Merge mozilla-central to fx-team

2024-09-13 09:24:08 -07:00 · 2015-04-21 15:35:04 +02:00 · 2015-04-21 15:35:04 +02:00 · f73c9a837b
commit f73c9a837b
parent 38459dc8d1 7d5bb8adbb
113 changed files with 1450 additions and 355 deletions
--- a/b2g/chrome/content/content.css
+++ b/b2g/chrome/content/content.css
@ -30,19 +30,14 @@ html xul|scrollbar {
  pointer-events: none;
 }

+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 xul|scrollbar[orient="vertical"] {
-  -moz-margin-start: -8px;
+  margin-left: -8px;
  min-width: 8px;
  max-width: 8px;
 }

-/* workaround for bug 1119057: as -moz-margin-start may not work as expected,
- * force a right margin value in RTL mode.  */
-[dir="rtl"] xul|scrollbar[root="true"][orient="vertical"] {
-  -moz-margin-start: unset;
-  margin-right: -8px;
-}
-
 xul|scrollbar[orient="vertical"] xul|thumb {
  max-width: 6px !important;
  min-width: 6px !important;
--- a/browser/themes/linux/devtools/floating-scrollbars.css
+++ b/browser/themes/linux/devtools/floating-scrollbars.css
@ -9,8 +9,10 @@ scrollbar {
  padding: 2px;
 }

+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 scrollbar[orient="vertical"] {
-  -moz-margin-start: -10px;
+  margin-left: -10px;
  min-width: 10px;
  max-width: 10px;
 }
--- a/browser/themes/osx/devtools/floating-scrollbars.css
+++ b/browser/themes/osx/devtools/floating-scrollbars.css
@ -10,8 +10,10 @@ scrollbar {
  padding: 2px;
 }

+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 scrollbar[orient="vertical"] {
-  -moz-margin-start: -8px;
+  margin-left: -8px;
  min-width: 8px;
  max-width: 8px;
 }
--- a/browser/themes/windows/devtools/floating-scrollbars.css
+++ b/browser/themes/windows/devtools/floating-scrollbars.css
@ -9,8 +9,10 @@ scrollbar {
  padding: 2px;
 }

+/* Scrollbar code will reset the margin to the correct side depending on
+   layout.scrollbar.side pref */
 scrollbar[orient="vertical"] {
-  -moz-margin-start: -10px;
+  margin-left: -10px;
  min-width: 10px;
  max-width: 10px;
 }
--- a/build/autoconf/icu.m4
+++ b/build/autoconf/icu.m4
@ -99,6 +99,12 @@ if test -n "$USE_ICU"; then
                    MOZ_ICU_DBG_SUFFIX=d
                fi
                ;;
+            Android)
+                if test -z "$gonkdir"; then
+                    AC_MSG_ERROR([ECMAScript Internationalization API is not yet supported on this platform])
+                fi
+                ICU_LIB_NAMES="icui18n icuuc icudata"
+                ;;
            Darwin|Linux|DragonFly|FreeBSD|NetBSD|OpenBSD|GNU/kFreeBSD|SunOS)
                ICU_LIB_NAMES="icui18n icuuc icudata"
                ;;
@ -271,6 +277,10 @@ if test -z "$BUILDING_JS" -o -n "$JS_STANDALONE"; then
    	fi
        fi

+        if test -n "$gonkdir"; then
+            ICU_CXXFLAGS="-I$gonkdir/abi/cpp/include $ICU_CXXFLAGS"
+        fi
+
        if test -z "$MOZ_SHARED_ICU"; then
          ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_STATIC_IMPLEMENTATION"
          ICU_CFLAGS="$ICU_CFLAGS -DU_STATIC_IMPLEMENTATION"
--- a/config/external/icu/moz.build
+++ b/config/external/icu/moz.build
@ -16,3 +16,8 @@ else:
            l,
            CONFIG['MOZ_ICU_DBG_SUFFIX']
        )]
+
+    if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
+        OS_LIBS += [
+            'gabi++',
+        ]
--- a/config/system-headers
+++ b/config/system-headers
@ -1346,6 +1346,7 @@ unicode/ucol.h
 unicode/udat.h
 unicode/udatpg.h
 unicode/uenum.h
+unicode/unorm.h
 unicode/unum.h
 unicode/ustring.h
 unicode/utypes.h
--- a/docshell/base/nsAboutRedirector.cpp
+++ b/docshell/base/nsAboutRedirector.cpp
@ -147,7 +147,7 @@ nsAboutRedirector::NewChannel(nsIURI* aURI,

      tempChannel->SetOriginalURI(aURI);

-      NS_ADDREF(*aResult = tempChannel);
+      tempChannel.forget(aResult);
      return rv;
    }
  }
@ -186,9 +186,6 @@ nsAboutRedirector::GetIndexedDBOriginPostfix(nsIURI* aURI, nsAString& aResult)
 nsresult
 nsAboutRedirector::Create(nsISupports* aOuter, REFNSIID aIID, void** aResult)
 {
-  nsAboutRedirector* about = new nsAboutRedirector();
-  NS_ADDREF(about);
-  nsresult rv = about->QueryInterface(aIID, aResult);
-  NS_RELEASE(about);
-  return rv;
+  nsRefPtr<nsAboutRedirector> about = new nsAboutRedirector();
+  return about->QueryInterface(aIID, aResult);
 }
--- a/docshell/base/nsDefaultURIFixup.cpp
+++ b/docshell/base/nsDefaultURIFixup.cpp
@ -105,9 +105,7 @@ nsDefaultURIFixup::CreateExposableURI(nsIURI* aURI, nsIURI** aReturn)
    uri->SetUserPass(EmptyCString());
  }

-  // return the fixed-up URI
-  *aReturn = uri;
-  NS_ADDREF(*aReturn);
+  uri.forget(aReturn);
  return NS_OK;
 }

--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -1139,8 +1139,7 @@ nsDocShell::GetInterface(const nsIID& aIID, void** aSink)
    nsCOMPtr<nsISHistory> shistory;
    nsresult rv = GetSessionHistory(getter_AddRefs(shistory));
    if (NS_SUCCEEDED(rv) && shistory) {
-      *aSink = shistory;
-      NS_ADDREF((nsISupports*)*aSink);
+      shistory.forget(aSink);
      return NS_OK;
    }
    return NS_NOINTERFACE;
@ -1158,8 +1157,7 @@ nsDocShell::GetInterface(const nsIID& aIID, void** aSink)
    nsCOMPtr<nsIEditingSession> editingSession;
    mEditorData->GetEditingSession(getter_AddRefs(editingSession));
    if (editingSession) {
-      *aSink = editingSession;
-      NS_ADDREF((nsISupports*)*aSink);
+      editingSession.forget(aSink);
      return NS_OK;
    }

@ -1757,8 +1755,7 @@ nsDocShell::CreateLoadInfo(nsIDocShellLoadInfo** aLoadInfo)
  NS_ENSURE_TRUE(loadInfo, NS_ERROR_OUT_OF_MEMORY);
  nsCOMPtr<nsIDocShellLoadInfo> localRef(loadInfo);

-  *aLoadInfo = localRef;
-  NS_ADDREF(*aLoadInfo);
+  localRef.forget(aLoadInfo);
  return NS_OK;
 }

@ -6253,7 +6250,7 @@ nsDocShell::GetOnePermittedSandboxedNavigator(nsIDocShell** aSandboxedNavigator)
  NS_ENSURE_ARG_POINTER(aSandboxedNavigator);
  nsCOMPtr<nsIDocShell> permittedNavigator =
    do_QueryReferent(mOnePermittedSandboxedNavigator);
-  NS_IF_ADDREF(*aSandboxedNavigator = permittedNavigator);
+  permittedNavigator.forget(aSandboxedNavigator);
  return NS_OK;
 }

@ -11966,8 +11963,7 @@ nsDocShell::AddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel,
  if (aNewEntry) {
    *aNewEntry = nullptr;
    if (NS_SUCCEEDED(rv)) {
-      *aNewEntry = entry;
-      NS_ADDREF(*aNewEntry);
+      entry.forget(aNewEntry);
    }
  }

--- a/docshell/shistory/src/nsSHistory.cpp
+++ b/docshell/shistory/src/nsSHistory.cpp
@ -10,6 +10,7 @@

 // Helper Classes
 #include "mozilla/Preferences.h"
+#include "mozilla/StaticPtr.h"

 // Interfaces Needed
 #include "nsILayoutHistoryState.h"
@ -178,7 +179,7 @@ protected:
  ~nsSHistoryObserver() {}
 };

-static nsSHistoryObserver* gObserver = nullptr;
+StaticRefPtr<nsSHistoryObserver> gObserver;

 NS_IMPL_ISUPPORTS(nsSHistoryObserver, nsIObserver)

@ -360,7 +361,6 @@ nsSHistory::Startup()
  // but keep the per SHistory cached viewer limit constant
  if (!gObserver) {
    gObserver = new nsSHistoryObserver();
-    NS_ADDREF(gObserver);
    Preferences::AddStrongObservers(gObserver, kObservedPrefs);

    nsCOMPtr<nsIObserverService> obsSvc =
@ -393,7 +393,7 @@ nsSHistory::Shutdown()
      obsSvc->RemoveObserver(gObserver, "cacheservice:empty-cache");
      obsSvc->RemoveObserver(gObserver, "memory-pressure");
    }
-    NS_RELEASE(gObserver);
+    gObserver = nullptr;
  }
 }

@ -540,8 +540,7 @@ nsSHistory::GetTransactionAtIndex(int32_t aIndex, nsISHTransaction ** aResult)
    if (NS_SUCCEEDED(rv) && ptr) {
      cnt++;
      if (cnt == aIndex) {
-        *aResult = ptr;
-        NS_ADDREF(*aResult);
+        ptr.forget(aResult);
        break;
      }
      else {
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@ -1389,6 +1389,9 @@ nsFrameLoader::StartDestroy()
    if (mRemoteBrowser) {
      mRemoteBrowser->CacheFrameLoader(this);
    }
+    if (mChildMessageManager) {
+      mChildMessageManager->CacheFrameLoader(this);
+    }
  }

  // If the TabParent has installed any event listeners on the window, this is
@ -1532,6 +1535,9 @@ nsFrameLoader::DestroyComplete()
    if (mRemoteBrowser) {
      mRemoteBrowser->CacheFrameLoader(nullptr);
    }
+    if (mChildMessageManager) {
+      mChildMessageManager->CacheFrameLoader(nullptr);
+    }
  }

  // Call TabParent::Destroy if we haven't already (in case of a crash).
@ -2443,7 +2449,7 @@ public:
      static_cast<nsInProcessTabChildGlobal*>(mFrameLoader->mChildMessageManager.get());
    if (tabChild && tabChild->GetInnerManager()) {
      nsCOMPtr<nsIXPConnectJSObjectHolder> kungFuDeathGrip(tabChild->GetGlobal());
-      ReceiveMessage(static_cast<EventTarget*>(tabChild),
+      ReceiveMessage(static_cast<EventTarget*>(tabChild), mFrameLoader,
                     tabChild->GetInnerManager());
    }
    return NS_OK;
--- a/dom/base/nsFrameMessageManager.cpp
+++ b/dom/base/nsFrameMessageManager.cpp
@ -995,6 +995,7 @@ public:

 nsresult
 nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
+                                      nsIFrameLoader* aTargetFrameLoader,
                                      const nsAString& aMessage,
                                      bool aIsSync,
                                      const StructuredCloneData* aCloneData,
@ -1002,12 +1003,13 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
                                      nsIPrincipal* aPrincipal,
                                      InfallibleTArray<nsString>* aJSONRetVal)
 {
-  return ReceiveMessage(aTarget, mClosed, aMessage, aIsSync,
+  return ReceiveMessage(aTarget, aTargetFrameLoader, mClosed, aMessage, aIsSync,
                        aCloneData, aCpows, aPrincipal, aJSONRetVal);
 }

 nsresult
 nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
+                                      nsIFrameLoader* aTargetFrameLoader,
                                      bool aTargetClosed,
                                      const nsAString& aMessage,
                                      bool aIsSync,
@ -1114,6 +1116,16 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
                JS_DefineProperty(cx, param, "objects", cpowsv, JSPROP_ENUMERATE);
      NS_ENSURE_TRUE(ok, NS_ERROR_UNEXPECTED);

+      if (aTargetFrameLoader) {
+        JS::Rooted<JS::Value> targetFrameLoaderv(cx);
+        nsresult rv = nsContentUtils::WrapNative(cx, aTargetFrameLoader, &targetFrameLoaderv);
+        NS_ENSURE_SUCCESS(rv, rv);
+
+        ok = JS_DefineProperty(cx, param, "targetFrameLoader", targetFrameLoaderv,
+                               JSPROP_ENUMERATE);
+        NS_ENSURE_TRUE(ok, NS_ERROR_UNEXPECTED);
+      }
+
      // message.principal == null
      if (!aPrincipal) {
        bool ok = JS_DefineProperty(cx, param, "principal",
@ -1190,7 +1202,8 @@ nsFrameMessageManager::ReceiveMessage(nsISupports* aTarget,
    }
  }
  nsRefPtr<nsFrameMessageManager> kungfuDeathGrip = mParentManager;
-  return mParentManager ? mParentManager->ReceiveMessage(aTarget, aTargetClosed, aMessage,
+  return mParentManager ? mParentManager->ReceiveMessage(aTarget, aTargetFrameLoader,
+                                                         aTargetClosed, aMessage,
                                                         aIsSync, aCloneData,
                                                         aCpows, aPrincipal,
                                                         aJSONRetVal) : NS_OK;
@ -1769,7 +1782,7 @@ public:
  NS_IMETHOD Run()
  {
    nsFrameMessageManager* ppm = nsFrameMessageManager::GetChildProcessManager();
-    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), ppm);
+    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), nullptr, ppm);
    return NS_OK;
  }
 };
@ -1924,7 +1937,7 @@ public:
  virtual nsresult HandleMessage() override
  {
    nsFrameMessageManager* ppm = nsFrameMessageManager::sSameProcessParentManager;
-    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), ppm);
+    ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm), nullptr, ppm);
    return NS_OK;
  }
 };
@ -1958,7 +1971,7 @@ public:
    if (nsFrameMessageManager::sSameProcessParentManager) {
      SameProcessCpowHolder cpows(js::GetRuntime(aCx), aCpows);
      nsRefPtr<nsFrameMessageManager> ppm = nsFrameMessageManager::sSameProcessParentManager;
-      ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), aMessage,
+      ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr, aMessage,
                          true, &aData, &cpows, aPrincipal, aJSONRetVal);
    }
    return true;
@ -2089,6 +2102,7 @@ nsSameProcessAsyncMessageBase::nsSameProcessAsyncMessageBase(JSContext* aCx,

 void
 nsSameProcessAsyncMessageBase::ReceiveMessage(nsISupports* aTarget,
+                                              nsIFrameLoader* aTargetFrameLoader,
                                              nsFrameMessageManager* aManager)
 {
  if (aManager) {
@ -2100,7 +2114,7 @@ nsSameProcessAsyncMessageBase::ReceiveMessage(nsISupports* aTarget,
    SameProcessCpowHolder cpows(mRuntime, mCpows);

    nsRefPtr<nsFrameMessageManager> mm = aManager;
-    mm->ReceiveMessage(aTarget, mMessage, false, &data, &cpows,
+    mm->ReceiveMessage(aTarget, aTargetFrameLoader, mMessage, false, &data, &cpows,
                       mPrincipal, nullptr);
  }
 }
--- a/dom/base/nsFrameMessageManager.h
+++ b/dom/base/nsFrameMessageManager.h
@ -31,6 +31,8 @@
 #include "mozilla/dom/StructuredCloneUtils.h"
 #include "mozilla/jsipc/CpowHolder.h"

+class nsIFrameLoader;
+
 namespace mozilla {
 namespace dom {

@ -229,7 +231,8 @@ public:
  static nsFrameMessageManager*
  NewProcessMessageManager(bool aIsRemote);

-  nsresult ReceiveMessage(nsISupports* aTarget, const nsAString& aMessage,
+  nsresult ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
+                          const nsAString& aMessage,
                          bool aIsSync, const StructuredCloneData* aCloneData,
                          mozilla::jsipc::CpowHolder* aCpows, nsIPrincipal* aPrincipal,
                          InfallibleTArray<nsString>* aJSONRetVal);
@ -293,7 +296,8 @@ private:
                       JS::MutableHandle<JS::Value> aRetval,
                       bool aIsSync);

-  nsresult ReceiveMessage(nsISupports* aTarget, bool aTargetClosed, const nsAString& aMessage,
+  nsresult ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
+                          bool aTargetClosed, const nsAString& aMessage,
                          bool aIsSync, const StructuredCloneData* aCloneData,
                          mozilla::jsipc::CpowHolder* aCpows, nsIPrincipal* aPrincipal,
                          InfallibleTArray<nsString>* aJSONRetVal);
@ -369,7 +373,8 @@ public:
                                JS::Handle<JSObject*> aCpows,
                                nsIPrincipal* aPrincipal);

-  void ReceiveMessage(nsISupports* aTarget, nsFrameMessageManager* aManager);
+  void ReceiveMessage(nsISupports* aTarget, nsIFrameLoader* aTargetFrameLoader,
+                      nsFrameMessageManager* aManager);

 private:
  nsSameProcessAsyncMessageBase(const nsSameProcessAsyncMessageBase&);
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@ -8884,8 +8884,8 @@ nsGlobalWindow::IsInModalState()
  nsGlobalWindow *topWin = GetScriptableTop();

  if (!topWin) {
-    NS_ERROR("Uh, IsInModalState() called w/o a reachable top window?");
-
+    // IsInModalState() getting called w/o a reachable top window is a bit
+    // iffy, but valid enough not to make noise about it.  See bug 404828
    return false;
  }

--- a/dom/base/nsIMessageManager.idl
+++ b/dom/base/nsIMessageManager.idl
@ -8,6 +8,7 @@
 interface nsIDOMWindow;
 interface nsIDocShell;
 interface nsIContent;
+interface nsIFrameLoader;
 interface nsIPrincipal;

 /**
@ -383,10 +384,11 @@ interface nsIContentFrameMessageManager : nsIMessageManagerGlobal
  readonly attribute nsIDocShell docShell;
 };

-[uuid(a9e07e89-7125-48e3-bf73-2cbae7fc5b1c)]
+[uuid(9c6bd4d7-88d2-46d6-8606-f2d57d46f051)]
 interface nsIInProcessContentFrameMessageManager : nsIContentFrameMessageManager
 {
  [notxpcom] nsIContent getOwnerContent();
+  [notxpcom] void cacheFrameLoader(in nsIFrameLoader aFrameLoader);
 };

 [scriptable, builtinclass, uuid(d0c799a2-d5ff-4a75-acbb-b8c8347944a6)]
--- a/dom/base/nsInProcessTabChildGlobal.cpp
+++ b/dom/base/nsInProcessTabChildGlobal.cpp
@ -42,7 +42,8 @@ nsInProcessTabChildGlobal::DoSendBlockingMessage(JSContext* aCx,
  if (mChromeMessageManager) {
    SameProcessCpowHolder cpows(js::GetRuntime(aCx), aCpows);
    nsRefPtr<nsFrameMessageManager> mm = mChromeMessageManager;
-    mm->ReceiveMessage(mOwner, aMessage, true, &aData, &cpows, aPrincipal,
+    nsCOMPtr<nsIFrameLoader> fl = GetFrameLoader();
+    mm->ReceiveMessage(mOwner, fl, aMessage, true, &aData, &cpows, aPrincipal,
                       aJSONRetVal);
  }
  return true;
@ -65,7 +66,8 @@ public:

  virtual nsresult HandleMessage() override
  {
-    ReceiveMessage(mTabChild->mOwner, mTabChild->mChromeMessageManager);
+    nsCOMPtr<nsIFrameLoader> fl = mTabChild->GetFrameLoader();
+    ReceiveMessage(mTabChild->mOwner, fl, mTabChild->mChromeMessageManager);
    return NS_OK;
  }
  nsRefPtr<nsInProcessTabChildGlobal> mTabChild;
@ -175,6 +177,12 @@ NS_INTERFACE_MAP_END_INHERITING(DOMEventTargetHelper)
 NS_IMPL_ADDREF_INHERITED(nsInProcessTabChildGlobal, DOMEventTargetHelper)
 NS_IMPL_RELEASE_INHERITED(nsInProcessTabChildGlobal, DOMEventTargetHelper)

+void
+nsInProcessTabChildGlobal::CacheFrameLoader(nsIFrameLoader* aFrameLoader)
+{
+  mFrameLoader = aFrameLoader;
+}
+
 NS_IMETHODIMP
 nsInProcessTabChildGlobal::GetContent(nsIDOMWindow** aContent)
 {
@ -336,3 +344,14 @@ nsInProcessTabChildGlobal::LoadFrameScript(const nsAString& aURL, bool aRunInGlo
  LoadScriptInternal(aURL, aRunInGlobalScope);
  mLoadingScript = tmp;
 }
+
+already_AddRefed<nsIFrameLoader>
+nsInProcessTabChildGlobal::GetFrameLoader()
+{
+  nsCOMPtr<nsIFrameLoaderOwner> owner = do_QueryInterface(mOwner);
+  nsCOMPtr<nsIFrameLoader> fl = owner ? owner->GetFrameLoader() : nullptr;
+  if (!fl) {
+    fl = mFrameLoader;
+  }
+  return fl.forget();
+}
--- a/dom/base/nsInProcessTabChildGlobal.h
+++ b/dom/base/nsInProcessTabChildGlobal.h
@ -150,6 +150,9 @@ public:
  {
    MOZ_CRASH("nsInProcessTabChildGlobal doesn't use DOM bindings!");
  }
+
+  already_AddRefed<nsIFrameLoader> GetFrameLoader();
+
 protected:
  virtual ~nsInProcessTabChildGlobal();

@ -165,6 +168,11 @@ protected:
  // PreHandleEvent.
  bool mIsBrowserOrAppFrame;
  bool mPreventEventsEscaping;
+
+  // We keep a strong reference to the frameloader after we've started
+  // teardown. This allows us to dispatch message manager messages during this
+  // time.
+  nsCOMPtr<nsIFrameLoader> mFrameLoader;
 public:
  nsIContent* mOwner;
  nsFrameMessageManager* mChromeMessageManager;
--- a/dom/base/nsPerformance.cpp
+++ b/dom/base/nsPerformance.cpp
@ -261,7 +261,9 @@ nsPerformanceTiming::DomainLookupEndHighRes()
  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
    return mZeroTime;
  }
-  return TimeStampToDOMHighResOrFetchStart(mDomainLookupEnd);
+  // Bug 1155008 - nsHttpTransaction is racy. Return DomainLookupStart when null
+  return mDomainLookupEnd.IsNull() ? DomainLookupStartHighRes()
+                                   : TimeStampToDOMHighRes(mDomainLookupEnd);
 }

 DOMTimeMilliSec
@ -292,7 +294,8 @@ nsPerformanceTiming::ConnectEndHighRes()
  if (!nsContentUtils::IsPerformanceTimingEnabled() || !IsInitialized()) {
    return mZeroTime;
  }
-  return mConnectEnd.IsNull() ? DomainLookupEndHighRes()
+  // Bug 1155008 - nsHttpTransaction is racy. Return ConnectStart when null
+  return mConnectEnd.IsNull() ? ConnectStartHighRes()
                              : TimeStampToDOMHighRes(mConnectEnd);
 }

@ -346,7 +349,9 @@ nsPerformanceTiming::ResponseEndHighRes()
     (!mCacheReadEnd.IsNull() && mCacheReadEnd < mResponseEnd)) {
    mResponseEnd = mCacheReadEnd;
  }
-  return TimeStampToDOMHighResOrFetchStart(mResponseEnd);
+  // Bug 1155008 - nsHttpTransaction is racy. Return ResponseStart when null
+  return mResponseEnd.IsNull() ? ResponseStartHighRes()
+                               : TimeStampToDOMHighRes(mResponseEnd);
 }

 DOMTimeMilliSec
--- a/dom/base/test/browser.ini
+++ b/dom/base/test/browser.ini
@ -7,6 +7,7 @@ skip-if = e10s # Bug ?????? - test directly touches content (contentWindow.ifram
 [browser_bug902350.js]
 skip-if = e10s # Bug ?????? - test e10s utils don't support load events from iframe etc, which this test relies on.
 [browser_messagemanager_loadprocessscript.js]
+[browser_messagemanager_targetframeloader.js]
 [browser_pagehide_on_tab_close.js]
 skip-if = e10s # this tests non-e10s behavior. it's not expected to work in e10s.
 [browser_messagemanager_unload.js]
--- a/dom/base/test/browser_messagemanager_targetframeloader.js
+++ b/dom/base/test/browser_messagemanager_targetframeloader.js
@ -0,0 +1,31 @@
+function frameScript()
+{
+  sendSyncMessage("Test:Message");
+  sendAsyncMessage("Test:Message");
+  sendAsyncMessage("Test:Done");
+}
+
+function test() {
+  waitForExplicitFinish();
+
+  var newTab = gBrowser.addTab("about:blank");
+  gBrowser.selectedTab = newTab;
+
+  let browser = newTab.linkedBrowser;
+  let frameLoader = browser.frameLoader;
+  ok(frameLoader !== null, "frameLoader looks okay");
+
+  browser.messageManager.loadFrameScript("data:,(" + frameScript.toString() + ")()", false);
+
+  browser.messageManager.addMessageListener("Test:Message", (msg) => {
+    ok(msg.target === browser, "<browser> is correct");
+    ok(msg.targetFrameLoader === frameLoader, "frameLoader is correct");
+    ok(browser.frameLoader === msg.targetFrameLoader, "browser frameloader is correct");
+  });
+
+  browser.messageManager.addMessageListener("Test:Done", () => {
+    info("Finished");
+    gBrowser.removeCurrentTab();
+    finish();
+  });
+}
--- a/dom/base/test/browser_messagemanager_unload.js
+++ b/dom/base/test/browser_messagemanager_unload.js
@ -70,6 +70,8 @@ function test() {
  gBrowser.selectedTab = newTab;

  let browser = newTab.linkedBrowser;
+  let frameLoader = browser.frameLoader;
+  ok(frameLoader !== null, "frameLoader looks okay");

  browser.messageManager.loadFrameScript("data:,(" + frameScript.toString() + ")()", false);

@ -80,6 +82,8 @@ function test() {
  let index = 0;
  browser.messageManager.addMessageListener("Test:Event", (msg) => {
    ok(msg.target === browser, "<browser> is correct");
+    ok(msg.targetFrameLoader === frameLoader, "frameLoader is correct");
+    ok(browser.frameLoader === null, "browser frameloader null during teardown");

    info(JSON.stringify(msg.data));

--- a/dom/canvas/WebGL2ContextUniforms.cpp
+++ b/dom/canvas/WebGL2ContextUniforms.cpp
@ -11,8 +11,7 @@
 #include "WebGLVertexAttribData.h"
 #include "mozilla/dom/WebGL2RenderingContextBinding.h"

-using namespace mozilla;
-using namespace mozilla::dom;
+namespace mozilla {

 typedef union { GLint i; GLfloat f; GLuint u; } fi_t;

@ -538,39 +537,7 @@ WebGL2Context::GetUniformBlockIndex(WebGLProgram* program,
    if (!ValidateObject("getUniformBlockIndex: program", program))
        return 0;

-    // Leave this unchecked for now.
-
-    const NS_LossyConvertUTF16toASCII cname(uniformBlockName);
-
-    GLuint progname = program->mGLName;
-
-    MakeContextCurrent();
-    return gl->fGetUniformBlockIndex(progname, cname.BeginReading());
-}
-
-static bool
-GetUniformBlockActiveUniforms(gl::GLContext* gl, JSContext* cx,
-                              WebGL2Context* owner, GLuint progname,
-                              GLuint uniformBlockIndex,
-                              JS::MutableHandleObject out_array)
-{
-    GLint length = 0;
-    gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex,
-                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS, &length);
-    JS::RootedObject obj(cx, Uint32Array::Create(cx, owner, length, nullptr));
-    if (!obj)
-        return false;
-
-    Uint32Array result;
-    DebugOnly<bool> inited = result.Init(obj);
-    MOZ_ASSERT(inited);
-    result.ComputeLengthAndData();
-    gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex,
-                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES,
-                                 (GLint*) result.Data());
-
-    out_array.set(obj);
-    return true;
+    return program->GetUniformBlockIndex(uniformBlockName);
 }

 void
@ -586,46 +553,25 @@ WebGL2Context::GetActiveUniformBlockParameter(JSContext* cx, WebGLProgram* progr
    if (!ValidateObject("getActiveUniformBlockParameter: program", program))
        return;

-    GLuint progname = program->mGLName;
-    GLint param = 0;
-
    MakeContextCurrent();

    switch(pname) {
    case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
    case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER:
-        gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex, pname, &param);
-        retval.SetValue().SetAsBoolean() = (param != 0);
-        return;
-
    case LOCAL_GL_UNIFORM_BLOCK_BINDING:
    case LOCAL_GL_UNIFORM_BLOCK_DATA_SIZE:
-    case LOCAL_GL_UNIFORM_BLOCK_NAME_LENGTH:
    case LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS:
-        gl->fGetActiveUniformBlockiv(progname, uniformBlockIndex, pname, &param);
-        retval.SetValue().SetAsUnsignedLong() = param;
+        program->GetActiveUniformBlockParam(uniformBlockIndex, pname, retval);
        return;

    case LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES:
-        JS::RootedObject array(cx);
-        if (!GetUniformBlockActiveUniforms(gl, cx, this, progname, uniformBlockIndex,
-                                           &array))
-        {
-            rv = NS_ERROR_OUT_OF_MEMORY;
-            return;
-        }
-
-        DebugOnly<bool> inited = retval.SetValue().SetAsUint32Array().Init(array);
-        MOZ_ASSERT(inited);
-
+        program->GetActiveUniformBlockActiveUniforms(cx, uniformBlockIndex, retval, rv);
        return;
    }

    ErrorInvalidEnumInfo("getActiveUniformBlockParameter: parameter", pname);
 }

-#define WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH 256
-
 void
 WebGL2Context::GetActiveUniformBlockName(WebGLProgram* program, GLuint uniformBlockIndex,
                                         nsAString& retval)
@ -636,19 +582,9 @@ WebGL2Context::GetActiveUniformBlockName(WebGLProgram* program, GLuint uniformBl
    if (!ValidateObject("getActiveUniformBlockName: program", program))
        return;

-    GLuint progname = program->mGLName;
-    GLchar nameBuffer[WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH];
-    GLsizei length = 0;
-
-    MakeContextCurrent();
-    gl->fGetActiveUniformBlockName(progname, uniformBlockIndex,
-                                   WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH, &length,
-                                   nameBuffer);
-    retval.Assign(NS_ConvertASCIItoUTF16(nsDependentCString(nameBuffer)));
+    program->GetActiveUniformBlockName(uniformBlockIndex, retval);
 }

-#undef WEBGL_MAX_UNIFORM_BLOCK_NAME_LENGTH
-
 void
 WebGL2Context::UniformBlockBinding(WebGLProgram* program, GLuint uniformBlockIndex,
                                   GLuint uniformBlockBinding)
@ -659,8 +595,7 @@ WebGL2Context::UniformBlockBinding(WebGLProgram* program, GLuint uniformBlockInd
    if (!ValidateObject("uniformBlockBinding: program", program))
        return;

-    GLuint progname = program->mGLName;
-
-    MakeContextCurrent();
-    gl->fUniformBlockBinding(progname, uniformBlockIndex, uniformBlockBinding);
+    program->UniformBlockBinding(uniformBlockIndex, uniformBlockBinding);
 }
+
+} // namespace mozilla
--- a/dom/canvas/WebGLActiveInfo.cpp
+++ b/dom/canvas/WebGLActiveInfo.cpp
@ -29,9 +29,9 @@ ElemSizeFromType(GLenum elemType)
    case LOCAL_GL_INT_SAMPLER_CUBE:
    case LOCAL_GL_INT_SAMPLER_2D_ARRAY:
    case LOCAL_GL_UNSIGNED_INT_SAMPLER_2D:
-    case LOCAL_GL_UNSIGNED_INT_SAMPLER_2D_ARRAY:
    case LOCAL_GL_UNSIGNED_INT_SAMPLER_3D:
    case LOCAL_GL_UNSIGNED_INT_SAMPLER_CUBE:
+    case LOCAL_GL_UNSIGNED_INT_SAMPLER_2D_ARRAY:
        return 1;

    case LOCAL_GL_BOOL_VEC2:
--- a/dom/canvas/WebGLProgram.cpp
+++ b/dom/canvas/WebGLProgram.cpp
@ -78,6 +78,16 @@ AddActiveInfo(WebGLContext* webgl, GLint elemCount, GLenum elemType, bool isArra
    infoLocMap->insert(std::make_pair(info->mBaseUserName, info.get()));
 }

+static void
+AddActiveBlockInfo(const nsACString& baseUserName,
+                   const nsACString& baseMappedName,
+                   std::vector<RefPtr<webgl::UniformBlockInfo>>* activeInfoList)
+{
+    RefPtr<webgl::UniformBlockInfo> info = new webgl::UniformBlockInfo(baseUserName, baseMappedName);
+
+    activeInfoList->push_back(info);
+}
+
 //#define DUMP_SHADERVAR_MAPPINGS

 static TemporaryRef<const webgl::LinkedProgramInfo>
@ -97,9 +107,18 @@ QueryProgramInfo(WebGLProgram* prog, gl::GLContext* gl)
    if (maxUniformLenWithNull < 1)
        maxUniformLenWithNull = 1;

+    GLuint maxUniformBlockLenWithNull = 0;
+    if (gl->IsSupported(gl::GLFeature::uniform_buffer_object)) {
+        gl->fGetProgramiv(prog->mGLName, LOCAL_GL_ACTIVE_UNIFORM_BLOCK_MAX_NAME_LENGTH,
+                          (GLint*)&maxUniformBlockLenWithNull);
+        if (maxUniformBlockLenWithNull < 1)
+            maxUniformBlockLenWithNull = 1;
+    }
+
 #ifdef DUMP_SHADERVAR_MAPPINGS
    printf_stderr("maxAttribLenWithNull: %d\n", maxAttribLenWithNull);
    printf_stderr("maxUniformLenWithNull: %d\n", maxUniformLenWithNull);
+    printf_stderr("maxUniformBlockLenWithNull: %d\n", maxUniformBlockLenWithNull);
 #endif

    // Attribs
@ -204,6 +223,54 @@ QueryProgramInfo(WebGLProgram* prog, gl::GLContext* gl)
                      baseMappedName, &info->activeUniforms, &info->uniformMap);
    }

+    // Uniform Blocks
+
+    if (gl->IsSupported(gl::GLFeature::uniform_buffer_object)) {
+        GLuint numActiveUniformBlocks = 0;
+        gl->fGetProgramiv(prog->mGLName, LOCAL_GL_ACTIVE_UNIFORM_BLOCKS,
+                          (GLint*)&numActiveUniformBlocks);
+
+        for (GLuint i = 0; i < numActiveAttribs; i++) {
+            nsAutoCString mappedName;
+            mappedName.SetLength(maxUniformBlockLenWithNull - 1);
+
+            GLint lengthWithoutNull;
+            gl->fGetActiveUniformBlockiv(prog->mGLName, i, LOCAL_GL_UNIFORM_BLOCK_NAME_LENGTH, &lengthWithoutNull);
+            gl->fGetActiveUniformBlockName(prog->mGLName, i, maxUniformBlockLenWithNull, &lengthWithoutNull, mappedName.BeginWriting());
+            mappedName.SetLength(lengthWithoutNull);
+
+            nsAutoCString baseMappedName;
+            bool isArray;
+            size_t arrayIndex;
+            if (!ParseName(mappedName, &baseMappedName, &isArray, &arrayIndex))
+                MOZ_CRASH("Failed to parse `mappedName` received from driver.");
+
+            nsAutoCString baseUserName;
+            if (!prog->FindUniformBlockByMappedName(baseMappedName, &baseUserName, &isArray)) {
+                baseUserName = baseMappedName;
+
+                if (needsCheckForArrays && !isArray) {
+                    std::string mappedName = baseMappedName.BeginReading();
+                    mappedName += "[0]";
+
+                    GLuint loc = gl->fGetUniformBlockIndex(prog->mGLName, mappedName.c_str());
+                    if (loc != LOCAL_GL_INVALID_INDEX)
+                        isArray = true;
+                }
+            }
+
+#ifdef DUMP_SHADERVAR_MAPPINGS
+            printf_stderr("[uniform block %i] %s/%i/%s/%s\n", i, mappedName.BeginReading(),
+                          (int)isArray, baseMappedName.BeginReading(),
+                          baseUserName.BeginReading());
+            printf_stderr("    lengthWithoutNull: %d\n", lengthWithoutNull);
+            printf_stderr("    isArray: %d\n", (int)isArray);
+#endif
+
+            AddActiveBlockInfo(baseUserName, baseMappedName, &info->uniformBlocks);
+        }
+    }
+
    return info.forget();
 }

@ -496,6 +563,141 @@ WebGLProgram::GetProgramParameter(GLenum pname) const
    }
 }

+GLuint
+WebGLProgram::GetUniformBlockIndex(const nsAString& userName_wide) const
+{
+    if (!ValidateGLSLVariableName(userName_wide, mContext, "getUniformBlockIndex"))
+        return LOCAL_GL_INVALID_INDEX;
+
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getUniformBlockIndex: `program` must be linked.");
+        return LOCAL_GL_INVALID_INDEX;
+    }
+
+    const NS_LossyConvertUTF16toASCII userName(userName_wide);
+
+    nsDependentCString baseUserName;
+    bool isArray;
+    size_t arrayIndex;
+    if (!ParseName(userName, &baseUserName, &isArray, &arrayIndex))
+        return LOCAL_GL_INVALID_INDEX;
+
+    RefPtr<const webgl::UniformBlockInfo> info;
+    if (!LinkInfo()->FindUniformBlock(baseUserName, &info)) {
+        return LOCAL_GL_INVALID_INDEX;
+    }
+
+    const nsCString& baseMappedName = info->mBaseMappedName;
+    nsAutoCString mappedName(baseMappedName);
+    if (isArray) {
+        mappedName.AppendLiteral("[");
+        mappedName.AppendInt(uint32_t(arrayIndex));
+        mappedName.AppendLiteral("]");
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    gl->MakeCurrent();
+
+    return gl->fGetUniformBlockIndex(mGLName, mappedName.BeginReading());
+}
+
+void
+WebGLProgram::GetActiveUniformBlockName(GLuint uniformBlockIndex, nsAString& retval) const
+{
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockName: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint) linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockName: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    const webgl::UniformBlockInfo* blockInfo = linkInfo->uniformBlocks[uniformBlockIndex];
+
+    retval.Assign(NS_ConvertASCIItoUTF16(blockInfo->mBaseUserName));
+}
+
+void
+WebGLProgram::GetActiveUniformBlockParam(GLuint uniformBlockIndex, GLenum pname,
+                                         Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval) const
+{
+    retval.SetNull();
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockParameter: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint)linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockParameter: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    GLint param = 0;
+
+    switch (pname) {
+    case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
+    case LOCAL_GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER:
+        gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex, pname, &param);
+        retval.SetValue().SetAsBoolean() = (param != 0);
+        return;
+
+    case LOCAL_GL_UNIFORM_BLOCK_BINDING:
+    case LOCAL_GL_UNIFORM_BLOCK_DATA_SIZE:
+    case LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS:
+        gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex, pname, &param);
+        retval.SetValue().SetAsUnsignedLong() = param;
+        return;
+    }
+}
+
+void
+WebGLProgram::GetActiveUniformBlockActiveUniforms(JSContext* cx, GLuint uniformBlockIndex,
+                                                  Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval,
+                                                  ErrorResult& rv) const
+{
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockParameter: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint)linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockParameter: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    GLint activeUniformCount = 0;
+    gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex,
+                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS,
+                                 &activeUniformCount);
+    JS::RootedObject obj(cx, dom::Uint32Array::Create(cx, mContext, activeUniformCount,
+                                                      nullptr));
+    if (!obj) {
+        rv = NS_ERROR_OUT_OF_MEMORY;
+        return;
+    }
+
+    dom::Uint32Array result;
+    DebugOnly<bool> inited = result.Init(obj);
+    MOZ_ASSERT(inited);
+    result.ComputeLengthAndData();
+    gl->fGetActiveUniformBlockiv(mGLName, uniformBlockIndex,
+                                 LOCAL_GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES,
+                                 (GLint*)result.Data());
+
+    inited = retval.SetValue().SetAsUint32Array().Init(obj);
+    MOZ_ASSERT(inited);
+}
+
 already_AddRefed<WebGLUniformLocation>
 WebGLProgram::GetUniformLocation(const nsAString& userName_wide) const
 {
@ -540,6 +742,31 @@ WebGLProgram::GetUniformLocation(const nsAString& userName_wide) const
    return locObj.forget();
 }

+void
+WebGLProgram::UniformBlockBinding(GLuint uniformBlockIndex, GLuint uniformBlockBinding) const
+{
+    if (!IsLinked()) {
+        mContext->ErrorInvalidOperation("getActiveUniformBlockName: `program` must be linked.");
+        return;
+    }
+
+    const webgl::LinkedProgramInfo* linkInfo = LinkInfo();
+    GLuint uniformBlockCount = (GLuint)linkInfo->uniformBlocks.size();
+    if (uniformBlockIndex >= uniformBlockCount) {
+        mContext->ErrorInvalidValue("getActiveUniformBlockName: index %u invalid.", uniformBlockIndex);
+        return;
+    }
+
+    if (uniformBlockBinding > mContext->mGLMaxUniformBufferBindings) {
+        mContext->ErrorInvalidEnum("getActiveUniformBlockName: binding %u invalid.", uniformBlockBinding);
+        return;
+    }
+
+    gl::GLContext* gl = mContext->GL();
+    gl->MakeCurrent();
+    gl->fUniformBlockBinding(mGLName, uniformBlockIndex, uniformBlockBinding);
+}
+
 bool
 WebGLProgram::LinkProgram()
 {
@ -707,6 +934,20 @@ WebGLProgram::FindUniformByMappedName(const nsACString& mappedName,
    return false;
 }

+bool
+WebGLProgram::FindUniformBlockByMappedName(const nsACString& mappedName,
+                                           nsCString* const out_userName,
+                                           bool* const out_isArray) const
+{
+    if (mVertShader->FindUniformBlockByMappedName(mappedName, out_userName, out_isArray))
+        return true;
+
+    if (mFragShader->FindUniformBlockByMappedName(mappedName, out_userName, out_isArray))
+        return true;
+
+    return false;
+}
+
 ////////////////////////////////////////////////////////////////////////////////

 JSObject*
--- a/dom/canvas/WebGLProgram.h
+++ b/dom/canvas/WebGLProgram.h
@ -9,6 +9,7 @@
 #include <map>
 #include "mozilla/CheckedInt.h"
 #include "mozilla/LinkedList.h"
+#include "mozilla/dom/WebGL2RenderingContextBinding.h"
 #include "nsString.h"
 #include "nsWrapperCache.h"
 #include <set>
@ -24,6 +25,21 @@ class WebGLUniformLocation;

 namespace webgl {

+struct UniformBlockInfo final
+    : public RefCounted<UniformBlockInfo>
+{
+    MOZ_DECLARE_REFCOUNTED_TYPENAME(UniformBlockInfo);
+
+    const nsCString mBaseUserName;
+    const nsCString mBaseMappedName;
+
+    UniformBlockInfo(const nsACString& baseUserName,
+                     const nsACString& baseMappedName)
+        : mBaseUserName(baseUserName)
+        , mBaseMappedName(baseMappedName)
+    {}
+};
+
 struct LinkedProgramInfo final
    : public RefCounted<LinkedProgramInfo>
    , public SupportsWeakPtr<LinkedProgramInfo>
@ -40,6 +56,8 @@ struct LinkedProgramInfo final
    std::map<nsCString, const WebGLActiveInfo*> uniformMap;
    std::map<nsCString, const nsCString>* fragDataMap;

+    std::vector<RefPtr<UniformBlockInfo>> uniformBlocks;
+
    // Needed for draw call validation.
    std::set<GLuint> activeAttribLocs;

@ -67,6 +85,20 @@ struct LinkedProgramInfo final
        return true;
    }

+    bool FindUniformBlock(const nsCString& baseUserName,
+                          RefPtr<const UniformBlockInfo>* const out_info) const
+    {
+        const size_t count = uniformBlocks.size();
+        for (size_t i = 0; i < count; i++) {
+            if (baseUserName == uniformBlocks[i]->mBaseUserName) {
+                *out_info = uniformBlocks[i].get();
+                return true;
+            }
+        }
+
+        return false;
+    }
+
    bool FindFragData(const nsCString& baseUserName,
                      nsCString* const out_baseMappedName) const
    {
@ -115,7 +147,16 @@ public:
    GLint GetFragDataLocation(const nsAString& name) const;
    void GetProgramInfoLog(nsAString* const out) const;
    JS::Value GetProgramParameter(GLenum pname) const;
+    GLuint GetUniformBlockIndex(const nsAString& name) const;
+    void GetActiveUniformBlockName(GLuint uniformBlockIndex, nsAString& name) const;
+    void GetActiveUniformBlockParam(GLuint uniformBlockIndex, GLenum pname,
+                                    Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval) const;
+    void GetActiveUniformBlockActiveUniforms(JSContext* cx, GLuint uniformBlockIndex,
+                                             Nullable<dom::OwningUnsignedLongOrUint32ArrayOrBoolean>& retval,
+                                             ErrorResult& rv) const;
    already_AddRefed<WebGLUniformLocation> GetUniformLocation(const nsAString& name) const;
+    void UniformBlockBinding(GLuint uniformBlockIndex, GLuint uniformBlockBinding) const;
+
    bool LinkProgram();
    bool UseProgram() const;
    void ValidateProgram() const;
@ -127,6 +168,9 @@ public:
    bool FindUniformByMappedName(const nsACString& mappedName,
                                 nsCString* const out_userName,
                                 bool* const out_isArray) const;
+    bool FindUniformBlockByMappedName(const nsACString& mappedName,
+                                      nsCString* const out_userName,
+                                      bool* const out_isArray) const;

    bool IsLinked() const { return mMostRecentLinkInfo; }

--- a/dom/canvas/WebGLShader.cpp
+++ b/dom/canvas/WebGLShader.cpp
@ -345,6 +345,15 @@ WebGLShader::FindUniformByMappedName(const nsACString& mappedName,
    return true;
 }

+bool
+WebGLShader::FindUniformBlockByMappedName(const nsACString& mappedName,
+                                          nsCString* const out_userName,
+                                          bool* const out_isArray) const
+{
+    // TODO: Extract block information from shader validator.
+    return false;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Boilerplate

--- a/dom/canvas/WebGLShader.h
+++ b/dom/canvas/WebGLShader.h
@ -51,6 +51,9 @@ public:
    bool FindUniformByMappedName(const nsACString& mappedName,
                                 nsCString* const out_userName,
                                 bool* const out_isArray) const;
+    bool FindUniformBlockByMappedName(const nsACString& mappedName,
+                                      nsCString* const out_userName,
+                                      bool* const out_isArray) const;

    bool IsCompiled() const {
        return mTranslationSuccessful && mCompilationSuccessful;
--- a/dom/events/test/chrome.ini
+++ b/dom/events/test/chrome.ini
@ -18,4 +18,7 @@ support-files =
 [test_bug617528.xul]
 [test_bug679494.xul]
 [test_bug930374-chrome.html]
+[test_bug1128787-1.html]
+[test_bug1128787-2.html]
+[test_bug1128787-3.html]
 [test_eventctors.xul]
--- a/dom/events/test/test_bug1128787-1.html
+++ b/dom/events/test/test_bug1128787-1.html
@ -0,0 +1,54 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1128787
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1128787</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1128787 **/
+  SimpleTest.waitForExplicitFinish();
+
+  window.onload = function (aEvent) {
+    var blurEventFired = false;
+    var input = document.getElementsByTagName("input")[0];
+    input.addEventListener("blur", function (aEvent) {
+      input.removeEventListener("blur", arguments.callee);
+      ok(true, "input element gets blur event correctly");
+
+      var utils = SpecialPowers.getDOMWindowUtils(window);
+      is(utils.IMEStatus, utils.IME_STATUS_ENABLED, "IME should be enabled");
+
+      SimpleTest.executeSoon(function () {
+        document.designMode = "off";
+
+        // XXX Should be fixed.
+        todo_is(utils.IMEStatus, utils.IME_STATUS_DISABLED, "IME should be disabled");
+
+        SimpleTest.finish();
+      });
+    });
+    document.designMode = "on";
+  }
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1128787">Mozilla Bug 1128787</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<input type="button"/>
+<script>
+var input = document.getElementsByTagName("input")[0];
+input.focus();
+</script>
+<pre id="test">
+</pre>
+</body>
+</html>
--- a/dom/events/test/test_bug1128787-2.html
+++ b/dom/events/test/test_bug1128787-2.html
@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1128787
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1128787</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1128787 **/
+  SimpleTest.waitForExplicitFinish();
+
+  window.onload = function (aEvent) {
+    var blurEventFired = false;
+    var input = document.getElementsByTagName("input")[0];
+    input.addEventListener("blur", function (aEvent) {
+      input.removeEventListener("blur", arguments.callee);
+      ok(true, "input element gets blur event correctly");
+
+      var utils = SpecialPowers.getDOMWindowUtils(window);
+      is(utils.IMEStatus, utils.IME_STATUS_ENABLED, "IME should be enabled");
+
+      SimpleTest.executeSoon(function () {
+        document.designMode = "off";
+
+        // XXX Should be fixed.
+        todo_is(utils.IMEStatus, utils.IME_STATUS_DISABLED, "IME should be disabled");
+
+        SimpleTest.finish();
+      });
+    });
+    document.designMode = "on";
+  }
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1128787">Mozilla Bug 1128787</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<p contenteditable="true"></p>
+<input type="button"/>
+<script>
+var input = document.getElementsByTagName("input")[0];
+input.focus();
+</script>
+<pre id="test">
+</pre>
+</body>
+</html>
--- a/dom/events/test/test_bug1128787-3.html
+++ b/dom/events/test/test_bug1128787-3.html
@ -0,0 +1,54 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1128787
+-->
+<head>
+  <meta charset="utf-8">
+  <title>Test for Bug 1128787</title>
+  <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="chrome://global/skin"/>
+  <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
+  <script type="application/javascript">
+
+  /** Test for Bug 1128787 **/
+  SimpleTest.waitForExplicitFinish();
+
+  window.onload = function (aEvent) {
+    var blurEventFired = false;
+    var input = document.getElementsByTagName("input")[0];
+    input.addEventListener("blur", function (aEvent) {
+      input.removeEventListener("blur", arguments.callee);
+      ok(true, "input element gets blur event correctly");
+
+      var utils = SpecialPowers.getDOMWindowUtils(window);
+      is(utils.IMEStatus, utils.IME_STATUS_ENABLED, "IME should be enabled");
+
+      is(document.designMode, "on",
+         "designMode should be \"on\" when blur event caused by enabling designMode is fired");
+      document.designMode = "off";
+      is(document.designMode, "off",
+         "designMode should become \"off\" even if it's reset by the blur event handler caused by enabling designMode");
+
+      todo_is(utils.IMEStatus, utils.IME_STATUS_DISABLED, "IME should be disabled");
+      SimpleTest.finish();
+    });
+    document.designMode = "on";
+  }
+  </script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1128787">Mozilla Bug 1128787</a>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<input type="button"/>
+<script>
+var input = document.getElementsByTagName("input")[0];
+input.focus();
+</script>
+<pre id="test">
+</pre>
+</body>
+</html>
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@ -110,6 +110,9 @@
 #include "nsCharsetSource.h"
 #include "nsIStringBundle.h"
 #include "nsDOMClassInfo.h"
+#include "nsFocusManager.h"
+#include "nsIFrame.h"
+#include "nsIContent.h"

 using namespace mozilla;
 using namespace mozilla::dom;
@ -2723,7 +2726,7 @@ nsHTMLDocument::EditingStateChanged()
  }

  if (mEditingState == eSettingUp || mEditingState == eTearingDown) {
-    // XXX We shouldn't recurse.
+    // XXX We shouldn't recurse
    return NS_OK;
  }

@ -2787,12 +2790,91 @@ nsHTMLDocument::EditingStateChanged()
  bool makeWindowEditable = mEditingState == eOff;
  bool updateState = false;
  bool spellRecheckAll = false;
+  bool putOffToRemoveScriptBlockerUntilModifyingEditingState = false;
  nsCOMPtr<nsIEditor> editor;

  {
    EditingState oldState = mEditingState;
    nsAutoEditingState push(this, eSettingUp);

+    nsCOMPtr<nsIPresShell> presShell = GetShell();
+    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
+
+    // Before making this window editable, we need to modify UA style sheet
+    // because new style may change whether focused element will be focusable
+    // or not.
+    nsCOMArray<nsIStyleSheet> agentSheets;
+    rv = presShell->GetAgentStyleSheets(agentSheets);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsCOMPtr<nsIURI> uri;
+    rv = NS_NewURI(getter_AddRefs(uri),
+                   NS_LITERAL_STRING("resource://gre/res/contenteditable.css"));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsRefPtr<CSSStyleSheet> sheet;
+    rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
+    NS_ENSURE_TRUE(sheet, rv);
+
+    bool result = agentSheets.AppendObject(sheet);
+    NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
+
+    // Should we update the editable state of all the nodes in the document? We
+    // need to do this when the designMode value changes, as that overrides
+    // specific states on the elements.
+    if (designMode) {
+      // designMode is being turned on (overrides contentEditable).
+      rv = NS_NewURI(getter_AddRefs(uri),
+                     NS_LITERAL_STRING("resource://gre/res/designmode.css"));
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
+      NS_ENSURE_TRUE(sheet, rv);
+
+      result = agentSheets.AppendObject(sheet);
+      NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
+
+      updateState = true;
+      spellRecheckAll = oldState == eContentEditable;
+    }
+    else if (oldState == eDesignMode) {
+      // designMode is being turned off (contentEditable is still on).
+      RemoveFromAgentSheets(agentSheets,
+        NS_LITERAL_STRING("resource://gre/res/designmode.css"));
+
+      updateState = true;
+    }
+
+    rv = presShell->SetAgentStyleSheets(agentSheets);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    presShell->ReconstructStyleData();
+
+    // Adjust focused element with new style but blur event shouldn't be fired
+    // until mEditingState is modified with newState.
+    nsAutoScriptBlocker scriptBlocker;
+    if (designMode) {
+      nsCOMPtr<nsPIDOMWindow> focusedWindow;
+      nsIContent* focusedContent =
+        nsFocusManager::GetFocusedDescendant(window, false,
+                                             getter_AddRefs(focusedWindow));
+      if (focusedContent) {
+        nsIFrame* focusedFrame = focusedContent->GetPrimaryFrame();
+        bool clearFocus = focusedFrame ? !focusedFrame->IsFocusable() :
+                                         !focusedContent->IsFocusable();
+        if (clearFocus) {
+          nsFocusManager* fm = nsFocusManager::GetFocusManager();
+          if (fm) {
+            fm->ClearFocus(window);
+            // If we need to dispatch blur event, we should put off after
+            // modifying mEditingState since blur event handler may change
+            // designMode state again.
+            putOffToRemoveScriptBlockerUntilModifyingEditingState = true;
+          }
+        }
+      }
+    }
+
    if (makeWindowEditable) {
      // Editing is being turned on (through designMode or contentEditable)
      // Turn on editor.
@ -2808,61 +2890,26 @@ nsHTMLDocument::EditingStateChanged()
    if (!editor)
      return NS_ERROR_FAILURE;

-    nsCOMPtr<nsIPresShell> presShell = GetShell();
-    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
-
    // If we're entering the design mode, put the selection at the beginning of
    // the document for compatibility reasons.
    if (designMode && oldState == eOff) {
      editor->BeginningOfDocument();
    }

-    nsCOMArray<nsIStyleSheet> agentSheets;
-    rv = presShell->GetAgentStyleSheets(agentSheets);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsIURI> uri;
-    rv = NS_NewURI(getter_AddRefs(uri), NS_LITERAL_STRING("resource://gre/res/contenteditable.css"));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsRefPtr<CSSStyleSheet> sheet;
-    rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
-    NS_ENSURE_TRUE(sheet, rv);
-
-    bool result = agentSheets.AppendObject(sheet);
-    NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
-
-    // Should we update the editable state of all the nodes in the document? We
-    // need to do this when the designMode value changes, as that overrides
-    // specific states on the elements.
-    if (designMode) {
-      // designMode is being turned on (overrides contentEditable).
-      rv = NS_NewURI(getter_AddRefs(uri), NS_LITERAL_STRING("resource://gre/res/designmode.css"));
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      rv = LoadChromeSheetSync(uri, true, getter_AddRefs(sheet));
-      NS_ENSURE_TRUE(sheet, rv);
-
-      result = agentSheets.AppendObject(sheet);
-      NS_ENSURE_TRUE(result, NS_ERROR_OUT_OF_MEMORY);
-
-      updateState = true;
-      spellRecheckAll = oldState == eContentEditable;
+    if (putOffToRemoveScriptBlockerUntilModifyingEditingState) {
+      nsContentUtils::AddScriptBlocker();
    }
-    else if (oldState == eDesignMode) {
-      // designMode is being turned off (contentEditable is still on).
-      RemoveFromAgentSheets(agentSheets, NS_LITERAL_STRING("resource://gre/res/designmode.css"));
-
-      updateState = true;
-    }
-
-    rv = presShell->SetAgentStyleSheets(agentSheets);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    presShell->ReconstructStyleData();
  }

  mEditingState = newState;
+  if (putOffToRemoveScriptBlockerUntilModifyingEditingState) {
+    nsContentUtils::RemoveScriptBlocker();
+    // If mEditingState is overwritten by another call and already disabled
+    // the editing, we shouldn't keep making window editable.
+    if (mEditingState == eOff) {
+      return NS_OK;
+    }
+  }

  if (makeWindowEditable) {
    // Set the editor to not insert br's on return when in p
--- a/dom/indexedDB/ActorsParent.cpp
+++ b/dom/indexedDB/ActorsParent.cpp
@ -5492,7 +5492,7 @@ private:
  ~WaitForTransactionsHelper()
  {
    MOZ_ASSERT(!mCallback);
-    MOZ_ASSERT(mState = State_Complete);
+    MOZ_ASSERT(mState == State_Complete);
  }

  void
@ -7877,7 +7877,7 @@ private:
  {
    MOZ_ASSERT(!mQuotaClient);
    MOZ_ASSERT(!mCallback);
-    MOZ_ASSERT(mState = State_Complete);
+    MOZ_ASSERT(mState == State_Complete);
  }

  void
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@ -2019,7 +2019,7 @@ ContentChild::RecvAsyncMessage(const nsString& aMsg,
    if (cpm) {
        StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForChild(aData);
        CrossProcessCpowHolder cpows(this, aCpows);
-        cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()),
+        cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()), nullptr,
                            aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
    }
    return true;
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@ -1703,7 +1703,7 @@ ContentParent::ShutDownMessageManager()
  }

  mMessageManager->ReceiveMessage(
-            static_cast<nsIContentFrameMessageManager*>(mMessageManager.get()),
+            static_cast<nsIContentFrameMessageManager*>(mMessageManager.get()), nullptr,
            CHILD_PROCESS_SHUTDOWN_MESSAGE, false,
            nullptr, nullptr, nullptr, nullptr);

@ -1883,11 +1883,6 @@ struct DelayedDeleteContentParentTask : public nsRunnable
 void
 ContentParent::ActorDestroy(ActorDestroyReason why)
 {
-#ifdef MOZ_CRASHREPORTER
-    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("ChildShutdownState"),
-                                       NS_LITERAL_CSTRING("ActorDestroy"));
-#endif
-
    if (mForceKillTimer) {
        mForceKillTimer->Cancel();
        mForceKillTimer = nullptr;
@ -2049,12 +2044,6 @@ ContentParent::NotifyTabDestroying(PBrowserParent* aTab)
    StartForceKillTimer();
 }

-static int32_t
-ForceKillTimeout()
-{
-    return Preferences::GetInt("dom.ipc.tabs.shutdownTimeoutSecs", 5);
-}
-
 void
 ContentParent::StartForceKillTimer()
 {
@ -2062,7 +2051,7 @@ ContentParent::StartForceKillTimer()
        return;
    }

-    int32_t timeoutSecs = ForceKillTimeout();
+    int32_t timeoutSecs = Preferences::GetInt("dom.ipc.tabs.shutdownTimeoutSecs", 5);
    if (timeoutSecs > 0) {
        mForceKillTimer = do_CreateInstance("@mozilla.org/timer;1");
        MOZ_ASSERT(mForceKillTimer);
@ -2933,27 +2922,13 @@ ContentParent::Observe(nsISupports* aSubject,
 {
    if (mSubprocess && (!strcmp(aTopic, "profile-before-change") ||
                        !strcmp(aTopic, "xpcom-shutdown"))) {
-#ifdef MOZ_CRASHREPORTER
-        CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("ChildShutdownState"),
-                                           NS_LITERAL_CSTRING("Begin"));
-#endif
-
        // Okay to call ShutDownProcess multiple times.
        ShutDownProcess(SEND_SHUTDOWN_MESSAGE);

-        int32_t timeout = ForceKillTimeout();
-
-        // Make sure we have a KillHard timer before we start waiting.
-        MOZ_RELEASE_ASSERT(!timeout || !mIPCOpen || mCalledKillHard || mForceKillTimer);
-
        // Wait for shutdown to complete, so that we receive any shutdown
        // data (e.g. telemetry) from the child before we quit.
        // This loop terminate prematurely based on mForceKillTimer.
-        while (mIPCOpen) {
-            // If we clear the KillHard timer, it should only be because we
-            // called KillHard. In that case, ActorDestroy should happen
-            // momentarily.
-            MOZ_RELEASE_ASSERT(!timeout || mCalledKillHard || mForceKillTimer);
+        while (mIPCOpen && !mCalledKillHard) {
            NS_ProcessNextEvent(nullptr, true);
        }
        NS_ASSERTION(!mSubprocess, "Close should have nulled mSubprocess");
@ -3400,11 +3375,6 @@ ContentParent::ForceKillTimerCallback(nsITimer* aTimer, void* aClosure)
 void
 ContentParent::KillHard(const char* aReason)
 {
-#ifdef MOZ_CRASHREPORTER
-    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("ChildShutdownState"),
-                                       NS_LITERAL_CSTRING("KillHard"));
-#endif
-
    // On Windows, calling KillHard multiple times causes problems - the
    // process handle becomes invalid on the first call, causing a second call
    // to crash our process - more details in bug 890840.
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@ -496,7 +496,7 @@ TabChildBase::DispatchMessageManagerMessage(const nsAString& aMessageName,
    // content manipulate the frame state.
    nsRefPtr<nsFrameMessageManager> mm =
      static_cast<nsFrameMessageManager*>(mTabChildGlobal->mMessageManager.get());
-    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal),
+    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal), nullptr,
                       aMessageName, false, &cloneData, nullptr, nullptr, nullptr);
 }

@ -2488,6 +2488,11 @@ TabChild::RecvRealKeyEvent(const WidgetKeyboardEvent& event,
  AutoCacheNativeKeyCommands autoCache(widget);

  if (event.message == NS_KEY_PRESS) {
+    // If content code called preventDefault() on a keydown event, then we don't
+    // want to process any following keypress events.
+    if (mIgnoreKeyPressEvent) {
+      return true;
+    }
    if (aBindings.type() == MaybeNativeKeyBinding::TNativeKeyBinding) {
      const NativeKeyBinding& bindings = aBindings;
      autoCache.Cache(bindings.singleLineCommands(),
@ -2497,11 +2502,6 @@ TabChild::RecvRealKeyEvent(const WidgetKeyboardEvent& event,
      autoCache.CacheNoCommands();
    }
  }
-  // If content code called preventDefault() on a keydown event, then we don't
-  // want to process any following keypress events.
-  if (event.message == NS_KEY_PRESS && mIgnoreKeyPressEvent) {
-    return true;
-  }

  WidgetKeyboardEvent localEvent(event);
  localEvent.widget = mWidget;
@ -2689,7 +2689,7 @@ TabChild::RecvAsyncMessage(const nsString& aMessage,
    nsRefPtr<nsFrameMessageManager> mm =
      static_cast<nsFrameMessageManager*>(mTabChildGlobal->mMessageManager.get());
    CrossProcessCpowHolder cpows(Manager(), aCpows);
-    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal),
+    mm->ReceiveMessage(static_cast<EventTarget*>(mTabChildGlobal), nullptr,
                       aMessage, false, &cloneData, &cpows, aPrincipal, nullptr);
  }
  return true;
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@ -2484,6 +2484,7 @@ TabParent::ReceiveMessage(const nsString& aMessage,
      frameLoader->GetFrameMessageManager();

    manager->ReceiveMessage(mFrameElement,
+                            frameLoader,
                            aMessage,
                            aSync,
                            aCloneData,
--- a/dom/ipc/nsIContentChild.cpp
+++ b/dom/ipc/nsIContentChild.cpp
@ -117,7 +117,7 @@ nsIContentChild::RecvAsyncMessage(const nsString& aMsg,
  if (cpm) {
    StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForChild(aData);
    CrossProcessCpowHolder cpows(this, aCpows);
-    cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()),
+    cpm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(cpm.get()), nullptr,
                        aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
  }
  return true;
--- a/dom/ipc/nsIContentParent.cpp
+++ b/dom/ipc/nsIContentParent.cpp
@ -194,7 +194,7 @@ nsIContentParent::RecvSyncMessage(const nsString& aMsg,
  if (ppm) {
    StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
    CrossProcessCpowHolder cpows(this, aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr,
                        aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
  }
  return true;
@ -221,7 +221,7 @@ nsIContentParent::RecvRpcMessage(const nsString& aMsg,
  if (ppm) {
    StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
    CrossProcessCpowHolder cpows(this, aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr,
                        aMsg, true, &cloneData, &cpows, aPrincipal, aRetvals);
  }
  return true;
@ -247,7 +247,7 @@ nsIContentParent::RecvAsyncMessage(const nsString& aMsg,
  if (ppm) {
    StructuredCloneData cloneData = ipc::UnpackClonedMessageDataForParent(aData);
    CrossProcessCpowHolder cpows(this, aCpows);
-    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()),
+    ppm->ReceiveMessage(static_cast<nsIContentFrameMessageManager*>(ppm.get()), nullptr,
                        aMsg, false, &cloneData, &cpows, aPrincipal, nullptr);
  }
  return true;
--- a/dom/media/AbstractThread.cpp
+++ b/dom/media/AbstractThread.cpp
@ -85,6 +85,8 @@ public:
    return mTailDispatcher.ref();
  }

+  virtual nsIThread* AsXPCOMThread() override { return mTarget; }
+
 private:
  nsRefPtr<nsIThread> mTarget;
  Maybe<AutoTaskDispatcher> mTailDispatcher;
--- a/dom/media/AbstractThread.h
+++ b/dom/media/AbstractThread.h
@ -17,6 +17,7 @@

 namespace mozilla {

+class MediaTaskQueue;
 class TaskDispatcher;

 /*
@ -66,6 +67,9 @@ public:
  // tasks to go through the tail dispatcher.
  bool RequiresTailDispatch() const { return mRequireTailDispatch; }

+  virtual MediaTaskQueue* AsTaskQueue() { MOZ_CRASH("Not a task queue!"); }
+  virtual nsIThread* AsXPCOMThread() { MOZ_CRASH("Not an XPCOM thread!"); }
+
  // Convenience method for getting an AbstractThread for the main thread.
  static AbstractThread* MainThread();

--- a/dom/media/MediaInfo.h
+++ b/dom/media/MediaInfo.h
@ -112,6 +112,7 @@ public:
    , mDisplay(nsIntSize(aWidth, aHeight))
    , mStereoMode(StereoMode::MONO)
    , mImage(nsIntSize(aWidth, aHeight))
+    , mCodecSpecificConfig(new MediaByteBuffer)
    , mExtraData(new MediaByteBuffer)
  {
  }
@ -130,7 +131,7 @@ public:

  // Size in pixels of decoded video's image.
  nsIntSize mImage;
-
+  nsRefPtr<MediaByteBuffer> mCodecSpecificConfig;
  nsRefPtr<MediaByteBuffer> mExtraData;
 };

--- a/dom/media/MediaTaskQueue.h
+++ b/dom/media/MediaTaskQueue.h
@ -42,6 +42,8 @@ public:

  TaskDispatcher& TailDispatcher() override;

+  MediaTaskQueue* AsTaskQueue() override { return this; }
+
  void Dispatch(already_AddRefed<nsIRunnable> aRunnable,
                DispatchFailureHandling aFailureHandling = AssertDispatchSuccess,
                DispatchReason aReason = NormalDispatch) override
--- a/dom/media/fmp4/MP4Reader.cpp
+++ b/dom/media/fmp4/MP4Reader.cpp
@ -345,6 +345,7 @@ bool
 MP4Reader::IsSupportedVideoMimeType(const nsACString& aMimeType)
 {
  return (aMimeType.EqualsLiteral("video/mp4") ||
+          aMimeType.EqualsLiteral("video/mp4v-es") ||
          aMimeType.EqualsLiteral("video/avc") ||
          aMimeType.EqualsLiteral("video/x-vnd.on2.vp6")) &&
         mPlatform->SupportsMimeType(aMimeType);
--- a/dom/media/fmp4/eme/EMEDecoderModule.cpp
+++ b/dom/media/fmp4/eme/EMEDecoderModule.cpp
@ -241,7 +241,7 @@ EMEDecoderModule::CreateVideoDecoder(const VideoInfo& aConfig,
  nsRefPtr<MediaDataDecoder> emeDecoder(new EMEDecryptor(decoder,
                                                         aCallback,
                                                         mProxy,
-                                                         static_cast<MediaTaskQueue*>(AbstractThread::GetCurrent())));
+                                                         AbstractThread::GetCurrent()->AsTaskQueue()));
  return emeDecoder.forget();
 }

@ -272,7 +272,7 @@ EMEDecoderModule::CreateAudioDecoder(const AudioInfo& aConfig,
  nsRefPtr<MediaDataDecoder> emeDecoder(new EMEDecryptor(decoder,
                                                         aCallback,
                                                         mProxy,
-                                                         static_cast<MediaTaskQueue*>(AbstractThread::GetCurrent())));
+                                                         AbstractThread::GetCurrent()->AsTaskQueue()));
  return emeDecoder.forget();
 }

--- a/dom/media/fmp4/eme/EMEDecoderModule.h
+++ b/dom/media/fmp4/eme/EMEDecoderModule.h
@ -13,7 +13,6 @@
 namespace mozilla {

 class CDMProxy;
-class FlushableMediaTaskQueue;

 class EMEDecoderModule : public PlatformDecoderModule {
 private:
@ -48,7 +47,7 @@ private:
  // Will be null if CDM has decoding capability.
  nsRefPtr<PlatformDecoderModule> mPDM;
  // We run the PDM on its own task queue.
-  nsRefPtr<FlushableMediaTaskQueue> mTaskQueue;
+  nsRefPtr<MediaTaskQueue> mTaskQueue;
  bool mCDMDecodesAudio;
  bool mCDMDecodesVideo;

--- a/dom/media/fmp4/gonk/GonkDecoderModule.cpp
+++ b/dom/media/fmp4/gonk/GonkDecoderModule.cpp
@ -61,4 +61,12 @@ GonkDecoderModule::DecoderNeedsConversion(const TrackInfo& aConfig) const
  }
 }

+bool
+GonkDecoderModule::SupportsMimeType(const nsACString& aMimeType)
+{
+  return aMimeType.EqualsLiteral("audio/mp4a-latm") ||
+    aMimeType.EqualsLiteral("video/mp4") ||
+    aMimeType.EqualsLiteral("video/mp4v-es") ||
+    aMimeType.EqualsLiteral("video/avc");
+}
 } // namespace mozilla
--- a/dom/media/fmp4/gonk/GonkDecoderModule.h
+++ b/dom/media/fmp4/gonk/GonkDecoderModule.h
@ -34,6 +34,9 @@ public:

  virtual ConversionRequired
  DecoderNeedsConversion(const TrackInfo& aConfig) const override;
+
+  virtual bool SupportsMimeType(const nsACString& aMimeType) override;
+
 };

 } // namespace mozilla
--- a/dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp
+++ b/dom/media/fmp4/gonk/GonkMediaDataDecoder.cpp
@ -175,7 +175,7 @@ GonkMediaDataDecoder::ProcessDecode(MediaRawData* aSample)
 {
  nsresult rv = mManager->Input(aSample);
  if (rv != NS_OK) {
-    NS_WARNING("GonkAudioDecoder failed to input data");
+    NS_WARNING("GonkMediaDataDecoder failed to input data");
    GMDD_LOG("Failed to input data err: %d",int(rv));
    mCallback->Error();
    return;
--- a/dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp
+++ b/dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp
@ -57,12 +57,14 @@ GonkVideoDecoderManager::GonkVideoDecoderManager(
  NS_ASSERTION(!NS_IsMainThread(), "Should not be on main thread.");
  MOZ_ASSERT(mImageContainer);
  MOZ_COUNT_CTOR(GonkVideoDecoderManager);
+  mMimeType = aConfig.mMimeType;
  mVideoWidth  = aConfig.mDisplay.width;
  mVideoHeight = aConfig.mDisplay.height;
  mDisplayWidth = aConfig.mDisplay.width;
  mDisplayHeight = aConfig.mDisplay.height;
  mInfo.mVideo = aConfig;

+  mCodecSpecificData = aConfig.mCodecSpecificConfig;
  nsIntRect pictureRect(0, 0, mVideoWidth, mVideoHeight);
  nsIntSize frameSize(mVideoWidth, mVideoHeight);
  mPicture = pictureRect;
@ -105,9 +107,8 @@ GonkVideoDecoderManager::Init(MediaDataDecoderCallback* aCallback)
  if (mLooper->start() != OK || mManagerLooper->start() != OK ) {
    return nullptr;
  }
-  mDecoder = MediaCodecProxy::CreateByType(mLooper, "video/avc", false, mVideoListener);
+  mDecoder = MediaCodecProxy::CreateByType(mLooper, mMimeType.get(), false, mVideoListener);
  mDecoder->AskMediaCodecAndWait();
-
  uint32_t capability = MediaCodecProxy::kEmptyCapability;
  if (mDecoder->getCapability(&capability) == OK && (capability &
      MediaCodecProxy::kCanExposeGraphicBuffer)) {
@ -390,10 +391,12 @@ GonkVideoDecoderManager::Output(int64_t aStreamOffset,
      if (mDecoder->UpdateOutputBuffers()) {
        return Output(aStreamOffset, aOutData);
      }
+      GVDM_LOG("Fails to update output buffers!");
      return NS_ERROR_FAILURE;
    }
    case -EAGAIN:
    {
+      GVDM_LOG("Need to try again!");
      return NS_ERROR_NOT_AVAILABLE;
    }
    case android::ERROR_END_OF_STREAM:
@ -493,7 +496,8 @@ GonkVideoDecoderManager::codecReserved()
  sp<Surface> surface;

  // Fixed values
-  format->setString("mime", "video/avc");
+  GVDM_LOG("Configure mime type: %s, widht:%d, height:%d", mMimeType.get(), mVideoWidth, mVideoHeight);
+  format->setString("mime", mMimeType.get());
  format->setInt32("width", mVideoWidth);
  format->setInt32("height", mVideoHeight);
  if (mNativeWindow != nullptr) {
@ -501,6 +505,12 @@ GonkVideoDecoderManager::codecReserved()
  }
  mDecoder->configure(format, surface, nullptr, 0);
  mDecoder->Prepare();
+  status_t rv = mDecoder->Input(mCodecSpecificData->Elements(), mCodecSpecificData->Length(), 0,
+                                android::MediaCodec::BUFFER_FLAG_CODECCONFIG);
+  if (rv != OK) {
+    GVDM_LOG("Failed to configure codec!!!!");
+    mReaderCallback->Error();
+  }
 }

 void
--- a/dom/media/fmp4/gonk/GonkVideoDecoderManager.h
+++ b/dom/media/fmp4/gonk/GonkVideoDecoderManager.h
@ -147,6 +147,7 @@ private:

  android::MediaBuffer* mVideoBuffer;

+  nsRefPtr<MediaByteBuffer>  mCodecSpecificData;
  MediaDataDecoderCallback*  mReaderCallback;
  MediaInfo mInfo;
  android::sp<VideoResourceListener> mVideoListener;
@ -176,6 +177,8 @@ private:
  Vector<android::MediaBuffer*> mPendingVideoBuffers;
  // The lock protects mPendingVideoBuffers.
  Mutex mPendingVideoBuffersLock;
+
+  nsAutoCString mMimeType;
 };

 } // namespace mozilla
--- a/dom/tests/mochitest/bugs/test_bug61098.html
+++ b/dom/tests/mochitest/bugs/test_bug61098.html
@ -21,7 +21,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=61098
 <script class="testbody" type="text/javascript">
 /** Test for Bug 61098 **/

-SimpleTest.expectAssertions(8);
 SimpleTest.waitForExplicitFinish();

 var mockPromptServiceRegisterer, mockPromptFactoryRegisterer;
--- a/editor/libeditor/crashtests/1128787.html
+++ b/editor/libeditor/crashtests/1128787.html
@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1128787</title>
+</head>
+<body>
+  <input type="button"/>
+  <script>
+    window.onload = function () {
+        document.designMode = "on";
+    }
+    var input = document.getElementsByTagName("input")[0];
+    input.focus();
+    input.type = "text";
+  </script>
+</body>
+</html>
--- a/editor/libeditor/crashtests/crashtests.list
+++ b/editor/libeditor/crashtests/crashtests.list
@ -59,4 +59,5 @@ load 772282.html
 load 776323.html
 needs-focus load 793866.html
 load 1057677.html
+needs-focus load 1128787.html
 load 1134545.html
--- a/embedding/components/webbrowserpersist/nsWebBrowserPersist.cpp
+++ b/embedding/components/webbrowserpersist/nsWebBrowserPersist.cpp
@ -2087,7 +2087,8 @@ nsWebBrowserPersist::MakeFilenameFromURI(nsIURI *aURI, nsString &aFilename)
        if (mPersistFlags & PERSIST_FLAGS_DONT_CHANGE_FILENAMES)
        {
            fileName.AssignWithConversion(NS_UnescapeURL(nameFromURL).get());
-            goto end;
+            aFilename = fileName;
+            return NS_OK;
        }
        if (!nameFromURL.IsEmpty())
        {
@ -2127,7 +2128,6 @@ nsWebBrowserPersist::MakeFilenameFromURI(nsIURI *aURI, nsString &aFilename)
        fileName.Append(char16_t('a')); // 'a' is for arbitrary
    }

-end:
    aFilename = fileName;
    return NS_OK;
 }
--- a/gfx/2d/BaseMargin.h
+++ b/gfx/2d/BaseMargin.h
@ -89,11 +89,11 @@ struct BaseMargin {

  T& Side(SideT aSide) {
    // This is ugly!
-    return *(&top + T(aSide));
+    return *(&top + int(aSide));
  }
  T Side(SideT aSide) const {
    // This is ugly!
-    return *(&top + T(aSide));
+    return *(&top + int(aSide));
  }

  void ApplySkipSides(Sides aSkipSides)
--- a/gfx/layers/RotatedBuffer.cpp
+++ b/gfx/layers/RotatedBuffer.cpp
@ -650,7 +650,7 @@ RotatedContentBuffer::BeginPaint(PaintedLayer* aLayer,
                         &destDTBuffer, &destDTBufferOnWhite);
            if (!destDTBuffer ||
                (!destDTBufferOnWhite && (bufferFlags & BUFFER_COMPONENT_ALPHA))) {
-              gfxCriticalError() << "Failed 1 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
+              gfxCriticalError(CriticalLog::DefaultOptions(Factory::ReasonableSurfaceSize(IntSize(destBufferRect.width, destBufferRect.height)))) << "Failed 1 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
              return result;
            }
          }
@ -672,7 +672,7 @@ RotatedContentBuffer::BeginPaint(PaintedLayer* aLayer,
                 &destDTBuffer, &destDTBufferOnWhite);
    if (!destDTBuffer ||
        (!destDTBufferOnWhite && (bufferFlags & BUFFER_COMPONENT_ALPHA))) {
-      gfxCriticalError() << "Failed 2 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
+      gfxCriticalError(CriticalLog::DefaultOptions(Factory::ReasonableSurfaceSize(IntSize(destBufferRect.width, destBufferRect.height)))) << "Failed 2 buffer db=" << hexa(destDTBuffer.get()) << " dw=" << hexa(destDTBufferOnWhite.get()) << " for " << destBufferRect.x << ", " << destBufferRect.y << ", " << destBufferRect.width << ", " << destBufferRect.height;
      return result;
    }
  }
@ -753,9 +753,8 @@ RotatedContentBuffer::BorrowDrawTargetForPainting(PaintState& aPaintState,
  if (aPaintState.mMode == SurfaceMode::SURFACE_COMPONENT_ALPHA) {
    if (!mDTBuffer || !mDTBufferOnWhite) {
      // This can happen in release builds if allocating one of the two buffers
-      // failed. This is pretty bad and the reason for the failure is already
-      // reported through gfxCriticalError.
-      MOZ_ASSERT(false);
+      // failed. This in turn can happen if unreasonably large textures are
+      // requested.
      return nullptr;
    }
    nsIntRegionRectIterator iter(*drawPtr);
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@ -1648,6 +1648,8 @@ public:
  virtual bool SetTestSampleTime(LayerTransactionParent* aLayerTree,
                                 const TimeStamp& aTime) override;
  virtual void LeaveTestMode(LayerTransactionParent* aLayerTree) override;
+  virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree)
+               override;
  virtual void GetAPZTestData(const LayerTransactionParent* aLayerTree,
                              APZTestData* aOutData) override;
  virtual void SetConfirmedTargetAPZC(const LayerTransactionParent* aLayerTree,
@ -2025,6 +2027,22 @@ CrossProcessCompositorParent::LeaveTestMode(LayerTransactionParent* aLayerTree)
  state->mParent->LeaveTestMode(aLayerTree);
 }

+void
+CrossProcessCompositorParent::ApplyAsyncProperties(
+    LayerTransactionParent* aLayerTree)
+{
+  uint64_t id = aLayerTree->GetId();
+  MOZ_ASSERT(id != 0);
+  const CompositorParent::LayerTreeState* state =
+    CompositorParent::GetIndirectShadowTree(id);
+  if (!state) {
+    return;
+  }
+
+  MOZ_ASSERT(state->mParent);
+  state->mParent->ApplyAsyncProperties(aLayerTree);
+}
+
 void
 CrossProcessCompositorParent::GetAPZTestData(const LayerTransactionParent* aLayerTree,
                                             APZTestData* aOutData)
--- a/gfx/layers/ipc/ShadowLayersManager.h
+++ b/gfx/layers/ipc/ShadowLayersManager.h
@ -35,7 +35,7 @@ public:
    virtual bool SetTestSampleTime(LayerTransactionParent* aLayerTree,
                                   const TimeStamp& aTime) { return true; }
    virtual void LeaveTestMode(LayerTransactionParent* aLayerTree) { }
-    virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree) { }
+    virtual void ApplyAsyncProperties(LayerTransactionParent* aLayerTree) = 0;
    virtual void GetAPZTestData(const LayerTransactionParent* aLayerTree,
                                APZTestData* aOutData) { }
    virtual void SetConfirmedTargetAPZC(const LayerTransactionParent* aLayerTree,
--- a/gfx/src/nsFont.cpp
+++ b/gfx/src/nsFont.cpp
@ -49,7 +49,7 @@ nsFont::Init()
 {
  systemFont = false;
  smoothing = NS_FONT_SMOOTHING_AUTO;
-  sizeAdjust = 0.0;
+  sizeAdjust = -1.0f;
  kerning = NS_FONT_KERNING_AUTO;
  synthesis = NS_FONT_SYNTHESIS_WEIGHT | NS_FONT_SYNTHESIS_STYLE;

--- a/gfx/src/nsFont.h
+++ b/gfx/src/nsFont.h
@ -92,8 +92,8 @@ struct NS_GFX nsFont {

  // The aspect-value (ie., the ratio actualsize:actualxheight) that any
  // actual physical font created from this font structure must have when
-  // rendering or measuring a string. A value of 0 means no adjustment
-  // needs to be done.
+  // rendering or measuring a string. A value of -1.0 means no adjustment
+  // needs to be done; otherwise the value must be nonnegative.
  float sizeAdjust;

  // -- list of value tags for font-specific alternate features
--- a/gfx/thebes/gfxDWriteFonts.cpp
+++ b/gfx/thebes/gfxDWriteFonts.cpp
@ -162,7 +162,7 @@ gfxDWriteFont::ComputeMetrics(AntialiasOption anAAOption)
        mFontFace->GetMetrics(&fontMetrics);
    }

-    if (mStyle.sizeAdjust != 0.0) {
+    if (mStyle.sizeAdjust >= 0.0) {
        gfxFloat aspect = (gfxFloat)fontMetrics.xHeight /
                   fontMetrics.designUnitsPerEm;
        mAdjustedSize = mStyle.GetAdjustedSize(aspect);
--- a/gfx/thebes/gfxFT2FontBase.cpp
+++ b/gfx/thebes/gfxFT2FontBase.cpp
@ -114,7 +114,8 @@ gfxFT2FontBase::GetHorizontalMetrics()
    if (mHasMetrics)
        return mMetrics;

-    if (MOZ_UNLIKELY(GetStyle()->size <= 0.0)) {
+    if (MOZ_UNLIKELY(GetStyle()->size <= 0.0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0)) {
        new(&mMetrics) gfxFont::Metrics(); // zero initialize
        mSpaceGlyph = GetGlyph(' ');
    } else {
--- a/gfx/thebes/gfxFont.cpp
+++ b/gfx/thebes/gfxFont.cpp
@ -2201,6 +2201,7 @@ gfxFont::Measure(gfxTextRun *aTextRun,
        ((aBoundingBoxType == LOOSE_INK_EXTENTS &&
            !needsGlyphExtents &&
            !aTextRun->HasDetailedGlyphs()) ||
+         (MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0)) ||
         (MOZ_UNLIKELY(GetStyle()->size == 0))) ? nullptr
        : GetOrCreateGlyphExtents(aTextRun->GetAppUnitsPerDevUnit());
    double x = 0;
@ -3332,7 +3333,7 @@ gfxFont::SanitizeMetrics(gfxFont::Metrics *aMetrics, bool aIsBadUnderlineFont)
 {
    // Even if this font size is zero, this font is created with non-zero size.
    // However, for layout and others, we should return the metrics of zero size font.
-    if (mStyle.size == 0.0) {
+    if (mStyle.size == 0.0 || mStyle.sizeAdjust == 0.0) {
        memset(aMetrics, 0, sizeof(gfxFont::Metrics));
        return;
    }
@ -3652,7 +3653,7 @@ gfxFontStyle::ParseFontLanguageOverride(const nsString& aLangTag)

 gfxFontStyle::gfxFontStyle() :
    language(nsGkAtoms::x_western),
-    size(DEFAULT_PIXEL_FONT_SIZE), sizeAdjust(0.0f), baselineOffset(0.0f),
+    size(DEFAULT_PIXEL_FONT_SIZE), sizeAdjust(-1.0f), baselineOffset(0.0f),
    languageOverride(NO_FONT_LANGUAGE_OVERRIDE),
    weight(NS_FONT_WEIGHT_NORMAL), stretch(NS_FONT_STRETCH_NORMAL),
    systemFont(true), printerFont(false), useGrayscaleAntialiasing(false),
@ -3697,7 +3698,7 @@ gfxFontStyle::gfxFontStyle(uint8_t aStyle, uint16_t aWeight, int16_t aStretch,

    if (size >= FONT_MAX_SIZE) {
        size = FONT_MAX_SIZE;
-        sizeAdjust = 0.0;
+        sizeAdjust = -1.0f;
    } else if (size < 0.0) {
        NS_WARNING("negative font size");
        size = 0.0;
--- a/gfx/thebes/gfxFont.h
+++ b/gfx/thebes/gfxFont.h
@ -103,8 +103,8 @@ struct gfxFontStyle {

    // The aspect-value (ie., the ratio actualsize:actualxheight) that any
    // actual physical font created from this font structure must have when
-    // rendering or measuring a string. A value of 0 means no adjustment
-    // needs to be done.
+    // rendering or measuring a string. A value of -1.0 means no adjustment
+    // needs to be done; otherwise the value must be nonnegative.
    float sizeAdjust;

    // baseline offset, used when simulating sub/superscript glyphs
@ -162,9 +162,9 @@ struct gfxFontStyle {
    uint8_t variantSubSuper;

    // Return the final adjusted font size for the given aspect ratio.
-    // Not meant to be called when sizeAdjust = 0.
+    // Not meant to be called when sizeAdjust = -1.0.
    gfxFloat GetAdjustedSize(gfxFloat aspect) const {
-        NS_ASSERTION(sizeAdjust != 0.0, "Not meant to be called when sizeAdjust = 0");
+        NS_ASSERTION(sizeAdjust >= 0.0, "Not meant to be called when sizeAdjust = -1.0");
        gfxFloat adjustedSize = std::max(NS_round(size*(sizeAdjust/aspect)), 1.0);
        return std::min(adjustedSize, FONT_MAX_SIZE);
    }
@ -1387,7 +1387,9 @@ public:
    }

    virtual gfxFloat GetAdjustedSize() const {
-        return mAdjustedSize > 0.0 ? mAdjustedSize : mStyle.size;
+        return mAdjustedSize > 0.0
+                 ? mAdjustedSize
+                 : (mStyle.sizeAdjust == 0.0 ? 0.0 : mStyle.size);
    }

    float FUnitsToDevUnitsFactor() const {
--- a/gfx/thebes/gfxGDIFont.cpp
+++ b/gfx/thebes/gfxGDIFont.cpp
@ -194,7 +194,7 @@ gfxGDIFont::Initialize()

    if (mAdjustedSize == 0.0) {
        mAdjustedSize = mStyle.size;
-        if (mStyle.sizeAdjust != 0.0 && mAdjustedSize > 0.0) {
+        if (mStyle.sizeAdjust > 0.0 && mAdjustedSize > 0.0) {
            // to implement font-size-adjust, we first create the "unadjusted" font
            FillLogFont(logFont, mAdjustedSize,
                        wantFakeItalic && !useCairoFakeItalic);
@ -213,6 +213,8 @@ gfxGDIFont::Initialize()
            mFont = nullptr;
            delete mMetrics;
            mMetrics = nullptr;
+        } else if (mStyle.sizeAdjust == 0.0) {
+            mAdjustedSize = 0.0;
        }
    }

--- a/gfx/thebes/gfxMacFont.cpp
+++ b/gfx/thebes/gfxMacFont.cpp
@ -254,7 +254,7 @@ gfxMacFont::InitMetrics()
        mMetrics.xHeight = ::CGFontGetXHeight(mCGFont) * cgConvFactor;
    }

-    if (mStyle.sizeAdjust != 0.0 && mStyle.size > 0.0 &&
+    if (mStyle.sizeAdjust > 0.0 && mStyle.size > 0.0 &&
        mMetrics.xHeight > 0.0) {
        // apply font-size-adjust, and recalculate metrics
        gfxFloat aspect = mMetrics.xHeight / mStyle.size;
--- a/gfx/thebes/gfxPangoFonts.cpp
+++ b/gfx/thebes/gfxPangoFonts.cpp
@ -1853,7 +1853,7 @@ gfxPangoFontGroup::GetBaseFontSet()
        MakeFontSet(mPangoLanguage, mSizeAdjustFactor, &pattern);

    double size = GetPixelSize(pattern);
-    if (size != 0.0 && mStyle.sizeAdjust != 0.0) {
+    if (size != 0.0 && mStyle.sizeAdjust > 0.0) {
        gfxFcFont *font = fontSet->GetFontAt(0, GetStyle());
        if (font) {
            const gfxFont::Metrics& metrics =
--- a/gfx/thebes/gfxTextRun.cpp
+++ b/gfx/thebes/gfxTextRun.cpp
@ -1358,7 +1358,8 @@ gfxTextRun::FetchGlyphExtents(gfxContext *aRefContext)
    for (i = 0; i < runCount; ++i) {
        const GlyphRun& run = mGlyphRuns[i];
        gfxFont *font = run.mFont;
-        if (MOZ_UNLIKELY(font->GetStyle()->size == 0)) {
+        if (MOZ_UNLIKELY(font->GetStyle()->size == 0) ||
+            MOZ_UNLIKELY(font->GetStyle()->sizeAdjust == 0.0f)) {
            continue;
        }

@ -2007,7 +2008,8 @@ gfxFontGroup::MakeSpaceTextRun(const Parameters *aParams, uint32_t aFlags)
    }

    gfxFont *font = GetFirstValidFont();
-    if (MOZ_UNLIKELY(GetStyle()->size == 0)) {
+    if (MOZ_UNLIKELY(GetStyle()->size == 0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0f)) {
        // Short-circuit for size-0 fonts, as Windows and ATSUI can't handle
        // them, and always create at least size 1 fonts, i.e. they still
        // render something for size 0 fonts.
@ -2106,7 +2108,8 @@ gfxFontGroup::MakeTextRun(const uint8_t *aString, uint32_t aLength,

    aFlags |= TEXT_IS_8BIT;

-    if (GetStyle()->size == 0) {
+    if (MOZ_UNLIKELY(GetStyle()->size == 0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0f)) {
        // Short-circuit for size-0 fonts, as Windows and ATSUI can't handle
        // them, and always create at least size 1 fonts, i.e. they still
        // render something for size 0 fonts.
@ -2137,7 +2140,8 @@ gfxFontGroup::MakeTextRun(const char16_t *aString, uint32_t aLength,
    if (aLength == 1 && aString[0] == ' ') {
        return MakeSpaceTextRun(aParams, aFlags);
    }
-    if (GetStyle()->size == 0) {
+    if (MOZ_UNLIKELY(GetStyle()->size == 0) ||
+        MOZ_UNLIKELY(GetStyle()->sizeAdjust == 0.0f)) {
        return MakeBlankTextRun(aLength, aParams, aFlags);
    }

--- a/ipc/glue/MessageChannel.cpp
+++ b/ipc/glue/MessageChannel.cpp
@ -522,7 +522,7 @@ MessageChannel::Echo(Message* aMsg)
    MonitorAutoLock lock(*mMonitor);

    if (!Connected()) {
-        ReportConnectionError("MessageChannel");
+        ReportConnectionError("MessageChannel", msg);
        return false;
    }

@ -545,7 +545,7 @@ MessageChannel::Send(Message* aMsg)

    MonitorAutoLock lock(*mMonitor);
    if (!Connected()) {
-        ReportConnectionError("MessageChannel");
+        ReportConnectionError("MessageChannel", msg);
        return false;
    }
    mLink->SendMessage(msg.forget());
@ -778,7 +778,7 @@ MessageChannel::Send(Message* aMsg, Message* aReply)
    nsAutoPtr<Message> msg(aMsg);

    if (!Connected()) {
-        ReportConnectionError("MessageChannel::SendAndWait");
+        ReportConnectionError("MessageChannel::SendAndWait", msg);
        return false;
    }

@ -871,7 +871,7 @@ MessageChannel::Call(Message* aMsg, Message* aReply)

    MonitorAutoLock lock(*mMonitor);
    if (!Connected()) {
-        ReportConnectionError("MessageChannel::Call");
+        ReportConnectionError("MessageChannel::Call", aMsg);
        return false;
    }

@ -1527,7 +1527,7 @@ MessageChannel::ReportMessageRouteError(const char* channelName) const
 }

 void
-MessageChannel::ReportConnectionError(const char* aChannelName) const
+MessageChannel::ReportConnectionError(const char* aChannelName, Message* aMsg) const
 {
    AssertWorkerThread();
    mMonitor->AssertCurrentThreadOwns();
@ -1554,7 +1554,16 @@ MessageChannel::ReportConnectionError(const char* aChannelName) const
        NS_RUNTIMEABORT("unreached");
    }

-    PrintErrorMessage(mSide, aChannelName, errorMsg);
+    if (aMsg) {
+        char reason[512];
+        PR_snprintf(reason, sizeof(reason),
+                    "(msgtype=0x%lX,name=%s) %s",
+                    aMsg->type(), aMsg->name(), errorMsg);
+
+        PrintErrorMessage(mSide, aChannelName, reason);
+    } else {
+        PrintErrorMessage(mSide, aChannelName, errorMsg);
+    }

    MonitorAutoUnlock unlock(*mMonitor);
    mListener->OnProcessingError(MsgDropped, errorMsg);
--- a/ipc/glue/MessageChannel.h
+++ b/ipc/glue/MessageChannel.h
@ -215,7 +215,7 @@ class MessageChannel : HasResultCodes

    void PostErrorNotifyTask();
    void OnNotifyMaybeChannelError();
-    void ReportConnectionError(const char* aChannelName) const;
+    void ReportConnectionError(const char* aChannelName, Message* aMsg = nullptr) const;
    void ReportMessageRouteError(const char* channelName) const;
    bool MaybeHandleError(Result code, const Message& aMsg, const char* channelName);

--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@ -1423,7 +1423,7 @@ DisplayName(JSContext* cx, unsigned argc, jsval* vp)
 }

 static JSObject*
-ShellObjectMetadataCallback(JSContext* cx)
+ShellObjectMetadataCallback(JSContext* cx, JSObject*)
 {
    RootedObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx));
    if (!obj)
--- a/js/src/doc/Debugger/Debugger.Memory.md
+++ b/js/src/doc/Debugger/Debugger.Memory.md
@ -198,14 +198,16 @@ Function Properties of the `Debugger.Memory.prototype` Object
    <pre class='language-js'><code>
    {
      "timestamp": <i>timestamp</i>,
-      "frame": <i>allocationSite</i>
+      "frame": <i>allocationSite</i>,
+      "class": <i>className</i>
    }
    </code></pre>

-    Here <i>timestamp</i> is the [timestamp][timestamps] of the allocation event and
-    <i>allocationSite</i> is an allocation site (as a
-    [captured stack][saved-frame]).  <i>allocationSite</i> is `null` for objects
-    allocated with no JavaScript frames on the stack.
+    Here <i>timestamp</i> is the [timestamp][timestamps] of the allocation
+    event, <i>allocationSite</i> is an allocation site (as a
+    [captured stack][saved-frame]), and <i>className</i> is the string name of
+    the allocated object's internal `[[Class]]` property.  <i>allocationSite</i>
+    is `null` for objects allocated with no JavaScript frames on the stack.

    When `trackingAllocationSites` is `false`, `drainAllocationsLog()` throws an
    `Error`.
--- a/js/src/jit-test/tests/debug/Memory-drainAllocationsLog-15.js
+++ b/js/src/jit-test/tests/debug/Memory-drainAllocationsLog-15.js
@ -0,0 +1,31 @@
+// Test drainAllocationsLog() and [[Class]] names.
+
+const root = newGlobal();
+const dbg = new Debugger();
+const wrappedRoot = dbg.addDebuggee(root)
+
+root.eval(
+  `
+  this.tests = [
+    { expected: "Object",    test: () => new Object    },
+    { expected: "Array",     test: () => []            },
+    { expected: "Date",      test: () => new Date      },
+    { expected: "RegExp",    test: () => /problems/    },
+    { expected: "Int8Array", test: () => new Int8Array },
+    { expected: "Promise",   test: makeFakePromise     },
+  ];
+  `
+);
+
+
+for (let { expected, test } of root.tests) {
+  print(expected);
+
+  dbg.memory.trackingAllocationSites = true;
+  test();
+  let allocs = dbg.memory.drainAllocationsLog();
+  dbg.memory.trackingAllocationSites = false;
+
+  assertEq(allocs.some(a => a.class === expected), true);
+}
+
--- a/js/src/jit/none/Architecture-none.h
+++ b/js/src/jit/none/Architecture-none.h
@ -25,7 +25,7 @@ class Registers
        r0 = 0,
        invalid_reg
    };
-    typedef RegisterID Code;
+    typedef uint8_t Code;
    typedef RegisterID Encoding;
    union RegisterContent {
        uintptr_t r;
@ -39,8 +39,8 @@ class Registers
    static const char* GetName(Code) { MOZ_CRASH(); }
    static Code FromName(const char*) { MOZ_CRASH(); }

-    static const Code StackPointer = invalid_reg;
-    static const Code Invalid = invalid_reg;
+    static const Encoding StackPointer = invalid_reg;
+    static const Encoding Invalid = invalid_reg;
    static const uint32_t Total = 1;
    static const uint32_t TotalPhys = 0;
    static const uint32_t Allocatable = 0;
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@ -713,7 +713,7 @@ JSCompartment::setNewObjectMetadata(JSContext* cx, JSObject* obj)
 {
    MOZ_ASSERT(this == cx->compartment());

-    if (JSObject* metadata = objectMetadataCallback(cx)) {
+    if (JSObject* metadata = objectMetadataCallback(cx, obj)) {
        if (!objectMetadataTable) {
            objectMetadataTable = cx->new_<ObjectWeakMap>(cx);
            if (!objectMetadataTable)
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@ -2622,7 +2622,7 @@ class JS_FRIEND_API(AutoCTypesActivityCallback) {
 };

 typedef JSObject*
-(* ObjectMetadataCallback)(JSContext* cx);
+(* ObjectMetadataCallback)(JSContext* cx, JSObject* obj);

 /*
 * Specify a callback to invoke when creating each JS object in the current
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@ -246,7 +246,8 @@ SetNewObjectMetadata(ExclusiveContext* cxArg, JSObject* obj)
            // callback, and any reentering of JS via Invoke() etc.
            AutoEnterAnalysis enter(cx);

-            cx->compartment()->setNewObjectMetadata(cx, obj);
+            RootedObject hobj(cx, obj);
+            cx->compartment()->setNewObjectMetadata(cx, hobj);
        }
    }
 }
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@ -1695,8 +1695,8 @@ Debugger::slowPathOnNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global)
 }

 /* static */ bool
-Debugger::slowPathOnLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when,
-                                      GlobalObject::DebuggerVector& dbgs)
+Debugger::slowPathOnLogAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
+                                      int64_t when, GlobalObject::DebuggerVector& dbgs)
 {
    MOZ_ASSERT(!dbgs.empty());
    mozilla::DebugOnly<Debugger**> begin = dbgs.begin();
@ -1708,7 +1708,7 @@ Debugger::slowPathOnLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int

        if ((*dbgp)->trackingAllocationSites &&
            (*dbgp)->enabled &&
-            !(*dbgp)->appendAllocationSite(cx, frame, when))
+            !(*dbgp)->appendAllocationSite(cx, obj, frame, when))
        {
            return false;
        }
@ -1725,14 +1725,15 @@ Debugger::isDebuggee(const JSCompartment* compartment) const
 }

 bool
-Debugger::appendAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when)
+Debugger::appendAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
+                               int64_t when)
 {
    AutoCompartment ac(cx, object);
-    RootedObject wrapped(cx, frame);
-    if (!cx->compartment()->wrap(cx, &wrapped))
+    RootedObject wrappedFrame(cx, frame);
+    if (!cx->compartment()->wrap(cx, &wrappedFrame))
        return false;

-    AllocationSite* allocSite = cx->new_<AllocationSite>(wrapped, when);
+    AllocationSite* allocSite = cx->new_<AllocationSite>(wrappedFrame, when, obj->getClass()->name);
    if (!allocSite)
        return false;

--- a/js/src/vm/Debugger.h
+++ b/js/src/vm/Debugger.h
@ -255,11 +255,17 @@ class Debugger : private mozilla::LinkedListElement<Debugger>

    struct AllocationSite : public mozilla::LinkedListElement<AllocationSite>
    {
-        AllocationSite(HandleObject frame, int64_t when) : frame(frame), when(when) {
+        AllocationSite(HandleObject frame, int64_t when, const char* className)
+            : frame(frame),
+              when(when),
+              className(className)
+        {
            MOZ_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>());
        };
+
        RelocatablePtrObject frame;
        int64_t when;
+        const char* className;
    };
    typedef mozilla::LinkedList<AllocationSite> AllocationSiteList;

@ -305,7 +311,8 @@ class Debugger : private mozilla::LinkedListElement<Debugger>

    static const size_t DEFAULT_MAX_ALLOCATIONS_LOG_LENGTH = 5000;

-    bool appendAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when);
+    bool appendAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
+                              int64_t when);
    void emptyAllocationsLog();

    /*
@ -515,7 +522,7 @@ class Debugger : private mozilla::LinkedListElement<Debugger>
    static JSTrapStatus slowPathOnExceptionUnwind(JSContext* cx, AbstractFramePtr frame);
    static void slowPathOnNewScript(JSContext* cx, HandleScript script);
    static void slowPathOnNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global);
-    static bool slowPathOnLogAllocationSite(JSContext* cx, HandleSavedFrame frame,
+    static bool slowPathOnLogAllocationSite(JSContext* cx, HandleObject obj, HandleSavedFrame frame,
                                            int64_t when, GlobalObject::DebuggerVector& dbgs);
    static void slowPathPromiseHook(JSContext* cx, Hook hook, HandleObject promise);
    static JSTrapStatus dispatchHook(JSContext* cx, MutableHandleValue vp, Hook which,
@ -666,7 +673,8 @@ class Debugger : private mozilla::LinkedListElement<Debugger>

    static inline void onNewScript(JSContext* cx, HandleScript script);
    static inline void onNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global);
-    static inline bool onLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when);
+    static inline bool onLogAllocationSite(JSContext* cx, JSObject* obj, HandleSavedFrame frame,
+                                           int64_t when);
    static inline void onGarbageCollection(JSRuntime* rt, const gcstats::Statistics& stats);
    static JSTrapStatus onTrap(JSContext* cx, MutableHandleValue vp);
    static JSTrapStatus onSingleStep(JSContext* cx, MutableHandleValue vp);
@ -975,12 +983,13 @@ Debugger::onNewGlobalObject(JSContext* cx, Handle<GlobalObject*> global)
 }

 /* static */ bool
-Debugger::onLogAllocationSite(JSContext* cx, HandleSavedFrame frame, int64_t when)
+Debugger::onLogAllocationSite(JSContext* cx, JSObject* obj, HandleSavedFrame frame, int64_t when)
 {
    GlobalObject::DebuggerVector* dbgs = cx->global()->getDebuggers();
    if (!dbgs || dbgs->empty())
        return true;
-    return Debugger::slowPathOnLogAllocationSite(cx, frame, when, *dbgs);
+    RootedObject hobj(cx, obj);
+    return Debugger::slowPathOnLogAllocationSite(cx, hobj, frame, when, *dbgs);
 }

 /* static */ void
--- a/js/src/vm/DebuggerMemory.cpp
+++ b/js/src/vm/DebuggerMemory.cpp
@ -209,6 +209,13 @@ DebuggerMemory::drainAllocationsLog(JSContext* cx, unsigned argc, Value* vp)
        if (!DefineProperty(cx, obj, cx->names().timestamp, timestampValue))
            return false;

+        RootedString className(cx, Atomize(cx, allocSite->className, strlen(allocSite->className)));
+        if (!className)
+            return false;
+        RootedValue classNameValue(cx, StringValue(className));
+        if (!DefineProperty(cx, obj, cx->names().class_, classNameValue))
+            return false;
+
        result->setDenseElement(i, ObjectValue(*obj));

        // Pop the front queue entry, and delete it immediately, so that
--- a/js/src/vm/SavedStacks.cpp
+++ b/js/src/vm/SavedStacks.cpp
@ -1180,8 +1180,10 @@ SavedStacks::chooseSamplingProbability(JSContext* cx)
 }

 JSObject*
-SavedStacksMetadataCallback(JSContext* cx)
+SavedStacksMetadataCallback(JSContext* cx, JSObject* target)
 {
+    RootedObject obj(cx, target);
+
    SavedStacks& stacks = cx->compartment()->savedStacks();
    if (stacks.allocationSkipCount > 0) {
        stacks.allocationSkipCount--;
@ -1221,7 +1223,7 @@ SavedStacksMetadataCallback(JSContext* cx)
    if (!stacks.saveCurrentStack(cx, &frame))
        CrashAtUnhandlableOOM("SavedStacksMetadataCallback");

-    if (!Debugger::onLogAllocationSite(cx, frame, PRMJ_Now()))
+    if (!Debugger::onLogAllocationSite(cx, obj, frame, PRMJ_Now()))
        CrashAtUnhandlableOOM("SavedStacksMetadataCallback");

    return frame;
--- a/js/src/vm/SavedStacks.h
+++ b/js/src/vm/SavedStacks.h
@ -260,7 +260,7 @@ struct SavedFrame::HashPolicy
 inline void AssertObjectIsSavedFrameOrWrapper(JSContext* cx, HandleObject stack);

 class SavedStacks {
-    friend JSObject* SavedStacksMetadataCallback(JSContext* cx);
+    friend JSObject* SavedStacksMetadataCallback(JSContext* cx, JSObject* target);

  public:
    SavedStacks()
@ -400,7 +400,7 @@ class SavedStacks {
    bool getLocation(JSContext* cx, const FrameIter& iter, MutableHandleLocationValue locationp);
 };

-JSObject* SavedStacksMetadataCallback(JSContext* cx);
+JSObject* SavedStacksMetadataCallback(JSContext* cx, JSObject* target);

 } /* namespace js */

--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@ -1760,7 +1760,7 @@ nsListControlFrame::GetIndexFromDOMEvent(nsIDOMEvent* aMouseEvent,
  return NS_ERROR_FAILURE;
 }

-static void
+static bool
 FireShowDropDownEvent(nsIContent* aContent)
 {
  if (XRE_GetProcessType() == GeckoProcessType_Content &&
@ -1768,7 +1768,10 @@ FireShowDropDownEvent(nsIContent* aContent)
    nsContentUtils::DispatchChromeEvent(aContent->OwnerDoc(), aContent,
                                        NS_LITERAL_STRING("mozshowdropdown"), true,
                                        false);
+    return true;
  }
+
+  return false;
 }

 nsresult
@ -1818,7 +1821,9 @@ nsListControlFrame::MouseDown(nsIDOMEvent* aMouseEvent)
  } else {
    // NOTE: the combo box is responsible for dropping it down
    if (mComboboxFrame) {
-      FireShowDropDownEvent(mContent);
+      if (FireShowDropDownEvent(mContent)) {
+        return NS_OK;
+      }

      if (!IgnoreMouseEventForSelection(aMouseEvent)) {
        return NS_OK;
@ -2059,8 +2064,9 @@ nsListControlFrame::DropDownToggleKey(nsIDOMEvent* aKeyEvent)
  if (IsInDropDownMode() && !nsComboboxControlFrame::ToolkitHasNativePopup()) {
    aKeyEvent->PreventDefault();
    if (!mComboboxFrame->IsDroppedDown()) {
-      FireShowDropDownEvent(mContent);
-      mComboboxFrame->ShowDropDown(true);
+      if (!FireShowDropDownEvent(mContent)) {
+        mComboboxFrame->ShowDropDown(true);
+      }
    } else {
      nsWeakFrame weakFrame(this);
      // mEndSelectionIndex is the last item that got selected.
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@ -395,7 +395,7 @@ nsHTMLScrollFrame::TryLayout(ScrollReflowState* aState,
  aState->mShowVScrollbar = aAssumeVScroll;
  nsPoint scrollPortOrigin(aState->mComputedBorder.left,
                           aState->mComputedBorder.top);
-  if (!mHelper.IsScrollbarOnRight()) {
+  if (mHelper.GetScrollbarSide() == ScrollFrameHelper::eScrollbarOnLeft) {
    scrollPortOrigin.x += vScrollbarActualWidth;
  }
  mHelper.mScrollPort = nsRect(scrollPortOrigin, scrollPortSize);
@ -1009,7 +1009,7 @@ ScrollFrameHelper::GetDesiredScrollbarSizes(nsBoxLayoutState* aState)
  if (mVScrollbarBox) {
    nsSize size = mVScrollbarBox->GetPrefSize(*aState);
    nsBox::AddMargin(mVScrollbarBox, size);
-    if (IsScrollbarOnRight())
+    if (GetScrollbarSide() == eScrollbarOnRight)
      result.left = size.width;
    else
      result.right = size.width;
@ -3766,7 +3766,7 @@ ScrollFrameHelper::CreateAnonymousContent(
    nsAutoString dir;
    switch (resizeStyle) {
      case NS_STYLE_RESIZE_HORIZONTAL:
-        if (IsScrollbarOnRight()) {
+        if (GetScrollbarSide() == eScrollbarOnRight) {
          dir.AssignLiteral("right");
        }
        else {
@ -4213,8 +4213,8 @@ ScrollFrameHelper::IsLTR() const
  return wm.IsVertical() ? wm.IsVerticalLR() : wm.IsBidiLTR();
 }

-bool
-ScrollFrameHelper::IsScrollbarOnRight() const
+ScrollFrameHelper::eScrollbarSide
+ScrollFrameHelper::GetScrollbarSide() const
 {
  nsPresContext *presContext = mOuter->PresContext();

@ -4222,18 +4222,19 @@ ScrollFrameHelper::IsScrollbarOnRight() const
  // layout.scrollbar.side. For non-top-level elements, it depends only on the
  // directionaliy of the element (equivalent to a value of "1" for the pref).
  if (!mIsRoot)
-    return IsLTR();
+    return IsLTR() ? eScrollbarOnRight : eScrollbarOnLeft;
  switch (presContext->GetCachedIntPref(kPresContext_ScrollbarSide)) {
    default:
    case 0: // UI directionality
-      return presContext->GetCachedIntPref(kPresContext_BidiDirection)
-             == IBMBIDI_TEXTDIRECTION_LTR;
+      return (presContext->GetCachedIntPref(kPresContext_BidiDirection)
+              == IBMBIDI_TEXTDIRECTION_LTR)
+        ? eScrollbarOnRight : eScrollbarOnLeft;
    case 1: // Document / content directionality
-      return IsLTR();
+      return IsLTR() ? eScrollbarOnRight : eScrollbarOnLeft;
    case 2: // Always right
-      return true;
+      return eScrollbarOnRight;
    case 3: // Always left
-      return false;
+      return eScrollbarOnLeft;
  }
 }

@ -4271,7 +4272,8 @@ ScrollFrameHelper::IsScrollingActive(nsDisplayListBuilder* aBuilder) const
 nsresult
 nsXULScrollFrame::Layout(nsBoxLayoutState& aState)
 {
-  bool scrollbarRight = mHelper.IsScrollbarOnRight();
+  bool scrollbarRight =
+    (mHelper.GetScrollbarSide() == ScrollFrameHelper::eScrollbarOnRight);
  bool scrollbarBottom = true;

  // get the content rect
@ -4738,7 +4740,7 @@ ScrollFrameHelper::LayoutScrollbars(nsBoxLayoutState& aState,
               "This should have been suppressed");

  bool hasResizer = HasResizer();
-  bool scrollbarOnLeft = !IsScrollbarOnRight();
+  bool scrollbarOnLeft = (GetScrollbarSide() == eScrollbarOnLeft);

  // place the scrollcorner
  if (mScrollCornerBox || mResizerBox) {
@ -4804,9 +4806,14 @@ ScrollFrameHelper::LayoutScrollbars(nsBoxLayoutState& aState,
    vRect.width = aContentArea.width - mScrollPort.width;
    vRect.x = scrollbarOnLeft ? aContentArea.x : mScrollPort.XMost();
    if (mHasVerticalScrollbar) {
-      nsMargin margin;
-      mVScrollbarBox->GetMargin(margin);
-      vRect.Deflate(margin);
+      nsScrollbarFrame* scrollbar = do_QueryFrame(mVScrollbarBox);
+      NS_ASSERTION(scrollbar, "Frame must be a scrollbar");
+
+      if (scrollbar) {
+        nsMargin margin;
+        scrollbar->GetScrollbarMargin(margin, GetScrollbarSide());
+        vRect.Deflate(margin);
+      }
    }
    AdjustScrollbarRectForResizer(mOuter, presContext, vRect, hasResizer, true);
  }
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@ -307,7 +307,8 @@ public:
  nsMargin GetDesiredScrollbarSizes(nsBoxLayoutState* aState);
  nscoord GetNondisappearingScrollbarWidth(nsBoxLayoutState* aState);
  bool IsLTR() const;
-  bool IsScrollbarOnRight() const;
+  enum eScrollbarSide { eScrollbarOnLeft, eScrollbarOnRight };
+  eScrollbarSide GetScrollbarSide() const;
  bool IsScrollingActive(nsDisplayListBuilder* aBuilder) const;
  bool IsMaybeScrollingActive() const;
  bool IsProcessingAsyncScroll() const {
--- a/layout/moz.build
+++ b/layout/moz.build
@ -19,6 +19,7 @@ DIRS += [
    'mathml',
    'inspector',
    'tools/recording',
+    'reftests',
 ]

 if CONFIG['NS_PRINTING']:
@ -33,11 +34,4 @@ DIRS += ['build', 'media']
 if CONFIG['MOZ_DEBUG']:
    TEST_DIRS += ['tools/layout-debug']

-MOCHITEST_MANIFESTS += [
-    'reftests/fonts/math/mochitest.ini',
-    'reftests/fonts/mochitest.ini',
-    'reftests/fonts/mplus/mochitest.ini'
-]
-
-REFTEST_MANIFESTS += ['reftests/reftest.list']
 CRASHTEST_MANIFESTS += ['../testing/crashtest/crashtests.list']
--- a/layout/reftests/moz.build
+++ b/layout/reftests/moz.build
@ -0,0 +1,274 @@
+# -*- Mode: python; c-basic-offset: 4; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+MOCHITEST_MANIFESTS += [
+    'fonts/math/mochitest.ini',
+    'fonts/mochitest.ini',
+    'fonts/mplus/mochitest.ini'
+]
+
+REFTEST_MANIFESTS += ['reftest.list']
+
+with Files('abs-pos/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('async-scrolling/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('backgrounds/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('bidi/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('border-image/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('border-radius/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('box/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('box-ordinal/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('box-properties/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('box-shadow/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('box-sizing/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('bugs/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('canvas/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('columns/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('counter-style/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('counters/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-animations/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-blending/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-break/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('css-calc/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-charset/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-default/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-disabled/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-display/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-enabled/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-gradients/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-grid/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('css-import/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-invalid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-mediaqueries/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-optional/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-parsing/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-placeholder/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-required/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-ruby/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('css-selectors/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-submit-invalid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-transitions/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-ui-invalid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-ui-valid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-valid/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('css-valuesandunits/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-variables/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('css-visited/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('cssom/**'):
+    BUG_COMPONENT = ('Core', 'DOM: CSS Object Model')
+with Files('datalist/**'):
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
+with Files('dom/**'):
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
+with Files('filters.svg'):
+    BUG_COMPONENT = ('Core', 'SVG')
+with Files('first-letter/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('first-line/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('flexbox/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('floats/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Floats')
+with Files('font-face/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('font-features/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('font-inflation/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('font-loading-api/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('font-matching/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('fonts/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('forms/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Form Controls')
+with Files('generated-content/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('ib-split/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('image/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('image-element/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('image-rect/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('image-region/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Images')
+with Files('indic-shaping/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('inline/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('inline-borderpadding/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('invalidation/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('layers/**'):
+    BUG_COMPONENT = ('Core', 'Graphics: Layers')
+with Files('line-breaking/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('list-item/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('margin-collapsing/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('marquee/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('mathml/**'):
+    BUG_COMPONENT = ('Core', 'MathML')
+with Files('native-theme/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('object/**'):
+    BUG_COMPONENT = ('Core', 'DOM')
+with Files('ogg-video/**'):
+    BUG_COMPONENT = ('Core', 'Video/Audio')
+with Files('outline/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('pagination/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('percent-overflow-sizing/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('pixel-rounding/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('position-dynamic-changes/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('position-relative/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('position-sticky/**'):
+    BUG_COMPONENT = ('Core', 'Layout: R & A Pos')
+with Files('printing/**'):
+    BUG_COMPONENT = ('Core', 'Printing: Output')
+with Files('reftest-sanity/**'):
+    BUG_COMPONENT = ('Testing', 'Reftest')
+with Files('scoped-style/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('scrolling/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('selection/**'):
+    BUG_COMPONENT = ('Core', 'Selection')
+with Files('svg/**'):
+    BUG_COMPONENT = ('Core', 'SVG')
+with Files('tab-size/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('table-anonymous-boxes/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-background/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-bordercollapse/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-dom/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-overflow/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('table-width/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Tables')
+with Files('text/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('text-decoration/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('text-indent/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('text-overflow/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('text-shadow/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('text-svgglyphs/**'):
+    BUG_COMPONENT = ('Core', 'SVG')
+with Files('text-transform/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('transform/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('transform-3d/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('unicode/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('view-source/**'):
+    BUG_COMPONENT = ('Core', 'HTML: Parser')
+with Files('w3c-css/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/received/css3-conditional/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/received/css3-namespace/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/submitted/conditional3/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/submitted/css21/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/flexbox/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/fonts3/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Text')
+with Files('w3c-css/submitted/images3/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/lists-3/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('w3c-css/submitted/multicol3/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/ruby/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('w3c-css/submitted/text-decor-3/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('w3c-css/submitted/ui3/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
+with Files('w3c-css/submitted/values3/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('w3c-css/submitted/variables/**'):
+    BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
+with Files('webcomponents/**'):
+    BUG_COMPONENT = ('Core', 'DOM')
+with Files('webm-video/**'):
+    BUG_COMPONENT = ('Core', 'Video/Audio')
+with Files('writing-mode/**'):
+    BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
+with Files('xul/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('xul-document-load/**'):
+    BUG_COMPONENT = ('Core', 'XP Toolkit/Widgets: XUL')
+with Files('z-index/**'):
+    BUG_COMPONENT = ('Core', 'Layout')
--- a/layout/reftests/table-overflow/reftest.list
+++ b/layout/reftests/table-overflow/reftest.list
@ -1,5 +1,5 @@
 == bug785684-x.html bug785684-ref.html
 == bug785684-y.html bug785684-ref.html
-== table-row-pagination.html table-row-pagination-ref.html
+skip-if(B2G||Mulet) == table-row-pagination.html table-row-pagination-ref.html # Frequently failing on b2g (bug 1155426)
 == 963441.html 963441-ref.html
 == table-caption-scroll.html table-caption-scroll-ref.html
--- a/layout/reftests/w3c-css/submitted/fonts3/font-size-adjust-zero-1.html
+++ b/layout/reftests/w3c-css/submitted/fonts3/font-size-adjust-zero-1.html
@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size-adjust: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-adjust-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-2-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+p.zero { font-size-adjust: 0 }
+</style>
+
+<p>before</p>
+<p class="zero">zero</p>
+<p>after</p>
--- a/layout/reftests/w3c-css/submitted/fonts3/font-size-adjust-zero-2.html
+++ b/layout/reftests/w3c-css/submitted/fonts3/font-size-adjust-zero-2.html
@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size-adjust: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-adjust-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-2-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+span { line-height: 0 }
+
+p { margin: 1em 0 }
+span.zero { font-size-adjust: 0 }
+</style>
+
+<p>before</p>
+<p><span class="zero">zero</span></p>
+<p>after</p>
--- a/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1-notref.html
+++ b/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1-notref.html
@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<title>CSS Test Reference</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+</style>
+
+<p>before</p>
+<p>zero</p>
+<p>after</p>
--- a/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1-ref.html
+++ b/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1-ref.html
@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<title>CSS Test Reference</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="mismatch" href="font-size-zero-1-notref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+p.first { margin-bottom: 2em }
+</style>
+
+<p class="first">before</p>
+<p>after</p>
--- a/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1.html
+++ b/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-1.html
@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-1-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+p.zero { font-size: 0 }
+</style>
+
+<p>before</p>
+<p class="zero">zero</p>
+<p>after</p>
--- a/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-2-ref.html
+++ b/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-2-ref.html
@ -0,0 +1,15 @@
+<!DOCTYPE HTML>
+<title>CSS Test Reference</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+</style>
+
+<p>before</p>
+<p>&nbsp;</p>
+<p>after</p>
--- a/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-2.html
+++ b/layout/reftests/w3c-css/submitted/fonts3/font-size-zero-2.html
@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<title>CSS Test: font-size: 0</title>
+<link rel="author" title="L. David Baron" href="http://dbaron.org/">
+<link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+<link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-size-prop">
+<link rel="help" href="http://www.w3.org/TR/CSS21/box.html#collapsing-margins">
+<link rel="match" href="font-size-zero-2-ref.html">
+<meta name="flags" content="">
+<style>
+/* spec ambiguous whether font-size-adjust influences line-height: normal */
+body { line-height: 1.2 }
+
+p { margin: 1em 0 }
+span.zero { font-size: 0 }
+</style>
+
+<p>before</p>
+<p><span class="zero">zero</span></p>
+<p>after</p>
--- a/layout/reftests/w3c-css/submitted/fonts3/reftest.list
+++ b/layout/reftests/w3c-css/submitted/fonts3/reftest.list
@ -0,0 +1,5 @@
+== font-size-zero-1.html font-size-zero-1-ref.html
+!= font-size-zero-1-ref.html font-size-zero-1-notref.html
+== font-size-zero-2.html font-size-zero-2-ref.html
+== font-size-adjust-zero-1.html font-size-zero-2-ref.html
+== font-size-adjust-zero-2.html font-size-zero-2-ref.html
--- a/layout/reftests/w3c-css/submitted/reftest.list
+++ b/layout/reftests/w3c-css/submitted/reftest.list
@ -23,7 +23,7 @@ include conditional3/reftest.list
 include flexbox/reftest.list

 # Fonts Level 3
-# include fonts3/reftest.list
+include fonts3/reftest.list

 # Image Values and Replaced Content Level 3
 include images3/reftest.list
--- a/layout/style/StyleAnimationValue.cpp
+++ b/layout/style/StyleAnimationValue.cpp
@ -3440,8 +3440,8 @@ StyleAnimationValue::ExtractComputedValue(nsCSSProperty aProperty,
      aComputedValue.SetFloatValue(*static_cast<const float*>(
        StyleDataAtOffset(styleStruct, ssOffset)));
      if (aProperty == eCSSProperty_font_size_adjust &&
-          aComputedValue.GetFloatValue() == 0.0f) {
-        // In nsStyleFont, we set mFont.sizeAdjust to 0 to represent
+          aComputedValue.GetFloatValue() == -1.0f) {
+        // In nsStyleFont, we set mFont.sizeAdjust to -1.0 to represent
        // font-size-adjust: none.  Here, we have to treat this as a keyword
        // instead of a float value, to make sure we don't end up doing
        // interpolation with it.
--- a/Show More
+++ b/Show More