 4, "Cue list length should be 4.");
+
+      // Check if first cue was parsed correctly.
+      var cue = cueList[0];
+      is(cue.id, "1", "Cue's ID should be 1.");
+      is(cue.startTime, 0.5, "Cue's start time should be 0.5.");
+      is(cue.endTime, 0.7, "Cue's end time should be 0.7.");
+      is(cue.pauseOnExit, false, "Cue's pause on exit flag should be false.");
+      is(cue.text, "This", "Cue's text should be set correctly.");
+      // TODO: https://bugzilla.mozilla.org/show_bug.cgi?id=879431
+      // GetTrack() isn't implemented so this *is* returning undefined currently.
+      todo_isnot(cue.track, undefined, "Cue's track should be defined.");
+
+      // Check that all cue times were not rounded
+      is(cueList[1].startTime, 1.2, "Second cue's start time should be 1.2.");
+      is(cueList[1].endTime, 2.4, "Second cue's end time should be 2.4.");
+      is(cueList[2].startTime, 2.71, "Third cue's start time should be 2.71.");
+      is(cueList[2].endTime, 2.91, "Third cue's end time should be 2.91.");
+      is(cueList[3].startTime, 3.217, "Fourth cue's start time should be 3.217.");
+      is(cueList[3].endTime, 3.989, "Fourth cue's end time should be 3.989.");
+
+      // Check that Cue setters are working correctly.
+      cue.id = "Cue 01";
+      is(cue.id, "Cue 01", "Cue's ID should be 'Cue 01'.");
+      cue.startTime = 1.5;
+      is(cue.startTime, 1.5, "Cue's start time should be 1.5.");
+      cue.endTime = 2.5;
+      is(cue.endTime, 2.5, "Cue's end time should be 2.5.");
+      cue.pauseOnExit = true;
+      is(cue.pauseOnExit, true, "Cue's pause on exit flag should be true.");
+
+      // Check that we can create and add new TextTrackCues
+      var textTrackCue = new TextTrackCue(3.999, 4, "foo");
+      trackElement.track.addCue(textTrackCue);
+      is(cueList.length, 5, "Cue list length should now be 5.");
+
+      // Check that new TestTrackCue was added correctly
+      cue = cueList[4];
+      is(cue.startTime, 3.999, "Cue's start time should be 3.999.");
+      is(cue.endTime, 4, "Cue's end time should be 4.");
+      is(cue.text, "foo", "Cue's text should be foo.");
+
+      // Adding the same cue again should not increase the cue count.
+      // TODO: https://bugzilla.mozilla.org/show_bug.cgi?id=867823
+      //       http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrack-addcue
+      trackElement.track.addCue(textTrackCue);
+      todo_is(cueList.length, 5, "Cue list length should be 5.");
+
+      // Check that we are able to remove cues.
+      trackElement.track.removeCue(cue);
+      // TODO: Marked as todo as incorrect addition up top increases cue count
+      // to 4 -- https://bugzilla.mozilla.org/show_bug.cgi?id=867823
+      todo_is(cueList.length, 4, "Cue list length should be 4.");
+
+      var exceptionHappened = false;
+      try {
+        // We should not be able to remove a cue that is not in the list.
+        cue = new TextTrackCue(1, 2, "foo");
+        trackElement.removeCue(cue);
+      } catch (e) {
+        // "NotFoundError" should be thrown when trying to remove a cue that is
+        // not in the list.
+        // TODO: https://bugzilla.mozilla.org/show_bug.cgi?id=867823
+        //       http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrack-removecue
+        todo_is(e.name, "NotFoundError", "We should have caught an error.");
+        exceptionHappened = true;
+      }
+      // If this is false then we did not throw an error and probably removed a cue
+      // when we shouln't have.
+      ok(exceptionHappened, "Exception should have happened.");
+
+      // We should not have removed a cue so the cue list length should not
+      // have changed.
+      // TODO: Marked as todo as incorrect addition of cue up top increases
+      // count erroneously.
+      // https://bugzilla.mozilla.org/show_bug.cgi?id=867823
+      todo_is(cueList.length, 4, "Cue list length should be 4.");
+
+      SimpleTest.finish();
+    }
+  }
+);
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/webaudio/AudioBufferSourceNode.cpp b/content/media/webaudio/AudioBufferSourceNode.cpp
index cb2263fb19d..af7624dde65 100644
--- a/content/media/webaudio/AudioBufferSourceNode.cpp
+++ b/content/media/webaudio/AudioBufferSourceNode.cpp
@@ -41,6 +41,12 @@ NS_INTERFACE_MAP_END_INHERITING(AudioNode)
 NS_IMPL_ADDREF_INHERITED(AudioBufferSourceNode, AudioNode)
 NS_IMPL_RELEASE_INHERITED(AudioBufferSourceNode, AudioNode)
 
+/**
+ * Media-thread playback engine for AudioBufferSourceNode.
+ * Nothing is played until a non-null buffer has been set (via
+ * AudioNodeStream::SetBuffer) and a non-zero duration has been set (via
+ * AudioNodeStream::SetInt32Parameter).
+ */
 class AudioBufferSourceNodeEngine : public AudioNodeEngine
 {
 public:
@@ -353,8 +359,9 @@ public:
                                  AudioChunk* aOutput,
                                  bool* aFinished)
   {
-    if (!mBuffer)
+    if (!mBuffer || !mDuration) {
       return;
+    }
 
     uint32_t channels = mBuffer->GetChannels();
     if (!channels) {
@@ -484,7 +491,9 @@ AudioBufferSourceNode::Start(double aWhen, double aOffset,
                       std::numeric_limits<double>::min();
     SendOffsetAndDurationParametersToStream(ns, aOffset, duration);
   } else {
-    // Remember our arguments so that we can use them once we have a buffer
+    // Remember our arguments so that we can use them once we have a buffer.
+    // We can't send these parameters now because we don't know the buffer
+    // sample rate.
     mOffset = aOffset;
     mDuration = aDuration.WasPassed() ?
                 aDuration.Value() :
@@ -512,11 +521,13 @@ AudioBufferSourceNode::SendBufferParameterToStream(JSContext* aCx)
       mBuffer->GetThreadSharedChannelsForRate(aCx);
     ns->SetBuffer(data.forget());
     ns->SetInt32Parameter(SAMPLE_RATE, rate);
+
+    if (mStartCalled) {
+      SendOffsetAndDurationParametersToStream(ns, mOffset, mDuration);
+    }
   } else {
     ns->SetBuffer(nullptr);
   }
-
-  SendOffsetAndDurationParametersToStream(ns, mOffset, mDuration);
 }
 
 void
@@ -524,8 +535,11 @@ AudioBufferSourceNode::SendOffsetAndDurationParametersToStream(AudioNodeStream*
                                                                double aOffset,
                                                                double aDuration)
 {
-  float rate = mBuffer ? mBuffer->SampleRate() : Context()->SampleRate();
-  int32_t lengthSamples = mBuffer ? mBuffer->Length() : 0;
+  NS_ASSERTION(mBuffer && mStartCalled,
+               "Only call this when we have a buffer and start() has been called");
+
+  float rate = mBuffer->SampleRate();
+  int32_t lengthSamples = mBuffer->Length();
   double length = double(lengthSamples) / rate;
   double offset = std::max(0.0, aOffset);
   double endOffset = aDuration == std::numeric_limits<double>::min() ?
diff --git a/content/media/webaudio/test/Makefile.in b/content/media/webaudio/test/Makefile.in
index 7aeb580e7fa..53c4ce3e6fc 100644
--- a/content/media/webaudio/test/Makefile.in
+++ b/content/media/webaudio/test/Makefile.in
@@ -44,6 +44,7 @@ MOCHITEST_FILES := \
   test_audioBufferSourceNodeLoop.html \
   test_audioBufferSourceNodeLoopStartEnd.html \
   test_audioBufferSourceNodeLoopStartEndSame.html \
+  test_audioBufferSourceNodeNoStart.html \
   test_audioBufferSourceNodeNullBuffer.html \
   test_badConnect.html \
   test_biquadFilterNode.html \
diff --git a/content/media/webaudio/test/test_audioBufferSourceNodeNoStart.html b/content/media/webaudio/test/test_audioBufferSourceNodeNoStart.html
new file mode 100644
index 00000000000..89340ade8b3
--- /dev/null
+++ b/content/media/webaudio/test/test_audioBufferSourceNodeNoStart.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test AudioBufferSourceNode when start() is not called</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="webaudio.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+var gTest = {
+  length: 2048,
+  numberOfChannels: 1,
+  createGraph: function(context) {
+    var buffer = context.createBuffer(1, 2048, context.sampleRate);
+    var data = buffer.getChannelData(0);
+    for (var i = 0; i < data.length; ++i) {
+      data[i] = (i%100)/100 - 0.5;
+    }
+    var source = context.createBufferSource();
+    source.buffer = buffer;
+    return source;
+  },
+};
+
+runTest();
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 36af17da2aa..62329fac8d8 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -18,7 +18,6 @@
 #include "mozilla/Services.h"
 #include "mozilla/StartupTimeline.h"
 #include "mozilla/Telemetry.h"
-#include "mozilla/Telemetry.h"
 #include "mozilla/unused.h"
 #include "mozilla/Util.h"
 #include "mozilla/VisualEventTracer.h"
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index 310cae7d990..f1bc6c6bad5 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1196,6 +1196,11 @@ DOMInterfaces = {
    'headerFile': 'WebGLExtensions.h'
 },
 
+'WebGLExtensionVertexArray': {
+   'nativeType': 'mozilla::WebGLExtensionVertexArray',
+   'headerFile': 'WebGLExtensions.h'
+},
+
 'WebGLFramebuffer': {
    'nativeType': 'mozilla::WebGLFramebuffer',
    'headerFile': 'WebGLFramebuffer.h'
@@ -1241,6 +1246,11 @@ DOMInterfaces = {
    'wrapperCache': False
 },
 
+'WebGLVertexArray': {
+   'nativeType': 'mozilla::WebGLVertexArray',
+   'headerFile': 'WebGLVertexArray.h'
+},
+
 'WebSocket': {
     'headerFile': 'WebSocket.h',
     'implicitJSContext': [ 'constructor' ]
diff --git a/dom/locales/en-US/chrome/accessibility/AccessFu.properties b/dom/locales/en-US/chrome/accessibility/AccessFu.properties
index 4d5874d3929..9066907e555 100644
--- a/dom/locales/en-US/chrome/accessibility/AccessFu.properties
+++ b/dom/locales/en-US/chrome/accessibility/AccessFu.properties
@@ -80,6 +80,20 @@ listStart      =       First item
 listEnd        =       Last item
 listItemCount  =       %S items
 
+# Description of a table or grid:
+# 1 is a dynamically retrieved localized role of either 'table' or 'grid'.
+# 2 is the number of columns within the table.
+# 3 is the number of rows within the table or grid.
+tableInfo = %S with %S and %S
+tableColumnInfo = 1 column;#1 columns
+tableRowInfo = 1 row;#1 rows
+
+# table or grid cell information
+columnInfo = Column %S
+rowInfo = Row %S
+spansColumns = spans %S columns
+spansRows = spans %S rows
+
 # Invoked actions
 jumpAction     =      jumped
 pressAction    =      pressed
@@ -141,3 +155,8 @@ passwordtextAbbr   =       passwdtxt
 imagemapAbbr       =       imgmap
 figureAbbr         =       fig
 textareaAbbr       =       txtarea
+tableAbbr          =       tbl
+tableInfoAbbr = %S %S %S
+tableColumnInfoAbbr = #1c;#1c
+tableRowInfoAbbr = #1r;#1r
+cellInfoAbbr = c%Sr%S
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index e891965c761..7c021f80ff0 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -49,6 +49,7 @@ using mozilla::DefaultXDisplay;
 #include "nsIDOMHTMLObjectElement.h"
 #include "nsIAppShell.h"
 #include "nsIDOMHTMLAppletElement.h"
+#include "nsIObjectLoadingContent.h"
 #include "nsAttrName.h"
 #include "nsIFocusManager.h"
 #include "nsFocusManager.h"
@@ -1047,6 +1048,11 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
     mNumCachedAttrs = 0xFFFD;
   }
 
+  // Check if we are java for special codebase handling
+  const char* mime = nullptr;
+  bool isJava = NS_SUCCEEDED(mInstance->GetMIMEType(&mime)) && mime &&
+                nsPluginHost::IsJavaMIMEType(mime);
+
   // now, we need to find all the PARAM tags that are children of us
   // however, be careful not to include any PARAMs that don't have us
   // as a direct parent. For nested object (or applet) tags, be sure
@@ -1139,6 +1145,23 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
     mNumCachedAttrs++;
   }
 
+  // (Bug 738396) java has quirks in its codebase parsing, pass the
+  // absolute codebase URI as content sees it.
+  bool addCodebase = false;
+  nsAutoCString codebaseStr;
+  if (isJava) {
+    nsCOMPtr<nsIObjectLoadingContent> objlc = do_QueryInterface(mContent);
+    NS_ENSURE_TRUE(objlc, NS_ERROR_UNEXPECTED);
+    nsCOMPtr<nsIURI> codebaseURI;
+    nsresult rv = objlc->GetBaseURI(getter_AddRefs(codebaseURI));
+    NS_ENSURE_SUCCESS(rv, rv);
+    codebaseURI->GetSpec(codebaseStr);
+    if (!mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::codebase)) {
+      mNumCachedAttrs++;
+      addCodebase = true;
+    }
+  }
+
   mCachedAttrParamNames  = (char**)NS_Alloc(sizeof(char*) * (mNumCachedAttrs + 1 + mNumCachedParams));
   NS_ENSURE_TRUE(mCachedAttrParamNames,  NS_ERROR_OUT_OF_MEMORY);
   mCachedAttrParamValues = (char**)NS_Alloc(sizeof(char*) * (mNumCachedAttrs + 1 + mNumCachedParams));
@@ -1183,7 +1206,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
     FixUpURLS(name, value);
 
     mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(name);
-    if (!wmodeType.IsEmpty() && 
+    if (!wmodeType.IsEmpty() &&
         0 == PL_strcasecmp(mCachedAttrParamNames[nextAttrParamIndex], "wmode")) {
       mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(NS_ConvertUTF8toUTF16(wmodeType));
 
@@ -1192,12 +1215,21 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
         mNumCachedAttrs--;
         wmodeSet = true;
       }
+    } else if (isJava && 0 == PL_strcasecmp(mCachedAttrParamNames[nextAttrParamIndex], "codebase")) {
+      mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(NS_ConvertUTF8toUTF16(codebaseStr));
     } else {
       mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(value);
     }
     nextAttrParamIndex++;
   }
 
+  // Potentially add CODEBASE attribute
+  if (addCodebase) {
+    mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("codebase"));
+    mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(NS_ConvertUTF8toUTF16(codebaseStr));
+    nextAttrParamIndex++;
+  }
+
   // Potentially add WMODE attribute.
   if (!wmodeType.IsEmpty() && !wmodeSet) {
     mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(NS_LITERAL_STRING("wmode"));
@@ -1223,7 +1255,10 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
   nextAttrParamIndex++;
 
   // Add PARAM name/value pairs.
-  for (uint16_t i = 0; i < mNumCachedParams; i++) {
+
+  // We may decrement mNumCachedParams below
+  uint16_t totalParams = mNumCachedParams;
+  for (uint16_t i = 0; i < totalParams; i++) {
     nsIDOMElement* param = ourParams.ObjectAt(i);
     if (!param) {
       continue;
@@ -1233,7 +1268,7 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
     nsAutoString value;
     param->GetAttribute(NS_LITERAL_STRING("name"), name); // check for empty done above
     param->GetAttribute(NS_LITERAL_STRING("value"), value);
-    
+
     FixUpURLS(name, value);
 
     /*
@@ -1248,6 +1283,12 @@ nsresult nsPluginInstanceOwner::EnsureCachedAttrParamArrays()
      */
     name.Trim(" \n\r\t\b", true, true, false);
     value.Trim(" \n\r\t\b", true, true, false);
+    if (isJava && name.EqualsIgnoreCase("codebase")) {
+      // We inserted normalized codebase above, don't include other versions in
+      // params
+      mNumCachedParams--;
+      continue;
+    }
     mCachedAttrParamNames [nextAttrParamIndex] = ToNewUTF8String(name);
     mCachedAttrParamValues[nextAttrParamIndex] = ToNewUTF8String(value);
     nextAttrParamIndex++;
diff --git a/dom/webidl/WebGLRenderingContext.webidl b/dom/webidl/WebGLRenderingContext.webidl
index 629bd5ef173..e5d447f9b0c 100644
--- a/dom/webidl/WebGLRenderingContext.webidl
+++ b/dom/webidl/WebGLRenderingContext.webidl
@@ -64,6 +64,9 @@ interface WebGLTexture {
 interface WebGLUniformLocation {
 };
 
+interface WebGLVertexArray {
+};
+
 interface WebGLActiveInfo {
     readonly attribute GLint size;
     readonly attribute GLenum type;
@@ -883,3 +886,13 @@ interface WebGLExtensionDrawBuffers {
 interface WebGLExtensionTextureFloatLinear
 {
 };
+
+[NoInterfaceObject]
+interface WebGLExtensionVertexArray {
+    const GLenum VERTEX_ARRAY_BINDING_OES = 0x85B5;
+
+    WebGLVertexArray? createVertexArrayOES();
+    void deleteVertexArrayOES(WebGLVertexArray? arrayObject);
+    [WebGLHandlesContextLoss] GLboolean isVertexArrayOES(WebGLVertexArray? arrayObject);
+    void bindVertexArrayOES(WebGLVertexArray? arrayObject);
+};
diff --git a/gfx/2d/2D.h b/gfx/2d/2D.h
index f0ccef614ae..f609079dd3a 100644
--- a/gfx/2d/2D.h
+++ b/gfx/2d/2D.h
@@ -719,7 +719,7 @@ public:
   virtual void MaskSurface(const Pattern &aSource,
                            SourceSurface *aMask,
                            Point aOffset,
-                           const DrawOptions &aOptions = DrawOptions()) { MOZ_ASSERT(0); };
+                           const DrawOptions &aOptions = DrawOptions()) = 0;
 
   /*
    * Push a clip to the DrawTarget.
diff --git a/gfx/2d/DrawTargetCairo.h b/gfx/2d/DrawTargetCairo.h
index 8eec8eff8c3..7b2ce39e31e 100644
--- a/gfx/2d/DrawTargetCairo.h
+++ b/gfx/2d/DrawTargetCairo.h
@@ -107,6 +107,10 @@ public:
   virtual void Mask(const Pattern &aSource,
                     const Pattern &aMask,
                     const DrawOptions &aOptions = DrawOptions());
+  virtual void MaskSurface(const Pattern &aSource,
+                           SourceSurface *aMask,
+                           Point aOffset,
+                           const DrawOptions &aOptions = DrawOptions()) { MOZ_ASSERT(0); };
 
   virtual void PushClip(const Path *aPath);
   virtual void PushClipRect(const Rect &aRect);
diff --git a/gfx/2d/DrawTargetRecording.cpp b/gfx/2d/DrawTargetRecording.cpp
index 5c5e5593032..37b386bac63 100644
--- a/gfx/2d/DrawTargetRecording.cpp
+++ b/gfx/2d/DrawTargetRecording.cpp
@@ -248,6 +248,16 @@ DrawTargetRecording::Mask(const Pattern &aSource,
   mFinalDT->Mask(*AdjustedPattern(aSource), *AdjustedPattern(aMask), aOptions);
 }
 
+void
+DrawTargetRecording::MaskSurface(const Pattern &aSource,
+                                 SourceSurface *aMask,
+                                 Point aOffset,
+                                 const DrawOptions &aOptions)
+{
+  mRecorder->RecordEvent(RecordedMaskSurface(this, aSource, aMask, aOffset, aOptions));
+  mFinalDT->MaskSurface(*AdjustedPattern(aSource), GetSourceSurface(aMask), aOffset, aOptions);
+}
+
 void
 DrawTargetRecording::Stroke(const Path *aPath,
                             const Pattern &aPattern,
diff --git a/gfx/2d/DrawTargetRecording.h b/gfx/2d/DrawTargetRecording.h
index b74b78ae130..f1e7da42876 100644
--- a/gfx/2d/DrawTargetRecording.h
+++ b/gfx/2d/DrawTargetRecording.h
@@ -172,6 +172,11 @@ public:
                     const Pattern &aMask,
                     const DrawOptions &aOptions = DrawOptions());
 
+  virtual void MaskSurface(const Pattern &aSource,
+                           SourceSurface *aMask,
+                           Point aOffset,
+                           const DrawOptions &aOptions = DrawOptions());
+
   /*
    * Push a clip to the DrawTarget.
    *
diff --git a/gfx/2d/DrawTargetSkia.h b/gfx/2d/DrawTargetSkia.h
index f02228ab05b..3f8c05e323e 100644
--- a/gfx/2d/DrawTargetSkia.h
+++ b/gfx/2d/DrawTargetSkia.h
@@ -75,6 +75,10 @@ public:
   virtual void Mask(const Pattern &aSource,
                     const Pattern &aMask,
                     const DrawOptions &aOptions = DrawOptions());
+  virtual void MaskSurface(const Pattern &aSource,
+                           SourceSurface *aMask,
+                           Point aOffset,
+                           const DrawOptions &aOptions = DrawOptions()) { MOZ_ASSERT(0); };
   virtual void PushClip(const Path *aPath);
   virtual void PushClipRect(const Rect& aRect);
   virtual void PopClip();
diff --git a/gfx/2d/RecordedEvent.cpp b/gfx/2d/RecordedEvent.cpp
index c8b649b9309..c70fd5899e6 100644
--- a/gfx/2d/RecordedEvent.cpp
+++ b/gfx/2d/RecordedEvent.cpp
@@ -58,6 +58,7 @@ RecordedEvent::LoadEventFromStream(std::istream &aStream, EventType aType)
     LOAD_EVENT_TYPE(SNAPSHOT, RecordedSnapshot);
     LOAD_EVENT_TYPE(SCALEDFONTCREATION, RecordedScaledFontCreation);
     LOAD_EVENT_TYPE(SCALEDFONTDESTRUCTION, RecordedScaledFontDestruction);
+    LOAD_EVENT_TYPE(MASKSURFACE, RecordedMaskSurface);
   default:
     return NULL;
   }
@@ -1216,5 +1217,40 @@ RecordedScaledFontDestruction::OutputSimpleEventInfo(stringstream &aStringStream
   aStringStream << "[" << mRefPtr << "] ScaledFont Destroyed";
 }
 
+void
+RecordedMaskSurface::PlayEvent(Translator *aTranslator) const
+{
+  aTranslator->LookupDrawTarget(mDT)->
+    MaskSurface(*GenericPattern(mPattern, aTranslator),
+                aTranslator->LookupSourceSurface(mRefMask),
+                mOffset, mOptions);
+}
+
+void
+RecordedMaskSurface::RecordToStream(ostream &aStream) const
+{
+  RecordedDrawingEvent::RecordToStream(aStream);
+  RecordPatternData(aStream, mPattern);
+  WriteElement(aStream, mRefMask);
+  WriteElement(aStream, mOffset);
+  WriteElement(aStream, mOptions);
+}
+
+RecordedMaskSurface::RecordedMaskSurface(istream &aStream)
+  : RecordedDrawingEvent(MASKSURFACE, aStream)
+{
+  ReadPatternData(aStream, mPattern);
+  ReadElement(aStream, mRefMask);
+  ReadElement(aStream, mOffset);
+  ReadElement(aStream, mOptions);
+}
+
+void
+RecordedMaskSurface::OutputSimpleEventInfo(stringstream &aStringStream) const
+{
+  aStringStream << "[" << mDT << "] MaskSurface (" << mRefMask << ")  Offset: (" << mOffset.x << "x" << mOffset.y << ") Pattern: ";
+  OutputSimplePatternInfo(mPattern, aStringStream);
+}
+
 }
 }
diff --git a/gfx/2d/RecordedEvent.h b/gfx/2d/RecordedEvent.h
index bf7d3912e52..27e2b183803 100644
--- a/gfx/2d/RecordedEvent.h
+++ b/gfx/2d/RecordedEvent.h
@@ -23,7 +23,7 @@ namespace gfx {
 const uint16_t kMajorRevision = 2;
 // A change in minor revision means additions of new events. New streams will
 // not play in older players.
-const uint16_t kMinorRevision = 0;
+const uint16_t kMinorRevision = 1;
 
 struct ReferencePtr
 {
@@ -160,7 +160,8 @@ public:
     GRADIENTSTOPSDESTRUCTION,
     SNAPSHOT,
     SCALEDFONTCREATION,
-    SCALEDFONTDESTRUCTION
+    SCALEDFONTDESTRUCTION,
+    MASKSURFACE
   };
 
   virtual void PlayEvent(Translator *aTranslator) const {}
@@ -865,6 +866,33 @@ private:
   RecordedScaledFontDestruction(std::istream &aStream);
 };
 
+class RecordedMaskSurface : public RecordedDrawingEvent {
+public:
+  RecordedMaskSurface(DrawTarget *aDT, const Pattern &aPattern, ReferencePtr aRefMask,
+                      const Point &aOffset, const DrawOptions &aOptions)
+    : RecordedDrawingEvent(MASKSURFACE, aDT), mRefMask(aRefMask), mOffset(aOffset)
+    , mOptions(aOptions)
+  {
+    StorePattern(mPattern, aPattern);
+  }
+
+  virtual void PlayEvent(Translator *aTranslator) const;
+
+  virtual void RecordToStream(std::ostream &aStream) const;
+  virtual void OutputSimpleEventInfo(std::stringstream &aStringStream) const;
+  
+  virtual std::string GetName() const { return "MaskSurface"; }
+private:
+  friend class RecordedEvent;
+
+  RecordedMaskSurface(std::istream &aStream);
+
+  PatternStorage mPattern;
+  ReferencePtr mRefMask;
+  Point mOffset;
+  DrawOptions mOptions;
+};
+
 }
 }
 
diff --git a/gfx/gl/GLContext.cpp b/gfx/gl/GLContext.cpp
index 1ecb44d941a..ea7e17f0bbf 100644
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -88,6 +88,7 @@ static const char *sExtensionNames[] = {
     "GL_OES_element_index_uint",
     "GL_OES_vertex_array_object",
     "GL_ARB_vertex_array_object",
+    "GL_APPLE_vertex_array_object",
     "GL_ARB_draw_buffers",
     "GL_EXT_draw_buffers",
     nullptr
@@ -552,11 +553,12 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             }
         }
 
-        if (IsExtensionSupported(OES_vertex_array_object)) {
+        if (IsExtensionSupported(ARB_vertex_array_object) ||
+            IsExtensionSupported(OES_vertex_array_object)) {
             SymLoadStruct vaoSymbols[] = {
                 { (PRFuncPtr*) &mSymbols.fIsVertexArray, { "IsVertexArray", "IsVertexArrayOES", nullptr } },
                 { (PRFuncPtr*) &mSymbols.fGenVertexArrays, { "GenVertexArrays", "GenVertexArraysOES", nullptr } },
-                { (PRFuncPtr*) &mSymbols.fBindVertexArray, { "BindVertexArrays", "BindVertexArrayOES", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fBindVertexArray, { "BindVertexArray", "BindVertexArrayOES", nullptr } },
                 { (PRFuncPtr*) &mSymbols.fDeleteVertexArrays, { "DeleteVertexArrays", "DeleteVertexArraysOES", nullptr } },
                 { nullptr, { nullptr } },
             };
@@ -564,7 +566,32 @@ GLContext::InitWithPrefix(const char *prefix, bool trygl)
             if (!LoadSymbols(&vaoSymbols[0], trygl, prefix)) {
                 NS_ERROR("GL supports Vertex Array Object without supplying its functions.");
 
+                MarkExtensionUnsupported(ARB_vertex_array_object);
                 MarkExtensionUnsupported(OES_vertex_array_object);
+                MarkExtensionUnsupported(APPLE_vertex_array_object);
+                mSymbols.fIsVertexArray = nullptr;
+                mSymbols.fGenVertexArrays = nullptr;
+                mSymbols.fBindVertexArray = nullptr;
+                mSymbols.fDeleteVertexArrays = nullptr;
+            }
+        }
+        else if (IsExtensionSupported(APPLE_vertex_array_object)) {
+            /*
+             * separate call to LoadSymbols with APPLE_vertex_array_object to work around
+             * a driver bug : the IsVertexArray symbol (without suffix) can be present but unusable.
+             */
+            SymLoadStruct vaoSymbols[] = {
+                { (PRFuncPtr*) &mSymbols.fIsVertexArray, { "IsVertexArrayAPPLE", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fGenVertexArrays, { "GenVertexArraysAPPLE", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fBindVertexArray, { "BindVertexArrayAPPLE", nullptr } },
+                { (PRFuncPtr*) &mSymbols.fDeleteVertexArrays, { "DeleteVertexArraysAPPLE", nullptr } },
+                { nullptr, { nullptr } },
+            };
+
+            if (!LoadSymbols(&vaoSymbols[0], trygl, prefix)) {
+                NS_ERROR("GL supports Vertex Array Object without supplying its functions.");
+
+                MarkExtensionUnsupported(APPLE_vertex_array_object);
                 mSymbols.fIsVertexArray = nullptr;
                 mSymbols.fGenVertexArrays = nullptr;
                 mSymbols.fBindVertexArray = nullptr;
diff --git a/gfx/gl/GLContext.h b/gfx/gl/GLContext.h
index 89ba5127b8e..bdfe724dd56 100644
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@@ -1026,6 +1026,7 @@ public:
         OES_element_index_uint,
         OES_vertex_array_object,
         ARB_vertex_array_object,
+        APPLE_vertex_array_object,
         ARB_draw_buffers,
         EXT_draw_buffers,
         Extensions_Max
diff --git a/gfx/gl/GLDefs.h b/gfx/gl/GLDefs.h
index 9aa06a571a3..c25f1dd58b2 100644
--- a/gfx/gl/GLDefs.h
+++ b/gfx/gl/GLDefs.h
@@ -3029,6 +3029,9 @@ typedef uint64_t EGLTime;
 #define LOCAL_GL_FOG_SPECULAR_TEXTURE_WIN 0x80EC
 #define LOCAL_GL_WIN_swap_hint 1
 
+// ARB_vertex_array_object
+#define LOCAL_GL_VERTEX_ARRAY_BINDING             0x85B5
+
 // ARB_sync
 #define LOCAL_GL_MAX_SERVER_WAIT_TIMEOUT          0x9111
 #define LOCAL_GL_OBJECT_TYPE                      0x9112
diff --git a/js/public/GCAPI.h b/js/public/GCAPI.h
index 2f68ff53c5e..69901edcf50 100644
--- a/js/public/GCAPI.h
+++ b/js/public/GCAPI.h
@@ -7,7 +7,7 @@
 #ifndef js_GCAPI_h
 #define js_GCAPI_h
 
-#include "HeapAPI.h"
+#include "js/HeapAPI.h"
 
 namespace JS {
 
diff --git a/js/public/Vector.h b/js/public/Vector.h
index d01ba76198d..d6d6999dfc0 100644
--- a/js/public/Vector.h
+++ b/js/public/Vector.h
@@ -11,8 +11,8 @@
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/TypeTraits.h"
 
-#include "TemplateLib.h"
-#include "Utility.h"
+#include "js/TemplateLib.h"
+#include "js/Utility.h"
 
 /* Silence dire "bugs in previous versions of MSVC have been fixed" warnings */
 #ifdef _MSC_VER
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 4944d3143ba..f0953a2f9ff 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -117,11 +117,6 @@ else
 LOCAL_INCLUDES = -Ictypes/libffi/include
 endif
 
-LOCAL_INCLUDES += \
-    -I. \
-    $(NULL)
-
-
 ifdef MOZ_NATIVE_FFI
 EXTRA_DSO_LDOPTS += $(MOZ_FFI_LIBS)
 else
@@ -682,8 +677,6 @@ ifneq (,$(ENABLE_YARR_JIT))
 CXXFLAGS +=  -DENABLE_JIT=1
 endif
 
-INCLUDES +=	-I$(srcdir)/assembler -I$(srcdir)/yarr
-
 #
 # END kludges for the Nitro assembler
 ###############################################
diff --git a/js/src/assembler/TestMain.cpp b/js/src/assembler/TestMain.cpp
index bf385b34fa1..f2b1bae20e7 100644
--- a/js/src/assembler/TestMain.cpp
+++ b/js/src/assembler/TestMain.cpp
@@ -17,12 +17,12 @@
 #define USE_SYSTEM_MALLOC 1
 // leads to FORCE_SYSTEM_MALLOC in wtf/FastMalloc.cpp
 
-#include <jit/ExecutableAllocator.h>
-#include <assembler/LinkBuffer.h>
-#include <assembler/CodeLocation.h>
-#include <assembler/RepatchBuffer.h>
+#include "assembler/jit/ExecutableAllocator.h"
+#include "assembler/assembler/LinkBuffer.h"
+#include "assembler/assembler/CodeLocation.h"
+#include "assembler/assembler/RepatchBuffer.h"
 
-#include <assembler/MacroAssembler.h>
+#include "assembler/assembler/MacroAssembler.h"
 
 #include <stdio.h>
 
diff --git a/js/src/assembler/assembler/ARMAssembler.cpp b/js/src/assembler/assembler/ARMAssembler.cpp
index 18f742b80b6..e634aebc2c7 100644
--- a/js/src/assembler/assembler/ARMAssembler.cpp
+++ b/js/src/assembler/assembler/ARMAssembler.cpp
@@ -32,7 +32,7 @@
 
 #if ENABLE_ASSEMBLER && WTF_CPU_ARM_TRADITIONAL
 
-#include "ARMAssembler.h"
+#include "assembler/assembler/ARMAssembler.h"
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index 6b00c596df2..cda5e1fa979 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -38,7 +38,7 @@
 
 #if ENABLE_ASSEMBLER && WTF_CPU_ARM_TRADITIONAL
 
-#include "AssemblerBufferWithConstantPool.h"
+#include "assembler/assembler/AssemblerBufferWithConstantPool.h"
 #include "assembler/wtf/Assertions.h"
 
 // TODO: We don't print the condition code in our spew lines. Doing this
diff --git a/js/src/assembler/assembler/ARMv7Assembler.h b/js/src/assembler/assembler/ARMv7Assembler.h
index cfe30bb5d46..3d2d7c916c9 100644
--- a/js/src/assembler/assembler/ARMv7Assembler.h
+++ b/js/src/assembler/assembler/ARMv7Assembler.h
@@ -35,9 +35,8 @@
 
 #if ENABLE(ASSEMBLER) && CPU(ARM_THUMB2)
 
-#include "AssemblerBuffer.h"
+#include "assembler/assembler/AssemblerBuffer.h"
 #include "assembler/wtf/Assertions.h"
-#include "assembler/wtf/Vector.h"
 #include <stdint.h>
 
 namespace JSC {
diff --git a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
index 6fbd1555c9d..519fc640699 100644
--- a/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
+++ b/js/src/assembler/assembler/AssemblerBufferWithConstantPool.h
@@ -35,7 +35,7 @@
 
 #if ENABLE_ASSEMBLER
 
-#include "AssemblerBuffer.h"
+#include "assembler/assembler/AssemblerBuffer.h"
 #include "assembler/wtf/SegmentedVector.h"
 #include "assembler/wtf/Assertions.h"
 
diff --git a/js/src/assembler/assembler/LinkBuffer.h b/js/src/assembler/assembler/LinkBuffer.h
index 8891232b500..3f51ab371c6 100644
--- a/js/src/assembler/assembler/LinkBuffer.h
+++ b/js/src/assembler/assembler/LinkBuffer.h
@@ -34,7 +34,7 @@
 
 #if ENABLE_ASSEMBLER
 
-#include <assembler/MacroAssembler.h>
+#include "assembler/assembler/MacroAssembler.h"
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/MIPSAssembler.h b/js/src/assembler/assembler/MIPSAssembler.h
index 45619c3374c..e50f218afdb 100644
--- a/js/src/assembler/assembler/MIPSAssembler.h
+++ b/js/src/assembler/assembler/MIPSAssembler.h
@@ -31,11 +31,10 @@
 
 #if ENABLE(ASSEMBLER) && CPU(MIPS)
 
-#include "AssemblerBuffer.h"
+#include "assembler/assembler/AssemblerBuffer.h"
 #include "assembler/wtf/Assertions.h"
 #include "assembler/wtf/SegmentedVector.h"
 
-#include "methodjit/Logging.h"
 #define IPFX  "        %s"
 #define ISPFX "        "
 #ifdef JS_METHODJIT_SPEW
diff --git a/js/src/assembler/assembler/MacroAssembler.h b/js/src/assembler/assembler/MacroAssembler.h
index 6197388428a..0ab2578758a 100644
--- a/js/src/assembler/assembler/MacroAssembler.h
+++ b/js/src/assembler/assembler/MacroAssembler.h
@@ -35,27 +35,27 @@
 #if ENABLE_ASSEMBLER
 
 #if WTF_CPU_ARM_THUMB2
-#include "MacroAssemblerARMv7.h"
+#include "assembler/assembler/MacroAssemblerARMv7.h"
 namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; }
 
 #elif WTF_CPU_ARM_TRADITIONAL
-#include "MacroAssemblerARM.h"
+#include "assembler/assembler/MacroAssemblerARM.h"
 namespace JSC { typedef MacroAssemblerARM MacroAssemblerBase; }
 
 #elif WTF_CPU_MIPS
-#include "MacroAssemblerMIPS.h"
+#include "assembler/assembler/MacroAssemblerMIPS.h"
 namespace JSC { typedef MacroAssemblerMIPS MacroAssemblerBase; }
 
 #elif WTF_CPU_X86
-#include "MacroAssemblerX86.h"
+#include "assembler/assembler/MacroAssemblerX86.h"
 namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; }
 
 #elif WTF_CPU_X86_64
-#include "MacroAssemblerX86_64.h"
+#include "assembler/assembler/MacroAssemblerX86_64.h"
 namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; }
 
 #elif WTF_CPU_SPARC
-#include "MacroAssemblerSparc.h"
+#include "assembler/assembler/MacroAssemblerSparc.h"
 namespace JSC { typedef MacroAssemblerSparc MacroAssemblerBase; }
 
 #else
diff --git a/js/src/assembler/assembler/MacroAssemblerARM.cpp b/js/src/assembler/assembler/MacroAssemblerARM.cpp
index 9c76e8fd43e..c01e5535476 100644
--- a/js/src/assembler/assembler/MacroAssemblerARM.cpp
+++ b/js/src/assembler/assembler/MacroAssemblerARM.cpp
@@ -32,7 +32,7 @@
 
 #if ENABLE_ASSEMBLER && WTF_CPU_ARM_TRADITIONAL
 
-#include "MacroAssemblerARM.h"
+#include "assembler/assembler/MacroAssemblerARM.h"
 
 #if WTF_OS_LINUX || WTF_OS_ANDROID
 #include <sys/types.h>
diff --git a/js/src/assembler/assembler/MacroAssemblerARM.h b/js/src/assembler/assembler/MacroAssemblerARM.h
index e8b00fe5d7b..cca8af018f7 100644
--- a/js/src/assembler/assembler/MacroAssemblerARM.h
+++ b/js/src/assembler/assembler/MacroAssemblerARM.h
@@ -36,8 +36,8 @@
 
 #if ENABLE_ASSEMBLER && WTF_CPU_ARM_TRADITIONAL
 
-#include "ARMAssembler.h"
-#include "AbstractMacroAssembler.h"
+#include "assembler/assembler/ARMAssembler.h"
+#include "assembler/assembler/AbstractMacroAssembler.h"
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/MacroAssemblerARMv7.h b/js/src/assembler/assembler/MacroAssemblerARMv7.h
index fabdb07a8a3..7f04c3699a2 100644
--- a/js/src/assembler/assembler/MacroAssemblerARMv7.h
+++ b/js/src/assembler/assembler/MacroAssemblerARMv7.h
@@ -35,8 +35,8 @@
 
 #if ENABLE(ASSEMBLER)
 
-#include "ARMv7Assembler.h"
-#include "AbstractMacroAssembler.h"
+#include "assembler/assembler/ARMv7Assembler.h"
+#include "assembler/assembler/AbstractMacroAssembler.h"
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/MacroAssemblerMIPS.h b/js/src/assembler/assembler/MacroAssemblerMIPS.h
index 6c6db425ba4..ffc92f2e5e8 100644
--- a/js/src/assembler/assembler/MacroAssemblerMIPS.h
+++ b/js/src/assembler/assembler/MacroAssemblerMIPS.h
@@ -29,8 +29,8 @@
 
 #if ENABLE(ASSEMBLER) && CPU(MIPS)
 
-#include "AbstractMacroAssembler.h"
-#include "MIPSAssembler.h"
+#include "assembler/assembler/AbstractMacroAssembler.h"
+#include "assembler/assembler/MIPSAssembler.h"
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/MacroAssemblerSparc.h b/js/src/assembler/assembler/MacroAssemblerSparc.h
index 6ae4808e02f..7efe82bf445 100644
--- a/js/src/assembler/assembler/MacroAssemblerSparc.h
+++ b/js/src/assembler/assembler/MacroAssemblerSparc.h
@@ -7,12 +7,12 @@
 #ifndef assembler_assembler_MacroAssemblerSparc_h
 #define assembler_assembler_MacroAssemblerSparc_h
 
-#include <assembler/wtf/Platform.h>
+#include "assembler/wtf/Platform.h"
 
 #if ENABLE_ASSEMBLER && WTF_CPU_SPARC
 
-#include "SparcAssembler.h"
-#include "AbstractMacroAssembler.h"
+#include "assembler/assembler/SparcAssembler.h"
+#include "assembler/assembler/AbstractMacroAssembler.h"
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/MacroAssemblerX86.h b/js/src/assembler/assembler/MacroAssemblerX86.h
index fbbc41c74c3..65afe64422c 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86.h
+++ b/js/src/assembler/assembler/MacroAssemblerX86.h
@@ -34,7 +34,7 @@
 
 #if ENABLE_ASSEMBLER && WTF_CPU_X86
 
-#include "MacroAssemblerX86Common.h"
+#include "assembler/assembler/MacroAssemblerX86Common.h"
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/MacroAssemblerX86Common.cpp b/js/src/assembler/assembler/MacroAssemblerX86Common.cpp
index e65b2a3d7c6..15e98762ce0 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86Common.cpp
+++ b/js/src/assembler/assembler/MacroAssemblerX86Common.cpp
@@ -9,7 +9,7 @@
 /* SSE checks only make sense on Intel platforms. */
 #if WTF_CPU_X86 || WTF_CPU_X86_64
 
-#include "MacroAssemblerX86Common.h"
+#include "assembler/assembler/MacroAssemblerX86Common.h"
 
 using namespace JSC;
 MacroAssemblerX86Common::SSECheckState MacroAssemblerX86Common::s_sseCheckState = NotCheckedSSE;
diff --git a/js/src/assembler/assembler/MacroAssemblerX86Common.h b/js/src/assembler/assembler/MacroAssemblerX86Common.h
index 8781642e529..c2000910d56 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86Common.h
+++ b/js/src/assembler/assembler/MacroAssemblerX86Common.h
@@ -34,8 +34,8 @@
 
 #if ENABLE_ASSEMBLER
 
-#include "X86Assembler.h"
-#include "AbstractMacroAssembler.h"
+#include "assembler/assembler/X86Assembler.h"
+#include "assembler/assembler/AbstractMacroAssembler.h"
 
 #if WTF_COMPILER_MSVC
 #if WTF_CPU_X86_64
diff --git a/js/src/assembler/assembler/MacroAssemblerX86_64.h b/js/src/assembler/assembler/MacroAssemblerX86_64.h
index c76b6ad6e97..147b5a53d6f 100644
--- a/js/src/assembler/assembler/MacroAssemblerX86_64.h
+++ b/js/src/assembler/assembler/MacroAssemblerX86_64.h
@@ -36,7 +36,7 @@
 
 #if ENABLE_ASSEMBLER && WTF_CPU_X86_64
 
-#include "MacroAssemblerX86Common.h"
+#include "assembler/assembler/MacroAssemblerX86Common.h"
 
 #define REPTACH_OFFSET_CALL_R11 3
 
diff --git a/js/src/assembler/assembler/RepatchBuffer.h b/js/src/assembler/assembler/RepatchBuffer.h
index eb51a1b7549..1ab5ecd731d 100644
--- a/js/src/assembler/assembler/RepatchBuffer.h
+++ b/js/src/assembler/assembler/RepatchBuffer.h
@@ -34,8 +34,8 @@
 
 #if ENABLE_ASSEMBLER
 
-#include <assembler/MacroAssembler.h>
-#include <moco/MocoStubs.h> //MOCO
+#include "assembler/assembler/MacroAssembler.h"
+#include "assembler/moco/MocoStubs.h" //MOCO
 
 namespace JSC {
 
diff --git a/js/src/assembler/assembler/SparcAssembler.h b/js/src/assembler/assembler/SparcAssembler.h
index 196f4d2b1e3..cfc54dc3ce1 100644
--- a/js/src/assembler/assembler/SparcAssembler.h
+++ b/js/src/assembler/assembler/SparcAssembler.h
@@ -7,17 +7,16 @@
 #ifndef assembler_assembler_SparcAssembler_h
 #define assembler_assembler_SparcAssembler_h
 
-#include <assembler/wtf/Platform.h>
+#include "assembler/wtf/Platform.h"
 
 // Some debug code uses s(n)printf for instruction logging.
 #include <stdio.h>
 
 #if ENABLE_ASSEMBLER && WTF_CPU_SPARC
 
-#include "AssemblerBufferWithConstantPool.h"
-#include <assembler/wtf/Assertions.h>
+#include "assembler/assembler/AssemblerBufferWithConstantPool.h"
+#include "assembler/wtf/Assertions.h"
 
-#include "methodjit/Logging.h"
 #define IPFX  "        %s"
 #define ISPFX "        "
 #ifdef JS_METHODJIT_SPEW
diff --git a/js/src/assembler/assembler/X86Assembler.h b/js/src/assembler/assembler/X86Assembler.h
index 6b808cd21a8..1a7bab8cba1 100644
--- a/js/src/assembler/assembler/X86Assembler.h
+++ b/js/src/assembler/assembler/X86Assembler.h
@@ -36,7 +36,7 @@
 
 #if ENABLE_ASSEMBLER && (WTF_CPU_X86 || WTF_CPU_X86_64)
 
-#include "AssemblerBuffer.h"
+#include "assembler/assembler/AssemblerBuffer.h"
 #include "assembler/wtf/Assertions.h"
 #include "js/Vector.h"
 
diff --git a/js/src/assembler/jit/ExecutableAllocator.cpp b/js/src/assembler/jit/ExecutableAllocator.cpp
index b8ba1eae05a..6d4d0906e4c 100644
--- a/js/src/assembler/jit/ExecutableAllocator.cpp
+++ b/js/src/assembler/jit/ExecutableAllocator.cpp
@@ -25,7 +25,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "ExecutableAllocator.h"
+#include "assembler/jit/ExecutableAllocator.h"
 
 #include "js/MemoryMetrics.h"
 
diff --git a/js/src/assembler/jit/ExecutableAllocatorOS2.cpp b/js/src/assembler/jit/ExecutableAllocatorOS2.cpp
index b0879c8ac69..219e34c6ee5 100644
--- a/js/src/assembler/jit/ExecutableAllocatorOS2.cpp
+++ b/js/src/assembler/jit/ExecutableAllocatorOS2.cpp
@@ -24,7 +24,7 @@
  */
 
 
-#include "ExecutableAllocator.h"
+#include "assembler/jit/ExecutableAllocator.h"
 
 #if ENABLE_ASSEMBLER && WTF_OS_OS2
 
diff --git a/js/src/assembler/jit/ExecutableAllocatorWin.cpp b/js/src/assembler/jit/ExecutableAllocatorWin.cpp
index 7f827fe7acc..7c28ae18fd3 100644
--- a/js/src/assembler/jit/ExecutableAllocatorWin.cpp
+++ b/js/src/assembler/jit/ExecutableAllocatorWin.cpp
@@ -23,7 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "ExecutableAllocator.h"
+#include "assembler/jit/ExecutableAllocator.h"
 
 #if ENABLE_ASSEMBLER && WTF_OS_WINDOWS
 
diff --git a/js/src/assembler/wtf/Assertions.cpp b/js/src/assembler/wtf/Assertions.cpp
index e2091d7f306..a460ce16df0 100644
--- a/js/src/assembler/wtf/Assertions.cpp
+++ b/js/src/assembler/wtf/Assertions.cpp
@@ -24,7 +24,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "Assertions.h"
+#include "assembler/wtf/Assertions.h"
 
 #include <stdio.h>
 #include <stdarg.h>
diff --git a/js/src/assembler/wtf/Assertions.h b/js/src/assembler/wtf/Assertions.h
index eb0744e746e..2cb1c5ecfab 100644
--- a/js/src/assembler/wtf/Assertions.h
+++ b/js/src/assembler/wtf/Assertions.h
@@ -26,7 +26,7 @@
 #ifndef assembler_wtf_Assertions_h
 #define assembler_wtf_Assertions_h
 
-#include "Platform.h"
+#include "assembler/wtf/Platform.h"
 #include "mozilla/Assertions.h"
 
 #ifndef DEBUG
@@ -37,7 +37,9 @@
 #  define ASSERT_DISABLED 1
 #endif
 
+#ifndef ASSERT
 #define ASSERT(assertion) MOZ_ASSERT(assertion)
+#endif
 #define ASSERT_UNUSED(variable, assertion) do { \
     (void)variable; \
     ASSERT(assertion); \
diff --git a/js/src/assembler/wtf/Platform.h b/js/src/assembler/wtf/Platform.h
index 29ca9dddbca..2478a1b96b2 100644
--- a/js/src/assembler/wtf/Platform.h
+++ b/js/src/assembler/wtf/Platform.h
@@ -1220,7 +1220,7 @@
 #endif
 
 #if ENABLE_GLIB_SUPPORT
-#include "GTypedefs.h"
+//#include "GTypedefs.h"
 #endif
 
 /* FIXME: This define won't be needed once #27551 is fully landed. However, 
diff --git a/js/src/ctypes/CTypes.cpp b/js/src/ctypes/CTypes.cpp
index d0439c93f7a..a45c123323e 100644
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -790,7 +790,7 @@ GetABICode(JSObject* obj)
 JSErrorFormatString ErrorFormatString[CTYPESERR_LIMIT] = {
 #define MSG_DEF(name, number, count, exception, format) \
   { format, count, exception } ,
-#include "ctypes.msg"
+#include "ctypes/ctypes.msg"
 #undef MSG_DEF
 };
 
@@ -1205,7 +1205,7 @@ InitTypeClasses(JSContext* cx, HandleObject parent)
       INT_TO_JSVAL(ffiType.alignment), &ffiType));                             \
   if (!typeObj_##name)                                                         \
     return false;
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
 
   // Alias 'ctypes.unsigned' as 'ctypes.unsigned_int', since they represent
   // the same type in C.
@@ -1592,7 +1592,7 @@ jsvalToInteger(JSContext* cx, jsval val, IntegerType* result)
         *result = IntegerType(*static_cast<fromType*>(data));                  \
         return true;
 #define DEFINE_WRAPPED_INT_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
       case TYPE_void_t:
       case TYPE_bool:
       case TYPE_float:
@@ -1682,7 +1682,7 @@ jsvalToFloat(JSContext *cx, jsval val, FloatType* result)
         return true;
 #define DEFINE_INT_TYPE(x, y, z) DEFINE_FLOAT_TYPE(x, y, z)
 #define DEFINE_WRAPPED_INT_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
       case TYPE_void_t:
       case TYPE_bool:
       case TYPE_char:
@@ -2101,7 +2101,7 @@ ConvertToJS(JSContext* cx,
     /* use, if any. */                                                         \
     *result = INT_TO_JSVAL(*static_cast<type*>(data));                         \
     break;
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   case TYPE_jschar: {
     // Convert the jschar to a 1-character string.
     JSString* str = JS_NewUCStringCopyN(cx, static_cast<jschar*>(data), 1);
@@ -2287,7 +2287,7 @@ ImplicitConvert(JSContext* cx,
     *static_cast<type*>(buffer) = result;                                      \
     break;                                                                     \
   }
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   case TYPE_pointer: {
     if (JSVAL_IS_NULL(val)) {
       // Convert to a null pointer.
@@ -2622,7 +2622,7 @@ ExplicitConvert(JSContext* cx, HandleValue val, HandleObject targetType, void* b
 #define DEFINE_WRAPPED_INT_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_CHAR_TYPE(x, y, z)
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   case TYPE_pointer: {
     // Convert a number, Int64 object, or UInt64 object to a pointer.
     uintptr_t result;
@@ -2778,7 +2778,7 @@ BuildTypeSource(JSContext* cx,
   case TYPE_void_t:
 #define DEFINE_TYPE(name, type, ffiType)  \
   case TYPE_##name:
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   {
     AppendString(result, "ctypes.");
     JSString* nameStr = CType::GetName(cx, typeObj);
@@ -2963,7 +2963,7 @@ BuildDataSource(JSContext* cx,
     /* Serialize as an integer. */                                             \
     IntegerToString(*static_cast<type*>(data), 10, result);                    \
     break;
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   case TYPE_jschar: {
     // Serialize as a 1-character JS string.
     JSString* str = JS_NewUCStringCopyN(cx, static_cast<jschar*>(data), 1);
@@ -5858,7 +5858,7 @@ FunctionType::Call(JSContext* cx,
 #define DEFINE_BOOL_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   default:
     break;
   }
@@ -6150,7 +6150,7 @@ CClosure::ClosureStub(ffi_cif* cif, void* result, void** args, void* userData)
 #define DEFINE_BOOL_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
       rvSize = Align(rvSize, sizeof(ffi_arg));
       break;
     default:
@@ -6238,7 +6238,7 @@ CClosure::ClosureStub(ffi_cif* cif, void* result, void** args, void* userData)
 #define DEFINE_BOOL_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_CHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
 #define DEFINE_JSCHAR_TYPE(x, y, z) DEFINE_INT_TYPE(x, y, z)
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   default:
     break;
   }
diff --git a/js/src/ctypes/CTypes.h b/js/src/ctypes/CTypes.h
index cb765001ae3..9f92e0b5146 100644
--- a/js/src/ctypes/CTypes.h
+++ b/js/src/ctypes/CTypes.h
@@ -178,7 +178,7 @@ ASSERT_OK(JSBool ok)
 enum ErrorNum {
 #define MSG_DEF(name, number, count, exception, format) \
   name = number,
-#include "ctypes.msg"
+#include "ctypes/ctypes.msg"
 #undef MSG_DEF
   CTYPESERR_LIMIT
 };
@@ -204,7 +204,7 @@ enum ABICode {
 enum TypeCode {
   TYPE_void_t,
 #define DEFINE_TYPE(name, type, ffiType) TYPE_##name,
-#include "typedefs.h"
+#include "ctypes/typedefs.h"
   TYPE_pointer,
   TYPE_function,
   TYPE_array,
diff --git a/js/src/ctypes/Library.cpp b/js/src/ctypes/Library.cpp
index 8daa03756b8..f17168f1a07 100644
--- a/js/src/ctypes/Library.cpp
+++ b/js/src/ctypes/Library.cpp
@@ -6,8 +6,8 @@
 
 #include "jscntxt.h"
 #include "jsstr.h"
-#include "Library.h"
-#include "CTypes.h"
+#include "ctypes/Library.h"
+#include "ctypes/CTypes.h"
 #include "prlink.h"
 
 namespace js {
diff --git a/js/src/ds/FixedSizeHash.h b/js/src/ds/FixedSizeHash.h
index bbbd37e81aa..5a6985de7ec 100644
--- a/js/src/ds/FixedSizeHash.h
+++ b/js/src/ds/FixedSizeHash.h
@@ -7,7 +7,7 @@
 #ifndef jsfixedsizehash_h_
 #define jsfixedsizehash_h_
 
-#include "LifoAlloc.h"
+#include "ds/LifoAlloc.h"
 
 namespace js {
 
diff --git a/js/src/ds/LifoAlloc.cpp b/js/src/ds/LifoAlloc.cpp
index b9621600f51..5df8fe8b85d 100644
--- a/js/src/ds/LifoAlloc.cpp
+++ b/js/src/ds/LifoAlloc.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "LifoAlloc.h"
+#include "ds/LifoAlloc.h"
 
 using namespace js;
 
diff --git a/js/src/ds/SplayTree.h b/js/src/ds/SplayTree.h
index a90bbf6886e..e3351ad61bd 100644
--- a/js/src/ds/SplayTree.h
+++ b/js/src/ds/SplayTree.h
@@ -7,7 +7,7 @@
 #ifndef ds_SplayTree_h
 #define ds_SplayTree_h
 
-#include "LifoAlloc.h"
+#include "ds/LifoAlloc.h"
 
 namespace js {
 
diff --git a/js/src/dtoa.c b/js/src/dtoa.c
index ca1644ba7c8..400f09a7a68 100644
--- a/js/src/dtoa.c
+++ b/js/src/dtoa.c
@@ -164,15 +164,15 @@ typedef unsigned Long ULong;
 #endif
 
 #ifdef DEBUG
-#include "stdio.h"
+#include <stdio.h>
 #define Bug(x) {fprintf(stderr, "%s\n", x); exit(1);}
 #endif
 
-#include "stdlib.h"
-#include "string.h"
+#include <stdlib.h>
+#include <string.h>
 
 #ifdef USE_LOCALE
-#include "locale.h"
+#include <locale.h>
 #endif
 
 #ifdef MALLOC
@@ -205,7 +205,7 @@ extern void *MALLOC(size_t);
 #define IEEE_Arith
 #endif
 
-#include "errno.h"
+#include <errno.h>
 
 #ifdef Bad_float_h
 
@@ -237,11 +237,11 @@ extern void *MALLOC(size_t);
 #endif
 
 #else /* ifndef Bad_float_h */
-#include "float.h"
+#include <float.h>
 #endif /* Bad_float_h */
 
 #ifndef __MATH_H__
-#include "math.h"
+#include <math.h>
 #endif
 
 #ifndef CONST
diff --git a/js/src/frontend/FullParseHandler.h b/js/src/frontend/FullParseHandler.h
index 43295c55a35..6402239e928 100644
--- a/js/src/frontend/FullParseHandler.h
+++ b/js/src/frontend/FullParseHandler.h
@@ -9,8 +9,8 @@
 
 #include "mozilla/PodOperations.h"
 
-#include "ParseNode.h"
-#include "SharedContext.h"
+#include "frontend/ParseNode.h"
+#include "frontend/SharedContext.h"
 
 namespace js {
 namespace frontend {
diff --git a/js/src/frontend/ParseMaps.cpp b/js/src/frontend/ParseMaps.cpp
index 332927be476..56f3790b973 100644
--- a/js/src/frontend/ParseMaps.cpp
+++ b/js/src/frontend/ParseMaps.cpp
@@ -5,10 +5,10 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jscntxt.h"
-#include "FullParseHandler.h"
-#include "SyntaxParseHandler.h"
+#include "frontend/FullParseHandler.h"
+#include "frontend/SyntaxParseHandler.h"
 
-#include "ParseMaps-inl.h"
+#include "frontend/ParseMaps-inl.h"
 #include "vm/String-inl.h"
 
 using namespace js;
diff --git a/js/src/ion/AliasAnalysis.cpp b/js/src/ion/AliasAnalysis.cpp
index 5fc176480ee..561746ed559 100644
--- a/js/src/ion/AliasAnalysis.cpp
+++ b/js/src/ion/AliasAnalysis.cpp
@@ -6,12 +6,12 @@
 
 #include <stdio.h>
 
-#include "MIR.h"
-#include "AliasAnalysis.h"
-#include "MIRGraph.h"
-#include "Ion.h"
-#include "IonBuilder.h"
-#include "IonSpewer.h"
+#include "ion/MIR.h"
+#include "ion/AliasAnalysis.h"
+#include "ion/MIRGraph.h"
+#include "ion/Ion.h"
+#include "ion/IonBuilder.h"
+#include "ion/IonSpewer.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/AliasAnalysis.h b/js/src/ion/AliasAnalysis.h
index 278849d8461..f0dd032e810 100644
--- a/js/src/ion/AliasAnalysis.h
+++ b/js/src/ion/AliasAnalysis.h
@@ -7,8 +7,8 @@
 #ifndef ion_AliasAnalysis_h
 #define ion_AliasAnalysis_h
 
-#include "MIR.h"
-#include "MIRGraph.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/AsmJS.cpp b/js/src/ion/AsmJS.cpp
index 064a19bd6ec..9b99a18fac2 100644
--- a/js/src/ion/AsmJS.cpp
+++ b/js/src/ion/AsmJS.cpp
@@ -16,10 +16,6 @@
 #include "ion/MIR.h"
 #include "ion/MIRGraph.h"
 
-#ifdef MOZ_VTUNE
-# include "jitprofiling.h"
-#endif
-
 #include "jsfuninlines.h"
 
 #include "frontend/ParseNode-inl.h"
diff --git a/js/src/ion/AsmJSLink.cpp b/js/src/ion/AsmJSLink.cpp
index 974d0b1541d..00113d7ced6 100644
--- a/js/src/ion/AsmJSLink.cpp
+++ b/js/src/ion/AsmJSLink.cpp
@@ -7,15 +7,11 @@
 #include "jsmath.h"
 #include "jscntxt.h"
 
-#include "AsmJS.h"
-#include "AsmJSModule.h"
+#include "ion/AsmJS.h"
+#include "ion/AsmJSModule.h"
 #include "frontend/BytecodeCompiler.h"
 
-#include "Ion.h"
-
-#ifdef MOZ_VTUNE
-# include "jitprofiling.h"
-#endif
+#include "ion/Ion.h"
 
 #include "jsfuninlines.h"
 #include "jstypedarrayinlines.h"
diff --git a/js/src/ion/AsmJSModule.h b/js/src/ion/AsmJSModule.h
index 1b0af4be3e0..13d6650d622 100644
--- a/js/src/ion/AsmJSModule.h
+++ b/js/src/ion/AsmJSModule.h
@@ -15,7 +15,7 @@
 #include "jsscript.h"
 #include "jstypedarrayinlines.h"
 
-#include "IonMacroAssembler.h"
+#include "ion/IonMacroAssembler.h"
 
 namespace js {
 
diff --git a/js/src/ion/BacktrackingAllocator.cpp b/js/src/ion/BacktrackingAllocator.cpp
index df06878f85c..83563fa87e5 100644
--- a/js/src/ion/BacktrackingAllocator.cpp
+++ b/js/src/ion/BacktrackingAllocator.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BacktrackingAllocator.h"
+#include "ion/BacktrackingAllocator.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/BacktrackingAllocator.h b/js/src/ion/BacktrackingAllocator.h
index 99cae2b4f09..56e6c195099 100644
--- a/js/src/ion/BacktrackingAllocator.h
+++ b/js/src/ion/BacktrackingAllocator.h
@@ -7,7 +7,7 @@
 #ifndef ion_BacktrackingAllocator_h
 #define ion_BacktrackingAllocator_h
 
-#include "LiveRangeAllocator.h"
+#include "ion/LiveRangeAllocator.h"
 
 #include "ds/PriorityQueue.h"
 #include "ds/SplayTree.h"
diff --git a/js/src/ion/Bailouts.cpp b/js/src/ion/Bailouts.cpp
index 44407f2cdbc..f8ff6527464 100644
--- a/js/src/ion/Bailouts.cpp
+++ b/js/src/ion/Bailouts.cpp
@@ -9,13 +9,13 @@
 #include "jscompartment.h"
 #include "jsinfer.h"
 
-#include "Bailouts.h"
-#include "SnapshotReader.h"
-#include "Ion.h"
-#include "IonCompartment.h"
-#include "IonSpewer.h"
+#include "ion/Bailouts.h"
+#include "ion/SnapshotReader.h"
+#include "ion/Ion.h"
+#include "ion/IonCompartment.h"
+#include "ion/IonSpewer.h"
 #include "vm/Interpreter.h"
-#include "BaselineJIT.h"
+#include "ion/BaselineJIT.h"
 
 #include "jsinferinlines.h"
 
diff --git a/js/src/ion/Bailouts.h b/js/src/ion/Bailouts.h
index a6ccc3551da..55b19486eb4 100644
--- a/js/src/ion/Bailouts.h
+++ b/js/src/ion/Bailouts.h
@@ -9,8 +9,8 @@
 
 #include "jstypes.h"
 #include "vm/Stack.h"
-#include "IonFrameIterator.h"
-#include "IonFrames.h"
+#include "ion/IonFrameIterator.h"
+#include "ion/IonFrames.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/BaselineBailouts.cpp b/js/src/ion/BaselineBailouts.cpp
index 879dbeca398..f737c62e470 100644
--- a/js/src/ion/BaselineBailouts.cpp
+++ b/js/src/ion/BaselineBailouts.cpp
@@ -4,12 +4,12 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineCompiler.h"
-#include "BaselineIC.h"
-#include "BaselineJIT.h"
-#include "CompileInfo.h"
-#include "IonSpewer.h"
-#include "IonFrames-inl.h"
+#include "ion/BaselineCompiler.h"
+#include "ion/BaselineIC.h"
+#include "ion/BaselineJIT.h"
+#include "ion/CompileInfo.h"
+#include "ion/IonSpewer.h"
+#include "ion/IonFrames-inl.h"
 
 #include "vm/Stack-inl.h"
 
diff --git a/js/src/ion/BaselineCompiler.cpp b/js/src/ion/BaselineCompiler.cpp
index 46b5129a628..e9fd8f63215 100644
--- a/js/src/ion/BaselineCompiler.cpp
+++ b/js/src/ion/BaselineCompiler.cpp
@@ -4,15 +4,15 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineJIT.h"
-#include "BaselineIC.h"
-#include "BaselineHelpers.h"
-#include "BaselineCompiler.h"
-#include "FixedList.h"
-#include "IonLinker.h"
-#include "IonSpewer.h"
-#include "VMFunctions.h"
-#include "IonFrames-inl.h"
+#include "ion/BaselineJIT.h"
+#include "ion/BaselineIC.h"
+#include "ion/BaselineHelpers.h"
+#include "ion/BaselineCompiler.h"
+#include "ion/FixedList.h"
+#include "ion/IonLinker.h"
+#include "ion/IonSpewer.h"
+#include "ion/VMFunctions.h"
+#include "ion/IonFrames-inl.h"
 
 #include "jsopcodeinlines.h"
 
diff --git a/js/src/ion/BaselineCompiler.h b/js/src/ion/BaselineCompiler.h
index e59704dfb89..35a17e19bab 100644
--- a/js/src/ion/BaselineCompiler.h
+++ b/js/src/ion/BaselineCompiler.h
@@ -11,23 +11,23 @@
 
 #include "jscntxt.h"
 #include "jscompartment.h"
-#include "IonCode.h"
+#include "ion/IonCode.h"
 #include "jsinfer.h"
 
 #include "vm/Interpreter.h"
 
-#include "IonAllocPolicy.h"
-#include "BaselineJIT.h"
-#include "BaselineIC.h"
-#include "FixedList.h"
-#include "BytecodeAnalysis.h"
+#include "ion/IonAllocPolicy.h"
+#include "ion/BaselineJIT.h"
+#include "ion/BaselineIC.h"
+#include "ion/FixedList.h"
+#include "ion/BytecodeAnalysis.h"
 
 #if defined(JS_CPU_X86)
-# include "x86/BaselineCompiler-x86.h"
+# include "ion/x86/BaselineCompiler-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/BaselineCompiler-x64.h"
+# include "ion/x64/BaselineCompiler-x64.h"
 #else
-# include "arm/BaselineCompiler-arm.h"
+# include "ion/arm/BaselineCompiler-arm.h"
 #endif
 
 namespace js {
diff --git a/js/src/ion/BaselineFrame-inl.h b/js/src/ion/BaselineFrame-inl.h
index 66aa3db8209..88df3ddcb89 100644
--- a/js/src/ion/BaselineFrame-inl.h
+++ b/js/src/ion/BaselineFrame-inl.h
@@ -14,7 +14,7 @@
 #include "jscntxt.h"
 #include "jscompartment.h"
 
-#include "IonFrames.h"
+#include "ion/IonFrames.h"
 #include "vm/ScopeObject-inl.h"
 
 namespace js {
diff --git a/js/src/ion/BaselineFrame.cpp b/js/src/ion/BaselineFrame.cpp
index 0021e3cc8e0..8c5fafb0a73 100644
--- a/js/src/ion/BaselineFrame.cpp
+++ b/js/src/ion/BaselineFrame.cpp
@@ -4,10 +4,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineFrame.h"
-#include "BaselineIC.h"
-#include "BaselineJIT.h"
-#include "Ion.h"
+#include "ion/BaselineFrame.h"
+#include "ion/BaselineIC.h"
+#include "ion/BaselineJIT.h"
+#include "ion/Ion.h"
 
 #include "vm/Debugger.h"
 #include "vm/ScopeObject.h"
diff --git a/js/src/ion/BaselineFrame.h b/js/src/ion/BaselineFrame.h
index f5f16f8ecf5..f47df3eabdf 100644
--- a/js/src/ion/BaselineFrame.h
+++ b/js/src/ion/BaselineFrame.h
@@ -12,7 +12,7 @@
 #include "jscntxt.h"
 #include "jscompartment.h"
 
-#include "IonFrames.h"
+#include "ion/IonFrames.h"
 #include "vm/Stack.h"
 
 namespace js {
diff --git a/js/src/ion/BaselineFrameInfo.cpp b/js/src/ion/BaselineFrameInfo.cpp
index be4030c305b..a0441160c79 100644
--- a/js/src/ion/BaselineFrameInfo.cpp
+++ b/js/src/ion/BaselineFrameInfo.cpp
@@ -4,9 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineFrameInfo.h"
-#include "IonSpewer.h"
-#include "shared/BaselineCompiler-shared.h"
+#include "ion/BaselineFrameInfo.h"
+#include "ion/IonSpewer.h"
+#include "ion/shared/BaselineCompiler-shared.h"
 
 #include "jsanalyze.h"
 #include "jsinferinlines.h"
diff --git a/js/src/ion/BaselineFrameInfo.h b/js/src/ion/BaselineFrameInfo.h
index a8b542195cf..916f277e9ca 100644
--- a/js/src/ion/BaselineFrameInfo.h
+++ b/js/src/ion/BaselineFrameInfo.h
@@ -12,12 +12,12 @@
 #include "jscntxt.h"
 #include "jscompartment.h"
 
-#include "BaselineJIT.h"
-#include "BaselineFrame.h"
-#include "BaselineRegisters.h"
-#include "BytecodeAnalysis.h"
-#include "IonMacroAssembler.h"
-#include "FixedList.h"
+#include "ion/BaselineJIT.h"
+#include "ion/BaselineFrame.h"
+#include "ion/BaselineRegisters.h"
+#include "ion/BytecodeAnalysis.h"
+#include "ion/IonMacroAssembler.h"
+#include "ion/FixedList.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/BaselineHelpers.h b/js/src/ion/BaselineHelpers.h
index 8264aa1b047..fe65ac14a18 100644
--- a/js/src/ion/BaselineHelpers.h
+++ b/js/src/ion/BaselineHelpers.h
@@ -10,11 +10,11 @@
 #ifdef JS_ION
 
 #if defined(JS_CPU_X86)
-# include "x86/BaselineHelpers-x86.h"
+# include "ion/x86/BaselineHelpers-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/BaselineHelpers-x64.h"
+# include "ion/x64/BaselineHelpers-x64.h"
 #elif defined(JS_CPU_ARM)
-# include "arm/BaselineHelpers-arm.h"
+# include "ion/arm/BaselineHelpers-arm.h"
 #else
 # error "Unknown architecture!"
 #endif
diff --git a/js/src/ion/BaselineIC.h b/js/src/ion/BaselineIC.h
index 365f1cf9444..6c0568da225 100644
--- a/js/src/ion/BaselineIC.h
+++ b/js/src/ion/BaselineIC.h
@@ -14,8 +14,8 @@
 #include "jsgc.h"
 #include "jsopcode.h"
 #include "jsproxy.h"
-#include "BaselineJIT.h"
-#include "BaselineRegisters.h"
+#include "ion/BaselineJIT.h"
+#include "ion/BaselineRegisters.h"
 
 #include "gc/Heap.h"
 
diff --git a/js/src/ion/BaselineInspector.cpp b/js/src/ion/BaselineInspector.cpp
index b088872c737..4461e293a4a 100644
--- a/js/src/ion/BaselineInspector.cpp
+++ b/js/src/ion/BaselineInspector.cpp
@@ -4,8 +4,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineIC.h"
-#include "BaselineInspector.h"
+#include "ion/BaselineIC.h"
+#include "ion/BaselineInspector.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/BaselineInspector.h b/js/src/ion/BaselineInspector.h
index a4d90e414c3..add4e7e278d 100644
--- a/js/src/ion/BaselineInspector.h
+++ b/js/src/ion/BaselineInspector.h
@@ -12,9 +12,9 @@
 #include "jscntxt.h"
 #include "jscompartment.h"
 
-#include "BaselineJIT.h"
-#include "BaselineIC.h"
-#include "MIR.h"
+#include "ion/BaselineJIT.h"
+#include "ion/BaselineIC.h"
+#include "ion/MIR.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/BaselineJIT.cpp b/js/src/ion/BaselineJIT.cpp
index 0eebd756f78..fd633dd7621 100644
--- a/js/src/ion/BaselineJIT.cpp
+++ b/js/src/ion/BaselineJIT.cpp
@@ -6,12 +6,12 @@
 
 #include "mozilla/MemoryReporting.h"
 
-#include "BaselineCompiler.h"
-#include "BaselineIC.h"
-#include "BaselineJIT.h"
-#include "CompileInfo.h"
-#include "IonSpewer.h"
-#include "IonFrames-inl.h"
+#include "ion/BaselineCompiler.h"
+#include "ion/BaselineIC.h"
+#include "ion/BaselineJIT.h"
+#include "ion/CompileInfo.h"
+#include "ion/IonSpewer.h"
+#include "ion/IonFrames-inl.h"
 
 #include "vm/Stack-inl.h"
 
diff --git a/js/src/ion/BaselineJIT.h b/js/src/ion/BaselineJIT.h
index d83ee1ca69c..16d40dae5aa 100644
--- a/js/src/ion/BaselineJIT.h
+++ b/js/src/ion/BaselineJIT.h
@@ -14,9 +14,9 @@
 #include "jscntxt.h"
 #include "jscompartment.h"
 
-#include "IonCode.h"
-#include "IonMacroAssembler.h"
-#include "Bailouts.h"
+#include "ion/IonCode.h"
+#include "ion/IonMacroAssembler.h"
+#include "ion/Bailouts.h"
 
 #include "ds/LifoAlloc.h"
 
diff --git a/js/src/ion/BaselineRegisters.h b/js/src/ion/BaselineRegisters.h
index f9b5c341cfe..231ce9839f0 100644
--- a/js/src/ion/BaselineRegisters.h
+++ b/js/src/ion/BaselineRegisters.h
@@ -10,11 +10,11 @@
 #ifdef JS_ION
 
 #if defined(JS_CPU_X86)
-# include "x86/BaselineRegisters-x86.h"
+# include "ion/x86/BaselineRegisters-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/BaselineRegisters-x64.h"
+# include "ion/x64/BaselineRegisters-x64.h"
 #else
-# include "arm/BaselineRegisters-arm.h"
+# include "ion/arm/BaselineRegisters-arm.h"
 #endif
 
 namespace js {
diff --git a/js/src/ion/BitSet.cpp b/js/src/ion/BitSet.cpp
index bbe12ce97f6..aa2818c209c 100644
--- a/js/src/ion/BitSet.cpp
+++ b/js/src/ion/BitSet.cpp
@@ -5,7 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "jsutil.h"
-#include "BitSet.h"
+#include "ion/BitSet.h"
 
 #include "jsscriptinlines.h"
 
diff --git a/js/src/ion/BitSet.h b/js/src/ion/BitSet.h
index aad517f6784..597729a09ff 100644
--- a/js/src/ion/BitSet.h
+++ b/js/src/ion/BitSet.h
@@ -7,7 +7,7 @@
 #ifndef ion_BitSet_h
 #define ion_BitSet_h
 
-#include "IonAllocPolicy.h"
+#include "ion/IonAllocPolicy.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/BytecodeAnalysis.h b/js/src/ion/BytecodeAnalysis.h
index ba7440ad17c..14df7429118 100644
--- a/js/src/ion/BytecodeAnalysis.h
+++ b/js/src/ion/BytecodeAnalysis.h
@@ -9,13 +9,12 @@
 
 #include "jscntxt.h"
 
-#include "IonAllocPolicy.h"
+#include "ion/IonAllocPolicy.h"
 #include "js/Vector.h"
 
 namespace js {
 namespace ion {
 
-
 // Basic information about bytecodes in the script.  Used to help baseline compilation.
 struct BytecodeInfo
 {
diff --git a/js/src/ion/C1Spewer.cpp b/js/src/ion/C1Spewer.cpp
index b66e04a4ad1..b8a37d4f958 100644
--- a/js/src/ion/C1Spewer.cpp
+++ b/js/src/ion/C1Spewer.cpp
@@ -9,12 +9,12 @@
 #include <stdarg.h>
 #include <time.h>
 
-#include "IonBuilder.h"
-#include "Ion.h"
-#include "C1Spewer.h"
-#include "MIRGraph.h"
-#include "LIR.h"
-#include "LinearScan.h"
+#include "ion/IonBuilder.h"
+#include "ion/Ion.h"
+#include "ion/C1Spewer.h"
+#include "ion/MIRGraph.h"
+#include "ion/LIR.h"
+#include "ion/LinearScan.h"
 
 #include "jsscriptinlines.h"
 
diff --git a/js/src/ion/CodeGenerator.cpp b/js/src/ion/CodeGenerator.cpp
index ba449fb9afe..2ecc20feb37 100644
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -9,20 +9,20 @@
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Util.h"
 
-#include "PerfSpewer.h"
-#include "CodeGenerator.h"
-#include "IonLinker.h"
-#include "IonSpewer.h"
-#include "MIRGenerator.h"
-#include "shared/CodeGenerator-shared-inl.h"
+#include "ion/PerfSpewer.h"
+#include "ion/CodeGenerator.h"
+#include "ion/IonLinker.h"
+#include "ion/IonSpewer.h"
+#include "ion/MIRGenerator.h"
+#include "ion/shared/CodeGenerator-shared-inl.h"
 #include "jsnum.h"
 #include "jsmath.h"
-#include "ParallelFunctions.h"
-#include "ExecutionModeInlines.h"
+#include "ion/ParallelFunctions.h"
+#include "ion/ExecutionModeInlines.h"
 #include "builtin/Eval.h"
 #include "gc/Nursery.h"
 #include "vm/ForkJoin.h"
-#include "ParallelSafetyAnalysis.h"
+#include "ion/ParallelSafetyAnalysis.h"
 
 #include "vm/Interpreter-inl.h"
 #include "vm/StringObject-inl.h"
@@ -570,18 +570,33 @@ CodeGenerator::visitPolyInlineDispatch(LPolyInlineDispatch *lir)
     return true;
 }
 
-typedef JSFlatString *(*IntToStringFn)(JSContext *, int);
+typedef JSFlatString *(*IntToStringFn)(ThreadSafeContext *, int);
 static const VMFunction IntToStringInfo =
     FunctionInfo<IntToStringFn>(Int32ToString<CanGC>);
 
+typedef ParallelResult (*ParallelIntToStringFn)(ForkJoinSlice *, int, MutableHandleString);
+static const VMFunction ParallelIntToStringInfo =
+    FunctionInfo<ParallelIntToStringFn>(ParIntToString);
+
 bool
 CodeGenerator::visitIntToString(LIntToString *lir)
 {
     Register input = ToRegister(lir->input());
     Register output = ToRegister(lir->output());
 
-    OutOfLineCode *ool = oolCallVM(IntToStringInfo, lir, (ArgList(), input),
-                                   StoreRegisterTo(output));
+    OutOfLineCode *ool;
+    switch (gen->info().executionMode()) {
+      case SequentialExecution:
+        ool = oolCallVM(IntToStringInfo, lir, (ArgList(), input),
+                        StoreRegisterTo(output));
+        break;
+      case ParallelExecution:
+        ool = oolCallVM(ParallelIntToStringInfo, lir, (ArgList(), input),
+                        StoreRegisterTo(output));
+        break;
+      default:
+        JS_NOT_REACHED("No such execution mode");
+    }
     if (!ool)
         return false;
 
@@ -595,6 +610,48 @@ CodeGenerator::visitIntToString(LIntToString *lir)
     return true;
 }
 
+typedef JSString *(*DoubleToStringFn)(ThreadSafeContext *, double);
+static const VMFunction DoubleToStringInfo =
+    FunctionInfo<DoubleToStringFn>(js_NumberToString<CanGC>);
+
+typedef ParallelResult (*ParallelDoubleToStringFn)(ForkJoinSlice *, double, MutableHandleString);
+static const VMFunction ParallelDoubleToStringInfo =
+    FunctionInfo<ParallelDoubleToStringFn>(ParDoubleToString);
+
+bool
+CodeGenerator::visitDoubleToString(LDoubleToString *lir)
+{
+    FloatRegister input = ToFloatRegister(lir->input());
+    Register temp = ToRegister(lir->tempInt());
+    Register output = ToRegister(lir->output());
+
+    OutOfLineCode *ool;
+    switch (gen->info().executionMode()) {
+      case SequentialExecution:
+        ool = oolCallVM(DoubleToStringInfo, lir, (ArgList(), input),
+                        StoreRegisterTo(output));
+        break;
+      case ParallelExecution:
+        ool = oolCallVM(ParallelDoubleToStringInfo, lir, (ArgList(), input),
+                        StoreRegisterTo(output));
+        break;
+      default:
+        JS_NOT_REACHED("No such execution mode");
+    }
+    if (!ool)
+        return false;
+
+    masm.convertDoubleToInt32(input, temp, ool->entry(), true);
+    masm.branch32(Assembler::AboveOrEqual, temp, Imm32(StaticStrings::INT_STATIC_LIMIT),
+                  ool->entry());
+
+    masm.movePtr(ImmWord(&gen->compartment->rt->staticStrings.intStaticTable), output);
+    masm.loadPtr(BaseIndex(output, temp, ScalePointer), output);
+
+    masm.bind(ool->rejoin());
+    return true;
+}
+
 typedef JSObject *(*CloneRegExpObjectFn)(JSContext *, JSObject *, JSObject *);
 static const VMFunction CloneRegExpObjectInfo =
     FunctionInfo<CloneRegExpObjectFn>(CloneRegExpObject);
@@ -3822,7 +3879,7 @@ CodeGenerator::visitIsNullOrLikeUndefinedAndBranch(LIsNullOrLikeUndefinedAndBran
     return true;
 }
 
-typedef JSString *(*ConcatStringsFn)(JSContext *, HandleString, HandleString);
+typedef JSString *(*ConcatStringsFn)(ThreadSafeContext *, HandleString, HandleString);
 static const VMFunction ConcatStringsInfo = FunctionInfo<ConcatStringsFn>(ConcatStrings<CanGC>);
 
 bool
@@ -3923,7 +3980,41 @@ CodeGenerator::visitConcat(LConcat *lir)
     if (!ool)
         return false;
 
-    IonCode *stringConcatStub = gen->ionCompartment()->stringConcatStub();
+    IonCode *stringConcatStub = gen->ionCompartment()->stringConcatStub(SequentialExecution);
+    masm.call(stringConcatStub);
+    masm.branchTestPtr(Assembler::Zero, output, output, ool->entry());
+
+    masm.bind(ool->rejoin());
+    return true;
+}
+
+typedef ParallelResult (*ParallelConcatStringsFn)(ForkJoinSlice *, HandleString, HandleString,
+                                                  MutableHandleString);
+static const VMFunction ParallelConcatStringsInfo =
+    FunctionInfo<ParallelConcatStringsFn>(ParConcatStrings);
+
+bool
+CodeGenerator::visitParConcat(LParConcat *lir)
+{
+    Register slice = ToRegister(lir->parSlice());
+    Register lhs = ToRegister(lir->lhs());
+    Register rhs = ToRegister(lir->rhs());
+    Register output = ToRegister(lir->output());
+
+    JS_ASSERT(lhs == CallTempReg0);
+    JS_ASSERT(rhs == CallTempReg1);
+    JS_ASSERT(slice == CallTempReg5);
+    JS_ASSERT(ToRegister(lir->temp1()) == CallTempReg2);
+    JS_ASSERT(ToRegister(lir->temp2()) == CallTempReg3);
+    JS_ASSERT(ToRegister(lir->temp3()) == CallTempReg4);
+    JS_ASSERT(output == CallTempReg6);
+
+    OutOfLineCode *ool = oolCallVM(ParallelConcatStringsInfo, lir, (ArgList(), lhs, rhs),
+                                   StoreRegisterTo(output));
+    if (!ool)
+        return false;
+
+    IonCode *stringConcatStub = gen->ionCompartment()->stringConcatStub(ParallelExecution);
     masm.call(stringConcatStub);
     masm.branchTestPtr(Assembler::Zero, output, output, ool->entry());
 
@@ -3957,7 +4048,7 @@ CopyStringChars(MacroAssembler &masm, Register to, Register from, Register len,
 }
 
 IonCode *
-IonCompartment::generateStringConcatStub(JSContext *cx)
+IonCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
 {
     MacroAssembler masm(cx);
 
@@ -3969,7 +4060,12 @@ IonCompartment::generateStringConcatStub(JSContext *cx)
     Register temp4 = CallTempReg5;
     Register output = CallTempReg6;
 
-    Label failure;
+    // In parallel execution, we pass in the ForkJoinSlice in CallTempReg5, as
+    // by the time we need to use the temp4 we no longer have need of the
+    // slice.
+    Register forkJoinSlice = CallTempReg5;
+
+    Label failure, failurePopTemps;
 
     // If lhs is empty, return rhs.
     Label leftEmpty;
@@ -3992,7 +4088,20 @@ IonCompartment::generateStringConcatStub(JSContext *cx)
     masm.branch32(Assembler::Above, temp2, Imm32(JSString::MAX_LENGTH), &failure);
 
     // Allocate a new rope.
-    masm.newGCString(output, &failure);
+    switch (mode) {
+      case SequentialExecution:
+        masm.newGCString(output, &failure);
+        break;
+      case ParallelExecution:
+        masm.push(temp1);
+        masm.push(temp2);
+        masm.parNewGCString(output, forkJoinSlice, temp1, temp2, &failurePopTemps);
+        masm.pop(temp2);
+        masm.pop(temp1);
+        break;
+      default:
+        JS_NOT_REACHED("No such execution mode");
+    }
 
     // Store lengthAndFlags.
     JS_STATIC_ASSERT(JSString::ROPE_FLAGS == 0);
@@ -4024,7 +4133,20 @@ IonCompartment::generateStringConcatStub(JSContext *cx)
                        Imm32(JSString::FLAGS_MASK), &failure);
 
     // Allocate a JSShortString.
-    masm.newGCShortString(output, &failure);
+    switch (mode) {
+      case SequentialExecution:
+        masm.newGCShortString(output, &failure);
+        break;
+      case ParallelExecution:
+        masm.push(temp1);
+        masm.push(temp2);
+        masm.parNewGCShortString(output, forkJoinSlice, temp1, temp2, &failurePopTemps);
+        masm.pop(temp2);
+        masm.pop(temp1);
+        break;
+      default:
+        JS_NOT_REACHED("No such execution mode");
+    }
 
     // Set lengthAndFlags.
     masm.lshiftPtr(Imm32(JSString::LENGTH_SHIFT), temp2);
@@ -4049,6 +4171,10 @@ IonCompartment::generateStringConcatStub(JSContext *cx)
     masm.store16(Imm32(0), Address(temp2, 0));
     masm.ret();
 
+    masm.bind(&failurePopTemps);
+    masm.pop(temp2);
+    masm.pop(temp1);
+
     masm.bind(&failure);
     masm.movePtr(ImmWord((void *)NULL), output);
     masm.ret();
diff --git a/js/src/ion/CodeGenerator.h b/js/src/ion/CodeGenerator.h
index e732f104bfb..03ed9957269 100644
--- a/js/src/ion/CodeGenerator.h
+++ b/js/src/ion/CodeGenerator.h
@@ -8,11 +8,11 @@
 #define ion_CodeGenerator_h
 
 #if defined(JS_CPU_X86)
-# include "x86/CodeGenerator-x86.h"
+# include "ion/x86/CodeGenerator-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/CodeGenerator-x64.h"
+# include "ion/x64/CodeGenerator-x64.h"
 #elif defined(JS_CPU_ARM)
-# include "arm/CodeGenerator-arm.h"
+# include "ion/arm/CodeGenerator-arm.h"
 #else
 #error "CPU Not Supported"
 #endif
@@ -75,6 +75,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitTypeObjectDispatch(LTypeObjectDispatch *lir);
     bool visitPolyInlineDispatch(LPolyInlineDispatch *lir);
     bool visitIntToString(LIntToString *lir);
+    bool visitDoubleToString(LDoubleToString *lir);
     bool visitInteger(LInteger *lir);
     bool visitRegExp(LRegExp *lir);
     bool visitRegExpTest(LRegExpTest *lir);
@@ -172,6 +173,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitEmulatesUndefined(LEmulatesUndefined *lir);
     bool visitEmulatesUndefinedAndBranch(LEmulatesUndefinedAndBranch *lir);
     bool visitConcat(LConcat *lir);
+    bool visitParConcat(LParConcat *lir);
     bool visitCharCodeAt(LCharCodeAt *lir);
     bool visitFromCharCode(LFromCharCode *lir);
     bool visitFunctionEnvironment(LFunctionEnvironment *lir);
diff --git a/js/src/ion/CompactBuffer.h b/js/src/ion/CompactBuffer.h
index b4d2460ee24..599e0e530dc 100644
--- a/js/src/ion/CompactBuffer.h
+++ b/js/src/ion/CompactBuffer.h
@@ -9,7 +9,7 @@
 
 #include "js/Vector.h"
 #include "jsalloc.h"
-#include "IonTypes.h"
+#include "ion/IonTypes.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/CompileInfo-inl.h b/js/src/ion/CompileInfo-inl.h
index 203e1e8b81b..86eef9cb926 100644
--- a/js/src/ion/CompileInfo-inl.h
+++ b/js/src/ion/CompileInfo-inl.h
@@ -7,7 +7,7 @@
 #ifndef ion_CompileInfo_inl_h
 #define ion_CompileInfo_inl_h
 
-#include "CompileInfo.h"
+#include "ion/CompileInfo.h"
 #include "jsgcinlines.h"
 #include "jsscriptinlines.h"
 
diff --git a/js/src/ion/CompileInfo.h b/js/src/ion/CompileInfo.h
index 39a60b5ec98..6039619da21 100644
--- a/js/src/ion/CompileInfo.h
+++ b/js/src/ion/CompileInfo.h
@@ -7,7 +7,7 @@
 #ifndef ion_CompileInfo_h
 #define ion_CompileInfo_h
 
-#include "Registers.h"
+#include "ion/Registers.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/EdgeCaseAnalysis.cpp b/js/src/ion/EdgeCaseAnalysis.cpp
index 38cb200838b..427272033aa 100644
--- a/js/src/ion/EdgeCaseAnalysis.cpp
+++ b/js/src/ion/EdgeCaseAnalysis.cpp
@@ -6,12 +6,12 @@
 
 #include <stdio.h>
 
-#include "Ion.h"
-#include "IonBuilder.h"
-#include "IonSpewer.h"
-#include "EdgeCaseAnalysis.h"
-#include "MIR.h"
-#include "MIRGraph.h"
+#include "ion/Ion.h"
+#include "ion/IonBuilder.h"
+#include "ion/IonSpewer.h"
+#include "ion/EdgeCaseAnalysis.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/EffectiveAddressAnalysis.cpp b/js/src/ion/EffectiveAddressAnalysis.cpp
index 45b83de2d68..92c4ceb4e54 100644
--- a/js/src/ion/EffectiveAddressAnalysis.cpp
+++ b/js/src/ion/EffectiveAddressAnalysis.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "EffectiveAddressAnalysis.h"
+#include "ion/EffectiveAddressAnalysis.h"
 
 using namespace js;
 using namespace ion;
diff --git a/js/src/ion/EffectiveAddressAnalysis.h b/js/src/ion/EffectiveAddressAnalysis.h
index 0c75196e50f..e11506f153f 100644
--- a/js/src/ion/EffectiveAddressAnalysis.h
+++ b/js/src/ion/EffectiveAddressAnalysis.h
@@ -7,8 +7,8 @@
 #ifndef ion_EffectiveAddressAnalysis_h
 #define ion_EffectiveAddressAnalysis_h
 
-#include "MIR.h"
-#include "MIRGraph.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/Ion.cpp b/js/src/ion/Ion.cpp
index c9b315800ce..40f7ce7da6c 100644
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -6,40 +6,40 @@
 
 #include "mozilla/MemoryReporting.h"
 
-#include "BaselineJIT.h"
-#include "BaselineCompiler.h"
-#include "BaselineInspector.h"
-#include "Ion.h"
-#include "IonAnalysis.h"
-#include "IonBuilder.h"
-#include "IonLinker.h"
-#include "IonSpewer.h"
-#include "LIR.h"
-#include "AliasAnalysis.h"
-#include "LICM.h"
-#include "ValueNumbering.h"
-#include "EdgeCaseAnalysis.h"
-#include "RangeAnalysis.h"
-#include "LinearScan.h"
-#include "ParallelSafetyAnalysis.h"
+#include "ion/BaselineJIT.h"
+#include "ion/BaselineCompiler.h"
+#include "ion/BaselineInspector.h"
+#include "ion/Ion.h"
+#include "ion/IonAnalysis.h"
+#include "ion/IonBuilder.h"
+#include "ion/IonLinker.h"
+#include "ion/IonSpewer.h"
+#include "ion/LIR.h"
+#include "ion/AliasAnalysis.h"
+#include "ion/LICM.h"
+#include "ion/ValueNumbering.h"
+#include "ion/EdgeCaseAnalysis.h"
+#include "ion/RangeAnalysis.h"
+#include "ion/LinearScan.h"
+#include "ion/ParallelSafetyAnalysis.h"
 #include "jscompartment.h"
 #include "vm/ThreadPool.h"
 #include "vm/ForkJoin.h"
-#include "IonCompartment.h"
-#include "PerfSpewer.h"
-#include "CodeGenerator.h"
+#include "ion/IonCompartment.h"
+#include "ion/PerfSpewer.h"
+#include "ion/CodeGenerator.h"
 #include "jsworkers.h"
-#include "BacktrackingAllocator.h"
-#include "StupidAllocator.h"
-#include "UnreachableCodeElimination.h"
-#include "EffectiveAddressAnalysis.h"
+#include "ion/BacktrackingAllocator.h"
+#include "ion/StupidAllocator.h"
+#include "ion/UnreachableCodeElimination.h"
+#include "ion/EffectiveAddressAnalysis.h"
 
 #if defined(JS_CPU_X86)
-# include "x86/Lowering-x86.h"
+# include "ion/x86/Lowering-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/Lowering-x64.h"
+# include "ion/x64/Lowering-x64.h"
 #elif defined(JS_CPU_ARM)
-# include "arm/Lowering-arm.h"
+# include "ion/arm/Lowering-arm.h"
 #endif
 #include "gc/Marking.h"
 
@@ -51,9 +51,9 @@
 #include "vm/Stack-inl.h"
 #include "ion/IonFrames-inl.h"
 #include "ion/CompilerRoot.h"
-#include "ExecutionModeInlines.h"
-#include "AsmJS.h"
-#include "AsmJSModule.h"
+#include "ion/ExecutionModeInlines.h"
+#include "ion/AsmJS.h"
+#include "ion/AsmJSModule.h"
 
 #if JS_TRACE_LOGGING
 #include "TraceLogging.h"
@@ -298,7 +298,8 @@ IonCompartment::IonCompartment(IonRuntime *rt)
   : rt(rt),
     stubCodes_(NULL),
     baselineCallReturnAddr_(NULL),
-    stringConcatStub_(NULL)
+    stringConcatStub_(NULL),
+    parallelStringConcatStub_(NULL)
 {
 }
 
@@ -322,11 +323,19 @@ bool
 IonCompartment::ensureIonStubsExist(JSContext *cx)
 {
     if (!stringConcatStub_) {
-        stringConcatStub_ = generateStringConcatStub(cx);
+        stringConcatStub_ = generateStringConcatStub(cx, SequentialExecution);
         if (!stringConcatStub_)
             return false;
     }
 
+#ifdef JS_THREADSAFE
+    if (!parallelStringConcatStub_) {
+        parallelStringConcatStub_ = generateStringConcatStub(cx, ParallelExecution);
+        if (!parallelStringConcatStub_)
+            return false;
+    }
+#endif
+
     return true;
 }
 
diff --git a/js/src/ion/Ion.h b/js/src/ion/Ion.h
index 998d7c339a8..f1033ddf280 100644
--- a/js/src/ion/Ion.h
+++ b/js/src/ion/Ion.h
@@ -13,8 +13,8 @@
 
 #include "jscntxt.h"
 #include "jscompartment.h"
-#include "IonCode.h"
-#include "CompileInfo.h"
+#include "ion/IonCode.h"
+#include "ion/CompileInfo.h"
 #include "jsinfer.h"
 
 #include "vm/Interpreter.h"
diff --git a/js/src/ion/IonAllocPolicy.h b/js/src/ion/IonAllocPolicy.h
index 34690754386..cab3f48f4f4 100644
--- a/js/src/ion/IonAllocPolicy.h
+++ b/js/src/ion/IonAllocPolicy.h
@@ -12,8 +12,8 @@
 #include "jscntxt.h"
 #include "ds/LifoAlloc.h"
 
-#include "Ion.h"
-#include "InlineList.h"
+#include "ion/Ion.h"
+#include "ion/InlineList.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/IonAnalysis.cpp b/js/src/ion/IonAnalysis.cpp
index 93d59d57f2b..646beeb9a2a 100644
--- a/js/src/ion/IonAnalysis.cpp
+++ b/js/src/ion/IonAnalysis.cpp
@@ -4,11 +4,11 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "IonBuilder.h"
-#include "MIRGraph.h"
-#include "Ion.h"
-#include "IonAnalysis.h"
-#include "LIR.h"
+#include "ion/IonBuilder.h"
+#include "ion/MIRGraph.h"
+#include "ion/Ion.h"
+#include "ion/IonAnalysis.h"
+#include "ion/LIR.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/IonAnalysis.h b/js/src/ion/IonAnalysis.h
index bfd5df48ce6..ca31e2799d5 100644
--- a/js/src/ion/IonAnalysis.h
+++ b/js/src/ion/IonAnalysis.h
@@ -9,8 +9,8 @@
 
 // This file declares various analysis passes that operate on MIR.
 
-#include "IonAllocPolicy.h"
-#include "MIR.h"
+#include "ion/IonAllocPolicy.h"
+#include "ion/MIR.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/IonBuilder.cpp b/js/src/ion/IonBuilder.cpp
index f3188f1e466..6905af6c1b2 100644
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -27,10 +27,6 @@
 #include "ion/ExecutionModeInlines.h"
 #include "vm/ScopeObject-inl.h"
 
-#ifdef JS_THREADSAFE
-# include "prthread.h"
-#endif
-
 using namespace js;
 using namespace js::ion;
 
@@ -3290,9 +3286,14 @@ IonBuilder::jsop_binary(JSOp op, MDefinition *left, MDefinition *right)
     // Do a string concatenation if adding two inputs that are int or string
     // and at least one is a string.
     if (op == JSOP_ADD &&
-        (left->type() == MIRType_String || right->type() == MIRType_String) &&
-        (left->type() == MIRType_String || left->type() == MIRType_Int32) &&
-        (right->type() == MIRType_String || right->type() == MIRType_Int32))
+        ((left->type() == MIRType_String &&
+          (right->type() == MIRType_String ||
+           right->type() == MIRType_Int32 ||
+           right->type() == MIRType_Double)) ||
+         (left->type() == MIRType_Int32 &&
+          right->type() == MIRType_String) ||
+         (left->type() == MIRType_Double &&
+          right->type() == MIRType_String)))
     {
         MConcat *ins = MConcat::New(left, right);
         current->add(ins);
diff --git a/js/src/ion/IonBuilder.h b/js/src/ion/IonBuilder.h
index 4e131dafbf2..07e2c445452 100644
--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -12,8 +12,8 @@
 // This file declares the data structures for building a MIRGraph from a
 // JSScript.
 
-#include "MIR.h"
-#include "MIRGraph.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
 
 namespace js {
 namespace ion {
@@ -507,7 +507,6 @@ class IonBuilder : public MIRGenerator
                                            uint32_t discards);
 
     // Utility intrinsics.
-    InliningStatus inlineThrowError(CallInfo &callInfo);
     InliningStatus inlineIsCallable(CallInfo &callInfo);
     InliningStatus inlineNewObjectWithClassPrototype(CallInfo &callInfo);
     InliningStatus inlineHaveSameClass(CallInfo &callInfo);
diff --git a/js/src/ion/IonCaches.cpp b/js/src/ion/IonCaches.cpp
index 861b097bcaf..d9ab71d4942 100644
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@@ -6,17 +6,17 @@
 
 #include "mozilla/DebugOnly.h"
 
-#include "PerfSpewer.h"
-#include "CodeGenerator.h"
-#include "Ion.h"
-#include "IonCaches.h"
-#include "IonLinker.h"
-#include "IonSpewer.h"
-#include "VMFunctions.h"
+#include "ion/PerfSpewer.h"
+#include "ion/CodeGenerator.h"
+#include "ion/Ion.h"
+#include "ion/IonCaches.h"
+#include "ion/IonLinker.h"
+#include "ion/IonSpewer.h"
+#include "ion/VMFunctions.h"
 
 #include "vm/Shape.h"
 
-#include "IonFrames-inl.h"
+#include "ion/IonFrames-inl.h"
 
 #include "vm/Interpreter-inl.h"
 
diff --git a/js/src/ion/IonCaches.h b/js/src/ion/IonCaches.h
index 7b484915ae1..7d2525e6a59 100644
--- a/js/src/ion/IonCaches.h
+++ b/js/src/ion/IonCaches.h
@@ -7,8 +7,8 @@
 #ifndef ion_IonCaches_h
 #define ion_IonCaches_h
 
-#include "IonCode.h"
-#include "Registers.h"
+#include "ion/IonCode.h"
+#include "ion/Registers.h"
 
 #include "vm/ForkJoin.h"
 
diff --git a/js/src/ion/IonCode.h b/js/src/ion/IonCode.h
index a71378db230..85d7496782c 100644
--- a/js/src/ion/IonCode.h
+++ b/js/src/ion/IonCode.h
@@ -10,8 +10,8 @@
 #include "mozilla/MemoryReporting.h"
 #include "mozilla/PodOperations.h"
 
-#include "IonTypes.h"
-#include "AsmJS.h"
+#include "ion/IonTypes.h"
+#include "ion/AsmJS.h"
 #include "gc/Heap.h"
 
 // For RecompileInfo
diff --git a/js/src/ion/IonCompartment.h b/js/src/ion/IonCompartment.h
index 7eca88d55fe..7e55314d49e 100644
--- a/js/src/ion/IonCompartment.h
+++ b/js/src/ion/IonCompartment.h
@@ -11,12 +11,12 @@
 
 #include "mozilla/MemoryReporting.h"
 
-#include "IonCode.h"
+#include "ion/IonCode.h"
 #include "jsweakcache.h"
 #include "js/Value.h"
 #include "vm/Stack.h"
-#include "IonFrames.h"
-#include "CompileInfo.h"
+#include "ion/IonFrames.h"
+#include "ion/CompileInfo.h"
 
 namespace js {
 namespace ion {
@@ -228,8 +228,9 @@ class IonCompartment
     // pointers. This has to be a weak pointer to avoid keeping the whole
     // compartment alive.
     ReadBarriered<IonCode> stringConcatStub_;
+    ReadBarriered<IonCode> parallelStringConcatStub_;
 
-    IonCode *generateStringConcatStub(JSContext *cx);
+    IonCode *generateStringConcatStub(JSContext *cx, ExecutionMode mode);
 
   public:
     IonCode *getVMWrapper(const VMFunction &f);
@@ -321,8 +322,12 @@ class IonCompartment
         return rt->debugTrapHandler(cx);
     }
 
-    IonCode *stringConcatStub() {
-        return stringConcatStub_;
+    IonCode *stringConcatStub(ExecutionMode mode) {
+        switch (mode) {
+          case SequentialExecution: return stringConcatStub_;
+          case ParallelExecution:   return parallelStringConcatStub_;
+          default:                  JS_NOT_REACHED("No such execution mode");
+        }
     }
 
     AutoFlushCache *flusher() {
diff --git a/js/src/ion/IonFrameIterator.h b/js/src/ion/IonFrameIterator.h
index 0800abb4747..abdb62c1a4f 100644
--- a/js/src/ion/IonFrameIterator.h
+++ b/js/src/ion/IonFrameIterator.h
@@ -10,8 +10,8 @@
 #ifdef JS_ION
 
 #include "jstypes.h"
-#include "IonCode.h"
-#include "SnapshotReader.h"
+#include "ion/IonCode.h"
+#include "ion/SnapshotReader.h"
 
 class JSFunction;
 class JSScript;
diff --git a/js/src/ion/IonFrames.cpp b/js/src/ion/IonFrames.cpp
index 2b84cc64c12..d2b13e36f7c 100644
--- a/js/src/ion/IonFrames.cpp
+++ b/js/src/ion/IonFrames.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "IonFrames.h"
+#include "ion/IonFrames.h"
 
 #include "jsobj.h"
 #include "jsscript.h"
diff --git a/js/src/ion/IonFrames.h b/js/src/ion/IonFrames.h
index 70a0f48991f..a0f243a85fb 100644
--- a/js/src/ion/IonFrames.h
+++ b/js/src/ion/IonFrames.h
@@ -14,9 +14,9 @@
 #include "jsfun.h"
 #include "jstypes.h"
 #include "jsutil.h"
-#include "Registers.h"
-#include "IonCode.h"
-#include "IonFrameIterator.h"
+#include "ion/Registers.h"
+#include "ion/IonCode.h"
+#include "ion/IonFrameIterator.h"
 
 class JSFunction;
 class JSScript;
diff --git a/js/src/ion/IonMacroAssembler.cpp b/js/src/ion/IonMacroAssembler.cpp
index c3983a4e8db..8c2806f476a 100644
--- a/js/src/ion/IonMacroAssembler.cpp
+++ b/js/src/ion/IonMacroAssembler.cpp
@@ -141,7 +141,14 @@ MacroAssembler::PushRegsInMask(RegisterSet set)
     int32_t diffF = set.fpus().size() * sizeof(double);
     int32_t diffG = set.gprs().size() * STACK_SLOT_SIZE;
 
-#ifdef JS_CPU_ARM
+#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
+    // On x86, always use push to push the integer registers, as it's fast
+    // on modern hardware and it's a small instruction.
+    for (GeneralRegisterBackwardIterator iter(set.gprs()); iter.more(); iter++) {
+        diffG -= STACK_SLOT_SIZE;
+        Push(*iter);
+    }
+#elif defined(JS_CPU_ARM)
     if (set.gprs().size() > 1) {
         adjustFrame(diffG);
         startDataTransferM(IsStore, StackPointer, DB, WriteBack);
@@ -150,15 +157,20 @@ MacroAssembler::PushRegsInMask(RegisterSet set)
             transferReg(*iter);
         }
         finishDataTransfer();
-    } else
-#endif
-    {
+    } else {
         reserveStack(diffG);
         for (GeneralRegisterBackwardIterator iter(set.gprs()); iter.more(); iter++) {
             diffG -= STACK_SLOT_SIZE;
             storePtr(*iter, Address(StackPointer, diffG));
         }
     }
+#else
+    reserveStack(diffG);
+    for (GeneralRegisterBackwardIterator iter(set.gprs()); iter.more(); iter++) {
+        diffG -= STACK_SLOT_SIZE;
+        storePtr(*iter, Address(StackPointer, diffG));
+    }
+#endif
     JS_ASSERT(diffG == 0);
 
 #ifdef JS_CPU_ARM
@@ -200,6 +212,17 @@ MacroAssembler::PopRegsInMaskIgnore(RegisterSet set, RegisterSet ignore)
     }
     JS_ASSERT(diffF == 0);
 
+#if defined(JS_CPU_X86) || defined(JS_CPU_X64)
+    // On x86, use pop to pop the integer registers, if we're not going to
+    // ignore any slots, as it's fast on modern hardware and it's a small
+    // instruction.
+    if (ignore.empty(false)) {
+        for (GeneralRegisterForwardIterator iter(set.gprs()); iter.more(); iter++) {
+            diffG -= STACK_SLOT_SIZE;
+            Pop(*iter);
+        }
+    } else
+#endif
 #ifdef JS_CPU_ARM
     if (set.gprs().size() > 1 && ignore.empty(false)) {
         startDataTransferM(IsLoad, StackPointer, IA, WriteBack);
@@ -523,7 +546,7 @@ MacroAssembler::parNewGCThing(const Register &result,
                               const Register &threadContextReg,
                               const Register &tempReg1,
                               const Register &tempReg2,
-                              JSObject *templateObject,
+                              gc::AllocKind allocKind,
                               Label *fail)
 {
     // Similar to ::newGCThing(), except that it allocates from a
@@ -536,7 +559,6 @@ MacroAssembler::parNewGCThing(const Register &result,
     // register as `threadContextReg`.  Then we overwrite that
     // register which messed up the OOL code.
 
-    gc::AllocKind allocKind = templateObject->tenuredGetAllocKind();
     uint32_t thingSize = (uint32_t)gc::Arena::thingSize(allocKind);
 
     // Load the allocator:
@@ -572,6 +594,41 @@ MacroAssembler::parNewGCThing(const Register &result,
     storePtr(tempReg2, Address(tempReg1, offsetof(gc::FreeSpan, first)));
 }
 
+void
+MacroAssembler::parNewGCThing(const Register &result,
+                              const Register &threadContextReg,
+                              const Register &tempReg1,
+                              const Register &tempReg2,
+                              JSObject *templateObject,
+                              Label *fail)
+{
+    gc::AllocKind allocKind = templateObject->tenuredGetAllocKind();
+    JS_ASSERT(allocKind >= gc::FINALIZE_OBJECT0 && allocKind <= gc::FINALIZE_OBJECT_LAST);
+    JS_ASSERT(!templateObject->hasDynamicElements());
+
+    parNewGCThing(result, threadContextReg, tempReg1, tempReg2, allocKind, fail);
+}
+
+void
+MacroAssembler::parNewGCString(const Register &result,
+                               const Register &threadContextReg,
+                               const Register &tempReg1,
+                               const Register &tempReg2,
+                               Label *fail)
+{
+    parNewGCThing(result, threadContextReg, tempReg1, tempReg2, js::gc::FINALIZE_STRING, fail);
+}
+
+void
+MacroAssembler::parNewGCShortString(const Register &result,
+                                    const Register &threadContextReg,
+                                    const Register &tempReg1,
+                                    const Register &tempReg2,
+                                    Label *fail)
+{
+    parNewGCThing(result, threadContextReg, tempReg1, tempReg2, js::gc::FINALIZE_SHORT_STRING, fail);
+}
+
 void
 MacroAssembler::initGCThing(const Register &obj, JSObject *templateObject)
 {
diff --git a/js/src/ion/IonMacroAssembler.h b/js/src/ion/IonMacroAssembler.h
index b49b662285b..110de6d058f 100644
--- a/js/src/ion/IonMacroAssembler.h
+++ b/js/src/ion/IonMacroAssembler.h
@@ -600,12 +600,28 @@ class MacroAssembler : public MacroAssemblerSpecific
     void newGCString(const Register &result, Label *fail);
     void newGCShortString(const Register &result, Label *fail);
 
+    void parNewGCThing(const Register &result,
+                       const Register &threadContextReg,
+                       const Register &tempReg1,
+                       const Register &tempReg2,
+                       gc::AllocKind allocKind,
+                       Label *fail);
     void parNewGCThing(const Register &result,
                        const Register &threadContextReg,
                        const Register &tempReg1,
                        const Register &tempReg2,
                        JSObject *templateObject,
                        Label *fail);
+    void parNewGCString(const Register &result,
+                        const Register &threadContextReg,
+                        const Register &tempReg1,
+                        const Register &tempReg2,
+                        Label *fail);
+    void parNewGCShortString(const Register &result,
+                             const Register &threadContextReg,
+                             const Register &tempReg1,
+                             const Register &tempReg2,
+                             Label *fail);
     void initGCThing(const Register &obj, JSObject *templateObject);
 
     // Compares two strings for equality based on the JSOP.
diff --git a/js/src/ion/IonSpewer.cpp b/js/src/ion/IonSpewer.cpp
index 98c6468641a..979d0b1b26c 100644
--- a/js/src/ion/IonSpewer.cpp
+++ b/js/src/ion/IonSpewer.cpp
@@ -6,8 +6,8 @@
 
 #ifdef DEBUG
 
-#include "Ion.h"
-#include "IonSpewer.h"
+#include "ion/Ion.h"
+#include "ion/IonSpewer.h"
 
 #include "jsscriptinlines.h"
 
diff --git a/js/src/ion/IonSpewer.h b/js/src/ion/IonSpewer.h
index ae277732fcc..5cb805f66e2 100644
--- a/js/src/ion/IonSpewer.h
+++ b/js/src/ion/IonSpewer.h
@@ -11,8 +11,8 @@
 
 #include "mozilla/DebugOnly.h"
 
-#include "C1Spewer.h"
-#include "JSONSpewer.h"
+#include "ion/C1Spewer.h"
+#include "ion/JSONSpewer.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/IonTypes.h b/js/src/ion/IonTypes.h
index c562e14d02f..21cd21ac991 100644
--- a/js/src/ion/IonTypes.h
+++ b/js/src/ion/IonTypes.h
@@ -8,7 +8,7 @@
 #define ion_IonTypes_h
 
 #include "js/Value.h"
-#include <jstypes.h>
+#include "jstypes.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/JSONSpewer.cpp b/js/src/ion/JSONSpewer.cpp
index b8445314599..35124ad2f40 100644
--- a/js/src/ion/JSONSpewer.cpp
+++ b/js/src/ion/JSONSpewer.cpp
@@ -6,12 +6,13 @@
 
 #include <stdarg.h>
 
-#include "JSONSpewer.h"
-#include "LIR.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "LinearScan.h"
-#include "RangeAnalysis.h"
+#include "ion/JSONSpewer.h"
+#include "ion/LIR.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/LinearScan.h"
+#include "ion/RangeAnalysis.h"
+
 using namespace js;
 using namespace js::ion;
 
diff --git a/js/src/ion/LICM.cpp b/js/src/ion/LICM.cpp
index bc0f13a31d4..100c0ca09ab 100644
--- a/js/src/ion/LICM.cpp
+++ b/js/src/ion/LICM.cpp
@@ -6,12 +6,12 @@
 
 #include <stdio.h>
 
-#include "Ion.h"
-#include "IonBuilder.h"
-#include "IonSpewer.h"
-#include "LICM.h"
-#include "MIR.h"
-#include "MIRGraph.h"
+#include "ion/Ion.h"
+#include "ion/IonBuilder.h"
+#include "ion/IonSpewer.h"
+#include "ion/LICM.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/LIR-Common.h b/js/src/ion/LIR-Common.h
index c746335e71b..5d83913ac1e 100644
--- a/js/src/ion/LIR-Common.h
+++ b/js/src/ion/LIR-Common.h
@@ -2304,6 +2304,41 @@ class LConcat : public LInstructionHelper<1, 2, 4>
     }
 };
 
+class LParConcat : public LInstructionHelper<1, 3, 3>
+{
+  public:
+    LIR_HEADER(ParConcat)
+
+    LParConcat(const LAllocation &parSlice, const LAllocation &lhs, const LAllocation &rhs,
+               const LDefinition &temp1, const LDefinition &temp2, const LDefinition &temp3) {
+        setOperand(0, parSlice);
+        setOperand(1, lhs);
+        setOperand(2, rhs);
+        setTemp(0, temp1);
+        setTemp(1, temp2);
+        setTemp(2, temp3);
+    }
+
+    const LAllocation *parSlice() {
+        return this->getOperand(0);
+    }
+    const LAllocation *lhs() {
+        return this->getOperand(1);
+    }
+    const LAllocation *rhs() {
+        return this->getOperand(2);
+    }
+    const LDefinition *temp1() {
+        return this->getTemp(0);
+    }
+    const LDefinition *temp2() {
+        return this->getTemp(1);
+    }
+    const LDefinition *temp3() {
+        return this->getTemp(2);
+    }
+};
+
 // Get uint16 character code from a string.
 class LCharCodeAt : public LInstructionHelper<1, 2, 0>
 {
@@ -2442,8 +2477,7 @@ class LTruncateDToInt32 : public LInstructionHelper<1, 1, 1>
     }
 };
 
-// Convert a any input type hosted on one definition to a string with a function
-// call.
+// Convert an integer hosted on one definition to a string with a function call.
 class LIntToString : public LInstructionHelper<1, 1, 0>
 {
   public:
@@ -2458,6 +2492,25 @@ class LIntToString : public LInstructionHelper<1, 1, 0>
     }
 };
 
+// Convert a double hosted on one definition to a string with a function call.
+class LDoubleToString : public LInstructionHelper<1, 1, 1>
+{
+  public:
+    LIR_HEADER(DoubleToString)
+
+    LDoubleToString(const LAllocation &input, const LDefinition &temp) {
+        setOperand(0, input);
+        setTemp(0, temp);
+    }
+
+    const LDefinition *tempInt() {
+        return getTemp(0);
+    }
+    const MToString *mir() {
+        return mir_->toToString();
+    }
+};
+
 // No-op instruction that is used to hold the entry snapshot. This simplifies
 // register allocation as it doesn't need to sniff the snapshot out of the
 // LIRGraph.
diff --git a/js/src/ion/LIR.cpp b/js/src/ion/LIR.cpp
index 5705156dd6a..9b710d2d40e 100644
--- a/js/src/ion/LIR.cpp
+++ b/js/src/ion/LIR.cpp
@@ -4,12 +4,13 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "LIR.h"
-#include "IonSpewer.h"
-#include "LIR-inl.h"
-#include "shared/CodeGenerator-shared.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/LIR.h"
+#include "ion/IonSpewer.h"
+#include "ion/LIR-inl.h"
+#include "ion/shared/CodeGenerator-shared.h"
+
 using namespace js;
 using namespace js::ion;
 
diff --git a/js/src/ion/LIR.h b/js/src/ion/LIR.h
index 1e55bd47744..3322de9b009 100644
--- a/js/src/ion/LIR.h
+++ b/js/src/ion/LIR.h
@@ -11,17 +11,17 @@
 // inputs and outputs, as well as the interface instructions must conform to.
 
 #include "jscntxt.h"
-#include "IonAllocPolicy.h"
-#include "InlineList.h"
-#include "FixedArityList.h"
-#include "LOpcodes.h"
-#include "Registers.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "shared/Assembler-shared.h"
-#include "Safepoints.h"
-#include "Bailouts.h"
-#include "VMFunctions.h"
+#include "ion/IonAllocPolicy.h"
+#include "ion/InlineList.h"
+#include "ion/FixedArityList.h"
+#include "ion/LOpcodes.h"
+#include "ion/Registers.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/shared/Assembler-shared.h"
+#include "ion/Safepoints.h"
+#include "ion/Bailouts.h"
+#include "ion/VMFunctions.h"
 
 namespace js {
 namespace ion {
@@ -1430,20 +1430,20 @@ LAllocation::toRegister() const
     }
 #endif
 
-#include "LIR-Common.h"
+#include "ion/LIR-Common.h"
 #if defined(JS_CPU_X86) || defined(JS_CPU_X64)
 # if defined(JS_CPU_X86)
-#  include "x86/LIR-x86.h"
+#  include "ion/x86/LIR-x86.h"
 # elif defined(JS_CPU_X64)
-#  include "x64/LIR-x64.h"
+#  include "ion/x64/LIR-x64.h"
 # endif
-# include "shared/LIR-x86-shared.h"
+# include "ion/shared/LIR-x86-shared.h"
 #elif defined(JS_CPU_ARM)
-# include "arm/LIR-arm.h"
+# include "ion/arm/LIR-arm.h"
 #endif
 
 #undef LIR_HEADER
 
-#include "LIR-inl.h"
+#include "ion/LIR-inl.h"
 
 #endif /* ion_LIR_h */
diff --git a/js/src/ion/LOpcodes.h b/js/src/ion/LOpcodes.h
index faadd57f9e2..0c76bf15044 100644
--- a/js/src/ion/LOpcodes.h
+++ b/js/src/ion/LOpcodes.h
@@ -108,6 +108,7 @@
     _(ModD)                         \
     _(BinaryV)                      \
     _(Concat)                       \
+    _(ParConcat)                    \
     _(CharCodeAt)                   \
     _(FromCharCode)                 \
     _(Int32ToDouble)                \
@@ -116,6 +117,7 @@
     _(DoubleToInt32)                \
     _(TruncateDToInt32)             \
     _(IntToString)                  \
+    _(DoubleToString)               \
     _(Start)                        \
     _(OsrEntry)                     \
     _(OsrValue)                     \
@@ -241,11 +243,11 @@
     _(ParCheckInterrupt)
 
 #if defined(JS_CPU_X86)
-# include "x86/LOpcodes-x86.h"
+# include "ion/x86/LOpcodes-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/LOpcodes-x64.h"
+# include "ion/x64/LOpcodes-x64.h"
 #elif defined(JS_CPU_ARM)
-# include "arm/LOpcodes-arm.h"
+# include "ion/arm/LOpcodes-arm.h"
 #endif
 
 #define LIR_OPCODE_LIST(_)          \
diff --git a/js/src/ion/LinearScan.cpp b/js/src/ion/LinearScan.cpp
index c874aa5a555..06783f808cb 100644
--- a/js/src/ion/LinearScan.cpp
+++ b/js/src/ion/LinearScan.cpp
@@ -8,11 +8,11 @@
 
 #include "mozilla/DebugOnly.h"
 
-#include "BitSet.h"
-#include "LinearScan.h"
-#include "IonBuilder.h"
-#include "IonSpewer.h"
-#include "LIR-inl.h"
+#include "ion/BitSet.h"
+#include "ion/LinearScan.h"
+#include "ion/IonBuilder.h"
+#include "ion/IonSpewer.h"
+#include "ion/LIR-inl.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/LinearScan.h b/js/src/ion/LinearScan.h
index 2c7e33815d6..96379198b44 100644
--- a/js/src/ion/LinearScan.h
+++ b/js/src/ion/LinearScan.h
@@ -7,8 +7,8 @@
 #ifndef ion_LinearScan_h
 #define ion_LinearScan_h
 
-#include "LiveRangeAllocator.h"
-#include "BitSet.h"
+#include "ion/LiveRangeAllocator.h"
+#include "ion/BitSet.h"
 
 #include "js/Vector.h"
 
diff --git a/js/src/ion/LiveRangeAllocator.cpp b/js/src/ion/LiveRangeAllocator.cpp
index 0ad3b89c379..09e5b14fec1 100644
--- a/js/src/ion/LiveRangeAllocator.cpp
+++ b/js/src/ion/LiveRangeAllocator.cpp
@@ -6,10 +6,10 @@
 
 #include "mozilla/DebugOnly.h"
 
-#include "LiveRangeAllocator.h"
+#include "ion/LiveRangeAllocator.h"
 
-#include "BacktrackingAllocator.h"
-#include "LinearScan.h"
+#include "ion/BacktrackingAllocator.h"
+#include "ion/LinearScan.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/LiveRangeAllocator.h b/js/src/ion/LiveRangeAllocator.h
index 99aac4762e5..416a84e8749 100644
--- a/js/src/ion/LiveRangeAllocator.h
+++ b/js/src/ion/LiveRangeAllocator.h
@@ -9,8 +9,8 @@
 
 #include "mozilla/DebugOnly.h"
 
-#include "RegisterAllocator.h"
-#include "StackSlotAllocator.h"
+#include "ion/RegisterAllocator.h"
+#include "ion/StackSlotAllocator.h"
 
 // Common structures and functions used by register allocators that operate on
 // virtual register live ranges.
diff --git a/js/src/ion/Lowering.cpp b/js/src/ion/Lowering.cpp
index 4d471dcc7f0..81f5532eb8b 100644
--- a/js/src/ion/Lowering.cpp
+++ b/js/src/ion/Lowering.cpp
@@ -4,16 +4,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "LIR.h"
-#include "Lowering.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "IonSpewer.h"
-#include "RangeAnalysis.h"
+#include "ion/LIR.h"
+#include "ion/Lowering.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/IonSpewer.h"
+#include "ion/RangeAnalysis.h"
 #include "jsanalyze.h"
 #include "jsbool.h"
 #include "jsnum.h"
-#include "shared/Lowering-shared-inl.h"
+#include "ion/shared/Lowering-shared-inl.h"
 #include "mozilla/DebugOnly.h"
 
 using namespace js;
@@ -1323,6 +1323,28 @@ LIRGenerator::visitConcat(MConcat *ins)
     return assignSafepoint(lir, ins);
 }
 
+bool
+LIRGenerator::visitParConcat(MParConcat *ins)
+{
+    MDefinition *parSlice = ins->parSlice();
+    MDefinition *lhs = ins->lhs();
+    MDefinition *rhs = ins->rhs();
+
+    JS_ASSERT(lhs->type() == MIRType_String);
+    JS_ASSERT(rhs->type() == MIRType_String);
+    JS_ASSERT(ins->type() == MIRType_String);
+
+    LParConcat *lir = new LParConcat(useFixed(parSlice, CallTempReg5),
+                                     useFixed(lhs, CallTempReg0),
+                                     useFixed(rhs, CallTempReg1),
+                                     tempFixed(CallTempReg2),
+                                     tempFixed(CallTempReg3),
+                                     tempFixed(CallTempReg4));
+    if (!defineFixed(lir, ins, LAllocation(AnyRegister(CallTempReg6))))
+        return false;
+    return assignSafepoint(lir, ins);
+}
+
 bool
 LIRGenerator::visitCharCodeAt(MCharCodeAt *ins)
 {
@@ -1521,13 +1543,20 @@ LIRGenerator::visitToString(MToString *ins)
     MDefinition *opd = ins->input();
 
     switch (opd->type()) {
-      case MIRType_Double:
       case MIRType_Null:
       case MIRType_Undefined:
       case MIRType_Boolean:
         JS_NOT_REACHED("NYI: Lower MToString");
         return false;
 
+      case MIRType_Double: {
+        LDoubleToString *lir = new LDoubleToString(useRegister(opd), temp());
+
+        if (!define(lir, ins))
+            return false;
+        return assignSafepoint(lir, ins);
+      }
+
       case MIRType_Int32: {
         LIntToString *lir = new LIntToString(useRegister(opd));
 
diff --git a/js/src/ion/Lowering.h b/js/src/ion/Lowering.h
index 7fa7d402743..23d47acb62e 100644
--- a/js/src/ion/Lowering.h
+++ b/js/src/ion/Lowering.h
@@ -10,16 +10,16 @@
 // This file declares the structures that are used for attaching LIR to a
 // MIRGraph.
 
-#include "IonAllocPolicy.h"
-#include "LIR.h"
-#include "MOpcodes.h"
+#include "ion/IonAllocPolicy.h"
+#include "ion/LIR.h"
+#include "ion/MOpcodes.h"
 
 #if defined(JS_CPU_X86)
-# include "x86/Lowering-x86.h"
+# include "ion/x86/Lowering-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/Lowering-x64.h"
+# include "ion/x64/Lowering-x64.h"
 #elif defined(JS_CPU_ARM)
-# include "arm/Lowering-arm.h"
+# include "ion/arm/Lowering-arm.h"
 #else
 # error "CPU!"
 #endif
@@ -143,6 +143,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitDiv(MDiv *ins);
     bool visitMod(MMod *ins);
     bool visitConcat(MConcat *ins);
+    bool visitParConcat(MParConcat *ins);
     bool visitCharCodeAt(MCharCodeAt *ins);
     bool visitFromCharCode(MFromCharCode *ins);
     bool visitStart(MStart *start);
diff --git a/js/src/ion/MCallOptimize.cpp b/js/src/ion/MCallOptimize.cpp
index 41690302afc..2ec2a202bc4 100644
--- a/js/src/ion/MCallOptimize.cpp
+++ b/js/src/ion/MCallOptimize.cpp
@@ -9,9 +9,9 @@
 #include "builtin/ParallelArray.h"
 #include "builtin/TestingFunctions.h"
 
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "IonBuilder.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/IonBuilder.h"
 
 #include "jsscriptinlines.h"
 
@@ -112,8 +112,6 @@ IonBuilder::inlineNativeCall(CallInfo &callInfo, JSNative native)
         return inlineParallelArray(callInfo);
 
     // Utility intrinsics.
-    if (native == intrinsic_ThrowError)
-        return inlineThrowError(callInfo);
     if (native == intrinsic_IsCallable)
         return inlineIsCallable(callInfo);
     if (native == intrinsic_NewObjectWithClassPrototype)
@@ -1416,40 +1414,6 @@ IonBuilder::inlineHaveSameClass(CallInfo &callInfo)
     return InliningStatus_Inlined;
 }
 
-IonBuilder::InliningStatus
-IonBuilder::inlineThrowError(CallInfo &callInfo)
-{
-    // In Parallel Execution, convert %ThrowError() into a bailout.
-
-    if (callInfo.constructing())
-        return InliningStatus_NotInlined;
-
-    ExecutionMode executionMode = info().executionMode();
-    switch (executionMode) {
-      case SequentialExecution:
-        return InliningStatus_NotInlined;
-      case ParallelExecution:
-        break;
-    }
-
-    callInfo.unwrapArgs();
-
-    MParBailout *bailout = new MParBailout();
-    if (!bailout)
-        return InliningStatus_Error;
-    current->end(bailout);
-
-    setCurrentAndSpecializePhis(newBlock(pc));
-    if (!current)
-        return InliningStatus_Error;
-
-    MConstant *udef = MConstant::New(UndefinedValue());
-    current->add(udef);
-    current->push(udef);
-
-    return InliningStatus_Inlined;
-}
-
 IonBuilder::InliningStatus
 IonBuilder::inlineIsCallable(CallInfo &callInfo)
 {
diff --git a/js/src/ion/MIR.cpp b/js/src/ion/MIR.cpp
index 4ede8a851c8..e264e967770 100644
--- a/js/src/ion/MIR.cpp
+++ b/js/src/ion/MIR.cpp
@@ -4,17 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MIR.h"
+#include "ion/MIR.h"
 
 #include "mozilla/Casting.h"
 
-#include "BaselineInspector.h"
-#include "IonBuilder.h"
-#include "LICM.h" // For LinearSum
-#include "MIRGraph.h"
-#include "EdgeCaseAnalysis.h"
-#include "RangeAnalysis.h"
-#include "IonSpewer.h"
+#include "ion/BaselineInspector.h"
+#include "ion/IonBuilder.h"
+#include "ion/LICM.h" // For LinearSum
+#include "ion/MIRGraph.h"
+#include "ion/EdgeCaseAnalysis.h"
+#include "ion/RangeAnalysis.h"
+#include "ion/IonSpewer.h"
 #include "jsnum.h"
 #include "jsstr.h"
 #include "jsatominlines.h"
diff --git a/js/src/ion/MIR.h b/js/src/ion/MIR.h
index 50481a7cc85..39181861a79 100644
--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -15,15 +15,15 @@
 #include "jsinfer.h"
 #include "jsinferinlines.h"
 #include "jstypedarrayinlines.h"
-#include "TypePolicy.h"
-#include "IonAllocPolicy.h"
-#include "InlineList.h"
-#include "MOpcodes.h"
-#include "FixedArityList.h"
-#include "IonMacroAssembler.h"
-#include "Bailouts.h"
-#include "FixedList.h"
-#include "CompilerRoot.h"
+#include "ion/TypePolicy.h"
+#include "ion/IonAllocPolicy.h"
+#include "ion/InlineList.h"
+#include "ion/MOpcodes.h"
+#include "ion/FixedArityList.h"
+#include "ion/IonMacroAssembler.h"
+#include "ion/Bailouts.h"
+#include "ion/FixedList.h"
+#include "ion/CompilerRoot.h"
 
 namespace js {
 namespace ion {
@@ -3545,6 +3545,49 @@ class MConcat
     }
 };
 
+class MParConcat
+  : public MTernaryInstruction,
+    public MixPolicy<StringPolicy<1>, StringPolicy<2> >
+{
+    MParConcat(MDefinition *parSlice, MDefinition *left, MDefinition *right)
+      : MTernaryInstruction(parSlice, left, right)
+    {
+        setMovable();
+        setResultType(MIRType_String);
+    }
+
+  public:
+    INSTRUCTION_HEADER(ParConcat)
+
+    static MParConcat *New(MDefinition *parSlice, MDefinition *left, MDefinition *right) {
+        return new MParConcat(parSlice, left, right);
+    }
+
+    static MParConcat *New(MDefinition *parSlice, MConcat *concat) {
+        return New(parSlice, concat->lhs(), concat->rhs());
+    }
+
+    MDefinition *parSlice() const {
+        return getOperand(0);
+    }
+    MDefinition *lhs() const {
+        return getOperand(1);
+    }
+    MDefinition *rhs() const {
+        return getOperand(2);
+    }
+
+    TypePolicy *typePolicy() {
+        return this;
+    }
+    bool congruentTo(MDefinition *const &ins) const {
+        return congruentIfOperandsEqual(ins);
+    }
+    AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
+};
+
 class MCharCodeAt
   : public MBinaryInstruction,
     public MixPolicy<StringPolicy<0>, IntPolicy<1> >
diff --git a/js/src/ion/MIRGenerator.h b/js/src/ion/MIRGenerator.h
index 7c53dc23a37..266eee8aa5a 100644
--- a/js/src/ion/MIRGenerator.h
+++ b/js/src/ion/MIRGenerator.h
@@ -13,10 +13,10 @@
 
 #include "jscntxt.h"
 #include "jscompartment.h"
-#include "IonAllocPolicy.h"
-#include "IonCompartment.h"
-#include "CompileInfo.h"
-#include "RegisterSets.h"
+#include "ion/IonAllocPolicy.h"
+#include "ion/IonCompartment.h"
+#include "ion/CompileInfo.h"
+#include "ion/RegisterSets.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/MIRGraph.cpp b/js/src/ion/MIRGraph.cpp
index 36e75e37e25..a626e51f088 100644
--- a/js/src/ion/MIRGraph.cpp
+++ b/js/src/ion/MIRGraph.cpp
@@ -4,11 +4,11 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Ion.h"
-#include "IonSpewer.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "IonBuilder.h"
+#include "ion/Ion.h"
+#include "ion/IonSpewer.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/IonBuilder.h"
 #include "jsscriptinlines.h"
 
 using namespace js;
diff --git a/js/src/ion/MIRGraph.h b/js/src/ion/MIRGraph.h
index fe5673a07da..7e7bbd5391c 100644
--- a/js/src/ion/MIRGraph.h
+++ b/js/src/ion/MIRGraph.h
@@ -10,9 +10,9 @@
 // This file declares the data structures used to build a control-flow graph
 // containing MIR.
 
-#include "IonAllocPolicy.h"
-#include "MIRGenerator.h"
-#include "FixedList.h"
+#include "ion/IonAllocPolicy.h"
+#include "ion/MIRGenerator.h"
+#include "ion/FixedList.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/MOpcodes.h b/js/src/ion/MOpcodes.h
index e9f24bd0418..eea1a3a4256 100644
--- a/js/src/ion/MOpcodes.h
+++ b/js/src/ion/MOpcodes.h
@@ -65,6 +65,7 @@ namespace ion {
     _(Div)                                                                  \
     _(Mod)                                                                  \
     _(Concat)                                                               \
+    _(ParConcat)                                                            \
     _(CharCodeAt)                                                           \
     _(FromCharCode)                                                         \
     _(Return)                                                               \
diff --git a/js/src/ion/MoveResolver.cpp b/js/src/ion/MoveResolver.cpp
index a2b661c3130..a52e1b2843a 100644
--- a/js/src/ion/MoveResolver.cpp
+++ b/js/src/ion/MoveResolver.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MoveResolver.h"
+#include "ion/MoveResolver.h"
 
 #include "jsscriptinlines.h"
 
diff --git a/js/src/ion/MoveResolver.h b/js/src/ion/MoveResolver.h
index e9e930196b6..72ba9f1f56d 100644
--- a/js/src/ion/MoveResolver.h
+++ b/js/src/ion/MoveResolver.h
@@ -7,9 +7,9 @@
 #ifndef ion_MoveResolver_h
 #define ion_MoveResolver_h
 
-#include "Registers.h"
-#include "InlineList.h"
-#include "IonAllocPolicy.h"
+#include "ion/Registers.h"
+#include "ion/InlineList.h"
+#include "ion/IonAllocPolicy.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/ParallelFunctions.cpp b/js/src/ion/ParallelFunctions.cpp
index d7e91894325..b86f34d6898 100644
--- a/js/src/ion/ParallelFunctions.cpp
+++ b/js/src/ion/ParallelFunctions.cpp
@@ -194,6 +194,37 @@ ion::ParExtendArray(ForkJoinSlice *slice, JSObject *array, uint32_t length)
     return array;
 }
 
+ParallelResult
+ion::ParConcatStrings(ForkJoinSlice *slice, HandleString left, HandleString right,
+                      MutableHandleString out)
+{
+    JSString *str = ConcatStrings<NoGC>(slice, left, right);
+    if (!str)
+        return TP_RETRY_SEQUENTIALLY;
+    out.set(str);
+    return TP_SUCCESS;
+}
+
+ParallelResult
+ion::ParIntToString(ForkJoinSlice *slice, int i, MutableHandleString out)
+{
+    JSFlatString *str = Int32ToString<NoGC>(slice, i);
+    if (!str)
+        return TP_RETRY_SEQUENTIALLY;
+    out.set(str);
+    return TP_SUCCESS;
+}
+
+ParallelResult
+ion::ParDoubleToString(ForkJoinSlice *slice, double d, MutableHandleString out)
+{
+    JSString *str = js_NumberToString<NoGC>(slice, d);
+    if (!str)
+        return TP_RETRY_SEQUENTIALLY;
+    out.set(str);
+    return TP_SUCCESS;
+}
+
 #define PAR_RELATIONAL_OP(OP, EXPECTED)                                         \
 do {                                                                            \
     /* Optimize for two int-tagged operands (typical loop control). */          \
@@ -452,7 +483,8 @@ ion::ParCallToUncompiledScript(JSFunction *func)
             Spew(SpewBailouts, "Call to bound function (excessive depth: %d)", depth);
         }
     } else {
-        JS_NOT_REACHED("ParCall'ed functions must have scripts or be ES6 bound functions.");
+        JS_ASSERT(func->isNative());
+        Spew(SpewBailouts, "Call to native function");
     }
 #endif
 }
diff --git a/js/src/ion/ParallelFunctions.h b/js/src/ion/ParallelFunctions.h
index dfb46ea19c8..cbff1405c11 100644
--- a/js/src/ion/ParallelFunctions.h
+++ b/js/src/ion/ParallelFunctions.h
@@ -41,6 +41,13 @@ JSObject* ParPush(ParPushArgs *args);
 // generation.
 JSObject *ParExtendArray(ForkJoinSlice *slice, JSObject *array, uint32_t length);
 
+// String related parallel functions. These tend to call existing VM functions
+// that take a ThreadSafeContext.
+ParallelResult ParConcatStrings(ForkJoinSlice *slice, HandleString left, HandleString right,
+                                MutableHandleString out);
+ParallelResult ParIntToString(ForkJoinSlice *slice, int i, MutableHandleString out);
+ParallelResult ParDoubleToString(ForkJoinSlice *slice, double d, MutableHandleString out);
+
 // These parallel operations fail if they would be required to convert
 // to a string etc etc.
 ParallelResult ParStrictlyEqual(ForkJoinSlice *slice, MutableHandleValue v1, MutableHandleValue v2, JSBool *);
diff --git a/js/src/ion/ParallelSafetyAnalysis.cpp b/js/src/ion/ParallelSafetyAnalysis.cpp
index 9a5b863ceb2..17637b5ee63 100644
--- a/js/src/ion/ParallelSafetyAnalysis.cpp
+++ b/js/src/ion/ParallelSafetyAnalysis.cpp
@@ -6,13 +6,13 @@
 
 #include <stdio.h>
 
-#include "Ion.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "ParallelSafetyAnalysis.h"
-#include "IonSpewer.h"
-#include "UnreachableCodeElimination.h"
-#include "IonAnalysis.h"
+#include "ion/Ion.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/ParallelSafetyAnalysis.h"
+#include "ion/IonSpewer.h"
+#include "ion/UnreachableCodeElimination.h"
+#include "ion/IonAnalysis.h"
 
 #include "vm/Stack.h"
 
@@ -156,7 +156,8 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     SPECIALIZED_OP(Mul, PERMIT_NUMERIC)
     SPECIALIZED_OP(Div, PERMIT_NUMERIC)
     SPECIALIZED_OP(Mod, PERMIT_NUMERIC)
-    UNSAFE_OP(Concat)
+    CUSTOM_OP(Concat)
+    SAFE_OP(ParConcat)
     UNSAFE_OP(CharCodeAt)
     UNSAFE_OP(FromCharCode)
     SAFE_OP(Return)
@@ -167,7 +168,7 @@ class ParallelSafetyVisitor : public MInstructionVisitor
     SAFE_OP(ToDouble)
     SAFE_OP(ToInt32)
     SAFE_OP(TruncateToInt32)
-    UNSAFE_OP(ToString)
+    CUSTOM_OP(ToString)
     SAFE_OP(NewSlots)
     CUSTOM_OP(NewArray)
     CUSTOM_OP(NewObject)
@@ -555,6 +556,21 @@ ParallelSafetyVisitor::visitRest(MRest *ins)
     return replace(ins, MParRest::New(parSlice(), ins));
 }
 
+bool
+ParallelSafetyVisitor::visitConcat(MConcat *ins)
+{
+    return replace(ins, MParConcat::New(parSlice(), ins));
+}
+
+bool
+ParallelSafetyVisitor::visitToString(MToString *ins)
+{
+    MIRType inputType = ins->input()->type();
+    if (inputType != MIRType_Int32 && inputType != MIRType_Double)
+        return markUnsafe();
+    return true;
+}
+
 bool
 ParallelSafetyVisitor::replaceWithParNew(MInstruction *newInstruction,
                                          JSObject *templateObject)
diff --git a/js/src/ion/ParallelSafetyAnalysis.h b/js/src/ion/ParallelSafetyAnalysis.h
index fb1326a56fa..c61bc56066e 100644
--- a/js/src/ion/ParallelSafetyAnalysis.h
+++ b/js/src/ion/ParallelSafetyAnalysis.h
@@ -7,8 +7,8 @@
 #ifndef ion_ParallelSafetyAnalysis_h
 #define ion_ParallelSafetyAnalysis_h
 
-#include "MIR.h"
-#include "CompileInfo.h"
+#include "ion/MIR.h"
+#include "ion/CompileInfo.h"
 
 namespace js {
 
diff --git a/js/src/ion/PcScriptCache-inl.h b/js/src/ion/PcScriptCache-inl.h
index 6db452b7fd2..0a3b126488d 100644
--- a/js/src/ion/PcScriptCache-inl.h
+++ b/js/src/ion/PcScriptCache-inl.h
@@ -7,7 +7,7 @@
 #ifndef ion_PcScriptCache_inl_h
 #define ion_PcScriptCache_inl_h
 
-#include "PcScriptCache.h"
+#include "ion/PcScriptCache.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/PerfSpewer.cpp b/js/src/ion/PerfSpewer.cpp
index 8229a1e98ff..b064edddc57 100644
--- a/js/src/ion/PerfSpewer.cpp
+++ b/js/src/ion/PerfSpewer.cpp
@@ -9,13 +9,13 @@
 # include <unistd.h>
 #endif
 
-#include "PerfSpewer.h"
-#include "IonSpewer.h"
-#include "LIR.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "LinearScan.h"
-#include "RangeAnalysis.h"
+#include "ion/PerfSpewer.h"
+#include "ion/IonSpewer.h"
+#include "ion/LIR.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/LinearScan.h"
+#include "ion/RangeAnalysis.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/PerfSpewer.h b/js/src/ion/PerfSpewer.h
index fcbe15fdfdb..8f70a805ee4 100644
--- a/js/src/ion/PerfSpewer.h
+++ b/js/src/ion/PerfSpewer.h
@@ -10,7 +10,7 @@
 #include <stdio.h>
 
 #include "jsscript.h"
-#include "IonMacroAssembler.h"
+#include "ion/IonMacroAssembler.h"
 #include "js/RootingAPI.h"
 
 class JSScript;
diff --git a/js/src/ion/RangeAnalysis.cpp b/js/src/ion/RangeAnalysis.cpp
index 442be04b774..071edfc14d9 100644
--- a/js/src/ion/RangeAnalysis.cpp
+++ b/js/src/ion/RangeAnalysis.cpp
@@ -11,12 +11,12 @@
 
 #include "vm/NumericConversions.h"
 
-#include "Ion.h"
-#include "IonAnalysis.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "RangeAnalysis.h"
-#include "IonSpewer.h"
+#include "ion/Ion.h"
+#include "ion/IonAnalysis.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/RangeAnalysis.h"
+#include "ion/IonSpewer.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/RangeAnalysis.h b/js/src/ion/RangeAnalysis.h
index cb36e420ab9..79c6f24d476 100644
--- a/js/src/ion/RangeAnalysis.h
+++ b/js/src/ion/RangeAnalysis.h
@@ -10,10 +10,9 @@
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/MathAlgorithms.h"
 
-#include "wtf/Platform.h"
-#include "MIR.h"
-#include "CompileInfo.h"
-#include "IonAnalysis.h"
+#include "ion/MIR.h"
+#include "ion/CompileInfo.h"
+#include "ion/IonAnalysis.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/RegisterAllocator.cpp b/js/src/ion/RegisterAllocator.cpp
index 2bfd2ac8d87..954258b7ed4 100644
--- a/js/src/ion/RegisterAllocator.cpp
+++ b/js/src/ion/RegisterAllocator.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "RegisterAllocator.h"
+#include "ion/RegisterAllocator.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/RegisterAllocator.h b/js/src/ion/RegisterAllocator.h
index 0f2096d1f57..73456013e58 100644
--- a/js/src/ion/RegisterAllocator.h
+++ b/js/src/ion/RegisterAllocator.h
@@ -9,12 +9,12 @@
 
 #include "mozilla/Attributes.h"
 
-#include "Ion.h"
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "InlineList.h"
-#include "LIR.h"
-#include "Lowering.h"
+#include "ion/Ion.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/InlineList.h"
+#include "ion/LIR.h"
+#include "ion/Lowering.h"
 
 // Generic structures and functions for use by register allocators.
 
diff --git a/js/src/ion/RegisterSets.h b/js/src/ion/RegisterSets.h
index b0fe45f5e8f..fc37b83a021 100644
--- a/js/src/ion/RegisterSets.h
+++ b/js/src/ion/RegisterSets.h
@@ -7,7 +7,7 @@
 #ifndef ion_RegisterSets_h
 #define ion_RegisterSets_h
 
-#include "Registers.h"
+#include "ion/Registers.h"
 #include "ion/IonAllocPolicy.h"
 
 namespace js {
diff --git a/js/src/ion/Registers.h b/js/src/ion/Registers.h
index f2d2fb9318e..b60e587f3d6 100644
--- a/js/src/ion/Registers.h
+++ b/js/src/ion/Registers.h
@@ -8,15 +8,15 @@
 #define ion_Registers_h
 
 #include "jsutil.h"
-#include "IonTypes.h"
+#include "ion/IonTypes.h"
 #if defined(JS_CPU_X86)
-# include "x86/Architecture-x86.h"
+# include "ion/x86/Architecture-x86.h"
 #elif defined(JS_CPU_X64)
-# include "x64/Architecture-x64.h"
+# include "ion/x64/Architecture-x64.h"
 #elif defined(JS_CPU_ARM)
-# include "arm/Architecture-arm.h"
+# include "ion/arm/Architecture-arm.h"
 #endif
-#include "FixedArityList.h"
+#include "ion/FixedArityList.h"
 
 // ARM defines the RegisterID within Architecture-arm.h
 #if !defined(JS_CPU_ARM) && defined(JS_METHODJIT)
diff --git a/js/src/ion/Safepoints.cpp b/js/src/ion/Safepoints.cpp
index c41249cbe5d..b3032ad93c5 100644
--- a/js/src/ion/Safepoints.cpp
+++ b/js/src/ion/Safepoints.cpp
@@ -4,9 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Safepoints.h"
-#include "IonSpewer.h"
-#include "LIR.h"
+#include "ion/Safepoints.h"
+#include "ion/IonSpewer.h"
+#include "ion/LIR.h"
 
 using namespace js;
 using namespace ion;
diff --git a/js/src/ion/Safepoints.h b/js/src/ion/Safepoints.h
index 35f7b4ea63c..4d5a1f6a23c 100644
--- a/js/src/ion/Safepoints.h
+++ b/js/src/ion/Safepoints.h
@@ -7,11 +7,11 @@
 #ifndef ion_Safepoints_h
 #define ion_Safepoints_h
 
-#include "Registers.h"
-#include "CompactBuffer.h"
-#include "BitSet.h"
+#include "ion/Registers.h"
+#include "ion/CompactBuffer.h"
+#include "ion/BitSet.h"
 
-#include "shared/Assembler-shared.h"
+#include "ion/shared/Assembler-shared.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/SnapshotReader.h b/js/src/ion/SnapshotReader.h
index d408ed81a1c..ea310b07712 100644
--- a/js/src/ion/SnapshotReader.h
+++ b/js/src/ion/SnapshotReader.h
@@ -7,10 +7,10 @@
 #ifndef ion_SnapshotReader_h
 #define ion_SnapshotReader_h
 
-#include "IonTypes.h"
-#include "IonCode.h"
-#include "Registers.h"
-#include "CompactBuffer.h"
+#include "ion/IonTypes.h"
+#include "ion/IonCode.h"
+#include "ion/Registers.h"
+#include "ion/CompactBuffer.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/SnapshotWriter.h b/js/src/ion/SnapshotWriter.h
index a35ee70ef1f..0a629fae2d2 100644
--- a/js/src/ion/SnapshotWriter.h
+++ b/js/src/ion/SnapshotWriter.h
@@ -7,11 +7,11 @@
 #ifndef ion_SnapshotWriter_h
 #define ion_SnapshotWriter_h
 
-#include "Ion.h"
-#include "IonCode.h"
-#include "Registers.h"
-#include "CompactBuffer.h"
-#include "Bailouts.h"
+#include "ion/Ion.h"
+#include "ion/IonCode.h"
+#include "ion/Registers.h"
+#include "ion/CompactBuffer.h"
+#include "ion/Bailouts.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/Snapshots.cpp b/js/src/ion/Snapshots.cpp
index d46a0c2333b..0017ee2421e 100644
--- a/js/src/ion/Snapshots.cpp
+++ b/js/src/ion/Snapshots.cpp
@@ -4,17 +4,17 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MIRGenerator.h"
-#include "IonFrames.h"
+#include "ion/MIRGenerator.h"
+#include "ion/IonFrames.h"
 #include "jsscript.h"
-#include "IonLinker.h"
-#include "IonSpewer.h"
-#include "SnapshotReader.h"
-#include "SnapshotWriter.h"
+#include "ion/IonLinker.h"
+#include "ion/IonSpewer.h"
+#include "ion/SnapshotReader.h"
+#include "ion/SnapshotWriter.h"
 
 #ifdef TRACK_SNAPSHOTS
-#include "MIR.h"
-#include "LIR.h"
+#include "ion/MIR.h"
+#include "ion/LIR.h"
 #endif
 
 #include "jsscriptinlines.h"
diff --git a/js/src/ion/StackSlotAllocator.h b/js/src/ion/StackSlotAllocator.h
index ca8eb9871c5..df1ae801702 100644
--- a/js/src/ion/StackSlotAllocator.h
+++ b/js/src/ion/StackSlotAllocator.h
@@ -7,7 +7,7 @@
 #ifndef ion_StackSlotAllocator_h
 #define ion_StackSlotAllocator_h
 
-#include "Registers.h"
+#include "ion/Registers.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/StupidAllocator.cpp b/js/src/ion/StupidAllocator.cpp
index b51414f8e8e..d8f268fa23c 100644
--- a/js/src/ion/StupidAllocator.cpp
+++ b/js/src/ion/StupidAllocator.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "StupidAllocator.h"
+#include "ion/StupidAllocator.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/StupidAllocator.h b/js/src/ion/StupidAllocator.h
index 3d339030665..5132feb9333 100644
--- a/js/src/ion/StupidAllocator.h
+++ b/js/src/ion/StupidAllocator.h
@@ -7,7 +7,7 @@
 #ifndef ion_StupidAllocator_h
 #define ion_StupidAllocator_h
 
-#include "RegisterAllocator.h"
+#include "ion/RegisterAllocator.h"
 
 // Simple register allocator that only carries registers within basic blocks.
 
diff --git a/js/src/ion/TypePolicy.cpp b/js/src/ion/TypePolicy.cpp
index 04ff47af588..5613f11c4df 100644
--- a/js/src/ion/TypePolicy.cpp
+++ b/js/src/ion/TypePolicy.cpp
@@ -4,9 +4,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "TypePolicy.h"
-#include "MIR.h"
-#include "MIRGraph.h"
+#include "ion/TypePolicy.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
 
 using namespace js;
 using namespace js::ion;
@@ -77,7 +77,7 @@ BinaryStringPolicy::adjustInputs(MInstruction *ins)
             continue;
 
         MInstruction *replace = NULL;
-        if (in->type() == MIRType_Int32) {
+        if (in->type() == MIRType_Int32 || in->type() == MIRType_Double) {
             replace = MToString::New(in);
         } else {
             if (in->type() != MIRType_Value)
@@ -300,7 +300,7 @@ StringPolicy<Op>::staticAdjustInputs(MInstruction *def)
         return true;
 
     MInstruction *replace;
-    if (in->type() == MIRType_Int32) {
+    if (in->type() == MIRType_Int32 || in->type() == MIRType_Double) {
         replace = MToString::New(in);
     } else {
         if (in->type() != MIRType_Value)
@@ -315,6 +315,7 @@ StringPolicy<Op>::staticAdjustInputs(MInstruction *def)
 
 template bool StringPolicy<0>::staticAdjustInputs(MInstruction *ins);
 template bool StringPolicy<1>::staticAdjustInputs(MInstruction *ins);
+template bool StringPolicy<2>::staticAdjustInputs(MInstruction *ins);
 
 template <unsigned Op>
 bool
diff --git a/js/src/ion/TypePolicy.h b/js/src/ion/TypePolicy.h
index 33fe9f06c76..0add41d2e2f 100644
--- a/js/src/ion/TypePolicy.h
+++ b/js/src/ion/TypePolicy.h
@@ -7,7 +7,7 @@
 #ifndef ion_TypePolicy_h
 #define ion_TypePolicy_h
 
-#include "IonTypes.h"
+#include "ion/IonTypes.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/UnreachableCodeElimination.cpp b/js/src/ion/UnreachableCodeElimination.cpp
index 08bf1895276..9a81fb90874 100644
--- a/js/src/ion/UnreachableCodeElimination.cpp
+++ b/js/src/ion/UnreachableCodeElimination.cpp
@@ -4,10 +4,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "UnreachableCodeElimination.h"
-#include "IonAnalysis.h"
-#include "AliasAnalysis.h"
-#include "ValueNumbering.h"
+#include "ion/UnreachableCodeElimination.h"
+#include "ion/IonAnalysis.h"
+#include "ion/AliasAnalysis.h"
+#include "ion/ValueNumbering.h"
 
 using namespace js;
 using namespace ion;
diff --git a/js/src/ion/UnreachableCodeElimination.h b/js/src/ion/UnreachableCodeElimination.h
index ba52e912223..1d5607e9dc6 100644
--- a/js/src/ion/UnreachableCodeElimination.h
+++ b/js/src/ion/UnreachableCodeElimination.h
@@ -7,8 +7,8 @@
 #ifndef ion_UnreachableCodeElimination_h
 #define ion_UnreachableCodeElimination_h
 
-#include "MIR.h"
-#include "MIRGraph.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/VMFunctions.cpp b/js/src/ion/VMFunctions.cpp
index 37ac09435b0..c611bbe9459 100644
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -4,8 +4,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Ion.h"
-#include "IonCompartment.h"
+#include "ion/Ion.h"
+#include "ion/IonCompartment.h"
 #include "ion/BaselineFrame-inl.h"
 #include "ion/BaselineIC.h"
 #include "ion/IonFrames.h"
diff --git a/js/src/ion/VMFunctions.h b/js/src/ion/VMFunctions.h
index 15759c959af..16819757032 100644
--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@@ -332,6 +332,7 @@ template <> struct OutParamToDataType<uint32_t *> { static const DataType result
 template <> struct OutParamToDataType<uint8_t **> { static const DataType result = Type_Pointer; };
 template <> struct OutParamToDataType<MutableHandleValue> { static const DataType result = Type_Handle; };
 template <> struct OutParamToDataType<MutableHandleObject> { static const DataType result = Type_Handle; };
+template <> struct OutParamToDataType<MutableHandleString> { static const DataType result = Type_Handle; };
 
 template <class> struct OutParamToRootType {
     static const VMFunction::RootType result = VMFunction::RootNone;
@@ -353,6 +354,12 @@ template <> struct MatchContext<JSContext *> {
 template <> struct MatchContext<ForkJoinSlice *> {
     static const ExecutionMode execMode = ParallelExecution;
 };
+template <> struct MatchContext<ThreadSafeContext *> {
+    // ThreadSafeContext functions can be called from either mode, but for
+    // calling from parallel they need to be wrapped first to return a
+    // ParallelResult, so we default to SequentialExecution here.
+    static const ExecutionMode execMode = SequentialExecution;
+};
 
 #define FOR_EACH_ARGS_1(Macro, Sep, Last) Macro(1) Last(1)
 #define FOR_EACH_ARGS_2(Macro, Sep, Last) FOR_EACH_ARGS_1(Macro, Sep, Sep) Macro(2) Last(2)
diff --git a/js/src/ion/ValueNumbering.cpp b/js/src/ion/ValueNumbering.cpp
index 2e8510e6637..5fb6a58bc58 100644
--- a/js/src/ion/ValueNumbering.cpp
+++ b/js/src/ion/ValueNumbering.cpp
@@ -4,11 +4,11 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Ion.h"
-#include "IonBuilder.h"
-#include "IonSpewer.h"
-#include "CompileInfo.h"
-#include "ValueNumbering.h"
+#include "ion/Ion.h"
+#include "ion/IonBuilder.h"
+#include "ion/IonSpewer.h"
+#include "ion/CompileInfo.h"
+#include "ion/ValueNumbering.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/ValueNumbering.h b/js/src/ion/ValueNumbering.h
index 1d48ea22475..d9d644e0cc2 100644
--- a/js/src/ion/ValueNumbering.h
+++ b/js/src/ion/ValueNumbering.h
@@ -7,9 +7,9 @@
 #ifndef ion_ValueNumbering_h
 #define ion_ValueNumbering_h
 
-#include "MIR.h"
-#include "MIRGraph.h"
-#include "CompileInfo.h"
+#include "ion/MIR.h"
+#include "ion/MIRGraph.h"
+#include "ion/CompileInfo.h"
 
 namespace js {
 namespace ion {
diff --git a/js/src/ion/arm/Architecture-arm.cpp b/js/src/ion/arm/Architecture-arm.cpp
index 7fc30293030..6a08d4b9756 100644
--- a/js/src/ion/arm/Architecture-arm.cpp
+++ b/js/src/ion/arm/Architecture-arm.cpp
@@ -5,7 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #define HWCAP_ARMv7 (1 << 31)
-#include <mozilla/StandardInteger.h>
+#include "mozilla/StandardInteger.h"
 
 #include <sys/types.h>
 #include <sys/stat.h>
diff --git a/js/src/ion/arm/Assembler-arm.cpp b/js/src/ion/arm/Assembler-arm.cpp
index 798933656f0..a4015a6b4af 100644
--- a/js/src/ion/arm/Assembler-arm.cpp
+++ b/js/src/ion/arm/Assembler-arm.cpp
@@ -6,8 +6,8 @@
 
 #include "mozilla/DebugOnly.h"
 
-#include "Assembler-arm.h"
-#include "MacroAssembler-arm.h"
+#include "ion/arm/Assembler-arm.h"
+#include "ion/arm/MacroAssembler-arm.h"
 #include "gc/Marking.h"
 #include "jsutil.h"
 #include "assembler/jit/ExecutableAllocator.h"
diff --git a/js/src/ion/arm/BaselineCompiler-arm.cpp b/js/src/ion/arm/BaselineCompiler-arm.cpp
index 7ed88a3f246..fb6ba10b106 100644
--- a/js/src/ion/arm/BaselineCompiler-arm.cpp
+++ b/js/src/ion/arm/BaselineCompiler-arm.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineCompiler-arm.h"
+#include "ion/arm/BaselineCompiler-arm.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/arm/CodeGenerator-arm.cpp b/js/src/ion/arm/CodeGenerator-arm.cpp
index a67ed3fec72..8d8623fcaf2 100644
--- a/js/src/ion/arm/CodeGenerator-arm.cpp
+++ b/js/src/ion/arm/CodeGenerator-arm.cpp
@@ -9,7 +9,7 @@
 #include "jscompartment.h"
 #include "jsnum.h"
 
-#include "CodeGenerator-arm.h"
+#include "ion/arm/CodeGenerator-arm.h"
 #include "ion/PerfSpewer.h"
 #include "ion/CodeGenerator.h"
 #include "ion/IonCompartment.h"
diff --git a/js/src/ion/arm/CodeGenerator-arm.h b/js/src/ion/arm/CodeGenerator-arm.h
index db5b4e4f12e..fcfdc3a6379 100644
--- a/js/src/ion/arm/CodeGenerator-arm.h
+++ b/js/src/ion/arm/CodeGenerator-arm.h
@@ -7,7 +7,7 @@
 #ifndef ion_arm_CodeGenerator_arm_h
 #define ion_arm_CodeGenerator_arm_h
 
-#include "Assembler-arm.h"
+#include "ion/arm/Assembler-arm.h"
 #include "ion/shared/CodeGenerator-shared.h"
 
 namespace js {
diff --git a/js/src/ion/arm/Lowering-arm.cpp b/js/src/ion/arm/Lowering-arm.cpp
index 5d16644fc50..f9cdfed5b19 100644
--- a/js/src/ion/arm/Lowering-arm.cpp
+++ b/js/src/ion/arm/Lowering-arm.cpp
@@ -6,7 +6,7 @@
 
 #include "ion/MIR.h"
 #include "ion/Lowering.h"
-#include "Assembler-arm.h"
+#include "ion/arm/Assembler-arm.h"
 #include "ion/shared/Lowering-shared-inl.h"
 
 using namespace js;
diff --git a/js/src/ion/arm/MoveEmitter-arm.cpp b/js/src/ion/arm/MoveEmitter-arm.cpp
index 289ecc795d8..34297265d27 100644
--- a/js/src/ion/arm/MoveEmitter-arm.cpp
+++ b/js/src/ion/arm/MoveEmitter-arm.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MoveEmitter-arm.h"
+#include "ion/arm/MoveEmitter-arm.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/shared/BaselineCompiler-shared.cpp b/js/src/ion/shared/BaselineCompiler-shared.cpp
index 3991edce576..8f4a76f9c02 100644
--- a/js/src/ion/shared/BaselineCompiler-shared.cpp
+++ b/js/src/ion/shared/BaselineCompiler-shared.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineCompiler-shared.h"
+#include "ion/shared/BaselineCompiler-shared.h"
 #include "ion/BaselineIC.h"
 #include "ion/VMFunctions.h"
 
diff --git a/js/src/ion/shared/BaselineCompiler-x86-shared.cpp b/js/src/ion/shared/BaselineCompiler-x86-shared.cpp
index 9c3db57f63a..660793820c2 100644
--- a/js/src/ion/shared/BaselineCompiler-x86-shared.cpp
+++ b/js/src/ion/shared/BaselineCompiler-x86-shared.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineCompiler-x86-shared.h"
+#include "ion/shared/BaselineCompiler-x86-shared.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/shared/CodeGenerator-shared.cpp b/js/src/ion/shared/CodeGenerator-shared.cpp
index c05eb542ed3..a87572451f3 100644
--- a/js/src/ion/shared/CodeGenerator-shared.cpp
+++ b/js/src/ion/shared/CodeGenerator-shared.cpp
@@ -6,11 +6,11 @@
 
 #include "mozilla/DebugOnly.h"
 
-#include "CodeGenerator-shared.h"
+#include "ion/shared/CodeGenerator-shared.h"
 #include "ion/MIRGenerator.h"
 #include "ion/IonFrames-inl.h"
 #include "ion/MIR.h"
-#include "CodeGenerator-shared-inl.h"
+#include "ion/shared/CodeGenerator-shared-inl.h"
 #include "ion/IonSpewer.h"
 #include "ion/IonMacroAssembler.h"
 #include "ion/ParallelFunctions.h"
diff --git a/js/src/ion/shared/CodeGenerator-x86-shared.cpp b/js/src/ion/shared/CodeGenerator-x86-shared.cpp
index 1c74bcaae48..d3bfeefe7a8 100644
--- a/js/src/ion/shared/CodeGenerator-x86-shared.cpp
+++ b/js/src/ion/shared/CodeGenerator-x86-shared.cpp
@@ -9,8 +9,8 @@
 #include "jscntxt.h"
 #include "jscompartment.h"
 #include "jsmath.h"
-#include "CodeGenerator-x86-shared.h"
-#include "CodeGenerator-shared-inl.h"
+#include "ion/shared/CodeGenerator-x86-shared.h"
+#include "ion/shared/CodeGenerator-shared-inl.h"
 #include "ion/IonFrames.h"
 #include "ion/MoveEmitter.h"
 #include "ion/IonCompartment.h"
diff --git a/js/src/ion/shared/IonAssemblerBuffer.h b/js/src/ion/shared/IonAssemblerBuffer.h
index 2255428cd05..de88adb6ede 100644
--- a/js/src/ion/shared/IonAssemblerBuffer.h
+++ b/js/src/ion/shared/IonAssemblerBuffer.h
@@ -51,21 +51,27 @@ class BufferOffset
 };
 
 template<int SliceSize>
-struct BufferSlice : public InlineForwardListNode<BufferSlice<SliceSize> > {
+struct BufferSlice {
   protected:
+    BufferSlice<SliceSize> *prev;
+    BufferSlice<SliceSize> *next;
     // How much data has been added to the current node.
     uint32_t nodeSize;
   public:
-    BufferSlice *getNext() { return static_cast<BufferSlice *>(this->next); }
+    BufferSlice *getNext() { return this->next; }
+    BufferSlice *getPrev() { return this->prev; }
     void setNext(BufferSlice<SliceSize> *next_) {
         JS_ASSERT(this->next == NULL);
+        JS_ASSERT(next_->prev == NULL);
         this->next = next_;
+        next_->prev = this;
     }
+
     uint8_t instructions [SliceSize];
     unsigned int size() {
         return nodeSize;
     }
-    BufferSlice() : InlineForwardListNode<BufferSlice<SliceSize> >(NULL), nodeSize(0) {}
+    BufferSlice() : next(NULL), prev(NULL), nodeSize(0) {}
     void putBlob(uint32_t instSize, uint8_t* inst) {
         if (inst != NULL)
             memcpy(&instructions[size()], inst, instSize);
@@ -114,8 +120,11 @@ struct AssemblerBuffer
             tail->setNext(tmp);
         }
         tail = tmp;
-        if (head == NULL)
+        if (head == NULL) {
+            finger = tmp;
+            finger_offset = 0;
             head = tmp;
+        }
         return true;
     }
 
@@ -160,19 +169,63 @@ struct AssemblerBuffer
     void fail_bail() {
         m_bail = true;
     }
+    // finger for speeding up accesses
+    Slice *finger;
+    unsigned int finger_offset;
     Inst *getInst(BufferOffset off) {
-        unsigned int local_off = off.getOffset();
+        int local_off = off.getOffset();
+        // don't update the structure's finger in place, so there is the option
+        // to not update it.
         Slice *cur = NULL;
-        if (local_off > bufferSize) {
-            local_off -= bufferSize;
-            cur = tail;
+        int cur_off;
+        // get the offset that we'd be dealing with by walking through backwards
+        int end_off = bufferSize - local_off;
+        // If end_off is negative, then it is in the last chunk, and there is no
+        // real work to be done.
+        if (end_off <= 0) {
+            return (Inst*)&tail->instructions[-end_off];
+        }
+        bool used_finger = false;
+        int finger_off = abs((int)(local_off - finger_offset));
+        if (finger_off < Min(local_off, end_off)) {
+            // The finger offset is minimal, use the finger.
+            cur = finger;
+            cur_off = finger_offset;
+            used_finger = true;
+        } else if (local_off < end_off) {
+            // it is closest to the start
+            cur = head;
+            cur_off = 0;
         } else {
-            for (cur = head; cur != NULL; cur = cur->getNext()) {
-                if (local_off < cur->size())
+            // it is closest to the end
+            cur = tail;
+            cur_off = bufferSize;
+        }
+        int count = 0;
+        char sigil;
+        if (local_off < cur_off) {
+            for (; cur != NULL; cur = cur->getPrev(), cur_off -= cur->size()) {
+                if (local_off >= cur_off) {
+                    local_off -= cur_off;
                     break;
-                local_off -= cur->size();
+                }
+                count++;
             }
             JS_ASSERT(cur != NULL);
+        } else {
+            for (; cur != NULL; cur = cur->getNext()) {
+                if (local_off < cur_off + cur->size()) {
+                    local_off -= cur_off;
+                    break;
+                }
+                cur_off += cur->size();
+                count++;
+            }
+            JS_ASSERT(cur != NULL);
+        }
+        if (count > 2 || used_finger) {
+            finger = cur;
+            finger_offset = cur_off;
         }
         // the offset within this node should not be larger than the node itself.
         JS_ASSERT(local_off < cur->size());
diff --git a/js/src/ion/shared/Lowering-shared.cpp b/js/src/ion/shared/Lowering-shared.cpp
index 7ab7b2e314f..97ce0bbf1fb 100644
--- a/js/src/ion/shared/Lowering-shared.cpp
+++ b/js/src/ion/shared/Lowering-shared.cpp
@@ -7,8 +7,8 @@
 #include "ion/LIR.h"
 #include "ion/MIR.h"
 #include "ion/MIRGraph.h"
-#include "Lowering-shared.h"
-#include "Lowering-shared-inl.h"
+#include "ion/shared/Lowering-shared.h"
+#include "ion/shared/Lowering-shared-inl.h"
 
 using namespace js;
 using namespace ion;
diff --git a/js/src/ion/shared/MoveEmitter-x86-shared.cpp b/js/src/ion/shared/MoveEmitter-x86-shared.cpp
index e061c913b4a..6db7fe32761 100644
--- a/js/src/ion/shared/MoveEmitter-x86-shared.cpp
+++ b/js/src/ion/shared/MoveEmitter-x86-shared.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MoveEmitter-x86-shared.h"
+#include "ion/shared/MoveEmitter-x86-shared.h"
 
 #include "jsscriptinlines.h"
 
diff --git a/js/src/ion/x64/Assembler-x64.cpp b/js/src/ion/x64/Assembler-x64.cpp
index 9cfc8b8b2d4..d897ee59a7b 100644
--- a/js/src/ion/x64/Assembler-x64.cpp
+++ b/js/src/ion/x64/Assembler-x64.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Assembler-x64.h"
+#include "ion/x64/Assembler-x64.h"
 #include "gc/Marking.h"
 #include "ion/LIR.h"
 
diff --git a/js/src/ion/x64/BaselineCompiler-x64.cpp b/js/src/ion/x64/BaselineCompiler-x64.cpp
index e0bce0af7d5..a3106883a76 100644
--- a/js/src/ion/x64/BaselineCompiler-x64.cpp
+++ b/js/src/ion/x64/BaselineCompiler-x64.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineCompiler-x64.h"
+#include "ion/x64/BaselineCompiler-x64.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/x64/CodeGenerator-x64.cpp b/js/src/ion/x64/CodeGenerator-x64.cpp
index e80226bdbcd..b53e346850e 100644
--- a/js/src/ion/x64/CodeGenerator-x64.cpp
+++ b/js/src/ion/x64/CodeGenerator-x64.cpp
@@ -6,7 +6,7 @@
 
 #include "jsnum.h"
 
-#include "CodeGenerator-x64.h"
+#include "ion/x64/CodeGenerator-x64.h"
 #include "ion/MIR.h"
 #include "ion/MIRGraph.h"
 #include "vm/Shape.h"
diff --git a/js/src/ion/x64/Lowering-x64.cpp b/js/src/ion/x64/Lowering-x64.cpp
index 46b90ab8abb..218142a750c 100644
--- a/js/src/ion/x64/Lowering-x64.cpp
+++ b/js/src/ion/x64/Lowering-x64.cpp
@@ -4,10 +4,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Lowering-x64.h"
+#include "ion/x64/Lowering-x64.h"
 
 #include "ion/MIR.h"
-#include "Assembler-x64.h"
+#include "ion/x64/Assembler-x64.h"
 #include "ion/shared/Lowering-shared-inl.h"
 
 using namespace js;
diff --git a/js/src/ion/x64/MacroAssembler-x64.cpp b/js/src/ion/x64/MacroAssembler-x64.cpp
index fa322b595a3..76430920154 100644
--- a/js/src/ion/x64/MacroAssembler-x64.cpp
+++ b/js/src/ion/x64/MacroAssembler-x64.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MacroAssembler-x64.h"
+#include "ion/x64/MacroAssembler-x64.h"
 #include "ion/BaselineFrame.h"
 #include "ion/MoveEmitter.h"
 #include "ion/IonFrames.h"
diff --git a/js/src/ion/x86/Assembler-x86.cpp b/js/src/ion/x86/Assembler-x86.cpp
index ede2d9057c9..02cc3feb35b 100644
--- a/js/src/ion/x86/Assembler-x86.cpp
+++ b/js/src/ion/x86/Assembler-x86.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Assembler-x86.h"
+#include "ion/x86/Assembler-x86.h"
 #include "gc/Marking.h"
 
 using namespace js;
diff --git a/js/src/ion/x86/BaselineCompiler-x86.cpp b/js/src/ion/x86/BaselineCompiler-x86.cpp
index 618ac55080c..2f81285d591 100644
--- a/js/src/ion/x86/BaselineCompiler-x86.cpp
+++ b/js/src/ion/x86/BaselineCompiler-x86.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "BaselineCompiler-x86.h"
+#include "ion/x86/BaselineCompiler-x86.h"
 
 using namespace js;
 using namespace js::ion;
diff --git a/js/src/ion/x86/CodeGenerator-x86.cpp b/js/src/ion/x86/CodeGenerator-x86.cpp
index 004a09f2ae3..3fc7945063d 100644
--- a/js/src/ion/x86/CodeGenerator-x86.cpp
+++ b/js/src/ion/x86/CodeGenerator-x86.cpp
@@ -8,7 +8,7 @@
 
 #include "jsnum.h"
 
-#include "CodeGenerator-x86.h"
+#include "ion/x86/CodeGenerator-x86.h"
 #include "ion/MIR.h"
 #include "ion/MIRGraph.h"
 #include "ion/shared/CodeGenerator-shared-inl.h"
diff --git a/js/src/ion/x86/CodeGenerator-x86.h b/js/src/ion/x86/CodeGenerator-x86.h
index 9dc9f456e93..b25d8e04f1e 100644
--- a/js/src/ion/x86/CodeGenerator-x86.h
+++ b/js/src/ion/x86/CodeGenerator-x86.h
@@ -7,7 +7,7 @@
 #ifndef ion_x86_CodeGenerator_x86_h
 #define ion_x86_CodeGenerator_x86_h
 
-#include "Assembler-x86.h"
+#include "ion/x86/Assembler-x86.h"
 #include "ion/shared/CodeGenerator-x86-shared.h"
 
 namespace js {
diff --git a/js/src/ion/x86/Lowering-x86.cpp b/js/src/ion/x86/Lowering-x86.cpp
index 61289996c09..abc1faf1a92 100644
--- a/js/src/ion/x86/Lowering-x86.cpp
+++ b/js/src/ion/x86/Lowering-x86.cpp
@@ -4,10 +4,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Lowering-x86.h"
+#include "ion/x86/Lowering-x86.h"
 
 #include "ion/MIR.h"
-#include "Assembler-x86.h"
+#include "ion/x86/Assembler-x86.h"
 #include "ion/shared/Lowering-shared-inl.h"
 
 using namespace js;
diff --git a/js/src/ion/x86/MacroAssembler-x86.cpp b/js/src/ion/x86/MacroAssembler-x86.cpp
index fbc491aeab0..3390da5f0a6 100644
--- a/js/src/ion/x86/MacroAssembler-x86.cpp
+++ b/js/src/ion/x86/MacroAssembler-x86.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "MacroAssembler-x86.h"
+#include "ion/x86/MacroAssembler-x86.h"
 #include "ion/BaselineFrame.h"
 #include "ion/MoveEmitter.h"
 #include "ion/IonFrames.h"
diff --git a/js/src/jsapi-tests/selfTest.cpp b/js/src/jsapi-tests/selfTest.cpp
index 39202abb572..6df57757bde 100644
--- a/js/src/jsapi-tests/selfTest.cpp
+++ b/js/src/jsapi-tests/selfTest.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(selfTest_NaNsAreSame)
 {
diff --git a/js/src/jsapi-tests/testAddPropertyPropcache.cpp b/js/src/jsapi-tests/testAddPropertyPropcache.cpp
index 666898e5bb3..59a41b49276 100644
--- a/js/src/jsapi-tests/testAddPropertyPropcache.cpp
+++ b/js/src/jsapi-tests/testAddPropertyPropcache.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 /* Do the test a bunch of times, because sometimes we seem to randomly
    miss the propcache */
diff --git a/js/src/jsapi-tests/testArgumentsObject.cpp b/js/src/jsapi-tests/testArgumentsObject.cpp
index e1f85f5d245..0b53e03285e 100644
--- a/js/src/jsapi-tests/testArgumentsObject.cpp
+++ b/js/src/jsapi-tests/testArgumentsObject.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "vm/Stack-inl.h"
 
diff --git a/js/src/jsapi-tests/testArrayBuffer.cpp b/js/src/jsapi-tests/testArrayBuffer.cpp
index a8299a611b5..78864fc5de3 100644
--- a/js/src/jsapi-tests/testArrayBuffer.cpp
+++ b/js/src/jsapi-tests/testArrayBuffer.cpp
@@ -2,7 +2,7 @@
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsfriendapi.h"
 
 #define NUM_TEST_BUFFERS 2
diff --git a/js/src/jsapi-tests/testBindCallable.cpp b/js/src/jsapi-tests/testBindCallable.cpp
index 8a6432f9b73..ac27c1c2a86 100644
--- a/js/src/jsapi-tests/testBindCallable.cpp
+++ b/js/src/jsapi-tests/testBindCallable.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(test_BindCallable)
 {
diff --git a/js/src/jsapi-tests/testBug604087.cpp b/js/src/jsapi-tests/testBug604087.cpp
index 436d7901751..7d99a7c185e 100644
--- a/js/src/jsapi-tests/testBug604087.cpp
+++ b/js/src/jsapi-tests/testBug604087.cpp
@@ -7,7 +7,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsobj.h"
 #include "jswrapper.h"
 
diff --git a/js/src/jsapi-tests/testCallNonGenericMethodOnProxy.cpp b/js/src/jsapi-tests/testCallNonGenericMethodOnProxy.cpp
index 6dec466c4cd..2bc0847201e 100644
--- a/js/src/jsapi-tests/testCallNonGenericMethodOnProxy.cpp
+++ b/js/src/jsapi-tests/testCallNonGenericMethodOnProxy.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 using namespace JS;
 
diff --git a/js/src/jsapi-tests/testChromeBuffer.cpp b/js/src/jsapi-tests/testChromeBuffer.cpp
index 2ea62f7c33e..909a995fd2f 100644
--- a/js/src/jsapi-tests/testChromeBuffer.cpp
+++ b/js/src/jsapi-tests/testChromeBuffer.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 JSPrincipals system_principals = {
     1
diff --git a/js/src/jsapi-tests/testClassGetter.cpp b/js/src/jsapi-tests/testClassGetter.cpp
index 5631d71b02f..0b07bb17982 100644
--- a/js/src/jsapi-tests/testClassGetter.cpp
+++ b/js/src/jsapi-tests/testClassGetter.cpp
@@ -8,7 +8,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 int called_test_fn;
 int called_test_prop_get;
diff --git a/js/src/jsapi-tests/testCloneScript.cpp b/js/src/jsapi-tests/testCloneScript.cpp
index 91ff93d7618..a4591af5559 100644
--- a/js/src/jsapi-tests/testCloneScript.cpp
+++ b/js/src/jsapi-tests/testCloneScript.cpp
@@ -8,7 +8,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsdbgapi.h"
 
 BEGIN_TEST(test_cloneScript)
diff --git a/js/src/jsapi-tests/testConservativeGC.cpp b/js/src/jsapi-tests/testConservativeGC.cpp
index ad340b6d1f9..1a3ed6ce089 100644
--- a/js/src/jsapi-tests/testConservativeGC.cpp
+++ b/js/src/jsapi-tests/testConservativeGC.cpp
@@ -4,7 +4,7 @@
 
 #if !defined(JSGC_ROOT_ANALYSIS) && !defined(JSGC_USE_EXACT_ROOTING)
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsobj.h"
 #include "vm/String.h"
 
diff --git a/js/src/jsapi-tests/testContexts.cpp b/js/src/jsapi-tests/testContexts.cpp
index e863a4086ee..205955a565f 100644
--- a/js/src/jsapi-tests/testContexts.cpp
+++ b/js/src/jsapi-tests/testContexts.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testContexts_IsRunning)
     {
diff --git a/js/src/jsapi-tests/testCustomIterator.cpp b/js/src/jsapi-tests/testCustomIterator.cpp
index 3c850811831..f02c73f6ebe 100644
--- a/js/src/jsapi-tests/testCustomIterator.cpp
+++ b/js/src/jsapi-tests/testCustomIterator.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "jsclass.h"
 
diff --git a/js/src/jsapi-tests/testDebugger.cpp b/js/src/jsapi-tests/testDebugger.cpp
index cbc3e85b186..060cb782eda 100644
--- a/js/src/jsapi-tests/testDebugger.cpp
+++ b/js/src/jsapi-tests/testDebugger.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsdbgapi.h"
 #include "jscntxt.h"
 
diff --git a/js/src/jsapi-tests/testDeepFreeze.cpp b/js/src/jsapi-tests/testDeepFreeze.cpp
index 48d31f6bcaa..c1ff9ab2e1a 100644
--- a/js/src/jsapi-tests/testDeepFreeze.cpp
+++ b/js/src/jsapi-tests/testDeepFreeze.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testDeepFreeze_bug535703)
 {
diff --git a/js/src/jsapi-tests/testDefineGetterSetterNonEnumerable.cpp b/js/src/jsapi-tests/testDefineGetterSetterNonEnumerable.cpp
index d28c8affb58..a7f9af27e37 100644
--- a/js/src/jsapi-tests/testDefineGetterSetterNonEnumerable.cpp
+++ b/js/src/jsapi-tests/testDefineGetterSetterNonEnumerable.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 static JSBool
 native(JSContext *cx, unsigned argc, jsval *vp)
diff --git a/js/src/jsapi-tests/testDefineProperty.cpp b/js/src/jsapi-tests/testDefineProperty.cpp
index 739dfafdb6c..be4fd58e72b 100644
--- a/js/src/jsapi-tests/testDefineProperty.cpp
+++ b/js/src/jsapi-tests/testDefineProperty.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testDefineProperty_bug564344)
 {
diff --git a/js/src/jsapi-tests/testEnclosingFunction.cpp b/js/src/jsapi-tests/testEnclosingFunction.cpp
index 0a88f6c598e..888cd8350b5 100644
--- a/js/src/jsapi-tests/testEnclosingFunction.cpp
+++ b/js/src/jsapi-tests/testEnclosingFunction.cpp
@@ -7,7 +7,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsfriendapi.h"
 #include "jsdbgapi.h"
 
diff --git a/js/src/jsapi-tests/testErrorCopying.cpp b/js/src/jsapi-tests/testErrorCopying.cpp
index bda243b8526..a9559d20148 100644
--- a/js/src/jsapi-tests/testErrorCopying.cpp
+++ b/js/src/jsapi-tests/testErrorCopying.cpp
@@ -9,7 +9,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jscntxt.h"
 
 static uint32_t column = 0;
diff --git a/js/src/jsapi-tests/testException.cpp b/js/src/jsapi-tests/testException.cpp
index b5965f54623..e375229479b 100644
--- a/js/src/jsapi-tests/testException.cpp
+++ b/js/src/jsapi-tests/testException.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testException_bug860435)
 {
diff --git a/js/src/jsapi-tests/testExternalStrings.cpp b/js/src/jsapi-tests/testExternalStrings.cpp
index 38845435ba1..414cf4acf82 100644
--- a/js/src/jsapi-tests/testExternalStrings.cpp
+++ b/js/src/jsapi-tests/testExternalStrings.cpp
@@ -5,7 +5,7 @@
 #include "mozilla/PodOperations.h"
 #include "mozilla/Util.h"
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "jsutil.h"
 
diff --git a/js/src/jsapi-tests/testFindSCCs.cpp b/js/src/jsapi-tests/testFindSCCs.cpp
index ad38b56ac03..ba31795fc43 100644
--- a/js/src/jsapi-tests/testFindSCCs.cpp
+++ b/js/src/jsapi-tests/testFindSCCs.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include <string.h>
 #include <stdarg.h>
diff --git a/js/src/jsapi-tests/testFuncCallback.cpp b/js/src/jsapi-tests/testFuncCallback.cpp
index fe7bd7e3392..b30cc3d794c 100644
--- a/js/src/jsapi-tests/testFuncCallback.cpp
+++ b/js/src/jsapi-tests/testFuncCallback.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsfun.h"
 #include "jscntxt.h"
 
diff --git a/js/src/jsapi-tests/testFunctionProperties.cpp b/js/src/jsapi-tests/testFunctionProperties.cpp
index b70f95bcb0e..98e4d1b4f5d 100644
--- a/js/src/jsapi-tests/testFunctionProperties.cpp
+++ b/js/src/jsapi-tests/testFunctionProperties.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testFunctionProperties)
 {
diff --git a/js/src/jsapi-tests/testGCExactRooting.cpp b/js/src/jsapi-tests/testGCExactRooting.cpp
index 4d598729dd5..b16c84d6983 100644
--- a/js/src/jsapi-tests/testGCExactRooting.cpp
+++ b/js/src/jsapi-tests/testGCExactRooting.cpp
@@ -5,7 +5,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testGCExactRooting)
 {
diff --git a/js/src/jsapi-tests/testGCFinalizeCallback.cpp b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
index e9328ac1c39..efb16b4a263 100644
--- a/js/src/jsapi-tests/testGCFinalizeCallback.cpp
+++ b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include <stdarg.h>
 
diff --git a/js/src/jsapi-tests/testGCOutOfMemory.cpp b/js/src/jsapi-tests/testGCOutOfMemory.cpp
index 49e3db00f81..149464f64de 100644
--- a/js/src/jsapi-tests/testGCOutOfMemory.cpp
+++ b/js/src/jsapi-tests/testGCOutOfMemory.cpp
@@ -6,7 +6,7 @@
  * Contributor: Igor Bukanov
  */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jscntxt.h"
 
 static unsigned errorCount = 0;
diff --git a/js/src/jsapi-tests/testGetPropertyDefault.cpp b/js/src/jsapi-tests/testGetPropertyDefault.cpp
index 8aa0323d8c3..be41d4ab525 100644
--- a/js/src/jsapi-tests/testGetPropertyDefault.cpp
+++ b/js/src/jsapi-tests/testGetPropertyDefault.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #define JSVAL_IS_FALSE(x) ((JSVAL_IS_BOOLEAN(x)) && !(JSVAL_TO_BOOLEAN(x)))
 #define JSVAL_IS_TRUE(x)  ((JSVAL_IS_BOOLEAN(x)) && (JSVAL_TO_BOOLEAN(x)))
diff --git a/js/src/jsapi-tests/testHashTable.cpp b/js/src/jsapi-tests/testHashTable.cpp
index 094a9f50a4a..9b132536d07 100644
--- a/js/src/jsapi-tests/testHashTable.cpp
+++ b/js/src/jsapi-tests/testHashTable.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "js/HashTable.h"
 
diff --git a/js/src/jsapi-tests/testHashTableInit.cpp b/js/src/jsapi-tests/testHashTableInit.cpp
index 75060697104..a43079c4923 100644
--- a/js/src/jsapi-tests/testHashTableInit.cpp
+++ b/js/src/jsapi-tests/testHashTableInit.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "js/HashTable.h"
 
diff --git a/js/src/jsapi-tests/testIndexToString.cpp b/js/src/jsapi-tests/testIndexToString.cpp
index f2401e2ca20..9a51e5b9522 100644
--- a/js/src/jsapi-tests/testIndexToString.cpp
+++ b/js/src/jsapi-tests/testIndexToString.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "jscntxt.h"
 #include "jscompartment.h"
diff --git a/js/src/jsapi-tests/testIntString.cpp b/js/src/jsapi-tests/testIntString.cpp
index fc627d62430..3a9cb74e7f0 100644
--- a/js/src/jsapi-tests/testIntString.cpp
+++ b/js/src/jsapi-tests/testIntString.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "vm/String.h"
 
 BEGIN_TEST(testIntString_bug515273)
diff --git a/js/src/jsapi-tests/testIntTypesABI.cpp b/js/src/jsapi-tests/testIntTypesABI.cpp
index 7f41666d44a..63ea8182128 100644
--- a/js/src/jsapi-tests/testIntTypesABI.cpp
+++ b/js/src/jsapi-tests/testIntTypesABI.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 /*
  * This test exercises the full, deliberately-exposed JSAPI interface to ensure
diff --git a/js/src/jsapi-tests/testIntern.cpp b/js/src/jsapi-tests/testIntern.cpp
index 96f268c1358..38fe814fe86 100644
--- a/js/src/jsapi-tests/testIntern.cpp
+++ b/js/src/jsapi-tests/testIntern.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsatom.h"
 
 #include "gc/Marking.h"
diff --git a/js/src/jsapi-tests/testJSEvaluateScript.cpp b/js/src/jsapi-tests/testJSEvaluateScript.cpp
index 72d92e75143..8fba89bba89 100644
--- a/js/src/jsapi-tests/testJSEvaluateScript.cpp
+++ b/js/src/jsapi-tests/testJSEvaluateScript.cpp
@@ -2,7 +2,7 @@
  * vim: set ts=8 sts=4 et sw=4 tw=99:
  */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testJSEvaluateScript)
 {
diff --git a/js/src/jsapi-tests/testLookup.cpp b/js/src/jsapi-tests/testLookup.cpp
index eac338db3e7..f3ac8a5843d 100644
--- a/js/src/jsapi-tests/testLookup.cpp
+++ b/js/src/jsapi-tests/testLookup.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsfun.h"  // for js::IsInternalFunctionObject
 
 #include "jsobjinlines.h"
diff --git a/js/src/jsapi-tests/testLooselyEqual.cpp b/js/src/jsapi-tests/testLooselyEqual.cpp
index 274df415aaa..24a9cfbd42b 100644
--- a/js/src/jsapi-tests/testLooselyEqual.cpp
+++ b/js/src/jsapi-tests/testLooselyEqual.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include <limits>
 #include <math.h>
 
diff --git a/js/src/jsapi-tests/testNewObject.cpp b/js/src/jsapi-tests/testNewObject.cpp
index 302708766d4..3f47b5a1d0a 100644
--- a/js/src/jsapi-tests/testNewObject.cpp
+++ b/js/src/jsapi-tests/testNewObject.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "jsfriendapi.h"
 
diff --git a/js/src/jsapi-tests/testOOM.cpp b/js/src/jsapi-tests/testOOM.cpp
index 7f130d9c102..9f4af14a70b 100644
--- a/js/src/jsapi-tests/testOOM.cpp
+++ b/js/src/jsapi-tests/testOOM.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "mozilla/DebugOnly.h"
 
diff --git a/js/src/jsapi-tests/testObjectEmulatingUndefined.cpp b/js/src/jsapi-tests/testObjectEmulatingUndefined.cpp
index af5212a1b54..7a1522074cd 100644
--- a/js/src/jsapi-tests/testObjectEmulatingUndefined.cpp
+++ b/js/src/jsapi-tests/testObjectEmulatingUndefined.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 static JSClass ObjectEmulatingUndefinedClass = {
     "ObjectEmulatingUndefined",
diff --git a/js/src/jsapi-tests/testOps.cpp b/js/src/jsapi-tests/testOps.cpp
index 42ef40be0e0..0a4e82d4969 100644
--- a/js/src/jsapi-tests/testOps.cpp
+++ b/js/src/jsapi-tests/testOps.cpp
@@ -8,7 +8,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 static JSBool
 my_convert(JSContext* context, JS::HandleObject obj, JSType type, JS::MutableHandleValue rval)
diff --git a/js/src/jsapi-tests/testOriginPrincipals.cpp b/js/src/jsapi-tests/testOriginPrincipals.cpp
index 779ec7a2ee2..2f7648f037e 100644
--- a/js/src/jsapi-tests/testOriginPrincipals.cpp
+++ b/js/src/jsapi-tests/testOriginPrincipals.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsdbgapi.h"
 
 JSPrincipals *sOriginPrincipalsInErrorReporter = NULL;
diff --git a/js/src/jsapi-tests/testParseJSON.cpp b/js/src/jsapi-tests/testParseJSON.cpp
index 7d62983b7f2..2f1b71a9b31 100644
--- a/js/src/jsapi-tests/testParseJSON.cpp
+++ b/js/src/jsapi-tests/testParseJSON.cpp
@@ -9,7 +9,7 @@
 #include <limits>
 #include <math.h>
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsstr.h"
 #include "vm/String.h"
 
diff --git a/js/src/jsapi-tests/testProfileStrings.cpp b/js/src/jsapi-tests/testProfileStrings.cpp
index 1e878db4517..e6833acf102 100644
--- a/js/src/jsapi-tests/testProfileStrings.cpp
+++ b/js/src/jsapi-tests/testProfileStrings.cpp
@@ -8,7 +8,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "jscntxt.h"
 
diff --git a/js/src/jsapi-tests/testPropCache.cpp b/js/src/jsapi-tests/testPropCache.cpp
index 96116535c64..f9f256c405f 100644
--- a/js/src/jsapi-tests/testPropCache.cpp
+++ b/js/src/jsapi-tests/testPropCache.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 static int g_counter;
 
diff --git a/js/src/jsapi-tests/testRegExp.cpp b/js/src/jsapi-tests/testRegExp.cpp
index 7811dd65c8d..d38f7f823ad 100644
--- a/js/src/jsapi-tests/testRegExp.cpp
+++ b/js/src/jsapi-tests/testRegExp.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testObjectIsRegExp)
 {
diff --git a/js/src/jsapi-tests/testRegExpInstanceProperties.cpp b/js/src/jsapi-tests/testRegExpInstanceProperties.cpp
index 717c7dccac2..de0a61c3ce0 100644
--- a/js/src/jsapi-tests/testRegExpInstanceProperties.cpp
+++ b/js/src/jsapi-tests/testRegExpInstanceProperties.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "jscompartment.h"
 #include "jsgc.h"
diff --git a/js/src/jsapi-tests/testResolveRecursion.cpp b/js/src/jsapi-tests/testResolveRecursion.cpp
index 62164727f00..eb4ec16f2f4 100644
--- a/js/src/jsapi-tests/testResolveRecursion.cpp
+++ b/js/src/jsapi-tests/testResolveRecursion.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 /*
  * Test that resolve hook recursion for the same object and property is
diff --git a/js/src/jsapi-tests/testSameValue.cpp b/js/src/jsapi-tests/testSameValue.cpp
index 3d35df3a671..d5205716ed5 100644
--- a/js/src/jsapi-tests/testSameValue.cpp
+++ b/js/src/jsapi-tests/testSameValue.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 BEGIN_TEST(testSameValue)
 {
diff --git a/js/src/jsapi-tests/testScriptInfo.cpp b/js/src/jsapi-tests/testScriptInfo.cpp
index 2fa8f29429a..c886904d4b9 100644
--- a/js/src/jsapi-tests/testScriptInfo.cpp
+++ b/js/src/jsapi-tests/testScriptInfo.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsdbgapi.h"
 
 const char code[] =
diff --git a/js/src/jsapi-tests/testScriptObject.cpp b/js/src/jsapi-tests/testScriptObject.cpp
index 29a522dfa85..a9fb34753d1 100644
--- a/js/src/jsapi-tests/testScriptObject.cpp
+++ b/js/src/jsapi-tests/testScriptObject.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 struct ScriptObjectFixture : public JSAPITest {
     static const int code_size;
diff --git a/js/src/jsapi-tests/testSetProperty.cpp b/js/src/jsapi-tests/testSetProperty.cpp
index 8003c473b35..0490ec63e06 100644
--- a/js/src/jsapi-tests/testSetProperty.cpp
+++ b/js/src/jsapi-tests/testSetProperty.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 static JSBool
 nativeGet(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::MutableHandleValue vp)
diff --git a/js/src/jsapi-tests/testSlowScript.cpp b/js/src/jsapi-tests/testSlowScript.cpp
index 1eaf9d9294a..f7adb623cd9 100644
--- a/js/src/jsapi-tests/testSlowScript.cpp
+++ b/js/src/jsapi-tests/testSlowScript.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 JSBool
 OperationCallback(JSContext *cx)
diff --git a/js/src/jsapi-tests/testSourcePolicy.cpp b/js/src/jsapi-tests/testSourcePolicy.cpp
index c5a55cfe92c..beace3d55df 100644
--- a/js/src/jsapi-tests/testSourcePolicy.cpp
+++ b/js/src/jsapi-tests/testSourcePolicy.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsscript.h"
 
 BEGIN_TEST(testBug795104)
diff --git a/js/src/jsapi-tests/testStringBuffer.cpp b/js/src/jsapi-tests/testStringBuffer.cpp
index 5b0a219fedb..05b95d67de8 100644
--- a/js/src/jsapi-tests/testStringBuffer.cpp
+++ b/js/src/jsapi-tests/testStringBuffer.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include "jsatom.h"
 
diff --git a/js/src/jsapi-tests/testToIntWidth.cpp b/js/src/jsapi-tests/testToIntWidth.cpp
index 43094b1fb9d..404157b2be3 100644
--- a/js/src/jsapi-tests/testToIntWidth.cpp
+++ b/js/src/jsapi-tests/testToIntWidth.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 #include <math.h>
 
diff --git a/js/src/jsapi-tests/testTrap.cpp b/js/src/jsapi-tests/testTrap.cpp
index a1bde8d9d2d..7bec0ec54f8 100644
--- a/js/src/jsapi-tests/testTrap.cpp
+++ b/js/src/jsapi-tests/testTrap.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsdbgapi.h"
 
 static int emptyTrapCallCount = 0;
diff --git a/js/src/jsapi-tests/testTypedArrays.cpp b/js/src/jsapi-tests/testTypedArrays.cpp
index cee892b5524..196e25ae4cc 100644
--- a/js/src/jsapi-tests/testTypedArrays.cpp
+++ b/js/src/jsapi-tests/testTypedArrays.cpp
@@ -6,7 +6,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsfriendapi.h"
 
 using namespace js;
diff --git a/js/src/jsapi-tests/testUTF8.cpp b/js/src/jsapi-tests/testUTF8.cpp
index 2ec6b06898e..b6dee4a34a5 100644
--- a/js/src/jsapi-tests/testUTF8.cpp
+++ b/js/src/jsapi-tests/testUTF8.cpp
@@ -5,7 +5,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsapi.h"
 #include "jsstr.h"
 #include "js/CharacterEncoding.h"
diff --git a/js/src/jsapi-tests/testValueABI.cpp b/js/src/jsapi-tests/testValueABI.cpp
index b778bc6363c..3ecc83da259 100644
--- a/js/src/jsapi-tests/testValueABI.cpp
+++ b/js/src/jsapi-tests/testValueABI.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 
 /*
  * Bug 689101 - jsval is technically a non-POD type because it has a private
diff --git a/js/src/jsapi-tests/testVersion.cpp b/js/src/jsapi-tests/testVersion.cpp
index 6673e2c35e6..f4a12790d48 100644
--- a/js/src/jsapi-tests/testVersion.cpp
+++ b/js/src/jsapi-tests/testVersion.cpp
@@ -2,7 +2,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsscript.h"
 #include "jscntxt.h"
 
diff --git a/js/src/jsapi-tests/testXDR.cpp b/js/src/jsapi-tests/testXDR.cpp
index 2b5900b7365..845eba139c7 100644
--- a/js/src/jsapi-tests/testXDR.cpp
+++ b/js/src/jsapi-tests/testXDR.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "jsscript.h"
 #include "jsstr.h"
 #include "jsfriendapi.h"
diff --git a/js/src/jsapi-tests/tests.cpp b/js/src/jsapi-tests/tests.cpp
index 30b89be2d3b..e41aeaaf6b3 100644
--- a/js/src/jsapi-tests/tests.cpp
+++ b/js/src/jsapi-tests/tests.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "tests.h"
+#include "jsapi-tests/tests.h"
 #include "js/RootingAPI.h"
 #include "jsobj.h"
 #include <stdio.h>
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 6833e6ab033..f756b7e0749 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -718,9 +718,26 @@ PerThreadData::PerThreadData(JSRuntime *runtime)
     ionStackLimit(0),
     activation_(NULL),
     asmJSActivationStack_(NULL),
+    dtoaState(NULL),
     suppressGC(0)
 {}
 
+PerThreadData::~PerThreadData()
+{
+    if (dtoaState)
+        js_DestroyDtoaState(dtoaState);
+}
+
+bool
+PerThreadData::init()
+{
+    dtoaState = js_NewDtoaState();
+    if (!dtoaState)
+        return false;
+
+    return true;
+}
+
 JSRuntime::JSRuntime(JSUseHelperThreads useHelperThreads)
   : mainThread(this),
     interrupt(0),
@@ -878,7 +895,6 @@ JSRuntime::JSRuntime(JSUseHelperThreads useHelperThreads)
     numGrouping(0),
 #endif
     mathCache_(NULL),
-    dtoaState(NULL),
     activeCompilations(0),
     trustedPrincipals_(NULL),
     wrapObjectCallback(TransparentObjectWrapper),
@@ -923,6 +939,9 @@ JSRuntime::init(uint32_t maxbytes)
         return false;
 #endif
 
+    if (!mainThread.init())
+        return false;
+
     js::TlsPerThreadData.set(&mainThread);
 
     if (!js_InitGC(this, maxbytes))
@@ -959,10 +978,6 @@ JSRuntime::init(uint32_t maxbytes)
     if (!InitRuntimeNumberState(this))
         return false;
 
-    dtoaState = js_NewDtoaState();
-    if (!dtoaState)
-        return false;
-
     dateTimeInfo.updateTimeZoneAdjustment();
 
     if (!scriptDataTable.init())
@@ -1030,9 +1045,6 @@ JSRuntime::~JSRuntime()
 #endif
     FinishAtoms(this);
 
-    if (dtoaState)
-        js_DestroyDtoaState(dtoaState);
-
     js_FinishGC(this);
 #ifdef JS_THREADSAFE
     if (gcLock)
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 1452854aa50..197aa7b4e59 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -119,7 +119,7 @@ JSRuntime::sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, JS::RuntimeSi
     for (ContextIter acx(this); !acx.done(); acx.next())
         rtSizes->contexts += acx->sizeOfIncludingThis(mallocSizeOf);
 
-    rtSizes->dtoa = mallocSizeOf(dtoaState);
+    rtSizes->dtoa = mallocSizeOf(mainThread.dtoaState);
 
     rtSizes->temporary = tempLifoAlloc.sizeOfExcludingThis(mallocSizeOf);
 
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 13b88cd8db5..ea996ab5dec 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -549,6 +549,9 @@ class PerThreadData : public js::PerThreadDataFriendFields
         return activation_;
     }
 
+    /* State used by jsdtoa.cpp. */
+    DtoaState           *dtoaState;
+
     /*
      * When this flag is non-zero, any attempt to GC will be skipped. It is used
      * to suppress GC when reporting an OOM (see js_ReportOutOfMemory) and in
@@ -560,6 +563,9 @@ class PerThreadData : public js::PerThreadDataFriendFields
     int32_t             suppressGC;
 
     PerThreadData(JSRuntime *runtime);
+    ~PerThreadData();
+
+    bool init();
 
     bool associatedWith(const JSRuntime *rt) { return runtime_ == rt; }
 };
@@ -1291,9 +1297,6 @@ struct JSRuntime : public JS::shadow::Runtime,
     js::EvalCache       evalCache;
     js::LazyScriptCache lazyScriptCache;
 
-    /* State used by jsdtoa.cpp. */
-    DtoaState           *dtoaState;
-
     js::DateTimeInfo    dateTimeInfo;
 
     js::ConservativeGCData conservativeGC;
@@ -1593,6 +1596,9 @@ struct ThreadSafeContext : js::ContextFriendFields,
     }
 #endif
 
+    /* Cut outs for string operations. */
+    StaticStrings &staticStrings() { return runtime_->staticStrings; }
+
     /*
      * Allocator used when allocating GCThings on this context. If we are a
      * JSContext, this is the Zone allocator of the JSContext's zone. If we
diff --git a/js/src/jsnum.cpp b/js/src/jsnum.cpp
index 20f2946e828..6ba959de092 100644
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@@ -69,7 +69,7 @@ ComputeAccurateDecimalInteger(JSContext *cx, const jschar *start, const jschar *
 
     char *estr;
     int err = 0;
-    *dp = js_strtod_harder(cx->runtime()->dtoaState, cstr, &estr, &err);
+    *dp = js_strtod_harder(cx->mainThread().dtoaState, cstr, &estr, &err);
     if (err == JS_DTOA_ENOMEM) {
         JS_ReportOutOfMemory(cx);
         js_free(cstr);
@@ -510,23 +510,26 @@ ToCStringBuf::~ToCStringBuf()
 
 template <AllowGC allowGC>
 JSFlatString *
-js::Int32ToString(JSContext *cx, int32_t si)
+js::Int32ToString(ThreadSafeContext *tcx, int32_t si)
 {
     uint32_t ui;
     if (si >= 0) {
         if (StaticStrings::hasInt(si))
-            return cx->runtime()->staticStrings.getInt(si);
+            return tcx->staticStrings().getInt(si);
         ui = si;
     } else {
         ui = uint32_t(-si);
         JS_ASSERT_IF(si == INT32_MIN, ui == uint32_t(INT32_MAX) + 1);
     }
 
-    JSCompartment *c = cx->compartment();
-    if (JSFlatString *str = c->dtoaCache.lookup(10, si))
-        return str;
+    JSCompartment *c = NULL;
+    if (tcx->isJSContext()) {
+        c = tcx->asJSContext()->compartment();
+        if (JSFlatString *str = c->dtoaCache.lookup(10, si))
+            return str;
+    }
 
-    JSShortString *str = js_NewGCShortString<allowGC>(cx);
+    JSShortString *str = js_NewGCShortString<allowGC>(tcx);
     if (!str)
         return NULL;
 
@@ -541,15 +544,20 @@ js::Int32ToString(JSContext *cx, int32_t si)
     jschar *dst = str->init(end - start);
     PodCopy(dst, start.get(), end - start + 1);
 
-    c->dtoaCache.cache(10, si, str);
+    /*
+     * Only attempt to cache the result if we have a JSContext, as it is
+     * racy.
+     */
+    if (c)
+        c->dtoaCache.cache(10, si, str);
     return str;
 }
 
 template JSFlatString *
-js::Int32ToString<CanGC>(JSContext *cx, int32_t si);
+js::Int32ToString<CanGC>(ThreadSafeContext *cx, int32_t si);
 
 template JSFlatString *
-js::Int32ToString<NoGC>(JSContext *cx, int32_t si);
+js::Int32ToString<NoGC>(ThreadSafeContext *cx, int32_t si);
 
 /* Returns a non-NULL pointer to inside cbuf.  */
 static char *
@@ -589,7 +597,7 @@ IntToCString(ToCStringBuf *cbuf, int i, int base = 10)
 
 template <AllowGC allowGC>
 static JSString * JS_FASTCALL
-js_NumberToStringWithBase(JSContext *cx, double d, int base);
+js_NumberToStringWithBase(ThreadSafeContext *cx, double d, int base);
 
 JS_ALWAYS_INLINE bool
 num_toString_impl(JSContext *cx, CallArgs args)
@@ -801,7 +809,7 @@ static bool
 DToStrResult(JSContext *cx, double d, JSDToStrMode mode, int precision, CallArgs args)
 {
     char buf[DTOSTR_VARIABLE_BUFFER_SIZE(MAX_PRECISION + 1)];
-    char *numStr = js_dtostr(cx->runtime()->dtoaState, buf, sizeof buf, mode, precision, d);
+    char *numStr = js_dtostr(cx->mainThread().dtoaState, buf, sizeof buf, mode, precision, d);
     if (!numStr) {
         JS_ReportOutOfMemory(cx);
         return false;
@@ -1186,7 +1194,7 @@ js_InitNumberClass(JSContext *cx, HandleObject obj)
 }
 
 static char *
-FracNumberToCString(JSContext *cx, ToCStringBuf *cbuf, double d, int base = 10)
+FracNumberToCString(ThreadSafeContext *tcx, ToCStringBuf *cbuf, double d, int base = 10)
 {
 #ifdef DEBUG
     {
@@ -1210,7 +1218,7 @@ FracNumberToCString(JSContext *cx, ToCStringBuf *cbuf, double d, int base = 10)
         converter.ToShortest(d, &builder);
         numStr = builder.Finalize();
     } else {
-        numStr = cbuf->dbuf = js_dtobasestr(cx->runtime()->dtoaState, base, d);
+        numStr = cbuf->dbuf = js_dtobasestr(tcx->perThreadData->dtoaState, base, d);
     }
     return numStr;
 }
@@ -1226,7 +1234,7 @@ js::NumberToCString(JSContext *cx, ToCStringBuf *cbuf, double d, int base/* = 10
 
 template <AllowGC allowGC>
 static JSString * JS_FASTCALL
-js_NumberToStringWithBase(JSContext *cx, double d, int base)
+js_NumberToStringWithBase(ThreadSafeContext *tcx, double d, int base)
 {
     ToCStringBuf cbuf;
     char *numStr;
@@ -1239,32 +1247,38 @@ js_NumberToStringWithBase(JSContext *cx, double d, int base)
     if (base < 2 || base > 36)
         return NULL;
 
-    JSCompartment *c = cx->compartment();
+    JSCompartment *c = NULL;
+    JSContext *cx = NULL;
+    if (tcx->isJSContext()) {
+        cx = tcx->asJSContext();
+        c = cx->compartment();
+    }
 
     int32_t i;
     if (mozilla::DoubleIsInt32(d, &i)) {
         if (base == 10 && StaticStrings::hasInt(i))
-            return cx->runtime()->staticStrings.getInt(i);
+            return tcx->staticStrings().getInt(i);
         if (unsigned(i) < unsigned(base)) {
             if (i < 10)
-                return cx->runtime()->staticStrings.getInt(i);
+                return tcx->staticStrings().getInt(i);
             jschar c = 'a' + i - 10;
             JS_ASSERT(StaticStrings::hasUnit(c));
-            return cx->runtime()->staticStrings.getUnit(c);
+            return tcx->staticStrings().getUnit(c);
         }
 
-        if (JSFlatString *str = c->dtoaCache.lookup(base, d))
+        if (JSFlatString *str = c ? c->dtoaCache.lookup(base, d) : NULL)
             return str;
 
         numStr = IntToCString(&cbuf, i, base);
         JS_ASSERT(!cbuf.dbuf && numStr >= cbuf.sbuf && numStr < cbuf.sbuf + cbuf.sbufSize);
     } else {
-        if (JSFlatString *str = c->dtoaCache.lookup(base, d))
+        if (JSFlatString *str = c ? c->dtoaCache.lookup(base, d) : NULL)
             return str;
 
-        numStr = FracNumberToCString(cx, &cbuf, d, base);
+        numStr = FracNumberToCString(tcx, &cbuf, d, base);
         if (!numStr) {
-            JS_ReportOutOfMemory(cx);
+            if (cx)
+                JS_ReportOutOfMemory(cx);
             return NULL;
         }
         JS_ASSERT_IF(base == 10,
@@ -1273,23 +1287,29 @@ js_NumberToStringWithBase(JSContext *cx, double d, int base)
                      cbuf.dbuf && cbuf.dbuf == numStr);
     }
 
-    JSFlatString *s = js_NewStringCopyZ<allowGC>(cx, numStr);
-    c->dtoaCache.cache(base, d, s);
+    JSFlatString *s = js_NewStringCopyZ<allowGC>(tcx, numStr);
+
+    /*
+     * We will only cache dtoa results if we have a JSContext, as it is
+     * racy.
+     */
+    if (c)
+        c->dtoaCache.cache(base, d, s);
     return s;
 }
 
 template <AllowGC allowGC>
 JSString *
-js_NumberToString(JSContext *cx, double d)
+js_NumberToString(ThreadSafeContext *tcx, double d)
 {
-    return js_NumberToStringWithBase<allowGC>(cx, d, 10);
+    return js_NumberToStringWithBase<allowGC>(tcx, d, 10);
 }
 
 template JSString *
-js_NumberToString<CanGC>(JSContext *cx, double d);
+js_NumberToString<CanGC>(ThreadSafeContext *tcx, double d);
 
 template JSString *
-js_NumberToString<NoGC>(JSContext *cx, double d);
+js_NumberToString<NoGC>(ThreadSafeContext *tcx, double d);
 
 JSFlatString *
 js::NumberToString(JSContext *cx, double d)
@@ -1303,7 +1323,7 @@ JSFlatString *
 js::IndexToString(JSContext *cx, uint32_t index)
 {
     if (StaticStrings::hasUint(index))
-        return cx->runtime()->staticStrings.getUint(index);
+        return cx->staticStrings().getUint(index);
 
     JSCompartment *c = cx->compartment();
     if (JSFlatString *str = c->dtoaCache.lookup(10, index))
@@ -1617,7 +1637,7 @@ js_strtod(JSContext *cx, const jschar *s, const jschar *send,
         estr = istr + 8;
     } else {
         int err;
-        d = js_strtod_harder(cx->runtime()->dtoaState, cstr, &estr, &err);
+        d = js_strtod_harder(cx->mainThread().dtoaState, cstr, &estr, &err);
         if (d == HUGE_VAL)
             d = js_PositiveInfinity;
         else if (d == -HUGE_VAL)
diff --git a/js/src/jsnum.h b/js/src/jsnum.h
index ce73b250b53..6afa181b136 100644
--- a/js/src/jsnum.h
+++ b/js/src/jsnum.h
@@ -49,13 +49,13 @@ class JSString;
  */
 template <js::AllowGC allowGC>
 extern JSString *
-js_NumberToString(JSContext *cx, double d);
+js_NumberToString(js::ThreadSafeContext *cx, double d);
 
 namespace js {
 
 template <AllowGC allowGC>
 extern JSFlatString *
-Int32ToString(JSContext *cx, int32_t i);
+Int32ToString(ThreadSafeContext *tcx, int32_t i);
 
 /*
  * Convert an integer or double (contained in the given value) to a string and
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index d3df2397d9b..df44659794d 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -3630,16 +3630,16 @@ js_InitStringClass(JSContext *cx, HandleObject obj)
 
 template <AllowGC allowGC>
 JSStableString *
-js_NewString(JSContext *cx, jschar *chars, size_t length)
+js_NewString(ThreadSafeContext *tcx, jschar *chars, size_t length)
 {
-    return JSStableString::new_<allowGC>(cx, chars, length);
+    return JSStableString::new_<allowGC>(tcx, chars, length);
 }
 
 template JSStableString *
-js_NewString<CanGC>(JSContext *cx, jschar *chars, size_t length);
+js_NewString<CanGC>(ThreadSafeContext *tcx, jschar *chars, size_t length);
 
 template JSStableString *
-js_NewString<NoGC>(JSContext *cx, jschar *chars, size_t length);
+js_NewString<NoGC>(ThreadSafeContext *tcx, jschar *chars, size_t length);
 
 JSLinearString *
 js_NewDependentString(JSContext *cx, JSString *baseArg, size_t start, size_t length)
@@ -3688,25 +3688,25 @@ js_NewStringCopyN<NoGC>(JSContext *cx, const jschar *s, size_t n);
 
 template <AllowGC allowGC>
 JSFlatString *
-js_NewStringCopyN(JSContext *cx, const char *s, size_t n)
+js_NewStringCopyN(ThreadSafeContext *tcx, const char *s, size_t n)
 {
     if (JSShortString::lengthFits(n))
-        return NewShortString<allowGC>(cx, JS::Latin1Chars(s, n));
+        return NewShortString<allowGC>(tcx, JS::Latin1Chars(s, n));
 
-    jschar *chars = InflateString(cx, s, &n);
+    jschar *chars = InflateString(tcx, s, &n);
     if (!chars)
         return NULL;
-    JSFlatString *str = js_NewString<allowGC>(cx, chars, n);
+    JSFlatString *str = js_NewString<allowGC>(tcx, chars, n);
     if (!str)
         js_free(chars);
     return str;
 }
 
 template JSFlatString *
-js_NewStringCopyN<CanGC>(JSContext *cx, const char *s, size_t n);
+js_NewStringCopyN<CanGC>(ThreadSafeContext *tcx, const char *s, size_t n);
 
 template JSFlatString *
-js_NewStringCopyN<NoGC>(JSContext *cx, const char *s, size_t n);
+js_NewStringCopyN<NoGC>(ThreadSafeContext *tcx, const char *s, size_t n);
 
 template <AllowGC allowGC>
 JSFlatString *
@@ -3735,16 +3735,16 @@ js_NewStringCopyZ<NoGC>(JSContext *cx, const jschar *s);
 
 template <AllowGC allowGC>
 JSFlatString *
-js_NewStringCopyZ(JSContext *cx, const char *s)
+js_NewStringCopyZ(ThreadSafeContext *tcx, const char *s)
 {
-    return js_NewStringCopyN<allowGC>(cx, s, strlen(s));
+    return js_NewStringCopyN<allowGC>(tcx, s, strlen(s));
 }
 
 template JSFlatString *
-js_NewStringCopyZ<CanGC>(JSContext *cx, const char *s);
+js_NewStringCopyZ<CanGC>(ThreadSafeContext *tcx, const char *s);
 
 template JSFlatString *
-js_NewStringCopyZ<NoGC>(JSContext *cx, const char *s);
+js_NewStringCopyZ<NoGC>(ThreadSafeContext *tcx, const char *s);
 
 const char *
 js_ValueToPrintable(JSContext *cx, const Value &vArg, JSAutoByteString *bytes, bool asSource)
@@ -3967,14 +3967,14 @@ js_strchr_limit(const jschar *s, jschar c, const jschar *limit)
 }
 
 jschar *
-js::InflateString(JSContext *cx, const char *bytes, size_t *lengthp)
+js::InflateString(ThreadSafeContext *tcx, const char *bytes, size_t *lengthp)
 {
     size_t nchars;
     jschar *chars;
     size_t nbytes = *lengthp;
 
     nchars = nbytes;
-    chars = cx->pod_malloc<jschar>(nchars + 1);
+    chars = tcx->pod_malloc<jschar>(nchars + 1);
     if (!chars)
         goto bad;
     for (size_t i = 0; i < nchars; i++)
diff --git a/js/src/jsstr.h b/js/src/jsstr.h
index 7bf40ae7c26..3f6d7da5b68 100644
--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -43,7 +43,7 @@ class RopeBuilder;
 
 template <AllowGC allowGC>
 extern JSString *
-ConcatStrings(JSContext *cx,
+ConcatStrings(ThreadSafeContext *cx,
               typename MaybeRooted<JSString*, allowGC>::HandleType left,
               typename MaybeRooted<JSString*, allowGC>::HandleType right);
 
@@ -88,7 +88,7 @@ extern const char js_encodeURIComponent_str[];
 /* GC-allocate a string descriptor for the given malloc-allocated chars. */
 template <js::AllowGC allowGC>
 extern JSStableString *
-js_NewString(JSContext *cx, jschar *chars, size_t length);
+js_NewString(js::ThreadSafeContext *tcx, jschar *chars, size_t length);
 
 extern JSLinearString *
 js_NewDependentString(JSContext *cx, JSString *base, size_t start, size_t length);
@@ -100,7 +100,7 @@ js_NewStringCopyN(JSContext *cx, const jschar *s, size_t n);
 
 template <js::AllowGC allowGC>
 extern JSFlatString *
-js_NewStringCopyN(JSContext *cx, const char *s, size_t n);
+js_NewStringCopyN(js::ThreadSafeContext *tcx, const char *s, size_t n);
 
 /* Copy a C string and GC-allocate a descriptor for it. */
 template <js::AllowGC allowGC>
@@ -109,7 +109,7 @@ js_NewStringCopyZ(JSContext *cx, const jschar *s);
 
 template <js::AllowGC allowGC>
 extern JSFlatString *
-js_NewStringCopyZ(JSContext *cx, const char *s);
+js_NewStringCopyZ(js::ThreadSafeContext *tcx, const char *s);
 
 /*
  * Convert a value to a printable C string.
@@ -228,7 +228,7 @@ namespace js {
  * new string (in jschars).
  */
 extern jschar *
-InflateString(JSContext *cx, const char *bytes, size_t *length);
+InflateString(ThreadSafeContext *cx, const char *bytes, size_t *length);
 
 /*
  * Inflate bytes in UTF-8 encoding to jschars. Return null on error, otherwise
diff --git a/js/src/jsutil.h b/js/src/jsutil.h
index be0eccfac29..3d3429a2fae 100644
--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -18,7 +18,7 @@
 #include "js/Utility.h"
 
 #ifdef USE_ZLIB
-#include "zlib.h"
+#include <zlib.h>
 #endif
 
 /* Forward declarations. */
diff --git a/js/src/perf/jsperf.cpp b/js/src/perf/jsperf.cpp
index adcc8b5fda2..00c4dbcc880 100644
--- a/js/src/perf/jsperf.cpp
+++ b/js/src/perf/jsperf.cpp
@@ -3,7 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "jsperf.h"
+#include "perf/jsperf.h"
 
 #include "jscntxt.h" /* for error messages */
 #include "jsobj.h" /* for unwrapping without a context */
diff --git a/js/src/perf/pm_linux.cpp b/js/src/perf/pm_linux.cpp
index de5675eff5e..5f0f24d5eb6 100644
--- a/js/src/perf/pm_linux.cpp
+++ b/js/src/perf/pm_linux.cpp
@@ -3,7 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "jsperf.h"
+#include "perf/jsperf.h"
 #include "jsutil.h"
 
 using namespace js;
diff --git a/js/src/perf/pm_stub.cpp b/js/src/perf/pm_stub.cpp
index cf82288f093..bb6910c735e 100644
--- a/js/src/perf/pm_stub.cpp
+++ b/js/src/perf/pm_stub.cpp
@@ -3,7 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "jsperf.h"
+#include "perf/jsperf.h"
 
 namespace JS {
 
diff --git a/js/src/prmjtime.cpp b/js/src/prmjtime.cpp
index 4fa2ae2359f..9a03a3ad33f 100644
--- a/js/src/prmjtime.cpp
+++ b/js/src/prmjtime.cpp
@@ -40,7 +40,7 @@
 #endif
 
 #ifdef JS_THREADSAFE
-#include <prinit.h>
+#include "prinit.h"
 #endif
 
 #endif
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 647ae0af51a..2201d4d6aeb 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -39,7 +39,7 @@
 #include "jstypedarrayinlines.h"
 #include "jsworkers.h"
 #include "jswrapper.h"
-#include "jsperf.h"
+#include "perf/jsperf.h"
 
 #include "builtin/TestingFunctions.h"
 #include "frontend/BytecodeEmitter.h"
@@ -48,8 +48,8 @@
 
 #include "prmjtime.h"
 
-#include "jsoptparse.h"
-#include "jsheaptools.h"
+#include "shell/jsoptparse.h"
+#include "shell/jsheaptools.h"
 
 #include "jsinferinlines.h"
 #include "jsscriptinlines.h"
diff --git a/js/src/shell/jsoptparse.cpp b/js/src/shell/jsoptparse.cpp
index 204efa1860f..d3674eec2e3 100644
--- a/js/src/shell/jsoptparse.cpp
+++ b/js/src/shell/jsoptparse.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "jsoptparse.h"
+#include "shell/jsoptparse.h"
 
 #include <ctype.h>
 #include <stdarg.h>
diff --git a/js/src/vm/DateTime.cpp b/js/src/vm/DateTime.cpp
index 3bcf8c5810d..82c017b094e 100644
--- a/js/src/vm/DateTime.cpp
+++ b/js/src/vm/DateTime.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "DateTime.h"
+#include "vm/DateTime.h"
 
 #include <time.h>
 
diff --git a/js/src/vm/DateTime.h b/js/src/vm/DateTime.h
index fb0a0293eb8..be331d42b46 100644
--- a/js/src/vm/DateTime.h
+++ b/js/src/vm/DateTime.h
@@ -11,7 +11,7 @@
 #include "mozilla/MathAlgorithms.h"
 #include "mozilla/StandardInteger.h"
 
-#include "NumericConversions.h"
+#include "vm/NumericConversions.h"
 
 namespace js {
 
diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
index 3c6e4cb8d8f..7ecb5e60c81 100644
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "GlobalObject.h"
+#include "vm/GlobalObject.h"
 
 #include "jscntxt.h"
 #include "jsdate.h"
diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
index 2beefa453fb..2dc7c567c0a 100644
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -8,7 +8,7 @@
  * JavaScript bytecode interpreter.
  */
 
-#include "Interpreter.h"
+#include "vm/Interpreter.h"
 
 #include "mozilla/DebugOnly.h"
 #include "mozilla/FloatingPoint.h"
diff --git a/js/src/vm/NumberObject-inl.h b/js/src/vm/NumberObject-inl.h
index 90d7aba0ef9..89952e92e35 100644
--- a/js/src/vm/NumberObject-inl.h
+++ b/js/src/vm/NumberObject-inl.h
@@ -7,7 +7,7 @@
 #ifndef vm_NumberObject_inl_h
 #define vm_NumberObject_inl_h
 
-#include "NumberObject.h"
+#include "vm/NumberObject.h"
 
 #include "jsobjinlines.h"
 
diff --git a/js/src/vm/Probes.cpp b/js/src/vm/Probes.cpp
index 68d56c519c2..660abe0206b 100644
--- a/js/src/vm/Probes.cpp
+++ b/js/src/vm/Probes.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "Probes-inl.h"
+#include "vm/Probes-inl.h"
 
 #include "jscntxt.h"
 
diff --git a/js/src/vm/RegExpObject-inl.h b/js/src/vm/RegExpObject-inl.h
index 9a6d81d9cd8..85e21fa2635 100644
--- a/js/src/vm/RegExpObject-inl.h
+++ b/js/src/vm/RegExpObject-inl.h
@@ -9,11 +9,11 @@
 
 #include "mozilla/Util.h"
 
-#include "RegExpObject.h"
+#include "vm/RegExpObject.h"
 
 #include "jsstrinlines.h"
 
-#include "String-inl.h"
+#include "vm/String-inl.h"
 
 namespace js {
 
diff --git a/js/src/vm/ScopeObject-inl.h b/js/src/vm/ScopeObject-inl.h
index 7e6e827a1d1..bf13051cf31 100644
--- a/js/src/vm/ScopeObject-inl.h
+++ b/js/src/vm/ScopeObject-inl.h
@@ -7,7 +7,7 @@
 #ifndef vm_ScopeObject_inl_h
 #define vm_ScopeObject_inl_h
 
-#include "ScopeObject.h"
+#include "vm/ScopeObject.h"
 
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index 981414c0146..ee008a249d5 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -9,10 +9,10 @@
 #include "jscompartment.h"
 #include "jsiter.h"
 
-#include "GlobalObject.h"
-#include "ScopeObject.h"
-#include "Shape.h"
-#include "Xdr.h"
+#include "vm/GlobalObject.h"
+#include "vm/ScopeObject.h"
+#include "vm/Shape.h"
+#include "vm/Xdr.h"
 
 #include "jsatominlines.h"
 #include "jsobjinlines.h"
diff --git a/js/src/vm/Stack-inl.h b/js/src/vm/Stack-inl.h
index 001900ca880..2d76e8f2a3e 100644
--- a/js/src/vm/Stack-inl.h
+++ b/js/src/vm/Stack-inl.h
@@ -19,8 +19,8 @@
 
 #include "jsscriptinlines.h"
 
-#include "ArgumentsObject-inl.h"
-#include "ScopeObject-inl.h"
+#include "vm/ArgumentsObject-inl.h"
+#include "vm/ScopeObject-inl.h"
 
 namespace js {
 
diff --git a/js/src/vm/String-inl.h b/js/src/vm/String-inl.h
index 57171613996..a3bc833a25e 100644
--- a/js/src/vm/String-inl.h
+++ b/js/src/vm/String-inl.h
@@ -20,13 +20,13 @@ namespace js {
 
 template <AllowGC allowGC>
 static JS_ALWAYS_INLINE JSInlineString *
-NewShortString(JSContext *cx, JS::Latin1Chars chars)
+NewShortString(ThreadSafeContext *tcx, JS::Latin1Chars chars)
 {
     size_t len = chars.length();
     JS_ASSERT(JSShortString::lengthFits(len));
     JSInlineString *str = JSInlineString::lengthFits(len)
-                          ? JSInlineString::new_<allowGC>(cx)
-                          : JSShortString::new_<allowGC>(cx);
+                          ? JSInlineString::new_<allowGC>(tcx)
+                          : JSShortString::new_<allowGC>(tcx);
     if (!str)
         return NULL;
 
@@ -145,9 +145,10 @@ JSString::readBarrier(JSString *str)
 }
 
 JS_ALWAYS_INLINE bool
-JSString::validateLength(JSContext *maybecx, size_t length)
+JSString::validateLength(js::ThreadSafeContext *maybetcx, size_t length)
 {
     if (JS_UNLIKELY(length > JSString::MAX_LENGTH)) {
+        JSContext *maybecx = maybetcx && maybetcx->isJSContext() ? maybetcx->asJSContext() : NULL;
         js_ReportAllocationOverflow(maybecx);
         return false;
     }
@@ -167,14 +168,15 @@ JSRope::init(JSString *left, JSString *right, size_t length)
 
 template <js::AllowGC allowGC>
 JS_ALWAYS_INLINE JSRope *
-JSRope::new_(JSContext *cx,
+JSRope::new_(js::ThreadSafeContext *tcx,
              typename js::MaybeRooted<JSString*, allowGC>::HandleType left,
              typename js::MaybeRooted<JSString*, allowGC>::HandleType right,
              size_t length)
 {
-    if (!validateLength(cx, length))
+    js::ThreadSafeContext *tcxIfCanGC = allowGC ? tcx : NULL;
+    if (!validateLength(tcxIfCanGC, length))
         return NULL;
-    JSRope *str = (JSRope *) js_NewGCString<allowGC>(cx);
+    JSRope *str = (JSRope *) js_NewGCString<allowGC>(tcx);
     if (!str)
         return NULL;
     str->init(left, right, length);
@@ -282,13 +284,13 @@ JSStableString::init(const jschar *chars, size_t length)
 
 template <js::AllowGC allowGC>
 JS_ALWAYS_INLINE JSStableString *
-JSStableString::new_(JSContext *cx, const jschar *chars, size_t length)
+JSStableString::new_(js::ThreadSafeContext *tcx, const jschar *chars, size_t length)
 {
     JS_ASSERT(chars[length] == jschar(0));
 
-    if (!validateLength(cx, length))
+    if (!validateLength(tcx->isJSContext() ? tcx->asJSContext() : NULL, length))
         return NULL;
-    JSStableString *str = (JSStableString *)js_NewGCString<allowGC>(cx);
+    JSStableString *str = (JSStableString *)js_NewGCString<allowGC>(tcx);
     if (!str)
         return NULL;
     str->init(chars, length);
@@ -297,9 +299,9 @@ JSStableString::new_(JSContext *cx, const jschar *chars, size_t length)
 
 template <js::AllowGC allowGC>
 JS_ALWAYS_INLINE JSInlineString *
-JSInlineString::new_(JSContext *cx)
+JSInlineString::new_(js::ThreadSafeContext *tcx)
 {
-    return (JSInlineString *)js_NewGCString<allowGC>(cx);
+    return (JSInlineString *)js_NewGCString<allowGC>(tcx);
 }
 
 JS_ALWAYS_INLINE jschar *
@@ -320,9 +322,9 @@ JSInlineString::resetLength(size_t length)
 
 template <js::AllowGC allowGC>
 JS_ALWAYS_INLINE JSShortString *
-JSShortString::new_(JSContext *cx)
+JSShortString::new_(js::ThreadSafeContext *tcx)
 {
-    return js_NewGCShortString<allowGC>(cx);
+    return js_NewGCShortString<allowGC>(tcx);
 }
 
 JS_ALWAYS_INLINE void
diff --git a/js/src/vm/String.cpp b/js/src/vm/String.cpp
index d5a77b630ef..34dff154aab 100644
--- a/js/src/vm/String.cpp
+++ b/js/src/vm/String.cpp
@@ -139,7 +139,7 @@ JSString::equals(const char *s)
 #endif /* DEBUG */
 
 static JS_ALWAYS_INLINE bool
-AllocChars(JSContext *maybecx, size_t length, jschar **chars, size_t *capacity)
+AllocChars(ThreadSafeContext *maybetcx, size_t length, jschar **chars, size_t *capacity)
 {
     /*
      * String length doesn't include the null char, so include it here before
@@ -161,14 +161,16 @@ AllocChars(JSContext *maybecx, size_t length, jschar **chars, size_t *capacity)
 
     JS_STATIC_ASSERT(JSString::MAX_LENGTH * sizeof(jschar) < UINT32_MAX);
     size_t bytes = numChars * sizeof(jschar);
-    *chars = (jschar *)(maybecx ? maybecx->malloc_(bytes) : js_malloc(bytes));
+    *chars = (jschar *)(maybetcx ? maybetcx->malloc_(bytes) : js_malloc(bytes));
     return *chars != NULL;
 }
 
 template<JSRope::UsingBarrier b>
 JSFlatString *
-JSRope::flattenInternal(JSContext *maybecx)
+JSRope::flattenInternal(ThreadSafeContext *maybetcx)
 {
+    JS_ASSERT_IF(maybetcx && !maybetcx->isJSContext(), b == NoBarrier);
+
     /*
      * Perform a depth-first dag traversal, splatting each node's characters
      * into a contiguous buffer. Visit each rope node three times:
@@ -251,7 +253,7 @@ JSRope::flattenInternal(JSContext *maybecx)
         }
     }
 
-    if (!AllocChars(maybecx, wholeLength, &wholeChars, &wholeCapacity))
+    if (!AllocChars(maybetcx, wholeLength, &wholeChars, &wholeCapacity))
         return NULL;
 
     pos = wholeChars;
@@ -310,26 +312,26 @@ JSRope::flattenInternal(JSContext *maybecx)
 }
 
 JSFlatString *
-JSRope::flatten(JSContext *maybecx)
+JSRope::flatten(ThreadSafeContext *maybetcx)
 {
 #if JSGC_INCREMENTAL
     if (zone()->needsBarrier())
-        return flattenInternal<WithIncrementalBarrier>(maybecx);
+        return flattenInternal<WithIncrementalBarrier>(maybetcx);
     else
-        return flattenInternal<NoBarrier>(maybecx);
+        return flattenInternal<NoBarrier>(maybetcx);
 #else
-    return flattenInternal<NoBarrier>(maybecx);
+    return flattenInternal<NoBarrier>(maybetcx);
 #endif
 }
 
 template <AllowGC allowGC>
 JSString *
-js::ConcatStrings(JSContext *cx,
+js::ConcatStrings(ThreadSafeContext *tcx,
                   typename MaybeRooted<JSString*, allowGC>::HandleType left,
                   typename MaybeRooted<JSString*, allowGC>::HandleType right)
 {
-    JS_ASSERT_IF(!left->isAtom(), left->zone() == cx->zone());
-    JS_ASSERT_IF(!right->isAtom(), right->zone() == cx->zone());
+    JS_ASSERT_IF(!left->isAtom(), tcx->isInsideCurrentZone(left));
+    JS_ASSERT_IF(!right->isAtom(), tcx->isInsideCurrentZone(right));
 
     size_t leftLen = left->length();
     if (leftLen == 0)
@@ -340,18 +342,18 @@ js::ConcatStrings(JSContext *cx,
         return left;
 
     size_t wholeLength = leftLen + rightLen;
-    JSContext *cxIfCanGC = allowGC ? cx : NULL;
-    if (!JSString::validateLength(cxIfCanGC, wholeLength))
+    ThreadSafeContext *tcxIfCanGC = allowGC ? tcx : NULL;
+    if (!JSString::validateLength(tcxIfCanGC, wholeLength))
         return NULL;
 
     if (JSShortString::lengthFits(wholeLength)) {
-        JSShortString *str = js_NewGCShortString<allowGC>(cx);
+        JSShortString *str = js_NewGCShortString<allowGC>(tcx);
         if (!str)
             return NULL;
-        const jschar *leftChars = left->getChars(cx);
+        const jschar *leftChars = left->getChars(tcx);
         if (!leftChars)
             return NULL;
-        const jschar *rightChars = right->getChars(cx);
+        const jschar *rightChars = right->getChars(tcx);
         if (!rightChars)
             return NULL;
 
@@ -362,17 +364,17 @@ js::ConcatStrings(JSContext *cx,
         return str;
     }
 
-    return JSRope::new_<allowGC>(cx, left, right, wholeLength);
+    return JSRope::new_<allowGC>(tcx, left, right, wholeLength);
 }
 
 template JSString *
-js::ConcatStrings<CanGC>(JSContext *cx, HandleString left, HandleString right);
+js::ConcatStrings<CanGC>(ThreadSafeContext *cx, HandleString left, HandleString right);
 
 template JSString *
-js::ConcatStrings<NoGC>(JSContext *cx, JSString *left, JSString *right);
+js::ConcatStrings<NoGC>(ThreadSafeContext *cx, JSString *left, JSString *right);
 
 JSFlatString *
-JSDependentString::undepend(JSContext *cx)
+JSDependentString::undepend(js::ThreadSafeContext *tcx)
 {
     JS_ASSERT(JSString::isDependent());
 
@@ -385,7 +387,7 @@ JSDependentString::undepend(JSContext *cx)
 
     size_t n = length();
     size_t size = (n + 1) * sizeof(jschar);
-    jschar *s = (jschar *) cx->malloc_(size);
+    jschar *s = (jschar *) tcx->malloc_(size);
     if (!s)
         return NULL;
 
@@ -403,11 +405,11 @@ JSDependentString::undepend(JSContext *cx)
 }
 
 JSStableString *
-JSInlineString::uninline(JSContext *maybecx)
+JSInlineString::uninline(ThreadSafeContext *maybetcx)
 {
     JS_ASSERT(isInline());
     size_t n = length();
-    jschar *news = maybecx ? maybecx->pod_malloc<jschar>(n + 1) : js_pod_malloc<jschar>(n + 1);
+    jschar *news = maybetcx ? maybetcx->pod_malloc<jschar>(n + 1) : js_pod_malloc<jschar>(n + 1);
     if (!news)
         return NULL;
     js_strncpy(news, d.inlineStorage, n);
diff --git a/js/src/vm/String.h b/js/src/vm/String.h
index b6823605d87..7628a41cb6b 100644
--- a/js/src/vm/String.h
+++ b/js/src/vm/String.h
@@ -232,7 +232,7 @@ class JSString : public js::gc::Cell
      * representable by a JSString. An allocation overflow is reported if false
      * is returned.
      */
-    static inline bool validateLength(JSContext *maybecx, size_t length);
+    static inline bool validateLength(js::ThreadSafeContext *maybetcx, size_t length);
 
     static void staticAsserts() {
         JS_STATIC_ASSERT(JS_BITS_PER_WORD >= 32);
@@ -265,18 +265,18 @@ class JSString : public js::gc::Cell
      * getCharsZ additionally ensures the array is null terminated.
      */
 
-    inline const jschar *getChars(JSContext *cx);
-    inline const jschar *getCharsZ(JSContext *cx);
-    inline bool getChar(JSContext *cx, size_t index, jschar *code);
+    inline const jschar *getChars(js::ThreadSafeContext *tcx);
+    inline const jschar *getCharsZ(js::ThreadSafeContext *tcx);
+    inline bool getChar(js::ThreadSafeContext *tcx, size_t index, jschar *code);
 
     /* Fallible conversions to more-derived string types. */
 
-    inline JSLinearString *ensureLinear(JSContext *cx);
-    inline JSFlatString *ensureFlat(JSContext *cx);
-    inline JSStableString *ensureStable(JSContext *cx);
+    inline JSLinearString *ensureLinear(js::ThreadSafeContext *tcx);
+    inline JSFlatString *ensureFlat(js::ThreadSafeContext *tcx);
+    inline JSStableString *ensureStable(js::ThreadSafeContext *tcx);
 
-    static bool ensureLinear(JSContext *cx, JSString *str) {
-        return str->ensureLinear(cx) != NULL;
+    static bool ensureLinear(js::ThreadSafeContext *tcx, JSString *str) {
+        return str->ensureLinear(tcx) != NULL;
     }
 
     /* Type query and debug-checked casts */
@@ -410,6 +410,7 @@ class JSString : public js::gc::Cell
     }
 
     JS::Zone *zone() const { return tenuredZone(); }
+    bool isInsideZone(JS::Zone *zone_) { return zone_ == zone(); }
     js::gc::AllocKind getAllocKind() const { return tenuredGetAllocKind(); }
 
     static inline void writeBarrierPre(JSString *str);
@@ -435,16 +436,16 @@ class JSRope : public JSString
 {
     enum UsingBarrier { WithIncrementalBarrier, NoBarrier };
     template<UsingBarrier b>
-    JSFlatString *flattenInternal(JSContext *cx);
+    JSFlatString *flattenInternal(js::ThreadSafeContext *tcx);
 
     friend class JSString;
-    JSFlatString *flatten(JSContext *cx);
+    JSFlatString *flatten(js::ThreadSafeContext *tcx);
 
     void init(JSString *left, JSString *right, size_t length);
 
   public:
     template <js::AllowGC allowGC>
-    static inline JSRope *new_(JSContext *cx,
+    static inline JSRope *new_(js::ThreadSafeContext *tcx,
                                typename js::MaybeRooted<JSString*, allowGC>::HandleType left,
                                typename js::MaybeRooted<JSString*, allowGC>::HandleType right,
                                size_t length);
@@ -498,7 +499,7 @@ JS_STATIC_ASSERT(sizeof(JSLinearString) == sizeof(JSString));
 class JSDependentString : public JSLinearString
 {
     friend class JSString;
-    JSFlatString *undepend(JSContext *cx);
+    JSFlatString *undepend(js::ThreadSafeContext *cx);
 
     void init(JSLinearString *base, const jschar *chars, size_t length);
 
@@ -516,7 +517,7 @@ JS_STATIC_ASSERT(sizeof(JSDependentString) == sizeof(JSString));
 class JSFlatString : public JSLinearString
 {
     /* Vacuous and therefore unimplemented. */
-    JSFlatString *ensureFlat(JSContext *cx) MOZ_DELETE;
+    JSFlatString *ensureFlat(js::ThreadSafeContext *cx) MOZ_DELETE;
     bool isFlat() const MOZ_DELETE;
     JSFlatString &asFlat() const MOZ_DELETE;
 
@@ -564,7 +565,7 @@ class JSStableString : public JSFlatString
 
   public:
     template <js::AllowGC allowGC>
-    static inline JSStableString *new_(JSContext *cx, const jschar *chars, size_t length);
+    static inline JSStableString *new_(js::ThreadSafeContext *cx, const jschar *chars, size_t length);
 
     JS_ALWAYS_INLINE
     JS::StableCharPtr chars() const {
@@ -661,11 +662,11 @@ class JSInlineString : public JSFlatString
 
   public:
     template <js::AllowGC allowGC>
-    static inline JSInlineString *new_(JSContext *cx);
+    static inline JSInlineString *new_(js::ThreadSafeContext *tcx);
 
     inline jschar *init(size_t length);
 
-    JSStableString *uninline(JSContext *cx);
+    JSStableString *uninline(js::ThreadSafeContext *tcx);
 
     inline void resetLength(size_t length);
 
@@ -697,7 +698,7 @@ class JSShortString : public JSInlineString
 
   public:
     template <js::AllowGC allowGC>
-    static inline JSShortString *new_(JSContext *cx);
+    static inline JSShortString *new_(js::ThreadSafeContext *tcx);
 
     static const size_t MAX_SHORT_LENGTH = JSString::NUM_INLINE_CHARS +
                                            INLINE_EXTENSION_CHARS
@@ -883,15 +884,15 @@ class AutoNameVector : public AutoVectorRooter<PropertyName *>
 /* Avoid requiring vm/String-inl.h just to call getChars. */
 
 JS_ALWAYS_INLINE const jschar *
-JSString::getChars(JSContext *cx)
+JSString::getChars(js::ThreadSafeContext *tcx)
 {
-    if (JSLinearString *str = ensureLinear(cx))
+    if (JSLinearString *str = ensureLinear(tcx))
         return str->chars();
     return NULL;
 }
 
 JS_ALWAYS_INLINE bool
-JSString::getChar(JSContext *cx, size_t index, jschar *code)
+JSString::getChar(js::ThreadSafeContext *tcx, size_t index, jschar *code)
 {
     JS_ASSERT(index < length());
 
@@ -908,13 +909,13 @@ JSString::getChar(JSContext *cx, size_t index, jschar *code)
     if (isRope()) {
         JSRope *rope = &asRope();
         if (uint32_t(index) < rope->leftChild()->length()) {
-            chars = rope->leftChild()->getChars(cx);
+            chars = rope->leftChild()->getChars(tcx);
         } else {
-            chars = rope->rightChild()->getChars(cx);
+            chars = rope->rightChild()->getChars(tcx);
             index -= rope->leftChild()->length();
         }
     } else {
-        chars = getChars(cx);
+        chars = getChars(tcx);
     }
 
     if (!chars)
@@ -925,36 +926,36 @@ JSString::getChar(JSContext *cx, size_t index, jschar *code)
 }
 
 JS_ALWAYS_INLINE const jschar *
-JSString::getCharsZ(JSContext *cx)
+JSString::getCharsZ(js::ThreadSafeContext *tcx)
 {
-    if (JSFlatString *str = ensureFlat(cx))
+    if (JSFlatString *str = ensureFlat(tcx))
         return str->chars();
     return NULL;
 }
 
 JS_ALWAYS_INLINE JSLinearString *
-JSString::ensureLinear(JSContext *cx)
+JSString::ensureLinear(js::ThreadSafeContext *tcx)
 {
     return isLinear()
            ? &asLinear()
-           : asRope().flatten(cx);
+           : asRope().flatten(tcx);
 }
 
 JS_ALWAYS_INLINE JSFlatString *
-JSString::ensureFlat(JSContext *cx)
+JSString::ensureFlat(js::ThreadSafeContext *tcx)
 {
     return isFlat()
            ? &asFlat()
            : isDependent()
-             ? asDependent().undepend(cx)
-             : asRope().flatten(cx);
+             ? asDependent().undepend(tcx)
+             : asRope().flatten(tcx);
 }
 
 JS_ALWAYS_INLINE JSStableString *
-JSString::ensureStable(JSContext *maybecx)
+JSString::ensureStable(js::ThreadSafeContext *maybetcx)
 {
     if (isRope()) {
-        JSFlatString *flat = asRope().flatten(maybecx);
+        JSFlatString *flat = asRope().flatten(maybetcx);
         if (!flat)
             return NULL;
         JS_ASSERT(!flat->isInline());
@@ -962,7 +963,7 @@ JSString::ensureStable(JSContext *maybecx)
     }
 
     if (isDependent()) {
-        JSFlatString *flat = asDependent().undepend(maybecx);
+        JSFlatString *flat = asDependent().undepend(maybetcx);
         if (!flat)
             return NULL;
         return &flat->asStable();
@@ -972,7 +973,7 @@ JSString::ensureStable(JSContext *maybecx)
         return &asStable();
 
     JS_ASSERT(isInline());
-    return asInline().uninline(maybecx);
+    return asInline().uninline(maybetcx);
 }
 
 inline JSLinearString *
diff --git a/js/src/vm/StringObject-inl.h b/js/src/vm/StringObject-inl.h
index 1251877e79a..fc4336bd0a0 100644
--- a/js/src/vm/StringObject-inl.h
+++ b/js/src/vm/StringObject-inl.h
@@ -7,7 +7,7 @@
 #ifndef vm_StringObject_inl_h
 #define vm_StringObject_inl_h
 
-#include "StringObject.h"
+#include "vm/StringObject.h"
 
 #include "jsobjinlines.h"
 
diff --git a/js/src/vm/Unicode.cpp b/js/src/vm/Unicode.cpp
index 42e6ba3fb08..3845e98116b 100644
--- a/js/src/vm/Unicode.cpp
+++ b/js/src/vm/Unicode.cpp
@@ -4,7 +4,7 @@
  * Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/licenses/publicdomain/
  */
-#include "Unicode.h"
+#include "vm/Unicode.h"
 
 using namespace js;
 using namespace js::unicode;
diff --git a/js/src/yarr/BumpPointerAllocator.h b/js/src/yarr/BumpPointerAllocator.h
index 44fe538d9f2..7ae12dc50cf 100644
--- a/js/src/yarr/BumpPointerAllocator.h
+++ b/js/src/yarr/BumpPointerAllocator.h
@@ -30,7 +30,7 @@
 #ifndef yarr_BumpPointerAllocator_h
 #define yarr_BumpPointerAllocator_h
 
-#include "PageAllocation.h"
+#include "yarr/PageAllocation.h"
 
 namespace WTF {
 
diff --git a/js/src/yarr/MatchResult.h b/js/src/yarr/MatchResult.h
index 6a3f39acf86..9985e6b59ca 100644
--- a/js/src/yarr/MatchResult.h
+++ b/js/src/yarr/MatchResult.h
@@ -28,7 +28,7 @@
 #ifndef yarr_MatchResult_h
 #define yarr_MatchResult_h
 
-#include "wtfbridge.h"
+#include "yarr/wtfbridge.h"
 
 typedef uint64_t EncodedMatchResult;
 
diff --git a/js/src/yarr/OSAllocator.h b/js/src/yarr/OSAllocator.h
index c75ca662230..5ad0fb43739 100644
--- a/js/src/yarr/OSAllocator.h
+++ b/js/src/yarr/OSAllocator.h
@@ -31,7 +31,7 @@
 #define yarr_OSAllocator_h
 
 #include <stdlib.h>
-#include "wtfbridge.h"
+#include "yarr/wtfbridge.h"
 #include "assembler/wtf/VMTags.h"
 #include "assembler/wtf/Assertions.h"
 
diff --git a/js/src/yarr/OSAllocatorOS2.cpp b/js/src/yarr/OSAllocatorOS2.cpp
index 466b9e949d8..1a2d400bc34 100644
--- a/js/src/yarr/OSAllocatorOS2.cpp
+++ b/js/src/yarr/OSAllocatorOS2.cpp
@@ -34,9 +34,9 @@
 #define INCL_DOS
 #include <os2.h>
 
-#include "wtf/Assertions.h"
+#include "assembler/wtf/Assertions.h"
 
-#include "OSAllocator.h"
+#include "yarr/OSAllocator.h"
 
 namespace WTF {
 
diff --git a/js/src/yarr/OSAllocatorPosix.cpp b/js/src/yarr/OSAllocatorPosix.cpp
index 013b6af0771..2c8ee259347 100644
--- a/js/src/yarr/OSAllocatorPosix.cpp
+++ b/js/src/yarr/OSAllocatorPosix.cpp
@@ -31,11 +31,11 @@
 
 #if WTF_OS_UNIX && !WTF_OS_SYMBIAN
 
-#include "OSAllocator.h"
+#include "yarr/OSAllocator.h"
 
 #include <errno.h>
 #include <sys/mman.h>
-#include "wtf/Assertions.h"
+#include "assembler/wtf/Assertions.h"
 
 namespace WTF {
 
diff --git a/js/src/yarr/OSAllocatorWin.cpp b/js/src/yarr/OSAllocatorWin.cpp
index a5d5fa7db82..0ff75a3fdd7 100644
--- a/js/src/yarr/OSAllocatorWin.cpp
+++ b/js/src/yarr/OSAllocatorWin.cpp
@@ -31,10 +31,10 @@
 
 #if ENABLE_ASSEMBLER && WTF_OS_WINDOWS
 
-#include "windows.h"
-#include "wtf/Assertions.h"
+#include <windows.h>
+#include "assembler/wtf/Assertions.h"
 
-#include "OSAllocator.h"
+#include "yarr/OSAllocator.h"
 
 namespace WTF {
 
diff --git a/js/src/yarr/PageAllocation.h b/js/src/yarr/PageAllocation.h
index 0e1cde00def..755071a7652 100644
--- a/js/src/yarr/PageAllocation.h
+++ b/js/src/yarr/PageAllocation.h
@@ -30,9 +30,9 @@
 #ifndef yarr_PageAllocation_h
 #define yarr_PageAllocation_h
 
-#include "wtfbridge.h"
-#include "OSAllocator.h"
-#include "PageBlock.h"
+#include "yarr/wtfbridge.h"
+#include "yarr/OSAllocator.h"
+#include "yarr/PageBlock.h"
 #include "assembler/wtf/VMTags.h"
 
 #if WTF_OS_DARWIN
diff --git a/js/src/yarr/PageBlock.cpp b/js/src/yarr/PageBlock.cpp
index 0ffc1bc9515..e297fedd2e4 100644
--- a/js/src/yarr/PageBlock.cpp
+++ b/js/src/yarr/PageBlock.cpp
@@ -27,8 +27,8 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "PageBlock.h"
-#include "wtf/Assertions.h"
+#include "yarr/PageBlock.h"
+#include "assembler/wtf/Assertions.h"
 
 #if WTF_OS_UNIX && !WTF_OS_SYMBIAN
 #include <unistd.h>
diff --git a/js/src/yarr/Yarr.h b/js/src/yarr/Yarr.h
index b12fb014b8e..41ed32fc563 100644
--- a/js/src/yarr/Yarr.h
+++ b/js/src/yarr/Yarr.h
@@ -31,8 +31,8 @@
 #define yarr_Yarr_h
 
 #include <limits.h>
-#include "YarrInterpreter.h"
-#include "YarrPattern.h"
+#include "yarr/YarrInterpreter.h"
+#include "yarr/YarrPattern.h"
 
 namespace JSC { namespace Yarr {
 
diff --git a/js/src/yarr/YarrCanonicalizeUCS2.cpp b/js/src/yarr/YarrCanonicalizeUCS2.cpp
index 49e733f7ca0..19d7f91d3b3 100644
--- a/js/src/yarr/YarrCanonicalizeUCS2.cpp
+++ b/js/src/yarr/YarrCanonicalizeUCS2.cpp
@@ -27,7 +27,7 @@
 
 // DO NOT EDIT! - this file autogenerated by YarrCanonicalizeUCS2.js
 
-#include "YarrCanonicalizeUCS2.h"
+#include "yarr/YarrCanonicalizeUCS2.h"
 
 #include <stddef.h>
 
diff --git a/js/src/yarr/YarrCanonicalizeUCS2.h b/js/src/yarr/YarrCanonicalizeUCS2.h
index 0cbcd5525f6..12839686d3c 100644
--- a/js/src/yarr/YarrCanonicalizeUCS2.h
+++ b/js/src/yarr/YarrCanonicalizeUCS2.h
@@ -30,7 +30,7 @@
 
 #include "mozilla/StandardInteger.h"
 
-#include "wtfbridge.h"
+#include "yarr/wtfbridge.h"
 
 namespace JSC { namespace Yarr {
 
diff --git a/js/src/yarr/YarrCanonicalizeUCS2.js b/js/src/yarr/YarrCanonicalizeUCS2.js
index 812dd8448c3..d2907fa75cf 100644
--- a/js/src/yarr/YarrCanonicalizeUCS2.js
+++ b/js/src/yarr/YarrCanonicalizeUCS2.js
@@ -174,7 +174,7 @@ print(copyright);
 print();
 print("// DO NOT EDIT! - this file autogenerated by YarrCanonicalizeUCS2.js");
 print();
-print('#include "YarrCanonicalizeUCS2.h"');
+print('#include "yarr/YarrCanonicalizeUCS2.h"');
 print();
 print('#include <stddef.h>');
 print();
diff --git a/js/src/yarr/YarrInterpreter.cpp b/js/src/yarr/YarrInterpreter.cpp
index 798091786ed..d2359042682 100644
--- a/js/src/yarr/YarrInterpreter.cpp
+++ b/js/src/yarr/YarrInterpreter.cpp
@@ -26,11 +26,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "YarrInterpreter.h"
+#include "yarr/YarrInterpreter.h"
 
-#include "Yarr.h"
-#include "YarrCanonicalizeUCS2.h"
-#include "BumpPointerAllocator.h"
+#include "yarr/Yarr.h"
+#include "yarr/YarrCanonicalizeUCS2.h"
+#include "yarr/BumpPointerAllocator.h"
 
 using namespace WTF;
 
diff --git a/js/src/yarr/YarrJIT.cpp b/js/src/yarr/YarrJIT.cpp
index d570f4697d4..b144293c778 100644
--- a/js/src/yarr/YarrJIT.cpp
+++ b/js/src/yarr/YarrJIT.cpp
@@ -25,11 +25,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "YarrJIT.h"
+#include "yarr/YarrJIT.h"
 
 #include "assembler/assembler/LinkBuffer.h"
-#include "Yarr.h"
-#include "YarrCanonicalizeUCS2.h"
+#include "yarr/Yarr.h"
+#include "yarr/YarrCanonicalizeUCS2.h"
 
 #if ENABLE_YARR_JIT
 
diff --git a/js/src/yarr/YarrJIT.h b/js/src/yarr/YarrJIT.h
index 23bda55a74e..4c1a6e9aaf5 100644
--- a/js/src/yarr/YarrJIT.h
+++ b/js/src/yarr/YarrJIT.h
@@ -34,9 +34,9 @@
 
 #include "assembler/assembler/MacroAssembler.h"
 
-#include "MatchResult.h"
-#include "Yarr.h"
-#include "YarrPattern.h"
+#include "yarr/MatchResult.h"
+#include "yarr/Yarr.h"
+#include "yarr/YarrPattern.h"
 
 #if WTF_CPU_X86 && !WTF_COMPILER_MSVC && !WTF_COMPILER_SUNCC
 #define YARR_CALL __attribute__ ((regparm (3)))
diff --git a/js/src/yarr/YarrParser.h b/js/src/yarr/YarrParser.h
index b949006a6ae..7a4c2073e8e 100644
--- a/js/src/yarr/YarrParser.h
+++ b/js/src/yarr/YarrParser.h
@@ -28,7 +28,7 @@
 #ifndef yarr_YarrParser_h
 #define yarr_YarrParser_h
 
-#include "Yarr.h"
+#include "yarr/Yarr.h"
 
 namespace JSC { namespace Yarr {
 
diff --git a/js/src/yarr/YarrPattern.cpp b/js/src/yarr/YarrPattern.cpp
index 658d4eaa498..7dc66a21b61 100644
--- a/js/src/yarr/YarrPattern.cpp
+++ b/js/src/yarr/YarrPattern.cpp
@@ -26,17 +26,17 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "YarrPattern.h"
+#include "yarr/YarrPattern.h"
 
-#include "Yarr.h"
-#include "YarrCanonicalizeUCS2.h"
-#include "YarrParser.h"
+#include "yarr/Yarr.h"
+#include "yarr/YarrCanonicalizeUCS2.h"
+#include "yarr/YarrParser.h"
 
 using namespace WTF;
 
 namespace JSC { namespace Yarr {
 
-#include "RegExpJitTables.h"
+#include "yarr/RegExpJitTables.h"
 
 #if WTF_CPU_SPARC
 # define BASE_FRAME_SIZE 24
diff --git a/js/src/yarr/YarrPattern.h b/js/src/yarr/YarrPattern.h
index 539f6d9ef15..5335a996499 100644
--- a/js/src/yarr/YarrPattern.h
+++ b/js/src/yarr/YarrPattern.h
@@ -29,8 +29,8 @@
 #ifndef yarr_YarrPattern_h
 #define yarr_YarrPattern_h
 
-#include "wtfbridge.h"
-#include "ASCIICType.h"
+#include "yarr/wtfbridge.h"
+#include "yarr/ASCIICType.h"
 
 namespace JSC { namespace Yarr {
 
diff --git a/js/src/yarr/YarrSyntaxChecker.cpp b/js/src/yarr/YarrSyntaxChecker.cpp
index bd4b8dc0502..813e551a2fc 100644
--- a/js/src/yarr/YarrSyntaxChecker.cpp
+++ b/js/src/yarr/YarrSyntaxChecker.cpp
@@ -25,9 +25,9 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#include "YarrSyntaxChecker.h"
+#include "yarr/YarrSyntaxChecker.h"
 
-#include "YarrParser.h"
+#include "yarr/YarrParser.h"
 
 namespace JSC { namespace Yarr {
 
diff --git a/js/src/yarr/YarrSyntaxChecker.h b/js/src/yarr/YarrSyntaxChecker.h
index f3e4232ce76..62df0ffc1ca 100644
--- a/js/src/yarr/YarrSyntaxChecker.h
+++ b/js/src/yarr/YarrSyntaxChecker.h
@@ -28,8 +28,8 @@
 #ifndef yarr_YarrSyntaxChecker_h
 #define yarr_YarrSyntaxChecker_h
 
-#include "wtfbridge.h"
-#include "YarrParser.h"
+#include "yarr/wtfbridge.h"
+#include "yarr/YarrParser.h"
 
 namespace JSC { namespace Yarr {
 
diff --git a/js/src/yarr/wtfbridge.h b/js/src/yarr/wtfbridge.h
index 1f1493a4e7d..018baec7693 100644
--- a/js/src/yarr/wtfbridge.h
+++ b/js/src/yarr/wtfbridge.h
@@ -19,7 +19,7 @@
 #include "vm/String.h"
 #include "assembler/wtf/Platform.h"
 #include "assembler/jit/ExecutableAllocator.h"
-#include "CheckedArithmetic.h"
+#include "yarr/CheckedArithmetic.h"
 #include "js/TemplateLib.h"
 
 namespace JSC { namespace Yarr {
diff --git a/layout/tools/reftest/b2g_start_script.js b/layout/tools/reftest/b2g_start_script.js
index 87ff726cf76..cc739989bd5 100644
--- a/layout/tools/reftest/b2g_start_script.js
+++ b/layout/tools/reftest/b2g_start_script.js
@@ -42,6 +42,9 @@ let win = wm.getMostRecentWindow('');
 setDefaultPrefs();
 setPermissions(args[0], args[1]);
 
+// Loading this into the global namespace causes intermittent failures.
+// See bug 882888 for more details.
+let reftest = {}; Components.utils.import("chrome://reftest/content/reftest.jsm", reftest);
+
 // Start the reftests
-Components.utils.import("chrome://reftest/content/reftest.jsm");
-OnRefTestLoad(win);
+reftest.OnRefTestLoad(win);
diff --git a/layout/xul/base/src/nsMenuPopupFrame.cpp b/layout/xul/base/src/nsMenuPopupFrame.cpp
index 7e67f8d5968..43a10df5b20 100644
--- a/layout/xul/base/src/nsMenuPopupFrame.cpp
+++ b/layout/xul/base/src/nsMenuPopupFrame.cpp
@@ -1301,8 +1301,10 @@ nsMenuPopupFrame::SetPopupPosition(nsIFrame* aAnchorFrame, bool aIsMove)
     // We might want to "slide" an arrow if the panel is of the correct type -
     // but we can only slide on one axis - the other axis must be "flipped or
     // resized" as normal.
-    bool slideHorizontal = mSlide && mPosition <= POPUPPOSITION_AFTEREND;
-    bool slideVertical = mSlide && mPosition >= POPUPPOSITION_STARTBEFORE;
+    bool slideHorizontal = mSlide && mPosition >= POPUPPOSITION_BEFORESTART
+                                  && mPosition <= POPUPPOSITION_AFTEREND;
+    bool slideVertical = mSlide && mPosition >= POPUPPOSITION_STARTBEFORE
+                                && mPosition <= POPUPPOSITION_ENDAFTER;
 
     // Next, check if there is enough space to show the popup at full size when
     // positioned at screenPoint. If not, flip the popups to the opposite side
diff --git a/layout/xul/base/src/nsPopupBoxObject.cpp b/layout/xul/base/src/nsPopupBoxObject.cpp
index 93233752da4..b6c07e3f572 100644
--- a/layout/xul/base/src/nsPopupBoxObject.cpp
+++ b/layout/xul/base/src/nsPopupBoxObject.cpp
@@ -359,7 +359,7 @@ nsPopupBoxObject::GetAlignmentPosition(nsAString& positionStr)
 NS_IMETHODIMP
 nsPopupBoxObject::GetAlignmentOffset(int32_t *aAlignmentOffset)
 {
-  nsMenuPopupFrame *menuPopupFrame = do_QueryFrame(GetFrame(true));
+  nsMenuPopupFrame *menuPopupFrame = do_QueryFrame(GetFrame(false));
   if (!menuPopupFrame)
     return NS_OK;
 
diff --git a/mfbt/double-conversion/bignum.cc b/mfbt/double-conversion/bignum.cc
index 747491a0897..dc8a2a63e77 100644
--- a/mfbt/double-conversion/bignum.cc
+++ b/mfbt/double-conversion/bignum.cc
@@ -501,8 +501,8 @@ uint16_t Bignum::DivideModuloIntBignum(const Bignum& other) {
   // Start by removing multiples of 'other' until both numbers have the same
   // number of digits.
   while (BigitLength() > other.BigitLength()) {
-    // This naive approach is extremely inefficient if the this divided other
-    // might be big. This function is implemented for doubleToString where
+    // This naive approach is extremely inefficient if `this` divided by other
+    // is big. This function is implemented for doubleToString where
     // the result should be small (less than 10).
     ASSERT(other.bigits_[other.used_digits_ - 1] >= ((1 << kBigitSize) / 16));
     // Remove the multiples of the first digit.
@@ -755,7 +755,6 @@ void Bignum::SubtractTimes(const Bignum& other, int factor) {
     Chunk difference = bigits_[i] - borrow;
     bigits_[i] = difference & kBigitMask;
     borrow = difference >> (kChunkSize - 1);
-    ++i;
   }
   Clamp();
 }
diff --git a/mfbt/double-conversion/double-conversion.cc b/mfbt/double-conversion/double-conversion.cc
index a79fe92d225..febba6cd782 100644
--- a/mfbt/double-conversion/double-conversion.cc
+++ b/mfbt/double-conversion/double-conversion.cc
@@ -577,7 +577,7 @@ double StringToDoubleConverter::StringToIeee(
     const char* input,
     int length,
     int* processed_characters_count,
-    bool read_as_double) {
+    bool read_as_double) const {
   const char* current = input;
   const char* end = input + length;
 
diff --git a/mfbt/double-conversion/double-conversion.h b/mfbt/double-conversion/double-conversion.h
index c62b16b6758..0900ba0060b 100644
--- a/mfbt/double-conversion/double-conversion.h
+++ b/mfbt/double-conversion/double-conversion.h
@@ -503,7 +503,7 @@ class StringToDoubleConverter {
   // in the 'processed_characters_count'. Trailing junk is never included.
   double StringToDouble(const char* buffer,
                         int length,
-                        int* processed_characters_count) {
+                        int* processed_characters_count) const {
     return StringToIeee(buffer, length, processed_characters_count, true);
   }
 
@@ -512,7 +512,7 @@ class StringToDoubleConverter {
   // due to potential double-rounding.
   float StringToFloat(const char* buffer,
                       int length,
-                      int* processed_characters_count) {
+                      int* processed_characters_count) const {
     return static_cast<float>(StringToIeee(buffer, length,
                                            processed_characters_count, false));
   }
@@ -527,7 +527,7 @@ class StringToDoubleConverter {
   double StringToIeee(const char* buffer,
                       int length,
                       int* processed_characters_count,
-                      bool read_as_double);
+                      bool read_as_double) const;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(StringToDoubleConverter);
 };
diff --git a/mfbt/double-conversion/update.sh b/mfbt/double-conversion/update.sh
index 43091e31253..5cbd18cec8f 100755
--- a/mfbt/double-conversion/update.sh
+++ b/mfbt/double-conversion/update.sh
@@ -3,7 +3,7 @@
 # Copies the needed files from a directory containing the original
 # double-conversion source that we need.
 
-# This was last updated with git rev e5b34421b763f7bf7e4f9081403db417d5a55a36.
+# This was last updated with git rev 04cae7a8d5ef3d62ceffb03cdc3d38f258457a52.
 
 set -e
 
@@ -18,3 +18,4 @@ cp $1/src/*.cc ./
 
 patch -p3 < add-mfbt-api-markers.patch
 patch -p3 < use-StandardInteger.patch
+patch -p3 < use-mozilla-assertions.patch
diff --git a/mfbt/double-conversion/use-StandardInteger.patch b/mfbt/double-conversion/use-StandardInteger.patch
index 6cd49b3bcec..755dd1b9e3f 100644
--- a/mfbt/double-conversion/use-StandardInteger.patch
+++ b/mfbt/double-conversion/use-StandardInteger.patch
@@ -2,7 +2,7 @@ diff --git a/mfbt/double-conversion/utils.h b/mfbt/double-conversion/utils.h
 index cd3e330..bdc7d4b 100644
 --- a/mfbt/double-conversion/utils.h
 +++ b/mfbt/double-conversion/utils.h
-@@ -68,23 +68,7 @@
+@@ -74,23 +74,7 @@
  #endif
  
  
diff --git a/mfbt/double-conversion/use-mozilla-assertions.patch b/mfbt/double-conversion/use-mozilla-assertions.patch
new file mode 100644
index 00000000000..c98565f655d
--- /dev/null
+++ b/mfbt/double-conversion/use-mozilla-assertions.patch
@@ -0,0 +1,23 @@
+diff --git a/mfbt/double-conversion/utils.h b/mfbt/double-conversion/utils.h
+--- a/mfbt/double-conversion/utils.h
++++ b/mfbt/double-conversion/utils.h
+@@ -31,15 +31,15 @@
+ #include <stdlib.h>
+ #include <string.h>
+ 
+-#include <assert.h>
++#include "mozilla/Assertions.h"
+ #ifndef ASSERT
+-#define ASSERT(condition)      (assert(condition))
++#define ASSERT(condition)      MOZ_ASSERT(condition)
+ #endif
+ #ifndef UNIMPLEMENTED
+-#define UNIMPLEMENTED() (abort())
++#define UNIMPLEMENTED() MOZ_CRASH()
+ #endif
+ #ifndef UNREACHABLE
+-#define UNREACHABLE()   (abort())
++#define UNREACHABLE()   MOZ_CRASH()
+ #endif
+ 
+ // Double operations detection based on target architecture.
diff --git a/mfbt/double-conversion/utils.h b/mfbt/double-conversion/utils.h
index 0eec2d91775..6d2c27f00be 100644
--- a/mfbt/double-conversion/utils.h
+++ b/mfbt/double-conversion/utils.h
@@ -31,15 +31,15 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include <assert.h>
+#include "mozilla/Assertions.h"
 #ifndef ASSERT
-#define ASSERT(condition)      (assert(condition))
+#define ASSERT(condition)      MOZ_ASSERT(condition)
 #endif
 #ifndef UNIMPLEMENTED
-#define UNIMPLEMENTED() (abort())
+#define UNIMPLEMENTED() MOZ_CRASH()
 #endif
 #ifndef UNREACHABLE
-#define UNREACHABLE()   (abort())
+#define UNREACHABLE()   MOZ_CRASH()
 #endif
 
 // Double operations detection based on target architecture.
@@ -55,10 +55,12 @@
 #if defined(_M_X64) || defined(__x86_64__) || \
     defined(__ARMEL__) || defined(__avr32__) || \
     defined(__hppa__) || defined(__ia64__) || \
-    defined(__mips__) || defined(__powerpc__) || \
+    defined(__mips__) || \
+    defined(__powerpc__) || defined(__ppc__) || defined(__ppc64__) || \
     defined(__sparc__) || defined(__sparc) || defined(__s390__) || \
     defined(__SH4__) || defined(__alpha__) || \
-    defined(_MIPS_ARCH_MIPS32R2)
+    defined(_MIPS_ARCH_MIPS32R2) || \
+    defined(_AARCH64EL_)
 #define DOUBLE_CONVERSION_CORRECT_DOUBLE_OPERATIONS 1
 #elif defined(_M_IX86) || defined(__i386__) || defined(__i386)
 #if defined(_WIN32)
diff --git a/mfbt/tests/TestEndian.cpp b/mfbt/tests/TestEndian.cpp
index 1ec520de3ce..b2f1e9beeeb 100644
--- a/mfbt/tests/TestEndian.cpp
+++ b/mfbt/tests/TestEndian.cpp
@@ -6,6 +6,8 @@
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Endian.h"
 
+#include <stddef.h>
+
 using mozilla::BigEndian;
 using mozilla::DebugOnly;
 using mozilla::LittleEndian;
@@ -51,7 +53,7 @@ TestSingleNoSwap(T value, T notSwappedValue)
 #define WRAP_COPYTO(NAME)                                       \
   template<typename T>                                          \
   void                                                          \
-  NAME(void* dst, const T* src, unsigned int count)             \
+  NAME(void* dst, const T* src, size_t count)                   \
   {                                                             \
     NativeEndian::NAME<T>(dst, src, count);                     \
   }
@@ -63,7 +65,7 @@ WRAP_COPYTO(copyAndSwapToNetworkOrder)
 #define WRAP_COPYFROM(NAME)                                     \
   template<typename T>                                          \
   void                                                          \
-  NAME(T* dst, const void* src, unsigned int count)             \
+  NAME(T* dst, const void* src, size_t count)                   \
   {                                                             \
     NativeEndian::NAME<T>(dst, src, count);                     \
   }
@@ -75,7 +77,7 @@ WRAP_COPYFROM(copyAndSwapFromNetworkOrder)
 #define WRAP_IN_PLACE(NAME)                                     \
   template<typename T>                                          \
   void                                                          \
-  NAME(T* p, unsigned int count)                                \
+  NAME(T* p, size_t count)                                      \
   {                                                             \
     NativeEndian::NAME<T>(p, count);                            \
   }
@@ -91,14 +93,14 @@ enum SwapExpectation {
   NoSwap
 };
 
-template<typename T, size_t count>
+template<typename T, size_t Count>
 void
 TestBulkSwapToSub(enum SwapExpectation expectSwap,
-                  const T (&values)[count],
-                  void (*swapperFunc)(void*, const T*, unsigned int),
+                  const T (&values)[Count],
+                  void (*swapperFunc)(void*, const T*, size_t),
                   T (*readerFunc)(const void*))
 {
-  const size_t arraySize = 2 * count;
+  const size_t arraySize = 2 * Count;
   const size_t bufferSize = arraySize * sizeof(T);
   static uint8_t buffer[bufferSize];
   const uint8_t fillValue = 0xa5;
@@ -109,7 +111,7 @@ TestBulkSwapToSub(enum SwapExpectation expectSwap,
   memset(checkBuffer, fillValue, bufferSize);
 
   for (size_t startPosition = 0; startPosition < sizeof(T); ++startPosition) {
-    for (size_t nValues = 0; nValues < count; ++nValues) {
+    for (size_t nValues = 0; nValues < Count; ++nValues) {
       memset(buffer, fillValue, bufferSize);
       swapperFunc(buffer + startPosition, values, nValues);
 
@@ -130,14 +132,14 @@ TestBulkSwapToSub(enum SwapExpectation expectSwap,
   }
 }
 
-template<typename T, size_t count>
+template<typename T, size_t Count>
 void
 TestBulkSwapFromSub(enum SwapExpectation expectSwap,
-                    const T (&values)[count],
-                    void (*swapperFunc)(T*, const void*, unsigned int),
+                    const T (&values)[Count],
+                    void (*swapperFunc)(T*, const void*, size_t),
                     T (*readerFunc)(const void*))
 {
-  const size_t arraySize = 2 * count;
+  const size_t arraySize = 2 * Count;
   const size_t bufferSize = arraySize * sizeof(T);
   static T buffer[arraySize];
   const uint8_t fillValue = 0xa5;
@@ -145,8 +147,8 @@ TestBulkSwapFromSub(enum SwapExpectation expectSwap,
 
   memset(checkBuffer, fillValue, bufferSize);
 
-  for (size_t startPosition = 0; startPosition < count; ++startPosition) {
-    for (size_t nValues = 0; nValues < (count - startPosition); ++nValues) {
+  for (size_t startPosition = 0; startPosition < Count; ++startPosition) {
+    for (size_t nValues = 0; nValues < (Count - startPosition); ++nValues) {
       memset(buffer, fillValue, bufferSize);
       swapperFunc(buffer + startPosition, values, nValues);
 
@@ -166,14 +168,14 @@ TestBulkSwapFromSub(enum SwapExpectation expectSwap,
 }
 
 
-template<typename T, size_t count>
+template<typename T, size_t Count>
 void
 TestBulkInPlaceSub(enum SwapExpectation expectSwap,
-                   const T (&values)[count],
-                   void (*swapperFunc)(T* p, unsigned int),
+                   const T (&values)[Count],
+                   void (*swapperFunc)(T* p, size_t),
                    T (*readerFunc)(const void*))
 {
-  const size_t bufferCount = 4 * count;
+  const size_t bufferCount = 4 * Count;
   const size_t bufferSize = bufferCount * sizeof(T);
   static T buffer[bufferCount];
   const T fillValue = 0xa5;
@@ -183,8 +185,8 @@ TestBulkInPlaceSub(enum SwapExpectation expectSwap,
 
   memset(checkBuffer, fillValue, bufferSize);
 
-  for (size_t startPosition = 0; startPosition < count; ++startPosition) {
-    for (size_t nValues = 0; nValues < count; ++nValues) {
+  for (size_t startPosition = 0; startPosition < Count; ++startPosition) {
+    for (size_t nValues = 0; nValues < Count; ++nValues) {
       memset(buffer, fillValue, bufferSize);
       memcpy(buffer + startPosition, values, nValues * sizeof(T));
       swapperFunc(buffer + startPosition, nValues);
@@ -224,9 +226,9 @@ SPECIALIZE_READER(int16_t, readInt16)
 SPECIALIZE_READER(int32_t, readInt32)
 SPECIALIZE_READER(int64_t, readInt64)
 
-template<typename T, size_t count>
+template<typename T, size_t Count>
 void
-TestBulkSwap(const T (&bytes)[count])
+TestBulkSwap(const T (&bytes)[Count])
 {
 #if MOZ_LITTLE_ENDIAN
   TestBulkSwapToSub(Swap, bytes, copyAndSwapToBigEndian<T>, Reader<T>::readBE);
@@ -239,9 +241,9 @@ TestBulkSwap(const T (&bytes)[count])
 #endif
 }
 
-template<typename T, size_t count>
+template<typename T, size_t Count>
 void
-TestBulkNoSwap(const T (&bytes)[count])
+TestBulkNoSwap(const T (&bytes)[Count])
 {
 #if MOZ_LITTLE_ENDIAN
   TestBulkSwapToSub(NoSwap, bytes, copyAndSwapToLittleEndian<T>, Reader<T>::readLE);
@@ -254,9 +256,9 @@ TestBulkNoSwap(const T (&bytes)[count])
 #endif
 }
 
-template<typename T, size_t count>
+template<typename T, size_t Count>
 void
-TestBulkInPlaceSwap(const T (&bytes)[count])
+TestBulkInPlaceSwap(const T (&bytes)[Count])
 {
 #if MOZ_LITTLE_ENDIAN
   TestBulkInPlaceSub(Swap, bytes, swapToBigEndianInPlace<T>, Reader<T>::readBE);
@@ -269,9 +271,9 @@ TestBulkInPlaceSwap(const T (&bytes)[count])
 #endif
 }
 
-template<typename T, size_t count>
+template<typename T, size_t Count>
 void
-TestBulkInPlaceNoSwap(const T (&bytes)[count])
+TestBulkInPlaceNoSwap(const T (&bytes)[Count])
 {
 #if MOZ_LITTLE_ENDIAN
   TestBulkInPlaceSub(NoSwap, bytes, swapToLittleEndianInPlace<T>, Reader<T>::readLE);
diff --git a/mobile/android/base/AwesomeBar.java b/mobile/android/base/AwesomeBar.java
index e847563a272..33ba7390bef 100644
--- a/mobile/android/base/AwesomeBar.java
+++ b/mobile/android/base/AwesomeBar.java
@@ -261,21 +261,6 @@ public class AwesomeBar extends GeckoActivity
         }
     }
 
-    /*
-     * Only one factory can be set on the inflater; however, we want to use two
-     * factories (GeckoViewsFactory and the FragmentActivity factory).
-     * Overriding onCreateView() here allows us to dispatch view creation to
-     * both factories.
-     */
-    @Override
-    public View onCreateView(String name, Context context, AttributeSet attrs) {
-        View view = GeckoViewsFactory.getInstance().onCreateView(name, context, attrs);
-        if (view == null) {
-            view = super.onCreateView(name, context, attrs);
-        }
-        return view;
-    }
-
     private boolean handleBackKey() {
         // Let mAwesomeTabs try to handle the back press, since we may be in a
         // bookmarks sub-folder.
diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index b13079a9db6..8879e6ff027 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -392,7 +392,7 @@ abstract public class BrowserApp extends GeckoApp
 
         super.onCreate(savedInstanceState);
 
-        RelativeLayout actionBar = (RelativeLayout) findViewById(R.id.browser_toolbar);
+        mBrowserToolbar = (BrowserToolbar) findViewById(R.id.browser_toolbar);
 
         mToast = new ButtonToast(findViewById(R.id.toast), new ButtonToast.ToastListener() {
             @Override
@@ -433,11 +433,8 @@ abstract public class BrowserApp extends GeckoApp
             mAboutHome.setUserVisibleHint(false);
         }
 
-        mBrowserToolbar = new BrowserToolbar(this);
-        mBrowserToolbar.from(actionBar);
-
         // Intercept key events for gamepad shortcuts
-        actionBar.setOnKeyListener(this);
+        mBrowserToolbar.setOnKeyListener(this);
 
         if (mTabsPanel != null) {
             mTabsPanel.setTabsLayoutChangeListener(this);
@@ -554,7 +551,7 @@ abstract public class BrowserApp extends GeckoApp
                 mLayerView.getLayerClient().setOnMetricsChangedListener(this);
             }
             setToolbarMargin(0);
-            mAboutHome.setTopPadding(mBrowserToolbar.getLayout().getHeight());
+            mAboutHome.setTopPadding(mBrowserToolbar.getHeight());
         } else {
             // Immediately show the toolbar when disabling the dynamic
             // toolbar.
@@ -563,7 +560,7 @@ abstract public class BrowserApp extends GeckoApp
             }
             mAboutHome.setTopPadding(0);
             if (mBrowserToolbar != null) {
-                mBrowserToolbar.getLayout().scrollTo(0, 0);
+                mBrowserToolbar.scrollTo(0, 0);
             }
         }
 
@@ -824,7 +821,7 @@ abstract public class BrowserApp extends GeckoApp
             mDynamicToolbarCanScroll = true;
         }
 
-        final View toolbarLayout = mBrowserToolbar.getLayout();
+        final View toolbarLayout = mBrowserToolbar;
         final int marginTop = Math.round(aMetrics.marginTop);
         ThreadUtils.postToUiThread(new Runnable() {
             public void run() {
@@ -857,7 +854,7 @@ abstract public class BrowserApp extends GeckoApp
     public void refreshToolbarHeight() {
         int height = 0;
         if (mBrowserToolbar != null) {
-            height = mBrowserToolbar.getLayout().getHeight();
+            height = mBrowserToolbar.getHeight();
         }
 
         if (!isDynamicToolbarEnabled()) {
diff --git a/mobile/android/base/BrowserToolbar.java b/mobile/android/base/BrowserToolbar.java
index d232e2b0776..d2941672d86 100644
--- a/mobile/android/base/BrowserToolbar.java
+++ b/mobile/android/base/BrowserToolbar.java
@@ -32,7 +32,6 @@ import android.graphics.drawable.ColorDrawable;
 import android.graphics.drawable.Drawable;
 import android.graphics.drawable.StateListDrawable;
 import android.os.Build;
-import android.os.Handler;
 import android.os.SystemClock;
 import android.text.style.ForegroundColorSpan;
 import android.text.Spannable;
@@ -41,7 +40,9 @@ import android.text.TextUtils;
 import android.util.AttributeSet;
 import android.util.Log;
 import android.view.ContextMenu;
+import android.view.LayoutInflater;
 import android.view.MenuInflater;
+import android.view.MotionEvent;
 import android.view.View;
 import android.view.ViewGroup;
 import android.view.ViewGroup.MarginLayoutParams;
@@ -66,12 +67,12 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 
-public class BrowserToolbar implements Tabs.OnTabsChangedListener,
+public class BrowserToolbar extends GeckoRelativeLayout
+                            implements Tabs.OnTabsChangedListener,
                                        GeckoMenu.ActionItemBarPresenter,
                                        Animation.AnimationListener {
     private static final String LOGTAG = "GeckoToolbar";
     public static final String PREF_TITLEBAR_MODE = "browser.chrome.titlebarMode";
-    private GeckoRelativeLayout mLayout;
     private LayoutParams mAwesomeBarParams;
     private View mUrlDisplayContainer;
     private View mAwesomeBarEntry;
@@ -95,10 +96,9 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
     private GeckoImageView mMenuIcon;
     private LinearLayout mActionItemBar;
     private MenuPopup mMenuPopup;
-    private List<View> mFocusOrder;
+    private List<? extends View> mFocusOrder;
 
     final private BrowserApp mActivity;
-    private Handler mHandler;
     private boolean mHasSoftMenuButton;
 
     private boolean mShowSiteSecurity;
@@ -131,9 +131,18 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
 
     private Integer mPrefObserverId;
 
-    public BrowserToolbar(BrowserApp activity) {
+    public BrowserToolbar(Context context) {
+        this(context, null);
+    }
+
+    public BrowserToolbar(Context context, AttributeSet attrs) {
+        super(context, attrs);
+
         // BrowserToolbar is attached to BrowserApp only.
-        mActivity = activity;
+        mActivity = (BrowserApp) context;
+
+        // Inflate the content.
+        LayoutInflater.from(context).inflate(R.layout.browser_toolbar, this);
 
         Tabs.registerOnTabsChangedListener(this);
         mSwitchingTabs = true;
@@ -169,22 +178,68 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             }
         });
 
-        Resources res = mActivity.getResources();
+        Resources res = getResources();
         mUrlColor = new ForegroundColorSpan(res.getColor(R.color.url_bar_urltext));
         mDomainColor = new ForegroundColorSpan(res.getColor(R.color.url_bar_domaintext));
         mPrivateDomainColor = new ForegroundColorSpan(res.getColor(R.color.url_bar_domaintext_private));
 
-    }
+        mShowSiteSecurity = false;
+        mShowReader = false;
 
-    public void from(RelativeLayout layout) {
-        if (mLayout != null) {
-            // make sure we retain the visibility property on rotation
-            layout.setVisibility(mLayout.getVisibility());
+        mAnimatingEntry = false;
+
+        mAddressBarBg = (BrowserToolbarBackground) findViewById(R.id.address_bar_bg);
+        mAddressBarViewOffset = res.getDimensionPixelSize(R.dimen.addressbar_offset_left);
+        mDefaultForwardMargin = res.getDimensionPixelSize(R.dimen.forward_default_offset);
+        mUrlDisplayContainer = findViewById(R.id.awesome_bar_display_container);
+        mAwesomeBarEntry = findViewById(R.id.awesome_bar_entry);
+
+        // This will clip the right edge's image at half of its width
+        mAwesomeBarRightEdge = (ImageView) findViewById(R.id.awesome_bar_right_edge);
+        if (mAwesomeBarRightEdge != null) {
+            mAwesomeBarRightEdge.getDrawable().setLevel(5000);
         }
 
-        mLayout = (GeckoRelativeLayout) layout;
+        mTitle = (GeckoTextView) findViewById(R.id.awesome_bar_title);
+        mTitlePadding = mTitle.getPaddingRight();
+        if (Build.VERSION.SDK_INT >= 16)
+            mTitle.setImportantForAccessibility(View.IMPORTANT_FOR_ACCESSIBILITY_NO);
 
-        mLayout.setOnClickListener(new Button.OnClickListener() {
+        mTabs = (ShapedButton) findViewById(R.id.tabs);
+        mTabsCounter = (TabCounter) findViewById(R.id.tabs_counter);
+        mBack = (ImageButton) findViewById(R.id.back);
+        mForward = (ImageButton) findViewById(R.id.forward);
+        mForward.setEnabled(false); // initialize the forward button to not be enabled
+
+        mFavicon = (ImageButton) findViewById(R.id.favicon);
+        if (Build.VERSION.SDK_INT >= 16)
+            mFavicon.setImportantForAccessibility(View.IMPORTANT_FOR_ACCESSIBILITY_NO);
+        mFaviconSize = Math.round(res.getDimension(R.dimen.browser_toolbar_favicon_size));
+
+        mSiteSecurity = (ImageButton) findViewById(R.id.site_security);
+        mSiteSecurityVisible = (mSiteSecurity.getVisibility() == View.VISIBLE);
+        mActivity.getSiteIdentityPopup().setAnchor(mSiteSecurity);
+
+
+        mStop = (ImageButton) findViewById(R.id.stop);
+        mReader = (ImageButton) findViewById(R.id.reader);
+        mShadow = (ImageView) findViewById(R.id.shadow);
+
+        if (Build.VERSION.SDK_INT >= 16) {
+            mShadow.setImportantForAccessibility(View.IMPORTANT_FOR_ACCESSIBILITY_NO);
+        }
+
+        mMenu = (GeckoImageButton) findViewById(R.id.menu);
+        mMenuIcon = (GeckoImageView) findViewById(R.id.menu_icon);
+        mActionItemBar = (LinearLayout) findViewById(R.id.menu_items);
+        mHasSoftMenuButton = !HardwareUtils.hasMenuButton();
+    }
+
+    @Override
+    public void onAttachedToWindow() {
+        super.onAttachedToWindow();
+
+        setOnClickListener(new Button.OnClickListener() {
             @Override
             public void onClick(View v) {
                 mActivity.autoHideTabs();
@@ -192,7 +247,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             }
         });
 
-        mLayout.setOnCreateContextMenuListener(new View.OnCreateContextMenuListener() {
+        setOnCreateContextMenuListener(new View.OnCreateContextMenuListener() {
             @Override
             public void onCreateContextMenu(ContextMenu menu, View v, ContextMenu.ContextMenuInfo menuInfo) {
                 MenuInflater inflater = mActivity.getMenuInflater();
@@ -225,27 +280,6 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             }
         });
 
-        mShowSiteSecurity = false;
-        mShowReader = false;
-
-        mAnimatingEntry = false;
-
-        mAddressBarBg = (BrowserToolbarBackground) mLayout.findViewById(R.id.address_bar_bg);
-        mAddressBarViewOffset = mActivity.getResources().getDimensionPixelSize(R.dimen.addressbar_offset_left);
-        mDefaultForwardMargin = mActivity.getResources().getDimensionPixelSize(R.dimen.forward_default_offset);
-        mUrlDisplayContainer = mLayout.findViewById(R.id.awesome_bar_display_container);
-        mAwesomeBarEntry = mLayout.findViewById(R.id.awesome_bar_entry);
-
-        // This will clip the right edge's image at half of its width
-        mAwesomeBarRightEdge = (ImageView) mLayout.findViewById(R.id.awesome_bar_right_edge);
-        if (mAwesomeBarRightEdge != null) {
-            mAwesomeBarRightEdge.getDrawable().setLevel(5000);
-        }
-
-        mTitle = (GeckoTextView) mLayout.findViewById(R.id.awesome_bar_title);
-        mTitlePadding = mTitle.getPaddingRight();
-
-        mTabs = (ShapedButton) mLayout.findViewById(R.id.tabs);
         mTabs.setOnClickListener(new Button.OnClickListener() {
             @Override
             public void onClick(View v) {
@@ -254,9 +288,6 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
         });
         mTabs.setImageLevel(0);
 
-        mTabsCounter = (TabCounter) mLayout.findViewById(R.id.tabs_counter);
-
-        mBack = (ImageButton) mLayout.findViewById(R.id.back);
         mBack.setOnClickListener(new Button.OnClickListener() {
             @Override
             public void onClick(View view) {
@@ -270,8 +301,6 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             }
         });
 
-        mForward = (ImageButton) mLayout.findViewById(R.id.forward);
-        mForward.setEnabled(false); // initialize the forward button to not be enabled
         mForward.setOnClickListener(new Button.OnClickListener() {
             @Override
             public void onClick(View view) {
@@ -302,20 +331,9 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             }
         };
 
-        mFavicon = (ImageButton) mLayout.findViewById(R.id.favicon);
         mFavicon.setOnClickListener(faviconListener);
-        if (Build.VERSION.SDK_INT >= 16)
-            mFavicon.setImportantForAccessibility(View.IMPORTANT_FOR_ACCESSIBILITY_NO);
-        mFaviconSize = Math.round(mActivity.getResources().getDimension(R.dimen.browser_toolbar_favicon_size));
-
-        mSiteSecurity = (ImageButton) mLayout.findViewById(R.id.site_security);
         mSiteSecurity.setOnClickListener(faviconListener);
-        mSiteSecurityVisible = (mSiteSecurity.getVisibility() == View.VISIBLE);
-        mActivity.getSiteIdentityPopup().setAnchor(mSiteSecurity);
-
-        mProgressSpinner = (AnimationDrawable) mActivity.getResources().getDrawable(R.drawable.progress_spinner);
         
-        mStop = (ImageButton) mLayout.findViewById(R.id.stop);
         mStop.setOnClickListener(new Button.OnClickListener() {
             @Override
             public void onClick(View v) {
@@ -326,7 +344,8 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             }
         });
 
-        mReader = (ImageButton) mLayout.findViewById(R.id.reader);
+        mProgressSpinner = (AnimationDrawable) getResources().getDrawable(R.drawable.progress_spinner);
+
         mReader.setOnClickListener(new Button.OnClickListener() {
             @Override
             public void onClick(View view) {
@@ -349,23 +368,16 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             }
         });
 
-        mShadow = (ImageView) mLayout.findViewById(R.id.shadow);
         mShadow.setOnClickListener(new Button.OnClickListener() {
             @Override
             public void onClick(View v) {
             }
         });
 
-        if (Build.VERSION.SDK_INT >= 16) {
-            mShadow.setImportantForAccessibility(View.IMPORTANT_FOR_ACCESSIBILITY_NO);
-        }
-
-        mHandler = new Handler();
-
-        float slideWidth = mActivity.getResources().getDimension(R.dimen.browser_toolbar_lock_width);
+        float slideWidth = getResources().getDimension(R.dimen.browser_toolbar_lock_width);
 
         LinearLayout.LayoutParams siteSecParams = (LinearLayout.LayoutParams) mSiteSecurity.getLayoutParams();
-        final float scale = mActivity.getResources().getDisplayMetrics().density;
+        final float scale = getResources().getDisplayMetrics().density;
         slideWidth += (siteSecParams.leftMargin + siteSecParams.rightMargin) * scale + 0.5f;
 
         mLockFadeIn = new AlphaAnimation(0.0f, 1.0f);
@@ -382,11 +394,6 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
         mTitleSlideLeft.setDuration(lockAnimDuration);
         mTitleSlideRight.setDuration(lockAnimDuration);
 
-        mMenu = (GeckoImageButton) mLayout.findViewById(R.id.menu);
-        mMenuIcon = (GeckoImageView) mLayout.findViewById(R.id.menu_icon);
-        mActionItemBar = (LinearLayout) mLayout.findViewById(R.id.menu_items);
-        mHasSoftMenuButton = !HardwareUtils.hasMenuButton();
-
         if (mHasSoftMenuButton) {
             mMenu.setVisibility(View.VISIBLE);
             mMenuIcon.setVisibility(View.VISIBLE);
@@ -402,7 +409,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
         if (!HardwareUtils.isTablet()) {
             // Set a touch delegate to Tabs button, so the touch events on its tail
             // are passed to the menu button.
-            mLayout.post(new Runnable() {
+            post(new Runnable() {
                 @Override
                 public void run() {
                     int height = mTabs.getHeight();
@@ -416,11 +423,34 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             });
         }
 
-        mFocusOrder = Arrays.asList(mBack, mForward, mLayout, mReader, mSiteSecurity, mStop, mTabs);
+        mFocusOrder = Arrays.asList(mBack, mForward,  mReader, mSiteSecurity, mStop, mTabs);
     }
 
-    public View getLayout() {
-        return mLayout;
+    @Override
+    public boolean onTouchEvent(MotionEvent event) {
+        // If the motion event has occured below the toolbar (due to the scroll
+        // offset), let it pass through to the page.
+        if (event != null && event.getY() > getHeight() - getScrollY()) {
+            return false;
+        }
+
+        return super.onTouchEvent(event);
+    }
+
+    @Override
+    protected void onSizeChanged(int w, int h, int oldw, int oldh) {
+        super.onSizeChanged(w, h, oldw, oldh);
+
+        if (h != oldh) {
+            // Post this to happen outside of onSizeChanged, as this may cause
+            // a layout change and relayouts within a layout change don't work.
+            post(new Runnable() {
+                @Override
+                public void run() {
+                    mActivity.refreshToolbarHeight();
+                }
+            });
+        }
     }
 
     @Override
@@ -491,11 +521,11 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
     }
 
     public boolean isVisible() {
-        return mLayout.getScrollY() == 0;
+        return getScrollY() == 0;
     }
 
     public void setNextFocusDownId(int nextId) {
-        mLayout.setNextFocusDownId(nextId);
+        super.setNextFocusDownId(nextId);
         mTabs.setNextFocusDownId(nextId);
         mBack.setNextFocusDownId(nextId);
         mForward.setNextFocusDownId(nextId);
@@ -535,11 +565,11 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
     }
 
     private int getAwesomeBarEntryTranslation() {
-        return mLayout.getWidth() - mAwesomeBarEntry.getRight();
+        return getWidth() - mAwesomeBarEntry.getRight();
     }
 
     private int getAwesomeBarCurveTranslation() {
-        return mLayout.getWidth() - mTabs.getLeft();
+        return getWidth() - mTabs.getLeft();
     }
 
     public void fromAwesomeBarSearch(String url) {
@@ -558,9 +588,9 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
         // while in awesome screen, activity was killed in background, etc). In this
         // case, we have to ensure the toolbar is in the correct initial state to
         // shrink back.
-        if (!mLayout.isSelected()) {
+        if (!isSelected()) {
             // Keep the entry highlighted during the animation
-            mLayout.setSelected(true);
+            setSelected(true);
 
             final int entryTranslation = getAwesomeBarEntryTranslation();
             final int curveTranslation = getAwesomeBarCurveTranslation();
@@ -620,7 +650,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
             @Override
             public void onPropertyAnimationEnd() {
                 // Turn off selected state on the entry
-                mLayout.setSelected(false);
+                setSelected(false);
 
                 PropertyAnimator buttonsAnimator = new PropertyAnimator(300);
 
@@ -645,7 +675,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
 
         mAnimatingEntry = true;
 
-        mHandler.postDelayed(new Runnable() {
+        postDelayed(new Runnable() {
             @Override
             public void run() {
                 contentAnimator.start();
@@ -670,7 +700,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
         final int curveTranslation = getAwesomeBarCurveTranslation();
 
         // Keep the entry highlighted during the animation
-        mLayout.setSelected(true);
+        setSelected(true);
 
         // Hide stop/reader buttons immediately
         ViewHelper.setAlpha(mReader, 0);
@@ -749,7 +779,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
         // tabs button is translated offscreen. Don't trigger tabs counter
         // updates until the tabs button is back on screen.
         // See fromAwesomeBarSearch()
-        if (mLayout.isSelected()) {
+        if (isSelected()) {
             return;
         }
 
@@ -878,7 +908,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
 
     private void setTitle(CharSequence title) {
         mTitle.setText(title);
-        mLayout.setContentDescription(title != null ? title : mTitle.getHint());
+        setContentDescription(title != null ? title : mTitle.getHint());
     }
 
     // Sets the toolbar title according to the selected tab, obeying the mShowUrl prference.
@@ -944,10 +974,6 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
         setPageActionVisibility(mStop.getVisibility() == View.VISIBLE);
     }
 
-    public void requestFocusFromTouch() {
-        mLayout.requestFocusFromTouch();
-    }
-
     public void prepareTabsAnimation(PropertyAnimator animator, boolean tabsAreShown) {
         if (!tabsAreShown) {
             PropertyAnimator buttonsAnimator =
@@ -1094,11 +1120,11 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
     }
 
     public void show() {
-        mLayout.setVisibility(View.VISIBLE);
+        setVisibility(View.VISIBLE);
     }
 
     public void hide() {
-        mLayout.setVisibility(View.GONE);
+        setVisibility(View.GONE);
     }
 
     public void refresh() {
@@ -1115,7 +1141,7 @@ public class BrowserToolbar implements Tabs.OnTabsChangedListener,
 
             final boolean isPrivate = tab.isPrivate();
             mAddressBarBg.setPrivateMode(isPrivate);
-            mLayout.setPrivateMode(isPrivate);
+            setPrivateMode(isPrivate);
             mTabs.setPrivateMode(isPrivate);
             mTitle.setPrivateMode(isPrivate);
             mMenu.setPrivateMode(isPrivate);
diff --git a/mobile/android/base/BrowserToolbarLayout.java b/mobile/android/base/BrowserToolbarLayout.java
deleted file mode 100644
index cb3e906283c..00000000000
--- a/mobile/android/base/BrowserToolbarLayout.java
+++ /dev/null
@@ -1,48 +0,0 @@
-/* -*- Mode: Java; c-basic-offset: 4; tab-width: 20; indent-tabs-mode: nil; -*-
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko;
-
-import android.content.Context;
-import android.util.AttributeSet;
-import android.view.MotionEvent;
-import android.widget.RelativeLayout;
-
-public class BrowserToolbarLayout extends GeckoRelativeLayout {
-    private static final String LOGTAG = "GeckoToolbarLayout";
-
-    public BrowserToolbarLayout(Context context, AttributeSet attrs) {
-        super(context, attrs);
-    }
-
-    @Override
-    public boolean onTouchEvent(MotionEvent event) {
-        // If the motion event has occured below the toolbar (due to the scroll
-        // offset), let it pass through to the page.
-        if (event != null && event.getY() > getHeight() - getScrollY()) {
-            return false;
-        }
-
-        return super.onTouchEvent(event);
-    }
-
-    @Override
-    protected void onSizeChanged(int w, int h, int oldw, int oldh) {
-        super.onSizeChanged(w, h, oldw, oldh);
-
-        if (h != oldh) {
-            // Post this to happen outside of onSizeChanged, as this may cause
-            // a layout change and relayouts within a layout change don't work.
-            final int height = h;
-            post(new Runnable() {
-                @Override
-                public void run() {
-                    ((BrowserApp)GeckoAppShell.getContext()).refreshToolbarHeight();
-                }
-            });
-        }
-    }
-}
-
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index 375e70bc60d..2658e9967de 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -76,7 +76,6 @@ import android.util.SparseBooleanArray;
 import android.view.Display;
 import android.view.Gravity;
 import android.view.KeyEvent;
-import android.view.LayoutInflater;
 import android.view.Menu;
 import android.view.MenuInflater;
 import android.view.MenuItem;
@@ -1232,8 +1231,6 @@ abstract public class GeckoApp
             }
         }
 
-        LayoutInflater.from(this).setFactory(this);
-
         super.onCreate(savedInstanceState);
 
         mOrientation = getResources().getConfiguration().orientation;
@@ -2075,21 +2072,6 @@ abstract public class GeckoApp
         return AppConstants.MOZ_CHILD_PROCESS_NAME;
     }
 
-    /*
-     * Only one factory can be set on the inflater; however, we want to use two
-     * factories (GeckoViewsFactory and the FragmentActivity factory).
-     * Overriding onCreateView() here allows us to dispatch view creation to
-     * both factories.
-     */
-    @Override
-    public View onCreateView(String name, Context context, AttributeSet attrs) {
-        View view = GeckoViewsFactory.getInstance().onCreateView(name, context, attrs);
-        if (view == null) {
-            view = super.onCreateView(name, context, attrs);
-        }
-        return view;
-    }
-
     public void addEnvToIntent(Intent intent) {
         Map<String,String> envMap = System.getenv();
         Set<Map.Entry<String,String>> envSet = envMap.entrySet();
diff --git a/mobile/android/base/GeckoViewsFactory.java b/mobile/android/base/GeckoViewsFactory.java
deleted file mode 100644
index 899e10807b3..00000000000
--- a/mobile/android/base/GeckoViewsFactory.java
+++ /dev/null
@@ -1,133 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-package org.mozilla.gecko;
-
-import org.mozilla.gecko.gfx.LayerView;
-import org.mozilla.gecko.menu.GeckoMenu;
-import org.mozilla.gecko.menu.MenuItemActionBar;
-import org.mozilla.gecko.menu.MenuItemDefault;
-import org.mozilla.gecko.widget.AboutHomeView;
-import org.mozilla.gecko.widget.AddonsSection;
-import org.mozilla.gecko.widget.FaviconView;
-import org.mozilla.gecko.widget.IconTabWidget;
-import org.mozilla.gecko.widget.LastTabsSection;
-import org.mozilla.gecko.widget.LinkTextView;
-import org.mozilla.gecko.widget.PromoBox;
-import org.mozilla.gecko.widget.RemoteTabsSection;
-import org.mozilla.gecko.widget.TabRow;
-import org.mozilla.gecko.widget.ThumbnailView;
-import org.mozilla.gecko.widget.TopSitesView;
-
-import android.content.Context;
-import android.text.TextUtils;
-import android.util.AttributeSet;
-import android.util.Log;
-import android.view.LayoutInflater;
-import android.view.View;
-
-import java.lang.reflect.Constructor;
-import java.util.HashMap;
-import java.util.Map;
-
-public final class GeckoViewsFactory implements LayoutInflater.Factory {
-    private static final String LOGTAG = "GeckoViewsFactory";
-
-    private static final String GECKO_VIEW_IDENTIFIER = "org.mozilla.gecko.";
-    private static final int GECKO_VIEW_IDENTIFIER_LENGTH = GECKO_VIEW_IDENTIFIER.length();
-
-    private static final String GECKO_IDENTIFIER = "Gecko.";
-    private static final int GECKO_IDENTIFIER_LENGTH = GECKO_IDENTIFIER.length();
-
-    private final Map<String, Constructor<? extends View>> mFactoryMap;
-
-    private GeckoViewsFactory() {
-        // initialize the hashmap to a capacity that is a prime number greater than
-        // (size * 4/3). The size is the number of items we expect to put in it, and
-        // 4/3 is the inverse of the default load factor.
-        mFactoryMap = new HashMap<String, Constructor<? extends View>>(53);
-        Class<Context> arg1Class = Context.class;
-        Class<AttributeSet> arg2Class = AttributeSet.class;
-        try {
-            mFactoryMap.put("AboutHomeView", AboutHomeView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("AddonsSection", AddonsSection.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("LastTabsSection", LastTabsSection.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("PromoBox", PromoBox.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("RemoteTabsSection", RemoteTabsSection.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TopSitesView", TopSitesView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("AwesomeBarTabs", AwesomeBarTabs.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("AwesomeBarTabs$BackgroundLayout", AwesomeBarTabs.BackgroundLayout.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("BackButton", BackButton.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("BrowserToolbarBackground", BrowserToolbarBackground.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("CheckableLinearLayout", CheckableLinearLayout.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("FormAssistPopup", FormAssistPopup.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("ForwardButton", ForwardButton.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("GeckoApp$MainLayout", GeckoApp.MainLayout.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("LinkTextView", LinkTextView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("menu.MenuItemActionBar", MenuItemActionBar.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("menu.MenuItemDefault", MenuItemDefault.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("menu.GeckoMenu$DefaultActionItemBar", GeckoMenu.DefaultActionItemBar.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("FindInPageBar", FindInPageBar.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("IconTabWidget", IconTabWidget.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("RemoteTabs", RemoteTabs.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("ShapedButton", ShapedButton.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TabRow", TabRow.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TabsPanel", TabsPanel.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TabsPanel$TabsListContainer", TabsPanel.TabsListContainer.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TabsPanel$TabsPanelToolbar", TabsPanel.TabsPanelToolbar.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TabsTray", TabsTray.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("ThumbnailView", ThumbnailView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TextSelectionHandle", TextSelectionHandle.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("gfx.LayerView", LayerView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("AllCapsTextView", AllCapsTextView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("Button", GeckoButton.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("EditText", GeckoEditText.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("FrameLayout", GeckoFrameLayout.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("ImageButton", GeckoImageButton.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("ImageView", GeckoImageView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("LinearLayout", GeckoLinearLayout.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("RelativeLayout", GeckoRelativeLayout.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TextSwitcher", GeckoTextSwitcher.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("TextView", GeckoTextView.class.getConstructor(arg1Class, arg2Class));
-            mFactoryMap.put("FaviconView", FaviconView.class.getConstructor(arg1Class, arg2Class));
-        } catch (NoSuchMethodException nsme) {
-            Log.e(LOGTAG, "Unable to initialize views factory", nsme);
-        }
-    }
-
-    // Making this a singleton class.
-    private static final GeckoViewsFactory INSTANCE = new GeckoViewsFactory();
-
-    public static GeckoViewsFactory getInstance() {
-        return INSTANCE;
-    }
-
-    @Override
-    public View onCreateView(String name, Context context, AttributeSet attrs) {
-        if (!TextUtils.isEmpty(name)) {
-            String viewName = null;
-
-            if (name.startsWith(GECKO_VIEW_IDENTIFIER))
-                viewName = name.substring(GECKO_VIEW_IDENTIFIER_LENGTH);
-            else if (name.startsWith(GECKO_IDENTIFIER))
-                viewName = name.substring(GECKO_IDENTIFIER_LENGTH);
-            else
-                return null;
-
-            Constructor<? extends View> constructor = mFactoryMap.get(viewName);
-            if (constructor != null) {
-                try {
-                    return constructor.newInstance(context, attrs);
-                } catch (Exception e) {
-                    Log.e(LOGTAG, "Unable to instantiate view " + name, e);
-                    return null;
-                }
-            }
-
-            Log.d(LOGTAG, "Warning: unknown custom view: " + name);
-        }
-
-        return null;
-    }
-}
diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index 6778bf8b027..7b2d812a314 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -70,7 +70,6 @@ FENNEC_JAVA_FILES = \
   BrowserApp.java \
   BrowserToolbar.java \
   BrowserToolbarBackground.java \
-  BrowserToolbarLayout.java \
   CameraImageResultHandler.java \
   CameraVideoResultHandler.java \
   CanvasDelegate.java \
@@ -113,7 +112,6 @@ FENNEC_JAVA_FILES = \
   GeckoThread.java \
   GeckoJavaSampler.java \
   GlobalHistory.java \
-  GeckoViewsFactory.java \
   GeckoView.java \
   health/BrowserHealthRecorder.java \
   health/BrowserHealthReporter.java \
diff --git a/mobile/android/base/android-services-files.mk b/mobile/android/base/android-services-files.mk
index 3cd32a0645b..ad2d16e49f7 100644
--- a/mobile/android/base/android-services-files.mk
+++ b/mobile/android/base/android-services-files.mk
@@ -197,6 +197,7 @@ SYNC_JAVA_FILES := \
   sync/repositories/domain/HistoryRecordFactory.java \
   sync/repositories/domain/PasswordRecord.java \
   sync/repositories/domain/Record.java \
+  sync/repositories/domain/RecordParseException.java \
   sync/repositories/domain/TabsRecord.java \
   sync/repositories/domain/VersionConstants.java \
   sync/repositories/FetchFailedException.java \
diff --git a/mobile/android/base/resources/layout-large-land-v11/tabs_panel_header.xml b/mobile/android/base/resources/layout-large-land-v11/tabs_panel_header.xml
index a29ab759e33..21dc6aa33b4 100644
--- a/mobile/android/base/resources/layout-large-land-v11/tabs_panel_header.xml
+++ b/mobile/android/base/resources/layout-large-land-v11/tabs_panel_header.xml
@@ -5,10 +5,10 @@
 
 <merge xmlns:android="http://schemas.android.com/apk/res/android">
 
-    <Gecko.IconTabWidget android:id="@+id/tab_widget"
-                         android:layout_width="wrap_content"
-                         android:layout_height="fill_parent"
-                         android:tabStripEnabled="false"
-                         android:divider="@drawable/tab_indicator_divider"/>
+    <org.mozilla.gecko.widget.IconTabWidget android:id="@+id/tab_widget"
+                                            android:layout_width="wrap_content"
+                                            android:layout_height="fill_parent"
+                                            android:tabStripEnabled="false"
+                                            android:divider="@drawable/tab_indicator_divider"/>
 
 </merge>
diff --git a/mobile/android/base/resources/layout-large-v11/browser_toolbar.xml b/mobile/android/base/resources/layout-large-v11/browser_toolbar.xml
index f3f194bf4d1..b0fcd50b31d 100644
--- a/mobile/android/base/resources/layout-large-v11/browser_toolbar.xml
+++ b/mobile/android/base/resources/layout-large-v11/browser_toolbar.xml
@@ -3,27 +3,23 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<org.mozilla.gecko.BrowserToolbarLayout xmlns:android="http://schemas.android.com/apk/res/android"
-              xmlns:gecko="http://schemas.android.com/apk/res-auto"
-              android:id="@+id/browser_toolbar"
-              style="@style/BrowserToolbar"
-              android:clickable="true"
-              android:focusable="true">
+<merge xmlns:android="http://schemas.android.com/apk/res/android"
+       xmlns:gecko="http://schemas.android.com/apk/res-auto">
 
     <org.mozilla.gecko.BrowserToolbarBackground android:id="@+id/address_bar_bg"
                                                 android:layout_width="fill_parent"
                                                 android:layout_height="fill_parent"
                                                 android:background="@drawable/address_bar_bg"/>
 
-    <Gecko.ShapedButton android:id="@+id/tabs"
-                        style="@style/AddressBar.ImageButton"
-                        android:layout_width="84dip"
-                        android:layout_alignParentLeft="true"
-                        gecko:curveTowards="left"
-                        android:background="@drawable/shaped_button"
-                        android:gravity="center_vertical"
-                        android:paddingLeft="6dip"
-                        android:paddingRight="38dip"/>
+    <org.mozilla.gecko.ShapedButton android:id="@+id/tabs"
+                                    style="@style/AddressBar.ImageButton"
+                                    android:layout_width="84dip"
+                                    android:layout_alignParentLeft="true"
+                                    gecko:curveTowards="left"
+                                    android:background="@drawable/shaped_button"
+                                    android:gravity="center_vertical"
+                                    android:paddingLeft="6dip"
+                                    android:paddingRight="38dip"/>
 
     <!-- The TextSwitcher should be shifted 28dp on the right, to avoid
          the curve. On a 56dp space, centering 24dp image will leave
@@ -93,19 +89,19 @@
                      android:contentDescription="@string/site_security"
                      android:visibility="gone"/>
 
-        <Gecko.TextView android:id="@+id/awesome_bar_title"
-                        style="@style/AddressBar.Button"
-                        android:layout_width="fill_parent"
-                        android:layout_height="fill_parent"
-                        android:layout_weight="1.0"
-                        android:singleLine="true"
-                        android:paddingRight="8dp"
-                        android:textColor="@color/awesome_bar_title"
-                        android:textColorHint="@color/awesome_bar_title_hint"
-                        android:gravity="center_vertical|left"
-                        android:hint="@string/awesomebar_default_text"
-                        android:layout_gravity="center_vertical"
-                        gecko:autoUpdateTheme="false"/>
+        <org.mozilla.gecko.GeckoTextView android:id="@+id/awesome_bar_title"
+                                         style="@style/AddressBar.Button"
+                                         android:layout_width="fill_parent"
+                                         android:layout_height="fill_parent"
+                                         android:layout_weight="1.0"
+                                         android:singleLine="true"
+                                         android:paddingRight="8dp"
+                                         android:textColor="@color/awesome_bar_title"
+                                         android:textColorHint="@color/awesome_bar_title_hint"
+                                         android:gravity="center_vertical|left"
+                                         android:hint="@string/awesomebar_default_text"
+                                         android:layout_gravity="center_vertical"
+                                         gecko:autoUpdateTheme="false"/>
 
         <ImageButton android:id="@+id/reader"
                      style="@style/AddressBar.ImageButton.Icon"
@@ -129,21 +125,21 @@
                   android:layout_toLeftOf="@id/menu"
                   android:layout_alignWithParentIfMissing="true"/>
 
-    <Gecko.ImageButton android:id="@+id/menu"
-                       style="@style/AddressBar.ImageButton"
-                       android:layout_width="56dip"
-                       android:layout_alignParentRight="true"
-                       android:contentDescription="@string/menu"
-                       android:background="@drawable/action_bar_button"
-                       android:visibility="gone"/>
+    <org.mozilla.gecko.GeckoImageButton android:id="@+id/menu"
+                                        style="@style/AddressBar.ImageButton"
+                                        android:layout_width="56dip"
+                                        android:layout_alignParentRight="true"
+                                        android:contentDescription="@string/menu"
+                                        android:background="@drawable/action_bar_button"
+                                        android:visibility="gone"/>
 
-    <Gecko.ImageView android:id="@+id/menu_icon"
-                     style="@style/AddressBar.ImageButton"
-                     android:layout_alignLeft="@id/menu"
-                     android:layout_alignRight="@id/menu"
-                     android:gravity="center_vertical"
-                     android:src="@drawable/menu_level"
-                     android:visibility="gone"/>
+    <org.mozilla.gecko.GeckoImageView android:id="@+id/menu_icon"
+                                      style="@style/AddressBar.ImageButton"
+                                      android:layout_alignLeft="@id/menu"
+                                      android:layout_alignRight="@id/menu"
+                                      android:gravity="center_vertical"
+                                      android:src="@drawable/menu_level"
+                                      android:visibility="gone"/>
 
     <ImageView android:id="@+id/shadow"
                android:layout_width="fill_parent"
@@ -153,4 +149,4 @@
                android:contentDescription="@null"
                android:visibility="gone"/>
 
-</org.mozilla.gecko.BrowserToolbarLayout>
+</merge>
diff --git a/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml b/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml
index 2fd37f81574..d67a60fb9d2 100644
--- a/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml
+++ b/mobile/android/base/resources/layout-xlarge-land-v11/abouthome_content.xml
@@ -22,43 +22,43 @@
                       android:layout_marginLeft="@dimen/abouthome_gutter_large"
                       android:layout_marginRight="@dimen/abouthome_gutter_small">
 
-            <Gecko.ImageView android:id="@+id/abouthome_logo"
-                             android:src="@drawable/abouthome_logo"
-                             android:layout_width="wrap_content"
-                             android:layout_height="24dip"
-                             android:layout_marginTop="16dip"
-                             android:layout_marginBottom="10dip"
-                             android:layout_marginLeft="12dip"/>
+            <org.mozilla.gecko.GeckoImageView android:id="@+id/abouthome_logo"
+                                              android:src="@drawable/abouthome_logo"
+                                              android:layout_width="wrap_content"
+                                              android:layout_height="24dip"
+                                              android:layout_marginTop="16dip"
+                                              android:layout_marginBottom="10dip"
+                                              android:layout_marginLeft="12dip"/>
 
-            <Gecko.TextView android:id="@+id/top_sites_title"
-                            android:text="@string/abouthome_top_sites_title"
-                            android:layout_width="fill_parent"
-                            android:layout_height="26dip"
-                            android:background="#34FFFFFF"
-                            android:paddingLeft="12dip"
-                            android:textSize="12sp"
-                            android:textColor="@color/abouthome_section_title"
-                            android:textStyle="bold"
-                            android:gravity="left|center_vertical"/>
+            <org.mozilla.gecko.GeckoTextView android:id="@+id/top_sites_title"
+                                             android:text="@string/abouthome_top_sites_title"
+                                             android:layout_width="fill_parent"
+                                             android:layout_height="26dip"
+                                             android:background="#34FFFFFF"
+                                             android:paddingLeft="12dip"
+                                             android:textSize="12sp"
+                                             android:textColor="@color/abouthome_section_title"
+                                             android:textStyle="bold"
+                                             android:gravity="left|center_vertical"/>
 
-            <Gecko.TopSitesView android:id="@+id/top_sites_grid"
-                                style="@style/AboutHome.Thumbnail.Grid"/>
+            <org.mozilla.gecko.widget.TopSitesView android:id="@+id/top_sites_grid"
+                                                   style="@style/AboutHome.Thumbnail.Grid"/>
 
-            <Gecko.PromoBox android:id="@+id/promo_box"
-                            android:background="@drawable/abouthome_promo_box"
-                            android:layout_width="fill_parent"
-                            android:layout_height="wrap_content"
-                            android:layout_marginLeft="12dp"
-                            android:layout_marginRight="12dp"
-                            android:layout_marginTop="17dp"
-                            android:layout_marginBottom="14dp"
-                            android:drawablePadding="7dp"
-                            android:gravity="center"
-                            android:clickable="true"
-                            android:textSize="16sp"
-                            android:textColor="#FFFFFF"
-                            android:visibility="gone"
-                            android:focusable="true"/>
+            <org.mozilla.gecko.widget.PromoBox android:id="@+id/promo_box"
+                                               android:background="@drawable/abouthome_promo_box"
+                                               android:layout_width="fill_parent"
+                                               android:layout_height="wrap_content"
+                                               android:layout_marginLeft="12dp"
+                                               android:layout_marginRight="12dp"
+                                               android:layout_marginTop="17dp"
+                                               android:layout_marginBottom="14dp"
+                                               android:drawablePadding="7dp"
+                                               android:gravity="center"
+                                               android:clickable="true"
+                                               android:textSize="16sp"
+                                               android:textColor="#FFFFFF"
+                                               android:visibility="gone"
+                                               android:focusable="true"/>
 
         </LinearLayout>
 
@@ -83,26 +83,26 @@
                           android:layout_alignParentLeft="true"
                           android:layout_marginTop="50dip">
 
-                <Gecko.LastTabsSection android:id="@+id/last_tabs"
-                                       android:layout_width="fill_parent"
-                                       android:layout_height="wrap_content"
-                                       android:visibility="gone"
-                                       gecko:title="@string/abouthome_last_tabs_title"
-                                       gecko:more_text="@string/abouthome_last_tabs_open"/>
+                <org.mozilla.gecko.widget.LastTabsSection android:id="@+id/last_tabs"
+                                                          android:layout_width="fill_parent"
+                                                          android:layout_height="wrap_content"
+                                                          android:visibility="gone"
+                                                          gecko:title="@string/abouthome_last_tabs_title"
+                                                          gecko:more_text="@string/abouthome_last_tabs_open"/>
 
-                <Gecko.AddonsSection android:id="@+id/recommended_addons"
-                                     android:layout_width="fill_parent"
-                                     android:layout_height="wrap_content"
-                                     android:visibility="gone"
-                                     gecko:title="@string/abouthome_addons_title"
-                                     gecko:more_text="@string/abouthome_addons_browse"/>
+                <org.mozilla.gecko.widget.AddonsSection android:id="@+id/recommended_addons"
+                                                        android:layout_width="fill_parent"
+                                                        android:layout_height="wrap_content"
+                                                        android:visibility="gone"
+                                                        gecko:title="@string/abouthome_addons_title"
+                                                        gecko:more_text="@string/abouthome_addons_browse"/>
 
-                <Gecko.RemoteTabsSection android:id="@+id/remote_tabs"
-                                         android:layout_width="fill_parent"
-                                         android:layout_height="wrap_content"
-                                         android:visibility="gone"
-                                         gecko:title="@string/remote_tabs"
-                                         gecko:more_text="@string/remote_tabs_show_all"/>
+                <org.mozilla.gecko.widget.RemoteTabsSection android:id="@+id/remote_tabs"
+                                                            android:layout_width="fill_parent"
+                                                            android:layout_height="wrap_content"
+                                                            android:visibility="gone"
+                                                            gecko:title="@string/remote_tabs"
+                                                            gecko:more_text="@string/remote_tabs_show_all"/>
 
             </LinearLayout>
 
diff --git a/mobile/android/base/resources/layout-xlarge-v11/awesomebar_search.xml b/mobile/android/base/resources/layout-xlarge-v11/awesomebar_search.xml
index f82f38b1e42..dbfd32bc4be 100644
--- a/mobile/android/base/resources/layout-xlarge-v11/awesomebar_search.xml
+++ b/mobile/android/base/resources/layout-xlarge-v11/awesomebar_search.xml
@@ -15,13 +15,13 @@
                                                 gecko:curveTowards="none"
                                                 android:background="@drawable/address_bar_bg"/>
 
-    <Gecko.ShapedButton android:id="@+id/dummy_tab"
-                        style="@style/AddressBar.ImageButton"
-                        android:layout_width="84dip"
-                        android:layout_alignParentLeft="true"
-                        gecko:curveTowards="left"
-                        android:background="@drawable/shaped_button"
-                        android:gravity="center_vertical"/>
+    <org.mozilla.gecko.ShapedButton android:id="@+id/dummy_tab"
+                                    style="@style/AddressBar.ImageButton"
+                                    android:layout_width="84dip"
+                                    android:layout_alignParentLeft="true"
+                                    gecko:curveTowards="left"
+                                    android:background="@drawable/shaped_button"
+                                    android:gravity="center_vertical"/>
 
     <view class="org.mozilla.gecko.CustomEditText"
           android:id="@+id/awesomebar_text"
diff --git a/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_group.xml b/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_group.xml
index ff4a1602a67..6c1f5ba06db 100644
--- a/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_group.xml
+++ b/mobile/android/base/resources/layout-xlarge-v11/remote_tabs_group.xml
@@ -3,16 +3,16 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.AllCapsTextView xmlns:android="http://schemas.android.com/apk/res/android"
-                       android:id="@+id/client"
-                       android:layout_width="fill_parent"
-                       android:layout_height="@dimen/remote_tab_group_row_height"
-                       style="@style/TabRowTextAppearance.Url"
-                       android:background="@android:color/transparent"
-                       android:paddingLeft="2dip"
-                       android:paddingRight="2dip"
-                       android:textStyle="bold"
-                       android:textSize="12sp"
-                       android:singleLine="false"
-                       android:maxLines="2"
-                       android:gravity="center_vertical"/>
+<org.mozilla.gecko.AllCapsTextView xmlns:android="http://schemas.android.com/apk/res/android"
+                                   android:id="@+id/client"
+                                   android:layout_width="fill_parent"
+                                   android:layout_height="@dimen/remote_tab_group_row_height"
+                                   style="@style/TabRowTextAppearance.Url"
+                                   android:background="@android:color/transparent"
+                                   android:paddingLeft="2dip"
+                                   android:paddingRight="2dip"
+                                   android:textStyle="bold"
+                                   android:textSize="12sp"
+                                   android:singleLine="false"
+                                   android:maxLines="2"
+                                   android:gravity="center_vertical"/>
diff --git a/mobile/android/base/resources/layout/abouthome_addon_row.xml b/mobile/android/base/resources/layout/abouthome_addon_row.xml
index 71cf0b64e06..512ec467b1f 100644
--- a/mobile/android/base/resources/layout/abouthome_addon_row.xml
+++ b/mobile/android/base/resources/layout/abouthome_addon_row.xml
@@ -3,10 +3,10 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.TextView xmlns:android="http://schemas.android.com/apk/res/android"
-                android:layout_width="fill_parent"
-                android:layout_height="@dimen/abouthome_rowitem_height"
-                android:paddingLeft="@dimen/abouthome_rowitem_left_padding"
-                android:gravity="center_vertical"
-                android:drawablePadding="12dip"
-                style="@style/AboutHome.RowItem.TextRow"/>
+<org.mozilla.gecko.GeckoTextView xmlns:android="http://schemas.android.com/apk/res/android"
+                                 android:layout_width="fill_parent"
+                                 android:layout_height="@dimen/abouthome_rowitem_height"
+                                 android:paddingLeft="@dimen/abouthome_rowitem_left_padding"
+                                 android:gravity="center_vertical"
+                                 android:drawablePadding="12dip"
+                                 style="@style/AboutHome.RowItem.TextRow"/>
diff --git a/mobile/android/base/resources/layout/abouthome_content.xml b/mobile/android/base/resources/layout/abouthome_content.xml
index ec0c44c6b65..78eb43230c0 100644
--- a/mobile/android/base/resources/layout/abouthome_content.xml
+++ b/mobile/android/base/resources/layout/abouthome_content.xml
@@ -16,27 +16,27 @@
                     android:paddingLeft="@dimen/abouthome_gutter_large"
                     android:paddingRight="@dimen/abouthome_gutter_large">
 
-        <Gecko.ImageView android:id="@+id/abouthome_logo"
-                         android:src="@drawable/abouthome_logo"
-                         android:layout_width="wrap_content"
-                         android:layout_height="24dip"
-                         android:layout_marginTop="16dip"
-                         android:layout_marginBottom="10dip"
-                         android:layout_marginLeft="12dip"
-                         android:layout_alignParentTop="true"
-                         android:layout_alignParentLeft="true"/>
+        <org.mozilla.gecko.GeckoImageView android:id="@+id/abouthome_logo"
+                                          android:src="@drawable/abouthome_logo"
+                                          android:layout_width="wrap_content"
+                                          android:layout_height="24dip"
+                                          android:layout_marginTop="16dip"
+                                          android:layout_marginBottom="10dip"
+                                          android:layout_marginLeft="12dip"
+                                          android:layout_alignParentTop="true"
+                                          android:layout_alignParentLeft="true"/>
 
-        <Gecko.TextView android:id="@+id/top_sites_title"
-                        android:text="@string/abouthome_top_sites_title"
-                        android:layout_width="fill_parent"
-                        android:layout_height="26dip"
-                        android:background="#34FFFFFF"
-                        android:paddingLeft="12dip"
-                        android:textSize="12sp"
-                        android:textColor="@color/abouthome_section_title"
-                        android:textStyle="bold"
-                        android:gravity="left|center_vertical"
-                        android:layout_below="@id/abouthome_logo"/>
+        <org.mozilla.gecko.GeckoTextView android:id="@+id/top_sites_title"
+                                         android:text="@string/abouthome_top_sites_title"
+                                         android:layout_width="fill_parent"
+                                         android:layout_height="26dip"
+                                         android:background="#34FFFFFF"
+                                         android:paddingLeft="12dip"
+                                         android:textSize="12sp"
+                                         android:textColor="@color/abouthome_section_title"
+                                         android:textStyle="bold"
+                                         android:gravity="left|center_vertical"
+                                         android:layout_below="@id/abouthome_logo"/>
 
         <ImageView android:src="@drawable/abouthome_icon"
                    android:layout_width="180dp"
@@ -51,45 +51,45 @@
                       android:layout_height="fill_parent"
                       android:layout_below="@id/top_sites_title">
 
-            <Gecko.TopSitesView android:id="@+id/top_sites_grid"
-                                style="@style/AboutHome.Thumbnail.Grid"/>
+            <org.mozilla.gecko.widget.TopSitesView android:id="@+id/top_sites_grid"
+                                                   style="@style/AboutHome.Thumbnail.Grid"/>
 
-            <Gecko.PromoBox android:id="@+id/promo_box"
-                            android:background="@drawable/abouthome_promo_box"
-                            android:layout_width="fill_parent"
-                            android:layout_height="wrap_content"
-                            android:layout_marginLeft="12dp"
-                            android:layout_marginRight="12dp"
-                            android:layout_marginTop="17dp"
-                            android:layout_marginBottom="14dp"
-                            android:drawablePadding="7dp"
-                            android:gravity="center"
-                            android:clickable="true"
-                            android:textSize="16sp"
-                            android:textColor="#FFFFFF"
-                            android:visibility="gone"
-                            android:focusable="true"/>
+            <org.mozilla.gecko.widget.PromoBox android:id="@+id/promo_box"
+                                               android:background="@drawable/abouthome_promo_box"
+                                               android:layout_width="fill_parent"
+                                               android:layout_height="wrap_content"
+                                               android:layout_marginLeft="12dp"
+                                               android:layout_marginRight="12dp"
+                                               android:layout_marginTop="17dp"
+                                               android:layout_marginBottom="14dp"
+                                               android:drawablePadding="7dp"
+                                               android:gravity="center"
+                                               android:clickable="true"
+                                               android:textSize="16sp"
+                                               android:textColor="#FFFFFF"
+                                               android:visibility="gone"
+                                               android:focusable="true"/>
 
-            <Gecko.LastTabsSection android:id="@+id/last_tabs"
-                                   android:layout_width="fill_parent"
-                                   android:layout_height="wrap_content"
-                                   android:visibility="gone"
-                                   gecko:title="@string/abouthome_last_tabs_title"
-                                   gecko:more_text="@string/abouthome_last_tabs_open"/>
+            <org.mozilla.gecko.widget.LastTabsSection android:id="@+id/last_tabs"
+                                                      android:layout_width="fill_parent"
+                                                      android:layout_height="wrap_content"
+                                                      android:visibility="gone"
+                                                      gecko:title="@string/abouthome_last_tabs_title"
+                                                      gecko:more_text="@string/abouthome_last_tabs_open"/>
 
-            <Gecko.AddonsSection android:id="@+id/recommended_addons"
-                                 android:layout_width="fill_parent"
-                                 android:layout_height="wrap_content"
-                                 android:visibility="gone"
-                                 gecko:title="@string/abouthome_addons_title"
-                                 gecko:more_text="@string/abouthome_addons_browse"/>
+            <org.mozilla.gecko.widget.AddonsSection android:id="@+id/recommended_addons"
+                                                    android:layout_width="fill_parent"
+                                                    android:layout_height="wrap_content"
+                                                    android:visibility="gone"
+                                                    gecko:title="@string/abouthome_addons_title"
+                                                    gecko:more_text="@string/abouthome_addons_browse"/>
 
-            <Gecko.RemoteTabsSection android:id="@+id/remote_tabs"
-                                     android:layout_width="fill_parent"
-                                     android:layout_height="wrap_content"
-                                     android:visibility="gone"
-                                     gecko:title="@string/remote_tabs"
-                                     gecko:more_text="@string/remote_tabs_show_all"/>
+            <org.mozilla.gecko.widget.RemoteTabsSection android:id="@+id/remote_tabs"
+                                                        android:layout_width="fill_parent"
+                                                        android:layout_height="wrap_content"
+                                                        android:visibility="gone"
+                                                        gecko:title="@string/remote_tabs"
+                                                        gecko:more_text="@string/remote_tabs_show_all"/>
 
         </LinearLayout>
 
diff --git a/mobile/android/base/resources/layout/abouthome_last_tabs_row.xml b/mobile/android/base/resources/layout/abouthome_last_tabs_row.xml
index c528cfe71c7..96471853c8f 100644
--- a/mobile/android/base/resources/layout/abouthome_last_tabs_row.xml
+++ b/mobile/android/base/resources/layout/abouthome_last_tabs_row.xml
@@ -9,32 +9,32 @@
                 android:gravity="left|center_vertical"
                 style="@style/AboutHome.RowItem">
 
-    <Gecko.FaviconView android:id="@+id/last_tab_favicon"
-                       android:layout_width="@dimen/favicon_bg"
-                       android:layout_height="@dimen/favicon_bg"
-                       android:layout_marginBottom="6dip"
-                       android:layout_marginLeft="@dimen/abouthome_rowitem_left_padding"
-                       android:layout_centerVertical="true"
-                       android:minWidth="@dimen/favicon_bg"
-                       android:minHeight="@dimen/favicon_bg"
-                       android:background="@drawable/favicon"/>
+    <org.mozilla.gecko.widget.FaviconView android:id="@+id/last_tab_favicon"
+                                          android:layout_width="@dimen/favicon_bg"
+                                          android:layout_height="@dimen/favicon_bg"
+                                          android:layout_marginBottom="6dip"
+                                          android:layout_marginLeft="@dimen/abouthome_rowitem_left_padding"
+                                          android:layout_centerVertical="true"
+                                          android:minWidth="@dimen/favicon_bg"
+                                          android:minHeight="@dimen/favicon_bg"
+                                          android:background="@drawable/favicon"/>
 
-    <Gecko.TextView android:id="@+id/last_tab_title"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_toRightOf="@id/last_tab_favicon"
-                    android:layout_marginTop="2dip"
-                    android:layout_marginLeft="12dip"
-                    android:layout_marginRight="12dip"
-                    style="@style/AboutHome.LastTabRow.Title"/>
+    <org.mozilla.gecko.GeckoTextView android:id="@+id/last_tab_title"
+                                     android:layout_width="wrap_content"
+                                     android:layout_height="wrap_content"
+                                     android:layout_toRightOf="@id/last_tab_favicon"
+                                     android:layout_marginTop="2dip"
+                                     android:layout_marginLeft="12dip"
+                                     android:layout_marginRight="12dip"
+                                     style="@style/AboutHome.LastTabRow.Title"/>
 
-    <Gecko.TextView android:id="@+id/last_tab_url"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_marginLeft="12dip"
-                    android:layout_marginRight="12dip"
-                    android:layout_toRightOf="@id/last_tab_favicon"
-                    android:layout_below="@id/last_tab_title"
-                    style="@style/AboutHome.LastTabRow.Url"/>
+    <org.mozilla.gecko.GeckoTextView android:id="@+id/last_tab_url"
+                                     android:layout_width="wrap_content"
+                                     android:layout_height="wrap_content"
+                                     android:layout_marginLeft="12dip"
+                                     android:layout_marginRight="12dip"
+                                     android:layout_toRightOf="@id/last_tab_favicon"
+                                     android:layout_below="@id/last_tab_title"
+                                     style="@style/AboutHome.LastTabRow.Url"/>
 
 </RelativeLayout>
diff --git a/mobile/android/base/resources/layout/abouthome_remote_tab_row.xml b/mobile/android/base/resources/layout/abouthome_remote_tab_row.xml
index 68105ba62ab..accc4780a67 100644
--- a/mobile/android/base/resources/layout/abouthome_remote_tab_row.xml
+++ b/mobile/android/base/resources/layout/abouthome_remote_tab_row.xml
@@ -3,10 +3,10 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.TextView xmlns:android="http://schemas.android.com/apk/res/android"
-                android:layout_width="fill_parent"
-                android:layout_height="@dimen/abouthome_rowitem_height"
-                android:paddingLeft="@dimen/abouthome_rowitem_left_padding"
-                android:gravity="center_vertical"
-                android:paddingRight="12dip"
-                style="@style/AboutHome.RowItem.TextRow"/>
+<org.mozilla.gecko.GeckoTextView xmlns:android="http://schemas.android.com/apk/res/android"
+                                 android:layout_width="fill_parent"
+                                 android:layout_height="@dimen/abouthome_rowitem_height"
+                                 android:paddingLeft="@dimen/abouthome_rowitem_left_padding"
+                                 android:gravity="center_vertical"
+                                 android:paddingRight="12dip"
+                                 style="@style/AboutHome.RowItem.TextRow"/>
diff --git a/mobile/android/base/resources/layout/abouthome_section.xml b/mobile/android/base/resources/layout/abouthome_section.xml
index b9b218970f3..ef75c9e5ea0 100644
--- a/mobile/android/base/resources/layout/abouthome_section.xml
+++ b/mobile/android/base/resources/layout/abouthome_section.xml
@@ -34,12 +34,12 @@
                   android:isScrollContainer="false"
                   android:duplicateParentState="true"/>
 
-    <org.mozilla.gecko.LinkTextView android:id="@+id/more_text"
-                                    android:layout_width="fill_parent"
-                                    android:layout_height="@dimen/abouthome_rowitem_height"
-                                    android:textColor="@color/abouthome_section_more_text"
-                                    android:textSize="12sp"
-                                    android:gravity="center"
-                                    android:focusable="true"/>
+    <org.mozilla.gecko.widget.LinkTextView android:id="@+id/more_text"
+                                           android:layout_width="fill_parent"
+                                           android:layout_height="@dimen/abouthome_rowitem_height"
+                                           android:textColor="@color/abouthome_section_more_text"
+                                           android:textSize="12sp"
+                                           android:gravity="center"
+                                           android:focusable="true"/>
 
 </merge>
diff --git a/mobile/android/base/resources/layout/awesomebar_folder_row.xml b/mobile/android/base/resources/layout/awesomebar_folder_row.xml
index 59d13c8292d..b8a95bcc13c 100644
--- a/mobile/android/base/resources/layout/awesomebar_folder_row.xml
+++ b/mobile/android/base/resources/layout/awesomebar_folder_row.xml
@@ -8,14 +8,14 @@
                 android:layout_height="@dimen/awesomebar_row_height"
                 android:padding="6dip">
 
-    <Gecko.FaviconView android:id="@+id/favicon"
-                       android:src="@drawable/folder"
-                       android:layout_width="@dimen/favicon_bg"
-                       android:layout_height="@dimen/favicon_bg"
-                       android:layout_marginRight="6dip"
-                       android:layout_centerVertical="true"
-                       android:minWidth="@dimen/favicon_bg"
-                       android:minHeight="@dimen/favicon_bg"/>
+    <org.mozilla.gecko.widget.FaviconView android:id="@+id/favicon"
+                                          android:src="@drawable/folder"
+                                          android:layout_width="@dimen/favicon_bg"
+                                          android:layout_height="@dimen/favicon_bg"
+                                          android:layout_marginRight="6dip"
+                                          android:layout_centerVertical="true"
+                                          android:minWidth="@dimen/favicon_bg"
+                                          android:minHeight="@dimen/favicon_bg"/>
 
     <TextView android:id="@+id/title"
               android:layout_width="wrap_content"
diff --git a/mobile/android/base/resources/layout/awesomebar_row.xml b/mobile/android/base/resources/layout/awesomebar_row.xml
index f6815ed3e30..39e1e30ffdf 100644
--- a/mobile/android/base/resources/layout/awesomebar_row.xml
+++ b/mobile/android/base/resources/layout/awesomebar_row.xml
@@ -8,14 +8,14 @@
                 android:layout_height="@dimen/awesomebar_row_height"
                 android:padding="6dip">
 
-    <Gecko.FaviconView android:id="@+id/favicon"
-                       android:layout_width="@dimen/favicon_bg"
-                       android:layout_height="@dimen/favicon_bg"
-                       android:layout_marginLeft="6dip"
-                       android:layout_marginRight="6dip"
-                       android:layout_centerVertical="true"
-                       android:minWidth="@dimen/favicon_bg"
-                       android:minHeight="@dimen/favicon_bg"/>
+    <org.mozilla.gecko.widget.FaviconView android:id="@+id/favicon"
+                                          android:layout_width="@dimen/favicon_bg"
+                                          android:layout_height="@dimen/favicon_bg"
+                                          android:layout_marginLeft="6dip"
+                                          android:layout_marginRight="6dip"
+                                          android:layout_centerVertical="true"
+                                          android:minWidth="@dimen/favicon_bg"
+                                          android:minHeight="@dimen/favicon_bg"/>
 
     <ImageView android:id="@+id/bookmark_icon"
                android:layout_width="wrap_content"
diff --git a/mobile/android/base/resources/layout/awesomebar_suggestion_prompt.xml b/mobile/android/base/resources/layout/awesomebar_suggestion_prompt.xml
index 286efc3181d..b0380ce9965 100644
--- a/mobile/android/base/resources/layout/awesomebar_suggestion_prompt.xml
+++ b/mobile/android/base/resources/layout/awesomebar_suggestion_prompt.xml
@@ -17,13 +17,13 @@
                   android:gravity="center_vertical"
                   android:padding="10dip">
 
-        <Gecko.TextView android:id="@+id/suggestions_prompt_title"
-                        android:layout_height="wrap_content"
-                        android:layout_width="wrap_content"
-                        android:textColor="@color/awesome_bar_title"
-                        android:layout_marginLeft="6dip"
-                        android:textSize="14sp"
-                        android:layout_weight="1" />
+        <org.mozilla.gecko.GeckoTextView android:id="@+id/suggestions_prompt_title"
+                                         android:layout_height="wrap_content"
+                                         android:layout_width="wrap_content"
+                                         android:textColor="@color/awesome_bar_title"
+                                         android:layout_marginLeft="6dip"
+                                         android:textSize="14sp"
+                                         android:layout_weight="1" />
 
         <TextView android:id="@+id/suggestions_prompt_yes"
                 android:layout_height="wrap_content"
diff --git a/mobile/android/base/resources/layout/awesomebar_suggestion_row.xml b/mobile/android/base/resources/layout/awesomebar_suggestion_row.xml
index 5f62f908fa4..f169e980f5d 100644
--- a/mobile/android/base/resources/layout/awesomebar_suggestion_row.xml
+++ b/mobile/android/base/resources/layout/awesomebar_suggestion_row.xml
@@ -9,14 +9,14 @@
                 android:minHeight="@dimen/awesomebar_row_height"
                 android:padding="7dip">
 
-    <Gecko.FaviconView android:id="@+id/suggestion_icon"
-                       android:layout_width="@dimen/favicon_bg"
-                       android:layout_height="@dimen/favicon_bg"
-                       android:layout_marginLeft="6dip"
-                       android:layout_marginRight="6dip"
-                       android:layout_centerVertical="true"
-                       android:minWidth="@dimen/favicon_bg"
-                       android:minHeight="@dimen/favicon_bg"/>
+    <org.mozilla.gecko.widget.FaviconView android:id="@+id/suggestion_icon"
+                                          android:layout_width="@dimen/favicon_bg"
+                                          android:layout_height="@dimen/favicon_bg"
+                                          android:layout_marginLeft="6dip"
+                                          android:layout_marginRight="6dip"
+                                          android:layout_centerVertical="true"
+                                          android:minWidth="@dimen/favicon_bg"
+                                          android:minHeight="@dimen/favicon_bg"/>
 
     <org.mozilla.gecko.FlowLayout android:id="@+id/suggestion_layout"
                                   android:layout_toRightOf="@id/suggestion_icon"
diff --git a/mobile/android/base/resources/layout/awesomebar_tab_indicator.xml b/mobile/android/base/resources/layout/awesomebar_tab_indicator.xml
index 56695e40d6a..07780ff683f 100644
--- a/mobile/android/base/resources/layout/awesomebar_tab_indicator.xml
+++ b/mobile/android/base/resources/layout/awesomebar_tab_indicator.xml
@@ -3,16 +3,16 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.TextView xmlns:android="http://schemas.android.com/apk/res/android"
-                xmlns:gecko="http://schemas.android.com/apk/res-auto"
-                android:layout_width="wrap_content"
-                android:layout_height="fill_parent"
-                android:layout_weight="1.0"
-                android:gravity="center"
-                android:background="@drawable/awesomebar_tab_indicator"
-                android:padding="10dp"
-                android:singleLine="true"
-                android:ellipsize="marquee"
-                android:textSize="14sp"
-                android:textColor="@color/awesome_bar_title"
-                gecko:autoUpdateTheme="false"/>
+<org.mozilla.gecko.GeckoTextView xmlns:android="http://schemas.android.com/apk/res/android"
+                                 xmlns:gecko="http://schemas.android.com/apk/res-auto"
+                                 android:layout_width="wrap_content"
+                                 android:layout_height="fill_parent"
+                                 android:layout_weight="1.0"
+                                 android:gravity="center"
+                                 android:background="@drawable/awesomebar_tab_indicator"
+                                 android:padding="10dp"
+                                 android:singleLine="true"
+                                 android:ellipsize="marquee"
+                                 android:textSize="14sp"
+                                 android:textColor="@color/awesome_bar_title"
+                                 gecko:autoUpdateTheme="false"/>
diff --git a/mobile/android/base/resources/layout/browser_toolbar.xml b/mobile/android/base/resources/layout/browser_toolbar.xml
index bc67ab4fff6..84ccadc48c4 100644
--- a/mobile/android/base/resources/layout/browser_toolbar.xml
+++ b/mobile/android/base/resources/layout/browser_toolbar.xml
@@ -3,15 +3,8 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<org.mozilla.gecko.BrowserToolbarLayout xmlns:android="http://schemas.android.com/apk/res/android"
-              xmlns:gecko="http://schemas.android.com/apk/res-auto"
-              android:id="@+id/browser_toolbar"
-              style="@style/BrowserToolbar"
-              android:layout_centerVertical="true"
-              android:clipChildren="false"
-              android:clipToPadding="false"
-              android:clickable="true"
-              android:focusable="true">
+<merge xmlns:android="http://schemas.android.com/apk/res/android"
+       xmlns:gecko="http://schemas.android.com/apk/res-auto">
 
     <ImageButton android:id="@+id/back"
                  style="@style/AddressBar.ImageButton.Back"/>
@@ -55,32 +48,32 @@
     <LinearLayout android:id="@+id/menu_items"
                   style="@style/AddressBar.ImageButton.Unused"/>
 
-    <Gecko.ShapedButton android:id="@+id/menu"
-                        style="@style/AddressBar.ImageButton"
-                        android:layout_width="48dip"
-                        android:layout_alignParentRight="true"
-                        android:contentDescription="@string/menu"
-                        android:background="@drawable/shaped_button"
-                        android:visibility="gone"/>
+    <org.mozilla.gecko.ShapedButton android:id="@+id/menu"
+                                    style="@style/AddressBar.ImageButton"
+                                    android:layout_width="48dip"
+                                    android:layout_alignParentRight="true"
+                                    android:contentDescription="@string/menu"
+                                    android:background="@drawable/shaped_button"
+                                    android:visibility="gone"/>
 
-    <Gecko.ImageView android:id="@+id/menu_icon"
-                     style="@style/AddressBar.ImageButton"
-                     android:layout_alignLeft="@id/menu"
-                     android:layout_alignRight="@id/menu"
-                     android:gravity="center_vertical"
-                     android:src="@drawable/menu_level"
-                     android:visibility="gone"/>
+    <org.mozilla.gecko.GeckoImageView android:id="@+id/menu_icon"
+                                      style="@style/AddressBar.ImageButton"
+                                      android:layout_alignLeft="@id/menu"
+                                      android:layout_alignRight="@id/menu"
+                                      android:gravity="center_vertical"
+                                      android:src="@drawable/menu_level"
+                                      android:visibility="gone"/>
 
-    <Gecko.ShapedButton android:id="@+id/tabs"
-                        style="@style/AddressBar.ImageButton"
-                        android:layout_width="72dip"
-                        android:layout_toLeftOf="@id/menu"
-                        android:layout_alignWithParentIfMissing="true"
-                        gecko:curveTowards="right"
-                        android:background="@drawable/shaped_button"
-                        android:gravity="center_vertical"
-                        android:paddingLeft="37dip"
-                        android:paddingRight="11dip"/>
+    <org.mozilla.gecko.ShapedButton android:id="@+id/tabs"
+                                    style="@style/AddressBar.ImageButton"
+                                    android:layout_width="72dip"
+                                    android:layout_toLeftOf="@id/menu"
+                                    android:layout_alignWithParentIfMissing="true"
+                                    gecko:curveTowards="right"
+                                    android:background="@drawable/shaped_button"
+                                    android:gravity="center_vertical"
+                                    android:paddingLeft="37dip"
+                                    android:paddingRight="11dip"/>
 
     <!-- The TextSwitcher should be shifted 24dp on the left, to avoid
          the curve. On a 48dp space, centering 24dp image will leave
@@ -122,19 +115,19 @@
                      android:contentDescription="@string/site_security"
                      android:visibility="gone"/>
 
-        <Gecko.TextView android:id="@+id/awesome_bar_title"
-                        style="@style/AddressBar.Button"
-                        android:layout_width="fill_parent"
-                        android:layout_height="fill_parent"
-                        android:layout_weight="1.0"
-                        android:singleLine="true"
-                        android:paddingRight="8dp"
-                        android:textColor="@color/awesome_bar_title"
-                        android:textColorHint="@color/awesome_bar_title_hint"
-                        android:gravity="center_vertical|left"
-                        android:hint="@string/awesomebar_default_text"
-                        android:layout_gravity="center_vertical"
-                        gecko:autoUpdateTheme="false"/>
+        <org.mozilla.gecko.GeckoTextView android:id="@+id/awesome_bar_title"
+                                         style="@style/AddressBar.Button"
+                                         android:layout_width="fill_parent"
+                                         android:layout_height="fill_parent"
+                                         android:layout_weight="1.0"
+                                         android:singleLine="true"
+                                         android:paddingRight="8dp"
+                                         android:textColor="@color/awesome_bar_title"
+                                         android:textColorHint="@color/awesome_bar_title_hint"
+                                         android:gravity="center_vertical|left"
+                                         android:hint="@string/awesomebar_default_text"
+                                         android:layout_gravity="center_vertical"
+                                         gecko:autoUpdateTheme="false"/>
 
         <ImageButton android:id="@+id/reader"
                      style="@style/AddressBar.ImageButton.Icon"
@@ -158,4 +151,4 @@
                android:contentDescription="@null"
                android:visibility="gone"/>
 
-</org.mozilla.gecko.BrowserToolbarLayout>
+</merge>
diff --git a/mobile/android/base/resources/layout/gecko_app.xml b/mobile/android/base/resources/layout/gecko_app.xml
index ad8707a0cc7..15fdf896820 100644
--- a/mobile/android/base/resources/layout/gecko_app.xml
+++ b/mobile/android/base/resources/layout/gecko_app.xml
@@ -35,9 +35,15 @@
                                          style="@style/FindBar"
                                          android:visibility="gone"/>
 
-        <include layout="@layout/browser_toolbar"
-                 android:layout_width="fill_parent"
-                 android:layout_height="@dimen/browser_toolbar_height"/>
+        <org.mozilla.gecko.BrowserToolbar android:id="@+id/browser_toolbar"
+                style="@style/BrowserToolbar"
+                android:layout_width="fill_parent"
+                android:layout_height="@dimen/browser_toolbar_height"
+                android:clipChildren="false"
+                android:clipToPadding="false"
+                android:clickable="true"
+                android:focusable="true"/>
+
     </view>
 
     <LinearLayout android:id="@+id/toast"
diff --git a/mobile/android/base/resources/layout/remote_tabs_group.xml b/mobile/android/base/resources/layout/remote_tabs_group.xml
index 45f040094a7..43c49a586db 100644
--- a/mobile/android/base/resources/layout/remote_tabs_group.xml
+++ b/mobile/android/base/resources/layout/remote_tabs_group.xml
@@ -3,14 +3,14 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.AllCapsTextView xmlns:android="http://schemas.android.com/apk/res/android"
-                       android:id="@+id/client"
-                       android:layout_width="fill_parent"
-                       android:layout_height="@dimen/remote_tab_group_row_height"
-                       style="@style/TabRowTextAppearance.Url"
-                       android:background="@android:color/transparent"
-                       android:paddingLeft="4dp"
-                       android:paddingRight="4dp"
-                       android:textStyle="bold"
-                       android:textSize="14sp"
-                       android:gravity="center_vertical"/>
+<org.mozilla.gecko.AllCapsTextView xmlns:android="http://schemas.android.com/apk/res/android"
+                                   android:id="@+id/client"
+                                   android:layout_width="fill_parent"
+                                   android:layout_height="@dimen/remote_tab_group_row_height"
+                                   style="@style/TabRowTextAppearance.Url"
+                                   android:background="@android:color/transparent"
+                                   android:paddingLeft="4dp"
+                                   android:paddingRight="4dp"
+                                   android:textStyle="bold"
+                                   android:textSize="14sp"
+                                   android:gravity="center_vertical"/>
diff --git a/mobile/android/base/resources/layout/tabs_counter.xml b/mobile/android/base/resources/layout/tabs_counter.xml
index 57ac244626b..44b1b850cec 100644
--- a/mobile/android/base/resources/layout/tabs_counter.xml
+++ b/mobile/android/base/resources/layout/tabs_counter.xml
@@ -3,15 +3,15 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.TextView xmlns:android="http://schemas.android.com/apk/res/android"
-                android:layout_width="24dip"
-                android:layout_height="24dip"
-                android:layout_margin="12dip"
-                android:paddingTop="2dip"
-                android:paddingLeft="4dip"
-                android:background="@drawable/tabs_count_foreground"
-                android:textAppearance="@style/TextAppearance.Micro"
-                android:textColor="#FF43484E"
-                android:textStyle="bold"
-                android:duplicateParentState="true"
-                android:gravity="center"/>
+<org.mozilla.gecko.GeckoTextView xmlns:android="http://schemas.android.com/apk/res/android"
+                                 android:layout_width="24dip"
+                                 android:layout_height="24dip"
+                                 android:layout_margin="12dip"
+                                 android:paddingTop="2dip"
+                                 android:paddingLeft="4dip"
+                                 android:background="@drawable/tabs_count_foreground"
+                                 android:textAppearance="@style/TextAppearance.Micro"
+                                 android:textColor="#FF43484E"
+                                 android:textStyle="bold"
+                                 android:duplicateParentState="true"
+                                 android:gravity="center"/>
diff --git a/mobile/android/base/resources/layout/tabs_item_cell.xml b/mobile/android/base/resources/layout/tabs_item_cell.xml
index 090f2d05125..6bff41e19ee 100644
--- a/mobile/android/base/resources/layout/tabs_item_cell.xml
+++ b/mobile/android/base/resources/layout/tabs_item_cell.xml
@@ -3,17 +3,17 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.TabRow xmlns:android="http://schemas.android.com/apk/res/android"
-              style="@style/TabsItem"
-              android:focusable="true"
-              android:id="@+id/info"
-              android:layout_width="fill_parent"
-              android:layout_height="wrap_content"
-              android:paddingTop="6dip"
-              android:paddingBottom="6dip"
-              android:paddingLeft="1dip"
-              android:paddingRight="1dip"
-              android:gravity="center">
+<org.mozilla.gecko.widget.TabRow xmlns:android="http://schemas.android.com/apk/res/android"
+                                 style="@style/TabsItem"
+                                 android:focusable="true"
+                                 android:id="@+id/info"
+                                 android:layout_width="fill_parent"
+                                 android:layout_height="wrap_content"
+                                 android:paddingTop="6dip"
+                                 android:paddingBottom="6dip"
+                                 android:paddingLeft="1dip"
+                                 android:paddingRight="1dip"
+                                 android:gravity="center">
 
     <RelativeLayout android:layout_width="wrap_content"
                     android:layout_height="wrap_content"
@@ -22,11 +22,10 @@
                     android:background="@drawable/tab_thumbnail"
                     android:duplicateParentState="true">
 
-        <Gecko.ThumbnailView android:id="@+id/thumbnail"
-                             android:layout_width="@dimen/tab_thumbnail_width"
-                             android:layout_height="@dimen/tab_thumbnail_height"
-                             android:src="@drawable/tab_thumbnail_default"/>
-
+        <org.mozilla.gecko.widget.ThumbnailView android:id="@+id/thumbnail"
+                                                android:layout_width="@dimen/tab_thumbnail_width"
+                                                android:layout_height="@dimen/tab_thumbnail_height"
+                                                android:src="@drawable/tab_thumbnail_default"/>
 
         <LinearLayout android:layout_width="@dimen/tab_thumbnail_width"
                       android:layout_height="wrap_content"
@@ -59,4 +58,4 @@
 
     </RelativeLayout>
 
-</Gecko.TabRow>
+</org.mozilla.gecko.widget.TabRow>
diff --git a/mobile/android/base/resources/layout/tabs_item_row.xml b/mobile/android/base/resources/layout/tabs_item_row.xml
index 121e3e19a02..4dfa92c7c99 100644
--- a/mobile/android/base/resources/layout/tabs_item_row.xml
+++ b/mobile/android/base/resources/layout/tabs_item_row.xml
@@ -3,16 +3,16 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
-<Gecko.TabRow xmlns:android="http://schemas.android.com/apk/res/android"
-              style="@style/TabsItem"
-              android:focusable="true"
-              android:id="@+id/info"
-              android:layout_width="fill_parent"
-              android:layout_height="wrap_content"
-              android:paddingLeft="12dip"
-              android:paddingTop="6dip"
-              android:paddingBottom="6dip"
-              android:background="@drawable/tab_row">
+<org.mozilla.gecko.widget.TabRow xmlns:android="http://schemas.android.com/apk/res/android"
+                                 style="@style/TabsItem"
+                                 android:focusable="true"
+                                 android:id="@+id/info"
+                                 android:layout_width="fill_parent"
+                                 android:layout_height="wrap_content"
+                                 android:paddingLeft="12dip"
+                                 android:paddingTop="6dip"
+                                 android:paddingBottom="6dip"
+                                 android:background="@drawable/tab_row">
 
     <LinearLayout android:layout_width="wrap_content"
                   android:layout_height="wrap_content"
@@ -20,10 +20,10 @@
                   android:background="@drawable/tab_thumbnail"
                   android:duplicateParentState="true">
 
-        <Gecko.ThumbnailView android:id="@+id/thumbnail"
-                             android:layout_width="@dimen/tab_thumbnail_width"
-                             android:layout_height="@dimen/tab_thumbnail_height"
-                             android:src="@drawable/tab_thumbnail_default"/>
+        <org.mozilla.gecko.widget.ThumbnailView android:id="@+id/thumbnail"
+                                                android:layout_width="@dimen/tab_thumbnail_width"
+                                                android:layout_height="@dimen/tab_thumbnail_height"
+                                                android:src="@drawable/tab_thumbnail_default"/>
 
     </LinearLayout>
 
@@ -50,4 +50,4 @@
                  android:contentDescription="@string/close_tab"
                  android:src="@drawable/tab_close"/>
 
-</Gecko.TabRow>
+</org.mozilla.gecko.widget.TabRow>
diff --git a/mobile/android/base/resources/layout/tabs_panel_header.xml b/mobile/android/base/resources/layout/tabs_panel_header.xml
index 36aff0cab5a..2b3f3478913 100644
--- a/mobile/android/base/resources/layout/tabs_panel_header.xml
+++ b/mobile/android/base/resources/layout/tabs_panel_header.xml
@@ -5,11 +5,11 @@
 
 <merge xmlns:android="http://schemas.android.com/apk/res/android">
 
-    <Gecko.IconTabWidget android:id="@+id/tab_widget"
-                         android:layout_width="wrap_content"
-                         android:layout_height="fill_parent"
-                         android:tabStripEnabled="false"
-                         android:divider="@drawable/tab_indicator_divider"/>
+    <org.mozilla.gecko.widget.IconTabWidget android:id="@+id/tab_widget"
+                                            android:layout_width="wrap_content"
+                                            android:layout_height="fill_parent"
+                                            android:tabStripEnabled="false"
+                                            android:divider="@drawable/tab_indicator_divider"/>
 
     <View android:layout_width="0dip"
           android:layout_height="fill_parent"
diff --git a/mobile/android/base/sync/CollectionKeys.java b/mobile/android/base/sync/CollectionKeys.java
index ec49b350253..6485ed4357c 100644
--- a/mobile/android/base/sync/CollectionKeys.java
+++ b/mobile/android/base/sync/CollectionKeys.java
@@ -109,6 +109,9 @@ public class CollectionKeys {
    */
   public void setKeyPairsFromWBO(CryptoRecord keys, KeyBundle syncKeyBundle)
       throws CryptoException, IOException, ParseException, NonObjectJSONException {
+    if (keys == null) {
+      throw new IllegalArgumentException("cannot set key pairs from null record");
+    }
     if (syncKeyBundle != null) {
       keys.keyBundle = syncKeyBundle;
       keys.decrypt();
diff --git a/mobile/android/base/sync/CryptoRecord.java b/mobile/android/base/sync/CryptoRecord.java
index 7140c145a82..14b8954b106 100644
--- a/mobile/android/base/sync/CryptoRecord.java
+++ b/mobile/android/base/sync/CryptoRecord.java
@@ -16,6 +16,7 @@ import org.mozilla.gecko.sync.crypto.KeyBundle;
 import org.mozilla.gecko.sync.crypto.MissingCryptoInputException;
 import org.mozilla.gecko.sync.crypto.NoKeyBundleException;
 import org.mozilla.gecko.sync.repositories.domain.Record;
+import org.mozilla.gecko.sync.repositories.domain.RecordParseException;
 
 /**
  * A Sync crypto record has:
@@ -128,7 +129,7 @@ public class CryptoRecord extends Record {
    * @throws IOException
    */
   public static CryptoRecord fromJSONRecord(String jsonRecord)
-      throws ParseException, NonObjectJSONException, IOException {
+      throws ParseException, NonObjectJSONException, IOException, RecordParseException {
     byte[] bytes = jsonRecord.getBytes("UTF-8");
     ExtendedJSONObject object = ExtendedJSONObject.parseUTF8AsJSONObject(bytes);
 
@@ -137,7 +138,7 @@ public class CryptoRecord extends Record {
 
   // TODO: defensive programming.
   public static CryptoRecord fromJSONRecord(ExtendedJSONObject jsonRecord)
-      throws IOException, ParseException, NonObjectJSONException {
+      throws IOException, ParseException, NonObjectJSONException, RecordParseException {
     String id                  = (String) jsonRecord.get(KEY_ID);
     String collection          = (String) jsonRecord.get(KEY_COLLECTION);
     String jsonEncodedPayload  = (String) jsonRecord.get(KEY_PAYLOAD);
@@ -148,15 +149,29 @@ public class CryptoRecord extends Record {
     record.guid         = id;
     record.collection   = collection;
     if (jsonRecord.containsKey(KEY_MODIFIED)) {
-      record.lastModified = jsonRecord.getTimestamp(KEY_MODIFIED);
+      Long timestamp = jsonRecord.getTimestamp(KEY_MODIFIED);
+      if (timestamp == null) {
+        throw new RecordParseException("timestamp could not be parsed");
+      }
+      record.lastModified = timestamp.longValue();
     }
     if (jsonRecord.containsKey(KEY_SORTINDEX)) {
-      record.sortIndex = jsonRecord.getLong(KEY_SORTINDEX);
+      // getLong tries to cast to Long, and might return null. We catch all
+      // exceptions, just to be safe.
+      try {
+        record.sortIndex = jsonRecord.getLong(KEY_SORTINDEX);
+      } catch (Exception e) {
+        throw new RecordParseException("timestamp could not be parsed");
+      }
     }
     if (jsonRecord.containsKey(KEY_TTL)) {
       // TTLs are never returned by the sync server, so should never be true if
       // the record was fetched.
-      record.ttl = jsonRecord.getLong(KEY_TTL);
+      try {
+        record.ttl = jsonRecord.getLong(KEY_TTL);
+      } catch (Exception e) {
+        throw new RecordParseException("TTL could not be parsed");
+      }
     }
     // TODO: deleted?
     return record;
diff --git a/mobile/android/base/sync/MetaGlobal.java b/mobile/android/base/sync/MetaGlobal.java
index b1efc698306..99baeb83af7 100644
--- a/mobile/android/base/sync/MetaGlobal.java
+++ b/mobile/android/base/sync/MetaGlobal.java
@@ -93,6 +93,9 @@ public class MetaGlobal implements SyncStorageRequestDelegate {
   }
 
   public void setFromRecord(CryptoRecord record) throws IllegalStateException, IOException, ParseException, NonObjectJSONException {
+    if (record == null) {
+      throw new IllegalArgumentException("Cannot set meta/global from null record");
+    }
     Logger.debug(LOG_TAG, "meta/global is " + record.payload.toJSONString());
     this.storageVersion = (Long) record.payload.get("storageVersion");
     this.syncID = (String) record.payload.get("syncID");
diff --git a/mobile/android/base/sync/repositories/domain/RecordParseException.java b/mobile/android/base/sync/repositories/domain/RecordParseException.java
new file mode 100644
index 00000000000..0d8fe90b2e7
--- /dev/null
+++ b/mobile/android/base/sync/repositories/domain/RecordParseException.java
@@ -0,0 +1,14 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.sync.repositories.domain;
+
+
+public class RecordParseException extends Exception {
+  private static final long serialVersionUID = -5145494854722254491L;
+
+  public RecordParseException(String detailMessage) {
+    super(detailMessage);
+  }
+}
diff --git a/mobile/android/base/sync/stage/EnsureCrypto5KeysStage.java b/mobile/android/base/sync/stage/EnsureCrypto5KeysStage.java
index 5b09a232f69..46cef489fc1 100644
--- a/mobile/android/base/sync/stage/EnsureCrypto5KeysStage.java
+++ b/mobile/android/base/sync/stage/EnsureCrypto5KeysStage.java
@@ -4,20 +4,16 @@
 
 package org.mozilla.gecko.sync.stage;
 
-import java.io.IOException;
 import java.net.URISyntaxException;
 import java.util.HashSet;
 import java.util.Set;
 
-import org.json.simple.parser.ParseException;
 import org.mozilla.gecko.background.common.log.Logger;
 import org.mozilla.gecko.sync.CollectionKeys;
 import org.mozilla.gecko.sync.CryptoRecord;
 import org.mozilla.gecko.sync.ExtendedJSONObject;
 import org.mozilla.gecko.sync.InfoCollections;
 import org.mozilla.gecko.sync.NoCollectionKeysSetException;
-import org.mozilla.gecko.sync.NonObjectJSONException;
-import org.mozilla.gecko.sync.crypto.CryptoException;
 import org.mozilla.gecko.sync.crypto.KeyBundle;
 import org.mozilla.gecko.sync.crypto.PersistedCrypto5Keys;
 import org.mozilla.gecko.sync.net.SyncStorageRecordRequest;
@@ -136,22 +132,9 @@ implements SyncStorageRequestDelegate {
         Logger.pii(LOG_TAG, "Fetched keys: " + body.toJSONString());
       }
       keys.setKeyPairsFromWBO(CryptoRecord.fromJSONRecord(body), session.config.syncKeyBundle);
-    } catch (IllegalStateException e) {
+    } catch (Exception e) {
       session.abort(e, "Invalid keys WBO.");
       return;
-    } catch (ParseException e) {
-      session.abort(e, "Invalid keys WBO.");
-      return;
-    } catch (NonObjectJSONException e) {
-      session.abort(e, "Invalid keys WBO.");
-      return;
-    } catch (IOException e) {
-      // Some kind of lower-level error.
-      session.abort(e, "IOException fetching keys.");
-      return;
-    } catch (CryptoException e) {
-      session.abort(e, "CryptoException handling keys WBO.");
-      return;
     }
 
     PersistedCrypto5Keys pck = session.config.persistedCryptoKeys();
diff --git a/mobile/android/services/java-sources.mn b/mobile/android/services/java-sources.mn
index 12084092194..c7e37bf0ff2 100644
--- a/mobile/android/services/java-sources.mn
+++ b/mobile/android/services/java-sources.mn
@@ -184,6 +184,7 @@ sync/repositories/domain/HistoryRecord.java
 sync/repositories/domain/HistoryRecordFactory.java
 sync/repositories/domain/PasswordRecord.java
 sync/repositories/domain/Record.java
+sync/repositories/domain/RecordParseException.java
 sync/repositories/domain/TabsRecord.java
 sync/repositories/domain/VersionConstants.java
 sync/repositories/FetchFailedException.java
diff --git a/netwerk/base/public/nsIProtocolProxyService2.idl b/netwerk/base/public/nsIProtocolProxyService2.idl
index 22b1a0a6a90..cb39a33aaab 100644
--- a/netwerk/base/public/nsIProtocolProxyService2.idl
+++ b/netwerk/base/public/nsIProtocolProxyService2.idl
@@ -9,7 +9,7 @@
 /**
  * An extension of nsIProtocolProxyService
  */
-[scriptable, uuid(bed3702d-9374-4804-a20f-32baed8e2954)]
+[scriptable, uuid(bb52e571-4a0e-4363-83d0-52034910dd14)]
 interface nsIProtocolProxyService2 : nsIProtocolProxyService
 {
   /**
@@ -26,4 +26,13 @@ interface nsIProtocolProxyService2 : nsIProtocolProxyService
    * No documentation - it is deprecated!
    **/
   nsIProxyInfo deprecatedBlockingResolve(in nsIURI aURI, in unsigned long aFlags);
+
+    /**
+     * This method is identical to asyncResolve() except it may execute the
+     * callback function immediately (i.e from the stack of asyncResolve2()) if
+     * it is immediately ready to run. The nsICancelable return value will be
+     * null in that case.
+     */
+  nsICancelable asyncResolve2(in nsIURI aURI, in unsigned long aFlags,
+                              in nsIProtocolProxyCallback aCallback);
 };
diff --git a/netwerk/base/src/nsProtocolProxyService.cpp b/netwerk/base/src/nsProtocolProxyService.cpp
index b7f240ce59b..19e1d6fc412 100644
--- a/netwerk/base/src/nsProtocolProxyService.cpp
+++ b/netwerk/base/src/nsProtocolProxyService.cpp
@@ -1087,15 +1087,16 @@ nsProtocolProxyService::DeprecatedBlockingResolve(nsIURI *aURI,
     return NS_OK;
 }
 
-// nsIProtocolProxyService
-NS_IMETHODIMP
-nsProtocolProxyService::AsyncResolve(nsIURI *uri, uint32_t flags,
-                                     nsIProtocolProxyCallback *callback,
-                                     nsICancelable **result)
+nsresult
+nsProtocolProxyService::AsyncResolveInternal(nsIURI *uri, uint32_t flags,
+                                             nsIProtocolProxyCallback *callback,
+                                             nsICancelable **result,
+                                             bool isSyncOK)
 {
     NS_ENSURE_ARG_POINTER(uri);
     NS_ENSURE_ARG_POINTER(callback);
 
+    *result = nullptr;
     nsRefPtr<nsAsyncResolveRequest> ctx =
         new nsAsyncResolveRequest(this, uri, flags, callback);
 
@@ -1119,19 +1120,42 @@ nsProtocolProxyService::AsyncResolve(nsIURI *uri, uint32_t flags,
         // we can do it locally
         ApplyFilters(uri, info, pi);
         ctx->SetResult(NS_OK, pi);
-        return ctx->DispatchCallback();
+        if (isSyncOK) {
+            ctx->Run();
+            return NS_OK;
+        }
+
+        rv = ctx->DispatchCallback();
+        if (NS_SUCCEEDED(rv))
+            ctx.forget(result);
+        return rv;
     }
 
     // else kick off a PAC thread query
 
     rv = mPACMan->AsyncGetProxyForURI(uri, ctx, true);
-    if (NS_SUCCEEDED(rv)) {
-        *result = ctx;
-        NS_ADDREF(*result);
-    }
+    if (NS_SUCCEEDED(rv))
+        ctx.forget(result);
     return rv;
 }
 
+// nsIProtocolProxyService
+NS_IMETHODIMP
+nsProtocolProxyService::AsyncResolve2(nsIURI *uri, uint32_t flags,
+                                      nsIProtocolProxyCallback *callback,
+                                      nsICancelable **result)
+{
+    return AsyncResolveInternal(uri, flags, callback, result, true);
+}
+
+NS_IMETHODIMP
+nsProtocolProxyService::AsyncResolve(nsIURI *uri, uint32_t flags,
+                                     nsIProtocolProxyCallback *callback,
+                                     nsICancelable **result)
+{
+    return AsyncResolveInternal(uri, flags, callback, result, false);
+}
+
 NS_IMETHODIMP
 nsProtocolProxyService::NewProxyInfo(const nsACString &aType,
                                      const nsACString &aHost,
diff --git a/netwerk/base/src/nsProtocolProxyService.h b/netwerk/base/src/nsProtocolProxyService.h
index 35ec5c26c8a..64aeba447c5 100644
--- a/netwerk/base/src/nsProtocolProxyService.h
+++ b/netwerk/base/src/nsProtocolProxyService.h
@@ -363,6 +363,13 @@ protected:
     PRTime                       mSessionStart;
     nsFailedProxyTable           mFailedProxies;
     int32_t                      mFailedProxyTimeout;
+
+private:
+    nsresult AsyncResolveInternal(nsIURI *uri, uint32_t flags,
+                                  nsIProtocolProxyCallback *callback,
+                                  nsICancelable **result,
+                                  bool isSyncOK);
+
 };
 
 #endif // !nsProtocolProxyService_h__
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 24dd2ed1e0e..8b874362582 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -19,6 +19,7 @@
 #include "nsIStreamListenerTee.h"
 #include "nsISeekableStream.h"
 #include "nsILoadGroupChild.h"
+#include "nsIProtocolProxyService2.h"
 #include "nsMimeTypes.h"
 #include "nsNetUtil.h"
 #include "prprf.h"
@@ -1775,8 +1776,19 @@ nsHttpChannel::ResolveProxy()
     if (NS_FAILED(rv))
         return rv;
 
-    return pps->AsyncResolve(mProxyURI ? mProxyURI : mURI, mProxyResolveFlags,
-                             this, getter_AddRefs(mProxyRequest));
+    // using the nsIProtocolProxyService2 allows a minor performance
+    // optimization, but if an add-on has only provided the original interface
+    // then it is ok to use that version.
+    nsCOMPtr<nsIProtocolProxyService2> pps2 = do_QueryInterface(pps);
+    if (pps2) {
+        rv = pps2->AsyncResolve2(mProxyURI ? mProxyURI : mURI, mProxyResolveFlags,
+                                 this, getter_AddRefs(mProxyRequest));
+    } else {
+        rv = pps->AsyncResolve(mProxyURI ? mProxyURI : mURI, mProxyResolveFlags,
+                               this, getter_AddRefs(mProxyRequest));
+    }
+
+    return rv;
 }
 
 bool
@@ -2237,12 +2249,12 @@ nsHttpChannel::ProcessFallback(bool *waitingForRedirectCallback)
     // fallback.
     if (mOfflineCacheEntry) {
         mOfflineCacheEntry->AsyncDoom(nullptr);
-        mOfflineCacheEntry = 0;
+        mOfflineCacheEntry = nullptr;
         mOfflineCacheAccess = 0;
     }
 
     mApplicationCacheForWrite = nullptr;
-    mOfflineCacheEntry = 0;
+    mOfflineCacheEntry = nullptr;
     mOfflineCacheAccess = 0;
 
     // Close the current cache entry.
@@ -3566,8 +3578,8 @@ nsHttpChannel::CloseCacheEntry(bool doomOnFailure)
 
     mCachedResponseHead = nullptr;
 
-    mCachePump = 0;
-    mCacheEntry = 0;
+    mCachePump = nullptr;
+    mCacheEntry = nullptr;
     mCacheAccess = 0;
     mInitedCacheEntry = false;
 }
@@ -3590,7 +3602,7 @@ nsHttpChannel::CloseOfflineCacheEntry()
             mOfflineCacheEntry->AsyncDoom(nullptr);
     }
 
-    mOfflineCacheEntry = 0;
+    mOfflineCacheEntry = nullptr;
     mOfflineCacheAccess = 0;
 }
 
@@ -5015,7 +5027,7 @@ nsHttpChannel::OnStopRequest(nsIRequest *request, nsISupports *ctxt, nsresult st
         // at this point, we're done with the transaction
         mTransactionTimings = mTransaction->Timings();
         mTransaction = nullptr;
-        mTransactionPump = 0;
+        mTransactionPump = nullptr;
 
         // We no longer need the dns prefetch object
         if (mDNSPrefetch && mDNSPrefetch->TimingsValid()) {
diff --git a/testing/marionette/client/marionette/__init__.py b/testing/marionette/client/marionette/__init__.py
index e86e22de596..8700636e9db 100644
--- a/testing/marionette/client/marionette/__init__.py
+++ b/testing/marionette/client/marionette/__init__.py
@@ -4,7 +4,7 @@
 
 from gestures import *
 from marionette import Marionette, HTMLElement, Actions, MultiActions
-from marionette_test import MarionetteTestCase, CommonTestCase
+from marionette_test import MarionetteTestCase, CommonTestCase, expectedFailure, skip, SkipTest
 from emulator import Emulator
 from runtests import MarionetteTestResult
 from runtests import MarionetteTestRunner
diff --git a/testing/marionette/client/marionette/marionette_test.py b/testing/marionette/client/marionette/marionette_test.py
index 258f6a28853..d85ee56e21e 100644
--- a/testing/marionette/client/marionette/marionette_test.py
+++ b/testing/marionette/client/marionette/marionette_test.py
@@ -5,15 +5,69 @@
 import imp
 import os
 import re
+import functools
 import sys
 import time
 import types
 import unittest
 import weakref
+import warnings
 
 from errors import *
 from marionette import HTMLElement, Marionette
 
+class SkipTest(Exception):
+    """
+    Raise this exception in a test to skip it.
+
+    Usually you can use TestResult.skip() or one of the skipping decorators
+    instead of raising this directly.
+    """
+    pass
+
+class _ExpectedFailure(Exception):
+    """
+    Raise this when a test is expected to fail.
+
+    This is an implementation detail.
+    """
+
+    def __init__(self, exc_info):
+        super(_ExpectedFailure, self).__init__()
+        self.exc_info = exc_info
+
+class _UnexpectedSuccess(Exception):
+    """
+    The test was supposed to fail, but it didn't!
+    """
+    pass
+
+def skip(reason):
+    """
+    Unconditionally skip a test.
+    """
+    def decorator(test_item):
+        if not isinstance(test_item, (type, types.ClassType)):
+            @functools.wraps(test_item)
+            def skip_wrapper(*args, **kwargs):
+                raise SkipTest(reason)
+            test_item = skip_wrapper
+
+        test_item.__unittest_skip__ = True
+        test_item.__unittest_skip_why__ = reason
+        return test_item
+    return decorator
+
+def expectedFailure(func):
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        try:
+            func(*args, **kwargs)
+        except Exception:
+            raise _ExpectedFailure(sys.exc_info())
+        raise _UnexpectedSuccess
+    return wrapper
+
 def skip_if_b2g(target):
     def wrapper(self, *args, **kwargs):
         if not hasattr(self.marionette, 'b2g') or not self.marionette.b2g:
@@ -25,12 +79,22 @@ def skip_if_b2g(target):
 class CommonTestCase(unittest.TestCase):
 
     match_re = None
+    failureException = AssertionError
 
     def __init__(self, methodName):
         unittest.TestCase.__init__(self, methodName)
         self.loglines = None
         self.duration = 0
 
+    def _addSkip(self, result, reason):
+        addSkip = getattr(result, 'addSkip', None)
+        if addSkip is not None:
+            addSkip(self, reason)
+        else:
+            warnings.warn("TestResult has no addSkip method, skips not reported",
+                          RuntimeWarning, 2)
+            result.addSuccess(self)
+
     def run(self, result=None):
         orig_result = result
         if result is None:
@@ -39,14 +103,25 @@ class CommonTestCase(unittest.TestCase):
             if startTestRun is not None:
                 startTestRun()
 
-        self._resultForDoCleanups = result
         result.startTest(self)
 
         testMethod = getattr(self, self._testMethodName)
+        if (getattr(self.__class__, "__unittest_skip__", False) or
+            getattr(testMethod, "__unittest_skip__", False)):
+            # If the class or method was skipped.
+            try:
+                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
+                            or getattr(testMethod, '__unittest_skip_why__', ''))
+                self._addSkip(result, skip_why)
+            finally:
+                result.stopTest(self)
+            return
         try:
             success = False
             try:
                 self.setUp()
+            except SkipTest as e:
+                self._addSkip(result, str(e))
             except KeyboardInterrupt:
                 raise
             except:
@@ -54,10 +129,30 @@ class CommonTestCase(unittest.TestCase):
             else:
                 try:
                     testMethod()
+                except self.failureException:
+                    result.addFailure(self, sys.exc_info())
                 except KeyboardInterrupt:
                     raise
-                except AssertionError:
+                except self.failureException:
                     result.addFailure(self, sys.exc_info())
+                except _ExpectedFailure as e:
+                    addExpectedFailure = getattr(result, 'addExpectedFailure', None)
+                    if addExpectedFailure is not None:
+                        addExpectedFailure(self, e.exc_info)
+                    else:
+                        warnings.warn("TestResult has no addExpectedFailure method, reporting as passes",
+                                      RuntimeWarning)
+                        result.addSuccess(self)
+                except _UnexpectedSuccess:
+                    addUnexpectedSuccess = getattr(result, 'addUnexpectedSuccess', None)
+                    if addUnexpectedSuccess is not None:
+                        addUnexpectedSuccess(self)
+                    else:
+                        warnings.warn("TestResult has no addUnexpectedSuccess method, reporting as failures",
+                                      RuntimeWarning)
+                        result.addFailure(self, sys.exc_info())
+                except SkipTest as e:
+                    self._addSkip(result, str(e))
                 except:
                     result.addError(self, sys.exc_info())
                 else:
diff --git a/testing/marionette/client/marionette/runtests.py b/testing/marionette/client/marionette/runtests.py
index adab8553c88..87ce5db40b1 100644
--- a/testing/marionette/client/marionette/runtests.py
+++ b/testing/marionette/client/marionette/runtests.py
@@ -16,6 +16,7 @@ import traceback
 import platform
 import moznetwork
 import xml.dom.minidom as dom
+from functools import wraps
 
 from manifestparser import TestManifest
 from mozhttpd import MozHttpd
@@ -32,6 +33,9 @@ class MarionetteTestResult(unittest._TextTestResult):
         del kwargs['marionette']
         super(MarionetteTestResult, self).__init__(*args, **kwargs)
         self.passed = 0
+        self.skipped = []
+        self.expectedFailures = []
+        self.unexpectedSuccesses = []
         self.tests_passed = []
 
     def addSuccess(self, test):
@@ -39,6 +43,33 @@ class MarionetteTestResult(unittest._TextTestResult):
         self.passed += 1
         self.tests_passed.append(test)
 
+    def addExpectedFailure(self, test, err):
+        """Called when an expected failure/error occured."""
+        self.expectedFailures.append(
+            (test, self._exc_info_to_string(err, test)))
+        if self.showAll:
+            self.stream.writeln("expected failure")
+        elif self.dots:
+            self.stream.write("x")
+            self.stream.flush()
+
+    def addUnexpectedSuccess(self, test):
+        """Called when a test was expected to fail, but succeed."""
+        self.unexpectedSuccesses.append(test)
+        if self.showAll:
+            self.stream.writeln("unexpected success")
+        elif self.dots:
+            self.stream.write("u")
+            self.stream.flush()
+
+    def addSkip(self, test, reason):
+        self.skipped.append((test, reason))
+        if self.showAll:
+            self.stream.writeln("skipped {0!r}".format(reason))
+        elif self.dots:
+            self.stream.write("s")
+            self.stream.flush()
+
     def getInfo(self, test):
         return test.test_name
 
@@ -491,14 +522,16 @@ class MarionetteTestRunner(object):
 
             self.failed += len(results.failures) + len(results.errors)
             if hasattr(results, 'skipped'):
-                self.todo += len(results.skipped) + len(results.expectedFailures)
+                self.todo += len(results.skipped)
             self.passed += results.passed
             for failure in results.failures + results.errors:
                 self.failures.append((results.getInfo(failure[0]), failure[1], 'TEST-UNEXPECTED-FAIL'))
-            if hasattr(results, 'unexpectedSuccess'):
+            if hasattr(results, 'unexpectedSuccesses'):
                 self.failed += len(results.unexpectedSuccesses)
                 for failure in results.unexpectedSuccesses:
-                    self.failures.append((results.getInfo(failure[0]), failure[1], 'TEST-UNEXPECTED-PASS'))
+                    self.failures.append((results.getInfo(failure), 'TEST-UNEXPECTED-PASS'))
+            if hasattr(results, 'expectedFailures'):
+                self.passed += len(results.expectedFailures)
 
     def register_handlers(self):
         self.test_handlers.extend([MarionetteTestCase, MarionetteJSTestCase])
diff --git a/testing/marionette/client/marionette/tests/unit/test_report.py b/testing/marionette/client/marionette/tests/unit/test_report.py
new file mode 100644
index 00000000000..fed48aea1b4
--- /dev/null
+++ b/testing/marionette/client/marionette/tests/unit/test_report.py
@@ -0,0 +1,30 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import unittest
+from marionette_test import MarionetteTestCase, expectedFailure, skip
+
+
+class TestReport(MarionetteTestCase):
+
+    def test_pass(self):
+        assert True
+
+    def test_fail(self):
+        assert False
+
+    @skip('Skip Message')
+    def test_skip(self):
+        assert False
+
+    @expectedFailure
+    def test_expected_fail(self):
+        assert False
+
+    @expectedFailure
+    def test_unexpected_pass(self):
+        assert True
+
+    def test_error(self):
+        raise Exception()
diff --git a/toolkit/components/filepicker/Makefile.in b/toolkit/components/filepicker/Makefile.in
index c87e4a1d465..2cd7640bfa1 100644
--- a/toolkit/components/filepicker/Makefile.in
+++ b/toolkit/components/filepicker/Makefile.in
@@ -18,7 +18,6 @@ IS_COMPONENT = 1
 MODULE_NAME = nsFileViewModule
 LIBXUL_LIBRARY = 1
 DISABLED_EXTRA_COMPONENTS = nsFilePicker.js
-DISABLED_EXTRA_PP_COMPONENTS = nsFilePicker.manifest
 endif
 endif
 
diff --git a/toolkit/components/prompts/src/nsPrompter.js b/toolkit/components/prompts/src/nsPrompter.js
index 33bf71e7be7..6aa55d6c6c3 100644
--- a/toolkit/components/prompts/src/nsPrompter.js
+++ b/toolkit/components/prompts/src/nsPrompter.js
@@ -377,7 +377,7 @@ function openModalWindow(domWin, uri, args) {
         // a domWin was passed, so we can apply the check for it being hidden.
         let winUtils = domWin.QueryInterface(Ci.nsIInterfaceRequestor)
                              .getInterface(Ci.nsIDOMWindowUtils);
-        if (!winUtils.isParentWindowMainWidgetVisible) {
+        if (winUtils && !winUtils.isParentWindowMainWidgetVisible) {
             throw Components.Exception("Cannot call openModalWindow on a hidden window",
                                        Cr.NS_ERROR_NOT_AVAILABLE);
         }
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 5d23214d4b8..0bb5bafac4d 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -3633,5 +3633,10 @@
   "BROWSER_IS_USER_DEFAULT": {
     "kind": "boolean",
     "description": "The result of the startup default desktop browser check."
+  },
+  "MIXED_CONTENT_PAGE_LOAD": {
+    "kind": "enumerated",
+    "n_values": 4,
+    "description": "Accumulates type of content (mixed, mixed passive, unmixed) per page load"
   }
 }
diff --git a/toolkit/content/tests/widgets/Makefile.in b/toolkit/content/tests/widgets/Makefile.in
index 00bf3b1d07c..53115dae7b3 100644
--- a/toolkit/content/tests/widgets/Makefile.in
+++ b/toolkit/content/tests/widgets/Makefile.in
@@ -47,6 +47,7 @@ MOCHITEST_CHROME_FILES = \
 		tree_shared.js \
 		test_tree_column_reorder.xul \
 		test_editor_currentURI.xul \
+		test_popupreflows.xul \
 		$(NULL)
 
 ifneq (cocoa,$(MOZ_WIDGET_TOOLKIT))
diff --git a/toolkit/content/tests/widgets/test_popupreflows.xul b/toolkit/content/tests/widgets/test_popupreflows.xul
new file mode 100644
index 00000000000..8fb9389976d
--- /dev/null
+++ b/toolkit/content/tests/widgets/test_popupreflows.xul
@@ -0,0 +1,107 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet href="/tests/SimpleTest/test.css" type="text/css"?>
+
+<window title="Popup Reflow Tests"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <title>Popup Reflow Tests</title>
+
+  <panel id="testPanel"
+         type="arrow"
+         noautohide="true">
+  </panel>
+
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+<script>
+<![CDATA[
+const {classes: Cc, interfaces: Ci, utils: Cu} = Components;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/commonjs/sdk/core/promise.js");
+
+let panel, anchor, arrow;
+
+// A reflow observer - it just remembers the stack trace of all sync reflows
+// done by the panel.
+let observer = {
+  reflows: [],
+  reflow: function (start, end) {
+    this.reflows.push(new Error().stack);
+  },
+
+  reflowInterruptible: function (start, end) {
+    // We're not interested in interruptible reflows.  Why, you ask?  Because
+    // we've simply cargo-culted this test from browser_tabopen_reflows.js!
+  },
+
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIReflowObserver,
+                                         Ci.nsISupportsWeakReference])
+};
+
+// A test utility that counts the reflows caused by a test function.  If the
+// count of reflows isn't what is expected, it causes a test failure and logs
+// the stack trace of all seen reflows.
+function countReflows(testfn, expected) {
+  let deferred = Promise.defer();
+  observer.reflows = [];
+  let docShell = panel.ownerDocument.defaultView
+                  .QueryInterface(Components.interfaces.nsIInterfaceRequestor)
+                  .getInterface(Components.interfaces.nsIWebNavigation)
+                  .QueryInterface(Components.interfaces.nsIDocShell);
+  docShell.addWeakReflowObserver(observer);
+  testfn().then(() => {
+    docShell.removeWeakReflowObserver(observer);
+    SimpleTest.is(observer.reflows.length, expected, "correct number of reflows");
+    if (observer.reflows.length != expected) {
+      SimpleTest.info("stack traces of reflows:\n" + observer.reflows.join("\n") + "\n");
+    }
+    deferred.resolve();
+  });
+  return deferred.promise
+}
+
+function openPopup() {
+  let deferred = Promise.defer();
+  panel.addEventListener("popupshown", function popupshown() {
+    panel.removeEventListener("popupshown", popupshown);
+    deferred.resolve();
+  });
+  panel.openPopup(anchor, "before_start");
+  return deferred.promise
+}
+
+// ********************
+// The actual tests...
+// We only have one atm - simply open a popup.
+//
+function testSimplePanel() {
+  return openPopup();
+}
+
+// ********************
+// The test harness...
+//
+SimpleTest.waitForExplicitFinish();
+
+addEventListener("load", function() {
+  anchor = document.getElementById("anchor");
+  panel = document.getElementById("testPanel");
+  arrow = document.getAnonymousElementByAttribute(panel, "anonid", "arrow");
+
+  // Cancel the arrow panel slide-in transition (bug 767133) - we are only
+  // testing reflows in the core panel implementation and not reflows that may
+  // or may not be caused by transitioning....
+  arrow.style.transition = "none";
+
+  // and off we go...
+  countReflows(testSimplePanel, 1).then(SimpleTest.finish);
+});
+]]>
+</script>
+<body xmlns="http://www.w3.org/1999/xhtml">
+  <p>The anchor --&gt; <span id="anchor">v</span> &lt;--</p>
+</body>
+</window>
diff --git a/toolkit/content/widgets/popup.xml b/toolkit/content/widgets/popup.xml
index 9a5c7413cc8..b2c1eb70b9e 100644
--- a/toolkit/content/widgets/popup.xml
+++ b/toolkit/content/widgets/popup.xml
@@ -398,19 +398,19 @@
         var container = document.getAnonymousElementByAttribute(this, "anonid", "container");
         var arrowbox = document.getAnonymousElementByAttribute(this, "anonid", "arrowbox");
 
+        var position = this.alignmentPosition;
+        var offset = this.alignmentOffset;
         // if this panel has a "sliding" arrow, we may have previously set margins...
         arrowbox.style.removeProperty("margin");
-
-        var position = this.alignmentPosition;
         if (position.indexOf("start_") == 0 || position.indexOf("end_") == 0) {
           container.orient = "";
           arrowbox.orient = "vertical";
           if (position.indexOf("_after") > 0) {
             arrowbox.pack = "end";
-            arrowbox.style.marginBottom = this.alignmentOffset + "px";
+            arrowbox.style.marginBottom = offset + "px";
           } else {
             arrowbox.pack = "start";
-            arrowbox.style.marginTop = this.alignmentOffset + "px";
+            arrowbox.style.marginTop = offset + "px";
           }
 
           // The assigned side stays the same regardless of direction.
diff --git a/toolkit/mozapps/update/test/unit/test_0200_app_launch_apply_update.js b/toolkit/mozapps/update/test/unit/test_0200_app_launch_apply_update.js
index 72fa45e4393..0077e5128e7 100644
--- a/toolkit/mozapps/update/test/unit/test_0200_app_launch_apply_update.js
+++ b/toolkit/mozapps/update/test/unit/test_0200_app_launch_apply_update.js
@@ -188,7 +188,12 @@ function end_test() {
   }
 
   // This will delete the app console log file if it exists.
-  getAppConsoleLogPath();
+  try {
+    getAppConsoleLogPath();
+  }
+  catch (e) {
+    logTestInfo("unable to remove file during end_test. Exception: " + e);
+  }
 
   if (IS_UNIX) {
     // This will delete the launch script if it exists.
diff --git a/widget/shared/NativeKeyToDOMKeyName.h b/widget/shared/NativeKeyToDOMKeyName.h
index a70d023f616..dde1b24a48e 100644
--- a/widget/shared/NativeKeyToDOMKeyName.h
+++ b/widget/shared/NativeKeyToDOMKeyName.h
@@ -17,6 +17,9 @@
 
 // Windows (both Desktop and Metro)
 #define KEY_MAP_WIN(aCPPKeyName, aNativeKey)
+#define KEY_MAP_WIN_JPN(aCPPKeyName, aNativeKey)
+#define KEY_MAP_WIN_KOR(aCPPKeyName, aNativeKey)
+#define KEY_MAP_WIN_OTH(aCPPKeyName, aNativeKey)
 // OS/2
 #define KEY_MAP_OS2(aCPPKeyName, aNativeKey)
 // Mac OS X
@@ -29,9 +32,28 @@
 #define KEY_MAP_ANDROID(aCPPKeyName, aNativeKey)
 
 #if defined(XP_WIN)
+// KEY_MAP_WIN() defines the mapping not depending on keyboard layout.
 #undef KEY_MAP_WIN
 #define KEY_MAP_WIN(aCPPKeyName, aNativeKey) \
   NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, KEY_NAME_INDEX_##aCPPKeyName)
+// KEY_MAP_WIN_JPN() defines the mapping which is valid only with Japanese
+// keyboard layout.
+#undef KEY_MAP_WIN_JPN
+#define KEY_MAP_WIN_JPN(aCPPKeyName, aNativeKey) \
+  NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, \
+                                               KEY_NAME_INDEX_##aCPPKeyName)
+// KEY_MAP_WIN_KOR() defines the mapping which is valid only with Korean
+// keyboard layout.
+#undef KEY_MAP_WIN_KOR
+#define KEY_MAP_WIN_KOR(aCPPKeyName, aNativeKey) \
+  NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, \
+                                             KEY_NAME_INDEX_##aCPPKeyName)
+// KEY_MAP_WIN_OTH() defines the mapping which is valid with neither
+// Japanese keyboard layout nor Korean keyboard layout.
+#undef KEY_MAP_WIN_OTH
+#define KEY_MAP_WIN_OTH(aCPPKeyName, aNativeKey) \
+  NS_OTHER_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, \
+                                            KEY_NAME_INDEX_##aCPPKeyName)
 #elif defined(XP_MACOSX)
 #undef KEY_MAP_COCOA
 #define KEY_MAP_COCOA(aCPPKeyName, aNativeKey) \
@@ -51,7 +73,7 @@
 #endif
 
 // Attn
-KEY_MAP_WIN     (Attn, VK_ATTN)
+KEY_MAP_WIN_OTH (Attn, VK_ATTN) // not valid with Japanese keyboard layout
 KEY_MAP_GTK     (Attn, GDK_3270_Attn) // legacy IBM keyboard layout
 
 // Apps
@@ -756,6 +778,7 @@ KEY_MAP_GTK     (DeadSemivoicedSound, GDK_dead_semivoiced_sound)
 KEY_MAP_QT      (DeadSemivoicedSound, Qt::Key_Dead_Semivoiced_Sound)
 
 // Alphanumeric
+KEY_MAP_WIN_JPN (Alphanumeric, VK_OEM_ATTN)
 KEY_MAP_GTK     (Alphanumeric, GDK_Eisu_Shift)
 KEY_MAP_GTK     (Alphanumeric, GDK_Eisu_toggle)
 KEY_MAP_QT      (Alphanumeric, Qt::Key_Eisu_Shift)
@@ -889,12 +912,15 @@ KEY_MAP_QT      (Nonconvert, Qt::Key_Muhenkan)
 KEY_MAP_ANDROID (Nonconvert, AKEYCODE_MUHENKAN)
 
 // FinalMode
+KEY_MAP_WIN     (FinalMode, VK_FINAL)
 
 // FullWidth
+KEY_MAP_WIN_JPN (FullWidth, VK_OEM_ENLW)
 KEY_MAP_GTK     (FullWidth, GDK_Zenkaku)
 KEY_MAP_QT      (FullWidth, Qt::Key_Zenkaku)
 
 // HalfWidth
+KEY_MAP_WIN_JPN (HalfWidth, VK_OEM_AUTO)
 KEY_MAP_GTK     (HalfWidth, GDK_Hankaku)
 KEY_MAP_QT      (HalfWidth, Qt::Key_Hankaku)
 
@@ -903,6 +929,7 @@ KEY_MAP_WIN     (ModeChange, VK_MODECHANGE)
 KEY_MAP_ANDROID (ModeChange, AKEYCODE_SWITCH_CHARSET)
 
 // RomanCharacters
+KEY_MAP_WIN_JPN (RomanCharacters, VK_OEM_BACKTAB)
 KEY_MAP_COCOA   (RomanCharacters, kVK_JIS_Eisu)
 KEY_MAP_GTK     (RomanCharacters, GDK_Romaji)
 KEY_MAP_QT      (RomanCharacters, Qt::Key_Romaji)
@@ -910,26 +937,31 @@ KEY_MAP_QT      (RomanCharacters, Qt::Key_Romaji)
 KEY_MAP_ANDROID (RomanCharacters, AKEYCODE_EISU)
 
 // HangulMode
+KEY_MAP_WIN_KOR (HangulMode, VK_HANGUL /* same as VK_KANA */)
 
 // HanjaMode
-KEY_MAP_WIN     (HanjaMode, VK_FINAL)
+KEY_MAP_WIN_KOR (HanjaMode, VK_HANJA /* same as VK_KANJI */)
 
 // JunjaMode
 KEY_MAP_WIN     (JunjaMode, VK_JUNJA)
 
 // Hiragana
+KEY_MAP_WIN_JPN (Hiragana, VK_OEM_COPY)
 KEY_MAP_GTK     (Hiragana, GDK_Hiragana)
 KEY_MAP_QT      (Hiragana, Qt::Key_Hiragana)
 
 // KanaMode
-KEY_MAP_WIN     (KanaMode, VK_KANA /* same as VK_HANGUL */)
+// VK_KANA is never used with modern Japanese keyboard, however, IE maps it to
+// KanaMode, therefore, we should use same map for it.
+KEY_MAP_WIN_JPN (KanaMode, VK_KANA /* same as VK_HANGUL */)
+KEY_MAP_WIN_JPN (KanaMode, VK_ATTN)
 KEY_MAP_GTK     (KanaMode, GDK_Kana_Lock)
 KEY_MAP_GTK     (KanaMode, GDK_Kana_Shift)
 KEY_MAP_QT      (KanaMode, Qt::Key_Kana_Lock)
 KEY_MAP_QT      (KanaMode, Qt::Key_Kana_Shift)
 
 // KanjiMode
-KEY_MAP_WIN     (KanjiMode, VK_KANJI /* same as VK_HANJA */)
+KEY_MAP_WIN_JPN (KanjiMode, VK_KANJI /* same as VK_HANJA */)
 KEY_MAP_COCOA   (KanjiMode, kVK_JIS_Kana) // Kana key opens IME
 KEY_MAP_GTK     (KanjiMode, GDK_Kanji) // Typically, Alt + Hankaku/Zenkaku key
 KEY_MAP_QT      (KanjiMode, Qt::Key_Kanji)
@@ -937,6 +969,7 @@ KEY_MAP_QT      (KanjiMode, Qt::Key_Kanji)
 KEY_MAP_ANDROID (KanjiMode, AKEYCODE_KANA)
 
 // Katakana
+KEY_MAP_WIN_JPN (Katakana, VK_OEM_FINISH)
 KEY_MAP_GTK     (Katakana, GDK_Katakana)
 KEY_MAP_QT      (Katakana, Qt::Key_Katakana)
 
@@ -1158,6 +1191,9 @@ KEY_MAP_GTK     (Yellow, GDK_Yellow)
 KEY_MAP_ANDROID (Yellow, AKEYCODE_PROG_YELLOW)
 
 #undef KEY_MAP_WIN
+#undef KEY_MAP_WIN_JPN
+#undef KEY_MAP_WIN_KOR
+#undef KEY_MAP_WIN_OTH
 #undef KEY_MAP_OS2
 #undef KEY_MAP_COCOA
 #undef KEY_MAP_GTK
diff --git a/widget/windows/KeyboardLayout.cpp b/widget/windows/KeyboardLayout.cpp
index 546f37a30b1..639624bfaac 100644
--- a/widget/windows/KeyboardLayout.cpp
+++ b/widget/windows/KeyboardLayout.cpp
@@ -2047,18 +2047,80 @@ KeyboardLayout::ConvertNativeKeyCodeToDOMKeyCode(UINT aNativeKeyCode) const
 KeyNameIndex
 KeyboardLayout::ConvertNativeKeyCodeToKeyNameIndex(uint8_t aVirtualKey) const
 {
+#define NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+#define NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+#define NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+#define NS_OTHER_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+
   switch (aVirtualKey) {
 
+#undef NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
 #define NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex) \
     case aNativeKey: return aKeyNameIndex;
 
 #include "NativeKeyToDOMKeyName.h"
 
 #undef NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#define NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
 
     default:
-      return IsPrintableCharKey(aVirtualKey) ? KEY_NAME_INDEX_PrintableKey :
-                                               KEY_NAME_INDEX_Unidentified;
+      if (IsPrintableCharKey(aVirtualKey)) {
+        return KEY_NAME_INDEX_PrintableKey;
+      }
+      break;
+  }
+
+  HKL layout = GetLayout();
+  WORD langID = LOWORD(static_cast<HKL>(layout));
+  WORD primaryLangID = PRIMARYLANGID(langID);
+
+  if (primaryLangID == LANG_JAPANESE) {
+    switch (aVirtualKey) {
+
+#undef NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#define NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)\
+      case aNativeKey: return aKeyNameIndex;
+
+#include "NativeKeyToDOMKeyName.h"
+
+#undef NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#define NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+
+      default:
+        break;
+    }
+  } else if (primaryLangID == LANG_KOREAN) {
+    switch (aVirtualKey) {
+
+#undef NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#define NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)\
+      case aNativeKey: return aKeyNameIndex;
+
+#include "NativeKeyToDOMKeyName.h"
+
+#undef NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#define NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+
+      default:
+        return KEY_NAME_INDEX_Unidentified;
+    }
+  }
+
+  switch (aVirtualKey) {
+
+#undef NS_OTHER_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#define NS_OTHER_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)\
+    case aNativeKey: return aKeyNameIndex;
+
+#include "NativeKeyToDOMKeyName.h"
+
+#undef NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#undef NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#undef NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#undef NS_OTHER_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+
+    default:
+      return KEY_NAME_INDEX_Unidentified;
   }
 }
 
diff --git a/widget/windows/winrt/MetroInput.cpp b/widget/windows/winrt/MetroInput.cpp
index e48998487bb..290110358c1 100644
--- a/widget/windows/winrt/MetroInput.cpp
+++ b/widget/windows/winrt/MetroInput.cpp
@@ -1463,10 +1463,16 @@ MetroInput::GetDOMKeyNameIndex(uint32_t aVirtualKey)
 
 #define NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex) \
     case aNativeKey: return aKeyNameIndex;
+#define NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+#define NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
+#define NS_OTHER_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX(aNativeKey, aKeyNameIndex)
 
 #include "NativeKeyToDOMKeyName.h"
 
 #undef NS_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#undef NS_JAPANESE_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#undef NS_KOREAN_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
+#undef NS_OTHER_NATIVE_KEY_TO_DOM_KEY_NAME_INDEX
 
     // printable keys:
     case System::VirtualKey::VirtualKey_Number0: