diff --git a/CLOBBER b/CLOBBER
index dcd0ce8ec1e..c465e959f58 100644
--- a/CLOBBER
+++ b/CLOBBER
@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Bug 1024707 - It seems like changing 3 uuids is just too much!
\ No newline at end of file
+Bug 1038799 - And be wary of your ccache too.
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 855d578f908..4d09fae9f88 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -664,6 +664,12 @@ pref("javascript.options.mem.gc_low_frequency_heap_growth", 120);
 pref("javascript.options.mem.high_water_mark", 6);
 pref("javascript.options.mem.gc_allocation_threshold_mb", 1);
 pref("javascript.options.mem.gc_decommit_threshold_mb", 1);
+#ifdef JSGC_GENERATIONAL
+pref("javascript.options.mem.gc_min_empty_chunk_count", 1);
+#else
+pref("javascript.options.mem.gc_min_empty_chunk_count", 0);
+#endif
+pref("javascript.options.mem.gc_max_empty_chunk_count", 2);
 
 // Show/Hide scrollbars when active/inactive
 pref("ui.showHideScrollbars", 1);
@@ -1007,7 +1013,7 @@ pref("services.sync.fxaccounts.enabled", true);
 pref("identity.fxaccounts.enabled", true);
 
 // Mobile Identity API.
-pref("services.mobileid.server.uri", "https://msisdn-dev.stage.mozaws.net");
+pref("services.mobileid.server.uri", "https://msisdn.services.mozilla.com");
 
 // Enable mapped array buffer
 pref("dom.mapped_arraybuffer.enabled", true);
diff --git a/b2g/config/emulator-ics/sources.xml b/b2g/config/emulator-ics/sources.xml
index 45bd870872a..854a7bbd91d 100644
--- a/b2g/config/emulator-ics/sources.xml
+++ b/b2g/config/emulator-ics/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
diff --git a/b2g/config/emulator-jb/sources.xml b/b2g/config/emulator-jb/sources.xml
index 898b9efd852..5b3174842f1 100644
--- a/b2g/config/emulator-jb/sources.xml
+++ b/b2g/config/emulator-jb/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="dc5ca96695cab87b4c2fcd7c9f046ae3415a70a5"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="777194d772c831b5dab40cf919523d5665f2a46c"/>
diff --git a/b2g/config/emulator-kk/sources.xml b/b2g/config/emulator-kk/sources.xml
index 0342816217d..00e60180a0d 100644
--- a/b2g/config/emulator-kk/sources.xml
+++ b/b2g/config/emulator-kk/sources.xml
@@ -15,7 +15,7 @@
   <project name="platform_build" path="build" remote="b2g" revision="276ce45e78b09c4a4ee643646f691d22804754c1">
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/emulator/sources.xml b/b2g/config/emulator/sources.xml
index 45bd870872a..854a7bbd91d 100644
--- a/b2g/config/emulator/sources.xml
+++ b/b2g/config/emulator/sources.xml
@@ -19,7 +19,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="platform_hardware_ril" path="hardware/ril" remote="b2g" revision="cd88d860656c31c7da7bb310d6a160d0011b0961"/>
diff --git a/b2g/config/flame/sources.xml b/b2g/config/flame/sources.xml
index a92c48e084c..0ce0594f79b 100644
--- a/b2g/config/flame/sources.xml
+++ b/b2g/config/flame/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="dc5ca96695cab87b4c2fcd7c9f046ae3415a70a5"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="777194d772c831b5dab40cf919523d5665f2a46c"/>
diff --git a/b2g/config/gaia.json b/b2g/config/gaia.json
index 9e4534a4acc..197cba7e137 100644
--- a/b2g/config/gaia.json
+++ b/b2g/config/gaia.json
@@ -4,6 +4,6 @@
         "remote": "", 
         "branch": ""
     }, 
-    "revision": "8cd6c73ef83257a569d148e246108b2c161127bb", 
+    "revision": "6739781fb8d0f3ae8bff65d1093e74d9f21ed6e5", 
     "repo_path": "/integration/gaia-central"
 }
diff --git a/b2g/config/hamachi/sources.xml b/b2g/config/hamachi/sources.xml
index 9cb88555b54..86faa9c6f20 100644
--- a/b2g/config/hamachi/sources.xml
+++ b/b2g/config/hamachi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/helix/sources.xml b/b2g/config/helix/sources.xml
index 1f24399130f..676ead2118a 100644
--- a/b2g/config/helix/sources.xml
+++ b/b2g/config/helix/sources.xml
@@ -15,7 +15,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/b2g/config/nexus-4/sources.xml b/b2g/config/nexus-4/sources.xml
index d2f8d04e5d1..844aed3d65b 100644
--- a/b2g/config/nexus-4/sources.xml
+++ b/b2g/config/nexus-4/sources.xml
@@ -17,7 +17,7 @@
   </project>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="fake-libdvm" path="dalvik" remote="b2g" revision="d50ae982b19f42f0b66d08b9eb306be81687869f"/>
-  <project name="gaia" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="moztt" path="external/moztt" remote="b2g" revision="dc5ca96695cab87b4c2fcd7c9f046ae3415a70a5"/>
   <project name="apitrace" path="external/apitrace" remote="apitrace" revision="777194d772c831b5dab40cf919523d5665f2a46c"/>
diff --git a/b2g/config/wasabi/sources.xml b/b2g/config/wasabi/sources.xml
index 6fceb9d0b76..fc9c8fa52fa 100644
--- a/b2g/config/wasabi/sources.xml
+++ b/b2g/config/wasabi/sources.xml
@@ -17,7 +17,7 @@
     <copyfile dest="Makefile" src="core/root.mk"/>
   </project>
   <project name="fake-dalvik" path="dalvik" remote="b2g" revision="ca1f327d5acc198bb4be62fa51db2c039032c9ce"/>
-  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="d29773d2a011825fd77d1c0915a96eb0911417b6"/>
+  <project name="gaia.git" path="gaia" remote="mozillaorg" revision="5edca8cd06409b8bf404de4adf7ea08fc2940fd7"/>
   <project name="gonk-misc" path="gonk-misc" remote="b2g" revision="7f792d756385bb894fba7645da59c67fe2c804bf"/>
   <project name="rilproxy" path="rilproxy" remote="b2g" revision="827214fcf38d6569aeb5c6d6f31cb296d1f09272"/>
   <project name="librecovery" path="librecovery" remote="b2g" revision="891e5069c0ad330d8191bf8c7b879c814258c89f"/>
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 391e6a969bc..c9e220c8fd7 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1511,11 +1511,16 @@ pref("shumway.disabled", true);
 // (This is intentionally on the high side; see bug 746055.)
 pref("image.mem.max_decoded_image_kb", 256000);
 
-#ifdef MOZ_LOOP
+// Enable by default on nightly and aurora.
+#ifndef RELEASE_BUILD
+pref("loop.enabled", true);
+#else
+pref("loop.enabled", false);
+#endif
+
 pref("loop.server", "https://loop.services.mozilla.com");
 pref("loop.do_not_disturb", false);
 pref("loop.ringtone", "chrome://browser/content/loop/shared/sounds/Firefox-Long.ogg");
-#endif
 
 // serverURL to be assigned by services team
 pref("services.push.serverURL", "wss://push.services.mozilla.com/");
diff --git a/browser/base/content/browser-loop.js b/browser/base/content/browser-loop.js
index 7e62f1f67f4..000d0df969b 100644
--- a/browser/base/content/browser-loop.js
+++ b/browser/base/content/browser-loop.js
@@ -36,6 +36,11 @@ XPCOMUtils.defineLazyModuleGetter(this, "PanelFrame", "resource:///modules/Panel
      * delayedStartup.
      */
     initialize: function() {
+      if (!Services.prefs.getBoolPref("loop.enabled")) {
+        CustomizableUI.getWidget("loop-call-button").forWindow(window).node.hidden = true;
+        return;
+      }
+
       MozLoopService.initialize();
     },
   };
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index d1fea52dab6..684c5b203c2 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -172,9 +172,7 @@ let gInitialPages = [
 #include browser-feeds.js
 #include browser-fullScreen.js
 #include browser-fullZoom.js
-#ifdef MOZ_LOOP
 #include browser-loop.js
-#endif
 #include browser-places.js
 #include browser-plugins.js
 #include browser-safebrowsing.js
@@ -1188,9 +1186,7 @@ var gBrowserInit = {
     gDataNotificationInfoBar.init();
 #endif
 
-#ifdef MOZ_LOOP
     LoopUI.initialize();
-#endif
 
     gBrowserThumbnails.init();
 
diff --git a/browser/base/content/browser.xul b/browser/base/content/browser.xul
index d97e1bb66a2..b06818cbf77 100644
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@@ -267,7 +267,6 @@
            noautofocus="true"
            position="topcenter topright"/>
 
-#ifdef MOZ_LOOP
     <panel id="loop-notification-panel"
            class="loop-panel social-panel"
            type="arrow"
@@ -279,7 +278,6 @@
            type="arrow"
            orient="horizontal"
            hidden="true"/>
-#endif
 
     <menupopup id="toolbar-context-menu"
                onpopupshowing="onViewToolbarsPopupShowing(event, document.getElementById('viewToolbarsMenuSeparator'));">
@@ -671,11 +669,7 @@
              aria-label="&navbarCmd.label;"
              fullscreentoolbar="true" mode="icons" customizable="true"
              iconsize="small"
-#ifdef MOZ_LOOP
              defaultset="urlbar-container,search-container,webrtc-status-button,bookmarks-menu-button,downloads-button,home-button,loop-call-button,social-share-button,social-toolbar-item"
-#else
-             defaultset="urlbar-container,search-container,webrtc-status-button,bookmarks-menu-button,downloads-button,home-button,social-share-button,social-toolbar-item"
-#endif
              customizationtarget="nav-bar-customization-target"
              overflowable="true"
              overflowbutton="nav-bar-overflow-button"
@@ -819,7 +813,7 @@
                        oncommand="LoopUI.openCallPanel(event);"
                        cui-areatype="toolbar">
         </toolbarbutton>
-#endif
+#endifhttps://hg.mozilla.org/mozilla-central/rev/cd712c340dd7
 
         <toolbarbutton id="bookmarks-menu-button"
                        class="toolbarbutton-1 chromeclass-toolbar-additional"
@@ -950,6 +944,21 @@
                        cui-areatype="toolbar"
                        aboutHomeOverrideTooltip="&abouthome.pageTitle;"/>
 
+        <!-- XXX Bug 1013989 will provide a label for the button -->
+        <!-- This uses badged to be compatible with the social api code it shares.
+             We may also want it to be badged in the future, for notification
+             purposes. -->
+        <toolbarbutton id="loop-call-button"
+                       class="toolbarbutton-1 chromeclass-toolbar-additional"
+                       persist="class"
+                       type="badged"
+                       removable="true"
+                       tooltiptext="&loopCallButton.tooltip;"
+                       oncommand="LoopUI.openCallPanel(event);"
+                       cui-areatype="toolbar"
+                       >
+        </toolbarbutton>
+
 
         <toolbarbutton id="social-share-button"
                        class="toolbarbutton-1 chromeclass-toolbar-additional"
diff --git a/browser/components/about/AboutRedirector.cpp b/browser/components/about/AboutRedirector.cpp
index 3f7d4128814..fc8b9a0b3a6 100644
--- a/browser/components/about/AboutRedirector.cpp
+++ b/browser/components/about/AboutRedirector.cpp
@@ -100,7 +100,6 @@ static RedirEntry kRedirMap[] = {
     nsIAboutModule::ALLOW_SCRIPT },
   { "customizing", "chrome://browser/content/customizableui/aboutCustomizing.xul",
     nsIAboutModule::ALLOW_SCRIPT },
-#ifdef MOZ_LOOP
   { "loopconversation", "chrome://browser/content/loop/conversation.html",
     nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
     nsIAboutModule::ALLOW_SCRIPT |
@@ -113,7 +112,6 @@ static RedirEntry kRedirMap[] = {
     nsIAboutModule::ENABLE_INDEXED_DB,
     // Shares an IndexedDB origin with about:loopconversation.
     "loopconversation" },
-#endif
 };
 static const int kRedirTotal = ArrayLength(kRedirMap);
 
diff --git a/browser/components/build/nsModule.cpp b/browser/components/build/nsModule.cpp
index df6d36e427c..21ffbf06de5 100644
--- a/browser/components/build/nsModule.cpp
+++ b/browser/components/build/nsModule.cpp
@@ -112,10 +112,8 @@ static const mozilla::Module::ContractIDEntry kBrowserContracts[] = {
 #endif
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "app-manager", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "customizing", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
-#ifdef MOZ_LOOP
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "looppanel", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
     { NS_ABOUT_MODULE_CONTRACTID_PREFIX "loopconversation", &kNS_BROWSER_ABOUT_REDIRECTOR_CID },
-#endif
 #if defined(XP_WIN)
     { NS_IEHISTORYENUMERATOR_CONTRACTID, &kNS_WINIEHISTORYENUMERATOR_CID },
 #elif defined(XP_MACOSX)
diff --git a/browser/components/customizableui/content/panelUI.inc.xul b/browser/components/customizableui/content/panelUI.inc.xul
index e0951b9034f..4a18f3db809 100644
--- a/browser/components/customizableui/content/panelUI.inc.xul
+++ b/browser/components/customizableui/content/panelUI.inc.xul
@@ -141,9 +141,7 @@
 
     <panelview id="PanelUI-socialapi" flex="1"/>
 
-#ifdef MOZ_LOOP
     <panelview id="PanelUI-loopapi" flex="1"/>
-#endif
 
     <panelview id="PanelUI-feeds" flex="1" oncommand="FeedHandler.subscribeToFeed(null, event);">
       <label value="&feedsMenu.label;" class="panel-subview-header"/>
diff --git a/browser/components/customizableui/src/CustomizableUI.jsm b/browser/components/customizableui/src/CustomizableUI.jsm
index 2e36081f665..478519d5a6b 100644
--- a/browser/components/customizableui/src/CustomizableUI.jsm
+++ b/browser/components/customizableui/src/CustomizableUI.jsm
@@ -206,9 +206,7 @@ let CustomizableUIInternal = {
         "bookmarks-menu-button",
         "downloads-button",
         "home-button",
-#ifdef MOZ_LOOP
         "loop-call-button",
-#endif
         "social-share-button",
       ],
       defaultCollapsed: false,
diff --git a/browser/components/loop/MozLoopService.jsm b/browser/components/loop/MozLoopService.jsm
index b0a0e13091a..1a6aace9442 100644
--- a/browser/components/loop/MozLoopService.jsm
+++ b/browser/components/loop/MozLoopService.jsm
@@ -449,6 +449,11 @@ this.MozLoopService = {
    * push and loop servers.
    */
   initialize: function() {
+    // Don't do anything if loop is not enabled.
+    if (!Services.prefs.getBoolPref("loop.enabled")) {
+      return;
+    }
+
     // If expiresTime is in the future then kick-off registration.
     if (MozLoopServiceInternal.urlExpiryTimeIsInFuture()) {
       this._startInitializeTimer();
@@ -481,6 +486,11 @@ this.MozLoopService = {
    *          rejected with an error code or string.
    */
   register: function(mockPushHandler) {
+    // Don't do anything if loop is not enabled.
+    if (!Services.prefs.getBoolPref("loop.enabled")) {
+      throw new Error("Loop is not enabled");
+    }
+
     return MozLoopServiceInternal.promiseRegisteredWithServers(mockPushHandler);
   },
 
diff --git a/browser/components/loop/content/js/client.js b/browser/components/loop/content/js/client.js
index 33fbe29e051..cac153651d9 100644
--- a/browser/components/loop/content/js/client.js
+++ b/browser/components/loop/content/js/client.js
@@ -34,13 +34,6 @@ loop.Client = (function($) {
   }
 
   Client.prototype = {
-    /**
-     * Converts from hours to seconds
-     */
-    _hoursToSeconds: function(value) {
-      return value * 60 * 60;
-    },
-
     /**
      * Validates a data object to confirm it has the specified properties.
      *
@@ -124,8 +117,7 @@ loop.Client = (function($) {
 
           cb(null, this._validate(urlData, expectedCallUrlProperties));
 
-          var expiresHours = this._hoursToSeconds(urlData.expiresAt);
-          this.mozLoop.noteCallUrlExpiry(expiresHours);
+          this.mozLoop.noteCallUrlExpiry(urlData.expiresAt);
         } catch (err) {
           console.log("Error requesting call info", err);
           cb(err);
diff --git a/browser/components/loop/content/shared/js/models.js b/browser/components/loop/content/shared/js/models.js
index 77cd825be06..a48ce0f270e 100644
--- a/browser/components/loop/content/shared/js/models.js
+++ b/browser/components/loop/content/shared/js/models.js
@@ -14,6 +14,7 @@ loop.shared.models = (function() {
    */
   var ConversationModel = Backbone.Model.extend({
     defaults: {
+      connected:    false,     // Session connected flag
       ongoing:      false,     // Ongoing call flag
       callerId:     undefined, // Loop caller id
       loopToken:    undefined, // Loop conversation token
@@ -38,11 +39,29 @@ loop.shared.models = (function() {
      */
     session: undefined,
 
+    /**
+     * Pending call timeout value.
+     * @type {Number}
+     */
+    pendingCallTimeout: undefined,
+
+    /**
+     * Pending call timer.
+     * @type {Number}
+     */
+    _pendingCallTimer: undefined,
+
     /**
      * Constructor.
      *
-     * Required options:
-     * - {OT} sdk: SDK object.
+     * Options:
+     *
+     * Required:
+     * - {OT} sdk: OT SDK object.
+     *
+     * Optional:
+     * - {Number} pendingCallTimeout: Pending call timeout in milliseconds
+     *                                (default: 20000).
      *
      * @param  {Object} attributes Attributes object.
      * @param  {Object} options    Options object.
@@ -53,6 +72,10 @@ loop.shared.models = (function() {
         throw new Error("missing required sdk");
       }
       this.sdk = options.sdk;
+      this.pendingCallTimeout = options.pendingCallTimeout || 20000;
+
+      // Ensure that any pending call timer is cleared on disconnect/error
+      this.on("session:ended session:error", this._clearPendingCallTimer, this);
     },
 
     /**
@@ -79,21 +102,38 @@ loop.shared.models = (function() {
      * @param {Object} options Options object
      */
     initiate: function(options) {
+      options = options || {};
+
+      // Outgoing call has never reached destination, closing - see bug 1020448
+      function handleOutgoingCallTimeout() {
+        /*jshint validthis:true */
+        if (!this.get("ongoing")) {
+          this.trigger("timeout").endSession();
+        }
+      }
+
       function handleResult(err, sessionData) {
         /*jshint validthis:true */
+        this._clearPendingCallTimer();
+
         if (err) {
           this.trigger("session:error", new Error(
             "Retrieval of session information failed: HTTP " + err));
           return;
         }
 
-        // XXX For incoming calls we might have more than one call queued.
-        // For now, we'll just assume the first call is the right information.
-        // We'll probably really want to be getting this data from the
-        // background worker on the desktop client.
-        // Bug 990714 should fix this.
-        if (!options.outgoing)
+        if (options.outgoing) {
+          // Setup pending call timeout.
+          this._pendingCallTimer = setTimeout(
+            handleOutgoingCallTimeout.bind(this), this.pendingCallTimeout);
+        } else {
+          // XXX For incoming calls we might have more than one call queued.
+          // For now, we'll just assume the first call is the right information.
+          // We'll probably really want to be getting this data from the
+          // background worker on the desktop client.
+          // Bug 990714 should fix this.
           sessionData = sessionData[0];
+        }
 
         this.setReady(sessionData);
       }
@@ -156,8 +196,17 @@ loop.shared.models = (function() {
      */
     endSession: function() {
       this.session.disconnect();
-      this.once("session:ended", this.stopListening, this);
-      this.set("ongoing", false);
+      this.set("ongoing", false)
+          .once("session:ended", this.stopListening, this);
+    },
+
+    /**
+     * Clears current pending call timer, if any.
+     */
+    _clearPendingCallTimer: function() {
+      if (this._pendingCallTimer) {
+        clearTimeout(this._pendingCallTimer);
+      }
     },
 
     /**
@@ -175,7 +224,7 @@ loop.shared.models = (function() {
         this.endSession();
       } else {
         this.trigger("session:connected");
-        this.set("ongoing", true);
+        this.set("connected", true);
       }
     },
 
@@ -186,7 +235,8 @@ loop.shared.models = (function() {
      * @param  {StreamEvent} event
      */
     _streamCreated: function(event) {
-      this.trigger("session:stream-created", event);
+      this.set("ongoing", true)
+          .trigger("session:stream-created", event);
     },
 
     /**
@@ -196,8 +246,9 @@ loop.shared.models = (function() {
      * @param  {SessionDisconnectEvent} event
      */
     _sessionDisconnected: function(event) {
-      this.trigger("session:ended");
-      this.set("ongoing", false);
+      this.set("connected", false)
+          .set("ongoing", false)
+          .trigger("session:ended");
     },
 
     /**
@@ -207,9 +258,11 @@ loop.shared.models = (function() {
      * @param  {ConnectionEvent} event
      */
     _connectionDestroyed: function(event) {
-      this.trigger("session:peer-hungup", {
-        connectionId: event.connection.connectionId
-      });
+      this.set("connected", false)
+          .set("ongoing", false)
+          .trigger("session:peer-hungup", {
+            connectionId: event.connection.connectionId
+          });
       this.endSession();
     },
 
@@ -220,7 +273,9 @@ loop.shared.models = (function() {
      * @param {ConnectionEvent} event
      */
     _networkDisconnected: function(event) {
-      this.trigger("session:network-disconnected");
+      this.set("connected", false)
+          .set("ongoing", false)
+          .trigger("session:network-disconnected");
       this.endSession();
     },
   });
diff --git a/browser/components/loop/standalone/Makefile b/browser/components/loop/standalone/Makefile
index f6d5e043083..bc207e125c4 100644
--- a/browser/components/loop/standalone/Makefile
+++ b/browser/components/loop/standalone/Makefile
@@ -3,6 +3,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 LOOP_SERVER_URL := $(shell echo $${LOOP_SERVER_URL-http://localhost:5000})
+LOOP_PENDING_CALL_TIMEOUT := $(shell echo $${LOOP_PENDING_CALL_TIMEOUT-20000})
 NODE_LOCAL_BIN=./node_modules/.bin
 
 install:
@@ -21,4 +22,7 @@ frontend:
 	@echo "Not implemented yet."
 
 config:
-	@echo "var loop = loop || {};\nloop.config = {serverUrl: '`echo $(LOOP_SERVER_URL)`'};" > content/config.js
+	@echo "var loop = loop || {};" > content/config.js
+	@echo "loop.config = loop.config || {};" >> content/config.js
+	@echo "loop.config.serverUrl          = '`echo $(LOOP_SERVER_URL)`';" >> content/config.js
+	@echo "loop.config.pendingCallTimeout = `echo $(LOOP_PENDING_CALL_TIMEOUT)`;" >> content/config.js
diff --git a/browser/components/loop/standalone/README.md b/browser/components/loop/standalone/README.md
index ca378d659c2..15750f779ce 100644
--- a/browser/components/loop/standalone/README.md
+++ b/browser/components/loop/standalone/README.md
@@ -16,11 +16,15 @@ Configuration
 
 You will need to generate a configuration file, you can do so with:
 
-	$ make config
+    $ make config
 
-It will read the configuration from the `LOOP_SERVER_URL` env variable and
-generate the appropriate configuration file. This setting defines the root url
-of the loop server, without trailing slash.
+It will read the configuration from the following env variables and generate the
+appropriate configuration file:
+
+- `LOOP_SERVER_URL` defines the root url of the loop server, without trailing
+  slash (default: `http://localhost:5000`).
+- `LOOP_PENDING_CALL_TIMEOUT` defines the amount of time a pending outgoing call
+  should be considered timed out, in milliseconds (default: `20000`).
 
 Usage
 -----
diff --git a/browser/components/loop/standalone/content/js/webapp.js b/browser/components/loop/standalone/content/js/webapp.js
index 435124ddf46..28a16bf8677 100644
--- a/browser/components/loop/standalone/content/js/webapp.js
+++ b/browser/components/loop/standalone/content/js/webapp.js
@@ -119,6 +119,8 @@ loop.webapp = (function($, _, OT) {
     initialize: function() {
       // Load default view
       this.loadView(new HomeView());
+
+      this.listenTo(this._conversation, "timeout", this._onTimeout);
     },
 
     /**
@@ -146,6 +148,10 @@ loop.webapp = (function($, _, OT) {
       this.navigate(route, {trigger: true});
     },
 
+    _onTimeout: function() {
+      this._notifier.errorL10n("call_timeout_notification_text");
+    },
+
     /**
      * Default entry point.
      */
@@ -213,8 +219,11 @@ loop.webapp = (function($, _, OT) {
   function init() {
     var helper = new WebappHelper();
     router = new WebappRouter({
-      conversation: new sharedModels.ConversationModel({}, {sdk: OT}),
-      notifier: new sharedViews.NotificationListView({el: "#messages"})
+      notifier: new sharedViews.NotificationListView({el: "#messages"}),
+      conversation: new sharedModels.ConversationModel({}, {
+        sdk: OT,
+        pendingCallTimeout: loop.config.pendingCallTimeout
+      })
     });
     Backbone.history.start();
     if (helper.isIOS(navigator.platform)) {
diff --git a/browser/components/loop/standalone/content/l10n/data.ini b/browser/components/loop/standalone/content/l10n/data.ini
index f77fe38dbf7..f8b89364d2b 100644
--- a/browser/components/loop/standalone/content/l10n/data.ini
+++ b/browser/components/loop/standalone/content/l10n/data.ini
@@ -1,5 +1,6 @@
 [en]
 call_has_ended=Your call has ended.
+call_timeout_notification_text=Your call did not go through.
 missing_conversation_info=Missing conversation information.
 network_disconnected=The network connection terminated abruptly.
 peer_ended_conversation=Your peer ended the conversation.
@@ -21,6 +22,7 @@ connection_error_see_console_notification=Call failed; see console for details.
 
 [fr]
 call_has_ended=L'appel est terminé.
+call_timeout_notification_text=Votre appel n'a pas abouti.
 missing_conversation_info=Informations de communication manquantes.
 network_disconnected=La connexion réseau semble avoir été interrompue.
 peer_ended_conversation=Votre correspondant a mis fin à la communication.
diff --git a/browser/components/loop/test/desktop-local/client_test.js b/browser/components/loop/test/desktop-local/client_test.js
index 3382e321d89..4c29645f6dd 100644
--- a/browser/components/loop/test/desktop-local/client_test.js
+++ b/browser/components/loop/test/desktop-local/client_test.js
@@ -91,7 +91,7 @@ describe("loop.Client", function() {
       it("should note the call url expiry when the request succeeds", function() {
         var callUrlData = {
           "callUrl": "fakeCallUrl",
-          "expiresAt": 60
+          "expiresAt": 6000
         };
 
         // Sets up the hawkRequest stub to trigger the callback with no error
@@ -101,10 +101,9 @@ describe("loop.Client", function() {
 
         client.requestCallUrl("foo", callback);
 
-        // expiresAt is in hours, and noteCallUrlExpiry wants seconds.
         sinon.assert.calledOnce(mozLoop.noteCallUrlExpiry);
         sinon.assert.calledWithExactly(mozLoop.noteCallUrlExpiry,
-          60 * 60 * 60);
+          6000);
       });
 
       it("should send an error when the request fails", function() {
diff --git a/browser/components/loop/test/desktop-local/conversation_test.js b/browser/components/loop/test/desktop-local/conversation_test.js
index 5510796fccf..a92c72da26d 100644
--- a/browser/components/loop/test/desktop-local/conversation_test.js
+++ b/browser/components/loop/test/desktop-local/conversation_test.js
@@ -96,7 +96,10 @@ describe("loop.conversation", function() {
     var conversation;
 
     beforeEach(function() {
-      conversation = new loop.shared.models.ConversationModel({}, {sdk: {}});
+      conversation = new loop.shared.models.ConversationModel({}, {
+        sdk: {},
+        pendingCallTimeout: 1000
+      });
       sandbox.stub(conversation, "initiate");
     });
 
@@ -285,7 +288,10 @@ describe("loop.conversation", function() {
     var conversation, view;
 
     beforeEach(function() {
-      conversation = new loop.shared.models.ConversationModel({}, {sdk: {}});
+      conversation = new loop.shared.models.ConversationModel({}, {
+        sdk: {},
+        pendingCallTimeout: 1000
+      });
       view = new loop.conversation.IncomingCallView({model: conversation});
     });
 
diff --git a/browser/components/loop/test/shared/models_test.js b/browser/components/loop/test/shared/models_test.js
index b1c5978f751..618dd4f884c 100644
--- a/browser/components/loop/test/shared/models_test.js
+++ b/browser/components/loop/test/shared/models_test.js
@@ -14,6 +14,7 @@ describe("loop.shared.models", function() {
 
   beforeEach(function() {
     sandbox = sinon.sandbox.create();
+    sandbox.useFakeTimers();
     fakeXHR = sandbox.useFakeXMLHttpRequest();
     requests = [];
     // https://github.com/cjohansen/Sinon.JS/issues/393
@@ -46,9 +47,16 @@ describe("loop.shared.models", function() {
     describe("#initialize", function() {
       it("should require a sdk option", function() {
         expect(function() {
-          new sharedModels.ConversationModel();
+          new sharedModels.ConversationModel({}, {});
         }).to.Throw(Error, /missing required sdk/);
       });
+
+      it("should accept a pendingCallTimeout option", function() {
+        expect(new sharedModels.ConversationModel({}, {
+          sdk: {},
+          pendingCallTimeout: 1000
+        }).pendingCallTimeout).eql(1000);
+      });
     });
 
     describe("constructed", function() {
@@ -56,7 +64,10 @@ describe("loop.shared.models", function() {
           requestCallInfoStub, requestCallsInfoStub;
 
       beforeEach(function() {
-        conversation = new sharedModels.ConversationModel({}, {sdk: fakeSDK});
+        conversation = new sharedModels.ConversationModel({}, {
+          sdk: fakeSDK,
+          pendingCallTimeout: 1000
+        });
         conversation.set("loopToken", "fakeToken");
         fakeBaseServerUrl = "http://fakeBaseServerUrl";
         fakeClient = {
@@ -68,6 +79,10 @@ describe("loop.shared.models", function() {
       });
 
       describe("#initiate", function() {
+        beforeEach(function() {
+          sandbox.stub(conversation, "endSession");
+        });
+
         it("call requestCallInfo on the client for outgoing calls",
           function() {
             conversation.initiate({
@@ -139,6 +154,35 @@ describe("loop.shared.models", function() {
             outgoing: true
           });
         });
+
+        it("should end the session on outgoing call timeout", function() {
+          requestCallInfoStub.callsArgWith(2, null, fakeSessionData);
+
+          conversation.initiate({
+            client: fakeClient,
+            outgoing: true
+          });
+
+          sandbox.clock.tick(1001);
+
+          sinon.assert.calledOnce(conversation.endSession);
+        });
+
+        it("should trigger a `timeout` event on outgoing call timeout",
+          function(done) {
+            requestCallInfoStub.callsArgWith(2, null, fakeSessionData);
+
+            conversation.once("timeout", function() {
+              done();
+            });
+
+            conversation.initiate({
+              client: fakeClient,
+              outgoing: true
+            });
+
+            sandbox.clock.tick(1001);
+          });
       });
 
       describe("#setReady", function() {
@@ -161,8 +205,11 @@ describe("loop.shared.models", function() {
         var model;
 
         beforeEach(function() {
+          sandbox.stub(sharedModels.ConversationModel.prototype,
+                       "_clearPendingCallTimer");
           model = new sharedModels.ConversationModel(fakeSessionData, {
-            sdk: fakeSDK
+            sdk: fakeSDK,
+            pendingCallTimeout: 1000
           });
           model.startSession();
         });
@@ -182,16 +229,16 @@ describe("loop.shared.models", function() {
                         sinon.match.func);
         });
 
-        it("should set ongoing to true when no error is called back",
+        it("should set connected to true when no error is called back",
             function() {
               fakeSession.connect = function(key, token, cb) {
                 cb(null);
               };
-              sinon.stub(model, "set");
+              sandbox.stub(model, "set");
 
               model.startSession();
 
-              sinon.assert.calledWith(model.set, "ongoing", true);
+              sinon.assert.calledWith(model.set, "connected", true);
             });
 
         it("should trigger session:connected when no error is called back",
@@ -215,7 +262,7 @@ describe("loop.shared.models", function() {
                   error: true
                 });
               };
-              sinon.stub(model, "endSession");
+              sandbox.stub(model, "endSession");
 
               model.startSession();
 
@@ -239,6 +286,17 @@ describe("loop.shared.models", function() {
                           "session:connection-error", sinon.match.object);
             });
 
+          it("should set the connected attr to true on connection completed",
+            function() {
+              fakeSession.connect = function(key, token, cb) {
+                cb();
+              };
+
+              model.startSession();
+
+              expect(model.get("connected")).eql(true);
+            });
+
           it("should trigger a session:ended event on sessionDisconnected",
             function(done) {
               model.once("session:ended", function(){ done(); });
@@ -246,16 +304,32 @@ describe("loop.shared.models", function() {
               fakeSession.trigger("sessionDisconnected", {reason: "ko"});
             });
 
-          it("should set the ongoing attribute to false on sessionDisconnected",
-            function(done) {
-              model.once("session:ended", function() {
-                expect(model.get("ongoing")).eql(false);
-                done();
-              });
-
+          it("should set the connected attribute to false on sessionDisconnected",
+            function() {
               fakeSession.trigger("sessionDisconnected", {reason: "ko"});
+
+              expect(model.get("connected")).eql(false);
             });
 
+          it("should set the ongoing attribute to false on sessionDisconnected",
+            function() {
+              fakeSession.trigger("sessionDisconnected", {reason: "ko"});
+
+              expect(model.get("ongoing")).eql(false);
+            });
+
+          it("should clear a pending timer on session:ended", function() {
+            model.trigger("session:ended");
+
+            sinon.assert.calledOnce(model._clearPendingCallTimer);
+          });
+
+          it("should clear a pending timer on session:error", function() {
+            model.trigger("session:error");
+
+            sinon.assert.calledOnce(model._clearPendingCallTimer);
+          });
+
           describe("connectionDestroyed event received", function() {
             var fakeEvent = {reason: "ko", connection: {connectionId: 42}};
 
@@ -304,7 +378,8 @@ describe("loop.shared.models", function() {
 
         beforeEach(function() {
           model = new sharedModels.ConversationModel(fakeSessionData, {
-            sdk: fakeSDK
+            sdk: fakeSDK,
+            pendingCallTimeout: 1000
           });
           model.startSession();
         });
@@ -315,6 +390,12 @@ describe("loop.shared.models", function() {
           sinon.assert.calledOnce(fakeSession.disconnect);
         });
 
+        it("should set the connected attribute to false", function() {
+          model.endSession();
+
+          expect(model.get("connected")).eql(false);
+        });
+
         it("should set the ongoing attribute to false", function() {
           model.endSession();
 
diff --git a/browser/components/loop/test/shared/router_test.js b/browser/components/loop/test/shared/router_test.js
index 1ec21c276d3..7d2437fcd7c 100644
--- a/browser/components/loop/test/shared/router_test.js
+++ b/browser/components/loop/test/shared/router_test.js
@@ -102,7 +102,10 @@ describe("loop.shared.router", function() {
       });
       conversation = new loop.shared.models.ConversationModel({
         loopToken: "fakeToken"
-      }, {sdk: {}});
+      }, {
+        sdk: {},
+        pendingCallTimeout: 1000
+      });
     });
 
     describe("#constructor", function() {
diff --git a/browser/components/loop/test/shared/views_test.js b/browser/components/loop/test/shared/views_test.js
index a75bc9bf942..a07a2e87b3c 100644
--- a/browser/components/loop/test/shared/views_test.js
+++ b/browser/components/loop/test/shared/views_test.js
@@ -205,7 +205,8 @@ describe("loop.shared.views", function() {
         initSession: sandbox.stub().returns(fakeSession)
       };
       model = new sharedModels.ConversationModel(fakeSessionData, {
-        sdk: fakeSDK
+        sdk: fakeSDK,
+        pendingCallTimeout: 1000
       });
     });
 
diff --git a/browser/components/loop/test/standalone/webapp_test.js b/browser/components/loop/test/standalone/webapp_test.js
index 5765f0bb166..ac2aac33ac3 100644
--- a/browser/components/loop/test/standalone/webapp_test.js
+++ b/browser/components/loop/test/standalone/webapp_test.js
@@ -23,10 +23,12 @@ describe("loop.webapp", function() {
       error: sandbox.spy(),
       errorL10n: sandbox.spy(),
     };
+    loop.config.pendingCallTimeout = 1000;
   });
 
   afterEach(function() {
     sandbox.restore();
+    delete loop.config.pendingCallTimeout;
   });
 
   describe("#init", function() {
@@ -69,7 +71,10 @@ describe("loop.webapp", function() {
     var router, conversation;
 
     beforeEach(function() {
-      conversation = new sharedModels.ConversationModel({}, {sdk: {}});
+      conversation = new sharedModels.ConversationModel({}, {
+        sdk: {},
+        pendingCallTimeout: 1000
+      });
       router = new loop.webapp.WebappRouter({
         conversation: conversation,
         notifier: notifier
@@ -253,7 +258,9 @@ describe("loop.webapp", function() {
     var conversation;
 
     beforeEach(function() {
-      conversation = new sharedModels.ConversationModel({}, {sdk: {}});
+      conversation = new sharedModels.ConversationModel({}, {
+        sdk: {},
+        pendingCallTimeout: 1000});
     });
 
     describe("#initialize", function() {
@@ -268,7 +275,10 @@ describe("loop.webapp", function() {
       var conversation, initiate, view, fakeSubmitEvent;
 
       beforeEach(function() {
-        conversation = new sharedModels.ConversationModel({}, {sdk: {}});
+        conversation = new sharedModels.ConversationModel({}, {
+          sdk: {},
+          pendingCallTimeout: 1000
+        });
         view = new loop.webapp.ConversationFormView({
           model: conversation,
           notifier: notifier
@@ -307,7 +317,10 @@ describe("loop.webapp", function() {
       beforeEach(function() {
         conversation = new sharedModels.ConversationModel({
           loopToken: "fake"
-        }, {sdk: {}});
+        }, {
+          sdk: {},
+          pendingCallTimeout: 1000
+        });
         view = new loop.webapp.ConversationFormView({
           model: conversation,
           notifier: notifier
diff --git a/browser/components/moz.build b/browser/components/moz.build
index 65b1f9d5052..8b760d7f5ef 100644
--- a/browser/components/moz.build
+++ b/browser/components/moz.build
@@ -10,6 +10,7 @@ PARALLEL_DIRS += [
     'dirprovider',
     'downloads',
     'feeds',
+    'loop',
     'places',
     'preferences',
     'privatebrowsing',
@@ -22,9 +23,6 @@ PARALLEL_DIRS += [
     'migration',
 ]
 
-if CONFIG['MOZ_LOOP']:
-    PARALLEL_DIRS += ['loop']
-
 DIRS += ['build']
 
 XPIDL_SOURCES += [
diff --git a/browser/themes/linux/browser.css b/browser/themes/linux/browser.css
index 42ce70f82df..afd41e10a51 100644
--- a/browser/themes/linux/browser.css
+++ b/browser/themes/linux/browser.css
@@ -1604,12 +1604,10 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
   list-style-image: url("chrome://browser/skin/Info.png");
 }
 
-%ifdef MOZ_LOOP
 /* Loop */
 #loop-call-button {
   list-style-image: url("chrome://global/skin/loop/loop-call.png");
 }
-%endif
 
 /* social share panel */
 
diff --git a/browser/themes/osx/browser.css b/browser/themes/osx/browser.css
index 6bc7415c22e..6f4256c78d7 100644
--- a/browser/themes/osx/browser.css
+++ b/browser/themes/osx/browser.css
@@ -2226,13 +2226,11 @@ richlistitem[type~="action"][actiontype="switchtab"][selected="true"] > .ac-url-
   }
 }
 
-%ifdef MOZ_LOOP
 /* Loop */
 /* XXX - probably need retina images here */
 #loop-call-button {
   list-style-image: url("chrome://global/skin/loop/loop-call.png");
 }
-%endif
 
 /* social share panel */
 .social-share-frame {
diff --git a/browser/themes/windows/browser.css b/browser/themes/windows/browser.css
index 2c3d8680580..3181aa0e94a 100644
--- a/browser/themes/windows/browser.css
+++ b/browser/themes/windows/browser.css
@@ -1540,13 +1540,10 @@ richlistitem[type~="action"][actiontype="switchtab"] > .ac-url-box > .ac-action-
   -moz-image-region: rect(0, 48px, 16px, 32px);
 }
 
-
-%ifdef MOZ_LOOP
 /* Loop */
 #loop-call-button {
   list-style-image: url("chrome://global/skin/loop/loop-call.png");
 }
-%endif
 
 /* social share panel */
 
diff --git a/config/system-headers b/config/system-headers
index dc20eb5caf4..e67071e0d65 100644
--- a/config/system-headers
+++ b/config/system-headers
@@ -1244,6 +1244,7 @@ X11/extensions/shape.h
 X11/extensions/scrnsaver.h
 X11/extensions/XShm.h
 X11/extensions/Xrender.h
+X11/extensions/Xfixes.h
 X11/extensions/Xdamage.h
 X11/extensions/Xcomposite.h
 X11/Intrinsic.h
diff --git a/configure.in b/configure.in
index 3251e4eb2b2..c50265c11ed 100644
--- a/configure.in
+++ b/configure.in
@@ -3892,7 +3892,6 @@ LIBJPEG_TURBO_ASFLAGS=
 LIBJPEG_TURBO_X86_ASM=
 LIBJPEG_TURBO_X64_ASM=
 LIBJPEG_TURBO_ARM_ASM=
-MOZ_LOOP=$NIGHTLY_BUILD
 MOZ_PERMISSIONS=1
 MOZ_PLACES=1
 MOZ_SOCIAL=1
@@ -8177,7 +8176,7 @@ if test "$MOZ_TREE_CAIRO"; then
     MOZ_CAIRO_OSLIBS='${CAIRO_FT_OSLIBS}'
 
     if test "$MOZ_X11"; then
-        MOZ_CAIRO_OSLIBS="$MOZ_CAIRO_OSLIBS $XLDFLAGS -lXrender"
+        MOZ_CAIRO_OSLIBS="$MOZ_CAIRO_OSLIBS $XLDFLAGS -lXext -lXdamage -lXfixes -lXcomposite -lXrender"
     fi
 
     CAIRO_FEATURES_H=gfx/cairo/cairo/src/cairo-features.h
@@ -8350,12 +8349,6 @@ if test "$BUILD_CTYPES"; then
     AC_DEFINE(BUILD_CTYPES)
 fi
 
-dnl Build Loop if required
-AC_SUBST(MOZ_LOOP)
-if test "$MOZ_LOOP"; then
-  AC_DEFINE(MOZ_LOOP)
-fi
-
 dnl Build Places if required
 if test "$MOZ_PLACES"; then
   AC_DEFINE(MOZ_PLACES)
diff --git a/content/base/public/nsIContentSecurityPolicy.idl b/content/base/public/nsIContentSecurityPolicy.idl
index 37d7721de4a..a651ce91c3b 100644
--- a/content/base/public/nsIContentSecurityPolicy.idl
+++ b/content/base/public/nsIContentSecurityPolicy.idl
@@ -17,7 +17,7 @@ interface nsIPrincipal;
  * one of these per document/principal.
  */
 
-[scriptable, uuid(15c409c5-ebf8-457c-a8dd-5b169ca0b218)]
+[scriptable, uuid(3e923bf6-a974-4f3b-91c4-b4fd48b37732)]
 interface nsIContentSecurityPolicy : nsISerializable
 {
 
@@ -221,18 +221,6 @@ interface nsIContentSecurityPolicy : nsISerializable
                    in ACString        aMimeTypeGuess,
                    in nsISupports     aExtra);
 
-  /**
-   * Delegate method called by the service when sub-elements of the protected
-   * document are being processed.  Given a bit of information about the request,
-   * decides whether or not the policy is satisfied.
-   */
-  short shouldProcess(in nsContentPolicyType   aContentType,
-                      in nsIURI          aContentLocation,
-                      in nsIURI          aRequestOrigin,
-                      in nsISupports     aContext,
-                      in ACString        aMimeType,
-                      in nsISupports     aExtra);
-
 %{ C++
 // nsIObserver topic to fire when the policy encounters a violation.
 #define CSP_VIOLATION_TOPIC "csp-on-violate-policy"
diff --git a/content/base/src/ImportManager.cpp b/content/base/src/ImportManager.cpp
index 45b609a75e0..c95c81d1fcf 100644
--- a/content/base/src/ImportManager.cpp
+++ b/content/base/src/ImportManager.cpp
@@ -10,6 +10,7 @@
 #include "HTMLLinkElement.h"
 #include "nsContentPolicyUtils.h"
 #include "nsContentUtils.h"
+#include "nsCrossSiteListenerProxy.h"
 #include "nsIChannel.h"
 #include "nsIChannelPolicy.h"
 #include "nsIContentPolicy.h"
@@ -59,6 +60,7 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(ImportLoader)
 
 NS_IMPL_CYCLE_COLLECTION(ImportLoader,
                          mDocument,
+                         mImportParent,
                          mLinks)
 
 ImportLoader::ImportLoader(nsIURI* aURI, nsIDocument* aImportParent)
@@ -132,8 +134,8 @@ public:
                                                 mNode,
                                                 mSuccess ? NS_LITERAL_STRING("load")
                                                          : NS_LITERAL_STRING("error"),
-                                                /* aCanBubble = */ true,
-                                                /* aCancelable = */ true);
+                                                /* aCanBubble = */ false,
+                                                /* aCancelable = */ false);
   }
 
 private:
@@ -177,7 +179,6 @@ ImportLoader::Error(bool aUnblockScripts)
   if (aUnblockScripts) {
     UnblockScripts();
   }
-
   ReleaseResources();
 }
 
@@ -186,7 +187,6 @@ ImportLoader::Error(bool aUnblockScripts)
 void ImportLoader::ReleaseResources()
 {
   mParserStreamListener = nullptr;
-  mChannel = nullptr;
   mImportParent = nullptr;
 }
 
@@ -198,6 +198,7 @@ ImportLoader::Open()
   nsCOMPtr<nsIDocument> master = mImportParent->MasterDocument();
   nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(master);
   nsCOMPtr<nsIPrincipal> principal = sop->GetPrincipal();
+
   int16_t shouldLoad = nsIContentPolicy::ACCEPT;
   nsresult rv = NS_CheckContentLoadPolicy(nsIContentPolicy::TYPE_SCRIPT,
                                           mURI,
@@ -213,6 +214,11 @@ ImportLoader::Open()
     return;
   }
 
+  nsIScriptSecurityManager* secMan = nsContentUtils::GetSecurityManager();
+  rv = secMan->CheckLoadURIWithPrincipal(principal, mURI,
+                                         nsIScriptSecurityManager::STANDARD);
+  NS_ENSURE_SUCCESS_VOID(rv);
+
   nsCOMPtr<nsILoadGroup> loadGroup = mImportParent->GetDocumentLoadGroup();
   nsCOMPtr<nsIChannelPolicy> channelPolicy;
   nsCOMPtr<nsIContentSecurityPolicy> csp;
@@ -224,7 +230,8 @@ ImportLoader::Open()
     channelPolicy->SetContentSecurityPolicy(csp);
     channelPolicy->SetLoadType(nsIContentPolicy::TYPE_SUBDOCUMENT);
   }
-  rv = NS_NewChannel(getter_AddRefs(mChannel),
+  nsCOMPtr<nsIChannel> channel;
+  rv = NS_NewChannel(getter_AddRefs(channel),
                      mURI,
                      /* ioService = */ nullptr,
                      loadGroup,
@@ -233,7 +240,16 @@ ImportLoader::Open()
                      channelPolicy);
   NS_ENSURE_SUCCESS_VOID(rv);
 
-  mChannel->AsyncOpen(this, nullptr);
+  // Init CORSListenerProxy and omit credentials.
+  nsRefPtr<nsCORSListenerProxy> corsListener =
+    new nsCORSListenerProxy(this, principal,
+                            /* aWithCredentials */ false);
+  rv = corsListener->Init(channel, true);
+  NS_ENSURE_SUCCESS_VOID(rv);
+
+  rv = channel->AsyncOpen(corsListener, nullptr);
+  NS_ENSURE_SUCCESS_VOID(rv);
+
   BlockScripts();
   ae.Pass();
 }
@@ -248,9 +264,13 @@ ImportLoader::OnDataAvailable(nsIRequest* aRequest,
   MOZ_ASSERT(mParserStreamListener);
 
   AutoError ae(this);
-  nsresult rv = mParserStreamListener->OnDataAvailable(mChannel, aContext,
-                                                       aStream, aOffset,
-                                                       aCount);
+  nsresult rv;
+  nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest, &rv);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = mParserStreamListener->OnDataAvailable(channel, aContext,
+                                              aStream, aOffset,
+                                              aCount);
   NS_ENSURE_SUCCESS(rv, rv);
   ae.Pass();
   return rv;
@@ -278,17 +298,20 @@ ImportLoader::OnStopRequest(nsIRequest* aRequest,
   if (aStatus == NS_ERROR_DOM_ABORT_ERR) {
     // We failed in OnStartRequest, nothing more to do (we've already
     // dispatched an error event) just return here.
-    MOZ_ASSERT(!mChannel);
+    MOZ_ASSERT(mStopped);
     return NS_OK;
   }
 
-  MOZ_ASSERT(aRequest == mChannel,
-             "Wrong channel something went horribly wrong");
-
   if (mParserStreamListener) {
     mParserStreamListener->OnStopRequest(aRequest, aContext, aStatus);
   }
 
+  if (!mDocument) {
+    // If at this point we don't have a document, then the error was
+    // already reported.
+    return NS_ERROR_DOM_ABORT_ERR;
+  }
+
   nsCOMPtr<EventTarget> eventTarget = do_QueryInterface(mDocument);
   EventListenerManager* manager = eventTarget->GetOrCreateListenerManager();
   manager->AddEventListenerByType(this,
@@ -300,16 +323,31 @@ ImportLoader::OnStopRequest(nsIRequest* aRequest,
 NS_IMETHODIMP
 ImportLoader::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
 {
-  MOZ_ASSERT(aRequest == mChannel,
-             "Wrong channel, something went horribly wrong");
-
   AutoError ae(this);
   nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(mImportParent);
   nsCOMPtr<nsIPrincipal> principal = sop->GetPrincipal();
-  mChannel->SetOwner(principal);
+  if (!sop) {
+    return NS_ERROR_DOM_ABORT_ERR;
+  }
+
+  nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest);
+  if (!channel) {
+    return NS_ERROR_DOM_ABORT_ERR;
+  }
+
+  if (nsContentUtils::IsSystemPrincipal(principal)) {
+    // We should never import non-system documents and run their scripts with system principal!
+    nsCOMPtr<nsIPrincipal> channelPrincipal;
+    nsContentUtils::GetSecurityManager()->GetChannelPrincipal(channel,
+                                                              getter_AddRefs(channelPrincipal));
+    if (!nsContentUtils::IsSystemPrincipal(channelPrincipal)) {
+      return NS_ERROR_FAILURE;
+    }
+  }
+  channel->SetOwner(principal);
 
   nsAutoCString type;
-  mChannel->GetContentType(type);
+  channel->GetContentType(type);
   if (!type.EqualsLiteral("text/html")) {
     NS_WARNING("ImportLoader wrong content type");
     return NS_ERROR_DOM_ABORT_ERR;
@@ -332,11 +370,15 @@ ImportLoader::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
   nsCOMPtr<nsIDocument> master = mImportParent->MasterDocument();
   mDocument->SetMasterDocument(master);
 
-  // We have to connect the blank document we created with the channel we opened.
+  // We have to connect the blank document we created with the channel we opened,
+  // and create its own LoadGroup for it.
   nsCOMPtr<nsIStreamListener> listener;
   nsCOMPtr<nsILoadGroup> loadGroup;
-  mChannel->GetLoadGroup(getter_AddRefs(loadGroup));
-  rv = mDocument->StartDocumentLoad("import", mChannel, loadGroup,
+  channel->GetLoadGroup(getter_AddRefs(loadGroup));
+  nsCOMPtr<nsILoadGroup> newLoadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
+  NS_ENSURE_TRUE(newLoadGroup, NS_ERROR_OUT_OF_MEMORY);
+  newLoadGroup->SetLoadGroup(loadGroup);
+  rv = mDocument->StartDocumentLoad("import", channel, newLoadGroup,
                                     nullptr, getter_AddRefs(listener),
                                     true);
   NS_ENSURE_SUCCESS(rv, NS_ERROR_DOM_ABORT_ERR);
diff --git a/content/base/src/ImportManager.h b/content/base/src/ImportManager.h
index d87a9f3bb17..783b4a7d9cd 100644
--- a/content/base/src/ImportManager.h
+++ b/content/base/src/ImportManager.h
@@ -117,7 +117,6 @@ private:
 
   nsCOMPtr<nsIDocument> mDocument;
   nsCOMPtr<nsIURI> mURI;
-  nsCOMPtr<nsIChannel> mChannel;
   nsCOMPtr<nsIStreamListener> mParserStreamListener;
   nsCOMPtr<nsIDocument> mImportParent;
   // List of the LinkElements that are referring to this import
diff --git a/content/base/src/nsCSPContext.cpp b/content/base/src/nsCSPContext.cpp
index 8fdb07638a4..f7d6e400cb3 100644
--- a/content/base/src/nsCSPContext.cpp
+++ b/content/base/src/nsCSPContext.cpp
@@ -209,19 +209,6 @@ nsCSPContext::ShouldLoad(nsContentPolicyType aContentType,
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsCSPContext::ShouldProcess(nsContentPolicyType aContentType,
-                            nsIURI*             aContentLocation,
-                            nsIURI*             aRequestOrigin,
-                            nsISupports*        aRequestContext,
-                            const nsACString&   aMimeType,
-                            nsISupports*        aExtra,
-                            int16_t*            outDecision)
-{
-  *outDecision = nsIContentPolicy::ACCEPT;
-  return NS_OK;
-}
-
 /* ===== nsISupports implementation ========== */
 
 NS_IMPL_CLASSINFO(nsCSPContext,
diff --git a/content/base/src/nsCSPService.cpp b/content/base/src/nsCSPService.cpp
index 178a17b0ee9..d48018b6b60 100644
--- a/content/base/src/nsCSPService.cpp
+++ b/content/base/src/nsCSPService.cpp
@@ -218,56 +218,7 @@ CSPService::ShouldProcess(uint32_t         aContentType,
   if (!aContentLocation)
     return NS_ERROR_FAILURE;
 
-  // default decision is to accept the item
   *aDecision = nsIContentPolicy::ACCEPT;
-
-  // No need to continue processing if CSP is disabled
-  if (!sCSPEnabled)
-    return NS_OK;
-
-  // find the nsDocument that initiated this request and see if it has a
-  // CSP policy object
-  nsCOMPtr<nsINode> node(do_QueryInterface(aRequestContext));
-  nsCOMPtr<nsIPrincipal> principal;
-  nsCOMPtr<nsIContentSecurityPolicy> csp;
-  if (node) {
-    principal = node->NodePrincipal();
-    principal->GetCsp(getter_AddRefs(csp));
-
-    if (csp) {
-#ifdef PR_LOGGING
-      {
-        uint32_t numPolicies = 0;
-        nsresult rv = csp->GetPolicyCount(&numPolicies);
-        if (NS_SUCCEEDED(rv)) {
-          for (uint32_t i=0; i<numPolicies; i++) {
-            nsAutoString policy;
-            csp->GetPolicy(i, policy);
-            PR_LOG(gCspPRLog, PR_LOG_DEBUG,
-                   ("shouldProcess - document has policy[%d]: %s", i,
-                   NS_ConvertUTF16toUTF8(policy).get()));
-          }
-        }
-      }
-#endif
-      // obtain the enforcement decision
-      csp->ShouldProcess(aContentType,
-                         aContentLocation,
-                         aRequestOrigin,
-                         aRequestContext,
-                         aMimeTypeGuess,
-                         aExtra,
-                         aDecision);
-    }
-  }
-#ifdef PR_LOGGING
-  else {
-    nsAutoCString uriSpec;
-    aContentLocation->GetSpec(uriSpec);
-    PR_LOG(gCspPRLog, PR_LOG_DEBUG,
-           ("COULD NOT get nsINode for location: %s", uriSpec.get()));
-  }
-#endif
   return NS_OK;
 }
 
diff --git a/content/html/content/test/file_imports_redirect.html b/content/html/content/test/file_imports_redirect.html
new file mode 100644
index 00000000000..eaca3f49fd1
--- /dev/null
+++ b/content/html/content/test/file_imports_redirect.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<body>
+</body>
+</html>
diff --git a/content/html/content/test/file_imports_redirect.html^headers^ b/content/html/content/test/file_imports_redirect.html^headers^
new file mode 100644
index 00000000000..3a348336451
--- /dev/null
+++ b/content/html/content/test/file_imports_redirect.html^headers^
@@ -0,0 +1,2 @@
+HTTP 301 Moved Permanently
+Location: http://mochi.test:8888/tests/content/html/content/test/file_imports_redirected.html
diff --git a/content/html/content/test/file_imports_redirected.html b/content/html/content/test/file_imports_redirected.html
new file mode 100644
index 00000000000..031ca313d54
--- /dev/null
+++ b/content/html/content/test/file_imports_redirected.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script> var redirected = true; </script>
+</body>
+</html>
diff --git a/content/html/content/test/mochitest.ini b/content/html/content/test/mochitest.ini
index b9d4895ed60..40f4da2c45b 100644
--- a/content/html/content/test/mochitest.ini
+++ b/content/html/content/test/mochitest.ini
@@ -148,6 +148,9 @@ support-files =
   file_iframe_sandbox_window_top_navigation_fail.html
   file_iframe_sandbox_worker.js
   file_imports_basics.html
+  file_imports_redirect.html
+  file_imports_redirect.html^headers^
+  file_imports_redirected.html
   file_srcdoc-2.html
   file_srcdoc.html
   form_submit_server.sjs
@@ -454,6 +457,8 @@ skip-if = buildapp == 'b2g' || e10s # b2g(multiple concurrent window.open()s fai
 [test_img_attributes_reflection.html]
 [test_imageSrcSet.html]
 [test_imports_basics.html]
+[test_imports_redirect.html]
+[test_imports_nonhttp.html]
 [test_li_attributes_reflection.html]
 [test_link_attributes_reflection.html]
 [test_link_sizes.html]
diff --git a/content/html/content/test/test_imports_nonhttp.html b/content/html/content/test/test_imports_nonhttp.html
new file mode 100644
index 00000000000..7a562059925
--- /dev/null
+++ b/content/html/content/test/test_imports_nonhttp.html
@@ -0,0 +1,56 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1016875
+-->
+<head>
+  <title>Test for Bug 1016875</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+</head>
+<body>
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1016875">Mozilla Bug 1016875</a>
+
+  <script type="text/javascript">
+    //<![CDATA[
+    SimpleTest.waitForExplicitFinish();
+    var counter = 0;
+    function loaded() {
+      if ( counter++ == 1 ) {
+        ok(document.getElementById("import1").import.getElementById("div1"),
+           "import document was loaded");
+        ok(document.getElementById("import2").import.getElementById("div1"),
+           "import document was loaded");
+        SimpleTest.finish();
+      }
+    }
+    function failed() {
+      ok(false, "Import should not have failed")
+      SimpleTest.finish();
+    }
+    var link = document.createElement("link");
+    link.setAttribute("id", "import1");
+    link.setAttribute("rel", "import");
+    var stringDoc = "<!DOCTYPE html><html><body><div id='div1'></div></body></html>";
+    var encoded = btoa(stringDoc);
+    var dataurl = "data:text/html;base64," + encoded;
+    link.setAttribute("href", dataurl);
+    link.onload = loaded;
+    link.onerror = failed;
+    document.body.appendChild(link);
+
+    var link = document.createElement("link");
+    link.setAttribute("id", "import2");
+    link.setAttribute("rel", "import");
+    var blob = new Blob([stringDoc], {type : 'text/html'});
+    var objectURL = URL.createObjectURL(blob);
+    link.setAttribute("href", objectURL);
+    link.onload = loaded;
+    link.onerror = failed;
+    document.body.appendChild(link);
+    //]]>
+  </script>
+
+</body>
+</html>
diff --git a/content/html/content/test/test_imports_redirect.html b/content/html/content/test/test_imports_redirect.html
new file mode 100644
index 00000000000..610f24a4e96
--- /dev/null
+++ b/content/html/content/test/test_imports_redirect.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1016875
+-->
+<head>
+  <title>Test for Bug 1016875</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+</head>
+<body>
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1016875">Mozilla Bug 1016875</a>
+
+  <script type="text/javascript">
+    SimpleTest.waitForExplicitFinish();
+    var loadEventFired = false;
+    var errorEventFired = false;
+    var counter = 0;
+    function loaded() {
+      loadEventFired = true;
+    }
+    function failed() {
+      errorEventFired = true;
+    }
+  </script>
+
+  <link rel="import" href="http://mochi.test:8888/tests/content/html/content/test/file_imports_redirect.html" id="import" onload="loaded()" onerror="failed()"></link>
+
+  <script type="text/javascript">
+    ok(loadEventFired, "Load event was fired");
+    ok(!errorEventFired, "Error event was not fired, redirection worked");
+    ok(redirected, "Script of the target of redirection was executed");
+
+    SimpleTest.finish();
+  </script>
+
+</body>
+</html>
diff --git a/content/media/test/mochitest.ini b/content/media/test/mochitest.ini
index 20f1c60894a..b5219dc921e 100644
--- a/content/media/test/mochitest.ini
+++ b/content/media/test/mochitest.ini
@@ -405,7 +405,6 @@ skip-if = buildapp == 'b2g' || toolkit == 'android' # Disabled on Android & B2G
 [test_played.html]
 skip-if = true # bug 1021794
 [test_preload_actions.html]
-skip-if = toolkit == 'android' # bug 886188
 [test_preload_attribute.html]
 [test_preload_suspend.html]
 skip-if = true # bug 493692
diff --git a/content/media/webrtc/MediaEngine.h b/content/media/webrtc/MediaEngine.h
index 241c6b4dfab..39b58a4221f 100644
--- a/content/media/webrtc/MediaEngine.h
+++ b/content/media/webrtc/MediaEngine.h
@@ -9,6 +9,7 @@
 #include "nsIDOMFile.h"
 #include "DOMMediaStream.h"
 #include "MediaStreamGraph.h"
+#include "mozilla/dom/MediaStreamTrackBinding.h"
 
 namespace mozilla {
 
@@ -54,11 +55,13 @@ public:
 
   /* Populate an array of video sources in the nsTArray. Also include devices
    * that are currently unavailable. */
-  virtual void EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSource> >*) = 0;
+  virtual void EnumerateVideoDevices(dom::MediaSourceEnum,
+                                     nsTArray<nsRefPtr<MediaEngineVideoSource> >*) = 0;
 
   /* Populate an array of audio sources in the nsTArray. Also include devices
    * that are currently unavailable. */
-  virtual void EnumerateAudioDevices(nsTArray<nsRefPtr<MediaEngineAudioSource> >*) = 0;
+  virtual void EnumerateAudioDevices(dom::MediaSourceEnum,
+                                     nsTArray<nsRefPtr<MediaEngineAudioSource> >*) = 0;
 
 protected:
   virtual ~MediaEngine() {}
@@ -182,6 +185,9 @@ class MediaEngineVideoSource : public MediaEngineSource
 public:
   virtual ~MediaEngineVideoSource() {}
 
+  virtual const dom::MediaSourceEnum GetMediaSource() {
+      return dom::MediaSourceEnum::Camera;
+  }
   /* This call reserves but does not start the device. */
   virtual nsresult Allocate(const VideoTrackConstraintsN &aConstraints,
                             const MediaEnginePrefs &aPrefs) = 0;
diff --git a/content/media/webrtc/MediaEngineDefault.cpp b/content/media/webrtc/MediaEngineDefault.cpp
index eb7b73d2639..90d64796e9b 100644
--- a/content/media/webrtc/MediaEngineDefault.cpp
+++ b/content/media/webrtc/MediaEngineDefault.cpp
@@ -478,9 +478,15 @@ MediaEngineDefaultAudioSource::Notify(nsITimer* aTimer)
 }
 
 void
-MediaEngineDefault::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSource> >* aVSources) {
+MediaEngineDefault::EnumerateVideoDevices(dom::MediaSourceEnum aMediaSource,
+                                          nsTArray<nsRefPtr<MediaEngineVideoSource> >* aVSources) {
   MutexAutoLock lock(mMutex);
 
+  // only supports camera sources (for now).  See Bug 1038241
+  if (aMediaSource != dom::MediaSourceEnum::Camera) {
+    return;
+  }
+
   // We once had code here to find a VideoSource with the same settings and re-use that.
   // This no longer is possible since the resolution is being set in Allocate().
 
@@ -492,10 +498,13 @@ MediaEngineDefault::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSour
 }
 
 void
-MediaEngineDefault::EnumerateAudioDevices(nsTArray<nsRefPtr<MediaEngineAudioSource> >* aASources) {
+MediaEngineDefault::EnumerateAudioDevices(dom::MediaSourceEnum aMediaSource,
+                                          nsTArray<nsRefPtr<MediaEngineAudioSource> >* aASources) {
   MutexAutoLock lock(mMutex);
   int32_t len = mASources.Length();
 
+  // aMediaSource is ignored for audio devices (for now).
+
   for (int32_t i = 0; i < len; i++) {
     nsRefPtr<MediaEngineAudioSource> source = mASources.ElementAt(i);
     if (source->IsAvailable()) {
diff --git a/content/media/webrtc/MediaEngineDefault.h b/content/media/webrtc/MediaEngineDefault.h
index 0cfd70e8a15..f69956b51db 100644
--- a/content/media/webrtc/MediaEngineDefault.h
+++ b/content/media/webrtc/MediaEngineDefault.h
@@ -138,8 +138,10 @@ public:
   : mMutex("mozilla::MediaEngineDefault")
   {}
 
-  virtual void EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSource> >*);
-  virtual void EnumerateAudioDevices(nsTArray<nsRefPtr<MediaEngineAudioSource> >*);
+  virtual void EnumerateVideoDevices(dom::MediaSourceEnum,
+                                     nsTArray<nsRefPtr<MediaEngineVideoSource> >*);
+  virtual void EnumerateAudioDevices(dom::MediaSourceEnum,
+                                     nsTArray<nsRefPtr<MediaEngineAudioSource> >*);
 
 private:
   ~MediaEngineDefault() {}
diff --git a/content/media/webrtc/MediaEngineWebRTC.cpp b/content/media/webrtc/MediaEngineWebRTC.cpp
index 7543e8ce594..3e09793d78e 100644
--- a/content/media/webrtc/MediaEngineWebRTC.cpp
+++ b/content/media/webrtc/MediaEngineWebRTC.cpp
@@ -45,12 +45,15 @@ GetUserMediaLog()
 namespace mozilla {
 
 MediaEngineWebRTC::MediaEngineWebRTC(MediaEnginePrefs &aPrefs)
-  : mMutex("mozilla::MediaEngineWebRTC")
-  , mVideoEngine(nullptr)
-  , mVoiceEngine(nullptr)
-  , mVideoEngineInit(false)
-  , mAudioEngineInit(false)
-  , mHasTabVideoSource(false)
+    : mMutex("mozilla::MediaEngineWebRTC")
+    , mScreenEngine(nullptr)
+    , mAppEngine(nullptr)
+    , mVideoEngine(nullptr)
+    , mVoiceEngine(nullptr)
+    , mVideoEngineInit(false)
+    , mAudioEngineInit(false)
+    , mScreenEngineInit(false)
+    , mAppEngineInit(false)
 {
 #ifndef MOZ_B2G_CAMERA
   nsCOMPtr<nsIComponentRegistrar> compMgr;
@@ -69,11 +72,18 @@ MediaEngineWebRTC::MediaEngineWebRTC(MediaEnginePrefs &aPrefs)
 }
 
 void
-MediaEngineWebRTC::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSource> >* aVSources)
+MediaEngineWebRTC::EnumerateVideoDevices(dom::MediaSourceEnum aMediaSource,
+                                         nsTArray<nsRefPtr<MediaEngineVideoSource> >* aVSources)
 {
-#ifdef MOZ_B2G_CAMERA
+  // We spawn threads to handle gUM runnables, so we must protect the member vars
   MutexAutoLock lock(mMutex);
 
+ #ifdef MOZ_B2G_CAMERA
+  if (aMediaSource != dom::MediaSourceEnum::Camera) {
+    // only supports camera sources
+    return;
+  }
+
   /**
    * We still enumerate every time, in case a new device was plugged in since
    * the last call. TODO: Verify that WebRTC actually does deal with hotplugging
@@ -102,7 +112,7 @@ MediaEngineWebRTC::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSourc
       // We've already seen this device, just append.
       aVSources->AppendElement(vSource.get());
     } else {
-      vSource = new MediaEngineWebRTCVideoSource(i);
+      vSource = new MediaEngineWebRTCVideoSource(i, aMediaSource);
       mVideoSources.Put(uuid, vSource); // Hashtable takes ownership.
       aVSources->AppendElement(vSource);
     }
@@ -112,9 +122,9 @@ MediaEngineWebRTC::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSourc
 #else
   ScopedCustomReleasePtr<webrtc::ViEBase> ptrViEBase;
   ScopedCustomReleasePtr<webrtc::ViECapture> ptrViECapture;
-
-  // We spawn threads to handle gUM runnables, so we must protect the member vars
-  MutexAutoLock lock(mMutex);
+  webrtc::Config configSet;
+  webrtc::VideoEngine *videoEngine = nullptr;
+  bool *videoEngineInit = nullptr;
 
 #ifdef MOZ_WIDGET_ANDROID
   // get the JVM
@@ -125,25 +135,53 @@ MediaEngineWebRTC::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSourc
     return;
   }
 #endif
-  if (!mVideoEngine) {
-    if (!(mVideoEngine = webrtc::VideoEngine::Create())) {
-      return;
-    }
+
+  switch (aMediaSource) {
+    case dom::MediaSourceEnum::Application:
+      mAppEngineConfig.Set<webrtc::CaptureDeviceInfo>(
+          new webrtc::CaptureDeviceInfo(webrtc::CaptureDeviceType::Application));
+      if (!mAppEngine) {
+        if (!(mAppEngine = webrtc::VideoEngine::Create(mAppEngineConfig))) {
+          return;
+        }
+      }
+      videoEngine = mAppEngine;
+      videoEngineInit = &mAppEngineInit;
+      break;
+    case dom::MediaSourceEnum::Screen:
+      mScreenEngineConfig.Set<webrtc::CaptureDeviceInfo>(
+          new webrtc::CaptureDeviceInfo(webrtc::CaptureDeviceType::Screen));
+      if (!mScreenEngine) {
+        if (!(mScreenEngine = webrtc::VideoEngine::Create(mScreenEngineConfig))) {
+          return;
+        }
+      }
+      videoEngine = mScreenEngine;
+      videoEngineInit = &mScreenEngineInit;
+      break;
+    case dom::MediaSourceEnum::Camera:
+      // fall through
+    default:
+      if (!mVideoEngine) {
+        if (!(mVideoEngine = webrtc::VideoEngine::Create())) {
+          return;
+        }
+      }
+      videoEngine = mVideoEngine;
+      videoEngineInit = &mVideoEngineInit;
+      break;
   }
 
-  ptrViEBase = webrtc::ViEBase::GetInterface(mVideoEngine);
+  ptrViEBase = webrtc::ViEBase::GetInterface(videoEngine);
   if (!ptrViEBase) {
     return;
   }
-
-  if (!mVideoEngineInit) {
-    if (ptrViEBase->Init() < 0) {
-      return;
-    }
-    mVideoEngineInit = true;
+  if (ptrViEBase->Init() < 0) {
+    return;
   }
+  *videoEngineInit = true;
 
-  ptrViECapture = webrtc::ViECapture::GetInterface(mVideoEngine);
+  ptrViECapture = webrtc::ViECapture::GetInterface(videoEngine);
   if (!ptrViECapture) {
     return;
   }
@@ -207,7 +245,7 @@ MediaEngineWebRTC::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSourc
       // We've already seen this device, just append.
       aVSources->AppendElement(vSource.get());
     } else {
-      vSource = new MediaEngineWebRTCVideoSource(mVideoEngine, i);
+      vSource = new MediaEngineWebRTCVideoSource(videoEngine, i, aMediaSource);
       mVideoSources.Put(uuid, vSource); // Hashtable takes ownership.
       aVSources->AppendElement(vSource);
     }
@@ -221,7 +259,8 @@ MediaEngineWebRTC::EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSourc
 }
 
 void
-MediaEngineWebRTC::EnumerateAudioDevices(nsTArray<nsRefPtr<MediaEngineAudioSource> >* aASources)
+MediaEngineWebRTC::EnumerateAudioDevices(dom::MediaSourceEnum aMediaSource,
+                                         nsTArray<nsRefPtr<MediaEngineAudioSource> >* aASources)
 {
   ScopedCustomReleasePtr<webrtc::VoEBase> ptrVoEBase;
   ScopedCustomReleasePtr<webrtc::VoEHardware> ptrVoEHw;
@@ -323,6 +362,13 @@ MediaEngineWebRTC::Shutdown()
     webrtc::VideoEngine::Delete(mVideoEngine);
   }
 
+  if (mScreenEngine) {
+    webrtc::VideoEngine::Delete(mScreenEngine);
+  }
+  if (mAppEngine) {
+    webrtc::VideoEngine::Delete(mAppEngine);
+  }
+
   if (mVoiceEngine) {
     mAudioSources.Clear();
     mVoiceEngine->SetTraceCallback(nullptr);
@@ -331,6 +377,8 @@ MediaEngineWebRTC::Shutdown()
 
   mVideoEngine = nullptr;
   mVoiceEngine = nullptr;
+  mScreenEngine = nullptr;
+  mAppEngine = nullptr;
 
   if (mThread) {
     mThread->Shutdown();
diff --git a/content/media/webrtc/MediaEngineWebRTC.h b/content/media/webrtc/MediaEngineWebRTC.h
index 79e1fae12c3..d1b72a16f51 100644
--- a/content/media/webrtc/MediaEngineWebRTC.h
+++ b/content/media/webrtc/MediaEngineWebRTC.h
@@ -28,9 +28,9 @@
 #include "MediaStreamGraph.h"
 
 #include "MediaEngineWrapper.h"
-
+#include "mozilla/dom/MediaStreamTrackBinding.h"
 // WebRTC library includes follow
-
+#include "webrtc/common.h"
 // Audio Engine
 #include "webrtc/voice_engine/include/voe_base.h"
 #include "webrtc/voice_engine/include/voe_codec.h"
@@ -95,12 +95,14 @@ class MediaEngineWebRTCVideoSource : public MediaEngineVideoSource
 {
 public:
 #ifdef MOZ_B2G_CAMERA
-  MediaEngineWebRTCVideoSource(int aIndex)
+  MediaEngineWebRTCVideoSource(int aIndex,
+                               dom::MediaSourceEnum aMediaSource = dom::MediaSourceEnum::Camera)
     : mCameraControl(nullptr)
     , mCallbackMonitor("WebRTCCamera.CallbackMonitor")
     , mRotation(0)
     , mBackCamera(false)
     , mCaptureIndex(aIndex)
+    , mMediaSource(aMediaSource)
     , mMonitor("WebRTCCamera.Monitor")
     , mWidth(0)
     , mHeight(0)
@@ -124,11 +126,13 @@ public:
    */
   virtual bool IsTextureSupported() { return false; }
 
-  MediaEngineWebRTCVideoSource(webrtc::VideoEngine* aVideoEnginePtr, int aIndex)
+  MediaEngineWebRTCVideoSource(webrtc::VideoEngine* aVideoEnginePtr, int aIndex,
+                               dom::MediaSourceEnum aMediaSource = dom::MediaSourceEnum::Camera)
     : mVideoEngine(aVideoEnginePtr)
     , mCaptureIndex(aIndex)
     , mFps(-1)
     , mMinFps(-1)
+    , mMediaSource(aMediaSource)
     , mMonitor("WebRTCCamera.Monitor")
     , mWidth(0)
     , mHeight(0)
@@ -165,6 +169,10 @@ public:
     return false;
   }
 
+  virtual const dom::MediaSourceEnum GetMediaSource() {
+    return mMediaSource;
+  }
+
 #ifndef MOZ_B2G_CAMERA
   NS_DECL_THREADSAFE_ISUPPORTS
 #else
@@ -239,6 +247,7 @@ private:
   int mCaptureIndex;
   int mFps; // Track rate (30 fps by default)
   int mMinFps; // Min rate we want to accept
+  dom::MediaSourceEnum mMediaSource; // source of media (camera | application | screen)
 
   // mMonitor protects mImage access/changes, and transitions of mState
   // from kStarted to kStopped (which are combined with EndTrack() and
@@ -381,9 +390,10 @@ public:
   // before invoking Shutdown on this class.
   void Shutdown();
 
-  virtual void EnumerateVideoDevices(nsTArray<nsRefPtr<MediaEngineVideoSource> >*);
-  virtual void EnumerateAudioDevices(nsTArray<nsRefPtr<MediaEngineAudioSource> >*);
-
+  virtual void EnumerateVideoDevices(dom::MediaSourceEnum,
+                                    nsTArray<nsRefPtr<MediaEngineVideoSource> >*);
+  virtual void EnumerateAudioDevices(dom::MediaSourceEnum,
+                                    nsTArray<nsRefPtr<MediaEngineAudioSource> >*);
 private:
   ~MediaEngineWebRTC() {
     Shutdown();
@@ -397,14 +407,22 @@ private:
   nsCOMPtr<nsIThread> mThread;
 
   Mutex mMutex;
-  // protected with mMutex:
 
+  // protected with mMutex:
+  webrtc::VideoEngine* mScreenEngine;
+  webrtc::VideoEngine* mAppEngine;
   webrtc::VideoEngine* mVideoEngine;
   webrtc::VoiceEngine* mVoiceEngine;
 
+  // specialized configurations
+  webrtc::Config mAppEngineConfig;
+  webrtc::Config mScreenEngineConfig;
+
   // Need this to avoid unneccesary WebRTC calls while enumerating.
   bool mVideoEngineInit;
   bool mAudioEngineInit;
+  bool mScreenEngineInit;
+  bool mAppEngineInit;
   bool mHasTabVideoSource;
 
   // Store devices we've already seen in a hashtable for quick return.
diff --git a/content/media/webrtc/MediaTrackConstraints.h b/content/media/webrtc/MediaTrackConstraints.h
index 6edc855502a..e85bca8919b 100644
--- a/content/media/webrtc/MediaTrackConstraints.h
+++ b/content/media/webrtc/MediaTrackConstraints.h
@@ -42,6 +42,19 @@ public:
         }
       }
     }
+
+    // treat MediaSource special because it's always required
+    mRequired.mMediaSource = mMediaSource;
+
+    if (mMediaSource != dom::MediaSourceEnum::Camera && mAdvanced.WasPassed()) {
+      // iterate through advanced, forcing mediaSource to match "root"
+      auto& array = mAdvanced.Value();
+      for (uint32_t i = 0; i < array.Length(); i++) {
+        if (array[i].mMediaSource == dom::MediaSourceEnum::Camera) {
+          array[i].mMediaSource = mMediaSource;
+        }
+      }
+    }
   }
 protected:
   MediaTrackConstraintSet& Triage(const Kind kind) {
@@ -85,6 +98,9 @@ struct VideoTrackConstraintsN :
     Triage(Kind::Width).mWidth = mWidth;
     Triage(Kind::Height).mHeight = mHeight;
     Triage(Kind::FrameRate).mFrameRate = mFrameRate;
+
+    // treat MediaSource special because it's always required
+    mRequired.mMediaSource = mMediaSource;
   }
 };
 
diff --git a/dom/base/MessagePort.cpp b/dom/base/MessagePort.cpp
index 15e81ab397c..e2777b99a1c 100644
--- a/dom/base/MessagePort.cpp
+++ b/dom/base/MessagePort.cpp
@@ -185,10 +185,12 @@ PostMessageReadTransferStructuredClone(JSContext* aCx,
     scInfo->mPorts.Put(port, nullptr);
 
     JS::Rooted<JSObject*> obj(aCx, port->WrapObject(aCx));
-    if (JS_WrapObject(aCx, &obj)) {
-      MOZ_ASSERT(port->GetOwner() == scInfo->mPort->GetOwner());
-      returnObject.set(obj);
+    if (!obj || !JS_WrapObject(aCx, &obj)) {
+      return false;
     }
+
+    MOZ_ASSERT(port->GetOwner() == scInfo->mPort->GetOwner());
+    returnObject.set(obj);
     return true;
   }
 
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index a72ebf53f92..eb0e94e78c2 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -3017,6 +3017,14 @@ nsJSContext::EnsureStatics()
   Preferences::RegisterCallbackAndCall(SetIncrementalCCPrefChangedCallback,
                                        "dom.cycle_collector.incremental");
 
+  Preferences::RegisterCallbackAndCall(SetMemoryGCPrefChangedCallback,
+                                       "javascript.options.mem.gc_min_empty_chunk_count",
+                                       (void *)JSGC_MIN_EMPTY_CHUNK_COUNT);
+
+  Preferences::RegisterCallbackAndCall(SetMemoryGCPrefChangedCallback,
+                                       "javascript.options.mem.gc_max_empty_chunk_count",
+                                       (void *)JSGC_MAX_EMPTY_CHUNK_COUNT);
+
   nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
   if (!obs) {
     MOZ_CRASH();
diff --git a/dom/bluetooth2/bluedroid/BluetoothInterface.cpp b/dom/bluetooth2/bluedroid/BluetoothInterface.cpp
index 54d3dd54026..cd5d01ee46a 100644
--- a/dom/bluetooth2/bluedroid/BluetoothInterface.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothInterface.cpp
@@ -4,9 +4,14 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include <errno.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#include "base/message_loop.h"
 #include "BluetoothInterface.h"
 #include "nsAutoPtr.h"
 #include "nsThreadUtils.h"
+#include "nsXULAppAPI.h"
 
 BEGIN_BLUETOOTH_NAMESPACE
 
@@ -69,6 +74,40 @@ private:
   Arg1 mArg1;
 };
 
+template <typename Obj, typename Res,
+          typename Arg1, typename Arg2, typename Arg3>
+class BluetoothInterfaceRunnable3 : public nsRunnable
+{
+public:
+  BluetoothInterfaceRunnable3(Obj* aObj,
+                              Res (Obj::*aMethod)(Arg1, Arg2, Arg3),
+                              const Arg1& aArg1, const Arg2& aArg2,
+                              const Arg3& aArg3)
+  : mObj(aObj)
+  , mMethod(aMethod)
+  , mArg1(aArg1)
+  , mArg2(aArg2)
+  , mArg3(aArg3)
+  {
+    MOZ_ASSERT(mObj);
+    MOZ_ASSERT(mMethod);
+  }
+
+  NS_METHOD
+  Run() MOZ_OVERRIDE
+  {
+    ((*mObj).*mMethod)(mArg1, mArg2, mArg3);
+    return NS_OK;
+  }
+
+private:
+  nsRefPtr<Obj> mObj;
+  void (Obj::*mMethod)(Arg1, Arg2, Arg3);
+  Arg1 mArg1;
+  Arg2 mArg2;
+  Arg3 mArg3;
+};
+
 //
 // Socket Interface
 //
@@ -84,23 +123,432 @@ struct interface_traits<BluetoothSocketInterface>
   }
 };
 
-bt_status_t
-BluetoothSocketInterface::Listen(btsock_type_t aType,
-                                 const char* aServiceName,
-                                 const uint8_t* aServiceUuid, int aChannel,
-                                 int& aSockFd, int aFlags)
+typedef
+  BluetoothInterfaceRunnable1<BluetoothSocketResultHandler, void, int>
+  BluetoothSocketIntResultRunnable;
+
+typedef
+  BluetoothInterfaceRunnable3<BluetoothSocketResultHandler,
+                              void, int, const nsAString_internal&, int>
+  BluetoothSocketIntStringIntResultRunnable;
+
+typedef
+  BluetoothInterfaceRunnable1<BluetoothSocketResultHandler, void, bt_status_t>
+  BluetoothSocketErrorRunnable;
+
+static nsresult
+DispatchBluetoothSocketResult(BluetoothSocketResultHandler* aRes,
+                              void (BluetoothSocketResultHandler::*aMethod)(int),
+                              int aArg, bt_status_t aStatus)
 {
-  return mInterface->listen(aType, aServiceName, aServiceUuid, aChannel,
-                           &aSockFd, aFlags);
+  MOZ_ASSERT(aRes);
+
+  nsRunnable* runnable;
+
+  if (aStatus == BT_STATUS_SUCCESS) {
+    runnable = new BluetoothSocketIntResultRunnable(aRes, aMethod, aArg);
+  } else {
+    runnable = new BluetoothSocketErrorRunnable(aRes,
+      &BluetoothSocketResultHandler::OnError, aStatus);
+  }
+  nsresult rv = NS_DispatchToMainThread(runnable);
+  if (NS_FAILED(rv)) {
+    BT_WARNING("NS_DispatchToMainThread failed: %X", rv);
+  }
+  return rv;
 }
 
-bt_status_t
+static nsresult
+DispatchBluetoothSocketResult(
+  BluetoothSocketResultHandler* aRes,
+  void (BluetoothSocketResultHandler::*aMethod)(int, const nsAString&, int),
+  int aArg1, const nsAString& aArg2, int aArg3, bt_status_t aStatus)
+{
+  MOZ_ASSERT(aRes);
+
+  nsRunnable* runnable;
+
+  if (aStatus == BT_STATUS_SUCCESS) {
+    runnable = new BluetoothSocketIntStringIntResultRunnable(aRes, aMethod,
+                                                             aArg1, aArg2,
+                                                             aArg3);
+  } else {
+    runnable = new BluetoothSocketErrorRunnable(aRes,
+      &BluetoothSocketResultHandler::OnError, aStatus);
+  }
+  nsresult rv = NS_DispatchToMainThread(runnable);
+  if (NS_FAILED(rv)) {
+    BT_WARNING("NS_DispatchToMainThread failed: %X", rv);
+  }
+  return rv;
+}
+
+void
+BluetoothSocketInterface::Listen(btsock_type_t aType,
+                                 const char* aServiceName,
+                                 const uint8_t* aServiceUuid,
+                                 int aChannel, int aFlags,
+                                 BluetoothSocketResultHandler* aRes)
+{
+  int fd;
+
+  bt_status_t status = mInterface->listen(aType, aServiceName, aServiceUuid,
+                                          aChannel, &fd, aFlags);
+  if (aRes) {
+    DispatchBluetoothSocketResult(aRes, &BluetoothSocketResultHandler::Listen,
+                                  fd, status);
+  }
+}
+
+#define CMSGHDR_CONTAINS_FD(_cmsghdr) \
+    ( ((_cmsghdr)->cmsg_level == SOL_SOCKET) && \
+      ((_cmsghdr)->cmsg_type == SCM_RIGHTS) )
+
+/* |SocketMessageWatcher| receives Bluedroid's socket setup
+ * messages on the I/O thread. You need to inherit from this
+ * class to make use of it.
+ *
+ * Bluedroid sends two socket info messages (20 bytes) at
+ * the beginning of a connection to both peers.
+ *
+ *   - 1st message: [channel:4]
+ *   - 2nd message: [size:2][bd address:6][channel:4][connection status:4]
+ *
+ * On the server side, the second message will contain a
+ * socket file descriptor for the connection. The client
+ * uses the original file descriptor.
+ */
+class SocketMessageWatcher : public MessageLoopForIO::Watcher
+{
+public:
+  static const unsigned char MSG1_SIZE = 4;
+  static const unsigned char MSG2_SIZE = 16;
+
+  static const unsigned char OFF_CHANNEL1 = 0;
+  static const unsigned char OFF_SIZE = 4;
+  static const unsigned char OFF_BDADDRESS = 6;
+  static const unsigned char OFF_CHANNEL2 = 12;
+  static const unsigned char OFF_STATUS = 16;
+
+  SocketMessageWatcher(int aFd)
+  : mFd(aFd)
+  , mClientFd(-1)
+  , mLen(0)
+  { }
+
+  virtual ~SocketMessageWatcher()
+  { }
+
+  virtual void Proceed(bt_status_t aStatus) = 0;
+
+  void OnFileCanReadWithoutBlocking(int aFd) MOZ_OVERRIDE
+  {
+    bt_status_t status;
+
+    switch (mLen) {
+      case 0:
+        status = RecvMsg1();
+        break;
+      case MSG1_SIZE:
+        status = RecvMsg2();
+        break;
+      default:
+        /* message-size error */
+        status = BT_STATUS_FAIL;
+        break;
+    }
+
+    if (IsComplete() || status != BT_STATUS_SUCCESS) {
+      mWatcher.StopWatchingFileDescriptor();
+      Proceed(status);
+    }
+  }
+
+  void OnFileCanWriteWithoutBlocking(int aFd) MOZ_OVERRIDE
+  { }
+
+  void Watch()
+  {
+    MessageLoopForIO::current()->WatchFileDescriptor(
+      mFd,
+      true,
+      MessageLoopForIO::WATCH_READ,
+      &mWatcher,
+      this);
+  }
+
+  bool IsComplete() const
+  {
+    return mLen == (MSG1_SIZE + MSG2_SIZE);
+  }
+
+  int GetFd() const
+  {
+    return mFd;
+  }
+
+  int32_t GetChannel1() const
+  {
+    return ReadInt32(OFF_CHANNEL1);
+  }
+
+  int32_t GetSize() const
+  {
+    return ReadInt16(OFF_SIZE);
+  }
+
+  nsString GetBdAddress() const
+  {
+    nsString bdAddress;
+    ReadBdAddress(OFF_BDADDRESS, bdAddress);
+    return bdAddress;
+  }
+
+  int32_t GetChannel2() const
+  {
+    return ReadInt32(OFF_CHANNEL2);
+  }
+
+  int32_t GetConnectionStatus() const
+  {
+    return ReadInt32(OFF_STATUS);
+  }
+
+  int GetClientFd() const
+  {
+    return mClientFd;
+  }
+
+private:
+  bt_status_t RecvMsg1()
+  {
+    struct iovec iv;
+    memset(&iv, 0, sizeof(iv));
+    iv.iov_base = mBuf;
+    iv.iov_len = MSG1_SIZE;
+
+    struct msghdr msg;
+    memset(&msg, 0, sizeof(msg));
+    msg.msg_iov = &iv;
+    msg.msg_iovlen = 1;
+
+    ssize_t res = TEMP_FAILURE_RETRY(recvmsg(mFd, &msg, MSG_NOSIGNAL));
+    if (res < 0) {
+      return BT_STATUS_FAIL;
+    }
+
+    mLen += res;
+
+    return BT_STATUS_SUCCESS;
+  }
+
+  bt_status_t RecvMsg2()
+  {
+    struct iovec iv;
+    memset(&iv, 0, sizeof(iv));
+    iv.iov_base = mBuf + MSG1_SIZE;
+    iv.iov_len = MSG2_SIZE;
+
+    struct msghdr msg;
+    struct cmsghdr cmsgbuf[2 * sizeof(cmsghdr) + 0x100];
+    memset(&msg, 0, sizeof(msg));
+    msg.msg_iov = &iv;
+    msg.msg_iovlen = 1;
+    msg.msg_control = cmsgbuf;
+    msg.msg_controllen = sizeof(cmsgbuf);
+
+    ssize_t res = TEMP_FAILURE_RETRY(recvmsg(mFd, &msg, MSG_NOSIGNAL));
+    if (res < 0) {
+      return BT_STATUS_FAIL;
+    }
+
+    mLen += res;
+
+    if (msg.msg_flags & (MSG_CTRUNC | MSG_OOB | MSG_ERRQUEUE)) {
+      return BT_STATUS_FAIL;
+    }
+
+    struct cmsghdr *cmsgptr = CMSG_FIRSTHDR(&msg);
+
+    // Extract client fd from message header
+    for (; cmsgptr; cmsgptr = CMSG_NXTHDR(&msg, cmsgptr)) {
+      if (CMSGHDR_CONTAINS_FD(cmsgptr)) {
+        // if multiple file descriptors have been sent, we close
+        // all but the final one.
+        if (mClientFd != -1) {
+          TEMP_FAILURE_RETRY(close(mClientFd));
+        }
+        // retrieve sent client fd
+        mClientFd = *(static_cast<int*>(CMSG_DATA(cmsgptr)));
+      }
+    }
+
+    return BT_STATUS_SUCCESS;
+  }
+
+  int16_t ReadInt16(unsigned long aOffset) const
+  {
+    /* little-endian buffer */
+    return (static_cast<int16_t>(mBuf[aOffset + 1]) << 8) |
+            static_cast<int16_t>(mBuf[aOffset]);
+  }
+
+  int32_t ReadInt32(unsigned long aOffset) const
+  {
+    /* little-endian buffer */
+    return (static_cast<int32_t>(mBuf[aOffset + 3]) << 24) |
+           (static_cast<int32_t>(mBuf[aOffset + 2]) << 16) |
+           (static_cast<int32_t>(mBuf[aOffset + 1]) << 8) |
+            static_cast<int32_t>(mBuf[aOffset]);
+  }
+
+  void ReadBdAddress(unsigned long aOffset, nsAString& aBdAddress) const
+  {
+    char str[18];
+    sprintf(str, "%02x:%02x:%02x:%02x:%02x:%02x",
+            mBuf[aOffset + 0], mBuf[aOffset + 1], mBuf[aOffset + 2],
+            mBuf[aOffset + 3], mBuf[aOffset + 4], mBuf[aOffset + 5]);
+    aBdAddress.AssignLiteral(str);
+  }
+
+  MessageLoopForIO::FileDescriptorWatcher mWatcher;
+  int mFd;
+  int mClientFd;
+  unsigned char mLen;
+  uint8_t mBuf[MSG1_SIZE + MSG2_SIZE];
+};
+
+/* |SocketMessageWatcherTask| starts a SocketMessageWatcher
+ * on the I/O task
+ */
+class SocketMessageWatcherTask MOZ_FINAL : public Task
+{
+public:
+  SocketMessageWatcherTask(SocketMessageWatcher* aWatcher)
+  : mWatcher(aWatcher)
+  {
+    MOZ_ASSERT(mWatcher);
+  }
+
+  void Run() MOZ_OVERRIDE
+  {
+    mWatcher->Watch();
+  }
+
+private:
+  SocketMessageWatcher* mWatcher;
+};
+
+/* |DeleteTask| deletes a class instance on the I/O thread
+ */
+template <typename T>
+class DeleteTask MOZ_FINAL : public Task
+{
+public:
+  DeleteTask(T* aPtr)
+  : mPtr(aPtr)
+  { }
+
+  void Run() MOZ_OVERRIDE
+  {
+    mPtr = nullptr;
+  }
+
+private:
+  nsAutoPtr<T> mPtr;
+};
+
+/* |ConnectWatcher| specializes SocketMessageWatcher for
+ * connect operations by reading the socket messages from
+ * Bluedroid and forwarding the connected socket to the
+ * resource handler.
+ */
+class ConnectWatcher MOZ_FINAL : public SocketMessageWatcher
+{
+public:
+  ConnectWatcher(int aFd, BluetoothSocketResultHandler* aRes)
+  : SocketMessageWatcher(aFd)
+  , mRes(aRes)
+  { }
+
+  void Proceed(bt_status_t aStatus) MOZ_OVERRIDE
+  {
+    if (mRes) {
+      DispatchBluetoothSocketResult(mRes,
+                                   &BluetoothSocketResultHandler::Connect,
+                                    GetFd(), GetBdAddress(),
+                                    GetConnectionStatus(), aStatus);
+    }
+    MessageLoopForIO::current()->PostTask(
+      FROM_HERE, new DeleteTask<ConnectWatcher>(this));
+  }
+
+private:
+  nsRefPtr<BluetoothSocketResultHandler> mRes;
+};
+
+void
 BluetoothSocketInterface::Connect(const bt_bdaddr_t* aBdAddr,
                                   btsock_type_t aType, const uint8_t* aUuid,
-                                  int aChannel, int& aSockFd, int aFlags)
+                                  int aChannel, int aFlags,
+                                  BluetoothSocketResultHandler* aRes)
 {
-  return mInterface->connect(aBdAddr, aType, aUuid, aChannel, &aSockFd,
-                             aFlags);
+  int fd;
+
+  bt_status_t status = mInterface->connect(aBdAddr, aType, aUuid, aChannel,
+                                           &fd, aFlags);
+  if (status == BT_STATUS_SUCCESS) {
+    /* receive Bluedroid's socket-setup messages */
+    Task* t = new SocketMessageWatcherTask(new ConnectWatcher(fd, aRes));
+    XRE_GetIOMessageLoop()->PostTask(FROM_HERE, t);
+  } else if (aRes) {
+      DispatchBluetoothSocketResult(aRes,
+                                    &BluetoothSocketResultHandler::Connect,
+                                    -1, EmptyString(), 0, status);
+  }
+}
+
+/* |AcceptWatcher| specializes |SocketMessageWatcher| for accept
+ * operations by reading the socket messages from Bluedroid and
+ * forwarding the received client socket to the resource handler.
+ * The first message is received immediately. When there's a new
+ * connection, Bluedroid sends the 2nd message with the socket
+ * info and socket file descriptor.
+ */
+class AcceptWatcher MOZ_FINAL : public SocketMessageWatcher
+{
+public:
+  AcceptWatcher(int aFd, BluetoothSocketResultHandler* aRes)
+  : SocketMessageWatcher(aFd)
+  , mRes(aRes)
+  {
+    /* not supplying a result handler leaks received file descriptor */
+    MOZ_ASSERT(mRes);
+  }
+
+  void Proceed(bt_status_t aStatus) MOZ_OVERRIDE
+  {
+    if (mRes) {
+      DispatchBluetoothSocketResult(mRes,
+                                    &BluetoothSocketResultHandler::Accept,
+                                    GetClientFd(), GetBdAddress(),
+                                    GetConnectionStatus(),
+                                    aStatus);
+    }
+    MessageLoopForIO::current()->PostTask(
+      FROM_HERE, new DeleteTask<AcceptWatcher>(this));
+  }
+
+private:
+  nsRefPtr<BluetoothSocketResultHandler> mRes;
+};
+
+void
+BluetoothSocketInterface::Accept(int aFd, BluetoothSocketResultHandler* aRes)
+{
+  /* receive Bluedroid's socket-setup messages and client fd */
+  Task* t = new SocketMessageWatcherTask(new AcceptWatcher(aFd, aRes));
+  XRE_GetIOMessageLoop()->PostTask(FROM_HERE, t);
 }
 
 BluetoothSocketInterface::BluetoothSocketInterface(
diff --git a/dom/bluetooth2/bluedroid/BluetoothInterface.h b/dom/bluetooth2/bluedroid/BluetoothInterface.h
index ebb62fe5804..38dbbc1ac3d 100644
--- a/dom/bluetooth2/bluedroid/BluetoothInterface.h
+++ b/dom/bluetooth2/bluedroid/BluetoothInterface.h
@@ -24,6 +24,25 @@ class BluetoothInterface;
 // Socket Interface
 //
 
+class BluetoothSocketResultHandler
+{
+public:
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(BluetoothSocketResultHandler)
+
+  virtual ~BluetoothSocketResultHandler() { }
+
+  virtual void OnError(bt_status_t aStatus)
+  {
+    BT_WARNING("Received error code %d", (int)aStatus);
+  }
+
+  virtual void Listen(int aSockFd) { }
+  virtual void Connect(int aSockFd, const nsAString& aBdAddress,
+                       int aConnectionState) { }
+  virtual void Accept(int aSockFd, const nsAString& aBdAddress,
+                      int aConnectionState) { }
+};
+
 class BluetoothSocketInterface
 {
 public:
@@ -31,13 +50,15 @@ public:
 
   // Init and Cleanup is handled by BluetoothInterface
 
-  bt_status_t Listen(btsock_type_t aType,
-                     const char* aServiceName, const uint8_t* aServiceUuid,
-                     int aChannel, int& aSockFd, int aFlags);
+  void Listen(btsock_type_t aType,
+              const char* aServiceName, const uint8_t* aServiceUuid,
+              int aChannel, int aFlags, BluetoothSocketResultHandler* aRes);
 
-  bt_status_t Connect(const bt_bdaddr_t* aBdAddr, btsock_type_t aType,
-                      const uint8_t* aUuid, int aChannel, int& aSockFd,
-                      int aFlags);
+  void Connect(const bt_bdaddr_t* aBdAddr, btsock_type_t aType,
+               const uint8_t* aUuid, int aChannel, int aFlags,
+               BluetoothSocketResultHandler* aRes);
+
+  void Accept(int aFd, BluetoothSocketResultHandler* aRes);
 
 protected:
   BluetoothSocketInterface(const btsock_interface_t* aInterface);
diff --git a/dom/bluetooth2/bluedroid/BluetoothSocket.cpp b/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
index 6c4d36925be..8d56595a56c 100644
--- a/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
@@ -18,9 +18,6 @@
 #include "nsThreadUtils.h"
 #include "nsXULAppAPI.h"
 
-#define FIRST_SOCKET_INFO_MSG_LENGTH 4
-#define TOTAL_SOCKET_INFO_LENGTH 20
-
 using namespace mozilla::ipc;
 USING_BLUETOOTH_NAMESPACE
 
@@ -48,61 +45,55 @@ EnsureBluetoothSocketHalLoad()
   return true;
 }
 
-static int16_t
-ReadInt16(const uint8_t* aData, size_t* aOffset)
-{
-  int16_t value = (aData[*aOffset + 1] << 8) | aData[*aOffset];
-
-  *aOffset += 2;
-  return value;
-}
-
-static int32_t
-ReadInt32(const uint8_t* aData, size_t* aOffset)
-{
-  int32_t value = (aData[*aOffset + 3] << 24) |
-                  (aData[*aOffset + 2] << 16) |
-                  (aData[*aOffset + 1] << 8) |
-                  aData[*aOffset];
-  *aOffset += 4;
-  return value;
-}
-
-static void
-ReadBdAddress(const uint8_t* aData, size_t* aOffset, nsAString& aDeviceAddress)
-{
-  char bdstr[18];
-  sprintf(bdstr, "%02x:%02x:%02x:%02x:%02x:%02x",
-          aData[*aOffset], aData[*aOffset + 1], aData[*aOffset + 2],
-          aData[*aOffset + 3], aData[*aOffset + 4], aData[*aOffset + 5]);
-
-  aDeviceAddress.AssignLiteral(bdstr);
-  *aOffset += 6;
-}
-
 class mozilla::dom::bluetooth::DroidSocketImpl : public ipc::UnixFdWatcher
 {
 public:
+  /* The connection status in DroidSocketImpl indicates the current
+   * phase of the socket connection. The initial settign should always
+   * be DISCONNECTED, when no connection is present.
+   *
+   * To establish a connection on the server, DroidSocketImpl moves
+   * to LISTENING. It now waits for incoming connection attempts by
+   * installing a read watcher on the I/O thread. When its socket file
+   * descriptor becomes readable, DroidSocketImpl accepts the connection
+   * and finally moves DroidSocketImpl to CONNECTED. DroidSocketImpl now
+   * uses read and write watchers during data transfers. Any socket setup
+   * is handled internally by the accept method.
+   *
+   * On the client side, DroidSocketImpl moves to CONNECTING and installs
+   * a write watcher on the I/O thread to wait until the connection is
+   * ready. The socket setup is handled internally by the connect method.
+   * Installing the write handler makes the code compatible with POSIX
+   * semantics for non-blocking connects and gives a clear signal when the
+   * conncetion is ready. DroidSocketImpl then moves to CONNECTED and uses
+   * read and write watchers during data transfers.
+   */
+  enum ConnectionStatus {
+    SOCKET_IS_DISCONNECTED = 0,
+    SOCKET_IS_LISTENING,
+    SOCKET_IS_CONNECTING,
+    SOCKET_IS_CONNECTED
+  };
+
   DroidSocketImpl(MessageLoop* aIOLoop, BluetoothSocket* aConsumer, int aFd)
     : ipc::UnixFdWatcher(aIOLoop, aFd)
     , mConsumer(aConsumer)
-    , mReadMsgForClientFd(false)
     , mShuttingDownOnIOThread(false)
     , mChannel(0)
     , mAuth(false)
     , mEncrypt(false)
-  {
-  }
+    , mConnectionStatus(SOCKET_IS_DISCONNECTED)
+  { }
 
   DroidSocketImpl(MessageLoop* aIOLoop, BluetoothSocket* aConsumer,
                   int aChannel, bool aAuth, bool aEncrypt)
     : ipc::UnixFdWatcher(aIOLoop)
     , mConsumer(aConsumer)
-    , mReadMsgForClientFd(false)
     , mShuttingDownOnIOThread(false)
     , mChannel(aChannel)
     , mAuth(aAuth)
     , mEncrypt(aEncrypt)
+    , mConnectionStatus(SOCKET_IS_DISCONNECTED)
   { }
 
   DroidSocketImpl(MessageLoop* aIOLoop, BluetoothSocket* aConsumer,
@@ -110,12 +101,12 @@ public:
                   int aChannel, bool aAuth, bool aEncrypt)
     : ipc::UnixFdWatcher(aIOLoop)
     , mConsumer(aConsumer)
-    , mReadMsgForClientFd(false)
     , mShuttingDownOnIOThread(false)
     , mDeviceAddress(aDeviceAddress)
     , mChannel(aChannel)
     , mAuth(aAuth)
     , mEncrypt(aEncrypt)
+    , mConnectionStatus(SOCKET_IS_DISCONNECTED)
   {
     MOZ_ASSERT(!mDeviceAddress.IsEmpty());
   }
@@ -159,24 +150,20 @@ public:
     mShuttingDownOnIOThread = true;
   }
 
-  void Connect();
-  void Listen();
-
-  void SetUpIO(bool aWrite)
-  {
-    AddWatchers(READ_WATCHER, true);
-    if (aWrite) {
-        AddWatchers(WRITE_WATCHER, false);
-    }
-  }
+  void Connect(int aFd);
+  void Listen(int aFd);
+  void Accept(int aFd);
 
   void ConnectClientFd()
   {
     // Stop current read watch
     RemoveWatchers(READ_WATCHER);
 
+    mConnectionStatus = SOCKET_IS_CONNECTED;
+
     // Restart read & write watch on client fd
-    SetUpIO(true);
+    AddWatchers(READ_WATCHER, true);
+    AddWatchers(WRITE_WATCHER, false);
   }
 
   /**
@@ -186,11 +173,6 @@ public:
    */
   RefPtr<BluetoothSocket> mConsumer;
 
-  /**
-   * If true, read message header to get client fd.
-   */
-  bool mReadMsgForClientFd;
-
 private:
   /**
    * libevent triggered functions that reads data from socket when available and
@@ -208,14 +190,10 @@ private:
    */
   virtual void OnFileCanWriteWithoutBlocking(int aFd);
 
-  /**
-   * Read message to get data and client fd wrapped in message header
-   *
-   * @param aFd     [in]  File descriptor to read message from
-   * @param aBuffer [out] Data buffer read
-   * @param aLength [out] Number of bytes read
-   */
-  ssize_t ReadMsg(int aFd, void *aBuffer, size_t aLength);
+  void OnSocketCanReceiveWithoutBlocking(int aFd);
+  void OnSocketCanAcceptWithoutBlocking(int aFd);
+  void OnSocketCanSendWithoutBlocking(int aFd);
+  void OnSocketCanConnectWithoutBlocking(int aFd);
 
   /**
    * Raw data queue. Must be pushed/popped from IO thread only.
@@ -232,6 +210,7 @@ private:
   int mChannel;
   bool mAuth;
   bool mEncrypt;
+  ConnectionStatus mConnectionStatus;
 };
 
 template<class T>
@@ -253,6 +232,70 @@ private:
   T* mInstance;
 };
 
+class DroidSocketImplRunnable : public nsRunnable
+{
+public:
+  DroidSocketImpl* GetImpl() const
+  {
+    return mImpl;
+  }
+
+protected:
+  DroidSocketImplRunnable(DroidSocketImpl* aImpl)
+  : mImpl(aImpl)
+  {
+    MOZ_ASSERT(aImpl);
+  }
+
+  virtual ~DroidSocketImplRunnable()
+  { }
+
+private:
+  DroidSocketImpl* mImpl;
+};
+
+class OnSocketEventRunnable : public DroidSocketImplRunnable
+{
+public:
+  enum SocketEvent {
+    CONNECT_SUCCESS,
+    CONNECT_ERROR,
+    DISCONNECT
+  };
+
+  OnSocketEventRunnable(DroidSocketImpl* aImpl, SocketEvent e)
+  : DroidSocketImplRunnable(aImpl)
+  , mEvent(e)
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+  }
+
+  NS_IMETHOD Run() MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    DroidSocketImpl* impl = GetImpl();
+
+    if (impl->IsShutdownOnMainThread()) {
+      NS_WARNING("CloseSocket has already been called!");
+      // Since we've already explicitly closed and the close happened before
+      // this, this isn't really an error. Since we've warned, return OK.
+      return NS_OK;
+    }
+    if (mEvent == CONNECT_SUCCESS) {
+      impl->mConsumer->NotifySuccess();
+    } else if (mEvent == CONNECT_ERROR) {
+      impl->mConsumer->NotifyError();
+    } else if (mEvent == DISCONNECT) {
+      impl->mConsumer->NotifyDisconnect();
+    }
+    return NS_OK;
+  }
+
+private:
+  SocketEvent mEvent;
+};
+
 class RequestClosingSocketTask : public nsRunnable
 {
 public:
@@ -392,32 +435,40 @@ private:
 class SocketConnectTask : public DroidSocketImplTask
 {
 public:
-  SocketConnectTask(DroidSocketImpl* aDroidSocketImpl)
+  SocketConnectTask(DroidSocketImpl* aDroidSocketImpl, int aFd)
   : DroidSocketImplTask(aDroidSocketImpl)
+  , mFd(aFd)
   { }
 
   void Run() MOZ_OVERRIDE
   {
     MOZ_ASSERT(!NS_IsMainThread());
     MOZ_ASSERT(!IsCanceled());
-    GetDroidSocketImpl()->Connect();
+    GetDroidSocketImpl()->Connect(mFd);
   }
+
+private:
+  int mFd;
 };
 
 class SocketListenTask : public DroidSocketImplTask
 {
 public:
-  SocketListenTask(DroidSocketImpl* aDroidSocketImpl)
+  SocketListenTask(DroidSocketImpl* aDroidSocketImpl, int aFd)
   : DroidSocketImplTask(aDroidSocketImpl)
+  , mFd(aFd)
   { }
 
   void Run() MOZ_OVERRIDE
   {
     MOZ_ASSERT(!NS_IsMainThread());
     if (!IsCanceled()) {
-      GetDroidSocketImpl()->Listen();
+      GetDroidSocketImpl()->Listen(mFd);
     }
   }
+
+private:
+  int mFd;
 };
 
 class SocketConnectClientFdTask : public Task
@@ -434,127 +485,83 @@ public:
 };
 
 void
-DroidSocketImpl::Connect()
+DroidSocketImpl::Connect(int aFd)
 {
-  MOZ_ASSERT(sBluetoothSocketInterface);
+  MOZ_ASSERT(aFd >= 0);
 
-  bt_bdaddr_t remoteBdAddress;
-  StringToBdAddressType(mDeviceAddress, &remoteBdAddress);
-
-  // TODO: uuid as argument
-  int fd = -1;
-  bt_status_t status =
-    sBluetoothSocketInterface->Connect(&remoteBdAddress,
-                                       BTSOCK_RFCOMM,
-                                       UUID_OBEX_OBJECT_PUSH,
-                                       mChannel,
-                                       fd,
-                                       (BTSOCK_FLAG_ENCRYPT * mEncrypt) |
-                                       (BTSOCK_FLAG_AUTH * mAuth));
-  NS_ENSURE_TRUE_VOID(status == BT_STATUS_SUCCESS);
-  NS_ENSURE_TRUE_VOID(fd >= 0);
-
-  int flags = TEMP_FAILURE_RETRY(fcntl(fd, F_GETFL));
+  int flags = TEMP_FAILURE_RETRY(fcntl(aFd, F_GETFL));
   NS_ENSURE_TRUE_VOID(flags >= 0);
 
   if (!(flags & O_NONBLOCK)) {
-    int res = TEMP_FAILURE_RETRY(fcntl(fd, F_SETFL, flags | O_NONBLOCK));
+    int res = TEMP_FAILURE_RETRY(fcntl(aFd, F_SETFL, flags | O_NONBLOCK));
     NS_ENSURE_TRUE_VOID(!res);
   }
 
-  SetFd(fd);
+  SetFd(aFd);
+  mConnectionStatus = SOCKET_IS_CONNECTING;
 
-  AddWatchers(READ_WATCHER, true);
   AddWatchers(WRITE_WATCHER, false);
 }
 
 void
-DroidSocketImpl::Listen()
+DroidSocketImpl::Listen(int aFd)
 {
-  MOZ_ASSERT(sBluetoothSocketInterface);
+  MOZ_ASSERT(aFd >= 0);
 
-  // TODO: uuid and service name as arguments
-
-  int fd = -1;
-  bt_status_t status =
-    sBluetoothSocketInterface->Listen(BTSOCK_RFCOMM,
-                                      "OBEX Object Push",
-                                      UUID_OBEX_OBJECT_PUSH,
-                                      mChannel,
-                                      fd,
-                                      (BTSOCK_FLAG_ENCRYPT * mEncrypt) |
-                                      (BTSOCK_FLAG_AUTH * mAuth));
-  NS_ENSURE_TRUE_VOID(status == BT_STATUS_SUCCESS);
-  NS_ENSURE_TRUE_VOID(fd >= 0);
-
-  int flags = TEMP_FAILURE_RETRY(fcntl(fd, F_GETFL));
+  int flags = TEMP_FAILURE_RETRY(fcntl(aFd, F_GETFL));
   NS_ENSURE_TRUE_VOID(flags >= 0);
 
   if (!(flags & O_NONBLOCK)) {
-    int res = TEMP_FAILURE_RETRY(fcntl(fd, F_SETFL, flags | O_NONBLOCK));
+    int res = TEMP_FAILURE_RETRY(fcntl(aFd, F_SETFL, flags | O_NONBLOCK));
     NS_ENSURE_TRUE_VOID(!res);
   }
 
-  SetFd(fd);
+  SetFd(aFd);
+  mConnectionStatus = SOCKET_IS_LISTENING;
+
   AddWatchers(READ_WATCHER, true);
 }
 
-ssize_t
-DroidSocketImpl::ReadMsg(int aFd, void *aBuffer, size_t aLength)
+void
+DroidSocketImpl::Accept(int aFd)
 {
-  ssize_t ret;
-  struct msghdr msg;
-  struct iovec iv;
-  struct cmsghdr cmsgbuf[2 * sizeof(cmsghdr) + 0x100];
+  Close();
 
-  memset(&msg, 0, sizeof(msg));
-  memset(&iv, 0, sizeof(iv));
+  int flags = TEMP_FAILURE_RETRY(fcntl(aFd, F_GETFL));
+  NS_ENSURE_TRUE_VOID(flags >= 0);
 
-  iv.iov_base = (unsigned char *)aBuffer;
-  iv.iov_len = aLength;
-
-  msg.msg_iov = &iv;
-  msg.msg_iovlen = 1;
-  msg.msg_control = cmsgbuf;
-  msg.msg_controllen = sizeof(cmsgbuf);
-
-  ret = recvmsg(GetFd(), &msg, MSG_NOSIGNAL);
-  if (ret < 0 && errno == EPIPE) {
-    // Treat this as an end of stream
-    return 0;
+  if (!(flags & O_NONBLOCK)) {
+    int res = TEMP_FAILURE_RETRY(fcntl(aFd, F_SETFL, flags | O_NONBLOCK));
+    NS_ENSURE_TRUE_VOID(!res);
   }
 
-  NS_ENSURE_FALSE(ret < 0, -1);
-  NS_ENSURE_FALSE(msg.msg_flags & (MSG_CTRUNC | MSG_OOB | MSG_ERRQUEUE), -1);
+  SetFd(aFd);
+  mConnectionStatus = SOCKET_IS_CONNECTED;
 
-  // Extract client fd from message header
-  for (struct cmsghdr *cmsgptr = CMSG_FIRSTHDR(&msg);
-       cmsgptr != nullptr; cmsgptr = CMSG_NXTHDR(&msg, cmsgptr)) {
-    if (cmsgptr->cmsg_level != SOL_SOCKET) {
-      continue;
-    }
-    if (cmsgptr->cmsg_type == SCM_RIGHTS) {
-      int *pDescriptors = (int *)CMSG_DATA(cmsgptr);
+  nsRefPtr<OnSocketEventRunnable> r =
+    new OnSocketEventRunnable(this, OnSocketEventRunnable::CONNECT_SUCCESS);
+  NS_DispatchToMainThread(r);
 
-      // Overwrite fd with client fd
-      int fd = pDescriptors[0];
-      int flags = TEMP_FAILURE_RETRY(fcntl(fd, F_GETFL));
-      NS_ENSURE_TRUE(flags >= 0, 0);
-      if (!(flags & O_NONBLOCK)) {
-        int res = TEMP_FAILURE_RETRY(fcntl(fd, F_SETFL, flags | O_NONBLOCK));
-        NS_ENSURE_TRUE(!res, 0);
-      }
-      Close();
-      SetFd(fd);
-      break;
-    }
+  AddWatchers(READ_WATCHER, true);
+  if (!mOutgoingQ.IsEmpty()) {
+    AddWatchers(WRITE_WATCHER, false);
   }
-
-  return ret;
 }
 
 void
 DroidSocketImpl::OnFileCanReadWithoutBlocking(int aFd)
+{
+  if (mConnectionStatus == SOCKET_IS_CONNECTED) {
+    OnSocketCanReceiveWithoutBlocking(aFd);
+  } else if (mConnectionStatus == SOCKET_IS_LISTENING) {
+    OnSocketCanAcceptWithoutBlocking(aFd);
+  } else {
+    NS_NOTREACHED("invalid connection state for reading");
+  }
+}
+
+void
+DroidSocketImpl::OnSocketCanReceiveWithoutBlocking(int aFd)
 {
   MOZ_ASSERT(!NS_IsMainThread());
   MOZ_ASSERT(!mShuttingDownOnIOThread);
@@ -563,12 +570,7 @@ DroidSocketImpl::OnFileCanReadWithoutBlocking(int aFd)
   while (true) {
     nsAutoPtr<UnixSocketRawData> incoming(new UnixSocketRawData(MAX_READ_SIZE));
 
-    ssize_t ret;
-    if (!mReadMsgForClientFd) {
-      ret = read(aFd, incoming->mData, incoming->mSize);
-    } else {
-      ret = ReadMsg(aFd, incoming->mData, incoming->mSize);
-    }
+    ssize_t ret = read(aFd, incoming->mData, incoming->mSize);
 
     if (ret <= 0) {
       if (ret == -1) {
@@ -606,8 +608,113 @@ DroidSocketImpl::OnFileCanReadWithoutBlocking(int aFd)
   MOZ_CRASH("We returned early");
 }
 
+class AcceptTask MOZ_FINAL : public DroidSocketImplTask
+{
+public:
+  AcceptTask(DroidSocketImpl* aDroidSocketImpl, int aFd)
+  : DroidSocketImplTask(aDroidSocketImpl)
+  , mFd(aFd)
+  { }
+
+  void Run() MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(!NS_IsMainThread());
+    MOZ_ASSERT(!IsCanceled());
+
+    GetDroidSocketImpl()->Accept(mFd);
+  }
+
+private:
+  int mFd;
+};
+
+class AcceptResultHandler MOZ_FINAL : public BluetoothSocketResultHandler
+{
+public:
+  AcceptResultHandler(DroidSocketImpl* aImpl)
+  : mImpl(aImpl)
+  {
+    MOZ_ASSERT(mImpl);
+  }
+
+  void Accept(int aFd, const nsAString& aBdAddress,
+              int aConnectionStatus) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    if (mImpl->IsShutdownOnMainThread()) {
+      BT_LOGD("mConsumer is null, aborting receive!");
+      return;
+    }
+
+    mImpl->mConsumer->SetAddress(aBdAddress);
+    XRE_GetIOMessageLoop()->PostTask(FROM_HERE, new AcceptTask(mImpl, aFd));
+  }
+
+  void OnError(bt_status_t aStatus) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    BT_LOGR("BluetoothSocketInterface::Accept failed: %d", (int)aStatus);
+  }
+
+private:
+  DroidSocketImpl* mImpl;
+};
+
+class AcceptRunnable MOZ_FINAL : public nsRunnable
+{
+public:
+  AcceptRunnable(int aFd, DroidSocketImpl* aImpl)
+  : mFd(aFd)
+  , mImpl(aImpl)
+  {
+    MOZ_ASSERT(mImpl);
+  }
+
+  NS_IMETHOD Run() MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    MOZ_ASSERT(sBluetoothSocketInterface);
+
+    sBluetoothSocketInterface->Accept(mFd, new AcceptResultHandler(mImpl));
+
+    return NS_OK;
+  }
+
+private:
+  int mFd;
+  DroidSocketImpl* mImpl;
+};
+
+void
+DroidSocketImpl::OnSocketCanAcceptWithoutBlocking(int aFd)
+{
+  MOZ_ASSERT(!NS_IsMainThread());
+  MOZ_ASSERT(!mShuttingDownOnIOThread);
+
+  /* When a listening socket is ready for receiving data,
+   * we can call |Accept| on it.
+   */
+
+  RemoveWatchers(READ_WATCHER);
+  nsRefPtr<AcceptRunnable> t = new AcceptRunnable(aFd, this);
+  NS_DispatchToMainThread(t);
+}
+
 void
 DroidSocketImpl::OnFileCanWriteWithoutBlocking(int aFd)
+{
+  if (mConnectionStatus == SOCKET_IS_CONNECTED) {
+    OnSocketCanSendWithoutBlocking(aFd);
+  } else if (mConnectionStatus == SOCKET_IS_CONNECTING) {
+    OnSocketCanConnectWithoutBlocking(aFd);
+  } else {
+    NS_NOTREACHED("invalid connection state for writing");
+  }
+}
+
+void
+DroidSocketImpl::OnSocketCanSendWithoutBlocking(int aFd)
 {
   MOZ_ASSERT(!NS_IsMainThread());
   MOZ_ASSERT(!mShuttingDownOnIOThread);
@@ -649,6 +756,28 @@ DroidSocketImpl::OnFileCanWriteWithoutBlocking(int aFd)
   }
 }
 
+void
+DroidSocketImpl::OnSocketCanConnectWithoutBlocking(int aFd)
+{
+  MOZ_ASSERT(!NS_IsMainThread());
+  MOZ_ASSERT(!mShuttingDownOnIOThread);
+
+  /* We follow Posix behaviour here: Connect operations are
+   * complete once we can write to the connecting socket.
+   */
+
+  mConnectionStatus = SOCKET_IS_CONNECTED;
+
+  nsRefPtr<OnSocketEventRunnable> r =
+    new OnSocketEventRunnable(this, OnSocketEventRunnable::CONNECT_SUCCESS);
+  NS_DispatchToMainThread(r);
+
+  AddWatchers(READ_WATCHER, true);
+  if (!mOutgoingQ.IsEmpty()) {
+    AddWatchers(WRITE_WATCHER, false);
+  }
+}
+
 BluetoothSocket::BluetoothSocket(BluetoothSocketObserver* aObserver,
                                  BluetoothSocketType aType,
                                  bool aAuth,
@@ -657,7 +786,6 @@ BluetoothSocket::BluetoothSocket(BluetoothSocketObserver* aObserver,
   , mImpl(nullptr)
   , mAuth(aAuth)
   , mEncrypt(aEncrypt)
-  , mReceivedSocketInfoLength(0)
 {
   MOZ_ASSERT(aObserver);
 
@@ -681,35 +809,107 @@ BluetoothSocket::CloseDroidSocket()
                                    new ShutdownSocketTask(mImpl));
   mImpl = nullptr;
 
-  OnDisconnect();
+  NotifyDisconnect();
 }
 
+class ConnectResultHandler MOZ_FINAL : public BluetoothSocketResultHandler
+{
+public:
+  ConnectResultHandler(DroidSocketImpl* aImpl)
+  : mImpl(aImpl)
+  {
+    MOZ_ASSERT(mImpl);
+  }
+
+  void Connect(int aFd, const nsAString& aBdAddress,
+               int aConnectionStatus) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    if (!mImpl->IsShutdownOnMainThread()) {
+      mImpl->mConsumer->SetAddress(aBdAddress);
+    }
+    XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
+                                     new SocketConnectTask(mImpl, aFd));
+  }
+
+  void OnError(bt_status_t aStatus) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+    BT_WARNING("Connect failed: %d", (int)aStatus);
+  }
+
+private:
+  DroidSocketImpl* mImpl;
+};
+
 bool
 BluetoothSocket::Connect(const nsAString& aDeviceAddress, int aChannel)
 {
   MOZ_ASSERT(NS_IsMainThread());
   NS_ENSURE_FALSE(mImpl, false);
 
-  mIsServer = false;
   mImpl = new DroidSocketImpl(XRE_GetIOMessageLoop(), this, aDeviceAddress,
                               aChannel, mAuth, mEncrypt);
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                   new SocketConnectTask(mImpl));
 
+  bt_bdaddr_t remoteBdAddress;
+  StringToBdAddressType(aDeviceAddress, &remoteBdAddress);
+
+  // TODO: uuid as argument
+  sBluetoothSocketInterface->Connect(&remoteBdAddress,
+                                     BTSOCK_RFCOMM,
+                                     UUID_OBEX_OBJECT_PUSH,
+                                     aChannel,
+                                     (BTSOCK_FLAG_ENCRYPT * mEncrypt) |
+                                     (BTSOCK_FLAG_AUTH * mAuth),
+                                     new ConnectResultHandler(mImpl));
   return true;
 }
 
+class ListenResultHandler MOZ_FINAL : public BluetoothSocketResultHandler
+{
+public:
+  ListenResultHandler(DroidSocketImpl* aImpl)
+  : mImpl(aImpl)
+  {
+    MOZ_ASSERT(mImpl);
+  }
+
+  void Listen(int aFd) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
+                                     new SocketListenTask(mImpl, aFd));
+  }
+
+  void OnError(bt_status_t aStatus) MOZ_OVERRIDE
+  {
+    MOZ_ASSERT(NS_IsMainThread());
+
+    BT_WARNING("Listen failed: %d", (int)aStatus);
+  }
+
+private:
+  DroidSocketImpl* mImpl;
+};
+
 bool
 BluetoothSocket::Listen(int aChannel)
 {
   MOZ_ASSERT(NS_IsMainThread());
   NS_ENSURE_FALSE(mImpl, false);
 
-  mIsServer = true;
   mImpl = new DroidSocketImpl(XRE_GetIOMessageLoop(), this, aChannel, mAuth,
                               mEncrypt);
-  XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                   new SocketListenTask(mImpl));
+
+  sBluetoothSocketInterface->Listen(BTSOCK_RFCOMM,
+                                    "OBEX Object Push",
+                                    UUID_OBEX_OBJECT_PUSH,
+                                    aChannel,
+                                    (BTSOCK_FLAG_ENCRYPT * mEncrypt) |
+                                    (BTSOCK_FLAG_AUTH * mAuth),
+                                    new ListenResultHandler(mImpl));
   return true;
 }
 
@@ -725,64 +925,9 @@ BluetoothSocket::SendDroidSocketData(UnixSocketRawData* aData)
   return true;
 }
 
-bool
-BluetoothSocket::ReceiveSocketInfo(nsAutoPtr<UnixSocketRawData>& aMessage)
-{
-  MOZ_ASSERT(NS_IsMainThread());
-
-  /**
-   * 2 socket info messages (20 bytes) to receive at the beginning:
-   * - 1st message: [channel:4]
-   * - 2nd message: [size:2][bd address:6][channel:4][connection status:4]
-   */
-  if (mReceivedSocketInfoLength >= TOTAL_SOCKET_INFO_LENGTH) {
-    // We've got both socket info messages
-    return false;
-  }
-  mReceivedSocketInfoLength += aMessage->mSize;
-
-  size_t offset = 0;
-  if (mReceivedSocketInfoLength == FIRST_SOCKET_INFO_MSG_LENGTH) {
-    // 1st message: [channel:4]
-    int32_t channel = ReadInt32(aMessage->mData, &offset);
-    BT_LOGR("channel %d", channel);
-
-    // If this is server socket, read header of next message for client fd
-    mImpl->mReadMsgForClientFd = mIsServer;
-  } else if (mReceivedSocketInfoLength == TOTAL_SOCKET_INFO_LENGTH) {
-    // 2nd message: [size:2][bd address:6][channel:4][connection status:4]
-    int16_t size = ReadInt16(aMessage->mData, &offset);
-    ReadBdAddress(aMessage->mData, &offset, mDeviceAddress);
-    int32_t channel = ReadInt32(aMessage->mData, &offset);
-    int32_t connectionStatus = ReadInt32(aMessage->mData, &offset);
-
-    BT_LOGR("size %d channel %d remote addr %s status %d",
-      size, channel, NS_ConvertUTF16toUTF8(mDeviceAddress).get(), connectionStatus);
-
-    if (connectionStatus != 0) {
-      OnConnectError();
-      return true;
-    }
-
-    if (mIsServer) {
-      mImpl->mReadMsgForClientFd = false;
-      // Connect client fd on IO thread
-      XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
-                                       new SocketConnectClientFdTask(mImpl));
-    }
-    OnConnectSuccess();
-  }
-
-  return true;
-}
-
 void
 BluetoothSocket::ReceiveSocketData(nsAutoPtr<UnixSocketRawData>& aMessage)
 {
-  if (ReceiveSocketInfo(aMessage)) {
-    return;
-  }
-
   MOZ_ASSERT(NS_IsMainThread());
   MOZ_ASSERT(mObserver);
   mObserver->ReceiveSocketData(this, aMessage);
@@ -811,4 +956,3 @@ BluetoothSocket::OnDisconnect()
   MOZ_ASSERT(mObserver);
   mObserver->OnSocketDisconnect(this);
 }
-
diff --git a/dom/bluetooth2/bluedroid/BluetoothSocket.h b/dom/bluetooth2/bluedroid/BluetoothSocket.h
index eda668f80a9..0ca6818474b 100644
--- a/dom/bluetooth2/bluedroid/BluetoothSocket.h
+++ b/dom/bluetooth2/bluedroid/BluetoothSocket.h
@@ -23,30 +23,8 @@ public:
                   bool aAuth,
                   bool aEncrypt);
 
-  /**
-   * Connect to remote server as a client.
-   *
-   * The steps are as following:
-   * 1) BluetoothSocket acquires fd from bluedroid, and creates
-   *    a DroidSocketImpl to watch read/write of the fd.
-   * 2) DroidSocketImpl receives first 2 messages to get socket info.
-   * 3) Obex client session starts.
-   */
   bool Connect(const nsAString& aDeviceAddress, int aChannel);
 
-  /**
-   * Listen to incoming connection as a server.
-   *
-   * The steps are as following:
-   * 1) BluetoothSocket acquires fd from bluedroid, and creates
-   *    a DroidSocketImpl to watch read of the fd. DroidSocketImpl
-   *    receives the 1st message immediately.
-   * 2) When there's incoming connection, DroidSocketImpl receives
-   *    2nd message to get socket info and client fd.
-   * 3) DroidSocketImpl stops watching read of original fd and
-   *    starts to watch read/write of client fd.
-   * 4) Obex server session starts.
-   */
   bool Listen(int aChannel);
 
   inline void Disconnect()
@@ -65,6 +43,11 @@ public:
     aDeviceAddress = mDeviceAddress;
   }
 
+  inline void SetAddress(const nsAString& aDeviceAddress)
+  {
+    mDeviceAddress = aDeviceAddress;
+  }
+
   void CloseDroidSocket();
   bool SendDroidSocketData(mozilla::ipc::UnixSocketRawData* aData);
 
@@ -74,10 +57,6 @@ private:
   nsString mDeviceAddress;
   bool mAuth;
   bool mEncrypt;
-  bool mIsServer;
-  int mReceivedSocketInfoLength;
-
-  bool ReceiveSocketInfo(nsAutoPtr<mozilla::ipc::UnixSocketRawData>& aMessage);
 };
 
 END_BLUETOOTH_NAMESPACE
diff --git a/dom/bluetooth2/tests/marionette/head.js b/dom/bluetooth2/tests/marionette/head.js
index 8fd146dd3d2..b7679cfdc26 100644
--- a/dom/bluetooth2/tests/marionette/head.js
+++ b/dom/bluetooth2/tests/marionette/head.js
@@ -561,6 +561,43 @@ function waitForAdapterAttributeChanged(aAdapter, aAttrName, aExpectedValue) {
   return deferred.promise;
 }
 
+/**
+ * Wait for specified number of 'devicefound' events.
+ *
+ * Resolve if specified number of devices has been found. Never reject.
+ *
+ * Fulfill params: an array which contains BluetoothDeviceEvents that we
+ *                 received from the BluetoothDiscoveryHandle.
+ *
+ * @param aDiscoveryHandle
+ *        A BluetoothDiscoveryHandle which is used to notify application of
+ *        discovered remote bluetooth devices.
+ * @param aExpectedNumberOfDevices
+ *        The number of remote devices we expect to discovery.
+ *
+ * @return A deferred promise.
+ */
+function waitForDevicesFound(aDiscoveryHandle, aExpectedNumberOfDevices) {
+  let deferred = Promise.defer();
+
+  ok(aDiscoveryHandle instanceof BluetoothDiscoveryHandle,
+    "discoveryHandle should be a BluetoothDiscoveryHandle");
+
+  let devicesArray = [];
+  aDiscoveryHandle.ondevicefound = function onDeviceFound(aEvent) {
+    ok(aEvent instanceof BluetoothDeviceEvent,
+      "aEvent should be a BluetoothDeviceEvent");
+
+    devicesArray.push(aEvent);
+    if (devicesArray.length >= aExpectedNumberOfDevices) {
+      aDiscoveryHandle.ondevicefound = null;
+      deferred.resolve(devicesArray);
+    }
+  };
+
+  return deferred.promise;
+}
+
 /**
  * Flush permission settings and call |finish()|.
  */
diff --git a/dom/bluetooth2/tests/marionette/manifest.ini b/dom/bluetooth2/tests/marionette/manifest.ini
index 88c6fe50b95..3b2e649e4bf 100644
--- a/dom/bluetooth2/tests/marionette/manifest.ini
+++ b/dom/bluetooth2/tests/marionette/manifest.ini
@@ -6,3 +6,4 @@ qemu = false
 [test_dom_BluetoothManager_API2.js]
 [test_dom_BluetoothAdapter_enable_API2.js]
 [test_dom_BluetoothAdapter_setters_API2.js]
+[test_dom_BluetoothAdapter_discovery_API2.js]
diff --git a/dom/bluetooth2/tests/marionette/test_dom_BluetoothAdapter_discovery_API2.js b/dom/bluetooth2/tests/marionette/test_dom_BluetoothAdapter_discovery_API2.js
new file mode 100644
index 00000000000..bb781368c9d
--- /dev/null
+++ b/dom/bluetooth2/tests/marionette/test_dom_BluetoothAdapter_discovery_API2.js
@@ -0,0 +1,124 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+///////////////////////////////////////////////////////////////////////////////
+// Test Purpose:
+//   To verify the discovery process of BluetoothAdapter.
+//   Testers have to put the B2G devices in an environment which is surrounded
+//   by N discoverable remote devices. To pass this test, the number N has to be
+//   greater or equals than EXPECTED_NUMBER_OF_REMOTE_DEVICES.
+//
+// Test Procedure:
+//   [0] Set Bluetooth permission and enable default adapter.
+//   [1] Start discovery and verify the correctness.
+//   [2] Attach event handler for 'ondevicefound'.
+//   [3] Stop discovery and verify the correctness.
+//   [4] Mark the BluetoothDiscoveryHandle from [1] as expired.
+//   [5] Start discovery and verify the correctness.
+//   [6] Wait for 'devicefound' events.
+//   [7] Stop discovery and verify the correctness.
+//   [8] Call 'startDiscovery' twice continuously.
+//   [9] Call 'stopDiscovery' twice continuously.
+//   [10] Clean up the event handler of [2].
+//
+// Test Coverage:
+//   - BluetoothAdapter.discovering
+//   - BluetoothAdapter.startDiscovery()
+//   - BluetoothAdapter.stopDiscovery()
+//   - BluetoothAdapter.onattributechanged()
+//   - BluetoothDiscoveryHandle.ondevicefound()
+//
+///////////////////////////////////////////////////////////////////////////////
+
+MARIONETTE_TIMEOUT = 60000;
+MARIONETTE_HEAD_JS = 'head.js';
+
+const EXPECTED_NUMBER_OF_REMOTE_DEVICES = 2;
+
+startBluetoothTest(true, function testCaseMain(aAdapter) {
+  log("Checking adapter attributes ...");
+
+  is(aAdapter.state, "enabled", "adapter.state");
+  isnot(aAdapter.address, "", "adapter.address");
+
+  // Since adapter has just been re-enabled, these properties should be 'false'.
+  is(aAdapter.discovering, false, "adapter.discovering");
+  is(aAdapter.discoverable, false, "adapter.discoverable");
+
+  log("adapter.address: " + aAdapter.address);
+  log("adapter.name: " + aAdapter.name);
+
+  let discoveryHandle = null;
+  return Promise.resolve()
+    .then(function() {
+      log("[1] Start discovery and verify the correctness ... ");
+      let promises = [];
+      promises.push(waitForAdapterAttributeChanged(aAdapter, "discovering", true));
+      promises.push(aAdapter.startDiscovery());
+      return Promise.all(promises);
+    })
+    .then(function(aResults) {
+      log("[2] Attach event handler for 'ondevicefound' ... ");
+      discoveryHandle = aResults[1];
+      isHandleExpired = false;
+      discoveryHandle.ondevicefound = function onDeviceFound(aEvent) {
+        if (isHandleExpired) {
+          ok(false, "Expired BluetoothDiscoveryHandle received an event.");
+        }
+      };
+    })
+    .then(function() {
+      log("[3] Stop discovery and and verify the correctness ... ");
+      let promises = [];
+      if (aAdapter.discovering) {
+        promises.push(waitForAdapterAttributeChanged(aAdapter, "discovering", false));
+      }
+      promises.push(aAdapter.stopDiscovery());
+      return Promise.all(promises);
+    })
+    .then(function() {
+      log("[4] Mark the BluetoothDiscoveryHandle from [1] as expired ... ");
+      isHandleExpired = true;
+    })
+    .then(function() {
+      log("[5] Start discovery and verify the correctness ... ");
+      let promises = [];
+      promises.push(waitForAdapterAttributeChanged(aAdapter, "discovering", true));
+      promises.push(aAdapter.startDiscovery());
+      return Promise.all(promises);
+    })
+    .then(function(aResults) {
+      log("[6] Wait for 'devicefound' events ... ");
+      return waitForDevicesFound(aResults[1], EXPECTED_NUMBER_OF_REMOTE_DEVICES);
+    })
+    .then(function() {
+      log("[7] Stop discovery and and verify the correctness ... ");
+      let promises = [];
+      if (aAdapter.discovering) {
+        promises.push(waitForAdapterAttributeChanged(aAdapter, "discovering", false));
+      }
+      promises.push(aAdapter.stopDiscovery());
+      return Promise.all(promises);
+    })
+    .then(function() {
+      log("[8] Call 'startDiscovery' twice continuously ... ");
+      return aAdapter.startDiscovery()
+        .then(() => aAdapter.startDiscovery())
+        .then(() => ok(false, "Call startDiscovery() when adapter is discovering. - Fail"),
+              () => ok(true, "Call startDiscovery() when adapter is discovering. - Success"));
+    })
+    .then(function() {
+      log("[9] Call 'stopDiscovery' twice continuously ... ");
+      return aAdapter.stopDiscovery()
+        .then(() => aAdapter.stopDiscovery())
+        .then(() => ok(true, "Call stopDiscovery() when adapter isn't discovering. - Success"),
+              () => ok(false, "Call stopDiscovery() when adapter isn't discovering. - Fail"));
+    })
+    .then(function() {
+      log("[10] Clean up the event handler of [2] ... ");
+      if (discoveryHandle) {
+        discoveryHandle.ondevicefound = null;
+      }
+    });
+});
diff --git a/dom/ipc/PBrowser.ipdl b/dom/ipc/PBrowser.ipdl
index de222896d76..2a7354a8b0c 100644
--- a/dom/ipc/PBrowser.ipdl
+++ b/dom/ipc/PBrowser.ipdl
@@ -401,49 +401,17 @@ child:
 
     UpdateFrame(FrameMetrics frame);
 
-    /**
-     * Acknowledge the receipt of a scroll offset update from the content
-     * process. This is used to manage concurrent scroll updates from many
-     * sources.
-     */
+    // The following methods correspond to functions on the GeckoContentController
+    // interface in gfx/layers/apz/public/GeckoContentController.h. Refer to documentation
+    // in that file for these functions.
     AcknowledgeScrollUpdate(ViewID aScrollId, uint32_t aScrollGeneration);
-
-    /**
-     * Requests handling of a double tap. |point| is in CSS pixels, relative to
-     * the scroll offset. This message is expected to round-trip back to
-     * ZoomToRect() with a rect indicating where we should zoom to.
-     */
     HandleDoubleTap(CSSPoint point, ScrollableLayerGuid aGuid);
-
-    /**
-     * Requests handling of a single tap. |point| is in CSS pixels, relative to
-     * the scroll offset. This message is expected to send a "mousedown" and
-     * "mouseup" series of events at this point.
-     */
     HandleSingleTap(CSSPoint point, ScrollableLayerGuid aGuid);
-
-    /**
-     * Requests handling of a long tap. |point| is in CSS pixels, relative to
-     * the scroll offset. This message is expected to send a "contextmenu"
-     * events at this point.
-     */
     HandleLongTap(CSSPoint point, ScrollableLayerGuid aGuid);
-
-    /**
-     * Requests handling of releasing a long tap. |aPoint| is in CSS pixels,
-     * relative to the current scroll offset. In the case the "contextmenu"
-     * event generated by the preceding HandleLongTap call was not handled,
-     * this message is expected to generate a "mousedown" and "mouseup"
-     * series of events
-     */
     HandleLongTapUp(CSSPoint point, ScrollableLayerGuid aGuid);
-
-    /**
-     * Notifies the child about various APZ state changes.
-     * See GeckoContentController::NotifyAPZStateChange() for details.
-     */
     NotifyAPZStateChange(ViewID aViewId, APZStateChange aChange, int aArg);
 
+
     /**
      * Sending an activate message moves focus to the child.
      */
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index cb85d7982f8..b886499c77e 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -702,9 +702,7 @@ TabChild::TabChild(nsIContentChild* aManager, const TabContext& aContext, uint32
   , mTriedBrowserInit(false)
   , mOrientation(eScreenOrientation_PortraitPrimary)
   , mUpdateHitRegion(false)
-  , mContextMenuHandled(false)
-  , mLongTapEventHandled(false)
-  , mWaitingTouchListeners(false)
+  , mPendingTouchPreventedResponse(false)
   , mIgnoreKeyPressEvent(false)
   , mActiveElementManager(new ActiveElementManager())
   , mHasValidInnerSize(false)
@@ -1805,23 +1803,23 @@ TabChild::RecvHandleLongTap(const CSSPoint& aPoint, const ScrollableLayerGuid& a
     return true;
   }
 
-  mContextMenuHandled =
+  bool eventHandled =
       DispatchMouseEvent(NS_LITERAL_STRING("contextmenu"),
                          APZCCallbackHelper::ApplyCallbackTransform(aPoint, aGuid),
                          2, 1, 0, false,
                          nsIDOMMouseEvent::MOZ_SOURCE_TOUCH);
 
   // If no one handle context menu, fire MOZLONGTAP event
-  if (!mContextMenuHandled) {
+  if (!eventHandled) {
     LayoutDevicePoint currentPoint =
       APZCCallbackHelper::ApplyCallbackTransform(aPoint, aGuid) * mWidget->GetDefaultScale();
     int time = 0;
     nsEventStatus status =
       DispatchSynthesizedMouseEvent(NS_MOUSE_MOZLONGTAP, time, currentPoint, mWidget);
-    mLongTapEventHandled = (status == nsEventStatus_eConsumeNoDefault);
+    eventHandled = (status == nsEventStatus_eConsumeNoDefault);
   }
 
-  SendContentReceivedTouch(aGuid, mContextMenuHandled || mLongTapEventHandled);
+  SendContentReceivedTouch(aGuid, eventHandled);
 
   return true;
 }
@@ -1829,16 +1827,6 @@ TabChild::RecvHandleLongTap(const CSSPoint& aPoint, const ScrollableLayerGuid& a
 bool
 TabChild::RecvHandleLongTapUp(const CSSPoint& aPoint, const ScrollableLayerGuid& aGuid)
 {
-  if (mContextMenuHandled) {
-    mContextMenuHandled = false;
-    return true;
-  }
-
-  if (mLongTapEventHandled) {
-    mLongTapEventHandled = false;
-    return true;
-  }
-
   RecvHandleSingleTap(aPoint, aGuid);
   return true;
 }
@@ -2095,23 +2083,21 @@ TabChild::RecvRealTouchEvent(const WidgetTouchEvent& aEvent,
     mActiveElementManager->SetTargetElement(localEvent.touches[0]->GetTarget());
   }
 
-  nsCOMPtr<nsPIDOMWindow> outerWindow = do_GetInterface(WebNavigation());
-  nsCOMPtr<nsPIDOMWindow> innerWindow = outerWindow ? outerWindow->GetCurrentInnerWindow() : nullptr;
-
-  if (!innerWindow || (!innerWindow->HasTouchEventListeners() &&
-                       !innerWindow->MayHaveTouchCaret())) {
-    SendContentReceivedTouch(aGuid, false);
-    return true;
-  }
-
   bool isTouchPrevented = nsIPresShell::gPreventMouseEvents ||
                           localEvent.mFlags.mMultipleActionsPrevented;
   switch (aEvent.message) {
   case NS_TOUCH_START: {
+    if (mPendingTouchPreventedResponse) {
+      // We can enter here if we get two TOUCH_STARTs in a row and didn't
+      // respond to the first one. Respond to it now.
+      SendContentReceivedTouch(mPendingTouchPreventedGuid, false);
+      mPendingTouchPreventedResponse = false;
+    }
     if (isTouchPrevented) {
       SendContentReceivedTouch(aGuid, isTouchPrevented);
     } else {
-      mWaitingTouchListeners = true;
+      mPendingTouchPreventedResponse = true;
+      mPendingTouchPreventedGuid = aGuid;
     }
     break;
   }
@@ -2119,9 +2105,10 @@ TabChild::RecvRealTouchEvent(const WidgetTouchEvent& aEvent,
   case NS_TOUCH_MOVE:
   case NS_TOUCH_END:
   case NS_TOUCH_CANCEL: {
-    if (mWaitingTouchListeners) {
-      SendContentReceivedTouch(aGuid, isTouchPrevented);
-      mWaitingTouchListeners = false;
+    if (mPendingTouchPreventedResponse) {
+      MOZ_ASSERT(aGuid == mPendingTouchPreventedGuid);
+      SendContentReceivedTouch(mPendingTouchPreventedGuid, isTouchPrevented);
+      mPendingTouchPreventedResponse = false;
     }
     break;
   }
diff --git a/dom/ipc/TabChild.h b/dom/ipc/TabChild.h
index a21c4116688..12649a0dd63 100644
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -586,9 +586,8 @@ private:
     bool mTriedBrowserInit;
     ScreenOrientation mOrientation;
     bool mUpdateHitRegion;
-    bool mContextMenuHandled;
-    bool mLongTapEventHandled;
-    bool mWaitingTouchListeners;
+    bool mPendingTouchPreventedResponse;
+    ScrollableLayerGuid mPendingTouchPreventedGuid;
     void FireSingleTapEvent(LayoutDevicePoint aPoint);
 
     bool mIgnoreKeyPressEvent;
diff --git a/dom/media/MediaManager.cpp b/dom/media/MediaManager.cpp
index 68f8de21dfa..525fa359d01 100644
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -310,6 +310,9 @@ VideoDevice::VideoDevice(MediaEngineVideoSource* aSource)
     mHasFacingMode = true;
     mFacingMode = dom::VideoFacingModeEnum::User;
   }
+
+  // dom::MediaSourceEnum::Camera;
+  mMediaSource = aSource->GetMediaSource();
 }
 
 AudioDevice::AudioDevice(MediaEngineAudioSource* aSource)
@@ -361,6 +364,15 @@ MediaDevice::GetFacingMode(nsAString& aFacingMode)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+MediaDevice::GetMediaSource(nsAString& aMediaSource)
+{
+
+  aMediaSource.Assign(NS_ConvertUTF8toUTF16(
+    dom::MediaSourceEnumValues::strings[uint32_t(mMediaSource)].value));
+  return NS_OK;
+}
+
 MediaEngineVideoSource*
 VideoDevice::GetSource()
 {
@@ -714,14 +726,19 @@ static bool SatisfyConstraintSet(const MediaEngineVideoSource *,
                                  const MediaTrackConstraintSet &aConstraints,
                                  nsIMediaDevice &aCandidate)
 {
+  nsString s;
   if (aConstraints.mFacingMode.WasPassed()) {
-    nsString s;
     aCandidate.GetFacingMode(s);
     if (!s.EqualsASCII(dom::VideoFacingModeEnumValues::strings[
         uint32_t(aConstraints.mFacingMode.Value())].value)) {
       return false;
     }
   }
+  aCandidate.GetMediaSource(s);
+  if (!s.EqualsASCII(dom::MediaSourceEnumValues::strings[
+      uint32_t(aConstraints.mMediaSource)].value)) {
+    return false;
+  }
   // TODO: Add more video-specific constraints
   return true;
 }
@@ -742,7 +759,7 @@ template<class SourceType, class ConstraintsType>
 static SourceSet *
   GetSources(MediaEngine *engine,
              ConstraintsType &aConstraints,
-             void (MediaEngine::* aEnumerate)(nsTArray<nsRefPtr<SourceType> >*),
+             void (MediaEngine::* aEnumerate)(dom::MediaSourceEnum, nsTArray<nsRefPtr<SourceType> >*),
              const char* media_device_name = nullptr)
 {
   ScopedDeletePtr<SourceSet> result(new SourceSet);
@@ -753,7 +770,7 @@ static SourceSet *
   SourceSet candidateSet;
   {
     nsTArray<nsRefPtr<SourceType> > sources;
-    (engine->*aEnumerate)(&sources);
+    (engine->*aEnumerate)(aConstraints.mMediaSource, &sources);
     /**
       * We're allowing multiple tabs to access the same camera for parity
       * with Chrome.  See bug 811757 for some of the issues surrounding
@@ -1018,8 +1035,8 @@ public:
     MOZ_ASSERT(mError);
     if (mConstraints.mPicture || IsOn(mConstraints.mVideo)) {
       VideoTrackConstraintsN constraints(GetInvariant(mConstraints.mVideo));
-      ScopedDeletePtr<SourceSet> sources (GetSources(backend, constraints,
-          &MediaEngine::EnumerateVideoDevices));
+      ScopedDeletePtr<SourceSet> sources(GetSources(backend, constraints,
+                               &MediaEngine::EnumerateVideoDevices));
 
       if (!sources->Length()) {
         Fail(NS_LITERAL_STRING("NO_DEVICES_FOUND"));
@@ -1180,8 +1197,8 @@ public:
     if (IsOn(mConstraints.mVideo)) {
       VideoTrackConstraintsN constraints(GetInvariant(mConstraints.mVideo));
       ScopedDeletePtr<SourceSet> s(GetSources(backend, constraints,
-          &MediaEngine::EnumerateVideoDevices,
-          mLoopbackVideoDevice.get()));
+              &MediaEngine::EnumerateVideoDevices,
+              mLoopbackVideoDevice.get()));
       final->MoveElementsFrom(*s);
     }
     if (IsOn(mConstraints.mAudio)) {
@@ -1191,6 +1208,7 @@ public:
           mLoopbackAudioDevice.get()));
       final->MoveElementsFrom(*s);
     }
+
     NS_DispatchToMainThread(new DeviceSuccessCallbackRunnable(mWindowId,
                                                               mSuccess, mError,
                                                               final.forget()));
@@ -1465,6 +1483,15 @@ MediaManager::GetUserMedia(bool aPrivileged,
       onError.forget(), windowID, listener, mPrefs);
   }
 
+  // deny screensharing request if support is disabled
+  if (c.mVideo.IsMediaTrackConstraints() &&
+      !Preferences::GetBool("media.getusermedia.screensharing.enabled", false)) {
+    auto& tc = c.mVideo.GetAsMediaTrackConstraints();
+    if (tc.mMediaSource != dom::MediaSourceEnum::Camera) {
+      return runnable->Denied(NS_LITERAL_STRING("PERMISSION_DENIED"));
+    }
+  }
+
 #ifdef MOZ_B2G_CAMERA
   if (mCameraManager == nullptr) {
     mCameraManager = nsDOMCameraManager::CreateInstance(aWindow);
@@ -1479,20 +1506,17 @@ MediaManager::GetUserMedia(bool aPrivileged,
   }
 #endif
   nsIURI* docURI = aWindow->GetDocumentURI();
-#ifdef MOZ_LOOP
-  {
-    bool isLoop = false;
-    nsCOMPtr<nsIURI> loopURI;
-    nsresult rv = NS_NewURI(getter_AddRefs(loopURI), "about:loopconversation");
-    NS_ENSURE_SUCCESS(rv, rv);
-    rv = docURI->EqualsExceptRef(loopURI, &isLoop);
-    NS_ENSURE_SUCCESS(rv, rv);
 
-    if (isLoop) {
-      aPrivileged = true;
-    }
+  bool isLoop = false;
+  nsCOMPtr<nsIURI> loopURI;
+  nsresult rv = NS_NewURI(getter_AddRefs(loopURI), "about:loopconversation");
+  NS_ENSURE_SUCCESS(rv, rv);
+  rv = docURI->EqualsExceptRef(loopURI, &isLoop);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (isLoop) {
+    aPrivileged = true;
   }
-#endif
 
   // XXX No full support for picture in Desktop yet (needs proper UI)
   if (aPrivileged ||
diff --git a/dom/media/MediaManager.h b/dom/media/MediaManager.h
index 3fa09df76f8..9e505d40efe 100644
--- a/dom/media/MediaManager.h
+++ b/dom/media/MediaManager.h
@@ -486,6 +486,7 @@ protected:
   nsString mID;
   bool mHasFacingMode;
   dom::VideoFacingModeEnum mFacingMode;
+  dom::MediaSourceEnum mMediaSource;
   nsRefPtr<MediaEngineSource> mSource;
 };
 
diff --git a/dom/media/PeerConnection.js b/dom/media/PeerConnection.js
index 0ba5e9509e1..43f0639669c 100644
--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@@ -358,14 +358,16 @@ RTCPeerConnection.prototype = {
 
   callCB: function(callback, arg) {
     if (callback) {
-      try {
-        callback(arg);
-      } catch(e) {
-        // A content script (user-provided) callback threw an error. We don't
-        // want this to take down peerconnection, but we still want the user
-        // to see it, so we catch it, report it, and move on.
-        this.logErrorAndCallOnError(e.message, e.fileName, e.lineNumber);
-      }
+      this._win.setTimeout(() => {
+        try {
+          callback(arg);
+        } catch(e) {
+          // A content script (user-provided) callback threw an error. We don't
+          // want this to take down peerconnection, but we still want the user
+          // to see it, so we catch it, report it, and move on.
+          this.logErrorAndCallOnError(e.message, e.fileName, e.lineNumber);
+        }
+      }, 0);
     }
   },
 
diff --git a/dom/media/nsIDOMNavigatorUserMedia.idl b/dom/media/nsIDOMNavigatorUserMedia.idl
index 28e951ea1a7..0c2feff270c 100644
--- a/dom/media/nsIDOMNavigatorUserMedia.idl
+++ b/dom/media/nsIDOMNavigatorUserMedia.idl
@@ -13,6 +13,7 @@ interface nsIMediaDevice : nsISupports
   readonly attribute DOMString name;
   readonly attribute DOMString id;
   readonly attribute DOMString facingMode;
+  readonly attribute DOMString mediaSource;
 };
 
 [scriptable, function, uuid(24544878-d35e-4962-8c5f-fb84e97bdfee)]
diff --git a/dom/system/gonk/AutoMounter.cpp b/dom/system/gonk/AutoMounter.cpp
index b0e5d7d10a4..4d7e7023bdc 100644
--- a/dom/system/gonk/AutoMounter.cpp
+++ b/dom/system/gonk/AutoMounter.cpp
@@ -25,6 +25,7 @@
 #include "mozilla/FileUtils.h"
 #include "mozilla/Hal.h"
 #include "mozilla/StaticPtr.h"
+#include "MozMtpServer.h"
 #include "nsAutoPtr.h"
 #include "nsMemory.h"
 #include "nsString.h"
@@ -35,6 +36,7 @@
 #include "VolumeManager.h"
 
 using namespace mozilla::hal;
+USING_MTP_NAMESPACE
 
 /**************************************************************************
 *
@@ -69,6 +71,7 @@ using namespace mozilla::hal;
 
 #define ICS_SYS_USB_FUNCTIONS "/sys/devices/virtual/android_usb/android0/functions"
 #define ICS_SYS_UMS_DIRECTORY "/sys/devices/virtual/android_usb/android0/f_mass_storage"
+#define ICS_SYS_MTP_DIRECTORY "/sys/devices/virtual/android_usb/android0/f_mtp"
 #define ICS_SYS_USB_STATE     "/sys/devices/virtual/android_usb/android0/state"
 
 #define USE_DEBUG 0
@@ -229,6 +232,9 @@ public:
     }
   }
 
+  void StartMtpServer();
+  void StopMtpServer();
+
   void UpdateState();
 
   const char* ModeStr(int32_t aMode)
@@ -347,6 +353,7 @@ private:
 };
 
 static StaticRefPtr<AutoMounter> sAutoMounter;
+static StaticRefPtr<MozMtpServer> sMozMtpServer;
 
 /***************************************************************************/
 
@@ -398,6 +405,25 @@ AutoMounterResponseCallback::ResponseReceived(const VolumeCommand* aCommand)
   }
 }
 
+void
+AutoMounter::StartMtpServer()
+{
+  if (sMozMtpServer) {
+    // Mtp Server is already running - nothing to do
+    return;
+  }
+  LOG("Starting MtpServer");
+  sMozMtpServer = new MozMtpServer();
+  sMozMtpServer->Run();
+}
+
+void
+AutoMounter::StopMtpServer()
+{
+  LOG("Stopping MtpServer");
+  sMozMtpServer = nullptr;
+}
+
 /***************************************************************************/
 
 void
@@ -441,22 +467,23 @@ AutoMounter::UpdateState()
 
   bool  umsAvail = false;
   bool  umsEnabled = false;
+  bool  mtpAvail = false;
+  bool  mtpEnabled = false;
 
   if (access(ICS_SYS_USB_FUNCTIONS, F_OK) == 0) {
+    char functionsStr[60];
+    if (!ReadSysFile(ICS_SYS_USB_FUNCTIONS, functionsStr, sizeof(functionsStr))) {
+      ERR("Error reading file '%s': %s", ICS_SYS_USB_FUNCTIONS, strerror(errno));
+      functionsStr[0] = '\0';
+    }
     umsAvail = (access(ICS_SYS_UMS_DIRECTORY, F_OK) == 0);
     if (umsAvail) {
-      char functionsStr[60];
-      if (ReadSysFile(ICS_SYS_USB_FUNCTIONS, functionsStr, sizeof(functionsStr))) {
-        umsEnabled = strstr(functionsStr, "mass_storage") != nullptr;
-      } else {
-        ERR("Error reading file '%s': %s", ICS_SYS_USB_FUNCTIONS, strerror(errno));
-        umsEnabled = false;
-      }
-    } else {
-      umsEnabled = false;
+      umsEnabled = strstr(functionsStr, "mass_storage") != nullptr;
+    }
+    mtpAvail = (access(ICS_SYS_MTP_DIRECTORY, F_OK) == 0);
+    if (mtpAvail) {
+      mtpEnabled = strstr(functionsStr, "mtp") != nullptr;
     }
-  } else {
-    umsAvail = ReadSysFile(GB_SYS_UMS_ENABLE, &umsEnabled);
   }
 
   bool usbCablePluggedIn = IsUsbCablePluggedIn();
@@ -469,9 +496,19 @@ AutoMounter::UpdateState()
     }
   }
 
-  bool tryToShare = (umsAvail && umsEnabled && enabled && usbCablePluggedIn);
-  LOG("UpdateState: umsAvail:%d umsEnabled:%d mode:%d usbCablePluggedIn:%d tryToShare:%d",
-      umsAvail, umsEnabled, mMode, usbCablePluggedIn, tryToShare);
+  bool tryToShare = (((umsAvail && umsEnabled) || (mtpAvail && mtpEnabled))
+                  && enabled && usbCablePluggedIn);
+  LOG("UpdateState: ums:%d%d mtp:%d%d mode:%d usbCablePluggedIn:%d tryToShare:%d",
+      umsAvail, umsEnabled, mtpAvail, mtpEnabled, mMode, usbCablePluggedIn, tryToShare);
+
+  if (mtpAvail && mtpEnabled) {
+    if (enabled && usbCablePluggedIn) {
+      StartMtpServer();
+    } else {
+      StopMtpServer();
+    }
+    return;
+  }
 
   bool filesOpen = false;
   static unsigned filesOpenDelayCount = 0;
@@ -902,6 +939,9 @@ AutoMounterUnmountVolume(const nsCString& aVolumeName)
 void
 ShutdownAutoMounter()
 {
+  if (sAutoMounter) {
+    sAutoMounter->StopMtpServer();
+  }
   sAutoMounterSetting = nullptr;
   sUsbCableObserver = nullptr;
 
diff --git a/dom/system/gonk/MozMtpCommon.h b/dom/system/gonk/MozMtpCommon.h
new file mode 100644
index 00000000000..72769f87f5c
--- /dev/null
+++ b/dom/system/gonk/MozMtpCommon.h
@@ -0,0 +1,44 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_system_mozmtpcommon_h__
+#define mozilla_system_mozmtpcommon_h__
+
+#include "mozilla/Types.h"
+#include <android/log.h>
+
+#define MTP_LOG(msg, ...)                                            \
+  __android_log_print(ANDROID_LOG_INFO, "MozMtp",                    \
+                      "%s: " msg, __FUNCTION__, ##__VA_ARGS__)       \
+
+#define MTP_ERR(msg, ...)                                            \
+  __android_log_print(ANDROID_LOG_ERROR, "MozMtp",                   \
+                      "%s: " msg, __FUNCTION__, ##__VA_ARGS__)       \
+
+#define BEGIN_MTP_NAMESPACE \
+  namespace mozilla { namespace system { namespace mtp {
+#define END_MTP_NAMESPACE \
+  } /* namespace mtp */ } /* namespace system */ } /* namespace mozilla */
+#define USING_MTP_NAMESPACE \
+  using namespace mozilla::system::mtp;
+
+namespace android {
+  class MOZ_EXPORT MtpServer;
+  class MOZ_EXPORT MtpStorage;
+  class MOZ_EXPORT MtpDatabase;
+  class MOZ_EXPORT MtpDataPacket;
+  class MOZ_EXPORT MtpProperty;
+}
+
+#include <mtp.h>
+#include <MtpDatabase.h>
+#include <MtpObjectInfo.h>
+#include <MtpProperty.h>
+#include <MtpServer.h>
+#include <MtpStorage.h>
+#include <MtpTypes.h>
+
+#endif // mozilla_system_mtpcommon_h__
diff --git a/dom/system/gonk/MozMtpDatabase.cpp b/dom/system/gonk/MozMtpDatabase.cpp
new file mode 100644
index 00000000000..44b787a41ab
--- /dev/null
+++ b/dom/system/gonk/MozMtpDatabase.cpp
@@ -0,0 +1,792 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MozMtpDatabase.h"
+
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/Scoped.h"
+#include "nsIFile.h"
+#include "nsPrintfCString.h"
+#include "prio.h"
+
+#include <dirent.h>
+#include <libgen.h>
+
+using namespace android;
+using namespace mozilla;
+
+namespace mozilla {
+MOZ_TYPE_SPECIFIC_SCOPED_POINTER_TEMPLATE(ScopedCloseDir, PRDir, PR_CloseDir)
+}
+
+BEGIN_MTP_NAMESPACE
+
+static const char *
+ObjectPropertyAsStr(MtpObjectProperty aProperty)
+{
+  switch (aProperty) {
+    case MTP_PROPERTY_STORAGE_ID:       return "MTP_PROPERTY_STORAGE_ID";
+    case MTP_PROPERTY_OBJECT_FORMAT:    return "MTP_PROPERTY_OBJECT_FORMAT";
+    case MTP_PROPERTY_OBJECT_SIZE:      return "MTP_PROPERTY_OBJECT_SIZE";
+    case MTP_PROPERTY_WIDTH:            return "MTP_PROPERTY_WIDTH";
+    case MTP_PROPERTY_HEIGHT:           return "MTP_PROPERTY_HEIGHT";
+    case MTP_PROPERTY_IMAGE_BIT_DEPTH:  return "MTP_PROPERTY_IMAGE_BIT_DEPTH";
+    case MTP_PROPERTY_DISPLAY_NAME:     return "MTP_PROPERTY_DISPLAY_NAME";
+  }
+  return "MTP_PROPERTY_???";
+}
+
+MozMtpDatabase::MozMtpDatabase(const char *aDir)
+{
+  MTP_LOG("");
+
+  // We use the index into the array as the handle. Since zero isn't a valid
+  // index, we stick a dummy entry there.
+
+  RefPtr<DbEntry> dummy;
+
+  mDb.AppendElement(dummy);
+
+  ReadVolume("sdcard", aDir);
+}
+
+//virtual
+MozMtpDatabase::~MozMtpDatabase()
+{
+  MTP_LOG("");
+}
+
+void
+MozMtpDatabase::AddEntry(DbEntry *entry)
+{
+  entry->mHandle = GetNextHandle();
+  MOZ_ASSERT(mDb.Length() == entry->mHandle);
+  mDb.AppendElement(entry);
+
+  MTP_LOG("AddEntry: Handle: 0x%08x Parent: 0x%08x Path:'%s'",
+          entry->mHandle, entry->mParent, entry->mPath.get());
+}
+
+TemporaryRef<MozMtpDatabase::DbEntry>
+MozMtpDatabase::GetEntry(MtpObjectHandle aHandle)
+{
+  RefPtr<DbEntry> entry;
+
+  if (aHandle > 0 && aHandle < mDb.Length()) {
+    entry = mDb[aHandle];
+  }
+  return entry;
+}
+
+void
+MozMtpDatabase::RemoveEntry(MtpObjectHandle aHandle)
+{
+  if (aHandle > 0 && aHandle < mDb.Length()) {
+    mDb[aHandle] = nullptr;
+  }
+}
+
+nsCString
+MozMtpDatabase::BaseName(const nsCString& path)
+{
+  nsCOMPtr<nsIFile> file;
+  NS_NewNativeLocalFile(path, false, getter_AddRefs(file));
+  if (file) {
+    nsCString leafName;
+    file->GetNativeLeafName(leafName);
+    return leafName;
+  }
+  return path;
+}
+
+void
+MozMtpDatabase::ParseDirectory(const char *aDir, MtpObjectHandle aParent)
+{
+  ScopedCloseDir dir;
+
+  if (!(dir = PR_OpenDir(aDir))) {
+    MTP_ERR("Unable to open directory '%s'", aDir);
+    return;
+  }
+
+  PRDirEntry* dirEntry;
+  while ((dirEntry = PR_ReadDir(dir, PR_SKIP_BOTH))) {
+    nsPrintfCString filename("%s/%s", aDir, dirEntry->name);
+    PRFileInfo64 fileInfo;
+    if (PR_GetFileInfo64(filename.get(), &fileInfo) != PR_SUCCESS) {
+      MTP_ERR("Unable to retrieve file information for '%s'", filename.get());
+      continue;
+    }
+
+    RefPtr<DbEntry> entry = new DbEntry;
+
+    entry->mStorageID = MTP_STORAGE_FIXED_RAM;
+    entry->mParent = aParent;
+    entry->mObjectName = dirEntry->name;
+    entry->mDisplayName = dirEntry->name;
+    entry->mPath = filename;
+    entry->mDateCreated = fileInfo.creationTime;
+    entry->mDateModified = fileInfo.modifyTime;
+
+    if (fileInfo.type == PR_FILE_FILE) {
+      entry->mObjectFormat = MTP_FORMAT_DEFINED;
+      //TODO: Check how 64-bit filesize are dealt with
+      entry->mObjectSize = fileInfo.size;
+      AddEntry(entry);
+    } else if (fileInfo.type == PR_FILE_DIRECTORY) {
+      entry->mObjectFormat = MTP_FORMAT_ASSOCIATION;
+      entry->mObjectSize = 0;
+      AddEntry(entry);
+      ParseDirectory(filename.get(), entry->mHandle);
+    }
+  }
+}
+
+void
+MozMtpDatabase::ReadVolume(const char *volumeName, const char *aDir)
+{
+  //TODO: Add an assert re thread being run on
+
+  PRFileInfo  fileInfo;
+
+  if (PR_GetFileInfo(aDir, &fileInfo) != PR_SUCCESS) {
+    MTP_ERR("'%s' doesn't exist", aDir);
+    return;
+  }
+  if (fileInfo.type != PR_FILE_DIRECTORY) {
+    MTP_ERR("'%s' isn't a directory", aDir);
+    return;
+  }
+
+  RefPtr<DbEntry> entry = new DbEntry;
+
+  entry->mStorageID = MTP_STORAGE_FIXED_RAM;
+  entry->mParent = MTP_PARENT_ROOT;
+  entry->mObjectName = volumeName;
+  entry->mDisplayName = volumeName;
+  entry->mPath = aDir;
+  entry->mObjectFormat = MTP_FORMAT_ASSOCIATION;
+  entry->mObjectSize = 0;
+
+  AddEntry(entry);
+
+  ParseDirectory(aDir, entry->mHandle);
+}
+
+// called from SendObjectInfo to reserve a database entry for the incoming file
+//virtual
+MtpObjectHandle
+MozMtpDatabase::beginSendObject(const char* aPath,
+                              MtpObjectFormat aFormat,
+                              MtpObjectHandle aParent,
+                              MtpStorageID aStorageID,
+                              uint64_t aSize,
+                              time_t aModified)
+{
+  if (!aParent) {
+    MTP_LOG("aParent is NULL");
+    return kInvalidObjectHandle;
+  }
+
+  RefPtr<DbEntry> entry = new DbEntry;
+
+  entry->mStorageID = aStorageID;
+  entry->mParent = aParent;
+  entry->mPath = aPath;
+  entry->mObjectName = BaseName(entry->mPath);
+  entry->mDisplayName = entry->mObjectName;
+  entry->mObjectFormat = aFormat;
+  entry->mObjectSize = aSize;
+
+  AddEntry(entry);
+
+  MTP_LOG("Handle: 0x%08x Parent: 0x%08x Path: '%s'", entry->mHandle, aParent, aPath);
+
+  return entry->mHandle;
+}
+
+// called to report success or failure of the SendObject file transfer
+// success should signal a notification of the new object's creation,
+// failure should remove the database entry created in beginSendObject
+
+//virtual
+void
+MozMtpDatabase::endSendObject(const char* aPath,
+                            MtpObjectHandle aHandle,
+                            MtpObjectFormat aFormat,
+                            bool succeeded)
+{
+  MTP_LOG("Handle: 0x%08x Path: '%s'", aHandle, aPath);
+  if (!succeeded) {
+    RemoveEntry(aHandle);
+  }
+}
+
+//virtual
+MtpObjectHandleList*
+MozMtpDatabase::getObjectList(MtpStorageID aStorageID,
+                            MtpObjectFormat aFormat,
+                            MtpObjectHandle aParent)
+{
+  MTP_LOG("StorageID: 0x%08x Format: 0x%04x Parent: 0x%08x",
+          aStorageID, aFormat, aParent);
+
+  //TODO: Optimize
+
+  ScopedDeletePtr<MtpObjectHandleList> list;
+
+  list = new MtpObjectHandleList();
+
+  DbArray::size_type numEntries = mDb.Length();
+  DbArray::index_type entryIndex;
+  for (entryIndex = 1; entryIndex < numEntries; entryIndex++) {
+    RefPtr<DbEntry> entry = mDb[entryIndex];
+    if (entry->mParent == aParent) {
+      list->push(entry->mHandle);
+    }
+  }
+  return list.forget();
+}
+
+//virtual
+int
+MozMtpDatabase::getNumObjects(MtpStorageID aStorageID,
+                            MtpObjectFormat aFormat,
+                            MtpObjectHandle aParent)
+{
+  MTP_LOG("");
+
+  return mDb.Length() - 1;
+}
+
+//virtual
+MtpObjectFormatList*
+MozMtpDatabase::getSupportedPlaybackFormats()
+{
+  static const uint16_t init_data[] = {MTP_FORMAT_PNG};
+
+  MtpObjectFormatList *list = new MtpObjectFormatList();
+  list->appendArray(init_data, MOZ_ARRAY_LENGTH(init_data));
+
+  MTP_LOG("returning MTP_FORMAT_PNG");
+  return list;
+}
+
+//virtual
+MtpObjectFormatList*
+MozMtpDatabase::getSupportedCaptureFormats()
+{
+  static const uint16_t init_data[] = {MTP_FORMAT_ASSOCIATION, MTP_FORMAT_PNG};
+
+  MtpObjectFormatList *list = new MtpObjectFormatList();
+  list->appendArray(init_data, MOZ_ARRAY_LENGTH(init_data));
+  MTP_LOG("returning MTP_FORMAT_PNG");
+  return list;
+}
+
+static const MtpObjectProperty sSupportedObjectProperties[] =
+{
+  MTP_PROPERTY_STORAGE_ID,
+  MTP_PROPERTY_PARENT_OBJECT,
+  MTP_PROPERTY_OBJECT_FORMAT,
+  MTP_PROPERTY_OBJECT_SIZE,
+  MTP_PROPERTY_OBJECT_FILE_NAME,    // just the filename - no directory
+  MTP_PROPERTY_PROTECTION_STATUS,   // UINT16 - always 0
+  MTP_PROPERTY_DATE_MODIFIED,
+  MTP_PROPERTY_DATE_ADDED,
+};
+
+//virtual
+MtpObjectPropertyList*
+MozMtpDatabase::getSupportedObjectProperties(MtpObjectFormat aFormat)
+{
+  MTP_LOG("");
+  MtpObjectPropertyList *list = new MtpObjectPropertyList();
+  list->appendArray(sSupportedObjectProperties,
+                    MOZ_ARRAY_LENGTH(sSupportedObjectProperties));
+  return list;
+}
+
+//virtual
+MtpDevicePropertyList*
+MozMtpDatabase::getSupportedDeviceProperties()
+{
+  MTP_LOG("");
+  static const uint16_t init_data[] = { MTP_DEVICE_PROPERTY_UNDEFINED };
+
+  MtpDevicePropertyList *list = new MtpDevicePropertyList();
+  list->appendArray(init_data, MOZ_ARRAY_LENGTH(init_data));
+  return list;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::getObjectPropertyValue(MtpObjectHandle aHandle,
+                                     MtpObjectProperty aProperty,
+                                     MtpDataPacket& aPacket)
+{
+  RefPtr<DbEntry> entry = GetEntry(aHandle);
+  if (!entry) {
+    MTP_ERR("Invalid Handle: 0x%08x", aHandle);
+    return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+  }
+
+  MTP_LOG("Handle: 0x%08x '%s' Property: %s 0x%08x",
+          aHandle, entry->mDisplayName.get(), ObjectPropertyAsStr(aProperty), aProperty);
+
+  switch (aProperty)
+  {
+    case MTP_PROPERTY_STORAGE_ID:     aPacket.putUInt32(entry->mStorageID); break;
+    case MTP_PROPERTY_PARENT_OBJECT:  aPacket.putUInt32(entry->mParent); break;
+    case MTP_PROPERTY_OBJECT_FORMAT:  aPacket.putUInt32(entry->mObjectFormat); break;
+    case MTP_PROPERTY_OBJECT_SIZE:    aPacket.putUInt32(entry->mObjectSize); break;
+    case MTP_PROPERTY_DISPLAY_NAME:   aPacket.putString(entry->mDisplayName.get()); break;
+
+    default:
+      MTP_LOG("Invalid Property: 0x%08x", aProperty);
+      return MTP_RESPONSE_INVALID_OBJECT_PROP_CODE;
+  }
+
+  return MTP_RESPONSE_OK;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::setObjectPropertyValue(MtpObjectHandle aHandle,
+                                     MtpObjectProperty aProperty,
+                                     MtpDataPacket& aPacket)
+{
+  MTP_LOG("Handle: 0x%08x (NOT SUPPORTED)", aHandle);
+  return MTP_RESPONSE_OPERATION_NOT_SUPPORTED;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::getDevicePropertyValue(MtpDeviceProperty aProperty,
+                                     MtpDataPacket& aPacket)
+{
+  MTP_LOG("(GENERAL ERROR)");
+  return MTP_RESPONSE_GENERAL_ERROR;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::setDevicePropertyValue(MtpDeviceProperty aProperty,
+                                     MtpDataPacket& aPacket)
+{
+  MTP_LOG("(NOT SUPPORTED)");
+  return MTP_RESPONSE_OPERATION_NOT_SUPPORTED;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::resetDeviceProperty(MtpDeviceProperty aProperty)
+{
+  MTP_LOG("(NOT SUPPORTED)");
+  return MTP_RESPONSE_OPERATION_NOT_SUPPORTED;
+}
+
+void
+MozMtpDatabase::QueryEntries(MozMtpDatabase::MatchType aMatchType,
+                             uint32_t aMatchField1,
+                             uint32_t aMatchField2,
+                             DbArray &result)
+{
+  DbArray::size_type numEntries = mDb.Length();
+  DbArray::index_type entryIdx;
+  RefPtr<DbEntry> entry;
+
+  result.Clear();
+
+  switch (aMatchType) {
+
+    case MatchAll:
+      for (entryIdx = 0; entryIdx < numEntries; entryIdx++) {
+        if (mDb[entryIdx]) {
+          result.AppendElement(mDb[entryIdx]);
+        }
+      }
+      break;
+
+    case MatchHandle:
+      for (entryIdx = 0; entryIdx < numEntries; entryIdx++) {
+        entry = mDb[entryIdx];
+        if (entry && entry->mHandle == aMatchField1) {
+          result.AppendElement(entry);
+          // Handles are unique - return the one that we found.
+          return;
+        }
+      }
+      break;
+
+    case MatchParent:
+      for (entryIdx = 0; entryIdx < numEntries; entryIdx++) {
+        entry = mDb[entryIdx];
+        if (entry && entry->mParent == aMatchField1) {
+          result.AppendElement(entry);
+        }
+      }
+      break;
+
+    case MatchFormat:
+      for (entryIdx = 0; entryIdx < numEntries; entryIdx++) {
+        entry = mDb[entryIdx];
+        if (entry && entry->mObjectFormat == aMatchField1) {
+          result.AppendElement(entry);
+        }
+      }
+      break;
+
+    case MatchHandleFormat:
+      for (entryIdx = 0; entryIdx < numEntries; entryIdx++) {
+        entry = mDb[entryIdx];
+        if (entry && entry->mHandle == aMatchField1) {
+          if (entry->mObjectFormat == aMatchField2) {
+            result.AppendElement(entry);
+          }
+          // Only 1 entry can match my aHandle. So we can return early.
+          return;
+        }
+      }
+      break;
+
+    case MatchParentFormat:
+      for (entryIdx = 0; entryIdx < numEntries; entryIdx++) {
+        entry = mDb[entryIdx];
+        if (entry && entry->mParent == aMatchField1 && entry->mObjectFormat == aMatchField2) {
+          result.AppendElement(entry);
+        }
+      }
+      break;
+
+    default:
+      MOZ_ASSERT(!"Invalid MatchType");
+  }
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::getObjectPropertyList(MtpObjectHandle aHandle,
+                                    uint32_t aFormat,
+                                    uint32_t aProperty,
+                                    int aGroupCode,
+                                    int aDepth,
+                                    MtpDataPacket& aPacket)
+{
+  MTP_LOG("Handle: 0x%08x Format: 0x%08x aProperty: 0x%08x aGroupCode: %d aDepth %d (NOT SUPPORTED)",
+          aHandle, aFormat, aProperty, aGroupCode, aDepth);
+
+  if (aDepth > 1) {
+    return MTP_RESPONSE_SPECIFICATION_BY_DEPTH_UNSUPPORTED;
+  }
+  if (aGroupCode != 0) {
+    return MTP_RESPONSE_SPECIFICATION_BY_GROUP_UNSUPPORTED;
+  }
+
+  MatchType matchType = MatchAll;
+  uint32_t matchField1 = 0;
+  uint32_t matchField2 = 0;
+
+  // aHandle == 0 implies all objects at the root level
+  // further specificed by aFormat and/or aDepth
+
+  if (aFormat == 0) {
+    if (aHandle == 0xffffffff) {
+      // select all objects
+      matchType = MatchAll;
+    } else {
+      if (aDepth == 1) {
+        // select objects whose Parent matches aHandle
+        matchType = MatchParent;
+        matchField1 = aHandle;
+      } else {
+        // select object whose handle matches aHandle
+        matchType = MatchHandle;
+        matchField1 = aHandle;
+      }
+    }
+  } else {
+    if (aHandle == 0xffffffff) {
+      // select all objects whose format matches aFormat
+      matchType = MatchFormat;
+      matchField1 = aFormat;
+    } else {
+      if (aDepth == 1) {
+        // select objects whose Parent is aHandle and format matches aFormat
+        matchType = MatchParentFormat;
+        matchField1 = aHandle;
+        matchField2 = aFormat;
+      } else {
+        // select objects whose handle is aHandle and format matches aFormat
+        matchType = MatchHandleFormat;
+        matchField1 = aHandle;
+        matchField2 = aFormat;
+      }
+    }
+  }
+
+  DbArray result;
+  QueryEntries(matchType, matchField1, matchField2, result);
+
+  const MtpObjectProperty *objectPropertyList;
+  size_t numObjectProperties = 0;
+  MtpObjectProperty objectProperty;
+
+  if (aProperty == 0xffffffff) {
+    // return all supported properties
+    numObjectProperties = MOZ_ARRAY_LENGTH(sSupportedObjectProperties);
+    objectPropertyList = sSupportedObjectProperties;
+  } else {
+    // return property indicated by aProperty
+    numObjectProperties = 1;
+    objectProperty = aProperty;
+    objectPropertyList = &objectProperty;
+  }
+
+  DbArray::size_type numEntries = result.Length();
+  DbArray::index_type entryIdx;
+
+  aPacket.putUInt32(numEntries);
+  for (entryIdx = 0; entryIdx < numEntries; entryIdx++) {
+    RefPtr<DbEntry> entry = result[entryIdx];
+
+    for (size_t propertyIdx = 0; propertyIdx < numObjectProperties; propertyIdx++) {
+      aPacket.putUInt32(entry->mHandle);
+      MtpObjectProperty prop = objectPropertyList[propertyIdx];
+      aPacket.putUInt16(prop);
+      switch (prop) {
+
+        case MTP_PROPERTY_STORAGE_ID:
+          aPacket.putUInt16(MTP_TYPE_UINT32);
+          aPacket.putUInt32(entry->mStorageID);
+          break;
+
+        case MTP_PROPERTY_PARENT_OBJECT:
+          aPacket.putUInt16(MTP_TYPE_UINT32);
+          aPacket.putUInt32(entry->mParent);
+          break;
+
+        case MTP_PROPERTY_OBJECT_FORMAT:
+          aPacket.putUInt16(MTP_TYPE_UINT16);
+          aPacket.putUInt16(entry->mObjectFormat);
+          break;
+
+        case MTP_PROPERTY_OBJECT_SIZE:
+          aPacket.putUInt16(MTP_TYPE_UINT64);
+          aPacket.putUInt64(entry->mObjectSize);
+          break;
+
+        case MTP_PROPERTY_OBJECT_FILE_NAME:
+          aPacket.putUInt16(MTP_TYPE_STR);
+          aPacket.putString(entry->mObjectName.get());
+          break;
+
+        case MTP_PROPERTY_PROTECTION_STATUS:
+          aPacket.putUInt16(MTP_TYPE_UINT16);
+          aPacket.putUInt16(0); // 0 = No Protection
+          break;
+
+        case MTP_PROPERTY_DATE_MODIFIED: {
+          aPacket.putUInt16(MTP_TYPE_STR);
+          PRExplodedTime explodedTime;
+          PR_ExplodeTime(entry->mDateModified, PR_LocalTimeParameters, &explodedTime);
+          char dateStr[20];
+          PR_FormatTime(dateStr, sizeof(dateStr), "%Y%m%dT%H%M%S", &explodedTime);
+          aPacket.putString(dateStr);
+          break;
+        }
+
+        case MTP_PROPERTY_DATE_ADDED: {
+          aPacket.putUInt16(MTP_TYPE_STR);
+          PRExplodedTime explodedTime;
+          PR_ExplodeTime(entry->mDateCreated, PR_LocalTimeParameters, &explodedTime);
+          char dateStr[20];
+          PR_FormatTime(dateStr, sizeof(dateStr), "%Y%m%dT%H%M%S", &explodedTime);
+          aPacket.putString(dateStr);
+          break;
+        }
+
+        default:
+          MTP_ERR("Unrecognized property code: %u", prop);
+          return MTP_RESPONSE_GENERAL_ERROR;
+      }
+    }
+  }
+  return MTP_RESPONSE_OK;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::getObjectInfo(MtpObjectHandle aHandle,
+                            MtpObjectInfo& aInfo)
+{
+  RefPtr<DbEntry> entry = GetEntry(aHandle);
+  if (!entry) {
+    MTP_ERR("Handle 0x%08x is invalid", aHandle);
+    return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+  }
+
+  MTP_LOG("Handle: 0x%08x Display:'%s' Object:'%s'", aHandle, entry->mDisplayName.get(), entry->mObjectName.get());
+
+  aInfo.mHandle = aHandle;
+  aInfo.mStorageID = entry->mStorageID;
+  aInfo.mFormat = entry->mObjectFormat;
+  aInfo.mProtectionStatus = 0x0;
+  aInfo.mCompressedSize = 0;
+  aInfo.mThumbFormat = entry->mObjectFormat;
+  aInfo.mThumbCompressedSize = 20*20*4;
+  aInfo.mThumbPixWidth = 20;
+  aInfo.mThumbPixHeight  =20;
+  aInfo.mImagePixWidth = 20;
+  aInfo.mImagePixHeight = 20;
+  aInfo.mImagePixDepth = 4;
+  aInfo.mParent = entry->mParent;
+  aInfo.mAssociationType = 0;
+  aInfo.mAssociationDesc = 0;
+  aInfo.mSequenceNumber = 0;
+  aInfo.mName = ::strdup(entry->mObjectName.get());
+  aInfo.mDateCreated = 0;
+  aInfo.mDateModified = 0;
+  aInfo.mKeywords = ::strdup("fxos,touch");
+
+  return MTP_RESPONSE_OK;
+}
+
+//virtual
+void*
+MozMtpDatabase::getThumbnail(MtpObjectHandle aHandle, size_t& aOutThumbSize)
+{
+  MTP_LOG("Handle: 0x%08x (returning nullptr)", aHandle);
+
+  aOutThumbSize = 0;
+
+  return nullptr;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::getObjectFilePath(MtpObjectHandle aHandle,
+                                MtpString& aOutFilePath,
+                                int64_t& aOutFileLength,
+                                MtpObjectFormat& aOutFormat)
+{
+  RefPtr<DbEntry> entry = GetEntry(aHandle);
+  if (!entry) {
+    MTP_ERR("Handle 0x%08x is invalid", aHandle);
+    return MTP_RESPONSE_INVALID_OBJECT_HANDLE;
+  }
+
+  MTP_LOG("Handle: 0x%08x FilePath: '%s'", aHandle, entry->mPath.get());
+
+  aOutFilePath = entry->mPath.get();
+  aOutFileLength = entry->mObjectSize;
+  aOutFormat = entry->mObjectFormat;
+
+  return MTP_RESPONSE_OK;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::deleteFile(MtpObjectHandle aHandle)
+{
+  MTP_LOG("Handle: 0x%08x (NOT SUPPORTED)", aHandle);
+
+  //TODO
+
+  return MTP_RESPONSE_OPERATION_NOT_SUPPORTED;
+}
+
+#if 0
+//virtual
+MtpResponseCode
+MozMtpDatabase::moveFile(MtpObjectHandle aHandle, MtpObjectHandle aNewParent)
+{
+  MTP_LOG("Handle: 0x%08x NewParent: 0x%08x", aHandle, aNewParent);
+
+  // change parent
+
+  return MTP_RESPONSE_OK
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::copyFile(MtpObjectHandle aHandle, MtpObjectHandle aNewParent)
+{
+  MTP_LOG("Handle: 0x%08x NewParent: 0x%08x", aHandle, aNewParent);
+
+  // duplicate DbEntry
+  // change parent
+
+  return MTP_RESPONSE_OK
+}
+#endif
+
+//virtual
+MtpObjectHandleList*
+MozMtpDatabase::getObjectReferences(MtpObjectHandle aHandle)
+{
+  MTP_LOG("Handle: 0x%08x (returning nullptr)", aHandle);
+  return nullptr;
+}
+
+//virtual
+MtpResponseCode
+MozMtpDatabase::setObjectReferences(MtpObjectHandle aHandle,
+                                  MtpObjectHandleList* aReferences)
+{
+  MTP_LOG("Handle: 0x%08x (NOT SUPPORTED)", aHandle);
+  return MTP_RESPONSE_OPERATION_NOT_SUPPORTED;
+}
+
+//virtual
+MtpProperty*
+MozMtpDatabase::getObjectPropertyDesc(MtpObjectProperty aProperty,
+                                      MtpObjectFormat aFormat)
+{
+  MTP_LOG("Property: %s 0x%08x", ObjectPropertyAsStr(aProperty), aProperty);
+
+  // TODO: Perhaps Filesize should be 64-bit?
+
+  MtpProperty* result = nullptr;
+  switch (aProperty)
+  {
+    case MTP_PROPERTY_STORAGE_ID:       result = new MtpProperty(aProperty, MTP_TYPE_UINT32); break;
+    case MTP_PROPERTY_OBJECT_FORMAT:    result = new MtpProperty(aProperty, MTP_TYPE_UINT32); break;
+    case MTP_PROPERTY_OBJECT_SIZE:      result = new MtpProperty(aProperty, MTP_TYPE_UINT32); break;
+    case MTP_PROPERTY_WIDTH:            result = new MtpProperty(aProperty, MTP_TYPE_UINT32); break;
+    case MTP_PROPERTY_HEIGHT:           result = new MtpProperty(aProperty, MTP_TYPE_UINT32); break;
+    case MTP_PROPERTY_IMAGE_BIT_DEPTH:  result = new MtpProperty(aProperty, MTP_TYPE_UINT32); break;
+    case MTP_PROPERTY_DISPLAY_NAME:     result = new MtpProperty(aProperty, MTP_TYPE_STR); break;
+    default:
+      break;
+  }
+
+  return result;
+}
+
+//virtual
+MtpProperty*
+MozMtpDatabase::getDevicePropertyDesc(MtpDeviceProperty aProperty)
+{
+  MTP_LOG("(returning MTP_DEVICE_PROPERTY_UNDEFINED)");
+  return new MtpProperty(MTP_DEVICE_PROPERTY_UNDEFINED, MTP_TYPE_UNDEFINED);
+}
+
+//virtual
+void
+MozMtpDatabase::sessionStarted()
+{
+  MTP_LOG("");
+}
+
+//virtual
+void
+MozMtpDatabase::sessionEnded()
+{
+  MTP_LOG("");
+}
+
+END_MTP_NAMESPACE
diff --git a/dom/system/gonk/MozMtpDatabase.h b/dom/system/gonk/MozMtpDatabase.h
new file mode 100644
index 00000000000..7edd3ca5c5b
--- /dev/null
+++ b/dom/system/gonk/MozMtpDatabase.h
@@ -0,0 +1,161 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_system_mozmtpdatabase_h__
+#define mozilla_system_mozmtpdatabase_h__
+
+#include "MozMtpCommon.h"
+
+#include "mozilla/RefPtr.h"
+#include "nsCOMPtr.h"
+#include "nsISupportsImpl.h"
+#include "nsString.h"
+#include "nsTArray.h"
+
+BEGIN_MTP_NAMESPACE // mozilla::system::mtp
+
+using namespace android;
+
+class MozMtpDatabase : public MtpDatabase
+{
+public:
+  MozMtpDatabase(const char *aDir);
+  virtual ~MozMtpDatabase();
+
+  // called from SendObjectInfo to reserve a database entry for the incoming file
+  virtual MtpObjectHandle beginSendObject(const char* aPath,
+                                          MtpObjectFormat aFormat,
+                                          MtpObjectHandle aParent,
+                                          MtpStorageID aStorageID,
+                                          uint64_t aSize,
+                                          time_t aModified);
+
+  // called to report success or failure of the SendObject file transfer
+  // success should signal a notification of the new object's creation,
+  // failure should remove the database entry created in beginSendObject
+  virtual void endSendObject(const char* aPath,
+                             MtpObjectHandle aHandle,
+                             MtpObjectFormat aFormat,
+                             bool aSucceeded);
+
+  virtual MtpObjectHandleList* getObjectList(MtpStorageID aStorageID,
+                                             MtpObjectFormat aFormat,
+                                             MtpObjectHandle aParent);
+
+  virtual int getNumObjects(MtpStorageID aStorageID,
+                            MtpObjectFormat aFormat,
+                            MtpObjectHandle aParent);
+
+  virtual MtpObjectFormatList* getSupportedPlaybackFormats();
+
+  virtual MtpObjectFormatList* getSupportedCaptureFormats();
+
+  virtual MtpObjectPropertyList* getSupportedObjectProperties(MtpObjectFormat aFormat);
+
+  virtual MtpDevicePropertyList* getSupportedDeviceProperties();
+
+  virtual MtpResponseCode getObjectPropertyValue(MtpObjectHandle aHandle,
+                                                 MtpObjectProperty aProperty,
+                                                 MtpDataPacket& aPacket);
+
+  virtual MtpResponseCode setObjectPropertyValue(MtpObjectHandle aHandle,
+                                                 MtpObjectProperty aProperty,
+                                                 MtpDataPacket& aPacket);
+
+  virtual MtpResponseCode getDevicePropertyValue(MtpDeviceProperty aProperty,
+                                                 MtpDataPacket& aPacket);
+
+  virtual MtpResponseCode setDevicePropertyValue(MtpDeviceProperty aProperty,
+                                                 MtpDataPacket& aPacket);
+
+  virtual MtpResponseCode resetDeviceProperty(MtpDeviceProperty aProperty);
+
+  virtual MtpResponseCode getObjectPropertyList(MtpObjectHandle aHandle,
+                                                uint32_t aFormat,
+                                                uint32_t aProperty,
+                                                int aGroupCode,
+                                                int aDepth,
+                                                MtpDataPacket& aPacket);
+
+  virtual MtpResponseCode getObjectInfo(MtpObjectHandle aHandle,
+                                        MtpObjectInfo& aInfo);
+
+  virtual void* getThumbnail(MtpObjectHandle aHandle, size_t& aOutThumbSize);
+
+  virtual MtpResponseCode getObjectFilePath(MtpObjectHandle aHandle,
+                                            MtpString& aOutFilePath,
+                                            int64_t& aOutFileLength,
+                                            MtpObjectFormat& aOutFormat);
+
+  virtual MtpResponseCode deleteFile(MtpObjectHandle aHandle);
+
+  virtual MtpObjectHandleList* getObjectReferences(MtpObjectHandle aHandle);
+
+  virtual MtpResponseCode setObjectReferences(MtpObjectHandle aHandle,
+                                              MtpObjectHandleList* aReferences);
+
+  virtual MtpProperty* getObjectPropertyDesc(MtpObjectProperty aProperty,
+                                             MtpObjectFormat aFormat);
+
+  virtual MtpProperty* getDevicePropertyDesc(MtpDeviceProperty aProperty);
+
+  virtual void sessionStarted();
+
+  virtual void sessionEnded();
+
+private:
+
+  struct DbEntry
+  {
+    NS_INLINE_DECL_REFCOUNTING(DbEntry)
+
+    MtpObjectHandle mHandle;        // uint32_t
+    MtpStorageID    mStorageID;     // uint32_t
+    nsCString       mObjectName;
+    MtpObjectFormat mObjectFormat;  // uint16_t
+    MtpObjectHandle mParent;        // uint32_t
+    uint64_t        mObjectSize;
+    nsCString       mDisplayName;
+    nsCString       mPath;
+    PRTime          mDateCreated;
+    PRTime          mDateModified;
+  };
+  typedef nsTArray<mozilla::RefPtr<DbEntry> > DbArray;
+
+  DbArray mDb;
+
+  enum MatchType
+  {
+    MatchAll,
+    MatchHandle,
+    MatchParent,
+    MatchFormat,
+    MatchHandleFormat,
+    MatchParentFormat,
+  };
+
+
+  void AddEntry(DbEntry *aEntry);
+  mozilla::TemporaryRef<DbEntry> GetEntry(MtpObjectHandle aHandle);
+  void RemoveEntry(MtpObjectHandle aHandle);
+  void QueryEntries(MatchType aMatchType, uint32_t aMatchField1,
+                    uint32_t aMatchField2, DbArray& aResult);
+
+  nsCString BaseName(const nsCString& aPath);
+
+
+  MtpObjectHandle GetNextHandle()
+  {
+    return mDb.Length();
+  }
+
+  void ParseDirectory(const char *aDir, MtpObjectHandle aParent);
+  void ReadVolume(const char *aVolumeName, const char *aDir);
+};
+
+END_MTP_NAMESPACE
+
+#endif // mozilla_system_mozmtpdatabase_h__
diff --git a/dom/system/gonk/MozMtpServer.cpp b/dom/system/gonk/MozMtpServer.cpp
new file mode 100644
index 00000000000..43df913dcc9
--- /dev/null
+++ b/dom/system/gonk/MozMtpServer.cpp
@@ -0,0 +1,80 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "MozMtpServer.h"
+#include "MozMtpDatabase.h"
+
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <unistd.h>
+
+#include <cutils/properties.h>
+
+#include "mozilla/FileUtils.h"
+#include "mozilla/Scoped.h"
+#include "nsThreadUtils.h"
+
+using namespace android;
+using namespace mozilla;
+USING_MTP_NAMESPACE
+
+class MtpServerRunnable : public nsRunnable
+{
+public:
+  nsresult Run()
+  {
+    const char *mtpUsbFilename = "/dev/mtp_usb";
+    const char *productName = "FirefoxOS";
+    const char *storageDir = "/storage/sdcard";
+
+    mFd = open(mtpUsbFilename, O_RDWR);
+    if (mFd.get() < 0) {
+      MTP_LOG("open of '%s' failed", mtpUsbFilename);
+      return NS_OK;
+    }
+
+    MTP_LOG("MozMtpServer open done, fd: %d. Start reading.", mFd.get());
+
+    ScopedDeletePtr<MozMtpDatabase> database;
+    ScopedDeletePtr<MtpServer> server;
+    ScopedDeletePtr<MtpStorage> storage;
+
+    database = new MozMtpDatabase(storageDir);
+    server = new MtpServer(mFd.get(), database, false, 1023, 0664, 0775);
+    storage = new MtpStorage(MTP_STORAGE_FIXED_RAM,       // id
+                             storageDir,                  // filePath
+                             productName,                 // description
+                             100uLL * 1024uLL * 1024uLL,  // reserveSpace
+                             false,                       // removable
+                             2uLL * 1024uLL * 1024uLL * 1024uLL); // maxFileSize
+
+    server->addStorage(storage);
+
+    MTP_LOG("MozMtpServer started");
+    server->run();
+    MTP_LOG("MozMtpServer finished");
+
+    return NS_OK;
+  }
+
+private:
+  ScopedClose mFd;
+};
+
+void
+MozMtpServer::Run()
+{
+  nsresult rv = NS_NewNamedThread("MtpServer", getter_AddRefs(mServerThread));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return;
+  }
+  MOZ_ASSERT(mServerThread);
+  mServerThread->Dispatch(new MtpServerRunnable(), 0);
+}
diff --git a/dom/system/gonk/MozMtpServer.h b/dom/system/gonk/MozMtpServer.h
new file mode 100644
index 00000000000..c7c6a6f8b2c
--- /dev/null
+++ b/dom/system/gonk/MozMtpServer.h
@@ -0,0 +1,32 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_system_mozmtpserver_h__
+#define mozilla_system_mozmtpserver_h__
+
+#include "MozMtpCommon.h"
+
+#include "nsCOMPtr.h"
+#include "nsIThread.h"
+
+BEGIN_MTP_NAMESPACE
+
+class MozMtpServer
+{
+public:
+  NS_INLINE_DECL_REFCOUNTING(MozMtpServer)
+
+  void Run();
+
+private:
+  nsCOMPtr<nsIThread> mServerThread;
+};
+
+END_MTP_NAMESPACE
+
+#endif  // mozilla_system_mozmtpserver_h__
+
+
diff --git a/dom/system/gonk/moz.build b/dom/system/gonk/moz.build
index 159cfa32098..efa545af31e 100644
--- a/dom/system/gonk/moz.build
+++ b/dom/system/gonk/moz.build
@@ -41,6 +41,8 @@ SOURCES += [
     'AutoMounter.cpp',
     'AutoMounterSetting.cpp',
     'GonkGPSGeolocationProvider.cpp',
+    'MozMtpDatabase.cpp',
+    'MozMtpServer.cpp',
     'NetworkUtils.cpp',
     'NetworkWorker.cpp',
     'nsVolume.cpp',
@@ -57,6 +59,11 @@ SOURCES += [
     'VolumeServiceTest.cpp',
 ]
 
+if CONFIG['ANDROID_VERSION'] >= '17':
+    CXXFLAGS += ['-I%s/frameworks/av/media/mtp' % CONFIG['ANDROID_SOURCE']]
+else:
+    CXXFLAGS += ['-I%s/frameworks/base/media/mtp' % CONFIG['ANDROID_SOURCE']]
+
 if CONFIG['ENABLE_TESTS']:
     XPCSHELL_TESTS_MANIFESTS += ['tests/xpcshell.ini']
 
diff --git a/dom/webidl/Constraints.webidl b/dom/webidl/Constraints.webidl
index 3fa2c40b7bb..468b0491d1c 100644
--- a/dom/webidl/Constraints.webidl
+++ b/dom/webidl/Constraints.webidl
@@ -14,6 +14,12 @@ enum VideoFacingModeEnum {
     "right"
 };
 
+enum MediaSourceEnum {
+    "camera",
+    "screen",
+    "application"
+};
+
 dictionary ConstrainLongRange {
     long min = -2147483647; // +1 works around windows compiler bug
     long max = 2147483647;
diff --git a/dom/webidl/MediaTrackConstraintSet.webidl b/dom/webidl/MediaTrackConstraintSet.webidl
index cee3bb2f7a7..ccebf26b69d 100644
--- a/dom/webidl/MediaTrackConstraintSet.webidl
+++ b/dom/webidl/MediaTrackConstraintSet.webidl
@@ -13,17 +13,20 @@ enum SupportedVideoConstraints {
     "width",
     "height",
     "frameRate",
+    "mediaSource"
 };
 
 enum SupportedAudioConstraints {
     "other"
 };
 
+
 dictionary MediaTrackConstraintSet {
     ConstrainLongRange width;
     ConstrainLongRange height;
     ConstrainDoubleRange frameRate;
     ConstrainVideoFacingMode facingMode;
+    ConstrainMediaSource mediaSource = "camera";
 };
 
 // TODO: Bug 995352 can't nest unions
@@ -31,5 +34,8 @@ dictionary MediaTrackConstraintSet {
 //typedef (double or ConstrainDoubleRange) ConstrainDouble;
 
 typedef VideoFacingModeEnum ConstrainVideoFacingMode;
+typedef MediaSourceEnum ConstrainMediaSource;
+
 // TODO: Bug 767924 sequences in unions
 //typedef (VideoFacingModeEnum or sequence<VideoFacingModeEnum>) ConstrainVideoFacingMode;
+//typedef (MediaSourceEnum or sequence<MediaSourceEnum>) ConstrainMediaSource;
\ No newline at end of file
diff --git a/dom/wifi/WifiWorker.js b/dom/wifi/WifiWorker.js
index 11a6e446172..9409e22bb83 100644
--- a/dom/wifi/WifiWorker.js
+++ b/dom/wifi/WifiWorker.js
@@ -1146,6 +1146,7 @@ var WifiManager = (function() {
         createWaitForDriverReadyTimer(doStartWifiTethering);
       });
     } else {
+      cancelWifiHotspotStatusTimer();
       gNetworkManager.setWifiTethering(enabled, WifiNetworkInterface,
                                        configuration, function(result) {
         // Should we fire a dom event if we fail to set wifi tethering  ?
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index acefb7641e3..4c449320f6c 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -594,6 +594,18 @@ LoadJSGCMemoryOptions(const char* aPrefName, void* /* aClosure */)
       continue;
     }
 
+    matchName.RebindLiteral(PREF_MEM_OPTIONS_PREFIX "gc_min_empty_chunk_count");
+    if (memPrefName == matchName || (!rts && index == 12)) {
+      UpdateCommonJSGCMemoryOption(rts, matchName, JSGC_MIN_EMPTY_CHUNK_COUNT);
+      continue;
+    }
+
+    matchName.RebindLiteral(PREF_MEM_OPTIONS_PREFIX "gc_max_empty_chunk_count");
+    if (memPrefName == matchName || (!rts && index == 13)) {
+      UpdateCommonJSGCMemoryOption(rts, matchName, JSGC_MAX_EMPTY_CHUNK_COUNT);
+      continue;
+    }
+
 #ifdef DEBUG
     nsAutoCString message("Workers don't support the 'mem.");
     message.Append(memPrefName);
diff --git a/gfx/layers/apz/public/GeckoContentController.h b/gfx/layers/apz/public/GeckoContentController.h
index 8db7ad83306..b767ff820f8 100644
--- a/gfx/layers/apz/public/GeckoContentController.h
+++ b/gfx/layers/apz/public/GeckoContentController.h
@@ -68,7 +68,8 @@ public:
    * relative to the current scroll offset. HandleLongTapUp will always be
    * preceeded by HandleLongTap. However not all calls to HandleLongTap will
    * be followed by a HandleLongTapUp (for example, if the user drags
-   * around between the long-tap and lifting their finger).
+   * around between the long-tap and lifting their finger, or if content
+   * notifies the APZ that the long-tap event was prevent-defaulted).
    */
   virtual void HandleLongTapUp(const CSSPoint& aPoint,
                                int32_t aModifiers,
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.cpp b/gfx/layers/apz/src/AsyncPanZoomController.cpp
index 00f4f4b3b0f..c873e891599 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.cpp
+++ b/gfx/layers/apz/src/AsyncPanZoomController.cpp
@@ -15,6 +15,7 @@
 #include "FrameMetrics.h"               // for FrameMetrics, etc
 #include "GestureEventListener.h"       // for GestureEventListener
 #include "InputData.h"                  // for MultiTouchInput, etc
+#include "TouchBlockState.h"            // for TouchBlockState
 #include "Units.h"                      // for CSSRect, CSSPoint, etc
 #include "UnitTransforms.h"             // for TransformTo
 #include "base/message_loop.h"          // for MessageLoop
@@ -316,14 +317,6 @@ typedef GeckoContentController::APZStateChange APZStateChange;
  * Units: ms
  */
 
-/**
- * Default touch behavior (is used when not touch behavior is set).
- */
-static const uint32_t DefaultTouchBehavior = AllowedTouchBehavior::VERTICAL_PAN |
-                                             AllowedTouchBehavior::HORIZONTAL_PAN |
-                                             AllowedTouchBehavior::PINCH_ZOOM |
-                                             AllowedTouchBehavior::DOUBLE_TAP_ZOOM;
-
 /**
  * Angle from axis within which we stay axis-locked
  */
@@ -412,6 +405,26 @@ GetFrameTime() {
   return sFrameTime;
 }
 
+static PRThread* sControllerThread;
+
+static void
+AssertOnControllerThread() {
+  if (!AsyncPanZoomController::GetThreadAssertionsEnabled()) {
+    return;
+  }
+
+  static bool sControllerThreadDetermined = false;
+  if (!sControllerThreadDetermined) {
+    // Technically this may not actually pick up the correct controller thread,
+    // if the first call to this method happens from a non-controller thread.
+    // If the assertion below fires, it is possible that it is because
+    // sControllerThread is not actually the controller thread.
+    sControllerThread = PR_GetCurrentThread();
+    sControllerThreadDetermined = true;
+  }
+  MOZ_ASSERT(sControllerThread == PR_GetCurrentThread());
+}
+
 class FlingAnimation: public AsyncPanZoomAnimation {
 public:
   FlingAnimation(AsyncPanZoomController& aApzc,
@@ -697,7 +710,6 @@ AsyncPanZoomController::AsyncPanZoomController(uint64_t aLayersId,
      mSharingFrameMetricsAcrossProcesses(false),
      mMonitor("AsyncPanZoomController"),
      mState(NOTHING),
-     mContentResponseTimeoutTask(nullptr),
      mX(MOZ_THIS_IN_INITIALIZER_LIST()),
      mY(MOZ_THIS_IN_INITIALIZER_LIST()),
      mPanDirRestricted(false),
@@ -707,7 +719,7 @@ AsyncPanZoomController::AsyncPanZoomController(uint64_t aLayersId,
      mLastAsyncScrollOffset(0, 0),
      mCurrentAsyncScrollOffset(0, 0),
      mAsyncScrollTimeoutTask(nullptr),
-     mHandlingTouchQueue(false),
+     mTouchBlockBalance(0),
      mTreeManager(aTreeManager),
      mScrollParentId(FrameMetrics::NULL_SCROLL_ID),
      mAPZCId(sAsyncPanZoomControllerCount++),
@@ -759,6 +771,8 @@ AsyncPanZoomController::Destroy()
 {
   CancelAnimation();
 
+  mTouchBlockQueue.Clear();
+
   { // scope the lock
     MonitorAutoLock lock(mRefPtrMonitor);
     mGeckoContentController = nullptr;
@@ -802,42 +816,57 @@ AsyncPanZoomController::GetTouchStartTolerance()
 }
 
 nsEventStatus AsyncPanZoomController::ReceiveInputEvent(const InputData& aEvent) {
-  if (aEvent.mInputType == MULTITOUCH_INPUT &&
-      aEvent.AsMultiTouchInput().mType == MultiTouchInput::MULTITOUCH_START) {
-    // Starting a new touch block, clear old touch block state.
-    mTouchBlockState = TouchBlockState();
+  AssertOnControllerThread();
+
+  if (aEvent.mInputType != MULTITOUCH_INPUT) {
+    return HandleInputEvent(aEvent);
   }
 
-  // If we may have touch listeners and touch action property is enabled, we
-  // enable the machinery that allows touch listeners to preventDefault any touch inputs
-  // and also waits for the allowed touch behavior values to be received from the outside.
-  // This should not happen unless there are actually touch listeners and touch-action property
-  // enable as it introduces potentially unbounded lag because it causes a round-trip through
-  // content.  Usually, if content is responding in a timely fashion, this only introduces a
-  // nearly constant few hundred ms of lag.
-  if ((mFrameMetrics.mMayHaveTouchListeners || mFrameMetrics.mMayHaveTouchCaret) &&
-      aEvent.mInputType == MULTITOUCH_INPUT &&
-      (mState == NOTHING || mState == TOUCHING || IsPanningState(mState))) {
-    const MultiTouchInput& multiTouchInput = aEvent.AsMultiTouchInput();
-    if (multiTouchInput.mType == MultiTouchInput::MULTITOUCH_START) {
-      SetState(WAITING_CONTENT_RESPONSE);
+  TouchBlockState* block = nullptr;
+  if (aEvent.AsMultiTouchInput().mType == MultiTouchInput::MULTITOUCH_START) {
+    block = StartNewTouchBlock(false);
+    APZC_LOG("%p started new touch block %p\n", this, block);
+    if (mFrameMetrics.mMayHaveTouchListeners || mFrameMetrics.mMayHaveTouchCaret) {
+      // Content may intercept the touch events and prevent-default them. So we schedule
+      // a timeout to give content time to do that.
+      ScheduleContentResponseTimeout();
+    } else {
+      // Content won't prevent-default this, so we can just pretend like we scheduled
+      // a timeout and it expired. Note that we will still receive a ContentReceivedTouch
+      // callback for this block, and so we need to make sure we adjust the touch balance.
+      APZC_LOG("%p not waiting for content response on block %p\n", this, block);
+      mTouchBlockBalance++;
+      block->TimeoutContentResponse();
     }
+  } else if (mTouchBlockQueue.IsEmpty()) {
+    NS_WARNING("Received a non-start touch event while no touch blocks active!");
+  } else {
+    // this touch is part of the most-recently created block
+    block = mTouchBlockQueue.LastElement().get();
+    APZC_LOG("%p received new event in block %p\n", this, block);
   }
 
-  if (mState == WAITING_CONTENT_RESPONSE || mHandlingTouchQueue) {
-    if (aEvent.mInputType == MULTITOUCH_INPUT) {
-      const MultiTouchInput& multiTouchInput = aEvent.AsMultiTouchInput();
-      mTouchQueue.AppendElement(multiTouchInput);
-
-      SetContentResponseTimer();
-    }
+  if (!block) {
     return nsEventStatus_eIgnore;
   }
 
-  return HandleInputEvent(aEvent);
+  if (block == CurrentTouchBlock() && block->IsReadyForHandling()) {
+    APZC_LOG("%p's current touch block is ready with preventdefault %d\n",
+        this, block->IsDefaultPrevented());
+    if (block->IsDefaultPrevented()) {
+      return nsEventStatus_eIgnore;
+    }
+    return HandleInputEvent(aEvent);
+  }
+
+  // Otherwise, add it to the queue for the touch block
+  block->AddEvent(aEvent.AsMultiTouchInput());
+  return nsEventStatus_eConsumeDoDefault;
 }
 
 nsEventStatus AsyncPanZoomController::HandleInputEvent(const InputData& aEvent) {
+  AssertOnControllerThread();
+
   nsEventStatus rv = nsEventStatus_eIgnore;
 
   switch (aEvent.mInputType) {
@@ -884,6 +913,8 @@ nsEventStatus AsyncPanZoomController::HandleInputEvent(const InputData& aEvent)
 
 nsEventStatus AsyncPanZoomController::HandleGestureEvent(const InputData& aEvent)
 {
+  AssertOnControllerThread();
+
   nsEventStatus rv = nsEventStatus_eIgnore;
 
   switch (aEvent.mInputType) {
@@ -957,7 +988,6 @@ nsEventStatus AsyncPanZoomController::OnTouchStart(const MultiTouchInput& aEvent
     case CROSS_SLIDING_X:
     case CROSS_SLIDING_Y:
     case PINCHING:
-    case WAITING_CONTENT_RESPONSE:
       NS_WARNING("Received impossible touch in OnTouchStart");
       break;
     default:
@@ -992,9 +1022,7 @@ nsEventStatus AsyncPanZoomController::OnTouchMove(const MultiTouchInput& aEvent)
         return nsEventStatus_eIgnore;
       }
 
-      if (gfxPrefs::TouchActionEnabled() &&
-          (GetTouchBehavior(0) & AllowedTouchBehavior::VERTICAL_PAN) &&
-          (GetTouchBehavior(0) & AllowedTouchBehavior::HORIZONTAL_PAN)) {
+      if (gfxPrefs::TouchActionEnabled() && CurrentTouchBlock()->TouchActionAllowsPanningXY()) {
         // User tries to trigger a touch behavior. If allowed touch behavior is vertical pan
         // + horizontal pan (touch-action value is equal to AUTO) we can return ConsumeNoDefault
         // status immediately to trigger cancel event further. It should happen independent of
@@ -1017,7 +1045,6 @@ nsEventStatus AsyncPanZoomController::OnTouchMove(const MultiTouchInput& aEvent)
       NS_WARNING("Gesture listener should have handled pinching in OnTouchMove.");
       return nsEventStatus_eIgnore;
 
-    case WAITING_CONTENT_RESPONSE:
     case SNAP_BACK:  // Should not receive a touch-move in the SNAP_BACK state
                      // as touch blocks that begin in an overscrolled state
                      // are ignored.
@@ -1092,7 +1119,6 @@ nsEventStatus AsyncPanZoomController::OnTouchEnd(const MultiTouchInput& aEvent)
     NS_WARNING("Gesture listener should have handled pinching in OnTouchEnd.");
     return nsEventStatus_eIgnore;
 
-  case WAITING_CONTENT_RESPONSE:
   case SNAP_BACK:  // Should not receive a touch-move in the SNAP_BACK state
                    // as touch blocks that begin in an overscrolled state
                    // are ignored.
@@ -1113,7 +1139,9 @@ nsEventStatus AsyncPanZoomController::OnTouchCancel(const MultiTouchInput& aEven
 nsEventStatus AsyncPanZoomController::OnScaleBegin(const PinchGestureInput& aEvent) {
   APZC_LOG("%p got a scale-begin in state %d\n", this, mState);
 
-  if (!TouchActionAllowPinchZoom()) {
+  // Note that there may not be a touch block at this point, if we received the
+  // PinchGestureEvent directly from widget code without any touch events.
+  if (HasReadyTouchBlock() && !CurrentTouchBlock()->TouchActionAllowsPinchZoom()) {
     return nsEventStatus_eIgnore;
   }
 
@@ -1130,7 +1158,7 @@ nsEventStatus AsyncPanZoomController::OnScaleBegin(const PinchGestureInput& aEve
 nsEventStatus AsyncPanZoomController::OnScale(const PinchGestureInput& aEvent) {
   APZC_LOG("%p got a scale in state %d\n", this, mState);
 
-  if (!TouchActionAllowPinchZoom()) {
+  if (HasReadyTouchBlock() && !CurrentTouchBlock()->TouchActionAllowsPinchZoom()) {
     return nsEventStatus_eIgnore;
   }
 
@@ -1213,7 +1241,7 @@ nsEventStatus AsyncPanZoomController::OnScale(const PinchGestureInput& aEvent) {
 nsEventStatus AsyncPanZoomController::OnScaleEnd(const PinchGestureInput& aEvent) {
   APZC_LOG("%p got a scale-end in state %d\n", this, mState);
 
-  if (!TouchActionAllowPinchZoom()) {
+  if (HasReadyTouchBlock() && !CurrentTouchBlock()->TouchActionAllowsPinchZoom()) {
     return nsEventStatus_eIgnore;
   }
 
@@ -1353,8 +1381,8 @@ nsEventStatus AsyncPanZoomController::OnLongPress(const TapGestureInput& aEvent)
     int32_t modifiers = WidgetModifiersToDOMModifiers(aEvent.modifiers);
     CSSPoint geckoScreenPoint;
     if (ConvertToGecko(aEvent.mPoint, &geckoScreenPoint)) {
-      SetState(WAITING_CONTENT_RESPONSE);
-      SetContentResponseTimer();
+      StartNewTouchBlock(true);
+      ScheduleContentResponseTimeout();
       controller->HandleLongTap(geckoScreenPoint, modifiers, GetGuid());
       return nsEventStatus_eConsumeNoDefault;
     }
@@ -1391,7 +1419,7 @@ nsEventStatus AsyncPanZoomController::GenerateSingleTap(const ScreenIntPoint& aP
         NewRunnableMethod(controller.get(), &GeckoContentController::HandleSingleTap,
                           geckoScreenPoint, modifiers, GetGuid()),
         0);
-      mTouchBlockState.mSingleTapOccurred = true;
+      CurrentTouchBlock()->SetSingleTapOccurred();
       return nsEventStatus_eConsumeNoDefault;
     }
   }
@@ -1401,7 +1429,7 @@ nsEventStatus AsyncPanZoomController::GenerateSingleTap(const ScreenIntPoint& aP
 void AsyncPanZoomController::OnTouchEndOrCancel() {
   if (nsRefPtr<GeckoContentController> controller = GetGeckoContentController()) {
     controller->NotifyAPZStateChange(
-        GetGuid(), APZStateChange::EndTouch, mTouchBlockState.mSingleTapOccurred);
+        GetGuid(), APZStateChange::EndTouch, CurrentTouchBlock()->SingleTapOccurred());
   }
 }
 
@@ -1409,7 +1437,7 @@ nsEventStatus AsyncPanZoomController::OnSingleTapUp(const TapGestureInput& aEven
   APZC_LOG("%p got a single-tap-up in state %d\n", this, mState);
   // If mZoomConstraints.mAllowDoubleTapZoom is true we wait for a call to OnSingleTapConfirmed before
   // sending event to content
-  if (!(mZoomConstraints.mAllowDoubleTapZoom && TouchActionAllowDoubleTapZoom())) {
+  if (!(mZoomConstraints.mAllowDoubleTapZoom && CurrentTouchBlock()->TouchActionAllowsDoubleTapZoom())) {
     return GenerateSingleTap(aEvent.mPoint, aEvent.modifiers);
   }
   return nsEventStatus_eIgnore;
@@ -1424,7 +1452,7 @@ nsEventStatus AsyncPanZoomController::OnDoubleTap(const TapGestureInput& aEvent)
   APZC_LOG("%p got a double-tap in state %d\n", this, mState);
   nsRefPtr<GeckoContentController> controller = GetGeckoContentController();
   if (controller) {
-    if (mZoomConstraints.mAllowDoubleTapZoom && TouchActionAllowDoubleTapZoom()) {
+    if (mZoomConstraints.mAllowDoubleTapZoom && CurrentTouchBlock()->TouchActionAllowsDoubleTapZoom()) {
       int32_t modifiers = WidgetModifiersToDOMModifiers(aEvent.modifiers);
       CSSPoint geckoScreenPoint;
       if (ConvertToGecko(aEvent.mPoint, &geckoScreenPoint)) {
@@ -1451,10 +1479,10 @@ const ScreenPoint AsyncPanZoomController::GetVelocityVector() {
   return ScreenPoint(mX.GetVelocity(), mY.GetVelocity());
 }
 
-void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle, TouchBehaviorFlags aBehavior) {
+void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle) {
   // Handling of cross sliding will need to be added in this method after touch-action released
   // enabled by default.
-  if ((aBehavior & AllowedTouchBehavior::VERTICAL_PAN) && (aBehavior & AllowedTouchBehavior::HORIZONTAL_PAN)) {
+  if (CurrentTouchBlock()->TouchActionAllowsPanningXY()) {
     if (mX.CanScrollNow() && mY.CanScrollNow()) {
       if (IsCloseToHorizontal(aAngle, AXIS_LOCK_ANGLE)) {
         mY.SetAxisLocked(true);
@@ -1470,7 +1498,7 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle, TouchBe
     } else {
       SetState(NOTHING);
     }
-  } else if (aBehavior & AllowedTouchBehavior::HORIZONTAL_PAN) {
+  } else if (CurrentTouchBlock()->TouchActionAllowsPanningX()) {
     // Using bigger angle for panning to keep behavior consistent
     // with IE.
     if (IsCloseToHorizontal(aAngle, ALLOWED_DIRECT_PAN_ANGLE)) {
@@ -1482,7 +1510,7 @@ void AsyncPanZoomController::HandlePanningWithTouchAction(double aAngle, TouchBe
       // requires it.
       SetState(NOTHING);
     }
-  } else if (aBehavior & AllowedTouchBehavior::VERTICAL_PAN) {
+  } else if (CurrentTouchBlock()->TouchActionAllowsPanningY()) {
     if (IsCloseToVertical(aAngle, ALLOWED_DIRECT_PAN_ANGLE)) {
       mX.SetAxisLocked(true);
       SetState(PANNING_LOCKED_Y);
@@ -1561,7 +1589,7 @@ nsEventStatus AsyncPanZoomController::StartPanning(const MultiTouchInput& aEvent
   angle = fabs(angle); // range [0, pi]
 
   if (gfxPrefs::TouchActionEnabled()) {
-    HandlePanningWithTouchAction(angle, GetTouchBehavior(0));
+    HandlePanningWithTouchAction(angle);
   } else {
     if (GetAxisLockMode() == FREE) {
       SetState(PANNING);
@@ -2458,90 +2486,154 @@ void AsyncPanZoomController::ZoomToRect(CSSRect aRect) {
   }
 }
 
-void AsyncPanZoomController::ContentReceivedTouch(bool aPreventDefault) {
-  mTouchBlockState.mPreventDefaultSet = true;
-  mTouchBlockState.mPreventDefault = aPreventDefault;
-  CheckContentResponse();
+void
+AsyncPanZoomController::ScheduleContentResponseTimeout() {
+  APZC_LOG("%p scheduling content response timeout\n", this);
+  PostDelayedTask(
+    NewRunnableMethod(this, &AsyncPanZoomController::ContentResponseTimeout),
+    gfxPrefs::APZContentResponseTimeout());
 }
 
-void AsyncPanZoomController::CheckContentResponse() {
-  bool canProceedToTouchState = true;
+void
+AsyncPanZoomController::ContentResponseTimeout() {
+  AssertOnControllerThread();
 
-  if (mFrameMetrics.mMayHaveTouchListeners ||
-      mFrameMetrics.mMayHaveTouchCaret) {
-    canProceedToTouchState &= mTouchBlockState.mPreventDefaultSet;
-  }
-
-  if (gfxPrefs::TouchActionEnabled()) {
-    canProceedToTouchState &= mTouchBlockState.mAllowedTouchBehaviorSet;
-  }
-
-  if (!canProceedToTouchState) {
-    return;
-  }
-
-  if (mContentResponseTimeoutTask) {
-    mContentResponseTimeoutTask->Cancel();
-    mContentResponseTimeoutTask = nullptr;
-  }
-
-  if (mState == WAITING_CONTENT_RESPONSE) {
-    if (!mTouchBlockState.mPreventDefault) {
-      SetState(NOTHING);
-    }
-
-    mHandlingTouchQueue = true;
-
-    while (!mTouchQueue.IsEmpty()) {
-      if (!mTouchBlockState.mPreventDefault) {
-        HandleInputEvent(mTouchQueue[0]);
-      }
-
-      if (mTouchQueue[0].mType == MultiTouchInput::MULTITOUCH_END ||
-          mTouchQueue[0].mType == MultiTouchInput::MULTITOUCH_CANCEL) {
-        mTouchQueue.RemoveElementAt(0);
+  mTouchBlockBalance++;
+  APZC_LOG("%p got a content response timeout; balance %d\n", this, mTouchBlockBalance);
+  if (mTouchBlockBalance > 0) {
+    // Find the first touch block in the queue that hasn't already received
+    // the content response timeout callback, and notify it.
+    bool found = false;
+    for (size_t i = 0; i < mTouchBlockQueue.Length(); i++) {
+      if (mTouchBlockQueue[i]->TimeoutContentResponse()) {
+        found = true;
         break;
       }
-
-      mTouchQueue.RemoveElementAt(0);
     }
-
-    mHandlingTouchQueue = false;
+    if (found) {
+      ProcessPendingInputBlocks();
+    } else {
+      NS_WARNING("APZC received more ContentResponseTimeout calls than it has unprocessed touch blocks\n");
+    }
   }
 }
 
-bool AsyncPanZoomController::TouchActionAllowPinchZoom() {
-  if (!gfxPrefs::TouchActionEnabled()) {
-    return true;
-  }
-  // Pointer events specification implies all touch points to allow zoom
-  // to perform it.
-  for (size_t i = 0; i < mTouchBlockState.mAllowedTouchBehaviors.Length(); i++) {
-    if (!(mTouchBlockState.mAllowedTouchBehaviors[i] & AllowedTouchBehavior::PINCH_ZOOM)) {
-      return false;
+void
+AsyncPanZoomController::ContentReceivedTouch(bool aPreventDefault) {
+  AssertOnControllerThread();
+
+  mTouchBlockBalance--;
+  APZC_LOG("%p got a content response; balance %d\n", this, mTouchBlockBalance);
+  if (mTouchBlockBalance < 0) {
+    // Find the first touch block in the queue that hasn't already received
+    // its response from content, and notify it.
+    bool found = false;
+    for (size_t i = 0; i < mTouchBlockQueue.Length(); i++) {
+      if (mTouchBlockQueue[i]->SetContentResponse(aPreventDefault)) {
+        found = true;
+        break;
+      }
+    }
+    if (found) {
+      ProcessPendingInputBlocks();
+    } else {
+      NS_WARNING("APZC received more ContentReceivedTouch calls than it has unprocessed touch blocks\n");
     }
   }
-  return true;
 }
 
-bool AsyncPanZoomController::TouchActionAllowDoubleTapZoom() {
-  if (!gfxPrefs::TouchActionEnabled()) {
-    return true;
-  }
-  for (size_t i = 0; i < mTouchBlockState.mAllowedTouchBehaviors.Length(); i++) {
-    if (!(mTouchBlockState.mAllowedTouchBehaviors[i] & AllowedTouchBehavior::DOUBLE_TAP_ZOOM)) {
-      return false;
+void
+AsyncPanZoomController::SetAllowedTouchBehavior(const nsTArray<TouchBehaviorFlags>& aBehaviors) {
+  AssertOnControllerThread();
+
+  bool found = false;
+  for (size_t i = 0; i < mTouchBlockQueue.Length(); i++) {
+    if (mTouchBlockQueue[i]->SetAllowedTouchBehaviors(aBehaviors)) {
+      found = true;
+      break;
     }
   }
-  return true;
+  if (found) {
+    ProcessPendingInputBlocks();
+  } else {
+    NS_WARNING("APZC received more SetAllowedTouchBehavior calls than it has unprocessed touch blocks\n");
+  }
 }
 
-AsyncPanZoomController::TouchBehaviorFlags
-AsyncPanZoomController::GetTouchBehavior(uint32_t touchIndex) {
-  if (touchIndex < mTouchBlockState.mAllowedTouchBehaviors.Length()) {
-    return mTouchBlockState.mAllowedTouchBehaviors[touchIndex];
+void
+AsyncPanZoomController::ProcessPendingInputBlocks() {
+  AssertOnControllerThread();
+
+  while (true) {
+    TouchBlockState* curBlock = CurrentTouchBlock();
+    if (!curBlock->IsReadyForHandling()) {
+      break;
+    }
+
+    APZC_LOG("%p processing input block %p; preventDefault %d\n",
+        this, curBlock, curBlock->IsDefaultPrevented());
+    if (curBlock->IsDefaultPrevented()) {
+      SetState(NOTHING);
+      curBlock->DropEvents();
+    } else {
+      while (curBlock->HasEvents()) {
+        HandleInputEvent(curBlock->RemoveFirstEvent());
+      }
+    }
+    MOZ_ASSERT(!curBlock->HasEvents());
+
+    if (mTouchBlockQueue.Length() == 1) {
+      // If |curBlock| is the only touch block in the queue, then it is still
+      // active and we cannot remove it yet. We only know that a touch block is
+      // over when we start the next one. This block will be removed by the code
+      // in StartNewTouchBlock, where new touch blocks are added.
+      break;
+    }
+
+    // If we get here, we know there are more touch blocks in the queue after
+    // |curBlock|, so we can remove |curBlock| and try to process the next one.
+    APZC_LOG("%p discarding depleted touch block %p\n", this, curBlock);
+    mTouchBlockQueue.RemoveElementAt(0);
   }
-  return DefaultTouchBehavior;
+}
+
+TouchBlockState*
+AsyncPanZoomController::StartNewTouchBlock(bool aCopyAllowedTouchBehaviorFromCurrent)
+{
+  TouchBlockState* newBlock = new TouchBlockState();
+  if (gfxPrefs::TouchActionEnabled() && aCopyAllowedTouchBehaviorFromCurrent) {
+    newBlock->CopyAllowedTouchBehaviorsFrom(*CurrentTouchBlock());
+  }
+
+  // We're going to start a new block, so clear out any depleted blocks at the head of the queue.
+  // See corresponding comment in ProcessPendingInputBlocks.
+  while (!mTouchBlockQueue.IsEmpty()) {
+    if (mTouchBlockQueue[0]->IsReadyForHandling() && !mTouchBlockQueue[0]->HasEvents()) {
+      APZC_LOG("%p discarding depleted touch block %p\n", this, mTouchBlockQueue[0]);
+      mTouchBlockQueue.RemoveElementAt(0);
+    } else {
+      break;
+    }
+  }
+
+  // Add the new block to the queue.
+  mTouchBlockQueue.AppendElement(newBlock);
+  return newBlock;
+}
+
+TouchBlockState*
+AsyncPanZoomController::CurrentTouchBlock()
+{
+  AssertOnControllerThread();
+
+  MOZ_ASSERT(!mTouchBlockQueue.IsEmpty());
+  return mTouchBlockQueue[0].get();
+}
+
+bool
+AsyncPanZoomController::HasReadyTouchBlock()
+{
+  return !mTouchBlockQueue.IsEmpty() && mTouchBlockQueue[0]->IsReadyForHandling();
 }
 
 AsyncPanZoomController::TouchBehaviorFlags
@@ -2552,13 +2644,6 @@ AsyncPanZoomController::GetAllowedTouchBehavior(ScreenIntPoint& aPoint) {
   return AllowedTouchBehavior::UNKNOWN;
 }
 
-void AsyncPanZoomController::SetAllowedTouchBehavior(const nsTArray<TouchBehaviorFlags>& aBehaviors) {
-  mTouchBlockState.mAllowedTouchBehaviors.Clear();
-  mTouchBlockState.mAllowedTouchBehaviors.AppendElements(aBehaviors);
-  mTouchBlockState.mAllowedTouchBehaviorSet = true;
-  CheckContentResponse();
-}
-
 void AsyncPanZoomController::SetState(PanZoomState aNewState) {
 
   PanZoomState oldState;
@@ -2582,27 +2667,13 @@ void AsyncPanZoomController::SetState(PanZoomState aNewState) {
 }
 
 bool AsyncPanZoomController::IsTransformingState(PanZoomState aState) {
-  return !(aState == NOTHING || aState == TOUCHING || aState == WAITING_CONTENT_RESPONSE);
+  return !(aState == NOTHING || aState == TOUCHING);
 }
 
 bool AsyncPanZoomController::IsPanningState(PanZoomState aState) {
   return (aState == PANNING || aState == PANNING_LOCKED_X || aState == PANNING_LOCKED_Y);
 }
 
-void AsyncPanZoomController::SetContentResponseTimer() {
-  if (!mContentResponseTimeoutTask) {
-    mContentResponseTimeoutTask =
-      NewRunnableMethod(this, &AsyncPanZoomController::TimeoutContentResponse);
-
-    PostDelayedTask(mContentResponseTimeoutTask, gfxPrefs::APZContentResponseTimeout());
-  }
-}
-
-void AsyncPanZoomController::TimeoutContentResponse() {
-  mContentResponseTimeoutTask = nullptr;
-  ContentReceivedTouch(false);
-}
-
 void AsyncPanZoomController::UpdateZoomConstraints(const ZoomConstraints& aConstraints) {
   APZC_LOG("%p updating zoom constraints to %d %d %f %f\n", this, aConstraints.mAllowZoom,
     aConstraints.mAllowDoubleTapZoom, aConstraints.mMinZoom.scale, aConstraints.mMaxZoom.scale);
diff --git a/gfx/layers/apz/src/AsyncPanZoomController.h b/gfx/layers/apz/src/AsyncPanZoomController.h
index bb895b714cc..864f56a3633 100644
--- a/gfx/layers/apz/src/AsyncPanZoomController.h
+++ b/gfx/layers/apz/src/AsyncPanZoomController.h
@@ -15,6 +15,7 @@
 #include "mozilla/Monitor.h"
 #include "mozilla/ReentrantMonitor.h"
 #include "mozilla/RefPtr.h"
+#include "mozilla/UniquePtr.h"
 #include "mozilla/Atomics.h"
 #include "InputData.h"
 #include "Axis.h"
@@ -41,6 +42,7 @@ class PCompositorParent;
 struct ViewTransform;
 class AsyncPanZoomAnimation;
 class FlingAnimation;
+class TouchBlockState;
 
 /**
  * Controller for all panning and zooming logic. Any time a user input is
@@ -111,6 +113,9 @@ public:
    * based on what type of input it is. For example, a PinchGestureEvent will
    * cause scaling. This should only be called externally to this class.
    * HandleInputEvent() should be used internally.
+   * This function returns nsEventStatus_eIgnore for events that are ignored,
+   * and nsEventStatus_eConsumeDoDefault for events that are queued for
+   * processing pending a content response.
    */
   nsEventStatus ReceiveInputEvent(const InputData& aEvent);
 
@@ -121,14 +126,6 @@ public:
    */
   void ZoomToRect(CSSRect aRect);
 
-  /**
-   * If we have touch listeners, this should always be called when we know
-   * definitively whether or not content has preventDefaulted any touch events
-   * that have come in. If |aPreventDefault| is true, any touch events in the
-   * queue will be discarded.
-   */
-  void ContentReceivedTouch(bool aPreventDefault);
-
   /**
    * Updates any zoom constraints contained in the <meta name="viewport"> tag.
    */
@@ -303,15 +300,6 @@ public:
    */
   TouchBehaviorFlags GetAllowedTouchBehavior(ScreenIntPoint& aPoint);
 
-  /**
-   * Sets allowed touch behavior for current touch session.
-   * This method is invoked by the APZCTreeManager which in its turn invoked by
-   * the widget after performing touch-action values retrieving.
-   * Must be called after receiving the TOUCH_START even that started the
-   * touch session.
-   */
-  void SetAllowedTouchBehavior(const nsTArray<TouchBehaviorFlags>& aBehaviors);
-
   /**
    * Returns whether this APZC is for an element marked with the 'scrollgrab'
    * attribute.
@@ -347,10 +335,6 @@ protected:
 
     PINCHING,                 /* nth touch-start, where n > 1. this mode allows pan and zoom */
     ANIMATING_ZOOM,           /* animated zoom to a new rect */
-    WAITING_CONTENT_RESPONSE, /* a state halfway between NOTHING and TOUCHING - the user has
-                                 put a finger down, but we don't yet know if a touch listener has
-                                 prevented the default actions yet and the allowed touch behavior
-                                 was not set yet. we still need to abort animations. */
     SNAP_BACK,                /* snap-back animation to relieve overscroll */
   };
 
@@ -487,7 +471,7 @@ protected:
   /**
    * Sets the panning state basing on the pan direction angle and current touch-action value.
    */
-  void HandlePanningWithTouchAction(double angle, TouchBehaviorFlags value);
+  void HandlePanningWithTouchAction(double angle);
 
   /**
    * Sets the panning state ignoring the touch action value.
@@ -543,24 +527,6 @@ protected:
    */
   const FrameMetrics& GetFrameMetrics() const;
 
-  /**
-   * Sets the timer for content response to a series of touch events, if it
-   * hasn't been already. This is to prevent us from batching up touch events
-   * indefinitely in the case that content doesn't respond with whether or not
-   * it wants to preventDefault. When the timer is fired, the touch event queue
-   * will be flushed.
-   */
-  void SetContentResponseTimer();
-
-  /**
-   * Timeout function for content response. This should be called on a timer
-   * after we get our first touch event in a batch, under the condition that we
-   * waiting for response from content. If a notification comes indicating whether or not
-   * content preventDefaulted a series of touch events and touch behavior values are
-   * set before the timeout, the timeout should be cancelled.
-   */
-  void TimeoutContentResponse();
-
   /**
    * Timeout function for mozbrowserasyncscroll event. Because we throttle
    * mozbrowserasyncscroll events in some conditions, this function ensures
@@ -570,62 +536,6 @@ protected:
   void FireAsyncScrollOnTimeout();
 
 private:
-  // State related to a single touch block. Does not persist across touch blocks.
-  struct TouchBlockState {
-
-    TouchBlockState()
-      :  mAllowedTouchBehaviorSet(false),
-         mPreventDefault(false),
-         mPreventDefaultSet(false),
-         mSingleTapOccurred(false)
-    {}
-
-    // Values of allowed touch behavior for touch points of this touch block.
-    // Since there are maybe a few current active touch points per time (multitouch case)
-    // and each touch point should have its own value of allowed touch behavior- we're
-    // keeping an array of allowed touch behavior values, not the single value.
-    nsTArray<TouchBehaviorFlags> mAllowedTouchBehaviors;
-
-    // Specifies whether mAllowedTouchBehaviors is set for this touch events block.
-    bool mAllowedTouchBehaviorSet;
-
-    // Flag used to specify that content prevented the default behavior of this
-    // touch events block.
-    bool mPreventDefault;
-
-    // Specifies whether mPreventDefault property is set for this touch events block.
-    bool mPreventDefaultSet;
-
-    // Specifies whether a single tap event was generated during this touch block.
-    bool mSingleTapOccurred;
-  };
-
-  /*
-   * Returns whether current touch behavior values allow pinch-zooming.
-   */
-  bool TouchActionAllowPinchZoom();
-
-  /*
-   * Returns whether current touch behavior values allow double-tap-zooming.
-   */
-  bool TouchActionAllowDoubleTapZoom();
-
-  /*
-   * Returns allowed touch behavior from the mAllowedTouchBehavior array.
-   * In case apzc didn't receive touch behavior values within the timeout
-   * it returns default value.
-   */
-  TouchBehaviorFlags GetTouchBehavior(uint32_t touchIndex);
-
-  /**
-   * To move from the WAITING_CONTENT_RESPONSE state to TOUCHING one we need two
-   * conditions set: get content listeners response (whether they called preventDefault)
-   * and get allowed touch behaviors.
-   * This method checks both conditions and changes (or not changes) state
-   * appropriately.
-   */
-  void CheckContentResponse();
-
   /**
    * Helper to set the current state. Holds the monitor before actually setting
    * it and fires content controller events based on state changes. Always set
@@ -734,10 +644,6 @@ private:
   // in a FIFO manner.
   FrameMetrics mLastDispatchedPaintMetrics;
 
-  nsTArray<MultiTouchInput> mTouchQueue;
-
-  CancelableTask* mContentResponseTimeoutTask;
-
   AxisX mX;
   AxisY mY;
 
@@ -771,19 +677,101 @@ private:
   // ensures the last mozbrowserasyncscroll event is always been fired.
   CancelableTask* mAsyncScrollTimeoutTask;
 
-  // Flag used to determine whether or not we should try to enter the
-  // WAITING_LISTENERS state. This is used in the case that we are processing a
-  // queued up event block. If set, this means that we are handling this queue
-  // and we don't want to queue the events back up again.
-  bool mHandlingTouchQueue;
-
-  // Stores information about the current touch block.
-  TouchBlockState mTouchBlockState;
-
   nsRefPtr<AsyncPanZoomAnimation> mAnimation;
 
   friend class Axis;
 
+  /* ===================================================================
+   * The functions and members in this section are used to manage
+   * blocks of touch events and the state needed to deal with content
+   * listeners.
+   */
+public:
+  /**
+   * This function is invoked by the APZCTreeManager which in turn is invoked
+   * by the widget when web content decides whether or not it wants to
+   * cancel a block of events. This automatically gets applied to the next
+   * block of events that has not yet been responded to. This function MUST
+   * be invoked exactly once for each touch block.
+   */
+  void ContentReceivedTouch(bool aPreventDefault);
+
+  /**
+   * Sets allowed touch behavior for current touch session.
+   * This method is invoked by the APZCTreeManager which in its turn invoked by
+   * the widget after performing touch-action values retrieving.
+   * Must be called after receiving the TOUCH_START even that started the
+   * touch session.
+   */
+  void SetAllowedTouchBehavior(const nsTArray<TouchBehaviorFlags>& aBehaviors);
+
+private:
+  void ScheduleContentResponseTimeout();
+  void ContentResponseTimeout();
+  /**
+   * Processes any pending input blocks that are ready for processing. There
+   * must be at least one input block in the queue when this function is called.
+   */
+  void ProcessPendingInputBlocks();
+  TouchBlockState* StartNewTouchBlock(bool aCopyAllowedTouchBehaviorFromCurrent);
+  TouchBlockState* CurrentTouchBlock();
+  bool HasReadyTouchBlock();
+
+private:
+  // The queue of touch blocks that have not yet been processed by this APZC.
+  // This member must only be accessed on the controller/UI thread.
+  nsTArray<UniquePtr<TouchBlockState>> mTouchBlockQueue;
+
+  // This variable requires some explanation. Strap yourself in.
+  //
+  // For each block of events, we do two things: (1) send the events to gecko and expect
+  // exactly one call to ContentReceivedTouch in return, and (2) kick off a timeout
+  // that triggers in case we don't hear from web content in a timely fashion.
+  // Since events are constantly coming in, we need to be able to handle more than one
+  // block of input events sitting in the queue.
+  //
+  // There are ordering restrictions on events that we can take advantage of, and that
+  // we need to abide by. Blocks of events in the queue will always be in the order that
+  // the user generated them. Responses we get from content will be in the same order as
+  // as the blocks of events in the queue. The timeout callbacks that have been posted
+  // will also fire in the same order as the blocks of events in the queue.
+  // HOWEVER, we may get multiple responses from content interleaved with multiple
+  // timeout expirations, and that interleaving is not predictable.
+  //
+  // Therefore, we need to make sure that for each block of events, we process the queued
+  // events exactly once, either when we get the response from content, or when the
+  // timeout expires (whichever happens first). There is no way to associate the timeout
+  // or response from content with a particular block of events other than via ordering.
+  //
+  // So, what we do to accomplish this is to track a "touch block balance", which is the
+  // number of timeout expirations that have fired, minus the number of content responses
+  // that have been received. (Think "balance" as in teeter-totter balance). This
+  // value is:
+  // - zero when we are in a state where the next content response we expect to receive
+  //   and the next timeout expiration we expect to fire both correspond to the next
+  //   unprocessed block of events in the queue.
+  // - negative when we are in a state where we have received more content responses than
+  //   timeout expirations. This means that the next content repsonse we receive will
+  //   correspond to the first unprocessed block, but the next n timeout expirations need
+  //   to be ignored as they are for blocks we have already processed. (n is the absolute
+  //   value of the balance.)
+  // - positive when we are in a state where we have received more timeout expirations
+  //   than content responses. This means that the next timeout expiration that we will
+  //   receive will correspond to the first unprocessed block, but the next n content
+  //   responses need to be ignored as they are for blocks we have already processed.
+  //   (n is the absolute value of the balance.)
+  //
+  // Note that each touch block internally carries flags that indicate whether or not it
+  // has received a content response and/or timeout expiration. However, we cannot rely
+  // on that alone to deliver these notifications to the right input block, because
+  // once an input block has been processed, it can potentially be removed from the queue.
+  // Therefore the information in that block is lost. An alternative approach would
+  // be to keep around those blocks until they have received both the content response
+  // and timeout expiration, but that involves a higher level of memory usage.
+  //
+  // This member must only be accessed on the controller/UI thread.
+  int32_t mTouchBlockBalance;
+
 
   /* ===================================================================
    * The functions and members in this section are used to manage
diff --git a/gfx/layers/apz/src/TouchBlockState.cpp b/gfx/layers/apz/src/TouchBlockState.cpp
new file mode 100644
index 00000000000..3460ea7cfd7
--- /dev/null
+++ b/gfx/layers/apz/src/TouchBlockState.cpp
@@ -0,0 +1,219 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set sw=2 ts=8 et tw=80 : */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "TouchBlockState.h"
+#include "mozilla/layers/APZCTreeManager.h" // for AllowedTouchBehavior
+#include "gfxPrefs.h"                       // for gfxPrefs
+
+#define TBS_LOG(...)
+// #define TBS_LOG(...) printf_stderr("TBS: " __VA_ARGS__)
+
+namespace mozilla {
+namespace layers {
+
+/**
+ * Default touch behavior (is used when no touch behavior is set).
+ */
+static const TouchBlockState::TouchBehaviorFlags kDefaultTouchBehavior =
+    AllowedTouchBehavior::VERTICAL_PAN |
+    AllowedTouchBehavior::HORIZONTAL_PAN |
+    AllowedTouchBehavior::PINCH_ZOOM |
+    AllowedTouchBehavior::DOUBLE_TAP_ZOOM;
+
+TouchBlockState::TouchBlockState()
+  : mAllowedTouchBehaviorSet(false)
+  , mPreventDefault(false)
+  , mContentResponded(false)
+  , mContentResponseTimerExpired(false)
+  , mSingleTapOccurred(false)
+{
+  TBS_LOG("Creating %p\n", this);
+}
+
+bool
+TouchBlockState::SetContentResponse(bool aPreventDefault)
+{
+  if (mContentResponded) {
+    return false;
+  }
+  TBS_LOG("%p got content response %d with timer expired %d\n",
+    this, aPreventDefault, mContentResponseTimerExpired);
+  if (!mContentResponseTimerExpired) {
+    mPreventDefault = aPreventDefault;
+  }
+  mContentResponded = true;
+  return true;
+}
+
+bool
+TouchBlockState::TimeoutContentResponse()
+{
+  if (mContentResponseTimerExpired) {
+    return false;
+  }
+  TBS_LOG("%p got content timer expired with response received %d\n",
+    this, mContentResponded);
+  if (!mContentResponded) {
+    mPreventDefault = false;
+  }
+  mContentResponseTimerExpired = true;
+  return true;
+}
+
+bool
+TouchBlockState::SetAllowedTouchBehaviors(const nsTArray<TouchBehaviorFlags>& aBehaviors)
+{
+  if (mAllowedTouchBehaviorSet) {
+    return false;
+  }
+  TBS_LOG("%p got allowed touch behaviours for %d points\n", this, aBehaviors.Length());
+  mAllowedTouchBehaviors.AppendElements(aBehaviors);
+  mAllowedTouchBehaviorSet = true;
+  return true;
+}
+
+bool
+TouchBlockState::CopyAllowedTouchBehaviorsFrom(const TouchBlockState& aOther)
+{
+  TBS_LOG("%p copying allowed touch behaviours from %p\n", this, &aOther);
+  MOZ_ASSERT(aOther.mAllowedTouchBehaviorSet);
+  return SetAllowedTouchBehaviors(aOther.mAllowedTouchBehaviors);
+}
+
+bool
+TouchBlockState::IsReadyForHandling() const
+{
+  // TODO: for long-tap blocks we probably don't need the touch behaviour?
+  if (gfxPrefs::TouchActionEnabled() && !mAllowedTouchBehaviorSet) {
+    return false;
+  }
+  if (!mContentResponded && !mContentResponseTimerExpired) {
+    return false;
+  }
+  return true;
+}
+
+bool
+TouchBlockState::IsDefaultPrevented() const
+{
+  MOZ_ASSERT(mContentResponded || mContentResponseTimerExpired);
+  return mPreventDefault;
+}
+
+void
+TouchBlockState::SetSingleTapOccurred()
+{
+  TBS_LOG("%p setting single-tap occurred\n", this);
+  mSingleTapOccurred = true;
+}
+
+bool
+TouchBlockState::SingleTapOccurred() const
+{
+  return mSingleTapOccurred;
+}
+
+bool
+TouchBlockState::HasEvents() const
+{
+  return !mEvents.IsEmpty();
+}
+
+void
+TouchBlockState::AddEvent(const MultiTouchInput& aEvent)
+{
+  TBS_LOG("%p adding event of type %d\n", this, aEvent.mType);
+  mEvents.AppendElement(aEvent);
+}
+
+void
+TouchBlockState::DropEvents()
+{
+  TBS_LOG("%p dropping %d events\n", this, mEvents.Length());
+  mEvents.Clear();
+}
+
+MultiTouchInput
+TouchBlockState::RemoveFirstEvent()
+{
+  MOZ_ASSERT(!mEvents.IsEmpty());
+  TBS_LOG("%p returning first of %d events\n", this, mEvents.Length());
+  MultiTouchInput event = mEvents[0];
+  mEvents.RemoveElementAt(0);
+  return event;
+}
+
+bool
+TouchBlockState::TouchActionAllowsPinchZoom() const
+{
+  if (!gfxPrefs::TouchActionEnabled()) {
+    return true;
+  }
+  // Pointer events specification requires that all touch points allow zoom.
+  for (size_t i = 0; i < mAllowedTouchBehaviors.Length(); i++) {
+    if (!(mAllowedTouchBehaviors[i] & AllowedTouchBehavior::PINCH_ZOOM)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool
+TouchBlockState::TouchActionAllowsDoubleTapZoom() const
+{
+  if (!gfxPrefs::TouchActionEnabled()) {
+    return true;
+  }
+  for (size_t i = 0; i < mAllowedTouchBehaviors.Length(); i++) {
+    if (!(mAllowedTouchBehaviors[i] & AllowedTouchBehavior::DOUBLE_TAP_ZOOM)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+bool
+TouchBlockState::TouchActionAllowsPanningX() const
+{
+  if (!gfxPrefs::TouchActionEnabled()) {
+    return true;
+  }
+  if (mAllowedTouchBehaviors.IsEmpty()) {
+    return false;
+  }
+  TouchBehaviorFlags flags = mAllowedTouchBehaviors[0];
+  return (flags & AllowedTouchBehavior::HORIZONTAL_PAN);
+}
+
+bool
+TouchBlockState::TouchActionAllowsPanningY() const
+{
+  if (!gfxPrefs::TouchActionEnabled()) {
+    return true;
+  }
+  if (mAllowedTouchBehaviors.IsEmpty()) {
+    return false;
+  }
+  TouchBehaviorFlags flags = mAllowedTouchBehaviors[0];
+  return (flags & AllowedTouchBehavior::VERTICAL_PAN);
+}
+
+bool
+TouchBlockState::TouchActionAllowsPanningXY() const
+{
+  if (!gfxPrefs::TouchActionEnabled()) {
+    return true;
+  }
+  if (mAllowedTouchBehaviors.IsEmpty()) {
+    return false;
+  }
+  TouchBehaviorFlags flags = mAllowedTouchBehaviors[0];
+  return (flags & AllowedTouchBehavior::HORIZONTAL_PAN)
+      && (flags & AllowedTouchBehavior::VERTICAL_PAN);
+}
+
+} // namespace layers
+} // namespace mozilla
diff --git a/gfx/layers/apz/src/TouchBlockState.h b/gfx/layers/apz/src/TouchBlockState.h
new file mode 100644
index 00000000000..4f82a7e6673
--- /dev/null
+++ b/gfx/layers/apz/src/TouchBlockState.h
@@ -0,0 +1,145 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set sw=2 ts=8 et tw=80 : */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_layers_TouchBlockState_h
+#define mozilla_layers_TouchBlockState_h
+
+#include "nsTArray.h"                       // for nsTArray
+#include "InputData.h"                      // for MultiTouchInput
+
+namespace mozilla {
+namespace layers {
+
+/**
+ * This class represents a single touch block. A touch block is
+ * a set of touch events that can be cancelled by web content via
+ * touch event listeners.
+ *
+ * Every touch-start event creates a new touch block. In this case, the
+ * touch block consists of the touch-start, followed by all touch events
+ * up to but not including the next touch-start (except in the case where
+ * a long-tap happens, see below). Note that in particular we cannot know
+ * when a touch block ends until the next one is started. Most touch
+ * blocks are created by receipt of a touch-start event.
+ *
+ * Every long-tap event also creates a new touch block, since it can also
+ * be consumed by web content. In this case, when the long-tap event is
+ * dispatched to web content, a new touch block is started to hold the remaining
+ * touch events, up to but not including the next touch start (or long-tap).
+ *
+ * Conceptually, each touch block can be cancelled by web content, and
+ * this information is stored in the mPreventDefault flag. Because web
+ * content runs on the Gecko main thread, we cannot always wait for web content's
+ * response. Instead, there is a timeout that sets this flag in the case
+ * where web content doesn't respond in time. The mContentResponded
+ * and mContentResponseTimerExpired flags indicate which of these scenarios
+ * occurred.
+ *
+ * Additionally, if touch-action is enabled, each touch block should
+ * have a set of allowed touch behavior flags; one for each touch point.
+ * This also requires running code on the Gecko main thread, and so may
+ * be populated with some latency. The mAllowedTouchBehaviorSet and
+ * mAllowedTouchBehaviors variables track this information.
+ */
+class TouchBlockState
+{
+public:
+  typedef uint32_t TouchBehaviorFlags;
+
+  TouchBlockState();
+
+  /**
+   * Record whether or not content cancelled this block of events.
+   * @param aPreventDefault true iff the block is cancelled.
+   * @return false if this block has already received a response from
+   *         web content, true if not.
+   */
+  bool SetContentResponse(bool aPreventDefault);
+  /**
+   * Record that content didn't respond in time.
+   * @return false if this block already timed out, true if not.
+   */
+  bool TimeoutContentResponse();
+  /**
+   * Set the allowed touch behavior flags for this block.
+   * @return false if this block already has these flags set, true if not.
+   */
+  bool SetAllowedTouchBehaviors(const nsTArray<TouchBehaviorFlags>& aBehaviors);
+  /**
+   * Copy the allowed touch behavior flags from another block.
+   * @return false if this block already has these flags set, true if not.
+   */
+  bool CopyAllowedTouchBehaviorsFrom(const TouchBlockState& aOther);
+
+  /**
+   * @return true iff this block has received all the information needed
+   *         to properly dispatch the events in the block.
+   */
+  bool IsReadyForHandling() const;
+  /**
+   * @return true iff web content cancelled this block of events.
+   */
+  bool IsDefaultPrevented() const;
+
+  /**
+   * Set a flag that indicates that this touch block triggered a single tap event.
+   */
+  void SetSingleTapOccurred();
+  /**
+   * @return true iff SetSingleTapOccurred was previously called on this block.
+   */
+  bool SingleTapOccurred() const;
+
+  /**
+   * @return true iff there are pending events in this touch block.
+   */
+  bool HasEvents() const;
+  /**
+   * Add a new touch event to the queue of events in this input block.
+   */
+  void AddEvent(const MultiTouchInput& aEvent);
+  /**
+   * Throw away all the events in this input block.
+   */
+  void DropEvents();
+  /**
+   * @return the first event in the queue. The event is removed from the queue
+   *         before it is returned.
+   */
+  MultiTouchInput RemoveFirstEvent();
+
+  /**
+   * @return false iff touch-action is enabled and the allowed touch behaviors for
+   *         this touch block do not allow pinch-zooming.
+   */
+  bool TouchActionAllowsPinchZoom() const;
+  /**
+   * @return false iff touch-action is enabled and the allowed touch behaviors for
+   *         this touch block do not allow double-tap zooming.
+   */
+  bool TouchActionAllowsDoubleTapZoom() const;
+  /**
+   * @return false iff touch-action is enabled and the allowed touch behaviors for
+   *         the first touch point do not allow panning in the specified direction(s).
+   */
+  bool TouchActionAllowsPanningX() const;
+  bool TouchActionAllowsPanningY() const;
+  bool TouchActionAllowsPanningXY() const;
+
+private:
+  nsTArray<TouchBehaviorFlags> mAllowedTouchBehaviors;
+  bool mAllowedTouchBehaviorSet;
+  bool mPreventDefault;
+  bool mContentResponded;
+  bool mContentResponseTimerExpired;
+  bool mSingleTapOccurred;
+  nsTArray<MultiTouchInput> mEvents;
+};
+
+} // namespace layers
+} // namespace mozilla
+
+#endif // mozilla_layers_TouchBlockState_h
diff --git a/gfx/layers/moz.build b/gfx/layers/moz.build
index 6795c0696dc..0ae2272a298 100644
--- a/gfx/layers/moz.build
+++ b/gfx/layers/moz.build
@@ -235,6 +235,7 @@ UNIFIED_SOURCES += [
     'apz/src/Axis.cpp',
     'apz/src/GestureEventListener.cpp',
     'apz/src/TaskThrottler.cpp',
+    'apz/src/TouchBlockState.cpp',
     'apz/testutil/APZTestData.cpp',
     'apz/util/ActiveElementManager.cpp',
     'apz/util/APZCCallbackHelper.cpp',
diff --git a/gfx/skia/generate_mozbuild.py b/gfx/skia/generate_mozbuild.py
index c4dcbb2b16a..0eff31ca2da 100755
--- a/gfx/skia/generate_mozbuild.py
+++ b/gfx/skia/generate_mozbuild.py
@@ -103,6 +103,8 @@ if CONFIG['INTEL_ARCHITECTURE'] and CONFIG['GNU_CC']:
 elif CONFIG['CPU_ARCH'] == 'arm' and CONFIG['GNU_CC'] and CONFIG['BUILD_ARM_NEON']:
     DEFINES['__ARM_HAVE_OPTIONAL_NEON_SUPPORT'] = 1
     DEFINES['USE_ANDROID_NDK_CPU_FEATURES'] = 0
+elif CONFIG['CLANG_CL']:
+    SOURCES['trunk/src/opts/SkBitmapProcState_opts_SSSE3.cpp'].flags += ['-mssse3']
 
 DEFINES['SKIA_IMPLEMENTATION'] = 1
 DEFINES['GR_IMPLEMENTATION'] = 1
diff --git a/gfx/skia/moz.build b/gfx/skia/moz.build
index e2eec68630b..816b2f32a24 100644
--- a/gfx/skia/moz.build
+++ b/gfx/skia/moz.build
@@ -911,6 +911,8 @@ if CONFIG['INTEL_ARCHITECTURE'] and CONFIG['GNU_CC']:
 elif CONFIG['CPU_ARCH'] == 'arm' and CONFIG['GNU_CC'] and CONFIG['BUILD_ARM_NEON']:
     DEFINES['__ARM_HAVE_OPTIONAL_NEON_SUPPORT'] = 1
     DEFINES['USE_ANDROID_NDK_CPU_FEATURES'] = 0
+elif CONFIG['CLANG_CL']:
+    SOURCES['trunk/src/opts/SkBitmapProcState_opts_SSSE3.cpp'].flags += ['-mssse3']
 
 DEFINES['SKIA_IMPLEMENTATION'] = 1
 DEFINES['GR_IMPLEMENTATION'] = 1
diff --git a/gfx/tests/gtest/TestAsyncPanZoomController.cpp b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
index a1ddbb2d7d8..546e7798217 100644
--- a/gfx/tests/gtest/TestAsyncPanZoomController.cpp
+++ b/gfx/tests/gtest/TestAsyncPanZoomController.cpp
@@ -137,7 +137,12 @@ public:
     mFrameMetrics = metrics;
   }
 
-  FrameMetrics GetFrameMetrics() {
+  FrameMetrics& GetFrameMetrics() {
+    ReentrantMonitorAutoEnter lock(mMonitor);
+    return mFrameMetrics;
+  }
+
+  const FrameMetrics& GetFrameMetrics() const {
     ReentrantMonitorAutoEnter lock(mMonitor);
     return mFrameMetrics;
   }
@@ -200,11 +205,9 @@ protected:
     apzc->Destroy();
   }
 
-  void UseTouchListenerMetrics()
+  void SetMayHaveTouchListeners()
   {
-    FrameMetrics frameMetrics(TestFrameMetrics());
-    frameMetrics.mMayHaveTouchListeners = true;
-    apzc->SetFrameMetrics(frameMetrics);
+    apzc->GetFrameMetrics().mMayHaveTouchListeners = true;
   }
 
   void MakeApzcZoomable()
@@ -349,10 +352,10 @@ ApzcPanAndCheckStatus(AsyncPanZoomController* aApzc,
   ApzcPan(aApzc, aTreeManager, aTime, aTouchStartY, aTouchEndY, false, aAllowedTouchBehaviors, &statuses);
 
   nsEventStatus touchStartStatus;
-  if (hasTouchListeners) {
+  if (hasTouchListeners || gfxPrefs::TouchActionEnabled()) {
     // APZC shouldn't consume the start event now, instead queueing it up
-    // waiting for content's response.
-    touchStartStatus = nsEventStatus_eIgnore;
+    // waiting for content's response and/or allowed behavior.
+    touchStartStatus = nsEventStatus_eConsumeDoDefault;
   } else {
     // APZC should go into the touching state and therefore consume the event.
     touchStartStatus = nsEventStatus_eConsumeNoDefault;
@@ -360,7 +363,10 @@ ApzcPanAndCheckStatus(AsyncPanZoomController* aApzc,
   EXPECT_EQ(touchStartStatus, statuses[0]);
 
   nsEventStatus touchMoveStatus;
-  if (expectIgnoredPan) {
+  if (hasTouchListeners) {
+    // APZC will queue up this event while waiting for content's response.
+    touchMoveStatus = nsEventStatus_eConsumeDoDefault;
+  } else if (expectIgnoredPan) {
     // APZC should ignore panning, be in TOUCHING state and therefore return eIgnore.
     // The same applies to all consequent touch move events.
     touchMoveStatus = nsEventStatus_eIgnore;
@@ -492,8 +498,7 @@ public:
   }
 
 protected:
-  void DoPinchTest(bool aShouldTriggerPinch,
-                   nsTArray<uint32_t> *aAllowedTouchBehaviors = nullptr)
+  FrameMetrics GetPinchableFrameMetrics()
   {
     FrameMetrics fm;
     fm.mViewport = CSSRect(0, 0, 980, 480);
@@ -501,9 +506,14 @@ protected:
     fm.mScrollableRect = CSSRect(0, 0, 980, 1000);
     fm.SetScrollOffset(CSSPoint(300, 300));
     fm.SetZoom(CSSToScreenScale(2.0));
-    apzc->SetFrameMetrics(fm);
     // the visible area of the document in CSS pixels is x=300 y=300 w=50 h=100
+    return fm;
+  }
 
+  void DoPinchTest(bool aShouldTriggerPinch,
+                   nsTArray<uint32_t> *aAllowedTouchBehaviors = nullptr)
+  {
+    apzc->SetFrameMetrics(GetPinchableFrameMetrics());
     MakeApzcZoomable();
 
     if (aShouldTriggerPinch) {
@@ -521,7 +531,7 @@ protected:
       ApzcPinchWithPinchInputAndCheckStatus(apzc, 250, 300, 1.25, aShouldTriggerPinch);
     }
 
-    fm = apzc->GetFrameMetrics();
+    FrameMetrics fm = apzc->GetFrameMetrics();
 
     if (aShouldTriggerPinch) {
       // the visible area of the document in CSS pixels is now x=305 y=310 w=40 h=80
@@ -604,6 +614,32 @@ TEST_F(APZCPinchGestureDetectorTester, Pinch_UseGestureDetector_TouchActionNotAl
   DoPinchTest(false, &behaviors);
 }
 
+TEST_F(APZCPinchGestureDetectorTester, Pinch_PreventDefault) {
+  FrameMetrics originalMetrics = GetPinchableFrameMetrics();
+  apzc->SetFrameMetrics(originalMetrics);
+
+  SetMayHaveTouchListeners();
+  MakeApzcZoomable();
+
+  int touchInputId = 0;
+  ApzcPinchWithTouchInput(apzc, 250, 300, 1.25, touchInputId);
+
+  // Send the prevent-default notification for the touch block
+  apzc->ContentReceivedTouch(true);
+
+  // Run all pending tasks (this should include at least the
+  // prevent-default timer).
+  EXPECT_LE(1, mcc->RunThroughDelayedTasks());
+
+  // verify the metrics didn't change (i.e. the pinch was ignored)
+  FrameMetrics fm = apzc->GetFrameMetrics();
+  EXPECT_EQ(originalMetrics.GetZoom().scale, fm.GetZoom().scale);
+  EXPECT_EQ(originalMetrics.GetScrollOffset().x, fm.GetScrollOffset().x);
+  EXPECT_EQ(originalMetrics.GetScrollOffset().y, fm.GetScrollOffset().y);
+
+  apzc->AssertStateIsReset();
+}
+
 TEST_F(APZCBasicTester, Overzoom) {
   // the visible area of the document in CSS pixels is x=10 y=0 w=100 h=100
   FrameMetrics fm;
@@ -778,6 +814,35 @@ protected:
     EXPECT_EQ(ScreenPoint(), pointOut);
     EXPECT_EQ(ViewTransform(), viewTransformOut);
   }
+
+  void DoPanWithPreventDefaultTest()
+  {
+    SetMayHaveTouchListeners();
+
+    int time = 0;
+    int touchStart = 50;
+    int touchEnd = 10;
+    ScreenPoint pointOut;
+    ViewTransform viewTransformOut;
+
+    // Pan down
+    nsTArray<uint32_t> allowedTouchBehaviors;
+    allowedTouchBehaviors.AppendElement(mozilla::layers::AllowedTouchBehavior::VERTICAL_PAN);
+    ApzcPanAndCheckStatus(apzc, tm, time, touchStart, touchEnd, true, true, &allowedTouchBehaviors);
+
+    // Send the signal that content has handled and preventDefaulted the touch
+    // events. This flushes the event queue.
+    apzc->ContentReceivedTouch(true);
+    // Run all pending tasks (this should include at least the
+    // prevent-default timer).
+    EXPECT_LE(1, mcc->RunThroughDelayedTasks());
+
+    apzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
+    EXPECT_EQ(ScreenPoint(), pointOut);
+    EXPECT_EQ(ViewTransform(), viewTransformOut);
+
+    apzc->AssertStateIsReset();
+  }
 };
 
 TEST_F(APZCPanningTester, Pan) {
@@ -810,28 +875,14 @@ TEST_F(APZCPanningTester, PanWithTouchActionPanY) {
   DoPanTest(true, mozilla::layers::AllowedTouchBehavior::VERTICAL_PAN);
 }
 
-TEST_F(APZCBasicTester, PanWithPreventDefault) {
+TEST_F(APZCPanningTester, PanWithPreventDefaultAndTouchAction) {
   SCOPED_GFX_PREF(TouchActionEnabled, bool, true);
-  UseTouchListenerMetrics();
+  DoPanWithPreventDefaultTest();
+}
 
-  int time = 0;
-  int touchStart = 50;
-  int touchEnd = 10;
-  ScreenPoint pointOut;
-  ViewTransform viewTransformOut;
-
-  // Pan down
-  nsTArray<uint32_t> allowedTouchBehaviors;
-  allowedTouchBehaviors.AppendElement(mozilla::layers::AllowedTouchBehavior::VERTICAL_PAN);
-  ApzcPanAndCheckStatus(apzc, tm, time, touchStart, touchEnd, true, true, &allowedTouchBehaviors);
-
-  // Send the signal that content has handled and preventDefaulted the touch
-  // events. This flushes the event queue.
-  apzc->ContentReceivedTouch(true);
-
-  apzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
-  EXPECT_EQ(ScreenPoint(), pointOut);
-  EXPECT_EQ(ViewTransform(), viewTransformOut);
+TEST_F(APZCPanningTester, PanWithPreventDefault) {
+  SCOPED_GFX_PREF(TouchActionEnabled, bool, false);
+  DoPanWithPreventDefaultTest();
 }
 
 TEST_F(APZCBasicTester, Fling) {
@@ -1036,12 +1087,23 @@ protected:
     int time = 0;
 
     nsEventStatus status = ApzcDown(apzc, 10, 10, time);
-    EXPECT_EQ(nsEventStatus_eConsumeNoDefault, status);
+    if (gfxPrefs::TouchActionEnabled()) {
+      // If touch-action is enabled, then the event is queued until the
+      // allowed touch behavior is set.
+      EXPECT_EQ(nsEventStatus_eConsumeDoDefault, status);
+    } else {
+      // Otherwise, it is processed immediately.
+      EXPECT_EQ(nsEventStatus_eConsumeNoDefault, status);
+    }
 
-    // SetAllowedTouchBehavior() must be called after sending touch-start.
-    nsTArray<uint32_t> allowedTouchBehaviors;
-    allowedTouchBehaviors.AppendElement(aBehavior);
-    apzc->SetAllowedTouchBehavior(allowedTouchBehaviors);
+    if (gfxPrefs::TouchActionEnabled()) {
+      // SetAllowedTouchBehavior() must be called after sending touch-start.
+      nsTArray<uint32_t> allowedTouchBehaviors;
+      allowedTouchBehaviors.AppendElement(aBehavior);
+      apzc->SetAllowedTouchBehavior(allowedTouchBehaviors);
+    }
+    // Have content "respond" to the touchstart
+    apzc->ContentReceivedTouch(false);
 
     MockFunction<void(std::string checkPointName)> check;
 
@@ -1057,6 +1119,7 @@ protected:
       EXPECT_CALL(check, Call("postHandleLongTapUp"));
     }
 
+    // There is a longpress event scheduled on a timeout
     mcc->CheckHasDelayedTask();
 
     // Manually invoke the longpress while the touch is currently down.
@@ -1066,24 +1129,23 @@ protected:
 
     // Destroy pending MAX_TAP timeout task
     mcc->DestroyOldestTask();
-    // There should be a TimeoutContentResponse task in the queue still
-    // Clear the waiting-for-content timeout task, then send the signal that
-    // content has handled this long tap. This takes the place of the
-    // "contextmenu" event.
+
+    // Dispatching the longpress event starts a new touch block, which
+    // needs a new content response and also has a pending timeout task
+    // in the queue. Deal with those here. We do the content response first
+    // with preventDefault=false, and then we run the timeout task which
+    // "loses the race" and does nothing.
+    apzc->ContentReceivedTouch(false);
     mcc->CheckHasDelayedTask();
-    mcc->ClearDelayedTask();
-    apzc->ContentReceivedTouch(true);
+    mcc->RunDelayedTask();
 
     time += 1000;
 
+    // Finally, simulate lifting the finger. Since the long-press wasn't
+    // prevent-defaulted, we should get a long-tap-up event.
+    check.Call("preHandleLongTapUp");
     status = ApzcUp(apzc, 10, 10, time);
     EXPECT_EQ(nsEventStatus_eIgnore, status);
-
-    // To get a LongTapUp event, we must kick APZC to flush its event queue. This
-    // would normally happen if we had a (Tab|RenderFrame)(Parent|Child)
-    // mechanism.
-    check.Call("preHandleLongTapUp");
-    apzc->ContentReceivedTouch(false);
     check.Call("postHandleLongTapUp");
 
     apzc->AssertStateIsReset();
@@ -1101,12 +1163,23 @@ protected:
 
     int time = 0;
     nsEventStatus status = ApzcDown(apzc, touchX, touchStartY, time);
-    EXPECT_EQ(nsEventStatus_eConsumeNoDefault, status);
+    if (gfxPrefs::TouchActionEnabled()) {
+      // If touch-action is enabled, then the event is queued until the
+      // allowed touch behavior is set.
+      EXPECT_EQ(nsEventStatus_eConsumeDoDefault, status);
+    } else {
+      // Otherwise, it is processed immediately.
+      EXPECT_EQ(nsEventStatus_eConsumeNoDefault, status);
+    }
 
-    // SetAllowedTouchBehavior() must be called after sending touch-start.
-    nsTArray<uint32_t> allowedTouchBehaviors;
-    allowedTouchBehaviors.AppendElement(aBehavior);
-    apzc->SetAllowedTouchBehavior(allowedTouchBehaviors);
+    if (gfxPrefs::TouchActionEnabled()) {
+      // SetAllowedTouchBehavior() must be called after sending touch-start.
+      nsTArray<uint32_t> allowedTouchBehaviors;
+      allowedTouchBehaviors.AppendElement(aBehavior);
+      apzc->SetAllowedTouchBehavior(allowedTouchBehaviors);
+    }
+    // Have content "respond" to the touchstart
+    apzc->ContentReceivedTouch(false);
 
     MockFunction<void(std::string checkPointName)> check;
 
@@ -1127,11 +1200,15 @@ protected:
 
     // Destroy pending MAX_TAP timeout task
     mcc->DestroyOldestTask();
-    // Clear the waiting-for-content timeout task, then send the signal that
-    // content has handled this long tap. This takes the place of the
-    // "contextmenu" event.
-    mcc->ClearDelayedTask();
+
+    // There should be a TimeoutContentResponse task in the queue still,
+    // waiting for the response from the longtap event dispatched above.
+    // Send the signal that content has handled the long-tap, and then run
+    // the timeout task (it will be a no-op because the content "wins" the
+    // race. This takes the place of the "contextmenu" event.
     apzc->ContentReceivedTouch(true);
+    mcc->CheckHasDelayedTask();
+    mcc->RunDelayedTask();
 
     time += 1000;
 
@@ -1144,11 +1221,6 @@ protected:
     status = ApzcUp(apzc, touchX, touchEndY, time);
     EXPECT_EQ(nsEventStatus_eIgnore, status);
 
-    // Flush the event queue. Once the "contextmenu" event is handled, any touch
-    // events that come from the same series of start->n*move->end events should
-    // be discarded, even if only the "contextmenu" event is preventDefaulted.
-    apzc->ContentReceivedTouch(false);
-
     ScreenPoint pointOut;
     ViewTransform viewTransformOut;
     apzc->SampleContentTransformForFrame(testStartTime, &viewTransformOut, pointOut);
@@ -1182,6 +1254,118 @@ TEST_F(APZCLongPressTester, LongPressPreventDefaultWithTouchAction) {
                                 | mozilla::layers::AllowedTouchBehavior::PINCH_ZOOM);
 }
 
+static void
+ApzcDoubleTap(AsyncPanZoomController* aApzc, int aX, int aY, int& aTime,
+              nsEventStatus (*aOutEventStatuses)[4] = nullptr)
+{
+  nsEventStatus status = ApzcDown(aApzc, aX, aY, aTime);
+  if (aOutEventStatuses) {
+    (*aOutEventStatuses)[0] = status;
+  }
+  aTime += 10;
+  status = ApzcUp(aApzc, aX, aY, aTime);
+  if (aOutEventStatuses) {
+    (*aOutEventStatuses)[1] = status;
+  }
+  aTime += 10;
+  status = ApzcDown(aApzc, aX, aY, aTime);
+  if (aOutEventStatuses) {
+    (*aOutEventStatuses)[2] = status;
+  }
+  aTime += 10;
+  status = ApzcUp(aApzc, aX, aY, aTime);
+  if (aOutEventStatuses) {
+    (*aOutEventStatuses)[3] = status;
+  }
+}
+
+static void
+ApzcDoubleTapAndCheckStatus(AsyncPanZoomController* aApzc, int aX, int aY, int& aTime)
+{
+  nsEventStatus statuses[4];
+  ApzcDoubleTap(aApzc, aX, aY, aTime, &statuses);
+  EXPECT_EQ(nsEventStatus_eConsumeDoDefault, statuses[0]);
+  EXPECT_EQ(nsEventStatus_eConsumeDoDefault, statuses[1]);
+  EXPECT_EQ(nsEventStatus_eConsumeDoDefault, statuses[2]);
+  EXPECT_EQ(nsEventStatus_eConsumeDoDefault, statuses[3]);
+}
+
+TEST_F(APZCGestureDetectorTester, DoubleTap) {
+  SetMayHaveTouchListeners();
+  MakeApzcZoomable();
+
+  EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(0);
+  EXPECT_CALL(*mcc, HandleDoubleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(1);
+
+  int time = 0;
+  ApzcDoubleTapAndCheckStatus(apzc, 10, 10, time);
+
+  // responses to the two touchstarts
+  apzc->ContentReceivedTouch(false);
+  apzc->ContentReceivedTouch(false);
+
+  while (mcc->RunThroughDelayedTasks());
+
+  apzc->AssertStateIsReset();
+}
+
+TEST_F(APZCGestureDetectorTester, DoubleTapNotZoomable) {
+  SetMayHaveTouchListeners();
+  MakeApzcUnzoomable();
+
+  EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(2);
+  EXPECT_CALL(*mcc, HandleDoubleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(0);
+
+  int time = 0;
+  ApzcDoubleTapAndCheckStatus(apzc, 10, 10, time);
+
+  // responses to the two touchstarts
+  apzc->ContentReceivedTouch(false);
+  apzc->ContentReceivedTouch(false);
+
+  while (mcc->RunThroughDelayedTasks());
+
+  apzc->AssertStateIsReset();
+}
+
+TEST_F(APZCGestureDetectorTester, DoubleTapPreventDefaultFirstOnly) {
+  SetMayHaveTouchListeners();
+  MakeApzcZoomable();
+
+  EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(1);
+  EXPECT_CALL(*mcc, HandleDoubleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(0);
+
+  int time = 0;
+  ApzcDoubleTapAndCheckStatus(apzc, 10, 10, time);
+
+  // responses to the two touchstarts
+  apzc->ContentReceivedTouch(true);
+  apzc->ContentReceivedTouch(false);
+
+  while (mcc->RunThroughDelayedTasks());
+
+  apzc->AssertStateIsReset();
+}
+
+TEST_F(APZCGestureDetectorTester, DoubleTapPreventDefaultBoth) {
+  SetMayHaveTouchListeners();
+  MakeApzcZoomable();
+
+  EXPECT_CALL(*mcc, HandleSingleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(0);
+  EXPECT_CALL(*mcc, HandleDoubleTap(CSSPoint(10, 10), 0, apzc->GetGuid())).Times(0);
+
+  int time = 0;
+  ApzcDoubleTapAndCheckStatus(apzc, 10, 10, time);
+
+  // responses to the two touchstarts
+  apzc->ContentReceivedTouch(true);
+  apzc->ContentReceivedTouch(true);
+
+  while (mcc->RunThroughDelayedTasks());
+
+  apzc->AssertStateIsReset();
+}
+
 // Layer tree for HitTesting1
 static already_AddRefed<mozilla::layers::Layer>
 CreateTestLayerTree1(nsRefPtr<LayerManager>& aLayerManager, nsTArray<nsRefPtr<Layer> >& aLayers) {
diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index d9fcb99c032..bdd63c19374 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -100,6 +100,9 @@ struct Zone;
 /* Default size for the generational nursery in bytes. */
 const uint32_t DefaultNurseryBytes = 16 * 1024 * 1024;
 
+/* Default maximum heap size in bytes to pass to JS_NewRuntime(). */
+const uint32_t DefaultHeapMaxBytes = 32 * 1024 * 1024;
+
 /*
  * We cannot expose the class hierarchy: the implementation is hidden. Instead
  * we provide cast functions with strong debug-mode assertions.
diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
index e556328afaa..31e456baba3 100644
--- a/js/public/MemoryMetrics.h
+++ b/js/public/MemoryMetrics.h
@@ -212,8 +212,10 @@ struct GCSizes
 struct StringInfo
 {
 #define FOR_EACH_SIZE(macro) \
-    macro(Strings, IsLiveGCThing,  gcHeap) \
-    macro(Strings, NotLiveGCThing, mallocHeap) \
+    macro(Strings, IsLiveGCThing,  gcHeapLatin1) \
+    macro(Strings, IsLiveGCThing,  gcHeapTwoByte) \
+    macro(Strings, NotLiveGCThing, mallocHeapLatin1) \
+    macro(Strings, NotLiveGCThing, mallocHeapTwoByte)
 
     StringInfo()
       : FOR_EACH_SIZE(ZERO_SIZE)
diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index bda5490ea99..b7befb76adc 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -677,12 +677,107 @@ regexp_test_impl(JSContext *cx, CallArgs args)
     return status != RegExpRunStatus_Error;
 }
 
+static inline bool
+StringHasDotStar(HandleLinearString str, size_t index)
+{
+    // Return whether the portion of the string at the specified index is '.*'
+    return str->latin1OrTwoByteChar(index) == '.' && str->latin1OrTwoByteChar(index + 1) == '*';
+}
+
+static bool
+TryFillRegExpTestCache(JSContext *cx, HandleObject regexp, RegExpTestCache &cache,
+                       MutableHandleObject result)
+{
+    cache.purge();
+
+    // test() on global RegExps uses the lastIndex in a fashion that is
+    // incompatible with the cache.
+    if (regexp->as<RegExpObject>().global())
+        return true;
+
+    RootedAtom source(cx, regexp->as<RegExpObject>().getSource());
+
+    // Try to strip a leading '.*' from the RegExp, but only if it is not
+    // followed by a '?' (which will affect how the .* is parsed).
+    if (source->length() >= 3 &&
+        StringHasDotStar(source, 0) &&
+        source->latin1OrTwoByteChar(2) != '?')
+    {
+        source = AtomizeSubstring(cx, source, 2, source->length() - 2);
+        if (!source)
+            return false;
+    }
+
+    // Try to strip a trailing '.*' from the RegExp, but only if it does not
+    // have any other meta characters (to be sure we are not affecting how the
+    // RegExp will be parsed).
+    if (source->length() >= 3 &&
+        StringHasDotStar(source, source->length() - 2) &&
+        !StringHasRegExpMetaChars(source, 0, 2))
+    {
+        source = AtomizeSubstring(cx, source, 0, source->length() - 2);
+        if (!source)
+            return false;
+    }
+
+    if (source == regexp->as<RegExpObject>().getSource()) {
+        // We weren't able to remove a leading or trailing .*
+        return true;
+    }
+
+    RegExpObjectBuilder builder(cx);
+
+    result.set(builder.build(source, regexp->as<RegExpObject>().getFlags()));
+    if (!result)
+        return false;
+
+    cache.fill(&regexp->as<RegExpObject>(), &result->as<RegExpObject>());
+    return true;
+}
+
 /* Separate interface for use by IonMonkey. */
 bool
 js::regexp_test_raw(JSContext *cx, HandleObject regexp, HandleString input, bool *result)
 {
     ScopedMatchPairs matches(&cx->tempLifoAlloc());
-    RegExpRunStatus status = ExecuteRegExp(cx, regexp, input, matches, UpdateRegExpStatics);
+
+    RegExpTestCache &cache = cx->runtime()->regExpTestCache;
+
+    RootedObject alternate(cx);
+    if (regexp == cache.key ||
+        (cache.key &&
+         regexp->as<RegExpObject>().getSource() == cache.key->getSource() &&
+         regexp->as<RegExpObject>().getFlags() == cache.key->getFlags()))
+    {
+        alternate = cache.value;
+    } else {
+        if (!TryFillRegExpTestCache(cx, regexp, cache, &alternate))
+            return false;
+    }
+
+    RegExpRunStatus status;
+    if (alternate) {
+        // The alternate RegExp is simpler and should execute faster than the
+        // original one, so use it instead.
+        status = ExecuteRegExp(cx, alternate, input, matches, DontUpdateRegExpStatics);
+
+        if (status == RegExpRunStatus_Success) {
+            // Update the RegExpStatics to reflect the original RegExp we were
+            // trying to execute, and not the alternate one.
+            RegExpStatics *res = cx->global()->getRegExpStatics(cx);
+            if (!res)
+                return RegExpRunStatus_Error;
+
+            RegExpGuard shared(cx);
+            if (!regexp->as<RegExpObject>().getShared(cx, &shared))
+                return RegExpRunStatus_Error;
+
+            res->updateLazily(cx, &input->asLinear(), shared.re(), 0);
+        }
+    } else {
+        status = ExecuteRegExp(cx, regexp, input, matches, UpdateRegExpStatics);
+    }
+
     *result = (status == RegExpRunStatus_Success);
     return status != RegExpRunStatus_Error;
 }
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 378fb5c8072..c600c7dbcd7 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -291,7 +291,9 @@ static const struct ParamPair {
     {"gcBytes",             JSGC_BYTES},
     {"gcNumber",            JSGC_NUMBER},
     {"sliceTimeBudget",     JSGC_SLICE_TIME_BUDGET},
-    {"markStackLimit",      JSGC_MARK_STACK_LIMIT}
+    {"markStackLimit",      JSGC_MARK_STACK_LIMIT},
+    {"minEmptyChunkCount",  JSGC_MIN_EMPTY_CHUNK_COUNT},
+    {"maxEmptyChunkCount",  JSGC_MAX_EMPTY_CHUNK_COUNT}
 };
 
 // Keep this in sync with above params.
diff --git a/js/src/gc/Barrier.h b/js/src/gc/Barrier.h
index 6d5ca65e18a..a08913089e2 100644
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -843,6 +843,7 @@ typedef ReadBarriered<UnownedBaseShape*> ReadBarrieredUnownedBaseShape;
 typedef ReadBarriered<jit::JitCode*> ReadBarrieredJitCode;
 typedef ReadBarriered<types::TypeObject*> ReadBarrieredTypeObject;
 typedef ReadBarriered<JSAtom*> ReadBarrieredAtom;
+typedef ReadBarriered<JS::Symbol*> ReadBarrieredSymbol;
 
 typedef ReadBarriered<Value> ReadBarrieredValue;
 
diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
index b43a5329729..09bba944116 100644
--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -480,6 +480,8 @@ class GCRuntime
     bool                  dynamicHeapGrowth;
     bool                  dynamicMarkSlice;
     uint64_t              decommitThreshold;
+    unsigned              minEmptyChunkCount;
+    unsigned              maxEmptyChunkCount;
 
     /* During shutdown, the GC needs to clean up every possible object. */
     bool                  cleanUpEverything;
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index b9d757529d4..59997715765 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -729,12 +729,14 @@ MarkValueInternal(JSTracer *trc, Value *v)
         void *thing = v->toGCThing();
         trc->setTracingLocation((void *)v);
         MarkKind(trc, &thing, v->gcKind());
-        if (v->isString())
+        if (v->isString()) {
             v->setString((JSString *)thing);
-        else if (v->isSymbol())
-            v->setSymbol((JS::Symbol *)thing);
-        else
+        } else if (v->isObject()) {
             v->setObjectOrNull((JSObject *)thing);
+        } else {
+            JS_ASSERT(v->isSymbol());
+            v->setSymbol((JS::Symbol *)thing);
+        }
     } else {
         /* Unset realLocation manually if we do not call MarkInternal. */
         trc->unsetTracingLocation();
@@ -800,10 +802,15 @@ gc::IsValueMarked(Value *v)
         JSString *str = (JSString *)v->toGCThing();
         rv = IsMarked<JSString>(&str);
         v->setString(str);
-    } else {
+    } else if (v->isObject()) {
         JSObject *obj = (JSObject *)v->toGCThing();
         rv = IsMarked<JSObject>(&obj);
         v->setObject(*obj);
+    } else {
+        JS_ASSERT(v->isSymbol());
+        JS::Symbol *sym = v->toSymbol();
+        rv = IsMarked<JS::Symbol>(&sym);
+        v->setSymbol(sym);
     }
     return rv;
 }
@@ -817,10 +824,15 @@ gc::IsValueAboutToBeFinalized(Value *v)
         JSString *str = (JSString *)v->toGCThing();
         rv = IsAboutToBeFinalized<JSString>(&str);
         v->setString(str);
-    } else {
+    } else if (v->isObject()) {
         JSObject *obj = (JSObject *)v->toGCThing();
         rv = IsAboutToBeFinalized<JSObject>(&obj);
         v->setObject(*obj);
+    } else {
+        JS_ASSERT(v->isSymbol());
+        JS::Symbol *sym = v->toSymbol();
+        rv = IsAboutToBeFinalized<JS::Symbol>(&sym);
+        v->setSymbol(sym);
     }
     return rv;
 }
diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index 2005d84bb43..85f6dc510dd 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -828,6 +828,10 @@ js::Nursery::collect(JSRuntime *rt, JS::gcreason::Reason reason, TypeObjectList
     rt->newObjectCache.clearNurseryObjects(rt);
     TIME_END(clearNewObjectCache);
 
+    TIME_START(clearRegExpTestCache);
+    rt->regExpTestCache.purge();
+    TIME_END(clearRegExpTestCache);
+
     // Most of the work is done here. This loop iterates over objects that have
     // been moved to the major heap. If these objects have any outgoing pointers
     // to the nursery, then those nursery objects get moved as well, until no
diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index 3ea8ef7b691..e40fa6d645e 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -251,7 +251,7 @@ gc::GCRuntime::startVerifyPreBarriers()
     rt->setNeedsBarrier(true);
     for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
         PurgeJITCaches(zone);
-        zone->setNeedsBarrier(true, Zone::UpdateIon);
+        zone->setNeedsBarrier(true, Zone::UpdateJit);
         zone->allocator.arenas.purge();
     }
 
@@ -336,7 +336,7 @@ gc::GCRuntime::endVerifyPreBarriers()
         if (!zone->needsBarrier())
             compartmentCreated = true;
 
-        zone->setNeedsBarrier(false, Zone::UpdateIon);
+        zone->setNeedsBarrier(false, Zone::UpdateJit);
         PurgeJITCaches(zone);
     }
     rt->setNeedsBarrier(false);
diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
index 07c98e0542e..42a422615ec 100644
--- a/js/src/gc/Zone.cpp
+++ b/js/src/gc/Zone.cpp
@@ -42,7 +42,7 @@ JS::Zone::Zone(JSRuntime *rt)
     gcState_(NoGC),
     gcScheduled_(false),
     gcPreserveCode_(false),
-    ionUsingBarriers_(false)
+    jitUsingBarriers_(false)
 {
     /* Ensure that there are no vtables to mess us up here. */
     JS_ASSERT(reinterpret_cast<JS::shadow::Zone *>(this) ==
@@ -68,12 +68,12 @@ bool Zone::init()
 }
 
 void
-Zone::setNeedsBarrier(bool needs, ShouldUpdateIon updateIon)
+Zone::setNeedsBarrier(bool needs, ShouldUpdateJit updateJit)
 {
 #ifdef JS_ION
-    if (updateIon == UpdateIon && needs != ionUsingBarriers_) {
+    if (updateJit == UpdateJit && needs != jitUsingBarriers_) {
         jit::ToggleBarriers(this, needs);
-        ionUsingBarriers_ = needs;
+        jitUsingBarriers_ = needs;
     }
 #endif
 
diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
index 648f3194a09..c7baa0cdb50 100644
--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@@ -187,8 +187,8 @@ struct Zone : public JS::shadow::Zone,
         return needsBarrier || runtimeFromMainThread()->gcZeal() == js::gc::ZealVerifierPreValue;
     }
 
-    enum ShouldUpdateIon { DontUpdateIon, UpdateIon };
-    void setNeedsBarrier(bool needs, ShouldUpdateIon updateIon);
+    enum ShouldUpdateJit { DontUpdateJit, UpdateJit };
+    void setNeedsBarrier(bool needs, ShouldUpdateJit updateJit);
     const bool *addressOfNeedsBarrier() const { return &needsBarrier_; }
 
     js::jit::JitZone *getJitZone(JSContext *cx) { return jitZone_ ? jitZone_ : createJitZone(cx); }
@@ -274,7 +274,7 @@ struct Zone : public JS::shadow::Zone,
     GCState gcState_;
     bool gcScheduled_;
     bool gcPreserveCode_;
-    bool ionUsingBarriers_;
+    bool jitUsingBarriers_;
 
     friend bool js::CurrentThreadCanAccessZone(Zone *zone);
     friend class js::gc::GCRuntime;
diff --git a/js/src/jit-test/tests/basic/regexp-removed-dot-star.js b/js/src/jit-test/tests/basic/regexp-removed-dot-star.js
new file mode 100644
index 00000000000..52184948836
--- /dev/null
+++ b/js/src/jit-test/tests/basic/regexp-removed-dot-star.js
@@ -0,0 +1,49 @@
+
+// Test that removal of leading or trailing .* from RegExp test() calls
+// does not affect lastMatch or other RegExpStatics info.
+
+function first(input) {
+    var re = /.*b(cd)/;
+    for (var i = 0; i < 10; i++)
+	re.test(input);
+}
+
+first("1234\nabcdefg\n1234");
+assertEq(RegExp.lastMatch, "abcd");
+assertEq(RegExp.$1, "cd");
+assertEq(RegExp.input, "1234\nabcdefg\n1234");
+assertEq(RegExp.leftContext, "1234\n");
+assertEq(RegExp.rightContext, "efg\n1234");
+assertEq(RegExp.lastParen, "cd");
+
+
+// Test that removal of leading or trailing .* from RegExp test() calls
+// does not affect lastMatch or other RegExpStatics info.
+
+function second(input) {
+    var re = /bcd.*/;
+    for (var i = 0; i < 10; i++)
+	re.test(input);
+}
+
+second("1234\nabcdefg\n1234");
+assertEq(RegExp.lastMatch, "bcdefg");
+assertEq(RegExp.$1, "");
+assertEq(RegExp.input, "1234\nabcdefg\n1234");
+assertEq(RegExp.leftContext, "1234\na");
+assertEq(RegExp.rightContext, "\n1234");
+assertEq(RegExp.lastParen, "");
+
+function third(input) {
+    var re = /.*bcd.*/;
+    for (var i = 0; i < 10; i++)
+	re.test(input);
+}
+
+third("1234\nabcdefg\n1234");
+assertEq(RegExp.lastMatch, "abcdefg");
+assertEq(RegExp.$1, "");
+assertEq(RegExp.input, "1234\nabcdefg\n1234");
+assertEq(RegExp.leftContext, "1234\n");
+assertEq(RegExp.rightContext, "\n1234");
+assertEq(RegExp.lastParen, "");
diff --git a/js/src/jit-test/tests/gc/bug-1017141.js b/js/src/jit-test/tests/gc/bug-1017141.js
new file mode 100644
index 00000000000..9c4533924ca
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1017141.js
@@ -0,0 +1,25 @@
+var min = gcparam('minEmptyChunkCount');
+var max = gcparam('maxEmptyChunkCount');
+
+gcparam('minEmptyChunkCount', 10);
+gcparam('maxEmptyChunkCount', 20);
+assertEq(gcparam('minEmptyChunkCount'), 10);
+assertEq(gcparam('maxEmptyChunkCount'), 20);
+gc();
+
+/* We maintain the invariant that maxEmptyChunkCount >= minEmptyChunkCount. */
+gcparam('minEmptyChunkCount', 30);
+assertEq(gcparam('minEmptyChunkCount'), 30);
+assertEq(gcparam('maxEmptyChunkCount'), 30);
+gc();
+
+gcparam('maxEmptyChunkCount', 5);
+assertEq(gcparam('minEmptyChunkCount'), 5);
+assertEq(gcparam('maxEmptyChunkCount'), 5);
+gc();
+
+gcparam('minEmptyChunkCount', min);
+gcparam('maxEmptyChunkCount', max);
+assertEq(gcparam('minEmptyChunkCount'), min);
+assertEq(gcparam('maxEmptyChunkCount'), max);
+gc();
diff --git a/js/src/jit-test/tests/gc/bug-1035371.js b/js/src/jit-test/tests/gc/bug-1035371.js
new file mode 100644
index 00000000000..b42a74656d2
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1035371.js
@@ -0,0 +1,4 @@
+x = function() {};
+y = new WeakMap;
+selectforgc({});;
+y.set(x, Symbol());
diff --git a/js/src/jit-test/tests/gc/bug-1039516.js b/js/src/jit-test/tests/gc/bug-1039516.js
new file mode 100644
index 00000000000..15f2a994d9b
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1039516.js
@@ -0,0 +1,6 @@
+gczeal(9);
+Symbol.for("a");
+gcslice(1);
+var a = Symbol.for("a");
+gcslice();
+print(Symbol.keyFor(a));
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 1d5bdd6ecf2..ca8e7430b2a 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -5548,8 +5548,7 @@ ICSetElem_TypedArray::Compiler::generateStubCode(MacroAssembler &masm)
 
     if (type_ == Scalar::Float32 || type_ == Scalar::Float64) {
         masm.ensureDouble(value, FloatReg0, &failure);
-        if (LIRGenerator::allowFloat32Optimizations() &&
-            type_ == Scalar::Float32)
+        if (type_ == Scalar::Float32)
         {
             masm.convertDoubleToFloat32(FloatReg0, ScratchFloat32Reg);
             masm.storeToTypedFloatArray(type_, ScratchFloat32Reg, dest);
diff --git a/js/src/jit/IonAnalysis.cpp b/js/src/jit/IonAnalysis.cpp
index 5ccb64198d8..6060c239a95 100644
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -952,11 +952,6 @@ TypeAnalyzer::graphContainsFloat32()
 bool
 TypeAnalyzer::tryEmitFloatOperations()
 {
-    // Backends that currently don't know how to generate Float32 specialized instructions
-    // shouldn't run this pass and just let all instructions as specialized for Double.
-    if (!LIRGenerator::allowFloat32Optimizations())
-        return true;
-
     // Asm.js uses the ahead of time type checks to specialize operations, no need to check
     // them again at this point.
     if (mir->compilingAsmJS())
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index fc2c3d351f9..78b814d357d 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -7559,7 +7559,7 @@ MIRTypeForTypedArrayRead(Scalar::Type arrayType, bool observedDouble)
       case Scalar::Uint32:
         return observedDouble ? MIRType_Double : MIRType_Int32;
       case Scalar::Float32:
-        return (LIRGenerator::allowFloat32Optimizations()) ? MIRType_Float32 : MIRType_Double;
+        return MIRType_Float32;
       case Scalar::Float64:
         return MIRType_Double;
       default:
diff --git a/js/src/jit/IonCaches.cpp b/js/src/jit/IonCaches.cpp
index 8e06020d463..83b56e2dc4b 100644
--- a/js/src/jit/IonCaches.cpp
+++ b/js/src/jit/IonCaches.cpp
@@ -3735,18 +3735,10 @@ GenerateSetTypedArrayElement(JSContext *cx, MacroAssembler &masm, IonCache::Stub
     BaseIndex target(elements, index, ScaleFromElemWidth(width));
 
     if (arrayType == Scalar::Float32) {
-        FloatRegister ftemp;
-        if (LIRGenerator::allowFloat32Optimizations()) {
-            JS_ASSERT(tempFloat32 != InvalidFloatReg);
-            if (!masm.convertConstantOrRegisterToFloat(cx, value, tempFloat32, &failures))
-                return false;
-            ftemp = tempFloat32;
-        } else {
-            if (!masm.convertConstantOrRegisterToDouble(cx, value, tempDouble, &failures))
-                return false;
-            ftemp = tempDouble;
-        }
-        masm.storeToTypedFloatArray(arrayType, ftemp, target);
+        JS_ASSERT(tempFloat32 != InvalidFloatReg);
+        if (!masm.convertConstantOrRegisterToFloat(cx, value, tempFloat32, &failures))
+            return false;
+        masm.storeToTypedFloatArray(arrayType, tempFloat32, target);
     } else if (arrayType == Scalar::Float64) {
         if (!masm.convertConstantOrRegisterToDouble(cx, value, tempDouble, &failures))
             return false;
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index dbfc69f1479..6b650f96798 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -278,16 +278,7 @@ StoreToTypedFloatArray(MacroAssembler &masm, int arrayType, const S &value, cons
 {
     switch (arrayType) {
       case Scalar::Float32:
-        if (LIRGenerator::allowFloat32Optimizations()) {
-            masm.storeFloat32(value, dest);
-        } else {
-#ifdef JS_MORE_DETERMINISTIC
-            // See the comment in TypedArrayObjectTemplate::doubleToNative.
-            masm.canonicalizeDouble(value);
-#endif
-            masm.convertDoubleToFloat32(value, ScratchFloat32Reg);
-            masm.storeFloat32(ScratchFloat32Reg, dest);
-        }
+        masm.storeFloat32(value, dest);
         break;
       case Scalar::Float64:
 #ifdef JS_MORE_DETERMINISTIC
@@ -350,13 +341,8 @@ MacroAssembler::loadFromTypedArray(Scalar::Type arrayType, const T &src, AnyRegi
         }
         break;
       case Scalar::Float32:
-        if (LIRGenerator::allowFloat32Optimizations()) {
-            loadFloat32(src, dest.fpu());
-            canonicalizeFloat(dest.fpu());
-        } else {
-            loadFloatAsDouble(src, dest.fpu());
-            canonicalizeDouble(dest.fpu());
-        }
+        loadFloat32(src, dest.fpu());
+        canonicalizeFloat(dest.fpu());
         break;
       case Scalar::Float64:
         loadDouble(src, dest.fpu());
@@ -414,8 +400,7 @@ MacroAssembler::loadFromTypedArray(Scalar::Type arrayType, const T &src, const V
       case Scalar::Float32:
         loadFromTypedArray(arrayType, src, AnyRegister(ScratchFloat32Reg), dest.scratchReg(),
                            nullptr);
-        if (LIRGenerator::allowFloat32Optimizations())
-            convertFloat32ToDouble(ScratchFloat32Reg, ScratchDoubleReg);
+        convertFloat32ToDouble(ScratchFloat32Reg, ScratchDoubleReg);
         boxDouble(ScratchDoubleReg, dest);
         break;
       case Scalar::Float64:
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index fb4c2c55e93..c739b4b60ea 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -511,9 +511,6 @@ LIRGenerator::visitAssertFloat32(MAssertFloat32 *assertion)
     MIRType type = assertion->input()->type();
     DebugOnly<bool> checkIsFloat32 = assertion->mustBeFloat32();
 
-    if (!allowFloat32Optimizations())
-        return true;
-
     if (type != MIRType_Value && !js_JitOptions.eagerCompilation) {
         JS_ASSERT_IF(checkIsFloat32, type == MIRType_Float32);
         JS_ASSERT_IF(!checkIsFloat32, type != MIRType_Float32);
@@ -2851,11 +2848,8 @@ LIRGenerator::visitStoreTypedArrayElement(MStoreTypedArrayElement *ins)
     JS_ASSERT(ins->index()->type() == MIRType_Int32);
 
     if (ins->isFloatArray()) {
-        DebugOnly<bool> optimizeFloat32 = allowFloat32Optimizations();
-        JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == Scalar::Float32,
-                     ins->value()->type() == MIRType_Float32);
-        JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == Scalar::Float64,
-                     ins->value()->type() == MIRType_Double);
+        JS_ASSERT_IF(ins->arrayType() == Scalar::Float32, ins->value()->type() == MIRType_Float32);
+        JS_ASSERT_IF(ins->arrayType() == Scalar::Float64, ins->value()->type() == MIRType_Double);
     } else {
         JS_ASSERT(ins->value()->type() == MIRType_Int32);
     }
@@ -2880,11 +2874,8 @@ LIRGenerator::visitStoreTypedArrayElementHole(MStoreTypedArrayElementHole *ins)
     JS_ASSERT(ins->length()->type() == MIRType_Int32);
 
     if (ins->isFloatArray()) {
-        DebugOnly<bool> optimizeFloat32 = allowFloat32Optimizations();
-        JS_ASSERT_IF(optimizeFloat32 && ins->arrayType() == Scalar::Float32,
-                     ins->value()->type() == MIRType_Float32);
-        JS_ASSERT_IF(!optimizeFloat32 || ins->arrayType() == Scalar::Float64,
-                     ins->value()->type() == MIRType_Double);
+        JS_ASSERT_IF(ins->arrayType() == Scalar::Float32, ins->value()->type() == MIRType_Float32);
+        JS_ASSERT_IF(ins->arrayType() == Scalar::Float64, ins->value()->type() == MIRType_Double);
     } else {
         JS_ASSERT(ins->value()->type() == MIRType_Int32);
     }
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 2c8dc3f591c..1a10f8498fb 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -1034,9 +1034,6 @@ IonBuilder::inlineMathImul(CallInfo &callInfo)
 IonBuilder::InliningStatus
 IonBuilder::inlineMathFRound(CallInfo &callInfo)
 {
-    if (!LIRGenerator::allowFloat32Optimizations())
-        return InliningStatus_NotInlined;
-
     if (callInfo.argc() != 1 || callInfo.constructing())
         return InliningStatus_NotInlined;
 
diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index ae2326da6a7..e227aafa6a2 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -777,15 +777,11 @@ StoreTypedArrayPolicy::adjustValueInput(TempAllocator &alloc, MInstruction *ins,
         JS_ASSERT(value->type() == MIRType_Int32);
         break;
       case Scalar::Float32:
-        if (LIRGenerator::allowFloat32Optimizations()) {
-            if (value->type() != MIRType_Float32) {
-                value = MToFloat32::New(alloc, value);
-                ins->block()->insertBefore(ins, value->toInstruction());
-            }
-            break;
+        if (value->type() != MIRType_Float32) {
+            value = MToFloat32::New(alloc, value);
+            ins->block()->insertBefore(ins, value->toInstruction());
         }
-        // Fallthrough: if the LIRGenerator cannot directly store Float32, it will expect the
-        // stored value to be a double.
+        break;
       case Scalar::Float64:
         if (value->type() != MIRType_Double) {
             value = MToDouble::New(alloc, value);
diff --git a/js/src/jit/arm/Lowering-arm.h b/js/src/jit/arm/Lowering-arm.h
index 5bdc9e7c2cb..285756650e9 100644
--- a/js/src/jit/arm/Lowering-arm.h
+++ b/js/src/jit/arm/Lowering-arm.h
@@ -91,10 +91,6 @@ class LIRGeneratorARM : public LIRGeneratorShared
     bool visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins);
     bool visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins);
     bool visitForkJoinGetSlice(MForkJoinGetSlice *ins);
-
-    static bool allowFloat32Optimizations() {
-        return true;
-    }
 };
 
 typedef LIRGeneratorARM LIRGeneratorSpecific;
diff --git a/js/src/jit/mips/Lowering-mips.h b/js/src/jit/mips/Lowering-mips.h
index dbd464b5d8d..6f834195f90 100644
--- a/js/src/jit/mips/Lowering-mips.h
+++ b/js/src/jit/mips/Lowering-mips.h
@@ -91,10 +91,6 @@ class LIRGeneratorMIPS : public LIRGeneratorShared
     bool visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins);
     bool visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins);
     bool visitForkJoinGetSlice(MForkJoinGetSlice *ins);
-
-    static bool allowFloat32Optimizations() {
-        return true;
-    }
 };
 
 typedef LIRGeneratorMIPS LIRGeneratorSpecific;
diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
index 71ace8ef11f..943123b7d7c 100644
--- a/js/src/jit/shared/Lowering-shared.h
+++ b/js/src/jit/shared/Lowering-shared.h
@@ -206,11 +206,6 @@ class LIRGeneratorShared : public MInstructionVisitorWithDefaults
         return false;
     }
 
-     // Whether we can emit Float32 specific optimizations.
-    static bool allowFloat32Optimizations() {
-       return false;
-    }
-
     // Whether we can inline ForkJoinGetSlice.
     static bool allowInlineForkJoinGetSlice() {
         return false;
diff --git a/js/src/jit/x64/Lowering-x64.h b/js/src/jit/x64/Lowering-x64.h
index e24fae3548e..21750eadafe 100644
--- a/js/src/jit/x64/Lowering-x64.h
+++ b/js/src/jit/x64/Lowering-x64.h
@@ -54,10 +54,6 @@ class LIRGeneratorX64 : public LIRGeneratorX86Shared
     bool visitAsmJSLoadFuncPtr(MAsmJSLoadFuncPtr *ins);
     bool visitStoreTypedArrayElementStatic(MStoreTypedArrayElementStatic *ins);
 
-    static bool allowFloat32Optimizations() {
-        return true;
-    }
-
     static bool allowInlineForkJoinGetSlice() {
         return true;
     }
diff --git a/js/src/jit/x86/Lowering-x86.h b/js/src/jit/x86/Lowering-x86.h
index eb25364ce7f..0fca7dbb308 100644
--- a/js/src/jit/x86/Lowering-x86.h
+++ b/js/src/jit/x86/Lowering-x86.h
@@ -64,9 +64,6 @@ class LIRGeneratorX86 : public LIRGeneratorX86Shared
     static bool allowStaticTypedArrayAccesses() {
         return true;
     }
-    static bool allowFloat32Optimizations() {
-        return true;
-    }
     static bool allowInlineForkJoinGetSlice() {
         return true;
     }
diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 8e93b6d0f81..a663e23aa8e 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2145,7 +2145,16 @@ typedef enum JSGCParamKey {
      * available to be decommitted, then JS_MaybeGC will trigger a shrinking GC
      * to decommit it.
      */
-    JSGC_DECOMMIT_THRESHOLD = 20
+    JSGC_DECOMMIT_THRESHOLD = 20,
+
+    /*
+     * We try to keep at least this many unused chunks in the free chunk pool at
+     * all times, even after a shrinking GC.
+     */
+    JSGC_MIN_EMPTY_CHUNK_COUNT = 21,
+
+    /* We never keep more than this many unused chunks in the free chunk pool. */
+    JSGC_MAX_EMPTY_CHUNK_COUNT = 22
 } JSGCParamKey;
 
 extern JS_PUBLIC_API(void)
diff --git a/js/src/jsatom.cpp b/js/src/jsatom.cpp
index d19a5e480b8..d38833c60f8 100644
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@@ -472,6 +472,22 @@ js::AtomizeString(ExclusiveContext *cx, JSString *str,
            : AtomizeAndCopyChars(cx, linear->twoByteChars(nogc), linear->length(), ib);
 }
 
+JSAtom *
+js::AtomizeSubstring(ExclusiveContext *cx, JSString *str, size_t start, size_t length,
+                     InternBehavior ib /* = DoNotInternAtom */)
+{
+    JS_ASSERT(start + length <= str->length());
+
+    JSLinearString *linear = str->ensureLinear(cx);
+    if (!linear)
+        return nullptr;
+
+    JS::AutoCheckCannotGC nogc;
+    return linear->hasLatin1Chars()
+           ? AtomizeAndCopyChars(cx, linear->latin1Chars(nogc) + start, length, ib)
+           : AtomizeAndCopyChars(cx, linear->twoByteChars(nogc) + start, length, ib);
+}
+
 JSAtom *
 js::Atomize(ExclusiveContext *cx, const char *bytes, size_t length, InternBehavior ib)
 {
diff --git a/js/src/jsatom.h b/js/src/jsatom.h
index a1e9a6b796c..3579ee43905 100644
--- a/js/src/jsatom.h
+++ b/js/src/jsatom.h
@@ -209,6 +209,10 @@ AtomizeChars(ExclusiveContext *cx, const CharT *chars, size_t length,
 extern JSAtom *
 AtomizeString(ExclusiveContext *cx, JSString *str, js::InternBehavior ib = js::DoNotInternAtom);
 
+extern JSAtom *
+AtomizeSubstring(ExclusiveContext *cx, JSString *str, size_t start, size_t length,
+                 InternBehavior ib = DoNotInternAtom);
+
 template <AllowGC allowGC>
 extern JSAtom *
 ToAtom(ExclusiveContext *cx, typename MaybeRooted<Value, allowGC>::HandleType v);
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index caf89a8782e..ded9fc9289b 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -238,18 +238,6 @@ static const uint64_t GC_IDLE_FULL_SPAN = 20 * 1000 * 1000;
 /* Increase the IGC marking slice time if we are in highFrequencyGC mode. */
 static const int IGC_MARK_SLICE_MULTIPLIER = 2;
 
-#ifdef JSGC_GENERATIONAL
-static const unsigned MIN_EMPTY_CHUNK_COUNT = 1;
-#else
-static const unsigned MIN_EMPTY_CHUNK_COUNT = 0;
-#endif
-
-#if defined(ANDROID) || defined(MOZ_B2G)
-static const unsigned MAX_EMPTY_CHUNK_COUNT = 2;
-#else
-static const unsigned MAX_EMPTY_CHUNK_COUNT = 30;
-#endif
-
 const AllocKind gc::slotsToThingKind[] = {
     /* 0 */  FINALIZE_OBJECT0,  FINALIZE_OBJECT2,  FINALIZE_OBJECT2,  FINALIZE_OBJECT4,
     /* 4 */  FINALIZE_OBJECT4,  FINALIZE_OBJECT8,  FINALIZE_OBJECT8,  FINALIZE_OBJECT8,
@@ -695,14 +683,15 @@ GCRuntime::expireChunkPool(bool shrinkBuffers, bool releaseAll)
      * without emptying the list, the older chunks will stay at the tail
      * and are more likely to reach the max age.
      */
+    JS_ASSERT(maxEmptyChunkCount >= minEmptyChunkCount);
     Chunk *freeList = nullptr;
     unsigned freeChunkCount = 0;
     for (ChunkPool::Enum e(chunkPool); !e.empty(); ) {
         Chunk *chunk = e.front();
         JS_ASSERT(chunk->unused());
         JS_ASSERT(!chunkSet.has(chunk));
-        if (releaseAll || freeChunkCount >= MAX_EMPTY_CHUNK_COUNT ||
-            (freeChunkCount >= MIN_EMPTY_CHUNK_COUNT &&
+        if (releaseAll || freeChunkCount >= maxEmptyChunkCount ||
+            (freeChunkCount >= minEmptyChunkCount &&
              (shrinkBuffers || chunk->info.age == MAX_EMPTY_CHUNK_AGE)))
         {
             e.removeAndPopFront();
@@ -716,7 +705,8 @@ GCRuntime::expireChunkPool(bool shrinkBuffers, bool releaseAll)
             e.popFront();
         }
     }
-    JS_ASSERT_IF(shrinkBuffers, chunkPool.getEmptyCount() <= MIN_EMPTY_CHUNK_COUNT);
+    JS_ASSERT(chunkPool.getEmptyCount() <= maxEmptyChunkCount);
+    JS_ASSERT_IF(shrinkBuffers, chunkPool.getEmptyCount() <= minEmptyChunkCount);
     JS_ASSERT_IF(releaseAll, chunkPool.getEmptyCount() == 0);
     return freeList;
 }
@@ -1032,7 +1022,7 @@ GCRuntime::wantBackgroundAllocation() const
      * of them.
      */
     return helperState.canBackgroundAllocate() &&
-           chunkPool.getEmptyCount() < MIN_EMPTY_CHUNK_COUNT &&
+           chunkPool.getEmptyCount() < minEmptyChunkCount &&
            chunkSet.count() >= 4;
 }
 
@@ -1137,6 +1127,8 @@ GCRuntime::GCRuntime(JSRuntime *rt) :
     dynamicHeapGrowth(false),
     dynamicMarkSlice(false),
     decommitThreshold(32 * 1024 * 1024),
+    minEmptyChunkCount(1),
+    maxEmptyChunkCount(30),
     cleanUpEverything(false),
     grayBitsValid(false),
     isNeeded(0),
@@ -1456,6 +1448,16 @@ GCRuntime::setParameter(JSGCParamKey key, uint32_t value)
       case JSGC_DECOMMIT_THRESHOLD:
         decommitThreshold = value * 1024 * 1024;
         break;
+      case JSGC_MIN_EMPTY_CHUNK_COUNT:
+        minEmptyChunkCount = value;
+        if (minEmptyChunkCount > maxEmptyChunkCount)
+            maxEmptyChunkCount = minEmptyChunkCount;
+        break;
+      case JSGC_MAX_EMPTY_CHUNK_COUNT:
+        maxEmptyChunkCount = value;
+        if (minEmptyChunkCount > maxEmptyChunkCount)
+            minEmptyChunkCount = maxEmptyChunkCount;
+        break;
       default:
         JS_ASSERT(key == JSGC_MODE);
         mode = JSGCMode(value);
@@ -1504,6 +1506,10 @@ GCRuntime::getParameter(JSGCParamKey key)
         return dynamicMarkSlice;
       case JSGC_ALLOCATION_THRESHOLD:
         return allocThreshold / 1024 / 1024;
+      case JSGC_MIN_EMPTY_CHUNK_COUNT:
+        return minEmptyChunkCount;
+      case JSGC_MAX_EMPTY_CHUNK_COUNT:
+        return maxEmptyChunkCount;
       default:
         JS_ASSERT(key == JSGC_NUMBER);
         return uint32_t(number);
@@ -3039,6 +3045,7 @@ PurgeRuntime(JSRuntime *rt)
     rt->nativeIterCache.purge();
     rt->uncompressedSourceCache.purge();
     rt->evalCache.clear();
+    rt->regExpTestCache.purge();
 
     if (!rt->hasActiveCompilations())
         rt->parseMapPool().purgeAll();
@@ -3842,7 +3849,7 @@ GCRuntime::getNextZoneGroup()
         for (GCZoneGroupIter zone(rt); !zone.done(); zone.next()) {
             JS_ASSERT(!zone->gcNextGraphComponent);
             JS_ASSERT(zone->isGCMarking());
-            zone->setNeedsBarrier(false, Zone::UpdateIon);
+            zone->setNeedsBarrier(false, Zone::UpdateJit);
             zone->setGCState(Zone::NoGC);
             zone->gcGrayRoots.clearAndFree();
         }
@@ -4657,7 +4664,7 @@ GCRuntime::resetIncrementalGC(const char *reason)
 
         for (GCZonesIter zone(rt); !zone.done(); zone.next()) {
             JS_ASSERT(zone->isGCMarking());
-            zone->setNeedsBarrier(false, Zone::UpdateIon);
+            zone->setNeedsBarrier(false, Zone::UpdateJit);
             zone->setGCState(Zone::NoGC);
         }
         rt->setNeedsBarrier(false);
@@ -4738,7 +4745,7 @@ AutoGCSlice::AutoGCSlice(JSRuntime *rt)
          */
         if (zone->isGCMarking()) {
             JS_ASSERT(zone->needsBarrier());
-            zone->setNeedsBarrier(false, Zone::DontUpdateIon);
+            zone->setNeedsBarrier(false, Zone::DontUpdateJit);
         } else {
             JS_ASSERT(!zone->needsBarrier());
         }
@@ -4753,11 +4760,11 @@ AutoGCSlice::~AutoGCSlice()
     bool haveBarriers = false;
     for (ZonesIter zone(runtime, WithAtoms); !zone.done(); zone.next()) {
         if (zone->isGCMarking()) {
-            zone->setNeedsBarrier(true, Zone::UpdateIon);
+            zone->setNeedsBarrier(true, Zone::UpdateJit);
             zone->allocator.arenas.prepareForIncrementalGC(runtime);
             haveBarriers = true;
         } else {
-            zone->setNeedsBarrier(false, Zone::UpdateIon);
+            zone->setNeedsBarrier(false, Zone::UpdateJit);
         }
     }
     runtime->setNeedsBarrier(haveBarriers);
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index c1c3d1f677e..0e02ad1a15c 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -3656,16 +3656,10 @@ JSScript::makeTypes(JSContext *cx)
     if (!typeScript)
         return false;
 
-    new(typeScript) TypeScript();
-
-    TypeSet *typeArray = typeScript->typeArray();
-
-    for (unsigned i = 0; i < count; i++)
-        new (&typeArray[i]) StackTypeSet();
-
     types = typeScript;
 
 #ifdef DEBUG
+    StackTypeSet *typeArray = typeScript->typeArray();
     for (unsigned i = 0; i < nTypeSets(); i++) {
         InferSpew(ISpewOps, "typeSet: %sT%p%s bytecode%u #%u",
                   InferSpewColor(&typeArray[i]), &typeArray[i], InferSpewColorReset(),
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 03ce12745f4..19f40a97d09 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1991,13 +1991,15 @@ HasRegExpMetaChars(const CharT *chars, size_t length)
 }
 
 bool
-js::StringHasRegExpMetaChars(JSLinearString *str)
+js::StringHasRegExpMetaChars(JSLinearString *str, size_t beginOffset, size_t endOffset)
 {
+    JS_ASSERT(beginOffset + endOffset <= str->length());
+
     AutoCheckCannotGC nogc;
     if (str->hasLatin1Chars())
-        return HasRegExpMetaChars(str->latin1Chars(nogc), str->length());
+        return HasRegExpMetaChars(str->latin1Chars(nogc) + beginOffset, str->length() - beginOffset - endOffset);
 
-    return HasRegExpMetaChars(str->twoByteChars(nogc), str->length());
+    return HasRegExpMetaChars(str->twoByteChars(nogc) + beginOffset, str->length() - beginOffset - endOffset);
 }
 
 namespace {
diff --git a/js/src/jsstr.h b/js/src/jsstr.h
index 0a68d15d0ad..6af86e3f140 100644
--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -262,8 +262,10 @@ StringHasPattern(JSLinearString *text, const jschar *pat, uint32_t patlen);
 extern int
 StringFindPattern(JSLinearString *text, JSLinearString *pat, size_t start);
 
+// Whether the string contains any RegExp meta characters (., *, and so forth).
+// Searches the range [beginOffset, length - endOffset>.
 extern bool
-StringHasRegExpMetaChars(JSLinearString *str);
+StringHasRegExpMetaChars(JSLinearString *str, size_t beginOffset = 0, size_t endOffset = 0);
 
 template <typename Char1, typename Char2>
 inline bool
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 76f1fb70646..dbaee8163e2 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -6419,7 +6419,7 @@ main(int argc, char **argv, char **envp)
 #endif
 
     /* Use the same parameters as the browser in xpcjsruntime.cpp. */
-    rt = JS_NewRuntime(32L * 1024L * 1024L, nurseryBytes);
+    rt = JS_NewRuntime(JS::DefaultHeapMaxBytes, nurseryBytes);
     if (!rt)
         return 1;
 
diff --git a/js/src/vm/MemoryMetrics.cpp b/js/src/vm/MemoryMetrics.cpp
index 6448eac3b57..18db4693680 100644
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@@ -380,8 +380,13 @@ StatsCellCallback(JSRuntime *rt, void *data, void *thing, JSGCTraceKind traceKin
         JSString *str = static_cast<JSString *>(thing);
 
         JS::StringInfo info;
-        info.gcHeap = thingSize;
-        info.mallocHeap = str->sizeOfExcludingThis(rtStats->mallocSizeOf_);
+        if (str->hasLatin1Chars()) {
+            info.gcHeapLatin1 = thingSize;
+            info.mallocHeapLatin1 = str->sizeOfExcludingThis(rtStats->mallocSizeOf_);
+        } else {
+            info.gcHeapTwoByte = thingSize;
+            info.mallocHeapTwoByte = str->sizeOfExcludingThis(rtStats->mallocSizeOf_);
+        }
         info.numCopies = 1;
 
         zStats->stringInfo.add(info);
diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
index 9216de35ad8..8a093a7d795 100644
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@@ -350,6 +350,30 @@ class NewObjectCache
     }
 };
 
+class RegExpObject;
+
+// One slot cache for speeding up RegExp.test() executions, by stripping
+// unnecessary leading or trailing .* from the RegExp.
+struct RegExpTestCache
+{
+    RegExpObject *key;
+    RegExpObject *value;
+
+    RegExpTestCache()
+      : key(nullptr), value(nullptr)
+    {}
+
+    void purge() {
+        key = nullptr;
+        value = nullptr;
+    }
+
+    void fill(RegExpObject *key, RegExpObject *value) {
+        this->key = key;
+        this->value = value;
+    }
+};
+
 /*
  * A FreeOp can do one thing: free memory. For convenience, it has delete_
  * convenience methods that also call destructors.
@@ -1110,6 +1134,7 @@ struct JSRuntime : public JS::shadow::Runtime,
     js::UncompressedSourceCache uncompressedSourceCache;
     js::EvalCache       evalCache;
     js::LazyScriptCache lazyScriptCache;
+    js::RegExpTestCache regExpTestCache;
 
     js::CompressedSourceSet compressedSourceSet;
     js::DateTimeInfo    dateTimeInfo;
diff --git a/js/src/vm/Symbol.h b/js/src/vm/Symbol.h
index d3c75e2c72d..12c54aa47df 100644
--- a/js/src/vm/Symbol.h
+++ b/js/src/vm/Symbol.h
@@ -83,7 +83,7 @@ struct HashSymbolsByDescription
  * This must be a typedef for the benefit of GCC 4.4.6 (used to build B2G for Ice
  * Cream Sandwich).
  */
-typedef HashSet<JS::Symbol *, HashSymbolsByDescription, SystemAllocPolicy> SymbolHashSet;
+typedef HashSet<ReadBarrieredSymbol, HashSymbolsByDescription, SystemAllocPolicy> SymbolHashSet;
 
 /*
  * The runtime-wide symbol registry, used to implement Symbol.for().
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index f25db8e86c1..dc780e04b3b 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -1915,8 +1915,10 @@ ReportZoneStats(const JS::ZoneStats &zStats,
         // strings which contain "string(length=" into their own bucket.
 #       define STRING_LENGTH "string(length="
         if (FindInReadable(NS_LITERAL_CSTRING(STRING_LENGTH), notableString)) {
-            stringsNotableAboutMemoryGCHeap += info.gcHeap;
-            stringsNotableAboutMemoryMallocHeap += info.mallocHeap;
+            stringsNotableAboutMemoryGCHeap += info.gcHeapLatin1;
+            stringsNotableAboutMemoryGCHeap += info.gcHeapTwoByte;
+            stringsNotableAboutMemoryMallocHeap += info.mallocHeapLatin1;
+            stringsNotableAboutMemoryMallocHeap += info.mallocHeapTwoByte;
             continue;
         }
 
@@ -1933,16 +1935,28 @@ ReportZoneStats(const JS::ZoneStats &zStats,
                             info.length, info.numCopies, escapedString.get(),
                             truncated ? " (truncated)" : "");
 
-        if (info.gcHeap > 0) {
-            REPORT_GC_BYTES(path + NS_LITERAL_CSTRING("gc-heap"),
-                info.gcHeap,
-                "Strings. " MAYBE_INLINE);
+        if (info.gcHeapLatin1 > 0) {
+            REPORT_GC_BYTES(path + NS_LITERAL_CSTRING("gc-heap/latin1"),
+                info.gcHeapLatin1,
+                "Latin1 strings. " MAYBE_INLINE);
         }
 
-        if (info.mallocHeap > 0) {
-            REPORT_BYTES(path + NS_LITERAL_CSTRING("malloc-heap"),
-                KIND_HEAP, info.mallocHeap,
-                "Non-inline string characters. " MAYBE_OVERALLOCATED);
+        if (info.gcHeapTwoByte > 0) {
+            REPORT_GC_BYTES(path + NS_LITERAL_CSTRING("gc-heap/two-byte"),
+                info.gcHeapTwoByte,
+                "TwoByte strings. " MAYBE_INLINE);
+        }
+
+        if (info.mallocHeapLatin1 > 0) {
+            REPORT_BYTES(path + NS_LITERAL_CSTRING("malloc-heap/latin1"),
+                KIND_HEAP, info.mallocHeapLatin1,
+                "Non-inline Latin1 string characters. " MAYBE_OVERALLOCATED);
+        }
+
+        if (info.mallocHeapTwoByte > 0) {
+            REPORT_BYTES(path + NS_LITERAL_CSTRING("malloc-heap/two-byte"),
+                KIND_HEAP, info.mallocHeapTwoByte,
+                "Non-inline TwoByte string characters. " MAYBE_OVERALLOCATED);
         }
     }
 
@@ -1951,16 +1965,28 @@ ReportZoneStats(const JS::ZoneStats &zStats,
                     ? NS_LITERAL_CSTRING("strings/")
                     : NS_LITERAL_CSTRING("strings/string(<non-notable strings>)/");
 
-    if (zStats.stringInfo.gcHeap > 0) {
-        REPORT_GC_BYTES(nonNotablePath + NS_LITERAL_CSTRING("gc-heap"),
-            zStats.stringInfo.gcHeap,
-            "Strings. " MAYBE_INLINE);
+    if (zStats.stringInfo.gcHeapLatin1 > 0) {
+        REPORT_GC_BYTES(nonNotablePath + NS_LITERAL_CSTRING("gc-heap/latin1"),
+            zStats.stringInfo.gcHeapLatin1,
+            "Latin1 strings. " MAYBE_INLINE);
     }
 
-    if (zStats.stringInfo.mallocHeap > 0) {
-        REPORT_BYTES(nonNotablePath + NS_LITERAL_CSTRING("malloc-heap"),
-            KIND_HEAP, zStats.stringInfo.mallocHeap,
-            "Non-inline string characters. " MAYBE_OVERALLOCATED);
+    if (zStats.stringInfo.gcHeapTwoByte > 0) {
+        REPORT_GC_BYTES(nonNotablePath + NS_LITERAL_CSTRING("gc-heap/two-byte"),
+            zStats.stringInfo.gcHeapTwoByte,
+            "TwoByte strings. " MAYBE_INLINE);
+    }
+
+    if (zStats.stringInfo.mallocHeapLatin1 > 0) {
+        REPORT_BYTES(nonNotablePath + NS_LITERAL_CSTRING("malloc-heap/latin1"),
+            KIND_HEAP, zStats.stringInfo.mallocHeapLatin1,
+            "Non-inline Latin1 string characters. " MAYBE_OVERALLOCATED);
+    }
+
+    if (zStats.stringInfo.mallocHeapTwoByte > 0) {
+        REPORT_BYTES(nonNotablePath + NS_LITERAL_CSTRING("malloc-heap/two-byte"),
+            KIND_HEAP, zStats.stringInfo.mallocHeapTwoByte,
+            "Non-inline TwoByte string characters. " MAYBE_OVERALLOCATED);
     }
 
     if (stringsNotableAboutMemoryGCHeap > 0) {
@@ -3069,7 +3095,7 @@ static const JSWrapObjectCallbacks WrapObjectCallbacks = {
 };
 
 XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect)
-   : CycleCollectedJSRuntime(nullptr, 32L * 1024L * 1024L),
+   : CycleCollectedJSRuntime(nullptr, JS::DefaultHeapMaxBytes),
    mJSContextStack(new XPCJSContextStack(MOZ_THIS_IN_INITIALIZER_LIST())),
    mCallContext(nullptr),
    mAutoRoots(nullptr),
diff --git a/layout/base/crashtests/767593-1.html b/layout/base/crashtests/767593-1.html
new file mode 100644
index 00000000000..38dc60e8304
--- /dev/null
+++ b/layout/base/crashtests/767593-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+<body>
+<div><span style="page-break-after: always;"></span><div style="position: fixed;"><span style="display: none;"></span></div>B</div>
+</body>
+</html>
+
diff --git a/layout/base/crashtests/767593-2.html b/layout/base/crashtests/767593-2.html
new file mode 100644
index 00000000000..b89b3ea9092
--- /dev/null
+++ b/layout/base/crashtests/767593-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+<body>
+<div><span style="page-break-after: always;"></span><div style="position: fixed;"><span style="display: none;"></span><span style="display: none;"></span></div>B</div>
+</body>
+</html>
+
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index f1cc01173f2..39e1b6584c9 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -401,6 +401,8 @@ asserts-if(winWidget,0-2) load 736924-1.html # bug 738803
 load 749816-1.html
 load 763223-1.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,100) load 763702.xhtml
+load 767593-1.html
+load 767593-2.html
 load 770381-1.html
 load 772306.html
 load 788360.html
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 8b589667fe1..a0cf4420a67 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -5267,8 +5267,9 @@ nsCSSFrameConstructor::AddFrameConstructionItems(nsFrameConstructorState& aState
                                     aItems);
 }
 
-/* static */ void
-nsCSSFrameConstructor::SetAsUndisplayedContent(FrameConstructionItemList& aList,
+void
+nsCSSFrameConstructor::SetAsUndisplayedContent(nsFrameConstructorState& aState,
+                                               FrameConstructionItemList& aList,
                                                nsIContent* aContent,
                                                nsStyleContext* aStyleContext,
                                                bool aIsGeneratedContent)
@@ -5279,8 +5280,13 @@ nsCSSFrameConstructor::SetAsUndisplayedContent(FrameConstructionItemList& aList,
     }
     return;
   }
-
   NS_ASSERTION(!aIsGeneratedContent, "Should have had pseudo type");
+
+  if (aState.mCreatingExtraFrames) {
+    MOZ_ASSERT(GetUndisplayedContent(aContent),
+               "should have called SetUndisplayedContent earlier");
+    return;
+  }
   aList.AppendUndisplayedItem(aContent, aStyleContext);
 }
 
@@ -5346,7 +5352,7 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
   // Pre-check for display "none" - if we find that, don't create
   // any frame at all
   if (NS_STYLE_DISPLAY_NONE == display->mDisplay) {
-    SetAsUndisplayedContent(aItems, aContent, styleContext, isGeneratedContent);
+    SetAsUndisplayedContent(aState, aItems, aContent, styleContext, isGeneratedContent);
     return;
   }
 
@@ -5370,7 +5376,7 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
         !aContent->IsRootOfNativeAnonymousSubtree()) {
       // No frame for aContent
       if (!isText) {
-        SetAsUndisplayedContent(aItems, aContent, styleContext,
+        SetAsUndisplayedContent(aState, aItems, aContent, styleContext,
                                 isGeneratedContent);
       }
       return;
@@ -5395,7 +5401,7 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
           IsFrameForSVG(aParentFrame) &&
           !aParentFrame->IsFrameOfType(nsIFrame::eSVGForeignObject)) ||
          (aFlags & ITEM_IS_WITHIN_SVG_TEXT))) {
-      SetAsUndisplayedContent(aItems, element, styleContext,
+      SetAsUndisplayedContent(aState, aItems, element, styleContext,
                               isGeneratedContent);
       return;
     }
@@ -5428,7 +5434,7 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
     NS_ASSERTION(data, "Should have frame construction data now");
 
     if (data->mBits & FCDATA_SUPPRESS_FRAME) {
-      SetAsUndisplayedContent(aItems, element, styleContext, isGeneratedContent);
+      SetAsUndisplayedContent(aState, aItems, element, styleContext, isGeneratedContent);
       return;
     }
 
@@ -5438,7 +5444,7 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
          aParentFrame->GetType() != nsGkAtoms::menuFrame)) {
       if (!aState.mPopupItems.containingBlock &&
           !aState.mHavePendingPopupgroup) {
-        SetAsUndisplayedContent(aItems, element, styleContext,
+        SetAsUndisplayedContent(aState, aItems, element, styleContext,
                                 isGeneratedContent);
         return;
       }
@@ -5455,7 +5461,7 @@ nsCSSFrameConstructor::AddFrameConstructionItemsInternal(nsFrameConstructorState
       aParentFrame->GetType() == nsGkAtoms::tableColGroupFrame &&
       (!(bits & FCDATA_IS_TABLE_PART) ||
        display->mDisplay != NS_STYLE_DISPLAY_TABLE_COLUMN)) {
-    SetAsUndisplayedContent(aItems, aContent, styleContext, isGeneratedContent);
+    SetAsUndisplayedContent(aState, aItems, aContent, styleContext, isGeneratedContent);
     return;
   }
 
diff --git a/layout/base/nsCSSFrameConstructor.h b/layout/base/nsCSSFrameConstructor.h
index 57370f7d50b..08a170c65cf 100644
--- a/layout/base/nsCSSFrameConstructor.h
+++ b/layout/base/nsCSSFrameConstructor.h
@@ -1768,10 +1768,11 @@ private:
    * contexts and also handles unbinding undisplayed generated content
    * as needed.
    */
-  static void SetAsUndisplayedContent(FrameConstructionItemList& aList,
-                                      nsIContent* aContent,
-                                      nsStyleContext* aStyleContext,
-                                      bool aIsGeneratedContent);
+  void SetAsUndisplayedContent(nsFrameConstructorState& aState,
+                               FrameConstructionItemList& aList,
+                               nsIContent* aContent,
+                               nsStyleContext* aStyleContext,
+                               bool aIsGeneratedContent);
   // Create touch caret frame.
   void ConstructAnonymousContentForCanvas(nsFrameConstructorState& aState,
                                           nsIFrame* aFrame,
diff --git a/media/webrtc/trunk/build/common.gypi b/media/webrtc/trunk/build/common.gypi
index 51aedc4742e..5ecfcb068ec 100644
--- a/media/webrtc/trunk/build/common.gypi
+++ b/media/webrtc/trunk/build/common.gypi
@@ -428,7 +428,7 @@
         }],
 
         # Flags to use X11 on non-Mac POSIX platforms
-        ['OS=="win" or OS=="mac" or OS=="ios" or OS=="android"', {
+        ['OS=="win" or OS=="mac" or OS=="ios" or OS=="android" or moz_widget_toolkit_gonk==1', {
           'use_glib%': 0,
           'use_x11%': 0,
         }, {
diff --git a/media/webrtc/trunk/peerconnection.gyp b/media/webrtc/trunk/peerconnection.gyp
index ed6450b2b18..b235aba43ee 100644
--- a/media/webrtc/trunk/peerconnection.gyp
+++ b/media/webrtc/trunk/peerconnection.gyp
@@ -40,6 +40,13 @@
           'webrtc/video_engine/video_engine.gyp:video_engine_core',
           'webrtc/voice_engine/voice_engine.gyp:voice_engine',
         ],
+        'conditions': [
+          ['OS!="android"', {
+            'dependencies': [
+              'webrtc/modules/modules.gyp:desktop_capture',
+            ],
+          },
+         ]],
       }, ],
     ],
   }, ],
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer.cc
new file mode 100644
index 00000000000..ac4112c6f00
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer.cc
@@ -0,0 +1,21 @@
+/*
+*  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+*
+*  Use of this source code is governed by a BSD-style license
+*  that can be found in the LICENSE file in the root of the source
+*  tree. An additional intellectual property rights grant can be found
+*  in the file PATENTS.  All contributing project authors may
+*  be found in the AUTHORS file in the root of the source tree.
+*/
+
+#include "webrtc/modules/desktop_capture/app_capturer.h"
+#include "webrtc/modules/desktop_capture/desktop_capture_options.h"
+
+namespace webrtc {
+
+// static
+AppCapturer* AppCapturer::Create() {
+  return Create(DesktopCaptureOptions::CreateDefault());
+}
+
+}  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer.h b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer.h
new file mode 100644
index 00000000000..cc6a855911c
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer.h
@@ -0,0 +1,50 @@
+/*
+*  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+*
+*  Use of this source code is governed by a BSD-style license
+*  that can be found in the LICENSE file in the root of the source
+*  tree. An additional intellectual property rights grant can be found
+*  in the file PATENTS.  All contributing project authors may
+*  be found in the AUTHORS file in the root of the source tree.
+*/
+
+#ifndef WEBRTC_MODULES_DESKTOP_CAPTURE_APP_CAPTURER_H_
+#define WEBRTC_MODULES_DESKTOP_CAPTURE_APP_CAPTURER_H_
+
+#include <vector>
+#include <string>
+
+#include "webrtc/modules/desktop_capture/desktop_capture_types.h"
+#include "webrtc/modules/desktop_capture/desktop_capturer.h"
+#include "webrtc/system_wrappers/interface/constructor_magic.h"
+#include "webrtc/typedefs.h"
+
+namespace webrtc {
+
+class DesktopCaptureOptions;
+
+class AppCapturer : public DesktopCapturer {
+public:
+    typedef webrtc::ProcessId ProcessId;
+    struct App {
+        ProcessId id;
+        // Application Name in UTF-8 encoding.
+        std::string title;
+    };
+    typedef std::vector<App> AppList;
+
+    static AppCapturer* Create(const DesktopCaptureOptions& options);
+    static AppCapturer* Create();
+
+    virtual ~AppCapturer() {}
+
+    //AppCapturer Interfaces
+    virtual bool GetAppList(AppList* apps) = 0;
+    virtual bool SelectApp(ProcessId id) = 0;
+    virtual bool BringAppToFront() = 0;
+};
+
+}  // namespace webrtc
+
+#endif  // WEBRTC_MODULES_DESKTOP_CAPTURE_APP_CAPTURER_H_
+
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_mac.mm b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_mac.mm
new file mode 100644
index 00000000000..5ea6c52d55f
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_mac.mm
@@ -0,0 +1,90 @@
+/*
+ *  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "webrtc/modules/desktop_capture/window_capturer.h"
+#include "webrtc/modules/desktop_capture/app_capturer.h"
+
+#include <assert.h>
+#include <ApplicationServices/ApplicationServices.h>
+#include <Cocoa/Cocoa.h>
+#include <CoreFoundation/CoreFoundation.h>
+
+#include "webrtc/modules/desktop_capture/desktop_frame.h"
+#include "webrtc/system_wrappers/interface/logging.h"
+
+namespace webrtc {
+
+namespace {
+
+class AppCapturerMac : public AppCapturer {
+ public:
+  AppCapturerMac();
+  virtual ~AppCapturerMac();
+
+  // AppCapturer interface.
+  virtual bool GetAppList(AppList* apps) OVERRIDE;
+  virtual bool SelectApp(ProcessId id) OVERRIDE;
+  virtual bool BringAppToFront() OVERRIDE;
+
+  // DesktopCapturer interface.
+  virtual void Start(Callback* callback) OVERRIDE;
+  virtual void Capture(const DesktopRegion& region) OVERRIDE;
+
+ private:
+  Callback* callback_;
+  ProcessId process_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(AppCapturerMac);
+};
+
+AppCapturerMac::AppCapturerMac()
+  : callback_(NULL),
+    process_id_(0) {
+}
+
+AppCapturerMac::~AppCapturerMac() {
+}
+
+// AppCapturer interface.
+bool AppCapturerMac::GetAppList(AppList* apps){
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+
+bool AppCapturerMac::SelectApp(ProcessId id){
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+
+bool AppCapturerMac::BringAppToFront() {
+  // Not implemented yet: See Bug 1036653
+   return true;
+}
+
+// DesktopCapturer interface.
+void AppCapturerMac::Start(Callback* callback) {
+  assert(!callback_);
+  assert(callback);
+
+  callback_ = callback;
+}
+
+void AppCapturerMac::Capture(const DesktopRegion& region) {
+  // Not implemented yet: See Bug 1036653
+}
+
+}  // namespace
+
+// static
+AppCapturer* AppCapturer::Create(const DesktopCaptureOptions& options) {
+  return new AppCapturerMac();
+}
+
+}  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_null.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_null.cc
new file mode 100644
index 00000000000..59ac5d45fa0
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_null.cc
@@ -0,0 +1,83 @@
+/*
+*  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+*
+*  Use of this source code is governed by a BSD-style license
+*  that can be found in the LICENSE file in the root of the source
+*  tree. An additional intellectual property rights grant can be found
+*  in the file PATENTS.  All contributing project authors may
+*  be found in the AUTHORS file in the root of the source tree.
+*/
+#include "webrtc/modules/desktop_capture/window_capturer.h"
+#include "webrtc/modules/desktop_capture/app_capturer.h"
+
+#include <assert.h>
+
+#include "webrtc/modules/desktop_capture/desktop_frame.h"
+
+namespace webrtc {
+
+namespace {
+
+class AppCapturerNull : public AppCapturer {
+public:
+  AppCapturerNull();
+  virtual ~AppCapturerNull();
+
+  // AppCapturer interface.
+  virtual bool GetAppList(AppList* apps) OVERRIDE;
+  virtual bool SelectApp(ProcessId id) OVERRIDE;
+  virtual bool BringAppToFront()	OVERRIDE;
+
+  // DesktopCapturer interface.
+  virtual void Start(Callback* callback) OVERRIDE;
+  virtual void Capture(const DesktopRegion& region) OVERRIDE;
+
+private:
+  Callback* callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(AppCapturerNull);
+};
+
+AppCapturerNull::AppCapturerNull()
+  : callback_(NULL) {
+}
+
+AppCapturerNull::~AppCapturerNull() {
+}
+
+bool AppCapturerNull::GetAppList(AppList* apps) {
+  // Not implemented yet: See Bug 1036653
+  return false;
+}
+
+bool SelectApp(ProcessId id) {
+  // Not implemented yet: See Bug 1036653
+  return false;
+}
+
+bool BringAppToFront() {
+  // Not implemented yet: See Bug 1036653
+  return false;
+}
+
+// DesktopCapturer interface.
+void AppCapturerNull::Start(Callback* callback) {
+  assert(!callback_);
+  assert(callback);
+
+  callback_ = callback;
+}
+
+void AppCapturerNull::Capture(const DesktopRegion& region) {
+  // Not implemented yet: See Bug 1036653
+  callback_->OnCaptureCompleted(NULL);
+}
+
+}  // namespace
+
+// static
+AppCapturer* AppCapturer::Create(const DesktopCaptureOptions& options) {
+  return new AppCapturerNull();
+}
+
+}  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_unittest.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_unittest.cc
new file mode 100644
index 00000000000..88c1828e424
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_unittest.cc
@@ -0,0 +1,89 @@
+/*
+*  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+*
+*  Use of this source code is governed by a BSD-style license
+*  that can be found in the LICENSE file in the root of the source
+*  tree. An additional intellectual property rights grant can be found
+*  in the file PATENTS.  All contributing project authors may
+*  be found in the AUTHORS file in the root of the source tree.
+*/
+#include "webrtc/modules/desktop_capture/app_capturer.h"
+
+#include "gtest/gtest.h"
+#include "webrtc/modules/desktop_capture/desktop_capture_options.h"
+#include "webrtc/modules/desktop_capture/desktop_frame.h"
+#include "webrtc/modules/desktop_capture/desktop_region.h"
+#include "webrtc/system_wrappers/interface/logging.h"
+#include "webrtc/system_wrappers/interface/scoped_ptr.h"
+
+namespace webrtc {
+
+class AppCapturerTest : public testing::Test,
+                        public DesktopCapturer::Callback {
+public:
+  void SetUp() OVERRIDE {
+    capturer_.reset(
+      AppCapturer::Create(DesktopCaptureOptions::CreateDefault())
+    );
+  }
+
+  void TearDown() OVERRIDE {
+  }
+
+  // DesktopCapturer::Callback interface
+  virtual SharedMemory* CreateSharedMemory(size_t size) OVERRIDE {
+    return NULL;
+  }
+
+  virtual void OnCaptureCompleted(DesktopFrame* frame) OVERRIDE {
+    frame_.reset(frame);
+  }
+
+protected:
+  scoped_ptr<AppCapturer> capturer_;
+  scoped_ptr<DesktopFrame> frame_;
+};
+
+// Verify that we can enumerate applications.
+TEST_F(AppCapturerTest, Enumerate) {
+  AppCapturer::AppList apps;
+  EXPECT_TRUE(capturer_->GetAppList(&apps));
+
+  // Verify that window titles are set.
+  for (AppCapturer::AppList::iterator it = apps.begin();
+       it != windows.end(); ++it) {
+    EXPECT_FALSE(it->title.empty());
+  }
+}
+
+// Verify we can capture a app.
+TEST_F(AppCapturerTest, Capture) {
+  AppCapturer::AppList apps;
+  capturer_->Start(this);
+  EXPECT_TRUE(capturer_->GetAppList(&apps));
+
+  // Verify that we can select and capture each app.
+  for (AppCapturer::AppList::iterator it = apps.begin();
+       it != apps.end(); ++it) {
+    frame_.reset();
+    if (capturer_->SelectApp(it->id)) {
+      capturer_->Capture(DesktopRegion());
+    }
+
+    // If we failed to capture a window make sure it no longer exists.
+    if (!frame_.get()) {
+      AppCapturer::AppList new_list;
+      EXPECT_TRUE(capturer_->GetAppList(&new_list));
+      for (AppCapturer::AppList::iterator new_list_it = apps.begin();
+           new_list_it != apps.end(); ++new_list_it) {
+        EXPECT_FALSE(it->id == new_list_it->id);
+      }
+      continue;
+    }
+
+    EXPECT_GT(frame_->size().width(), 0);
+    EXPECT_GT(frame_->size().height(), 0);
+  }
+}
+
+}  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_win.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_win.cc
new file mode 100644
index 00000000000..1eafb308f19
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_win.cc
@@ -0,0 +1,103 @@
+/*
+*  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+*
+*  Use of this source code is governed by a BSD-style license
+*  that can be found in the LICENSE file in the root of the source
+*  tree. An additional intellectual property rights grant can be found
+*  in the file PATENTS.  All contributing project authors may
+*  be found in the AUTHORS file in the root of the source tree.
+*/
+#include "webrtc/modules/desktop_capture/window_capturer.h"
+#include "webrtc/modules/desktop_capture/app_capturer.h"
+
+#include <assert.h>
+#include <windows.h>
+
+#include "webrtc/modules/desktop_capture/desktop_frame_win.h"
+#include "webrtc/system_wrappers/interface/logging.h"
+#include "webrtc/system_wrappers/interface/scoped_ptr.h"
+
+namespace webrtc {
+
+namespace {
+
+std::string Utf16ToUtf8(const WCHAR* str) {
+  int len_utf8 = WideCharToMultiByte(CP_UTF8, 0, str, -1,
+                                     NULL, 0, NULL, NULL);
+  if (len_utf8 <= 0)
+    return std::string();
+  std::string result(len_utf8, '\0');
+  int rv = WideCharToMultiByte(CP_UTF8, 0, str, -1,
+                               &*(result.begin()), len_utf8, NULL, NULL);
+  if (rv != len_utf8)
+    assert(false);
+
+  return result;
+}
+
+
+class AppCapturerWin : public AppCapturer {
+public:
+  AppCapturerWin();
+  virtual ~AppCapturerWin();
+
+  // AppCapturer interface.
+  virtual bool GetAppList(AppList* apps) OVERRIDE;
+  virtual bool SelectApp(ProcessId id) OVERRIDE;
+  virtual bool BringAppToFront() OVERRIDE;
+
+  // DesktopCapturer interface.
+  virtual void Start(Callback* callback) OVERRIDE;
+  virtual void Capture(const DesktopRegion& region) OVERRIDE;
+
+private:
+  Callback* callback_;
+
+  ProcessId processId_;
+
+  DISALLOW_COPY_AND_ASSIGN(AppCapturerWin);
+};
+
+AppCapturerWin::AppCapturerWin()
+  : callback_(NULL),
+    processId_(NULL) {
+}
+
+AppCapturerWin::~AppCapturerWin() {
+}
+
+// AppCapturer interface.
+bool AppCapturerWin::GetAppList(AppList* apps){
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+
+bool AppCapturerWin::SelectApp(ProcessId id) {
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+
+bool AppCapturerWin::BringAppToFront() {
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+
+// DesktopCapturer interface.
+void AppCapturerWin::Start(Callback* callback) {
+  assert(!callback_);
+  assert(callback);
+
+  callback_ = callback;
+}
+void AppCapturerWin::Capture(const DesktopRegion& region) {
+  // Not implemented yet: See Bug 1036653
+}
+
+}  // namespace
+
+// static
+AppCapturer* AppCapturer::Create(const DesktopCaptureOptions& options) {
+  return new AppCapturerWin();
+}
+
+}  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_x11.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_x11.cc
new file mode 100644
index 00000000000..29276e4f42a
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/app_capturer_x11.cc
@@ -0,0 +1,99 @@
+/*
+*  Copyright (c) 2013 The WebRTC project authors. All Rights Reserved.
+*
+*  Use of this source code is governed by a BSD-style license
+*  that can be found in the LICENSE file in the root of the source
+*  tree. An additional intellectual property rights grant can be found
+*  in the file PATENTS.  All contributing project authors may
+*  be found in the AUTHORS file in the root of the source tree.
+*/
+#include "webrtc/modules/desktop_capture/window_capturer.h"
+#include "webrtc/modules/desktop_capture/app_capturer.h"
+
+#include <assert.h>
+#include <string.h>
+#include <X11/Xatom.h>
+#include <X11/extensions/Xcomposite.h>
+#include <X11/extensions/Xrender.h>
+#include <X11/Xutil.h>
+
+#include <algorithm>
+
+#include "webrtc/modules/desktop_capture/desktop_capture_options.h"
+#include "webrtc/modules/desktop_capture/desktop_frame.h"
+#include "webrtc/modules/desktop_capture/x11/shared_x_display.h"
+#include "webrtc/modules/desktop_capture/x11/x_error_trap.h"
+#include "webrtc/modules/desktop_capture/x11/x_server_pixel_buffer.h"
+#include "webrtc/system_wrappers/interface/logging.h"
+#include "webrtc/system_wrappers/interface/scoped_ptr.h"
+#include "webrtc/system_wrappers/interface/scoped_refptr.h"
+
+namespace webrtc {
+
+namespace {
+
+
+class AppCapturerLinux : public AppCapturer{
+public:
+  AppCapturerLinux(const DesktopCaptureOptions& options);
+  virtual ~AppCapturerLinux();
+
+  // AppCapturer interface.
+  virtual bool GetAppList(AppList* apps) OVERRIDE;
+  virtual bool SelectApp(ProcessId id) OVERRIDE;
+  virtual bool BringAppToFront() OVERRIDE;
+
+  // DesktopCapturer interface.
+  virtual void Start(Callback* callback) OVERRIDE;
+  virtual void Capture(const DesktopRegion& region) OVERRIDE;
+
+
+private:
+  Callback* callback_;
+  ProcessId selected_process_;
+
+  DISALLOW_COPY_AND_ASSIGN(AppCapturerLinux);
+};
+
+AppCapturerLinux::AppCapturerLinux(const DesktopCaptureOptions& options)
+  : callback_(NULL),
+    selected_process_(0) {
+}
+
+AppCapturerLinux::~AppCapturerLinux() {
+}
+
+// AppCapturer interface.
+bool AppCapturerLinux::GetAppList(AppList* apps){
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+bool AppCapturerLinux::SelectApp(ProcessId id){
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+bool AppCapturerLinux::BringAppToFront(){
+  // Not implemented yet: See Bug 1036653
+  return true;
+}
+
+// DesktopCapturer interface.
+void AppCapturerLinux::Start(Callback* callback) {
+  assert(!callback_);
+  assert(callback);
+
+  callback_ = callback;
+}
+
+void AppCapturerLinux::Capture(const DesktopRegion& region) {
+  // Not implemented yet: See Bug 1036653
+}
+
+}  // namespace
+
+// static
+AppCapturer* AppCapturer::Create(const DesktopCaptureOptions& options) {
+  return new AppCapturerLinux(options);
+}
+
+}  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture.gypi b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture.gypi
index 9463257ce99..6ef055ed889 100644
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture.gypi
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture.gypi
@@ -7,6 +7,9 @@
 # be found in the AUTHORS file in the root of the source tree.
 
 {
+  'variables': {
+    'multi_monitor_screenshare%' : 0,
+  },
   'targets': [
     {
       'target_name': 'desktop_capture',
@@ -21,8 +24,6 @@
         "desktop_capturer.h",
         "desktop_frame.cc",
         "desktop_frame.h",
-        "desktop_frame_win.cc",
-        "desktop_frame_win.h",
         "desktop_geometry.cc",
         "desktop_geometry.h",
         "desktop_capture_options.h",
@@ -34,20 +35,9 @@
         "differ.h",
         "differ_block.cc",
         "differ_block.h",
-        "mac/desktop_configuration.h",
-        "mac/desktop_configuration.mm",
-        "mac/desktop_configuration_monitor.h",
-        "mac/desktop_configuration_monitor.cc",
-        "mac/osx_version.h",
-        "mac/osx_version.cc",
-        "mac/scoped_pixel_buffer_object.cc",
-        "mac/scoped_pixel_buffer_object.h",
         "mouse_cursor.cc",
         "mouse_cursor.h",
         "mouse_cursor_monitor.h",
-        "mouse_cursor_monitor_mac.mm",
-        "mouse_cursor_monitor_win.cc",
-        "mouse_cursor_monitor_x11.cc",
         "mouse_cursor_shape.h",
         "screen_capture_frame_queue.cc",
         "screen_capture_frame_queue.h",
@@ -55,39 +45,46 @@
         "screen_capturer.h",
         "screen_capturer_helper.cc",
         "screen_capturer_helper.h",
-        "screen_capturer_mac.mm",
-        "screen_capturer_win.cc",
-        "screen_capturer_x11.cc",
         "shared_desktop_frame.cc",
         "shared_desktop_frame.h",
         "shared_memory.cc",
         "shared_memory.h",
-        "win/cursor.cc",
-        "win/cursor.h",
-        "win/desktop.cc",
-        "win/desktop.h",
-        "win/scoped_gdi_object.h",
-        "win/scoped_thread_desktop.cc",
-        "win/scoped_thread_desktop.h",
         "window_capturer.cc",
         "window_capturer.h",
-        "window_capturer_mac.cc",
-        "window_capturer_win.cc",
-        "window_capturer_x11.cc",
-        "x11/shared_x_display.h",
-        "x11/shared_x_display.cc",
-        "x11/x_error_trap.cc",
-        "x11/x_error_trap.h",
-        "x11/x_server_pixel_buffer.cc",
-        "x11/x_server_pixel_buffer.h",
+        "desktop_device_info.h",
+        "desktop_device_info.cc",
+        "app_capturer.h",
+        "app_capturer.cc",
       ],
       'conditions': [
+        ['multi_monitor_screenshare != 0', {
+          'defines': [
+            'MULTI_MONITOR_SCREENSHARE'
+          ],
+        }],
         ['OS!="ios" and (target_arch=="ia32" or target_arch=="x64")', {
           'dependencies': [
             'desktop_capture_differ_sse2',
           ],
         }],
         ['use_x11 == 1', {
+          'defines':[
+            'USE_X11',
+          ],
+          'sources': [
+            "mouse_cursor_monitor_x11.cc",
+            "screen_capturer_x11.cc",
+            "window_capturer_x11.cc",
+            "x11/shared_x_display.h",
+            "x11/shared_x_display.cc",
+            "x11/x_error_trap.cc",
+            "x11/x_error_trap.h",
+            "x11/x_server_pixel_buffer.cc",
+            "x11/x_server_pixel_buffer.h",
+            "x11/desktop_device_info_x11.h",
+            "x11/desktop_device_info_x11.cc",
+            "app_capturer_x11.cc",
+          ],
           'link_settings': {
             'libraries': [
               '-lX11',
@@ -107,6 +104,22 @@
           ],
         }],
         ['OS=="mac"', {
+          'sources': [
+            "mac/desktop_configuration.h",
+            "mac/desktop_configuration.mm",
+            "mac/desktop_configuration_monitor.h",
+            "mac/desktop_configuration_monitor.cc",
+            "mac/osx_version.h",
+            "mac/osx_version.cc",
+            "mac/scoped_pixel_buffer_object.cc",
+            "mac/scoped_pixel_buffer_object.h",
+            "mac/desktop_device_info_mac.h",
+            "mac/desktop_device_info_mac.mm",
+            "mouse_cursor_monitor_mac.mm",
+            "screen_capturer_mac.mm",
+            "window_capturer_mac.mm",
+            "app_capturer_mac.mm",
+          ],
           'link_settings': {
             'libraries': [
               '$(SDKROOT)/System/Library/Frameworks/AppKit.framework',
@@ -115,6 +128,25 @@
             ],
           },
         }],
+        ['OS=="win"', {
+           'sources': [
+             "desktop_frame_win.cc",
+             "desktop_frame_win.h",
+             "mouse_cursor_monitor_win.cc",
+             "screen_capturer_win.cc",
+             "win/cursor.cc",
+             "win/cursor.h",
+             "win/desktop.cc",
+             "win/desktop.h",
+             "win/scoped_gdi_object.h",
+             "win/scoped_thread_desktop.cc",
+             "win/scoped_thread_desktop.h",
+             "win/desktop_device_info_win.h",
+             "win/desktop_device_info_win.cc",
+             "window_capturer_win.cc",
+             "app_capturer_win.cc",
+           ],
+          }],
       ],
     },
   ],  # targets
@@ -132,9 +164,8 @@
           ],
           'conditions': [
             [ 'os_posix == 1 and OS != "mac"', {
-              'cflags': [
-                '-msse2',
-              ],
+              'cflags': [ '-msse2', ],
+              'cflags_mozilla': [ '-msse2', ],
             }],
           ],
         },
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture_types.h b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture_types.h
index 3e417965531..a7a2735f9ae 100644
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture_types.h
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture_types.h
@@ -37,6 +37,10 @@ const ScreenId kFullDesktopScreenId = -1;
 
 const ScreenId kInvalidScreenId = -2;
 
+
+typedef intptr_t ProcessId;
+const ProcessId DesktopProcessId = 0;
+
 }  // namespace webrtc
 
 #endif  // WEBRTC_MODULES_DESKTOP_CAPTURE_DESKTOP_CAPTURE_TYPES_H_
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.cc
new file mode 100644
index 00000000000..2a69530ba54
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.cc
@@ -0,0 +1,199 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "webrtc/modules/desktop_capture/desktop_device_info.h"
+
+#include <cstddef>
+#include <cstring>
+
+namespace webrtc {
+
+static inline void SetStringMember(char **member, const char *value) {
+  if (!value) {
+    return;
+  }
+
+  if (*member) {
+    delete [] *member;
+    *member = NULL;
+  }
+
+  size_t  nBufLen = strlen(value) + 1;
+  char *buffer = new char[nBufLen];
+  memcpy(buffer, value, nBufLen - 1);
+  buffer[nBufLen - 1] = '\0';
+  *member = buffer;
+}
+
+DesktopDisplayDevice::DesktopDisplayDevice() {
+  screenId_ = kInvalidScreenId;
+  deviceUniqueIdUTF8_ = NULL;
+  deviceNameUTF8_ = NULL;
+}
+
+DesktopDisplayDevice::~DesktopDisplayDevice() {
+  screenId_ = kInvalidScreenId;
+
+  if (deviceUniqueIdUTF8_){
+    delete [] deviceUniqueIdUTF8_;
+  }
+
+  if (deviceNameUTF8_){
+    delete [] deviceNameUTF8_;
+  }
+
+  deviceUniqueIdUTF8_ = NULL;
+  deviceNameUTF8_ = NULL;
+}
+
+void DesktopDisplayDevice::setScreenId(const ScreenId screenId) {
+  screenId_ = screenId;
+}
+
+void DesktopDisplayDevice::setDeviceName(const char *deviceNameUTF8) {
+  SetStringMember(&deviceNameUTF8_, deviceNameUTF8);
+}
+
+void DesktopDisplayDevice::setUniqueIdName(const char *deviceUniqueIdUTF8) {
+  SetStringMember(&deviceUniqueIdUTF8_, deviceUniqueIdUTF8);
+}
+
+ScreenId DesktopDisplayDevice::getScreenId() {
+  return screenId_;
+}
+
+const char *DesktopDisplayDevice::getDeviceName() {
+  return deviceNameUTF8_;
+}
+
+const char *DesktopDisplayDevice::getUniqueIdName() {
+  return deviceUniqueIdUTF8_;
+}
+
+DesktopDisplayDevice& DesktopDisplayDevice::operator= (DesktopDisplayDevice& other) {
+  screenId_ = other.getScreenId();
+  setUniqueIdName(other.getUniqueIdName());
+  setDeviceName(other.getDeviceName());
+
+  return *this;
+}
+
+
+DesktopApplication::DesktopApplication() {
+  processId_ =0;
+  processPathNameUTF8_= NULL;
+  applicationNameUTF8_= NULL;
+  processUniqueIdUTF8_= NULL;
+}
+
+DesktopApplication::~DesktopApplication() {
+}
+
+void DesktopApplication::setProcessId(const ProcessId processId) {
+  processId_ = processId;
+}
+
+void DesktopApplication::setProcessPathName(const char *appPathNameUTF8) {
+  SetStringMember(&processPathNameUTF8_, appPathNameUTF8);
+}
+
+void DesktopApplication::setUniqueIdName(const char *appUniqueIdUTF8) {
+  SetStringMember(&processPathNameUTF8_, appUniqueIdUTF8);
+}
+
+void DesktopApplication::setProcessAppName(const char *appNameUTF8) {
+  SetStringMember(&applicationNameUTF8_, appNameUTF8);
+}
+
+ProcessId DesktopApplication::getProcessId() {
+  return processId_;
+}
+
+const char *DesktopApplication::getProcessPathName() {
+  return processPathNameUTF8_;
+}
+
+const char *DesktopApplication::getUniqueIdName() {
+  return applicationNameUTF8_;
+}
+
+const char *DesktopApplication::getProcessAppName() {
+  return applicationNameUTF8_;
+}
+
+DesktopApplication& DesktopApplication::operator= (DesktopApplication& other) {
+  processId_ = other.getProcessId();
+  setProcessPathName(other.getProcessPathName());
+  setUniqueIdName(other.getUniqueIdName());
+  setProcessAppName(other.getProcessAppName());
+
+  return *this;
+}
+
+DesktopDeviceInfoImpl::DesktopDeviceInfoImpl() {
+}
+
+DesktopDeviceInfoImpl::~DesktopDeviceInfoImpl() {
+  std::map<intptr_t,DesktopDisplayDevice*>::iterator iterDevice;
+  for (iterDevice=desktop_display_list_.begin(); iterDevice!=desktop_display_list_.end(); iterDevice++){
+    DesktopDisplayDevice * pDesktopDisplayDevice = iterDevice->second;
+    if (pDesktopDisplayDevice) {
+      delete pDesktopDisplayDevice;
+    }
+    iterDevice->second = NULL;
+  }
+  desktop_display_list_.clear();
+
+  std::map<intptr_t,DesktopApplication*>::iterator iterApp;
+  for (iterApp=desktop_application_list_.begin(); iterApp!=desktop_application_list_.end(); iterApp++){
+    DesktopApplication * pDesktopApplication = iterApp->second;
+    if (pDesktopApplication) {
+      delete pDesktopApplication;
+    }
+    iterApp->second = NULL;
+  }
+  desktop_application_list_.clear();
+}
+
+int32_t DesktopDeviceInfoImpl::getDisplayDeviceCount() {
+  return desktop_display_list_.size();
+}
+
+int32_t DesktopDeviceInfoImpl::getDesktopDisplayDeviceInfo(int32_t nIndex,
+                                                           DesktopDisplayDevice & desktopDisplayDevice) {
+  if(nIndex < 0 || nIndex >= desktop_display_list_.size()) {
+    return -1;
+  }
+
+  std::map<intptr_t,DesktopDisplayDevice*>::iterator iter = desktop_display_list_.begin();
+  std::advance (iter, nIndex);
+  DesktopDisplayDevice * pDesktopDisplayDevice = iter->second;
+  if(pDesktopDisplayDevice) {
+    desktopDisplayDevice = (*pDesktopDisplayDevice);
+  }
+
+  return 0;
+}
+
+int32_t DesktopDeviceInfoImpl::getApplicationCount() {
+  return desktop_application_list_.size();
+}
+
+int32_t DesktopDeviceInfoImpl::getApplicationInfo(int32_t nIndex,
+                                                  DesktopApplication & desktopApplication) {
+  if(nIndex < 0 || nIndex >= desktop_application_list_.size()) {
+    return -1;
+  }
+
+  std::map<intptr_t,DesktopApplication*>::iterator iter = desktop_application_list_.begin();
+  std::advance (iter, nIndex);
+  DesktopApplication * pDesktopApplication = iter->second;
+  if (pDesktopApplication) {
+    desktopApplication = (*pDesktopApplication);
+  }
+
+  return 0;
+}
+
+}
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.h b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.h
new file mode 100644
index 00000000000..b6245dc4400
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_device_info.h
@@ -0,0 +1,95 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef WEBRTC_MODULES_DESKTOP_CAPTURE_DEVICE_INFO_H_
+#define WEBRTC_MODULES_DESKTOP_CAPTURE_DEVICE_INFO_H_
+
+#include <map>
+#include "webrtc/modules/desktop_capture/desktop_capture_types.h"
+
+namespace webrtc {
+
+class DesktopDisplayDevice {
+public:
+  DesktopDisplayDevice();
+  ~DesktopDisplayDevice();
+
+  void setScreenId(const ScreenId screenId);
+  void setDeviceName(const char *deviceNameUTF8);
+  void setUniqueIdName(const char *deviceUniqueIdUTF8);
+
+  ScreenId getScreenId();
+  const char *getDeviceName();
+  const char *getUniqueIdName();
+
+  DesktopDisplayDevice& operator= (DesktopDisplayDevice& other);
+
+protected:
+  ScreenId screenId_;
+  char* deviceNameUTF8_;
+  char* deviceUniqueIdUTF8_;
+};
+
+typedef std::map<intptr_t,DesktopDisplayDevice*> DesktopDisplayDeviceList;
+
+class DesktopApplication {
+public:
+  DesktopApplication();
+  ~DesktopApplication();
+
+  void setProcessId(const ProcessId processId);
+  void setProcessPathName(const char *appPathNameUTF8);
+  void setUniqueIdName(const char *appUniqueIdUTF8);
+  void setProcessAppName(const char *appNameUTF8);
+
+  ProcessId getProcessId();
+  const char *getProcessPathName();
+  const char *getUniqueIdName();
+  const char *getProcessAppName();
+
+  DesktopApplication& operator= (DesktopApplication& other);
+
+protected:
+  ProcessId processId_;
+  char* processPathNameUTF8_;
+  char* applicationNameUTF8_;
+  char* processUniqueIdUTF8_;
+};
+
+typedef std::map<intptr_t,DesktopApplication*> DesktopApplicationList;
+
+class DesktopDeviceInfo {
+public:
+  virtual ~DesktopDeviceInfo() {};
+
+  virtual int32_t Init() = 0;
+  virtual int32_t getDisplayDeviceCount() = 0;
+  virtual int32_t getDesktopDisplayDeviceInfo(int32_t nIndex,
+                                              DesktopDisplayDevice & desktopDisplayDevice) = 0;
+  virtual int32_t getApplicationCount() = 0;
+  virtual int32_t getApplicationInfo(int32_t nIndex,
+                                     DesktopApplication & desktopApplication) = 0;
+};
+
+class DesktopDeviceInfoImpl : public DesktopDeviceInfo {
+public:
+  DesktopDeviceInfoImpl();
+  ~DesktopDeviceInfoImpl();
+
+  virtual int32_t getDisplayDeviceCount();
+  virtual int32_t getDesktopDisplayDeviceInfo(int32_t nIndex,
+                                              DesktopDisplayDevice & desktopDisplayDevice);
+  virtual int32_t getApplicationCount();
+  virtual int32_t getApplicationInfo(int32_t nIndex,
+                                     DesktopApplication & desktopApplication);
+
+  static DesktopDeviceInfo * Create();
+
+protected:
+  DesktopDisplayDeviceList desktop_display_list_;
+  DesktopApplicationList desktop_application_list_;
+};
+};
+
+#endif
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/mac/desktop_device_info_mac.h b/media/webrtc/trunk/webrtc/modules/desktop_capture/mac/desktop_device_info_mac.h
new file mode 100644
index 00000000000..af198506d09
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/mac/desktop_device_info_mac.h
@@ -0,0 +1,24 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef WEBRTC_MODULES_DESKTOP_CAPTURE_MAC_DEVICE_INFO_H_
+#define WEBRTC_MODULES_DESKTOP_CAPTURE_MAC_DEVICE_INFO_H_
+
+#include "webrtc/typedefs.h"
+#include "webrtc/modules/desktop_capture/desktop_device_info.h"
+
+namespace webrtc {
+
+class DesktopDeviceInfoMac : public DesktopDeviceInfoImpl {
+public:
+  DesktopDeviceInfoMac();
+  ~DesktopDeviceInfoMac();
+
+  //DesktopDeviceInfo Interfaces
+  virtual int32_t Init();
+};
+
+}// namespace webrtc
+
+#endif //WEBRTC_MODULES_DESKTOP_CAPTURE_MAC_DEVICE_INFO_H_
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/mac/desktop_device_info_mac.mm b/media/webrtc/trunk/webrtc/modules/desktop_capture/mac/desktop_device_info_mac.mm
new file mode 100644
index 00000000000..6751552e4f3
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/mac/desktop_device_info_mac.mm
@@ -0,0 +1,40 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "webrtc/modules/desktop_capture/mac/desktop_device_info_mac.h"
+#include <Cocoa/Cocoa.h>
+
+namespace webrtc {
+
+#define MULTI_MONITOR_NO_SUPPORT 1
+
+DesktopDeviceInfo * DesktopDeviceInfoImpl::Create() {
+  DesktopDeviceInfoMac * pDesktopDeviceInfo = new DesktopDeviceInfoMac();
+  if (pDesktopDeviceInfo && pDesktopDeviceInfo->Init() != 0){
+    delete pDesktopDeviceInfo;
+    pDesktopDeviceInfo = NULL;
+  }
+  return pDesktopDeviceInfo;
+}
+
+DesktopDeviceInfoMac::DesktopDeviceInfoMac() {
+}
+
+DesktopDeviceInfoMac::~DesktopDeviceInfoMac() {
+}
+
+int32_t DesktopDeviceInfoMac::Init() {
+#if !defined(MULTI_MONITOR_SCREENSHARE)
+  DesktopDisplayDevice *pDesktopDeviceInfo = new DesktopDisplayDevice;
+  if(pDesktopDeviceInfo) {
+    pDesktopDeviceInfo->setScreenId(0);
+    pDesktopDeviceInfo->setDeviceName("Primary Monitor");
+    pDesktopDeviceInfo->setUniqueIdName("\\screen\\monitor#1");
+    desktop_display_list_[pDesktopDeviceInfo->getScreenId()] = pDesktopDeviceInfo;
+  }
+#endif
+  return 0;
+}
+
+} //namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_win.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_win.cc
index d45e69bb169..db0a57c0334 100644
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_win.cc
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/screen_capturer_win.cc
@@ -188,7 +188,8 @@ void ScreenCapturerWin::Capture(const DesktopRegion& region) {
                              &region);
     helper_.InvalidateRegion(region);
   } else {
-    // No previous frame is available. Invalidate the whole screen.
+    // No previous frame is available, or the screen is resized. Invalidate the
+    // whole screen.
     helper_.InvalidateScreen(current_frame->size());
   }
 
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/win/desktop_device_info_win.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/win/desktop_device_info_win.cc
new file mode 100644
index 00000000000..49983bb9db2
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/win/desktop_device_info_win.cc
@@ -0,0 +1,38 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "webrtc/modules/desktop_capture/win/desktop_device_info_win.h"
+
+namespace webrtc{
+
+DesktopDeviceInfo * DesktopDeviceInfoImpl::Create() {
+  DesktopDeviceInfoWin * pDesktopDeviceInfo = new DesktopDeviceInfoWin();
+  if(pDesktopDeviceInfo && pDesktopDeviceInfo->Init() != 0){
+    delete pDesktopDeviceInfo;
+    pDesktopDeviceInfo = NULL;
+  }
+  return pDesktopDeviceInfo;
+}
+
+DesktopDeviceInfoWin::DesktopDeviceInfoWin() {
+}
+
+DesktopDeviceInfoWin::~DesktopDeviceInfoWin() {
+}
+
+int32_t DesktopDeviceInfoWin::Init() {
+#if !defined(MULTI_MONITOR_SCREENSHARE)
+  DesktopDisplayDevice *pDesktopDeviceInfo = new DesktopDisplayDevice;
+  if (pDesktopDeviceInfo) {
+    pDesktopDeviceInfo->setScreenId(0);
+    pDesktopDeviceInfo->setDeviceName("Primary Monitor");
+    pDesktopDeviceInfo->setUniqueIdName("\\screen\\monitor#1");
+
+    desktop_display_list_[pDesktopDeviceInfo->getScreenId()] = pDesktopDeviceInfo;
+  }
+#endif
+  return 0;
+}
+
+} //namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/win/desktop_device_info_win.h b/media/webrtc/trunk/webrtc/modules/desktop_capture/win/desktop_device_info_win.h
new file mode 100644
index 00000000000..e64f236af8c
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/win/desktop_device_info_win.h
@@ -0,0 +1,24 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef WEBRTC_MODULES_DESKTOP_CAPTURE_WIN_DEVICE_INFO_H_
+#define WEBRTC_MODULES_DESKTOP_CAPTURE_WIN_DEVICE_INFO_H_
+
+#include "webrtc/typedefs.h"
+#include "webrtc/modules/desktop_capture/desktop_device_info.h"
+
+namespace webrtc {
+
+class DesktopDeviceInfoWin : public DesktopDeviceInfoImpl {
+public:
+  DesktopDeviceInfoWin();
+  ~DesktopDeviceInfoWin();
+
+  //DesktopDeviceInfo Interfaces
+  virtual int32_t Init();
+};
+
+}// namespace webrtc
+
+#endif //WEBRTC_MODULES_DESKTOP_CAPTURE_WIN_DEVICE_INFO_H_
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer.h b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer.h
index 478c8ee99c3..86b3d19bfd2 100644
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer.h
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer.h
@@ -49,6 +49,14 @@ class WindowCapturer : public DesktopCapturer {
   // Select window to be captured. Returns false in case of a failure (e.g. if
   // there is no window with the specified id).
   virtual bool SelectWindow(WindowId id) = 0;
+
+  // Bring the selected window to the front. Returns false in case of a
+  // failure or no window selected.
+  // TODO(jiayl): remove the default impl when FakeWindowCapturer is updated in
+  // Chromium.
+  virtual bool BringSelectedWindowToFront() {
+    return true;
+  }
 };
 
 }  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_mac.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_mac.mm
old mode 100755
new mode 100644
similarity index 81%
rename from media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_mac.cc
rename to media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_mac.mm
index 6268fc01156..8fdbdc8d894
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_mac.cc
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_mac.mm
@@ -12,6 +12,7 @@
 
 #include <assert.h>
 #include <ApplicationServices/ApplicationServices.h>
+#include <Cocoa/Cocoa.h>
 #include <CoreFoundation/CoreFoundation.h>
 
 #include "webrtc/modules/desktop_capture/desktop_frame.h"
@@ -49,6 +50,7 @@ class WindowCapturerMac : public WindowCapturer {
   // WindowCapturer interface.
   virtual bool GetWindowList(WindowList* windows) OVERRIDE;
   virtual bool SelectWindow(WindowId id) OVERRIDE;
+  virtual bool BringSelectedWindowToFront() OVERRIDE;
 
   // DesktopCapturer interface.
   virtual void Start(Callback* callback) OVERRIDE;
@@ -133,6 +135,43 @@ bool WindowCapturerMac::SelectWindow(WindowId id) {
   return true;
 }
 
+bool WindowCapturerMac::BringSelectedWindowToFront() {
+  if (!window_id_)
+    return false;
+
+  CGWindowID ids[1];
+  ids[0] = window_id_;
+  CFArrayRef window_id_array =
+      CFArrayCreate(NULL, reinterpret_cast<const void **>(&ids), 1, NULL);
+
+  CFArrayRef window_array =
+      CGWindowListCreateDescriptionFromArray(window_id_array);
+  if (window_array == NULL || 0 == CFArrayGetCount(window_array)) {
+    // Could not find the window. It might have been closed.
+    LOG(LS_INFO) << "Window not found";
+    CFRelease(window_id_array);
+    return false;
+  }
+
+  CFDictionaryRef window = reinterpret_cast<CFDictionaryRef>(
+      CFArrayGetValueAtIndex(window_array, 0));
+  CFNumberRef pid_ref = reinterpret_cast<CFNumberRef>(
+      CFDictionaryGetValue(window, kCGWindowOwnerPID));
+
+  int pid;
+  CFNumberGetValue(pid_ref, kCFNumberIntType, &pid);
+
+  // TODO(jiayl): this will bring the process main window to the front. We
+  // should find a way to bring only the window to the front.
+  bool result =
+      [[NSRunningApplication runningApplicationWithProcessIdentifier: pid]
+          activateWithOptions: NSApplicationActivateIgnoringOtherApps];
+
+  CFRelease(window_id_array);
+  CFRelease(window_array);
+  return result;
+}
+
 void WindowCapturerMac::Start(Callback* callback) {
   assert(!callback_);
   assert(callback);
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_null.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_null.cc
index 7bb1247ea9d..5f9010d2fd3 100755
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_null.cc
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_null.cc
@@ -26,6 +26,7 @@ class WindowCapturerNull : public WindowCapturer {
   // WindowCapturer interface.
   virtual bool GetWindowList(WindowList* windows) OVERRIDE;
   virtual bool SelectWindow(WindowId id) OVERRIDE;
+  virtual bool BringSelectedWindowToFront() OVERRIDE;
 
   // DesktopCapturer interface.
   virtual void Start(Callback* callback) OVERRIDE;
@@ -54,6 +55,11 @@ bool WindowCapturerNull::SelectWindow(WindowId id) {
   return false;
 }
 
+bool WindowCapturerNull::BringSelectedWindowToFront() {
+  // Not implemented yet.
+  return false;
+}
+
 void WindowCapturerNull::Start(Callback* callback) {
   assert(!callback_);
   assert(callback);
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_win.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_win.cc
index d65c625ea28..97a15dd9a06 100644
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_win.cc
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_win.cc
@@ -89,6 +89,7 @@ class WindowCapturerWin : public WindowCapturer {
   // WindowCapturer interface.
   virtual bool GetWindowList(WindowList* windows) OVERRIDE;
   virtual bool SelectWindow(WindowId id) OVERRIDE;
+  virtual bool BringSelectedWindowToFront() OVERRIDE;
 
   // DesktopCapturer interface.
   virtual void Start(Callback* callback) OVERRIDE;
@@ -157,6 +158,16 @@ bool WindowCapturerWin::SelectWindow(WindowId id) {
   return true;
 }
 
+bool WindowCapturerWin::BringSelectedWindowToFront() {
+  if (!window_)
+    return false;
+
+  if (!IsWindow(window_) || !IsWindowVisible(window_) || IsIconic(window_))
+    return false;
+
+  return SetForegroundWindow(window_) != 0;
+}
+
 void WindowCapturerWin::Start(Callback* callback) {
   assert(!callback_);
   assert(callback);
@@ -217,11 +228,11 @@ void WindowCapturerWin::Capture(const DesktopRegion& region) {
   // When composition is enabled the DC returned by GetWindowDC() doesn't always
   // have window frame rendered correctly. Windows renders it only once and then
   // caches the result between captures. We hack it around by calling
-  // PrintWindow() whenever window size changes - it somehow affects what we
-  // get from BitBlt() on the subsequent captures.
+  // PrintWindow() whenever window size changes, including the first time of
+  // capturing - it somehow affects what we get from BitBlt() on the subsequent
+  // captures.
 
-  if (!IsAeroEnabled() ||
-      (!previous_size_.is_empty() && !previous_size_.equals(frame->size()))) {
+  if (!IsAeroEnabled() || !previous_size_.equals(frame->size())) {
     result = PrintWindow(window_, mem_dc, 0);
   }
 
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_x11.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_x11.cc
index 5a14356fd16..e83ebb06f67 100755
--- a/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_x11.cc
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/window_capturer_x11.cc
@@ -15,6 +15,7 @@
 #include <X11/extensions/Xcomposite.h>
 #include <X11/extensions/Xrender.h>
 #include <X11/Xutil.h>
+
 #include <algorithm>
 #include <cassert>
 
@@ -84,7 +85,8 @@ class XWindowProperty {
   DISALLOW_COPY_AND_ASSIGN(XWindowProperty);
 };
 
-class WindowCapturerLinux : public WindowCapturer {
+class WindowCapturerLinux : public WindowCapturer,
+                            public SharedXDisplay::XEventHandler {
  public:
   WindowCapturerLinux(const DesktopCaptureOptions& options);
   virtual ~WindowCapturerLinux();
@@ -92,11 +94,15 @@ class WindowCapturerLinux : public WindowCapturer {
   // WindowCapturer interface.
   virtual bool GetWindowList(WindowList* windows) OVERRIDE;
   virtual bool SelectWindow(WindowId id) OVERRIDE;
+  virtual bool BringSelectedWindowToFront() OVERRIDE;
 
   // DesktopCapturer interface.
   virtual void Start(Callback* callback) OVERRIDE;
   virtual void Capture(const DesktopRegion& region) OVERRIDE;
 
+  // SharedXDisplay::XEventHandler interface.
+  virtual bool HandleXEvent(const XEvent& event) OVERRIDE;
+
  private:
   Display* display() { return x_display_->display(); }
 
@@ -146,9 +152,13 @@ WindowCapturerLinux::WindowCapturerLinux(const DesktopCaptureOptions& options)
   } else {
     LOG(LS_INFO) << "Xcomposite extension not available or too old.";
   }
+
+  x_display_->AddEventHandler(ConfigureNotify, this);
 }
 
-WindowCapturerLinux::~WindowCapturerLinux() {}
+WindowCapturerLinux::~WindowCapturerLinux() {
+  x_display_->RemoveEventHandler(ConfigureNotify, this);
+}
 
 bool WindowCapturerLinux::GetWindowList(WindowList* windows) {
   WindowList result;
@@ -194,6 +204,9 @@ bool WindowCapturerLinux::SelectWindow(WindowId id) {
   if (!x_server_pixel_buffer_.Init(display(), id))
     return false;
 
+  // Tell the X server to send us window resizing events.
+  XSelectInput(display(), id, StructureNotifyMask);
+
   selected_window_ = id;
 
   // In addition to needing X11 server-side support for Xcomposite, it actually
@@ -208,6 +221,55 @@ bool WindowCapturerLinux::SelectWindow(WindowId id) {
   return true;
 }
 
+bool WindowCapturerLinux::BringSelectedWindowToFront() {
+  if (!selected_window_)
+    return false;
+
+  unsigned int num_children;
+  ::Window* children;
+  ::Window parent;
+  ::Window root;
+  // Find the root window to pass event to.
+  int status = XQueryTree(
+      display(), selected_window_, &root, &parent, &children, &num_children);
+  if (status == 0) {
+    LOG(LS_ERROR) << "Failed to query for the root window.";
+    return false;
+  }
+
+  if (children)
+    XFree(children);
+
+  XRaiseWindow(display(), selected_window_);
+
+  // Some window managers (e.g., metacity in GNOME) consider it illegal to
+  // raise a window without also giving it input focus with
+  // _NET_ACTIVE_WINDOW, so XRaiseWindow() on its own isn't enough.
+  Atom atom = XInternAtom(display(), "_NET_ACTIVE_WINDOW", True);
+  if (atom != None) {
+    XEvent xev;
+    xev.xclient.type = ClientMessage;
+    xev.xclient.serial = 0;
+    xev.xclient.send_event = True;
+    xev.xclient.window = selected_window_;
+    xev.xclient.message_type = atom;
+
+    // The format member is set to 8, 16, or 32 and specifies whether the
+    // data should be viewed as a list of bytes, shorts, or longs.
+    xev.xclient.format = 32;
+
+    memset(xev.xclient.data.l, 0, sizeof(xev.xclient.data.l));
+
+    XSendEvent(display(),
+               root,
+               False,
+               SubstructureRedirectMask | SubstructureNotifyMask,
+               &xev);
+  }
+  XFlush(display());
+  return true;
+}
+
 void WindowCapturerLinux::Start(Callback* callback) {
   assert(!callback_);
   assert(callback);
@@ -216,6 +278,8 @@ void WindowCapturerLinux::Start(Callback* callback) {
 }
 
 void WindowCapturerLinux::Capture(const DesktopRegion& region) {
+  x_display_->ProcessPendingXEvents();
+
   if (!has_composite_extension_) {
     // Without the Xcomposite extension we capture when the whole window is
     // visible on screen and not covered by any other window. This is not
@@ -235,6 +299,20 @@ void WindowCapturerLinux::Capture(const DesktopRegion& region) {
   callback_->OnCaptureCompleted(frame);
 }
 
+bool WindowCapturerLinux::HandleXEvent(const XEvent& event) {
+  if (event.type == ConfigureNotify) {
+    XConfigureEvent xce = event.xconfigure;
+    if (!DesktopSize(xce.width, xce.height).equals(
+            x_server_pixel_buffer_.window_size())) {
+      if (!x_server_pixel_buffer_.Init(display(), selected_window_)) {
+        LOG(LS_ERROR) << "Failed to initialize pixel buffer after resizing.";
+      }
+      return true;
+    }
+  }
+  return false;
+}
+
 ::Window WindowCapturerLinux::GetApplicationWindow(::Window window) {
   // Get WM_STATE property of the window.
   XWindowProperty<uint32_t> window_state(display(), window, wm_state_atom_);
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/x11/desktop_device_info_x11.cc b/media/webrtc/trunk/webrtc/modules/desktop_capture/x11/desktop_device_info_x11.cc
new file mode 100644
index 00000000000..b91bdc06020
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/x11/desktop_device_info_x11.cc
@@ -0,0 +1,39 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "webrtc/modules/desktop_capture/x11/desktop_device_info_x11.h"
+#include "webrtc/modules/desktop_capture/window_capturer.h"
+
+namespace webrtc{
+
+DesktopDeviceInfo * DesktopDeviceInfoImpl::Create() {
+  DesktopDeviceInfoX11 * pDesktopDeviceInfo = new DesktopDeviceInfoX11();
+  if (pDesktopDeviceInfo && pDesktopDeviceInfo->Init() != 0){
+    delete pDesktopDeviceInfo;
+    pDesktopDeviceInfo = NULL;
+  }
+  return pDesktopDeviceInfo;
+}
+
+DesktopDeviceInfoX11::DesktopDeviceInfoX11() {
+}
+
+DesktopDeviceInfoX11::~DesktopDeviceInfoX11() {
+}
+
+int32_t DesktopDeviceInfoX11::Init() {
+#if !defined(MULTI_MONITOR_SCREENSHARE)
+  DesktopDisplayDevice *pDesktopDeviceInfo = new DesktopDisplayDevice;
+  if(pDesktopDeviceInfo){
+    pDesktopDeviceInfo->setScreenId(0);
+    pDesktopDeviceInfo->setDeviceName("Primary Monitor");
+    pDesktopDeviceInfo->setUniqueIdName("\\screen\\monitor#1");
+
+    desktop_display_list_[pDesktopDeviceInfo->getScreenId()] = pDesktopDeviceInfo;
+  }
+#endif
+  return 0;
+}
+
+} //namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/modules/desktop_capture/x11/desktop_device_info_x11.h b/media/webrtc/trunk/webrtc/modules/desktop_capture/x11/desktop_device_info_x11.h
new file mode 100644
index 00000000000..94c18b11aa2
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/modules/desktop_capture/x11/desktop_device_info_x11.h
@@ -0,0 +1,23 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef WEBRTC_MODULES_DESKTOP_CAPTURE_X11_DEVICE_INFO_H_
+#define WEBRTC_MODULES_DESKTOP_CAPTURE_X11_DEVICE_INFO_H_
+
+#include "webrtc/typedefs.h"
+#include "webrtc/modules/desktop_capture/desktop_device_info.h"
+
+namespace webrtc {
+
+class DesktopDeviceInfoX11 : public DesktopDeviceInfoImpl {
+public:
+  DesktopDeviceInfoX11();
+  ~DesktopDeviceInfoX11();
+
+  //DesktopDeviceInfo Interfaces
+  virtual int32_t Init();
+};
+
+}// namespace webrtc
+#endif //WEBRTC_MODULES_DESKTOP_CAPTURE_X11_DEVICE_INFO_H_
diff --git a/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.cc b/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.cc
new file mode 100644
index 00000000000..f8b08a874b0
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.cc
@@ -0,0 +1,681 @@
+/*
+ *  Copyright (c) 2014 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#include "webrtc/modules/video_capture/video_capture_impl.h"
+
+#include <stdlib.h>
+
+#include "webrtc/common_video/libyuv/include/webrtc_libyuv.h"
+#include "webrtc/modules/interface/module_common_types.h"
+#include "webrtc/modules/video_capture/video_capture_config.h"
+#include "webrtc/system_wrappers/interface/clock.h"
+#include "webrtc/system_wrappers/interface/critical_section_wrapper.h"
+#include "webrtc/system_wrappers/interface/ref_count.h"
+#include "webrtc/system_wrappers/interface/tick_util.h"
+#include "webrtc/system_wrappers/interface/trace.h"
+#include "webrtc/system_wrappers/interface/trace_event.h"
+#include "webrtc/video_engine/desktop_capture_impl.h"
+#include "webrtc/modules/desktop_capture/desktop_frame.h"
+#include "webrtc/modules/desktop_capture/desktop_device_info.h"
+#include "webrtc/modules/desktop_capture/app_capturer.h"
+#include "webrtc/modules/desktop_capture/desktop_capture_options.h"
+
+namespace webrtc {
+
+ScreenDeviceInfoImpl::ScreenDeviceInfoImpl(const int32_t id) : _id(id) {
+}
+
+ScreenDeviceInfoImpl::~ScreenDeviceInfoImpl(void) {
+}
+
+int32_t ScreenDeviceInfoImpl::Init() {
+  desktop_device_info_.reset(DesktopDeviceInfoImpl::Create());
+  return 0;
+}
+
+uint32_t ScreenDeviceInfoImpl::NumberOfDevices() {
+  return desktop_device_info_->getDisplayDeviceCount();
+}
+
+int32_t ScreenDeviceInfoImpl::GetDeviceName(uint32_t deviceNumber,
+                                            char* deviceNameUTF8,
+                                            uint32_t deviceNameUTF8Length,
+                                            char* deviceUniqueIdUTF8,
+                                            uint32_t deviceUniqueIdUTF8Length,
+                                            char* productUniqueIdUTF8,
+                                            uint32_t productUniqueIdUTF8Length) {
+
+  DesktopDisplayDevice desktopDisplayDevice;
+
+  // always initialize output
+  if (deviceNameUTF8 && deviceNameUTF8Length > 0) {
+    memset(deviceNameUTF8, 0, deviceNameUTF8Length);
+  }
+
+  if (deviceUniqueIdUTF8 && deviceUniqueIdUTF8Length > 0) {
+    memset(deviceUniqueIdUTF8, 0, deviceUniqueIdUTF8Length);
+  }
+  if (productUniqueIdUTF8 && productUniqueIdUTF8Length > 0) {
+    memset(productUniqueIdUTF8, 0, productUniqueIdUTF8Length);
+  }
+
+  if (desktop_device_info_->getDesktopDisplayDeviceInfo(deviceNumber,
+                                                       desktopDisplayDevice) == 0) {
+    size_t len;
+
+    const char *deviceName = desktopDisplayDevice.getDeviceName();
+    len = deviceName ? strlen(deviceName) : 0;
+    if (len && deviceNameUTF8 && len <= deviceNameUTF8Length) {
+      memcpy(deviceNameUTF8,
+             deviceName,
+             len);
+    }
+
+    const char *deviceUniqueId = desktopDisplayDevice.getUniqueIdName();
+    len = deviceUniqueId ? strlen(deviceUniqueId) : 0;
+    if (len && deviceUniqueIdUTF8 && len <= deviceUniqueIdUTF8Length) {
+      memcpy(deviceUniqueIdUTF8,
+             deviceUniqueId,
+             len);
+    }
+  }
+
+  return 0;
+}
+
+int32_t ScreenDeviceInfoImpl::DisplayCaptureSettingsDialogBox(const char* deviceUniqueIdUTF8,
+                                                              const char* dialogTitleUTF8,
+                                                              void* parentWindow,
+                                                              uint32_t positionX,
+                                                              uint32_t positionY) {
+  // no device properties to change
+  return 0;
+}
+
+int32_t ScreenDeviceInfoImpl::NumberOfCapabilities(const char* deviceUniqueIdUTF8) {
+  return 0;
+}
+
+int32_t ScreenDeviceInfoImpl::GetCapability(const char* deviceUniqueIdUTF8,
+                                            const uint32_t deviceCapabilityNumber,
+                                            VideoCaptureCapability& capability) {
+  return 0;
+}
+
+int32_t ScreenDeviceInfoImpl::GetBestMatchedCapability(const char* deviceUniqueIdUTF8,
+                                                       const VideoCaptureCapability& requested,
+                                                       VideoCaptureCapability& resulting) {
+  return 0;
+}
+
+int32_t ScreenDeviceInfoImpl::GetOrientation(const char* deviceUniqueIdUTF8,
+                                             VideoCaptureRotation& orientation) {
+  return 0;
+}
+
+AppDeviceInfoImpl::AppDeviceInfoImpl(const int32_t id) {
+}
+
+AppDeviceInfoImpl::~AppDeviceInfoImpl(void) {
+}
+
+int32_t AppDeviceInfoImpl::Init() {
+  desktop_device_info_.reset(DesktopDeviceInfoImpl::Create());
+  return 0;
+}
+
+uint32_t AppDeviceInfoImpl::NumberOfDevices() {
+  return desktop_device_info_->getApplicationCount();
+}
+
+int32_t AppDeviceInfoImpl::GetDeviceName(uint32_t deviceNumber,
+                                         char* deviceNameUTF8,
+                                         uint32_t deviceNameUTF8Length,
+                                         char* deviceUniqueIdUTF8,
+                                         uint32_t deviceUniqueIdUTF8Length,
+                                         char* productUniqueIdUTF8,
+                                         uint32_t productUniqueIdUTF8Length) {
+
+  DesktopApplication desktopApplication;
+
+  // always initialize output
+  if (deviceNameUTF8Length && deviceNameUTF8Length > 0) {
+    memset(deviceNameUTF8, 0, deviceNameUTF8Length);
+  }
+  if (deviceUniqueIdUTF8 && deviceUniqueIdUTF8Length > 0) {
+    memset(deviceUniqueIdUTF8, 0, deviceUniqueIdUTF8Length);
+  }
+  if (productUniqueIdUTF8 && productUniqueIdUTF8Length > 0) {
+    memset(productUniqueIdUTF8, 0, productUniqueIdUTF8Length);
+  }
+
+  if (desktop_device_info_->getApplicationInfo(deviceNumber,desktopApplication) == 0) {
+    size_t len;
+
+    const char *deviceName = desktopApplication.getProcessAppName();
+    len = deviceName ? strlen(deviceName) : 0;
+    if (len && len <= deviceNameUTF8Length) {
+      memcpy(deviceNameUTF8, deviceName, len);
+    }
+
+    const char *deviceUniqueId = desktopApplication.getUniqueIdName();
+    len = deviceUniqueId ? strlen(deviceUniqueId) : 0;
+    if (len && deviceUniqueIdUTF8 && len <= deviceUniqueIdUTF8Length) {
+      memcpy(deviceUniqueIdUTF8,
+             deviceUniqueId,
+             len);
+    }
+  }
+  return 0;
+}
+
+int32_t AppDeviceInfoImpl::DisplayCaptureSettingsDialogBox(const char* deviceUniqueIdUTF8,
+                                                           const char* dialogTitleUTF8,
+                                                           void* parentWindow,
+                                                           uint32_t positionX,
+                                                           uint32_t positionY) {
+  return 0;
+}
+
+int32_t AppDeviceInfoImpl::NumberOfCapabilities(const char* deviceUniqueIdUTF8) {
+  return 0;
+}
+
+int32_t AppDeviceInfoImpl::GetCapability(
+                                         const char* deviceUniqueIdUTF8,
+                                         const uint32_t deviceCapabilityNumber,
+                                         VideoCaptureCapability& capability) {
+  return 0;
+}
+
+int32_t AppDeviceInfoImpl::GetBestMatchedCapability(
+                                                    const char* deviceUniqueIdUTF8,
+                                                    const VideoCaptureCapability& requested,
+                                                    VideoCaptureCapability& resulting) {
+  return 0;
+}
+
+int32_t AppDeviceInfoImpl::GetOrientation(const char* deviceUniqueIdUTF8,
+                                          VideoCaptureRotation& orientation) {
+  return 0;
+}
+
+VideoCaptureModule* DesktopCaptureImpl::Create(const int32_t id,
+                                               const char* uniqueId,
+                                               const bool bIsApp) {
+  RefCountImpl<DesktopCaptureImpl>* capture = new RefCountImpl<DesktopCaptureImpl>(id);
+
+  //create real screen capturer.
+  if (capture->Init(uniqueId, bIsApp) != 0) {
+    delete capture;
+    return NULL;
+  }
+
+  return capture;
+}
+
+VideoCaptureModule::DeviceInfo* DesktopCaptureImpl::CreateDeviceInfo(const int32_t id,
+                                                                     const bool bIsApp) {
+  if (bIsApp) {
+    AppDeviceInfoImpl * pAppDeviceInfoImpl = new AppDeviceInfoImpl(id);
+    if (!pAppDeviceInfoImpl || pAppDeviceInfoImpl->Init()) {
+      delete pAppDeviceInfoImpl;
+      pAppDeviceInfoImpl = NULL;
+    }
+    return pAppDeviceInfoImpl;
+  } else {
+    ScreenDeviceInfoImpl * pScreenDeviceInfoImpl = new ScreenDeviceInfoImpl(id);
+    if (!pScreenDeviceInfoImpl || pScreenDeviceInfoImpl->Init()) {
+      delete pScreenDeviceInfoImpl;
+      pScreenDeviceInfoImpl = NULL;
+    }
+    return pScreenDeviceInfoImpl;
+  }
+}
+
+const char* DesktopCaptureImpl::CurrentDeviceName() const {
+  return _deviceUniqueId;
+}
+
+int32_t DesktopCaptureImpl::ChangeUniqueId(const int32_t id) {
+  _id = id;
+  return 0;
+}
+
+int32_t DesktopCaptureImpl::Init(const char* uniqueId,
+                                 const bool bIsApp) {
+  if (bIsApp) {
+    AppCapturer *pAppCapturer = AppCapturer::Create();
+    if (!pAppCapturer) {
+      return -1;
+    }
+
+    // processid hard-coded until implemented.  See Bug 1036653
+    ProcessId processid = 0;
+    pAppCapturer->SelectApp(processid);
+
+    MouseCursorMonitor * pMouseCursorMonitor = MouseCursorMonitor::CreateForScreen(webrtc::DesktopCaptureOptions::CreateDefault(), webrtc::kFullDesktopScreenId);
+    desktop_capturer_cursor_composer_.reset(new DesktopAndCursorComposer(pAppCapturer, pMouseCursorMonitor));
+  } else {
+    ScreenCapturer *pScreenCapturer = ScreenCapturer::Create();
+    if (!pScreenCapturer) {
+      return -1;
+    }
+
+    ScreenId screenid = webrtc::kFullDesktopScreenId;
+    pScreenCapturer->SelectScreen(screenid);
+    pScreenCapturer->SetMouseShapeObserver(this);
+
+    MouseCursorMonitor * pMouseCursorMonitor = MouseCursorMonitor::CreateForScreen(webrtc::DesktopCaptureOptions::CreateDefault(), screenid);
+    desktop_capturer_cursor_composer_.reset(new DesktopAndCursorComposer(pScreenCapturer, pMouseCursorMonitor));
+  }
+  return 0;
+}
+
+// returns the number of milliseconds until the module want a worker thread to call Process
+int32_t DesktopCaptureImpl::TimeUntilNextProcess() {
+  CriticalSectionScoped cs(&_callBackCs);
+
+  int32_t timeToNormalProcess = kProcessInterval
+    - (int32_t)((TickTime::Now() - _lastProcessTime).Milliseconds());
+
+  return timeToNormalProcess;
+}
+
+// Process any pending tasks such as timeouts
+int32_t DesktopCaptureImpl::Process() {
+  CriticalSectionScoped cs(&_callBackCs);
+
+  const TickTime now = TickTime::Now();
+  _lastProcessTime = TickTime::Now();
+
+  // Handle No picture alarm
+  if (_lastProcessFrameCount.Ticks() == _incomingFrameTimes[0].Ticks() &&
+      _captureAlarm != Raised) {
+    if (_noPictureAlarmCallBack && _captureCallBack) {
+      _captureAlarm = Raised;
+      _captureCallBack->OnNoPictureAlarm(_id, _captureAlarm);
+    }
+  } else if (_lastProcessFrameCount.Ticks() != _incomingFrameTimes[0].Ticks() &&
+             _captureAlarm != Cleared) {
+    if (_noPictureAlarmCallBack && _captureCallBack) {
+      _captureAlarm = Cleared;
+      _captureCallBack->OnNoPictureAlarm(_id, _captureAlarm);
+    }
+  }
+
+  // Handle frame rate callback
+  if ((now - _lastFrameRateCallbackTime).Milliseconds()
+      > kFrameRateCallbackInterval) {
+    if (_frameRateCallBack && _captureCallBack) {
+      const uint32_t frameRate = CalculateFrameRate(now);
+      _captureCallBack->OnCaptureFrameRate(_id, frameRate);
+    }
+    _lastFrameRateCallbackTime = now; // Can be set by EnableFrameRateCallback
+
+  }
+
+  _lastProcessFrameCount = _incomingFrameTimes[0];
+
+  return 0;
+}
+
+DesktopCaptureImpl::DesktopCaptureImpl(const int32_t id)
+  : _id(id),
+    _deviceUniqueId(NULL),
+    _apiCs(*CriticalSectionWrapper::CreateCriticalSection()),
+    _captureDelay(0),
+    _requestedCapability(),
+    _callBackCs(*CriticalSectionWrapper::CreateCriticalSection()),
+    _lastProcessTime(TickTime::Now()),
+    _lastFrameRateCallbackTime(TickTime::Now()),
+    _frameRateCallBack(false),
+    _noPictureAlarmCallBack(false),
+    _captureAlarm(Cleared),
+    _setCaptureDelay(0),
+    _dataCallBack(NULL),
+    _captureCallBack(NULL),
+  _lastProcessFrameCount(TickTime::Now()),
+  _rotateFrame(kRotateNone),
+  last_capture_time_(TickTime::MillisecondTimestamp()),
+  delta_ntp_internal_ms_(
+                         Clock::GetRealTimeClock()->CurrentNtpInMilliseconds() -
+                         TickTime::MillisecondTimestamp()),
+  capturer_thread_(*ThreadWrapper::CreateThread(Run, this, kHighPriority, "ScreenCaptureThread")) {
+  _requestedCapability.width = kDefaultWidth;
+  _requestedCapability.height = kDefaultHeight;
+  _requestedCapability.maxFPS = 30;
+  _requestedCapability.rawType = kVideoI420;
+  _requestedCapability.codecType = kVideoCodecUnknown;
+  memset(_incomingFrameTimes, 0, sizeof(_incomingFrameTimes));
+}
+
+DesktopCaptureImpl::~DesktopCaptureImpl() {
+  capturer_thread_.Stop();
+  delete &capturer_thread_;
+
+  DeRegisterCaptureDataCallback();
+  DeRegisterCaptureCallback();
+  delete &_callBackCs;
+  delete &_apiCs;
+
+  delete[] _deviceUniqueId;
+}
+
+void DesktopCaptureImpl::RegisterCaptureDataCallback(
+                                                     VideoCaptureDataCallback& dataCallBack)
+{
+  CriticalSectionScoped cs(&_apiCs);
+  CriticalSectionScoped cs2(&_callBackCs);
+  _dataCallBack = &dataCallBack;
+}
+
+void DesktopCaptureImpl::DeRegisterCaptureDataCallback()
+{
+  CriticalSectionScoped cs(&_apiCs);
+  CriticalSectionScoped cs2(&_callBackCs);
+  _dataCallBack = NULL;
+}
+
+void DesktopCaptureImpl::RegisterCaptureCallback(VideoCaptureFeedBack& callBack)
+{
+
+  CriticalSectionScoped cs(&_apiCs);
+  CriticalSectionScoped cs2(&_callBackCs);
+  _captureCallBack = &callBack;
+}
+
+void DesktopCaptureImpl::DeRegisterCaptureCallback()
+{
+
+  CriticalSectionScoped cs(&_apiCs);
+  CriticalSectionScoped cs2(&_callBackCs);
+  _captureCallBack = NULL;
+}
+
+void DesktopCaptureImpl::SetCaptureDelay(int32_t delayMS)
+{
+  CriticalSectionScoped cs(&_apiCs);
+  _captureDelay = delayMS;
+}
+
+int32_t DesktopCaptureImpl::CaptureDelay()
+{
+  CriticalSectionScoped cs(&_apiCs);
+  return _setCaptureDelay;
+}
+
+int32_t DesktopCaptureImpl::DeliverCapturedFrame(I420VideoFrame& captureFrame,
+                                                 int64_t capture_time) {
+  UpdateFrameCount();  // frame count used for local frame rate callback.
+
+  const bool callOnCaptureDelayChanged = _setCaptureDelay != _captureDelay;
+  // Capture delay changed
+  if (_setCaptureDelay != _captureDelay) {
+    _setCaptureDelay = _captureDelay;
+  }
+
+  // Set the capture time
+  if (capture_time != 0) {
+    captureFrame.set_render_time_ms(capture_time - delta_ntp_internal_ms_);
+  } else {
+    captureFrame.set_render_time_ms(TickTime::MillisecondTimestamp());
+  }
+
+  if (captureFrame.render_time_ms() == last_capture_time_) {
+    // We don't allow the same capture time for two frames, drop this one.
+    return -1;
+  }
+  last_capture_time_ = captureFrame.render_time_ms();
+
+  if (_dataCallBack) {
+    if (callOnCaptureDelayChanged) {
+      _dataCallBack->OnCaptureDelayChanged(_id, _captureDelay);
+    }
+    _dataCallBack->OnIncomingCapturedFrame(_id, captureFrame);
+  }
+
+  return 0;
+}
+
+// Copied from VideoCaptureImpl::IncomingFrame. See Bug 1038324
+int32_t DesktopCaptureImpl::IncomingFrame(uint8_t* videoFrame,
+                                          int32_t videoFrameLength,
+                                          const VideoCaptureCapability& frameInfo,
+                                          int64_t captureTime/*=0*/)
+{
+  WEBRTC_TRACE(webrtc::kTraceStream, webrtc::kTraceVideoCapture, _id,
+               "IncomingFrame width %d, height %d", (int) frameInfo.width,
+               (int) frameInfo.height);
+
+  TickTime startProcessTime = TickTime::Now();
+
+  CriticalSectionScoped cs(&_callBackCs);
+
+  const int32_t width = frameInfo.width;
+  const int32_t height = frameInfo.height;
+
+  TRACE_EVENT1("webrtc", "VC::IncomingFrame", "capture_time", captureTime);
+
+  if (frameInfo.codecType == kVideoCodecUnknown) {
+    // Not encoded, convert to I420.
+    const VideoType commonVideoType =
+      RawVideoTypeToCommonVideoVideoType(frameInfo.rawType);
+
+    if (frameInfo.rawType != kVideoMJPEG &&
+        CalcBufferSize(commonVideoType, width,
+                       abs(height)) != videoFrameLength) {
+      WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceVideoCapture, _id,
+                   "Wrong incoming frame length.");
+      return -1;
+    }
+
+    int stride_y = width;
+    int stride_uv = (width + 1) / 2;
+    int target_width = width;
+    int target_height = height;
+    // Rotating resolution when for 90/270 degree rotations.
+    if (_rotateFrame == kRotate90 || _rotateFrame == kRotate270)  {
+      target_width = abs(height);
+      target_height = width;
+    }
+
+    // Setting absolute height (in case it was negative).
+    // In Windows, the image starts bottom left, instead of top left.
+    // Setting a negative source height, inverts the image (within LibYuv).
+    int ret = _captureFrame.CreateEmptyFrame(target_width,
+                                             abs(target_height),
+                                             stride_y,
+                                             stride_uv, stride_uv);
+    if (ret < 0) {
+      WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceVideoCapture, _id,
+                   "Failed to allocate I420 frame.");
+      return -1;
+    }
+    const int conversionResult = ConvertToI420(commonVideoType,
+                                               videoFrame,
+                                               0, 0,  // No cropping
+                                               width, height,
+                                               videoFrameLength,
+                                               _rotateFrame,
+                                               &_captureFrame);
+    if (conversionResult < 0) {
+      WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceVideoCapture, _id,
+                   "Failed to convert capture frame from type %d to I420",
+                   frameInfo.rawType);
+      return -1;
+    }
+    DeliverCapturedFrame(_captureFrame, captureTime);
+  } else {
+    assert(false);
+    return -1;
+  }
+
+  const uint32_t processTime =
+    (uint32_t)(TickTime::Now() - startProcessTime).Milliseconds();
+
+  if (processTime > 10) {
+    WEBRTC_TRACE(webrtc::kTraceWarning, webrtc::kTraceVideoCapture, _id,
+                 "Too long processing time of Incoming frame: %ums",
+                 (unsigned int) processTime);
+  }
+
+  return 0;
+}
+
+int32_t DesktopCaptureImpl::IncomingI420VideoFrame(I420VideoFrame* video_frame, int64_t captureTime) {
+
+  CriticalSectionScoped cs(&_callBackCs);
+  int stride_y = video_frame->stride(kYPlane);
+  int stride_u = video_frame->stride(kUPlane);
+  int stride_v = video_frame->stride(kVPlane);
+  int size_y = video_frame->height() * stride_y;
+  int size_u = stride_u * ((video_frame->height() + 1) / 2);
+  int size_v =  stride_v * ((video_frame->height() + 1) / 2);
+  int ret = _captureFrame.CreateFrame(size_y, video_frame->buffer(kYPlane),
+                                      size_u, video_frame->buffer(kUPlane),
+                                      size_v, video_frame->buffer(kVPlane),
+                                      video_frame->width(), video_frame->height(),
+                                      stride_y, stride_u, stride_v);
+
+  if (ret < 0) {
+    WEBRTC_TRACE(webrtc::kTraceError, webrtc::kTraceVideoCapture, _id,
+                 "Failed to create I420VideoFrame");
+    return -1;
+  }
+
+  DeliverCapturedFrame(_captureFrame, captureTime);
+
+  return 0;
+}
+
+int32_t DesktopCaptureImpl::SetCaptureRotation(VideoCaptureRotation rotation) {
+  CriticalSectionScoped cs(&_apiCs);
+  CriticalSectionScoped cs2(&_callBackCs);
+  switch (rotation) {
+  case kCameraRotate0:
+    _rotateFrame = kRotateNone;
+    break;
+  case kCameraRotate90:
+    _rotateFrame = kRotate90;
+    break;
+  case kCameraRotate180:
+    _rotateFrame = kRotate180;
+    break;
+  case kCameraRotate270:
+    _rotateFrame = kRotate270;
+    break;
+  }
+  return 0;
+}
+
+void DesktopCaptureImpl::EnableFrameRateCallback(const bool enable) {
+  CriticalSectionScoped cs(&_apiCs);
+  CriticalSectionScoped cs2(&_callBackCs);
+  _frameRateCallBack = enable;
+  if (enable) {
+    _lastFrameRateCallbackTime = TickTime::Now();
+  }
+}
+
+void DesktopCaptureImpl::EnableNoPictureAlarm(const bool enable) {
+  CriticalSectionScoped cs(&_apiCs);
+  CriticalSectionScoped cs2(&_callBackCs);
+  _noPictureAlarmCallBack = enable;
+}
+
+void DesktopCaptureImpl::UpdateFrameCount() {
+  if (_incomingFrameTimes[0].MicrosecondTimestamp() == 0) {
+    // first no shift
+  } else {
+    // shift
+    for (int i = (kFrameRateCountHistorySize - 2); i >= 0; i--) {
+      _incomingFrameTimes[i + 1] = _incomingFrameTimes[i];
+    }
+  }
+  _incomingFrameTimes[0] = TickTime::Now();
+}
+
+uint32_t DesktopCaptureImpl::CalculateFrameRate(const TickTime& now) {
+  int32_t num = 0;
+  int32_t nrOfFrames = 0;
+  for (num = 1; num < (kFrameRateCountHistorySize - 1); num++) {
+    // don't use data older than 2sec
+    if (_incomingFrameTimes[num].Ticks() <= 0
+        || (now - _incomingFrameTimes[num]).Milliseconds() > kFrameRateHistoryWindowMs) {
+      break;
+    } else {
+      nrOfFrames++;
+    }
+  }
+  if (num > 1) {
+    int64_t diff = (now - _incomingFrameTimes[num - 1]).Milliseconds();
+    if (diff > 0) {
+      // round to nearest value rather than return minimumid_
+      return uint32_t((nrOfFrames * 1000.0f / diff) + 0.5f);
+    }
+  }
+
+  return nrOfFrames;
+}
+
+int32_t DesktopCaptureImpl::StartCapture(const VideoCaptureCapability& capability) {
+  _requestedCapability = capability;
+  desktop_capturer_cursor_composer_->Start(this);
+  unsigned int t_id =0;
+  capturer_thread_.Start(t_id);
+  return 0;
+}
+
+int32_t DesktopCaptureImpl::StopCapture() {
+  return -1;
+}
+
+bool DesktopCaptureImpl::CaptureStarted() {
+  return false;
+}
+
+int32_t DesktopCaptureImpl::CaptureSettings(VideoCaptureCapability& settings) {
+  return -1;
+}
+
+void DesktopCaptureImpl::OnCaptureCompleted(DesktopFrame* frame) {
+  if (frame == NULL) return;
+  uint8_t * videoFrame = frame->data();
+  VideoCaptureCapability frameInfo;
+  frameInfo.width = frame->size().width();
+  frameInfo.height = frame->size().height();
+  frameInfo.rawType = kVideoARGB;
+
+  // combine cursor in frame
+  // Latest WebRTC already support it by DesktopFrameWithCursor/DesktopAndCursorComposer.
+
+  int32_t videoFrameLength = frameInfo.width * frameInfo.height * DesktopFrame::kBytesPerPixel;
+  IncomingFrame(videoFrame, videoFrameLength, frameInfo);
+  delete frame; //handled it, so we need delete it
+}
+
+SharedMemory* DesktopCaptureImpl::CreateSharedMemory(size_t size) {
+  return NULL;
+}
+
+void DesktopCaptureImpl::process() {
+  DesktopRect desktop_rect;
+  DesktopRegion desktop_region;
+
+  desktop_capturer_cursor_composer_->Capture(DesktopRegion());
+}
+
+void DesktopCaptureImpl::OnCursorShapeChanged(MouseCursorShape* cursor_shape) {
+  // do nothing, DesktopAndCursorComposer does it all
+}
+
+}  // namespace webrtc
+
diff --git a/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.h b/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.h
new file mode 100644
index 00000000000..0c6774fa587
--- /dev/null
+++ b/media/webrtc/trunk/webrtc/video_engine/desktop_capture_impl.h
@@ -0,0 +1,228 @@
+/*
+ *  Copyright (c) 2014 The WebRTC project authors. All Rights Reserved.
+ *
+ *  Use of this source code is governed by a BSD-style license
+ *  that can be found in the LICENSE file in the root of the source
+ *  tree. An additional intellectual property rights grant can be found
+ *  in the file PATENTS.  All contributing project authors may
+ *  be found in the AUTHORS file in the root of the source tree.
+ */
+
+#ifndef WEBRTC_MODULES_DESKTOP_CAPTURE_MAIN_SOURCE_DESKTOP_CAPTURE_IMPL_H_
+#define WEBRTC_MODULES_DESKTOP_CAPTURE_MAIN_SOURCE_DESKTOP_CAPTURE_IMPL_H_
+
+/*
+ * video_capture_impl.h
+ */
+
+#include "webrtc/common_video/interface/i420_video_frame.h"
+#include "webrtc/common_video/libyuv/include/webrtc_libyuv.h"
+#include "webrtc/modules/desktop_capture/screen_capturer.h"
+#include "webrtc/system_wrappers/interface/tick_util.h"
+#include "webrtc/modules/video_capture/video_capture_config.h"
+#include "webrtc/modules/desktop_capture/shared_memory.h"
+#include "webrtc/system_wrappers/interface/thread_wrapper.h"
+#include "webrtc/modules/desktop_capture/mouse_cursor_shape.h"
+#include "webrtc/modules/desktop_capture/desktop_device_info.h"
+#include "webrtc/modules/desktop_capture/desktop_and_cursor_composer.h"
+
+using namespace webrtc::videocapturemodule;
+
+namespace webrtc {
+
+class CriticalSectionWrapper;
+class VideoCaptureEncodeInterface;
+
+
+//simulate deviceInfo interface for video engine, bridge screen/application and real screen/application device info
+
+class ScreenDeviceInfoImpl : public VideoCaptureModule::DeviceInfo {
+public:
+  ScreenDeviceInfoImpl(const int32_t id);
+  virtual ~ScreenDeviceInfoImpl(void);
+
+  int32_t Init();
+
+  virtual uint32_t NumberOfDevices();
+  virtual int32_t GetDeviceName(uint32_t deviceNumber,
+                                char* deviceNameUTF8,
+                                uint32_t deviceNameLength,
+                                char* deviceUniqueIdUTF8,
+                                uint32_t deviceUniqueIdUTF8Length,
+                                char* productUniqueIdUTF8,
+                                uint32_t productUniqueIdUTF8Length);
+
+  virtual int32_t DisplayCaptureSettingsDialogBox(const char* deviceUniqueIdUTF8,
+                                                  const char* dialogTitleUTF8,
+                                                  void* parentWindow,
+                                                  uint32_t positionX,
+                                                  uint32_t positionY);
+  virtual int32_t NumberOfCapabilities(const char* deviceUniqueIdUTF8);
+  virtual int32_t GetCapability(const char* deviceUniqueIdUTF8,
+                                const uint32_t deviceCapabilityNumber,
+                                VideoCaptureCapability& capability);
+
+  virtual int32_t GetBestMatchedCapability(const char* deviceUniqueIdUTF8,
+                                           const VideoCaptureCapability& requested,
+                                           VideoCaptureCapability& resulting);
+  virtual int32_t GetOrientation(const char* deviceUniqueIdUTF8,
+                                 VideoCaptureRotation& orientation);
+protected:
+  int32_t _id;
+  scoped_ptr<DesktopDeviceInfo> desktop_device_info_;
+
+};
+
+class AppDeviceInfoImpl : public VideoCaptureModule::DeviceInfo {
+public:
+  AppDeviceInfoImpl(const int32_t id);
+  virtual ~AppDeviceInfoImpl(void);
+
+  int32_t Init();
+
+  virtual uint32_t NumberOfDevices();
+  virtual int32_t GetDeviceName(uint32_t deviceNumber,
+                                char* deviceNameUTF8,
+                                uint32_t deviceNameLength,
+                                char* deviceUniqueIdUTF8,
+                                uint32_t deviceUniqueIdUTF8Length,
+                                char* productUniqueIdUTF8,
+                                uint32_t productUniqueIdUTF8Length);
+
+  virtual int32_t DisplayCaptureSettingsDialogBox(const char* deviceUniqueIdUTF8,
+                                                  const char* dialogTitleUTF8,
+                                                  void* parentWindow,
+                                                  uint32_t positionX,
+                                                  uint32_t positionY);
+  virtual int32_t NumberOfCapabilities(const char* deviceUniqueIdUTF8);
+  virtual int32_t GetCapability(const char* deviceUniqueIdUTF8,
+                                const uint32_t deviceCapabilityNumber,
+                                VideoCaptureCapability& capability);
+
+  virtual int32_t GetBestMatchedCapability(const char* deviceUniqueIdUTF8,
+                                           const VideoCaptureCapability& requested,
+                                           VideoCaptureCapability& resulting);
+  virtual int32_t GetOrientation(const char* deviceUniqueIdUTF8,
+                                 VideoCaptureRotation& orientation);
+protected:
+  int32_t _id;
+  scoped_ptr<DesktopDeviceInfo> desktop_device_info_;
+};
+
+// Reuses the video engine pipeline for screen sharing.
+// As with video, DesktopCaptureImpl is a proxy for screen sharing
+// and follows the video pipeline design
+class DesktopCaptureImpl: public VideoCaptureModule,
+                          public VideoCaptureExternal,
+                          public ScreenCapturer::Callback,
+                          public ScreenCapturer::MouseShapeObserver
+{
+public:
+  /* Create a screen capture modules object
+   */
+  static VideoCaptureModule* Create(const int32_t id, const char* uniqueId, const bool bIsApp);
+  static VideoCaptureModule::DeviceInfo* CreateDeviceInfo(const int32_t id, const bool bIsApp);
+
+  int32_t Init(const char* uniqueId,const bool bIsApp);
+  // Implements Module declared functions.
+  virtual int32_t ChangeUniqueId(const int32_t id) OVERRIDE;
+
+  //Call backs
+  virtual void RegisterCaptureDataCallback(VideoCaptureDataCallback& dataCallback) OVERRIDE;
+  virtual void DeRegisterCaptureDataCallback() OVERRIDE;
+  virtual void RegisterCaptureCallback(VideoCaptureFeedBack& callBack) OVERRIDE;
+  virtual void DeRegisterCaptureCallback() OVERRIDE;
+
+  virtual void SetCaptureDelay(int32_t delayMS) OVERRIDE;
+  virtual int32_t CaptureDelay() OVERRIDE;
+  virtual int32_t SetCaptureRotation(VideoCaptureRotation rotation) OVERRIDE;
+
+  virtual void EnableFrameRateCallback(const bool enable) OVERRIDE;
+  virtual void EnableNoPictureAlarm(const bool enable) OVERRIDE;
+
+  virtual const char* CurrentDeviceName() const OVERRIDE;
+
+  // Module handling
+  virtual int32_t TimeUntilNextProcess() OVERRIDE;
+  virtual int32_t Process() OVERRIDE;
+
+  // Implement VideoCaptureExternal
+  // |capture_time| must be specified in the NTP time format in milliseconds.
+  virtual int32_t IncomingFrame(uint8_t* videoFrame,
+                                int32_t videoFrameLength,
+                                const VideoCaptureCapability& frameInfo,
+                                int64_t captureTime = 0) OVERRIDE;
+  virtual int32_t IncomingI420VideoFrame(
+                                         I420VideoFrame* video_frame,
+                                         int64_t captureTime = 0) OVERRIDE;
+
+  // Platform dependent
+  virtual int32_t StartCapture(const VideoCaptureCapability& capability) OVERRIDE;
+  virtual int32_t StopCapture() OVERRIDE;
+  virtual bool CaptureStarted() OVERRIDE;
+  virtual int32_t CaptureSettings(VideoCaptureCapability& settings) OVERRIDE;
+  VideoCaptureEncodeInterface* GetEncodeInterface(const VideoCodec& codec) OVERRIDE { return NULL; }
+
+  //ScreenCapturer::Callback
+  virtual SharedMemory* CreateSharedMemory(size_t size) OVERRIDE;
+  virtual void OnCaptureCompleted(DesktopFrame* frame) OVERRIDE;
+
+  //ScreenCapturer::MouseShapeObserver
+  virtual void OnCursorShapeChanged(MouseCursorShape* cursor_shape) OVERRIDE;
+
+protected:
+  DesktopCaptureImpl(const int32_t id);
+  virtual ~DesktopCaptureImpl();
+  int32_t DeliverCapturedFrame(I420VideoFrame& captureFrame,
+                               int64_t capture_time);
+
+  int32_t _id; // Module ID
+  char* _deviceUniqueId; // current Device unique name;
+  CriticalSectionWrapper& _apiCs;
+  int32_t _captureDelay; // Current capture delay. May be changed of platform dependent parts.
+  VideoCaptureCapability _requestedCapability; // Should be set by platform dependent code in StartCapture.
+
+private:
+  void UpdateFrameCount();
+  uint32_t CalculateFrameRate(const TickTime& now);
+
+  CriticalSectionWrapper& _callBackCs;
+
+  TickTime _lastProcessTime; // last time the module process function was called.
+  TickTime _lastFrameRateCallbackTime; // last time the frame rate callback function was called.
+  bool _frameRateCallBack; // true if EnableFrameRateCallback
+  bool _noPictureAlarmCallBack; //true if EnableNoPictureAlarm
+  VideoCaptureAlarm _captureAlarm; // current value of the noPictureAlarm
+
+  int32_t _setCaptureDelay; // The currently used capture delay
+  VideoCaptureDataCallback* _dataCallBack;
+  VideoCaptureFeedBack* _captureCallBack;
+
+  TickTime _lastProcessFrameCount;
+  TickTime _incomingFrameTimes[kFrameRateCountHistorySize];// timestamp for local captured frames
+  VideoRotationMode _rotateFrame; //Set if the frame should be rotated by the capture module.
+
+  I420VideoFrame _captureFrame;
+  VideoFrame _capture_encoded_frame;
+
+  // Used to make sure incoming timestamp is increasing for every frame.
+  int64_t last_capture_time_;
+
+  // Delta used for translating between NTP and internal timestamps.
+  const int64_t delta_ntp_internal_ms_;
+
+public:
+  static bool Run(void*obj) {
+    static_cast<DesktopCaptureImpl*>(obj)->process();
+    return true;
+  };
+  void process();
+
+private:
+  scoped_ptr<DesktopAndCursorComposer> desktop_capturer_cursor_composer_;
+  ThreadWrapper&  capturer_thread_;
+};
+
+}  // namespace webrtc
+
+#endif  // WEBRTC_MODULES_DESKTOP_CAPTURE_MAIN_SOURCE_DESKTOP_CAPTURE_IMPL_H_
diff --git a/media/webrtc/trunk/webrtc/video_engine/include/vie_capture.h b/media/webrtc/trunk/webrtc/video_engine/include/vie_capture.h
index cee36265101..439f0692f4c 100644
--- a/media/webrtc/trunk/webrtc/video_engine/include/vie_capture.h
+++ b/media/webrtc/trunk/webrtc/video_engine/include/vie_capture.h
@@ -47,6 +47,19 @@ struct CaptureCapability {
   }
 };
 
+enum CaptureDeviceType {
+  Camera = 0,
+  Screen = 1,
+  Application = 2,
+  Window = 3
+};
+struct CaptureDeviceInfo {
+  CaptureDeviceType type;
+
+  CaptureDeviceInfo() : type(CaptureDeviceType::Camera) {}
+  CaptureDeviceInfo(CaptureDeviceType t) : type(t) {}
+};
+
 // This enumerator tells the current brightness alarm mode.
 enum Brightness {
   Normal = 0,
diff --git a/media/webrtc/trunk/webrtc/video_engine/video_engine_core.gypi b/media/webrtc/trunk/webrtc/video_engine/video_engine_core.gypi
index 14d5fb6b9e2..28b83f4b9e9 100644
--- a/media/webrtc/trunk/webrtc/video_engine/video_engine_core.gypi
+++ b/media/webrtc/trunk/webrtc/video_engine/video_engine_core.gypi
@@ -110,6 +110,14 @@
         'vie_sender.cc',
         'vie_sync_module.cc',
       ], # source
+      'conditions' : [
+        ['OS!="android"', {
+          'sources': [
+            'desktop_capture_impl.cc',
+            'desktop_capture_impl.h',
+          ],
+        }],
+      ],
       # TODO(jschuh): Bug 1348: fix size_t to int truncations.
       'msvs_disabled_warnings': [ 4267, ],
     },
diff --git a/media/webrtc/trunk/webrtc/video_engine/vie_capturer.cc b/media/webrtc/trunk/webrtc/video_engine/vie_capturer.cc
index 8b962777369..343bd9bc93c 100644
--- a/media/webrtc/trunk/webrtc/video_engine/vie_capturer.cc
+++ b/media/webrtc/trunk/webrtc/video_engine/vie_capturer.cc
@@ -27,6 +27,7 @@
 #include "webrtc/video_engine/overuse_frame_detector.h"
 #include "webrtc/video_engine/vie_defines.h"
 #include "webrtc/video_engine/vie_encoder.h"
+#include "webrtc/video_engine/desktop_capture_impl.h"
 
 namespace webrtc {
 
@@ -61,7 +62,8 @@ ViECapturer::ViECapturer(int capture_id,
       observer_(NULL),
       overuse_detector_(new OveruseFrameDetector(Clock::GetRealTimeClock(),
                                                  kNormalUseStdDevMs,
-                                                 kOveruseStdDevMs)) {
+                                                 kOveruseStdDevMs)),
+      config_(config) {
   WEBRTC_TRACE(kTraceMemory, kTraceVideo, ViEId(engine_id, capture_id),
                "ViECapturer::ViECapturer(capture_id: %d, engine_id: %d)",
                capture_id, engine_id);
@@ -166,12 +168,30 @@ ViECapturer* ViECapturer::CreateViECapture(
 int32_t ViECapturer::Init(const char* device_unique_idUTF8,
                           uint32_t device_unique_idUTF8Length) {
   assert(capture_module_ == NULL);
-  if (device_unique_idUTF8 == NULL) {
+  CaptureDeviceType type = config_.Get<CaptureDeviceInfo>().type;
+
+  if(type != CaptureDeviceType::Camera) {
+#if !defined(ANDROID)
+    switch (type) {
+      case CaptureDeviceType::Screen:
+        capture_module_ = DesktopCaptureImpl::Create(
+            ViEModuleId(engine_id_, capture_id_), device_unique_idUTF8, false);
+        break;
+      case CaptureDeviceType::Application:
+        capture_module_ = DesktopCaptureImpl::Create(
+            ViEModuleId(engine_id_, capture_id_), device_unique_idUTF8, true);
+        break;
+      default:
+        // all other non-camera types are not supported
+        return -1;
+    }
+#endif
+  } else if (device_unique_idUTF8 == NULL) {
     capture_module_  = VideoCaptureFactory::Create(
-        ViEModuleId(engine_id_, capture_id_), external_capture_module_);
+      ViEModuleId(engine_id_, capture_id_), external_capture_module_);
   } else {
     capture_module_ = VideoCaptureFactory::Create(
-        ViEModuleId(engine_id_, capture_id_), device_unique_idUTF8);
+      ViEModuleId(engine_id_, capture_id_), device_unique_idUTF8);
   }
   if (!capture_module_) {
     return -1;
diff --git a/media/webrtc/trunk/webrtc/video_engine/vie_capturer.h b/media/webrtc/trunk/webrtc/video_engine/vie_capturer.h
index 21644e20c67..25c1f8ce1bd 100644
--- a/media/webrtc/trunk/webrtc/video_engine/vie_capturer.h
+++ b/media/webrtc/trunk/webrtc/video_engine/vie_capturer.h
@@ -25,6 +25,7 @@
 #include "webrtc/video_engine/include/vie_capture.h"
 #include "webrtc/video_engine/vie_defines.h"
 #include "webrtc/video_engine/vie_frame_provider_base.h"
+#include "webrtc/common.h"
 
 namespace webrtc {
 
@@ -191,6 +192,7 @@ class ViECapturer
   CaptureCapability requested_capability_;
 
   scoped_ptr<OveruseFrameDetector> overuse_detector_;
+  const Config & config_;
 };
 
 }  // namespace webrtc
diff --git a/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.cc b/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.cc
index f5727c56485..16bdb1fa74a 100644
--- a/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.cc
+++ b/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.cc
@@ -22,6 +22,7 @@
 #include "webrtc/video_engine/include/vie_errors.h"
 #include "webrtc/video_engine/vie_capturer.h"
 #include "webrtc/video_engine/vie_defines.h"
+#include "webrtc/video_engine/desktop_capture_impl.h"
 
 namespace webrtc {
 
@@ -62,9 +63,7 @@ int ViEInputManager::NumberOfCaptureDevices() {
   WEBRTC_TRACE(webrtc::kTraceInfo, webrtc::kTraceVideo, ViEId(engine_id_), "%s",
                __FUNCTION__);
   CriticalSectionScoped cs(device_info_cs_.get());
-  if (capture_device_info_ == NULL)
-    capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(
-        ViEModuleId(engine_id_));
+  GetDeviceInfo();
   assert(capture_device_info_);
   return capture_device_info_->NumberOfDevices();
 }
@@ -77,9 +76,7 @@ int ViEInputManager::GetDeviceName(uint32_t device_number,
   WEBRTC_TRACE(webrtc::kTraceInfo, webrtc::kTraceVideo, ViEId(engine_id_),
                "%s(device_number: %d)", __FUNCTION__, device_number);
   CriticalSectionScoped cs(device_info_cs_.get());
-  if (capture_device_info_ == NULL)
-    capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(
-        ViEModuleId(engine_id_));
+  GetDeviceInfo();
   assert(capture_device_info_);
   return capture_device_info_->GetDeviceName(device_number, device_nameUTF8,
                                              device_name_length,
@@ -92,9 +89,7 @@ int ViEInputManager::NumberOfCaptureCapabilities(
   WEBRTC_TRACE(webrtc::kTraceInfo, webrtc::kTraceVideo, ViEId(engine_id_), "%s",
                __FUNCTION__);
   CriticalSectionScoped cs(device_info_cs_.get());
-  if (capture_device_info_ == NULL)
-    capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(
-        ViEModuleId(engine_id_));
+  GetDeviceInfo();
   assert(capture_device_info_);
   return capture_device_info_->NumberOfCapabilities(device_unique_idUTF8);
 }
@@ -107,9 +102,7 @@ int ViEInputManager::GetCaptureCapability(
                "%s(device_unique_idUTF8: %s, device_capability_number: %d)",
                __FUNCTION__, device_unique_idUTF8, device_capability_number);
   CriticalSectionScoped cs(device_info_cs_.get());
-  if (capture_device_info_ == NULL)
-    capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(
-        ViEModuleId(engine_id_));
+  GetDeviceInfo();
   assert(capture_device_info_);
   VideoCaptureCapability module_capability;
   int result = capture_device_info_->GetCapability(device_unique_idUTF8,
@@ -135,9 +128,7 @@ int ViEInputManager::GetOrientation(const char* device_unique_idUTF8,
                "%s(device_unique_idUTF8: %s,)", __FUNCTION__,
                device_unique_idUTF8);
   CriticalSectionScoped cs(device_info_cs_.get());
-  if (capture_device_info_ == NULL)
-    capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(
-        ViEModuleId(engine_id_));
+  GetDeviceInfo();
   assert(capture_device_info_);
   VideoCaptureRotation module_orientation;
   int result = capture_device_info_->GetOrientation(device_unique_idUTF8,
@@ -167,9 +158,7 @@ int ViEInputManager::DisplayCaptureSettingsDialogBox(
     uint32_t positionX,
     uint32_t positionY) {
   CriticalSectionScoped cs(device_info_cs_.get());
-  if (capture_device_info_ == NULL)
-    capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(
-        ViEModuleId(engine_id_));
+  GetDeviceInfo();
   assert(capture_device_info_);
   return capture_device_info_->DisplayCaptureSettingsDialogBox(
            device_unique_idUTF8, dialog_titleUTF8, parent_window, positionX,
@@ -205,9 +194,7 @@ int ViEInputManager::CreateCaptureDevice(
   // Make sure the device name is valid.
   bool found_device = false;
   CriticalSectionScoped cs_devinfo(device_info_cs_.get());
-  if (capture_device_info_ == NULL)
-    capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(
-        ViEModuleId(engine_id_));
+  GetDeviceInfo();
   assert(capture_device_info_);
   for (uint32_t device_index = 0;
        device_index < capture_device_info_->NumberOfDevices(); ++device_index) {
@@ -426,6 +413,34 @@ ViECapturer* ViEInputManager::ViECapturePtr(int capture_id) const {
   return static_cast<ViECapturer*>(ViEFrameProvider(capture_id));
 }
 
+// Create different DeviceInfo by _config;
+VideoCaptureModule::DeviceInfo* ViEInputManager::GetDeviceInfo() {
+  CaptureDeviceType type = config_.Get<CaptureDeviceInfo>().type;
+
+  if (capture_device_info_ == NULL) {
+    switch (type) {
+      case CaptureDeviceType::Screen:
+#if !defined(ANDROID)
+        capture_device_info_ = DesktopCaptureImpl::CreateDeviceInfo(ViEModuleId(engine_id_),
+                                                                    false);
+#endif
+        break;
+      case CaptureDeviceType::Application:
+#if !defined(ANDROID)
+        capture_device_info_ = DesktopCaptureImpl::CreateDeviceInfo(ViEModuleId(engine_id_),
+                                                                    true);
+#endif
+        break;
+      case CaptureDeviceType::Camera:
+        capture_device_info_ = VideoCaptureFactory::CreateDeviceInfo(ViEModuleId(engine_id_));
+        break;
+      default:
+        // Don't try to build anything for unknown/unsupported types
+        break;
+    }
+  }
+  return capture_device_info_;
+}
 ViEInputManagerScoped::ViEInputManagerScoped(
     const ViEInputManager& vie_input_manager)
     : ViEManagerScopedBase(vie_input_manager) {
diff --git a/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.h b/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.h
index a4db9a70fea..26252069f01 100644
--- a/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.h
+++ b/media/webrtc/trunk/webrtc/video_engine/vie_input_manager.h
@@ -77,7 +77,8 @@ class ViEInputManager : private ViEManagerBase {
   int CreateExternalCaptureDevice(ViEExternalCapture*& external_capture,
                                   int& capture_id);
   int DestroyCaptureDevice(int capture_id);
-
+ protected:
+  VideoCaptureModule::DeviceInfo* GetDeviceInfo();
  private:
   // Gets and allocates a free capture device id. Assumed protected by caller.
   bool GetFreeCaptureId(int* freecapture_id);
diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index ded06f32a2b..4f16152cd6f 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -428,6 +428,12 @@ pref("javascript.options.mem.gc_low_frequency_heap_growth", 120);
 pref("javascript.options.mem.high_water_mark", 16);
 pref("javascript.options.mem.gc_allocation_threshold_mb", 3);
 pref("javascript.options.mem.gc_decommit_threshold_mb", 1);
+#ifdef JSGC_GENERATIONAL
+pref("javascript.options.mem.gc_min_empty_chunk_count", 1);
+#else
+pref("javascript.options.mem.gc_min_empty_chunk_count", 0);
+#endif
+pref("javascript.options.mem.gc_max_empty_chunk_count", 2);
 #else
 pref("javascript.options.mem.high_water_mark", 32);
 #endif
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index 71f17d21767..236856e1978 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -357,6 +357,12 @@ pref("media.navigator.enabled", true);
 #endif
 #endif
 
+// do not enable screensharing before addressing security concerns: Bug 1035577
+// do not enable screensharing before implementing app/window sharing: Bug 1036653
+// do not enable screensharing before source constraints are finalized: Bug 1033885
+// do not enable screensharing before UX is ready: Bug 1035577
+pref("media.getusermedia.screensharing.enabled", false);
+
 // TextTrack support
 pref("media.webvtt.enabled", true);
 pref("media.webvtt.regions.enabled", false);
@@ -894,6 +900,12 @@ pref("javascript.options.mem.gc_dynamic_heap_growth", true);
 pref("javascript.options.mem.gc_dynamic_mark_slice", true);
 pref("javascript.options.mem.gc_allocation_threshold_mb", 30);
 pref("javascript.options.mem.gc_decommit_threshold_mb", 32);
+#ifdef JSGC_GENERATIONAL
+pref("javascript.options.mem.gc_min_empty_chunk_count", 1);
+#else
+pref("javascript.options.mem.gc_min_empty_chunk_count", 0);
+#endif
+pref("javascript.options.mem.gc_max_empty_chunk_count", 30);
 
 pref("javascript.options.showInConsole", false);
 
diff --git a/netwerk/base/public/nsISpeculativeConnect.idl b/netwerk/base/public/nsISpeculativeConnect.idl
index f4bcd3cf403..aabe54278db 100644
--- a/netwerk/base/public/nsISpeculativeConnect.idl
+++ b/netwerk/base/public/nsISpeculativeConnect.idl
@@ -35,7 +35,7 @@ interface nsISpeculativeConnect : nsISupports
  * inline) to determine whether or not to actually make a speculative
  * connection.
  */
-[builtinclass, uuid(2b6d6fb6-ab28-4f4c-af84-bfdbb7866d72)]
+[builtinclass, uuid(a9cdd875-2ef8-4d53-95d6-e4e18f65e0db)]
 interface nsISpeculativeConnectionOverrider : nsISupports
 {
     /**
@@ -57,4 +57,10 @@ interface nsISpeculativeConnectionOverrider : nsISupports
      * connection.
      */
     [infallible] readonly attribute boolean ignoreIdle;
+
+    /*
+     * Used by the Predictor to gather telemetry data on speculative connection
+     * usage.
+     */
+    [infallible] readonly attribute boolean isFromPredictor;
 };
diff --git a/netwerk/base/src/Predictor.cpp b/netwerk/base/src/Predictor.cpp
index e23e43d884a..007c0682d10 100644
--- a/netwerk/base/src/Predictor.cpp
+++ b/netwerk/base/src/Predictor.cpp
@@ -388,6 +388,13 @@ Predictor::GetParallelSpeculativeConnectLimit(
   return NS_OK;
 }
 
+NS_IMETHODIMP
+Predictor::GetIsFromPredictor(bool *isFromPredictor)
+{
+  *isFromPredictor = true;
+  return NS_OK;
+}
+
 // Predictor::nsIInterfaceRequestor
 
 NS_IMETHODIMP
diff --git a/netwerk/cache2/AppCacheStorage.cpp b/netwerk/cache2/AppCacheStorage.cpp
index 69c03fb0f18..6f54347cb6d 100644
--- a/netwerk/cache2/AppCacheStorage.cpp
+++ b/netwerk/cache2/AppCacheStorage.cpp
@@ -84,6 +84,12 @@ NS_IMETHODIMP AppCacheStorage::AsyncOpenURI(nsIURI *aURI,
   return NS_OK;
 }
 
+NS_IMETHODIMP AppCacheStorage::OpenTruncate(nsIURI *aURI, const nsACString & aIdExtension,
+                                            nsICacheEntry **aCacheEntry)
+{
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 NS_IMETHODIMP AppCacheStorage::Exists(nsIURI *aURI, const nsACString & aIdExtension,
                                       bool *aResult)
 {
diff --git a/netwerk/cache2/CacheFileIOManager.cpp b/netwerk/cache2/CacheFileIOManager.cpp
index a4500bfd12d..db49a238718 100644
--- a/netwerk/cache2/CacheFileIOManager.cpp
+++ b/netwerk/cache2/CacheFileIOManager.cpp
@@ -881,7 +881,7 @@ public:
       if (!mIOMan) {
         mRV = NS_ERROR_NOT_INITIALIZED;
       } else {
-        mRV = mIOMan->DoomFileByKeyInternal(&mHash);
+        mRV = mIOMan->DoomFileByKeyInternal(&mHash, false);
         mIOMan = nullptr;
       }
 
@@ -2161,10 +2161,11 @@ CacheFileIOManager::DoomFileByKey(const nsACString &aKey,
 }
 
 nsresult
-CacheFileIOManager::DoomFileByKeyInternal(const SHA1Sum::Hash *aHash)
+CacheFileIOManager::DoomFileByKeyInternal(const SHA1Sum::Hash *aHash,
+                                          bool aFailIfAlreadyDoomed)
 {
-  LOG(("CacheFileIOManager::DoomFileByKeyInternal() [hash=%08x%08x%08x%08x%08x]"
-       , LOGSHA1(aHash)));
+  LOG(("CacheFileIOManager::DoomFileByKeyInternal() [hash=%08x%08x%08x%08x%08x,"
+        " failIfAlreadyDoomed=%d]", LOGSHA1(aHash), aFailIfAlreadyDoomed));
 
   MOZ_ASSERT(CacheFileIOManager::IsOnIOThreadOrCeased());
 
@@ -2186,7 +2187,7 @@ CacheFileIOManager::DoomFileByKeyInternal(const SHA1Sum::Hash *aHash)
     handle->Log();
 
     if (handle->IsDoomed()) {
-      return NS_OK;
+      return aFailIfAlreadyDoomed ? NS_ERROR_NOT_AVAILABLE : NS_OK;
     }
 
     return DoomFileInternal(handle);
@@ -2701,7 +2702,7 @@ CacheFileIOManager::OverLimitEvictionInternal()
     rv = CacheIndex::GetEntryForEviction(&hash, &cnt);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = DoomFileByKeyInternal(&hash);
+    rv = DoomFileByKeyInternal(&hash, true);
     if (NS_SUCCEEDED(rv)) {
       consecutiveFailures = 0;
     } else if (rv == NS_ERROR_NOT_AVAILABLE) {
@@ -2709,6 +2710,16 @@ CacheFileIOManager::OverLimitEvictionInternal()
            "DoomFileByKeyInternal() failed. [rv=0x%08x]", rv));
       // TODO index is outdated, start update
 
+#ifdef DEBUG
+      // Dooming should never fail due to already doomed handle, but bug 1028415
+      // shows that this unexpected state can happen. Assert in debug build so
+      // we can find the cause if we ever find a way to reproduce it with NSPR
+      // logging enabled.
+      nsRefPtr<CacheFileHandle> handle;
+      mHandles.GetHandle(&hash, true, getter_AddRefs(handle));
+      MOZ_ASSERT(!handle || !handle->IsDoomed());
+#endif
+
       // Make sure index won't return the same entry again
       CacheIndex::RemoveEntry(&hash);
       consecutiveFailures = 0;
diff --git a/netwerk/cache2/CacheFileIOManager.h b/netwerk/cache2/CacheFileIOManager.h
index 98cb1de5600..00c0d454c7b 100644
--- a/netwerk/cache2/CacheFileIOManager.h
+++ b/netwerk/cache2/CacheFileIOManager.h
@@ -331,7 +331,8 @@ private:
   nsresult WriteInternal(CacheFileHandle *aHandle, int64_t aOffset,
                          const char *aBuf, int32_t aCount, bool aValidate);
   nsresult DoomFileInternal(CacheFileHandle *aHandle);
-  nsresult DoomFileByKeyInternal(const SHA1Sum::Hash *aHash);
+  nsresult DoomFileByKeyInternal(const SHA1Sum::Hash *aHash,
+                                 bool aFailIfAlreadyDoomed);
   nsresult ReleaseNSPRHandleInternal(CacheFileHandle *aHandle);
   nsresult TruncateSeekSetEOFInternal(CacheFileHandle *aHandle,
                                       int64_t aTruncatePos, int64_t aEOFPos);
diff --git a/netwerk/cache2/CacheFileInputStream.cpp b/netwerk/cache2/CacheFileInputStream.cpp
index fecfed3b46c..4c3cfd8d4cf 100644
--- a/netwerk/cache2/CacheFileInputStream.cpp
+++ b/netwerk/cache2/CacheFileInputStream.cpp
@@ -49,7 +49,6 @@ CacheFileInputStream::CacheFileInputStream(CacheFile *aFile)
   , mStatus(NS_OK)
   , mWaitingForUpdate(false)
   , mListeningForChunk(-1)
-  , mInReadSegments(false)
   , mCallbackFlags(0)
 {
   LOG(("CacheFileInputStream::CacheFileInputStream() [this=%p]", this));
@@ -74,7 +73,6 @@ NS_IMETHODIMP
 CacheFileInputStream::Available(uint64_t *_retval)
 {
   CacheFileAutoLock lock(mFile);
-  MOZ_ASSERT(!mInReadSegments);
 
   if (mClosed) {
     LOG(("CacheFileInputStream::Available() - Stream is closed. [this=%p, "
@@ -116,7 +114,6 @@ CacheFileInputStream::ReadSegments(nsWriteSegmentFun aWriter, void *aClosure,
                                    uint32_t aCount, uint32_t *_retval)
 {
   CacheFileAutoLock lock(mFile);
-  MOZ_ASSERT(!mInReadSegments);
 
   LOG(("CacheFileInputStream::ReadSegments() [this=%p, count=%d]",
        this, aCount));
@@ -164,24 +161,8 @@ CacheFileInputStream::ReadSegments(nsWriteSegmentFun aWriter, void *aClosure,
     } else if (canRead > 0) {
       uint32_t toRead = std::min(static_cast<uint32_t>(canRead), aCount);
 
-      // We need to release the lock to avoid lock re-entering unless the
-      // caller is Read() method.
-#ifdef DEBUG
-      int64_t oldPos = mPos;
-#endif
-      mInReadSegments = true;
-      if (aWriter != (nsWriteSegmentFun)NS_CopySegmentToBuffer) {
-        lock.Unlock();
-      }
       uint32_t read;
       rv = aWriter(this, aClosure, buf, *_retval, toRead, &read);
-      if (aWriter != (nsWriteSegmentFun)NS_CopySegmentToBuffer) {
-        lock.Lock();
-      }
-      mInReadSegments = false;
-#ifdef DEBUG
-      MOZ_ASSERT(oldPos == mPos);
-#endif
 
       if (NS_SUCCEEDED(rv)) {
         MOZ_ASSERT(read <= toRead,
@@ -243,8 +224,6 @@ CacheFileInputStream::CloseWithStatusLocked(nsresult aStatus)
   LOG(("CacheFileInputStream::CloseWithStatusLocked() [this=%p, "
        "aStatus=0x%08x]", this, aStatus));
 
-  MOZ_ASSERT(!mInReadSegments);
-
   if (mClosed) {
     MOZ_ASSERT(!mCallback);
     return NS_OK;
@@ -271,7 +250,6 @@ CacheFileInputStream::AsyncWait(nsIInputStreamCallback *aCallback,
                                 nsIEventTarget *aEventTarget)
 {
   CacheFileAutoLock lock(mFile);
-  MOZ_ASSERT(!mInReadSegments);
 
   LOG(("CacheFileInputStream::AsyncWait() [this=%p, callback=%p, flags=%d, "
        "requestedCount=%d, eventTarget=%p]", this, aCallback, aFlags,
@@ -306,7 +284,6 @@ NS_IMETHODIMP
 CacheFileInputStream::Seek(int32_t whence, int64_t offset)
 {
   CacheFileAutoLock lock(mFile);
-  MOZ_ASSERT(!mInReadSegments);
 
   LOG(("CacheFileInputStream::Seek() [this=%p, whence=%d, offset=%lld]",
        this, whence, offset));
@@ -341,7 +318,6 @@ NS_IMETHODIMP
 CacheFileInputStream::Tell(int64_t *_retval)
 {
   CacheFileAutoLock lock(mFile);
-  MOZ_ASSERT(!mInReadSegments);
 
   if (mClosed) {
     LOG(("CacheFileInputStream::Tell() - Stream is closed. [this=%p]", this));
@@ -381,7 +357,6 @@ CacheFileInputStream::OnChunkAvailable(nsresult aResult, uint32_t aChunkIdx,
                                        CacheFileChunk *aChunk)
 {
   CacheFileAutoLock lock(mFile);
-  MOZ_ASSERT(!mInReadSegments);
 
   LOG(("CacheFileInputStream::OnChunkAvailable() [this=%p, result=0x%08x, "
        "idx=%d, chunk=%p]", this, aResult, aChunkIdx, aChunk));
@@ -432,7 +407,6 @@ nsresult
 CacheFileInputStream::OnChunkUpdated(CacheFileChunk *aChunk)
 {
   CacheFileAutoLock lock(mFile);
-  MOZ_ASSERT(!mInReadSegments);
 
   LOG(("CacheFileInputStream::OnChunkUpdated() [this=%p, idx=%d]",
        this, aChunk->Index()));
diff --git a/netwerk/cache2/CacheFileInputStream.h b/netwerk/cache2/CacheFileInputStream.h
index f9fa4f51d2f..a62efdd564b 100644
--- a/netwerk/cache2/CacheFileInputStream.h
+++ b/netwerk/cache2/CacheFileInputStream.h
@@ -60,7 +60,6 @@ private:
   nsresult                 mStatus;
   bool                     mWaitingForUpdate;
   int64_t                  mListeningForChunk;
-  bool                     mInReadSegments;
 
   nsCOMPtr<nsIInputStreamCallback> mCallback;
   uint32_t                         mCallbackFlags;
diff --git a/netwerk/cache2/CacheFileMetadata.cpp b/netwerk/cache2/CacheFileMetadata.cpp
index dc49137ada2..624bdb7b08b 100644
--- a/netwerk/cache2/CacheFileMetadata.cpp
+++ b/netwerk/cache2/CacheFileMetadata.cpp
@@ -272,7 +272,7 @@ CacheFileMetadata::WriteMetadata(uint32_t aOffset,
     // result from some reason fails during shutdown, we would unnecessarily leak
     // both this object and the buffer.
     writeBuffer = static_cast<char *>(moz_xmalloc(p - mWriteBuf));
-    memcpy(mWriteBuf, writeBuffer, p - mWriteBuf);
+    memcpy(writeBuffer, mWriteBuf, p - mWriteBuf);
   }
 
   rv = CacheFileIOManager::Write(mHandle, aOffset, writeBuffer, p - mWriteBuf,
diff --git a/netwerk/cache2/CacheStorage.cpp b/netwerk/cache2/CacheStorage.cpp
index 6844be36a7f..c98c44d9ad5 100644
--- a/netwerk/cache2/CacheStorage.cpp
+++ b/netwerk/cache2/CacheStorage.cpp
@@ -105,6 +105,33 @@ NS_IMETHODIMP CacheStorage::AsyncOpenURI(nsIURI *aURI,
 }
 
 
+NS_IMETHODIMP CacheStorage::OpenTruncate(nsIURI *aURI, const nsACString & aIdExtension,
+                                         nsICacheEntry **aCacheEntry)
+{
+  if (!CacheStorageService::Self())
+    return NS_ERROR_NOT_INITIALIZED;
+
+  nsresult rv;
+
+  nsCOMPtr<nsIURI> noRefURI;
+  rv = aURI->CloneIgnoringRef(getter_AddRefs(noRefURI));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsRefPtr<CacheEntryHandle> entry;
+  rv = CacheStorageService::Self()->AddStorageEntry(
+    this, noRefURI, aIdExtension,
+    true, // create always
+    true, // replace any existing one
+    getter_AddRefs(entry));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Just open w/o callback, similar to nsICacheEntry.recreate().
+  entry->Entry()->AsyncOpen(nullptr, OPEN_TRUNCATE);
+  entry.forget(aCacheEntry);
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP CacheStorage::Exists(nsIURI *aURI, const nsACString & aIdExtension,
                                    bool *aResult)
 {
diff --git a/netwerk/cache2/OldWrappers.cpp b/netwerk/cache2/OldWrappers.cpp
index 007193e110b..5e4979ff3ab 100644
--- a/netwerk/cache2/OldWrappers.cpp
+++ b/netwerk/cache2/OldWrappers.cpp
@@ -944,6 +944,12 @@ NS_IMETHODIMP _OldStorage::AsyncOpenURI(nsIURI *aURI,
   return NS_OK;
 }
 
+NS_IMETHODIMP _OldStorage::OpenTruncate(nsIURI *aURI, const nsACString & aIdExtension,
+                                        nsICacheEntry **aCacheEntry)
+{
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 NS_IMETHODIMP _OldStorage::Exists(nsIURI *aURI, const nsACString & aIdExtension,
                                    bool *aResult)
 {
diff --git a/netwerk/cache2/nsICacheStorage.idl b/netwerk/cache2/nsICacheStorage.idl
index f8d681d300e..991d050a61b 100644
--- a/netwerk/cache2/nsICacheStorage.idl
+++ b/netwerk/cache2/nsICacheStorage.idl
@@ -5,6 +5,7 @@
 #include "nsISupports.idl"
 
 interface nsIURI;
+interface nsICacheEntry;
 interface nsICacheEntryOpenCallback;
 interface nsICacheEntryDoomCallback;
 interface nsICacheStorageVisitor;
@@ -14,7 +15,7 @@ interface nsICacheStorageVisitor;
  * in-mem+on-disk, in-mem+on-disk+app-cache or just a specific
  * app-cache storage.
  */
-[scriptable, uuid(d9006881-a536-4ce3-bc48-e7f94b40a690)]
+[scriptable, uuid(35d104a6-d252-4fd4-8a56-3c14657cad3b)]
 interface nsICacheStorage : nsISupports
 {
   /**
@@ -77,6 +78,21 @@ interface nsICacheStorage : nsISupports
                     in uint32_t aFlags,
                     in nsICacheEntryOpenCallback aCallback);
 
+  /**
+   * Immediately opens a new and empty cache entry in the storage, any existing
+   * entries are immediately doomed.  This is similar to the recreate() method
+   * on nsICacheEntry.
+   *
+   * Storage may not implement this method and throw NS_ERROR_NOT_IMPLEMENTED.
+   * In that case consumer must use asyncOpen with OPEN_TRUNCATE flag and get
+   * the new entry via a callback.
+   *
+   * @param aURI @see asyncOpenURI
+   * @param aIdExtension @see asyncOpenURI
+   */
+  nsICacheEntry openTruncate(in nsIURI aURI,
+                             in ACString aIdExtension);
+
   /**
    * Synchronously check on existance of an entry.  In case of disk entries
    * this uses information from the cache index.  When the index data are not
diff --git a/netwerk/protocol/http/nsHttpChannel.cpp b/netwerk/protocol/http/nsHttpChannel.cpp
index 4972efcf5d6..ce4e3089e55 100644
--- a/netwerk/protocol/http/nsHttpChannel.cpp
+++ b/netwerk/protocol/http/nsHttpChannel.cpp
@@ -2740,7 +2740,7 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
         (appCache ||
          (mCacheEntryIsReadOnly && !(mLoadFlags & nsIRequest::INHIBIT_CACHING)) ||
          mFallbackChannel)) {
-        rv = OpenCacheInputStream(entry, true);
+        rv = OpenCacheInputStream(entry, true, !!appCache);
         if (NS_SUCCEEDED(rv)) {
             mCachedContentIsValid = true;
             entry->MaybeMarkValid();
@@ -2791,7 +2791,7 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
             rv = MaybeSetupByteRangeRequest(size, contentLength);
             mCachedContentIsPartial = NS_SUCCEEDED(rv) && mIsPartialRequest;
             if (mCachedContentIsPartial) {
-                rv = OpenCacheInputStream(entry, false);
+                rv = OpenCacheInputStream(entry, false, !!appCache);
                 *aResult = ENTRY_NEEDS_REVALIDATION;
             }
             return rv;
@@ -2987,7 +2987,7 @@ nsHttpChannel::OnCacheEntryCheck(nsICacheEntry* entry, nsIApplicationCache* appC
     }
 
     if (mCachedContentIsValid || mDidReval) {
-        rv = OpenCacheInputStream(entry, mCachedContentIsValid);
+        rv = OpenCacheInputStream(entry, mCachedContentIsValid, !!appCache);
         if (NS_FAILED(rv)) {
             // If we can't get the entity then we have to act as though we
             // don't have the cache entry.
@@ -3379,7 +3379,8 @@ nsHttpChannel::ShouldUpdateOfflineCacheEntry()
 }
 
 nsresult
-nsHttpChannel::OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBuffering)
+nsHttpChannel::OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBuffering,
+                                    bool checkingAppCacheEntry)
 {
     nsresult rv;
 
@@ -3399,8 +3400,9 @@ nsHttpChannel::OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBufferi
 
         // XXX: We should not be skilling this check in the offline cache
         // case, but we have to do so now to work around bug 794507.
-        MOZ_ASSERT(mCachedSecurityInfo || mLoadedFromApplicationCache);
-        if (!mCachedSecurityInfo && !mLoadedFromApplicationCache) {
+        bool mustHaveSecurityInfo = !mLoadedFromApplicationCache && !checkingAppCacheEntry;
+        MOZ_ASSERT(mCachedSecurityInfo || !mustHaveSecurityInfo);
+        if (!mCachedSecurityInfo && mustHaveSecurityInfo) {
             LOG(("mCacheEntry->GetSecurityInfo returned success but did not "
                  "return the security info [channel=%p, entry=%p]",
                  this, cacheEntry));
diff --git a/netwerk/protocol/http/nsHttpChannel.h b/netwerk/protocol/http/nsHttpChannel.h
index 7acdaa78873..cf567a88868 100644
--- a/netwerk/protocol/http/nsHttpChannel.h
+++ b/netwerk/protocol/http/nsHttpChannel.h
@@ -328,7 +328,8 @@ private:
                      bool ignoreMissingPartialLen = false) const;
     nsresult MaybeSetupByteRangeRequest(int64_t partialLen, int64_t contentLength);
     nsresult SetupByteRangeRequest(int64_t partialLen);
-    nsresult OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBuffering);
+    nsresult OpenCacheInputStream(nsICacheEntry* cacheEntry, bool startBuffering,
+                                  bool checkingAppCacheEntry);
 
 private:
     nsCOMPtr<nsISupports>             mSecurityInfo;
diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.cpp b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
index 92675877799..2a3c16801a1 100644
--- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
@@ -359,6 +359,7 @@ public: // intentional!
     uint32_t mParallelSpeculativeConnectLimit;
     bool mIgnoreIdle;
     bool mIgnorePossibleSpdyConnections;
+    bool mIsFromPredictor;
 
     // As above, added manually so we can use nsRefPtr without inheriting from
     // nsISupports
@@ -407,6 +408,7 @@ nsHttpConnectionMgr::SpeculativeConnect(nsHttpConnectionInfo *ci,
         overrider->GetIgnoreIdle(&args->mIgnoreIdle);
         overrider->GetIgnorePossibleSpdyConnections(
             &args->mIgnorePossibleSpdyConnections);
+        overrider->GetIsFromPredictor(&args->mIsFromPredictor);
     }
 
     nsresult rv =
@@ -1401,6 +1403,11 @@ nsHttpConnectionMgr::MakeNewConnection(nsConnectionEntry *ent,
             Telemetry::AutoCounter<Telemetry::HTTPCONNMGR_USED_SPECULATIVE_CONN> usedSpeculativeConn;
             ++usedSpeculativeConn;
 
+            if (ent->mHalfOpens[i]->IsFromPredictor()) {
+              Telemetry::AutoCounter<Telemetry::PREDICTOR_TOTAL_PRECONNECTS_USED> totalPreconnectsUsed;
+              ++totalPreconnectsUsed;
+            }
+
             // return OK because we have essentially opened a new connection
             // by converting a speculative half-open to general use
             return NS_OK;
@@ -2061,7 +2068,8 @@ nsresult
 nsHttpConnectionMgr::CreateTransport(nsConnectionEntry *ent,
                                      nsAHttpTransaction *trans,
                                      uint32_t caps,
-                                     bool speculative)
+                                     bool speculative,
+                                     bool isFromPredictor)
 {
     MOZ_ASSERT(PR_GetCurrentThread() == gSocketThread);
 
@@ -2070,6 +2078,12 @@ nsHttpConnectionMgr::CreateTransport(nsConnectionEntry *ent,
         sock->SetSpeculative(true);
         Telemetry::AutoCounter<Telemetry::HTTPCONNMGR_TOTAL_SPECULATIVE_CONN> totalSpeculativeConn;
         ++totalSpeculativeConn;
+
+        if (isFromPredictor) {
+          sock->SetIsFromPredictor(true);
+          Telemetry::AutoCounter<Telemetry::PREDICTOR_TOTAL_PRECONNECTS_CREATED> totalPreconnectsCreated;
+          ++totalPreconnectsCreated;
+        }
     }
 
     nsresult rv = sock->SetupPrimaryStreams();
@@ -2785,11 +2799,13 @@ nsHttpConnectionMgr::OnMsgSpeculativeConnect(int32_t, void *param)
         gHttpHandler->ParallelSpeculativeConnectLimit();
     bool ignorePossibleSpdyConnections = false;
     bool ignoreIdle = false;
+    bool isFromPredictor = false;
 
     if (args->mOverridesOK) {
         parallelSpeculativeConnectLimit = args->mParallelSpeculativeConnectLimit;
         ignorePossibleSpdyConnections = args->mIgnorePossibleSpdyConnections;
         ignoreIdle = args->mIgnoreIdle;
+        isFromPredictor = args->mIsFromPredictor;
     }
 
     if (mNumHalfOpenConns < parallelSpeculativeConnectLimit &&
@@ -2797,7 +2813,7 @@ nsHttpConnectionMgr::OnMsgSpeculativeConnect(int32_t, void *param)
          !ent->mIdleConns.Length()) &&
         !RestrictConnections(ent, ignorePossibleSpdyConnections) &&
         !AtActiveConnectionLimit(ent, args->mTrans->Caps())) {
-        CreateTransport(ent, args->mTrans, args->mTrans->Caps(), true);
+        CreateTransport(ent, args->mTrans, args->mTrans->Caps(), true, isFromPredictor);
     }
     else {
         LOG(("  Transport not created due to existing connection count\n"));
@@ -2846,6 +2862,7 @@ nsHalfOpenSocket::nsHalfOpenSocket(nsConnectionEntry *ent,
     , mTransaction(trans)
     , mCaps(caps)
     , mSpeculative(false)
+    , mIsFromPredictor(false)
     , mHasConnected(false)
     , mPrimaryConnectedOK(false)
     , mBackupConnectedOK(false)
@@ -3716,6 +3733,11 @@ nsConnectionEntry::RemoveHalfOpen(nsHalfOpenSocket *halfOpen)
     if (halfOpen->IsSpeculative()) {
       Telemetry::AutoCounter<Telemetry::HTTPCONNMGR_UNUSED_SPECULATIVE_CONN> unusedSpeculativeConn;
       ++unusedSpeculativeConn;
+
+      if (halfOpen->IsFromPredictor()) {
+        Telemetry::AutoCounter<Telemetry::PREDICTOR_TOTAL_PRECONNECTS_UNUSED> totalPreconnectsUnused;
+        ++totalPreconnectsUnused;
+      }
     }
 
     // A failure to create the transport object at all
diff --git a/netwerk/protocol/http/nsHttpConnectionMgr.h b/netwerk/protocol/http/nsHttpConnectionMgr.h
index 7be89c180af..73a67e9776f 100644
--- a/netwerk/protocol/http/nsHttpConnectionMgr.h
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.h
@@ -451,6 +451,9 @@ private:
         bool IsSpeculative() { return mSpeculative; }
         void SetSpeculative(bool val) { mSpeculative = val; }
 
+        bool IsFromPredictor() { return mIsFromPredictor; }
+        void SetIsFromPredictor(bool val) { mIsFromPredictor = val; }
+
         bool HasConnected() { return mHasConnected; }
 
         void PrintDiagnostics(nsCString &log);
@@ -471,6 +474,11 @@ private:
         // more connections that are needed.)
         bool                           mSpeculative;
 
+        // mIsFromPredictor is set if the socket originated from the network
+        // Predictor. It is used to gather telemetry data on used speculative
+        // connections from the predictor.
+        bool                           mIsFromPredictor;
+
         TimeStamp             mPrimarySynStarted;
         TimeStamp             mBackupSynStarted;
 
@@ -541,7 +549,7 @@ private:
     void     ClosePersistentConnections(nsConnectionEntry *ent);
     void     ReportProxyTelemetry(nsConnectionEntry *ent);
     nsresult CreateTransport(nsConnectionEntry *, nsAHttpTransaction *,
-                             uint32_t, bool);
+                             uint32_t, bool, bool = false);
     void     AddActiveConn(nsHttpConnection *, nsConnectionEntry *);
     void     DecrementActiveConnCount(nsHttpConnection *);
     void     StartedConnect();
diff --git a/netwerk/test/unit/test_cache2-01f-basic-openTruncate.js b/netwerk/test/unit/test_cache2-01f-basic-openTruncate.js
new file mode 100644
index 00000000000..d1ef54b5fc7
--- /dev/null
+++ b/netwerk/test/unit/test_cache2-01f-basic-openTruncate.js
@@ -0,0 +1,24 @@
+function run_test()
+{
+  do_get_profile();
+
+  if (!newCacheBackEndUsed()) {
+    do_check_true(true, "This test doesn't run when the old cache back end is used since the behavior is different");
+    return;
+  }
+
+  var storage = getCacheStorage("disk");
+  var entry = storage.openTruncate(createURI("http://new1/"), "");
+  do_check_true(!!entry);
+
+  // Fill the entry, and when done, check it's content
+  (new OpenCallback(NEW, "meta", "data", function() {
+    asyncOpenCacheEntry("http://new1/", "disk", Ci.nsICacheStorage.OPEN_NORMALLY, null,
+      new OpenCallback(NORMAL, "meta", "data", function() {
+        finish_cache2_test();
+      })
+    );
+  })).onCacheEntryAvailable(entry, true, null, 0);
+
+  do_test_pending();
+}
diff --git a/netwerk/test/unit/xpcshell.ini b/netwerk/test/unit/xpcshell.ini
index 7215c9968e7..2168531beb8 100644
--- a/netwerk/test/unit/xpcshell.ini
+++ b/netwerk/test/unit/xpcshell.ini
@@ -26,6 +26,7 @@ support-files =
 [test_cache2-01c-basic-hasmeta-only.js]
 [test_cache2-01d-basic-not-wanted.js]
 [test_cache2-01e-basic-bypass-if-busy.js]
+[test_cache2-01f-basic-openTruncate.js]
 [test_cache2-02-open-non-existing.js]
 [test_cache2-03-oncacheentryavail-throws.js]
 [test_cache2-04-oncacheentryavail-throws2x.js]
diff --git a/security/apps/AppTrustDomain.cpp b/security/apps/AppTrustDomain.cpp
index 41bc3f82379..4789ad02845 100644
--- a/security/apps/AppTrustDomain.cpp
+++ b/security/apps/AppTrustDomain.cpp
@@ -219,4 +219,10 @@ AppTrustDomain::IsChainValid(const DERArray& certChain)
   return ConstructCERTCertListFromReversedDERArray(certChain, mCertChain);
 }
 
+SECStatus
+AppTrustDomain::CheckPublicKey(const SECItem& subjectPublicKeyInfo)
+{
+  return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
+}
+
 } } // namespace mozilla::psm
diff --git a/security/apps/AppTrustDomain.h b/security/apps/AppTrustDomain.h
index 9bf23f36e13..ba3fda4c655 100644
--- a/security/apps/AppTrustDomain.h
+++ b/security/apps/AppTrustDomain.h
@@ -38,6 +38,7 @@ public:
               const SECItem& subjectPublicKeyInfo) MOZ_OVERRIDE;
   SECStatus DigestBuf(const SECItem& item, /*out*/ uint8_t* digestBuf,
                       size_t digestBufLen) MOZ_OVERRIDE;
+  SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo) MOZ_OVERRIDE;
 
 private:
   /*out*/ ScopedCERTCertList& mCertChain;
diff --git a/security/build/nss.def b/security/build/nss.def
index 6ca176e074d..47ed077581b 100644
--- a/security/build/nss.def
+++ b/security/build/nss.def
@@ -510,6 +510,7 @@ SECKEY_ECParamsToKeySize
 SECKEY_EncodeDERSubjectPublicKeyInfo
 SECKEY_ExtractPublicKey
 SECKEY_PublicKeyStrength
+SECKEY_PublicKeyStrengthInBits
 SECKEY_RSAPSSParamsTemplate DATA
 SECMIME_DecryptionAllowed
 SECMOD_AddNewModule
diff --git a/security/certverifier/NSSCertDBTrustDomain.cpp b/security/certverifier/NSSCertDBTrustDomain.cpp
index c24be27cd02..2f18a63f656 100644
--- a/security/certverifier/NSSCertDBTrustDomain.cpp
+++ b/security/certverifier/NSSCertDBTrustDomain.cpp
@@ -667,6 +667,12 @@ NSSCertDBTrustDomain::IsChainValid(const DERArray& certArray)
   return SECSuccess;
 }
 
+SECStatus
+NSSCertDBTrustDomain::CheckPublicKey(const SECItem& subjectPublicKeyInfo)
+{
+  return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
+}
+
 namespace {
 
 static char*
diff --git a/security/certverifier/NSSCertDBTrustDomain.h b/security/certverifier/NSSCertDBTrustDomain.h
index 3e30cf2b8c0..55dfba1e828 100644
--- a/security/certverifier/NSSCertDBTrustDomain.h
+++ b/security/certverifier/NSSCertDBTrustDomain.h
@@ -77,6 +77,8 @@ public:
 
   virtual SECStatus IsChainValid(const mozilla::pkix::DERArray& certChain);
 
+  virtual SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo);
+
 private:
   enum EncodedResponseSource {
     ResponseIsFromNetwork = 1,
diff --git a/security/manager/boot/src/StaticHPKPins.h b/security/manager/boot/src/StaticHPKPins.h
index 07eaf0aef51..4a3d9684d85 100644
--- a/security/manager/boot/src/StaticHPKPins.h
+++ b/security/manager/boot/src/StaticHPKPins.h
@@ -89,7 +89,7 @@ static const char kDigiCert_High_Assurance_EV_Root_CAFingerprint[] =
 
 /* End Entity Test Cert */
 static const char kEnd_Entity_Test_CertFingerprint[] =
-  "a08RrXscTn7kKTSPR8uZVrmc0o3ryPd+o3menqJHJBw=";
+  "w3a2zMuMdmP9ed7H9HLExM+i+/0UxqHlKszZ5GQpHYM=";
 
 /* Entrust Root Certification Authority */
 static const char kEntrust_Root_Certification_AuthorityFingerprint[] =
@@ -1067,4 +1067,4 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
 
 static const int32_t kUnknownId = -1;
 
-static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1413832295312000);
+static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1413940883162000);
diff --git a/security/manager/ssl/tests/unit/head_psm.js b/security/manager/ssl/tests/unit/head_psm.js
index 92be58dced5..f4231858a0a 100644
--- a/security/manager/ssl/tests/unit/head_psm.js
+++ b/security/manager/ssl/tests/unit/head_psm.js
@@ -35,6 +35,7 @@ const SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE              = SEC_ERROR_BASE +  30;
 const SEC_ERROR_EXTENSION_VALUE_INVALID                 = SEC_ERROR_BASE +  34; // -8158
 const SEC_ERROR_EXTENSION_NOT_FOUND                     = SEC_ERROR_BASE +  35; // -8157
 const SEC_ERROR_CA_CERT_INVALID                         = SEC_ERROR_BASE +  36;
+const SEC_ERROR_INVALID_KEY                             = SEC_ERROR_BASE +  40; // -8152
 const SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION              = SEC_ERROR_BASE +  41;
 const SEC_ERROR_INADEQUATE_KEY_USAGE                    = SEC_ERROR_BASE +  90; // -8102
 const SEC_ERROR_INADEQUATE_CERT_TYPE                    = SEC_ERROR_BASE +  91; // -8101
diff --git a/security/manager/ssl/tests/unit/psm_common_py/CertUtils.py b/security/manager/ssl/tests/unit/psm_common_py/CertUtils.py
index 4f0321b36e1..8ed67d0b0cd 100644
--- a/security/manager/ssl/tests/unit/psm_common_py/CertUtils.py
+++ b/security/manager/ssl/tests/unit/psm_common_py/CertUtils.py
@@ -10,7 +10,7 @@ import pexpect
 import time
 import sys
 
-def init_dsa(db_dir):
+def init_dsa(db_dir, param_filename = 'dsa_param.pem', key_size = '2048'):
     """
     Initialize dsa parameters
 
@@ -18,15 +18,19 @@ def init_dsa(db_dir):
 
     Arguments:
       db_dir     -- location of the temporary params for the certificate
+      param_filename -- the file name for the param file
+      key_size   -- public key size
     """
-    dsa_key_params = db_dir + "/dsa_param.pem"
-    os.system("openssl dsaparam -out " + dsa_key_params + " 2048")
+    dsa_key_params = db_dir + '/' + param_filename
+    os.system("openssl dsaparam -out " + dsa_key_params + ' ' + key_size)
 
 
 def generate_cert_generic(db_dir, dest_dir, serial_num,  key_type, name,
                           ext_text, signer_key_filename = "",
                           signer_cert_filename = "",
-                          subject_string = ""):
+                          subject_string = "",
+                          dsa_param_filename = 'dsa_param.pem',
+                          key_size = '2048'):
     """
     Generate an x509 certificate with a sha256 signature
 
@@ -50,6 +54,8 @@ def generate_cert_generic(db_dir, dest_dir, serial_num,  key_type, name,
                     roots).
       signer_cert_filename -- the certificate that will sign the certificate
                     (used to extract signer info) it must be in DER format.
+      dsa_param_filename -- the filename for the DSA param file
+      key_size   -- public key size for RSA certs
 
     output:
       key_name   -- the filename of the key file (PEM format)
@@ -58,9 +64,9 @@ def generate_cert_generic(db_dir, dest_dir, serial_num,  key_type, name,
     key_name = db_dir + "/"+ name + ".key"
     if key_type == 'rsa':
       os.system ("openssl genpkey -algorithm RSA -out " + key_name +
-                 " -pkeyopt rsa_keygen_bits:2048")
+                 " -pkeyopt rsa_keygen_bits:" + key_size)
     elif key_type == 'dsa':
-      dsa_key_params = db_dir + "/dsa_param.pem"
+      dsa_key_params = db_dir + '/' + dsa_param_filename
       os.system("openssl gendsa -out " + key_name + "  " + dsa_key_params)
     else:
       #assume is ec
diff --git a/security/manager/ssl/tests/unit/test_keysize.js b/security/manager/ssl/tests/unit/test_keysize.js
new file mode 100644
index 00000000000..4333194dbe9
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_keysize.js
@@ -0,0 +1,80 @@
+// -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+"use strict";
+
+// Checks that RSA and DSA certs with key sizes below 1024 bits are rejected.
+
+do_get_profile(); // must be called before getting nsIX509CertDB
+const certdb = Cc["@mozilla.org/security/x509certdb;1"]
+                 .getService(Ci.nsIX509CertDB);
+
+function certFromFile(filename) {
+  let der = readFile(do_get_file("test_keysize/" + filename, false));
+  return certdb.constructX509(der, der.length);
+}
+
+function load_cert(cert_name, trust_string) {
+  let cert_filename = cert_name + ".der";
+  addCertFromFile(certdb, "test_keysize/" + cert_filename, trust_string);
+  return certFromFile(cert_filename);
+}
+
+function check_cert_err_generic(cert, expected_error, usage) {
+  do_print("cert cn=" + cert.commonName);
+  do_print("cert issuer cn=" + cert.issuerCommonName);
+  let hasEVPolicy = {};
+  let verifiedChain = {};
+  let error = certdb.verifyCertNow(cert, usage,
+                                   NO_FLAGS, verifiedChain, hasEVPolicy);
+  equal(error, expected_error);
+}
+
+function check_cert_err(cert, expected_error) {
+  check_cert_err_generic(cert, expected_error, certificateUsageSSLServer)
+}
+
+function check_ok(cert) {
+  return check_cert_err(cert, 0);
+}
+
+function check_ok_ca(cert) {
+  return check_cert_err_generic(cert, 0, certificateUsageSSLCA);
+}
+
+function check_fail(cert) {
+  return check_cert_err(cert, SEC_ERROR_INVALID_KEY);
+}
+
+function check_fail_ca(cert) {
+  return check_cert_err_generic(cert,
+                                SEC_ERROR_INVALID_KEY,
+                                certificateUsageSSLCA);
+}
+
+function check_for_key_type(key_type) {
+  // OK CA -> OK INT -> OK EE
+  check_ok_ca(load_cert(key_type + "-caOK", "CTu,CTu,CTu"));
+  check_ok_ca(load_cert(key_type + "-intOK-caOK", ",,"));
+  check_ok(certFromFile(key_type + "-eeOK-intOK-caOK.der"));
+
+  // Bad CA -> OK INT -> OK EE
+  check_fail_ca(load_cert(key_type + "-caBad", "CTu,CTu,CTu"));
+  check_fail_ca(load_cert(key_type + "-intOK-caBad", ",,"));
+  check_fail(certFromFile(key_type + "-eeOK-intOK-caBad.der"));
+
+  // OK CA -> Bad INT -> OK EE
+  check_fail_ca(load_cert(key_type + "-intBad-caOK", ",,"));
+  check_fail(certFromFile(key_type + "-eeOK-intBad-caOK.der"));
+
+  // OK CA -> OK INT -> Bad EE
+  check_fail(certFromFile(key_type + "-eeBad-intOK-caOK.der"));
+}
+
+function run_test() {
+  check_for_key_type("rsa");
+  check_for_key_type("dsa");
+
+  run_next_test();
+}
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-caBad.der b/security/manager/ssl/tests/unit/test_keysize/dsa-caBad.der
new file mode 100644
index 00000000000..b7ea48d5170
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-caBad.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-caOK.der b/security/manager/ssl/tests/unit/test_keysize/dsa-caOK.der
new file mode 100644
index 00000000000..c57957fc455
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-eeBad-intOK-caOK.der b/security/manager/ssl/tests/unit/test_keysize/dsa-eeBad-intOK-caOK.der
new file mode 100644
index 00000000000..07629f06038
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-eeBad-intOK-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intBad-caOK.der b/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intBad-caOK.der
new file mode 100644
index 00000000000..9b5cf38bf6f
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intBad-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intOK-caBad.der b/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intOK-caBad.der
new file mode 100644
index 00000000000..b3b083d686e
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intOK-caBad.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intOK-caOK.der b/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intOK-caOK.der
new file mode 100644
index 00000000000..97ad32b1e9e
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-eeOK-intOK-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-intBad-caOK.der b/security/manager/ssl/tests/unit/test_keysize/dsa-intBad-caOK.der
new file mode 100644
index 00000000000..79795850171
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-intBad-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-intOK-caBad.der b/security/manager/ssl/tests/unit/test_keysize/dsa-intOK-caBad.der
new file mode 100644
index 00000000000..09476591dc2
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-intOK-caBad.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/dsa-intOK-caOK.der b/security/manager/ssl/tests/unit/test_keysize/dsa-intOK-caOK.der
new file mode 100644
index 00000000000..c12bf885106
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/dsa-intOK-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/generate.py b/security/manager/ssl/tests/unit/test_keysize/generate.py
new file mode 100644
index 00000000000..2879c66e2ac
--- /dev/null
+++ b/security/manager/ssl/tests/unit/test_keysize/generate.py
@@ -0,0 +1,138 @@
+#!/usr/bin/python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import tempfile, os, sys
+import random
+
+libpath = os.path.abspath('../psm_common_py')
+
+sys.path.append(libpath)
+
+import CertUtils
+
+srcdir = os.getcwd()
+db_dir = tempfile.mkdtemp()
+dsaBad_param_filename = 'dsaBad_param.pem'
+dsaOK_param_filename = 'dsaOK_param.pem'
+
+ca_ext_text = 'basicConstraints = critical, CA:TRUE\n'
+ee_ext_text = ''
+
+def generate_certs(key_type, bad_key_size, ok_key_size):
+    if key_type == 'dsa':
+        CertUtils.init_dsa(db_dir, dsaBad_param_filename, bad_key_size)
+        CertUtils.init_dsa(db_dir, dsaOK_param_filename, ok_key_size)
+
+    # OK Chain
+    [caOK_key, caOK_cert] = CertUtils.generate_cert_generic(
+                                db_dir,
+                                srcdir,
+                                random.randint(100, 40000000),
+                                key_type,
+                                key_type + '-caOK',
+                                ca_ext_text,
+                                dsa_param_filename = dsaOK_param_filename,
+                                key_size = ok_key_size)
+
+    [intOK_key, intOK_cert] = CertUtils.generate_cert_generic(
+                                  db_dir,
+                                  srcdir,
+                                  random.randint(100, 40000000),
+                                  key_type,
+                                  key_type + '-intOK-caOK',
+                                  ca_ext_text,
+                                  caOK_key,
+                                  caOK_cert,
+                                  dsa_param_filename = dsaOK_param_filename,
+                                  key_size = ok_key_size)
+
+    CertUtils.generate_cert_generic(db_dir,
+                                    srcdir,
+                                    random.randint(100, 40000000),
+                                    key_type,
+                                    key_type + '-eeOK-intOK-caOK',
+                                    ee_ext_text,
+                                    intOK_key,
+                                    intOK_cert,
+                                    dsa_param_filename = dsaOK_param_filename,
+                                    key_size = ok_key_size)
+
+    # Bad CA
+    [caBad_key, caBad_cert] = CertUtils.generate_cert_generic(
+                                  db_dir,
+                                  srcdir,
+                                  random.randint(100, 40000000),
+                                  key_type,
+                                  key_type + '-caBad',
+                                  ca_ext_text,
+                                  dsa_param_filename = dsaBad_param_filename,
+                                  key_size = bad_key_size)
+
+    [int_key, int_cert] = CertUtils.generate_cert_generic(
+                              db_dir,
+                              srcdir,
+                              random.randint(100, 40000000),
+                              key_type,
+                              key_type + '-intOK-caBad',
+                              ca_ext_text,
+                              caBad_key,
+                              caBad_cert,
+                              dsa_param_filename = dsaOK_param_filename,
+                              key_size = ok_key_size)
+
+    CertUtils.generate_cert_generic(db_dir,
+                                    srcdir,
+                                    random.randint(100, 40000000),
+                                    key_type,
+                                    key_type + '-eeOK-intOK-caBad',
+                                    ee_ext_text,
+                                    int_key,
+                                    int_cert,
+                                    dsa_param_filename = dsaOK_param_filename,
+                                    key_size = ok_key_size)
+
+    # Bad Intermediate
+    [intBad_key, intBad_cert] = CertUtils.generate_cert_generic(
+                                    db_dir,
+                                    srcdir,
+                                    random.randint(100, 40000000),
+                                    key_type,
+                                    key_type + '-intBad-caOK',
+                                    ca_ext_text,
+                                    caOK_key,
+                                    caOK_cert,
+                                    dsa_param_filename = dsaBad_param_filename,
+                                    key_size = bad_key_size)
+
+    CertUtils.generate_cert_generic(db_dir,
+                                    srcdir,
+                                    random.randint(100, 40000000),
+                                    key_type,
+                                    key_type + '-eeOK-intBad-caOK',
+                                    ee_ext_text,
+                                    intBad_key,
+                                    intBad_cert,
+                                    dsa_param_filename = dsaOK_param_filename,
+                                    key_size = ok_key_size)
+
+    # Bad End Entity
+    CertUtils.generate_cert_generic(db_dir,
+                                    srcdir,
+                                    random.randint(100, 40000000),
+                                    key_type,
+                                    key_type + '-eeBad-intOK-caOK',
+                                    ee_ext_text,
+                                    intOK_key,
+                                    intOK_cert,
+                                    dsa_param_filename = dsaBad_param_filename,
+                                    key_size = bad_key_size)
+
+# SECKEY_PublicKeyStrengthInBits() rounds up the number of bits to the next
+# multiple of 8 - therefore the highest key size less than 1024 that can be
+# tested at the moment is 1016
+generate_certs('rsa', '1016', '1024')
+
+generate_certs('dsa', '960', '1024')
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-caBad.der b/security/manager/ssl/tests/unit/test_keysize/rsa-caBad.der
new file mode 100644
index 00000000000..f7079a333a1
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-caBad.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-caOK.der b/security/manager/ssl/tests/unit/test_keysize/rsa-caOK.der
new file mode 100644
index 00000000000..0016f5152ca
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-eeBad-intOK-caOK.der b/security/manager/ssl/tests/unit/test_keysize/rsa-eeBad-intOK-caOK.der
new file mode 100644
index 00000000000..7397577653c
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-eeBad-intOK-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intBad-caOK.der b/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intBad-caOK.der
new file mode 100644
index 00000000000..f8d60726e08
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intBad-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intOK-caBad.der b/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intOK-caBad.der
new file mode 100644
index 00000000000..5ec9faf69df
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intOK-caBad.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intOK-caOK.der b/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intOK-caOK.der
new file mode 100644
index 00000000000..94dfef87e0e
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-eeOK-intOK-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-intBad-caOK.der b/security/manager/ssl/tests/unit/test_keysize/rsa-intBad-caOK.der
new file mode 100644
index 00000000000..707d0004daf
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-intBad-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-intOK-caBad.der b/security/manager/ssl/tests/unit/test_keysize/rsa-intOK-caBad.der
new file mode 100644
index 00000000000..b7391c49ab3
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-intOK-caBad.der differ
diff --git a/security/manager/ssl/tests/unit/test_keysize/rsa-intOK-caOK.der b/security/manager/ssl/tests/unit/test_keysize/rsa-intOK-caOK.der
new file mode 100644
index 00000000000..d41c1cb05c9
Binary files /dev/null and b/security/manager/ssl/tests/unit/test_keysize/rsa-intOK-caOK.der differ
diff --git a/security/manager/ssl/tests/unit/test_ocsp_stapling.js b/security/manager/ssl/tests/unit/test_ocsp_stapling.js
index d825d2162ee..5591560602c 100644
--- a/security/manager/ssl/tests/unit/test_ocsp_stapling.js
+++ b/security/manager/ssl/tests/unit/test_ocsp_stapling.js
@@ -137,6 +137,11 @@ function add_tests(certDB, otherTestCA) {
   // ocsp-stapling-expired.example.com and
   // ocsp-stapling-expired-fresh-ca.example.com are handled in
   // test_ocsp_stapling_expired.js
+
+  // Check that OCSP responder certificates with key sizes below 1024 bits are
+  // rejected, even when the main certificate chain keys are at least 1024 bits.
+  add_ocsp_test("keysize-ocsp-delegated.example.com",
+                getXPCOMStatusFromNSS(SEC_ERROR_INVALID_KEY), true);
 }
 
 function check_ocsp_stapling_telemetry() {
@@ -148,7 +153,7 @@ function check_ocsp_stapling_telemetry() {
   do_check_eq(histogram.counts[1], 5); // 5 connections with a good response
   do_check_eq(histogram.counts[2], 18); // 18 connections with no stapled resp.
   do_check_eq(histogram.counts[3], 0); // 0 connections with an expired response
-  do_check_eq(histogram.counts[4], 19); // 19 connections with bad responses
+  do_check_eq(histogram.counts[4], 20); // 20 connections with bad responses
   run_next_test();
 }
 
diff --git a/security/manager/ssl/tests/unit/tlsserver/cert9.db b/security/manager/ssl/tests/unit/tlsserver/cert9.db
index fc7427e756e..26137ebfc33 100644
Binary files a/security/manager/ssl/tests/unit/tlsserver/cert9.db and b/security/manager/ssl/tests/unit/tlsserver/cert9.db differ
diff --git a/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp b/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp
index 2433ad35430..052a986b41f 100644
--- a/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp
+++ b/security/manager/ssl/tests/unit/tlsserver/cmd/OCSPStaplingServer.cpp
@@ -52,6 +52,7 @@ const OCSPHost sOCSPHosts[] =
   { "ocsp-stapling-delegated-keyUsage-crlSigning.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerKeyUsageCrlSigning" },
   { "ocsp-stapling-delegated-wrong-extKeyUsage.example.com", ORTDelegatedIncluded, "invalidDelegatedSignerWrongExtKeyUsage" },
   { "ocsp-stapling-ancient-valid.example.com", ORTAncientAlmostExpired, nullptr},
+  { "keysize-ocsp-delegated.example.com", ORTDelegatedIncluded, "badKeysizeDelegatedSigner" },
   { nullptr, ORTNull, nullptr }
 };
 
diff --git a/security/manager/ssl/tests/unit/tlsserver/default-ee.der b/security/manager/ssl/tests/unit/tlsserver/default-ee.der
index 9b2359dda3b..f43ba1bc1be 100644
Binary files a/security/manager/ssl/tests/unit/tlsserver/default-ee.der and b/security/manager/ssl/tests/unit/tlsserver/default-ee.der differ
diff --git a/security/manager/ssl/tests/unit/tlsserver/generate_certs.sh b/security/manager/ssl/tests/unit/tlsserver/generate_certs.sh
index 322e04aba75..2d9000ea901 100755
--- a/security/manager/ssl/tests/unit/tlsserver/generate_certs.sh
+++ b/security/manager/ssl/tests/unit/tlsserver/generate_certs.sh
@@ -184,4 +184,6 @@ make_delegated invalidDelegatedSignerWrongExtKeyUsage 'CN=Test Invalid Delegated
 
 make_INT self-signed-EE-with-cA-true 'CN=Test Self-signed End-entity with CA true' unused "-x -8 self-signed-end-entity-with-cA-true.example.com"
 
+make_delegated badKeysizeDelegatedSigner 'CN=Bad Keysize Delegated Responder' testCA "--extKeyUsage ocspResponder -g 1008"
+
 cleanup
diff --git a/security/manager/ssl/tests/unit/tlsserver/key4.db b/security/manager/ssl/tests/unit/tlsserver/key4.db
index 62ca667c93e..b68debcac97 100644
Binary files a/security/manager/ssl/tests/unit/tlsserver/key4.db and b/security/manager/ssl/tests/unit/tlsserver/key4.db differ
diff --git a/security/manager/ssl/tests/unit/tlsserver/other-test-ca.der b/security/manager/ssl/tests/unit/tlsserver/other-test-ca.der
index 742bb86ca00..4220d56eca6 100644
Binary files a/security/manager/ssl/tests/unit/tlsserver/other-test-ca.der and b/security/manager/ssl/tests/unit/tlsserver/other-test-ca.der differ
diff --git a/security/manager/ssl/tests/unit/tlsserver/pkcs11.txt b/security/manager/ssl/tests/unit/tlsserver/pkcs11.txt
index b32b9197a21..02fd3a9ee6b 100644
--- a/security/manager/ssl/tests/unit/tlsserver/pkcs11.txt
+++ b/security/manager/ssl/tests/unit/tlsserver/pkcs11.txt
@@ -1,5 +1,5 @@
 library=
 name=NSS Internal PKCS #11 Module
-parameters=configdir='sql:./security/manager/ssl/tests/unit/tlsserver' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+parameters=configdir='sql:security/manager/ssl/tests/unit/tlsserver' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
 NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
 
diff --git a/security/manager/ssl/tests/unit/tlsserver/test-ca.der b/security/manager/ssl/tests/unit/tlsserver/test-ca.der
index 356de5b02cb..d28b99a7d83 100644
Binary files a/security/manager/ssl/tests/unit/tlsserver/test-ca.der and b/security/manager/ssl/tests/unit/tlsserver/test-ca.der differ
diff --git a/security/manager/ssl/tests/unit/xpcshell.ini b/security/manager/ssl/tests/unit/xpcshell.ini
index 44cb9230b36..37be9647441 100644
--- a/security/manager/ssl/tests/unit/xpcshell.ini
+++ b/security/manager/ssl/tests/unit/xpcshell.ini
@@ -15,6 +15,7 @@ support-files =
   test_cert_eku/**
   test_ocsp_url/**
   test_ocsp_fetch_method/**
+  test_keysize/**
 
 [test_datasignatureverifier.js]
 [test_hash_algorithms.js]
@@ -92,3 +93,4 @@ run-sequentially = hardcoded ports
 # Bug 1009158: this test times out on Android
 skip-if = os == "android"
 [test_add_preexisting_cert.js]
+[test_keysize.js]
diff --git a/security/pkix/include/pkix/pkix.h b/security/pkix/include/pkix/pkix.h
index bd57e53a569..fbe1215d4c3 100644
--- a/security/pkix/include/pkix/pkix.h
+++ b/security/pkix/include/pkix/pkix.h
@@ -139,6 +139,9 @@ SECStatus VerifyEncodedOCSPResponse(TrustDomain& trustDomain,
 SECStatus DigestBuf(const SECItem& item, /*out*/ uint8_t* digestBuf,
                     size_t digestBufLen);
 
+// Checks, for RSA keys and DSA keys, that the modulus is at least 1024 bits.
+SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo);
+
 } } // namespace mozilla::pkix
 
 #endif // mozilla_pkix__pkix_h
diff --git a/security/pkix/include/pkix/pkixtypes.h b/security/pkix/include/pkix/pkixtypes.h
index 465b2df1ba3..8951906b452 100644
--- a/security/pkix/include/pkix/pkixtypes.h
+++ b/security/pkix/include/pkix/pkixtypes.h
@@ -302,6 +302,9 @@ public:
   //
   // Most implementations of this function should probably forward the call
   // directly to mozilla::pkix::VerifySignedData.
+  //
+  // In any case, the implementation must perform checks on the public key
+  // similar to how mozilla::pkix::CheckPublicKey() does.
   virtual SECStatus VerifySignedData(const SignedDataWithSignature& signedData,
                                      const SECItem& subjectPublicKeyInfo) = 0;
 
@@ -319,6 +322,14 @@ public:
   virtual SECStatus DigestBuf(const SECItem& item, /*out*/ uint8_t* digestBuf,
                               size_t digestBufLen) = 0;
 
+  // Check that the key size, algorithm, and parameters of the given public key
+  // are acceptable.
+  //
+  // VerifySignedData() should do the same checks that this function does, but
+  // mainly for efficiency, some keys are not passed to VerifySignedData().
+  // This function is called instead for those keys.
+  virtual SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo) = 0;
+
 protected:
   TrustDomain() { }
 
diff --git a/security/pkix/lib/pkixbuild.cpp b/security/pkix/lib/pkixbuild.cpp
index 910380e8c37..29e5db801d0 100644
--- a/security/pkix/lib/pkixbuild.cpp
+++ b/security/pkix/lib/pkixbuild.cpp
@@ -319,6 +319,13 @@ BuildCertChain(TrustDomain& trustDomain, const SECItem& certDER,
     return SECFailure;
   }
 
+  // See documentation for CheckPublicKey() in pkixtypes.h for why the public
+  // key also needs to be checked here when trustDomain.VerifySignedData()
+  // should already be doing it.
+  if (trustDomain.CheckPublicKey(cert.GetSubjectPublicKeyInfo()) != SECSuccess) {
+    return SECFailure;
+  }
+
   rv = BuildForward(trustDomain, cert, time, requiredKeyUsageIfPresent,
                     requiredEKUIfPresent, requiredPolicy, stapledOCSPResponse,
                     0/*subCACount*/);
diff --git a/security/pkix/lib/pkixkey.cpp b/security/pkix/lib/pkixkey.cpp
index a2d0abfe5ae..507eb6d7df1 100644
--- a/security/pkix/lib/pkixkey.cpp
+++ b/security/pkix/lib/pkixkey.cpp
@@ -36,6 +36,58 @@
 
 namespace mozilla { namespace pkix {
 
+typedef ScopedPtr<SECKEYPublicKey, SECKEY_DestroyPublicKey> ScopedSECKeyPublicKey;
+
+SECStatus
+CheckPublicKeySize(const SECItem& subjectPublicKeyInfo,
+                   /*out*/ ScopedSECKeyPublicKey& publicKey)
+{
+  ScopedPtr<CERTSubjectPublicKeyInfo, SECKEY_DestroySubjectPublicKeyInfo>
+    spki(SECKEY_DecodeDERSubjectPublicKeyInfo(&subjectPublicKeyInfo));
+  if (!spki) {
+    return SECFailure;
+  }
+  publicKey = SECKEY_ExtractPublicKey(spki.get());
+  if (!publicKey) {
+    return SECFailure;
+  }
+
+  static const unsigned int MINIMUM_NON_ECC_BITS = 1024;
+
+  switch (publicKey.get()->keyType) {
+    case ecKey:
+      // TODO(bug 622859): We should check which curve.
+      return SECSuccess;
+    case dsaKey: // fall through
+    case rsaKey:
+      // TODO(bug 622859): Enforce a minimum of 2048 bits for EV certs.
+      if (SECKEY_PublicKeyStrengthInBits(publicKey.get()) < MINIMUM_NON_ECC_BITS) {
+        // TODO(bug 1031946): Create a new error code.
+        PR_SetError(SEC_ERROR_INVALID_KEY, 0);
+        return SECFailure;
+      }
+      break;
+    case nullKey:
+    case fortezzaKey:
+    case dhKey:
+    case keaKey:
+    case rsaPssKey:
+    case rsaOaepKey:
+    default:
+      PR_SetError(SEC_ERROR_UNSUPPORTED_KEYALG, 0);
+      return SECFailure;
+  }
+
+  return SECSuccess;
+}
+
+SECStatus
+CheckPublicKey(const SECItem& subjectPublicKeyInfo)
+{
+  ScopedSECKeyPublicKey unused;
+  return CheckPublicKeySize(subjectPublicKeyInfo, unused);
+}
+
 SECStatus
 VerifySignedData(const SignedDataWithSignature& sd,
                  const SECItem& subjectPublicKeyInfo, void* pkcs11PinArg)
@@ -101,14 +153,8 @@ VerifySignedData(const SignedDataWithSignature& sd,
       return SECFailure;
   }
 
-  ScopedPtr<CERTSubjectPublicKeyInfo, SECKEY_DestroySubjectPublicKeyInfo>
-    spki(SECKEY_DecodeDERSubjectPublicKeyInfo(&subjectPublicKeyInfo));
-  if (!spki) {
-    return SECFailure;
-  }
-  ScopedPtr<SECKEYPublicKey, SECKEY_DestroyPublicKey>
-    pubKey(SECKEY_ExtractPublicKey(spki.get()));
-  if (!pubKey) {
+  ScopedSECKeyPublicKey pubKey;
+  if (CheckPublicKeySize(subjectPublicKeyInfo, pubKey) != SECSuccess) {
     return SECFailure;
   }
 
diff --git a/security/pkix/test/gtest/pkixbuild_tests.cpp b/security/pkix/test/gtest/pkixbuild_tests.cpp
index 33c9fb9d833..2041e0a7bbe 100644
--- a/security/pkix/test/gtest/pkixbuild_tests.cpp
+++ b/security/pkix/test/gtest/pkixbuild_tests.cpp
@@ -177,6 +177,11 @@ private:
     return SECFailure;
   }
 
+  SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo)
+  {
+    return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
+  }
+
   // We hold references to CERTCertificates in the cert chain tail so that we
   // CERT_CreateSubjectCertList can find them.
   ScopedCERTCertificate certChainTail[7];
diff --git a/security/pkix/test/gtest/pkixcert_extension_tests.cpp b/security/pkix/test/gtest/pkixcert_extension_tests.cpp
index 223e161335c..d11e86cb559 100644
--- a/security/pkix/test/gtest/pkixcert_extension_tests.cpp
+++ b/security/pkix/test/gtest/pkixcert_extension_tests.cpp
@@ -115,6 +115,11 @@ private:
     PR_SetError(SEC_ERROR_LIBRARY_FAILURE, 0);
     return SECFailure;
   }
+
+  SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo)
+  {
+    return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
+  }
 };
 
 class pkixcert_extension: public NSSTest
diff --git a/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp b/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp
index 899b92776c4..b28b7f820bb 100644
--- a/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp
+++ b/security/pkix/test/gtest/pkixocsp_CreateEncodedOCSPRequest_tests.cpp
@@ -77,6 +77,11 @@ private:
   {
     return ::mozilla::pkix::DigestBuf(item, digestBuf, digestBufLen);
   }
+
+  virtual SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo)
+  {
+    return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
+  }
 };
 
 class pkixocsp_CreateEncodedOCSPRequest : public NSSTest
diff --git a/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp b/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
index b693f79d28f..99d4110ac55 100644
--- a/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
+++ b/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
@@ -92,6 +92,11 @@ public:
     return ::mozilla::pkix::DigestBuf(item, digestBuf, digestBufLen);
   }
 
+  virtual SECStatus CheckPublicKey(const SECItem& subjectPublicKeyInfo)
+  {
+    return ::mozilla::pkix::CheckPublicKey(subjectPublicKeyInfo);
+  }
+
 private:
   OCSPTestTrustDomain(const OCSPTestTrustDomain&) /*delete*/;
   void operator=(const OCSPTestTrustDomain&) /*delete*/;
diff --git a/security/sandbox/chromium/base/base_paths.cc b/security/sandbox/chromium/base/base_paths.cc
deleted file mode 100644
index 9f2b250561f..00000000000
--- a/security/sandbox/chromium/base/base_paths.cc
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/base_paths.h"
-
-#include "base/file_util.h"
-#include "base/files/file_path.h"
-#include "base/path_service.h"
-
-namespace base {
-
-bool PathProvider(int key, FilePath* result) {
-  // NOTE: DIR_CURRENT is a special case in PathService::Get
-
-  FilePath cur;
-  switch (key) {
-    case DIR_EXE:
-      PathService::Get(FILE_EXE, &cur);
-      cur = cur.DirName();
-      break;
-    case DIR_MODULE:
-      PathService::Get(FILE_MODULE, &cur);
-      cur = cur.DirName();
-      break;
-    case DIR_TEMP:
-      if (!file_util::GetTempDir(&cur))
-        return false;
-      break;
-    case DIR_TEST_DATA:
-      if (!PathService::Get(DIR_SOURCE_ROOT, &cur))
-        return false;
-      cur = cur.Append(FILE_PATH_LITERAL("base"));
-      cur = cur.Append(FILE_PATH_LITERAL("test"));
-      cur = cur.Append(FILE_PATH_LITERAL("data"));
-      if (!base::PathExists(cur))  // We don't want to create this.
-        return false;
-      break;
-    default:
-      return false;
-  }
-
-  *result = cur;
-  return true;
-}
-
-}  // namespace base
diff --git a/security/sandbox/chromium/base/base_paths_win.cc b/security/sandbox/chromium/base/base_paths_win.cc
deleted file mode 100644
index bc883358add..00000000000
--- a/security/sandbox/chromium/base/base_paths_win.cc
+++ /dev/null
@@ -1,208 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <windows.h>
-#include <shlobj.h>
-
-#include "base/base_paths.h"
-#include "base/files/file_path.h"
-#include "base/path_service.h"
-#include "base/win/scoped_co_mem.h"
-#include "base/win/windows_version.h"
-
-// http://blogs.msdn.com/oldnewthing/archive/2004/10/25/247180.aspx
-extern "C" IMAGE_DOS_HEADER __ImageBase;
-
-using base::FilePath;
-
-namespace {
-
-bool GetQuickLaunchPath(bool default_user, FilePath* result) {
-  if (default_user) {
-    wchar_t system_buffer[MAX_PATH];
-    system_buffer[0] = 0;
-    // As per MSDN, passing -1 for |hToken| indicates the Default user:
-    // http://msdn.microsoft.com/library/windows/desktop/bb762181.aspx
-    if (FAILED(SHGetFolderPath(NULL, CSIDL_APPDATA,
-                               reinterpret_cast<HANDLE>(-1), SHGFP_TYPE_CURRENT,
-                               system_buffer))) {
-      return false;
-    }
-    *result = FilePath(system_buffer);
-  } else if (!PathService::Get(base::DIR_APP_DATA, result)) {
-    // For the current user, grab the APPDATA directory directly from the
-    // PathService cache.
-    return false;
-  }
-  // According to various sources, appending
-  // "Microsoft\Internet Explorer\Quick Launch" to %appdata% is the only
-  // reliable way to get the quick launch folder across all versions of Windows.
-  // http://stackoverflow.com/questions/76080/how-do-you-reliably-get-the-quick-
-  // http://www.microsoft.com/technet/scriptcenter/resources/qanda/sept05/hey0901.mspx
-  *result = result->AppendASCII("Microsoft");
-  *result = result->AppendASCII("Internet Explorer");
-  *result = result->AppendASCII("Quick Launch");
-  return true;
-}
-
-}  // namespace
-
-namespace base {
-
-bool PathProviderWin(int key, FilePath* result) {
-  // We need to go compute the value. It would be nice to support paths with
-  // names longer than MAX_PATH, but the system functions don't seem to be
-  // designed for it either, with the exception of GetTempPath (but other
-  // things will surely break if the temp path is too long, so we don't bother
-  // handling it.
-  wchar_t system_buffer[MAX_PATH];
-  system_buffer[0] = 0;
-
-  FilePath cur;
-  switch (key) {
-    case base::FILE_EXE:
-      GetModuleFileName(NULL, system_buffer, MAX_PATH);
-      cur = FilePath(system_buffer);
-      break;
-    case base::FILE_MODULE: {
-      // the resource containing module is assumed to be the one that
-      // this code lives in, whether that's a dll or exe
-      HMODULE this_module = reinterpret_cast<HMODULE>(&__ImageBase);
-      GetModuleFileName(this_module, system_buffer, MAX_PATH);
-      cur = FilePath(system_buffer);
-      break;
-    }
-    case base::DIR_WINDOWS:
-      GetWindowsDirectory(system_buffer, MAX_PATH);
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_SYSTEM:
-      GetSystemDirectory(system_buffer, MAX_PATH);
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_PROGRAM_FILESX86:
-      if (base::win::OSInfo::GetInstance()->architecture() !=
-          base::win::OSInfo::X86_ARCHITECTURE) {
-        if (FAILED(SHGetFolderPath(NULL, CSIDL_PROGRAM_FILESX86, NULL,
-                                   SHGFP_TYPE_CURRENT, system_buffer)))
-          return false;
-        cur = FilePath(system_buffer);
-        break;
-      }
-      // Fall through to base::DIR_PROGRAM_FILES if we're on an X86 machine.
-    case base::DIR_PROGRAM_FILES:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_PROGRAM_FILES, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_IE_INTERNET_CACHE:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_INTERNET_CACHE, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_COMMON_START_MENU:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_COMMON_PROGRAMS, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_START_MENU:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_PROGRAMS, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_APP_DATA:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_APPDATA, NULL, SHGFP_TYPE_CURRENT,
-                                 system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_COMMON_APP_DATA:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_COMMON_APPDATA, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_PROFILE:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_PROFILE, NULL, SHGFP_TYPE_CURRENT,
-                                 system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_LOCAL_APP_DATA_LOW:
-      if (win::GetVersion() < win::VERSION_VISTA)
-        return false;
-
-      // TODO(nsylvain): We should use SHGetKnownFolderPath instead. Bug 1281128
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_APPDATA, NULL, SHGFP_TYPE_CURRENT,
-                                 system_buffer)))
-        return false;
-      cur = FilePath(system_buffer).DirName().AppendASCII("LocalLow");
-      break;
-    case base::DIR_LOCAL_APP_DATA:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_LOCAL_APPDATA, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer)))
-        return false;
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_SOURCE_ROOT: {
-      FilePath executableDir;
-      // On Windows, unit tests execute two levels deep from the source root.
-      // For example:  chrome/{Debug|Release}/ui_tests.exe
-      PathService::Get(base::DIR_EXE, &executableDir);
-      cur = executableDir.DirName().DirName();
-      break;
-    }
-    case base::DIR_APP_SHORTCUTS: {
-      if (win::GetVersion() < win::VERSION_WIN8)
-        return false;
-
-      base::win::ScopedCoMem<wchar_t> path_buf;
-      if (FAILED(SHGetKnownFolderPath(FOLDERID_ApplicationShortcuts, 0, NULL,
-                                      &path_buf)))
-        return false;
-
-      cur = FilePath(string16(path_buf));
-      break;
-    }
-    case base::DIR_USER_DESKTOP:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_DESKTOPDIRECTORY, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer))) {
-        return false;
-      }
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_COMMON_DESKTOP:
-      if (FAILED(SHGetFolderPath(NULL, CSIDL_COMMON_DESKTOPDIRECTORY, NULL,
-                                 SHGFP_TYPE_CURRENT, system_buffer))) {
-        return false;
-      }
-      cur = FilePath(system_buffer);
-      break;
-    case base::DIR_USER_QUICK_LAUNCH:
-      if (!GetQuickLaunchPath(false, &cur))
-        return false;
-      break;
-    case base::DIR_DEFAULT_USER_QUICK_LAUNCH:
-      if (!GetQuickLaunchPath(true, &cur))
-        return false;
-      break;
-    case base::DIR_TASKBAR_PINS:
-      if (!PathService::Get(base::DIR_USER_QUICK_LAUNCH, &cur))
-        return false;
-      cur = cur.AppendASCII("User Pinned");
-      cur = cur.AppendASCII("TaskBar");
-      break;
-    default:
-      return false;
-  }
-
-  *result = cur;
-  return true;
-}
-
-}  // namespace base
diff --git a/security/sandbox/chromium/base/command_line.cc b/security/sandbox/chromium/base/command_line.cc
deleted file mode 100644
index 36ac88f12c1..00000000000
--- a/security/sandbox/chromium/base/command_line.cc
+++ /dev/null
@@ -1,424 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/command_line.h"
-
-#include <algorithm>
-#include <ostream>
-
-#include "base/basictypes.h"
-#include "base/files/file_path.h"
-#include "base/logging.h"
-#include "base/strings/string_split.h"
-#include "base/strings/string_util.h"
-#include "base/strings/utf_string_conversions.h"
-#include "build/build_config.h"
-
-#if defined(OS_WIN)
-#include <windows.h>
-#include <shellapi.h>
-#endif
-
-using base::FilePath;
-
-CommandLine* CommandLine::current_process_commandline_ = NULL;
-
-namespace {
-const CommandLine::CharType kSwitchTerminator[] = FILE_PATH_LITERAL("--");
-const CommandLine::CharType kSwitchValueSeparator[] = FILE_PATH_LITERAL("=");
-// Since we use a lazy match, make sure that longer versions (like "--") are
-// listed before shorter versions (like "-") of similar prefixes.
-#if defined(OS_WIN)
-const CommandLine::CharType* const kSwitchPrefixes[] = {L"--", L"-", L"/"};
-#elif defined(OS_POSIX)
-// Unixes don't use slash as a switch.
-const CommandLine::CharType* const kSwitchPrefixes[] = {"--", "-"};
-#endif
-
-size_t GetSwitchPrefixLength(const CommandLine::StringType& string) {
-  for (size_t i = 0; i < arraysize(kSwitchPrefixes); ++i) {
-    CommandLine::StringType prefix(kSwitchPrefixes[i]);
-    if (string.compare(0, prefix.length(), prefix) == 0)
-      return prefix.length();
-  }
-  return 0;
-}
-
-// Fills in |switch_string| and |switch_value| if |string| is a switch.
-// This will preserve the input switch prefix in the output |switch_string|.
-bool IsSwitch(const CommandLine::StringType& string,
-              CommandLine::StringType* switch_string,
-              CommandLine::StringType* switch_value) {
-  switch_string->clear();
-  switch_value->clear();
-  size_t prefix_length = GetSwitchPrefixLength(string);
-  if (prefix_length == 0 || prefix_length == string.length())
-    return false;
-
-  const size_t equals_position = string.find(kSwitchValueSeparator);
-  *switch_string = string.substr(0, equals_position);
-  if (equals_position != CommandLine::StringType::npos)
-    *switch_value = string.substr(equals_position + 1);
-  return true;
-}
-
-// Append switches and arguments, keeping switches before arguments.
-void AppendSwitchesAndArguments(CommandLine& command_line,
-                                const CommandLine::StringVector& argv) {
-  bool parse_switches = true;
-  for (size_t i = 1; i < argv.size(); ++i) {
-    CommandLine::StringType arg = argv[i];
-    TrimWhitespace(arg, TRIM_ALL, &arg);
-
-    CommandLine::StringType switch_string;
-    CommandLine::StringType switch_value;
-    parse_switches &= (arg != kSwitchTerminator);
-    if (parse_switches && IsSwitch(arg, &switch_string, &switch_value)) {
-#if defined(OS_WIN)
-      command_line.AppendSwitchNative(WideToASCII(switch_string), switch_value);
-#elif defined(OS_POSIX)
-      command_line.AppendSwitchNative(switch_string, switch_value);
-#endif
-    } else {
-      command_line.AppendArgNative(arg);
-    }
-  }
-}
-
-// Lowercase switches for backwards compatiblity *on Windows*.
-std::string LowerASCIIOnWindows(const std::string& string) {
-#if defined(OS_WIN)
-  return StringToLowerASCII(string);
-#elif defined(OS_POSIX)
-  return string;
-#endif
-}
-
-
-#if defined(OS_WIN)
-// Quote a string as necessary for CommandLineToArgvW compatiblity *on Windows*.
-std::wstring QuoteForCommandLineToArgvW(const std::wstring& arg) {
-  // We follow the quoting rules of CommandLineToArgvW.
-  // http://msdn.microsoft.com/en-us/library/17w5ykft.aspx
-  if (arg.find_first_of(L" \\\"") == std::wstring::npos) {
-    // No quoting necessary.
-    return arg;
-  }
-
-  std::wstring out;
-  out.push_back(L'"');
-  for (size_t i = 0; i < arg.size(); ++i) {
-    if (arg[i] == '\\') {
-      // Find the extent of this run of backslashes.
-      size_t start = i, end = start + 1;
-      for (; end < arg.size() && arg[end] == '\\'; ++end)
-        /* empty */;
-      size_t backslash_count = end - start;
-
-      // Backslashes are escapes only if the run is followed by a double quote.
-      // Since we also will end the string with a double quote, we escape for
-      // either a double quote or the end of the string.
-      if (end == arg.size() || arg[end] == '"') {
-        // To quote, we need to output 2x as many backslashes.
-        backslash_count *= 2;
-      }
-      for (size_t j = 0; j < backslash_count; ++j)
-        out.push_back('\\');
-
-      // Advance i to one before the end to balance i++ in loop.
-      i = end - 1;
-    } else if (arg[i] == '"') {
-      out.push_back('\\');
-      out.push_back('"');
-    } else {
-      out.push_back(arg[i]);
-    }
-  }
-  out.push_back('"');
-
-  return out;
-}
-#endif
-
-}  // namespace
-
-CommandLine::CommandLine(NoProgram no_program)
-    : argv_(1),
-      begin_args_(1) {
-}
-
-CommandLine::CommandLine(const FilePath& program)
-    : argv_(1),
-      begin_args_(1) {
-  SetProgram(program);
-}
-
-CommandLine::CommandLine(int argc, const CommandLine::CharType* const* argv)
-    : argv_(1),
-      begin_args_(1) {
-  InitFromArgv(argc, argv);
-}
-
-CommandLine::CommandLine(const StringVector& argv)
-    : argv_(1),
-      begin_args_(1) {
-  InitFromArgv(argv);
-}
-
-CommandLine::~CommandLine() {
-}
-
-// static
-bool CommandLine::Init(int argc, const char* const* argv) {
-  if (current_process_commandline_) {
-    // If this is intentional, Reset() must be called first. If we are using
-    // the shared build mode, we have to share a single object across multiple
-    // shared libraries.
-    return false;
-  }
-
-  current_process_commandline_ = new CommandLine(NO_PROGRAM);
-#if defined(OS_WIN)
-  current_process_commandline_->ParseFromString(::GetCommandLineW());
-#elif defined(OS_POSIX)
-  current_process_commandline_->InitFromArgv(argc, argv);
-#endif
-
-  return true;
-}
-
-// static
-void CommandLine::Reset() {
-  DCHECK(current_process_commandline_);
-  delete current_process_commandline_;
-  current_process_commandline_ = NULL;
-}
-
-// static
-CommandLine* CommandLine::ForCurrentProcess() {
-  DCHECK(current_process_commandline_);
-  return current_process_commandline_;
-}
-
-// static
-bool CommandLine::InitializedForCurrentProcess() {
-  return !!current_process_commandline_;
-}
-
-#if defined(OS_WIN)
-// static
-CommandLine CommandLine::FromString(const std::wstring& command_line) {
-  CommandLine cmd(NO_PROGRAM);
-  cmd.ParseFromString(command_line);
-  return cmd;
-}
-#endif
-
-void CommandLine::InitFromArgv(int argc,
-                               const CommandLine::CharType* const* argv) {
-  StringVector new_argv;
-  for (int i = 0; i < argc; ++i)
-    new_argv.push_back(argv[i]);
-  InitFromArgv(new_argv);
-}
-
-void CommandLine::InitFromArgv(const StringVector& argv) {
-  argv_ = StringVector(1);
-  switches_.clear();
-  begin_args_ = 1;
-  SetProgram(argv.empty() ? FilePath() : FilePath(argv[0]));
-  AppendSwitchesAndArguments(*this, argv);
-}
-
-CommandLine::StringType CommandLine::GetCommandLineString() const {
-  StringType string(argv_[0]);
-#if defined(OS_WIN)
-  string = QuoteForCommandLineToArgvW(string);
-#endif
-  StringType params(GetArgumentsString());
-  if (!params.empty()) {
-    string.append(StringType(FILE_PATH_LITERAL(" ")));
-    string.append(params);
-  }
-  return string;
-}
-
-CommandLine::StringType CommandLine::GetArgumentsString() const {
-  StringType params;
-  // Append switches and arguments.
-  bool parse_switches = true;
-  for (size_t i = 1; i < argv_.size(); ++i) {
-    StringType arg = argv_[i];
-    StringType switch_string;
-    StringType switch_value;
-    parse_switches &= arg != kSwitchTerminator;
-    if (i > 1)
-      params.append(StringType(FILE_PATH_LITERAL(" ")));
-    if (parse_switches && IsSwitch(arg, &switch_string, &switch_value)) {
-      params.append(switch_string);
-      if (!switch_value.empty()) {
-#if defined(OS_WIN)
-        switch_value = QuoteForCommandLineToArgvW(switch_value);
-#endif
-        params.append(kSwitchValueSeparator + switch_value);
-      }
-    }
-    else {
-#if defined(OS_WIN)
-      arg = QuoteForCommandLineToArgvW(arg);
-#endif
-      params.append(arg);
-    }
-  }
-  return params;
-}
-
-FilePath CommandLine::GetProgram() const {
-  return FilePath(argv_[0]);
-}
-
-void CommandLine::SetProgram(const FilePath& program) {
-  TrimWhitespace(program.value(), TRIM_ALL, &argv_[0]);
-}
-
-bool CommandLine::HasSwitch(const std::string& switch_string) const {
-  return switches_.find(LowerASCIIOnWindows(switch_string)) != switches_.end();
-}
-
-std::string CommandLine::GetSwitchValueASCII(
-    const std::string& switch_string) const {
-  StringType value = GetSwitchValueNative(switch_string);
-  if (!IsStringASCII(value)) {
-    DLOG(WARNING) << "Value of switch (" << switch_string << ") must be ASCII.";
-    return std::string();
-  }
-#if defined(OS_WIN)
-  return WideToASCII(value);
-#else
-  return value;
-#endif
-}
-
-FilePath CommandLine::GetSwitchValuePath(
-    const std::string& switch_string) const {
-  return FilePath(GetSwitchValueNative(switch_string));
-}
-
-CommandLine::StringType CommandLine::GetSwitchValueNative(
-    const std::string& switch_string) const {
-  SwitchMap::const_iterator result = switches_.end();
-  result = switches_.find(LowerASCIIOnWindows(switch_string));
-  return result == switches_.end() ? StringType() : result->second;
-}
-
-void CommandLine::AppendSwitch(const std::string& switch_string) {
-  AppendSwitchNative(switch_string, StringType());
-}
-
-void CommandLine::AppendSwitchPath(const std::string& switch_string,
-                                   const FilePath& path) {
-  AppendSwitchNative(switch_string, path.value());
-}
-
-void CommandLine::AppendSwitchNative(const std::string& switch_string,
-                                     const CommandLine::StringType& value) {
-  std::string switch_key(LowerASCIIOnWindows(switch_string));
-#if defined(OS_WIN)
-  StringType combined_switch_string(ASCIIToWide(switch_key));
-#elif defined(OS_POSIX)
-  StringType combined_switch_string(switch_string);
-#endif
-  size_t prefix_length = GetSwitchPrefixLength(combined_switch_string);
-  switches_[switch_key.substr(prefix_length)] = value;
-  // Preserve existing switch prefixes in |argv_|; only append one if necessary.
-  if (prefix_length == 0)
-    combined_switch_string = kSwitchPrefixes[0] + combined_switch_string;
-  if (!value.empty())
-    combined_switch_string += kSwitchValueSeparator + value;
-  // Append the switch and update the switches/arguments divider |begin_args_|.
-  argv_.insert(argv_.begin() + begin_args_++, combined_switch_string);
-}
-
-void CommandLine::AppendSwitchASCII(const std::string& switch_string,
-                                    const std::string& value_string) {
-#if defined(OS_WIN)
-  AppendSwitchNative(switch_string, ASCIIToWide(value_string));
-#elif defined(OS_POSIX)
-  AppendSwitchNative(switch_string, value_string);
-#endif
-}
-
-void CommandLine::CopySwitchesFrom(const CommandLine& source,
-                                   const char* const switches[],
-                                   size_t count) {
-  for (size_t i = 0; i < count; ++i) {
-    if (source.HasSwitch(switches[i]))
-      AppendSwitchNative(switches[i], source.GetSwitchValueNative(switches[i]));
-  }
-}
-
-CommandLine::StringVector CommandLine::GetArgs() const {
-  // Gather all arguments after the last switch (may include kSwitchTerminator).
-  StringVector args(argv_.begin() + begin_args_, argv_.end());
-  // Erase only the first kSwitchTerminator (maybe "--" is a legitimate page?)
-  StringVector::iterator switch_terminator =
-      std::find(args.begin(), args.end(), kSwitchTerminator);
-  if (switch_terminator != args.end())
-    args.erase(switch_terminator);
-  return args;
-}
-
-void CommandLine::AppendArg(const std::string& value) {
-#if defined(OS_WIN)
-  DCHECK(IsStringUTF8(value));
-  AppendArgNative(UTF8ToWide(value));
-#elif defined(OS_POSIX)
-  AppendArgNative(value);
-#endif
-}
-
-void CommandLine::AppendArgPath(const FilePath& path) {
-  AppendArgNative(path.value());
-}
-
-void CommandLine::AppendArgNative(const CommandLine::StringType& value) {
-  argv_.push_back(value);
-}
-
-void CommandLine::AppendArguments(const CommandLine& other,
-                                  bool include_program) {
-  if (include_program)
-    SetProgram(other.GetProgram());
-  AppendSwitchesAndArguments(*this, other.argv());
-}
-
-void CommandLine::PrependWrapper(const CommandLine::StringType& wrapper) {
-  if (wrapper.empty())
-    return;
-  // The wrapper may have embedded arguments (like "gdb --args"). In this case,
-  // we don't pretend to do anything fancy, we just split on spaces.
-  StringVector wrapper_argv;
-  base::SplitString(wrapper, FILE_PATH_LITERAL(' '), &wrapper_argv);
-  // Prepend the wrapper and update the switches/arguments |begin_args_|.
-  argv_.insert(argv_.begin(), wrapper_argv.begin(), wrapper_argv.end());
-  begin_args_ += wrapper_argv.size();
-}
-
-#if defined(OS_WIN)
-void CommandLine::ParseFromString(const std::wstring& command_line) {
-  std::wstring command_line_string;
-  TrimWhitespace(command_line, TRIM_ALL, &command_line_string);
-  if (command_line_string.empty())
-    return;
-
-  int num_args = 0;
-  wchar_t** args = NULL;
-  args = ::CommandLineToArgvW(command_line_string.c_str(), &num_args);
-
-  DPLOG_IF(FATAL, !args) << "CommandLineToArgvW failed on command line: "
-                         << command_line;
-  InitFromArgv(num_args, args);
-  LocalFree(args);
-}
-#endif
diff --git a/security/sandbox/chromium/base/command_line.h b/security/sandbox/chromium/base/command_line.h
deleted file mode 100644
index ed46c4f0d13..00000000000
--- a/security/sandbox/chromium/base/command_line.h
+++ /dev/null
@@ -1,178 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This class works with command lines: building and parsing.
-// Arguments with prefixes ('--', '-', and on Windows, '/') are switches.
-// Switches will precede all other arguments without switch prefixes.
-// Switches can optionally have values, delimited by '=', e.g., "-switch=value".
-// An argument of "--" will terminate switch parsing during initialization,
-// interpreting subsequent tokens as non-switch arguments, regardless of prefix.
-
-// There is a singleton read-only CommandLine that represents the command line
-// that the current process was started with.  It must be initialized in main().
-
-#ifndef BASE_COMMAND_LINE_H_
-#define BASE_COMMAND_LINE_H_
-
-#include <stddef.h>
-#include <map>
-#include <string>
-#include <vector>
-
-#include "base/base_export.h"
-#include "build/build_config.h"
-
-namespace base {
-class FilePath;
-}
-
-class BASE_EXPORT CommandLine {
- public:
-#if defined(OS_WIN)
-  // The native command line string type.
-  typedef std::wstring StringType;
-#elif defined(OS_POSIX)
-  typedef std::string StringType;
-#endif
-
-  typedef StringType::value_type CharType;
-  typedef std::vector<StringType> StringVector;
-  typedef std::map<std::string, StringType> SwitchMap;
-
-  // A constructor for CommandLines that only carry switches and arguments.
-  enum NoProgram { NO_PROGRAM };
-  explicit CommandLine(NoProgram no_program);
-
-  // Construct a new command line with |program| as argv[0].
-  explicit CommandLine(const base::FilePath& program);
-
-  // Construct a new command line from an argument list.
-  CommandLine(int argc, const CharType* const* argv);
-  explicit CommandLine(const StringVector& argv);
-
-  ~CommandLine();
-
-  // Initialize the current process CommandLine singleton. On Windows, ignores
-  // its arguments (we instead parse GetCommandLineW() directly) because we
-  // don't trust the CRT's parsing of the command line, but it still must be
-  // called to set up the command line. Returns false if initialization has
-  // already occurred, and true otherwise. Only the caller receiving a 'true'
-  // return value should take responsibility for calling Reset.
-  static bool Init(int argc, const char* const* argv);
-
-  // Destroys the current process CommandLine singleton. This is necessary if
-  // you want to reset the base library to its initial state (for example, in an
-  // outer library that needs to be able to terminate, and be re-initialized).
-  // If Init is called only once, as in main(), Reset() is not necessary.
-  static void Reset();
-
-  // Get the singleton CommandLine representing the current process's
-  // command line. Note: returned value is mutable, but not thread safe;
-  // only mutate if you know what you're doing!
-  static CommandLine* ForCurrentProcess();
-
-  // Returns true if the CommandLine has been initialized for the given process.
-  static bool InitializedForCurrentProcess();
-
-#if defined(OS_WIN)
-  static CommandLine FromString(const std::wstring& command_line);
-#endif
-
-  // Initialize from an argv vector.
-  void InitFromArgv(int argc, const CharType* const* argv);
-  void InitFromArgv(const StringVector& argv);
-
-  // Constructs and returns the represented command line string.
-  // CAUTION! This should be avoided on POSIX because quoting behavior is
-  // unclear.
-  StringType GetCommandLineString() const;
-
-  // Constructs and returns the represented arguments string.
-  // CAUTION! This should be avoided on POSIX because quoting behavior is
-  // unclear.
-  StringType GetArgumentsString() const;
-
-  // Returns the original command line string as a vector of strings.
-  const StringVector& argv() const { return argv_; }
-
-  // Get and Set the program part of the command line string (the first item).
-  base::FilePath GetProgram() const;
-  void SetProgram(const base::FilePath& program);
-
-  // Returns true if this command line contains the given switch.
-  // (Switch names are case-insensitive).
-  bool HasSwitch(const std::string& switch_string) const;
-
-  // Returns the value associated with the given switch. If the switch has no
-  // value or isn't present, this method returns the empty string.
-  std::string GetSwitchValueASCII(const std::string& switch_string) const;
-  base::FilePath GetSwitchValuePath(const std::string& switch_string) const;
-  StringType GetSwitchValueNative(const std::string& switch_string) const;
-
-  // Get a copy of all switches, along with their values.
-  const SwitchMap& GetSwitches() const { return switches_; }
-
-  // Append a switch [with optional value] to the command line.
-  // Note: Switches will precede arguments regardless of appending order.
-  void AppendSwitch(const std::string& switch_string);
-  void AppendSwitchPath(const std::string& switch_string,
-                        const base::FilePath& path);
-  void AppendSwitchNative(const std::string& switch_string,
-                          const StringType& value);
-  void AppendSwitchASCII(const std::string& switch_string,
-                         const std::string& value);
-
-  // Copy a set of switches (and any values) from another command line.
-  // Commonly used when launching a subprocess.
-  void CopySwitchesFrom(const CommandLine& source,
-                        const char* const switches[],
-                        size_t count);
-
-  // Get the remaining arguments to the command.
-  StringVector GetArgs() const;
-
-  // Append an argument to the command line. Note that the argument is quoted
-  // properly such that it is interpreted as one argument to the target command.
-  // AppendArg is primarily for ASCII; non-ASCII input is interpreted as UTF-8.
-  // Note: Switches will precede arguments regardless of appending order.
-  void AppendArg(const std::string& value);
-  void AppendArgPath(const base::FilePath& value);
-  void AppendArgNative(const StringType& value);
-
-  // Append the switches and arguments from another command line to this one.
-  // If |include_program| is true, include |other|'s program as well.
-  void AppendArguments(const CommandLine& other, bool include_program);
-
-  // Insert a command before the current command.
-  // Common for debuggers, like "valgrind" or "gdb --args".
-  void PrependWrapper(const StringType& wrapper);
-
-#if defined(OS_WIN)
-  // Initialize by parsing the given command line string.
-  // The program name is assumed to be the first item in the string.
-  void ParseFromString(const std::wstring& command_line);
-#endif
-
- private:
-  // Disallow default constructor; a program name must be explicitly specified.
-  CommandLine();
-  // Allow the copy constructor. A common pattern is to copy of the current
-  // process's command line and then add some flags to it. For example:
-  //   CommandLine cl(*CommandLine::ForCurrentProcess());
-  //   cl.AppendSwitch(...);
-
-  // The singleton CommandLine representing the current process's command line.
-  static CommandLine* current_process_commandline_;
-
-  // The argv array: { program, [(--|-|/)switch[=value]]*, [--], [argument]* }
-  StringVector argv_;
-
-  // Parsed-out switch keys and values.
-  SwitchMap switches_;
-
-  // The index after the program and switches, any arguments start here.
-  size_t begin_args_;
-};
-
-#endif  // BASE_COMMAND_LINE_H_
diff --git a/security/sandbox/chromium/base/critical_closure.h b/security/sandbox/chromium/base/critical_closure.h
deleted file mode 100644
index ca51ed5cef2..00000000000
--- a/security/sandbox/chromium/base/critical_closure.h
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_CRITICAL_CLOSURE_H_
-#define BASE_CRITICAL_CLOSURE_H_
-
-#include "base/callback.h"
-
-namespace base {
-
-// Returns a closure that will continue to run for a period of time when the
-// application goes to the background if possible on platforms where
-// applications don't execute while backgrounded, otherwise the original task is
-// returned.
-//
-// Example:
-//   file_message_loop_proxy_->PostTask(
-//       FROM_HERE,
-//       MakeCriticalClosure(base::Bind(&WriteToDiskTask, path_, data)));
-//
-// Note new closures might be posted in this closure. If the new closures need
-// background running time, |MakeCriticalClosure| should be applied on them
-// before posting.
-#if defined(OS_IOS)
-base::Closure MakeCriticalClosure(const base::Closure& closure);
-#else
-inline base::Closure MakeCriticalClosure(const base::Closure& closure) {
-  // No-op for platforms where the application does not need to acquire
-  // background time for closures to finish when it goes into the background.
-  return closure;
-}
-#endif  // !defined(OS_IOS)
-
-}  // namespace base
-
-#endif  // BASE_CRITICAL_CLOSURE_H_
diff --git a/security/sandbox/chromium/base/environment.h b/security/sandbox/chromium/base/environment.h
deleted file mode 100644
index c8811e27eee..00000000000
--- a/security/sandbox/chromium/base/environment.h
+++ /dev/null
@@ -1,90 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_ENVIRONMENT_H_
-#define BASE_ENVIRONMENT_H_
-
-#include <map>
-#include <string>
-
-#include "base/base_export.h"
-#include "base/memory/scoped_ptr.h"
-#include "base/strings/string16.h"
-#include "build/build_config.h"
-
-namespace base {
-
-namespace env_vars {
-
-#if defined(OS_POSIX)
-BASE_EXPORT extern const char kHome[];
-#endif
-
-}  // namespace env_vars
-
-class BASE_EXPORT Environment {
- public:
-  virtual ~Environment();
-
-  // Static factory method that returns the implementation that provide the
-  // appropriate platform-specific instance.
-  static Environment* Create();
-
-  // Gets an environment variable's value and stores it in |result|.
-  // Returns false if the key is unset.
-  virtual bool GetVar(const char* variable_name, std::string* result) = 0;
-
-  // Syntactic sugar for GetVar(variable_name, NULL);
-  virtual bool HasVar(const char* variable_name);
-
-  // Returns true on success, otherwise returns false.
-  virtual bool SetVar(const char* variable_name,
-                      const std::string& new_value) = 0;
-
-  // Returns true on success, otherwise returns false.
-  virtual bool UnSetVar(const char* variable_name) = 0;
-};
-
-
-#if defined(OS_WIN)
-
-typedef string16 NativeEnvironmentString;
-typedef std::map<NativeEnvironmentString, NativeEnvironmentString>
-    EnvironmentMap;
-
-// Returns a modified environment vector constructed from the given environment
-// and the list of changes given in |changes|. Each key in the environment is
-// matched against the first element of the pairs. In the event of a match, the
-// value is replaced by the second of the pair, unless the second is empty, in
-// which case the key-value is removed.
-//
-// This Windows version takes and returns a Windows-style environment block
-// which is a concatenated list of null-terminated 16-bit strings. The end is
-// marked by a double-null terminator. The size of the returned string will
-// include the terminators.
-BASE_EXPORT string16 AlterEnvironment(const wchar_t* env,
-                                      const EnvironmentMap& changes);
-
-#elif defined(OS_POSIX)
-
-typedef std::string NativeEnvironmentString;
-typedef std::map<NativeEnvironmentString, NativeEnvironmentString>
-    EnvironmentMap;
-
-// See general comments for the Windows version above.
-//
-// This Posix version takes and returns a Posix-style environment block, which
-// is a null-terminated list of pointers to null-terminated strings. The
-// returned array will have appended to it the storage for the array itself so
-// there is only one pointer to manage, but this means that you can't copy the
-// array without keeping the original around.
-BASE_EXPORT scoped_ptr<char*[]> AlterEnvironment(
-    const char* const* env,
-    const EnvironmentMap& changes);
-
-#endif
-
-}  // namespace base
-
-#endif  // BASE_ENVIRONMENT_H_
diff --git a/security/sandbox/chromium/base/file_util.cc b/security/sandbox/chromium/base/file_util.cc
deleted file mode 100644
index e9806763855..00000000000
--- a/security/sandbox/chromium/base/file_util.cc
+++ /dev/null
@@ -1,264 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/file_util.h"
-
-#if defined(OS_WIN)
-#include <io.h>
-#endif
-#include <stdio.h>
-
-#include <fstream>
-
-#include "base/files/file_enumerator.h"
-#include "base/files/file_path.h"
-#include "base/logging.h"
-#include "base/strings/string_piece.h"
-#include "base/strings/string_util.h"
-#include "base/strings/stringprintf.h"
-#include "base/strings/utf_string_conversions.h"
-
-namespace base {
-
-namespace {
-
-const FilePath::CharType kExtensionSeparator = FILE_PATH_LITERAL('.');
-
-// The maximum number of 'uniquified' files we will try to create.
-// This is used when the filename we're trying to download is already in use,
-// so we create a new unique filename by appending " (nnn)" before the
-// extension, where 1 <= nnn <= kMaxUniqueFiles.
-// Also used by code that cleans up said files.
-static const int kMaxUniqueFiles = 100;
-
-}  // namespace
-
-bool g_bug108724_debug = false;
-
-int64 ComputeDirectorySize(const FilePath& root_path) {
-  int64 running_size = 0;
-  FileEnumerator file_iter(root_path, true, FileEnumerator::FILES);
-  while (!file_iter.Next().empty())
-    running_size += file_iter.GetInfo().GetSize();
-  return running_size;
-}
-
-bool Move(const FilePath& from_path, const FilePath& to_path) {
-  if (from_path.ReferencesParent() || to_path.ReferencesParent())
-    return false;
-  return internal::MoveUnsafe(from_path, to_path);
-}
-
-bool CopyFile(const FilePath& from_path, const FilePath& to_path) {
-  if (from_path.ReferencesParent() || to_path.ReferencesParent())
-    return false;
-  return internal::CopyFileUnsafe(from_path, to_path);
-}
-
-bool ContentsEqual(const FilePath& filename1, const FilePath& filename2) {
-  // We open the file in binary format even if they are text files because
-  // we are just comparing that bytes are exactly same in both files and not
-  // doing anything smart with text formatting.
-  std::ifstream file1(filename1.value().c_str(),
-                      std::ios::in | std::ios::binary);
-  std::ifstream file2(filename2.value().c_str(),
-                      std::ios::in | std::ios::binary);
-
-  // Even if both files aren't openable (and thus, in some sense, "equal"),
-  // any unusable file yields a result of "false".
-  if (!file1.is_open() || !file2.is_open())
-    return false;
-
-  const int BUFFER_SIZE = 2056;
-  char buffer1[BUFFER_SIZE], buffer2[BUFFER_SIZE];
-  do {
-    file1.read(buffer1, BUFFER_SIZE);
-    file2.read(buffer2, BUFFER_SIZE);
-
-    if ((file1.eof() != file2.eof()) ||
-        (file1.gcount() != file2.gcount()) ||
-        (memcmp(buffer1, buffer2, file1.gcount()))) {
-      file1.close();
-      file2.close();
-      return false;
-    }
-  } while (!file1.eof() || !file2.eof());
-
-  file1.close();
-  file2.close();
-  return true;
-}
-
-bool TextContentsEqual(const FilePath& filename1, const FilePath& filename2) {
-  std::ifstream file1(filename1.value().c_str(), std::ios::in);
-  std::ifstream file2(filename2.value().c_str(), std::ios::in);
-
-  // Even if both files aren't openable (and thus, in some sense, "equal"),
-  // any unusable file yields a result of "false".
-  if (!file1.is_open() || !file2.is_open())
-    return false;
-
-  do {
-    std::string line1, line2;
-    getline(file1, line1);
-    getline(file2, line2);
-
-    // Check for mismatched EOF states, or any error state.
-    if ((file1.eof() != file2.eof()) ||
-        file1.bad() || file2.bad()) {
-      return false;
-    }
-
-    // Trim all '\r' and '\n' characters from the end of the line.
-    std::string::size_type end1 = line1.find_last_not_of("\r\n");
-    if (end1 == std::string::npos)
-      line1.clear();
-    else if (end1 + 1 < line1.length())
-      line1.erase(end1 + 1);
-
-    std::string::size_type end2 = line2.find_last_not_of("\r\n");
-    if (end2 == std::string::npos)
-      line2.clear();
-    else if (end2 + 1 < line2.length())
-      line2.erase(end2 + 1);
-
-    if (line1 != line2)
-      return false;
-  } while (!file1.eof() || !file2.eof());
-
-  return true;
-}
-
-bool ReadFileToString(const FilePath& path, std::string* contents) {
-  if (path.ReferencesParent())
-    return false;
-  FILE* file = file_util::OpenFile(path, "rb");
-  if (!file) {
-    return false;
-  }
-
-  char buf[1 << 16];
-  size_t len;
-  while ((len = fread(buf, 1, sizeof(buf), file)) > 0) {
-    if (contents)
-      contents->append(buf, len);
-  }
-  file_util::CloseFile(file);
-
-  return true;
-}
-
-}  // namespace base
-
-// -----------------------------------------------------------------------------
-
-namespace file_util {
-
-using base::FileEnumerator;
-using base::FilePath;
-using base::kExtensionSeparator;
-using base::kMaxUniqueFiles;
-
-bool IsDirectoryEmpty(const FilePath& dir_path) {
-  FileEnumerator files(dir_path, false,
-      FileEnumerator::FILES | FileEnumerator::DIRECTORIES);
-  if (files.Next().empty())
-    return true;
-  return false;
-}
-
-FILE* CreateAndOpenTemporaryFile(FilePath* path) {
-  FilePath directory;
-  if (!GetTempDir(&directory))
-    return NULL;
-
-  return CreateAndOpenTemporaryFileInDir(directory, path);
-}
-
-bool CreateDirectory(const base::FilePath& full_path) {
-  return CreateDirectoryAndGetError(full_path, NULL);
-}
-
-bool GetFileSize(const FilePath& file_path, int64* file_size) {
-  base::PlatformFileInfo info;
-  if (!GetFileInfo(file_path, &info))
-    return false;
-  *file_size = info.size;
-  return true;
-}
-
-bool TouchFile(const FilePath& path,
-               const base::Time& last_accessed,
-               const base::Time& last_modified) {
-  int flags = base::PLATFORM_FILE_OPEN | base::PLATFORM_FILE_WRITE_ATTRIBUTES;
-
-#if defined(OS_WIN)
-  // On Windows, FILE_FLAG_BACKUP_SEMANTICS is needed to open a directory.
-  if (DirectoryExists(path))
-    flags |= base::PLATFORM_FILE_BACKUP_SEMANTICS;
-#endif  // OS_WIN
-
-  const base::PlatformFile file =
-      base::CreatePlatformFile(path, flags, NULL, NULL);
-  if (file != base::kInvalidPlatformFileValue) {
-    bool result = base::TouchPlatformFile(file, last_accessed, last_modified);
-    base::ClosePlatformFile(file);
-    return result;
-  }
-
-  return false;
-}
-
-bool SetLastModifiedTime(const FilePath& path,
-                         const base::Time& last_modified) {
-  return TouchFile(path, last_modified, last_modified);
-}
-
-bool CloseFile(FILE* file) {
-  if (file == NULL)
-    return true;
-  return fclose(file) == 0;
-}
-
-bool TruncateFile(FILE* file) {
-  if (file == NULL)
-    return false;
-  long current_offset = ftell(file);
-  if (current_offset == -1)
-    return false;
-#if defined(OS_WIN)
-  int fd = _fileno(file);
-  if (_chsize(fd, current_offset) != 0)
-    return false;
-#else
-  int fd = fileno(file);
-  if (ftruncate(fd, current_offset) != 0)
-    return false;
-#endif
-  return true;
-}
-
-int GetUniquePathNumber(
-    const FilePath& path,
-    const FilePath::StringType& suffix) {
-  bool have_suffix = !suffix.empty();
-  if (!PathExists(path) &&
-      (!have_suffix || !PathExists(FilePath(path.value() + suffix)))) {
-    return 0;
-  }
-
-  FilePath new_path;
-  for (int count = 1; count <= kMaxUniqueFiles; ++count) {
-    new_path =
-        path.InsertBeforeExtensionASCII(base::StringPrintf(" (%d)", count));
-    if (!PathExists(new_path) &&
-        (!have_suffix || !PathExists(FilePath(new_path.value() + suffix)))) {
-      return count;
-    }
-  }
-
-  return -1;
-}
-
-}  // namespace file_util
diff --git a/security/sandbox/chromium/base/file_version_info.h b/security/sandbox/chromium/base/file_version_info.h
deleted file mode 100644
index 59cd45df07d..00000000000
--- a/security/sandbox/chromium/base/file_version_info.h
+++ /dev/null
@@ -1,87 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_FILE_VERSION_INFO_H__
-#define BASE_FILE_VERSION_INFO_H__
-
-#include "build/build_config.h"
-
-#if defined(OS_WIN)
-#include <windows.h>
-// http://blogs.msdn.com/oldnewthing/archive/2004/10/25/247180.aspx
-extern "C" IMAGE_DOS_HEADER __ImageBase;
-#endif  // OS_WIN
-
-#include <string>
-
-#include "base/base_export.h"
-#include "base/strings/string16.h"
-
-namespace base {
-class FilePath;
-}
-
-// Provides an interface for accessing the version information for a file. This
-// is the information you access when you select a file in the Windows Explorer,
-// right-click select Properties, then click the Version tab, and on the Mac
-// when you select a file in the Finder and do a Get Info.
-//
-// This list of properties is straight out of Win32's VerQueryValue
-// <http://msdn.microsoft.com/en-us/library/ms647464.aspx> and the Mac
-// version returns values from the Info.plist as appropriate. TODO(avi): make
-// this a less-obvious Windows-ism.
-
-class FileVersionInfo {
- public:
-  virtual ~FileVersionInfo() {}
-#if defined(OS_WIN) || defined(OS_MACOSX)
-  // Creates a FileVersionInfo for the specified path. Returns NULL if something
-  // goes wrong (typically the file does not exit or cannot be opened). The
-  // returned object should be deleted when you are done with it.
-  BASE_EXPORT static FileVersionInfo* CreateFileVersionInfo(
-      const base::FilePath& file_path);
-#endif  // OS_WIN || OS_MACOSX
-
-#if defined(OS_WIN)
-  // Creates a FileVersionInfo for the specified module. Returns NULL in case
-  // of error. The returned object should be deleted when you are done with it.
-  BASE_EXPORT static FileVersionInfo* CreateFileVersionInfoForModule(
-      HMODULE module);
-
-  // Creates a FileVersionInfo for the current module. Returns NULL in case
-  // of error. The returned object should be deleted when you are done with it.
-  // This function should be inlined so that the "current module" is evaluated
-  // correctly, instead of being the module that contains base.
-  __forceinline static FileVersionInfo*
-  CreateFileVersionInfoForCurrentModule() {
-    HMODULE module = reinterpret_cast<HMODULE>(&__ImageBase);
-    return CreateFileVersionInfoForModule(module);
-  }
-#else
-  // Creates a FileVersionInfo for the current module. Returns NULL in case
-  // of error. The returned object should be deleted when you are done with it.
-  BASE_EXPORT static FileVersionInfo* CreateFileVersionInfoForCurrentModule();
-#endif  // OS_WIN
-
-  // Accessors to the different version properties.
-  // Returns an empty string if the property is not found.
-  virtual string16 company_name() = 0;
-  virtual string16 company_short_name() = 0;
-  virtual string16 product_name() = 0;
-  virtual string16 product_short_name() = 0;
-  virtual string16 internal_name() = 0;
-  virtual string16 product_version() = 0;
-  virtual string16 private_build() = 0;
-  virtual string16 special_build() = 0;
-  virtual string16 comments() = 0;
-  virtual string16 original_filename() = 0;
-  virtual string16 file_description() = 0;
-  virtual string16 file_version() = 0;
-  virtual string16 legal_copyright() = 0;
-  virtual string16 legal_trademarks() = 0;
-  virtual string16 last_change() = 0;
-  virtual bool is_official_build() = 0;
-};
-
-#endif  // BASE_FILE_VERSION_INFO_H__
diff --git a/security/sandbox/chromium/base/file_version_info_win.h b/security/sandbox/chromium/base/file_version_info_win.h
deleted file mode 100644
index a37857783a9..00000000000
--- a/security/sandbox/chromium/base/file_version_info_win.h
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_FILE_VERSION_INFO_WIN_H_
-#define BASE_FILE_VERSION_INFO_WIN_H_
-
-#include <string>
-
-#include "base/base_export.h"
-#include "base/basictypes.h"
-#include "base/file_version_info.h"
-#include "base/memory/scoped_ptr.h"
-
-struct tagVS_FIXEDFILEINFO;
-typedef tagVS_FIXEDFILEINFO VS_FIXEDFILEINFO;
-
-class FileVersionInfoWin : public FileVersionInfo {
- public:
-  BASE_EXPORT FileVersionInfoWin(void* data, int language, int code_page);
-  BASE_EXPORT ~FileVersionInfoWin();
-
-  // Accessors to the different version properties.
-  // Returns an empty string if the property is not found.
-  virtual string16 company_name() OVERRIDE;
-  virtual string16 company_short_name() OVERRIDE;
-  virtual string16 product_name() OVERRIDE;
-  virtual string16 product_short_name() OVERRIDE;
-  virtual string16 internal_name() OVERRIDE;
-  virtual string16 product_version() OVERRIDE;
-  virtual string16 private_build() OVERRIDE;
-  virtual string16 special_build() OVERRIDE;
-  virtual string16 comments() OVERRIDE;
-  virtual string16 original_filename() OVERRIDE;
-  virtual string16 file_description() OVERRIDE;
-  virtual string16 file_version() OVERRIDE;
-  virtual string16 legal_copyright() OVERRIDE;
-  virtual string16 legal_trademarks() OVERRIDE;
-  virtual string16 last_change() OVERRIDE;
-  virtual bool is_official_build() OVERRIDE;
-
-  // Lets you access other properties not covered above.
-  BASE_EXPORT bool GetValue(const wchar_t* name, std::wstring* value);
-
-  // Similar to GetValue but returns a wstring (empty string if the property
-  // does not exist).
-  BASE_EXPORT std::wstring GetStringValue(const wchar_t* name);
-
-  // Get the fixed file info if it exists. Otherwise NULL
-  VS_FIXEDFILEINFO* fixed_file_info() { return fixed_file_info_; }
-
- private:
-  scoped_ptr_malloc<char> data_;
-  int language_;
-  int code_page_;
-  // This is a pointer into the data_ if it exists. Otherwise NULL.
-  VS_FIXEDFILEINFO* fixed_file_info_;
-
-  DISALLOW_COPY_AND_ASSIGN(FileVersionInfoWin);
-};
-
-#endif  // BASE_FILE_VERSION_INFO_WIN_H_
diff --git a/security/sandbox/chromium/base/format_macros.h b/security/sandbox/chromium/base/format_macros.h
deleted file mode 100644
index 466d79be731..00000000000
--- a/security/sandbox/chromium/base/format_macros.h
+++ /dev/null
@@ -1,73 +0,0 @@
-// Copyright (c) 2009 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_FORMAT_MACROS_H_
-#define BASE_FORMAT_MACROS_H_
-
-// This file defines the format macros for some integer types.
-
-// To print a 64-bit value in a portable way:
-//   int64_t value;
-//   printf("xyz:%" PRId64, value);
-// The "d" in the macro corresponds to %d; you can also use PRIu64 etc.
-//
-// For wide strings, prepend "Wide" to the macro:
-//   int64_t value;
-//   StringPrintf(L"xyz: %" WidePRId64, value);
-//
-// To print a size_t value in a portable way:
-//   size_t size;
-//   printf("xyz: %" PRIuS, size);
-// The "u" in the macro corresponds to %u, and S is for "size".
-
-#include "build/build_config.h"
-
-#if defined(OS_POSIX)
-
-#if (defined(_INTTYPES_H) || defined(_INTTYPES_H_)) && !defined(PRId64)
-#error "inttypes.h has already been included before this header file, but "
-#error "without __STDC_FORMAT_MACROS defined."
-#endif
-
-#if !defined(__STDC_FORMAT_MACROS)
-#define __STDC_FORMAT_MACROS
-#endif
-
-#include <inttypes.h>
-
-// GCC will concatenate wide and narrow strings correctly, so nothing needs to
-// be done here.
-#define WidePRId64 PRId64
-#define WidePRIu64 PRIu64
-#define WidePRIx64 PRIx64
-
-#if !defined(PRIuS)
-#define PRIuS "zu"
-#endif
-
-#else  // OS_WIN
-
-#if !defined(PRId64)
-#define PRId64 "I64d"
-#endif
-
-#if !defined(PRIu64)
-#define PRIu64 "I64u"
-#endif
-
-#if !defined(PRIx64)
-#define PRIx64 "I64x"
-#endif
-
-#define WidePRId64 L"I64d"
-#define WidePRIu64 L"I64u"
-#define WidePRIx64 L"I64x"
-
-#if !defined(PRIuS)
-#define PRIuS "Iu"
-#endif
-
-#endif
-
-#endif  // BASE_FORMAT_MACROS_H_
diff --git a/security/sandbox/chromium/base/logging.cc b/security/sandbox/chromium/base/logging.cc
deleted file mode 100644
index e836092e766..00000000000
--- a/security/sandbox/chromium/base/logging.cc
+++ /dev/null
@@ -1,866 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/logging.h"
-
-#if defined(OS_WIN)
-#include <io.h>
-#include <windows.h>
-typedef HANDLE FileHandle;
-typedef HANDLE MutexHandle;
-// Windows warns on using write().  It prefers _write().
-#define write(fd, buf, count) _write(fd, buf, static_cast<unsigned int>(count))
-// Windows doesn't define STDERR_FILENO.  Define it here.
-#define STDERR_FILENO 2
-#elif defined(OS_MACOSX)
-#include <mach/mach.h>
-#include <mach/mach_time.h>
-#include <mach-o/dyld.h>
-#elif defined(OS_POSIX)
-#if defined(OS_NACL)
-#include <sys/time.h> // timespec doesn't seem to be in <time.h>
-#else
-#include <sys/syscall.h>
-#endif
-#include <time.h>
-#endif
-
-#if defined(OS_POSIX)
-#include <errno.h>
-#include <pthread.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#define MAX_PATH PATH_MAX
-typedef FILE* FileHandle;
-typedef pthread_mutex_t* MutexHandle;
-#endif
-
-#include <algorithm>
-#include <cstring>
-#include <ctime>
-#include <iomanip>
-#include <ostream>
-
-#include "base/base_switches.h"
-#include "base/command_line.h"
-#include "base/debug/alias.h"
-#include "base/debug/debugger.h"
-#include "base/debug/stack_trace.h"
-#include "base/posix/eintr_wrapper.h"
-#include "base/strings/string_piece.h"
-#include "base/strings/utf_string_conversions.h"
-#include "base/synchronization/lock_impl.h"
-#include "base/threading/platform_thread.h"
-#include "base/vlog.h"
-#if defined(OS_POSIX)
-#include "base/safe_strerror_posix.h"
-#endif
-
-#if defined(OS_ANDROID)
-#include <android/log.h>
-#endif
-
-namespace logging {
-
-DcheckState g_dcheck_state = DISABLE_DCHECK_FOR_NON_OFFICIAL_RELEASE_BUILDS;
-
-DcheckState get_dcheck_state() {
-  return g_dcheck_state;
-}
-
-void set_dcheck_state(DcheckState state) {
-  g_dcheck_state = state;
-}
-
-namespace {
-
-VlogInfo* g_vlog_info = NULL;
-VlogInfo* g_vlog_info_prev = NULL;
-
-const char* const log_severity_names[LOG_NUM_SEVERITIES] = {
-  "INFO", "WARNING", "ERROR", "ERROR_REPORT", "FATAL" };
-
-int min_log_level = 0;
-
-LoggingDestination logging_destination = LOG_DEFAULT;
-
-// For LOG_ERROR and above, always print to stderr.
-const int kAlwaysPrintErrorLevel = LOG_ERROR;
-
-// Which log file to use? This is initialized by InitLogging or
-// will be lazily initialized to the default value when it is
-// first needed.
-#if defined(OS_WIN)
-typedef std::wstring PathString;
-#else
-typedef std::string PathString;
-#endif
-PathString* log_file_name = NULL;
-
-// this file is lazily opened and the handle may be NULL
-FileHandle log_file = NULL;
-
-// what should be prepended to each message?
-bool log_process_id = false;
-bool log_thread_id = false;
-bool log_timestamp = true;
-bool log_tickcount = false;
-
-// Should we pop up fatal debug messages in a dialog?
-bool show_error_dialogs = false;
-
-// An assert handler override specified by the client to be called instead of
-// the debug message dialog and process termination.
-LogAssertHandlerFunction log_assert_handler = NULL;
-// An report handler override specified by the client to be called instead of
-// the debug message dialog.
-LogReportHandlerFunction log_report_handler = NULL;
-// A log message handler that gets notified of every log message we process.
-LogMessageHandlerFunction log_message_handler = NULL;
-
-// Helper functions to wrap platform differences.
-
-int32 CurrentProcessId() {
-#if defined(OS_WIN)
-  return GetCurrentProcessId();
-#elif defined(OS_POSIX)
-  return getpid();
-#endif
-}
-
-uint64 TickCount() {
-#if defined(OS_WIN)
-  return GetTickCount();
-#elif defined(OS_MACOSX)
-  return mach_absolute_time();
-#elif defined(OS_NACL)
-  // NaCl sadly does not have _POSIX_TIMERS enabled in sys/features.h
-  // So we have to use clock() for now.
-  return clock();
-#elif defined(OS_POSIX)
-  struct timespec ts;
-  clock_gettime(CLOCK_MONOTONIC, &ts);
-
-  uint64 absolute_micro =
-    static_cast<int64>(ts.tv_sec) * 1000000 +
-    static_cast<int64>(ts.tv_nsec) / 1000;
-
-  return absolute_micro;
-#endif
-}
-
-void DeleteFilePath(const PathString& log_name) {
-#if defined(OS_WIN)
-  DeleteFile(log_name.c_str());
-#elif defined (OS_NACL)
-  // Do nothing; unlink() isn't supported on NaCl.
-#else
-  unlink(log_name.c_str());
-#endif
-}
-
-PathString GetDefaultLogFile() {
-#if defined(OS_WIN)
-  // On Windows we use the same path as the exe.
-  wchar_t module_name[MAX_PATH];
-  GetModuleFileName(NULL, module_name, MAX_PATH);
-
-  PathString log_file = module_name;
-  PathString::size_type last_backslash =
-      log_file.rfind('\\', log_file.size());
-  if (last_backslash != PathString::npos)
-    log_file.erase(last_backslash + 1);
-  log_file += L"debug.log";
-  return log_file;
-#elif defined(OS_POSIX)
-  // On other platforms we just use the current directory.
-  return PathString("debug.log");
-#endif
-}
-
-// This class acts as a wrapper for locking the logging files.
-// LoggingLock::Init() should be called from the main thread before any logging
-// is done. Then whenever logging, be sure to have a local LoggingLock
-// instance on the stack. This will ensure that the lock is unlocked upon
-// exiting the frame.
-// LoggingLocks can not be nested.
-class LoggingLock {
- public:
-  LoggingLock() {
-    LockLogging();
-  }
-
-  ~LoggingLock() {
-    UnlockLogging();
-  }
-
-  static void Init(LogLockingState lock_log, const PathChar* new_log_file) {
-    if (initialized)
-      return;
-    lock_log_file = lock_log;
-    if (lock_log_file == LOCK_LOG_FILE) {
-#if defined(OS_WIN)
-      if (!log_mutex) {
-        std::wstring safe_name;
-        if (new_log_file)
-          safe_name = new_log_file;
-        else
-          safe_name = GetDefaultLogFile();
-        // \ is not a legal character in mutex names so we replace \ with /
-        std::replace(safe_name.begin(), safe_name.end(), '\\', '/');
-        std::wstring t(L"Global\\");
-        t.append(safe_name);
-        log_mutex = ::CreateMutex(NULL, FALSE, t.c_str());
-
-        if (log_mutex == NULL) {
-#if DEBUG
-          // Keep the error code for debugging
-          int error = GetLastError();  // NOLINT
-          base::debug::BreakDebugger();
-#endif
-          // Return nicely without putting initialized to true.
-          return;
-        }
-      }
-#endif
-    } else {
-      log_lock = new base::internal::LockImpl();
-    }
-    initialized = true;
-  }
-
- private:
-  static void LockLogging() {
-    if (lock_log_file == LOCK_LOG_FILE) {
-#if defined(OS_WIN)
-      ::WaitForSingleObject(log_mutex, INFINITE);
-      // WaitForSingleObject could have returned WAIT_ABANDONED. We don't
-      // abort the process here. UI tests might be crashy sometimes,
-      // and aborting the test binary only makes the problem worse.
-      // We also don't use LOG macros because that might lead to an infinite
-      // loop. For more info see http://crbug.com/18028.
-#elif defined(OS_POSIX)
-      pthread_mutex_lock(&log_mutex);
-#endif
-    } else {
-      // use the lock
-      log_lock->Lock();
-    }
-  }
-
-  static void UnlockLogging() {
-    if (lock_log_file == LOCK_LOG_FILE) {
-#if defined(OS_WIN)
-      ReleaseMutex(log_mutex);
-#elif defined(OS_POSIX)
-      pthread_mutex_unlock(&log_mutex);
-#endif
-    } else {
-      log_lock->Unlock();
-    }
-  }
-
-  // The lock is used if log file locking is false. It helps us avoid problems
-  // with multiple threads writing to the log file at the same time.  Use
-  // LockImpl directly instead of using Lock, because Lock makes logging calls.
-  static base::internal::LockImpl* log_lock;
-
-  // When we don't use a lock, we are using a global mutex. We need to do this
-  // because LockFileEx is not thread safe.
-#if defined(OS_WIN)
-  static MutexHandle log_mutex;
-#elif defined(OS_POSIX)
-  static pthread_mutex_t log_mutex;
-#endif
-
-  static bool initialized;
-  static LogLockingState lock_log_file;
-};
-
-// static
-bool LoggingLock::initialized = false;
-// static
-base::internal::LockImpl* LoggingLock::log_lock = NULL;
-// static
-LogLockingState LoggingLock::lock_log_file = LOCK_LOG_FILE;
-
-#if defined(OS_WIN)
-// static
-MutexHandle LoggingLock::log_mutex = NULL;
-#elif defined(OS_POSIX)
-pthread_mutex_t LoggingLock::log_mutex = PTHREAD_MUTEX_INITIALIZER;
-#endif
-
-// Called by logging functions to ensure that debug_file is initialized
-// and can be used for writing. Returns false if the file could not be
-// initialized. debug_file will be NULL in this case.
-bool InitializeLogFileHandle() {
-  if (log_file)
-    return true;
-
-  if (!log_file_name) {
-    // Nobody has called InitLogging to specify a debug log file, so here we
-    // initialize the log file name to a default.
-    log_file_name = new PathString(GetDefaultLogFile());
-  }
-
-  if ((logging_destination & LOG_TO_FILE) != 0) {
-#if defined(OS_WIN)
-    log_file = CreateFile(log_file_name->c_str(), GENERIC_WRITE,
-                          FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
-                          OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
-    if (log_file == INVALID_HANDLE_VALUE || log_file == NULL) {
-      // try the current directory
-      log_file = CreateFile(L".\\debug.log", GENERIC_WRITE,
-                            FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
-                            OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
-      if (log_file == INVALID_HANDLE_VALUE || log_file == NULL) {
-        log_file = NULL;
-        return false;
-      }
-    }
-    SetFilePointer(log_file, 0, 0, FILE_END);
-#elif defined(OS_POSIX)
-    log_file = fopen(log_file_name->c_str(), "a");
-    if (log_file == NULL)
-      return false;
-#endif
-  }
-
-  return true;
-}
-
-void CloseFile(FileHandle log) {
-#if defined(OS_WIN)
-  CloseHandle(log);
-#else
-  fclose(log);
-#endif
-}
-
-void CloseLogFileUnlocked() {
-  if (!log_file)
-    return;
-
-  CloseFile(log_file);
-  log_file = NULL;
-}
-
-}  // namespace
-
-LoggingSettings::LoggingSettings()
-    : logging_dest(LOG_DEFAULT),
-      log_file(NULL),
-      lock_log(LOCK_LOG_FILE),
-      delete_old(APPEND_TO_OLD_LOG_FILE),
-      dcheck_state(DISABLE_DCHECK_FOR_NON_OFFICIAL_RELEASE_BUILDS) {}
-
-bool BaseInitLoggingImpl(const LoggingSettings& settings) {
-#if defined(OS_NACL)
-  // Can log only to the system debug log.
-  CHECK_EQ(settings.logging_dest & ~LOG_TO_SYSTEM_DEBUG_LOG, 0);
-#endif
-  g_dcheck_state = settings.dcheck_state;
-  CommandLine* command_line = CommandLine::ForCurrentProcess();
-  // Don't bother initializing g_vlog_info unless we use one of the
-  // vlog switches.
-  if (command_line->HasSwitch(switches::kV) ||
-      command_line->HasSwitch(switches::kVModule)) {
-    // NOTE: If g_vlog_info has already been initialized, it might be in use
-    // by another thread. Don't delete the old VLogInfo, just create a second
-    // one. We keep track of both to avoid memory leak warnings.
-    CHECK(!g_vlog_info_prev);
-    g_vlog_info_prev = g_vlog_info;
-
-    g_vlog_info =
-        new VlogInfo(command_line->GetSwitchValueASCII(switches::kV),
-                     command_line->GetSwitchValueASCII(switches::kVModule),
-                     &min_log_level);
-  }
-
-  logging_destination = settings.logging_dest;
-
-  // ignore file options unless logging to file is set.
-  if ((logging_destination & LOG_TO_FILE) == 0)
-    return true;
-
-  LoggingLock::Init(settings.lock_log, settings.log_file);
-  LoggingLock logging_lock;
-
-  // Calling InitLogging twice or after some log call has already opened the
-  // default log file will re-initialize to the new options.
-  CloseLogFileUnlocked();
-
-  if (!log_file_name)
-    log_file_name = new PathString();
-  *log_file_name = settings.log_file;
-  if (settings.delete_old == DELETE_OLD_LOG_FILE)
-    DeleteFilePath(*log_file_name);
-
-  return InitializeLogFileHandle();
-}
-
-void SetMinLogLevel(int level) {
-  min_log_level = std::min(LOG_ERROR_REPORT, level);
-}
-
-int GetMinLogLevel() {
-  return min_log_level;
-}
-
-int GetVlogVerbosity() {
-  return std::max(-1, LOG_INFO - GetMinLogLevel());
-}
-
-int GetVlogLevelHelper(const char* file, size_t N) {
-  DCHECK_GT(N, 0U);
-  // Note: g_vlog_info may change on a different thread during startup
-  // (but will always be valid or NULL).
-  VlogInfo* vlog_info = g_vlog_info;
-  return vlog_info ?
-      vlog_info->GetVlogLevel(base::StringPiece(file, N - 1)) :
-      GetVlogVerbosity();
-}
-
-void SetLogItems(bool enable_process_id, bool enable_thread_id,
-                 bool enable_timestamp, bool enable_tickcount) {
-  log_process_id = enable_process_id;
-  log_thread_id = enable_thread_id;
-  log_timestamp = enable_timestamp;
-  log_tickcount = enable_tickcount;
-}
-
-void SetShowErrorDialogs(bool enable_dialogs) {
-  show_error_dialogs = enable_dialogs;
-}
-
-void SetLogAssertHandler(LogAssertHandlerFunction handler) {
-  log_assert_handler = handler;
-}
-
-void SetLogReportHandler(LogReportHandlerFunction handler) {
-  log_report_handler = handler;
-}
-
-void SetLogMessageHandler(LogMessageHandlerFunction handler) {
-  log_message_handler = handler;
-}
-
-LogMessageHandlerFunction GetLogMessageHandler() {
-  return log_message_handler;
-}
-
-// MSVC doesn't like complex extern templates and DLLs.
-#if !defined(COMPILER_MSVC)
-// Explicit instantiations for commonly used comparisons.
-template std::string* MakeCheckOpString<int, int>(
-    const int&, const int&, const char* names);
-template std::string* MakeCheckOpString<unsigned long, unsigned long>(
-    const unsigned long&, const unsigned long&, const char* names);
-template std::string* MakeCheckOpString<unsigned long, unsigned int>(
-    const unsigned long&, const unsigned int&, const char* names);
-template std::string* MakeCheckOpString<unsigned int, unsigned long>(
-    const unsigned int&, const unsigned long&, const char* names);
-template std::string* MakeCheckOpString<std::string, std::string>(
-    const std::string&, const std::string&, const char* name);
-#endif
-
-// Displays a message box to the user with the error message in it.
-// Used for fatal messages, where we close the app simultaneously.
-// This is for developers only; we don't use this in circumstances
-// (like release builds) where users could see it, since users don't
-// understand these messages anyway.
-void DisplayDebugMessageInDialog(const std::string& str) {
-  if (str.empty())
-    return;
-
-  if (!show_error_dialogs)
-    return;
-
-#if defined(OS_WIN)
-  // For Windows programs, it's possible that the message loop is
-  // messed up on a fatal error, and creating a MessageBox will cause
-  // that message loop to be run. Instead, we try to spawn another
-  // process that displays its command line. We look for "Debug
-  // Message.exe" in the same directory as the application. If it
-  // exists, we use it, otherwise, we use a regular message box.
-  wchar_t prog_name[MAX_PATH];
-  GetModuleFileNameW(NULL, prog_name, MAX_PATH);
-  wchar_t* backslash = wcsrchr(prog_name, '\\');
-  if (backslash)
-    backslash[1] = 0;
-  wcscat_s(prog_name, MAX_PATH, L"debug_message.exe");
-
-  std::wstring cmdline = UTF8ToWide(str);
-  if (cmdline.empty())
-    return;
-
-  STARTUPINFO startup_info;
-  memset(&startup_info, 0, sizeof(startup_info));
-  startup_info.cb = sizeof(startup_info);
-
-  PROCESS_INFORMATION process_info;
-  if (CreateProcessW(prog_name, &cmdline[0], NULL, NULL, false, 0, NULL,
-                     NULL, &startup_info, &process_info)) {
-    WaitForSingleObject(process_info.hProcess, INFINITE);
-    CloseHandle(process_info.hThread);
-    CloseHandle(process_info.hProcess);
-  } else {
-    // debug process broken, let's just do a message box
-    MessageBoxW(NULL, &cmdline[0], L"Fatal error",
-                MB_OK | MB_ICONHAND | MB_TOPMOST);
-  }
-#else
-  // We intentionally don't implement a dialog on other platforms.
-  // You can just look at stderr.
-#endif
-}
-
-#if defined(OS_WIN)
-LogMessage::SaveLastError::SaveLastError() : last_error_(::GetLastError()) {
-}
-
-LogMessage::SaveLastError::~SaveLastError() {
-  ::SetLastError(last_error_);
-}
-#endif  // defined(OS_WIN)
-
-LogMessage::LogMessage(const char* file, int line, LogSeverity severity,
-                       int ctr)
-    : severity_(severity), file_(file), line_(line) {
-  Init(file, line);
-}
-
-LogMessage::LogMessage(const char* file, int line)
-    : severity_(LOG_INFO), file_(file), line_(line) {
-  Init(file, line);
-}
-
-LogMessage::LogMessage(const char* file, int line, LogSeverity severity)
-    : severity_(severity), file_(file), line_(line) {
-  Init(file, line);
-}
-
-LogMessage::LogMessage(const char* file, int line, std::string* result)
-    : severity_(LOG_FATAL), file_(file), line_(line) {
-  Init(file, line);
-  stream_ << "Check failed: " << *result;
-  delete result;
-}
-
-LogMessage::LogMessage(const char* file, int line, LogSeverity severity,
-                       std::string* result)
-    : severity_(severity), file_(file), line_(line) {
-  Init(file, line);
-  stream_ << "Check failed: " << *result;
-  delete result;
-}
-
-LogMessage::~LogMessage() {
-#if !defined(NDEBUG) && !defined(OS_NACL)
-  if (severity_ == LOG_FATAL) {
-    // Include a stack trace on a fatal.
-    base::debug::StackTrace trace;
-    stream_ << std::endl;  // Newline to separate from log message.
-    trace.OutputToStream(&stream_);
-  }
-#endif
-  stream_ << std::endl;
-  std::string str_newline(stream_.str());
-
-  // Give any log message handler first dibs on the message.
-  if (log_message_handler &&
-      log_message_handler(severity_, file_, line_,
-                          message_start_, str_newline)) {
-    // The handler took care of it, no further processing.
-    return;
-  }
-
-  if ((logging_destination & LOG_TO_SYSTEM_DEBUG_LOG) != 0) {
-#if defined(OS_WIN)
-    OutputDebugStringA(str_newline.c_str());
-#elif defined(OS_ANDROID)
-    android_LogPriority priority =
-        (severity_ < 0) ? ANDROID_LOG_VERBOSE : ANDROID_LOG_UNKNOWN;
-    switch (severity_) {
-      case LOG_INFO:
-        priority = ANDROID_LOG_INFO;
-        break;
-      case LOG_WARNING:
-        priority = ANDROID_LOG_WARN;
-        break;
-      case LOG_ERROR:
-      case LOG_ERROR_REPORT:
-        priority = ANDROID_LOG_ERROR;
-        break;
-      case LOG_FATAL:
-        priority = ANDROID_LOG_FATAL;
-        break;
-    }
-    __android_log_write(priority, "chromium", str_newline.c_str());
-#endif
-    fprintf(stderr, "%s", str_newline.c_str());
-    fflush(stderr);
-  } else if (severity_ >= kAlwaysPrintErrorLevel) {
-    // When we're only outputting to a log file, above a certain log level, we
-    // should still output to stderr so that we can better detect and diagnose
-    // problems with unit tests, especially on the buildbots.
-    fprintf(stderr, "%s", str_newline.c_str());
-    fflush(stderr);
-  }
-
-  // write to log file
-  if ((logging_destination & LOG_TO_FILE) != 0) {
-    // We can have multiple threads and/or processes, so try to prevent them
-    // from clobbering each other's writes.
-    // If the client app did not call InitLogging, and the lock has not
-    // been created do it now. We do this on demand, but if two threads try
-    // to do this at the same time, there will be a race condition to create
-    // the lock. This is why InitLogging should be called from the main
-    // thread at the beginning of execution.
-    LoggingLock::Init(LOCK_LOG_FILE, NULL);
-    LoggingLock logging_lock;
-    if (InitializeLogFileHandle()) {
-#if defined(OS_WIN)
-      SetFilePointer(log_file, 0, 0, SEEK_END);
-      DWORD num_written;
-      WriteFile(log_file,
-                static_cast<const void*>(str_newline.c_str()),
-                static_cast<DWORD>(str_newline.length()),
-                &num_written,
-                NULL);
-#else
-      fprintf(log_file, "%s", str_newline.c_str());
-      fflush(log_file);
-#endif
-    }
-  }
-
-  if (severity_ == LOG_FATAL) {
-    // Ensure the first characters of the string are on the stack so they
-    // are contained in minidumps for diagnostic purposes.
-    char str_stack[1024];
-    str_newline.copy(str_stack, arraysize(str_stack));
-    base::debug::Alias(str_stack);
-
-    // display a message or break into the debugger on a fatal error
-    if (base::debug::BeingDebugged()) {
-      base::debug::BreakDebugger();
-    } else {
-      if (log_assert_handler) {
-        // make a copy of the string for the handler out of paranoia
-        log_assert_handler(std::string(stream_.str()));
-      } else {
-        // Don't use the string with the newline, get a fresh version to send to
-        // the debug message process. We also don't display assertions to the
-        // user in release mode. The enduser can't do anything with this
-        // information, and displaying message boxes when the application is
-        // hosed can cause additional problems.
-#ifndef NDEBUG
-        DisplayDebugMessageInDialog(stream_.str());
-#endif
-        // Crash the process to generate a dump.
-        base::debug::BreakDebugger();
-      }
-    }
-  } else if (severity_ == LOG_ERROR_REPORT) {
-    // We are here only if the user runs with --enable-dcheck in release mode.
-    if (log_report_handler) {
-      log_report_handler(std::string(stream_.str()));
-    } else {
-      DisplayDebugMessageInDialog(stream_.str());
-    }
-  }
-}
-
-// writes the common header info to the stream
-void LogMessage::Init(const char* file, int line) {
-  base::StringPiece filename(file);
-  size_t last_slash_pos = filename.find_last_of("\\/");
-  if (last_slash_pos != base::StringPiece::npos)
-    filename.remove_prefix(last_slash_pos + 1);
-
-  // TODO(darin): It might be nice if the columns were fixed width.
-
-  stream_ <<  '[';
-  if (log_process_id)
-    stream_ << CurrentProcessId() << ':';
-  if (log_thread_id)
-    stream_ << base::PlatformThread::CurrentId() << ':';
-  if (log_timestamp) {
-    time_t t = time(NULL);
-    struct tm local_time = {0};
-#if _MSC_VER >= 1400
-    localtime_s(&local_time, &t);
-#else
-    localtime_r(&t, &local_time);
-#endif
-    struct tm* tm_time = &local_time;
-    stream_ << std::setfill('0')
-            << std::setw(2) << 1 + tm_time->tm_mon
-            << std::setw(2) << tm_time->tm_mday
-            << '/'
-            << std::setw(2) << tm_time->tm_hour
-            << std::setw(2) << tm_time->tm_min
-            << std::setw(2) << tm_time->tm_sec
-            << ':';
-  }
-  if (log_tickcount)
-    stream_ << TickCount() << ':';
-  if (severity_ >= 0)
-    stream_ << log_severity_names[severity_];
-  else
-    stream_ << "VERBOSE" << -severity_;
-
-  stream_ << ":" << filename << "(" << line << ")] ";
-
-  message_start_ = stream_.tellp();
-}
-
-#if defined(OS_WIN)
-// This has already been defined in the header, but defining it again as DWORD
-// ensures that the type used in the header is equivalent to DWORD. If not,
-// the redefinition is a compile error.
-typedef DWORD SystemErrorCode;
-#endif
-
-SystemErrorCode GetLastSystemErrorCode() {
-#if defined(OS_WIN)
-  return ::GetLastError();
-#elif defined(OS_POSIX)
-  return errno;
-#else
-#error Not implemented
-#endif
-}
-
-#if defined(OS_WIN)
-Win32ErrorLogMessage::Win32ErrorLogMessage(const char* file,
-                                           int line,
-                                           LogSeverity severity,
-                                           SystemErrorCode err,
-                                           const char* module)
-    : err_(err),
-      module_(module),
-      log_message_(file, line, severity) {
-}
-
-Win32ErrorLogMessage::Win32ErrorLogMessage(const char* file,
-                                           int line,
-                                           LogSeverity severity,
-                                           SystemErrorCode err)
-    : err_(err),
-      module_(NULL),
-      log_message_(file, line, severity) {
-}
-
-Win32ErrorLogMessage::~Win32ErrorLogMessage() {
-  const int error_message_buffer_size = 256;
-  char msgbuf[error_message_buffer_size];
-  DWORD flags = FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS;
-  HMODULE hmod;
-  if (module_) {
-    hmod = GetModuleHandleA(module_);
-    if (hmod) {
-      flags |= FORMAT_MESSAGE_FROM_HMODULE;
-    } else {
-      // This makes a nested Win32ErrorLogMessage. It will have module_ of NULL
-      // so it will not call GetModuleHandle, so recursive errors are
-      // impossible.
-      DPLOG(WARNING) << "Couldn't open module " << module_
-          << " for error message query";
-    }
-  } else {
-    hmod = NULL;
-  }
-  DWORD len = FormatMessageA(flags,
-                             hmod,
-                             err_,
-                             0,
-                             msgbuf,
-                             sizeof(msgbuf) / sizeof(msgbuf[0]),
-                             NULL);
-  if (len) {
-    while ((len > 0) &&
-           isspace(static_cast<unsigned char>(msgbuf[len - 1]))) {
-      msgbuf[--len] = 0;
-    }
-    stream() << ": " << msgbuf;
-  } else {
-    stream() << ": Error " << GetLastError() << " while retrieving error "
-        << err_;
-  }
-  // We're about to crash (CHECK). Put |err_| on the stack (by placing it in a
-  // field) and use Alias in hopes that it makes it into crash dumps.
-  DWORD last_error = err_;
-  base::debug::Alias(&last_error);
-}
-#elif defined(OS_POSIX)
-ErrnoLogMessage::ErrnoLogMessage(const char* file,
-                                 int line,
-                                 LogSeverity severity,
-                                 SystemErrorCode err)
-    : err_(err),
-      log_message_(file, line, severity) {
-}
-
-ErrnoLogMessage::~ErrnoLogMessage() {
-  stream() << ": " << safe_strerror(err_);
-}
-#endif  // OS_WIN
-
-void CloseLogFile() {
-  LoggingLock logging_lock;
-  CloseLogFileUnlocked();
-}
-
-void RawLog(int level, const char* message) {
-  if (level >= min_log_level) {
-    size_t bytes_written = 0;
-    const size_t message_len = strlen(message);
-    int rv;
-    while (bytes_written < message_len) {
-      rv = HANDLE_EINTR(
-          write(STDERR_FILENO, message + bytes_written,
-                message_len - bytes_written));
-      if (rv < 0) {
-        // Give up, nothing we can do now.
-        break;
-      }
-      bytes_written += rv;
-    }
-
-    if (message_len > 0 && message[message_len - 1] != '\n') {
-      do {
-        rv = HANDLE_EINTR(write(STDERR_FILENO, "\n", 1));
-        if (rv < 0) {
-          // Give up, nothing we can do now.
-          break;
-        }
-      } while (rv != 1);
-    }
-  }
-
-  if (level == LOG_FATAL)
-    base::debug::BreakDebugger();
-}
-
-// This was defined at the beginning of this file.
-#undef write
-
-#if defined(OS_WIN)
-std::wstring GetLogFileFullPath() {
-  if (log_file_name)
-    return *log_file_name;
-  return std::wstring();
-}
-#endif
-
-}  // namespace logging
-
-std::ostream& operator<<(std::ostream& out, const wchar_t* wstr) {
-  return out << WideToUTF8(std::wstring(wstr));
-}
diff --git a/security/sandbox/chromium/base/logging_win.cc b/security/sandbox/chromium/base/logging_win.cc
deleted file mode 100644
index a7146657884..00000000000
--- a/security/sandbox/chromium/base/logging_win.cc
+++ /dev/null
@@ -1,139 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/logging_win.h"
-#include "base/memory/singleton.h"
-#include <initguid.h>  // NOLINT
-
-namespace logging {
-
-using base::win::EtwEventLevel;
-using base::win::EtwMofEvent;
-
-DEFINE_GUID(kLogEventId,
-    0x7fe69228, 0x633e, 0x4f06, 0x80, 0xc1, 0x52, 0x7f, 0xea, 0x23, 0xe3, 0xa7);
-
-LogEventProvider::LogEventProvider() : old_log_level_(LOG_NONE) {
-}
-
-LogEventProvider* LogEventProvider::GetInstance() {
-  return Singleton<LogEventProvider,
-                   StaticMemorySingletonTraits<LogEventProvider> >::get();
-}
-
-bool LogEventProvider::LogMessage(logging::LogSeverity severity,
-    const char* file, int line, size_t message_start,
-    const std::string& message) {
-  EtwEventLevel level = TRACE_LEVEL_NONE;
-
-  // Convert the log severity to the most appropriate ETW trace level.
-  if (severity >= 0) {
-    switch (severity) {
-      case LOG_INFO:
-        level = TRACE_LEVEL_INFORMATION;
-        break;
-      case LOG_WARNING:
-        level = TRACE_LEVEL_WARNING;
-        break;
-      case LOG_ERROR:
-      case LOG_ERROR_REPORT:
-        level = TRACE_LEVEL_ERROR;
-        break;
-      case LOG_FATAL:
-        level = TRACE_LEVEL_FATAL;
-        break;
-    }
-  } else {  // severity < 0 is VLOG verbosity levels.
-    level = TRACE_LEVEL_INFORMATION - severity;
-  }
-
-  // Bail if we're not logging, not at that level,
-  // or if we're post-atexit handling.
-  LogEventProvider* provider = LogEventProvider::GetInstance();
-  if (provider == NULL || level > provider->enable_level())
-    return false;
-
-  // And now log the event.
-  if (provider->enable_flags() & ENABLE_LOG_MESSAGE_ONLY) {
-    EtwMofEvent<1> event(kLogEventId, LOG_MESSAGE, level);
-    event.SetField(0, message.length() + 1 - message_start,
-        message.c_str() + message_start);
-
-    provider->Log(event.get());
-  } else {
-    const size_t kMaxBacktraceDepth = 32;
-    void* backtrace[kMaxBacktraceDepth];
-    DWORD depth = 0;
-
-    // Capture a stack trace if one is requested.
-    // requested per our enable flags.
-    if (provider->enable_flags() & ENABLE_STACK_TRACE_CAPTURE)
-      depth = CaptureStackBackTrace(2, kMaxBacktraceDepth, backtrace, NULL);
-
-    EtwMofEvent<5> event(kLogEventId, LOG_MESSAGE_FULL, level);
-    if (file == NULL)
-      file = "";
-
-    // Add the stack trace.
-    event.SetField(0, sizeof(depth), &depth);
-    event.SetField(1, sizeof(backtrace[0]) * depth, &backtrace);
-    // The line.
-    event.SetField(2, sizeof(line), &line);
-    // The file.
-    event.SetField(3, strlen(file) + 1, file);
-    // And finally the message.
-    event.SetField(4, message.length() + 1 - message_start,
-        message.c_str() + message_start);
-
-    provider->Log(event.get());
-  }
-
-  // Don't increase verbosity in other log destinations.
-  if (severity < provider->old_log_level_)
-    return true;
-
-  return false;
-}
-
-void LogEventProvider::Initialize(const GUID& provider_name) {
-  LogEventProvider* provider = LogEventProvider::GetInstance();
-
-  provider->set_provider_name(provider_name);
-  provider->Register();
-
-  // Register our message handler with logging.
-  SetLogMessageHandler(LogMessage);
-}
-
-void LogEventProvider::Uninitialize() {
-  LogEventProvider::GetInstance()->Unregister();
-}
-
-void LogEventProvider::OnEventsEnabled() {
-  // Grab the old log level so we can restore it later.
-  old_log_level_ = GetMinLogLevel();
-
-  // Convert the new trace level to a logging severity
-  // and enable logging at that level.
-  EtwEventLevel level = enable_level();
-  if (level == TRACE_LEVEL_NONE || level == TRACE_LEVEL_FATAL) {
-    SetMinLogLevel(LOG_FATAL);
-  } else if (level == TRACE_LEVEL_ERROR) {
-    SetMinLogLevel(LOG_ERROR);
-  } else if (level == TRACE_LEVEL_WARNING) {
-    SetMinLogLevel(LOG_WARNING);
-  } else if (level == TRACE_LEVEL_INFORMATION) {
-    SetMinLogLevel(LOG_INFO);
-  } else if (level >= TRACE_LEVEL_VERBOSE) {
-    // Above INFO, we enable verbose levels with negative severities.
-    SetMinLogLevel(TRACE_LEVEL_INFORMATION - level);
-  }
-}
-
-void LogEventProvider::OnEventsDisabled() {
-  // Restore the old log level.
-  SetMinLogLevel(old_log_level_);
-}
-
-}  // namespace logging
diff --git a/security/sandbox/chromium/base/logging_win.h b/security/sandbox/chromium/base/logging_win.h
deleted file mode 100644
index 38508a32466..00000000000
--- a/security/sandbox/chromium/base/logging_win.h
+++ /dev/null
@@ -1,80 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_LOGGING_WIN_H_
-#define BASE_LOGGING_WIN_H_
-
-#include <string>
-
-#include "base/base_export.h"
-#include "base/basictypes.h"
-#include "base/win/event_trace_provider.h"
-#include "base/logging.h"
-
-template <typename Type>
-struct StaticMemorySingletonTraits;
-
-namespace logging {
-
-// Event ID for the log messages we generate.
-EXTERN_C BASE_EXPORT const GUID kLogEventId;
-
-// Feature enable mask for LogEventProvider.
-enum LogEnableMask {
-  // If this bit is set in our provider enable mask, we will include
-  // a stack trace with every log message.
-  ENABLE_STACK_TRACE_CAPTURE = 0x0001,
-  // If this bit is set in our provider enable mask, the provider will log
-  // a LOG message with only the textual content of the message, and no
-  // stack trace.
-  ENABLE_LOG_MESSAGE_ONLY = 0x0002,
-};
-
-// The message types our log event provider generates.
-// ETW likes user message types to start at 10.
-enum LogMessageTypes {
-  // A textual only log message, contains a zero-terminated string.
-  LOG_MESSAGE = 10,
-  // A message with a stack trace, followed by the zero-terminated
-  // message text.
-  LOG_MESSAGE_WITH_STACKTRACE = 11,
-  // A message with:
-  //  a stack trace,
-  //  the line number as a four byte integer,
-  //  the file as a zero terminated UTF8 string,
-  //  the zero-terminated UTF8 message text.
-  LOG_MESSAGE_FULL = 12,
-};
-
-// Trace provider class to drive log control and transport
-// with Event Tracing for Windows.
-class BASE_EXPORT LogEventProvider : public base::win::EtwTraceProvider {
- public:
-  static LogEventProvider* GetInstance();
-
-  static bool LogMessage(logging::LogSeverity severity, const char* file,
-      int line, size_t message_start, const std::string& str);
-
-  static void Initialize(const GUID& provider_name);
-  static void Uninitialize();
-
- protected:
-  // Overridden to manipulate the log level on ETW control callbacks.
-  virtual void OnEventsEnabled();
-  virtual void OnEventsDisabled();
-
- private:
-  LogEventProvider();
-
-  // The log severity prior to OnEventsEnabled,
-  // restored in OnEventsDisabled.
-  logging::LogSeverity old_log_level_;
-
-  friend struct StaticMemorySingletonTraits<LogEventProvider>;
-  DISALLOW_COPY_AND_ASSIGN(LogEventProvider);
-};
-
-}  // namespace logging
-
-#endif  // BASE_LOGGING_WIN_H_
diff --git a/security/sandbox/chromium/base/observer_list.h b/security/sandbox/chromium/base/observer_list.h
deleted file mode 100644
index bd1dc64055b..00000000000
--- a/security/sandbox/chromium/base/observer_list.h
+++ /dev/null
@@ -1,217 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_OBSERVER_LIST_H__
-#define BASE_OBSERVER_LIST_H__
-
-#include <algorithm>
-#include <limits>
-#include <vector>
-
-#include "base/basictypes.h"
-#include "base/logging.h"
-#include "base/memory/weak_ptr.h"
-
-///////////////////////////////////////////////////////////////////////////////
-//
-// OVERVIEW:
-//
-//   A container for a list of observers.  Unlike a normal STL vector or list,
-//   this container can be modified during iteration without invalidating the
-//   iterator.  So, it safely handles the case of an observer removing itself
-//   or other observers from the list while observers are being notified.
-//
-// TYPICAL USAGE:
-//
-//   class MyWidget {
-//    public:
-//     ...
-//
-//     class Observer {
-//      public:
-//       virtual void OnFoo(MyWidget* w) = 0;
-//       virtual void OnBar(MyWidget* w, int x, int y) = 0;
-//     };
-//
-//     void AddObserver(Observer* obs) {
-//       observer_list_.AddObserver(obs);
-//     }
-//
-//     void RemoveObserver(Observer* obs) {
-//       observer_list_.RemoveObserver(obs);
-//     }
-//
-//     void NotifyFoo() {
-//       FOR_EACH_OBSERVER(Observer, observer_list_, OnFoo(this));
-//     }
-//
-//     void NotifyBar(int x, int y) {
-//       FOR_EACH_OBSERVER(Observer, observer_list_, OnBar(this, x, y));
-//     }
-//
-//    private:
-//     ObserverList<Observer> observer_list_;
-//   };
-//
-//
-///////////////////////////////////////////////////////////////////////////////
-
-template <typename ObserverType>
-class ObserverListThreadSafe;
-
-template <class ObserverType>
-class ObserverListBase
-    : public base::SupportsWeakPtr<ObserverListBase<ObserverType> > {
- public:
-  // Enumeration of which observers are notified.
-  enum NotificationType {
-    // Specifies that any observers added during notification are notified.
-    // This is the default type if non type is provided to the constructor.
-    NOTIFY_ALL,
-
-    // Specifies that observers added while sending out notification are not
-    // notified.
-    NOTIFY_EXISTING_ONLY
-  };
-
-  // An iterator class that can be used to access the list of observers.  See
-  // also the FOR_EACH_OBSERVER macro defined below.
-  class Iterator {
-   public:
-    Iterator(ObserverListBase<ObserverType>& list)
-        : list_(list.AsWeakPtr()),
-          index_(0),
-          max_index_(list.type_ == NOTIFY_ALL ?
-                     std::numeric_limits<size_t>::max() :
-                     list.observers_.size()) {
-      ++list_->notify_depth_;
-    }
-
-    ~Iterator() {
-      if (list_.get() && --list_->notify_depth_ == 0)
-        list_->Compact();
-    }
-
-    ObserverType* GetNext() {
-      if (!list_.get())
-        return NULL;
-      ListType& observers = list_->observers_;
-      // Advance if the current element is null
-      size_t max_index = std::min(max_index_, observers.size());
-      while (index_ < max_index && !observers[index_])
-        ++index_;
-      return index_ < max_index ? observers[index_++] : NULL;
-    }
-
-   private:
-    base::WeakPtr<ObserverListBase<ObserverType> > list_;
-    size_t index_;
-    size_t max_index_;
-  };
-
-  ObserverListBase() : notify_depth_(0), type_(NOTIFY_ALL) {}
-  explicit ObserverListBase(NotificationType type)
-      : notify_depth_(0), type_(type) {}
-
-  // Add an observer to the list.  An observer should not be added to
-  // the same list more than once.
-  void AddObserver(ObserverType* obs) {
-    if (std::find(observers_.begin(), observers_.end(), obs)
-        != observers_.end()) {
-      NOTREACHED() << "Observers can only be added once!";
-      return;
-    }
-    observers_.push_back(obs);
-  }
-
-  // Remove an observer from the list if it is in the list.
-  void RemoveObserver(ObserverType* obs) {
-    typename ListType::iterator it =
-      std::find(observers_.begin(), observers_.end(), obs);
-    if (it != observers_.end()) {
-      if (notify_depth_) {
-        *it = 0;
-      } else {
-        observers_.erase(it);
-      }
-    }
-  }
-
-  bool HasObserver(ObserverType* observer) const {
-    for (size_t i = 0; i < observers_.size(); ++i) {
-      if (observers_[i] == observer)
-        return true;
-    }
-    return false;
-  }
-
-  void Clear() {
-    if (notify_depth_) {
-      for (typename ListType::iterator it = observers_.begin();
-           it != observers_.end(); ++it) {
-        *it = 0;
-      }
-    } else {
-      observers_.clear();
-    }
-  }
-
- protected:
-  size_t size() const { return observers_.size(); }
-
-  void Compact() {
-    observers_.erase(
-        std::remove(observers_.begin(), observers_.end(),
-                    static_cast<ObserverType*>(NULL)), observers_.end());
-  }
-
- private:
-  friend class ObserverListThreadSafe<ObserverType>;
-
-  typedef std::vector<ObserverType*> ListType;
-
-  ListType observers_;
-  int notify_depth_;
-  NotificationType type_;
-
-  friend class ObserverListBase::Iterator;
-
-  DISALLOW_COPY_AND_ASSIGN(ObserverListBase);
-};
-
-template <class ObserverType, bool check_empty = false>
-class ObserverList : public ObserverListBase<ObserverType> {
- public:
-  typedef typename ObserverListBase<ObserverType>::NotificationType
-      NotificationType;
-
-  ObserverList() {}
-  explicit ObserverList(NotificationType type)
-      : ObserverListBase<ObserverType>(type) {}
-
-  ~ObserverList() {
-    // When check_empty is true, assert that the list is empty on destruction.
-    if (check_empty) {
-      ObserverListBase<ObserverType>::Compact();
-      DCHECK_EQ(ObserverListBase<ObserverType>::size(), 0U);
-    }
-  }
-
-  bool might_have_observers() const {
-    return ObserverListBase<ObserverType>::size() != 0;
-  }
-};
-
-#define FOR_EACH_OBSERVER(ObserverType, observer_list, func)               \
-  do {                                                                     \
-    if ((observer_list).might_have_observers()) {                          \
-      ObserverListBase<ObserverType>::Iterator                             \
-          it_inside_observer_macro(observer_list);                         \
-      ObserverType* obs;                                                   \
-      while ((obs = it_inside_observer_macro.GetNext()) != NULL)           \
-        obs->func;                                                         \
-    }                                                                      \
-  } while (0)
-
-#endif  // BASE_OBSERVER_LIST_H__
diff --git a/security/sandbox/chromium/base/observer_list_threadsafe.h b/security/sandbox/chromium/base/observer_list_threadsafe.h
deleted file mode 100644
index 70b4f11ffa6..00000000000
--- a/security/sandbox/chromium/base/observer_list_threadsafe.h
+++ /dev/null
@@ -1,295 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_OBSERVER_LIST_THREADSAFE_H_
-#define BASE_OBSERVER_LIST_THREADSAFE_H_
-
-#include <algorithm>
-#include <map>
-
-#include "base/basictypes.h"
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/logging.h"
-#include "base/memory/ref_counted.h"
-#include "base/message_loop/message_loop.h"
-#include "base/message_loop/message_loop_proxy.h"
-#include "base/observer_list.h"
-#include "base/stl_util.h"
-#include "base/threading/platform_thread.h"
-
-///////////////////////////////////////////////////////////////////////////////
-//
-// OVERVIEW:
-//
-//   A thread-safe container for a list of observers.
-//   This is similar to the observer_list (see observer_list.h), but it
-//   is more robust for multi-threaded situations.
-//
-//   The following use cases are supported:
-//    * Observers can register for notifications from any thread.
-//      Callbacks to the observer will occur on the same thread where
-//      the observer initially called AddObserver() from.
-//    * Any thread may trigger a notification via Notify().
-//    * Observers can remove themselves from the observer list inside
-//      of a callback.
-//    * If one thread is notifying observers concurrently with an observer
-//      removing itself from the observer list, the notifications will
-//      be silently dropped.
-//
-//   The drawback of the threadsafe observer list is that notifications
-//   are not as real-time as the non-threadsafe version of this class.
-//   Notifications will always be done via PostTask() to another thread,
-//   whereas with the non-thread-safe observer_list, notifications happen
-//   synchronously and immediately.
-//
-//   IMPLEMENTATION NOTES
-//   The ObserverListThreadSafe maintains an ObserverList for each thread
-//   which uses the ThreadSafeObserver.  When Notifying the observers,
-//   we simply call PostTask to each registered thread, and then each thread
-//   will notify its regular ObserverList.
-//
-///////////////////////////////////////////////////////////////////////////////
-
-// Forward declaration for ObserverListThreadSafeTraits.
-template <class ObserverType>
-class ObserverListThreadSafe;
-
-// An UnboundMethod is a wrapper for a method where the actual object is
-// provided at Run dispatch time.
-template <class T, class Method, class Params>
-class UnboundMethod {
- public:
-  UnboundMethod(Method m, const Params& p) : m_(m), p_(p) {
-    COMPILE_ASSERT(
-        (base::internal::ParamsUseScopedRefptrCorrectly<Params>::value),
-        badunboundmethodparams);
-  }
-  void Run(T* obj) const {
-    DispatchToMethod(obj, m_, p_);
-  }
- private:
-  Method m_;
-  Params p_;
-};
-
-// This class is used to work around VS2005 not accepting:
-//
-// friend class
-//     base::RefCountedThreadSafe<ObserverListThreadSafe<ObserverType> >;
-//
-// Instead of friending the class, we could friend the actual function
-// which calls delete.  However, this ends up being
-// RefCountedThreadSafe::DeleteInternal(), which is private.  So we
-// define our own templated traits class so we can friend it.
-template <class T>
-struct ObserverListThreadSafeTraits {
-  static void Destruct(const ObserverListThreadSafe<T>* x) {
-    delete x;
-  }
-};
-
-template <class ObserverType>
-class ObserverListThreadSafe
-    : public base::RefCountedThreadSafe<
-        ObserverListThreadSafe<ObserverType>,
-        ObserverListThreadSafeTraits<ObserverType> > {
- public:
-  typedef typename ObserverList<ObserverType>::NotificationType
-      NotificationType;
-
-  ObserverListThreadSafe()
-      : type_(ObserverListBase<ObserverType>::NOTIFY_ALL) {}
-  explicit ObserverListThreadSafe(NotificationType type) : type_(type) {}
-
-  // Add an observer to the list.  An observer should not be added to
-  // the same list more than once.
-  void AddObserver(ObserverType* obs) {
-    // If there is not a current MessageLoop, it is impossible to notify on it,
-    // so do not add the observer.
-    if (!base::MessageLoop::current())
-      return;
-
-    ObserverList<ObserverType>* list = NULL;
-    base::PlatformThreadId thread_id = base::PlatformThread::CurrentId();
-    {
-      base::AutoLock lock(list_lock_);
-      if (observer_lists_.find(thread_id) == observer_lists_.end())
-        observer_lists_[thread_id] = new ObserverListContext(type_);
-      list = &(observer_lists_[thread_id]->list);
-    }
-    list->AddObserver(obs);
-  }
-
-  // Remove an observer from the list if it is in the list.
-  // If there are pending notifications in-transit to the observer, they will
-  // be aborted.
-  // If the observer to be removed is in the list, RemoveObserver MUST
-  // be called from the same thread which called AddObserver.
-  void RemoveObserver(ObserverType* obs) {
-    ObserverListContext* context = NULL;
-    ObserverList<ObserverType>* list = NULL;
-    base::PlatformThreadId thread_id = base::PlatformThread::CurrentId();
-    {
-      base::AutoLock lock(list_lock_);
-      typename ObserversListMap::iterator it = observer_lists_.find(thread_id);
-      if (it == observer_lists_.end()) {
-        // This will happen if we try to remove an observer on a thread
-        // we never added an observer for.
-        return;
-      }
-      context = it->second;
-      list = &context->list;
-
-      // If we're about to remove the last observer from the list,
-      // then we can remove this observer_list entirely.
-      if (list->HasObserver(obs) && list->size() == 1)
-        observer_lists_.erase(it);
-    }
-    list->RemoveObserver(obs);
-
-    // If RemoveObserver is called from a notification, the size will be
-    // nonzero.  Instead of deleting here, the NotifyWrapper will delete
-    // when it finishes iterating.
-    if (list->size() == 0)
-      delete context;
-  }
-
-  // Verifies that the list is currently empty (i.e. there are no observers).
-  void AssertEmpty() const {
-    base::AutoLock lock(list_lock_);
-    DCHECK(observer_lists_.empty());
-  }
-
-  // Notify methods.
-  // Make a thread-safe callback to each Observer in the list.
-  // Note, these calls are effectively asynchronous.  You cannot assume
-  // that at the completion of the Notify call that all Observers have
-  // been Notified.  The notification may still be pending delivery.
-  template <class Method>
-  void Notify(Method m) {
-    UnboundMethod<ObserverType, Method, Tuple0> method(m, MakeTuple());
-    Notify<Method, Tuple0>(method);
-  }
-
-  template <class Method, class A>
-  void Notify(Method m, const A& a) {
-    UnboundMethod<ObserverType, Method, Tuple1<A> > method(m, MakeTuple(a));
-    Notify<Method, Tuple1<A> >(method);
-  }
-
-  template <class Method, class A, class B>
-  void Notify(Method m, const A& a, const B& b) {
-    UnboundMethod<ObserverType, Method, Tuple2<A, B> > method(
-        m, MakeTuple(a, b));
-    Notify<Method, Tuple2<A, B> >(method);
-  }
-
-  template <class Method, class A, class B, class C>
-  void Notify(Method m, const A& a, const B& b, const C& c) {
-    UnboundMethod<ObserverType, Method, Tuple3<A, B, C> > method(
-        m, MakeTuple(a, b, c));
-    Notify<Method, Tuple3<A, B, C> >(method);
-  }
-
-  template <class Method, class A, class B, class C, class D>
-  void Notify(Method m, const A& a, const B& b, const C& c, const D& d) {
-    UnboundMethod<ObserverType, Method, Tuple4<A, B, C, D> > method(
-        m, MakeTuple(a, b, c, d));
-    Notify<Method, Tuple4<A, B, C, D> >(method);
-  }
-
-  // TODO(mbelshe):  Add more wrappers for Notify() with more arguments.
-
- private:
-  // See comment above ObserverListThreadSafeTraits' definition.
-  friend struct ObserverListThreadSafeTraits<ObserverType>;
-
-  struct ObserverListContext {
-    explicit ObserverListContext(NotificationType type)
-        : loop(base::MessageLoopProxy::current()),
-          list(type) {
-    }
-
-    scoped_refptr<base::MessageLoopProxy> loop;
-    ObserverList<ObserverType> list;
-
-    DISALLOW_COPY_AND_ASSIGN(ObserverListContext);
-  };
-
-  ~ObserverListThreadSafe() {
-    STLDeleteValues(&observer_lists_);
-  }
-
-  template <class Method, class Params>
-  void Notify(const UnboundMethod<ObserverType, Method, Params>& method) {
-    base::AutoLock lock(list_lock_);
-    typename ObserversListMap::iterator it;
-    for (it = observer_lists_.begin(); it != observer_lists_.end(); ++it) {
-      ObserverListContext* context = (*it).second;
-      context->loop->PostTask(
-          FROM_HERE,
-          base::Bind(&ObserverListThreadSafe<ObserverType>::
-              template NotifyWrapper<Method, Params>, this, context, method));
-    }
-  }
-
-  // Wrapper which is called to fire the notifications for each thread's
-  // ObserverList.  This function MUST be called on the thread which owns
-  // the unsafe ObserverList.
-  template <class Method, class Params>
-  void NotifyWrapper(ObserverListContext* context,
-      const UnboundMethod<ObserverType, Method, Params>& method) {
-
-    // Check that this list still needs notifications.
-    {
-      base::AutoLock lock(list_lock_);
-      typename ObserversListMap::iterator it =
-          observer_lists_.find(base::PlatformThread::CurrentId());
-
-      // The ObserverList could have been removed already.  In fact, it could
-      // have been removed and then re-added!  If the master list's loop
-      // does not match this one, then we do not need to finish this
-      // notification.
-      if (it == observer_lists_.end() || it->second != context)
-        return;
-    }
-
-    {
-      typename ObserverList<ObserverType>::Iterator it(context->list);
-      ObserverType* obs;
-      while ((obs = it.GetNext()) != NULL)
-        method.Run(obs);
-    }
-
-    // If there are no more observers on the list, we can now delete it.
-    if (context->list.size() == 0) {
-      {
-        base::AutoLock lock(list_lock_);
-        // Remove |list| if it's not already removed.
-        // This can happen if multiple observers got removed in a notification.
-        // See http://crbug.com/55725.
-        typename ObserversListMap::iterator it =
-            observer_lists_.find(base::PlatformThread::CurrentId());
-        if (it != observer_lists_.end() && it->second == context)
-          observer_lists_.erase(it);
-      }
-      delete context;
-    }
-  }
-
-  // Key by PlatformThreadId because in tests, clients can attempt to remove
-  // observers without a MessageLoop. If this were keyed by MessageLoop, that
-  // operation would be silently ignored, leaving garbage in the ObserverList.
-  typedef std::map<base::PlatformThreadId, ObserverListContext*>
-      ObserversListMap;
-
-  mutable base::Lock list_lock_;  // Protects the observer_lists_.
-  ObserversListMap observer_lists_;
-  const NotificationType type_;
-
-  DISALLOW_COPY_AND_ASSIGN(ObserverListThreadSafe);
-};
-
-#endif  // BASE_OBSERVER_LIST_THREADSAFE_H_
diff --git a/security/sandbox/chromium/base/os_compat_nacl.h b/security/sandbox/chromium/base/os_compat_nacl.h
deleted file mode 100644
index 13e0e3f8dd1..00000000000
--- a/security/sandbox/chromium/base/os_compat_nacl.h
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_OS_COMPAT_NACL_H_
-#define BASE_OS_COMPAT_NACL_H_
-
-#include <sys/types.h>
-
-#if !defined (__GLIBC__)
-// NaCl has no timegm().
-extern "C" time_t timegm(struct tm* const t);
-#endif  // !defined (__GLIBC__)
-
-#endif  // BASE_OS_COMPAT_NACL_H_
-
diff --git a/security/sandbox/chromium/base/path_service.cc b/security/sandbox/chromium/base/path_service.cc
deleted file mode 100644
index 89e58b2cdb1..00000000000
--- a/security/sandbox/chromium/base/path_service.cc
+++ /dev/null
@@ -1,336 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/path_service.h"
-
-#if defined(OS_WIN)
-#include <windows.h>
-#include <shellapi.h>
-#include <shlobj.h>
-#endif
-
-#include "base/containers/hash_tables.h"
-#include "base/file_util.h"
-#include "base/files/file_path.h"
-#include "base/lazy_instance.h"
-#include "base/logging.h"
-#include "base/synchronization/lock.h"
-
-using base::FilePath;
-using base::MakeAbsoluteFilePath;
-
-namespace base {
-  bool PathProvider(int key, FilePath* result);
-#if defined(OS_WIN)
-  bool PathProviderWin(int key, FilePath* result);
-#elif defined(OS_MACOSX)
-  bool PathProviderMac(int key, FilePath* result);
-#elif defined(OS_ANDROID)
-  bool PathProviderAndroid(int key, FilePath* result);
-#elif defined(OS_POSIX)
-  // PathProviderPosix is the default path provider on POSIX OSes other than
-  // Mac and Android.
-  bool PathProviderPosix(int key, FilePath* result);
-#endif
-}
-
-namespace {
-
-typedef base::hash_map<int, FilePath> PathMap;
-
-// We keep a linked list of providers.  In a debug build we ensure that no two
-// providers claim overlapping keys.
-struct Provider {
-  PathService::ProviderFunc func;
-  struct Provider* next;
-#ifndef NDEBUG
-  int key_start;
-  int key_end;
-#endif
-  bool is_static;
-};
-
-Provider base_provider = {
-  base::PathProvider,
-  NULL,
-#ifndef NDEBUG
-  base::PATH_START,
-  base::PATH_END,
-#endif
-  true
-};
-
-#if defined(OS_WIN)
-Provider base_provider_win = {
-  base::PathProviderWin,
-  &base_provider,
-#ifndef NDEBUG
-  base::PATH_WIN_START,
-  base::PATH_WIN_END,
-#endif
-  true
-};
-#endif
-
-#if defined(OS_MACOSX)
-Provider base_provider_mac = {
-  base::PathProviderMac,
-  &base_provider,
-#ifndef NDEBUG
-  base::PATH_MAC_START,
-  base::PATH_MAC_END,
-#endif
-  true
-};
-#endif
-
-#if defined(OS_ANDROID)
-Provider base_provider_android = {
-  base::PathProviderAndroid,
-  &base_provider,
-#ifndef NDEBUG
-  base::PATH_ANDROID_START,
-  base::PATH_ANDROID_END,
-#endif
-  true
-};
-#endif
-
-#if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)
-Provider base_provider_posix = {
-  base::PathProviderPosix,
-  &base_provider,
-#ifndef NDEBUG
-  base::PATH_POSIX_START,
-  base::PATH_POSIX_END,
-#endif
-  true
-};
-#endif
-
-
-struct PathData {
-  base::Lock lock;
-  PathMap cache;        // Cache mappings from path key to path value.
-  PathMap overrides;    // Track path overrides.
-  Provider* providers;  // Linked list of path service providers.
-  bool cache_disabled;  // Don't use cache if true;
-
-  PathData() : cache_disabled(false) {
-#if defined(OS_WIN)
-    providers = &base_provider_win;
-#elif defined(OS_MACOSX)
-    providers = &base_provider_mac;
-#elif defined(OS_ANDROID)
-    providers = &base_provider_android;
-#elif defined(OS_POSIX)
-    providers = &base_provider_posix;
-#endif
-  }
-
-  ~PathData() {
-    Provider* p = providers;
-    while (p) {
-      Provider* next = p->next;
-      if (!p->is_static)
-        delete p;
-      p = next;
-    }
-  }
-};
-
-static base::LazyInstance<PathData> g_path_data = LAZY_INSTANCE_INITIALIZER;
-
-static PathData* GetPathData() {
-  return g_path_data.Pointer();
-}
-
-// Tries to find |key| in the cache. |path_data| should be locked by the caller!
-bool LockedGetFromCache(int key, const PathData* path_data, FilePath* result) {
-  if (path_data->cache_disabled)
-    return false;
-  // check for a cached version
-  PathMap::const_iterator it = path_data->cache.find(key);
-  if (it != path_data->cache.end()) {
-    *result = it->second;
-    return true;
-  }
-  return false;
-}
-
-// Tries to find |key| in the overrides map. |path_data| should be locked by the
-// caller!
-bool LockedGetFromOverrides(int key, PathData* path_data, FilePath* result) {
-  // check for an overridden version.
-  PathMap::const_iterator it = path_data->overrides.find(key);
-  if (it != path_data->overrides.end()) {
-    if (!path_data->cache_disabled)
-      path_data->cache[key] = it->second;
-    *result = it->second;
-    return true;
-  }
-  return false;
-}
-
-}  // namespace
-
-// TODO(brettw): this function does not handle long paths (filename > MAX_PATH)
-// characters). This isn't supported very well by Windows right now, so it is
-// moot, but we should keep this in mind for the future.
-// static
-bool PathService::Get(int key, FilePath* result) {
-  PathData* path_data = GetPathData();
-  DCHECK(path_data);
-  DCHECK(result);
-  DCHECK_GE(key, base::DIR_CURRENT);
-
-  // special case the current directory because it can never be cached
-  if (key == base::DIR_CURRENT)
-    return file_util::GetCurrentDirectory(result);
-
-  Provider* provider = NULL;
-  {
-    base::AutoLock scoped_lock(path_data->lock);
-    if (LockedGetFromCache(key, path_data, result))
-      return true;
-
-    if (LockedGetFromOverrides(key, path_data, result))
-      return true;
-
-    // Get the beginning of the list while it is still locked.
-    provider = path_data->providers;
-  }
-
-  FilePath path;
-
-  // Iterating does not need the lock because only the list head might be
-  // modified on another thread.
-  while (provider) {
-    if (provider->func(key, &path))
-      break;
-    DCHECK(path.empty()) << "provider should not have modified path";
-    provider = provider->next;
-  }
-
-  if (path.empty())
-    return false;
-
-  if (path.ReferencesParent()) {
-    // Make sure path service never returns a path with ".." in it.
-    path = MakeAbsoluteFilePath(path);
-    if (path.empty())
-      return false;
-  }
-  *result = path;
-
-  base::AutoLock scoped_lock(path_data->lock);
-  if (!path_data->cache_disabled)
-    path_data->cache[key] = path;
-
-  return true;
-}
-
-// static
-bool PathService::Override(int key, const FilePath& path) {
-  // Just call the full function with true for the value of |create|.
-  return OverrideAndCreateIfNeeded(key, path, true);
-}
-
-// static
-bool PathService::OverrideAndCreateIfNeeded(int key,
-                                            const FilePath& path,
-                                            bool create) {
-  PathData* path_data = GetPathData();
-  DCHECK(path_data);
-  DCHECK_GT(key, base::DIR_CURRENT) << "invalid path key";
-
-  FilePath file_path = path;
-
-  // For some locations this will fail if called from inside the sandbox there-
-  // fore we protect this call with a flag.
-  if (create) {
-    // Make sure the directory exists. We need to do this before we translate
-    // this to the absolute path because on POSIX, MakeAbsoluteFilePath fails
-    // if called on a non-existent path.
-    if (!base::PathExists(file_path) &&
-        !file_util::CreateDirectory(file_path))
-      return false;
-  }
-
-  // We need to have an absolute path.
-  file_path = MakeAbsoluteFilePath(file_path);
-  if (file_path.empty())
-    return false;
-
-  base::AutoLock scoped_lock(path_data->lock);
-
-  // Clear the cache now. Some of its entries could have depended
-  // on the value we are overriding, and are now out of sync with reality.
-  path_data->cache.clear();
-
-  path_data->overrides[key] = file_path;
-
-  return true;
-}
-
-// static
-bool PathService::RemoveOverride(int key) {
-  PathData* path_data = GetPathData();
-  DCHECK(path_data);
-
-  base::AutoLock scoped_lock(path_data->lock);
-
-  if (path_data->overrides.find(key) == path_data->overrides.end())
-    return false;
-
-  // Clear the cache now. Some of its entries could have depended on the value
-  // we are going to remove, and are now out of sync.
-  path_data->cache.clear();
-
-  path_data->overrides.erase(key);
-
-  return true;
-}
-
-// static
-void PathService::RegisterProvider(ProviderFunc func, int key_start,
-                                   int key_end) {
-  PathData* path_data = GetPathData();
-  DCHECK(path_data);
-  DCHECK_GT(key_end, key_start);
-
-  Provider* p;
-
-  p = new Provider;
-  p->is_static = false;
-  p->func = func;
-#ifndef NDEBUG
-  p->key_start = key_start;
-  p->key_end = key_end;
-#endif
-
-  base::AutoLock scoped_lock(path_data->lock);
-
-#ifndef NDEBUG
-  Provider *iter = path_data->providers;
-  while (iter) {
-    DCHECK(key_start >= iter->key_end || key_end <= iter->key_start) <<
-      "path provider collision";
-    iter = iter->next;
-  }
-#endif
-
-  p->next = path_data->providers;
-  path_data->providers = p;
-}
-
-// static
-void PathService::DisableCache() {
-  PathData* path_data = GetPathData();
-  DCHECK(path_data);
-
-  base::AutoLock scoped_lock(path_data->lock);
-  path_data->cache.clear();
-  path_data->cache_disabled = true;
-}
diff --git a/security/sandbox/chromium/base/pending_task.h b/security/sandbox/chromium/base/pending_task.h
deleted file mode 100644
index 65e17f8d8cb..00000000000
--- a/security/sandbox/chromium/base/pending_task.h
+++ /dev/null
@@ -1,60 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef PENDING_TASK_H_
-#define PENDING_TASK_H_
-
-#include <queue>
-
-#include "base/base_export.h"
-#include "base/callback.h"
-#include "base/location.h"
-#include "base/time/time.h"
-#include "base/tracking_info.h"
-
-namespace base {
-
-// Contains data about a pending task. Stored in TaskQueue and DelayedTaskQueue
-// for use by classes that queue and execute tasks.
-struct BASE_EXPORT PendingTask : public TrackingInfo {
-#if _MSC_VER >= 1700
-  PendingTask();
-#endif
-  PendingTask(const tracked_objects::Location& posted_from,
-              const Closure& task);
-  PendingTask(const tracked_objects::Location& posted_from,
-              const Closure& task,
-              TimeTicks delayed_run_time,
-              bool nestable);
-  ~PendingTask();
-
-  // Used to support sorting.
-  bool operator<(const PendingTask& other) const;
-
-  // The task to run.
-  Closure task;
-
-  // The site this PendingTask was posted from.
-  tracked_objects::Location posted_from;
-
-  // Secondary sort key for run time.
-  int sequence_num;
-
-  // OK to dispatch from a nested loop.
-  bool nestable;
-};
-
-// Wrapper around std::queue specialized for PendingTask which adds a Swap
-// helper method.
-class BASE_EXPORT TaskQueue : public std::queue<PendingTask> {
- public:
-  void Swap(TaskQueue* queue);
-};
-
-// PendingTasks are sorted by their |delayed_run_time| property.
-typedef std::priority_queue<base::PendingTask> DelayedTaskQueue;
-
-}  // namespace base
-
-#endif  // PENDING_TASK_H_
diff --git a/security/sandbox/chromium/base/platform_file.cc b/security/sandbox/chromium/base/platform_file.cc
deleted file mode 100644
index bb411b893fe..00000000000
--- a/security/sandbox/chromium/base/platform_file.cc
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/platform_file.h"
-
-namespace base {
-
-PlatformFileInfo::PlatformFileInfo()
-    : size(0),
-      is_directory(false),
-      is_symbolic_link(false) {
-}
-
-PlatformFileInfo::~PlatformFileInfo() {}
-
-#if !defined(OS_NACL)
-PlatformFile CreatePlatformFile(const FilePath& name,
-                                int flags,
-                                bool* created,
-                                PlatformFileError* error) {
-  if (name.ReferencesParent()) {
-    if (error)
-      *error = PLATFORM_FILE_ERROR_ACCESS_DENIED;
-    return kInvalidPlatformFileValue;
-  }
-  return CreatePlatformFileUnsafe(name, flags, created, error);
-}
-#endif
-
-}  // namespace base
diff --git a/security/sandbox/chromium/base/profiler/alternate_timer.h b/security/sandbox/chromium/base/profiler/alternate_timer.h
deleted file mode 100644
index fdc75dc6f01..00000000000
--- a/security/sandbox/chromium/base/profiler/alternate_timer.h
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This is a glue file, which allows third party code to call into our profiler
-// without having to include most any functions from base.
-
-#ifndef BASE_PROFILER_ALTERNATE_TIMER_H_
-#define BASE_PROFILER_ALTERNATE_TIMER_H_
-
-#include "base/base_export.h"
-
-namespace tracked_objects {
-
-enum TimeSourceType {
-  TIME_SOURCE_TYPE_WALL_TIME,
-  TIME_SOURCE_TYPE_TCMALLOC
-};
-
-// Provide type for an alternate timer function.
-typedef unsigned int NowFunction();
-
-// Environment variable name that is used to activate alternate timer profiling
-// (such as using TCMalloc allocations to provide a pseudo-timer) for tasks
-// instead of wall clock profiling.
-BASE_EXPORT extern const char kAlternateProfilerTime[];
-
-// Set an alternate timer function to replace the OS time function when
-// profiling.  Typically this is called by an allocator that is providing a
-// function that indicates how much memory has been allocated on any given
-// thread.
-BASE_EXPORT void SetAlternateTimeSource(NowFunction* now_function,
-                                        TimeSourceType type);
-
-// Gets the pointer to a function that was set via SetAlternateTimeSource().
-// Returns NULL if no set was done prior to calling GetAlternateTimeSource.
-NowFunction* GetAlternateTimeSource();
-
-// Returns the type of the currently set time source.
-BASE_EXPORT TimeSourceType GetTimeSourceType();
-
-}  // namespace tracked_objects
-
-#endif  // BASE_PROFILER_ALTERNATE_TIMER_H_
diff --git a/security/sandbox/chromium/base/profiler/tracked_time.h b/security/sandbox/chromium/base/profiler/tracked_time.h
deleted file mode 100644
index 23632749a00..00000000000
--- a/security/sandbox/chromium/base/profiler/tracked_time.h
+++ /dev/null
@@ -1,71 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_PROFILER_TRACKED_TIME_H_
-#define BASE_PROFILER_TRACKED_TIME_H_
-
-
-#include "base/base_export.h"
-#include "base/basictypes.h"
-#include "base/time/time.h"
-
-namespace tracked_objects {
-
-//------------------------------------------------------------------------------
-
-// TimeTicks maintains a wasteful 64 bits of data (we need less than 32), and on
-// windows, a 64 bit timer is expensive to even obtain. We use a simple
-// millisecond counter for most of our time values, as well as millisecond units
-// of duration between those values.  This means we can only handle durations
-// up to 49 days (range), or 24 days (non-negative time durations).
-// We only define enough methods to service the needs of the tracking classes,
-// and our interfaces are modeled after what TimeTicks and TimeDelta use (so we
-// can swap them into place if we want to use the "real" classes).
-
-class BASE_EXPORT Duration {  // Similar to base::TimeDelta.
- public:
-  Duration();
-
-  Duration& operator+=(const Duration& other);
-  Duration operator+(const Duration& other) const;
-
-  bool operator==(const Duration& other) const;
-  bool operator!=(const Duration& other) const;
-  bool operator>(const Duration& other) const;
-
-  static Duration FromMilliseconds(int ms);
-
-  int32 InMilliseconds() const;
-
- private:
-  friend class TrackedTime;
-  explicit Duration(int32 duration);
-
-  // Internal time is stored directly in milliseconds.
-  int32 ms_;
-};
-
-class BASE_EXPORT TrackedTime {  // Similar to base::TimeTicks.
- public:
-  TrackedTime();
-  explicit TrackedTime(const base::TimeTicks& time);
-
-  static TrackedTime Now();
-  Duration operator-(const TrackedTime& other) const;
-  TrackedTime operator+(const Duration& other) const;
-  bool is_null() const;
-
-  static TrackedTime FromMilliseconds(int32 ms) { return TrackedTime(ms); }
-
- private:
-  friend class Duration;
-  explicit TrackedTime(int32 ms);
-
-  // Internal duration is stored directly in milliseconds.
-  uint32 ms_;
-};
-
-}  // namespace tracked_objects
-
-#endif  // BASE_PROFILER_TRACKED_TIME_H_
diff --git a/security/sandbox/chromium/base/run_loop.h b/security/sandbox/chromium/base/run_loop.h
deleted file mode 100644
index f5ee5c34665..00000000000
--- a/security/sandbox/chromium/base/run_loop.h
+++ /dev/null
@@ -1,124 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_RUN_LOOP_H_
-#define BASE_RUN_LOOP_H_
-
-#include "base/base_export.h"
-#include "base/callback.h"
-#include "base/memory/weak_ptr.h"
-#include "base/message_loop/message_loop.h"
-
-namespace base {
-#if defined(OS_ANDROID)
-class MessagePumpForUI;
-#endif
-
-#if defined(OS_IOS)
-class MessagePumpUIApplication;
-#endif
-
-// Helper class to Run a nested MessageLoop. Please do not use nested
-// MessageLoops in production code! If you must, use this class instead of
-// calling MessageLoop::Run/Quit directly. RunLoop::Run can only be called once
-// per RunLoop lifetime. Create a RunLoop on the stack and call Run/Quit to run
-// a nested MessageLoop.
-class BASE_EXPORT RunLoop {
- public:
-  RunLoop();
-#if !defined(OS_MACOSX) && !defined(OS_ANDROID) && \
-    !defined(USE_GTK_MESSAGE_PUMP)
-  explicit RunLoop(MessageLoop::Dispatcher* dispatcher);
-#endif
-  ~RunLoop();
-
-#if !defined(OS_MACOSX) && !defined(OS_ANDROID) && \
-    !defined(USE_GTK_MESSAGE_PUMP)
-  void set_dispatcher(MessageLoop::Dispatcher* dispatcher) {
-    dispatcher_ = dispatcher;
-  }
-#endif
-
-  // Run the current MessageLoop. This blocks until Quit is called. Before
-  // calling Run, be sure to grab an AsWeakPtr or the QuitClosure in order to
-  // stop the MessageLoop asynchronously. MessageLoop::Quit and QuitNow will
-  // also trigger a return from Run, but those are deprecated.
-  void Run();
-
-  // Run the current MessageLoop until it doesn't find any tasks or messages in
-  // the queue (it goes idle). WARNING: This may never return! Only use this
-  // when repeating tasks such as animated web pages have been shut down.
-  void RunUntilIdle();
-
-  bool running() const { return running_; }
-
-  // Quit an earlier call to Run(). There can be other nested RunLoops servicing
-  // the same task queue (MessageLoop); Quitting one RunLoop has no bearing on
-  // the others. Quit can be called before, during or after Run. If called
-  // before Run, Run will return immediately when called. Calling Quit after the
-  // RunLoop has already finished running has no effect.
-  //
-  // WARNING: You must NEVER assume that a call to Quit will terminate the
-  // targetted message loop. If a nested message loop continues running, the
-  // target may NEVER terminate. It is very easy to livelock (run forever) in
-  // such a case.
-  void Quit();
-
-  // Convenience method to get a closure that safely calls Quit (has no effect
-  // if the RunLoop instance is gone).
-  //
-  // Example:
-  //   RunLoop run_loop;
-  //   PostTask(run_loop.QuitClosure());
-  //   run_loop.Run();
-  base::Closure QuitClosure();
-
- private:
-  friend class MessageLoop;
-#if defined(OS_ANDROID)
-  // Android doesn't support the blocking MessageLoop::Run, so it calls
-  // BeforeRun and AfterRun directly.
-  friend class base::MessagePumpForUI;
-#endif
-
-#if defined(OS_IOS)
-  // iOS doesn't support the blocking MessageLoop::Run, so it calls
-  // BeforeRun directly.
-  friend class base::MessagePumpUIApplication;
-#endif
-
-  // Return false to abort the Run.
-  bool BeforeRun();
-  void AfterRun();
-
-  MessageLoop* loop_;
-
-  // WeakPtrFactory for QuitClosure safety.
-  base::WeakPtrFactory<RunLoop> weak_factory_;
-
-  // Parent RunLoop or NULL if this is the top-most RunLoop.
-  RunLoop* previous_run_loop_;
-
-#if !defined(OS_MACOSX) && !defined(OS_ANDROID) && \
-    !defined(USE_GTK_MESSAGE_PUMP)
-  MessageLoop::Dispatcher* dispatcher_;
-#endif
-
-  // Used to count how many nested Run() invocations are on the stack.
-  int run_depth_;
-
-  bool run_called_;
-  bool quit_called_;
-  bool running_;
-
-  // Used to record that QuitWhenIdle() was called on the MessageLoop, meaning
-  // that we should quit Run once it becomes idle.
-  bool quit_when_idle_received_;
-
-  DISALLOW_COPY_AND_ASSIGN(RunLoop);
-};
-
-}  // namespace base
-
-#endif  // BASE_RUN_LOOP_H_
diff --git a/security/sandbox/chromium/base/sys_info.h b/security/sandbox/chromium/base/sys_info.h
deleted file mode 100644
index 38462ed1110..00000000000
--- a/security/sandbox/chromium/base/sys_info.h
+++ /dev/null
@@ -1,113 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_SYS_INFO_H_
-#define BASE_SYS_INFO_H_
-
-#include <string>
-
-#include "base/base_export.h"
-#include "base/basictypes.h"
-#include "base/files/file_path.h"
-#include "build/build_config.h"
-
-namespace base {
-
-class BASE_EXPORT SysInfo {
- public:
-  // Return the number of logical processors/cores on the current machine.
-  static int NumberOfProcessors();
-
-  // Return the number of bytes of physical memory on the current machine.
-  static int64 AmountOfPhysicalMemory();
-
-  // Return the number of bytes of current available physical memory on the
-  // machine.
-  static int64 AmountOfAvailablePhysicalMemory();
-
-  // Return the number of megabytes of physical memory on the current machine.
-  static int AmountOfPhysicalMemoryMB() {
-    return static_cast<int>(AmountOfPhysicalMemory() / 1024 / 1024);
-  }
-
-  // Return the available disk space in bytes on the volume containing |path|,
-  // or -1 on failure.
-  static int64 AmountOfFreeDiskSpace(const FilePath& path);
-
-  // Returns system uptime in milliseconds.
-  static int64 Uptime();
-
-  // Returns the name of the host operating system.
-  static std::string OperatingSystemName();
-
-  // Returns the version of the host operating system.
-  static std::string OperatingSystemVersion();
-
-  // Retrieves detailed numeric values for the OS version.
-  // TODO(port): Implement a Linux version of this method and enable the
-  // corresponding unit test.
-  // DON'T USE THIS ON THE MAC OR WINDOWS to determine the current OS release
-  // for OS version-specific feature checks and workarounds. If you must use
-  // an OS version check instead of a feature check, use the base::mac::IsOS*
-  // family from base/mac/mac_util.h, or base::win::GetVersion from
-  // base/win/windows_version.h.
-  static void OperatingSystemVersionNumbers(int32* major_version,
-                                            int32* minor_version,
-                                            int32* bugfix_version);
-
-  // Returns the architecture of the running operating system.
-  // Exact return value may differ across platforms.
-  // e.g. a 32-bit x86 kernel on a 64-bit capable CPU will return "x86",
-  //      whereas a x86-64 kernel on the same CPU will return "x86_64"
-  static std::string OperatingSystemArchitecture();
-
-  // Avoid using this. Use base/cpu.h to get information about the CPU instead.
-  // http://crbug.com/148884
-  // Returns the CPU model name of the system. If it can not be figured out,
-  // an empty string is returned.
-  static std::string CPUModelName();
-
-  // Return the smallest amount of memory (in bytes) which the VM system will
-  // allocate.
-  static size_t VMAllocationGranularity();
-
-#if defined(OS_POSIX) && !defined(OS_MACOSX)
-  // Returns the maximum SysV shared memory segment size.
-  static size_t MaxSharedMemorySize();
-#endif  // defined(OS_POSIX) && !defined(OS_MACOSX)
-
-#if defined(OS_CHROMEOS)
-  // Returns the name of the version entry we wish to look up in the
-  // Linux Standard Base release information file.
-  static std::string GetLinuxStandardBaseVersionKey();
-
-  // Parses /etc/lsb-release to get version information for Google Chrome OS.
-  // Declared here so it can be exposed for unit testing.
-  static void ParseLsbRelease(const std::string& lsb_release,
-                              int32* major_version,
-                              int32* minor_version,
-                              int32* bugfix_version);
-
-  // Returns the path to the lsb-release file.
-  static FilePath GetLsbReleaseFilePath();
-#endif  // defined(OS_CHROMEOS)
-
-#if defined(OS_ANDROID)
-  // Returns the Android build's codename.
-  static std::string GetAndroidBuildCodename();
-
-  // Returns the Android build ID.
-  static std::string GetAndroidBuildID();
-
-  // Returns the device's name.
-  static std::string GetDeviceName();
-
-  static int DalvikHeapSizeMB();
-  static int DalvikHeapGrowthLimitMB();
-#endif  // defined(OS_ANDROID)
-};
-
-}  // namespace base
-
-#endif  // BASE_SYS_INFO_H_
diff --git a/security/sandbox/chromium/base/thread_task_runner_handle.h b/security/sandbox/chromium/base/thread_task_runner_handle.h
deleted file mode 100644
index 238435f978e..00000000000
--- a/security/sandbox/chromium/base/thread_task_runner_handle.h
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_THREAD_TASK_RUNNER_HANDLE_H_
-#define BASE_THREAD_TASK_RUNNER_HANDLE_H_
-
-#include "base/base_export.h"
-#include "base/memory/ref_counted.h"
-
-namespace base {
-
-class SingleThreadTaskRunner;
-
-// ThreadTaskRunnerHandle stores a reference to a thread's TaskRunner
-// in thread-local storage.  Callers can then retrieve the TaskRunner
-// for the current thread by calling ThreadTaskRunnerHandle::Get().
-// At most one TaskRunner may be bound to each thread at a time.
-class BASE_EXPORT ThreadTaskRunnerHandle {
- public:
-  // Gets the SingleThreadTaskRunner for the current thread.
-  static scoped_refptr<SingleThreadTaskRunner> Get();
-
-  // Returns true if the SingleThreadTaskRunner is already created for
-  // the current thread.
-  static bool IsSet();
-
-  // Binds |task_runner| to the current thread. |task_runner| must belong
-  // to the current thread for this to succeed.
-  explicit ThreadTaskRunnerHandle(
-      const scoped_refptr<SingleThreadTaskRunner>& task_runner);
-  ~ThreadTaskRunnerHandle();
-
- private:
-  scoped_refptr<SingleThreadTaskRunner> task_runner_;
-};
-
-}  // namespace base
-
-#endif  // BASE_THREAD_TASK_RUNNER_HANDLE_H_
diff --git a/security/sandbox/chromium/base/threading/thread_local_storage.h b/security/sandbox/chromium/base/threading/thread_local_storage.h
deleted file mode 100644
index eb5648f76c9..00000000000
--- a/security/sandbox/chromium/base/threading/thread_local_storage.h
+++ /dev/null
@@ -1,93 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_THREADING_THREAD_LOCAL_STORAGE_H_
-#define BASE_THREADING_THREAD_LOCAL_STORAGE_H_
-
-#include "base/base_export.h"
-#include "base/basictypes.h"
-
-#if defined(OS_POSIX)
-#include <pthread.h>
-#endif
-
-namespace base {
-
-// Wrapper for thread local storage.  This class doesn't do much except provide
-// an API for portability.
-class BASE_EXPORT ThreadLocalStorage {
- public:
-
-  // Prototype for the TLS destructor function, which can be optionally used to
-  // cleanup thread local storage on thread exit.  'value' is the data that is
-  // stored in thread local storage.
-  typedef void (*TLSDestructorFunc)(void* value);
-
-  // StaticSlot uses its own struct initializer-list style static
-  // initialization, as base's LINKER_INITIALIZED requires a constructor and on
-  // some compilers (notably gcc 4.4) this still ends up needing runtime
-  // initialization.
-  #define TLS_INITIALIZER {0}
-
-  // A key representing one value stored in TLS.
-  // Initialize like
-  //   ThreadLocalStorage::StaticSlot my_slot = TLS_INITIALIZER;
-  // If you're not using a static variable, use the convenience class
-  // ThreadLocalStorage::Slot (below) instead.
-  struct BASE_EXPORT StaticSlot {
-    // Set up the TLS slot.  Called by the constructor.
-    // 'destructor' is a pointer to a function to perform per-thread cleanup of
-    // this object.  If set to NULL, no cleanup is done for this TLS slot.
-    // Returns false on error.
-    bool Initialize(TLSDestructorFunc destructor);
-
-    // Free a previously allocated TLS 'slot'.
-    // If a destructor was set for this slot, removes
-    // the destructor so that remaining threads exiting
-    // will not free data.
-    void Free();
-
-    // Get the thread-local value stored in slot 'slot'.
-    // Values are guaranteed to initially be zero.
-    void* Get() const;
-
-    // Set the thread-local value stored in slot 'slot' to
-    // value 'value'.
-    void Set(void* value);
-
-    bool initialized() const { return initialized_; }
-
-    // The internals of this struct should be considered private.
-    bool initialized_;
-#if defined(OS_WIN)
-    int slot_;
-#elif defined(OS_POSIX)
-    pthread_key_t key_;
-#endif
-
-  };
-
-  // A convenience wrapper around StaticSlot with a constructor. Can be used
-  // as a member variable.
-  class BASE_EXPORT Slot : public StaticSlot {
-   public:
-    // Calls StaticSlot::Initialize().
-    explicit Slot(TLSDestructorFunc destructor = NULL);
-
-   private:
-    using StaticSlot::initialized_;
-#if defined(OS_WIN)
-    using StaticSlot::slot_;
-#elif defined(OS_POSIX)
-    using StaticSlot::key_;
-#endif
-    DISALLOW_COPY_AND_ASSIGN(Slot);
-  };
-
-  DISALLOW_COPY_AND_ASSIGN(ThreadLocalStorage);
-};
-
-}  // namespace base
-
-#endif  // BASE_THREADING_THREAD_LOCAL_STORAGE_H_
diff --git a/security/sandbox/chromium/base/tracking_info.h b/security/sandbox/chromium/base/tracking_info.h
deleted file mode 100644
index a1c6392d2ea..00000000000
--- a/security/sandbox/chromium/base/tracking_info.h
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This is a simple struct with tracking information that is stored
-// with a PendingTask (when message_loop is handling the task).
-// Only the information that is shared with the profiler in tracked_objects
-// are included in this structure.
-
-
-#ifndef BASE_TRACKING_INFO_H_
-#define BASE_TRACKING_INFO_H_
-
-#include "base/base_export.h"
-#include "base/profiler/tracked_time.h"
-#include "base/time/time.h"
-
-namespace tracked_objects {
-class Location;
-class Births;
-}
-
-namespace base {
-
-// This structure is copied around by value.
-struct BASE_EXPORT TrackingInfo {
-  TrackingInfo();
-  TrackingInfo(const tracked_objects::Location& posted_from,
-               base::TimeTicks delayed_run_time);
-  ~TrackingInfo();
-
-  // To avoid conflating our stats with the delay duration in a PostDelayedTask,
-  // we identify such tasks, and replace their post_time with the time they
-  // were scheduled (requested?) to emerge from the delayed task queue. This
-  // means that queuing delay for such tasks will show how long they went
-  // unserviced, after they *could* be serviced.  This is the same stat as we
-  // have for non-delayed tasks, and we consistently call it queuing delay.
-  tracked_objects::TrackedTime EffectiveTimePosted() const {
-    return tracked_objects::TrackedTime(
-        delayed_run_time.is_null() ? time_posted : delayed_run_time);
-  }
-
-  // Record of location and thread that the task came from.
-  tracked_objects::Births* birth_tally;
-
-  // Time when the related task was posted.
-  base::TimeTicks time_posted;
-
-  // The time when the task should be run.
-  base::TimeTicks delayed_run_time;
-};
-
-}  // namespace base
-
-#endif  // BASE_TRACKING_INFO_H_
diff --git a/testing/b2g_cppunittest_manifest.txt b/testing/b2g_cppunittest_manifest.txt
new file mode 100644
index 00000000000..c91733baf69
--- /dev/null
+++ b/testing/b2g_cppunittest_manifest.txt
@@ -0,0 +1,9 @@
+# This is just a list of tests to skip, one test per line
+TestPLDHash                         # Bug 1038197
+TestTXMgr                           # Bug 919595
+TestPlainTextSerializer             # Bug 919599
+TestNativeXMLHttpRequest            # Bug 919642
+mediapipeline_unittest              # Bug 919646
+TestStartupCache                    # Bug 929655
+TestStartupCacheTelemetry.manifest  # Bug 929655
+TestStartupCacheTelemetry.js        # Bug 929655
diff --git a/testing/config/mozharness/b2g_emulator_config.py b/testing/config/mozharness/b2g_emulator_config.py
index 9d5ea735ae8..afa0d1005b4 100644
--- a/testing/config/mozharness/b2g_emulator_config.py
+++ b/testing/config/mozharness/b2g_emulator_config.py
@@ -47,4 +47,14 @@ config = {
         "--testing-modules-dir=%(modules_dir)s", "--symbols-path=%(symbols_path)s",
         "--busybox=%(busybox)s", "--total-chunks=%(total_chunks)s", "--this-chunk=%(this_chunk)s",
     ],
+
+    "cppunittest_options": [
+        "--dm_trans=adb",
+        "--symbols-path=%(symbols_path)s",
+        "--xre-path=%(xre_path)s",
+        "--addEnv", "LD_LIBRARY_PATH=/vendor/lib:/system/lib:/system/b2g",
+        "--with-b2g-emulator=%(b2gpath)s",
+        "--skip-manifest=b2g_cppunittest_manifest.txt",
+        "."
+    ],
 }
diff --git a/testing/marionette/client/marionette/scripts/runemu.py b/testing/marionette/client/marionette/scripts/runemu.py
deleted file mode 100644
index 3a4b993fed6..00000000000
--- a/testing/marionette/client/marionette/scripts/runemu.py
+++ /dev/null
@@ -1,50 +0,0 @@
-from marionette import Marionette, Emulator
-from optparse import OptionParser
-
-
-def runemulator(homedir=None, url=None, pidfile=None, arch='x86', noWindow=False,
-                userdata=None):
-    qemu = Emulator(homedir=homedir, arch=arch, noWindow=noWindow,
-                    userdata=userdata)
-    qemu.start()
-    port = qemu.setup_port_forwarding(2828)
-    assert(qemu.wait_for_port())
-    if pidfile:
-        f = open(pidfile, 'w')
-        f.write("%d" % qemu.proc.pid)
-        f.close()
-    print 'emulator launched, pid:', qemu.proc.pid
-
-    if url:
-        marionette = Marionette(port=port)
-        marionette.start_session()
-        marionette.navigate(url)
-        marionette.delete_session()
-
-if __name__ == '__main__':
-    parser = OptionParser()
-    parser.add_option('--repo', dest='repo_path', action='store',
-                      help='directory of the B2G repo')
-    parser.add_option('--arch', dest='arch', action='store',
-                      default='x86',
-                      help='the emulator cpu architecture (x86 or arm)')
-    parser.add_option('--url', dest='url', action='store',
-                      help='url to navigate to after launching emulator')
-    parser.add_option('--pidfile', dest='pidfile', action='store',
-                      help='file in which to store emulator pid')
-    parser.add_option('--no-window', dest='noWindow', action='store_true',
-                      help='pass -no-window to the emulator')
-    parser.add_option('--userdata', dest='userdata', action='store',
-                      help='path to userdata.img file to use')
-
-    options, args = parser.parse_args()
-    if not options.repo_path:
-        raise Exception ("must specify the --repo /path/to/B2G/repo argument")
-
-    runemulator(homedir=options.repo_path,
-                url=options.url,
-                pidfile=options.pidfile,
-                arch=options.arch,
-                noWindow=options.noWindow,
-                userdata=options.userdata)
-
diff --git a/testing/marionette/client/marionette/scripts/runemu.sh b/testing/marionette/client/marionette/scripts/runemu.sh
deleted file mode 100755
index 7022d6dd4ae..00000000000
--- a/testing/marionette/client/marionette/scripts/runemu.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/bin/bash
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at http://mozilla.org/MPL/2.0/.
-
-# Marionette requires Python 2.7, so the first parameter to this script
-# should be the path to that.
-PYTHON=$1
-
-if [ -z "${PYTHON}" ]
-then
-    echo "No python found"
-    exit 1
-fi
-
-# Determine the absolute path of our location.
-echo $0
-echo `dirname $0`
-echo $PWD
-SCRIPTS_HOME=`dirname $0`
-cd $SCRIPTS_HOME
-cd ..
-MARIONETTE_HOME=`dirname $PWD`
-echo "Detected Marionette home in $MARIONETTE_HOME"
-
-# If a GECKO_OBJDIR environemnt variable exists, we will create the Python
-# virtual envirnoment there. Otherwise we create it in the PWD.
-VENV_DIR="runemu_venv"
-if [ -z $GECKO_OBJDIR ]
-then
-    VENV_DIR="$MARIONETTE_HOME/$VENV_DIR"
-else
-    VENV_DIR="$GECKO_OBJDIR/$VENV_DIR"
-fi
-
-# Check if environment exists, if not, create a virtualenv:
-if [ -d $VENV_DIR ]
-then
-  echo "Using virtual environment in $VENV_DIR"
-  cd $VENV_DIR
-  . bin/activate
-else
-  echo "Creating a virtual environment in $VENV_DIR"
-  curl -L https://raw.github.com/pypa/virtualenv/develop/virtualenv.py | ${PYTHON} - $VENV_DIR
-  cd $VENV_DIR
-  . bin/activate
-  # set up mozbase
-  git clone git://github.com/mozilla/mozbase.git
-  cd mozbase
-  python setup_development.py
-fi
-
-# update the marionette_client
-cd $MARIONETTE_HOME
-python setup.py develop
-cd marionette
-
-# pop off the python parameter
-shift
-cd scripts
-python runemu.py $@
-
diff --git a/testing/remotecppunittests.py b/testing/remotecppunittests.py
index 2a115841b4c..607bf839d9a 100644
--- a/testing/remotecppunittests.py
+++ b/testing/remotecppunittests.py
@@ -75,19 +75,20 @@ class RemoteCPPUnitTests(cppunittests.CPPUnitTests):
                         self.device.pushFile(os.path.join(tmpdir, info.filename), remote_file)
             return
 
-        for file in os.listdir(self.options.local_lib):
-            if file.endswith(".so"):
-                print >> sys.stderr, "Pushing %s.." % file
-                remote_file = posixpath.join(self.remote_bin_dir, file)
-                self.device.pushFile(os.path.join(self.options.local_lib, file), remote_file)
-        # Additional libraries may be found in a sub-directory such as "lib/armeabi-v7a"
-        local_arm_lib = os.path.join(self.options.local_lib, "lib")
-        if os.path.isdir(local_arm_lib):
-            for root, dirs, files in os.walk(local_arm_lib):
-                for file in files:
-                    if (file.endswith(".so")):
-                        remote_file = posixpath.join(self.remote_bin_dir, file)
-                        self.device.pushFile(os.path.join(root, file), remote_file)
+        elif self.options.local_lib:
+            for file in os.listdir(self.options.local_lib):
+                if file.endswith(".so"):
+                    print >> sys.stderr, "Pushing %s.." % file
+                    remote_file = posixpath.join(self.remote_bin_dir, file)
+                    self.device.pushFile(os.path.join(self.options.local_lib, file), remote_file)
+            # Additional libraries may be found in a sub-directory such as "lib/armeabi-v7a"
+            local_arm_lib = os.path.join(self.options.local_lib, "lib")
+            if os.path.isdir(local_arm_lib):
+                for root, dirs, files in os.walk(local_arm_lib):
+                    for file in files:
+                        if (file.endswith(".so")):
+                            remote_file = posixpath.join(self.remote_bin_dir, file)
+                            self.device.pushFile(os.path.join(root, file), remote_file)
 
     def push_progs(self, progs):
         for local_file in progs:
@@ -187,6 +188,9 @@ class RemoteCPPUnittestOptions(cppunittests.CPPUnittestOptions):
         self.add_option("--remoteTestRoot", action = "store",
                     type = "string", dest = "remote_test_root",
                     help = "remote directory to use as test root (eg. /data/local/tests)")
+        self.add_option("--with-b2g-emulator", action = "store",
+                    type = "string", dest = "with_b2g_emulator",
+                    help = "Start B2G Emulator (specify path to b2g home)")
         # /data/local/tests is used because it is usually not possible to set +x permissions
         # on binaries on /mnt/sdcard
         defaults["remote_test_root"] = "/data/local/tests"
@@ -204,9 +208,6 @@ def main():
     if not args:
         print >>sys.stderr, """Usage: %s <test binary> [<test binary>...]""" % sys.argv[0]
         sys.exit(1)
-    if options.local_lib is None and options.local_apk is None:
-        print >>sys.stderr, """Error: --localLib or --apk is required"""
-        sys.exit(1)
     if options.local_lib is not None and not os.path.isdir(options.local_lib):
         print >>sys.stderr, """Error: --localLib directory %s not found""" % options.local_lib
         sys.exit(1)
@@ -216,11 +217,27 @@ def main():
     if not options.xre_path:
         print >>sys.stderr, """Error: --xre-path is required"""
         sys.exit(1)
+    if options.with_b2g_emulator:
+        from mozrunner import B2GEmulatorRunner
+        runner = B2GEmulatorRunner(b2g_home=options.with_b2g_emulator)
+        runner.start()
     if options.dm_trans == "adb":
-        if options.device_ip:
-            dm = devicemanagerADB.DeviceManagerADB(options.device_ip, options.device_port, packageName=None, deviceRoot=options.remote_test_root)
+        if options.with_b2g_emulator:
+            # because we just started the emulator, we need more than the
+            # default number of retries here.
+            retryLimit = 50
         else:
-            dm = devicemanagerADB.DeviceManagerADB(packageName=None, deviceRoot=options.remote_test_root)
+            retryLimit = 5
+        try:
+            if options.device_ip:
+                dm = devicemanagerADB.DeviceManagerADB(options.device_ip, options.device_port, packageName=None, deviceRoot=options.remote_test_root, retryLimit=retryLimit)
+            else:
+                dm = devicemanagerADB.DeviceManagerADB(packageName=None, deviceRoot=options.remote_test_root, retryLimit=retryLimit)
+        except:
+            if options.with_b2g_emulator:
+                runner.cleanup()
+                runner.wait()
+            raise
     else:
         dm = devicemanagerSUT.DeviceManagerSUT(options.device_ip, options.device_port, deviceRoot=options.remote_test_root)
         if not options.device_ip:
@@ -234,6 +251,9 @@ def main():
     except Exception, e:
         log.error(str(e))
         result = False
+    if options.with_b2g_emulator:
+        runner.cleanup()
+        runner.wait()
     sys.exit(0 if result else 1)
 
 if __name__ == '__main__':
diff --git a/testing/testsuite-targets.mk b/testing/testsuite-targets.mk
index 8ce96d443af..87bff453233 100644
--- a/testing/testsuite-targets.mk
+++ b/testing/testsuite-targets.mk
@@ -504,6 +504,9 @@ endif
 ifeq ($(MOZ_WIDGET_TOOLKIT),android)
 	$(NSINSTALL) $(topsrcdir)/testing/android_cppunittest_manifest.txt $(PKG_STAGE)/cppunittests
 endif
+ifeq ($(MOZ_WIDGET_TOOLKIT),gonk)
+	$(NSINSTALL) $(topsrcdir)/testing/b2g_cppunittest_manifest.txt $(PKG_STAGE)/cppunittests
+endif
 ifeq ($(MOZ_DISABLE_STARTUPCACHE),)
 	$(NSINSTALL) $(topsrcdir)/startupcache/test/TestStartupCacheTelemetry.js $(PKG_STAGE)/cppunittests
 	$(NSINSTALL) $(topsrcdir)/startupcache/test/TestStartupCacheTelemetry.manifest $(PKG_STAGE)/cppunittests
diff --git a/toolkit/components/jsdownloads/src/DownloadIntegration.jsm b/toolkit/components/jsdownloads/src/DownloadIntegration.jsm
index ccbe2522043..87c3e66c227 100644
--- a/toolkit/components/jsdownloads/src/DownloadIntegration.jsm
+++ b/toolkit/components/jsdownloads/src/DownloadIntegration.jsm
@@ -517,13 +517,12 @@ this.DownloadIntegration = {
     if (aDownload.source.referrer) {
       aReferrer: NetUtil.newURI(aDownload.source.referrer);
     }
-    let aSuggestedFileName = OS.Path.basename(aDownload.target.path);
     gApplicationReputationService.queryReputation({
       sourceURI: NetUtil.newURI(aDownload.source.url),
       referrerURI: aReferrer,
       fileSize: aDownload.currentBytes,
       sha256Hash: hash,
-      suggestedFileName: aSuggestedFileName,
+      suggestedFileName: OS.Path.basename(aDownload.target.path),
       signatureInfo: sigInfo,
       redirects: channelRedirects },
       function onComplete(aShouldBlock, aRv) {
diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
index 77c6dca136e..b2c1f363834 100644
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@@ -2201,6 +2201,30 @@
     "extended_statistics_ok": true,
     "description": "How many actual preconnects happen"
   },
+  "PREDICTOR_TOTAL_PRECONNECTS_CREATED": {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "high": "1000 * 1000",
+    "n_buckets": 50,
+    "extended_statistics_ok": true,
+    "description": "How many preconnects actually created a speculative socket"
+  },
+  "PREDICTOR_TOTAL_PRECONNECTS_USED": {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "high": "1000 * 1000",
+    "n_buckets": 50,
+    "extended_statistics_ok": true,
+    "description": "How many preconnects actually created a used speculative socket"
+  },
+  "PREDICTOR_TOTAL_PRECONNECTS_UNUSED": {
+    "expires_in_version": "never",
+    "kind": "exponential",
+    "high": "1000 * 1000",
+    "n_buckets": 50,
+    "extended_statistics_ok": true,
+    "description": "How many preconnects needlessly created a speculative socket"
+  },
   "PREDICTOR_TOTAL_PRERESOLVES": {
     "expires_in_version": "never",
     "kind": "exponential",
diff --git a/toolkit/library/libxul.mk b/toolkit/library/libxul.mk
index 4e556df0320..d424d64a3cb 100644
--- a/toolkit/library/libxul.mk
+++ b/toolkit/library/libxul.mk
@@ -134,6 +134,7 @@ OS_LIBS += \
   -lstagefright_omx \
   -lbinder \
   -lgui \
+  -lmtp \
   $(NULL)
 endif
 
diff --git a/uriloader/prefetch/OfflineCacheUpdateGlue.cpp b/uriloader/prefetch/OfflineCacheUpdateGlue.cpp
index 1e33d3a0866..bfcb253931a 100644
--- a/uriloader/prefetch/OfflineCacheUpdateGlue.cpp
+++ b/uriloader/prefetch/OfflineCacheUpdateGlue.cpp
@@ -50,6 +50,7 @@ NS_IMPL_ISUPPORTS(OfflineCacheUpdateGlue,
 //-----------------------------------------------------------------------------
 
 OfflineCacheUpdateGlue::OfflineCacheUpdateGlue()
+: mCoalesced(false)
 {
     LOG(("OfflineCacheUpdateGlue::OfflineCacheUpdateGlue [%p]", this));
 }
@@ -89,6 +90,9 @@ OfflineCacheUpdateGlue::Schedule()
     // Do not use weak reference, we must survive!
     mUpdate->AddObserver(this, false);
 
+    if (mCoalesced) // already scheduled
+        return NS_OK;
+
     return mUpdate->Schedule();
 }
 
@@ -100,6 +104,14 @@ OfflineCacheUpdateGlue::Init(nsIURI *aManifestURI,
                              uint32_t aAppID,
                              bool aInBrowser)
 {
+    nsOfflineCacheUpdateService* service =
+        nsOfflineCacheUpdateService::EnsureService();
+    if (service) {
+        service->FindUpdate(aManifestURI, aAppID, aInBrowser, aCustomProfileDir,
+                            getter_AddRefs(mUpdate));
+        mCoalesced = !!mUpdate;
+    }
+
     if (!EnsureUpdate())
         return NS_ERROR_NULL_POINTER;
 
@@ -108,6 +120,11 @@ OfflineCacheUpdateGlue::Init(nsIURI *aManifestURI,
     if (aDocument)
         SetDocument(aDocument);
 
+    if (mCoalesced) { // already initialized
+        LOG(("OfflineCacheUpdateGlue %p coalesced with update %p", this, mUpdate.get()));
+        return NS_OK;
+    }
+
     return mUpdate->Init(aManifestURI, aDocumentURI, nullptr, aCustomProfileDir, aAppID, aInBrowser);
 }
 
diff --git a/uriloader/prefetch/OfflineCacheUpdateGlue.h b/uriloader/prefetch/OfflineCacheUpdateGlue.h
index 13d29d3f05c..c275a647d64 100644
--- a/uriloader/prefetch/OfflineCacheUpdateGlue.h
+++ b/uriloader/prefetch/OfflineCacheUpdateGlue.h
@@ -67,6 +67,7 @@ private:
     ~OfflineCacheUpdateGlue();
 
     nsRefPtr<nsOfflineCacheUpdate> mUpdate;
+    bool mCoalesced;
 
     /* Document that requested this update */
     nsCOMPtr<nsIDOMDocument> mDocument;
diff --git a/uriloader/prefetch/OfflineCacheUpdateParent.cpp b/uriloader/prefetch/OfflineCacheUpdateParent.cpp
index 04ced4468a2..ea4e58cc977 100644
--- a/uriloader/prefetch/OfflineCacheUpdateParent.cpp
+++ b/uriloader/prefetch/OfflineCacheUpdateParent.cpp
@@ -112,7 +112,7 @@ OfflineCacheUpdateParent::Schedule(const URIParams& aManifestURI,
     if (!NS_SecurityCompareURIs(manifestURI, documentURI, false))
         return NS_ERROR_DOM_SECURITY_ERR;
 
-    service->FindUpdate(manifestURI, mAppId, mIsInBrowserElement,
+    service->FindUpdate(manifestURI, mAppId, mIsInBrowserElement, nullptr,
                         getter_AddRefs(update));
     if (!update) {
         update = new nsOfflineCacheUpdate();
diff --git a/uriloader/prefetch/nsOfflineCacheUpdate.cpp b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
index bdd39af5745..7aafdcf4d09 100644
--- a/uriloader/prefetch/nsOfflineCacheUpdate.cpp
+++ b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
@@ -1994,6 +1994,20 @@ nsOfflineCacheUpdate::IsForGroupID(const nsCSubstring &groupID)
     return mGroupID == groupID;
 }
 
+bool
+nsOfflineCacheUpdate::IsForProfile(nsIFile* aCustomProfileDir)
+{
+    if (!mCustomProfileDir && !aCustomProfileDir)
+        return true;
+    if (!mCustomProfileDir || !aCustomProfileDir)
+        return false;
+
+    bool equals;
+    nsresult rv = mCustomProfileDir->Equals(aCustomProfileDir, &equals);
+
+    return NS_SUCCEEDED(rv) && equals;
+}
+
 nsresult
 nsOfflineCacheUpdate::UpdateFinished(nsOfflineCacheUpdate *aUpdate)
 {
diff --git a/uriloader/prefetch/nsOfflineCacheUpdate.h b/uriloader/prefetch/nsOfflineCacheUpdate.h
index 3a29d2d40b5..083ae172693 100644
--- a/uriloader/prefetch/nsOfflineCacheUpdate.h
+++ b/uriloader/prefetch/nsOfflineCacheUpdate.h
@@ -222,6 +222,7 @@ public:
     void SetOwner(nsOfflineCacheUpdateOwner *aOwner);
 
     bool IsForGroupID(const nsCSubstring &groupID);
+    bool IsForProfile(nsIFile* aCustomProfileDir);
 
     virtual nsresult UpdateFinished(nsOfflineCacheUpdate *aUpdate);
 
@@ -337,6 +338,7 @@ public:
     nsresult FindUpdate(nsIURI *aManifestURI,
                         uint32_t aAppID,
                         bool aInBrowser,
+                        nsIFile *aCustomProfileDir,
                         nsOfflineCacheUpdate **aUpdate);
 
     nsresult Schedule(nsIURI *aManifestURI,
diff --git a/uriloader/prefetch/nsOfflineCacheUpdateService.cpp b/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
index 9b4fe2e986f..3ff6b02f27a 100644
--- a/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
+++ b/uriloader/prefetch/nsOfflineCacheUpdateService.cpp
@@ -491,6 +491,7 @@ nsresult
 nsOfflineCacheUpdateService::FindUpdate(nsIURI *aManifestURI,
                                         uint32_t aAppID,
                                         bool aInBrowser,
+                                        nsIFile *aCustomProfileDir,
                                         nsOfflineCacheUpdate **aUpdate)
 {
     nsresult rv;
@@ -518,7 +519,7 @@ nsOfflineCacheUpdateService::FindUpdate(nsIURI *aManifestURI,
             continue;
         }
 
-        if (update->IsForGroupID(groupID)) {
+        if (update->IsForGroupID(groupID) && update->IsForProfile(aCustomProfileDir)) {
             update.swap(*aUpdate);
             return NS_OK;
         }
diff --git a/widget/windows/WinUtils.cpp b/widget/windows/WinUtils.cpp
index 8e2197c7274..4d6ac9680d2 100644
--- a/widget/windows/WinUtils.cpp
+++ b/widget/windows/WinUtils.cpp
@@ -60,8 +60,8 @@ using namespace mozilla::gfx;
 namespace mozilla {
 namespace widget {
 
-NS_IMPL_ISUPPORTS(myDownloadObserver, nsIDownloadObserver)
 #ifdef MOZ_PLACES
+NS_IMPL_ISUPPORTS(myDownloadObserver, nsIDownloadObserver)
 NS_IMPL_ISUPPORTS(AsyncFaviconDataReady, nsIFaviconDataCallback)
 #endif
 NS_IMPL_ISUPPORTS(AsyncEncodeAndWriteIcon, nsIRunnable)
diff --git a/widget/windows/WinUtils.h b/widget/windows/WinUtils.h
index ba5c21a0f06..e00e44cd259 100644
--- a/widget/windows/WinUtils.h
+++ b/widget/windows/WinUtils.h
@@ -97,12 +97,16 @@ namespace widget {
 #define LogException(e) mozilla::widget::WinUtils::Log("%s Exception:%s", __FUNCTION__, e->ToString()->Data())
 #define LogHRESULT(hr) mozilla::widget::WinUtils::Log("%s hr=%X", __FUNCTION__, hr)
 
+#ifdef MOZ_PLACES
 class myDownloadObserver MOZ_FINAL : public nsIDownloadObserver
 {
+  ~myDownloadObserver() {}
+
 public:
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOWNLOADOBSERVER
 };
+#endif
 
 class WinUtils {
 public:
diff --git a/widget/windows/nsScreenManagerWin.cpp b/widget/windows/nsScreenManagerWin.cpp
index 17ba65949da..bd2eb766a73 100644
--- a/widget/windows/nsScreenManagerWin.cpp
+++ b/widget/windows/nsScreenManagerWin.cpp
@@ -9,9 +9,9 @@
 #include "nsIWidget.h"
 
 
-BOOL CALLBACK CountMonitors ( HMONITOR, HDC, LPRECT, LPARAM ioCount ) ;
+BOOL CALLBACK CountMonitors(HMONITOR, HDC, LPRECT, LPARAM ioCount);
 
-nsScreenManagerWin :: nsScreenManagerWin ( )
+nsScreenManagerWin::nsScreenManagerWin()
   : mNumberOfScreens(0)
 {
   // nothing to do. I guess we could cache a bunch of information
@@ -20,7 +20,7 @@ nsScreenManagerWin :: nsScreenManagerWin ( )
 }
 
 
-nsScreenManagerWin :: ~nsScreenManagerWin()
+nsScreenManagerWin::~nsScreenManagerWin()
 {
 }
 
@@ -38,22 +38,22 @@ NS_IMPL_ISUPPORTS(nsScreenManagerWin, nsIScreenManager)
 //        screen. This should change when a multi-monitor impl is done.
 //
 nsIScreen* 
-nsScreenManagerWin :: CreateNewScreenObject ( HMONITOR inScreen )
+nsScreenManagerWin::CreateNewScreenObject(HMONITOR inScreen)
 {
   nsIScreen* retScreen = nullptr;
   
   // look through our screen list, hoping to find it. If it's not there,
   // add it and return the new one.
-  for ( unsigned i = 0; i < mScreenList.Length(); ++i ) {
+  for (unsigned i = 0; i < mScreenList.Length(); ++i) {
     ScreenListItem& curr = mScreenList[i];
-    if ( inScreen == curr.mMon ) {
+    if (inScreen == curr.mMon) {
       NS_IF_ADDREF(retScreen = curr.mScreen.get());
       return retScreen;
     }
   } // for each screen.
  
   retScreen = new nsScreenWin(inScreen);
-  mScreenList.AppendElement ( ScreenListItem ( inScreen, retScreen ) );
+  mScreenList.AppendElement(ScreenListItem(inScreen, retScreen));
 
   NS_IF_ADDREF(retScreen);
   return retScreen;
@@ -86,12 +86,12 @@ nsScreenManagerWin::ScreenForId(uint32_t aId, nsIScreen **outScreen)
 // The coordinates are in pixels (not twips) and in logical screen coordinates.
 //
 NS_IMETHODIMP
-nsScreenManagerWin :: ScreenForRect ( int32_t inLeft, int32_t inTop, int32_t inWidth, int32_t inHeight,
-                                        nsIScreen **outScreen )
+nsScreenManagerWin::ScreenForRect(int32_t inLeft, int32_t inTop, int32_t inWidth, int32_t inHeight,
+                                  nsIScreen **outScreen)
 {
-  if ( !(inWidth || inHeight) ) {
-    NS_WARNING ( "trying to find screen for sizeless window, using primary monitor" );
-    *outScreen = CreateNewScreenObject ( nullptr );    // addrefs
+  if (!(inWidth || inHeight)) {
+    NS_WARNING("trying to find screen for sizeless window, using primary monitor");
+    *outScreen = CreateNewScreenObject(nullptr);    // addrefs
     return NS_OK;
   }
 
@@ -107,10 +107,10 @@ nsScreenManagerWin :: ScreenForRect ( int32_t inLeft, int32_t inTop, int32_t inW
     NSToIntRound(dpiScale * (inTop + inHeight))
   };
 
-  HMONITOR genScreen = ::MonitorFromRect( &globalWindowBounds, MONITOR_DEFAULTTOPRIMARY );
-
-  *outScreen = CreateNewScreenObject ( genScreen );    // addrefs
-  
+  HMONITOR genScreen = ::MonitorFromRect(&globalWindowBounds, MONITOR_DEFAULTTOPRIMARY);
+ 
+  *outScreen = CreateNewScreenObject(genScreen);    // addrefs
+ 
   return NS_OK;
     
 } // ScreenForRect
@@ -123,9 +123,9 @@ nsScreenManagerWin :: ScreenForRect ( int32_t inLeft, int32_t inTop, int32_t inW
 // often.
 //
 NS_IMETHODIMP 
-nsScreenManagerWin :: GetPrimaryScreen(nsIScreen** aPrimaryScreen) 
+nsScreenManagerWin::GetPrimaryScreen(nsIScreen** aPrimaryScreen) 
 {
-  *aPrimaryScreen = CreateNewScreenObject ( nullptr );    // addrefs  
+  *aPrimaryScreen = CreateNewScreenObject(nullptr);    // addrefs  
   return NS_OK;
   
 } // GetPrimaryScreen
@@ -139,7 +139,7 @@ nsScreenManagerWin :: GetPrimaryScreen(nsIScreen** aPrimaryScreen)
 // count up to this point.
 //
 BOOL CALLBACK
-CountMonitors ( HMONITOR, HDC, LPRECT, LPARAM ioParam )
+CountMonitors(HMONITOR, HDC, LPRECT, LPARAM ioParam)
 {
   uint32_t* countPtr = reinterpret_cast<uint32_t*>(ioParam);
   ++(*countPtr);
@@ -155,9 +155,9 @@ CountMonitors ( HMONITOR, HDC, LPRECT, LPARAM ioParam )
 // Returns how many physical screens are available.
 //
 NS_IMETHODIMP
-nsScreenManagerWin :: GetNumberOfScreens(uint32_t *aNumberOfScreens)
+nsScreenManagerWin::GetNumberOfScreens(uint32_t *aNumberOfScreens)
 {
-  if ( mNumberOfScreens )
+  if (mNumberOfScreens)
     *aNumberOfScreens = mNumberOfScreens;
   else {
     uint32_t count = 0;
@@ -179,9 +179,9 @@ nsScreenManagerWin::GetSystemDefaultScale(float *aDefaultScale)
 }
 
 NS_IMETHODIMP
-nsScreenManagerWin :: ScreenForNativeWidget(void *aWidget, nsIScreen **outScreen)
+nsScreenManagerWin::ScreenForNativeWidget(void *aWidget, nsIScreen **outScreen)
 {
-  HMONITOR mon = MonitorFromWindow ((HWND) aWidget, MONITOR_DEFAULTTOPRIMARY);
-  *outScreen = CreateNewScreenObject (mon);
+  HMONITOR mon = MonitorFromWindow((HWND) aWidget, MONITOR_DEFAULTTOPRIMARY);
+  *outScreen = CreateNewScreenObject(mon);
   return NS_OK;
 }
diff --git a/widget/windows/nsScreenWin.cpp b/widget/windows/nsScreenWin.cpp
index ecfc5d15990..31d8d42c007 100644
--- a/widget/windows/nsScreenWin.cpp
+++ b/widget/windows/nsScreenWin.cpp
@@ -10,14 +10,14 @@
 
 static uint32_t sScreenId;
 
-nsScreenWin :: nsScreenWin ( HMONITOR inScreen )
+nsScreenWin::nsScreenWin(HMONITOR inScreen)
   : mScreen(inScreen)
   , mId(++sScreenId)
 {
 #ifdef DEBUG
   HDC hDCScreen = ::GetDC(nullptr);
   NS_ASSERTION(hDCScreen,"GetDC Failure");
-  NS_ASSERTION ( ::GetDeviceCaps(hDCScreen, TECHNOLOGY) == DT_RASDISPLAY, "Not a display screen");
+  NS_ASSERTION(::GetDeviceCaps(hDCScreen, TECHNOLOGY) == DT_RASDISPLAY, "Not a display screen");
   ::ReleaseDC(nullptr,hDCScreen);
 #endif
 
@@ -27,7 +27,7 @@ nsScreenWin :: nsScreenWin ( HMONITOR inScreen )
 }
 
 
-nsScreenWin :: ~nsScreenWin()
+nsScreenWin::~nsScreenWin()
 {
   // nothing to see here.
 }
@@ -42,14 +42,14 @@ nsScreenWin::GetId(uint32_t *outId)
 
 
 NS_IMETHODIMP
-nsScreenWin :: GetRect(int32_t *outLeft, int32_t *outTop, int32_t *outWidth, int32_t *outHeight)
+nsScreenWin::GetRect(int32_t *outLeft, int32_t *outTop, int32_t *outWidth, int32_t *outHeight)
 {
   BOOL success = FALSE;
-  if ( mScreen ) {
+  if (mScreen) {
     MONITORINFO info;
     info.cbSize = sizeof(MONITORINFO);
-    success = ::GetMonitorInfoW( mScreen, &info );
-    if ( success ) {
+    success = ::GetMonitorInfoW(mScreen, &info);
+    if (success) {
       *outLeft = info.rcMonitor.left;
       *outTop = info.rcMonitor.top;
       *outWidth = info.rcMonitor.right - info.rcMonitor.left;
@@ -72,15 +72,15 @@ nsScreenWin :: GetRect(int32_t *outLeft, int32_t *outTop, int32_t *outWidth, int
 
 
 NS_IMETHODIMP
-nsScreenWin :: GetAvailRect(int32_t *outLeft, int32_t *outTop, int32_t *outWidth, int32_t *outHeight)
+nsScreenWin::GetAvailRect(int32_t *outLeft, int32_t *outTop, int32_t *outWidth, int32_t *outHeight)
 {
   BOOL success = FALSE;
 
-  if ( mScreen ) {
+  if (mScreen) {
     MONITORINFO info;
     info.cbSize = sizeof(MONITORINFO);
-    success = ::GetMonitorInfoW( mScreen, &info );
-    if ( success ) {
+    success = ::GetMonitorInfoW(mScreen, &info);
+    if (success) {
       *outLeft = info.rcWork.left;
       *outTop = info.rcWork.top;
       *outWidth = info.rcWork.right - info.rcWork.left;
@@ -168,7 +168,7 @@ nsScreenWin :: GetPixelDepth(int32_t *aPixelDepth)
 
 
 NS_IMETHODIMP 
-nsScreenWin :: GetColorDepth(int32_t *aColorDepth)
+nsScreenWin::GetColorDepth(int32_t *aColorDepth)
 {
   return GetPixelDepth(aColorDepth);